{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,24]],"date-time":"2025-08-24T00:02:19Z","timestamp":1755993739691,"version":"3.44.0"},"publisher-location":"New York, NY, USA","reference-count":39,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,26]],"date-time":"2023-11-26T00:00:00Z","timestamp":1700956800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Bavarian State Ministry for Science and the Arts"},{"name":"ERC Deep4MI","award":["884622"],"award-info":[{"award-number":["884622"]}]},{"name":"German Federal Ministry of Education and Research"},{"name":"Special Research Programme of the State of Bavaria","award":["Privacy-preserving machine learning for nosocomial infection chain tracing"],"award-info":[{"award-number":["Privacy-preserving machine learning for nosocomial infection chain tracing"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,30]]},"DOI":"10.1145\/3605764.3623902","type":"proceedings-article","created":{"date-parts":[[2023,11,21]],"date-time":"2023-11-21T12:12:17Z","timestamp":1700568737000},"page":"11-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3218-7976","authenticated-orcid":false,"given":"Florian A.","family":"H\u00f6lzl","sequence":"first","affiliation":[{"name":"Technical University of Munich, Munich, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5683-5889","authenticated-orcid":false,"given":"Daniel","family":"Rueckert","sequence":"additional","affiliation":[{"name":"Imperial College London &amp; Technical University of Munich, Munich, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8382-8062","authenticated-orcid":false,"given":"Georgios","family":"Kaissis","sequence":"additional","affiliation":[{"name":"Helmholtz Munich &amp; Technical University of Munich, Munich, Germany"}]}],"member":"320","published-online":{"date-parts":[[2023,11,26]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_2_1_2_1","volume-title":"Deep Learning using Rectified Linear Units (ReLU). ArXiv abs\/1803.08375","author":"Agarap Abien Fred","year":"2018","unstructured":"Abien Fred Agarap. 2018. Deep Learning using Rectified Linear Units (ReLU). ArXiv abs\/1803.08375 (2018)."},{"key":"e_1_3_2_1_3_1","volume-title":"Reconstructing Training Data with Informed Adversaries. 2022 IEEE Symposium on Security and Privacy (SP)","author":"Balle Borja","year":"2022","unstructured":"Borja Balle, Giovanni Cherubin, and Jamie Hayes. 2022. Reconstructing Training Data with Informed Adversaries. 2022 IEEE Symposium on Security and Privacy (SP) (2022), 1138--1156."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1175\/1520-0493(1950)078<0001:VOFEIT>2.0.CO;2"},{"key":"e_1_3_2_1_5_1","volume-title":"30th USENIX Security Symposium (USENIX Security . USENIX Association, 2633--2650","author":"Carlini Nicholas","year":"2021","unstructured":"Nicholas Carlini, Florian Tram\u00e8r, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Xiaodong Song, \u00dalfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security . USENIX Association, 2633--2650. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/carlini-extracting"},{"key":"e_1_3_2_1_6_1","unstructured":"Gabriele Cesa Leon Lang and Maurice Weiler. 2022. A Program to Build E(N)-Equivariant Steerable CNNs. In ICLR."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1115\/1.1421108"},{"key":"e_1_3_2_1_8_1","volume-title":"A Downsampled Variant of ImageNet as an Alternative to the CIFAR Datasets. ArXiv abs\/1707.08819","author":"Chrabaszcz Patryk","year":"2017","unstructured":"Patryk Chrabaszcz, Ilya Loshchilov, and Frank Hutter. 2017. A Downsampled Variant of ImageNet as an Alternative to the CIFAR Datasets. ArXiv abs\/1707.08819 (2017)."},{"key":"e_1_3_2_1_9_1","volume-title":"ArXiv abs\/1801.10130","author":"Cohen Taco","year":"2018","unstructured":"Taco Cohen, Mario Geiger, Jonas K\u00f6hler, and MaxWelling. 2018. Spherical CNNs. ArXiv abs\/1801.10130 (2018)."},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of The 33rd International Conference on Machine Learning (Proceedings of Machine Learning Research","volume":"2999","author":"Cohen Taco","year":"2016","unstructured":"Taco Cohen and Max Welling. 2016. Group Equivariant Convolutional Networks. In Proceedings of The 33rd International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 48), Maria Florina Balcan and Kilian Q. Weinberger (Eds.). PMLR, New York, New York, USA, 2990--2999. https:\/\/proceedings.mlr.press\/v48\/cohenc16.html"},{"key":"e_1_3_2_1_11_1","volume-title":"Steerable CNNs. In International Conference on Learning Representations.","author":"Cohen Taco","year":"2017","unstructured":"Taco Cohen and Max Welling. 