Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: summary: This work proposes leveraging the intrinsic noise induced by optical processors performing matrix multiplication to provide differential privacy to neural networks trained with the direct feedback alignment algorithm. The authors demonstrate both theoretically and empirically the viability of this approach by training a neural network on an optical processing unit with direct feedback alignment and providing multiple levels of differential privacy noise.
main_review: This work demonstrates what may have originally been considered a weakness of analog hardware to be a benefit in the context of data privacy. Furthermore, they demonstrate the real-world applicability of this approach by implementing the proposed learning procedure on an actual optical processing device. But details about the operations performed by the optical processing unit are not reported and what features about this device make it particularly well suited for the direct feedback alignment compared to other neural network learning procedures (most notably the backpropagation algorithm). There is some mention about the inherent parallelizability of the layerwise training with direct feedback alignment as compared to backpropagation, but this is generally a benefit to most neural network hardware solutions including CPUs/GPUs. Therefore, further justification about the chosen learning algorithm with the optical processing unit hardware should be expanded upon. It's also a little unintuitive why the optical processing is only used in the matrix multiplication of the DFA backward pass while a conventional GPU (nvidia v100) is used for the forward pass. Does this not limit the advantages of the proposed procedure since the conventional GPU creates a lower bound in training time?

Overall, the work is an exciting demonstration of the viability of the direct feedback alignment algorithm to a novel hardware domain. But this excitement is somewhat muted by the lack of detail of why combining these two things makes sense and more detail in this respect would further improve this work.
limitations_and_societal_impact: Some suggestions for improvement:

-Further detail on properties of the optical processing unit that make it particularly well suited for direct feedback alignment (the intrinsic noise justifies the differential privacy)

-Some experiments beyond the FashionMNIST dataset would also be helpful to demonstrate whether the performance differences widen or narrow with dataset difficulty (possibly CIFAR10 and MNIST).

-In the context of real-world privacy and what differential privacy implies, it would be helpful to provide a specific example use case. The formulations (Definition 2.2) imply that private information can still be present in the network and only the notion of plausible deniability of what data the model was trained on. This may be beyond the scope of this particular paper but would help make a more complete standalone work.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper proposes a hardware-based approach to Differential Privacy (DP) using OPU to perform optical random projections for a differentially private DFA training algorithm, leveraging noise intrinsic to the hardware to achieve privacy-by-design. The proposed approach was analyzed mathematically in detail. The proposed methods were analyzed on the vanilla Fashion MNIST dataset.  

The paper is very well written in general. The proposed methods/approach are very interesting, and mathematical results are solid.

main_review: One of the major issues with the paper is limited experimental analysis of the proposed methods in comparison with baseline DFA and state-of-the-art DP methods on different benchmark datasets. Although mathematical results are interesting, more detailed additional experimental results are needed to examine and justify its merit compared to the state-of-the-art in different tasks.
Additional comments and suggestions are provided as follows:

1.	Please definite the notation and terms as they are used. For instance, please either define the notation used in (1) or just refer to (4).

2.	What do you mean by “train deep architectures”? I suppose that you refer training deep learning models whose functional structures are identified by the corresponding network architectures, instead of “designing network architectures using data”.

3.	Could you please provide additional analyses using more complicated datasets such as Cifar-10/100 or variations of ImageNet,  and networks, such as ResNets? Indeed, how would random projection of the error will be applied to networks with bottlenecks, skip connections and dense connections?

4.	Please check the consistency of the notation and fix it in the text. For instance, please update the notation used for distribution D, and data spaces/sets X and Y according to that used in Section 2.3, vice versa.

5.	In Definition 2.1, please define the record.

6.	 In Theorem 1, please define the mechanism M_i, more precisely.

7.	Please define | \cdot |

8.	Please define || || used at line 148, page 5.

9.	Page 5, line 162: Section 3.1

10.	Alg. 1, line 15: g_1^l,…,g_m^l

11.	Please fix use of gaussian or Gaussian.

12.	Please capitalize section names.

13.	 In Proposition 13, what is the difference between .n_l\alpha and n_l.\alpha?

14.	Please provide a complexity analysis of the proposed method in comparison with non-private and baseline DFA.

After Rebuttal: Thank you for your response to my comments. I checked the comments of other reviewers and the response to their comments as well. The authors answered most of the questions in the rebuttal. Therefore, I increase my grade, while I consider that the paper should be improved for a clear acceptance, especially with additional experimental results.
limitations_and_societal_impact: Please see the above comments.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The manuscript entitled “Photonic Differential Privacy with Direct Feedback Alignment” extends their previous work - Differential Privacy with Direct Feedback Alignment. In this work, they leverage the intrinsic noise (which might be controlled by temperature) of optical random projections to build a differentially private DFA mechanism, making Optical Processing Units (OPUs) a solution of choice to provide a private-by-design training. This work is motivated by a photonic implementation that naturally induces noise that we exploit for differential privacy. The proposed method is demonstrated by simulations showing that adding noise does not decrease the performance significantly. In other words, this approach is robust to increasing DP noise. This paper also provides its theoretical analysis.
main_review: This paper has some significance in terms of making Photonic Differential Privacy with Direct Feedback Alignment suitable for protecting privacy in training by nature. I have a few comments and hope them can be addressed before its publication:

1.	On Line 14 Page 4, what is the relation between χ and χ_n?

2.	In definition 2.2 on Page 4, it says A : D ->Im A means Im A is the image of D through A, and O ∈ Im A. How can A(D) which is Im A belong to O, i.e. A(D) ∈ O?

3.	Neither Figure 1 nor Figure 2 are discussed in any section. The authors should discuss them in the corresponding sections.

4.	In Figure 2, the authors use the degree of transparency of the lines to indicate the noise level. However, with more transparency, it becomes quite hard to distinguish the colors of the lines (e.g blue vs black). It will become even worse if we print the paper out. Figure 2 should be revised with other line styles.

5.	In Table 1 Page 9, what is the difference between non-private and sigma=0?

6.	On Line 215 Page 8, it should be ‘improved’ instead of ‘improve’. On Line 31-32 Page 8, the sentence should be rephrased to avoid grammar mistakes.

In summary, I recommend its publication in NeurIPS after those commends are addressed.

limitations_and_societal_impact: Yes, they are addressed adequately.
review_title: null

Meta-review: This paper draws a connection between differentially private machine learning and noise injected by specialty analog hardware - specifically, optical processing units. This noise is normally a downside, but this submission shows that it may, in principle, be useful for privacy.

The reviewers agree that this is an interesting connection. There are some reservations about how well-developed this approach is - e.g. limited experiments, which are simulations rather than actual OPU hardware. However, the results seem acceptable as an initial proof-of-concept for this connection.
Decision: Accept (Poster)