Photonic Differential Privacy with Direct Feedback Alignment
Year: 2021

Abstract:
Optical Processing Units (OPUs) – low-power photonic chips dedicated to large scale random projections – have been used in previous work to train deep neural networks using Direct Feedback Alignment (DFA), an effective alternative to backpropagation. Here, we demonstrate how to leverage the intrinsic noise of optical random projections to build a differentially private DFA mechanism, making OPUs a solution of choice to provide a private-by-design training. We provide a theoretical analysis of our adaptive privacy mechanism, carefully measuring how the noise of optical random projections propagates in the process and gives rise to provable Differential Privacy. Finally, we conduct experiments demonstrating the ability of our learning procedure to achieve solid end-task performance.

heading: 1 Introduction
text: The widespread use of machine learning models has created concern about their release in the wild when trained on sensitive data such as health records or queries in data bases [7, 15]. Such concern has motivated a abundant line of research around privacy-preserving training of models. A popular technique to guarantee privacy is differential privacy (DP), that works by injecting noise in an deterministic algorithm, making the contribution of a single data-point hardly distinguishable from the added noise. Therefore it is impossible to infer information on individuals from the aggregate.
While there are alternative methods to ensure privacy, such as knowledge distillation (e.g. PATE [25]), a simple and effective strategy is to use perturbed and quenched Stochastic Gradient Descent (SGD) [1]: the gradients are clipped before being aggregated and then perturbed by some additive noise, finally they are used to update the parameters. The DP property comes at a cost of decreased utility. These biased and perturbed gradients provide a noisy estimate of the update direction and decrease utility, i.e. end-task performance.
We revisit this strategy and develop a private-by-design learning algorithm, inspired by the implementation of an alternative training algorithm, Direct Feedback Alignment [23], on Optical Processing Units [20], photonic co-processors dedicated to large scale random projections. The analog nature of the photonic co-processor implies the presence of noise, and while this is usually minimized, in this case we propose to leverage it, and tame it to fulfill our needs, i.e to control the level of privacy of the learning process. The main sources of noise in Optical Processing Units can be modeled as additive Poisson noise on the output signal, and approach a Gaussian distribution in the operating regime of the device. In particular, these sources can be modulated through temperature control, in order to attain a desired privacy level.
Finally, we test our algorithm using the photonic hardware demonstrating solid performance on the goal metrics. To summarize, our setting consists in OPUs performing the multiplication by a fixed random matrix, with a different realization of additive noise for every random projection.
∗Equal contribution. Corresponding authors: ruben@lighton.ai and hj.medinaruiz@criteo.com
35th Conference on Neural Information Processing Systems (NeurIPS 2021).

heading: 1.1 Related work
text: The amount of noise needed to guarantee differential privacy was first formalized in [9]. Later, a training algorithm that satisfied Renyi Differential Privacy was proposed in [1]. This sparked a line of research in differential privacy for deep learning, investigating different architecture and clipping or noise injection mechanisms [2, 3]. The majority of these works though rely on backpropagation. An original take was offered in [19], that evaluated the privacy performance of Direct Feedback Alignment (DFA) [23], an alternative to backpropagation. While Lee et al. [19] basically extend the gradient clipping/Gaussian mechanism approach to DFA, our work, while applied to the same DFA setting, is motivated by a photonic implementation that naturally induces noise that we exploit for differential privacy. As such, we provide a new DP framework together with its theoretical analysis.

