---
title: "Model Conversion via Differentially Private Data-Free Distillation"
authors:
  - "Bochao Liu"
  - "Pengju Wang"
  - "Shikun Li"
  - "Dan Zeng"
  - "Shiming Ge"
doi: "10.24963/ijcai.2023/243"
url: "https://ijcai.org/proceedings/2023/243"
pdf: "https://ijcai.org/proceedings/2023/0243.pdf"
venue: "Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence"
year: 2023
pages: "2187-2195"
track: "Main Track"
keywords:
  - "Computer Vision: CV: Bias, fairness and privacy"
  - "Data Mining: DM: Privacy-preserving data mining"
---

# Model Conversion via Differentially Private Data-Free Distillation

Bochao Liu, Pengju Wang, Shikun Li, Dan Zeng, Shiming Ge

*Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence*, pages 2187-2195. DOI: [10.24963/ijcai.2023/243](https://doi.org/10.24963/ijcai.2023/243)

## Abstract

While massive valuable deep models trained on large-scale data have been released to facilitate the artificial intelligence community, they may encounter attacks in deployment which leads to privacy leakage of training data. In this work, we propose a learning approach termed differentially private data-free distillation (DPDFD) for model conversion that can convert a pretrained model (teacher) into its privacy-preserving counterpart (student) via an intermediate generator without access to training data. The learning collaborates three parties in a unified way. First, massive synthetic data are generated with the generator. Then, they are fed into the teacher and student to compute differentially private gradients by normalizing the gradients and adding noise before performing descent. Finally, the student is updated with these differentially private gradients and the generator is updated by taking the student as a fixed discriminator in an alternate manner. In addition to a privacy-preserving student, the generator can generate synthetic data in a differentially private way for other down-stream tasks. We theoretically prove that our approach can guarantee differential privacy and well convergence. Extensive experiments that significantly outperform other differentially private generative approaches demonstrate the effectiveness of our approach.

## Full text

## 1 Introduction

The success of deep neural networks in a wide array of applications [Jia et al., 2019a; Jia et al., 2019b; Ye et al., 2020] greatly owes to the open source of massive models. However, a major problem is that the training data of these models often contain a large amount of sensitive information that can be easily recovered with a few access to the models [Fredrikson et al., 2015; Yang et al., 2019]. How to protect such private information while maintaining the model performance has attracted a lot of attentions. Differential privacy (DP) [Dwork et al., 2006] is a common technique for protecting privacy. [Abadi et al., 2016] guaranteed that the model was differentially private regarding the training data by clipping gradients and adding Gaussian noise to gradients. However, the model accuracy decreases severely when the privacy requirements increase so that the model can't be applied directly to the case where only the pretrained models are given. [Papernot et al., 2017; Papernot et al., 2018] proposed a semi-supervised learning framework called PATE to reduce the impact of the DP noise by leveraging the noisy aggregation of multiple teacher models trained directly on the private data. It is possible to train a privacy-preserving student model using PATE framework given only sensitive teacher models, but it is difficult to find a suitable unlabeled public dataset for the distillation process.

∗ Shiming Ge is the corresponding author (geshiming@iie.ac.cn). Supplementary material is available at: https://arxiv.org/abs/2304.12528

In the meantime, an independent line of research concerning model compression shows that some data-free knowledge distillation approaches (DFKD) [Chen et al., 2019; Zhu et al., 2021; Choi et al., 2020] could achieve similar performance by vanilla training with only a teacher model. The data used for the distillation process is generated by a generator, which could potentially be a remedy for the above problem of the suitable public dataset. The generators of such methods mainly learn the data distribution rather than the image details, which intuitively also provides a degree of protection of privacy. [Ge et al., 2023] has showed that: It is possible to leverage the power of data-free knowledge distillation to train a privacy-preserving student model that is not necessary to access to the original dataset. But there is still a long way to take advantage of this intuition.

Inspired by the above observations, in this paper we propose a model conversion approach with Differentially Private Data-Free Distillation (DPDFD) to facilitate the model releasing by distilling a pretrained model as teacher into a differentially private student. Specifically, our DPDFD combines DFKD and DP, which applies DFKD to distill private knowledge and a DP mechanism AC,σ to guarantee privacy. The objective is to enable an effective conversion that achieves strong privacy protection with minimum accuracy loss when only private models (teachers) are given. As shown in Fig. 1, we first generate massive synthetic data with a generator. Then, we feed the synthetic data into the teacher model and student model to compute the loss. Differentially private gradients are calculated by applying DP mechanism AC,σ. Finally, we update the student with these gradients and update the generator by taking the student as a fixed discriminator. In particular, we achieve DP by performing normalization on the gradients of student outputs and adding Gaussian noise to gradients during student learning. The reason for performing normalization instead of clipping is that it will retain the relative size information of the gradients and achieve better performance with a smaller norm bound. The reason for adding Gaussian noise to the gradients of student outputs is that it has a lower dimension compared to other gradients. Both smaller norm bound and lower dimension gradients make it easier to balance the performance and privacy. In addition, the DP mechanism AC,σ also ensures differentially private training of the generator according to the postprocessing mechanism. We can use the generator to generate data for other down stream tasks if needed. We also provide privacy and convergence analysis for our DPDFD in theory. Furthermore, DPDFD can be extended to multi-model case, which aggregates multiple sensitive teachers into a privacypreserving student model.

