Comparing Classiﬁers’ Performance under Diﬀerential Privacy

Milan Lopuhaä-Zwakenberg, Mina Alishahi, Jeroen Kivits, Jordi Klarenbeek,

Gert-Jan van der Velde and Nicola Zannone

Department of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, The Netherlands

Keywords:

Diﬀerential Privacy, Classiﬁer Construction, Accuracy Comparison.

Abstract:

The application of diﬀerential privacy in privacy-preserving data analysis has gained momentum in recent years.

In particular, it provides an eﬀective solution for the construction of privacy-preserving classiﬁers, in which

one party owns the data and another party is interested in obtaining a classiﬁer model from this data. While

several approaches have been proposed in the literature to employ diﬀerential privacy for the construction of

classiﬁers, an understanding of the diﬀerence in performance of these classiﬁers is currently missing. This

knowledge enables the data owner and the analyst to select the most appropriate classiﬁcation algorithm and

training parameters in order to guarantee high privacy requirements while minimizing the loss of accuracy.

In this study, we investigate the impact of the use of diﬀerential privacy on three well-known classiﬁers, i.e.,

Naïve Bayes, SVM, and Decision Tree classiﬁers. To this end, we show how these classiﬁers can be trained in a

diﬀerential privacy setting and perform extensive experiments to evaluate the eﬀect of this privacy enforcement

on their performance.

1 INTRODUCTION

In the data-driven society of the 21st century, machine

learning algorithms are largely employed to infer addi-

tional knowledge and intelligence from the increasing

amounts of data available in the Internet (Marr, 2019).

In particular, classiﬁers have been widely used in

many real-world applications, such as face and speech

recognition, text analysis, fraud and anomaly detection,

recommendation system, weather forecasting, medical

image analysis, and biometric identiﬁcation. A clas-

siﬁer assigns labels (classes) to new instances based

on its model trained on data whose classes are known

beforehand.

Classiﬁers are often trained under the assumption

that the underlying data is freely accessible. How-

ever, this assumption may not hold when training data

contains sensitive information as its publication might

raise the data owners’ privacy concerns. Consider, for

instance, a situation in which a hospital owns a dataset

describing patient information, including age, address,

gender, symptoms, and diseases. A classiﬁer trained

on this dataset might leak sensitive information about

the individual patients.

To address this issue, a large body of work has

been devoted to train a classiﬁer on datasets containing

sensitive information in such a way that the privacy of

the individuals whose data is present in the dataset is

guaranteed. Existing privacy-preserving solutions can

be categorized into two main classes. One class com-

prises cryptographic-based approaches that securely

train a classiﬁer over protected data (Khodaparast et al.,

2019). These approaches, however, are not scalable

both in terms of execution runtime and bandwidth

usage (Naehrig et al., 2011). The other class com-

prises solutions relying on data anonymization tech-

niques, in which the data under analysis is perturbed

before being released, e.g.,

-anonymity,

-diversity,

and

-closeness (Sheikhalishahi et al., 2021). These

anonymization techniques have been criticized for not

being rigorous enough in protecting the individuals’

conﬁdential information, and diﬀerential privacy is

emerging as the de-facto privacy standard for data

anonymization (Dwork et al., 2006). It addresses the

weaknesses of other anonymization techniques by lim-

iting the disclosure of private information of individual

records when published data aggregates information

in the dataset.

The rigorous privacy guarantees oﬀered by diﬀer-

ential privacy has led to its broad application in the

ﬁeld of privacy-preserving data analysis. In particular,

diﬀerential privacy is used to introduce noise during the

training of classiﬁcation algorithms, where the noise is

scaled according to the sensitivity of the training algo-

rithm. One of the main scenarios in which diﬀerential

privacy is applied is the training of classiﬁers, where

Lopuhaä-Zwakenberg, M., Alishahi, M., Kivits, J., Klarenbeek, J., van der Velde, G. and Zannone, N.

Comparing Classiﬁers’ Performance under Differential Privacy.

DOI: 10.5220/0010519000500061

In Proceedings of the 18th International Conference on Security and Cryptography (SECRYPT 2021), pages 50-61

ISBN: 978-989-758-524-1

one party owns the data (containing sensitive informa-

tion) and the other party is interested in obtaining a

classiﬁer trained over that data.

In this setting, multiple classiﬁcation algorithms

have been extended to incorporate diﬀerential privacy,

e.g., Nearest Neighbor (Gursoy et al., 2017), Naïve

Bayes (Vaidya et al., 2013), Support Vector Machine

(SVM) (Chaudhuri et al., 2011), and Decision Tree

(Jagannathan et al., 2009). However, there is still a lack

of understanding on the impact of diﬀerential privacy

on their classiﬁcation accuracy. Such knowledge would

enable the data owner and the analyst (model requester)

to decide which classiﬁer to be trained according to (i)

dataset properties, such as dataset size, (ii) structural

properties of the classiﬁcation algorithm, and (iii) the

amount of privacy required (

in diﬀerential privacy).

Accordingly, this study aims to answer the following

research questions:

RQ1.

Which dataset properties inﬂuence the accuracy

of diﬀerentially private classiﬁers?

RQ2.

How does the accuracy of diﬀerent classiﬁca-

tion algorithms change when applied in a diﬀerential

privacy setting?

RQ3.

How is classiﬁer accuracy aﬀected by the pri-

vacy level enforced?

To answer these questions, we investigate three

well-known classiﬁcation algorithms, namely the Naïve

Bayes, SVM and Decision Tree classiﬁers in a diﬀeren-

tial privacy setting. We show how these classiﬁcation

algorithms can be adapted to train diﬀerentially pri-

vate classiﬁers and apply them to several largely-used

benchmark datasets. For each classiﬁcation algorithm,

we analyze the eﬀect of dataset properties and pri-

vacy levels on the classiﬁer accuracy. The experiment

results show that in a diﬀerential privacy setting, no

classiﬁcation algorithm is a one-size-ﬁts-all solution

for all datasets and privacy levels. Nonetheless, under

some conditions one might outperform the others. For

example, our experiments show that a diﬀerentially

private SVM classiﬁer returns higher accuracy when

the training dataset is large; on the other hand, the ac-

curacy of a Decision Tree classiﬁer mainly depends on

the privacy level where the accuracy notably increases

when the privacy level is relaxed.

The contribution of this work can be summarized

as follows:

•

We show how three well-known classiﬁcation al-

gorithms can be adapted to the diﬀerential private

setting and prove that these adaptations satisfy the

prescribed privacy level.

•

We apply the revised algorithms to several bench-

mark datasets and empirically evaluate classiﬁer

accuracy with respect to the dataset properties and

privacy level.

training

data

training

process

classiﬁer

model

predicted

label

unlabeled

data

free access

Figure 1: Classiﬁer learning setting.