heading: 1.2 Motivations and contributions
text: We propose a hardware-based approach to Differential Privacy (DP), centered around a photonic co-processor, the OPU. We use it to perform optical random projections for a differentially private DFA training algorithm, leveraging noise intrinsic to the hardware to achieve privacy-by-design. This is a significant departure from the classical view that such analog noise should be minimized, instead leveraging it as a key feature of our approach. Our mechanism can be formalized through the following (simplified) learning rule at layer `:
δW` = −η[(B`+1e︸ ︷︷ ︸ scaled DFA learning signal +
Gaussian hardware noise︷︸︸︷ g ) φ′`(z`)](h`−1︸︷︷︸
neuron-wise clipped activations
)> (1)
Photonic-inspired and tested. The OPU is used as both inspiration and an actual platform for our experiments. We demonstrate theoretically that the noise induced by the analog co-processor makes the algorithm private by design, and we perform experiments on a real photonic co-processor to show we achieve end-task performance competitive with DFA on GPU.
Differential Privacy beyond backpropagation. We extend previous work [19] on DP with DFA both theoretically and empirically. We provide new theoretical elements for noise injected on the DFA learning signal, a setting closer to our hardware implementation.
Theoretical contribution. Previous works on DP and DFA [19] proposes a straightforward extension of the DP-SGD paradigm to direct feedback alignment. In our work, by adding noise directly to the random projection in DFA, we study a different Gaussian mechanism [22] with a covariance matrix depending on the values of the activations of the network. Therefore the theoretical analysis is more challenging than in [19]. We succeed to upper bound the Rényi Divergence of our mechanism and deduce the ( , δ)-DP parameters of our setup.

heading: 2 Background
text: Formally the problem we study the following: the analysis of the built-in Differential Privacy thanks to the combination of DFA and OPUs to train deep architectures. Before proceeding, we recall a minimal set of principles of DFA and Differential Privacy.
From here on {xi}Ni=1 are the training points belonging to Rd, {yi}Ni=1 the target labels belonging to R. The aim of training a neural network is to find a function f : Rd → R that minimizes the true L-risk EXY∼DL(f(X), Y ), where L : R × R → R is a loss function and D a fixed (and unknown) distribution over data and labels (and the (xi, yi) are independent realizations of X,Y ), and to achieve that, the empirical risk 1N ∑N i=1 L(f(xi), yi) is minimized.

heading: 2.1 Learning with Direct Feedback Alignment (DFA)
text: DFA is a biologically inspired alternative to backpropagation with an asymmetric backward pass. For ease of notation, we introduce it for fully connected networks but it generalizes to convolutional networks, transformers and other architectures [17]. It has been theoretically studied in [21, 27]. Note that in the following, we incorporate the bias terms in the weight matrices.
Forward pass. In a model with L layers of neurons, ` ∈ {1, . . . , L} is the index of the `-th layer, W` ∈ Rn`×n`−1 the weight matrix between layers ` − 1 and `, φ` the activation function of the neurons, and h` their activations. The forward pass for a pair (x, y) writes as:
∀` ∈ {1, . . . , L} : z` = W`h`−1,h` = φ`(z`), (2) where h0 .= x and ŷ .= hL = φ(zL) is the predicted output.
Backpropagation update. With backpropagation [28], leaving aside the specifics of the optimizer used (learning rate, etc.), the weight updates are computed using the chain-rule of derivatives :
δW` = − ∂L ∂W` = −[((W`+1)>δz`+1) φ′`(z`)](h`−1)>, δz` = ∂L ∂z` , (3)
where φ′` is the derivative of φ`, is the Hadamard product, and L(ŷ,y) is the prediction loss.
DFA update. DFA replaces the gradient signal (W`+1)>δz`+1 with a random projection of the derivative of the loss with respect to the pre-activations δzL of the last layer. For losses L commonly used in classification and regression, such as the squared loss or the cross-entropy loss, this will amount to a random projection of the error e ∝ ŷ − y. With a fixed random matrix B`+1 of appropriate shape drawn at initialization of the learning process, the parameter update of DFA is:
δW` = −[(B`+1e) φ′`(z`)](h`−1)>, e = ∂L ∂zL
(4)
Backpropagation vs DFA training. Learning using backpropagation consists in iteratively applying the forward pass (2) on batches of training examples and then applying backpropagation updates (3). Training with DFA consists in replacing the backpropagation updates by DFA ones (4). An interesting feature of DFA is the parallelization of the training step, where all the random projections of the error can be done at the same time, as shown in Figure 1.

