Making the Shoe Fit: Architectures, Initializations, and Tuning for Learning with Privacy
Authors: Nicolas Papernot
Steve Chien
Shuang Song
Abhradeep Thakurta
Ulfar Erlingsson
Venue:  (2020)
Keywords: differential privacy
deep learning

Abstract: Because learning sometimes involves sensitive data, standard machine-learning algorithms have been extended to offer strong privacy guarantees for training data. However, in practice, this has been mostly an afterthought, with privacy-preserving models obtained by re-running training with a different optimizer, but using the same model architecture that performed well in a non-privacy-preserving setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures and initializations are chosen and hyperparameter tuning is performed, ab initio, explicitly for privacy-preserving training. Using this paradigm, we achieve new state-of-the-art accuracy on MNIST, FashionMNIST, and CIFAR10 without any modification of the fundamental learning procedures or differential-privacy analysis.

Under review as a conference paper at ICLR 2020
MAKING THE SHOE FIT: ARCHITECTURES, INITIALI- ZATIONS, AND TUNING FOR LEARNING WITH PRIVACY
Anonymous authors Paper under double-blind review
ABSTRACT
Because learning sometimes involves sensitive data, standard machine-learning algorithms have been extended to offer strong privacy guarantees for training data. However, in practice, this has been mostly an afterthought, with privacy- preserving models obtained by re-running training with different optimizer, but using the same model architecture that performed well in non-privacy-preseriing setting. This approach leads to less than ideal privacy/utility tradeoffs, as we show here. Instead, we propose that model architectures and initializations are chosen and hyperparameter tuning is performed, ab initio, explicitly for privacy- preserving training. Using this paradigm, achieve new state-of-the-at accu- racy on MNIST, FashionMNIST, and CIFAR1O without any modification the fundamental learning procedures peterenntialprrvvvage analysis.
INTRODUCTION
Machine learning (ML) can be usefully applied to the analysis of sensitive data, e.g., in the domain of healthcare (Kononenko, 200T). However, ML models may unintentionally reveal sensitive aspects of their training data, e.g., due to overfitting (Shokri et al. 2017; Song & Shmatikov (019). To counter this, ML techniques that offer strong privacy guarantees have been developed. Notably, the differentially private stochastic gradient descent, or DP-SGD, of Afbai et al. (2016) is an easy- to-use, senerally-applicat modification of stochastic gradient descent. In addition its rigorous privacy guarantees, it has been empirically shown to stop the leaking of secrets (Carlini et al. 2019).
To strictly bound the impact of any training example, DP-SGD makes two changes to every gradient step: first, each example's 's gradient contribution is limited to fixed bound (in practice, by clipping all per-example gradients to a maximum & norm); second, random (Gaussian) noise of the scale of the clipping norm is added to each batch's 's combined gradient, before it is backpropagated to update model parameters. Together, these changes create new, artificial noise floor at each step of gradient descent, such that the unique signal of any individual example is below this noise floor; this allows differential privacy to be guaranteed for all training examples (Dwork & Roth 20144).
Training using DP-SGD is eminently practical and in addition to privacy offers advantages such as strong generalization and the promise of reusable holdouts (Google 2019: DDoork et af.) 2015). Un- fortunately, its advantages have not been without cost: empirically, the test accuracy of differentially private ML is consistently lower than that of non-private learning (e.g., see Papernot et al. (2018) Such accuracy loss may sometimes be inevitable: for example. the task may involve heavy-tailed dis- tributions and adding noise will definitely hinder visibility of examples in the tails (Feldman 2019 Bagdasaryan & Shmatikov 2019). However, this does not explain the accuracy loss of differentially private learning on standard benchmark tasks that are known to be relatively simple: MNIST (Yann)
al. 1998). FaShionMNIST (Xiao et al. 2017), CIFAR10 KKrihheskky al. 2009). etc.
This paper presents several new results for the-art in terms of both privacy and accuracy. Significantly, these new results stem from a single, learning with DP-SGD is different enough that all aspects model architecture, parameter initialization, and optimization strategy, as well as hy-
learning that improve the state-of-
simple observation: differentially-prival
of learning modeil perparameter tuning tuning-mus: must be reconsidered. To achieve the best privacy/accuracy tradeoffs, must tune our learning strategies to the specifics of crivacy-preserving learning; i.c, we must "learn to learn" with privacy. Conversely, we concretely demonstrate how the architecture, initialization,

