Differentially Private Model Personalization

We provide algorithms that exploit popular non-private approaches in this domain like the Almost-No-Inner-Loop ( ANIL ) method , and give strong user-level privacy guarantees for our general approach . When the problems Pi are linear regression problems with each user ’ s regression vector lying in a common , unknown lowdimensional subspace , we show that our efficient algorithms satisfy nearly optimal estimation error guarantees . We also establish a general , information-theoretic upper bound via an exponential mechanism-based algorithm . 1 Introduction . Modern machine learning techniques are amazingly successful but come with a range of risks to the privacy of the personal data on which they are trained . Complex models often encode exact personal information in surprising ways—allowing , in extreme cases , the exact recovery of training data from black box use of the model [ 7 , 8 ] . The emerging architecture of modern learning systems , in which models are trained collaboratively by networks of mobile devices using extremely rich , personal information exacerbates these risks . The paradigm of model personalization , a special case of multitask learning , has emerged as one way to address both privacy and scalability issues . The idea is to let users train models on their own data—for example , to recognize friends ’ and family members ’ faces in photos , or to suggest text completions that match the user ’ s style—based on information that is common to the many other similar learning problems being solved by other users in the system . Even a fairly limited amount of shared information—a useful feature representation or starting set of parameters for optimization , for example—can dramatically reduce the amount of data each user requires . But that shared information can nevertheless be highly disclosive . In this paper , we formulate a model for reasoning rigorously about the loss to privacy incurred by sharing information for model personalization . In our model , there are n users , each holding a dataset of m labeled examples . We assume user j ’ s data set Dj is drawn i.i.d . from a distribution Pj ; the user ’ s goal is to learn a prediction rule that generalizes well to unseen examples from Pj . Ideally , the user should succeed much better than they could have on their own . We give new algorithms for this setting , analyze their accuracy on specific data distributions , and test our results empirically . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . We ask that our algorithms satisfy user-level , joint differential privacy ( DP ) [ 28 ] ( called task-level privacy , in the context of multi-task learning [ 32 ] ) . In this setting , each user provides their data set Dj as input to the algorithm and receives output Aj = Aj ( D1 , ... , Dn ) . We require that for every choice of the other data sets D−j = ( D1 , ... , Dj−1 , Dj+1 , ... , Dn ) and for every two data sets Dj and D′j , the collective view of the other users A−j be distributed essentially identically regardless of whether user j inputs Dj or D′j . The standard model of differential privacy doesn ’ t directly fit our setting , since the model ultimately trained by user j will definitely reveal information about user j ’ s data set . That said , the algorithms we design can ultimately be viewed as an appropriate composition of modules that satisfy the usual notion of DP ( an approach known as the billboard model ) . For simplicity , we describe our algorithms in a centralized model in which the data are stored in a single location , and the algorithm A is run as a single operation . In most cases , we expect A to be run as a distributed protocol , using either general tools such as multiparty computation or lightweight , specialized ones such as differentially private aggregation to simulate the shared platform . Intuitively , strong privacy requirement at user level , while still demanding that users share some common information is significantly challenging . For one , as each user individually has a small amount of data , it has to share information about it ’ s model/data to learn a meaningful representation . Furthermore , in practical personalization settings , there is feedback loop between the common or pooled knowledge of all users and the personalized models for each user . That is , starting with reasonable personalized models for each user , leads to a better pooled information , while good pooled information then helps each user learn better personal model . Now , requirement of strong privacy guarantees forces the pooled information quality to degrade up to some extent , which can then lead to poorer personalized model and form a negative feedback loop . 1.1 Contributions . We consider two types of algorithms for DP model personalization : inefficient algorithms ( based on the exponential mechanism [ 35 ] ) that establish information-theoretic upper bounds on achievable error , and efficient ones based on popular iterative approaches to non-private personalization [ 40 , 26 , 51 , 52 ] . These latter approaches are popular for their convergence speed and low communication overhead . As is often the case , those same features make them attractive starting points for DP algorithms . Problem Setting : Consider a set of n users , and suppose each user j ∈ [ n ] holds a data set of m records Dj = { ( xij , yij ) } i∈ [ m ] where xij ∈ R d , yij ∈ R. The goal is to learn a personalized model fj ( · ) = f ( · ; θj ) : Rd → R for each user j , where θj is a vector of parameters describing the model . We aim to learn a shared , low-dimensional representation for the features that allows users to train good predictors individually . For concreteness , we consider a linear embedding specified by a d× k matrix U , where k d. We may think of U either as providing a k-dimensional representation of the feature xij ( as U > xij ) or , alternatively , as a compact way to specify a d-dimensional regression vector θj = Uvj where vj is vector of length k. In both cases , user j ’ s final predictor has the form fj ( xij ) = f ′ ( 〈xij , Uvj〉 ) = f ′ ( 〈U > xij , vj〉 ) One may view this as a model as a two-layer neural network , where the first layer is shared across all users and the second layer is trained individually . A useful setting to have in mind is one where k m d—so users do not have enough data to find a good solution on their own , but they do have enough data to find the best vector vj once an embedding U has been specified . Without loss of generality , we assume U ∈ Rd×k to be an orthonormal basis and refer to it as embedding matrix . For brevity , we will define the matrix V = [ v1| · · · |vn ] ∈ C ⊆ Rk×n with vjs as columns . Measure of Accuracy : Let LPop ( U ; V ) = E ( i , j ) ∼u [ m ] × [ n ] , ( xij , yij ) ∼Pj [ ` ( 〈U > xij , vj〉 ; yij ) ] , where the loss function takes the form ` : R × R → R. We will focus on excess population risk defined in ( 1 ) . The privately learned models are denoted by ( Upriv , V priv ) . The error measures are defined with respect to any fixed choice of parameters ( U∗ , V ∗ ) . RiskPop ( ( Upriv , V priv ) ; ( U∗ , V ∗ ) ) = LPop ( Upriv , V priv ) − LPop ( U∗ , V ∗ ) . ( 1 ) Alternating Minimization Framework : We develop an efficient framework based on alternating minimization [ 46 , 29 , 23 ] : starting from an initial embedding map U0 , the algorithm proceeds in rounds that alternate between users individually selecting the model v ( t ) j that minimizes the error of the predictor f ′ ( 〈· , U ( t ) v ( t ) j 〉 ) , and then running a DP algorithm , for which user j provides inputs Dj , v ( t ) j , to privately select a new embedding U ( t+1 ) that minimizes the error of the predictor f ′ ( 〈· , U ( t+1 ) v ( t ) j 〉 ) . In both steps , the optimization to be performed is convex when the loss being optimized is convex . This helps us handle the inherent non-convexity in the problem formulation . Instantiation and Analysis for Linear Regression with Gaussian Data : For the specific case of linear regression with the squared error loss , we show that our framework can be fully instantiated with an efficient algorithm which converges quickly to an optimal solution . For simplicity , we consider the case where the feature vectors and field noise are normally distributed and independent of each user ’ s “ true ” model θ∗j , and furthermore that the θ ∗ j vectors admit a common low-dimensional representation U∗ ∈ Rd×k , so that θ∗j = U . ∗v∗j . We show that careful initialization of U0 followed by alternating minimization converges to a near-optimal embedding as long as m = ω ( k2 ) and n = ω ( k2.5d1.5 ε ) . Notice that non-privately , one would require n = ω ( dk ) users to get any reasonable test error . For standard private linear regression in dk dimensions , current state-of-the-art results ( Theorem 3.2 , [ 3 ] ) have a sample complexity similar to what we achieve . Theorem 1.1 ( Special case of Theorem 4.2 ) . Suppose the output for point xij ∼ N ( 0 , 1 ) d of user j is given by yij ∼ 〈 ( U∗ ) > xij , v∗j 〉 +N ( 0 , σ2F ) where U ∗ ∈ Rd×k is an orthonormal matrix that describes the shared representation , and suppose v∗j ∼ N ( 0 , 1 ) k. Let σF ≤ √ k and ε ≤ 1 . Then , assuming the number of users n is at least ( kd ) 1.5/ε , and the number of points per user m is at least k2 , with high probability Algorithm 1 learns an embedding matrix Upriv such that the average test error of a linear regressor learned over points embedded by Upriv is at most Õ ( d3k5 ε2n2 + σ 2 F · km ) . Our instantiation of the framework in this case has two major components : The initial embedding U0 is derived from users ’ data by a single noisy averaging step which roughly approximates the d× d projector onto the k-dimensional column space of U∗ . The idea is that given two data points ( xij , yij ) and ( x ( i+1 ) j , y ( i+1 ) j ) , the expected value of the rank-one matrix yijy ( i+1 ) jxijx > ( i+1 ) j is ( when rescaled ) a projector onto the space spanned by the regression vector θj . Adding these rank-one matrices across many data points and users produces a matrix with high overlap with the desired projector U∗ ( U∗ ) > . This is similar to the approach taken by [ 13 ] to design a non-private algorithm for a related , less general setting . The DP minimization step , which fixes the vj ’ s and seeks a near-minimal U , can be performed using any DP algorithm for convex minimization [ 9 , 4 ] . In this particular case , one can view this step as solving a linear regression problem in which U represents a list of dk real parameters : once x and v are fixed , 〈U > x , v〉 = x > Uv is a linear function of U . For the analysis to be tractable , we restrict our attention to linear regression with independent , normally-distributed features . However , the framework we provide is more general , and can be applied to a wider class of models . Developing mathematical tools to analyse the behavior of noisy alternating minimization algorithms in more general settings remains an important open question . Additionally , we run simulations on synthetic data to demonstrate the effectiveness of our proposed algorithm . Our algorithm reaches a significantly better privacy-utility tradeoff compared to two baselines : i ) each user uses their own data , and ii ) all users jointly learn a single model under differential privacy . Information-theoretic Upper Bounds : In addition to developing efficient algorithms for particular settings , we give upper bounds on the achievable error of user-level DP model personalization via inefficient algorithms . Specifically , we consider the natural approach of using the exponential mechanism [ 35 ] to select a common structure that provides low prediction error on average across users . For the specific case of a shared linear embedding ( a generalization of the linear regression setting above ) , when the feature vectors are drawn i.i.d . from N ( 0 , 1 ) d , and when the v∗j ’ s are drawn i.i.d . from N ( 0 , 1 ) k , we provide an upper bound showing that n = ω ( k1.5d1.5 ε ) users suffice to learn a good model , assuming m is sufficiently large for users to train the remaining parameters locally ( Theorem 5.2 ) . In comparison to alternating minimization , the sample complexity is better by a factor of k. In summary , we initiate a systematic study of differentially private model personalization in the practically important few-shot ( or per-user sparse data ) learning regime . We propose using users ’ data to learn a strong common representation/embedding using differential privacy , that can in turn be used to learn sample efficient models for each user . Using a simple but foundational problem setting , we demonstrate rigorously that this technique can indeed learn accurate common representation as well as personalized models , despite users housing only a small number of data points .

Summary: The authors deal with personalized model learning under the user-level joint differential privacy. In this problem, each user aims to build a user-specified model to make a prediction for the user's data. In the training process, the users utilize knowledge from the other users' data to improve their model's performance. In this setup, we want to prevent the leakage of the sensitive information in the user's data to the other user. The authors develop the differentially private algorithms for the model personalization task and reveal the upper bounds on the personalized model's accuracy of these algorithms.