Public Data-Assisted Mirror Descent for Private Model Training

In this paper , we revisit the problem of using public data to improve the privacy/utility trade-offs for differentially private ( DP ) model training . Here , public data refers to auxiliary data sets that have no privacy concerns . We consider public training data sets that are from the same distribution as the private training data . For convex losses , we show that a variant of Mirror Descent provides population risk guarantees which are independent of the dimension of the model ( p ) . Specifically , we apply Mirror Descent with the loss generated by the public data as the mirror map , and using DP gradients of the loss generated by the private ( sensitive ) data . To obtain dimension independence , we requireG2Q ≤ p public data samples , where GQ is the Gaussian width of the smallest convex set Q such that the public loss functions are 1-strongly convex with respect to ‖ · ‖Q . We further show that our algorithm has a natural “ noise stability ” property : If in a bounded region around the current iterate , the public loss satisfies αv-strong convexity in a direction v , then using noisy gradients instead of the exact gradients shifts our next iterate in the direction v by an amount proportional to 1/αv ( in contrast with DP stochastic gradient descent ( DP-SGD ) , where the shift is isotropic ) . Analogous results in prior works had to explicitly learn the geometry using the public data in the form of preconditioner matrices . Our method is also applicable to non-convex losses , as it does not rely on convexity assumptions to ensure DP guarantees . We demonstrate the empirical efficacy of our algorithm by showing privacy/utility trade-offs on linear regression , deep learning benchmark datasets ( WikiText-2 , CIFAR-10 , and EMNIST ) . We show that our algorithm not only significantly improves over traditional DP-SGD , which does not have access to public data , but also improves over DP-SGD on models that have been pretrained with the public data to begin with . 1 INTRODUCTION . Differentially Private Stochastic Gradient Descent ( DP-SGD ) ( Song et al. , 2013 ; Bassily et al. , 2014 ; Abadi et al. , 2016 ) , and its variants ( Kairouz et al. , 2021b ) have become the de facto standard algorithms for training machine learning models with differential privacy ( DP ) ( Dwork et al. , 2006 ) . While DP-SGD is known to be optimal in terms of obtaining both optimal excess empirical risk ( Bassily et al. , 2014 ) , and excess population risk ( Bassily et al. , 2020b ) for convex losses , the obtained error guarantees suffer from an explicit polynomial dependence on the model dimension ( p ) . This polynomial dependence significantly impacts the privacy/utility trade-off when p ≥ npriv , where npriv is the number of private training samples . Thus , even empirically , when DP-SGD is used to train large deep learning models , there is a significant drop in accuracy compared to the nonprivate counterpart ( Papernot et al. , 2020 ) . In this paper , we revisit the problem of effectively using public data ( i.e. , data drawn from the same distribution as the private training data set , but without privacy concerns ) to improve the privacy/utility trade-offs for DP model training . Specifically , we design a central DP variant of mirror descent ( Nemirovsky & Yudin , 1983 ) that uses the loss function generated by the public data as the mirror map and DP gradients on the private/sensitive data as the linear term , ensuring population risk guarantees for convex losses with no explicit dependence on dimensions as long as npub ≥ p , where npub is the number of records in the public data set . We show both theoretically and empirically that our DP variant of mirror descent , assisted with public data , can improve the privacy-utility trade-offs by effectively reducing the variance in the noise added to the gradients in DP model training . Our empirical results are on standard benchmark data sets like CIFAR-10 , EMNIST , and WikiText-2 . Learning Geometry with Mirror Maps : Common to most DP model training algorithms , including DP-SGD , DP-FTRL ( Kairouz et al. , 2021b ) , and our algorithm , is a DP estimator of the gradient of the loss ∇θL ( θt ; Dpriv ) = ∑ d∈Dpriv ∇θ ` ( θt ; d ) generated by the private data set Dpriv at a given model state θt ∈ Rp . This DP estimator essentially adds isotropic Gaussian noise N ( 0 , σ2Ip ) to ∇θL ( θt ; Dpriv ) , where σ depends on the privacy parameters ( ε , δ ) and the maximum allowable value of ‖∇θ ` ( θt ; d ) ‖2 ( a.k.a . the clipping norm ( Abadi et al. , 2016 ) ) .1 It is well known that for most learning tasks , the set of gradients vectors in L ( θt ; Dpriv ) are seldom isotropic ( Gur-Ari et al. , 2018 ; Agarwal et al. , 2019 ) . Hence , it is natural to wonder if the Gaussian noise in the DP estimator can be made to respect the geometry of the gradients . Prior works ( Zhou et al. , 2020 ; Asi et al. , 2021 ; Kairouz et al. , 2021a ) have used public data ( Dpub ) to explicitly learn this geometry , mostly in the form of preconditioner matrices ( Duchi et al. , 2011 ) to be multiplied to the estimated noisy gradients . In this paper , we take an implicit approach towards respecting this geometry , by using the loss L ( θ ; Dpub ) generated by the public data as the mirror map in classical mirror descent . As a first order approximation ( formalized in Section 4 ) , one can view it as doing DP-SGD on L ( θ ; Dpriv ) while using L ( θ ; Dpub ) as a regularizer . This approach has the following advantages : ( i ) The information of the geometry is “ free ” , i.e. , one does not need to learn the preconditioner explicitly from the public data , ( ii ) Unlike prior works ( Zhou et al. , 2020 ; Kairouz et al. , 2021a ) , one does not need to assume that the gradients of L ( θ ; Dpriv ) lie in a fixed rank subspace , ( iii ) The achieved excess population risk guarantees have better dependence on npub = |Dpub| compared to prior results ( Asi et al. , 2021 ) , and ( iv ) Because the geometry is implicitly defined , the implementation does not need to maintain an additional data structure for the preconditioner , and hence is much easier to implement . Empirically , under