SELF-SUPERVISED PRETRAINING FOR DIFFERENTIALLY PRIVATE LEARNING
Authors: Arash Asadian
Evan Weidner
Lei Jiang
Venue: Submitted to ICLR 2023 (2023)
Keywords: differential privacy
contrastive learning
learned features
one image

Abstract: We demonstrate self-supervised pretraining (SSP) is a scalable solution to deep learning with differential privacy (DP) regardless of the size of available public datasets in image classification. When facing the lack of public datasets, we show the features generated by SSP on only one single image enable a private classifier to obtain a much better utility than the non-learned handcrafted features under the same privacy budget. When a moderate or large size public dataset is available, the features produced by SSP greatly outperform the features trained with labels on various complex private datasets under the same private budget. We also compared multiple DP-enabled training frameworks to train a private classifier on the features generated by SSP.

Under review as a conference paper at ICLR 2023
SELF-SUPERVISED PRETRAINING FOR DIFFERENTIALLY PRIVATE LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
We demonstrate supervvie pretraining (SSP) is scalable solution to deep learning with differential privacy (DP) regardless of the size of available public datasets in image classification. When facing the lack of public datasets, we show the features generated by SSP on only one single image enable a private classifier to obtain much better utility than the non-learned handcrafted features under the same privacy budget. When a moderate or large size public dataset is available, the features produced by SSP greatly outperform the features trained with labels on various complex private datasets under the same private budget. We also com- pared multiple DP-enabled training frameworks to train private classifier the features generated by SSP.
INTRODUCTION
Machine learning (ML) has been applied ubiquitously in the analysis of sensitive data such as med-
ical images (Tajbakhsh et al. 2016). financial records (Fischer & Krauss 2018), social media
channels (Agrawal & Awekar 2018). Many attacks (Shokri et al.] 2017] Carlini et al. 2021) are developed to successfully extract meaningful training data out of standard ML models. According
to recent governmental regulations, e.g., GDPR and CCPA, ML models have to protect sensitive
training data. Differential privacy (DP) (Chaudhuri al. 201 I Bu al. 2020 Abadi et al. 2016)
has emerged as an effective framework to train models resilient to private training data leakage.
Unfortunately, training models with strong DP guarantees significantly hurts the model utility (i.e.. accuracy) (Papernot et al.) 20188 Abadi et al. (016). Although non-lcarned handcrafted fea- tures such as ScatterNet (Oyallon Mallat] 2015 Oyallon et af., 2018) make a private linear model (Tramer & Boneh 2021 achieve the state-of-the-art (SOTA) utility of < 70% under the privacy budget of (c S 3,8 10-9) on a private CIFAR-10 dataset, it is difficult to learn better features in the DP domain, since the clipped and perturbed gradients during DP training provide only a noisy estimate of the update direction. tures learned from large public labeled (Luo et al. 202I) datasets can greatly mitigate the utility gap between private and non- non-private models. However, sometimes there is no available public dataset for training& feature extractor due to legal causes ethical issues (Flanders) 2009)_
contrast, it is straightforward that pretrained fea-
In this paper, we aim to demonstrate that self-supervised pretraining (SSP) is a scalable solution improving the utility of deep learning with DP regardless of the size of available public datasets in image classification. Any updates on the learnable parameters of a differentially private model increase privacy overhead. It is easier achieve both high utility and small privacy loss via the features generated by a well-trained feature extractor that can fully take advantage of SOTA net- work architectures and public datasets. Even when no large public dataset is available, we show a feature extractor built upon data- HarmonicNet (Ulieny et al. 2019) and trained by self- supervised SimCIRv2 (Chen et al. 2020) on only one single image (YM. et al., (2200) can make a private linear classifier obtain much better utility than the non-learned handcrafted features (Tramer) & Bonch 202I) under the same privacy budget. With a larger public dataset, the features generated by SSP substantially outperform the features trained with labels on various complex private datasets, as shown in T To better explore the trade-off between utility and privacy. we compared SOTA en-eledled training frameworks, i.e., DP stochastic gradient descent (DPSGD) (Abadi al. 2016), DP direct feedback alignment (DPDFA) (Ohana et al. 2021; Lee & Kifer (020). DP stochastic gradient Langevin dynamics (DPSGLD) (Bu et al. 2021 and Private Aggregation of Teacher En-

