Public Data-Assisted Mirror Descent for Private Model Training

In this paper , we revisit the problem of using public data to improve the privacy/utility trade-offs for differentially private ( DP ) model training . Here , public data refers to auxiliary data sets that have no privacy concerns . We consider public training data sets that are from the same distribution as the private training data . For convex losses , we show that a variant of Mirror Descent provides population risk guarantees which are independent of the dimension of the model ( p ) . Specifically , we apply Mirror Descent with the loss generated by the public data as the mirror map , and using DP gradients of the loss generated by the private ( sensitive ) data . To obtain dimension independence , we requireG2Q ≤ p public data samples , where GQ is the Gaussian width of the smallest convex set Q such that the public loss functions are 1-strongly convex with respect to ‖ · ‖Q . We further show that our algorithm has a natural “ noise stability ” property : If in a bounded region around the current iterate , the public loss satisfies αv-strong convexity in a direction v , then using noisy gradients instead of the exact gradients shifts our next iterate in the direction v by an amount proportional to 1/αv ( in contrast with DP stochastic gradient descent ( DP-SGD ) , where the shift is isotropic ) . Analogous results in prior works had to explicitly learn the geometry using the public data in the form of preconditioner matrices . Our method is also applicable to non-convex losses , as it does not rely on convexity assumptions to ensure DP guarantees . We demonstrate the empirical efficacy of our algorithm by showing privacy/utility trade-offs on linear regression , deep learning benchmark datasets ( WikiText-2 , CIFAR-10 , and EMNIST ) . We show that our algorithm not only significantly improves over traditional DP-SGD , which does not have access to public data , but also improves over DP-SGD on models that have been pretrained with the public data to begin with . 1 INTRODUCTION . Differentially Private Stochastic Gradient Descent ( DP-SGD ) ( Song et al. , 2013 ; Bassily et al. , 2014 ; Abadi et al. , 2016 ) , and its variants ( Kairouz et al. , 2021b ) have become the de facto standard algorithms for training machine learning models with differential privacy ( DP ) ( Dwork et al. , 2006 ) . While DP-SGD is known to be optimal in terms of obtaining both optimal excess empirical risk ( Bassily et al. , 2014 ) , and excess population risk ( Bassily et al. , 2020b ) for convex losses , the obtained error guarantees suffer from an explicit polynomial dependence on the model dimension ( p ) . This polynomial dependence significantly impacts the privacy/utility trade-off when p ≥ npriv , where npriv is the number of private training samples . Thus , even empirically , when DP-SGD is used to train large deep learning models , there is a significant drop in accuracy compared to the nonprivate counterpart ( Papernot et al. , 2020 ) . In this paper , we revisit the problem of effectively using public data ( i.e. , data drawn from the same distribution as the private training data set , but without privacy concerns ) to improve the privacy/utility trade-offs for DP model training . Specifically , we design a central DP variant of mirror descent ( Nemirovsky & Yudin , 1983 ) that uses the loss function generated by the public data as the mirror map and DP gradients on the private/sensitive data as the linear term , ensuring population risk guarantees for convex losses with no explicit dependence on dimensions as long as npub ≥ p , where npub is the number of records in the public data set . We show both theoretically and empirically that our DP variant of mirror descent , assisted with public data , can improve the privacy-utility trade-offs by effectively reducing the variance in the noise added to the gradients in DP model training . Our empirical results are on standard benchmark data sets like CIFAR-10 , EMNIST , and WikiText-2 . Learning Geometry with Mirror Maps : Common to most DP model training algorithms , including DP-SGD , DP-FTRL ( Kairouz et al. , 2021b ) , and our algorithm , is a DP estimator of the gradient of the loss ∇θL ( θt ; Dpriv ) = ∑ d∈Dpriv ∇θ ` ( θt ; d ) generated by the private data set Dpriv at a given model state θt ∈ Rp . This DP estimator essentially adds isotropic Gaussian noise N ( 0 , σ2Ip ) to ∇θL ( θt ; Dpriv ) , where σ depends on the privacy parameters ( ε , δ ) and the maximum allowable value of ‖∇θ ` ( θt ; d ) ‖2 ( a.k.a . the clipping norm ( Abadi et al. , 2016 ) ) .1 It is well known that for most learning tasks , the set of gradients vectors in L ( θt ; Dpriv ) are seldom isotropic ( Gur-Ari et al. , 2018 ; Agarwal et al. , 2019 ) . Hence , it is natural to wonder if the Gaussian noise in the DP estimator can be made to respect the geometry of the gradients . Prior works ( Zhou et al. , 2020 ; Asi et al. , 2021 ; Kairouz et al. , 2021a ) have used public data ( Dpub ) to explicitly learn this geometry , mostly in the form of preconditioner matrices ( Duchi et al. , 2011 ) to be multiplied to the estimated noisy gradients . In this paper , we take an implicit approach towards respecting this geometry , by using the loss L ( θ ; Dpub ) generated by the public data as the mirror map in classical mirror descent . As a first order approximation ( formalized in Section 4 ) , one can view it as doing DP-SGD on L ( θ ; Dpriv ) while using L ( θ ; Dpub ) as a regularizer . This approach has the following advantages : ( i ) The information of the geometry is “ free ” , i.e. , one does not need to learn the preconditioner explicitly from the public data , ( ii ) Unlike prior works ( Zhou et al. , 2020 ; Kairouz et al. , 2021a ) , one does not need to assume that the gradients of L ( θ ; Dpriv ) lie in a fixed rank subspace , ( iii ) The achieved excess population risk guarantees have better dependence on npub = |Dpub| compared to prior results ( Asi et al. , 2021 ) , and ( iv ) Because the geometry is