SlowGuess/NeurIPS_2023_OCR huggingface dataset:
We discuss this lemma in the Appendix in more details. The next lemma is standard, showing how large the function values can decrease in each step.
Lemma 3.5. By setting  $\eta = 1 / M$ , we have  $F(x_{t + 1})\leq F(x_t) + \eta \| \nabla_t\| \cdot \| \nabla F(x_t) - \nabla_t\| -\frac{\eta}{2}\| \nabla_t\|^2$ . Moreover, with probability at least  $1 - \omega$ , for each  $t\le T$  such that  $\| \nabla F(x_t)\| \geq \gamma$ , we have
$$
F (x _ {t + 1}) - F (x _ {t}) \leq - \eta \| \nabla_ {t} \| ^ {2} / 6 \leq - \eta \gamma^ {2} / 6.
$$
With the algorithm designed to control the drift term, the guarantee for Stochastic Spider to find the second order stationary point is stated below:
Lemma 3.6. Suppose  $\mathcal{O}_1$  and  $\mathcal{O}_2$  are  $\zeta_1$  and  $\zeta_2$  norm-subGaussian respectively. If one sets  $\gamma = O(1)\sqrt{(\zeta_2^2\kappa + 4\zeta_1^2)\cdot\log(Td / \omega)}$ , with probability at least  $1 - \omega$ , at least one point in the output set  $\{x_1,\dots ,x_T\}$  of Algorithm 1 is  $\alpha$ -SOSP, where
$$
\alpha = \gamma \log^ {3} (B M d / \rho \omega \gamma) = \sqrt {(\zeta_ {2} ^ {2} \kappa + 4 \zeta_ {1} ^ {2}) \cdot \log (\frac {d / \omega}{\zeta_ {2} ^ {2} \kappa + \zeta_ {1} ^ {2}})} \cdot \log^ {3} (\frac {B M d}{\rho \omega (\zeta_ {2} ^ {2} \kappa + \zeta_ {1} ^ {2})}).
$$
As mentioned before, we can bound the number of occurrences where the drift gets large and hence bound the total time we query the oracle of the first kind.
Lemma 3.7. Under the event that  $\| \nabla_t - \nabla F(x_t)\| \leq \gamma /4$  for all  $t\in [T]$  and our parameter settings, letting  $K = \{t\in [T]:\mathrm{drift}_t\geq \kappa \}$  be the set of iterations where the drift is large, we know  $|K|\leq O\bigl {(}\frac{B\eta}{\kappa} +T\gamma^{2}\eta^{2} / \kappa \bigr) = O\bigl {(}B\eta \log^4 (\frac{dMB}{\rho\gamma\omega}) / \kappa \bigr).$
4 Private SOSP
We adopt the framework before and get our main results on finding SOSP privately by constructing private gradient oracles in this section. Finding SOSP for empirical risk function  $F_{\mathcal{D}}$  and for population risk function  $F_{\mathcal{P}}$  are discussed in Subsection 4.1 and Subsection 4.2 respectively.
4.1 Convergence to the SOSP of the Empirical Risk
We use Stochastic Spider to improve the convergence to  $\alpha$ -SOSP of the empirical risk, and aim at getting  $\alpha = \tilde{O}(d^{1/3}/n^{2/3})$ . We use the full-batch size for simplicity, and use the gradient oracles
$$
\mathcal {O} _ {1} (x) := \nabla F _ {\mathcal {D}} (x) + g _ {1}, \text {a n d} \mathcal {O} _ {2} (x, y) := \nabla F _ {\mathcal {D}} (x) - \nabla F _ {\mathcal {D}} (y) + g _ {2}, \tag {2}
$$
where  $g_{1}\sim \mathcal{N}(0,\sigma_{1}^{2}I_{d})$  and  $g_{2}\sim \mathcal{N}(0,\sigma_{2}^{2}\| x - y\|_{2}^{2}I_{d})$  are added to ensure privacy by Gaussian mechanism (in Appendix).