•

Based on the experiment results, we draw recommen-

dations to guide data owners and analysts in the selec-

tion of a classiﬁcation algorithm for training a classi-

ﬁer and directions for future work to improve the state-

of-the-art in diﬀerentially private classiﬁer learning.

Outline. The remainder of the paper is organized as

follows. The next section presents the classiﬁcation

algorithms studied in this work. Section 3 presents

the diﬀerential privacy classiﬁer learning setting and

discusses the diﬀerentially private counterparts of the

classiﬁcation algorithms. Sections 4 and 5 describe our

experimental setup and results, respectively. Section 6

discusses related work, and Section 7 concludes the

paper and provides directions for future work.

2 CLASSIFICATION

ALGORITHMS

In this work, we consider a classiﬁer learning setting in

which an analyst aims to train a classiﬁer based on the

data owned by another party. The setting is depicted

in Figure 1. We assume the training data consists of a

dataset

with

rows

, which is described by a set of

attributes

and a distinct class attribute

(hereafter

we assume that

is a categorical attribute). Each row

is a vector in which each element

is a value of

attribute

A ∈ A

and a class

. We write

¯x

for the

unlabeled row, i.e., for

with the class

removed.

The analyst’s goal is to create a classiﬁer, which can

be used to predict the class

of a new unlabeled

observation

¯x

. The analyst has free access to

, which

is used to train the classiﬁer. When the classiﬁer is

trained, it is published to the general public to be used

in the classiﬁcation of new unlabeled data.

Next, we describe the three classiﬁcation algorithms

studied in this work.

2.1 Naïve Bayes Classiﬁer

Naïve Bayes classiﬁer is a probabilistic classiﬁer built

based on Bayes’ theorem and assumes the attributes

describing the data to be mutually independent. For-

Comparing Classiﬁers’ Performance under Differential Privacy

mally, for an unlabeled data point

¯x

, the conditional

probability of

¯x

being class

is denoted by

p(c|¯x)

and

(with the use of Bayes theorem) is computed as:

p(c|¯x) =

p(c)p( ¯x|c)

p( ¯x)

p(c)

∏

A∈A

p(x

|c)

p( ¯x)

(1)

where

p(c)

is the probability of class

to occur in

the dataset,

p( ¯x|c)

is the conditional probability that

¯x

occurs given it is labeled

, and

p( ¯x)

is the probability

¯x

to occur.

These probabilities are computed by

observing frequencies in the dataset. The classiﬁer

assigns a class label

ˆc

to given data with a maximum a

posteriori probability as follows:

ˆc = argmax

p(c)

∏

A∈A

p(x

|c) (2)

This equation is equivalent to Eq. 1, removing the

constant value

p( ¯x)

in the denominator. From this

formula, it can be inferred that for constructing a Naïve

Bayes classiﬁer, it is enough to compute the conditional

probabilities and the probability of each class label.

For a class

, a categorical attribute

, and a value

v ∈ A

, the conditional probability

p(x

= v|c)

and the

probability p(c) are computed as:

p(x

= v|c) =

Avc

, p(c) =

, (3)

where

Avc

is the number of rows

with

= v

and

= c

and

is the number of rows with

= c

For a numerical attribute

and

z ∈ R

, the distribution

given

= c

is assumed to be normal, and its

probability density function is computed as:

p(x

= z|c) =

√

2πσ

(z−µ

)

2σ

, (4)

where

is the mean value of

among the rows

with class

, and

is the standard deviation of

these values.

2.2 Support Vector Machine

The Support Vector Machine (SVM) algorithm is a clas-

siﬁer deﬁned based on a statistical learning framework,

in which the class attribute is binary, i.e., the classes are

±1

, and each attribute

is numerical. As such we can

represent each

¯x

as a point in

|A|

-dimensional space.

The aim of the SVM training algorithm is to ﬁnd a

hyperplane in this space that best separates the sets of

points corresponding to the two labels. The degree to

The second equivalence of (1) is derived by assuming

that attributes are independent.

which a hyperplane, represented by a normal vector

¯w

fails at separating the sets of points is measured by

J( ¯w,D) =

∑

i=1

( ¯w · ¯x

)) +

|| ¯w||

, (5)

where

∈ {±1}

is the class of the

-th data point,

¯w · ¯x

is the inner product of

¯w

with the unlabeled data

point

¯x

, and

is the Huber loss function given, for a

ﬁxed parameter h > 0, by

(z) =











0 if z > 1 +h,

(1 + h −z)

if |1 −z|≤ h,

1 −z if z < 1 −h.

(6)

The term

|| ¯w||

in (5) is to prevent overﬁtting. Fol-

lowing (Chaudhuri et al., 2011), we take

h = 0.05

and

Λ = 10

−2.5

. The SVM returns the

¯w

that minimizes

(5), i.e., ˆw = argmin

¯w

J( ¯w,D).

2.3 Decision Tree Classiﬁer

A Decision Tree classiﬁer is a classiﬁer that takes the

form of a rooted tree, which is iteratively trained from

the top (root) to down (leaves). Each leaf is labeled

with a class and each internal node corresponds to an

attribute in which the outgoing edges are the attribute-

values. A new data point is classiﬁed by starting from

the root and passing along its attribute-values until it

reaches a leaf. The class label of the associated leaf is

returned as the class label of the new instance.

Among the existing Decision Tree classiﬁers,

we consider the Classiﬁcation And Regression Tree

(CART) algorithm (Breiman et al., 1984) for its sim-

ple training process. CART is a binary decision tree,

where each attribute

A ∈ A

only takes values

{0,1}

and the class attribute

can take more than two values.

The tree is built recursively from the root. At every

node the attribute that gives the best splitup is selected.

Formally, it is deﬁned as follows.

The purity of node

(i.e., its homogeneity in

terms of class labels) is measured with the Gini index,

denoted by G(N ), and it is computed as:

G(N ) = 1 −

∑

c∈C

= c)

, (7)

where

is the probability among all dataset rows

that end up in node

when walking from the

root. Note that

G(N ) = 0

iﬀ all rows in

have

the same class. The CART classiﬁer selects the

attribute whose split creates the children with the

least average Gini index (the purest children), i.e.,

SECRYPT 2021 - 18th International Conference on Security and Cryptography

best

= argmin

A∈A

∑

v∈{0,1}

= v)G(N

A,v

), (8)

where

A,v

is the child of

with value

in the splitup

along with

. More concretely, for a given

and

v ∈ {0, 1}

and class

, and for a ﬁxed

, let

Avc

the number of rows

that end up at node

and that satisfy

= v

= c

. The best attribute is

selected as:

best

= argmin

A∈A

∑

v∈{0,1}

(

∑

Avc

)

−

∑

Avc

(

∑

Avc

)



∑



. (9)

If the stopping condition is reached, then

is a leaf,

and we assign to

the class that is most prevalent

among the training items that end up in

, i.e.,

ˆc =

argmax

, where

is the number of rows

that end up at node N and that satisfy x

= c.