implicitly defined , the implementation does not need to maintain an additional data structure for the preconditioner , and hence is much easier to implement . Empirically , under our best-effort comparison , our baseline algorithm improves over the state of the art ( Asi et al. , 2021 ) .2 We note that differentially private mirror descent has been considered before by Talwar et al . ( 2014 ) and Wang et al . ( 2017 ) . Their results are not directly comparable to ours because ( i ) they do not have access to in-distribution public data ( ii ) as shown in Bassily et al . ( 2014 ) , without public data , it is impossible to achieve the dimension independent bounds we achieve ( iii ) in our experiments we solve unconstrained optimization problems , but those works choose the mirror map based on the constraint set rather than the data set . We note that the utility bounds we prove in this paper also apply to a public data-assisted variant of the accelerated mirror descent algorithm considered in Wang et al . ( 2017 ) . In-distribution vs. Out-of-distribution Public Data : Prior works have considered both settings where the public data set Dpub comes from the same distribution as the private data Dpriv ( a.k.a . indistribution ) ( Bassily et al. , 2018a ; Zhou et al. , 2020 ; Kairouz et al. , 2021a ; Asi et al. , 2021 ) , and where the distributions are different ( a.k.a . out-of-distribution ) ( Abadi et al. , 2016 ; Papernot et al. , 2016 ; 2018 ; Liu et al. , 2021 ) . In principle , our algorithm can be used in out-of-distribution settings , but our results in this paper are for the in-distribution case . In the in-distribution setting , it is typical that there are fewer public data samples available than private data samples – i.e. , npub npriv – as it is harder to obtain public data sets than ones with privacy constraints attached . In-distribution public data could come from either altruistic opt-in users ( Merriman , 2014 ; Avent et al. , 2017 ) or from users who are incentivized to provide such data ( e.g. , mechanical turks ) . Out-of-distribution public data may be easier to obtain but can have various degrees of freedom ; e.g. , the domains of private and public data may not be identical , the representation of some classes may vary , the distributions can be mean shifted , etc . It is usually hard to quantify these degrees of freedom to the extent that we can provide precise guarantees . Hence , we leave this aspect for future exploration , and work with the idealized assumption that the public data comes from the same distribution as the private data , or , at least , that the differences between these two distributions are not material . Design of Algorithms without Relying on Convexity for Privacy : While most of our theoretical utility guarantees are specific to convex functions , our algorithm can be used seamlessly in nonconvex settings . The main reason is that its DP guarantee does not rely on convexity . Prior work 1For the ease of presentation , at this point we do not consider the noise due to stochastic mini-batching . 2The implementation of Asi et al . ( 2021 ) is not publicly available . Since the algorithms can be sensitive to hyperparameter choices , for a fair comparison we directly consider the results quoted in ( Asi et al. , 2021 ) . that provided similar dimension-independent excess population risk guarantees under the the same conditions as ours ( i.e. , npub ≥ p ) ( Feldman et al. , 2018 ) heavily relied on convexity to ensure DP and hence , can not be used in non-convex settings . Choice of Benchmark for Empirical Comparison : Mirror descent ( Nemirovsky & Yudin , 1983 ; Hazan , 2019 ) as a first step optimizes the mirror map function . In our setting , this corresponds to pre-training on the public loss function L ( θ ; Dpub ) before running the DP optimization procedure on L ( θ ; Dpriv ) . Since pre-training on public data is intuitive and easy , we always compare to DP-SGD ( and its variants ) that have been pre-trained to convergence with the public loss . We show that our algorithm outperforms even pre-trained DP-SGD . To the best of our knowledge , ours is the only empirical work that compares to this strong ( but fair ) benchmark . Other Uses of Public Data in DP Learning : The use of in-distribution public data has been extensively explored both theoretically and empirically . On the theoretical side , it has been shown ( Alon et al. , 2019 ; Bassily et al. , 2020a ) that a combination of private and public data samples can yield asymptotically better worst-case PAC learning guarantees than either on their own . Another line of work ( Papernot et al. , 2016 ; 2018 ; Bassily et al. , 2018b ; Dwork & Feldman , 2018 ; Nandi & Bassily , 2020 ) considers public data that is unlabelled , but otherwise comes from the same distribution as the private data ; the primary goal is to use the private data to generate labels for the public data , which can then be used arbitrarily . So far only two papers have considered out-of-distribution data . Bassily et al . ( 2020c ) assume that whether a data record is public or private depends on its label ; e.g. , the public data may contain many negative examples , but few positive examples . They show that halfspaces can be learned in this model . Liu et al . ( 2021 ) consider synthetic data generation and provide guarantees that depend on the Rényi divergences between the public and private distributions . Abadi et al . ( 2016 ) and Tramer & Boneh ( 2020 ) provided techniques to effectively use out-of-distribution public data for pre-training for DP-SGD . However , they did not consider techniques to improve a pre-trained model using private and public data , which is the focus of our work .

Summary: The paper is in the continuation of recent line of work that studies private algorithms when it has access to some public data. They also achieve a dimension independent bound as in some of the previous work. The idea of the paper is very simple: they use public data as the mirror map in the private mirror descent algorithm.