Before stating the formal results, note that by Lemma 3.6, the framework can only guarantee the existence of an  $\alpha$ -SOSP in the outputted set. In order to find the SOSP privately from the set, we adopt the well-known AboveThreshold algorithm, whose pseudo-code can be found in Algorithm 2 in the Appendix. Algorithm 2 is a slight modification of the well-known AboveThreshold algorithm in [20], and we get the following guarantee immediately.
Lemma 4.1. Algorithm 2 is  $(\varepsilon, 0)$ -DP. Given the point set  $\{x_1, \dots, x_T\}$  and  $S$  of size  $n$  as the input, (i) if it outputs any point  $x_i$ , then with probability at least  $1 - \omega$ , we know
$$
\| \nabla F _ {S} (x _ {i}) \| \leq \alpha + \frac {3 2 \log (2 T / \omega) G}{n \varepsilon}, a n d \operatorname {s m i n} \left(\nabla^ {2} F _ {S} (x _ {i})\right) \geq - \sqrt {\rho \alpha} - \frac {3 2 \log (2 T / \omega) M}{n \varepsilon}
$$
(ii) if there exists a  $\alpha$ -SOSP point  $x \in \{x_i\}_{i \in [T]}$ , then with probability at least  $1 - \omega$ , Algorithm 2 will output one point.
Choosing the appropriate noise scales for the Gaussian added in Equation (2) and running Algorithm 1 can get a private set of points which contains at least one good SOSP. Then we can run Algorithm 2 to find the good SOSP in the set privately. The formal guarantee is stated below:
Theorem 4.2 (Empirical). For  $\varphi = O(1)$ , use Equation (2) as gradient oracles with  $\kappa = \frac{G^{4/3}B^{1/3}}{M^{5/3}}\left(\frac{\sqrt{d}}{n\sqrt{\varphi}}\right)^{2/3}$ ,  $\sigma_{1} = \frac{G\sqrt{B\eta/\kappa}\log^{2}(dB/\omega)}{n\sqrt{\varphi}}$ ,  $\sigma_{2} = \frac{M\sqrt{BM/\alpha_{1}^{2}}\log^{5}(dB/\omega)}{n\sqrt{\varphi}}$ . Running Algorithm 1, outputting the set  $\{x_{i}\}_{i\in [T]}$  if the total time to query  $\mathcal{O}_{1}$  is bounded by  $O(B\eta\log^{4}(\frac{dB}{\rho\gamma\omega})/\kappa)$ , otherwise outputting a set of  $T$  arbitrary points is  $(\varphi/2)$ -zCDP. With probability at least  $1 - \omega$ , at least one point in the output set is  $\alpha_{1}$ -SOSP of  $F_{\mathcal{D}}$  with
$$
\alpha_ {1} = O \left(\left(\frac {\sqrt {d B G M}}{n \sqrt {\varphi}}\right) ^ {2 / 3} \cdot \log^ {6} \left(\frac {n B M d}{\rho \omega}\right)\right).
$$
Moreover, if we run Algorithm 2 with inputs  $\{x_i\}_{i\in [T]},\mathcal{D},B,M,G,\rho ,\alpha_1$  and  $\varepsilon = \sqrt{\varphi}$ , with probability at least  $1 - \omega$ , we can get an  $\alpha_{2}$ -SOSP of  $F_{\mathcal{D}}$  with  $\alpha_{2} = O\left(\alpha_{1} + \frac{G\log(n / G\omega)}{n\sqrt{\varphi}} +\frac{M\log(dBG M / \rho\omega)}{n\sqrt{\varphi}\sqrt{\rho}}\sqrt{\alpha_{1}}\right)$ . The whole procedure is  $\varphi$ -zCDP.
For more generality, we state the above theorem in terms of zCDP.  $\varphi$ -zCDP implies  $(\varphi + 2\sqrt{\varphi\log(1 / \delta)}, \delta)$ -DP, which gives the bounds in Table 1 (see Appendix for details).
