Weekly Updates for Pujan Budhathoki

Pujan:

Hello everyone,

Milestone: Dec 10: Present on the current scenario of Privacy testing and my previously read papers and set a new milestone based on the feedback I receive on that presentation

I will present on the scenario of Privacy Testing and previously read papers on the Friday Meeting.

Action Items Completed this week:

1. Literature review, Zhang, H., Roth, E., Haeberlen, A., Pierce, B. C., & Roth, A. (2020). Testing differential privacy with dual interpreters. Proceedings of the ACM on Programming Languages, 4(OOPSLA), 1-26. This was one of the papers that Krishna suggested to me and I read this in preparation for my presentation. This is a white-box testing method for DP.

1. I was mostly busy with the final exam and grading last week so I couldn’t meet with Krishna last week. I will have a meeting with him this week.

Replies:

Dr. Lei:

look forward to your presentation today

---

Pujan:

Dr. Lei, I’m feeling a bit under the weather myself today and I want to run it through Krishna before I present it to the group so I’ll present it in the Friday meeting. I apologize for the inconvenience.

---

Pujan:

Hello everyone,

Milestone: Dec 10: Present on the current scenario of Privacy testing and my previously read papers and set a new milestone based on the feedback I receive on that presentation

I spent most of my time last week at my relatives for thanksgiving and I was studying for my final exam which was yesterday so I couldn’t commit much time to research. Also, I have to finish all of the TA grading by Friday so I’ve been very busy with that.

Meeting minutes for meeting with Krishna:

Topic: Privacy Testing in General

• I presented on the current focus of research in privacy testing.

• Concluded that Differential Privacy is the primary protection method being tested

Topic: White Box DP Testing methods

• Krishna had suggested some papers beforehand related to whitebox testing DP testing

• These techniques involved whitebox code testing and could be used for finding bugs in implementation but their pros are that they require whitebox access and we need to design different tests for each implementation

Topic: Black box DP Testing

• I presented on these methods to Krishna

• These methods have been my focus for some time

• They involve probabilistic and statistical techniques to find the upper bound for level of privacy provided

• They are a black box testing method and can be used universally to test almost all implementations

Replies:

Dr. Lei:

good that you are working with krishna. keep it up

---

Pujan:

Hello everyone,

Milestone: Set a new milestone based on the feedback I receive on my presentation on Friday Meeting

I had multiple Project/Assignment deadlines last week so I couldn’t commit much time to research

Actions Items completed:

1. I have been working on my presentation summarizing everything I have read so far and the general scenario of privacy testing in machine learning. I will present it in the Friday meeting.

I have project presentations going on in my GTA class right before the meeting so I could be 5-10 minutes late in today’s meeting.

Pujan:

Hi Dr Lei, my professor has scheduled an online class today during the meeting time to finish the coursework. The attendance carries points in this course so I won’t be able to miss this class. So, I won’t be able to join the online meeting today. I apologize for the inconvenience.

Pujan:

Hello everyone,

Milestone: Nov 26:Create a summarized presentation of everything I have read so far and the overall scenario of Privacy Testing in Machine learning

Action Items completed:

1. Literature review, “Empirically Testing Privacy in Machine Learning” by Flavio Hafner and Chang Sun (March 2024)” : Provides an overview of all the different empirical privacy testing methods in Machine learning

1. I have been searching for scenarios where we can test the whole deployment for finding bugs in the implementation instead of testing just the library that provides privacy to the model. So far, I’ve only found services and libraries that help deploy privacy preserving machine learning systems but not any testable deployed systems themselves.

1. Based on the feedback I received on last week’s meeting, I am also starting to put together everything I have read so far to provide a presentation on summary of topics I have explored and the current scenario of Privacy Testing in Machine Learning

Pujan:

Hello everyone,

Milestones: Nov 12: Present findings related to the new approach

I was very sick the whole week last week so I couldn’t get much done. I’m currently still searching for information on possible service providers(or services) where I can test their whole implementation. (Following up on the discussion we had)

Replies:

Dr. Lei:

hope you have recovered. what do you mean by service providers?

---

Pujan:

Hello everyone,

Milestones: Nov 5:Present findings related to new approach as discussed in the last meeting

I have been feeling very ill and won’t be able to give the new idea presentation tomorrow. I will give the presentation at the Friday meeting instead. I will join tomorrow’s meeting if I feel a little better tomorrow.

Actions Items Completed:

1. I have been researching information on possible service providers(or services) where I can test their whole implementation. (Following up on the discussion we had). So far I have only come across service providers similar to Tumult Labs that provide a comprehensive platform focused on differential privacy, allowing organizations to safely use, share, and monetize sensitive data while ensuring individual privacy. I will research some more on this and present my findings next week.