---

Under review as a conference paper at ICLR 2020
and optimization strategy that gives the best accuracy for non non-private learning can be poor fit for learning with privacy. Instead, by revisiting our choices, we can reduce the information loss induced by clipping, limit the impact of added noise, and improve the utility of each gradient step when learning with privacy. Our contributions facilitate DP-SGD learning as follows:
We show how simple architecture changes, such as the use of tanh instead of ReLU acti- vations, can improve a model's private-learning suitability and achievable privacy/accuracy tradeoffs, by eliminating the negative effects of clipping and noising large gradients.
We explain how high-capacity models can be disadvantageous, as well as the advantages of models with a final, fully-connected layer that can be independently fine tuned, and how both help address the curse of dimensionality and high-dimensional noise.
We demonstrate the importance of finding good initializations, and show how this can be done with privacy using either transfer learning or weight scaling (Raghu et al.) 2019).
We show that better tradeoffs and increased wall-clock learning speeds can be achieved by tuning hyperparameters and choosing optimizers directly for DP-SGD learning.
By applying the above, we advance the state of the art for MNIST, FashionMNIST, and CIFARIO, significantly improving upon the privacy/accuracy tradoffss from prior work. On MNIST, we achieve 98.1% 1% test accuracy for a privacy guarantee of (s, 6) (2.93, 10 +). whereas the previous state- of- reported in the TensorFlow Privacy library (Google 2019) was 96.6%. On CIFARIO, we achieve 72% test accuracy at (e, 6) (2.1, 10 10-5) in setup for which to the best of our knowledge the previous ofte-of-the-ar was achieved by AAbadi et al. (2016) at 67% accuracy.
TRAINING-DATA MEMORIZATION, DIFFERENTIAL PRIVACY, AND DP-SGD
Machine-learning models will easily memorize whatever sensitive, personal, or private data that was used in their training, and models may in practice disclose this data- as demonstrated by the attacks Shokri al. (011)) Song & Shmatikov (2019). and Carlini et al. (2019).
For reasoning about the privacy guarantees of algorithms such as training by stochastic gradient descent, differential privacy has become the established gold standard (Dwork & Roth 2014). In- formally, an algorithm can be differentially private if it will always produce effectively the same output (in a mathematically precise sense), when applied to two input datasets that differ by only one record. Formally, learning algorithm A that trains models from the set S is (c, d) -)-differentially- private, if the following holds for all training datasets d and d' that differ by exactly one record:
Pr[A(d) E SS] S e Pr[A(d') E S] +
(I)
Here, gives the formal privacy guarantee. by placing a strong upper bound on any privacy loss, even in the worst possible case. A lower indicates a stronger privacy guarantee or a tighter upper bound (Erlingsson et al. 2019). The factor 5 allows for some probability that the property may not hold (in practice, this ò is required to be very small, e.g., in inverse proportion to the dataset size).
A very attractive property of differential-privacy guarantees is that they hold true for all attackers- whatever they are probing and whatever their prior knowledge-as that they remain true under various forms of composition. In particular, the output of differentially-priiatee algorithm can be arbitrarily post processed, without any weakening of the guarantees, Also, if sensitive training data contains multiple examples from the same person (or, more generally, the same sensitive group), e- e-differentially -rrivate training on this data will result in model with a he--diferential-priine antee for each person, as long as at most & training-datt records are present per person.
guar-
Abadi et al. (2016) introduced DP-SGD as a method for training deep neural networks with differentiallprivacy guarantees that was able to achieve better privacy and utility than previous ef- forts (Chaudhuri et al., 2011: [Song et al. 2013] (Bassily et 2014). DP-SGD bounds the sensitiv- ity of the learning process to each individual training example by computing per-example gradients {gr hioo..n- with respect to the loss, for the model parameters {0.)..o.n-1, and clipping each per eer-example gradient to a maximum fixed &g norm C. Subsequently. to the average of these per- example gradients. SGD adds (Gaussian) noise that whose standard deviation is proportional to this sensitivity. In this work, we use the canonical implementation of DP-SGD and its associated analysis that has been made available through the TensorFlow Privacy library (Google 2019)
2

---

Under review as a conference paper at ICLR 2020
0.98
Test Accuracy
0.96
Accurac
0.86
DPSGD (MNIST) SGD (MN:ST)
0.84
DPSGD (fashinMMNSS)
SGD (ashicnMNNST)
0.94
0.82
0.92
0.76
50
100 150
200
50
100
150
200
Number
Number
Figure 1: Test accuracy function of the number of filters k in the convolutional architecture of T when training with vanilla SGD and DPSGD. Each point corresponds to multiple training MNIST (left) or FashionMNIST (right). For both datasets, adding filters always improves non-private learning, whereas after an early point they are not beneficial to learning with privacy.
MODEL ARCHITECTURES BETTER SUITED TO LEARNING WITH PRIVACY
We show here that learning with differential privacy imposes additional constraints that need to be taken into account when designing neural network architectures. They help us control the sensi- tivity of learning training examples before the clipping operation is performed in DP-SGD, thus reducing the potential negative impact of clipping on the estimated gradient direction.
3.1 MODEL CAPACITY
The success of neural networks is in part explained by their ability to scale complex tasks through an increase in model capacity. ResNets are an illustrative recent examples (He et al. 2016). Here, we explain how additional capacity may not beneficial when learning with privacy. One of the major challenges in training models with differential privacy is the curse of dimensionality (Bassily et al.) 2014). The accuracy of privately trained models typically degrades with the increase the number of dimensions. Unfortunately, strong lower bounds suggest that this dependence on dimensionality necessary (Bassily al., 2014).
Consider the convolutional architecture described to the right. With all other architectural details ing fixed, we can control the model's capacity by varying the number of filters tional layers. While the relationship between gen- eralization performance and the number of param- al.
Table 1: MNIST and FaSHionMNIST model architecture (33,000 parameters for k = 31).
its two convolu-
Layer
Parameters
Convolution
k filters of 8x8, strides 2
Max-Pooling Convolution
2x2
is not always monotonic (Neyshabur 2017]. we leave as future work a study how dif- ferent measures of capacity can inform the design of model architectures for private learning. We re- port the model's s accuracy when trained with SGD and DP-SGD in Figure both on MNIST (left) and FashionMNIST (right). The test accuracy of models trained without privacy monotonically increases with the number filters their convo- lutional layers. Instead, we observe an inflection point at about 15 filters for which models trained with privacy achieve their highest test accuracy. Afterwards, the model's generalization suffers as more filters are added.
k filters 4x4, strides 2
Max-Pooling Fully connected
2x2
32 units
Softmax
10 units
There are two competing explanations this behavior, both compatible with lower bound stated Bassily et al. 20144. First, recall that DP-SGD performs clipping operation each per-example gradient before the average gradients is used to update model parameters; i.c., each gradient is subject to the following transformation
C
9: +- 9: min
1,
12-1
where 9: is the gradient corresponding to model parameter i. For fixed clipping norm (corre- C by which individual param-
sponding to certain, fixed privacy guarantee), the quantity VΣE- gf
eters multiplied decreases the number of parameters in model increases. That is, the more
3