Remark 4.3. It's worth noting that the cost of gradient computation can be reduced by utilizing smaller batch sizes. However, our work does not focus on optimizing this aspect.
4.2 Convergence to the SOSP of the Population Risk
This subsection aims at getting an  $\alpha$ -SOSP for  $F_{\mathcal{P}}$  (the population function). Differing from the stochastic oracles used for empirical function  $F_{\mathcal{D}}$ , we do not use full batch in the oracle. As an alternative, we draw fresh samples from  $\mathcal{D}$  without replacement with a smaller batch size:
$$
\mathcal {O} _ {1} (x) := \frac {1}{b _ {1}} \sum_ {z \in S _ {1}} \nabla f (x; z) + g _ {1}, \text {a n d} \mathcal {O} _ {2} (x, y) := \frac {1}{b _ {2}} \sum_ {z \in S _ {2}} (\nabla f (x; z) - \nabla f (y; z)) + g _ {2}, \tag {3}
$$
where  $S_{1}$  and  $S_{2}$  are sets of size of  $b_{1}$  and  $b_{2}$  respectively drawn from  $\mathcal{D}$  without replacement,  $g_{1} \sim \mathcal{N}(0, \sigma_{1}^{2} I_{d})$  and  $g_{2} \sim \mathcal{N}(0, \sigma_{2}^{2} \| x - y \|_{2}^{2} \cdot I_{d})$  are added for privacy guarantee. These gradient oracles satisfy the following.
Claim 4.4. The gradient oracles  $\mathcal{O}_1$  and  $\mathcal{O}_2$  constructed in Equation (3) are a first kind of  $O\left(\frac{L\sqrt{\log d}}{\sqrt{b_1}} + \sqrt{d}\sigma_1\right)$  norm-subGaussian gradient oracle and second kind of  $O\left(\frac{M\sqrt{\log d}}{\sqrt{b_2}} + \sqrt{d}\sigma_2\right)$  norm-subGaussian gradient oracle respectively.
Recall that in the empirical case, we use Algorithm 2 to choose the SOSP for  $F_{\mathcal{D}}$ . But in the population case, we need to find SOSP for  $F_{\mathcal{P}}$ , and what we have are samples from  $\mathcal{P}$ . We need the following technical results to help us find the SOSP from the set, which follows from Hoeffding inequality for norm-subGaussians (Lemma 2.4) and Matrix Bernstein inequality (in the Appendix).
Lemma 4.5. Fix a point  $x \in \mathbb{R}^d$ . Given a set  $S$  of  $m$  samples drawn i.i.d. from the distribution  $\mathcal{P}$ , then we know with probability at least  $1 - \omega$ , we have
$$
\| \nabla F _ {S} (x) - \nabla F _ {\mathcal {P}} (x) \| _ {2} \leq O \big (\frac {G \log (d / \omega)}{\sqrt {m}} \big) \bigwedge \| \nabla^ {2} F _ {S} (x) - \nabla^ {2} F _ {\mathcal {P}} (x) \| _ {o p} \leq O \big (\frac {M \log (d / \omega)}{\sqrt {m}} \big).
$$
By choosing the appropriate noise scales  $\sigma_{1}$  and  $\sigma_{2}$  to ensure the privacy guarantee, we can bound the population bound similar to the empirical bound with these tools.