Pujan:

Hello everyone,

Milestones: Oct 29:Present findings related to new approach as discussed in the last meeting

I’m postponing the previous milestones regarding setting up and running experiments until I’ve investigated and presented my new baseline approach based on the new discussion we had

Action Items:

1. I’m currently investigating any relevant papers or information regarding service providers who claim that their machine learning implementation satisfies differential privacy.

Pujan:

Milestone: Oct 24:Setup experiments integrating Influence function

Oct 31:Present experimental results with use of influence functions

Actions Items completed this week:

1. Literature review:

• Koskela, Antti, and Jafar Mohammadi. “Black Box Differential Privacy Auditing Using Total Variation Distance.” arXiv preprint arXiv:2406.04827 (2024).

• Lu, Yun, et al. “Eureka: a general framework for black-box differential privacy estimators.” 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024

These two papers were published very recently for testing privacy of differential privacy in a black box setting. I am currently trying to fully understand the methodology of the second(Eureka) paper(Published in September), their methodology promises lots of improvements over current methods.

1. I will present my updated Baseline Approach in the Friday meeting.

Replies:

Dr. Lei:

at this point, the key concern is to have a reasonable baseline, which should include clearly specified input/output, the key insight, and a step-by-step process.

---

Pujan:

Milestone: Oct 24:Setup experiment integrating Influence function

Oct 15:Present Updated Baseline Approach

Oct 31:Present experimental results with use of influence functions

Action Items completed in previous weeks:

1. Setup base experiment based on other papers

1. Literature review on the use of influence functions

I had the final exam for a subject today and have a project due this Friday so I have been mostly busy preparing for that.

I have been currently exploring the use of influence functions, this will give the most influential training points which can be changed to bring maximum change in output for detecting possible violations of privacy. I will explain more about this in my updated baseline approach presentation next week.

Replies:

Dr. Lei:

Glad that you are the first one to send out the status update. In terms of action times, I would like to see more on the “result”, i.e., what you have achieved. For example, what do you mean by “setup base experiment based on other papers”? are you able to run those experiments or not? also, on the literature review, what papers you have read, and what interesting ideas you have found from these papers? try to make your status updates as meaningful/informative as possible, especially from the reader’s perspective.

---

Pujan:

I understand Dr. Lei, I will keep these in mind moving forward. Regarding the base experiment setup, yes I can run them. I am basing it on the experiment setup by another paper, it runs but because of the time taken, I haven’t completed running the experiments. I have to set up a parallelizing mechanism like nohup for it to run quicker. I’m looking into integrating the Influence functions into the setup.

And regarding the papers, the two papers I read were:

1. Suzuki, Kenji, Yoshiyuki Kobayashi, and Takuya Narihira. “Data cleansing for deep neural networks with storage-efficient approximation of influence functions.” arXiv preprint arXiv:2103.11807 (2021).

1. Koh, Pang Wei, and Percy Liang. “Understanding black-box predictions via influence functions.” International conference on machine learning. PMLR, 2017.

I am currently exploring the idea of SGD Influence functions based on the first paper, because of its claims of efficiency compared to other methods of Influence functions.

---

No update was provided for the week ending 2024-10-02.

Pujan:

Hello everyone,

Milestone: Setup and carry initial experiment by 9/27

Action Items completed this week:

1. Literature Review, Garrido, G. M., Liu, X., Matthes, F., & Song, D. (2022). Lessons learned: Surveying the practicality of differential privacy in the industry. arXiv preprint arXiv:2211.03898.

1. I have been following Krishna’s feedback to further refine my baseline approach.

Replies:

Dr. Lei:

try not to miss the milestone

---

Pujan:

Hello everyone,

Milestone: Setup and carry initial experiment by 9/27

• Setup base experiment used by other papers 9/20

Action Items completed this week:

1. I have been working with Krishna on refining my baseline. Because I have an exam this week too and a project deadline, I haven’t been able to make much time for it. I have an 8 week course that ends on Oct 7, after which I should have plenty of time.

Pujan:

Hello everyone,

Milestone:Setup and carry out initial experiments by 9/27

• Finalize baseline approach 9/13

• Setup base experiment used by other papers 9/20

I have an exam on Wednesday so I have been mostly preparing for that

Action Items completed this week:

1. I have been carrying out more literature reviews related to my baseline approach.

1. Literature review, Koh, Pang Wei, and Percy Liang. “Understanding black-box predictions via influence functions.” International conference on machine learning. PMLR, 2017

I’ll be presenting for the new idea session tomorrow.

Replies:

Dr. Lei:

sounds good. please discuss the baseline approach with krishna and present to the group

---