  Machine learning models are known to memorize private data to reduce their
training loss, which can be inadvertently exploited by privacy attacks such as
model inversion and membership inference. To protect against these attacks,
differential privacy (DP) has become the de facto standard for
privacy-preserving machine learning, particularly those popular training
algorithms using stochastic gradient descent, such as DPSGD. Nonetheless, DPSGD
still suffers from severe utility loss due to its slow convergence. This is
partially caused by the random sampling, which brings bias and variance to the
gradient, and partially by the Gaussian noise, which leads to fluctuation of
gradient updates.
  Our key idea to address these issues is to apply selective updates to the
model training, while discarding those useless or even harmful updates.
Motivated by this, this paper proposes DPSUR, a Differentially Private training
framework based on Selective Updates and Release, where the gradient from each
iteration is evaluated based on a validation test, and only those updates
leading to convergence are applied to the model. As such, DPSUR ensures the
training in the right direction and thus can achieve faster convergence than
DPSGD. The main challenges lie in two aspects -- privacy concerns arising from
gradient evaluation, and gradient selection strategy for model update. To
address the challenges, DPSUR introduces a clipping strategy for update
randomization and a threshold mechanism for gradient selection. Experiments
conducted on MNIST, FMNIST, CIFAR-10, and IMDB datasets show that DPSUR
significantly outperforms previous works in terms of convergence speed and
model utility.