---

Under review as a conference paper at ICLR 2020
85
80
Test Accuracy
90
Test Accuracy
70
80-
MNIST
FashionMNIST
ReLU
65
ReLU
tanh
tanh
60
1.0
2.5 DP-z values better)
1.5
2.0
3.0
1.0
1.5
2.0
2.5 better)
3.0
DP-z
Figure 2: Test accuracy function of the privacy loss when training a pair of models with DP- SGD. The only difference between the two models is the activation function for their hidden layer: ReLU tanh. All other elements of the architecture (number, type, and dimension of layers) and the training algorithm (optimizer, learning rate, number of microbatches, clipping norm, and noise multiplier) are identical. Results are averaged over 10 runs for each curve.
parameters have, the more likely DP-SGD to clip the gradient (or signal) at each parameter. This can explain the presence of an inflection point in Figure D after which learning with privacy becomes increasingly difficult as capacity is increased. Second, as the number of parameters (i.e., ')) increases, the norm of the noise vector that DP-SGD must add to the gradient average to ensure privacy also increases. This noise norm increases as / #parameters, and introduces another source of accuracy degradation with an increased number of parameters.
Our observations may seem to contradict some of the findings in Abadi et al. (2016). However, their limited experimental setup could offer few general lessons. First, they reduced data dimensionality using PCA to have inputs of only 60 dimensions; second, they explored only model architectures using a single layer pereeptron with between 200 and 2, 000 units. Instead, our experiments involve realistic setting where the full input is passed to convolutional neural network with total of hidden layers and over 26,000 parameters.
3.2 ACTIVATION FUNCTIONS
When training a model with differential privacy, gradients computed during SGD are clipped (recall Equation 2) to control the sensitivity of learning training examples. If these gradients take large values, some of the signal will be discarded as gradients are being clipped. One way to reduce the magnitude (or at least control it), is prevent the model's activations from exploding. However, a common choice of activation function in modern deep neural networks is the ReLU and, unlike other activations functions, ReLUs are unbounded.
Here, we thus test the hypothesis that replacing ReLUs with bounded activation function prevents activations from exploding and thus keeps the magnitude of gradients to more reasonable value. This in turn implies that the clipping operation applied by DP-SGD will discard less signal from gradient updates eventually resulting in higher performance test time.
On MNIST and FashionMNIST, we train two models based off the architecture of Table the first model uses ReLU whereas the second model uses tant as the activation for its hidden layers, with other architectural elements kept identical. In our experiments, we later fine-tuned those architec- tural aspects (i.c., model capacity, choice of optimizer, etc.) separately for each activation function, to avoid favoring any one choice. In all cases, tanh was an improvement, as summarized in our conclusions (Section(6).
Figure 2 visualizes the privacy-utility Pareto curve (Avent et al. 2019) of the two models trained with DP-SGD. Rather than plotting the test accuracy as a function of the number of steps, we plot it function of the privacy loss e (but the privacy loss is monotonically increasing function of the number of steps). On MNIST, the test accuracy of the tanh model is 98.0% compared to 96.6% for the ReLU model with identical privacy loss of 2.93. For comparison, baseline tanh and ReLU models trained without privacy both achieve test accuracy of 99.0%. Similarly, on FNSH, the tanh model trained with DP-SGD achieves 85.5% test accuracy compared to 81.9% with ReLUs. The baselines on T FasHionMNIST are 89.3% for tanh and 89.4% with ReLUs.
We obtained results similar the tanh with sigmoid and learning rate increased by factor of 2 to 8. This is explained by the fact that the tanh is rescaled sigmoid do tanh(z) 20(x))
4

---

Under review as a conference paper at ICLR 2020
To explain why simple change of activation functions has large impact the model's aceu- racy, we conjecture that the bounded nature of the tanh prevents activations from exploding during
training. We thus monitored the l nomm of the first layer's activations for our MNIST model while is being trained in three scenarios: (a)
1250
1.2 norm of the first activattion vacter
ReLU (SGD)
ReLU (DP-SGD)
tanh (DP-SGD)
1000
without privacy using vanilla SGD and ReLU
M
activations, (b) with ReLU activations and DP-
SGD, and (c) with tanh activations and DP- SGD. The evolution activation norms on test data is visualized in Figure 8 As conjectured, activations of our ReLU network explode by a factor of 3 when training with privacy when compared to without privacy. Switching to tanh activations brings down the norms of activations back to levels comparable with the activations of our non-privee non-private ReLU network.
500
250
0
2500
5000
7500
10000
12500
Number training steps
Figure 3: la norm of the first conv activations.
4 INITIALIZATIONS FOR LEARNING WITH DIFFERENTIAL PRIVACY
Because each gradient step expends some privacy budget, good initialization of learning is impor- tant; here, we consider transfer learning (Pratt al. [99I) and weight scaling (Raghu et 2019).
4.1 INITIALIZING FROM A PRE-TRAINED MODEL USING TRANSFER LEARNING
Transfer learning can improve the initialization used when learning with privacy, and allow better privacy/accuracy tradoffs to be achieved For example, to reach reasonable accuracy (> 80%) on CIFAR10, a convolutional neural network may necessarily include many convolutional layers comprising several hundred-thousann image-processing tasks are known to learn similar representations-aat least in early layers-it may be possible to transfer most of these parameters from public model, either as initializations or as frozen parameters, and subsequently train with DP-SGD. For CIFAR10, the natural choice for such transfer is a CIFARI00 model, and this has been previously explored by Abadi et al. (2016).
parameters. However, since convolutional layers for similar
Taking the Abadi et al. (216)) transfer learn- ing results for CIFARIO as baseline, we per- form new experiments using much of the same
Table 2: CIFARIO convolutional model architec- ture (in total, 2,395,434 parameters).
Cony x 2 Max-Pooling
32 filters of 3x3, strides I
setup and the model architecture As it is relatively simple, this model is a good candidate for differentialll-prig -rivvtte learning (al- though it reaches only 84.2% accuracy on CI- FAR10 when all its parameters are trained non- privately, whereas state-of-the-an models have over 10% higher accuracy).
Table 2
2x2
Conv x 2 Max-Pooling
64 filters of 3x3, strides 1
2x2
Conv x 2 Fully connected Softmax
128 filters of 3x3, strides
1024 units
10 units
We performed new transfe-learming experiments based on training this model CIFAR100 data in three different ways: trained on a total of 5000 examples from 10 classes picked at random (Min- rand-10 ); trained 25,000 examples from random half of the CIFAR1O0 100 classes, grouped into 10 new, evenly-sized meta classes (Half-rand-50) ); trained on all examples and all 100 separate classes (Max-100), From each of these trained models, transfer learning was used initialize model to be trained on CIFAR10. In the subsequent CIFAR11 10 training, all but the last layer was frozen, which simplifies the learning task that of logistic regression (but also reduces utility, with the best non-private accuracy reduced to 75% CIFARI0).
Table shows CIFARIO privacy and accuracy resulting from fine-tuning different transfer- learning models with DP-SGD. As shown in Table 4 the results improve on those of Abadi (et al. (016)), even though they performed non-linear fine-tuning of two neural-network lay- ers, and their underlying model was able to achieve higher non-private accuracy (86%).
A different, formal take on how public models and data can facilitate learning with privacy is studied in (Bassily al. 2018, Feldman et al. 2018).
5