While theoretically one can continue splitting up

nodes until all attributes have appeared in the tree

structure, this generally results in overﬁtting. Therefore,

the algorithm is stopped when a maximum depth

is reached. We take

d = d

√

, which satisﬁes the

best trade-oﬀ between the underﬁtting and overﬁtting

of the Decision Tree model (for the selected dataset)

(Mantovani et al., 2018).

3 DIFFERENTIAL PRIVACY

CLASSIFIER LEARNING

To measure information leakage when classiﬁers are

trained over sensitive data, we use the de facto standard

metric named Diﬀerential Privacy (DP) deﬁned as

follows (Dwork et al., 2006).

Deﬁnition 3.1.

Two datasets are called adjacent if

they diﬀer in at most one row. Let

ε ∈ R

≥0

, and let

be an algorithm operating on datasets. We say that

satisﬁes

-Diﬀerential Privacy if for all adjacent

datasets D,D

and all sets of possible outputs S:

P( f (D) ∈ S) ≤ e

P( f (D

) ∈ S). (10)

By ensuring that the probability distributions on the

output space originating from two input datasets cannot

diﬀer too much,

-DP provides plausible deniability

about any row’s true value, even if all other rows are

compromised. The lower

, the stronger privacy

-DP

guarantees. To ensure privacy in the classiﬁer learning

setting, we demand that a classiﬁer training algorithm

satisﬁes

-DP. Thus, we aim to solve the following

problem:

Problem 1.

Given a privacy level

and a dataset

determine the

-DP classiﬁer training algorithm

that maximizes the accuracy of the classiﬁer Q (D).

Many classiﬁers are trained by retrieving infor-

mation from the dataset through numerical queries.

In this case, one can ensure

-DP by making sure

the responses to queries satisfy diﬀerential privacy.

DP on a single query can be incorporated as follows.

Let

be a numerical function on datasets, and let

s := max |ϕ(D)−ϕ(D

, where the maximum is taken

over all adjacent

D,D

. Suppose a query asks for

ϕ(D)

Then the response

L(ϕ,ε) = ϕ(D) + Lap(0,s/ε), (11)

where

Lap(0,s/ε)

is a Laplace random variable with

mean

and scale parameter

s/ε

, is

-DP. Occasionally

we will need responses that are positive, in which case

we will use

(ϕ,ε) = max{L(ϕ, ε),α}

, where

a small positive number that should be substantially

smaller than

ϕ(D)

. Since most of our queries are counts

and therefore integers, we use

α = 10

−5

throughout.

The response

(ϕ,ε)

-DP as well. The following

Theorem, which follows from standard properties of

diﬀerential privacy (Dwork et al., 2006; Nguyen et al.,

2013), shows that such DP responses can be used to

construct DP classiﬁer training algorithms:

Theorem 3.1.

Let

be a classiﬁer training algorithm,

accessing the database via queries. Suppose that each

row of the dataset is accessed through at most

queries

and that the response to each query is

-DP. Then,

is ε-DP.

3.1 ε-DP Naïve Bayes Classiﬁer

To train the Naïve Bayes classiﬁer in the

-DP setting,

we mainly follow the work presented in (Vaidya et al.,

2013) with few adjustments. Speciﬁcally, 1) we have

modiﬁed the deﬁnition of standard deviation sensitivity

coming from using a diﬀerent deﬁnition of adjacent

datasets, and 2) we consider the eﬀect of multiple

queries by applying the lower value of

per query

(Theorem 3.1) such that the ﬁnal algorithm satisﬁes

-DP. Algorithm 1 details the process including our

contribution and it can be summarized as follows.

Naïve Bayes relies on the dataset via the queries

Avc

and

for all

∈ A

(cf. Section 2.1).

To insert diﬀerential privacy, we instead use the noisy

versions of these values as:

Avc

,ε

),L

,ε

),L

(σ

,ε

),L(µ

,ε

), (12)

where

is chosen such that the collection of noisy

answers as a whole satisﬁes ε-DP. More concretely,

1 + #{categorical A}+ 2#{numerical A}

. (13)

Comparing Classiﬁers’ Performance under Differential Privacy

Algorithm 1: Construction of

-DP Naïve Bayes

classiﬁer.

Data: Privacy parameter ε.

Result: Prior probabilities p(c); Conditional

probabilities p(x

= v|c) for each class,

categorical attribute, and value of that

attribute; Obfuscated mean ˜µ

and

standard deviation

for each class and

numerical attribute.

1 ε

←

1+#{categorical A}+2#{numerical A}

;

2 for each class c do

3 ˜n

← L

,ε

);

4 p(c) ←

˜n

;

5 for each categorical A, each value v ∈ A do

6 ˜n

Avc

← L

Avc

,ε

);

7 p(x

= v|c) =

˜n

Avc

˜n

;

8 end

9 for each numerical A do

10 ˜µ

← L(µ

,ε

);

← L

(σ

,ε

);

12 end

13 end

Note that in (12) we use

for the counts and the stan-

dard deviation because they are assumed to be positive,

and L for the mean because it has no such restriction.

To calculate the expressions in relations (12), we

need to know their sensitivities. The sensitivities of the

counts

Avc

and

satisfy

s = 1

. We assume that for

each numerical attribute

, a lower bound

and upper

bound

are public knowledge. Then, the sensitivity

of µ

and σ

, respectively, are given as

−l

, s

−l

√

. (14)

Theorem 3.2. Algorithm 1 satisﬁes ε-DP.

Proof.

Every row in dataset is queried in one

, in

one

for each categorical attribute

, and in one

and one

for each numerical attribute

, so the

total amount of times each row is queried is

1 + #{categorical A}+ 2#{numerical A}. (15)

The result now follows from Theorem 3.1.

Compared to (Vaidya et al., 2013), we work with

rather than

, we have a diﬀerent formula for

in (14),

and we use

to round up certain negative responses,

rather than resampling until a positive response appears.

These changes are necessary to ensure ε-DP.

Algorithm 2: Construction of

-DP SVM classi-

ﬁer.

Data: Privacy parameter ε; Huber parameter h;

overﬁtting parameter Λ.