Theorem 4.6 (Population). Divide the dataset  $\mathcal{D}$  into two disjoint datasets  $\mathcal{D}_1$  and  $\mathcal{D}_2$  of size  $\lceil n/2 \rceil$  and  $\lfloor n/2 \rfloor$  respectively. Set  $b_1 = \frac{n\kappa}{B\eta}, b_2 = \frac{n\alpha_1^2}{BM}, \sigma_1 = \frac{G}{b_1\sqrt{\varphi}}, \sigma_2 = \frac{M}{b_2\sqrt{\varphi}}$  and  $\kappa = \max \left( \frac{G^{4/3} B^{1/3} \log^{1/3} d}{M^{5/3}} n^{-1/3}, \left( \frac{GB^{2/3}}{M^{5/3}} \right)^{6/7} \left( \frac{\sqrt{d}}{n\sqrt{\varphi}} \right)^{4/7} \right)$  in Equation (3) and use them as gradient oracles. Running Algorithm 1 with  $\mathcal{D}_1$ , and outputting the set  $\{x_i\}_{i \in [T]}$  if the total time to query  $\mathcal{O}_1$  is bounded by  $O(B\eta \log^4 \left( \frac{dMB}{\rho\gamma\omega} \right) / \kappa)$ , otherwise outputting a set of  $T$  arbitrary points, is  $(\varphi/2) - zCDP$ , and with probability at least  $1 - \omega$ , at least one point in the output is  $\alpha_1$ -SOSP of  $F_{\mathcal{P}}$  with
$$
\alpha_ {1} = O \Big ((B G M \cdot \log d) ^ {1 / 3} \frac {1}{n ^ {1 / 3}} + (G ^ {1 / 7} B ^ {3 / 7} M ^ {3 / 7}) (\frac {\sqrt {d}}{n \sqrt {\varphi}}) ^ {3 / 7} \big) \log^ {3} (n B M d / \rho \omega) \Big).
$$
Moreover, if we run Algorithm 2 with inputs  $\{x_i\}_{i\in [T]}$ ,  $\mathcal{D}_2, B, M, G, \rho, \alpha_1, \varepsilon = \sqrt{\varphi}$  with probability at least  $1 - \omega$ , Algorithm 2 can output an  $\alpha_2$ -SOSP of  $F_{\mathcal{P}}$  with  $\alpha_2 = O\left(\alpha_1 + \frac{M\log(ndBGM / \rho\omega)}{\sqrt{\rho\min(n\sqrt{\varphi},n^{1/2})}}\sqrt{\alpha_1} + G\left(\frac{\log(n / G\omega)}{n\sqrt{\varphi}} + \frac{\log(d / \omega)}{\sqrt{n}}\right)\right)$ . The whole procedure is  $\varphi$ -zCDP.
5 Bounding the Private Excess Risk
In this section, we shift our focus from "second-order" guarantees to "zeroth-order" guarantees, and consider the problem of getting good private risk bounds without convexity.
5.1 Polynomial Time Approach
If we want the algorithm to be efficient and implementable in polynomial time, to our knowledge the only known bound is  $O\left(\frac{d\log(1 / \delta)}{\varepsilon^2\log n}\right)$  in [46] for smooth functions. [46] used Gradient Langevin Dynamics, a popular variant of SGD to solve this problem, and prove the privacy by advanced composition [31]. We generalize the exponential mechanism to the non-convex case and implement it without a smoothness assumption.
First recall the Log-Sobolev inequality: We say a probability distribution  $\pi$  satisfies LSI with constant  $C_{\mathrm{LSI}}$  if for all  $f:\mathbb{R}^d\to \mathbb{R}$ ,  $\mathbb{E}_{\pi}[f^{2}\log f^{2}] - \mathbb{E}_{\pi}[f^{2}]\log \mathbb{E}_{\pi}[f^{2}]\leq 2C_{\mathrm{LSI}}\mathbb{E}_{\pi}\| \nabla f\| _2^2$ . A well-known result ([40]) says if  $f$  is  $\mu$ -strongly convex, then the distribution proportional to  $\exp (-f)$  satisfies LSI with constant  $1 / \mu$ . Recall the results from previous results [39] about LSI and DP:
Theorem 5.1 ([39]). Sampling from  $\exp(-\beta F(x; \mathcal{D}) - r(x))$  for some public regularizer  $r$  is  $(\varepsilon, \delta)$ -DP, where  $\varepsilon \leq 2\frac{G\beta}{n}\sqrt{C_{\mathrm{LSI}}}\sqrt{1 + 2\log(1 / \delta)}$ , and  $C_{\mathrm{LSI}}$  is the worst LSI constant.