2017. Steerable CNNs. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_12_1","volume-title":"Unlocking High-Accuracy Differentially Private Image Classification through Scale. ArXiv abs\/2204.13650","author":"De Soham","year":"2022","unstructured":"Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, and Borja Balle. 2022. Unlocking High-Accuracy Differentially Private Image Classification through Scale. ArXiv abs\/2204.13650 (2022)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.0437847100"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/MLSP52302.2021.9596307"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1561\/0400000042"},{"key":"e_1_3_2_1_16_1","volume-title":"Smith","author":"Fort Stanislav","year":"2021","unstructured":"Stanislav Fort, Andrew Brock, Razvan Pascanu, Soham De, and Samuel L. Smith. 2021. Drawing Multiple Augmentation Samples Per Image During Training Efficiently Decreases Test Error. ArXiv abs\/2105.13343 (2021)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","unstructured":"Mario Geiger and Tess Smidt. 2022. e3nn: Euclidean Neural Networks. https:\/\/doi.org\/10.48550\/ARXIV.2207.09453","DOI":"10.48550\/ARXIV.2207.09453"},{"key":"e_1_3_2_1_18_1","volume-title":"Mixed Differential Privacy in Computer Vision. 2022 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Golatkar Aditya","year":"2022","unstructured":"Aditya Golatkar, Alessandro Achille, Yu-Xiang Wang, Aaron Roth, Michael Kearns, and Stefano Soatto. 2022. Mixed Differential Privacy in Computer Vision. 2022 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2022), 8366--8376."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00502"},{"key":"e_1_3_2_1_20_1","article-title":"Sparsity in Deep Learning: Pruning and Growth for Efficient Inference and Training in Neural Networks","volume":"22","author":"Hoefler Torsten","year":"2021","unstructured":"Torsten Hoefler, Dan Alistarh, Tal Ben-Nun, Nikoli Dryden, and Alexandra Peste. 2021. Sparsity in Deep Learning: Pruning and Growth for Efficient Inference and Training in Neural Networks. J. Mach. Learn. Res. 22 (2021), 241:1--241:124.","journal-title":"J. Mach. Learn. Res."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00815"},{"key":"e_1_3_2_1_22_1","volume-title":"Tsubasa Takahashi, Yuya Sasaki, and Makoto Onizuka.","author":"Ito Ryuichi","year":"2022","unstructured":"Ryuichi Ito, Seng Pei Liew, Tsubasa Takahashi, Yuya Sasaki, and Makoto Onizuka. 2022. Scaling Private Deep Learning with Low-Rank and Sparse Gradients. ArXiv abs\/2207.02699 (2022)."},{"key":"e_1_3_2_1_23_1","volume-title":"Differentially Private Training of Residual Networks with Scale Normalisation. In ICML Theory and Practice of Differential Privacy Workshop.","author":"Klause Helena","year":"2022","unstructured":"Helena Klause, Alexander Ziller, Daniel Rueckert, Kerstin Hammernik, and Georgios Kaissis. 2022. Differentially Private Training of Residual Networks with Scale Normalisation. In ICML Theory and Practice of Differential Privacy Workshop."},{"key":"e_1_3_2_1_24_1","unstructured":"Moritz Knolle Alexander Ziller Dmitrii Usynin Rickmer F. Braren Marcus R. Makowski Daniel Rueckert and G. Kaissis. 2021. Differentially Private Training of Neural Networks with Langevin Dynamics for Calibrated Predictive Uncertainty. ArXiv abs\/2107.04296 (2021)."},{"key":"e_1_3_2_1_25_1","volume-title":"Toward Training at ImageNet Scale with Differential Privacy. ArXiv abs\/2201.12328","author":"Kurakin Alexey","year":"2022","unstructured":"Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, A. Terzis, and Abhradeep Thakurta. 2022. Toward Training at ImageNet Scale with Differential Privacy. ArXiv abs\/2201.12328 (2022)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","unstructured":"Xueyan Mei Zelong Liu Philip M. Robson Brett Marinelli Mingqian Huang Amish Doshi Adam Jacobi Chendi Cao Katherine E. Link Thomas Yang Ying Wang Hayit Greenspan Timothy Deyer Zahi A. Fayad and Yang Yang. 0. RadImageNet: An Open Radiologic Deep Learning Research Dataset for Effective Transfer Learning. Radiology: Artificial Intelligence 0 ja (0) e210315. https:\/\/doi.org\/10.1148\/ryai.210315 arXiv:https:\/\/doi.org\/10.1148\/ryai.210315","DOI":"10.1148\/ryai.210315"},{"key":"e_1_3_2_1_27_1","volume-title":"R\u00e9nyi Differential Privacy. 