Calculating the privacy for the standard optimizer

[FelixNeutatz]

Dear all,

I would like to extend the question that was raised in the Issue https://github.com/tensorflow/privacy/issues/136

I would like to know how much worse is it to run a standard optimizer, such as Adam, in terms of privacy:

from sklearn.model_selection import train_test_split
from sklearn.datasets import load_wine
import tensorflow as tf
import matplotlib.pyplot as plt
from tensorflow_privacy.privacy.analysis import compute_dp_sgd_privacy
from tensorflow_privacy.privacy.optimizers.dp_optimizer import DPGradientDescentGaussianOptimizer

features, target = load_wine(return_X_y=True)
X_train, X_test, y_train, y_test = train_test_split(features, target, test_size=0.30, random_state=42)
y_train, y_test = tf.keras.utils.to_categorical(y_train), tf.keras.utils.to_categorical(y_test)

input_dim = X_train.shape[1]
class_num = y_train.shape[1]

model = tf.keras.Sequential()
model.add(tf.keras.layers.Dense(units=50, activation='relu', input_dim=input_dim))
model.add(tf.keras.layers.Dense(units=class_num, activation='softmax'))

l2_norm_clip = 1.5
noise_multiplier = 1.3
num_microbatches = 1
learning_rate = 0.007

optimizer = tf.keras.optimizers.Adam(lr=learning_rate)

'''
optimizer = DPGradientDescentGaussianOptimizer(
    l2_norm_clip=l2_norm_clip,
    noise_multiplier=noise_multiplier,
    num_microbatches=num_microbatches,
    learning_rate=learning_rate)
'''

model.compile(loss='categorical_crossentropy', optimizer=optimizer, metrics=['accuracy'])
history = model.fit(X_train, y_train, epochs=800, validation_data=(X_test, y_test), shuffle=False, verbose=0)

compute_dp_sgd_privacy.compute_dp_sgd_privacy(n=60000, batch_size=1, noise_multiplier=1.3, epochs=15, delta=1e-5)

As https://github.com/tensorflow/privacy/issues/136 stated, we cannot use compute_dp_sgd_privacy because it assumes randomization and Adam does not perform this way. Is there any other way to measure privacy of the Adam optimizer?

Thank you for your help.

Best regards, Felix