aiqbench analysis
This research bridges a critical gap in differential privacy by extending hidden state threat model analyses from convex problems to two-layer ReLU networks. By converting the non-convex minimization of deep learning models into a strongly convex dual formulation, the authors enable rigorous privacy bounds for modern neural architectures that were previously inaccessible under standard assumptions. Empirical results confirm that this approach matches the utility-performance trade-offs of established DP-SGD methods while offering stronger theoretical guarantees against intermediate state leakage.
Convex Approximation of Two-Layer ReLU Networks for Hidden State Differential Privacy
arXiv:2407.04884v4 Announce Type: replace Abstract: The hidden state threat model of differential privacy (DP) assumes that the adversary has access only to the final trained machine learning (ML) model, without seeing intermediate states during training. However, the current privacy analyses under this model are restricted to convex optimization problems, reducing their applicability to multi-layer neural networks, which are essential in modern deep learning applications. Notably, the most successful applications of the hidden state privacy analyses in classification tasks have only been for logistic regression models. We demonstrate that it is possible to privately train convex problems with privacy-utility trade-offs comparable to those of 2-layer ReLU networks trained with DP stochastic gradient descent (DP-SGD). This is achieved through a stochastic approximation of a dual formulation of the ReLU minimization problem, resulting in a strongly convex problem. This enables the use of existing hidden state privacy analyses and provides accurate privacy bounds also for the noisy cyclic mini-batch gradient descent (NoisyCGD) method with fixed disjoint mini-batches. Empirical results on benchmark classification tasks demonstrate that NoisyCGD can achieve privacy-utility trade-offs on par with DP-SGD applied to 2-layer ReLU networks.
Abstract:The hidden state threat model of differential privacy (DP) assumes that the adversary has access only to the final trained machine learning (ML) model, without seeing intermediate states during training. However, the current privacy analyses under this model are restricted to convex optimization problems, reducing their applicability to multi-layer neural networks, which are essential in modern deep learning applications. Notably, the most successful applications of the hidden state privacy analyses in classification tasks have only been for logistic regression models. We demonstrate that it is possible to privately train convex problems with privacy-utility trade-offs comparable to those of 2-layer ReLU networks trained with DP stochastic gradient descent (DP-SGD). This is achieved through a stochastic approximation of a dual formulation of the ReLU minimization problem, resulting in a strongly convex problem. This enables the use of existing hidden state privacy analyses and provides accurate privacy bounds also for the noisy cyclic mini-batch gradient descent (NoisyCGD) method with fixed disjoint mini-batches. Empirical results on benchmark classification tasks demonstrate that NoisyCGD can achieve privacy-utility trade-offs on par with DP-SGD applied to 2-layer ReLU networks.
Errata: correction of Lemma 3.1. Added experiments in Appendix D.1
Machine Learning (cs.LG); Cryptography and Security (cs.CR)
arXiv:2407.04884 [cs.LG]
(or arXiv:2407.04884v4 [cs.LG] for this version)
Full text under the publisher's open licence · 206 words
Related coverage
Challenge: Hand coding weights for efficient sequence memorisation
AI Alignment Forum · Jul 23, 2026
Why and When Deep is Better than Shallow: Implementation-Agnostic State-Transition Model of Deep Learning
arXiv · Sep 30, 2026
J++ Lens: Jacobian Filtering Enables More Faithful Workspace Lenses
LessWrong · Oct 8, 2026
PIRAMID: Progress and Plans
LessWrong · Jul 27, 2026