We can apply the classic perturbation lemma to get the new LSI constant in the non-convex case. Suppose we add a regularizer  $\frac{\mu}{2}\|x\|^2$ , and try to sample from  $\exp(-\beta(F(x; \mathcal{D}) + \frac{\mu}{2}\|x\|^2))$ .
Lemma 5.2 (Stroock perturbation). Suppose  $\pi$  satisfies LSI with constant  $C_{\mathrm{LSI}}(\pi)$ . If  $0 < c \leq \frac{\mathrm{d}\pi'}{\mathrm{d}\pi} \leq C$ , then  $C_{\mathrm{LSI}}(\pi') \leq \frac{C}{c} C_{\mathrm{LSI}}(\pi)$ .
Lemma 5.3 is a more general version of Theorem 3.4 in [23] and can be used to bound the empirical risk.
Lemma 5.3. Let  $\pi (x)\propto \exp (-\beta (F_{\mathcal{D}}(x) + \frac{\mu}{2}\| x\| _2^2))$  . Then for  $\beta GD > d$  , we know
$$
\underset {x \sim \pi} {\mathbb {E}} \left(F _ {\mathcal {D}} (x) + \frac {\mu}{2} \| x \| _ {2} ^ {2}\right) - \underset {x ^ {*} \in \mathcal {K}} {\min } \left(F _ {\mathcal {D}} \left(x ^ {*}\right) + \frac {\mu}{2} \| x ^ {*} \| _ {2} ^ {2}\right) \leq \frac {d}{\beta} \log (\beta G D / d)
$$
We now turn to bound the generalization error, and use the notion of uniform stability:
Lemma 5.4 (Stability and Generalization [10]). Given a dataset  $\mathcal{D} = \{s_i\}_{i\in [n]}$  drawn i.i.d. from some underlying distribution  $\mathcal{P}$ , and given any algorithm  $\mathcal{A}$ , suppose we randomly replace a sample  $s$  in  $\mathcal{D}$  by an independent fresh one  $s'$  from  $\mathcal{P}$  and get the neighboring dataset  $\mathcal{D}'$ , then  $\mathbb{E}_{\mathcal{D},\mathcal{A}}[F_{\mathcal{P}}(\mathcal{A}(\mathcal{D})) - F_{\mathcal{D}}(\mathcal{A}(\mathcal{D}))] = \mathbb{E}_{\mathcal{D},s',\mathcal{A}}[f(\mathcal{A}(\mathcal{D});s')) - f(\mathcal{A}(\mathcal{D}');s'))]$ , where  $\mathcal{A}(\mathcal{D})$  is the output of  $\mathcal{A}$  with input  $\mathcal{D}$ .
As each function  $f(\cdot; s')$  is  $G$ -Lipschitz, it suffices to bound the  $W_2$  distance of  $\mathcal{A}(\mathcal{D})$  and  $\mathcal{A}(\mathcal{D}')$ . If  $\mathcal{A}$  is sampling from the exponential mechanism, letting  $\pi_{\mathcal{D}} \propto \exp(-\beta(F_{\mathcal{D}}(x) + \frac{\mu}{2}\|x\|^2))$  and  $\pi_{\mathcal{D}'} \propto \exp(-\beta(F_{\mathcal{D}'}(x) + \frac{\mu}{2}\|x\|^2))$ , it suffices to bound the  $W_2$  distance between  $\pi_{\mathcal{D}}$  and  $\pi_{\mathcal{D}'}$ . The following lemma can bound the generalization risk of the exponential mechanism under LSI:
Lemma 5.5 (Generalization error bound). Let  $\pi_{\mathcal{D}} \propto \exp(-\beta(F_{\mathcal{D}}(x) + \frac{\mu}{2}\|x\|_2^2))$ . Then we have  $\mathbb{E}_{\mathcal{D}, x \sim \pi_{\mathcal{D}}} [F_{\mathcal{P}}(x) - F_{\mathcal{D}}(x)] \leq O\left(\frac{G^2 \exp(\beta G D)}{n \mu}\right)$ .