---

Under review as a conference paper at ICLR 2020
Type
Epoch 10
Epoch 50
Epoch 100
Epoch 200
Epoch 400
Min-rand-10
44.8% = 4.6
49.6% = 3.9
51.0% = 3.9
52.8% + 3.3
53.7% 3.5
(81.0% + 4.0)
50% best
54.1% best
55.7% best
56.9% best
57.6% best
Half-rand-50
39.4% = 2.9
51.4% = 0.8
54.7% = 1.5
56.8% = 1.3
59.0% + 0.9
(62. 1.4)
44.3% best
52.6% best
56.6% best
58.3% = best
60.2% = best
Max-100
57.0% = 1.0
66.2% = 0.6
68,4% = 0.6
69.7% = 0.6
71.0% + 0.5
(54.9% + 0.7)
59.1% best
67.2% = best
69.5% = best
70.6% = best
72. 1 = best
Table 3: Accuracy of learning with privacy (average/best of 10 runs) compared to a non-private baseline of 75%. A CIFARIO model is trained from a CIFARIO0 10-rrrrrresesf-llemmnnng initialization, with tul-bbut-the-lat layer frozen during training. The DP-SGD E upper bounds at = 10 are
E10 0.32, Es0 0.73, E100 1.04, E200 1.48, 1000 2.12 for the subscript-indicate epochs. The source model CIFAR100 accuracy (first column), is uncorellated to the CIFAR 10 accuracy.
In addition, the results show the benefits of model architectures whose final layer can be fine-tuned using logistic regression training. or other forms of convex optimization. Such training can be made possible by including a final fully-connected layer into a network; in additional experiments (not detailed here), the inclusion of such a layer did not harm the training of the original, source model from done. Furthermore, the number of pa-
Table 4: CIFARIO privacy and accuracy tradeoffs.
This paper (s, acc.)
Abadi al.
(E, acc.)
(0.3, 59%)
(1.0, 70%)
which transfer learning rameters in this layer did not seem to matter much: privacy/accuracy tradeoff's remained the same, even when the layer was grown by an order of magnitude, which is consistent with what is known about differentially-privee convex optimization (Jain & Thakurta 2014).
(2.1, 72%)
(2.0, 67%)
(4.0, 70%
(8.0, 73%
4.2 INITIALIZATION BY WEIGHT SCALING
Initialization by transfer learning is only applicable when suitable public model exists whose weights can facilitate learning with privacy on sensitive data. But, such model may not exist, and DP-SGD learning may possibly benefit from other, non-standard means of initialization. We consider the Mean Var weight- scaling approach of Raghu et al. (2019) and initialize DP-SGD learning with Gaussian random parameter distributions whose layer-wise mean and variance are extracted from seed model trained on the same sensi- tive input data. The weight-scaling approach does not directly transfer the parameters of an existing model; instead, just the layer- wise mean and variance tracted, and those statistics are used to configure the Gaussian random distributions from which second model with the same architecture is initialized.
Tor acc-arc
0F seed
07 seed
0.1
07 seed
Mea Var
Rean Var
Moan Var
0.0
10 20
35
Epech
Figure Colored lines show DP-SGD accuracy for three "seed" random initiali- zations of a CIFAR-I0 model. Colored bands show accuracy range of 30 DP-SGD models using Mean Var initialization based on per-layer parameter statisties in the cor- responding seed model. In all models, the privacy each epoch identical; how- ever, Mean Var initialization substantially improves the privacy/accuracy tradeoff.
In the context of learning with privacy, Mean Var weight scaling can improve model initialization by transfer from one differentially-priieeee other. First, DP-SGD can be applied to train a model with standard random initialization. From this model, per-layer mean/variang statistics can be extracted to initialize new model of the same architecture, sub- sequently trained with strong privacy guarantees. (This extraction can be done privately, although the privacy risk of summary statistics that drive random initialization should be vanishing. Follow- ing Bassily et al. 2018); ; Papernot et al. (2018). one can use the formal framework of sub-sample and aggregate in conjunction with Propose- splits the training data into disjoint subsets, and trains models independently Using these trained models, the parameter is chosen via consensus voting with differential privacy. Notice that if the training data set is large, and there is strong consensus, then the cost towards
model an-
(PTR) for this selection. The algorithm first
each of the splits.