In summary, our DPDFD can effectively convert a sensitive teacher model to a privacy-preserving student model through three key components. First, performing normalization instead of clipping which is usually used in other approaches retains information about the relative size of the gradients. Second, achieving DP by adding noise on the gradients of lower dimensional outputs makes it easier to balance performance and privacy. Third, synthetic data generated by the generator has a similar distribution with the training data of teacher model. In this way, we can convert the sensitive model to a privacy-preserving student with minimum accuracy loss.

Our major contributions are three folds: 1) we propose a model conversion approach to convert a pretrained sensitive model into a privacy-preserving model for secure releasing; 2) we provide privacy analysis and convergence analysis for our approach in theory; 3) we conduct extensive experiments and analysis to demonstrate the scalability and effectiveness of our approach.

## 2 RelatedWorks

The approach we proposed in this paper aims to train privacypreserving student models by distilling knowledge from given sensitive model(s) via a differentially private data-free distillation. Therefore, we briefly review the related works for two inspects, including differentially private learning and datafree knowledge distillation.

## 2.1 Differentially Private Learning

Differentially private learning aims to ensure the learning model is differentially private regarding the private data. [Abadi et al., 2016] proposed a differentially private stochastic gradient descent (DPSGD) algorithm which achieved DP by clipping and adding noise to the gradients of all parameters during the training process. However, the model performance degrades severely with strong privacy requirements. [Papernot et al., 2017] later proposed PATE which used semisupervised learning to transfer the knowledge of the teacher ensemble to the student by using a noisy aggregation. It can reduce the impact of noise on performance by increasing the number of teacher models. However, it is difficult to find an unlabeled public dataset that has similar distribution to the training data of teachers. Some works want to train differentially private generators to generate data that has similar distribution to private data while preserving privacy. [Xie et al., 2018] applied DPSGD to the training process of Generative Adversarial Networks (GAN) [Goodfellow et al., 2014] to get a differentially private generator. [Chen et al., 2020] suggested that it is not necessary to clip and add noise to all gradients, but only needs to achieve DP in the back propagation process from discriminator to generator. [Cao et al., 2021] applied differentially private optimal transmission theory to train generators. [Chen et al., 2022] proposed an energyguided network trained on sanitized data to indicate the direction of the true data distribution via Langevin Markov Chain Monte Carlo sampling method. In this paper, we make a better balance between performance and privacy by applying normalization instead of clipping and post-processing of DP.

## 2.2 Data-Free Knowledge Distillation

Data-free knowledge distillation is a class of approaches that aims to train a student model with a pretrained teacher model without access to original training data. It uses the information extracted from the teacher model to synthesize data used in the distillation process. [Srinivas and Babu, 2015] proposed to directly merge similar neurons in fully-connected layers, which cannot be applied to convolutional layers and networks because the detailed architectures and parameters information is unknown. [Lopes et al., 2017] first proposed data-free knowledge distillation, using the distribution information of the original data to reconstruct the synthetic data used in the distillation process. [Deng and Zhang, 2021] used this approach to generate synthetic graph data for data-free knowledge distillation for graph classification tasks. [Zhu et al., 2021] modified and applied it to federated settings. [Chen et al., 2019] proposed a novel framework named DAFL for training the student model by exploiting GAN. It uses the teacher model as the discriminator to train a generator. [Choi et al., 2020] proposed matching statistics from the batch normalization layers for generated data and the original data in the teacher. It can make the generated data closer to the original data. [Fang et al., 2022] proposed FastDFKD that applied the idea of meta-learning to the training process to accelerate the efficiency of data synthesis. Inspired by these approaches, it is possible to convert a sensitive model into a privacy-preserving model without access to the original data.

## 3 Preliminaries

Here we will first provide some background knowledge about differential privacy. We then draw connections between the definitions and theorems we introduced here and our DP analysis on DPDFD later. The following definition explains how DP provides rigorous privacy guarantees clearly.

Definition 1 (Differential Privacy). A randomized mechanism A with domain R is (ε, δ)-differential privacy, if for all O ⊆ R and any adjacent datasets D and D′ :

Figure 1: Overview of our differentially private data-free distillation approach. The approach learns to convert a pretrained model ϕt into a privacy-preserving student ϕs via an intermediate generator ϕg. The learning is performed to collaborate three parties in a unified way. First, the generator generates massive data. Then, these data are fed into the teacher and student models to calculate the gradients gs; Finally, the student and generator are updated with differentially private gradients ˜ gs, which are computed by applying DP mechanism AC,σ to gs. Here, C is the norm bound and N(0, σ2 ) is Gaussian noise with mean 0 and variance σ2 .

![Image](https://ijcai.org/proceedings/2023/fulltext/243/image_000000_b0b069949be23430f77e08f479fe819daa9ac8207491da6def09e10206eb181e.png)

<!-- formula-not-decoded -->

where adjacent datasets D and D′ differ from each other with only one training example. ε is the privacy budget and the smaller it is the better, and δ is the failure probability.

[Mironov, 2017] proposed a variant R´ enyi differential privacy (RDP), which computes privacy with R´ enyi divergence. We review the definition of RDP and its connection to DP.

Definition 2 (R´enyi Differential Privacy). A randomized mechanism A is (λ, ε)-RDP with λ &gt; 1 if for any adjacent datasets D and D′ :

<!-- formula-not-decoded -->

<!-- formula-not-decoded -->

Different from DP, RDP has a more friendly composition theorem and can be applied to both data-independent and data-dependent settings. It supports a tighter composition of privacy budget which can be described as follows: For a sequence of mechanisms A1, ...,Ai, ...,Ak, where Ai is (λ, εi)-RDP, the composition of them A1 ◦ ...Ai... ◦ Ak is (λ, ∑i εi)-RDP. Ai represents one query to the teacher model in our case. Moreover, the connection between RDP and DP can be described as follows:

Theorem 1 (Convert RDP to DP). A (λ, ε)-RDP mechanism A also satisfies (ε + log λ-1 λ - log δ+logλ λ-1 , δ)-DP.

