diff --git a/tutorials/Classification_Privacy.ipynb b/tutorials/Classification_Privacy.ipynb index 58f9fb3..1ceb095 100644 --- a/tutorials/Classification_Privacy.ipynb +++ b/tutorials/Classification_Privacy.ipynb @@ -1,35 +1,20 @@ { - "nbformat": 4, - "nbformat_minor": 0, - "metadata": { - "colab": { - "name": "Classification_Privacy.ipynb", - "provenance": [], - "collapsed_sections": [], - "toc_visible": true, - "include_colab_link": true - }, - "kernelspec": { - "name": "python3", - "display_name": "Python 3" - } - }, "cells": [ { "cell_type": "markdown", "metadata": { - "id": "view-in-github", - "colab_type": "text" + "colab_type": "text", + "id": "view-in-github" }, "source": [ - "\"Open" + "\u003ca href=\"https://colab.research.google.com/github/tensorflow/privacy/blob/master/tutorials/Classification_Privacy.ipynb\" target=\"_parent\"\u003e\u003cimg src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/\u003e\u003c/a\u003e" ] }, { "cell_type": "markdown", "metadata": { - "id": "XAVN6c8prKOL", - "colab_type": "text" + "colab_type": "text", + "id": "XAVN6c8prKOL" }, "source": [ "##### Copyright 2019 The TensorFlow Authors.\n", @@ -39,12 +24,14 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "SassPC7WQAUO", - "colab_type": "code", "cellView": "both", - "colab": {} + "colab": {}, + "colab_type": "code", + "id": "SassPC7WQAUO" }, + "outputs": [], "source": [ "#@title Licensed under the Apache License, Version 2.0 (the \"License\");\n", "# you may not use this file except in compliance with the License.\n", @@ -57,15 +44,13 @@ "# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n", "# See the License for the specific language governing permissions and\n", "# limitations under the License." - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "KwDK47gfLsYf", - "colab_type": "text" + "colab_type": "text", + "id": "KwDK47gfLsYf" }, "source": [ "# Implement Differential Privacy with TensorFlow Privacy" @@ -78,21 +63,21 @@ "id": "MfBg1C5NB3X0" }, "source": [ - "\n", - " \n", - " \n", - "
\n", - " Run in Google Colab\n", - " \n", - " View source on GitHub\n", - "
" + "\u003ctable class=\"tfo-notebook-buttons\" align=\"left\"\u003e\n", + " \u003ctd\u003e\n", + " \u003ca target=\"_blank\" href=\"https://colab.research.google.com/github/tensorflow/privacy/blob/master/tutorials/Classification_Privacy.ipynb\"\u003e\u003cimg src=\"https://www.tensorflow.org/images/colab_logo_32px.png\" /\u003eRun in Google Colab\u003c/a\u003e\n", + " \u003c/td\u003e\n", + " \u003ctd\u003e\n", + " \u003ca target=\"_blank\" href=\"https://github.com/tensorflow/privacy/blob/master/tutorials/Classification_Privacy.ipynb\"\u003e\u003cimg src=\"https://www.tensorflow.org/images/GitHub-Mark-32px.png\" /\u003eView source on GitHub\u003c/a\u003e\n", + " \u003c/td\u003e\n", + "\u003c/table\u003e" ] }, { "cell_type": "markdown", "metadata": { - "id": "00fQV7e0Unz3", - "colab_type": "text" + "colab_type": "text", + "id": "00fQV7e0Unz3" }, "source": [ "## Overview" @@ -101,8 +86,8 @@ { "cell_type": "markdown", "metadata": { - "id": "TUphKzYu01O9", - "colab_type": "text" + "colab_type": "text", + "id": "TUphKzYu01O9" }, "source": [ "[Differential privacy](https://en.wikipedia.org/wiki/Differential_privacy) (DP) is a framework that allows for measuring the privacy guarantees provided by a Machine Learning (ML) algorithm with respect to its input data. Recent advances allow the training of ML models with DP, greatly mitigating the risk of exposing sensitive training data in ML. Intuitively, a model trained with DP should not be affected by any single training example (or small set of training examples) in its dataset. \n", @@ -119,8 +104,8 @@ { "cell_type": "markdown", "metadata": { - "id": "ijJYKVc05DYX", - "colab_type": "text" + "colab_type": "text", + "id": "ijJYKVc05DYX" }, "source": [ "## Setup" @@ -128,28 +113,34 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "ef56gCUqrdVn", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "ef56gCUqrdVn" }, + "outputs": [], "source": [ "from __future__ import absolute_import\n", "from __future__ import division\n", "from __future__ import print_function\n", "\n", + "try:\n", + " # %tensorflow_version only exists in Colab.\n", + " %tensorflow_version 1.x\n", + "except Exception:\n", + " pass\n", + "\n", "import tensorflow as tf\n", "\n", "import numpy as np" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "r_fVhfUyeI3d", - "colab_type": "text" + "colab_type": "text", + "id": "r_fVhfUyeI3d" }, "source": [ "Install TensorFlow Privacy." @@ -157,25 +148,25 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "RseeuA7veIHU", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "RseeuA7veIHU" }, + "outputs": [], "source": [ "!pip install tensorflow_privacy\n", "\n", "from tensorflow_privacy.privacy.analysis import compute_dp_sgd_privacy\n", "from tensorflow_privacy.privacy.optimizers.dp_optimizer import DPGradientDescentGaussianOptimizer" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "mU1p8N7M5Mmn", - "colab_type": "text" + "colab_type": "text", + "id": "mU1p8N7M5Mmn" }, "source": [ "## Load and pre-process the dataset\n", @@ -185,11 +176,13 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "_1ML23FlueTr", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "_1ML23FlueTr" }, + "outputs": [], "source": [ "train, test = tf.keras.datasets.mnist.load_data()\n", "train_data, train_labels = train\n", @@ -211,15 +204,13 @@ "assert train_data.max() == 1.