Differentially Private Meta-Learning
Authors: Jeffrey Li
Mikhail Khodak
Sebastian Caldas
Ameet Talwalkar
Venue:  (2020)
Keywords: Differential Privacy
Meta-Learning
Federated Learning

Abstract: Parameter-transfer is a well-known and versatile approach for meta-learning, with applications including few-shot learning, federated learning, with personalization, and reinforcement learning. However, parameter-transfer algorithms often require sharing models that have been trained on the samples from specific tasks, thus leaving the task-owners susceptible to breaches of privacy. We conduct the first formal study of privacy in this setting and formalize the notion of task-global differential privacy as a practical relaxation of more commonly studied threat models. We then propose a new differentially private algorithm for gradient-based parameter transfer that not only satisfies this privacy requirement but also retains provable transfer learning guarantees in convex settings. Empirically, we apply our analysis to the problems of federated learning with personalization and few-shot classification, showing that allowing the relaxation to task-global privacy from the more commonly studied notion of local privacy leads to dramatically increased performance in recurrent neural language modeling and image classification.

Published as a conference paper at ICLR 2020
DIFFERENTIALLY PRIVATE META-LEARNING
Jeffrey Li, Mikhail Khodak, Sebastian Caldas Carnegie Mellon University jw138cs cmu.
Ameet Talwalkar Cameegie Mellon University Determined Al
ABSTRACT
Parameter-transferr a well-known and versatile approach for meta-learning, with applications including few-shot learning. federated learning, and reinforcement learning. However, parameter-transfer algorithms often require sharing models that have been trained on the samples from specific tasks, thus leaving the lask-owners susceptible to breaches of privacy. We conduct the first formal study of privacy in this setting and formalize the notion of task-global differential privacy practical relaxation of more commonly studied threat models. We then propose a new differentially private algorithm for gradient-based parameter transfer that not only satisfies this privacy requirement but also retains provable transfer learning guarantees in convex settings. Empirically, we apply our analysis to the problems federated learning with personalization and few-shot classification, showing that allowing the relaxation task-globa privacy from the more commonly studied notion of local privacy leads to dramatically increased performance in recurrent neural language modeling and image classification.
INTRODUCTION
The field of meta-learning offers promising directions for improving the performance and adaptability of machine learning methods. At high level, the key assumption leveraged by these approaches is that the sharing of knowledge gained from individual learning tasks can help catalyze the learning of similar unseen tasks. However, the collaborative nature of this process, in which task-specific information must be sent to and used by a meta-learner, also introduces inherent data privacy risks.
In this work, we focus on popular and flexible meta-learning approach, parameter transfer via gradient-bast based meta-leane learning (GBML). This set of methods, which includes well-known algorithms such as MAML (Finn al. 2017) and Reptile (Nichol al. 2018), tries to learn common initialization ø over a set of tasks / t= I,..., T such that a high-performance model can be learned in only few gradient-steps on new tasks. Notably, information flows constantly between training tasks and the meta-learner as learning progresses; to make iterative updates, the meta-learne obtains feedback on the current by having task-specific models 0, trained with it.
Meanwhile, in many settings amenable to meta-learning, it is crucial to ensure that sensitive informa- tion in each task's dataset stays private. Examples of this include learning models for word prediction on cell phone data (McMahan et al.) 2018), clinical predictions using hospital records (Zhang et al. 2019). and fraud detectors for competing credit card companies (Stolfo al. 1997). In such cases, each data-owner can benefit from information learned from other tasks, but each also desires, or is legally required, to keep their raw data private. Thus, not sufficient to learn a well-performing di it is equally imperative to ensure that task's 's sensitive information is not obtainable by anyone clse.
While parameter transfer algorithms can move towards this goal by peforming task-specific opti- mization locally, thus preventing direct access to private data, this provision is far from fail-safe in terms of privacy. A wealth of work has shown in the single-task setting that it is possible for an adversary with only access to the model to learn detailed information about the training set, such as the presence or absence of specific records (Shokri et al. 2017) or the identities of sensitive features given other covariates (Fredrikson al. 2015). Furthermore, Carlini et al. (018) showed that deep

---

Published as a conference paper at ICLR 2020
neural networks effectively memorize user-unique training examples, which can be recovered even after only a single epoch of training. As such, in parameter-transtee methods, the meta- meta-learner or any downstream participant can potentially recover data from previous task.
However, despite these serious risks, privacy-preserving meta-learning has remained largely an unstudied problem. Our work aims address this issue by applying differential privacy (DP), well-established definition of privacy with rich theoretical guarantees and consistent empirical success at preventing leakages of data (Carlini et al., 2018 Fredrikson et al. 2015 Jayaraman and Evans 2019). Crucially, although there are various threat models and degrees of DP one could consider in the meta-learning setting (as we outline in Section 2). we balance the well-documented trade-off between privacy and model utility by formalizing and focusing on a setting that we call task global DP. This setting provides strong privacy guarantee for each task-owner that sharing 6g with the meta-learner will not reliably reveal anything about specific training examples to any downstream agent. It also allows to use the framework of Khodak et al. (2019a) to provide a DP GBML algorithm that enjoys provable learning guarantees in convex settings.
Finally, we show application of our work by drawing connections to federated learning (FL) LL ct al., 2019). While standard methods for FL, such as FedAvg (McMahan et al. 2017). have inspired many works also concerning DP in a multi-user setup (Agarwal et al.) 2018, Bhowmick et al. 2019 Geyer et al.) 2018: McMahan et al. 2018 Truex et al. 2019), we are the first to consider task-global DP as useful variation on standard DP settings. Moreover, these works fundamentally differ from ours in that they do not consider a task-based notion of learnability, instead focusing on the global federated learning problem to learn a single global model. That being said, federated setting involving per-user personalization (Chen et al., 2018 Smith et al., 2017) is a natural meta- veea-lcarnnng application.
More specifically, our main contributions are:
1. We are the first to provide taxonomy for the different notions of DP possible for meta-leamiig. In particular, we formalize on a variant we call lask-global DP, showing and arguing that it adds a useful option to commonly studied settings in terms of trading privacy and accuracy.
2. We propose the first DP GBML algorithm, which we construct to satisfy this privacy setting. Further, we show straightforward extension for obtaining a group DP version of our setting to protect multiple samples simultaneously.
3. While our privacy guarantees hold generally, we also prove lcarning- theoretic results in convex settings. Our learning guarantees scale with task task-similarity, measured by the closeness of the task-specific optimal parameters (Denevi et al. 2019; Khodak et al.] 2019b).
4. We show that algorithm, along with its theoretical guarantees, naturally carries over to federated learning with personalization. Compared to previous notions of privacy considered in works for DP federated learning (Agarwal et al. 2018,, Bhowmick al. 2019 Geyer et al., 2018 McMahan et al. 2018] Truex et 2011). we are, to the best of our knowledge, the first to simultaneously provide both privacy and learning guarantees.
5. Empirically, we demonstrate that our proposed privacy setting allows for strong performance on federated language-modeling and fhw-shot image classification tasks. For the former, we achieve close to the performance of non non- private models and significantly improve upon the performance of models trained with local-DP guarantees. a previously studied notion that also provides protections against the meta-learner. Our setting reasonably relaxes this latter notion but can achieve roughly 1.7-2.3 times the accuracy on a modified version of the Shakespeare dataset (Caldas et al,, 2018) and 1.6-1.7 times the accuracy a modified version of Wiki-3029 (Arora et al. (2019) across various privacy budgets. For significant benefits of meta-learning while applying task-global DP Omniglot (Lake et al. 2011) and Mini-ImageNet (Ravi and Larochelle 2017).
we show that we show that we can still retain
1.1 RELATED WORK
DP Algorithms in Federated Learning Settings. Works most similar to ours focus on providing DP for federated learning. Specifically,, Geyer et al. (2018) and McMahan et al. (2018) apply update clipping and the Gaussian Mechanism to achieve leerl global DP federated learning algorithms for language modeling and image classification tasks respectively. Their methods are shown to only suffer minor drops in accuracy compared to non-private training but they do not consider protections
2

