Venue: ICLR 2018 conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: Summary: The paper provides the first evidence of effectively training large RNN based language models under the constraint of differential privacy. The paper focuses on the user-level privacy setting, where the complete contribution of a single user is protected as opposed to protecting a single training example. The algorithm is based on the Federated Averaging and Federated Stochastic gradient framework.

Positive aspects of the paper: The paper is a very strong empirical paper, with experiments comparable to industrial scale. The paper uses the right composition tools like moments accountant to get strong privacy guarantees. The main technical ideas in the paper seem to be i) bounding the sensitivity for weighted average queries, and ii) clipping strategies for the gradient parameters, in order to control the norm. Both these contributions are important in the effectiveness of the overall algorithm.

Concern: The paper seems to be focused on demonstrating the effectiveness of previous approaches to the setting of language models. I did not find strong algorithmic ideas in the paper. I found the paper to be lacking in that respect.  
review_title: I like the experimental strength of the paper, but I have mild concerns about the new algorithmic ideas in the paper.

final_score: rating: 7: Good paper, accept
review_content: 
Summary of the paper
-------------------------------

The authors propose to add 4 elements to the 'FederatedAveraging' algorithm to provide a user-level differential privacy guarantee. The impact of those 4 elements on the model'a accuracy and privacy is then carefully analysed.

Clarity, Significance and Correctness
--------------------------------------------------

Clarity: Excellent

Significance: I'm not familiar with the literature of differential privacy, so I'll let more knowledgeable reviewers evaluate this point.

Correctness: The paper is technically correct.

Questions
--------------

1. Figure 1: Adding some noise to the updates could be view as some form of regularization, so I have trouble understand why the models with noise are less efficient than the baseline.
2. Clipping is supposed to help with the exploding gradients problem. Do you have an idea why a low threshold hurts the performances? Is it because it reduces the amplitude of the updates (and thus simply slows down the training)?
3. Is your method compatible with other optimizers, such as RMSprop or ADAM (which are commonly used to train RNNs)?

Pros
------

1. Nice extensions to FederatedAveraging to provide privacy guarantee.
2. Strong experimental setup that analyses in details the proposed extensions.
3. Experiments performed on public datasets.

Cons
-------

None

Typos
--------

1. Section 2, paragraph 3 : "is given in Figure 1" -> "is given in Algorithm 1"

Note
-------

Since I'm not familiar with the differential privacy literature, I'm flexible with my evaluation based on what other reviewers with more expertise have to say.
review_title:  Nice extensions to FederatedAveraging, with strong experimental setup.

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: This paper extends the previous results on differentially private SGD to user-level differentially private recurrent language models. It experimentally shows that the proposed differentially private LSTM achieves comparable utility compared to the non-private model.

The idea of training differentially private neural network is interesting and very important to the machine learning + differential privacy community. This work makes a pretty significant contribution to such topic. It adapts techniques from some previous work to address the difficulties in training language model and providing user-level privacy. The experiment shows good privacy and utility.

The presentation of the paper can be improved a bit. For example, it might be better to have a preliminary section before Section2 introducing the original differentially private SGD algorithm with clipping, the original FedAvg and FedSGD, and moments accountant as well as privacy amplification; otherwise, it can be pretty difficult for readers who are not familiar with those concepts to fully understand the paper. Such introduction can also help readers understand the difficulty of adapting the original algorithms and appreciate the contributions of this work.

review_title: Nice work

Meta-review: This paper uses known methods for learning a differentially private models and applies it to the task of learning a language model, and find they are able to maintain accuracy results on large datasets. Reviewers found the method convincing and original saying it was "interesting and very important to the machine learning ... community", and that in terms of results it was a "very strong empirical paper, with experiments comparable to industrial scale". There were some complaints as to the clarity of the work, with requests for more clear explanations of the methods used.


Decision: Accept (Poster)