Differentially Private Meta-Learning

1 INTRODUCTION . The field of meta-learning offers promising directions for improving the performance and adaptability of machine learning methods . At a high level , the key assumption leveraged by these approaches is that the sharing of knowledge gained from individual learning tasks can help catalyze the learning of similar unseen tasks . However , the collaborative nature of this process , in which task-specific information must be sent to and used by a meta-learner , also introduces inherent data privacy risks . In this work , we focus on a popular and flexible meta-learning approach , parameter transfer via gradient-based meta-learning ( GBML ) . This set of methods , which includes well-known algorithms such as MAML ( Finn et al. , 2017 ) and Reptile ( Nichol et al. , 2018 ) , tries to learn a common initialization φ over a set of tasks t = 1 , . . . , T such that a high-performance model can be learned in only a few gradient-steps on new tasks . Notably , information flows constantly between training tasks and the meta-learner as learning progresses ; to make iterative updates , the meta-learner obtains feedback on the current φ by having task-specific models θ̄t trained with it . Meanwhile , in many settings amenable to meta-learning , it is crucial to ensure that sensitive information in each task ’ s dataset stays private . Examples of this include learning models for word prediction on cell phone data ( McMahan et al. , 2018 ) , clinical predictions using hospital records ( Zhang et al. , 2019 ) , and fraud detectors for competing credit card companies ( Stolfo et al. , 1997 ) . In such cases , each data-owner can benefit from information learned from other tasks , but each also desires , or is legally required , to keep their raw data private . Thus , it is not sufficient to learn a well-performing φ ; it is equally imperative to ensure that a task ’ s sensitive information is not obtainable by anyone else . While parameter transfer algorithms can move towards this goal by peforming task-specific optimization locally , thus preventing direct access to private data , this provision is far from fail-safe in terms of privacy . A wealth of work has shown in the single-task setting that it is possible for an adversary with only access to the model to learn detailed information about the training set , such as the presence or absence of specific records ( Shokri et al. , 2017 ) or the identities of sensitive features given other covariates ( Fredrikson et al. , 2015 ) . Furthermore , Carlini et al . ( 2018 ) showed that deep neural networks can effectively memorize user-unique training examples , which can be recovered even after only a single epoch of training . As such , in parameter-transfer methods , the meta-learner or any downstream participant can potentially recover data from a previous task . However , despite these serious risks , privacy-preserving meta-learning has remained largely an unstudied problem . Our work aims to address this issue by applying differential privacy ( DP ) , a well-established definition of privacy with rich theoretical guarantees and consistent empirical success at preventing leakages of data ( Carlini et al. , 2018 ; Fredrikson et al. , 2015 ; Jayaraman and Evans , 2019 ) . Crucially , although there are various threat models and degrees of DP one could consider in the meta-learning setting ( as we outline in Section 2 ) , we balance the well-documented trade-off between privacy and model utility by formalizing and focusing on a setting that we call task-global DP . This setting provides a strong privacy guarantee for each task-owner that sharing θ̂t with the meta-learner will not reliably reveal anything about specific training examples to any downstream agent . It also allows us to use the framework of Khodak et al . ( 2019a ) to provide a DP GBML algorithm that enjoys provable learning guarantees in convex settings . Finally , we show an application of our work by drawing connections to federated learning ( FL ) ( Li et al. , 2019 ) . While standard methods for FL , such as FedAvg ( McMahan et al. , 2017 ) , have inspired many works also concerning DP in a multi-user setup ( Agarwal et al. , 2018 ; Bhowmick et al. , 2019 ; Geyer et al. , 2018 ; McMahan et al. , 2018 ; Truex et al. , 2019 ) , we are the first to consider task-global DP as a useful variation on standard DP settings . Moreover , these works fundamentally differ from ours in that they do not consider a task-based notion of learnability , instead focusing on the global federated learning problem to learn a single global model . That being said , a federated setting involving per-user personalization ( Chen et al. , 2018 ; Smith et al. , 2017 ) is a natural meta-learning application . More specifically , our main contributions are : 1 . We are the first to provide a taxonomy for the different notions of DP possible for meta-learning . In particular , we formalize on a variant we call task-global DP , showing and arguing that it adds a useful option to commonly studied settings in terms of trading privacy and accuracy . 2 . We propose the first DP GBML algorithm , which we construct to satisfy this privacy setting . Further , we show a straightforward extension for obtaining a group DP version of our setting to protect multiple samples simultaneously . 3 . While our privacy guarantees hold generally , we also prove learning-theoretic results in convex settings . Our learning guarantees scale with task-similarity , as measured by the closeness of the task-specific optimal parameters ( Denevi et al. , 2019 ; Khodak et al. , 2019b ) . 