Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: In this paper, the authors propose a meta-framework that applies DP-SGD to NLP tasks. As a DP learning algorithm, DP-SGD provides a practical method to protect the privacy of the training samples of the deep learning model. The framework works on the fine-tuning phase of the pre-trained language model and protects the privacy of the fine-tuning datasets. To adapt DP-SGD to NLP models, the authors propose to fine-tune only a part of the parameters in the large pre-trained language model. The proposed meta-framework can handle various fine-tuning algorithms. The experimental results show the proposed method can achieve performance very close to the non-protection algorithms.
main_review: Pros,
1. The proposed method can handle various fine-tuning algorithms.
2. The experimental results seem promising since the gaps between the proposed methods and the non-protection methods are not so large.
3. The authors conduct experiments on multiple NLP tasks, including NLU and NLP tasks.
4. The framework is also adaptive to other NLG methods.

Cons,
1. Table 3 & 4 compare the proposed methods with the traditional usage (Full). "Full" acts as a baseline method. However, in Table 5 (NLG tasks), there's no baseline method for comparison.
2. It will be better if the model can achieve good performnace when \espilon is less than 5. Usually, \espilon in a range of 0.1 ~ 5 can provide meaningful private protection. Also, the \delta is large than it should be. The value of \delta on the order of 1/|D_train| are very dangerous according to [2]. In that level of \delta, they permit “preserving privacy” by publishing the complete records of a small number of database participants. (But in the experiments of E2E, the data size is 42000 and the \delta is 1/50000.) Unsuitable \epsilon and \delta can ensure the utility (model performance) but the privacy protection becomes too weak.
3. The authors claim that "we are the first to fine-tune GPT-2-Large using differential privacy". Actually, [2] also fine-tune on large GPT-2 with DP-SGD.
4. There's some hyper-parameters play an important role for model training. But, tuning hyper-parameters requires additional information about the private information (accessing validation set or testing set), which leads to private leakage. So, how to count the information leakags of users? How to avoid it?
5. This paper propose a meta-framework that handles several existing fine-tuning algorithms with DP-SGD. The performance is amazing. However, the contribution in terms of the technical novelty is not much.

[1] The Algorithmic Foundations of Differential Privacy, 2014.

[2] Differentially Private Language Models Benefit from Public Pre-training. 2020.
summary_of_the_review: This paper proposes a meta-framework carrying some existing fine-tune methods. The performance looks good but there are still some issues. The technical novelty is limited.

The rebuttal solved most of my concerns. Thanks for the author's efforts!
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Paper studies the deferentially private fine-tuning of large language models and shows that privately finetuning language models can provide good utility. 
main_review: Paper studies the problem of DP finetuning large language models, where DP is enforced during finetuning by using various methods (LoRA, RGP, Compacter). paper is very clearly written and easy to follow.

Although one can say that the paper is mostly empirical and focused on showing that DP finetuning works when the curse of dimensionality for DPSGD is dealt with in one way or the other, I think it adds good value and a proof to the literature.

I do not have any major concerns with the paper.
summary_of_the_review: I like the paper and think that it will add good value to the literature and the conference.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper demonstrates the feasibility of fine-tuning large language models (pretrained on public dataset) on private datasets for various downstream tasks. It proposes a meta-framework in which most of the pretrained weights are held constant and only a small number of additional parameters are updated during fine-tuning. Combined with state-of-the-art dimension reduction and privacy accounting techniques, their method achieves good privacy/utility tradeoff on several GLEU benchmarks using RoBERTa and NLG using GPT-2.
main_review: Strength: 
+ The problem the paper aims to address is an important one. Machine learning with differential privacy is a very active research area, and this paper is a valuable addition to the literature in this field and could serve as a benchmark for further research in the area.

+ The paper is well-written. The presentation is clear. It is a great pleasure to read through the manuscript. 

+ The experiments are well designed and executed. The results show improved privacy/utility trade-off over previous work.

Weakness:
- One major question I have is novelty. The idea to fine-tune large LMs on private datasets is not new [1]. So is the idea to hold most of the pretrained weights constant and only update a small subset of the parameters (e.g., [3]). Thus, this paper is a combination of existing state-of-the-art techniques on several fronts including LoRA [3] for dimension reduction and FFT based method (4) for privacy accounting. While this is solid engineering work and demonstrates the feasibility of integrating DP into NLP, I am not sure if it has enough novelty to be published as a separate research paper.


References:
[1] Differentially Private Language Models Benefit from Public Pre-training

[2] Parameter-efficient transfer learning for nlp.

[3] LoRA: Low-Rank Adaptation of Large Language Models

[4] Numerical composition of differential privacy

summary_of_the_review: This paper presents solid engineering work for adopting DP in NLP tasks using large transformer-based language models pretrained on public datasets. Although the result is interesting, the paper is a combination of several existing techniques and do not have enough novelty to be published as a separate research paper.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper introduces a parameter-efficient framework for privately fine-tuning large language models. The techniques were proposed in prior literature for non-private learning while the authors found that these techniques are very effective for training with differential privacy (DP), which was extremely hard for large models due to the amount of noise added. On common NLP benchmarks and with relatively small privacy budget, these parameter-efficient methods outperformed the regular DPSGD and could even be close to the non-private baseline, in terms of utility. These methods are also much more memory-efficient and faster than DPSGD as well.  

main_review: Strengths
1. The paper is well written and organized. The framework and the particular methods were explained clearly and the experiments were well executed, proving the claims in the paper.
2. The proposed framework could have a lot of impact for NLP practitioners when training DP. Large models are notoriously difficult to train with DP from scratch. Given there are huge amounts of public texts and pretrained models in the NLP community, fine-tuning with privacy as proposed in this paper could be standard for learning on sensitive data. 

Weaknesses and Questions
1. Technique novelty is a bit limited given that all the methods (Adapters, Compactors and LoRA) in the proposed framework are from prior non-private fine-tuning works. The only thing different is that this paper is more using these methods with DPSGD are effective. Could there be specific changes that are more effective just for private learning? 
2. Adapters, Compactors and LoRA are also not only parameter-efficient methods. How well might other sparsification techniques (e.g. lottery tickets [1], diff pruning [2]) compare to the proposed framework?
3. Baseline comparison is lacking, although the authors provided the non-private utility baseline, all non-private numbers are learned with full SGD. It would make more sense to provide non-private numbers for the corresponding parameter-efficient methods.
4. The comparison for RGP is also a bit unfair because it was originally proposed for training with privacy from scratch. Is it likely that training large models from scratch with DP could be better with the parameter-efficient frameworks as well?

References

[1] The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networks. Jonathan Frankle, Michael Carbin

[2] Parameter-Efficient Transfer Learning with Diff Pruning. Demi Guo, Alexander M. Rush, Yoon Kim
summary_of_the_review: Overall, I am leaning towards accepting this paper given the strong results and the hope for learning large models with differential privacy. The experiment section could be strengthened with better comparison to baseline methods.
review_title: null

Meta-review: Discussions and additional baseline experiments added during the author response period were enough to motivate multiple reviewers to change their recommendation to an accept during the author response. Multiple reviewers felt that the technical novelty of the work was limited, but the rebuttal cleared up their concerns enough to motivate them to switch their assessments to accept.

The claim of this work is that it provides a simpler, sparser, and faster algorithms for differentially private fine tuning of LLMs, yielding SOTA privacy results vs. utility on a number of standard NLP tasks. The work proposes a meta-framework. 

In the end, all reviewers rated this paper as an accept and the AC also recommends acceptance.
Decision: Accept (Poster)