# Toward Training at ImageNet Scale with Differential Privacy Source: [Toward Training at ImageNet Scale with Differential Privacy]() Collection index: [llms.txt]() Data updated: 2025-12-14T18:21:08.808Z Authors: Alexey Kurakin, Shuang Song, Steve Chien, Roxana Geambasu, Andreas Terzis, Abhradeep Thakurta Published: 2022-01-28T18:48:18.000Z ## Abstract Differential privacy (DP) is the de facto standard for training machine learning (ML) models, including neural networks, while ensuring the privacy of individual examples in the training set. Despite a rich literature on how to train ML models with differential privacy, it remains extremely challenging to train real-life, large neural networks with both reasonable accuracy and privacy. We set out to investigate how to do this, using ImageNet image classification as a poster example of an ML task that is very challenging to resolve accurately with DP right now. This paper shares initial lessons from our effort, in the hope that it will inspire and inform other researchers to explore DP training at scale. We show approaches that help make DP training faster, as well as model types and settings of the training process that tend to work better in the DP setting. Combined, the methods we discuss let us train a Resnet-18 with DP to $47.9\\%$ accuracy and privacy parameters $\\epsilon = 10, \\delta = 10^{-6}$. This is a significant improvement over "naive" DP training of ImageNet models, but a far cry from the $75\\%$ accuracy that can be obtained by the same network without privacy. The model we use was pretrained on the Places365 data set as a starting point. We share our code at https://github.com/google-research/dp-imagenet, calling for others to build upon this new baseline to further improve DP at scale. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Image Classification on ImageNet (val) (Top-1/Top-5 Accuracy)](): Image Classification; ImageNet (val); Top-1 Accuracy: 6.9. - [Image Classification on ImageNet (test) (Standard Accuracy)](): Image Classification; ImageNet (test); Top-1 Accuracy: 6.2. ## Original sources and implementation [Original paper]() [PDF]() [Implementation]()