Large Scale Private Learning via Low-rank Reparametrization

Abstract

We propose a reparametrization scheme to address the challenges of applying differentially private SGD on large neural networks, which are 1) the huge memory cost of storing individual gradients, 2) the added noise suffering notorious dimensional dependence. Specifically, we reparametrize each weight matrix with two \emph{gradient-carrier} matrices of small dimension and a \emph{residual weight} matrix. We argue that such reparametrization keeps the forward/backward process unchanged while enabling us to compute the projected gradient without computing the gradient itself. To learn with differential privacy, we design \emph{reparametrized gradient perturbation (RGP)} that perturbs the gradients on gradient-carrier matrices and reconstructs an update for the original weight from the noisy gradients. Importantly, we use historical updates to find the gradient-carrier matrices, whose optimality is rigorously justified under linear regression and empirically verified with deep learning tasks. RGP significantly reduces the memory cost and improves the utility. For example, we are the first able to apply differential privacy on the BERT model and achieve an average accuracy of $83.9\%$ on four downstream tasks with $\epsilon =8$, which is within $5\%$ loss compared to the non-private baseline but enjoys much lower privacy leakage risk.

arXiv commentPublished as a conference paper in International Conference on Machine Learning (ICML 2021). Source code available at https://github.com/dayu11/Differentially-Private-Deep-Learning

References in corpus (20)

• Deep Learning with Differential Privacy
• Wide Residual Networks
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Scalable Private Learning with PATE
• Error Feedback Fixes SignSGD and other Gradient Compression Schemes
• White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
• Gradient Descent Happens in a Tiny Subspace
• Subsampled Rényi Differential Privacy and Analytical Moments Accountant
• Rényi Differential Privacy of the Sampled Gaussian Mechanism
• Large Language Models Can Be Strong Differentially Private Learners
• Sketchy Decisions: Convex Low-Rank Matrix Optimization with Optimal Storage
• Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Bounds
• The Cost of Privacy: Rates of Convergence for Parameter Estimation with Differential Privacy
• Tempered Sigmoid Activations for Deep Learning with Differential Privacy
• Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning
• Scalable Differential Privacy with Certified Robustness in Adversarial Learning
• Coupling Adaptive Batch Sizes with Learning Rates
• Assessing differentially private deep learning with Membership Inference
• Fast Dimension Independent Private AdaGrad on Publicly Estimated Subspaces
• How Does Data Augmentation Affect Privacy in Machine Learning?

Cited by in corpus (2)

• DP-Forward: Fine-tuning and Inference on Language Models with Differential Privacy in Forward Pass
• Learning Privacy-Preserving Student Networks via Discriminative-Generative Distillation