---

Published as a conference paper at ICLR 2020
to inferences made by the meta-leamnrr. Alternatvely, Bhowmicc et al. (2019) does achieve such protection by applying a theoretically rate-optimal local DP mechanism on the f2 's users send to the meta-learner. However, they sidestep hard minimax rates (Duchi et al. 2018) by assuming the central server has limited side-information and allowing for a large privacy budget. In this work, though achieve relaxation of the privacy of Bhowwick al. (20T9), we do not restrict the adversary's power. Finally. Truex et al. (2019) does consider a setting that coincides with task-global DP, but they focus primarily on the added benefits of applying MPC (see below) rather than studying the merits of the setting in comparison to other potential settings.
Secure Multiparty Computation (MPC). MPC is a cryptographic technique that allows parties to calculate a function of their inputs while also maintaining the privacy of each individual inputs. In GBML,, sets of model updates may come in a batch from multiple tasks, and hence MPC can securely aggregate the batch before it is seen by the meta-learner. Though MPC itself gives no DP guarantees against future inference, it can combined with DP to increase privacy. This approach has been studied in the federated setting, e.g. by Agarwal et al. (2018). who apply MPC in the same difficult setting of Bhowmick et al. 2019), and Truex et al. 2019). who apply MPC similarly to a setting analogous to ours. On the other hand, MPC also comes with additional practical challenges such as peer-to-peer communication costs, drop outs, and vulnerability to collaborating participants. As such, combined with its applicability to multiple settings, including ours, consider MPC to be an orthogonal direction.
2 PRIVACY IN A META-LEARNING CONTEXT
In this section, we first formalize the meta-learning setting that we consider. We then describe the various threat models that arise in the GBML setup, before presenting the different DP notions that can be achieved. Finally, we highlight the specific model and type of DP that we analyze.
2.1 PARAMETER TRANSFER META-LEARNING
In parameter transfer meta-learning, we assume that there is set of learning tasks t = 1....,T, ,T, each with its corresponding disjoint training set D.- Each D, contains m, training examples {2+,5 ]= where each ,t, E X' x y. The goal within each task is to learn function Sa. XX' - 3 parameterized by 02 e C Rdd that performs "well," generally in the sense that it has low within-task population risk in the distributional setting. The meta-learner's goal is to learn an initialization & E Ô that leads to well-performing Ó within-task. In GBML this is learned via an iterative process that alternates between the following two steps: (1) within-task procedure where batch of lask-owners B receives the current e and each E uses Φ as an initialization for running a within-task optimization procedure, obtaining 0, (Dt, <); (2) meta-level procedure where the meta-leamnr receives these model updates heE and aggregates them to determine an updated é. Note that we do not assume
0, = 0,, as the updates shared for the meta-learning procedure can be obtained from different procedure than the refined model used for downstream within-task inference. This is especially the case when concerning the addition of noise for DP as part of the meta- procedure.
2.2 THREAT MODELS FOR GBML
As in any privacy endeavor, before discussing particular mechanisms, key specification must be made in terms of what threat model is being considered. In particular, it must be specified both (1) who the potential adversaries are and (2) what information needs to protected.
Potential adversaries. For single task-owner, adversaries may be either solely recipients of ø (i.e. other tosk-sw or recipients of either & or Og (i.e. also the meta-learner). In the latter case, consider only honest-but-curious meta-learner, who does not deviate from the agreed upon algorithm but may try to make inferences from 0,. In both cases, concern is placed not only about these other participants' intentions, but also their own security against access by malicious outsiders.
Data to be protected. A system can choose either to protect information contained in single records 21,i ine-at-a-time to protect entire datasets D, simultancously. This distinction between record-level and task-level privacy can be practically important. Multiple 21, within D, may reveal the same secret (e.g., cell-phone user has sent their SSN multiple times), the entire distribution
3

---

Published as a conference paper at ICLR 2020
What cata is protected which queries?
What would mean for mobile users?
What would this for hospitall?
(and thus D2) protected release of @
Global
Entire message history private to other userd but not server
Whole databese private other hospitals out not server
Meta-level
Query
(anand protected before ease. aiding in privatized (3
message history private to everyone else
private to everyone clsc
Local
Task- Global
7t. protected in release of
Individual messages private to everyone else
patient's private everyone else
Within-task
Query
Task-
protected before releasee aask-owwer, aiding privaized f),
indivicual message
Each patient's record is private to everybody, including their own hospital.
Local
is private to everybody, including the therseelve
Summary of the privacy protections guaranteed by local and global DP at the different levels the meta-learning problem (with our notion in blue). On the right, we show what each specification would mean in two practical federated scenarios: mobile users and hospital networks.
Figure 1:
of Dr could reveal sensitive information (e.g., user has sent all messages in a foreign language). In these cases, record-level privacy may not sufficient. However, given that privacy and utility are often at odds, we often seek the weakest notion of privacy needed in order to best preserve utility.
In related work, focus has primarily been placed on task-level protections. However, such approaches usually fall into two extremes, either obtaining strong learning but having to trust the meta-learner (McMahan et al. 2018 Geyer et al. 2018) or trusting nobody but also obtaining low performance try to bridge the gap between these threat models by considering a model that makes a relaxation from task-level to record-level privacy but retains protections for each task-owner against all other parties. This relaxation can be reasonably justified in practical situations, as while task-level guarantees are strictly stronger, they may also be unnecessary. In partieular, record-level guarantees likely be sufficient whenever single records each pertain to different individuals. For example, for hospitals, what we care about is providing privacy to the individual patients and aggregate hospital information. For cell-phones, if one can bound the number of texts that could reveal the same sensitive information, then a straightforward extension of our setting and methods, which protects up to k records simultaneously, could also be sufficient.
(Bhowmick et al. 2019). In response,
2.3 DIFFERENTIAL PRIVACY (DP) IN A SINGLE- LAGKE-TASK SETTING
In terms of actually achieving privacy guarantees for machine learning, a de-facto standard has been to apply DP, a provision which strongly limits what one can infer about the examples a given model was trained Assuming training set D = {z1,.... 2m J. two common types of DP are considered.
Differential Privacy (Global DP). A randomized mechanism M is (s, o)differrentiall private for all measurable S C RRnge(MM (M) and for all datasets D, D' that differ by at most one element:
P[M(D) 8] < eP((M(D') E S 8
If this holds for D, D' differing by at most & elements, then (e, 6) k- k-group DP is achieved.
Local Differential Privacy. A randomized mechanism M is (s, -llocaly differentially private if for any two possible training examples 2, X' y and measurable C X YY:
P([((=) E S] < TP(( E S E)+
Global DP guarantees the difficulty of inferring the presence of a specific record the training set by observing M(D). It assumes trusted aggregator running M gets direct access to D and privatizes the final output. Meanwhile, local DP assumes more strictly that the aggregator also cannot be trusted, thus requiring random mechanism to be applied individually each 2 before training. However. it generally results in worse model performance, suffering from hard minimax rates (Duchi et al. 2018).
4

