[MUSIC PLAYING]
YUFENG GUO: Typically, the goal of machine learning
is to generalize about a set of data.
However, sometimes it's possible to recover
information about specific training examples
from a trained model.
How can we provide more privacy and ensure
our models capture general patterns, rather than
specific examples?
Stay tuned to find out.
Welcome to AI Adventures, where we explore the art, science,
and tools of machine learning.
My name is Yufeng Guo, and on this episode,
we're going to take a look at TensorFlow Privacy,
a new tool aimed at making it easy to train models
with privacy.
Last year, Google published a set of responsible AI practices
focused around fairness, interpretability, privacy,
and security.
One of the recommended practices in the Privacy section
states, "Appropriately safeguard the privacy of ML models,"
and recommends that we train ML models using
techniques that establish mathematical guarantees
for privacy.
This is all well and good to recommend,
but it does leave you wondering, how exactly do I do that?
When you train a machine learning model,
the goal should be to learn these general patterns, not
facts about specific training examples.
Otherwise the model ends up memorizing
a set of specific facts, which may not generalize well
to previously-unseen data, and may
lead to possible exposure of the underlying data that
was memorized.
This is especially important when that data set corresponds
to user actions or user attributes.
Of course, it's not enough to say that your model probably
doesn't memorize specific users' data.
What we want is to use techniques
that offer strong mathematical guarantees that models do not
learn or remember any details about any specific user.
TensorFlow Privacy does just this--
all without needing any expertise in privacy
or understanding its underlying mathematics.
So what's happening under the hood?
In order to ensure that no single example can impact
that final trained model, TensorFlow Privacy
introduces some modifications to the way
that gradients are calculated during the training process.
Gradients are a way of expressing which direction
and how far a model should update
its internal state, represented by weights and biases--
or put another way, a large matrix of numbers.
And typically, during a single training step,
we use a batch of data--
just some subset-- to determine the gradient,
and then apply it to update the value of the weights.
So in other words, we look at some bit of the data,
figure out, based on that, which direction
and how far to shift our model, and then we go there.
TensorFlow Privacy makes a few small but key tweaks
to how that gradient is computed.
If a single example is providing an outsize effect
on that model's gradient, it may cause it to stick out,
so to speak, and thus potentially be
exposed in the trained model.
One example of how TensorFlow Privacy addresses this
is by averaging together multiple mini-gradient updates
on a subset of the full batch.
So each mini-gradient's value is clipped,
limiting its range of possible values,
and so that restricts their individual impact.
These mini-gradients are then averaged together.
And finally, we add some Gaussian random noise
on top of this average.
So by doing this, we're ensured that no individual example
will be memorized by the model.
In practice, you don't need to modify your model architecture
or training procedures to take advantage
of TensorFlow Privacy.
Instead, to train models, use a different optimizer
provided by the TensorFlow Privacy Library,
and we'll fill in some values to customize the optimizer's
clipping, noise level, and number of mini-batches
to average together.
Yes, we're going to introduce some more hyperparameters
for you to tune, but hey, it's better
than rewiring your entire model, and it's better
than exposing your users' data.
Now let's take a look at an example of what
TensorFlow Privacy can achieve.
In their blog post announcing the launch,
the team highlighted an interesting situation
with a language learning model which
is supposed to identify English sentences that look like they
come from financial news.
With the two models side by side,
one trained using TensorFlow Privacy and one without,
there are many sentences where both models agreed
on, say, sentences that look like financial news,
such as, "South Korea and Japan continue to be profitable."
But then there were the ones which the models disagreed on.
These were notable, because while the data set had marked
these sentences as financial news,
they definitely don't look like they belong in financial news.
What's interesting here is that not only
do these anomalous sentences account for most
of the differences in accuracy between these two models,
but this really illustrates the idea
that going by metrics purely is not always the right decision.
It also suggests that perhaps we can
utilize TensorFlow Privacy and similar tools
to identify aspects of a data set
which perhaps shouldn't even be there in the first place.
TensorFlow Privacy turns the science and math
behind differential privacy into a tool that you can use.
And while the tuning of hyperparameters
does remain a bit of an art, the team
has offered up some reasonable initial values
to begin your exploration.
For more details and examples, head on over to the blog post
I have linked below in the description.
Thanks for watching this episode of Cloud AI Adventures,
and if you enjoyed it hit that Like button
and be sure to subscribe to get all the latest episodes, right
when they come out.
For now, check out TensorFlow Privacy
to make machine learning safer for your users.