---

Under review as a conference paper at ICLR 2023
Table 1: The utility and privacy comparison private CIFARIO dataset. DP-SOTA-I: Tramer &
Boneh 2021) and DP-SOTA-2; Luo et al. (00T..
Public Dataset
Scheme
c-DP
Network
Training
Accuracy (%)
None
DP-SOTA-1
3
Scat CNN
DPSGD
66.
image
Ours
3
HarmRN18
DPSGD
66.3
labeled CIFARIO0
DP-SOTA-2
1.5
ResNet18
DPSGD
71'
unlabeled CIFARIO0
Ours
1.5
ResNet18
DPSGD
75.5²
DP-SOTA-1
2
ResNet50
DPSGD
92.7
unlabeled ImageNet
Ours
2
ResNet50
DPDFA
94.9
sembles (PATE) Papernot et al. 2018), when training a private classifier on the features produced by SSP. Private datasets having different learning distances from the public dataset favor different training frameworks under different privacy budgets. Our contributions are summarized as:
When facing the lack of public datasets, adopt HarmonicNet the backbone of SimCLRv2 to learn only one image. The features extracted by the HarmonicNet greatly outperform the non- learned handcrafted ScatterNet features various private datasets by 0.6% on CIFARIO, 1.4% on CIFARI00, 100, 6.7% on CropDiseases, 49.7% on EuroSAT, and 3.5% on ISIC2018, when e 2.
When there is moderate or large size public dataset, the features produced by SSP improve the utility of these private complex datasets over the features trained with labels by 0.5% ~ 8.6% under the privacy budget of 2.
We compared SOTA DP-enabled training frameworks, i.e., DPSGD, DPDFA, DPSGLD, and PATE, to train private classifier on the features produced by SSP. Compared to DPSGD, DPS- GLD obtains better utility on private datasets when e S 1. DPDFA achieves a higher utility than DPSGD on private datasets with a smaller learning distance from the public dataset when > 0.5.
BACKGROUND
2.1
DIFFERENTIALLY PRIVATE LEARNING
Differential privacy. A network model M D - R. is trained on two datasets D, D' E DD which differ only by a single data record. For any subset of outputs R E R. the model satisfies (e, ddifffrrrnlt privacy (DP) (Abadi et al. 2016) if
Pr(M(D) s Pr(M(D') +
In another word, bounds the privacy loss any single sample, and ò is the probability that this bound does not hold. Rényi DP (RDP) (Mironov, 2017) generalization of (e, 6DP that uses Rényi divergence as distance metric. More RDP details can be viewed in Appendix A.I
DP-enabled training. DP guarantees can be enforced into a private network model by various DP- enabled training frameworks including DPSGD (Abadi et al., 2016). DPSGLD (Bu et al. 202T
DPDFA (Ohana et al. 2021 Lee & Kifer 2020). and PATE (Papernot et al. 2018).
DPSGD. DPSGD (Abadi al. 2016) is the most widely used De-enabled training framework that satisfies RDP. RDP during DPSGD on a model is enforced by two components: (1) par-sample gradients are clipped at fixed L22 norm threshold C: and (2) Gaussian noise of magnitude o²C² is added to the gradient updates for a noise scale parameter a. The privacy cost during DPSGD can be measured by Moments Accountant (Abadi al., (2016). which computes the upper bound of as consequence of using different composition theories. The privacy loss rate depends on the hyper-parameters (Mohapatra et al. 202T) of DPSGD.
DPSGLD. SGLD (Welling & Teh, 2011 is a gradient technique to train Bayesian networks. SGLD makes the weights of model converge to posterior distribution rather than
"Group normalization. The results of batch normalization can be found in Appendix A.2
Batch normalization trained by the puhlic dataset.
2

---

Under review as a conference paper at ICLR 2023
point estimate, from which it can sample and characterize the uncertainty of weights. DPS- GLD (Wang et al. 2013) is built to train DP Bayesian networks by adding per-sample clipping.
Recent work (Bu et al. 2021 proves that DPSGLD is equivalent to DPSGD with regulariza-
tion (Bu et al.
2021).
DPDFA. DFA No kland 2016) emerges
effective alternative to paoppropagation in non- I Lee Kifer 2020) enforces DP in DFA by clipping activations and error signals after the feed-forward phase, scaling the emror transport matrix, and adding Gaussian noises to the update direction.
private training. DPDFA (Ohana et al. 202T
PATE. PATE (Papernot et al. 2018) is framework based on private knowledge aggregation of an ensemble model and knowledge transfer. trains an ensemble of teachers on disjoint subsets of the private dataset. The ensemble's knowledge is then transferred to a studení model via differen- tially private aggregation the teachers' votes on samples from an unlabeled public dataset. The student model is released as the output of the training.
2.2 HANDCRAFTING AND LEARNING LOW-LEVEL FEATURES
Handcrafted features. Tramer & Boneh 2021 advocates adopting the seseletttrasffrmm-baae ScatterNet (Oyallon & Mallat 2015 Oyallon et al., 2018) to extract non-learned handcrafted fea- tures (e.g., invariance small rotations and translations) for differentially private learning. A private linear classifier learned on these handcrafted features exhibits higher utility than an end-to-end CNN under moderate privacy budget.
Learned features. In the non-private setting, YM. et al. (2020) demonstrates the features learned from one single image with strong augmentations and via contrastive learning (Chen et al. 2020) can obtain a non-trivial accuracy on ImageNet. However, the performance of these learned features never studied in the DP domain. In this paper, we show that the learned features are more effective than the handcrafted ScatterNet features in the DP domain.
Combining handcrafted and learned features. HarmonicNet (Ulieny et al. 2019) is a data- efficient network using set of non-learned handcrafted filters based on Discrete Cosine Transform (DCT) at multiple frequencies combined by learnable weights. HarmonicNet obtains a higher non- private accuracy than ScatterNet particularly with small training datasets. However, the performance of the features generated by HarmonicNet is never examined in the DP domain.
3 SULEVIEDE PRETRAINING FOR DIFFERENTIALLY PRIVATE LEARNING
In this section, we explain how to build scalable pretrained features for differentially private learning with various sizes of public datasets, i.c., public dataset, moderate size (38K~50K) public dataset, and a large size (M) public dataset. Although batch normalization (BN) can be supported by DP in principle, it is difficult to use the same rate, to train BN parameters and the other network parameters in the DP domain. The SOTA DP- enabled training libraries such Opacus YYuusefporr al.) (021) do not even support BN yet. Therefore, in this paper, we enforce that DP-enabled training directly happening on the private dataset requires the model to use only group normalization, and all pretrained features generated with the BN parameters trained by only the public dataset. How to fine-tune BN parameters with private datasets is beyond the topic of this paper, and can be answered by Luo al. (202I). Results of BN on private datasets can be viewed in Appendix [.2)] The utility and privacy improvement of the features generated by SSP over non-learned handcrafted features and those trained with labels cannot be reduced by private BN.
e.g., noise multiplier and learning
3.1 No PUBLIC DATASET AVAILABLE
When no public dataset is available, compare two ways to train private model on private dataset. One way is to train the private model directly on the private dataset using non-learned handcrafted features. The other way is to train feature extractor by a data-efficient network, self- supervision, and one image, and then to train a private linear classifier on the private dataset using features produced by the feature extractor. We used only DPSGD for DP training in this section.
3

