Differentially Private Model Personalization

We provide algorithms that exploit popular non-private approaches in this domain like the Almost-No-Inner-Loop ( ANIL ) method , and give strong user-level privacy guarantees for our general approach . When the problems Pi are linear regression problems with each user ’ s regression vector lying in a common , unknown lowdimensional subspace , we show that our efficient algorithms satisfy nearly optimal estimation error guarantees . We also establish a general , information-theoretic upper bound via an exponential mechanism-based algorithm . 1 Introduction . Modern machine learning techniques are amazingly successful but come with a range of risks to the privacy of the personal data on which they are trained . Complex models often encode exact personal information in surprising ways—allowing , in extreme cases , the exact recovery of training data from black box use of the model [ 7 , 8 ] . The emerging architecture of modern learning systems , in which models are trained collaboratively by networks of mobile devices using extremely rich , personal information exacerbates these risks . The paradigm of model personalization , a special case of multitask learning , has emerged as one way to address both privacy and scalability issues . The idea is to let users train models on their own data—for example , to recognize friends ’ and family members ’ faces in photos , or to suggest text completions that match the user ’ s style—based on information that is common to the many other similar learning problems being solved by other users in the system . Even a fairly limited amount of shared information—a useful feature representation or starting set of parameters for optimization , for example—can dramatically reduce the amount of data each user requires . But that shared information can nevertheless be highly disclosive . In this paper , we formulate a model for reasoning rigorously about the loss to privacy incurred by sharing information for model personalization . In our model , there are n users , each holding a dataset of m labeled examples . We assume user j ’ s data set Dj is drawn i.i.d . from a distribution Pj ; the user ’ s goal is to learn a prediction rule that generalizes well to unseen examples from Pj . Ideally , the user should succeed much better than they could have on their own . We give new algorithms for this setting , analyze their accuracy on specific data distributions , and test our results empirically . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . We ask that our algorithms satisfy user-level , joint differential privacy ( DP ) [ 28 ] ( called task-level privacy , in the context of multi-task learning [ 32 ] ) . In this setting , each user provides their data set Dj as input to the algorithm and receives output Aj = Aj ( D1 , ... , Dn ) . We require that for every choice of the other data sets D−j = ( D1 , ... , Dj−1 , Dj+1 , ... , Dn ) and for every two data sets Dj and D′j , the collective view of the other users A−j be distributed essentially identically regardless of whether user j inputs Dj or D′j . The standard model of differential privacy doesn ’ t directly fit our setting , since the model ultimately trained by user j will definitely reveal information about user j ’ s data set . That said , the algorithms we design can ultimately be viewed as an appropriate composition of modules that satisfy the usual notion of DP ( an approach known as the billboard model ) . For simplicity , we describe our algorithms in a centralized model in which the data are stored in a single location , and the algorithm A is run as a single operation . In most cases , we expect A to be run as a distributed protocol , using either general tools such as multiparty computation or lightweight , specialized ones such as differentially private aggregation to simulate the shared platform . Intuitively , strong privacy requirement at user level , while still demanding that users share some common information is significantly challenging . For one , as each user individually has a small amount of data , it has to share information about it ’ s model/data to learn a meaningful representation . Furthermore , in practical personalization settings , there is feedback loop between the common or pooled knowledge of all users and the personalized models for each user . That is , starting with reasonable personalized models for each user , leads to a better pooled information , while good pooled information then helps each user learn better personal model . Now , requirement of strong privacy guarantees forces the pooled information quality to degrade up to some extent , which can then lead to poorer personalized model and form a negative feedback loop . 