We get the following results:
Theorem 5.6 (Risk bound). We are given  $\varepsilon, \delta \in (0,1/2)$ . Sampling from  $\exp(-\beta(F_{\mathcal{D}}(x) + \frac{\mu}{2}\|x\|_2^2))$  with  $\beta = O\left(\frac{\varepsilon\log(nd)}{GD\sqrt{\log(1/\delta)}}\right), \mu = \frac{d}{D^2\beta}$  is  $(\varepsilon, \delta)$ -DP. The empirical risk and population risk are bounded by  $O(GD\frac{d\log\log(n)\sqrt{\log(1/\delta)}}{\varepsilon\log(nd)})$ .
Implementation There are multiple existing algorithms that can sample efficiently from density with LSI, under mild assumptions. For example, when the functions are smooth or weakly smooth, one can turn to the Langevin Monte Carlo [16], and [36]. The algorithm in [46] also requires mild smoothness assumptions. We discuss the implementation of non-smooth functions in bit more details, which is more challenging.
We can adopt the rejection sampler in [26], which is based on the alternating sampling algorithm in [35]. Both [35] and [26] are written in the language of log-concave and strongly log-concave densities, but their results hold as long as LSI holds. By combining them together, we can get the following risk bounds. The details of the implementation can be found in Appendix D.3.
Theorem 5.7 (Implementation, risk bound). For  $\varepsilon, \delta \in (0,1/2)$ , there is an  $(\varepsilon,2\delta)$ -DP efficient sampler that can achieve the empirical and population risks  $O(GD\frac{d\log\log(n)\sqrt{\log(1/\delta)}}{\varepsilon\log(nd)})$ . Moreover, in expectation, the sampler takes  $\tilde{O}\left(n\varepsilon^3\log^3(d)\sqrt{\log(1/\delta)}/(GD)\right)$  function values query and some Gaussian random variables restricted to the convex set  $\mathcal{K}$  in total.
5.2 Exponential Time Approach
In [23], it is shown that sampling from  $\exp \left(-\frac{\varepsilon n}{GD} F_{\mathcal{D}}(x)\right)$  is  $\varepsilon$ -DP, and a nearly tight empirical risk bound of  $\tilde{O}\left(\frac{DGd}{n\varepsilon}\right)$  is achieved for convex functions. It is open what is the bound we can get for non-convex DP-SO.
Upper Bound Given exponential time we can use a discrete exponential mechanism as considered in [9]. We recap the argument and extend it to DP-SO. The proof is based on a simple packing argument, and can be found in the Appendix.
Theorem 5.8. There exists an  $\varepsilon$ -DP differentially private algorithm that achieves a population risk of  $O\left(GD\left(d\log (\varepsilon n / d) / (\varepsilon n) + \sqrt{d\log(\varepsilon n / d)} /(\sqrt{n})\right)\right)$ .
Lower Bound Results in [23] imply that the first term of  $\tilde{O}(GDd / \varepsilon n)$  is tight, even if we relax to approximate DP with  $\delta > 0$ . A reduction from private selection problem shows the  $\tilde{O}(\sqrt{d / n})$  generalization term is also nearly-tight (Theorem 5.11). In the selection problem, we have  $k$  coins, each with an unknown probability  $p_i$ . Each coin is flipped  $n$  times such that  $\{x_{i,j}\}_{j \in [n]}$ , each  $x_{i,j}$  i.i.d. sampled from  $\mathrm{Bern}(p_i)$ , and we want to choose a coin  $i$  with the smallest  $p_i$ . The risk of choosing  $i$  is  $p_i - \min_{i^*} p_{i^*}$ .
Theorem 5.9. Any algorithm for the selection problem has excess population risk  $\tilde{\Omega} (\sqrt{\frac{\log k}{n}})$ .