Result: Separating hyperplane ¯w

priv

1 ε

← ε −log



1 +

nhΛ



;

2 if ε

> 0 then

3 ε

← ε

;

4 Λ

← Λ;

5 else

6 ε

←

;

7 Λ

←

2nh(e

ε/4

−1)

;

8 end

9 draw

b according to p(

b = ¯z) ∝ e

−

||¯z||

;

10 ¯w

priv

← argmax

¯w

∑

i=1

Huber

( ¯w · ¯x

) +

|| ¯w||

b · ¯w;

3.2 ε-DP SVM Classiﬁer

We adopt the

-DP implementation of SVM introduced

in (Chaudhuri et al., 2011), which is detailed in Algo-

rithm 2 and works as follows. In SVM, the resulting

hyperplane

¯w

can leak information about

, since it

minimizes an objective function

depending on

To avoid this, the objective function is perturbed so

that it does not rely on any row in

signiﬁcantly.

More precisely, instead of the objective function

from Section 5, we use

priv

( ¯w,D) =

∑

i=1

( ¯w · ¯x

) +

|| ¯w||

b · ¯w

(16)

where

is a random vector, whose probability distribu-

tion is deﬁned below, and

depends on the choice of

and the privacy parameter

. More concretely, given

ε, Λ and the Huber parameter h, we deﬁne

= ε −log



1 +

nhΛ



, (17)



, if ε

> 0

, otherwise,

(18)

(

Λ, if ε

> 0

2nh(e

ε/4

−1)

, otherwise,

(19)

and

is drawn according to

b = ¯z) ∝ e

−

||¯z||

. The

algorithm then outputs the hyperplane

¯w

priv

= argmin

¯w

priv

( ¯w,D).

Theorem 3.3

(Theorem 9 of (Chaudhuri et al., 2011))

Algorithm 2 satisﬁes ε-DP.

SECRYPT 2021 - 18th International Conference on Security and Cryptography

Algorithm 3: Construction of

-DP Decision

Tree classiﬁer.

Data: Privacy parameter ε; Maximum depth d.

Result: Rooted tree T with labeled edges and

leaves.

1 ε

←

|A|(d+1)

;

2 create root R ;

3 R .expandable ← True;

4 while #{expandable nodes} > 0 do

5 choose expandable node N ;

6 if N .depth = d then

7 for each class c do

8 ˜m

← L(m

,ε

);

9 end

10 N .label ← argmax

˜m

;

11 else

12 for each attribute A not set on path

R → N do

13 for v, c ∈ {0,1} do

14 ˜m

← L

Avc

,ε

);

15 end

16 G(A) ←

∑

(

∑

˜m

)

−

∑

˜m

(

∑

˜m

)

(

∑

˜m

)

;

17 end

18 A ← arg min

G(A);

19 create nodes N

;

20 add labeled edges N

A=0

−→N

A=1

−→N

;

21 N

.expandable,N

.expandable ← True;

22 end

23 N .expandable ← False;

24 end

3.3 ε-DP Decision Tree Classiﬁer

An overview of diﬀerentially private Decision Tree

classiﬁers is given in (Fletcher and Islam, 2019). We

follow its general framework, adapted to the CART

classiﬁer as presented in Algorithm 3. It works by

replacing the counts

Avc

and

with diﬀerential

privacy equivalents. More precisely, instead of

use the noisy version

L(m

,ε

)

, where

|A|(d+1)

, in

which

is the depth of the tree. The Gini impurity

needs positive counts as inputs, so we use

Avc

,ε

)

Both these noisy counts have sensitivity s = 1.

Theorem 3.4. Algorithm 3 satisﬁes ε-DP.

Proof.

At each level of the tree, each row of the training

dataset is present in at most 1 node

. At

, it is

present in exactly one of the

is a leaf, and

in exactly one

Avc

for each attribute

is an

interior node. Hence each row is queried at most

|A|(d + 1)

times, and by Theorem 3.1, Algorithm 3

satisﬁes ε-DP.

Table 1: Dataset statistics.

Name Type #Attributes #Instances

Adult Mix 14 48 842

Mushroom Categorical 22 8 000

Nursery Categorical 8 12 960

Congressional Voting Binary 16 435

SPECT Heart Binary 22 267

Skin Segmentation Numerical 3 245 057

4 EXPERIMENTAL ANALYSIS

The experimental analysis aims to assess and compare

the classiﬁers’ performance when they are trained in

-DP setting w.r.t. dataset properties (

RQ1

), clas-

siﬁcation algorithm (

RQ2

) and privacy level (

RQ3

Next, we present the experimental setup, the datasets

used for the experiments and the evaluation approach.

Experiment Setup.

We implemented the classiﬁca-

tion algorithms both in a non-private (Section 2) and

-DP setting (Algorithms 1, 2, and 3) in Python.

The privacy levels ε used to train the classiﬁers in the

-DP setting are taken from the set

E = {10

−11

,0.001,

0.005,0.01,0.05, 0.1,0.25, 0.5,0.75,1}.

Datasets.

For our experiments we selected six datasets

from the UCI repository

. Table 1 summarizes the

statistics of the selected datasets.

Adult:

The dataset describes 48842 individuals using

14 attributes such as age, occupation, education. The

class attribute represents their income, which has two

possible values: ‘

> 50K

’ and ‘

< 50K

’. The attributes

are both numerical and categorical.

Mushroom:

This dataset describes 8000 hypothetical

samples of mushrooms, characterized using 22 cate-

gorical attributes, such as cap shape. The samples are

classiﬁed into two classes: edible and poisonous.

Nursery:

This dataset has originally been developed

to rank applications for nursery schools. The dataset

includes 12960 instances, described with 8 categorical

features such as health situation. The records are

classiﬁed into ﬁve classes, each representing a level of

being recommended for the position.

Congressional Voting:

This dataset includes votes for

each of the U.S. House of Representatives Congress-

men on the 16 key votes identiﬁed by the CQA. The

dataset includes 435 records, described with binary

The codes of our experiments are available in

https://github.com/jeroenkivits/seminar

3https://archive.ics.uci.edu/ml/datasets/

4https://archive.ics.uci.edu/ml/datasets/adult

5https://archive.ics.uci.edu/ml/datasets/Mushroom

6https://archive.ics.uci.edu/ml/datasets/nursery

7https://archive.ics.uci.edu/ml/datasets/Congressional

+Voting+Records

Comparing Classiﬁers’ Performance under Differential Privacy

attributes, such as immigration, where the records are

labeled either democrat or republican.

SPECT Heart:

The dataset describes diagnosing of

cardiac Single Proton Emission Computed Tomogra-

phy (SPECT) images. Each of the patients is classiﬁed

into two categories: normal and abnormal. It contains

267 instances that are described by 23 binary attributes.

Skin Segmentation:

This dataset comprises 245057

samples of face images of people. Each sample is

described by its RGB value (3 numerical attributes)

and is classiﬁed into two classes: skin and non-skin.