To provide DP guarantees, we exploit the postprocessing [Dwork and Roth, 2014] described as follows:

Theorem 2 (Post-processing). If mechanism A satisfies (ε, δ)-DP, the composition of a data-independent function F with A is also (ε, δ)-DP.

## 4 Proposed Approach

## 4.1 ProblemFormulation

Given a sensitive teacher model ϕt with parameters θt, the objective is converting it into a privacy-preserving student model ϕs with parameters θs that does not reveal data privacy and has the ability to perform similarly to the teacher model. To achieve that, we introduce a differentially private data-free distillation approach. We first sample a batch of noise vectors z = {zi}Bi=1 and feed them into the generator ϕg with parameters θg to generate massive synthetic data D = {di}Bi=1 . Enter them into the teacher model and student model to calculate the loss LT (ϕt(θt;D), ϕs(θs;D)) and then calculate updated outputs of student ys to achieve DP with a differentially private mechanism AC,σ. Finally update the student by the loss LS(ϕs(θs; D), ys) . Thus, the converting process can be formulated by minimizing an energy function E:

<!-- formula-not-decoded -->

where g = ∂LT (ϕt(θt;D),ϕs(θs;D)) ∂ϕs(θs;D) and γ is the learning rate. We suppress the risk of privacy leakage with DP mechanism AC,σ which normalizes the gradients with norm bound C and adds Gaussian noise with variance σ2 . We will introduce how the differentially private mechanism AC,σ protects privacy in detail in the following.

## 4.2 Our Solution: DPDFD

Student model distilled from a sensitive teacher model directly may lead to privacy leakage and another main problem is that we don't have access to the original dataset. Thus, we aim to convert the sensitive teacher model to a privacypreserving student model while having similar performance to the sensitive model in a data-free manner.

Unlike [Abadi et al., 2016] which requires clipping and adding Gaussian noise to gradients of all parameters, due to the post-processing of DP, we only need to perform normalization and add noise to the gradients of student's outputs to calculate new differentially private outputs. As shown in Fig. 1 and Alg. 1, we first sample a batch of noise vectors z = {zi}Bi=1 and feed them into the generator ϕg with parameter θg to obtain massive synthetic data D = ϕg(z). Then enter the synthetic data D into the teacher and student to compute the loss LT (ϕt(θt;D), ϕs(θs;D)). To get better results,

## Algorithm 1 DPDFD

Input: Training iterations T, loss function LT ,LS,LG, noise scale σ, sample size B, learning rate γ, γs, γg, gradient norm bound C, a positive stability constant e

- 1: for t ∈ [T] do
- 2: Sample B noise samples z = {zi}Bi=1
- 3: Generate B synthetic samples D = {ϕg(θg; zi)}Bi=1
- 4: for each synthetic data di = ϕg(θg; zi) do
- 5: Compute loss LT (ϕt(θt; di), ϕs(θs; di))
- 6: Compute the gradient gi = ∂LT ∂ϕs(θs;di)
- 7: Normalize the gradient ¯ gi = C·gi ||g||2+e
- 8: end for
- 9: Add noise ˜ g = 1B ( B∑ i=1 ¯ gi + N (0, σ2C 2 I))
- 10: Compute differentially private outputs of student ys = ϕs(θs;D) -γ · ˜ g
- 11: Compute loss LS(ϕs(θs;D), ys)
- 12: Update student θt+1 s = θts -γs · ∂LS ∂θts
- 13: Compute loss LG(ϕs(θs;D))
- 14: Update generator θt+1 g = θtg -γg · ∂(LS+LG) ∂θtg
- 15: end for
- 16: return θs and θg

we treat argmax(ϕt(θt;D)) as the target labels and then calculate the distillation loss LT same as [Zhao et al., 2022]. After that we achieve DP by the mechanism AC,σ which can be described as follows:

<!-- formula-not-decoded -->

and generate new differentially private outputs ys. Compared with clipping, normalization can achieve higher accuracy at smaller norm bound C. This is because when C is small, clipping makes the gradients lose their variability but normalization retains the relative size relationship of gradients. Another important point is that the smaller the C, the smaller the privacy budget consumed by each query to the teacher model, which is exactly what we want. So we choose a smaller C and normalization operation to get a lower privacy budget and better performance. Finally, we compute the loss LS(ϕs(θs; D), ys) and update the student model with it. This loss function can take many forms, and we use cross-entropy loss in our experiments. In order to make the distribution of the synthetic data closer to the private data and balance the classes of the synthetic data, we add an additional loss LG when updating the generator. It can be formulated as:

<!-- formula-not-decoded -->

where α and β are the tuning parameters to balance the effect of three terms, and we set both of them to 1. The first term ℓ(·) is a cross entropy function that measures the one-hot classification loss, which enforces the synthetic data having similar distribution as the private data. The second term is the information entropy loss to measure the class balance of generated data. The third term uses l2-norm ||∗||2 to measure the activation loss, since the features that are extracted by the student and correspond to the output before the fully-connected layer tend to receive higher activation value if input data are real rather than some random vectors, where θs ⊂ θs is the student's backbone parameters. We update the student and generator alternately in our experiments. In the nutshell, the trained student and generator satisfy DP because the training process can be seen as post-processing, given that ys is differentially private results. Overall, DPDFD can be formally proved DP in Theorem. 3.

