tensorflow / tensorflow/privacy
DP accountant and composition
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2k
- Forks
- 477
- Avg merge
- 22h 12m
- Merged PRs (30d)
- 1
Description
Hi,
I read some of paper (both DP and RDP) such as [1,2], they mentioned that the composition of epsilon is O(\sqrt(T)) when all the iterations have the same epsilon (homogenous mechanisms). I think that in DPSGD, each iteration has the same epsilon. But the epsilon I got from compute_dp_sgd_privacy() didn't satisfy the O(\sqrt(T)) composition when I changed the number of epoches. I am wondering why the composition results and accountant results are not the same.
Thank you in advance!!!
[1]Abadi, Martin, et al. "Deep learning with differential privacy." Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 2016.
[2]Mironov, Ilya. "Rényi differential privacy." 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, 2017.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the compute_dp_sgd_privacy() entry point and reproduce the reported results while varying the number of epochs. Compare those results with the homogeneous-mechanism composition described in the cited DP and RDP papers. Done means explaining the discrepancy or identifying the accountant behavior that needs correction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- machine-learning, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100