Given that the selected SVM and Decision Tree

algorithms are respectively applicable on numerical

and binary attributes, we convert the attributes of the

selected datasets in such a way that they respect the

requirements of these algorithms. For SVM, integer

numbers are randomly assigned to the distinct values

of categorical attributes. For Decision Tree, each

attribute-value of a categorical attribute is considered

as an attribute by itself, where if a record satisﬁes that

attribute-value the value 1 is assigned (the value 0 is

assigned, otherwise). For continuous attributes, the

median value is used to assign 1 to attribute-values

higher than the median value and 0 otherwise.

Evaluation Approach.

We measure the classiﬁers’

performance in terms of their accuracy. Classiﬁer

accuracy is assessed using 10-fold cross-validation. It

is worth noting that the accuracy of

-DP classiﬁers

is aﬀected by the randomness introduced both by the

partitioning of the datasets and by the

-DP noise,

where the latter has an especially large eﬀect on accu-

racy. To mitigate the eﬀect of randomness and to get a

clear picture of the average accuracy, we have repeated

each 10-fold cross-validation for 100 runs for each

value for

-DP Naïve Bayes and SVM classiﬁers. As

-DP Decision Tree classiﬁers showed a more stable

behaviour, we repeated the experiments 10 times for

Decision Tree. The parameters of classiﬁers have been

tuned to their highest performance with respect to each

selected dataset in order to allow for a fair comparison.

Criteria for RQ1: Research question RQ1 aims to

understand the eﬀect of dataset properties on classiﬁer

accuracy in an

-DP setting. To this end, we investigate

how classiﬁer accuracy varies for datasets with diﬀerent

sizes and number of attributes.

Criteria for RQ2: To investigate the eﬀect of built-in

properties of classiﬁers on their accuracy when trained

in an

-DP setting, we study the performance of clas-

siﬁcation algorithms when used in an

-DP setting

independently from the dataset. To this end, we com-

pute the average classiﬁer accuracy over all datasets.

8https://archive.ics.uci.edu/ml/datasets/SPECT+Heart

9https://archive.ics.uci.edu/ml/datasets/skin+segmentation

To verify whether the accuracy diﬀerence between

classiﬁcation algorithms used in an

-DP setting is sta-

tistically signiﬁcant, we use a non-parametric statistical

test, named the Wilcoxon test (Wilcoxon, 1945). The

Wilcoxon test can be adapted to our problem as follows.

Deﬁnition 4.1

(Wilcoxon Test)

Given two classiﬁca-

tion algorithms, let

be the signed diﬀerence between

the performance scores of the classiﬁers obtained by

applying each algorithm on a given dataset for a given

privacy level. The diﬀerences

(

1 ≤ i ≤ N

where

is the number of possible combinations of datasets and

privacy levels to which the classiﬁcation algorithms

are applied) are ranked based on the absolute values

(average rank is assigned for equal performances). Let

denote the sum of the ranks for datasets and privacy

level on which

> 0

, and let

−

be the sum of the ranks

for datasets and privacy level on which

< 0

(dividing

the sum of the ranks for which d

= 0 evenly), i.e.,

∑

rank(d

) +

∑

rank(d

) (20)

−

∑

rank(d

) +

∑

rank(d

) (21)

Let T = min(R

−

), then

z =

T −

N(N + 1)

N(N + 1)(2N + 1)

(22)

is approximately distributed normally. Under this con-

dition, the diﬀerence between the accuracy distribution

of the two classiﬁcation algorithms is statistically signif-

icant (i.e., the null hypothesis is rejected) if the

-value

is less than or equal to a given signiﬁcance level σ.

In our experiments, we require a 95% conﬁdence

interval, which corresponds to σ = 0.05.

To get insight into the performance of classiﬁcation

algorithms when used in an

-DP setting compared to

the non-private setting, we compute

•

Accuracy (no privacy): the classiﬁer accuracy in the

non-private setting.

•

Average accuracy (

-DP): the average accuracy of

ε-DP classiﬁers over all ε values.

•

Ratio: the eﬀect size of employing

-diﬀerential

privacy compared to a non-private learning setting

computed as the average accuracy of

-DP classiﬁers

over all privacy level

ε ∈ E

divided by the classiﬁer

accuracy obtained in a non-private setting.

Criteria for RQ3: To assess the impact of privacy

levels on classiﬁer accuracy, we analyze, for each

value in

, the distribution of the classiﬁer accuracy

over all selected datasets and classiﬁcation algorithms.

SECRYPT 2021 - 18th International Conference on Security and Cryptography

To measure the eﬀect size of

on the classiﬁer

accuracy, we use the classiﬁer accuracy obtained in

the non-private setting (Accuracy (no privacy)) as

the baseline and compute, for each

-DP classiﬁer,

the classiﬁer accuracy ratio as the ratio between the

classiﬁer accuracy in the

-DP setting and the accuracy

of the corresponding baseline classiﬁer. Intuitively,

the classiﬁer accuracy ratio represents to what extent

enforcing a given privacy level aﬀects classiﬁer

accuracy compared to the non-private setting.

5 RESULTS

We computed the accuracy of

-DP Naïve Bayes, SVM,

and Decision Tree classiﬁers on each selected dataset

for all privacy levels in

. The results of classiﬁers

accuracy over Adult, Mushroom, Nursery, Congres-

sional Voting, SPECT Heart, and Skin datasets, are

respectively shown in Figures 2a, 2b, 2c, 2d, 2e, and 2f.

RQ1: Which Dataset Properties Inﬂuence the Ac-

curacy of ε-DP Classiﬁers?

From Figure 2 we can

observe that SVM classiﬁers are typically accurate

when trained over datasets with a large number of

records (Adult, Mushroom, Nursery, and Skin Sep-

aration), while it returns low accuracy when trained

over small datasets (SPECT Heart and Congressional

Voting). This is due to the SVM structure in which the

hyperplane is determined based on the support vectors’

distances. When the dataset comprises a large number

of records, the noises added through diﬀerential privacy

negligibly aﬀect the hyperplane location. On the other

hand, the accuracy of Naïve Bayes classiﬁers depends

neither on the number of attributes nor on the number

of records. As shown in Figure 2, for datasets with

an equal number of attributes (Mushroom and SPECT

Heart) or a large number of records (Mushroom and

Nursery), the Naïve Bayes classiﬁer returns diﬀerent

trends of accuracy. This could be because the accuracy

of Naïve Bayes classiﬁer mainly depends on: i) the dis-

tribution of attributes’ values, and ii) the independence

of attributes (Jiang et al., 2007). Similarly, the results

show that the accuracy of Decision Tree classiﬁers does

not depend on the number of attributes and dataset size.

RQ2: How Does the Accuracy of Diﬀerent Clas-

siﬁcation Algorithms Change when Trained in an

ε-DP Setting?

