Understanding Gradient Clipping in Private SGD: A Geometric Perspective

Abstract

Deep learning models are increasingly popular in many machine learning applications where the training data may contain sensitive information. To provide formal and rigorous privacy guarantee, many learning systems now incorporate differential privacy by training their models with (differentially) private SGD. A key step in each private SGD update is gradient clipping that shrinks the gradient of an individual example whenever its L2 norm exceeds some threshold. We first demonstrate how gradient clipping can prevent SGD from converging to stationary point. We then provide a theoretical analysis that fully quantifies the clipping bias on convergence with a disparity measure between the gradient distribution and a geometrically symmetric distribution. Our empirical evaluation further suggests that the gradient distributions along the trajectory of private SGD indeed exhibit symmetric structure that favors convergence. Together, our results provide an explanation why private SGD with gradient clipping remains effective in practice despite its potential clipping bias. Finally, we develop a new perturbation-based technique that can provably correct the clipping bias even for instances with highly asymmetric gradient distributions.

References in corpus (10)

• TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems
• Deep Learning with Differential Privacy
• Learning Differentially Private Recurrent Language Models
• Gradient Descent Happens in a Tiny Subspace
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• Differentially Private Learning with Adaptive Clipping
• Why gradient clipping accelerates training: A theoretical justification for adaptivity
• AdaCliP: Adaptive Clipping for Private SGD
• Deep Learning with Gaussian Differential Privacy
• Evading Curse of Dimensionality in Unconstrained Private GLMs via Private Gradient Descent

Cited by in corpus (17)

• How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy
• Review: Deep Learning in Electron Microscopy
• Generative Modeling of Turbulence
• DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation
• Unpacking the Expressed Consequences of AI Research in Broader Impact Statements
• Learning Privacy-Preserving Student Networks via Discriminative-Generative Distillation
• Privacy-Preserving Ensemble Infused Enhanced Deep Neural Network Framework for Edge Cloud Convergence
• Training Production Language Models without Memorizing User Data
• Improving Neural Network Training using Dynamic Learning Rate Schedule for PINNs and Image Classification
• Chasing Your Long Tails: Differentially Private Prediction in Health Care Settings
• Evading Curse of Dimensionality in Unconstrained Private GLMs via Private Gradient Descent
• Fast and Memory Efficient Differentially Private-SGD via JL Projections
• Privacy For Free: Wireless Federated Learning Via Uncoded Transmission With Adaptive Power Control
• Dynamic Differential-Privacy Preserving SGD
• Federated Learning is Better with Non-Homomorphic Encryption
• The Relative Gaussian Mechanism and its Application to Private Gradient Descent
• NeuralDP Differentially private neural networks by design