---

Published as a conference paper at ICLR 2020
Table 1: Broad categorization of the DPP settings considered by work in meta-learning and notable past works in the federated setting. Note that by using de-centralized method for aggregation, Agarwal et al. (018)) can still protect against the meta-learner from making inferences on any individual 0, with what is only effectively a global DP mechanism.
Previous Work
Notion of DP
Privacy for
Privacy for Oz
McMahan et al. (2018)
Global
Task-level
Geyer et al. (2018)
Global
Task-level
Bhowmick ct al. (2019)
Local, Global
Task-level
Task-level
Agarwal al. 2018
Global + MPC
Task-level
Task-level
Truex et al. 2019)
Task-Global + MPC
Record-level
Record-level
Our work
Task-Global
Record-level
Record-level
2.4 DIFFERENTIAL PRIVACY FOR GBML SETTING
In meta-learning, there exists hierarchy of agents and statistical queries, so we cannot as simply define global and local DP. Here, both the meta-level sub-procedure, (0 - d, and the within- task aub-procedure, { ) Oz, can be considered individual queries and DP algorithm can implement either to be DP. Further, for each query, the procedure may be altered to satisfy either local DP or global DP. Thus, there are four fundamental options that follow from standard DP definitions.
(1) Global DP: Releasing e will at no point compromise information regarding any specific O,.
(2) Local DP: Additionally, each 8, is protected from being revealed to the meta-learner.
(3)
DP: Releasing 6g will no point compromise any specific 21, (4) Task-Local DP: Additionally, each 2,,; is protected from being revealed to task-owner.
To form analogies hinglettssk DP, the examples in the meta-level procedure the model updates and the aggregator is the meta-learner For the within-task procedure, the examples are actually the individual records and the aggregator is the task-owner. As such, (1) implemented by the meta- learner, (2) and (3) are implemented by the task-owner, and (4) is implemented by record-owners. By immunity to post-processing. the guarantees for (3) and (4) also automatically apply the release of any future iteration of ó, thus protecting against future task-swners as well. Mcanwhile, though (I) and (2) by definition protect the identities of individual 6,, they actually satisfy a task-level threat model by doing so. Intuitively. not being able to reliably infer anything about 0g implies that nothing can be inferred about the D, that was used to generate it.
Using the terminology we introduce in Section 2.4, previous works for DP in federated settings can be categorized as Table [ While these works do not assume multi-task setting, we can still naturally use the terms global/local and task- bonk-glbbalttss-lae global model (by the central server in the case without MPC) and user-specific updates (by users' devices) respectively.
to analogously refer to releasing the
3 DIFFERENTIALLY PRIVATE GRRAMETER-TRANSEEE
3.1 ALGORITHM
We now present our DP GBML method, which is written out in its online (regret) form in Algorithm Here, we observe that both within-task optimization and metaaoopimmzzatinn are done using some form of gradient descent. The key difference between this algorithm and traditional GBML is that since task-learners must send back privatized model updates, each now applies an DP gradient descent procedure to learn 6, when called. However, at meta-test time the task-learner will run a non-private descent algorithm to obtain the parameter ô used for inference, as this parameter may remain locally. To obtain learning- theoretic guarantees, use variant of Algorithm [ in which the DP algorithm is an SGD procedure (Bassily et al. 2009 Algorithm 1) that adds a properly scaled Gaussian noise vector each iteration.
5

---

Published as a conference paper at ICLR 2020
Algorithm 1: Online version of our (c, -eta---ae--e parameter-transfer algorithm.
Meta-learner picks first meta-initialization Φ1 E θ
for task t [2'] do
Meta-learner sends meta- iettainitiializaiinn Φe to task t. Task-leamnrr runs OGD starting from θt,1 = Φi on losses {fu:) to obtain d..
Task-learner runs (e, 8)-DP algorithm (noisy-SGD) on losses (61,) to get 0,.
Task-learner sends 0g to meta-learner.
Meta-learner constructs loss (2()) 1 2e112
Meta-learner updates meta-initialization Φe+1 using an OCO algorithm on ,1,...,. b.
Result:
Meta-initialization & = T Ei= dr to use on test tasks.
3.2 PRIVACY GUARANTEES
Algorithm 1) within each task. Therefore, this guarantees that the contribution of each task-owner, a 0g trained on their data, carries global DP guarantees with respect to the meta-learner. Additionally, since DP is preserved under post-processing, the release of any future calculation stemming from 0 also carries the same DP guarantee.
We run certified (e, (D version of SGD (Bassily et al. 2019
3.3 LEARNING GUARANTEES
Our learning result follows the setup of Baxter (2000), who formalized the LTL problem as using disk-distribution samples Pi...., Pr ~ Q from some meta- meta-distribution Q and samples indexed by i = 1,..., m from those tasks to improve performance when a new task P is sampled from and we draw m samples from it. In the setting of parameter-transfer meta-learning we are learning functions parameterized by real-valued vectors
C IRd, so our goal will follow that of Denev al. (2019) and Khodak et al. (2019b) in seeking bounds on the transfer-risk the distributional performance of a learned parameter on a new task from Q that improve with task similarity.
The specific task-similarity metric we consider is the average deviation of the risk-minimizing parameters of tasks sampled from the distribution Q are close together. This will be measured in-terms of the following quantity: V2 = minşsee &Ep..oll0p 2 for 0p E arg minge (p a risk-minimizer of task-distiibttion P. This quantity roughly the variance of risk-minimizing mask-parameten and is a standard quantifier of improvement due meta-learning (Denevi al.) 2019 Khodak et al. 2019b). For example, Denevi et al. (2019) show excess transfer-risk guarantees T
of the form O V Vm
when T tasks with samples are drawn from the distribution. This
guarantee ensures that as we see more tasks our transfer risk becomes roughly V/ym, which if the tasks are similar, i.e. V is small, implies that LTL improves over single-task learning.
In Algorithm 1. each user t obtains a within-tas parameter 0g by running (no--private) OGD on sequence of Tosses fr.,,...,f fi.m and averaging the iterates. The regret of this procedure, when averaged across the users, implies a bound on the expected excess transfer risk of new task from Q when running OGD from learned initialization bound this regret in terms of V; here we follow the Average Regret-Upper Bound Analysis (ARUBA) framework Khodak al. (2099)) and treat meta-update procedure itself optimizing a bound on the performance measure (regret) of each within-task algorithm. As OGD's regret depends the squared distance } _106 d:113 of the optimal parameter from the initialization di, with privacy concerns could simply update dh using 07 E arg mingge Di=1 (0) to
Clesa-Bianchi et al., 2004). Thus our goal is to
online algorithm
recover guarantees similar to those in Denevi et al. (2019) and Khodak et al. (2019b).
However, this approach requires sending 07 to the meta-learner which is not private; instead in
Algorithm I we send 0,, which is the output of noisy SGD. To apply ARUBA. we need an additional assumption that the losses satisfy the following quadratic growth (QG) property: for some a >> 0,
a 11e 0p 1p < (0) - (pp)) AOEA
(1)
2