---

Under review as a conference paper at ICLR 2023
Table 3: The utility comparison of private linear classifiers learned on pretrained features and private CIFARIO under (c 3, 10-9).
Table 2: The utility comparison of private mod- els directly trained on a private CIFAR10 under (c = 3, 8 10 10-
Public
Feature
Public
Network Architecture
Acc (%)
Acc (%)
Dataset
Extractor
Dataset
end-to-end CNN
59.2
ResNet18
ResBlock-1 1
49.7
one imags
ResBlock-2
56.3
ScatterNet+linear
64.2
none
ResBlock-3
51.4
ScatterNet+CNN
66.1
ResBlock-4
50.3
HarmonicNet linear
47.7
ScatRN18
63.1
HarmonicNet + CNN
50.2
HarmRN18
66.3
Training directly on the private dataset. We show the utility comparison of various schemes directly learning private CIFARIO under the privacy budget of (c 3, 5 10 (0055 in Table The training schemes include a 5-layer CNN, a linear classifier learned on the ScatterNet features, and a 5-layer CNN learned the ScatterNet features, which are adopted from Tramer & Boneh (2021) We also compare a linear classifier and a 5-layer CNN learned on the DCT-based HarmonieNet handcrafted features. The CNN with the ScatterNet features achieves the highest utility, i.e., 66. %. We find the HarmonicNet features are vulnerable to noises, i.e., applying noises to the weights combining multiple DCT frequencies significantly degrades the utility of private models.
Training a feature extractor. We applied a series of aggressive data augmentations (c.g., crop- ping) on single 600 x 225 image (shown in Appendix (3.3) to create a synthetic dataset as the public dataset. More details of our experimental methodology can be found in Section 4 To first train a feature extractor on the synthetic dataset, we used three different network architectures in- cluding R8 (He et al. 2016), ScatRN18, and HarmRNI8 to serve the backbone of the self-supervised SimCLRv2 (Chen et al,, 2020). ScatRN18 means ResNet18 with ScatterNet hand- crafted features, while HarmRNI8 indicates ResNet18 where all convolutional filters are replaced by DCT-based HarmonicNet filters. ResNet18 contains four basic blocks connected sequentially. We extracted pretrained features from all four basic blocks, and ResBlock-X X to represent the pre- trained features extracted from the block of ResNet18. We show the CIFAR10 utility comparison of private classifiers learned on the pretrained features produced by different feature extractors under the privacy budget of (e = 3, 8 10-5) in Table 3 All private classifiers have 1 layer. Although compared the last ResBlock, the two middle basic blocks of ResNet18 produce better features, single image is not enough to make ResNet18 generate high-quality features. Both ScatRN18 8 and HarmRN18 output better features than ResNet18. The features produced by HarmRN18 (66.3%) slightly outperform the ScatterNet features (ScatterNet+CNN 66. 1 1% in Table used directly in the DP training, since DCT is fused with every filter of HarmRN18. We will show the HarmRN18 fea- tures can obtain significantly higher utility than the ScatterNet features with the same privacy loss on other complex datasets in Section 5.1
3.2 A MODERATE SIZE PUBLIC DATASET IS AVAILABLE
Fine-tuning by public unlabeled images. To further improve the quality of pretrained features, randomly selected IK unlabeled image from a public CIFAR 100 dataset fine-tune the feature extractors, as shown in Table 4 where we still used DPSGD to train the private classifier. Training with IK unlabeled images improves the utility of the private classifier learned on the features gen- erated by HarmRN18 to 72.4%. The entire unlabeled CIFAR 100 dataset (50K images) makes the private classifier achieve 78% accuracy on the private CIFARIO dataset.
Comparing DP-enabled training frameworks. We used different DP-enabled training frame- works, i.e. PATE, DPSGD, DPSGLD, and DPDFA, to train a private classifier learned on the HarmRN18 features for private CIFAR10. The HarmRN18 feature extractor is trained by pub- lie CIFAR100 dataset. For PATE, teacher and student models are I-layer linear classifiers, and use the HarmRN18 features. We adopted 1K teacher models, and CIFAR 100 the public dataset. The private classifiers of DPSGD and DPSGLD have one layer, while the private classifier of DPDFA 2-layer multilayer perceptron (MLP), where the first layer uses Tanh activations and the sec-
4

