Verification of Neural Networks’ Local Differential Classification Privacy
summary
Defines local differential classification privacy for black-box classifiers and builds Sphynx, an algorithm that predicts an interval-based abstract “hyper network” from a small subset of retrained models. Uses kernel density estimation (KDE) to turn weight samples into confidence intervals, extends a MILP local-robustness verifier to handle interval weights, and avoids training D+1 networks. Trains only 7% of networks, achieves 93% verification accuracy, and cuts analysis time by about 1.7·10^4× compared to the naive procedure.
AI-written summary · about
chapters (10)
- 0:00Local differential classification privacy
- 1:27Differential privacy in training
- 3:34Local differential classification privacy
- 6:11Sphinx analyzer and hypernetworks
- 9:08Hypernetwork intervals from samples
- 11:21Verifying LDCP on hypernetworks
- 13:31Evaluation on sensitive datasets
- 16:44Interval prediction effectiveness
- 18:52Conclusion and key results
- 19:37Q&A
related talks
59mDifferential Verification of Deep Neural Networks
14mGuarding the Privacy of Label-Only Access to Neural Network Classifiers via Formal(…)
33mPrivacy of Decentralized Machine Learning
16mVerification of Neural Networks' Global Robustness
53mPrivate Learning with Auxiliary Public Data
31mIs your model private?
43mDifferential Privacy Meets Robust Statistics
17mData privacy and reliable learning