heading: 2.2 Optical Processing Units
text: An Optical Processing Unit (OPU)2 is a co-processor that multiplies an input vector x ∈ Rd by a fixed random matrix B ∈ RD×d, harnessing the physical phenomenon of light scattering through a diffusive medium [20]. The operation performed is:
p = Bx (5)
If the coefficients of B are unknown, they are guaranteed to be (independently) distributed according to a Gaussian distribution [20, 24]. An additional interesting characteristics of the OPU is its low energy consumption compared to GPUs for high-dimensional matrix multiplication [24].
2Accessible through LightOn Cloud: https://cloud.lighton.ai.
A central feature we will rely on is that the measurement of the random projection (5) may be corrupted by an additive zero-mean Gaussian random vector g, so as for an OPU to provide access to p = Bx+ g. If g is usually negligible, its variance can be modulated by controlling the physical environment around the OPU. We take advantage of this feature to enforce differential privacy. In the current versions of the OPUs, however, modulating the analog noise at will is not easy, so we will simulate the noise numerically in the experiments.

heading: 2.3 Differential Privacy (DP)
text: Differential Privacy [9, 10] sets a framework to analyze the privacy guarantees of algorithms. It rests on the following core definitions. Definition 2.1 (Neighboring datasets). Let {X j}Nj=1 (e.g. X j = Rd) be a domain andD . = ∪Nj=1 X j . D,D′ ∈ D are neighboring datasets if they differ from one element. This is denoted by D ∼ D′. Definition 2.2 ((ε, δ)-differential privacy [10]). Let ε, δ > 0. LetA : D → RangeA be a randomized algorithm, where RangeA is the range of D through A. A is (ε, δ)-differentially private, or (ε, δ)-DP, if for all neighboring datasets D,D′ ∈ D and for all sets O ∈ Im A, the following inequality holds:
P[A(D) ∈ O] ≤ eεP[A(D′) ∈ O] + δ
where the probability relates to the randomness of A.
Mironov [22] proposed an alternative notion of differential privacy based on Rényi α-divergences and established a connection between their definition and the (ε, δ)-differential privacy of Definition 2.2. Rényi-based Differential Privacy is captured by the following:
Definition 2.3 (Rényi α-divergence [29]). For two probability distributions P and Q defined over R, the Rényi divergence of order α > 1 is given by:
Dα (P‖Q) . =
1
α− 1 logEx∼Q
( P (x)
Q(x)
)α (6)
Definition 2.4 ((α, ε)-Rényi differential privacy [22]). Let ε > 0 and α > 1. A randomized algorithm A is (α, ε)-Rényi differential private or (α, ε)-RDP, if for any neighboring datasets D,D′ ∈ D,
Dα (A(D)‖A(D′)) ≤ ε.
Theorem 1 (Composition of RDP mechanisms [22]). Let {Mi}ki=1 be a set of mechanisms, each satisfying (α, i)-RDP. Then their combination is (α, ∑ i i)-RDP.
Going from RDP to the Differential Privacy of Definition 2.2 is made possible by the following theorem (see also [4, 6, 30]). Theorem 2 (Converting RDP parameters to DP parameters [22]). An (α, ε)-RDP mechanism is( ε+ log 1/δα−1 , δ ) -DP for all δ ∈ (0, 1).
For the theoretical analysis, we will need the following proposition, specific to the case of multivariate Gaussian distributions, to obtain bounds on the Rényi divergence.
Proposition 1 (Rényi divergence for two multivariate Gaussian distributions [26]). The Rényi divergence for two multivariate Gaussian distributions with means µ1,µ2 and respective covariances Σ1,Σ2 is given by:
Dα(N (µ1,Σ1)‖N (µ2,Σ2)) = α
2 (µ1 − µ2)>(αΣ2 + (1− α)Σ1)−1(µ1 − µ2)
− 1 2(α− 1) log [ det(αΣ2 + (1− α)Σ1) (det Σ1)1−α(det Σ2)α ] (7) with det(Σ) the determinant of the matrix Σ. Note that (αΣ2 + (1 − α)Σ1)−1 must be definitepositive3, otherwise the Rényi divergence is not defined and is equal to +∞.
3Note that here α > 1 and the combination αΣ2 + (1− α)Σ1 is not a convex combination; extra-case must be given to ensure that the resulting matrix is positive
Remark 2.1. A standard method to generate an (R)DP algorithm from a deterministic function f : X → Rd is the Gaussian mechanismMσ acting asMσf(·) = f(·) + v where v ∼ N (0, σ2Id). If f has ∆f - (or `2-) sensitivity
∆f . = max D∼D′ ‖f(D)− f(D′)‖2,
thenMσ is ( α, α∆2f 2σ2 ) -RDP.