<!-- formula-not-decoded -->

## 4.3 Convergence Analysis

To analyze the convergence of our DPDFD, we follow the standard assumptions in the SGD literature [Allen-Zhu, 2017; Bottou et al., 2018; Ghadimi and Lan, 2013], with an additional assumption on the gradient noise. We assume that LT has a lower bound L∗ and LT is κ-smoothness, which can be described as follows: ∀x, y, there is an non-negative constant κ such that LT (x)-LT (y) ≤ ∇LT (x)⊤(x-y)+ κ2 ||x-y||2 . The additional assumption is that (gr-g) ∼ N(0, ζ 2 ), where gr is the ideal gradients of LT and g is the gradient we compute as an unbiased estimate of gr. Then according to [Bu et al., 2022], in our case we have:

<!-- formula-not-decoded -->

where χ is min 0≤t≤T E(∥gtr ∥), d is a constant number, L0 is the initial loss and F(·) results only from the normalization operation same as [Bu et al., 2022] and it won't affect the monotonicity of input variables. We simply set the learning rate γ ∝ 1 √T and the gradients will gradually tend to 0 as T increases.

## 4.4 Discussion

Extension toMulti-Model Ensemble. Our DPDFD can be extended to the case of multiple sensitive models. Different from the case of a single teacher that reduces the impact of DP noise by averaging a batch of gradients, the case of multi-model achieves it by averaging the gradients from given sensitive models. In particular, given multiple teacher models {ϕjt }nj=1 , we first sample noise vectors and generate massive synthetic data same as the case of a single teacher. For each data di, we enter it into multiple teacher models {ϕjt (θj t ; di)}nj=1 and student model ϕs(θs; di) and compute losses {LT (ϕjt (θj t ; di), ϕs(θs; di))}nj=1 . Then, we compute gradients gij = { ∂LT (ϕjt (θj t ;di),ϕs(θs;di)) ∂ϕs(θs;di) }n j=1 with the losses. After that, we normalize them with norm bound C and add noise to them to get differentially private gradients

Table 1: Accuracy comparisons with 9 explicit approaches under different privacy budget ε (δ = 10-5 ).

| Dataset         |   Teacher |      ε |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD | DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD   |   DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD | DP-GANPATE-GANG-PATEGS-WGANDP-MERFP3GMDataLens DPSHDPGENDPDFD   |
|-----------------|-----------|--------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------|
| MNIST 0.9921    |         1 | 0.4036 |                                                          0.4168 |                                                          0.5810 |                                                          0.1432 |                                                          0.6367 |                                                          0.7369 |                                                          0.7123 | N/A                                                             |                                                          0.9046 | 0.9512 0.9751                                                   |
| MNIST 0.9921    |        10 | 0.8011 |                                                          0.6667 |                                                          0.8092 |                                                          0.8075 |                                                          0.6738 |                                                          0.7981 |                                                          0.8066 | 0.8320                                                          |                                                          0.9357 |                                                                 |
| FMNIST 0.9102   |         1 | 0.1053 |                                                          0.4222 |                                                          0.5567 |                                                          0.1661 |                                                          0.5862 |                                                          0.7223 |                                                          0.6478 | N/A                                                             |                                                          0.8283 | 0.8386                                                          |
| FMNIST 0.9102   |        10 | 0.6098 |                                                          0.6218 |                                                          0.6934 |                                                          0.6579 |                                                          0.6162 |                                                          0.7480 |                                                          0.7061 | 0.7110                                                          |                                                          0.8784 | 0.8988                                                          |
| CelebA-G 0.9353 |         1 | 0.5330 |                                                          0.6068 |                                                          0.6702 |                                                          0.5901 |                                                          0.5936 |                                                          0.5673 |                                                          0.7058 | N/A                                                             |                                                          0.6999 | 0.7237                                                          |
| CelebA-G 0.9353 |        10 | 0.5211 |                                                          0.6535 |                                                          0.6897 |                                                          0.6136 |                                                          0.6082 |                                                          0.5884 |                                                          0.7287 | 0.7630                                                          |                                                          0.8835 | 0.8992                                                          |
| CelebA-H 0.8868 |         1 | 0.3447 |                                                          0.3789 |                                                          0.4985 |                                                          0.4203 |                                                          0.4413 |                                                          0.4532 |                                                          0.6061 | N/A                                                             |                                                          0.6614 | 0.7839                                                          |
| CelebA-H 0.8868 |        10 | 0.3920 |                                                          0.3900 |                                                          0.6217 |                                                          0.5225 |                                                          0.4489 |                                                          0.4858 |                                                          0.6224 | N/A                                                             |                                                          0.8147 | 0.8235                                                          |

<!-- formula-not-decoded -->

an updated output of student yis = ϕs(θs; di)-γ · ˜ gi. Finally, we update the student and generator same as Alg. 1. In this way, we can aggregate multiple sensitive teacher models into a privacy-preserving student model.

Direct Training on Private Data. The proposed DPmechanism AC,σ is a key building block of DPDFD, and can also be applied to situations where private data is available. Given a private dataset {x, y}, we input the data x into the model and calculate the cross-entroy loss L(ϕ(θ; x), y). After that, we run the same procedures to achieve DP and update the model as Alg. 1 except we don't need to update the generator. In this way, we can train a privacy-preserving model with direct access to private data.

## 5 Experiments

In this section, we present the experimental evaluation of DPDFD for converting the sensitive model to a differentially private model with high performance.