---

sqd
70-
95
adam
Text TestAccurcy
Accuaay
82-
Test Accuracy
60
90-
78-
-0
85-
MNIST
CIFAR10
74
FashionMNIST
sgo
acam
adam
Epochs 30
20
200
300
400
Epochs
Epechs
Figure 5: Learning curves for DP-SGD and DP-Adam. Early on in training, DP-Adam converges faster to accuracy that is within point of its final accuracy, however DP-SGD increases more steadily towards the end of training, thus both achieve comparable results. Given one of the datasets, the privacy budget for both models is identical each epoch.
privacy is very low.) The idea is that the mean and variance pairs can be obtained quickly at a mod- est privacy budget, but the faster convergence of the Mean Var initialized model both reduces the overall privacy budget needed for training, and mitigates the increased wall-clock time of DP-SGD.
We experiment with relatively deep CIFAR convolutional model (see Appendix [A), since Raghu et al.) found the benefits of Mean Var initialization most pronounced for large models. We first trained a model using random initialization, and then did weight scaling by transferring that model's statistics to new model. In this proof-of-concept, both models were trained with the same noise variance (a = 0.5), but one could reserve a larger portion of the privacy budget for the new model.
We should note that we did not directly transfer the weight statistics between corresponding layers in the original and new models. Rather, we used the weight statistics of each of original model's early layers of the original model for two of the layers in the new model. This gives superior performance to one-to-one transfer; we conjecture that this is because early layers have higher variance.
Figure44 shows the results of this experiment for some early training epochs. Each run that used stan- dard He random initialization (He et al. 2015) gave near identical results, achieving 37% accuracy epoch 33. The Mean Var initialization runs showed substantially higher variance, with the best models having 7% better accuracy at epoch 33. These results are intriguing, and reminiscent of the lottery ticket hypothesis (Frankle & Carbin 2019); they suggest a strategy of training a collection of Mean Var models and keeping those that show early promise.
TUNING OPTIMIZERS FOR PRIVATE LEARNING
Architectural choices presented in Section 3 control how sensitive learning is to training examples. This helps us to learn with privacy- because it eliminates the negative effects of clipping and noising large gradients. We now turn our attention to the training algorithm itself. We find that it is important to tailor algorithm and hyperparameter choices to the specificities of private learning: a batch size or learning rate that yields good results without privacy may not perform well with privacy.
5.1 ADAPTIVE OPTIMIZERS PROVIDE MARGINAL GAINS WHEN LEARNING WITH PRIVACY
We first explore the choice of optimizer, and in particular whether adaptive optimizers that leverage the history of iterates help convergence when learning privately. We compare learning curves for DP- SGD and the differentially private counterpart of Adam (Kngmma & Ba 2014). a canonical adaptive optimizer. A qualitative analysis of Figure 5 leads the same conclusion for all datasets (MNIST, FashionMNIST, and CIFARIO). While DP-Adam may converge faster initially, its convergence rate eventually slows down sufficiently for DP-SGD to achieve comparable (if not higher) accuracy.
To explain the ineffectiveness of adaptive optimizers, we hypothesize that the iterates they accumu- late during training are affected negatively by noise introduced to preserve privacy. Indeed, while there is enough signal from the training data included in any given batch sampled early in training, later training most training examples have a loss of zero and do not contribute to the gradients being noised. Carrying this noise from one gradient descent step the next to adapt learning rates therefore inadequately slows down training. To verify this, we track the estimate of the first moment in Adam MNIST. The mean absolute value of its components converges when learning without privacy (from 0.5 after the first epoch to about 0.8 for epochs 45 through 60). Instead, it increases steadily throughout training with privacy (from 0.5 at the first epoch to above 1. after 60 epochs).
Thus, choosing an adaptive optimizer (c.g., DP-Adam) is not necessary if one is interested in achiev- ing maximal accuracy: given fixed privacy budget, fine-tuning the learning rate is more important
7