our best-effort comparison , our baseline algorithm improves over the state of the art ( Asi et al. , 2021 ) .2 We note that differentially private mirror descent has been considered before by Talwar et al . ( 2014 ) and Wang et al . ( 2017 ) . Their results are not directly comparable to ours because ( i ) they do not have access to in-distribution public data ( ii ) as shown in Bassily et al . ( 2014 ) , without public data , it is impossible to achieve the dimension independent bounds we achieve ( iii ) in our experiments we solve unconstrained optimization problems , but those works choose the mirror map based on the constraint set rather than the data set . We note that the utility bounds we prove in this paper also apply to a public data-assisted variant of the accelerated mirror descent algorithm considered in Wang et al . ( 2017 ) . In-distribution vs. Out-of-distribution Public Data : Prior works have considered both settings where the public data set Dpub comes from the same distribution as the private data Dpriv ( a.k.a . indistribution ) ( Bassily et al. , 2018a ; Zhou et al. , 2020 ; Kairouz et al. , 2021a ; Asi et al. , 2021 ) , and where the distributions are different ( a.k.a . out-of-distribution ) ( Abadi et al. , 2016 ; Papernot et al. , 2016 ; 2018 ; Liu et al. , 2021 ) . In principle , our algorithm can be used in out-of-distribution settings , but our results in this paper are for the in-distribution case . In the in-distribution setting , it is typical that there are fewer public data samples available than private data samples – i.e. , npub npriv – as it is harder to obtain public data sets than ones with privacy constraints attached . In-distribution public data could come from either altruistic opt-in users ( Merriman , 2014 ; Avent et al. , 2017 ) or from users who are incentivized to provide such data ( e.g. , mechanical turks ) . Out-of-distribution public data may be easier to obtain but can have various degrees of freedom ; e.g. , the domains of private and public data may not be identical , the representation of some classes may vary , the distributions can be mean shifted , etc . It is usually hard to quantify these degrees of freedom to the extent that we can provide precise guarantees . Hence , we leave this aspect for future exploration , and work with the idealized assumption that the public data comes from the same distribution as the private data , or , at least , that the differences between these two distributions are not material . Design of Algorithms without Relying on Convexity for Privacy : While most of our theoretical utility guarantees are specific to convex functions , our algorithm can be used seamlessly in nonconvex settings . The main reason is that its DP guarantee does not rely on convexity . Prior work 1For the ease of presentation , at this point we do not consider the noise due to stochastic mini-batching . 2The implementation of Asi et al . ( 2021 ) is not publicly available . Since the algorithms can be sensitive to hyperparameter choices , for a fair comparison we directly consider the results quoted in ( Asi et al. , 2021 ) . that provided similar dimension-independent excess population risk guarantees under the the same conditions as ours ( i.e. , npub ≥ p ) ( Feldman et al. , 2018 ) heavily relied on convexity to ensure DP and hence , can not be used in non-convex settings . Choice of Benchmark for Empirical Comparison : Mirror descent ( Nemirovsky & Yudin , 1983 ; Hazan , 2019 ) as a first step optimizes the mirror map function . In our setting , this corresponds to pre-training on the public loss function L ( θ ; Dpub ) before running the DP optimization procedure on L ( θ ; Dpriv ) . Since pre-training on public data is intuitive and easy , we always compare to DP-SGD ( and its variants ) that have been pre-trained to convergence with the public loss . We show that our algorithm outperforms even pre-trained DP-SGD . To the best of our knowledge , ours is the only empirical work that compares to this strong ( but fair ) benchmark . Other Uses of Public Data in DP Learning : The use of in-distribution public data has been extensively explored both theoretically and empirically . On the theoretical side , it has been shown ( Alon et al. , 2019 ; Bassily et al. , 2020a ) that a combination of private and public data samples can yield asymptotically better worst-case PAC learning guarantees than either on their own . Another line of work ( Papernot et al. , 2016 ; 2018 ; Bassily et al. , 2018b ; Dwork & Feldman , 2018 ; Nandi & Bassily , 2020 ) considers public data that is unlabelled , but otherwise comes from the same distribution as the private data ; the primary goal is to use the private data to generate labels for the public data , which can then be used arbitrarily . So far only two papers have considered out-of-distribution data . Bassily et al . ( 2020c ) assume that whether a data record is public or private depends on its label ; e.g. , the public data may contain many negative examples , but few positive examples . They show that halfspaces can be learned in this model . Liu et al . ( 2021 ) consider synthetic data generation and provide guarantees that depend on the Rényi divergences between the public and private distributions . Abadi et al . ( 2016 ) and Tramer & Boneh ( 2020 ) provided techniques to effectively use out-of-distribution public data for pre-training for DP-SGD . However , they did not consider techniques to improve a pre-trained model using private and public data , which is the focus of our work .

Summary: In this paper, the authors study differentially private empirical risk minimization (DP-ERM). Specifically, they study the case where the constraint set $\mathcal{C}$ has additional geometric structure, i.e., its Gaussian width could much lower than the underlying dimension $p$, such as the $\ell_1$-norm ball. The paper has been studied previously. However, this paper assume there are some additional public data. Specifically, they apply Mirror Descent with the loss generated by the public data as the *mirror map*, and using DP gradients of the loss generated by the private (sensitive) data. They also provide some experiments to show the performance of their algorithm.