\n", "assert test_data.min() == 0.\n", "assert test_data.max() == 1." - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "xVDcswOCtlr3", - "colab_type": "text" + "colab_type": "text", + "id": "xVDcswOCtlr3" }, "source": [ "## Define and tune learning model hyperparameters\n", @@ -229,23 +220,23 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "E14tL1vUuTRV", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "E14tL1vUuTRV" }, + "outputs": [], "source": [ "epochs = 15\n", "batch_size = 250" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "qXNp_25y7JP2", - "colab_type": "text" + "colab_type": "text", + "id": "qXNp_25y7JP2" }, "source": [ "DP-SGD has three privacy-specific hyperparameters and one existing hyperamater that you must tune:\n", @@ -260,11 +251,13 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "pVw_r2Mq7ntd", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "pVw_r2Mq7ntd" }, + "outputs": [], "source": [ "l2_norm_clip = 1.5\n", "noise_multiplier = 1.3\n", @@ -273,15 +266,13 @@ "\n", "if batch_size % num_microbatches != 0:\n", " raise ValueError('Batch size should be an integer multiple of the number of microbatches')" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "wXAmHcNOmHc5", - "colab_type": "text" + "colab_type": "text", + "id": "wXAmHcNOmHc5" }, "source": [ "## Build the learning model\n", @@ -291,11 +282,13 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "oCOo8aOLmFta", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "oCOo8aOLmFta" }, + "outputs": [], "source": [ "model = tf.keras.Sequential([\n", " tf.keras.layers.Conv2D(16, 8,\n", @@ -313,15 +306,13 @@ " tf.keras.layers.Dense(32, activation='relu'),\n", " tf.keras.layers.Dense(10, activation='softmax')\n", "])" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "FT4lByFg-I_r", - "colab_type": "text" + "colab_type": "text", + "id": "FT4lByFg-I_r" }, "source": [ "Define the optimizer and loss function for the learning model. Compute the loss as a vector of losses per-example rather than as the mean over a minibatch to support gradient manipulation over each training point. " @@ -329,11 +320,13 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "bqBvjCf5-ZXy", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "bqBvjCf5-ZXy" }, + "outputs": [], "source": [ "optimizer = DPGradientDescentGaussianOptimizer(\n", " l2_norm_clip=l2_norm_clip,\n", @@ -343,15 +336,13 @@ "\n", "loss = tf.keras.losses.CategoricalCrossentropy(\n", " from_logits=True, reduction=tf.losses.Reduction.NONE)" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "LI_3nXzEGmrP", - "colab_type": "text" + "colab_type": "text", + "id": "LI_3nXzEGmrP" }, "source": [ "## Compile and train the learning model\n" @@ -359,11 +350,13 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "z4iV03VqG1Bo", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "z4iV03VqG1Bo" }, + "outputs": [], "source": [ "model.compile(optimizer=optimizer, loss=loss, metrics=['accuracy'])\n", "\n", @@ -371,15 +364,13 @@ " epochs=epochs,\n", " validation_data=(test_data, test_labels),\n", " batch_size=batch_size)" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "TL7_lX5sHCTI", - "colab_type": "text" + "colab_type": "text", + "id": "TL7_lX5sHCTI" }, "source": [ "## Measure the differential privacy guarantee\n", @@ -397,8 +388,8 @@ { "cell_type": "markdown", "metadata": { - "id": "wUEk25pgmnm-", - "colab_type": "text" + "colab_type": "text", + "id": "wUEk25pgmnm-" }, "source": [ "Two metrics are used to express the DP guarantee of an ML algorithm:\n", @@ -417,22 +408,22 @@ }, { "cell_type": "code", + "execution_count": 0, "metadata": { - "id": "ws8-nVuVDgtJ", + "colab": {}, "colab_type": "code", - "colab": {} + "id": "ws8-nVuVDgtJ" }, + "outputs": [], "source": [ "compute_dp_sgd_privacy.compute_dp_sgd_privacy(n=60000, batch_size=250, noise_multiplier=1.3, epochs=15, delta=1e-5)" - ], - "execution_count": 0, - "outputs": [] + ] }, { "cell_type": "markdown", "metadata": { - "id": "c-KyttEWFRDc", - "colab_type": "text" + "colab_type": "text", + "id": "c-KyttEWFRDc" }, "source": [ "The tool reports that for the hyperparameters chosen above, the trained model has an $\\epsilon$ value of 1.18." @@ -441,8 +432,8 @@ { "cell_type": "markdown", "metadata": { - "id": "SA_9HMGBWFM3", - "colab_type": "text" + "colab_type": "text", + "id": "SA_9HMGBWFM3" }, "source": [ "## Summary\n", @@ -452,5 +443,19 @@ "* Measure the privacy guarantee provided using analysis tools included in TensorFlow Privacy" ] } - ] + ], + "metadata": { + "colab": { + "collapsed_sections": [], + "name": "Classification_Privacy.ipynb", + "provenance": [], + "toc_visible": true + }, + "kernelspec": { + "display_name": "Python 3", + "name": "python3" + } + }, + "nbformat": 4, + "nbformat_minor": 0 }