This follows from a folklore result on the selection problem (see e.g. [5]). We can combine this with the following reduction from selection to non-convex optimization:
Theorem 5.10 (Restatement of results in [23]). If any  $(\varepsilon, \delta)$ -DP algorithm for selection has risk  $R(k)$ , where  $R(k)$  is a function with  $k$  as variables, then any  $(\varepsilon, \delta)$ -DP algorithm for minimizing 1-Lipschitz losses over  $B_d(0,1)$  (the  $d$ -dimensional unit ball) has risk  $R(2^{\Theta(d)})$ .
From this and the aforementioned lower bounds in empirical non-convex optimization we get the following:
Theorem 5.11. For  $\varepsilon \leq 1, \delta \in [2^{-\Omega(n)}, 1/n^{1+\Omega(1)}]$ , any  $(\varepsilon, \delta)$ -DP algorithm for minimizing 1-Lipschitz losses over  $B_d(0,1)$  has excess population risk  $\max \{\Omega(d\log(1/\delta)/(\varepsilon n)), \tilde{\Omega}(\sqrt{d/n})\}$ .
In this paper, we gave improved bounds for finding SOSPs under differential privacy, as well as points with low population risk. We discuss some potential follow-up questions here.
First, there is still a gap between our upper bounds and the lower bounds of [2]. Closing this gap is an interesting question and may lead to novel technical insights about private optimization. To obtain upper bounds for finding SOSP, both our work and the work of [2] uses the oracle of the second kind defined in Definition 3.2. Second, in typical private optimization work, only oracles of the first kind are used. It is possible that the oracle of the second kind is useful in private optimization problems besides finding stationary points, either in theory or practice. In particular, since this oracle has lower sensitivity, it may allow us to tolerate a higher noise level / lower privacy budget across multiple iterations. Third, we privatize the SpiderBoost in the work, and there are other versions of variance-reduced algorithms like Spiker and SARAH. It is interesting if our ideas can be used to privatize those algorithms, and compare their practical performance. Lastly, our polynomial-time excess population risk bounds have a  $O(1 / \log n)$  dependence on the dataset size, whereas for convex losses standard results have a  $\max \{1 / \sqrt{n}, 1 / \varepsilon n\}$  dependence. The stronger dependence is achievable under LSI, but the practical settings in which LSI holds without convexity holding seems limited. It remains an open question to find a practical assumption weaker than convexity that allows us to achieve better dependence on  $n$ .
DG would like to thank Ruoqi Shen and Kevin Tian for several discussions.
[55] Qiuchen Zhang, Jing Ma, Jian Lou, and Li Xiong. Private stochastic non-convex optimization with improved utility rates. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, 2021.
[56] Yingxue Zhou, Xiangyi Chen, Mingyi Hong, Zhiwei Steven Wu, and Arindam Banerjee. Private stochastic non-convex optimization: Adaptive algorithms and tighter generalization bounds. arXiv preprint arXiv:2006.13501, 2020.
A Other Preliminary
Definition A.1 (Laplace distribution). We say  $X \sim \mathrm{Lap}(b)$  if  $X$  has density  $f(X = x) = \frac{1}{2b} \exp \left( \frac{-|x|}{b} \right)$ .
In the analysis we use zero-concentrated differential privacy (zCDP):
Definition A.2 (zCDP). A mechanism  $M$  is  $\varphi$ -zCDP if for all  $\alpha > 1$  and neighboring  $\mathcal{D}$ ,  $\mathcal{D}'$ :
$$
R _ {\alpha} (M (\mathcal {D}), M (\mathcal {D} ^ {\prime})) \leq \varphi \alpha ,
$$
where  $R_{\alpha}$  denotes the  $\alpha$ -Renyi divergence.
Theorem A.3 (zCDP composition, [11]). The (adaptive) composition of  $k$  mechanisms that satisfy  $\varphi_{1} - zCDP$ ,  $\varphi_{2} - zCDP$ , ...,  $\varphi_{k} - zCDP$  respectively is  $(\varphi_{1} + \varphi_{2} + \ldots + \varphi_{k}) - zCDP$ .
