Trustworthy Machine Learning from an Optimization Lens
Optimization techniques for modern considerations such as privacy, robustness and fairness in machine learning.
Course Description and Objectives
Optimization techniques lie at the heart of how models are trained and developed. In this course, we will explore modern considerations such as privacy, robustness and fairness, particularly from the standpoint of optimization techniques. We will both discuss recent research work on formalizing these societal requirements, and algorithmic solutions for obtaining them. Optimization-based approaches such as differentially private optimization, minimax and constrained optimization are particularly useful toolboxes for these problems, and will be explored in this context.
Recommended Preparation
Machine learning knowledge (at the level of CSCI 567, CSCI 467, or ISE 529 is sufficient) using Python. Basic optimization knowledge, basic probability and linear algebra concepts. Mathematical maturity to read research papers.
Syllabus and Materials
The following is a tentative schedule. We will post lecture notes and assignments here. Additional related reading for all lectures will be posted on ed discussion after the lecture.
| Lecture | Topics | Lecture notes | Homework |
|---|---|---|---|
| 1, 08/27 | Course introduction, ML basics, Adversarial examples, Finding adversarial examples, Adversarial training | Lecture slides | |
| 2, 09/03 | Certified robustness, randomized smoothing, data poisoning Paper presentations: (1) Recent Advances in Algorithmic High-Dimensional Robust Statistics (also see Robustness Meets Algorithms) (2) Jailbreaking Black Box Large Language Models in Twenty Queries | Lecture slides | |
| 3, 09/10 | Undetectable backdoors, tradeoffs in adversarial robustness Paper presentations: (1) Deliberative Alignment: Reasoning Enables Safer Language Models (briefly cover Adversarial Reasoning at Jailbreaking Time) (2) Do ImageNet Classifiers Generalize to ImageNet? (3) Accuracy on the Line: On the Strong Correlation Between Out-of-Distribution and In-Distribution Generalization (briefly cover Accuracy on the wrong line: On the pitfalls of noisy data for out-of-distribution generalisation) | Lecture slides | |
| 4, 09/17 | Robust and non-robust features, distributional robustness, introduction to algorithmic fairness Paper presentations: (1) Discrimination in the Age of Algorithms (2) First-Person Fairness in Chatbots | Lecture slides | HW1 |
| 5, 09/24 | Fairness notions in classification, individual fairness, group fairness, case study of fairness notions Paper presentations: (1) Performative Prediction (2) The Value of Prediction in Identifying the Worst-Off | Lecture slides | |
| 6, 10/01 | Inherent tradeoffs between notions, individual fairness via uncertainty quantification, multicalibration Paper presentations: (1) Delayed Impact of Fair Machine Learning (2) Avoiding Discrimination through Causal Reasoning (3) Why Language Models Hallucinate (also see Calibrated Language Models Must Hallucinate) | Lecture slides | |
| 7, 10/08 | Review of iteration complexity analysis: smooth convex, strongly convex, and nonconvex | Lecture slides | Project proposal due |
| 8, 10/15 | Privacy and membership inference attacks Paper presentations: (1) Robust De-anonymization of Large Datasets (also see Resolving Individuals Contributing Trace Amounts of DNA) (2) Model Inversion Attacks (also see Membership Inference Attacks Against Machine Learning Models) | Lecture slides | |
| 9, 10/22 | Differential privacy and its basic properties Paper presentations: (1) Learning with Privacy at Scale at Apple (2) Scalable Extraction of Training Data from (Production) Language Models | Lecture slides | HW1 due |
| 10, 10/29 | DP mechanisms and properties of DP Paper presentations: (1) Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data (PATE) (2) Deep Learning with Differential Privacy (DP-SGD) (3) Extracting Training Data from Diffusion Models | Lecture slides | |
| 11, 11/05 | DP optimization: output perturbation, objective perturbation, and exponential mechanism Paper presentations: (1) Scaling Laws for Differentially Private Language Models (2) Renyi Differential Privacy (3) Differentially Private Fine-tuning of Language Models | Lecture slides | |
| 12, 11/12 | DP optimization: DP-SGD and its variants Paper presentations: (1) Privacy Auditing with One Training Run (2) Large Language Models Can Be Strong Differentially Private Learners (Ghost Clipping) (3) Inverting Gradients - How easy is it to break privacy in federated learning? (also see Deep Leakage from Gradients) | Lecture slides | |
| 13, 11/19 | Project presentations | ||
| 14, 12/03 | Project presentations | HW2 due |
Related Posts
Project Updates
-
Paper review: Catastrophe Insurance: An Adaptive Robust Optimization Approach
A review of Bertsimas and Zeng (2024) on applying adaptive robust optimization to catastrophe insurance pricing.