---

Under review as a conference paper at ICLR 2023
Table The CIFARIO utility comparison of the features produced by feature extractors further fine-tuned by different numbers public im- ages from CIFARI00 under (c 3, 8 10 10-5).
Table 5: The CIFARIO utility comparison of private classifiers learned on the HarmRN18 features and trained by various DP-tranning methods (DP-SOTA-2) Luo al. (2021)).
Pretrained Feature
Ace (%)
3, 8 10 10
Public Dataset
Training Scheme
c-DP
Ace (%)
Unlabeled Image
Extractor
0
IK
10K
50K
PATE
16
70.3
unlabeled CIFARI00
DPSGD
1.5
75.5
ResNet18
56.3
62.6
66.8
71.5
DPSGLD
1.5
74.9
ScatRN18
63.1
67.2
70.8
73.2
DPDFA
1.5
78.2
Harm
66.3
72.4
73.1
78
CIFARIO0
DP-SOTA-2
1.5
71
ond layer uses a Sigmoid activation. We actually tried a 2-layer MLP for all frameworks, but works better only with DPDFA, as shown in Appendix A.4 The comparison between DP-enabled training frameworks is shown in Table []] Compared to DPSGD, the supervisee PATE cannot fully take advantage of the pretrained features. The student model has perform many queries on teacher models to obtain a reasonably high utility, so the privacy loss is high. DPSGLD is similar DPSGD, but costs higher privacy overhead in each epoch. As result, DPSGLD achieves slightly worse utility than DPSGD under the same privacy budget. Although we used the worst privacy overhead per epoch to estimate the privacy loss of DPDFA, DPDFA still obtains the best utility when c = 1.5 among all frameworks. DPDFA makes the private classifier learned on the HarmRN18 features obtain a much better utility than the classifier (Luo al. (02T) learned on the features trained by labeled CIFAR 100. The comparisons between these DP-enabled training frameworks on more complex private datasets can be found in Section
8d
Test Acaracy (%)
18.9
22
Test Accuacy
79.1
Test Accuracy
8o
79
Traaeed labled
76
lab
Li abled
1
E-DP
r.DP
E-DP
(a) Crop (small distance)
(b) EuroSAT (medium distance)
(c) ISIC2018 (large distance)
Figure 1: The comparison of features trained by labeled and unlabeled mini-ImageNet various out-of-domain complex private datasets.
Pretrained features for cross-domain private datasets. To exam the effectiveness of pretrained features on a private dataset from a different domain, we adopted mini- Mnni-ImmgeNet (Vinyals et al. 2016) as our public dataset to train the pretrained features, and studied the -iliitcyppivcyy trade-off on out-of-domain private datasets such as CropDiseases (Crop) (Mohanty et al.) 2016a), EuroSAT (Hel- ber et al. 2019), and ISIC2018 (Tschandl al. 2018). We first trained HarmRNi8 by SimCLRv2 on the mini-Imaged produce features private Crop, EuroSAT, and ISIC2018 datasets. Finally, we trained a private classifier on each set of features. We trained ResNet18 feature extractor (Luo er al.) 2021) by the labeled mini-ImageNet dataset as our baseline. Our baseline is trained using the standard cross- entropy loss with label smoothing. We set the label-smoothing parameter to 0.1. The comparison between our scheme and baseline is shown in Figure Except ISIC2018 under e < 1.3, the features generated by SSP enable the private classifier to achieve a better utility than our baseline under the same privacy budget. Particularly, the features produced by SSP on moderate size of public dataset are already capable enough even for private datasets (e.g., ISIC2018) having a larger learning dis- tance from the public dataset. Compared to supervised pretraining, SSP generates better low- and mid-level features (Zhao al. 22021, which more critical to the utility in the DP domain. We also find further fine-tuning these pretrained features with all labels of the public dataset actually degrades the feature quality these private datasets. The intra-class invariance (Zhao et al. 2021
dataset with no label. And then, we used HarmRNI8 as the feature extractor
5

---

Under review as a conference paper at ICLR 2023
Test Accuracy (%)
94.7
92.3
90
Tedd Accuaryy 8
30
Accuracc
80
545
Faurated Lodeed Leliiied
2
E-DP
r-DP
r-DP
(a) Crop (small distance)
(b) EuroSAT (medium distance)
(c) ISIC2018 (large distance)
Figure 2: The comparison of features trained by labeled and unlabeled ImageNet on various out-of- domain complex private datasets.
introduced by the fine-tuning with all labels of the public dataset increases the class misalignment of private datasets.
3.3 A LARGE PUBLIC DATASET IS AVAILABLE
is easier for a private classifier learned on the features trained by a large public dataset to obtain high utility and small privacy overhead. We adopted ImageNet- 1K (Deng et al., (2099 as public dataset to train features with and without labels. And then, we trained a private classifier using these features on various private complex datasets Crop, EuroSAT, or ISIC2018. We used ResNet50 the backbone of SimCLRv2, and then the feature extractor for private datasets. We also trained another ResNet50 with labels as our baseline. The comparison between our scheme and baseline is shown in Figure 2 For all three datasets, the features produced by SSP make the private classifier obtain much higher utility than our supervised-learinn baseline under the same privacy budget. larger unlabeled public dataset greatly improves the quality of features yielded by SSP.
METHODS
Public datasets. We selected the "Image-B" from YM. al. (2020), which has the size equiva- lent 132 CIFAR images, due to its rich textures and diversity. The image be viewed in Appendix A.3 We applied a series of aggressive data augmentations including cropping, scaling, rotation, contrast changes, and adding noise the image, and then created synthetic dataset hav- ing 50K CIFAAR/iiniImmageNe-siiizz images. The detailed parameters of these augmentations can be also used CIFAR 100, mini-ImageeNt (Vinyals) 2016), ImageNet (Deng et al. 2009), and PASS (Asano et al. 2021) as public datasets. et al.
viewed in YM. et al. 2020). Besides "Image-B"
Private datasets. We studied multiple private datasets such CIFAR (Krizhevsky al. 2009). CropDiseases (Mohanty et al. (2016)), EuroSAT (Helber et al. 2019). ISIC2018 (Codella al. 2018), and ImageNet. CropDisease/EuuoSAAT/SIIC distance from the public dataset muni-ImageNNe
has small/medium/large learning
Feature pretraining. We adopted SimCLRv2 (Chen al. 2020) train feature extractor on different public datasets with no label. The backbone of SimCLRv2 uses ResNet18, ResNet50, or HarmRN18 architecture. The pretraining of each model lasts 200 epochs with a batch size 64 or 128. After SSP, we used the backbone as feature extractor.
Supervised learning pretraining. We trained supervised learning feature extractor on vari- ous public datasets using the standard cross-entropy loss with label smoothing. We set the label- smoothing parameter to 0.1.
DP-enabled training. We adopted multiple frameworks including DPSGD (Abadi al. 2016), DPDFA (Ohana et al., 20221 Lee & Kifer 2020), DPSGLD (Bu et al., (022 and PATE (Papernot) al. 2018) to train private classifiers. Only DPDFA trains 2-layer private MLP classifier, while the other en-ellde training frameworks train a 1-layer linear classifier.
Normalization layers. Models learned handcrafted features and directly trained private datasets use only group normalization. All pretrained features are produced with the BN param- eters trained by only the public dataset. Results related to BN can be found in Appendix A.2

