Why not? CIFAR-10 style pictures are well-represented in ImageNet, differing primarily in terms of resolution. This may not be the case for settings where we care about privacy, such as medical imaging: by nature of being private, similar pictures are not broadly available. 9/n
@thegautamkamath
-
Privacy in Machine Learning: Scaling Challenges and Solutions
By
–
3. Scale makes ML hard to use in a truly private fashion. If you want to do inference on a point without sharing it, you either have to fine-tune&run the model locally (see e.g. this nice paper by @simran_s_arora @HazyResearch https://
arxiv.org/abs/2205.13722), or use FHE encryption. 10/n -
Private ML Progress Measurement Benchmarks Need Reassessment
By
–
2. We're not measuring progress meaningfully. Many of the benchmarks adopted in private ML come from the non-private setting. For example, pre-training on ImageNet and fine-tuning on CIFAR-10. Good starting point, but may not reflect settings we'd want to use private ML. 8/n
-
ML Privacy Risks: Models Can Leak Secrets from Training Data
By
–
There's more such examples in large pre-training datasets. Since ML models pretrained on them without privacy considerations can be coerced to spit secrets out verbatim (see e.g., https://
arxiv.org/abs/2012.07805 by Carlini et al), this dilutes the meaning of "privacy" for such models 7/n -
Public Data vs Private ML Training Ethics
By
–
1. Publicly available data is not the same as public data. For example, http://
insecam.org has livestreams from videocameras with default passwords. This is publicly available. But it certainly should not be used to train an ML model which purports to be "private." 6/n -
Privacy Challenges in Public Data Pretraining and Fine-tuning
By
–
Seems great, right? Public data is plentiful online, we can just download tons of it, pretrain our models with this public data, and do fine-tuning privately! Privacy is solved! Of course not, and we highlight three (orthogonal) considerations for these settings. 5/n
-
Private Fine-Tuning of LLMs Shows Modest Utility Loss
By
–
Story is similar for language models. In some prior works at #ICLR2022 (by Yu et al https://
arxiv.org/abs/2110.06500 and @lxuechen et al https://
arxiv.org/abs/2110.05679), it was shown that privately fine-tuning (publicly) pretrained LLMs suffers only a modest utility loss. 4/n -
Pre-training ImageNet Fine-tuning CIFAR-10 Privacy
By
–
The good news is, public data can help dramatically! Pre-training on ImageNet (without privacy constraints) and fine-tuning on CIFAR-10 (privately) gets us up to 95%+ (figure from the same paper). Takes it from bad (and in some cases, unusable) to pretty good! 3/n
-
Differential Privacy in ML: CIFAR-10 Performance Gap Challenge
By
–
Differentially private ML is hard. Even basic "solved" tasks in the non-private setting are very hard to do with privacy. Figure from a nice paper by @sohamde_ @LeonardBerrada et al (
https://
arxiv.org/abs/2204.13650), showing SOTA results on CIFAR10.. 60-80%, versus 99%+ non-privately 2/n -
Differential Privacy Challenges in Large-Scale AI Pretraining
By
–
New paper w Nicholas Carlini & @florian_tramer
: "Considerations for Differentially Private Learning with Large-Scale Public Pretraining." We critique the increasingly popular use of large-scale public pretraining in private ML. Comments welcome. https://
arxiv.org/abs/2212.06470 1/n