DPOptimizer: filter parameters to add noise to

Gianmarco_Aversano: <p>Hello<br>
I modified Opacus source code to create a modified version of <code>DPOptimizer</code> that will add noise only to some specified parameter groups of the the underlying optimizer. I did this because I was having countless errors, like this one:</p>
<pre><code class="lang-auto">self = SGD (
Parameter Group 0
    dampening: 0
    foreach: None
    initial_lr: 0.0001
    lr: 0.0001
    maximize: False
    momentum: 0.9
    nesterov: False
    weight_decay: 0.0
)

    def clip_and_accumulate(self):
        """
        Performs gradient clipping.
        Stores clipped and aggregated gradients into `p.summed_grad```
        """
    
        per_param_norms = [
            g.reshape(len(g), -1).norm(2, dim=-1) for g in self.grad_samples
        ]
&gt;       per_sample_norms = torch.stack(per_param_norms, dim=1).norm(2, dim=1)
E       RuntimeError: stack expects each tensor to be equal size, but got [300] at entry 0 and [50] at entry 12
</code></pre>
<p>I realized I could solve this if I could “skip” DP for some layers, but I could not split one optimizer into two and wrap only one around <code>DPOptimizer</code> because this would turn the training loop into a multi-optimizer one and I’ve struggled integrating Opacus with Pytorch Lightning for multi-optimizer LightningModules. So here’s what I did:</p>
<pre><code class="lang-python">__all__ = ["DPOptimizer"]

import typing as ty
from opacus.optimizers import DPOptimizer as OpacusDPOptimizer
import torch

# from opacus.optimizers.optimizer import _check_processed_flag, _mark_as_processed
# from opt_einsum.contract import contract


def params(
    optimizer: torch.optim.Optimizer,
    accepted_names: ty.List[str] = None,
) -&gt; ty.List[torch.nn.Parameter]:
    """
    Return all parameters controlled by the optimizer
    Args:
        optimizer (torch.optim.Optimizer):
            Current optimizer.
    Returns:
        (ty.List[torch.nn.Parameter]): Flat list of parameters from all `param_groups`
    """
    if accepted_names is not None:
        accepted_names = [name.lower() for name in accepted_names]
    ret = []
    for param_group in optimizer.param_groups:
        if accepted_names is not None and "name" in param_group.keys():
            if param_group["name"].lower() in accepted_names:
                ret += [p for p in param_group["params"] if p.requires_grad]
        else:
            ret += [p for p in param_group["params"] if p.requires_grad]
    return ret


class DPOptimizer(OpacusDPOptimizer):
    """Brainiac-2's DP-Optimizer"""

    def __init__(
        self,
        *args: ty.Any,
        param_group_names: ty.List[str] = None,
        **kwargs: ty.Any,
    ) -&gt; None:
        """Constructor."""
        self.param_group_names = param_group_names
        super().__init__(*args, **kwargs)

    @property
    def params(self) -&gt; ty.List[torch.nn.Parameter]:
        """
        Returns a flat list of ``nn.Parameter`` managed by the optimizer
        """
        return params(self, self.param_group_names)

    def clip_and_accumulate(self) -&gt; ty.Any:
        """Performs gradient clipping. Stores clipped and aggregated gradients into `p.summed_grad`."""
        return super().clip_and_accumulate()
</code></pre>
<p>Now I’m wondering, am I breaking anything? Of course, the same code that was raising the <code>RuntimeError</code> is now not raising any exception, but I’m still skeptical. Will the accountant still work properly? Is this a good solution?</p>
<p>Thanks!</p>