heading: 3 Photonic Differential Privacy
text: This section explains how to use photonic devices to perform DFA and a theoretical analysis showing how this combination entails photonic differential privacy.

heading: 3.1 Clipping parameters
text: As usual in Differential Privacy, we will need to clip layers of the network during the backward pass. Given a vector v ∈ Rd and positive constants c, s, ν, we define:
clipc(v) . = (sign(v1) ·min(c, |v1|), . . . , sign(vd) ·min(c, |vd|))> scales(v) . = min(s, ‖v‖2) v‖v‖2 offsetν(v) . = (v1 + ν, . . . , vd + ν) >
The weight update with clipping to be considered in place of (4) is given by
δW` = − 1 m m∑ i=1 (scales`(B `ei) + gi) φ′(z`i))clipc`(offsetν`(h ` i)) > (8)
For each layer `, we set the s`, c` and ν` parameters as follows:
c` . = τmaxh√ n`
ν` . = τminh√ n`
s` . = τB (9)
These choices ensure that:
τminh ≤ ‖clipc`(offsetν`(h ` i))‖2 ≤ τmaxh
‖scales`(B`ei)‖2 ≤ τB Moreover, we require the derivatives of the each activation function φ` are lower and upper bounded by constants i.e. γmin` ≤ |φ′`(t)| ≤ γmax` for all scalars t. This is a reasonable assumption for activation functions such as sigmoid, tanh, ReLU. . .
In the following, the quantities should all be considered clipped/scaled/offset as above and, for sake of clarity, we drop the explicit mentions of these operations.

heading: 3.2 Photonic Direct Feedback Alignment is a natural Gaussian mechanism
text: Noise modulation. Mainly due to the photon shot noise of the measurement process [16], Gaussian noise is naturally added to the random projection of (5). This noise is negligible for machine learning purposes, however it can be modulated through temperature control yielding the following projection:
p = Bx+N (0, σ2ID) (10) where ID is the identity matrix in dimension D. Note that this noise is truly random due to the quantum nature of the photon shot noise. As previously stated, due to experimental constraints, the noise will be simulated in the experiments of Section 4.
Building on that feature, we perform the random projection of DFA of (4) using the OPU. Since this equation is valid for any layer ` of the network, we allow ourselves, for sake of clarity, to drop the layer indices and study the generic update (the quantities below are all clipped as in Section 3.1):
δW = − 1 m m∑ i=1 (Bei + gi) φ′(zi))h > i (clipped quantities as in section 3.1) (11)
= − 1 m m∑ i=1 (Bei φ′(zi))h>i + 1 m m∑ i=1 (gi φ′(zi))h > i (12)
Algorithm 1 Photonic DFA training Require: training set S = {(xj , yj)}Nj=1, φ` with bounded derivatives, scale parameters s`, clipping
thresholds ν` and c`, stepsize η, noise scale σ, minibatch of size m, number of iterations T Ensure: A performing DP model
1: for ` = 1 to L do 2: Sample B` . Note: with OPUs, there is no explicit sampling of B 3: end for 4: for T iterations do 5: Create a minibatch S ⊂ {1, . . . , N} of size |S| = m (sampling without replacement) 6: for i ∈ S do 7: for ` = 1 to L− 1 do 8: z`i = W
`h`−1i 9: h`i = φ`(z ` i)
10: end for 11: ŷi ← φ`(W`h `−1 i ) 12: end for 13: for l = L to 1 do 14: Perform B`+1ei with the OPU 15: Independently sample g`1, . . . , g ` m ∼ N (0, σ2ID)
16: W` ←W` − ηm ∑m i=1((scales`(B `+1ei) + g ` i) φ′`(z`i) )clipc`(offsetν`(h ` i)) > 17: end for 18: end for
where gi ∼ N (0, σ2In`) is the Gaussian noise added during the OPU process. As stated previously, its variance σ2 can be modulated to obtain the desired value. The overall training procedure with Photonic DFA (PDFA) is described in Algorithm 3.1.