---

Under review as a conference paper at ICLR 2020
confirm in Section 5.2 Note that this resonates well with recent results questioning the gen- eralization capabilities of adaptive optimizers (Wilson et al. 2017).
5.2 CHOOSING A (LARGE) BATCH SIZE AND LEARNING RATE
Having observed that few training examples contribute signal after the first epochs, it is natural to ask whether increasing the size of batches could improve the noise-to-signal ratio in DP learning.
To ensure a fair comparison, we fix the privacy budget e and deduce the number of epochs we can train the model for given desired batch size. For instance, in Table 5 we compare models trained for 7 epochs on batches of 1, 024 examples to models trained for 40 epochs on batches of 256 examples. In both cases, the total privacy budget for training these models E 2.7. We run hyperparameter search to fine-ture the choice of learning rate for both DP-SGD and DP-Adam. We then compare the test accuracy achieved with small and large batch sizes.
Non-private
infferentialll-privvee
Optimizer
Batch
Epochs
Time
Learning Rate
Test Acc.
Learning Rate
Test Acc.
256
40
240s
1.07
10-1
90.3%
3.32 10-1
86.1% 1%
SGD
1024
42s
3.68 10-1
86.3%
4.46
85.1%
256
40
240s
1.06 10
90.5%
1.32
10
86.0%
Adam
1024
42s
4.32
10-3
88.7%
7.08
10
85.1%
Table Impact of batch size on trade-off between accuracy and privacy. The privacy budget is fixed to 2.7 for all rows. A hyperparameter search is then conducted to find the best learning rate to train the model with or without differential privacy on FashionMNIST.
Hyperparameters should be tuned for DP-SGD, not SGD. We confirm that DP-Adam does not improve over DP-SGD, Yet, this experiment shows how training for small number of epochs at large batch size do comparably well to large number of epochs at small batch size: the wall-clock time gain is important (about 5x) and the cost in performance is moderate- half a percentage point. This suggests that earlier theoretical analysis (Talwar et al.) (2044) also holds in the non-convex setting. Furthermore, note how learning rates vary across the non-DP and DP settings.
CONCLUSIONS
Rather than first train non-private model and later attempt to make it private, bypass non- private training altogether and directly incorporate specificities of privacy-preserving learning in the selection of architectures, initializations, and tuning strategies. This improves substantially upon the state-of-the-ar privacy/accuracy trade-offss on three benchmarks, as summarized below. Up to now, we evaluated each component (c.g., change of activation function, optimizer, etc.) individually to demonstrate its influence on private learning. Instead, here this summary table compares each approach after all hyperparameters explored in the paper have been jointly fined tuned. In particu- lar, note how even in their own individually-be setting, tanh continues to consistently outperform ReLU with for example 98.1 % test accuracy (instead of 96.6% for ReLU) on MNIST.
Dataset
Technique
Acc.
E
8
Assumptions
SGD w/ tanh (not private)
99.0%
00
0
MNIST
DP-SGD w/ ReLU
96.6%
2.93
10-5
DP-SGD w/ tanh (ours)
98.1%
2.93
10-5
SGD w/ ReLU (not private)
89,4%
00
0
WNSS
DP-SGD w/ ReLU
81.9%
2.7
10
DP-SGD w/ tanh (ours)
86.1%
2.7
10-5
Transter SGD (not private)
75%
00
0
CIFARIO
Transfer DP-SGD (Abadi al.)
67%
2
10-5
Public Data
Transfer + DP-SGD (ours)
72%
2.1
10
Public Data
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318. ACM, 2016.
Brendan Avent, Javier Gonzalez, Tom Diethe, Andrei Paleyes, and Borja Balle. Automatic discovery of privacy-utility pareto fronts. arXiv preprint urXiv:1905.10880 2019.
Eugene Bagdasaryan and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy, 2019.
Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pp. 464-473, IEEE, 2014.
Raef Bassily, Abhradeep Guha Thakurta, and Om Dipakbhai Thakkar. Model-agnostie private learn- ing. In Advances in Neural Information Processing Systems, pp. 7102-71 12, 2018.
Nicholas Carlini, Chang Liu, Úlfar Frlingsson, Jernej Kos, and Dawn Song. The secret sharer: Eval- uating and testing unintended memorization in neural networks. In USENIX Security Symposium, 2019.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 120Mar):1069-1119 2011.
C. Dwork and A. Roth. The Algorithmic Foundations of Differential Privacy. now, 2014.
Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Aaron Roth. The reusable holdout: Preserving validity in adaptive data analysis. Science, 349(6248))636-6388 2015.
Úlfar Erlingsson, Ilya Mironov, Ananth Raghunathan, and Shuang Song. That which we call private, 2019.
Vitaly Feldman. Does learning require memorization? short tale about long tail. arXiv preprint arXiv: 190600517, 2019.
Vitaly Feldman, Ilya Mironov, Kunal Talwar, and Abhradeep Thakurta. Privacy amplification by iteration. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS), pp. 521-532. IEEE, 2018.
Jonathan Frankle and Michael Carbin. The lottery ticket hypothesis: Finding sparse, trainable neu- ral networks. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019, 2019.
Google. TensorFlow Privacy.
2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the 2015 IEEE Inter- national Conference Computer Vision (ICCV), ICCV '15, pp. 1026-1034, Washington, DC, doi: 10. 109/CCCV20055122..
USA, 2015. IEEE Computer Society. ISBN
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and patlern recognition, pp- 770-778, 2016.
Prateek Jain and Abhradeep Guha Thakurta. (near) dimension independent risk bounds for differ- entially private learning. In International Conference Machine Learning, pp. 476-484, 2014.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint 141.6994/ 2014.
Igor Kononenko. Machine learning for medical diagnosis: history, state of the art and perspective.
Artificial Intelligence in medicine, 23(1):89-109) 2001.

---

Under review as a conference paper at ICLR 2020
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring general- ization in deep learning. In Advances in Neural Information Processing Systems, pp. 5947-5956, 2017.
Nicolas Papernot, Shuang Song, llya Mironov, Ananth Raghunathan, Kunal Talwar, and Ifar Er- lingsson. Scalable private learning with pate, 2018.
Lorien Pratt, Jack Mostow, Candace Kamm, and Ace A Kamm. Direct transfer of learned information among neural networks. In AAAI, volume 91, pp. 584-589, 1991.
Maithra Raghu, Chiyuan Zhang, Jon Kleinberg, and Samy Bengio. Transfusion: Understanding transfer learning for medical imaging, 2019.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE Symposium on Security and Privucy (SP), pp. 3-18. IEEE, 2017.
Congzheng Song and Vitaly Shmatikov. Auditing data provenance in exxtgeeneration models. 2019.
Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differ- entially private updates. In 2013 IEEE Global Conference on Signal and Information Processing, pp. 245-248. IEEE, 2013.
Kunal Talwar, Abhradeep Thakurta, and Li Zhang. Private empirical risk minimization beyond the worst case: The effect of the constraint set geometry. arXiv preprint arXiv: 2014,
Ashia C Wilson, Rebecca Roelofs, Mitchell Stern, Nati Srebro, and Benjamin Recht. The marginal value of adaptive gradient methods in machine learning. In Advances in Neural Information Processing Systems, pp. 4148 1854,,8, 2017.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmark- ing machine learning algorithms, 2017.
LeCun Yann, Cortes Corinna, and Christopher. The mnist database of handwritten digits. URL htpp//yhunn. lecun. com/exdb/mnist, 1998.
10

