Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper proposed to do DP fine-tuning on only the bias terms of the model. It analyzes the computational efficiency and demonstrated the empirical advantage of the proposed method.
strength_and_weaknesses: Strength:
The idea seems interesting and the result on large models seem encouraging.

Weakness:
Maybe the authors can investigate and elaborate more on when and why the proposed method would work.
clarity,_quality,_novelty_and_reproducibility: Clarity: The paper is quite easy to follow.

Quality: The analyses of the efficiency looks correct and the empirical evaluation seems pretty throughout.

Novelty: There are quite some work on fine-tuning certain part of the parameters under DP but the idea and the analyses of fine-tuning the bias with DP seems novel.
summary_of_the_review: The idea is simple, yet it seems to work pretty well in some cases and the computational efficiency is also good.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper focuses on the problem of differentially private fine-tuning of large pre-trained models, which is the most prevailing DP learning paradigm in the era of large machine models. Specifically, the authors propose to use differentially private bias-term fine-tuning (DP-BiTFiT) as a new parameter-efficient DP fine-tuning paradigm. They demonstrate that the proposed method has the following advantages: 
(1) DP-BiTFiT is model-agnostic
(2) DP-BiTFiT has its parameter efficiency around 0.1% across different pretrained models in computer vision and natural language processing. 
(3) DP-BiTFiT is computation efficient and almost removes the overhead introduced by DP, which makes the algorithm scalable to larger models with long-sequence texts or high-resolution images
(4) DP-BiTFiT matches the similar performance of state-of-the-art DP fine-tuning algorithms.
The authors conduct comprehensive studies over the model parameter efficiency, training time and space complexity, and the scalability of the DP algorithms, and empirically compare with the state-of-the-art DP fine-tuning methods on larger language models and computer vision models across different tasks under different privacy constraints.

strength_and_weaknesses: Strengths:
1. The paper is clearly written and easy to follow
2. The complexity analysis and comparison is technically sound
3. The empirical experiments on memory and time complexity improvements look convincing to me

Weakness:
1. The novelty is still limited. While I acknowledge the authors’ clarification in Introduction and appreciate their efforts in the comprehensive experiments they have done, the proposed DP-BiTFiT is still a simple adaptation of BiTFiT to DP fine-tuning by adding gradient clipping and gaussian noise. 
2. Despite the training efficiency and memory usage improvement, there is some accuracy drop compared to the state-of-the-art DP fine-tuning methods. While most of the accuracy gap is subtle and acceptable, the accuracy of DP-BiTFiT in Table 7 is a bit confusing to me, where the accuracy can be as low as 1% or 11%, and two-phase training must be used to alleviate the issue. This raises my concern about whether the proposed DP-BiTFiT is a general framework that works for every method/model/dataset.
3. Unclear insights on two-phase training. While Table 7 has shown promising results when interpolating full fine-tuning and BiTFiT, the authors seem not to provide enough insights on why combining these methods can achieve both better efficiency as well as better accuracy. Moreover, practical and principled guidance on when and how to employ two-phase fine-tuning is missing.


Additional question:
Since there is some accuracy gap between DP-BiTFiT and state-of-the-art DP fine-tuning methods, have you applied the two-phase training method to close the gap or even improve the accuracy?
I am willing to increase my score if my concerns are well addressed.

clarity,_quality,_novelty_and_reproducibility: The paper is well presented, except that the table is hard to interpret given that no numbers are bold.
The novelty of the paper is limited given that BiTFiT is an existing algorithm.

===
Updates after authors' response:

Overall I feel that it is a borderline paper.

I like the clarity of the writing and the comprehensive experiments to demonstrate the memory and computational efficiency improvement.

However, I share the same concerns as other reviewers that the novelty is quite limited, especially given the fact that the proposed method is not universally applicable to every task (low performance on CV tasks) and requires combining both full model fine-tuning and the proposed method to mitigate the issue. Thus the significance of the work is also reduced.

I decreased my score from 6 to 5, considering the limited novelty and significance. However, I am not against accepting the paper due to its comprehensive experiments and practical insights.
summary_of_the_review: Strengths:
1. The paper is clearly written and easy to follow
2. The complexity analysis and comparison is technically sound
3. The empirical experiments on memory and time complexity improvements look convincing to me


