Privacy Amplification by Structured Subsampling for Deep Differentially Private Time Series Forecasting

TL;DR

This paper analyzes how structured subsampling in time series forecasting enhances privacy guarantees under differential privacy, addressing limitations of standard DP-SGD for sequential data.

Contribution

It provides a theoretical analysis of privacy amplification through structured subsampling specific to time series forecasting tasks.

Findings

Structured subsampling improves privacy guarantees in time series models.

Data augmentation further amplifies privacy in self-supervised training.

Empirical results confirm strong privacy guarantees with structured subsampling.

Abstract

Many forms of sensitive data, such as web traffic, mobility data, or hospital occupancy, are inherently sequential. The standard method for training machine learning models while ensuring privacy for units of sensitive information, such as individual hospital visits, is differentially private stochastic gradient descent (DP-SGD). However, we observe in this work that the formal guarantees of DP-SGD are incompatible with time series specific tasks like forecasting, since they rely on the privacy amplification attained by training on small, unstructured batches sampled from an unstructured dataset. In contrast, batches for forecasting are generated by (1) sampling sequentially structured time series from a dataset, (2) sampling contiguous subsequences from these series, and (3) partitioning them into context and ground-truth forecast windows. We theoretically analyze the privacy amplification attained by this structured subsampling to enable the training of forecasting models with sound and tight event- and user-level privacy guarantees. Towards more private models, we additionally prove how data augmentation amplifies privacy in self-supervised training of sequence models. Our empirical evaluation demonstrates that amplification by structured subsampling enables the training of forecasting models with strong formal privacy guarantees.