---

Under review as a conference paper at ICLR 2020
A
DEEP CONVOLUTIONAL MODEL
Conv
64 filters of 3x3, strides
Cony
128 filters of 3x3, strides
Av pooling
2x2
Conv
128 filters of 3x3, strides
Conv
256 filters of 3x3, strides
Av pooling
2x2
Conv
256 filters of 3x3, strides
Conv
512 filters of 3x3, strides
Av pooling
2x2
Conv
10 filters of 3x3, strides
Reduce mean
1x2
Softmax
10 units
Table 6: All convolutional architecture for CIFARIO model with 2,334,730 parameters.
B EXPERIMENTAL DETAILS
We describe hyperparameters used in Sections body of the paper due space constraints.
and 5 because they were omitted from the main
Section 3.1
Section 3.2
Batch size / microbatches
100
256
Epochs
40
40
Optimizer
SGD / DP-SGD
SGD / DP-SGD
Learning rate
0.15
0.15
Clipping norm
1.0
1.0
Noise multiplier
1.1
1.1
Architecture
Table (varying k)
Table (k = 16)
Activation function
ReLU
ReLU tanh
Section
4.1
(CIFAR10))
Section
(CIFAR1O)
Section 4.2
Batch size / microbatches
64
5000
500
Epochs Optimizer
150
400
See Figure
Adam
DP-SGD
DP-Adam
Learning rate
0,001
0.8
0.0001
Clipping norm
(public)
1.0
1,0
Noise multiplier
n/a (public)
15
0.5
Architecture
Table 2
Table 2
Table 6
Activation function
ReLU
ReLU
tanh
Section 5.1
Section 5.2
Batch size / microbatches
256
256 1024
Epochs
40
40
Optimizer
DP-SGD DP-Adam
SGD / DP-SGD / Adam AP-Adam
Learning rate
See Table
for dataset specific rates
Clipping norm
1.0
1.0
Noise multiplier
1.1
1.1
Architecture
Table (k = 16)
Table
(k 16)
Activation function
tanh
tanh
11


