DPMLBench - Holistic Evaluation of Differentially Private Machine Learning

Aug 2, 2026

Uploaded by Riley

Differential privacy (DP) provides a rigorous way to quantify privacy leakage, and differentially private machine learning (DPML) is increasingly used to protect sensitive data. DP-SGD remains foundational but often suffers from major utility loss, prompting many follow-up algorithms with better privacy-utility trade-offs. Prior work evaluates improvements separately and lacks holistic comparisons across utility, defensive effectiveness against membership inference attacks, and generalizability. This work performs a comprehensive benchmark on improved DPML algorithms, spanning twelve algorithms, multiple architectures and datasets, and two attack types, also covering state-of-the-art label DP methods.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages24

Reading Time1 h 0 min

AccessFree to download

Abstract

Introduction

Differential privacy and DPML background

Our Contributions

VU Research Portal DPMLBench Wei, Chengkun; Zhao, Minghu; Zhang, Zhikun; Chen, Min; Meng, Wenlong; Liu, Bo; Fan, Yuan; Chen, Wenzhi 2023 DOI (link to publisher) 10.48550/arXiv.2305.05900 Link to publication in VU Research Portal citation for published version (APA) Wei, C. , Zhao, M. , Zhang, Z. , Chen, M. , Meng, W. , Liu, B. , Fan, Y. , & Chen, W. (2023) . DPMLBench: Holistic Evaluation of Differentially Private Machine Learning. (pp. 1-23) . arXiv. [https://doi.org/10.48550/arXiv.2305.05900](https://doi.org/10.48550/arXiv.2305.05900) General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [vuresearchportal.ub@vu.nl](vuresearchportal.ub@vu.nl) [Download date: 15](Download date: 15) . Feb. 2025 To appear in the 30th ACM SIGSAC Conference on Computer and Communications Security. November 26-30, 2023 . DPMLBench: Holistic Evaluation of Differentially Private Machine Learning Chengkun Wei¶ * Minghu Zhao¶∗ Zhikun Zhang‡§¶† Min Chen‡ Wenlong Meng¶ Bo Liu∥ Yuan Fan¶ Wenzhi Chen¶†¶ Zhejiang University ‡ CISPA Helmholtz Center for Information Security § Stanford University ∥ DBAPPSecurity arXiv :2305 .05900v2 [ cs .LG] 14 Oct 2023 Abstract Differential privacy (DP), as a rigorous mathematical definition quantifying privacy leakage, has become a wellaccepted standard for privacy protection. Combined with powerful machine learning techniques, differentially private machine learning (DPML) is increasingly important. As the most classic DPML algorithm, DP-SGD incurs a significant loss of utility, which hinders DPML’s deployment in practice. Many studies have recently proposed improved algorithms based on DP-SGD to mitigate utility loss. However, these studies are isolated and cannot comprehensively measure the performance of improvements proposed in algorithms. More importantly, there is a lack of comprehensive research to compare improvements in these DPML algorithms across utility, defensive capabilities, and generalizability. We fill this gap by performing a holistic measurement of improved DPML algorithms on utility and defense capability against membership inference attacks (MIAs) on image classification tasks. We first present a taxonomy of where improvements are located in the machine learning life cycle. Based on our taxonomy, we jointly perform an extensive measurement study of the improved DPML algorithms, over twelve algorithms, four model architectures, four datasets, two attacks, and various privacy budget configurations. We also cover state-of-the-art label differential privacy (Label DP) algorithms in the evaluation. According to our empirical results, DP can effectively defend against MIAs, and sensitivity-bounding techniques such as per-sample gradient clipping play an important role in defense. We also explore some improvements that can maintain model utility and defend against MIAs more effectively. Experiments show that Label DP algorithms achieve less utility loss but are fragile to MIAs. Machine learning practitioners may benefit from these evaluations to select appropriate algorithms. To support our evaluation, we implement a modular re-usable software, DPMLBench, 1 which enables sensitive data owners to deploy DPML a

FAQs

What problem does DPMLBench address in differentially private machine learning research?

It addresses the lack of comprehensive, holistic evaluation of improved DPML algorithms, since prior studies typically measure improvements in isolation. The goal is to compare algorithms across utility, defense against membership inference attacks, and generalizability.

How does DPMLBench evaluate improved DPML algorithms?

It performs extensive measurements over twelve algorithms, four model architectures, four datasets, and two membership inference attack types under multiple privacy budget configurations. It also evaluates label differential privacy methods.

What key findings does the benchmark report about defense and utility?

Experiments show that DP effectively defends against membership inference attacks, and sensitivity-bounding techniques like per-sample gradient clipping are important. Label DP approaches can reduce utility loss but may be more fragile to membership inference attacks.

Aug 2, 2026

Uploaded by Riley