---

Under review as a conference paper at ICLR 2023
Table 6: The utility comparison of features trained by single image.
Public
Network Architecture
CIFARIO
CIFARIO 100
Crop
EuroSAT
ISIC2018
Dataset
Utility (%) under e-DP= 1 1|2
None
ScatterNet + CNN
51.6
63.4
14.7
25.7
45.1
67.6
17.6
34.8
61.2
63.7
image
HarmRN18
61.1
64.8
22.3
27.1
70.1
74.3
80.1
84.5
65.1
67.2
Table 7: The utility comparison of features trained by public mini Mini-ImageNer dataset.
Public Dataset
Extractor Architecture
CIFARIO
CIFARI00
Crop
EuroSAT
ISIC2018
Utility (%) under e-DP= 1 ||2
labeled
ResNet18
68.8
72.7
33,8
39.1
62.2
77.0
69.3
76.4
68.4
67.8
unlabeled
ResNet18
69.1
73.0
34.9
40.8
75.2
78.1
84.9
87.6
68.1
70.2
unlabeled
HarmRN18
69.5
73.5
34.3
40.4
76.0
79.5
85.2
88.8
67.7
69.8
Table The utility comparison of features trained by a public ImageNet dataset.
Public
Extractor
CIFARIO
CIFARI00
Crop Utility (%) under e-DP= 1
EuroSAT
ISIC2018
Dataset
Architecture
labeled
ResNer50
90.4
91.1
61.3
65.4
81.1
83.7
82.9
88..2
69.5
72.7
unlabeled
ResNet50
91.6 92.7
63.3
69.2
87.7
92.3
92.5
94.3
70.3
75.2
Hypee--prrameter search. Similar to Tramer & Boneh (2021): Luo et al. (2021), we do not count the privacy leakage during hyper-parameter searches on network architectures, optimizers, and papea-parameters We target moderate DP budget of (e I 4.5, 10-3) for private Ima- geNet, and a small DP budget of (c = 0 ~ 2, 8 = 10-5 for the other private datasets. We fixed the gradient clipping threshold to C = 0.1 as default, and tried different batch sizes [B] and learning rates The typical batch size we used is 4096, 8192, or 16384. For each set of hyper-parameter, ran the experiment for five times and report the average values.
Library. We implemented all privacy-related experiments by Opacus v1.1.1 Yousefpour et al. (02II) where native Poisson sampling supported by MarchMMemorMManageee Private models com- pute per sample gradients, and the DP optimizer does gradient clipping and noise addition.
5 RESULTS
To measure classifier's utility for a range of privacy budgets. we compute the test accuracy and the DP budget e after each training epoch. For a small DP budget (e S 2,8 10-5), we studied the features trained with a single image, the public mini-ImageNet dataset, and the public ImageNet dataset. We also compared various DP-enabled training frameworks to train private classifier with these features various private datasets.
5.1 No PUBLIC DATASET
When there is no public dataset, we trained HarmRN18 network by SimCLRv2 on single image as our feature extractor. And then, we trained a private 1-layer classifier by DPSGD on various private datasets using features produced by the HarmRN18 feature extractor. As T utility of the private classifier is much higher than that of a 5-layer CNN learning directly on the non-learned ScatterNet handcrafted features, when even the ScatterNet handcrafted features due to clipped and noisy gradients during DPSGD. The advantage of the features trained by single image particularly significant private datasets like Crop and AT. This suggests that leveraging features generated by SSP a scalable solution to differentially private learning even when facing the lack of public datasets.
the
1 and 2. It is difficult to directly learn

---

Under review as a conference paper at ICLR 2023
85
80
Test Accuracy (%)
30
75
Acquraty
Test Accurayy
200
70
65
66
60
96
DPSGLD DP550 DPD-A
5000 DFDFA
8
90
3.5
0.5
1.5
0.5
1.5
c-DP
E-DP
c-DP
(a) Crop (small distance)
(b) EuroSAT (medium distance)
(c) ISIC2018 (large distance)
Figure 3: The comparison DPSGD, DPSGLD, and DPDFA when training with the features pro-
duced by public mini-Imagen dataset.
94.
Test Accurac (%)
Test Accuracy (%)
96
95.7
Test Accuracy (9%)
80
70
00
OPSGLD
85
DISSOLE
DPSGD .PCRA
50
80
3.5
1.5
E-DP
e-DP
(a) Crop (small distance)
(b) EuroSAT (medium distance)
(c) ISIC2018 (large distance)
Figure 4: The comparison of DPSGD, DPSGLD, and DPDFA when training with the features pro-
duced by public ImageNet dataset.
5.2 MODERATE SIZE PUBLIC DATASET
When public mini- ImageNet dataset is available, we trained HarmRN18 network and ResNet18 network via SimCLRva as our feature extractors. We then used their features to train two private 1-layer classifiers by DPSGD on private CIFAR10, CIFAR100, Crop, EuroSAT, and ISIC2018. Compared to our supervised-learning baseline, as Table learned on features produced by SSP higher than that learned with labels except the ISIC2018 dataset having large learning distance, when = 1. Although HarmRN18 outperforms ResNet18 in the non-private domain (Ulieny et al. 2019), we do not find there significant difference be- tween them in the DP domain. Particularly. the self-supervised pretrained ResNet18 extractor gen- erates slightly better features than HarmRN18
the utility of the private classifiers
private CIFARI00 (e = and 2) and ISIC2018 (e 2) datasets. When pretrained on public mini-ImageNet, ResNet 8 is strong enough for produc- ing features for various private datasets.
5.3 A LARGE SIZE PUBLIC DATASET
public ImageNet dataset greatly improves the quality of pretrained features for differentially pri- vate learning. We used ResNet50 the backbone of SimCIRR22 and feature extractor. And then, we trained private 1-layer classifier by DPSGD on the features of various private datasets. As Table 8 highlights. the utility of the private classifier learned on features produced by SSP is much higher than that learned with labels, when improving the utility and privacy loss of differentially private learning.
and 2. A large unlabeled public dataset is the key
5.4 COMPARING VARIOUS DP-ENABLED TRAINING FRAMEWORKS
We compared DPSGD, DPSGLD, and DPDFA to train a private classifier using the ResNet50 fea- tures pretrained public mini Imaieet and ImageNet for three private datasets including Crop, EuroSAT, and ISIC2018. Since the utility of PATE much lower than the other three training frame- works under the same DP budget, we excluded PATE in the comparison. DPSGD is the most widely
8

