The Impact of Generalization Techniques on the Interplay Among Privacy, Utility, and Fairness in Image Classification

TL;DR

This paper explores how generalization techniques like sharpness-aware training and differential privacy impact the balance among privacy, utility, and fairness in image classification, revealing complex trade-offs and new metrics.

Contribution

It introduces a harmonic score metric to evaluate privacy, utility, and fairness simultaneously and empirically analyzes the effects of generalization techniques on these aspects.

Findings

Achieved 81.11% accuracy under differential privacy, surpassing previous results.

Found that memorization can occur before overfitting, and generalization techniques do not prevent it.

Demonstrated that generalization can amplify bias and that removing outliers reduces accuracy and increases bias.

Abstract

This study investigates the trade-offs between fairness, privacy, and utility in image classification using machine learning (ML). Recent research suggests that generalization techniques can improve the balance between privacy and utility. One focus of this work is sharpness-aware training (SAT) and its integration with differential privacy (DP-SAT) to further improve this balance. Additionally, we examine fairness in both private and non-private learning models trained on datasets with synthetic and real-world biases. We also measure the privacy risks involved in these scenarios by performing membership inference attacks (MIAs) and explore the consequences of eliminating high-privacy risk samples, termed outliers. Moreover, we introduce a new metric, named \emph{harmonic score}, which combines accuracy, privacy, and fairness into a single measure. Through empirical analysis using generalization techniques, we achieve an accuracy of 81.11\% under $(8, 10^{-5})$-DP on CIFAR-10, surpassing the 79.5\% reported by De et al. (2022). Moreover, our experiments show that memorization of training samples can begin before the overfitting point, and generalization techniques do not guarantee the prevention of this memorization. Our analysis of synthetic biases shows that generalization techniques can amplify model bias in both private and non-private models. Additionally, our results indicate that increased bias in training data leads to reduced accuracy, greater vulnerability to privacy attacks, and higher model bias. We validate these findings with the CelebA dataset, demonstrating that similar trends persist with real-world attribute imbalances. Finally, our experiments show that removing outlier data decreases accuracy and further amplifies model bias.