heading: 3.3 Theoretical Analysis of our method
text: In the following, the quantities in the DFA update of the weights are always clipped according to (11) and as before clipping/scale/offset operators are in force but dropped from the text.
To demonstrate that our mechanism is Differentially Private, we will use the following reasoning: the noise being added at the random projection level as in (10), we can decompose the update of the weights as a Gaussian mechanism as in (12). We will compute the covariance matrix of the Gaussian noise, which will depend on the data, which is in striking contrast with the standard Gaussian mechanism [1]. We will then use Proposition 1 to compute the upper bound the Rényi divergence. The Differential Privacy parameters will be obtained using Theorem 2.
In the following, we will consider the Gaussian mechanism applied to the columns of the weight matrix. We consider this case for the following reasons: since our noise matrix has the same realisation of the Gaussian noise (but multiplied by different scalars), it makes sense to consider the Differential Privacy parameters of only columns of the weight matrix and then multiply the Rényi divergence by the number of columns. If our noise was i.i.d. we could have used the theorems from [8] to lower the Rényi divergence. Given the update equation of the weights at layer l in (12), the update of column k of the weight of layer l is the following Gaussian mechanism:
1
m m∑ i=1 ((Bei) φ′(zi))hik + 1 m m∑ i=1 (gi φ′(zi))hik = fk(D) +N (0,Σk) (13)
where Σk = σ 2 m2 diag(ak) 2 and (ak)j = √∑m i=1(φ ′ ijhik)
2,∀j = 1, . . . , n`−1. Note that these expressions are due to the inner product with hi. In the following, we will focus on column k and we therefore drop the index k in the notation. Using the clipping of the quantities of interest detailed in (8), we can compute some useful bounds bounds on aj :√
m n` γmin` τ min h ≤ aj ≤
√ m
n` γmax` τ max h (14)
Proposition 2 (Sensitivity of Photonic DFA [19]). For neighboring datasets D and D′ (i.e. differing from only one element), the sensitivity ∆`f of the function fk described in (12) at layer l is given by:
∆`f = sup D∼D′
‖f(D)− f(D′)‖2 ≤ 2
m ‖(B`ei) φ′`(z`i))h`−1ik ‖2 (15)
≤ 2 m τBγ max ` τmaxh√ n`
(16)
The following proposition is our main theoretical result: we compute the parameter of Rényi Differential Privacy.
Proposition 3 (Photonic Differential Privacy parameters). Given two probability distributions P ∼ N (f(D),Σ) and Q ∼ N (f(D′),Σ′) corresponding to the Gaussian mechanisms depicted in (13) on neighboring datasets D and D′, the Rényi divergence of order α between these mechanisms is:
Dα(P‖Q) ≤ 2n`.α m.σ2 (γmaxτmaxτB) 2
(γmin` τ min h )
2 +
n`.α
2(α− 1) log
[ m(γmin` τ min h ) 2
(m+ 1)(γmin` τ min h ) 2 − (γmax` τmaxh )2 ] = εPDFA (17)
Our mechanism is therefore (α, TεPDFA)-RDP with T the number of training epochs. We can deduce that the mechanism on the weight matrix with n`−1 columns is (α, Tn`−1εPDFA)-RDP. Then the mechanism of the whole network composed of L layers is (α,LTn`−1εPDFA)-RDP. We can then convert our bound to DP parameters using Theorem 2 to obtain a (LTn`−1εPDFA + log 1/δ α−1 , δ)-DP mechanism for all δ ∈ (0, 1).
Proof. In the following, the variables with a prime correspond to the ones built upon dataset D′. According to (13), the covariance matrices Σ and Σ′ are diagonal and any of their weighted sum is diagonal, as well as their inverse. Moreover, the determinant of a diagonal matrix is the product of its diagonal elements. Using these elements in (7) yield:
Dα(P‖Q) = n∑̀ j=1 ( αm2 2σ2 (fj(D)− fj(D′))2 αa′2j + (1− α)a2j − 1 2(α− 1) log [ (1− α)a2j + αa′2j a 2(1−α) j a ′2α j ]) Using the fact that we are studying neighboring datasets, the sums composing aj and a′j differ by only one element at element i = I . This implies that
αa′2j + (1− α)a2j = a2j + α[(φ̃′Ij h̃Ik)2 − (φ′IjhIk)2)]
where φ̃′Ij and h̃ 2 Ik are taken on the dataset D ′. By choosing D and D′ such that [(φ̃′Ij h̃Ik) 2 − (φ′IjhIk) 2)] ≥ 0 and some rearrangement, we can upper bound the Rényi divergence by:
Dα(P‖Q) ≤ α.n`.m
2 2σ2 ∆2f ( √
m n` γmin` τ min h )
2 + α.n` 2(α− 1) log
[ m(γmin` τ min h ) 2
(m+ 1)(γmin` τ min h ) 2 − (γmax` τmaxh )2
]
Using the bound on the sensitivity f computed in (15), we obtain the desired PDFA, upper bound of the Rényi divergence. A more detailed proof is presented in the Appendix.
Remark 3.1. This bound is not tight since it assumes that all the activations reach their worst cases in all the layers for upper bounding. However, obtaining a tighter bound would be very challenging since the values of the covariance matrices depend on the output of the neurons of the Neural network, which are data and architecture dependent.
We believe tighter bounds could be obtained in much simpler cases. First we can notice that having equal covariance matrices Σ and Σ′ would cancel the logarithm term. If additionally we assume that all the activations saturate to their clipping values, then we would retrieve the formula of in [19].
Owing to mini-batch training, we believe the privacy parameter could be further improve by considering subsampling mechanism [30] and its properties. However, this would require a novel theoretical framework adapted to our case and we leave it for future work.

