Private Aggregation of Teacher Ensembles (PATE)

The foundational privacy mechanism of PATE. The sensitive training dataset is partitioned into non-overlapping subsets, and a separate teacher model is trained exclusively on each subset.

• Data Isolation: No single teacher sees the entire dataset, limiting the information any one model can leak.
• Parallel Architecture: Teachers can be trained independently and in parallel, scaling with the number of data partitions.
• Sensitive Domain Application: This partitioning is critical for medical imaging and financial records where data cannot be commingled due to regulatory constraints.

The student model queries the teacher ensemble, and the teachers vote on the predicted class. Calibrated random noise is added to the vote counts before the result is revealed to the student.

• Laplace Noise: Noise is drawn from a Laplace distribution scaled by the sensitivity of the voting function.
• Privacy Budget Accounting: Each query to the teachers consumes a portion of the overall privacy budget (epsilon), tracked via the moments accountant.
• Selective Revelation: Only the noisy argmax (the winning class) is typically shared with the student, not the full vote histogram, minimizing information leakage.

The student model is trained exclusively on public, unlabeled data using the noisy labels generated by the teacher ensemble. The student never accesses the original sensitive training data.

• Public Data Reliance: The quality of the student depends on the availability of a representative public dataset that matches the distribution of the private data.
• Soft Label Transfer: Teachers can provide soft probability distributions over classes, transferring richer dark knowledge than hard labels.
• Final Deployment Artifact: Only the student model is published or exposed via API. The teacher ensemble and sensitive data remain isolated in a secure enclave.

PATE provides a formal (ε, δ)-differential privacy guarantee. The privacy loss parameter ε quantifies the maximum information an adversary can gain about any single training record.

• Provable Bound: The privacy guarantee is mathematical, not heuristic. It holds against adversaries with arbitrary auxiliary information.
• Composition Tracking: The moments accountant tightly tracks privacy loss across multiple student queries, preventing privacy budget overruns.
• Tunable Privacy-Utility Trade-off: Increasing noise protects privacy but reduces label accuracy. Decreasing noise improves student performance but consumes the privacy budget faster.

The PATE framework can be extended with a Generative Adversarial Network (GAN) to generate synthetic labeled data for the student, reducing reliance on real public data.

• Private Data Generation: The teacher ensemble labels samples produced by a generator, and a discriminator ensures the synthetic data is realistic.
• Unlimited Student Training: Once the generator is trained, it can produce an arbitrary amount of labeled synthetic data without further privacy budget consumption.
• Enhanced Utility: This approach often yields higher student accuracy compared to using limited real public data, especially when public data is scarce or mismatched.

To conserve the privacy budget, the teacher ensemble can abstain from answering queries where the consensus is weak or the privacy cost is too high.

• Confidence Thresholding: The teachers only respond if the noisy vote margin exceeds a predefined threshold, ensuring answers are both accurate and privacy-efficient.
• Adaptive Budget Allocation: More privacy budget can be allocated to difficult or critical queries while saving budget on easy, high-consensus examples.
• Query Auditing Integration: This mechanism naturally pairs with query auditing systems to detect and block malicious sequences of queries designed to extract private information.

The training paradigm that PATE leverages. A student model is trained not on raw data, but on the aggregated, noisy predictions of an ensemble of teacher models.

• Soft Labels: The student learns from the teachers' probability distributions
• Compression: Transfers knowledge from a complex ensemble to a single deployable model
• Privacy Bridge: The distillation process is the point where differential privacy is enforced

The architectural prerequisite for PATE's privacy guarantee. The training dataset is split into disjoint shards, with each teacher trained exclusively on a single partition.

• Non-Overlapping: No data point is seen by more than one teacher
• Independence: Limits the influence of any single record on the ensemble's consensus
• Containment: A breach of one teacher exposes only its specific shard

The core privacy operation where individual teacher votes are counted and calibrated noise is injected before the student sees the label.

• Gaussian Noisy Max (GNMax): A common PATE mechanism that adds Gaussian noise to vote counts and selects the highest
• Confidence Thresholding: The student only learns from queries where the noisy consensus is strong, conserving the privacy budget
• Privacy Amplification: The act of aggregating votes from a diverse ensemble inherently obscures individual contributions

A finite, quantifiable resource consumed by each student query during PATE training. The total privacy loss is bounded by the moments accountant.

• Moments Accountant: A technique to tightly track cumulative privacy loss across multiple queries
• Budget Depletion: Once the epsilon budget is exhausted, no further queries can be answered without compromising the guarantee
• Trade-off: A smaller epsilon means stronger privacy but typically requires more noise, potentially reducing student accuracy

The primary threat model that PATE is designed to defeat. An attacker with black-box API access attempts to reconstruct representative training samples by repeatedly querying a model.

• Exploitation: Attackers use confidence scores to iteratively optimize a random input into a recognizable face or data record
• PATE Defense: The noisy, thresholded voting process masks the fine-grained confidence scores that inversion attacks rely on
• Protection: PATE severs the direct link between the output and any single teacher's memorized data