## 5.1 Experimental Setup

Datasets. We conduct our experiments on 7 image datasets, including MNIST [LeCun et al., 1998], FashionMNIST(FMNIST) [Xiao et al., 2017], CIFAR10 [Krizhevsky, 2009], CelebA [Liu et al., 2015], PathMNIST [Yang et al., 2021], COVIDx and ImageNet [Deng et al., 2009]. We created CelebA-H and CelebA-G based on CelebA. CelebA-H and CelebA-G are classification datasets with hair color (black/blonde/brown) and gender as the label, respectively. COVIDx is a classification dataset for COVID.

Baselines. We perform compartments with 14 state-of-theart benchmarks, including 9 explicit approaches that training classifiers with generative data (DP-GAN [Xie et al., 2018], GS-WGAN [Chen et al., 2020], PATE-GAN [Jordon et al., 2019], DP-MERF [Harder et al., 2021], P3GM [Takagi et al., 2021], DataLens [Wang et al., 2021], G-PATE [Long et al., 2021], DPSH [Cao et al., 2021], DPGEN [Chen et al., 2022]) and 5 implicit approaches that training classifiers with differentially private learning (DPSGD [Abadi et al., 2016], TSADP [Papernot et al., 2021], TOPAGG [Wang et al., 2021], GM-DP [McMahan et al., 2018], DGD [Ge et al.,

2023]). To make the comparisons fair, we take the results from original papers or run the official codes.

Networks. We adopt several popular network architectures as our teacher models, including AlexNet [Krizhevsky et al., 2012], VGGNet [Simonyan and Zisserman, 2015], ResNet [He et al., 2016], WideResnet [Zagoruyko and Komodakis, 2017], DenseNet [Huang et al., 2016], MobileNet [Howard et al., 2017], ShuffleNet [Zhang et al., 2018], GoogleNet [Szegedy et al., 2015] and ViT [Dosovitskiy et al., 2020]. For VGGNet, we use 19-layer net with BN. For ResNet, we use 50-layer networks for ImageNet and 34layer networks for others. For WideResnet, we use 50-layer networks as teacher. For DenseNet, we use 161-layer networks with growth rate equals 24. For ViT, we use the same architecture as [Dosovitskiy et al., 2020]. For student model, we use 34-layer ResNet for ImageNet and the same network as DataLens for others.

## 5.2 Experimental Results

In this section, we compare DPDFD with 14 baselines and evaluate it on different networks to verify its effectiveness. We first compare the model performance of DPDFD and other state-of-the-art approaches. Then, we conduct experiments on ImageNet with different networks under different privacy budget. We show that our DPDFD is scalable and outperforms all baselines.

Comparisons with 9 Explicit Baselines. To demonstrate the effectiveness of our DPDFD, we conduct comparisons with 9 baselines under different privacy budget and report the results in Tab. 1. All approaches are under a low failure probability δ = 10-5 . We can see that our DPDFD achieves the highest performance under the same condition of privacy budget. In particular, when ε = 1, our DPDFD achieves an accuracy of 0.9512 on MNIST and 0.8386 on FMNIST, which remarkably reduces the accuracy drop by 0.0409 and 0.0716 respectively, while most of the other approaches fail to achieve an accuracy of 0.8000. It shows that our approach has the best privacy-preserving ability and minimal accuracy drop. Even for high dimensional datasets like CelebA whose dimensionality is about 16 times larger than MNIST, all approaches suffer from accuracy drop with respect to their counterparts under high privacy budget while our DPDFD still delivers the highest test accuracy. This demonstrates that our approach is also effective for high-dimensional datasets.

Table 2: Accuracy comparisons with 5 implicit approaches under different privacy budget ε.

| Approach   |   ε |   MNIST |   ε |   CIFAR10 |
|------------|-----|---------|-----|-----------|
| DPSGD      | 2.0 |  0.9500 | 2.0 |    0.6623 |
| TSADP      | 1.0 |  0.7991 | 7.5 |    0.6620 |
| TOPAGG     | 1.0 |  0.9465 | 2.0 |    0.8518 |
| GM-DP      | 1.0 |  0.9508 | 2.0 |    0.8597 |
| DGD        | 1.0 |  0.7360 | 3.0 |    0.7365 |
| DPDFD      | 1.0 |  0.9512 | 2.0 |    0.8601 |

Table 3: Accuracy on ImageNet with different networks under different privacy budget ε (δ = 10-5 ).

| Networks   | Teacher   |      ε |      ε |      ε |
|------------|-----------|--------|--------|--------|
| Networks   | Teacher   |      1 |      2 |      5 |
| AlexNet    | 0.5655    | 0.2756 | 0.5124 | 0.5218 |
| VGGNet     | 0.7423    | 0.3419 | 0.6381 | 0.6602 |
| ResNet     | 0.7602    | 0.3823 | 0.6499 | 0.6781 |
| WideResNet | 0.7848    | 0.2982 | 0.5997 | 0.7117 |
| DenseNet   | 0.7765    | 0.4552 | 0.6612 | 0.7029 |
| MobileNet  | 0.7186    | 0.3830 | 0.6203 | 0.6424 |
| ShuffleNet | 0.6953    | 0.4964 | 0.6313 | 0.6652 |
| GoogleNet  | 0.6246    | 0.2987 | 0.5717 | 0.5858 |
| ViT        | 0.8140    | 0.3142 | 0.6880 | 0.7240 |

Comparisons with 5 Implicit Baselines. In addition, we conduct experimental comparisons with 5 implicit baselines on MNIST and CIFAR10. The results are shown in Tab. 2, where our DPDFD achieves the highest accuracy of 0.9512 and 0.8601 under the lowest privacy budget of 1.0 and 2.0. The main reason comes from that we use normalization instead of traditional clipping. In this way, the differentially private gradients obtained after AC,σ retain more information (relative size between gradients).