ffuuugor: <p>Hi <a class="mention" href="/u/gianmarco_aversano">@Gianmarco_Aversano</a><br>
I don’t have enough context about your system to say whether these changes affect the validity of the privacy guarantee, but I’ll try to provide high-level overview of what could go wrong.</p>
<p>First thing that immediately jumps out to me is the shape mismatch exception you’ve had in the first place. Errors at this stage might indicate fundamental issues which invalidate DP guarantees for the entire model.<br>
One important requirement the model must satisfy to be viable for DP-SGD is that throughout all layers batch dimension should always remain first (or second if <code>batch_first=False</code>). That is, for every submodule, the input tensor should always be of shape <code>[N, *]</code>, where N is the same as the input batch size and also the same for all layers. We need that to properly compute per sample gradients, i.e. the impact each individual sample from the dataset has on the trained model.<br>
The error you’ve been getting (<code>stack expects each tensor to be equal size</code>) might indicate that somewhere within your <code>forward()</code> method batch dimension is not preserved.</p>
<p>Additionally, you need to understand the implications of “skipping” DP for certain layers. Having noise only for a subset of model parameters does not give you any guarantees about the model as a whole. It only really works if you freeze certain layers, in which case you don’t need to add noise but also you don’t update these parameters at all (see this <a href="https://github.com/pytorch/opacus/blob/main/tutorials/building_text_classifier.ipynb" rel="noopener nofollow ugc">tutorial</a> for more details). Note, that if you do this, you don’t really need two optimizers.</p>

Gianmarco_Aversano: <p>Hello, thanks for replying!</p>
<p>For more context, the model I need to make DP compliant is <a href="https://github.com/lrjconan/GRAN/blob/master/model/gran_mixture_bernoulli.py" rel="noopener nofollow ugc">GRAN</a>, which also sports <code>GRUCell</code> layers…</p>
<p>This was also encountered by other users but I am failing to find that discussion at the moment.</p>
<p>If you know the model GRAN, do you know how one would apply DP to it? If not, what are the limitations of using Opacus? For example, is using <code>GRUCell</code> and/or a number of backward passes that is higher/lower than the number of forward passes a limitation for Opacus?</p>
<p>Please note that I’ve also already tried to replace all the <code>GRUCell</code> layers with private counterparts from Opacus (<code>from opacus.layers.dp_rnn import DPGRUCell</code>).</p>

ffuuugor: <p>Unfortunately I’m not familiar with the specifics of GRAN. AFAIK we do support GRUCells, and in general recurrent networks are supported, and by itself should not cause shape errors you’ve been describing in your post.</p>

Gianmarco_Aversano: <p>Ok, for even more context:</p>
<ul>
<li>I am trying to use Opacus on a graph dataset using PyTorch Geometric. Here, you do not really have batches which are <code>Tensor</code> objects with size <code>(B,*)</code>… But batches are <code>torch_geometric.data.Data</code> objects (or <code>Batch</code>/<code>DataBatch</code>, do not remember exactly). Can this be the problem? But if it is, then why does it work when I apply DP only to some layers?</li>
<li>With <a href="https://github.com/pytorch/opacus/blob/main/examples/dcgan.py" rel="noopener nofollow ugc">GANs</a>, as shown in the link, we apply DP only to the discriminator. With GRAN (the model I need to make DP compliant), I was hoping to achieve the same thing.</li>
</ul>

ffuuugor: <aside class="quote no-group" data-username="Gianmarco_Aversano" data-post="5" data-topic="164027">
<div class="title">
<div class="quote-controls"></div>
<img loading="lazy" alt="" width="24" height="24" src="https://discuss.pytorch.org/user_avatar/discuss.pytorch.org/gianmarco_aversano/48/54198_2.png" class="avatar"> Gianmarco_Aversano:</div>
<blockquote>
<p>Can this be the problem? But if it is, then why does it work when I apply DP only to some layers?</p>
</blockquote>
</aside>
<p>Unfortunately, this is a weak sport of Opacus validation process. If your model does not respect the batch notation, it is possible that Opacus won’t notice it, however the privacy guarantee will be broken.</p>
<p>I’m not familiar with the specifics of PyTorch Geometric - do these <code>DataBatch</code> objects functionally equivalent to batches?</p>
<p>On your second question - there’s a difference between Opacus not throwing an error and you getting meaningful privacy guarantee at the end. If you only apply DP to a subset of training weights, we assume you know what you’re doing, as we try to be flexible in a way you can use opacus. However, the way you describe it, I don’t see what meaningful guarantee (at least theoretical) you get from applying DP to only a subset of training weights</p>