Weakness:
1. The novelty is still limited. 
2. Accuracy drop compared to the state-of-the-art DP fine-tuning methods. 
3. Unclear insights on two-phase training.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper considers applying bias-term fine-tuning (BiTFiT) to DP large model training. They describe efficient implementations of (DP)-BiTFiT and demonstrate that the time and space complexity of these implementations improves both over non-DP and DP full model training. They then give a deep empirical study of BiTFiT and its effectiveness in terms of accuracy and efficiency. They demonstrate that:
-For many problems, DP BiTFiT only needs to train ~.1-.2% of the model parameters.
-DP BiTFiT has a memory footprint and throughput that are 2-8 times better than other SOTA algorithms.
-BiTFiT's accuracy only is worse by a few percentage points in tasks where the SOTA accuracy ranges from 60-95%, when compared to full model training, even for large (100s of millions of parameters) models. Furthermore, DP BiTFiT demonstrates the same behavior and in some cases even outperforms DP full model training.
strength_and_weaknesses: I think the main strength of the paper is that it is pretty comprehensive as an empirical exploration of the benefits of using (DP) BiTFiT for model training. The authors run many different sets of experiments, and each set of experiments is fairly comprehensive. Another strength is how well the authors present the math-based motivation for using DP BiTFiT. e.g. I thought the explanation at the bottom of Section 4 on why computing gradients of bias only is more efficient, Figure 2 visualizing back-propagation for several algorithms simultaneously, and Section 3.2 where the authors show BiTFiT has improved space and time complexity over other approaches all demonstrated a great deal of effort by the authors to make conceptually understanding the paper much more digestible. Finally, the results in the paper show a lot of promise for guiding large model training with DP in practice. e.g., I think the fact that DP FiTBiT actually improves over full model training when the number of parameters is large enough for some problems strongly demonstrates the potential of the approach. 

I think the main weakness of the paper is that, as the authors mention, BiTFiT is a method introduced in a previous paper. While the authors do provide a more efficient implementation of DP-BiTFiT than the naive baseline, beyond that there is not much algorithmic novelty in the paper. That being said, the original BiTFiT paper is relatively short and doesn't provide nearly as much insight into the algorithm both theoretically and empirically as this paper, so I think this is less of a weakness and more of a lack of a certain strength. 
clarity,_quality,_novelty_and_reproducibility: As mentioned in the previous section, I felt the paper was quite clear and high-quality. A lot of effort is put into maximizing the reader's understanding, and many different sets of experiments capturing comparing DP BiTFiT to full training/other approaches in many different aspects are present. The main originality of the work is the efficient implementation of DP BiTFiT; otherwise, BiTFiT is an existing algorithm and most contributions of the work are empirical.
summary_of_the_review: Overall I weakly recommend accepting the paper. I think the paper provides a lot of intuition for a promising algorithm for practice, and may enable training much larger models with DP fine-tuning than what was previous possible, so the paper has much potential for impact. The writing and content of the paper meets the bar for acceptance in my opinion, for the reasons listed in the previous sections. However, I am hesitant to give the paper a higher score because of the limited originality. Again, I don't view this as a weakness; I still feel the paper is a quality paper ready for publication at a conference, and that having more exploratory papers such as this one to guide practice is a good thing for the community in general. However, based on the reviewing criteria, this paper may not compare favorably to a paper proposing a novel approach that also has high impact and good quality.

---
Comments for authors:
Remark 4.1: I guess, the idea is that as the number of parameters increases, the fraction of them that BitFiT trains is decreasing, and so it is a relatively weaker algorithm. So if accuracy were "one-to-one" measure of how strong an algorithm is, one would expect the gap to increase with the number of parameters. But increasing accuracy generally gets more difficult as model size/baseline accuracy approaches 100% (i.e., going from 90 to 95% accuracy for one architecture could actually be easier than going from 98 to 99% for a larger architecture, even though it is a "smaller gap"), and the accuracy gap decreasing could just be explained by this phenomenon. So this remark feels slightly misleading to me. 

In contrast with the previous comment, I think Table 5 which shows DP BiTFiT starts to outperform DP full fine-tuning at large # of parameters is one of the most interesting results of the paper and it was easy to miss on first read since this is sort of bundled in with Remark 4.1 by the text, but in my view it's really demonstrating something very different and promising. I might suggest emphasizing this more in the paper, space permitting. It makes a lot of sense, since DP suffers from curse of dimensionality, but I'm not aware of any past works that show that reducing the dimension of the optimization problem actually shows benefits in an empirical result (without assuming something like a low-rank gradient subspace), much less one where the way of reducing the dimension is so simple to describe.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper studies a parameter-efficient method for privately fine-tuning foundation models, a DP variant of the BiTFiT method. The negatives of this paper were that it has relatively low novelty in a few different ways. First, BiTFiT was already introduced in the non-private setting. Additionally, DP fine-tuning with parameter efficient methods has been investigated in both Li et al., and Yu et al.'s works from 2022. While this particular approach was not studied in those works, very similar ones were. The idea of investigating this was already suggested in at least one of these works, and thus the novelty and ideas contributed by this paper are low. The benefits were that the method was more effective in certain metrics, and the authors had a reasonably thorough investigation.

To be more direct: it is unclear whether an expert in DP ML would have their course modified by this paper. The authors emphasize that the course correction could be through the specific structure of this approach being amenable to better optimization, but this seems a bit slim/marginal for acceptance to ICLR.

Reviewer maoM had some concerns regarding the presentation of certain experimental results, which they brought up in subsequent discussion. The authors may want to address these points in a subsequent revision, either adding these experiments or discussing why they aren't appropriate.   

Note that Reviewer 7D3z did not adequately substantiate their high score in their review nor participate in the subsequent discussion, so their positive sentiment was downweighted.
justification_for_why_not_higher_score: Low novelty of methods and investigation compared to prior work.
Decision: Reject