---

Under review as a conference paper at ICLR 2023
used DP-enabled training algorithm, pared to DPSGD, DPSGLD obtains the same utility, but uses only a smaller privacy budget e & 1. However, for large privacy loss 1, DPSGD achieves very similar utility to DPSGLD. DPDFA typically can obtain higher utility than the other two DP-enabled training frameworks on the private datasets having a smaller learning distance from the public dataset, i.e., Crop and EuroSAT, under the same privacy budget when > 0.5. However, for private datasets having a large learning dis- tance from the public dataset, i.e., ISIC2018, DPDFA achieves only lower utility than DPSGD and DPSGLD under the same privacy budget.
it baseline. As Figure 3 and highlight, com-
6 CONCLUSION AND FUTURE WORK
We have demonstrated that SSP is a simple yet scalable solution to differentially private learning regardless of the size of available public datasets. The features produced by SSP on single image, or moderate/large size public dataset significantly outperform the features trained with labels in the DP domain, let alone the non-learned handcrafted ScatterNet features. Based on the learning distance from the public dataset and the privacy budget, different private datasets may favor distinctive DP-enabled training frameworks to train their private classifiers learned on features produced by SSP.
Conclusion.
Future work. We also tried SSP on private ImageNet- and obtained top-1 accuracy of 25.3% when 3. However, more research efforts are required to further improve the utility of large-scale private datasets under moderate privacy budget (e S 3). We adopted ResNet50 as the backbone of SimCLRv2, and trained on a public PASS dataset consisting of 1.4 million CC-BY images with no label. The backbone is used to gener- ate features for private ImageNet. The features can yield 60.8% top-1 non-private accuracy. We further trained private classi- fier on these features in the DP domain. We find that the gradient clipping threshold C' = 0.1 only produces a top-1 utility 8.1% even when 3. So we enlarged C to 1, and adjusted the other DP parameters. The utility and privacy overhead of the classifier private ImageNet is shown in Figure 5 When e = 3, the top-1 utility of the classifier becomes 25.3%. We also compared DPSGD and DPDFA train our private classifier. Since PASS is still too small produce strong enough pretained features, DPDFA achieves a lower utility than DPSGD under the same privacy budget. Although Kurakin al. (2022) uses supervised-learning- based features achieve a top-1 utility 47.9% on private ImageNet with (e = 10, 5 = 9). its top-1 utility is only 7.6% when 4.57. Under a moderate privacy budget < 4.5), the features generated by SSP greatly outperform prior sepervised-learning based features. More recently, Mehta et al. (2022) obtains a top-1 utility of 81.5% on private ImageNet under 2 by features trained by JFT-300M and JFT-4B datasets (Sun) et al. 2017). However, JFT-300M and JFT-4B datasets are not publicly available. We leave further improving the utility of private ImageNet under small or moderate privacy budget to future work.
25
25.5
Test Accuraty
220
1s
m
560
t-DP
Figure 5: The utility and privacy loss of private ImageNet-1K.
ETHICS STATEMENT
Our study improves the privacy of sensitive training data in various machine learning models. our proposed technique fails, the privacy of sensitive training data will not be worse than our baseline.
REPRODUCIBILITY STATEMENT
Our code is anonymously released at
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In ACM SIGSAC Conference on Computer and Communications Security, pp. 318-318, 2016.

---

Under review as a conference paper at ICLR 2023
Sweta Agrawal and Amit Awekar. Deep learning for detecting cyberbullying across multiple social media platforms. In European conference on information retrieval, pp. 141-153, 2018.
Yuki M. Asano, Christian Rupprecht, Andrew Zisserman, and Andrea Vedaldi. Pass: An imagenet replacement for self-supervised pretraining without humans. NeurIPS Track on Datasets and Benchmarks, 2021.
Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie Su. Deep learning with gaussian differential privacy. Harvard Data Science Review, 2(3), 9 2020.
Zhiqi Bu, Qiyiwen Zhang, Kan Chen, and Qi Long. Differentially private bayesian neural net- works on accuracy, privacy and reliabilityy. In ICML, Theory and Practice of Differential Privacy workshop, 2021.
Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In USENIX Security Symposium, pp. 2633- 2650, August 2021.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E Hinton. Big self-supervised models are strong semi-supervised learners. Advances in neural information pro- cessing systems, 33:22243-22255, 2020.
Noel CF Codella, David Gutman, M Emre Celebi, Brian Helba, Michael A Marchetti, Stephen W Dusza, Aadi Kalloo, Konstantinos Liopyris, Nabin Mishra, Harald Kittler, et al. Skin lesion anal- ysis toward melanoma detection: A challenge at the 2017 international symposium on biomedical imaging (isbi), hosted by the international skin imaging collaboration (isic). In IEEE International symposium on biomedical imaging, pp. 168-16 172, 2018
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In IEEE Conference Computer Vision and Pattern Recognition, pp. 248-255, 2009.
Thomas Fischer and Christopher Krauss. Deep learning with long short-term memory networks for financial market predictions. European Journal of Operational Research, 270(2):654-669, 2018.
Adam E Flanders. Medical image and data sharing: 1247-1251, 2009.
there yet? Radiographics, 29(5):
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. IEFE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 12(7):2217-222) 2019.
Alex Krizhevsky et al. Learning multiple layers of features from tiny images. Technical Report, 2009.
Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward training at imagenet scale with differential privacy. CoRR, abs/2201.11228, 2022.
12328
Jaewoo Lee and Daniel Kifer. Differentially private deep learning with direct feedback alignment. CoRR, abs/2010.03701, 2020.
Zelun Luo, Daniel J. Wu, Ehsan Adeli, and Li Fei-Fei. Scalable differential privacy with sparse network finetuning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 5059-5068, June 2021.
10

