SlowGuess/NeurIPS_2023_OCR huggingface dataset:
B Truncated Negative Binomial Distribution
We introduce the definition of truncated negative binomial distribution [32] in this section.
Definition B.1. (Truncated Negative Binomial Distribution [32]). Let  $\gamma \in (0,1)$  and  $\theta \in (-1,\infty)$ .
Define a distribution  $\mathrm{NegBin}(\theta, \gamma)$  on  $\mathbb{N}^+$  as follows:
- If  $\theta \neq 0$  and  $T$  is drawn from  $\mathrm{NegBin}(\theta, \gamma)$ , then
$$
\forall k \in \mathbb {N} \quad \mathbb {P} [ T = k ] = \frac {(1 - \gamma) ^ {k}}{\gamma^ {- \theta} - 1} \cdot \prod_ {\ell = 0} ^ {k - 1} \left(\frac {\ell + \theta}{\ell + 1}\right)
$$
and  $\mathbb{E}[T] = \frac{\theta\cdot(1 - \gamma)}{\gamma\cdot(1 - \gamma^{\theta})}$ . Note that when  $\theta = 1$ , it reduces to the geometric distribution with parameter  $\gamma$ .
- If  $\theta = 0$  and  $T$  is drawn from  $\mathrm{NegBin}(0, \gamma)$ , then
$$
\mathbb {P} [ T = k ] = \frac {(1 - \gamma) ^ {k}}{k \cdot \log (1 / \gamma)}
$$
and  $\mathbb{E}[T] = \frac{1 / \gamma - 1}{\log(1 / \gamma)}$
C Privatization of Sampling Distribution
C.1 General Functional Projection Framework
In section 3.2, we define the projection onto a convex set  $S_{C,c}$  as an optimization in terms of  $\ell_2$  loss. More generally, we can perform the following general projection at the  $j$ -th iteration by considering an additional penalty term, with a constant  $\nu$ :
$$
\min  _ {f} \| f - \pi^ {(j)} \| _ {2} + \nu K L (\pi^ {(j)}, f) \tag {C.1}
$$
When  $\nu = 0$ , we recover the original  $\ell_2$  projection. Moreover, it's worth noting that our formulation has implications for the information projection literature [9, 21]. Specifically, as the penalty term parameter  $\nu$  approaches infinity, the optimization problem evolves into a minimization of KL divergence, recovering the objective function of information projection (in this instance, moment projection). However, the constraint sets in the literature of information projection are generally much simpler than our set  $S_{C,c}$ , making it infeasible to directly borrow methods from its field. To the best of our knowledge, our framework is the first to address this specific problem in functional projection and establish a connection to information projection in the DP community.
C.2 Practical Implementation of Functional Projection
Optimization program (3.1) is essentially a functional programming since  $f$  is a function on  $\Lambda$ . However, when  $\Lambda$  represents a non-discrete parameter space, such functional minimization is typically difficult to solve analytically. Even within the literature of information projection, none of the methods considers our constraint set  $S_{C,c}$ , which can be viewed as the intersections of uncountable single-point constraints on  $f$ . To obtain a feasible solution to the optimization problem, we leverage the idea of discretization. Instead of viewing (3.1) as a functional projection problem, we manually discretize  $\Lambda$  and solve (3.1) as a minimization problem over a discrete set. Note that such approximation is unavoidable in numerical computations since computers can only manage discrete functions, even when we solve the functional projection analytically. Moreover, we also have the freedom of choosing the discretization grid without incurring extra privacy loss since the privacy cost is independent of the size of parameter space. By converting  $S_{C,c}$  into a set of finite constraints, we are able to solve the discrete optimization problem efficiently using CVXOPT [2].
D DP-HyPO with General Prior Distribution
In the main manuscript, we assume  $\pi^{(0)}$  follows a uniform distribution over the parameter space  $\Lambda$  for simplicity. In practice, informed priors can be used when we want to integrate knowledge about the parameter space into sampling distribution, which is common in the Bayesian optimization framework. We now present the general DP-HyPO framework under the informed prior distribution.
To begin with, we define the space of essentially bounded density functions with respect to  $\pi^{(0)}$  as
$$
S _ {C, c} \left(\pi^ {(0)}\right) = \left\{f \in \Lambda^ {\mathbb {R} ^ {+}}: \operatorname {e s s} \sup  f / \pi^ {(0)} \leq C, \operatorname {e s s} \inf  f / \pi^ {(0)} \geq c, \int_ {\alpha \in \Lambda} f (\alpha) d \alpha = 1, f \ll \pi^ {(0)} \right\}.
$$
When  $\pi^{(0)} = \frac{1}{\mu(\lambda)}$ , we recover the original definition of  $S_{C,c}$ . Note that here  $f \ll \pi^{(0)}$  means that  $f$  is absolute continuous with respect to the prior distribution  $\pi^{(0)}$  and this ensures that  $S_{C,c}(\pi^{(0)})$  is non-empty. Note that such condition is automatically satisfied when  $\pi^{(0)}$  is the uniform prior over the entire parameter space.
