pith. sign in

arxiv: 2012.07828 · v3 · pith:SZIGDRMPnew · submitted 2020-12-14 · 💻 cs.LG · cs.CR

Robustness Threats of Differential Privacy

Nurislam Tursynbek , Aleksandr Petiushko , Ivan Oseledets This is my paper
classification 💻 cs.LG cs.CR
keywords robustnessnetworksprivacymodelneuraldifferentdifferentialaccuracy
0
0 comments X
read the original abstract

Differential privacy (DP) is a gold-standard concept of measuring and guaranteeing privacy in data analysis. It is well-known that the cost of adding DP to deep learning model is its accuracy. However, it remains unclear how it affects robustness of the model. Standard neural networks are not robust to different input perturbations: either adversarial attacks or common corruptions. In this paper, we empirically observe an interesting trade-off between privacy and robustness of neural networks. We experimentally demonstrate that networks, trained with DP, in some settings might be even more vulnerable in comparison to non-private versions. To explore this, we extensively study different robustness measurements, including FGSM and PGD adversaries, distance to linear decision boundaries, curvature profile, and performance on a corrupted dataset. Finally, we study how the main ingredients of differentially private neural networks training, such as gradient clipping and noise addition, affect (decrease and increase) the robustness of the model.

This paper has not been read by Pith yet.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

    cs.LG 2026-05 unverdicted novelty 7.0

    PACZero achieves zero mutual information privacy for LLM fine-tuning via sign-quantized zeroth-order gradients, delivering near-non-private accuracy on SST-2 and SQuAD at I=0.

  2. PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization

    cs.LG 2026-05 unverdicted novelty 7.0

    PACZero achieves zero mutual information privacy in LLM fine-tuning via sign-quantized subset-aggregated ZO gradients, delivering near non-private accuracy on SST-2 at I=0.

  3. Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD

    cs.LG 2026-01 unverdicted novelty 6.0

    Shuffled DP-SGD requires σ ≥ 1/√(2 ln M) or κ ≥ (1/√8)(1 - 1/√(4π ln M)) to limit adversarial advantage, preventing strong privacy and high utility simultaneously.