Evaluation on Open Source Networks. To demonstrate the scalability of our DPDFD, we apply it to convert several popular networks pretrained on ImageNet under different privacy budget ε. These teacher models are taken directly from the PyTorch model zoo. The results are shown in Tab. 3. We find that the effect of network architectures is sometimes greater than the effect of public teacher model accuracy when ε is small. In particular, when ε = 1, the student model reaches the highest accuracy of 0.4964 when the teacher model is ShuffleNet, but the accuracy of teacher model is 0.1187 lower than the highest ViT. We guess this is because the simpler the teacher model is, the easier it is for the generator to learn the distribution of its training data, resulting in faster convergence of the student model. As ε increases, the student model can learn more and more fully from the teacher model, so the effect of teacher performance dominates. The more complex the teacher model, the more information about the training data it contains. The student model learns more accurate predictions from the teacher and the generator learns a more similar data distribution, both of which lead to higher accuracy of the student model. We can see that at ε = 5, the accuracy of the student is positively correlated with the accuracy of teacher model and it has approached that of the teachers, which proves that our DPDFD is not only scalable but also effective to a variety of popular network architectures.

Table 4: Accuracy comparisons with 3 DPSGD mechanisms on MNIST and CIFAR10 under different privacy budget ε.

| Dataset     |      ε |   DPSGD |   TOPAGG |   GM-DP DPDFD |
|-------------|--------|---------|----------|---------------|
| 0.5         | 0.8103 |  0.9235 |   0.9331 |        0.9377 |
| MNIST 0.7   | 0.8932 |  0.9382 |   0.9438 |        0.9447 |
| 1.0         | 0.9247 |  0.9465 |   0.9508 |        0.9762 |
| 2.0         | 0.6623 |  0.8518 |   0.8597 |        0.8652 |
| CIFAR10 4.0 | 0.6884 |  0.8540 |   0.8663 |        0.8708 |
| 8.0         | 0.7159 |  0.8562 |   0.8705 |        0.8973 |

Evalution of Training Directly with Private Data. In this section, we conduct experiments to evaluate the application of our DP mechanism AC,σ to the case where private data can be accessed. We compare 3 state-of-the-art approaches which trained directly with private data (based on DPSGD mechnism): DPSGD, TOPAGG and GM-DP on MNIST and CIFAR10 under the same settings except for the DP mechanism. The results are shown in Tab. 4. We can see that our approach achieves the best performance on both the low-dimensional MNIST dataset and the high-dimensional CIFAR10 dataset. These results depend on two aspects. On one hand, we only need to compute a new differentially private output in the first step of backpropagation instead of adding noise to each gradient like other approaches. On the other hand, we use normalization instead of clipping, which retains more gradient information in the case of small norm bound C. So our approach can achieve better results.

## 5.3 Ablation Studies

After the promising performance is achieved, we further analyze the impact of each component in our approach, including normalization vs. clipping, norm bound, noise scale, and composition of loss function.

Normalization vs. Clipping. To study the effect of different operations on the gradients, we conduct experiments with 34-layer ResNet pretrained on MNIST and FMNIST as teachers and report the results in Fig. 2. Performing normalization is significantly better than clipping when C is small, and even clipping makes the student not converge. The advantage of normalization gradually decreases as C increases, and when it increases to a certain level (about 10-3 as Fig. 2 shows), clipping will be superior to normalization. This is because normalization retains the relative size information of the gradients while clipping retains the absolute size information.

Figure 2: Student accuracy under different norm bound C and different operations on gradients ('-C' or '-N') in the case ε = 0.6 and δ = 10-5 ('-C': Clipping, '-N': Normalization)

![Image](https://ijcai.org/proceedings/2023/fulltext/243/image_000001_9a4715e1b71422309ed5c0c8c34d305a0fc4191d3ab1c396c2ce59217b625ac8.png)

Table 5: Student accuracy under different noise scale σ

| Dataset   |   σ - 20 |   σ - 50 |   σ - 100 |   σ - 200 |   σ - 500 |
|-----------|----------|----------|-----------|-----------|-----------|
| MNIST     |   0.4159 |   0.8314 |    0.9822 |    0.9815 |    0.9751 |
| FMNIST    |   0.5193 |   0.6578 |    0.8386 |    0.8053 |    0.8142 |

Norm Bound. Norm bound is an important hyperparameter of our DP mechanism AC,σ. We conduct experiments to investigate how norm bound C affects the performance of student model. The results are shown as the red and green lines in Fig. 2. As we see, the student performs better when C is small. This is because normalization preserves information about the relative size of the gradients. Although smaller C will be more affected by DP noise, it will allow more training epochs. So the student performs better when C is small.

Noise Scale. Like normbound, noise scale is also an important hyper-parameter of our DP mechanism AC,σ. To study the effect of it, we conduct experiments and the results are shown in Tab. 5. We observe that the model performance gets better as noise scale σ increases from 20 to 100. This is because a larger noise scale consumes a smaller privacy budget per epoch, which allows the student model to learn more fully with a limited privacy budget. However, we find that there is a slightly worse decrease in model performance as noise scale increases from 100 to 500. This is because the gradients will be more broken with a larger noise scale, thus leading to a slightly worse performance. In practical applications, a tradeoff should be made based on the actual situation.