---

Published as a conference paper at ICLR 2020
Here 0p is the risk minimizer of lp. This assumption, which Khodak et al. (2019a) shows is reasonable in settings such as logistic regression, amounts to a statistical non-degeneracy assumption on the parameter-speie space that parameters far away from the fisk-minimizer do not have low-risk. Note that assuming the population risk is QG is significantly weaker than assuming strong convexity of the empirical risk, which previous work (Finn et al. 2019) has assumed to hold for task losses but does not hold for applicable cases such as few-shot least-squares or logistic regression if the number of task-samples smaller than the data-dimension.
We are now able to state our main theoretical result, a proof of which is given in Appendix A The result follows from a bound on the task-averaged regret across all tasks of simple online meta- meta-learning procedure that treats the update 8, sent by each task as an approximation of the optimal parameter in hindsight 07. Since this parameter determines regret on that task, by reducing the meta- update procedure to OCO on this sequence of functions in manner similar to (Khodak et al. (019a), we are able to show a task-similarity -deeeddtt bound. Following this the statistical guarantee stems from a nested online-to-batch conversion, a standard procedure to convert low-regret online-learning algorithms to low-risk distribution- -earning algorithms (Cesa-Bianchi et al. 2004).
Theorem 3.1. Suppose smooth, I-bounded convex loss functions & θ - R over parameter space @ with diameter D for
distribution over task-distributions P over G-Liscchtz B-strongly-
8 556 min
ETIL
and let each P satisfy the quadratic growth property ( Suppose
2
2dlogg
the distribution P, of each task sampled ii.dd from Q and we run Algorithm 7 with the (e, DDP procedure of Bassily et al. (2019 Algorithm 1) to obtain 8₂ as the average iterate for the meta-upda reta-update step, using n 2 1 steps and learning rate बे for > O. Letting V mingge 2 }EEp~el07 there exist settings of n, 7 n,
&1 such that we have the following bound on the expected transfer risk when a new task P is sampled from 2, m samples are drawn i.i.d. from P, and we run OGD with learning rate n starting from d= + ΣT 6r and use the average 0 of the resulting iterates as the learned parameter:
(
V mm
aD
ddlog' 1
EE REEO PPONEP PROEEP
((0')
+
max
e2m² m
a
Here 8" is any element θ and the outer expectation is taken over le P. randomness of the within-task DP mechanism. Note that this procedure is (E.6)-DP.
Q and the
Theorem 3.I shows that one can usefully run a DP-algorithm as the within-tat method in meta- learning and still obtain improvement due to task-similarity. Specifically, the standard term of 1/Vm multiplied by V. which is small the tasks are related via the closeness of their risk minimizers. Thus use meta-learning to improve within-task performance relative single-task learning. We also obtain very fast convergence of (1/TT) in the number of tasks. However, we do gain some O(1/m) terms due to the quadratic growth approximation and the privacy mechanism. Note that the assumption that both the functions and its gradients Lipschitz-continunt are standard and required by the noisy SGD procedure of Bassily et al. (2019).
This theorem also gives relatively straightforward extension if the desire is to provide (s, 6)- group-DP. Since any privacy mechanism that provides (e, 8DDP also provides (kat ( DDP guarantees for groups of size Is (Dwork and Roth 2014), we immediately have the following corollary.
Corollary 3.1. Under the same assumptions and setting as Theorem 3.1 achieving (s, ()go)u DP possible with the same guarantee except replacing
1 dloog 2 with kdd kdd
log
For constant k. this allows learning rates. This is a useful result given that in some settings, it may be desired to simultaneously protect small groups of size l << my such as protecting entire families for hospital records.
enjoy the stronger guarantee while maintaining largely the same
4 EMPIRICAL RESULTS
We present results that show it is possible learn useful deep models in federated scenarios while still preserving privacy against all other participants. Specifically, we evaluate the performance of models that have been trained with task-global DP algorithm in comparison models that
7

---

Published as a conference paper at ICLR 2020
Sbakespeure 100 Arcurary (Neptlie)
20
Actunesfon
250
500
750
1000
1250
1300
1720
2000
Wikd-1600 Accurncy (Kepptile)
Astuneyyogp (8)
0
1000
2000 Cilents Seee
3000
4009
Task Global JP ie 22.5)
Tasl Global t 9.2)
Task Cook-Clobal DEtc 4,51 Locall DP (2 4.5)
Local DP (c 22.5)
Local DP 9
Non-Private
Figure Performance of different versions Reptile on a next-word word--redidiiioon task for two federated datasets. We report the test accuracy on unseen tasks and repeat each experiment 10 times. Solid lines correspond to means, colored bands indicate standard deviation, and dotted lines are for comparing final accuracies (private algorithms can only be trained until privacy budget is met).
have been trained both non-privately and with local DP algorithms. We evaluate performance on federated language modeling and few-shot image classification, applying practical batched variant of Algorithm
Datasets: We train a LSTM-RNN for next word prediction on two federated datasets: (1) The Shakespeare dataset preprocessed by (Caldas et al., 2018), and (2) dataset constructed from 3, 000 Wikipedia articles drawn from the Wiki-3029 dataset (Arora er al., 2019). where each article is used different task. For each dataset, we fixed number of tokens per task, discard tasks with fewer tokens than the specified, and discard samples from those tasks with more. We set the number of tokens per task 800 for Shakespeare and 600 for Wikipedia, divide tokens into sequences of length 10, and we refer to these modified datasets as Shakespeare-88 and Wiki-1600.
For few-shot image classification, we use the Omniglot (Lake al. 2011) and Mini Mini-ImageNer (Ravi and Larochelle] 2017) datasets, both with 5-shot-5-way test tasks. As has been done for non-private Reptile (Nichol et al. 2018), we use more training shots meta-training (trying m 10, 20, 30 for Omniglot and m 15, 30, 45 for Mini- Mini-ImageNett than meta-test time. Though tasks could be sampled indefinitely, we set a fixed budget tasks at T' 10t to reflect to a setting in which finite number of training tasks constrains our learning and privacy trade-off. For both local and task-global DP, the more tasks that can be grouped in a meta-batch means that less total noise can be added at each round. However, this also means fewer iterations be taken. We note that for the smallest values of m. this setting is enough for non-private training to essentially achieve the reported final accuracies from Nichol al. (2018).
Meta Learning Algorithm. We study the performance of our method when applied to the batched version of Reptile (Nichol et al. 2018) (which, in our setup, reduces to personalized Federated Averaging when the meta-learning rate is set to 1.0). For the language modelling tasks, tune various configurations of task batch size for all methods. We also allow for multiple visits per client, though at the cost of more added noise per iteration for the private methods. Additionally,
8