The average accuracy of the classiﬁca-

tion algorithms when used in an

-DP setting over all

datasets is reported in Figure 3. It can be observed that,

on average, SVM (for

values higher than

0.005

and

lower than 3) outperforms the other two classiﬁcation

algorithms. However, for small

values, Naïve Bayes

and Decision Tree show slightly better performances.

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

(a) Adult Dataset.

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

(b) Mushroom Dataset.

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

(d) Congressional Voting Dataset.

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

(e) SPECT Heart Dataset.

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

(f) Skin Separation Dataset.

Figure 2: Accuracy of Naïve Bayes, SVM, Decision Tree

classiﬁers trained in an

-DP setting for diﬀerent values of

For low privacy levels (

higher than 3), Decision Tree

returns the most accurate results. Overall, Decision

Tree classiﬁers show, in general, a higher improvement

Comparing Classiﬁers’ Performance under Differential Privacy

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

0.2

0.4

0.6

0.8

Privacy level ε

Accuracy

SVM

Figure 3: Average accuracy of the classiﬁcation algorithms

when used in an ε-DP setting over all datasets.

Figure 4: Heatmap of Wilcoxon test on mutual comparison

of performance between classiﬁcation algorithms applied in

an ε-DP setting in terms of p-values.

when the privacy requirements are relaxed compared

to the other types of classiﬁers, i.e., the accuracy shows

a more noticeable increase for increasing ε values.

We used the Wilcoxon test to verify the statistical

signiﬁcance of these diﬀerences. Figure 4 depicts the

heatmap of mutual comparison of

-DP classiﬁers’

performance in terms of

-values. The lower

-value

(lighter color) shows more conﬁdence in rejecting

the null hypothesis (i.e., more diﬀerent performance).

Figure 4 shows that the null hypothesis of the Wilcoxon

test is rejected in the mutual comparison of SVM

with both Decision Tree (

p = 0.017

) and Naïve Bayes

(

p = 0.003

) classiﬁcation algorithms, i.e., SVM shows

a diﬀerent behaviour compared to the other algorithms.

On the other hand, the Wilcoxon test fails to reject the

null hypothesis when comparing the accuracy of Naïve

Bayes and Decision Tree, i.e., these algorithms show

similar performance.

A comparison between the accuracy achieved by the

classiﬁcation algorithms when trained in a non-private

setting and in an

-DP setting along with the eﬀect size

of the accuracy diﬀerence between these settings (Ra-

tio) is reported in Table 2. The results in the non-private

setting show that for the selected datasets, on average,

the Decision Tree classiﬁcation algorithm outperforms

the other two classiﬁcation algorithms. However, SVM

shows better performance than the other two algorithms

when used in an

-DP setting. The ratio shows that the

Naïve Bayes classiﬁcation algorithm is the most stable

between the

-DP and non-private settings, indicating

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

no privacy

0.2

0.4

0.6

0.8

Average Accuracy

(a) Distribution of classiﬁer accuracy for diﬀerent ε

−11

0.001

0.005

0.01

0.05

0.1

0.25

0.5

0.75

no privacy

0.5

1.5

Accuracy Ratio

(b)

Distribution of classiﬁer accuracy ratio for diﬀerent

Figure 5: Distribution of classiﬁer accuracy and classiﬁer

accuracy ratio for diﬀerent ε values.

that it is the one less aﬀected by the ε-DP noise.

RQ3: How Is Classiﬁer Accuracy Aﬀected by the

Privacy Level Enforced?

Figure 2 and Figure 3 show

that classiﬁer accuracy decreases with the decrease of

(i.e., for higher privacy requirement). SVM classiﬁers

perform poorly for some datasets (Nursery, Congres-

sional Voting and Skin Separation) when trained using

very small values of

(Figure 2), although on average

perform only slightly worse than Decision Tree and

Naïve Bayes classiﬁers (Figure 3). Decision Tree clas-

siﬁers show sudden increments of accuracy for some

values, which can be due to the recursive structure of

this algorithm. In the construction of

-DP Decision

Tree classiﬁers, the noise is added at every level and

each subtree can be constructed using a set of data with

a diﬀerent distribution of values.

Figure 5 shows the distribution of classiﬁer accu-

racy and classiﬁer accuracy ratio for diﬀerent

values

over all classiﬁcation algorithms and datasets. Each

box represents the distribution over 18 classiﬁers (3

classiﬁcation algorithms applied to 6 datasets) for the

associated ε value.

Figure 5a shows a high variation in the accuracy of

-DP classiﬁers (represented by the size of boxes and

length of whiskers) for every

value. This variation

is especially notable for

values lower than (equal to)

0.1. For

values greater than 3, the distributions are

similar. This suggests the selection of a higher privacy

level in this range results in a small accuracy cost.

SECRYPT 2021 - 18th International Conference on Security and Cryptography

Table 2: Accuracy comparison between classiﬁcation algorithms when applied in a non-private learning setting (Accuracy (no

privacy)) and in an

-DP learning setting (Average accuracy (

-DP)). The ratio measures the eﬀect size of training a classiﬁer

in an ε-DP setting compared to a non-private setting.

Classiﬁer Measurement Adult Mushroom Nursery SPECT Congress Skin Average

Accuracy (no privacy) 0.8208 0.8472 0.0834 0.5337 0.9135 0.9239 0.6871

Average accuracy (ε-DP) 0.6905 0.7458 0.1148 0.6204 0.7374 0.7763 0.6130

Ratio 0.8412 0.8803 1.3772 1.1624 0.8073 0.8922 0.9934

SVM

Accuracy (no privacy) 0.8288 0.9990 0.9747 0.6995 0.4139 0.7914 0.7846

Average accuracy (ε-DP) 0.8131 0.8892 0.8794 0.5014 0.2454 0.7918 0.6867

Ratio 0.9811 0.8901 0.9022 0.7167 0.5929 1.0001 0.8473

Accuracy (no privacy) 0.8450 1.0000 0.8248 0.7388 0.9538 0.7926 0.8592

Average accuracy (ε-DP) 0.7059 0.6620 0.5427 0.5636 0.5893 0.7685 0.6387

Ratio 0.8354 0.6620 0.6580 0.7628 0.6179 0.9696 0.7510

In Figure 5b, the small boxes for

ε ≥ 0.25

, with

median values close to 1, show that classiﬁer accuracy

is not considerably aﬀected when the classiﬁers are

trained in an

-DP setting for this range of

(for the

selected datasets). For

0.005 ≤ ε < 0.25

, the result

shows more variation where the accuracy of

-DP

classiﬁers can be slightly or signiﬁcantly worse than

the one of classiﬁers trained in a non-private setting.

For

ε ≤0.001

, we can observe that the median value is

close to 0.5, indicating that, on average, the accuracy of

classiﬁers trained in the

-DP setting halves compared

to the classiﬁers trained in a non-private setting.