2017 IEEE 30th Computer Security Foundations Symposium (CSF)","author":"Mironov Ilya","year":"2017","unstructured":"Ilya Mironov. 2017. R\u00e9nyi Differential Privacy. 2017 IEEE 30th Computer Security Foundations Symposium (CSF) (2017), 263--275."},{"key":"e_1_3_2_1_28_1","volume-title":"R\u00e9nyi Differential Privacy of the Sampled Gaussian Mechanism. ArXiv abs\/1908.10530","author":"Mironov Ilya","year":"2019","unstructured":"Ilya Mironov, Kunal Talwar, and Li Zhang. 2019. R\u00e9nyi Differential Privacy of the Sampled Gaussian Mechanism. ArXiv abs\/1908.10530 (2019)."},{"key":"e_1_3_2_1_29_1","volume-title":"Mish: A Self Regularized Non-Monotonic Activation Function. In BMVC.","author":"Misra Diganta","year":"2020","unstructured":"Diganta Misra. 2020. Mish: A Self Regularized Non-Monotonic Activation Function. In BMVC."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1137\/0330046"},{"key":"e_1_3_2_1_31_1","volume-title":"ArXiv abs\/1903.10520","author":"Qiao Siyuan","year":"2019","unstructured":"Siyuan Qiao, Huiyu Wang, Chenxi Liu, Wei Shen, and Alan Loddon Yuille. 2019. Weight Standardization. ArXiv abs\/1903.10520 (2019)."},{"key":"e_1_3_2_1_32_1","volume-title":"TAN without a Burn: Scaling Laws of DP-SGD. ArXiv abs\/2210.03403","author":"Sander Tom","year":"2022","unstructured":"Tom Sander, Pierre Stock, and Alexandre Sablayrolles. 2022. TAN without a Burn: Scaling Laws of DP-SGD. ArXiv abs\/2210.03403 (2022)."},{"key":"e_1_3_2_1_33_1","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR).","author":"Tram\u00e8r Florian","year":"2021","unstructured":"Florian Tram\u00e8r and Dan Boneh. 2021. Differentially Private Learning Needs Better Features (or Much More Data). In Proceedings of the International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_1_34_1","volume-title":"Considerations for Differentially Private Learning with Large-Scale Public Pretraining. ArXiv abs\/2212.06470","author":"Tram\u00e8r Florian","year":"2022","unstructured":"Florian Tram\u00e8r, Gautam Kamath, and Nicholas Carlini. 2022. Considerations for Differentially Private Learning with Large-Scale Public Pretraining. ArXiv abs\/2212.06470 (2022)."},{"key":"e_1_3_2_1_35_1","volume-title":"Advances in Neural Information Processing Systems 32","author":"Weiler Maurice","year":"2019","unstructured":"Maurice Weiler and Gabriele Cesa. 2019. General E(2)-Equivariant Steerable CNNs. Advances in Neural Information Processing Systems 32 (2019)."},{"key":"e_1_3_2_1_36_1","volume-title":"Learning Steerable Filters for Rotation Equivariant CNNs. 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition","author":"Hamprecht Fred A.","year":"2018","unstructured":"MauriceWeiler, Fred A. Hamprecht, and Martin Storath. 2018. Learning Steerable Filters for Rotation Equivariant CNNs. 2018 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (2018), 849--858."},{"key":"e_1_3_2_1_37_1","volume-title":"Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning. ArXiv abs\/2102.12677","author":"Yu Da","year":"2021","unstructured":"Da Yu, Huishuai Zhang, Wei Chen, and Tie-Yan Liu. 2021. Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning. ArXiv abs\/2102.12677 (2021)."},{"key":"e_1_3_2_1_38_1","volume-title":"A Closer Look at the Calibration of Differentially Private Learners. ArXiv abs\/2210.08248","author":"Zhang Hanlin","year":"2022","unstructured":"Hanlin Zhang, Xuechen Li, Prithviraj Sen, Salim Roukos, and Tatsunori Hashimoto. 2022. A Closer Look at the Calibration of Differentially Private Learners. ArXiv abs\/2210.08248 (2022)."},{"key":"e_1_3_2_1_39_1","volume-title":"Blaschko","author":"Zhu Junyi","year":"2021","unstructured":"Junyi Zhu and Matthew B. Blaschko. 2021. Differentially Private SGD with Sparse Gradients. In arXiv preprint arXiv:2112.00845."}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Copenhagen Denmark","acronym":"CCS '23"},"container-title":["Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605764.3623902","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3605764.3623902","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T01:37:45Z","timestamp":1755913065000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605764.3623902"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,26]]},"references-count":39,"alternative-id":["10.1145\/3605764.3623902","10.1145\/3605764"],"URL":"https:\/\/doi.org\/10.1145\/3605764.3623902","relation":{},"subject":[],"published":{"date-parts":[[2023,11,26]]},"assertion":[{"value":"2023-11-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}