---

Published as a conference paper at ICLR 2020
Omnncclot
Conmalltt
Omasggot.
1.0
1.80
1.50
(:95
0/13-
0.35
0:30
6-8-
6.40
0.30
0.76
0.75
0.75
6070
00:0
686
0.5
0.3
060
0.30
Tacts Siew
Theie Siane
Toelk Stenn
0.75
Mun--naageNee. m 15
6.75
Kmn-laageNet, m
0.75
Ming Lmngeeee,, 211
6.73-
6.6-
0.70
665
0.55
648
660
0.50
0.35
0.30
032
b.30
0.30
0.4
14b
845
6.42
140
840
0:3
6:35
0.35
6:3
20020
90001
IDM03
33:01
10000
20000
12003
10tted
0.30
20000
400m0
30000
100000
Non-Private
Task-Global DP (E 9.5)
No Meta-Learning
Figure 3: Performance of task-global DP Reptile on 5-shot-5-way Omniglot and Net 10 sampled test- tasks were used for evaluation and experiments were repeated 3 times. We do not show line for Local DP since all hyperparameter settings tried for Local DP resulted in worse performance than the "No Meta-Learning" baseline, whose performance can always be recovered.
for language modeling, we implement gradient clipping and exponential decay on the meta learning rate. For Omniglot and Mini-ImageNet, we use largely the same parameters as Nichol et al. (2018) but we tune the parameters most directly related to privacy: the Le clipping threshold, the Adam Learning Rate at meta-training time, the meta-batch size, and the within-task batch size. We defer more complete discussion of hyperparameter tuning to Appendix B
Privacy Considerations. For the task-global DP models, set 5 10 3 M. by convention on each task and we implement DP-SGD (for language modelling) and DP-Adam (for image- classification) within-task using the tools provided by TensorFlow Privacy using the RDP accountant to track our privacy budgets. Although these algorithms differ from the one presented in Section they still let us realistically explore the efficacy of considering task task-global privacy. For the language modeling datasets, we try three different privacy budgets (as determined relative to each other by successively doubling the amount of noise added when the goal to take full gradient step per task) and make sure that all training tasks are sampled without replacement with fixed batch size until all are seen. This is necessary since multiple visits to a single client results in degradation of the privacy guarantee for that client. We instead aim to provide the same guarantee for each client. For local-DP, though this notion of DP is stronger, we explore the same privacy budgets so as to obtain guarantees that are of the same confidence. Here, we essentially run the DP De-FedAvg algorithm from (McMahan et al., 2018) with some key changes. First, to get local DP instead of global, we add Gaussian noise each clipped set of model updates before returning them to the central server instead of after aggregation. Second, while additional gradient steps within-task do not increase the amount of noise required, we do again iterate through tasks without replacement. Unlike for global DP, we cannot hope to have any privacy boosts due to sub-sampling if the meta-learner knows who it communicating with.
Results. Figure 2 shows the performance of both the non-private and task-globul private versions of Reptile (Nichol et al. 2018 for the language modelling tasks across three different privacy budgets. As expected, neither private algorithm reaches the same accuracy of the non-private version of the algorithm. Nonetheless, the fask-global version still comes within 78%, 88%, and 92% of the non- private accuracy for Shakespeare-80N and within 72%, 82%, and 83% for Wiki- 1600. Meanwhile

---

Published as a conference paper at ICLR 2020
achieving local DP results in only about 55% and 50% of the non-private accuracy both datasets for the most generous privacy budget. In practice, these differences can be toggled by further changing the privacy budget continuing trade off more training iterations for larger noise multipliers.
We display results for few-shot image classification on Omniglot and Mini-ImageNer in Figure 3 In this setting, nor applying meta-learning results in meta-test accuracies of around 62% and 36%, respectively. Thus, while performance indeed lower than non-private learning, applying task-global DP does result meta-learning benefits for test-time tasks. In settings where privacy a concern, this increase in performance is still significantly advantageous for the "lask-owners" test-time tasks (who hold less data). On average, they are able obtain better models and are still guaranteed privacy at a single-digit Intuitively, larger training- tuining-task task datasets make it casier to apply privacy within-task, and in accordance with our learning guarantees, adding training shots indeed closes the gap in performance between task-global DP Reptile and non-private Reptile. In comparison, applying local-DP for similar hyperparameter range consistently decreases performance at test-time. However, the no-meta-learning baseline is a theoretical lower bound for local-DP, as could set the clipping threshold or meta-learning rate close to to recover the effects of no meta-learning.
CONCLUSIONS
In this work, we have outlined and studied the issue of privacy in the context of meta-learning. Focusing on the class of gradient-based parameter-transfer methods, we used differential privacy to address the privacy risks posed to task-owners by sharing task-specific models with a central meta-learner. To do so, we formalized and considered the notion of task- alsk-globll differential privacy, which guarantees that individual examples from the tasks are protected from all downstream agents (and particularly the meta meta-leamerr). Working in this privacy model, we developed differentially private algorithm that guarantees both this protection as well as learning-theoretie results in the convex setting. Finally, demonstrate how this notion of privacy can translate into useful deep learning models for non-convex language modelling and maseeccassiffictionn tasks.
ACKNOWLEDGMENTS
This work was supported in part by DARPA FA875017C0141, the National Science Foundation grants I1S1618714, IIS170512,, and IIS1838017, Okawa Grant, Google Faculty Award, an Amazon Web Services Award, a JP Morgan A.I. Research Faculty Award, and a Carnegie Bosch Institute Research Award. Any opinions. findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of DARPA, the National Science Foundation, or any other funding agency.
REFERENCES
Naman Agarwal, Ananda Theertha Suresh, Felix Xinnan X Yu, Sanjiv Kumar, and Brendan McMahan. cpsgd: Communication--ffionl and differentially-priin private distributed sgd. In Advances in Neural Information Processing Systems 31, pages 7564-7575, Curran Associates, Inc., 2018
Sanjeev Arora, Hrishikesh Khandeparkar, Mikhail Khodak, Nikunj Saunshi, and Orestis Plevrakis. A theoretical analysis of contrastive unsupervised representation learning. In Proceedings of the 36th International Conference on Machine Learning, 2019.
Raef Bassily, Vitaly Feldman, Kunal Talwar, and Abhradeep Thakurta. Private stochastic convex op- timization with optimal rates. arXiv, 2019. URLhttpa arwaiaiiiiv......
peattss:/arxiv.oz000 wwtpaaiwww.....aaaaaa/aaaaeeeeee 09970
Jonathan Baxter. A model of inductive bias learning. Journal of Artificial Intelligence Research, 12: 149-198, 2000.
Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers. Protection against reconstruction and its applications in private federated learning, 2019. https: //arxivv brg//bs//8112_ 00984
10