Discussion.

In this work, we have selected three

well-known classiﬁers, namely Naïve Bayes, SVM,

and Decision Tree classiﬁers, and trained them in an

-DP setting. We then explored the impact of dataset

properties, classiﬁcation algorithms, and privacy levels

(in terms of diﬀerential privacy) on classiﬁer accuracy.

Our analysis shows that none of the selected clas-

siﬁers is a one-size-ﬁts-all solution for all datasets and

privacy levels. Nonetheless, based on their inherent

structural properties, the required privacy level, and the

dataset properties, we found some interesting results

on classiﬁers’ performance trained in the

-DP setting:

•

The ratio values reported in Table 2 show that the

Naïve Bayes classiﬁer returns the most similar ac-

curacy between the private and non-private settings.

This speciﬁcally suggests the application of the dif-

ferentially private Naïve Bayes classiﬁer in datasets

in which the non-private version is accurate.

•

The private SVM classiﬁer is quite accurate when it

is trained over large datasets due to its structure.

•

The Decision Tree classiﬁers show increased ac-

curacy when privacy constraints are relaxed. This

could result from the fact that on the selected datasets,

the non-private Decision Tree classiﬁers also return

the most accurate results. Further investigation is

required to study this trend.

•

The mutual comparison of

-DP classiﬁers’ perfor-

mance (in terms of the Wilcoxon test) shows that

probability-based classiﬁcation algorithms behave

almost similarly when trained in an ε-DP setting.

•

For the selected datasets, classiﬁer accuracy does not

change when the privacy level

varies in a speciﬁc

range of values. This suggests the data owner and an-

alyst need to ﬁnd the maximum privacy level for their

dataset which will not signiﬁcantly aﬀect accuracy.

It should be noted that there exist several other

alternative classiﬁcation algorithms for Naïve Bayes,

SVM and Decision Tree classiﬁers compared to the

ones selected for this study. For instance, ID3 and

C4.5 are two types of Decision Trees, the polynomial

and RBF kernel-based SVM are other types of SVM

classiﬁers, and the Bernoulli and Gaussian are two

types of Naïve Bayes classiﬁers. Nonetheless, we

expect that the selection of an alternative classiﬁcation

algorithm will not considerably aﬀect our ﬁndings.

This claim and the other aforementioned ﬁndings of

this study needs more work to investigate the results on

a wider range of datasets, diﬀerent types of classiﬁers,

and other classiﬁcation algorithms in an ε-DP setting.

6 RELATED WORK

In recent years, privacy-preserving machine learning,

including classiﬁcation, regression, clustering, and

dimensionality reduction, has received increasing at-

tention (Ji et al., 2014). This attention has resulted

in several solutions in the ﬁeld of diﬀerential privacy

classiﬁcation. Existing approaches in this ﬁeld usually

ensure diﬀerential privacy by employing one of the

following general methods:

Each row in the dataset is obfuscated, and the

training algorithm is run on the resulting data.

Queries to the dataset originating from the training

algorithm are answered with a noisy result set.

Once the classiﬁer has been trained, noise is added

to its parameters before its release.

The ﬁrst method, called Local Diﬀerential Privacy (Ka-

Comparing Classiﬁers’ Performance under Differential Privacy

siviswanathan et al., 2011), provides strong privacy

guarantee in training the classiﬁers in a diﬀerential pri-

vacy setting (Gong et al., 2020). For instance, the Naïve

Bayes classiﬁer has been implemented with Local Dif-

ferential Privacy, i.e., with a non-interactive obfuscated

dataset (Yilmaz et al., 2019). While this method has the

advantage that it does not require a trusted data aggrega-

tor, it comes at an undesirable utility cost (Arachchige

et al., 2019). Accordingly, under the condition that

data has already been collected by a trusted aggregator,

this extra privacy guarantee is not needed.

The second method has been widely used as an ef-

fective tool in privacy-preserving classiﬁcation, when

one party owns the data and another party is interested

in obtaining a classiﬁer model on this sensitive non-

public data (Fletcher and Islam, 2019). This approach

has been used to enforce diﬀerential privacy on Naïve

Bayes classiﬁer (Vaidya et al., 2013), which replaces the

dataset queries in the standard Naïve Bayes algorithm

with diﬀerentially private ones. This methodology has

been improved in (Zafarani and Clifton, 2020) by using

smooth sensitivity, a diﬀerential privacy technique that

lowers the amount of random noise on each query, while

retaining the same level of privacy. Diﬀerential private

SVM in a nonlinear environment has been addressed

with the use of kernel methods based on random projec-

tions (Rahimi and Recht, 2008). The accuracy of these

methods can be increased by perturbing and then solv-

ing the dual problem (Zhang et al., 2019). The methods

in (Jain and Thakurta, 2013) oﬀer a weaker form of pri-

vacy, namely

(ε,δ)

-diﬀerential privacy, but can be ap-

plied to a wider range of kernel functions. All these ap-

proaches result in a model that does not leak unwanted

information about the training data. Depending on the

precise implementation, these approaches may have the

additional privacy guarantee that private information

is kept from the analyst as well. An overview of dif-

ferentially private Decision Tree algorithms is given in

(Fletcher and Islam, 2019). In particular, the methodol-

ogy proposed in (Blum et al., 2005) replaces the dataset

queries in a non-private Decision Tree algorithm by

diﬀerentially private equivalents. Since under diﬀeren-

tial privacy, having more queries decreases utility, one

can improve upon this by using algorithms that require

fewer dataset queries (Friedman and Schuster, 2010).

The last method adds noise to the model’s param-

eters before the model is published e.g., the optimal

hyperplane of the SVM classiﬁer is perturbed (Chaud-

huri et al., 2011), or a random forest is created inde-

pendently of the database, and noise is then added to

the leaves’ class predictions taken from the database

(Jagannathan et al., 2009). While this approach needs

fewer queries per tree, one needs multiple trees to

get decent accuracy. In this setting, in (Jayaraman

and Evans, 2019) the evaluation of diﬀerential privacy

mechanisms for two machine learning algorithms pre-

sented to understand the impact of diﬀerent choices of

and diﬀerent relaxations of diﬀerential privacy on

both utility and privacy. Adding noise to the classiﬁer’s

parameters after it is trained usually results in lower

accuracy compared to previous two methods.

Our work employs the second method in which

noise is added to the analyst’s queries during the train-

ing of the classiﬁer. Speciﬁcally, we showed how

Naïve Bayes, SVM, and Decision Tree classiﬁers can

be constructed in an

-DP setting and compared their

performance. While some work in the literature com-

pares the impact of privacy in the context of classiﬁer

learning, e.g., the costs of training diﬀerent classiﬁers

using Homomorphic Encryption (Sheikhalishahi and

Zannone, 2020), to the best of our knowledge no prior

work has focused on the comparison of classiﬁers’

performance in a diﬀerential privacy setting.

