End-to-End Differential Privacy in Training Deep Neural Network Classifiers

2026-07-21

AI Summary

This work addresses the unnecessary utility loss in existing differential privacy (DP) training methods, which add noise to both inputs and labels even when labels are public. To remedy this, the authors propose an end-to-end DP framework that protects only the input data. Their approach introduces the Dirichlet mechanism—applied for the first time to the softmax output layer—to enforce input-level privacy, and leverages Rényi differential privacy theory to tightly track the privacy budget across multiple training epochs. Evaluated on standard benchmarks such as CIFAR-10 and MNIST, the method achieves state-of-the-art accuracy under the label-public setting: on CIFAR-10, it attains 88.17% accuracy at ε=4—nearly a 10-percentage-point improvement over prior art—and maintains 82.96% accuracy even at the stringent privacy level of ε=1, setting a new performance record for DP training with public labels.

Abstract

Differentially private machine learning enables model training on sensitive data while ensuring that individual data is unlikely to be recoverable from the parameters of the resulting model. However, existing work often privatizes both training inputs and their labels, and these protections may be conservative when labels are public or can be safely made public. Therefore, in this work we propose a novel private training framework that instead privatizes training inputs while keeping labels public. We consider neural networks with softmax output layers, and thus the mapping from training inputs to the output of the softmax layer is a mapping onto the unit simplex. We randomize softmax outputs during training by applying the Dirichlet mechanism to enforce differential privacy for the training inputs, hence the ``end-to-end'' label. Because training data is reused across multiple training epochs, we use the notion of \Renyi differential privacy to formulate tight bounds on the strength of privacy provided by the Dirichlet mechanism across repeated uses. We show empirically that we attain new state-of-the-art accuracy when training from scratch on CIFAR10, MNIST, MedMNIST, FashionMNIST, and SVHN across all privacy budgets evaluated. Notably, when implementing $(ε, δ)$-differential privacy with $δ=10^{-5}$, we improve the prior state-of-the-art accuracy from $78.37\%$ to $88.17\%$ at $ε=4$ on CIFAR10, and our approach has $82.96\%$ accuracy even for $ε=1$, which significantly outperforms prior work.

Problem

• differential privacy
• deep neural networks
• private training
• softmax outputs
• data privacy

Innovation

• Differential Privacy
• Dirichlet Mechanism
• End-to-End Privacy
• Rényi Differential Privacy
• Softmax Randomization