---

Published as a conference paper at ICLR 2020
Sebastian Caldas, Peter Wu, Tian Li, Jakub Konecný, H. Brendan McMahan, Virginia Smith, and Ameet Talwalkar. LEAF: A benchmark for federated settings, 2018. URL http:://ak
org/abs/18122 1ttp/1812..0 01097
Nicholas Carlini, Chang Liu, Jernjj Kos, Úlfar Erlingsson, and Dawn Song. The secret sharer:
Measuring unintended neural network memorization & extracting secrets, 2018. URL http/
/1802 08232
Nicoló Cesa- Desa-Bianchi, Alex Conconi, and Claudio Gentile. On the generalization ability of on-line learning algorithms. IEEE Transactions Information Theory, 50(9):2050-20000 2004.
Fei Chen, Zhenhua Dong, Zhenguo Li, and Xiuqiang He. Federated meta-lcaming for recommenda- tion. CoRR, abs/1802.07876 2018.
Giulia Denevi, Carlo Ciliberto, Riccardo Grazzi, and Massimiliano Pontil. Leaming-to-lcam stochas tic gradient descent with biased regularization, 2019. URL http://:///axx.vvor/////////////
10399
John Duchi, Martin Wainwright, and Michael Jordan. Minimax optimal procedures for locally private estimation. In Journal of the American Statistical Association. 2018.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3&4):211-407 2014. doi: 10. 10/450/00400000042.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Mgdel-agmostic meta-learning for fast adaptation of deep networks. Proceedings of the 34th International Conference on Machine Learning, 2017.
Chelsea Finn, Aravind Rajeswaran, Sham M. Kakade, and Sergey Levine, Online meta-learning. In Proceedings of the 36th International Conference Machine Learning, 2019.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322-1333 1333, 2015.
Robin C. Geyer, Tassilo J. Klein, and Moin Nabi. Differentially private federated learning: A client level perspective, 2018. URL
net http://eeeeooommmm11Saaata11111.
Bargav Jayaraman and David Evans. When relaxations go bad: "differentially-privaee machine learning, 2019, URL http: //atpi//arxiv.. wttg///bs///2.0003377777
Mikhail Khodak, Maria-Florina Balcan, and Ameet Talwalkar. Provable guarantees for gradient-based meta-learning In Proceedings of the 36th International Conference on Machine Learning, 2019a.
Mikhail Khodak, Maria-Florina Balcan, and Ameet Talwalkar. Adaptive gradient-based meta-learning methods. In Advances in Neural Information Processing Systems, 2019b. To Appear.
Brenden M. Lake, Ruslan Salakhutdinov, Jason Gross, and Joshua B. Tenenbaum. One shot learning of simple visual concepts. In CogSci, 2011.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions, 2019.
www..ivworg//b/////e.../ 07873
H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication--fficcen learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, pages 1273-1282, 2017.
H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private language models. In ICLR, 2018.
Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-leaminng algorithms. CoRR, Abs/1803.0299/ 2018. URL/tts:://arxix http://awwivvoor///////////// 02999
abs
Sachin Ravi and Hugo Larochelle. Optimization as a model for few-shot learning. In Proceedings of the 5th International Conference Learning Representations, 2017.

---

Published as a conference paper at ICLR 2020
Shai Shalev-Shwartz and Shai Ben-David. Understanding Machine Learning: From Theory to Algorithms. Cambridge University Press, 2014.
Reza Shokri, Marco Stronati, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In Proceedings of 2017 IEEE Symposium on Security and Privacy, pages 3-18, 2017.
Virginia Smith, Chao-Kai Chiang. Maziar Sanjabi, and Ameet Talwalkar. Federated multi-task learning. Advances in Neural Information Processing Systems 31, 2017.
Salvatore J. Stolfo, David W. Fan, Wenke Lee, Andreas L. Prodromidis, and Philip K. Chan. Credit card fraud detection using meta-learning: Issues and initial results 1. In Working notes of AAAI Workshop on Al Approaches to Fraud Detection and Risk Management, 1997.
Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, and Rui Zhang, A hybrid approach to savacc-preserving federated learning, 2019. URL http://///// //tp///axvvvv.aaa///a//eaaeaaaia org/ abs 1812 03224
Xi Sheryl Zhang, Fengyi Tang. Hiroko Dodge, Jiayu Zhou, and Fei Wang. Metapred: Meta- learning for clinical risk prediction with limited patient electronic health records, 2019. URL. https: sttps://arxiv: org abg/ 1905. 03218
12

---

Published as a conference paper at ICLR 2020
A PROOFS OF LEARNING GUARANTEES
Setting A.1. We assume that at each time-step t. an adversary chooses a task-distribution Ps over loss-finctions θ Rd and samples m loss functions l,, for E [m]. At each time-step the task- learner receives a parameter tr from the meta-learner, runs online gradient descent with step-size > 0 starting from 6t. and uses the average iterate 0g as its learned parameter. The task-learner also runs Algorithm of Bassily et al. (2.11) for min
32d steps with learning rate T 0 on these loss functions and sends the result 0, to the meta-learnen. The meta-leane leea-learrer G
m 8
e2m²
updates Φ1+1 = (1 1/t)o: Be/t. We assume all loss functions are G-Lipschitz w.r.t. |l ll2 and B-strongly-smooth w.r.f. || 12 for some B G min 2 2d where D is the diameter of
O. For each distribution Pt les (()) = Eenp, (0) be its population risk, Em (0) be its empirical risk, and 07 E arg mingge (() be the closest population risk minimizer to O-.
Lemma A.1. In Setting A.7 we have
V dolog 2/
110 0, +7) max
1
(C,(O.) (x(0)) s 5G
m
Proof. Similarly to Lemma 3.3 in Bassily et al. (2019), applying standard OGD analysis (e.g. Lemmas 14.1 and 14.9 of SSWhaler-Swwartz and Ben David 2014)) to noisy gradient vectors and taking expectations yields
| 0/13
G2 +
E (((0))-((00))) <
+ no?d
21mn
2
where n is the number of steps in noisy SGD and o² is the variance of the noise added at each step.
As in the proof of Theorem 3.2 Bassily et al. (2019), substituting 0² 8nGa log and applying
m2g
the stability result in Lemma 3.4 of the same paper ylelds
0= 27m
0
G2
16nd log à
G2
(&. (0,)
+1)
2
m2g2
m
Substituting = min
m 32d log $
and
GVū yields the result.
13