7 CONCLUSION

This paper provides a comparison of classiﬁers’ per-

formance when they are trained in an

-DP setting.

Three well-known classiﬁers, namely Naïve Bayes,

SVM and Decision Tree, have been trained under the

assumption that one party owns the data and the other

party is interested in obtaining the classiﬁer’s model

respecting

-diﬀerential privacy. Our experimental

results show that depending on dataset properties, clas-

siﬁer structure, and privacy level

one classiﬁer might

outperform the other ones.

In future work, we plan to extend our work to a

thorough comparison considering a wider range of

well-known classiﬁers (e.g.,

Nearest Neighbor, Ran-

dom Forest) including diﬀerent types of each classiﬁer

(e.g., diﬀerent SVM algorithms) on a broader set of

benchmark datasets trained in an ε-DP setting.

ACKNOWLEDGEMENTS

This work was supported by NWO grant 628.001.026

and H2020 EU funded project SECREDAS [GA

#783119].

REFERENCES

Arachchige, P. C. M., Bertok, P., Khalil, I., Liu, D., Camtepe,

S., and Atiquzzaman, M. (2019). Local diﬀerential

privacy for deep learning. IEEE Internet of Things

Journal, 7(7):5827–5842.

SECRYPT 2021 - 18th International Conference on Security and Cryptography

Blum, A., Dwork, C., McSherry, F., and Nissim, K. (2005).

Practical Privacy: The SuLQ Framework. In Interna-

tional Conference on Principles of Database Systems,

pages 128–138. ACM.

Breiman, L., Friedman, J., Stone, C. J., and Olshen, R. A.

(1984). Classiﬁcation and regression trees. CRC press.

Chaudhuri, K., Monteleoni, C., and Sarwate, A. D. (2011).

Diﬀerentially private empirical risk minimization. Jour-

nal of Machine Learning Research, 12(29):1069–1109.

Dwork, C., McSherry, F., Nissim, K., and Smith, A. (2006).

Calibrating noise to sensitivity in private data analysis.

In Theory of Cryptography, pages 265–284. Springer.

Fletcher, S. and Islam, M. Z. (2019). Decision tree clas-

siﬁcation with diﬀerential privacy: A survey. ACM

Computing Surveys, 52(4):1–33.

Friedman, A. and Schuster, A. (2010). Data mining with

diﬀerential privacy. In International Conference on

Knowledge Discovery and Data Mining, pages 493–502.

ACM.

Gong, M., Xie, Y., Pan, K., Feng, K., and Qin, A. (2020). A

survey on diﬀerentially private machine learning. IEEE

Comp. Intell. Mag., 15(2):49–64.

Gursoy, M. E., Inan, A., Nergiz, M. E., and Saygin, Y. (2017).

Diﬀerentially private nearest neighbor classiﬁcation.

Data Min. Knowl. Discov., 31(5):1544–1575.

Jagannathan, G., Pillaipakkamnatt, K., and Wright, R. N.

(2009). A practical diﬀerentially private random de-

cision tree classiﬁer. In International Conference on

Data Mining, pages 114–121. IEEE.

Jain, P. and Thakurta, A. (2013). Diﬀerentially private

learning with kernels. In International Conference on

Machine Learning, pages 118–126.

Jayaraman, B. and Evans, D. (2019). Evaluating diﬀeren-

tially private machine learning in practice. In USENIX

Conference on Security Symposium, SEC’19, page

1895–1912.

Ji, Z., Lipton, Z. C., and Elkan, C. (2014). Diﬀerential

privacy and machine learning: a survey and review.

arXiv:1412.7584.

Jiang, L., Wang, D., Cai, Z., and Yan, X. (2007). Survey

of improving naive bayes for classiﬁcation. In Ad-

vanced Data Mining and Applications, pages 134–145.

Springer.

Kasiviswanathan, S. P., Lee, H. K., Nissim, K., Raskhod-

nikova, S., and Smith, A. (2011). What can we learn

privately? SIAM Journal on Computing, 40(3):793–

826.

Khodaparast, F., Sheikhalishahi, M., Haghighi, H., and Mar-

tinelli, F. (2019). Privacy-preserving LDA classiﬁcation

over horizontally distributed data. In International Sym-

posium on Intelligent Distributed Computing, pages

65–74.

Mantovani, R. G., Horváth, T., Cerri, R., Junior, S. B.,

Vanschoren, J., and de Leon Ferreira de Carvalho, A.

C. P. (2018). An empirical study on hyperparameter

tuning of decision trees. CoRR, abs/1812.02207.

Marr, B. (2019). Artiﬁcial intelligence in practice: how 50

successful companies used AI and machine learning to

solve problems. John Wiley & Sons.

Naehrig, M., Lauter, K., and Vaikuntanathan, V. (2011).

Can homomorphic encryption be practical? In Cloud

Computing Security Workshop, pages 113–124. ACM.

Nguyen, H. H., Kim, J., and Kim, Y. (2013). Diﬀerential

privacy in practice. Journal of Computing Science and

Engineering, 7(3):177–186.

Rahimi, A. and Recht, B. (2008). Random features for

large-scale kernel machines. In Advances in neural

information processing systems, pages 1177–1184.

Sheikhalishahi, M., Saracino, A., Martinelli, F., and Marra,

A. L. (2021). Privacy preserving data sharing and

analysis for edge-based architectures. International

Journal of Information Security.

Sheikhalishahi, M. and Zannone, N. (2020). On the com-

parison of classiﬁers’ construction over private inputs.

In International Conference on Trust, Security and

Privacy in Computing and Communications. IEEE.

Vaidya, J., Shaﬁq, B., Basu, A., and Hong, Y. (2013). Dif-

ferentially private naive bayes classiﬁcation. In Inter-

national Joint Conferences on Web Intelligence and

Intelligent Agent Technologies, volume 1, pages 571–

576.

Wilcoxon, F. (1945). Individual comparisons by ranking

methods. Biometrics Bulletin, 1:60–83.

Yilmaz, E., Al-Rubaie, M., and Chang, J. M. (2019). Lo-

cally diﬀerentially private naive bayes classiﬁcation.

arXiv:1905.01039.

Zafarani, F. and Clifton, C. (2020). Diﬀerentially pri-

vate naïve bayes classiﬁer using smooth sensitivity.

arXiv:2003.13955.

Zhang, Y., Hao, Z., and Wang, S. (2019). A diﬀerential

privacy support vector machine classiﬁer based on dual

variable perturbation. IEEE Access, 7:98238–98251.

Comparing Classiﬁers’ Performance under Differential Privacy