Reviews:
[{"review_id": "Skx5Yj8pcr", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents experimental evidence that learning with privacy requires approaches that are not identical to those used when learning without privacy. These approaches include re-considering different model choices (i.e., its structure and activation functions), its initialization, and its optimization procedure. With these changes, they show that it is possible to obtain state-of-the-art results for some canonical learning tasks.\n\nStrengths:\nThis paper questions nearly every component in the training pipeline, including choices about the model structure, initialization strategies, and optimization procedures. For each component, they show that judiciously choosing the components (which go against the standard choices in the non-private learning setting) enables training higher-utility models than in previous works without sacrificing privacy. Moreover, in addition to the experimental evidence alone, most of the components considered in the paper were accompanied by reasonable justification/hypotheses for why the choices enable such improvements.\nThis paper helps push differentially private learning to a more practically-useful realm. First, the suggested changes here are easy for a practitioner to understand and easy to implement. With only these simple changes, the concrete results then show that it is possible to achieve utility close to the analogous non-private model while still maintaining reasonable utility (\\epsilon less than 3 with \\delta of 10^-5).\n\n\nWeaknesses:\nMy major concern with this paper lies in the experimental methodology. Specifically, most experiments are based on varying a single component while leaving all other components the same. While this is certainly the scientifically-valid way to demonstrate the component’s influence on the entire system given the other fixed components, it doesn’t convincingly demonstrate that the component has this influence across all (or at least most) reasonable configurations of the other components.\nThis can be made concrete using many experiments in the paper, but let’s take the activation functions experiment of 3.2 as an example. Here, it is shown that after fixing the privacy guarantee, model structure, training procedure, and hyperparameters -- the tanh activation performs better than the ReLU activation. However, suppose instead that we fix all of these components except the hyperparameters; it may then be the case that the ReLU activation is capable of outperforming the tanh activation when its hyperparameters are chosen carefully. In other words, to validly compare the two activations and reach a convincing conclusion, they should be compared against each other in their own individually-best settings (e.g., the results induced by the optimal hyperparameters for ReLU versus the results induced by the optimal hyperparameters for tanh).\nThis is similar to the problem addressed in Avent et al.’s “Automatic Discovery of Privacy–Utility Pareto Fronts” paper (https://arxiv.org/abs/1905.10862). \nThe specific technical details on some experiments were either difficult to find or were lacking. Given that this is fundamentally an experimental paper, having these details clearly listed somewhere for reference is important, even if relegated to an Appendix. Although this applies more broadly to most of the experiments, we can use Section 3 as an example again: the details on the experiment in 3.1 were found in the caption of Figure 1, whereas I would have expected them either in the main body or clearly listed in their own table; the details on the experiment in 3.2 specify that everything is identical between the tests of the two activation functions, however it is never specified exactly what is being altered (and by how much) to vary the \\epsilon value.\n4.2 Initialization by Weight Scaling proposes that judiciously scaling initial weights can improve model privacy/utility. This scaling is done by “transfer from one differentially private model to another”, where “DP-SGD can be applied to train a model with high utility, but less than ideal privacy” and then extracting the relevant information from there in order to initialize a new differentially private model that will be trained with strong privacy guarantees. It is claimed that “this extraction can be done in a differentially-private manner, e.g., as in Papernot et al. (2018), although the privacy\nrisk of summary statistics that drive random initialization should be vanishing”. It is unclear to me how this extraction of summary statistics should be done in such a way that doesn’t consume a significant portion of the privacy budget. If there is such a way, it should be clearly stated and its effect on the privacy budget should be explicitly incorporated into this paper’s results.\nMinor: The statement that “Such accuracy loss may sometimes be inevitable” on page 1 should include a reference; e.g., Feldman’s “Does Learning Require Memorization? A Short Tale about a Long Tail” paper (https://arxiv.org/abs/1906.05271).\n\n\nOverall, this work provides good practical guidance to practitioners and researchers who wish to do differentially private machine learning. However, given the lack of theoretical novelty, the experimental methodology needs to be improved in order to significantly strengthen the results (assuming they continue to hold).\n\n\n----------------------------------------------------\n\nUpdate: Due to the authors' writing clarifications and experimental additions, in conjunction with the concrete and realistically-applicable insights from the paper, I've modified my rating to a Weak Accept.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "SJxqstEyqB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper methodically analyses the settings and choices used when training neural networks (specifically CNNs) via the DP-SGD algorithm and suggests changes to the standard procedures that empirically lead to higher accuracies despite the added noise. The main statement of the paper is quite simple: optimize hyperparameters for the model that you're training (DP-SGD) rather than the model it is inspired by. Yet, the findings an recommendations may be useful for practitioners.\n\nNevertheless, to be more practically relevant the paper needs some modifications:\n\nThe example models used in demonstrations are quite small (3 hidden layers 26,000 parameters, when, for example, a standard segmentation CNN model U-net can typically have 26,000,000, AlexNet has about 60,000,000 and so on). The results would be much more convincing if these or other models widely used in practice were used as running examples.\n\nIn Figure 1 the multitude of point on the plot makes it unclear whether they represent result variability per number of filters or simply reflect variability as the number of filters grows. If it is the latter, it seems appropriate to perform a cross validation analysis and report standard deviations. Especially in the MNIST plot the values for SGD and DP-SGD are so close that they may in fact be statistically indistinguishable. Hard to tell by looking at a point estimate. The same request holds for Figure 2, where the difference may be immaterial, but as the figure currently stands it is unclear.\n\nSection 3.2 reports some numbers for test accuracy but the uncertainty of these numbers with respect to the test set changes (cross validation) is not reported and the numbers are quite close to each other. Furthermore, the dataset is not described and it is unclear what was the size of the training and the test sets.\n\nConclusions relative Adam vs SGD seem to repeat what's already known or been discussed about these methods outside of the DP topic. May be worth highlighting that when one knows how to set learning rates for SGD (may be via learning rate scheduler, not discussed in the paper but practically relevant) then SGD may be as good or slightly better than Adam. However note, adaptive optimizers are often preferred for their ease of use as no tweaking and searching for an optimal learning rate is required. Would not this problem be detrimental for SGD optimization affecting the privacy budget?\n\nPlease add wall-clock time column to Table 5 to support the statement about 4 times gain.\n\nI think it's more accurate to change \" This confirms that earlier theoreticalanalysis (Talwar et al., 2014) also holds in the non-convex setting.\" to \"This suggests that earlier theoreticalanalysis (Talwar et al., 2014) also holds in the non-convex setting.\"\n\n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "B1gcmtH15B", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Overall, this work empirically evaluates different techniques used in privacy learning and suggest useful methods to stabilize or improve performance.\n\nDetail comments:\n\nStrength:\nDespite the progress of privacy-preserving learning in theory, there are few works providing learning details for better training. Especially, considering the instability in perturbation-based private algorithms, e.g., most DP ones, the work could be valuable in the sense of practice.\n\nWeakness:\nAs far as empirical research, the compared techniques are too few. What if we use those less popular techniques, for example, RMSprop optimization method?\n\nThe model capacity of neural networks, especially deep networks, has some non-trivial relation to the number of filters or the number parameters. It is important to quantify such relation. A good reference might be [A]. Briefly, the generalization performance may not be monotonic against the number of parameters.\n\nThe baselines are not enough. Of course, Abadi et al.’s work is outstanding in handling the privacy learning of deep networks. It has been further developed by the following researchers. For example, [B] and [C]. Does the conclusion still hold for these algorithms?\n\n[A] Neyshabur, B., Bhojanapalli, S., Mcallester, D., & Srebro, N. (2017). Exploring Generalization in Deep Learning. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, & R. Garnett (Eds.), Advances in Neural Information Processing Systems 30 (pp. 5947–5956). \n[B] Yu, L., Liu, L., Pu, C., Gursoy, M. E., & Truex, S. (2019). Differentially Private Model Publishing for Deep Learning. Proceedings of 40th IEEE Symposium on Security and Privacy. \n[C] Phan, N., Vu, M. N., Liu, Y., Jin, R., Dou, D., Wu, X., & Thai, M. T. (2019). Heterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustness. Proceedings of the Twenty-Eighth International Joint Conference on Artificial ", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I did not assess the derivations or theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper presents experimental evidence that learning with privacy requires optimization of the model settings (architectures and initializations) that are not identical to those used when learning without privacy. While acknowledging potential usefulness of this work for practitioners, the reviewers expressed several important concerns such as (1) lack of SOTA baseline comparisons, (2) lack of clarity of the empirical evaluation protocols, (3) large models (that are widely used in practice) have not been studied in the paper, (4) low technical novelty. The authors have successfully addressed some of the concerns regarding (1) and (2). However (3) and (4) make it difficult to assess the benefits of the proposed approach for the community and were viewed by AC as critical issues. We hope the detailed reviews are useful for improving and revising the paper. 
Decision: Reject