---

Published as a conference paper at ICLR 2020
Lemma A.2. In Setting
A.1
fix some 6* θ and define V = E/=1 B B1 07.12.
Then for
120G y
max dlog i
we have
a
em
m
T
D² + log T) 2V2T
7200G²
d 1 c2m
max
27m
27m
a²m
Proof. We first bound the left-hand side without denominator as
T
E
0r
0/ 2
T
E
10: 00112 + 100 - 0,11
t=1
< <D²(1 log T + 2
|10" 0.11 10: - -2
t=1
S <D + log T') 2E
2|1Ø"
0/ 3100 0e113
T
[[[++log +1 logT) + 4V
+ 6E
10 - 0711
12 T
< <D +
E (0,) - Ee(
1=1
60G
V dlog
|1
0, ?
s D2 + log T) +
2V
max
Σ
E
+ +7)
Em
v m
where in the last step we applied Lemma
A.1
Substituting 7
120G max
Vdlog
yields
cm
14400G 2T
dlog 1/
1
E Σ ف 0, D2 + log T)
T
a
m?m²
The result follows by dividing by 21pm.
14

---

Published as a conference paper at ICLR 2020
Theorem A.1. In Setting A.1 suppose all distributions Pt were drawn i..d. from some meta- distribution Q and we used
120G max
Vdlog
G Suppose we draw another task-
distribution p Q with population risk Ep and minimizer Op, set & E' de, and run OGD with learning rate V satisfies
starting from & on m samples from P. Then the average iterate
T
7GV
7201G
dllog 1
aGD2
S
max
(1 + log T)
2 m
a
e2m² m
2T
for V2 = mingge Ep-g maxop 1|
0p 1
Proof. Applying online-to-batell conversion (e.g. Proposition A.1 in Khodak et (2019b) twice and substituting Lemma A.2 yields
(((p(0)-(p(0")
|1
E
n/
21pm
100- - 0
T
E
+ G/
E 11bbe 07112
2mm
2mmT
|0
0
D2 1+log
+ 4EV2
7200G2
d 1 e2m? m
S
+ G1
+
max
2mm
20ym
a²mm
5V2
7200G
[dlog 1 e2m
D
max
(1 + log
2pm
a²mm
m
2mm
V+ avm G/m
where we have applied E EV2
V2 Substituting
yields the result.
15

---

Published as a conference paper at ICLR 2020
B EXPERIMENT DETAILS
Datasets: We train a next word predictor for two federated datasets: (1) The Shakespeare dataset as preprocessed by (Caldas et al. 2018), and (2) a dataset constructed from Wikipedia articles, where each article is used as a different task. For each dataset, we set a fixed number of tokens per task, discard tasks with less tokens than the specified, and discard samples from those tasks with more. For Shakespeare, we set the number of tokens per task to 800 tokens, leaving 279 tasks for meta- cettittrainigg 31 for meta-validation, and 35 for meta-testing. For Wikipedia, we set the number of tokens to 1, 600, which corresponds to having 2, 179 tasks for meta-training, 243 for meta-validation, and 606 for meta-testing. For the meta-validation and meta-test tasks, 75% of the tokens are used for local training. and the remaining 25% for local testing.
For the few-shot image classification experiments, we follow the standard set-up by splitting labels into training and testing and forming training tasks by randomly drawing labels from the training set. At evaluation time, we draw from the test set.
Model Structure: Our model first maps each token to embedding of dimension 200 before passing it through an LSTM of two layers of 200 units each. The LSTM emits an output embedding, which is scored against all items of the vocabulary via dot product followed by a softmax. We build the vocabulary from the tokens in the meta-trane meta-training set and fix its length to 10, 000. We use sequence length of 10 for the LSTM and, just as (McMahan et al.) 2018), we evaluate using AccuracyTop (i.e., we only consider the predicted word to which the model assigned the highest probability) and consider all predictions of the unknown token as incorrect. For Omniglot and Mini- ImageNet, we use the architectures from Nichol et al. (2018) to also match the ones from Finn et al. (2017). We evaluate in the standard transductive setting.
Hyperparameters: For the Lunguage-modeling experiments, we tune the hyperparameters on the set of meta-validation tasks. For both datasets and all versions of the meta-learning algorithm, we tune hyperparameters in a two step process. We first tune all the parameters that are not related to refinement: the meta learning rate, the local (within-task) meta-training learning rate, the maximum gradient norm, and the decay constant. Then, we use the configuration with the best accuracy pre-refinement and then tune the refinement parameters: the refine learning rate, refine batch size, and refine epochs.
All other hyperparameters are kept fixed for the sake of comparison: full batch steps were taken on within-task data, with the maximum number of microbatches used for the task-global DP model. The parameter search spaces from which we sample are given in Tables 2 3 while Tables and and 6 contain our final choices. Note that the space for Local DP, especially in terms of the clipping threshold, is distinctively different from the others, as we did not find that searching through ranges similar to those for non-private and task-global DP led to learning high-quality meta-initializztionn.
For Omniglot, largely based hyperparameters 5-way classification. We vary m, the number of training shots, but we continue to take 5 SGD steps of expected size within task and we leave the test-time SGD procedure exactly the same. However, we do tune for privacy clipping thresholds {0.01, 0. 020, 0.05, 0.1, 0.2, 0.3, 0.4, 0.5), Adam Learning Rates for meta-training tasks (10-1, 5 x 10 10-1, 10-3 5 x 10-3), and meta-batch sizes of (5, 15, 25, 50}.
the choices of Nichol et al. (2018) for
For Mini-ImageNet, we perform a similar search except we also double the inner batch size to 2m (trading off less privacy amplification due to subsampling). We continue to tune for privacy clipping thresholds {0.01, 0.025, 0.05, 0.1, 0.3, 0.5, 0.7, 0.9, 1.1, 1.3, 1.5). Adam Learning Rates {10 4 *, x 10 4.10 10-355 10 -3. and math- sizes of (5, 15, 503
16

---

Published as a conference paper at ICLR 2020
Table Hyperparameter Search Space for Non-Private Training
Shakespeare-800
Wiki-1600
Visits Per Task
{1, 3, 4, 6,8,7,8.9) {5, 10}
(1,2.3)
Tasks Per Round
(5, 10)
Within-Tase Steps
(,, 7,97
(1,3,5,7.9)
Meta LR
{1, 2, 4, 8,
v2, 2, 2,2 4,2,
Meta Decay Rate
{0, 0,000001, 0.005, 0.01, 0.025, 0.05, 0.1)
(0,0.001, 0.005, 0.01, 0.025, 0.05)
Within-Task LR
2,,22,,,222,,44422 0.,,,,,,,,,
(1, 2, {0.3, 0.5, 0,
T/ Clipping
Refine LR
(0.1, 0.15, 0.3, 0.7,0.7.0.8 {10, 20, 30, 60} 2
{0.1, (0.1, 0.3. 0.7.0.7.0.8. {10, 20, 30, 60, 120) (1,2,3)
Refine Batch Size
Refine Epochs
Table 3: Hyperparameter Search Space for Task-Global DP Training
Shakexpeare-800
Wiki-1600
Visits Per Task
{1, 2, {5, 10}
[1
Tasks Per Round
{5, 10}
Within-Task Steps
1
Meta LR
4. 4
2.
Meta Decay Rate
{0, (0,0.001, 0.005, 0.01 0.025, 0.05, 0.1]
(0,0.001, 0.01 0.0,0,,,0000., 0.025, 0.05)
Within-Tass LR
{1, 2.242,2222444422.8 (0.4, 0.5, 0.6, 0.7,0,,,,
{1, {0.3, 0.5, 0.6,
4v
L2 Clipping
Refine LR
(0.1, 0.15, 0.3, 0,3,0, {10, 30,
0. 0.3, 0.5,, 0,,7 {10, 20, 30, 60, 120) {1,2,3)
Refine Batch Size
Refine Epochs
[1,2,3}
Table 4: Hyperparameter Search Space for Local-DP Training
Shakespeare-800
Wiki-1600
Visits Per Task
(1,2,3)
(1,2)
Tasks Per Round
{5, 10, 20}
{10, 20, 80)
Within-Task Steps
{1, 23
{1, 2,33
Meta LR
{1, 2,, 2 2 4, 4,4,
{1, /2, 2,, 4,42,,,,444,,,,,88,,,,
Meta Decay Rate
(0, 0.001, 0.005, 0.01, 0.025, 0.05,,0.1
(0,0.001, 0.005, 0.01, 0.025, 0.05)
Within-Task LR
{1, 2v,,4422,, {0.005, 0.01, 0.025, 0.05, 0.2,0,,0
4, {1, 2,,222,,,,442,,
Le Clipping
(0.005, 0.01, 0.025, 0.1,,0.1,0.22
Refine LR
(0.1, 0.15, 0.3, 0.5, 0.7,0.8) (10, 20, 30, 60) (1, 2,3)
0..1, 0.3. 0.5, 0.8) {10, 20, 30, 60, 120) (1,2,3)
Refine Batch Size
Refine Epochs
17