heading: 4 Experimental results
text: In this section, we demonstrate that photonic training is robust to Gaussian mechanism, i.e. adding noise as in Eq. 8, delivering good end-task performance even under strong privacy constraints. As detailed by our theoretical analysis, we focus on two specific mechanisms:
Clipping and offsetting the neurons with τ max h√ n` and τ min h√ n` to enforce τminh ≤ ‖h l‖2 ≤ τmaxh , as explained in section 3.1;
Adding noise g to Be, according to the clipping of Be with τf (||Be||2 ≤ τf ) and the scaling of g with σ (g ∼ N (0, σ2I)).
To make our results easy to interpret, we fix τf = 1, such that σ = 0.1 implies ||g||2 ' ||Be||2. At σ = 0.01, this means that the noise is roughly 10% of the norm of the DFA learning signal. This is in line with differentially-private setup using backpropagation, and is in fact more demanding as our experimental setup makes it such that this is a lower bound on the noise.
Photonic DFA. We perform the random projection Be at the core of the DFA training step using the OPU, a photonic co-processor. As the inputs of the OPU are binary, we ternarize the error – although binarized DFA, known as Direct Random Target Propagation [11], is possible, its performance is inferior. Ternarization is performed using a tunable treshold t, such that values smaller than −t are set to -1, values larger than t are set to 1, and all in between values are set to 0. We then project the positive part e+ of this vector using the OPU, obtaining Be+, and then the negative part e−, obtaining Be−. Finally, we substract the two to obtain the projection of the ternarized error, B(e+− e−). This is in line with the setup proposed in [18]. We refer thereafter to DFA performed on a ternarized error on a GPU as ternarized DFA (TDFA), and to DFA performed optically with a ternarized error as photonic DFA (PDFA).
Setting. We run our simulations on cloud servers with a single NVIDIA V100 GPU and an OPU, for a total estimate of 75 GPU-hours. We perform our experiments on FashionMNIST dataset [32], reserving 10% of the data as validation, and reporting test accuracy on a held-out set. We use a fully-connected network, with two hidden layers of size 512, with tanh activation. Optimization is done over 15 epochs with SGD, using a batch size of 256, learning rate of 0.01 and 0.9 momentum. For TDFA, we use a threshold of 0.15. Despite the fundamentally different hardware platform, no specific hyperparameter tuning is necessary for the photonic training: this demonstrates the reliability and robustness of our approach.
BP baseline. We also apply our DP mechanism to a network trained with backpropagation. The clipping and offsetting of the activations’ neurons is unchanged, but we adapt the noise element. We
apply the noise on the derivative of the loss once at the top of the network. We also lower the learning rate to 10−4 to stabilize runs.
Results. We fix τmaxh = 1 for all experiments, and consider a range of σ corresponding to noise between 0-200% of the DFA training signal Be. We also compare to a non-private, vanilla baseline. Results are reported in Table 1 and Figure 2. We find our DFA-based approach to be remarkably robust to the addition of noise, providing Differential Privacy, with a test accuracy hit contained within 3% of baseline for up to σ = 0.05 (i.e. noise 50% as large as the training signal). Most of the performance hit can actually be attributed to the aggressive activation clipping, with noise having a limited effect. In comparison, BP is far more sensitive to activation clipping and to our noise mechanism. However, our method was devised for DFA and not BP, explaining the under-performance of BP. Finally, photonic training achieves good test accuracy, always within 1% of the corresponding DFA run. This demonstrates the validity of our approach, on a real photonic co-processor. We note that, usually, demonstrations of neural networks with beyond silicon hardware are mostly limited to simulations [14, 12], or that these demonstrations come with a significant end-task performance penalty [34, 31]. Additional results with similar conclusions on MNIST and CIFAR-10 are presented in the Appendix.