To define the projection of a density at the  $j$ -th iteration,  $\pi^{(j)}$ , into the space  $S_{C,c}(\pi^{(0)})$ , we consider the following functional programming problem:
$$
\min _ {f} \| f - \pi^ {(j)} \| _ {2}
$$
$$
\mathrm {s . t .} f \in S _ {C, c} (\pi^ {(0)}),
$$
which is a direct generalization of Equation (3.1). As before,  $S_{C,c}(\pi^{(0)})$  is also convex and closed and the optimization program can be solved efficiently via discretization on  $\Lambda$ .
E.1 MNIST Simulation
We now provide the detailed description of the experiment in Section 4.2.1. As specified therein, we consider two variable hyperparameters: the learning rate  $\eta$  and clipping norm  $R$ , while keeping all the other hyperparameters fixed. We set the training batch size to be 256, and the total number of epoch to be 10. The value of  $\sigma$  is determined based on the allocated  $\varepsilon$  budget for each base algorithm. Specifically,  $\sigma = 0.71$  for GP and  $\sigma = 0.64$  for Uniform. For demonstration purposes, we set  $C$  to 2 and  $c$  to 0.75 in the GP method, so each base algorithm of Uniform has  $\log C / c$  more privacy budget than base algorithms in GP method. In Algorithm 3, we set  $\tau$  to 0.1 and  $\beta$  to 1. To facilitate the implementation of both methods, we discretize the learning rates and clipping norms as specified in the following setting to allow simple implementation of sampling and projection for Uniform and GP methods.
Setting E.1. we set a log-spaced grid discretization on  $\eta$  in the range [0.0001, 10] with a multiplicative factor of  $\sqrt[3]{10}$ , resulting in 16 observations for  $\eta$ . We also set a linear-spaced grid discretization on  $R$  in the range [0.3, 6] with an increment of 0.3, resulting in 20 observations for  $R$ . This gives a total of 320 hyperparameters over the search region.
We specify the network structure we used in the simulation as below. It is the standard CNN in Tensorflow Privacy and Opacus.
class ConvNet(nnModule): def__init__(self): super().__init_(self.conv1  $=$  nn.Conv2d(1,16,8,2,padding  $\equiv$  3) self.conv2  $=$  nn.Conv2d(16,32,4,2) self.fc1  $=$  nn.Linear(32\*4\*4,32) self.fc2  $=$  nn.Linear(32，10) def forward(self,x): x  $=$  F.relu(self.conv1(x)) x  $=$  F.max_pool2d(x,2,1) x  $=$  F.relu(self.conv2(x)) x  $=$  F.max_pool2d(x,2,1) x  $=$  x.view(-1，32\*4\*4) x  $=$  F.relu(self.fc1(x)) x  $=$  self.fc2(x) returnx
Despite the simple nature of MNIST, the simulation of training CNN with the two methods over each different fixed  $T$  still take significant computation resources. Due to the constraints on computational resources, we conduct a semi-real simulation using the MNIST dataset. We cache the mean accuracy of 5 independently trained models for each discretized hyperparameter and treat that as a proxy for the
"actual accuracy" of the hyperparameter. Each time we sample the accuracy of a hyperparameter, we add Gaussian noise with a standard deviation of 0.1 to the cached mean. We evaluate the performance of the output model based on the "actual accuracy" corresponding to the selected hyperparameter.
E.2 CIFAR-10 Simulation
We also provide a description of the experiment in Section 4.2.2. We set the training batch size to be 256, and the total number of epoch to be 10. The value of  $\sigma$  is determined based on the allocated  $\varepsilon$  budget for each base algorithm. Specifically,  $\sigma = 0.65$  for GP and  $\sigma = 0.6$  for Uniform. Regarding our GP method, we adopt the same set of hyperparameters as used in our MNIST experiments, which include  $C = 2$ ,  $c = 0.75$ ,  $\tau = 0.1$ , and  $\beta = 1$ . As usual, we discretize the learning rates and clipping norms as specified in the following Setting.
Setting E.2. we set a log-spaced grid discretization on  $\eta$  in the range [0.0001, 1] with a multiplicative factor of  $10^{0.1}$ , resulting in 50 observations for  $\eta$ . We also set a linear-spaced grid discretization on  $R$  in the range [0, 100] with an increment of 2, resulting in 50 observations for  $R$ . This gives a total of 2500 hyperparameter combinations over the search region.
We follow the same CNN model architecture with our MNIST experiments.
In Figure 2, we provide the hyperparameter landscape for  $\sigma = 0.65$ , as generated by BoTorch [3].
Figure 2: Mean and standard error of the accuracy of DP-SGD over the two hyperparameters for  $\sigma = 0.65$ . The learning rate (log-scale) ranges from 0.00001 (left) to 1 (right) while the clipping norm ranges from 0 (top) to 100 (bottom). The landscape for  $\sigma = 0.6$  is similar, with a better accuracy.