---

Published as a conference paper at ICLR 2020
Table 5: Final Hyperparameters for Shakespeare-S00
Non- private
T-G
T-G
T-G
Local
Local
Local 4.5
22.5
= 9.2
= 4.5
22.5
9.2
Visits Per Task
2
2
Tasks Per Round
5
5
5
20
5
20
Within-Task Task Steps
5
4
Meta LR
8/2
8v2
4
4v2
Meta Decay Rate
0.01
0.01
0.01
0.05
0.1
0
Within-Task LR
2
2v2
2
4v2
4v2
L2 Clipping
0.5
0.6
0.5
0.1
0.01
0.01
Refine LR
0.15
0.5
0.1
0.3
0.8
0.8
0.5
Refine Batch Size
30
10
60
10
Refine Epochs
1
1
1
3
3
Table 6: Final Hyperparameters for Wiki-800
Non- private
T-G
T-G
T-G
Local
Local = 9.2
Local
22.5
== 9.2
= 4.5
22.5
4.5
Visits Per Task
2
Tasks Per Round
5
10
10
20
20
20
20
Within-Task Steps
3
2
Meta LR
2
2/2
8
4
Meta Decay Rate
0.001
0
0.001
0.005
0.005
0.025
Within-Task LR
2
8
4
8
2
2/2
2
L2 Clipping
0.8
0.7
0.025
0.05
0.005
Refine LR
0.1
0.8
0.5
0.7
0.8
0.8
0.8
Refine Batch Size
60
10
10
10
Refine Epochs
1
2
2
2
2
2
18


Reviews:
[{"review_id": "rkeUYdN7iB", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper considers the problem of achieving formal privacy guarantees in the context of parameter-sharing meta learning. This is a problem that has been studied recently, although generally not under the exact record-level task-privacy model studied in this paper (what they call global task privacy). The problem is well-motivated: since in meta learning we want to leverage information from similar tasks to increate data efficiency, there may be privacy concerns for each of the task owners about both other task owners and the aggregator (meta-learner). \n\n\nTheir approach is conceptually simple; they use standard private stochastic gradient descent within each task to provide task level privacy. In combination with post-processing and composition guarantees this gives privacy for the overall mechanism. They are able to show theoretical guarantees via the standard accuracy guarantees of private SGD and no-regret\nguarantees of OCO. They show a bound on the expected transfer risk:  \nO(V/sqrt(m) + 1/Tsqrt(m)) + o(1/sqrt(m)) which is close to the non-private bound from Denevi (2019).\n\nThey evaluate the empirical performance of these models via a transfer learning setting  where they are training a deep RNN for next word prediction on two large corpi, and the tasks correspond to individual articles. They show that the private variate of Reptile is competitive with the non-private variant in these settings. \nA few comments \n-\tIt is odd to just fix epsilon = 9.2 instead of showing a Pareto curve. Why this particular value?\n-\tSimpler (convex) experiments to illustrate the theoretical guarantees would improve the paper\n\nOverall I like the motivation and the theory results are solid, if not a bit obvious. However, due to the lack of novelty in any of the applied techniques, and the fact that the experiments could be expanded, I recommend a weak accept. ", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "Byg8MiRp9H", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "As a non-expert in differential privacy, my review is based on my educated guess and limited understanding of the paper.\n\nThis paper considers a the differential privacy problem regarding the parameter-tranfer algorihtm in meta-learning, such as MAML and Repile. To me, the setting is very interesting and according to the paper, it seems that it is the first formalization for this setting. Since meta-learning is becoming more and more popular, the paper possesses practical values for privacy-preseving meta-learning algorithms.\n\nThe proposed differential privacy seetings are well illustrated and presented in the paper. The differentially private parameter-transfer is also straightforward but has been twisted a little bit for theoretical guarantees. The theoretical results seem pretty reasonable to me, but I have not checked the proof in detail.\n\nThe experiments demonstrate the effectiveness of the proposed differentially private parameter-transfer. However, the experiments are also very toy-ish in some senses, which reduces the the pritical values. All the datasets the paper uses are very easy ones. It is highly recommended to perform experiments on more challenging meta-learning datasets, such as Mini-ImageNet, CUB, etc. See [A Closer Look at Few-shot Classification, ICLR 2019] as an example for conducting few-shot learning experiments.", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I did not assess the derivations or theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper."}, "extra_text": {}}, {"review_id": "B1gikEDpFH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes the notions of different privacy levels for different attack models, namely global and local meta-level and within-task level privacy for meta-learning. It proposes an algorithm for global within-task privacy. It provides privacy and utility guarantee of the proposed algorithm and experimental evaluations.\n\nThe proposed definitions make sense to me for the scenarios mentioned in the paper. The utility guarantee also seems interesting. I’m a little concerned with the significance and novelty of the proposed algorithm (it seems like a direct application of a generic DPSGD algorithm) and the utility analysis. Maybe you can justify more on that part. I think the experimental evaluation can be made more complete, for example, you may consider:\n- a convex setting as was considered in the utility guarantee,\n- varying epsilon values. I think a utility vs. epsilon curve can better support your paper.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: Thanks to the authors for the submission. This paper studies differentially private meta-learning, where the algorithm needs to use information across several learning tasks to protect the privacy of the data set from each task. The reviewers agree that this is a natural problem and the paper presents a solution that is essentially an adoption of differentially private SGD. There are several places the paper can improve. For the experimental evaluation, the authors should include a wider range of epsilon values in order to investigate the accuracy-privacy trade-off. The authors should also consider expanding the existing experiments with other datasets. 
Decision: Accept (Poster)