1.1 Contributions . We consider two types of algorithms for DP model personalization : inefficient algorithms ( based on the exponential mechanism [ 35 ] ) that establish information-theoretic upper bounds on achievable error , and efficient ones based on popular iterative approaches to non-private personalization [ 40 , 26 , 51 , 52 ] . These latter approaches are popular for their convergence speed and low communication overhead . As is often the case , those same features make them attractive starting points for DP algorithms . Problem Setting : Consider a set of n users , and suppose each user j ∈ [ n ] holds a data set of m records Dj = { ( xij , yij ) } i∈ [ m ] where xij ∈ R d , yij ∈ R. The goal is to learn a personalized model fj ( · ) = f ( · ; θj ) : Rd → R for each user j , where θj is a vector of parameters describing the model . We aim to learn a shared , low-dimensional representation for the features that allows users to train good predictors individually . For concreteness , we consider a linear embedding specified by a d× k matrix U , where k d. We may think of U either as providing a k-dimensional representation of the feature xij ( as U > xij ) or , alternatively , as a compact way to specify a d-dimensional regression vector θj = Uvj where vj is vector of length k. In both cases , user j ’ s final predictor has the form fj ( xij ) = f ′ ( 〈xij , Uvj〉 ) = f ′ ( 〈U > xij , vj〉 ) One may view this as a model as a two-layer neural network , where the first layer is shared across all users and the second layer is trained individually . A useful setting to have in mind is one where k m d—so users do not have enough data to find a good solution on their own , but they do have enough data to find the best vector vj once an embedding U has been specified . Without loss of generality , we assume U ∈ Rd×k to be an orthonormal basis and refer to it as embedding matrix . For brevity , we will define the matrix V = [ v1| · · · |vn ] ∈ C ⊆ Rk×n with vjs as columns . Measure of Accuracy : Let LPop ( U ; V ) = E ( i , j ) ∼u [ m ] × [ n ] , ( xij , yij ) ∼Pj [ ` ( 〈U > xij , vj〉 ; yij ) ] , where the loss function takes the form ` : R × R → R. We will focus on excess population risk defined in ( 1 ) . The privately learned models are denoted by ( Upriv , V priv ) . The error measures are defined with respect to any fixed choice of parameters ( U∗ , V ∗ ) . RiskPop ( ( Upriv , V priv ) ; ( U∗ , V ∗ ) ) = LPop ( Upriv , V priv ) − LPop ( U∗ , V ∗ ) . ( 1 ) Alternating Minimization Framework : We develop an efficient framework based on alternating minimization [ 46 , 29 , 23 ] : starting from an initial embedding map U0 , the algorithm proceeds in rounds that alternate between users individually selecting the model v ( t ) j that minimizes the error of the predictor f ′ ( 〈· , U ( t ) v ( t ) j 〉 ) , and then running a DP algorithm , for which user j provides inputs Dj , v ( t ) j , to privately select a new embedding U ( t+1 ) that minimizes the error of the predictor f ′ ( 〈· , U ( t+1 ) v ( t ) j 〉 ) . In both steps , the optimization to be performed is convex when the loss being optimized is convex . This helps us handle the inherent non-convexity in the problem formulation . Instantiation and Analysis for Linear Regression with Gaussian Data : For the specific case of linear regression with the squared error loss , we show that our framework can be fully instantiated with an efficient algorithm which converges quickly to an optimal solution . For simplicity , we consider the case where the feature vectors and field noise are normally distributed and independent of each user ’ s “ true ” model θ∗j , and furthermore that the θ ∗ j vectors admit a common low-dimensional representation U∗ ∈ Rd×k , so that θ∗j = U . ∗v∗j . We show that careful initialization of U0 followed by alternating minimization converges to a near-optimal embedding as long as m = ω ( k2 ) and n = ω ( k2.5d1.5 ε ) . Notice that non-privately , one would require n = ω ( dk ) users to get any reasonable test error . For standard private linear regression in dk dimensions , current state-of-the-art results ( Theorem 3.2 , [ 3 ] ) have a sample complexity similar to what we achieve . Theorem 1.1 ( Special case of Theorem 4.2 ) . Suppose the output for point xij ∼ N ( 0 , 1 ) d of user j is given by yij ∼ 〈 ( U∗ ) > xij , v∗j 〉 +N ( 0 , σ2F ) where U ∗ ∈ Rd×k is an orthonormal matrix that describes the shared representation , and suppose v∗j ∼ N ( 0 , 1 ) k. Let σF ≤ √ k and ε ≤ 1 . Then , assuming the number of users n is at least ( kd ) 1.5/ε , and the number of points per user m is at least k2 , with high probability Algorithm 1 learns an embedding matrix Upriv such that the average test error of a linear regressor learned over points embedded by Upriv is at most Õ ( d3k5 ε2n2 + σ 2 F · km ) . Our instantiation of the framework in this case has two major components : The initial embedding U0 is derived from users ’ data by a single noisy averaging step which roughly approximates the d× d projector onto the k-dimensional column space of U∗ . The idea is that given two data points ( xij , yij ) and ( x ( i+1 ) j , y ( i+1 ) j ) , the expected value of the rank-one matrix yijy ( i+1 ) jxijx > ( i+1 ) j is ( when rescaled ) a projector onto the space spanned by the regression vector θj . Adding these rank-one matrices across many data points and users produces a matrix with high overlap with the desired projector U∗ ( U∗ ) > . This is similar to the approach taken by [ 13 ] to design a non-private algorithm for a related , less general setting . The DP minimization step , which fixes the vj ’ s and seeks a near-minimal U , can be performed using any DP algorithm for convex minimization [ 9 , 4 ] . In this particular case , one can view this step as solving a linear regression problem in which U represents a list of dk real parameters : once x and v are fixed , 〈U > x , v〉 = x > Uv is a linear function of U . For the analysis to be tractable , we restrict our attention to linear regression with independent , normally-distributed features . However , the framework we provide is more general , and can be applied to a wider class of models . Developing mathematical tools to analyse the behavior of noisy alternating minimization algorithms in more general settings remains an important open question . Additionally , we run simulations on synthetic data to demonstrate the effectiveness of our proposed algorithm . Our algorithm reaches a significantly better privacy-utility tradeoff compared to two baselines : i ) each user uses their own data , and ii ) all users jointly learn a single model under differential privacy . Information-theoretic Upper Bounds : In addition to developing efficient algorithms for particular settings , we give upper bounds on the achievable error of user-level DP model personalization via inefficient algorithms . Specifically , we consider the natural approach of using the exponential mechanism [ 35 ] to select a common structure that provides low prediction error on average across users . For the specific case of a shared linear embedding ( a generalization of the linear regression setting above ) , when the feature vectors are drawn i.i.d . from N ( 0 , 1 ) d , and when the v∗j ’ s are drawn i.i.d . from N ( 0 , 1 ) k , we provide an upper bound showing that n = ω ( k1.5d1.5 ε ) users suffice to learn a good model , assuming m is sufficiently large for users to train the remaining parameters locally ( Theorem 5.2 ) . In comparison to alternating minimization , the sample complexity is better by a factor of k. In summary , we initiate a systematic study of differentially private model personalization in the practically important few-shot ( or per-user sparse data ) learning regime . We propose using users ’ data to learn a strong common representation/embedding using differential privacy , that can in turn be used to learn sample efficient models for each user . Using a simple but foundational problem setting , we demonstrate rigorously that this technique can indeed learn accurate common representation as well as personalized models , despite users housing only a small number of data points .

Summary: This paper studies the problem of model personalization with user-level differential privacy in the setting where users don't have enough data to find a good solution on their own but can leverage information in similar learning problems shared by other users. The problem is viewed as learning a 2-layer neural network, where the first embedding is the shared structure and the second layer is trained individually. This paper provides two types of algorithms: inefficient algorithms based on the exponential mechanism that establish information-theoretic upper bounds on an achievable error and efficient algorithms based on alternating minimization, which starts from an initial embedding and then repeatedly uses a DP minimizer to minimize the error. For the specific case of linear regression with squared error loss, the paper shows the alternating minimization framework can converge to a near-optimal embedding.