E.3 Federated Learning Simulation
Figure 3: Mean and Standard Error of the loss of the FL over the two hyperparameters.
We now provide the detailed description of the experiment in Section 4.2.3. As specified therein, we considered a FL task on a proprietary dataset<sup>5</sup>. Our objective is to determine the optimal learning
<sup>5</sup>We are unable to report a lot of detail about the proprietary dataset due to confidentiality.
rates for the central server (using AdaGrad) and the individual users (using SGD). To simulate this scenario, we utilize the landscape generated by BoTorch [3], as illustrated in Figure 3, and consider it as our reference landscape for both mean and standard deviation of the loss for each hyperparameter. When the algorithm (GP or Uniform) visits a specific hyperparameter  $\lambda$ , our oracle returns a noisy score  $q(\lambda)$  drawn from a normal distribution  $N(\mu_{\lambda}, \sigma_{\lambda})$ . Figure 3 displays a heatmap that presents the mean  $(\mu_{\lambda})$  and standard error  $(\sigma_{\lambda})$  structure of the loss over these two hyperparameters, providing insights into the landscape's characteristics.
In this section, we delve into a more detailed review of the pertinent literature.
We begin with non-private Hyperparameter Optimization, a critical topic in the realm of Automated Machine Learning (AutoML) [16]. The fundamental inquiry revolves around the generation of high-performing models within a specific search space. In historical context, two types of optimizations have proven significant in addressing this inquiry: architecture optimization and hyperparameter optimization. Architecture optimization pertains to model-specific parameters such as the number of neural network layers and their interconnectivity, while hyperparameter optimization concerns training-specific parameters, including the learning rate and minibatch size. In our paper, we incorporate both types of optimizations within our HPO framework. Practically speaking,  $\Lambda$  can encompass various learning rates and network architectures for selection. For HPO, elementary methods include grid search and random search [22, 17, 15]. Progressing beyond non-adaptive random approaches, surrogate model-based optimization presents an adaptive method, leveraging information from preceding results to construct a surrogate model of the objective function [26, 41, 20, 30]. These methods predominantly employs Bayesian optimization techniques, including Gaussian process [33], Random Forest [18], and tree-structured Parzen estimator [5].
Another important topic in this paper is Differential Privacy (DP). DP offers a mathematically robust framework for measuring privacy leakage. A DP algorithm promises that an adversary with perfect information about the entire private dataset in use – except for a single individual – would find it hard to distinguish between its presence or absence based on the output of the algorithm [12].
Historically, DP machine learning research has overlooked the privacy cost associated with HPO [1, 39, 42]. The focus has only recently shifted to the "honest HPO" setting, where this cost is factored in [28]. Addressing this issue directly involves employing a composition-based analysis. If each training run of a hyperparameter upholds DP, then the overall HPO procedure adheres to DP through composition across all attempted hyperparameter values. A plethora of literature on the composition of DP mechanisms attempts to quantify a better DP guarantee of the composition. Vadhan et al. [36] demonstrated that though  $(\varepsilon, \delta)$ -DP possesses a simple mathematical form, deriving the precise privacy parameters of a composition is #-P hard. Despite this obstacle, numerous advanced techniques are available to calculate a reasonably accurate approximation of the privacy parameters, such as Moments Accountant [1], GDP Accountant [11], and Edgeworth Accountant [37]. The efficacy of these accountants is attributed to the fact that it is easier to reason about the privacy guarantees of compositions within the framework of Rényi differential privacy [27] or  $f$ -differential privacy [11]. These methods have found widespread application in DP machine learning. For instance, when training deep learning models, one of the most commonly adopted methods to ensure DP is via noisy stochastic gradient descent (noisy SGD) [4, 35], which uses Moments Accountant to better quantify the privacy guarantee.
Although using composition for HPO is a simple and straightforward approach, it carries with it a significant challenge. The privacy guarantee derived from composition accounting can be excessively loose, scaling polynomially with the number of runs. Chaudhuri et al. [7] were the first to enhance the DP bounds for HPO by introducing additional stability assumptions on the learning algorithms. [24] made significant progress in enhancing DP bounds for HPO without relying on any stability properties of the learning algorithms. They proposed a simple procedure where a hyperparameter was randomly selected from a uniform distribution for each training run. This selection process was repeated a random number of times according to a geometric distribution, and the best model obtained from these runs was outputted. They showed that this procedure satisfied  $(3\varepsilon ,0)$  -DP as long as each training run of a hyperparameter was  $(\varepsilon ,0)$  -DP. Building upon this, [32] extended the procedure to accommodate negative binomial or Poisson distributions for the repeated uniform selection. They also
offered more precise Rényi DP guarantees for this extended procedure. Furthermore, [8] explored a generalization of the procedure for top- $k$  selection, considering  $(\varepsilon, \delta)$ -DP guarantees.