arXiv:2601.19090cs.LGcs.AI2026-01TPAMI

用合成数据训练私密模型,防止泄露原始数据。

Privacy-Preserving Model Transcription with Differentially Private Synthetic Distillation

  • 通过生成合成数据,无须原始数据即可转换模型。
  • 在多个数据集上准确率超26种现有方法,且满足差分隐私。
  • 适合需保护数据隐私的模型部署场景,如医疗、金融。

尽管许多基于私有数据集训练的深度学习模型已应用于实际任务,但攻击者仍可能从模型中恢复出有价值的数据或标签信息,造成隐私泄露。本文提出一种名为「隐私保护模型转写」的数据无关模型到模型转换方案,实现带隐私保障的模型部署。为此,我们设计了一种协同竞争学习方法——差分隐私合成蒸馏,通过可训练生成器,在不访问私有数据的情况下,将预训练模型(教师)转化为具有隐私保护能力的对应模型(学生)。该方法在统一框架下由三个参与者协作优化:生成器学习生成合成数据;教师与学生接收合成数据,并通过灵活的数据或标签噪声扰动计算差分隐私标签;学生使用带噪标签更新,生成器则以学生为判别器进行对抗训练。理论证明本方法可保证差分隐私与收敛性。实验表明,转写后的学生模型在性能和隐私保护方面表现优异,生成器亦能产出可用于下游任务的私有合成数据。大量实验清晰显示,本方法超越26种现有先进方法。

原文摘要 · Abstract (English)

While many deep learning models trained on private datasets have been deployed in various practical tasks, they may pose a privacy leakage risk as attackers could recover informative data or label knowledge from models. In this work, we present \emph{privacy-preserving model transcription}, a data-free model-to-model conversion solution to facilitate model deployment with a privacy guarantee. To this end, we propose a cooperative-competitive learning approach termed \emph{differentially private synthetic distillation} that learns to convert a pretrained model (teacher) into its privacy-preserving counterpart (student) via a trainable generator without access to private data. The learning collaborates with three players in a unified framework and performs alternate optimization: i)~the generator is learned to generate synthetic data, ii)~the teacher and student accept the synthetic data and compute differential private labels by flexible data or label noisy perturbation, and iii)~the student is updated with noisy labels and the generator is updated by taking the student as a discriminator for adversarial training. We theoretically prove that our approach can guarantee differential privacy and convergence. The transcribed student has good performance and privacy protection, while the resulting generator can generate private synthetic data for downstream tasks. Extensive experiments clearly demonstrate that our approach outperforms 26 state-of-the-arts.

隐私保护模型蒸馏差分隐私合成数据

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。