---

Under review as a conference paper at ICLR 2023
Harsh Mehta, Abhradeep Thakurta, Alexey Kurakin, and Ashok Cutkosky. Large scale transfer learning for differentially private image classification. CoRR, abs/2205 02973,, 2022. doi: 10. 48850/uaXii.2225..2225 22.9299....... |t htt.:pp://oo..coo1.....///////// 4t150/cc4555/ar... 2205. 02973
yya Mironov. Rényi differential privacy. In IEEE computer security foundations symposium, pp.
263-275, 2017.
Sharada P Mohanty, David P Hughes, and Marcel Salathé. Using deep learning for image-based plant disease detection. Frontiers plant science, 7:1419, 2016a.
Sharada P Mohanty, David P Hughes, and Marcel Salathé. Using deep learning for image-based plant disease detection. Frontiers in plant science, 7:1419, 2016b.
Shubhankar Mohapatra, Sajin Sasy, Xi He, Gautam Kamath, and Om Thakkar. The role of adaptive optimizers for honest private hyperparameter selection. CORR, abs/21 11 1.09066, 2021.
Arild Nø kland. Direct feedback alignment provides learning in deep neural networks. In D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 29, 2016.
Ruben Ohana, Hamlet Medina, Julien Launay, Alessandro Cappelli, Iacopo Poli, Liva Ralaivola, and Alain Rakotomamonjy. Photonic differential privacy with direct feedback alignment. In Advances in Neural Information Processing Systems, volume 34, pp. 22010-22020, 2021.
Edouard Oyallon and Stephane Mallat. Deep roto-translation scattering for object classification. In IEEE Conference on Computer Vision and Pattern Recognition, June 2015.
Edouard Oyallon, Sergey Zagoruyko, Gabriel Huang, Nikos Komodakis, Simon Lacoste-Julien, Matthew Blaschko, and Eugene Belilovsky. Scattering networks for hybrid representation learn- ing. IEEE transactions on pattern analysis and machine intelligence, 4 41(9):2208-22 220-2221,, 2018.
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Ulfar Er- lingsson. Scalable private learning with PATE. In International Conference on Learning Repre- sentations, 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. IEEE symposium on security and privacy (SP), pp- 3-18, 2017.
Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta. Revisiting unreasonable ef- fectiveness of data in deep learning era. In IEEE International Conference on Computer Vision, pp. 843-852, 2017.
Nima Tajbakhsh, Jae Y Shin, Suryakanth R Gurudu, Todd Hurst, Christopher B Kendall, Michael B Gotway, and Jianming Liang. Convolutional neural networks for medical image anal- ysis: Full training or fine tuning? IEEE transactions on medical imaging, 35(9):1299-13122 2016.
Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much more data). In International Conference on Learning Representations, 2021.
Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. The ham I 10000 dataset, a large collection of multi-source dermatoscopie images of common pigmented skin lesions. Scientific data, 5(1):1-9, 2018.
Matej Ulicny, Vladimir A Krylov, and Rozenn Dahyot. Harmonic networks for image classification. In British Machine Vision Conference, 2019.
Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al. Matching networks for one shot learning. Advances in neural information processing systems, 29, 2016.
Yu- Yu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and
stochastic gradient monte carlo. In International Conference on Machine Learning, pp. 2493- 2502, 2015.

---

Under review as a conference paper at ICLR 2023
Max Welling and Yee W Teh. Bayesian learning via stochastic gradient langevin dynamics. In International Conference on Machine Learning, pp. 681-688, 2011.
Asano YM., Rupprecht C., and Vedaldi A. A critical analysis of self-supervision, or what we can learn from single image. In International Conference on Learning Representations, 2020.
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in pytorch. In NeurlPS 2021 Workshop Privacy in Machine Learning, 2021.
Nanxuan Zhao, Zhirong Wu, Rynson W. H. Lau, and Stephen Lin. What makes instance discrim- ination good for transfer learning? In International Conference on Learning Representations, 2021.
12

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1
RÉNYT DP
Rényi DP (RDP) (Mironov 2017 is generalization of (e, 6D- that uses Rényi divergence
distance metric. The Rényi divergence of order a between two distributions P and Q is defined as:
1
P(x)
Da(P)1Q)
log Eaw
Q(x)
model satisfies (a,, <)-RDP if
Pr[M = x] Pr(M(D') =
D. Da(M(D))M(())
log BLNM(D)
Pure (e, 0)-DP is equivalent to (oc, RDP. And model M satisfies (a, e) RDDP M also satisfies for any 5 E (0, 1). RDP during the training of model is enforced by two components: per- per-sample gradients are clipped at a fixed L2 norm threshold C, and Gaussian noise of magnitude o² o²C² added to the gradient updates for noise scale parameter
Table 9: The utility and privacy comparison of various schemes using batch normalization on a
private CIFARIO dataset. DP-SOTA-1: Tramer & Boneh (202T); and DP-SOTA-2: Luo et al. 2021
Public Dataset
Scheme
6-D
Network
Training
Accuracy (%)
None
DP-SOTA-1
Scat + CNN
DPSGD
69.3
image
Ours
HarmRN18
DPSGD
71.1
labeled CIFAR100
DP-SOTA-2
1.5
ResNet18 ResNet18
DPSGD
81.6
unlabeled CIFAR100
Ours
1.5
DPSGD
80.7
A.2 PRIVATE DATA NORMALIZATION
Prior work Tramer & Boneh 2021
Luo
et al.] (021] finds batch normalization BNN) greatly improves convergence on complex pri- vate datasets. Private BN (Tramer & Boneh 202T) is proposed to compute private estimates of the per-channel mean and variance of the ScatterNet features. It is difficult to use the same set of papeeeprrameters train BN lay- ers and the other private components in a neu- ral network. Different values for noise multi-
Figure 6: Single-image self suff-uupervisio.
plier (Tramer& & Boneh (021) or learning rate (Luo et al. 2021) are used to train BN layers. More- over, most DP training libraries do not support BN layers in private model yet. We adopt the same method and hyper-parameterr parameters to train BN layers as prior work (Tramer & Bonch 2021 Luo al. 202T. The utility and privacy comparison between our schemes and prior work shown in Table The features trained by HarmRN18 18 using BN on single image obtain better utility than the ScatterNet non- lea-naaaeebee handcrafted features. However, the features trained by ResNet18 on public unlabeled CIFAR 100 achieve slightly worse utility than those trained with labels (Luo al.) 2021). This because besides BN layers, (Luo et al. 202I) also fine-tunes convolutional layers in the DP domain.
A.3 LEARNING ON A SINGLE IMAGE
Recent work (YM. et al. 2020) shows the self-supervised learning methods such as BiGAN, RotNet, and DeepCluster can be used to train the first few layers of deep network model using a single training image, when sufficient data augmentation is used. We select the "Image-B", which is shown Figure 6, due to its rich texture and high diversity. The image size is 600 x 225. We also try the "Image-A A and the "Image-C" from (YM. et al.) (020) our experiments. Among three images, "Image-B" B achieves the best utility and privacy budget for most private classifiers.
13

