Learning to Generate Image Embeddings with User-level Differential Privacy

TL;DR

This paper introduces DP-FedEmb, a federated learning method with differential privacy controls for training large image embedding models across many users, achieving strong privacy guarantees with minimal utility loss.

Contribution

It proposes DP-FedEmb, a novel federated learning approach with user-level differential privacy for large-scale image embedding models, combining privacy techniques and federated strategies.

Findings

Superior utility under same privacy budget on benchmark datasets

Achieves user-level DP with epsilon<4 while maintaining utility within 5%

Effective for face, landmark, and species image embeddings

Abstract

Small on-device models have been successfully trained with user-level differential privacy (DP) for next word prediction and image classification tasks in the past. However, existing methods can fail when directly applied to learn embedding models using supervised training data with a large class space. To achieve user-level DP for large image-to-embedding feature extractors, we propose DP-FedEmb, a variant of federated learning algorithms with per-user sensitivity control and noise addition, to train from user-partitioned data centralized in the datacenter. DP-FedEmb combines virtual clients, partial aggregation, private local fine-tuning, and public pretraining to achieve strong privacy utility trade-offs. We apply DP-FedEmb to train image embedding models for faces, landmarks and natural species, and demonstrate its superior utility under same privacy budget on benchmark datasets DigiFace, EMNIST, GLD and iNaturalist. We further illustrate it is possible to achieve strong user-level DP guarantees of $\epsilon<4$ while controlling the utility drop within 5%, when millions of users can participate in training.