4 . We show that our algorithm , along with its theoretical guarantees , naturally carries over to federated learning with personalization . Compared to previous notions of privacy considered in works for DP federated learning ( Agarwal et al. , 2018 ; Bhowmick et al. , 2019 ; Geyer et al. , 2018 ; McMahan et al. , 2018 ; Truex et al. , 2019 ) , we are , to the best of our knowledge , the first to simultaneously provide both privacy and learning guarantees . 5 . Empirically , we demonstrate that our proposed privacy setting allows for strong performance on federated language-modeling and few-shot image classification tasks . For the former , we achieve close to the performance of non-private models and significantly improve upon the performance of models trained with local-DP guarantees , a previously studied notion that also provides protections against the meta-learner . Our setting reasonably relaxes this latter notion but can achieve roughly 1.7–2.3 times the accuracy on a modified version of the Shakespeare dataset ( Caldas et al. , 2018 ) and 1.6–1.7 times the accuracy on a modified version of Wiki-3029 ( Arora et al. , 2019 ) across various privacy budgets . For image-classification , we show that we show that we can still retain significant benefits of meta-learning while applying task-global DP on Omniglot ( Lake et al. , 2011 ) and Mini-ImageNet ( Ravi and Larochelle , 2017 ) . 1.1 RELATED WORK . DP Algorithms in Federated Learning Settings . Works most similar to ours focus on providing DP for federated learning . Specifically , Geyer et al . ( 2018 ) and McMahan et al . ( 2018 ) apply update clipping and the Gaussian Mechanism to achieve user-level global DP federated learning algorithms for language modeling and image classification tasks respectively . Their methods are shown to only suffer minor drops in accuracy compared to non-private training but they do not consider protections to inferences made by the meta-learner . Alternatively , Bhowmick et al . ( 2019 ) does achieve such protection by applying a theoretically rate-optimal local DP mechanism on the θ̄t ’ s users send to the meta-learner . However , they sidestep hard minimax rates ( Duchi et al. , 2018 ) by assuming the central server has limited side-information and allowing for a large privacy budget . In this work , though we achieve a relaxation of the privacy of Bhowmick et al . ( 2019 ) , we do not restrict the adversary ’ s power . Finally , Truex et al . ( 2019 ) does consider a setting that coincides with task-global DP , but they focus primarily on the added benefits of applying MPC ( see below ) rather than studying the merits of the setting in comparison to other potential settings . Secure Multiparty Computation ( MPC ) . MPC is a cryptographic technique that allows parties to calculate a function of their inputs while also maintaining the privacy of each individual inputs . In GBML , sets of model updates may come in a batch from multiple tasks , and hence MPC can securely aggregate the batch before it is seen by the meta-learner . Though MPC itself gives no DP guarantees against future inference , it can combined with DP to increase privacy . This approach has been studied in the federated setting , e.g . by Agarwal et al . ( 2018 ) , who apply MPC in the same difficult setting of Bhowmick et al . ( 2019 ) , and Truex et al . ( 2019 ) , who apply MPC similarly to a setting analogous to ours . On the other hand , MPC also comes with additional practical challenges such as peer-to-peer communication costs , drop outs , and vulnerability to collaborating participants . As such , combined with its applicability to multiple settings , including ours , we consider MPC to be an orthogonal direction . 2 PRIVACY IN A META-LEARNING CONTEXT . In this section , we first formalize the meta-learning setting that we consider . We then describe the various threat models that arise in the GBML setup , before presenting the different DP notions that can be achieved . Finally , we highlight the specific model and type of DP that we analyze . 2.1 PARAMETER TRANSFER META-LEARNING . In parameter transfer meta-learning , we assume that there is a set of learning tasks t = 1 , . . . , T , each with its corresponding disjoint training set Dt . Each Dt contains mt training examples { zt , i } mti=1 where each zt , i ∈ X ×Y . The goal within each task is to learn a function fθ̂t : X → Y parameterized by θ̂t ∈ Θ ⊂ Rd that performs “ well , ” generally in the sense that it has low within-task population risk in the distributional setting . The meta-learner ’ s goal is to learn an initialization φ ∈ Θ that leads to a well-performing θ̂t within-task . In GBML this φ is learned via an iterative process that alternates between the following two steps : ( 1 ) a within-task procedure where a batch of task-owners B receives the current φ and each t ∈ B uses φ as an initialization for running a within-task optimization procedure , obtaining θ̄t ( Dt , φ ) ; ( 2 ) a meta-level procedure where the meta-learner receives these model updates { θ̄t } t∈B and aggregates them to determine an updated φ . Note that we do not assume θ̂t = θ̄t , as the updates shared for the meta-learning procedure can be obtained from a different procedure than the refined model used for downstream within-task inference . This is especially the case when concerning the addition of noise for DP as part of the meta-learning procedure .

Summary: This paper considers the problem of achieving formal privacy guarantees in the context of parameter-sharing meta learning. This is a problem that has been studied recently, although generally not under the exact record-level task-privacy model studied in this paper (what they call global task privacy). The problem is well-motivated: since in meta learning we want to leverage information from similar tasks to increate data efficiency, there may be privacy concerns for each of the task owners about both other task owners and the aggregator (meta-learner).