Lemma A.4. [Conversion between  $(\varepsilon, \delta)$ -DP and  $zCDP$ , [11]] A mechanism that is  $(\varepsilon, 0)$ -DP is also  $\varepsilon^2/2$ - $zCDP$ . A mechanism that is  $\varphi$ - $zCDP$  is also  $(\varepsilon, \delta)$ -DP for any  $\delta > 0$  and  $\varepsilon = \varphi + 2\sqrt{\varphi \log(1/\delta)}$ .
Theorem A.5 (zCDP of Gaussian Mechanism, [11]). Given a randomized algorithm  $\mathcal{A}: P^* \to \mathbb{R}^d$ , let  $\Delta_2 f = \max_{\text{neighboring } \mathcal{D}, \mathcal{D}'} \| \mathcal{A}(\mathcal{D}) - \mathcal{A}(\mathcal{D}') \|_2$ , then releasing  $\mathcal{A}(\mathcal{D})$  plus noise  $\mathcal{N}(0, \sigma^2)$  is  $\frac{(\Delta_2 f)^2}{2\sigma^2} - zCDP$ .
Theorem A.6 (Matrix Bernstein inequality, [45]). Consider a sequence  $\{X_i\}_{i \in m}$  of independent, mean-zero, symmetric  $d \times d$  random matrices. If for each matrix  $X_i$ , we know  $\| X_i \|_{op} \leq M$ , then for all  $t \geq 0$ , we have  $\operatorname*{Pr}\left[\| \sum_{i \in [m]} X_i \|_{op} \geq t\right] \leq d \exp \left(\frac{-t^2}{2 (\sigma^2 + Mt / 3)}\right)$ , where  $\sigma^2 = \|\sum_{i \in [m]} \mathbb{E} X_i^2\|_{op}$ .
B Omitted Proof of Section 3
B.1 Proof of Lemma 3.3
Proof. If  $\mathrm{drift}_{\tau_t} = 0$  happens, we use the first kind oracle to query the gradient, and hence  $\nabla_{\tau_t} - \nabla F(x_{\tau_t})$  is zero-mean and nSG(2ζ1). If  $t = \tau_t$ , Equation (1) holds by the property of norm-subGaussian.
For each  $\tau_{t} + 1\leq i\leq t$  , conditional on  $\nabla_{i - 1}$  , we know  $\Delta_i - (\nabla F(x_i) - F(x_{i - 1}))$  is zero-mean and nSG(  $\zeta_2\| x_i - x_{i - 1}\|$  ). Note that
$$
\nabla_ {t} - \nabla F (x _ {t}) = \nabla_ {\tau_ {t}} - \nabla F (x _ {\tau_ {t}}) + \sum_ {i = \tau_ {t} + 1} ^ {t} [ \Delta_ {i} - (\nabla F (x _ {i}) - \nabla F (x _ {i - 1})) ].
$$
Equation (1) follows from Lemma 2.4.
We know  $\mathrm{drift}_{t-1} = \sum_{i=\tau_t+1}^t \|x_i - x_{i-1}\|^2 \leq \kappa$  almost surely by the design of the algorithm. By union bound, we know with probability at least  $1 - \omega$ , for each  $t \in [T]$
$$
\left\| \nabla_ {t} - \nabla F (x _ {t}) \right\| ^ {2} \leq C \left(\zeta_ {2} ^ {2} \kappa + 4 \zeta_ {1} ^ {2}\right) \cdot \log (T d / \omega) = \gamma^ {2} / 1 6.
$$
B.2 Discussion of Lemma 3.4
We briefly recap the proof of Lemma 3.4 in [46]. One observation between the decreased function value, and the distance solutions moved is stated below:
Lemma B.1 (Lemma 11, [46]). For each  $t \in [\Gamma]$ , we know
$$
\left\| x _ {t + 1} - x _ {0} \right\| _ {2} ^ {2} \leq 8 \eta (\Gamma (F (x _ {0}) - F (x _ {\Gamma})) + 5 0 \eta^ {2} \Gamma \sum_ {i \in [ \Gamma ]} \| \nabla_ {i} - \nabla F (x _ {t}) \| _ {2} ^ {2}.
$$