Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes to do layer freezing for DPSGD training. It analyzes the properties of different layers in the training process, provides some theoretical analysis on the affect of freezing, and shows the effectiveness of the algorithm in some real datasets.
strength_and_weaknesses: Strength:
The paper looks at an important problem, and provides some interesting empirical and theoretical analyses. I like the part about PWCCA specifically.

Weakness:
- Given the amount of work on layer freezing in private training (though in the pre-training / fine-tuning case, as has been mentioned in the paper), I'm not so sure about the novelty of the work.
- The empirical improvement doesn't seem very significant.
clarity,_quality,_novelty_and_reproducibility: Clarity:
In general it's clear, but the theoretical analysis seems a bit confusing to me. (See point below.)

Quality:
- The analysis in Section 3.4 sounds quite straightforward to me. Because I think when we freeze some parameters, the norm "quota" of the rest of the parameters are for sure increased and that would give us reduced bias. Could you elaborate more on the difficulty of the analysis?
- The empirical results don't seem very significant.

Novelty:
I'm a bit concerned about this, as it seems like the idea of layer freezing is quite common in DPSGD training (though in the pre-training / fine-tuning case, as has been mentioned in the paper). Also, I feel like the works about per-layer clipping or adaptive clipping might be related, as they also look at properties of different layers. I guess per-layer clipping can be viewed as a general case of freezing, i.e. some layer has clip norm 0.

Reproducibility:
I didn't see the specification of batch size and number of steps in the experiments. Those parameters are quite essential as they affects the privacy-utility tradeoff.


Other comments:
"... adding noise does not bias the estimation...A higher variance means a larger noise is more likely added to s_t^B , therefore we would expect γ_t to be large.": It seems a bit contradictive to me. Also, I feel like if the noise is increased by increasing C, then γ_t^B might even be smaller, right?

- Assumption 3.2 "... does not change the gradients that are clipped and unclipped gradients": I don't understand the sentence. Could you elaborate more?
summary_of_the_review: Some analyses seem interesting, while I'm a bit concerned about the novelty of the work.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper studies the DP-SGD with a set of fine-tuning methods, which freeze some hidden layers in a neural network. The authors claim that their method can (under some strong assumptions) improve the utility under the same privacy budget, which is verified on small image datasets.
strength_and_weaknesses: Strength: The paper is clearly written and the algorithm is carefully verified, from both theoretical and empirical perspectives.

Weakness: The major flaw is in the novelty which is explained in detail in the following section. Another major flaw is the scope of this work: notice that DP is a systematic effort, covering different clipping function (e.g. recent DP-NSGD or automatic clipping still work with layer freezing, but not mentioned; also per-layer clipping will likely violate Assumption 3.2; but this work only considers the common gradient clipping in the flat clipping style), fine-tuning methods, tasks (this work only experiment on tiny images and not consider language tasks), optimzers (only experiment with SGD, not adaptive optimizers which have been used to achieve SOTA on CIFAR10), etc. Therefore, this work really studies a very narrow perspective of DP deep learning.

Because of the narrow scope of this work, I would expect to see better analysis or empirical improvement. However, the improvement is insignificant (about 1% within the incomplete Table 1), and the analysis relies on too strong assumptions that are not empirically verified. In fact, it shouldn't be hard to print out the percentage of per-sample gradients that are clipped/not-clipped before and after freezing.
clarity,_quality,_novelty_and_reproducibility: The overall quality is okay, especially the clarity. However, I doubt the originality of the work is significant given that last-layer training (also known as linear probing) and training only the last few layers is commonly used already (see Sec 5.2 in https://aclanthology.org/2020.blackboxnlp-1.4.pdf and "top2" method in https://arxiv.org/pdf/2110.05679.pdf)
summary_of_the_review: I recommend heavy revision of this work before publishing.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper studies the effect of freezing parameters after certain iterations of differentially private training, both theoretically and empirically. Theory shows the convergence could be improved under certain situations and experiments show freezing layers closer to input (bottom layers) after training for a while could improve performance after DP training.


strength_and_weaknesses: Strengths:
1. Freezing bottom layers during training is proven to be useful in DP training in a few other works, this paper provides some theory support of the approach.

2. The decomposition of bias caused by clipping from an angular perspective is new in the community, to the best of my knowledge.

Weaknesses:
1. It is unclear whether the bias caused by clipping in Lemma 3.1 is a tight characterization or not, if the authors could provide a case when the bias is achieved, it will make the theory more convincing.

2. The experiments are only for relatively simple architectures and datasets, if the authors could verify that freezing lower layers will benefit more variety of tasks, it would strengthen the contribution.
clarity,_quality,_novelty_and_reproducibility: The paper is easy to follow and in good quality, the novelty is moderate significant and the experiment should be reproducible with details provided in the paper.
summary_of_the_review: Overall I feel the paper studied an interesting problem/approach, with both theory and experiment support, but there is plenty room for improvements.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This work investigates layer freezing during private training. Prefixes of the network are iteratively frozen as training proceeds. This leads to minor improvements in accuracy (i.e., absolute improvements on the order of 1%-2%). Some theoretical analysis/explanation is given.

Reviewers felt the method was a bit low in novelty (since freezing parameters is well studied), and the effect is quite small to stand alone as the main contribution. The theoretical analysis/perspective was of interest, but was not considered significant enough to warrant acceptance. 
justification_for_why_not_higher_score: Low novelty of investigating layer freezing, small effect size.
Decision: Reject