Composition of Loss Functions. To check the effect of loss terms in the training generator, we investigate how each component of loss function contributes to the performance of student with 34-layer ResNet as the teacher model. We evaluate how they impact the performance by adding or removing each component and the results are shown in Tab. 6. We note that the information entropy loss term is the most important component based on the results. This is because removing it will result in an imbalance in the classes of the synthetic data. Cross entropy loss contributes differently for different datasets, with 1% improvement on the MNIST dataset and 13% improvement on the FMNIST dataset. l2- normalization is also a useful term though less critical, contributing to the 2%-3% of the performance improvement as shown in Tab. 6. In summary, all three compositions have a positive effect on the performance of the converted model.

Table 6: Impact of each term in LG. The test accuracy of student models trained on synthetic data under ε=10 is reported. CE: Cross Entropy; IE: Information Entropy; Norm: l2-Normalization.

| Dataset   | CE   | IE   | Norm   |   Accuracy |
|-----------|------|------|--------|------------|
| MNIST     |      |      |        |     0.9751 |
| MNIST     |      |      |        |     0.9691 |
| MNIST     |      |      |        |     0.5463 |
| MNIST     |      |      |        |     0.9496 |
| FMNIST    |      |      |        |     0.8988 |
| FMNIST    |      |      |        |     0.7649 |
| FMNIST    |      |      |        |     0.5463 |
| FMNIST    |      |      |        |     0.8806 |

## 6 Conclusion

Public pretrained models in model zoos may pose the risk of privacy leakage. To facilitate model deployment, we proposed a differentially private data-free distillation approach to convert sensitive teacher models into privacy-preserving student models. We train a generator for approximating the private dataset without the training data and student networks can be learned effectively through the knowledge distillation scheme. In addition, we perform normalization on the gradients of student outputs and add Gaussian noise to them to guarantee privacy. We also provide privacy analysis and convergence analysis for DPDFD. Extensive experiments are conducted to show the effectiveness of our approach. In the future, we will explore the approach in more real-world applications like federated learning on medical images.

## Acknowledgements

This work was partially supported by grants from the National Key Research and Development Plan (2020AAA0140001), and the Beijing Natural Science Foundation (19L2040).