heading: 5 Conclusion and Outlooks
text: We have investigated how the Gaussian measurement noise that goes with the use of the photonic chips known as Optical Processor Units, can be taken advantage of to ensure a Differentially Private Direct Feedback Alignment training algorithm for deep architectures. We theoretically establish the features of the so-obtained Photonic Differential Privacy and we feature these theoretical findings with compelling empirical results showing how adding noise does not decreases the performance significantly.
At an age where both privacy-preserving training algorithms and energy-aware machine learning procedures are a must, our contribution addresses both points through our photonic differential privacy framework. As such we believe the holistic machine learning contribution we bring will mostly bring positive impacts by reducing energy consumption when learning from large-scale datasets and by keeping those datasets private. On the negative impact side, our DP approach is heavily based on clipping, which is well-known to have negative effects on underrepresented classes and groups [5, 13] in a machine learning model.
We plan to extend the present work in two ways. First, we would like to refine the theoretical analysis and exhibit privacy properties that are more in line with the observed privacy; this would give us theoretical grounds to help us set parameters such as the clipping thresholds or the noise modulation. Second, we want to expand our training scenario and address wider ranges of applications such as recommendation, federated learning, natural language processing. We also plan to spend efforts so as to mitigate the effect of clipping on the fairness of our model [33].

heading: Acknowledgments
text: R.O. acknowledges funding from the Région Ile-de-France. The authors would like to thanks Kilian Muller and Gustave Pariente for fruitful discussions regarding the OPU. This work was granted access to the HPC/AI resources of IDRIS under the allocation 2021-A0101012429 made by GENCI. Specifically, we thank the team of the Jean Zay supercomputer for their support.

Review summaries:
The paper proposes a hardware-based approach to Differential Privacy (DP) using OPU to perform optical random projections for a differentially private DFA training algorithm, leveraging noise intrinsic to the hardware to achieve privacy-by-design. The proposed approach was analyzed mathematically in detail. The proposed methods were analyzed on the vanilla Fashion MNIST dataset.    The paper is very well written in general. The proposed methods/approach are very interesting, and mathematical results are solid. 

The manuscript entitled “Photonic Differential Privacy with Direct Feedback Alignment” extends their previous work - Differential Privacy with Direct Feedback Alignment. In this work, they leverage the intrinsic noise (which might be controlled by temperature) of optical random projections to build a differentially private DFA mechanism, making Optical Processing Units (OPUs) a solution of choice to provide a private-by-design training. This work is motivated by a photonic implementation that naturally induces noise that we exploit for differential privacy. The proposed method is demonstrated by simulations showing that adding noise does not decrease the performance significantly. In other words, this approach is robust to increasing DP noise. This paper also provides its theoretical analysis.