## References

1. [Abadi et al., 2016] Martin Abadi, Andy Chu, Ian Goodfel- low, et al. Deep learning with differential privacy. In CCS, pages 308-318, 2016.
2. [Allen-Zhu, 2017] Z Natasha Allen-Zhu. Natasha 2: Faster non-convex optimization than sgd. arXiv:1708.08694, 2017.
3. [Bottou et al., 2018] Léon Bottou, Frank E Curtis, and Jorge Nocedal. Optimization methods for large-scale machine learning. SIAM Review, 60(2):223-311, 2018.
4. [Bu et al., 2022] Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Automatic clipping: Differen- tially private deep learning made easier and stronger. arXiv:2206.07136, 2022.
5. [Cao et al., 2021] Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don't generate me: Train- ing differentially private generative models with sinkhorn divergence. In NeurIPS, pages 12480-12492, 2021.
6. [Chen et al., 2019] Hanting Chen, Yunhe Wang, Chang Xu, Zhaohui Yang, Chuanjian Liu, Boxin Shi, Chunjing Xu, Chao Xu, and Qi Tian. Data-free learning of student net- works. In ICCV, pages 3514-3522, 2019.
7. [Chen et al., 2020] Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. Gs-wgan: A gradient-sanitized approach for learning differentially private generators. In NeurIPS, pages 12673-12684, 2020.
8. [Chen et al., 2022] Jia-Wei Chen, Chia-Mu Yu, Ching-Chia Kao, Tzai-Wei Pang, and Chun-Shien Lu. Dpgen: Differ- entially private generative energy-guided network for nat- ural image synthesis. In CVPR, pages 8387-8396, 2022.
9. [Choi et al., 2020] Yoojin Choi, Jihwan Choi, Mostafa El- Khamy, and Lee Jungwon. Data-free network quantization with adversarial knowledge distillation. In CVPR Work- shop, pages 710-711, 2020.
10. [Deng and Zhang, 2021] Xiang Deng and Zhongfei Zhang. Graph-free knowledge distillation for graph neural net- works. arXiv:2105.07519, 2021.
11. [Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, pages 248-255, 2009.
12. [Dosovitskiy et al., 2020] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Trans- formers for image recognition at scale. In ICLR, 2020.
13. [Dwork and Roth, 2014] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. FTTCS, pages 211-407, 2014.
14. [Dwork et al., 2006] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In TCC, pages 265-284, 2006.
15. [Fang et al., 2022] Gongfan Fang, Kanya Mo, Xinchao Wang, Jie Song, Shitao Bei, Haofei Zhang, and Mingli Song. Up to 100x faster data-free knowledge distillation. In AAAI, pages 6597-6604, 2022.
16. [Fredrikson et al., 2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In CCS, pages 1322-1333, 2015.
17. [Ge et al., 2023] Shiming Ge, Bochao Liu, Pengju Wang, Yong Li, and Dan Zeng. Learning privacy-preserving student networks via discriminative-generative distillation. IEEE TIP, 32:116-127, 2023.
18. [Ghadimi and Lan, 2013] Saeed Ghadimi and Guanghui Lan. Stochastic first-and zeroth-order methods for non- convex stochastic programming. SIAM Journal on Opti- mization, 23(4):2341-2368, 2013.
19. [Goodfellow et al., 2014] Ian Goodfellow, Jean Pouget- Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Gen- erative adversarial nets. In NeurIPS, pages 2672-2680, 2014.
20. [Harder et al., 2021] Frederik Harder, Kamil Adamczewski, and Mijung Park. Dp-merf: Differentially private mean embeddings with random features for practical privacy- preserving data generation. In AISTATS, pages 1819- 1827, 2021.
21. [He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, pages 770-778, 2016.
22. [Howard et al., 2017] Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mo- bilenets: Efficient convolutional neural networks for mo- bile vision applications. arXiv:1704.04861, 2017.
23. [Huang et al., 2016] Gao Huang, Yu Sun, Zhuang Liu, Daniel Sedra, and Kilian Q Weinberger. Deep networks with stochastic depth. In ECCV, pages 646-661, 2016.
24. [Jia et al., 2019a] Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nezihe Merve Gurel, Bo Li, Ce Zhang, Costas J Spanos, and Dawn Song. Effi- cient task-specific data valuation for nearest neighbor al- gorithms. Proc. VLDB Endow, pages 1610-1623, 2019.
25. [Jia et al., 2019b] Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. To- wards efficient data valuation based on the shapley value. In AISTATS, pages 1167-1176, 2019.
26. [Jordon et al., 2019] James Jordon, Jinsung Yoon, and Mi- haela Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In ICLR, 2019.
27. [Krizhevsky et al., 2012] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In NeurIPS, pages 1097- 1105, 2012.
28. [Krizhevsky, 2009] Alex Krizhevsky. Learning multiple lay- ers of features from tiny images. Technical report, Univer- sity of Toronto, 2009.
29. [LeCun et al., 1998] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning ap- plied to document recognition. Proceedings of the IEEE, 86(11):2278-2324, 1998.
30. [Liu et al., 2015] Ziwei Liu, Ping Luo, Xiaogang Wang, and Tang Xiaoou. Deep learning face attributes in the wild. In ICCV, pages 3730-3738, 2015.
31. [Long et al., 2021] Yunhui Long, Boxin Wang, Zhuolin Yang, Bhavya Kailkhura, Aston Zhang, Carl Gunter, and Bo Li. G-pate: Scalable differentially private data gener- ator via private aggregation of teacher discriminators. In NeurIPS, pages 2965-2977, 2021.
32. [Lopes et al., 2017] Raphael Lopes, Stefano Fenu, and Thad Starner. Data-free knowledge distillation for deep neural networks. arXiv:1710.07535, 2017.
33. [McMahan et al., 2018] H Brendan McMahan, Galen An- drew, Ulfar Erlingsson, Steve Chien, Ilya Mironov, Nico- las Papernot, and Peter Kairouz. A general approach to adding differential privacy to iterative training procedures. arXiv:1812.06210, 2018.
34. [Mironov, 2017] Ilya Mironov. Rényi differential privacy. In CSF, pages 263-275, 2017.
35. [Papernot et al., 2017] Nicolas Papernot, Martín Abadi, Ul- far Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from pri- vate training data. In ICLR, 2017.
36. [Papernot et al., 2018] Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Erlingsson. Scalable private learning with pate. In ICLR, 2018.
37. [Papernot et al., 2021] Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, and Úlfar Erlings- son. Tempered sigmoid activations for deep learning with differential privacy. In AAAI, pages 9312-9321, 2021.
38. [Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
39. [Srinivas and Babu, 2015] Suraj Srinivas and R Venkatesh Babu. Data-free parameter pruning for deep neural net- works. arXiv:1507.06149, 2015.
40. [Szegedy et al., 2015] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabi- novich. Going deeper with convolutions. In CVPR, pages 1-9, 2015.
41. [Takagi et al., 2021] Shun Takagi, Tsubasa Takahashi, Yang Cao, and Masatoshi Yoshikawa. P3gm: Private high- dimensional data release via privacy preserving phased generative model. In ICDE, pages 169-180, 2021.
42. [Wang et al., 2021] Boxin Wang, Fan Wu, Yunhui Long, Luka Rimanic, Ce Zhang, and Bo Li. Datalens: Scalable privacy preserving training via gradient compression and aggregation. In CCS, pages 2146-2168, 2021.
43. [Xiao et al., 2017] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: A novel image dataset for bench- marking machine learning algorithms. arXiv:1708.07747, 2017.
44. [Xie et al., 2018] Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv:1802.06739, 2018.
45. [Yang et al., 2019] Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang. Neural network inversion in adversar- ial setting via background knowledge alignment. In CCS, pages 225-240, 2019.
46. [Yang et al., 2021] Jiancheng Yang, Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. Medmnist v2: A large-scale lightweight benchmark for 2d and 3d biomedical image classification. arXiv:2110.14795, 2021.
47. [Ye et al., 2020] Yunan Ye, Hengzhi Pei, Boxin Wang, Pin- Yu Chen, Yada Zhu, Ju Xiao, and Bo Li. Reinforcement- learning based portfolio management with augmented as- set movement prediction states. In AAAI, pages 1112- 1119, 2020.
48. [Zagoruyko and Komodakis, 2017] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In CVPR, 2017.
49. [Zhang et al., 2018] Xiangyu Zhang, Xinyu Zhou, Mengx- iao Lin, and Jian Sun. Shufflenet: An extremely effi- cient convolutional neural network for mobile devices. In CVPR, pages 6848-6856, 2018.
50. [Zhao et al., 2022] Borui Zhao, Quan Cui, Renjie Song, Yiyu Qiu, and Jiajun Liang. Decoupled knowledge dis- tillation. In CVPR, pages 11953-11962, 2022.
51. [Zhu et al., 2021] Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. Data-free knowledge distillation for heterogeneous federated learning. In ICML, pages 12878-12889, 2021.