---

Under review as a conference paper at ICLR 2023
Table 10: The utility comparison of classifiers consisting of different numbers of layers.
Public Dataset
Private Dataset
Arch + Train
Utility (%)
1-layer DPSGD
1.5
75.5
2-layer DPSGD
1.5
73.3
1-layer DPSGLD
1.5
74.2
CI
CIFAR10
2-layer DPSGLD
1.5
72.8
1-layer PATE
16
70.2
2-layer PATE
16
64.7
2-layer DPDFA
1.5
78.2
A.4 SINGLE-LAYER AND 2-LAYER CLASSIFIESS
In order to study DPDFA, we need to use 2-layer linear MLP to serve as our private classifier, where the first layer uses Tanh activations and the second layer uses a Sigmoid activation. natural question is "how does DPSGD work with 2-layer MLP?". As Table I0 shows, we find that unlike DPDFA, all the other en-elldled training frameworks work better with single-layer linear classi- fier. For instance, 2-layer MIP-hased private classifier is always overtopped by l-layer classifier when trained by DPSGD. Therefore, in this paper, we always adopt a 2-layer classifier for DPDFA, and 1 l-layer classifier for the other DP-enabled training frameworks.
14


Reviews:
[{"review_id": "jEePObtT-j", "reviewer": "Reviewer_SheV", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents various ways of using Self-Supervised pre-training (SSP) using public data in the context of differentially private learning. In particular, the paper claims to provide suggestions on what is the best approach when varying **amounts** and **types** of public data are available for SSP.", "summary_of_the_review": "* I think it would be better to use a more relevant citation when referring to Differential Privacy than Abadi et. al. For example Dwork et. al. would be a more relevant citation here.\n\n* It is now quite well known that hyper-parameter selections using the private dataset can lead to privacy leaks. However, usually that is chosen from a relatively small set eg. learning rate is chosen from a few values. However, I wonder whether choosing the public image as Image (b) can lead to a huge leak. I am not sure whether this is indeed true but I would appreciate if the authors provided a discussion of this.\n\n* The conclusion drawn from table 2 is that ScatterNet features are better than those from harmonicNet and the presented reason is that \"applying weights to combining multiple DCT frequencies significantly degrades the utility of private models\" But this seems rather arbitrary. \n    * First, there is no discussion of why we should use HarmonicNet to compare with and why larger models like ResNet and WideResNet are not compared with here. \n    * Second, if harmonic net is indeed to be used, why are the features of HarmonicNet more affected than ScatterNet? The presented reason is not backed up with any evidence.\n* In Table 5, DPDFA is championed to be the best method. But there are various confounders here. To begin with, DPDFA uses 2 layer MLPs whereas the others use one layer linear as stated in the paper. Second, there are optimisation differences between a method like DPDFA and other methods as the hyper-parameters are very different. I may have missed it but I am not sure how the noise rate and the number of steps of DP-SGD were selected. It is possible that the advantage of DPDFA comes merely from the ease of its hyper-parameter selection. While this is possibly an interesting outcome, it is not discussed in the paper where the advantage of DPDFA comes from.\n\n* In Figure 1 (a) unlabelled SSP and labeled R18 supervised features achieved nearly the same accuracy at $\\epsilon=3$ with fine-tuned lacking behind a little bit. On ISIC, there is really no statistically significant difference between the methods. Using these observations the author claims that SSP is better than labeled and in fact, fine-tuned features are worse. This is despite the fact that SSP and supervised features are nearly the same in Figure 2(a) for larger $\\epsilon$ and in Figure 2(b) for small $\\epsilon$ and figure 2(c) almost everywhere. Moreover, in Figure 2, when using the full imagenet, this trend is reversed. Fine-tuned features do better than SSP and much better than Supervised R18 feature. But the text in section 3.3 claims the opposite that SSP features are better. Thus, there are a lot of experiments here but I can't find a hypothesis that can be validated or negated using them. The claims made in the paper do not hold consistently across the experiments in the paper.\n\n* An interesting question from Figure 2, according to me, is why are the accuracies from supervised R18 and finetuned features so different ?\n\n* From Figure 3,4 the paper claims that DP-DFA is better than the other methods when there is a small distance between pre-training and fine-tuned distance. However, it seems quite anecdotal without a systemic study of varying this distance. Perhaps, the authors can use the setting of _Controllable-Shift (CS) datasets_ from Shi et. al. 2022.\n\n\nDwork, Cynthia, et al. \"Calibrating noise to sensitivity in private data analysis.\" Theory of cryptography conference. Springer, Berlin, Heidelberg, 2006.\nShi, Yuge, et al. \"How robust are pre-trained models to distribution shift?.\" arXiv preprint arXiv:2206.08871 (2022)", "strength_and_weaknesses": "## Strength\n\n* The paper addresses and important and relevant topic of using public data to boost the accuracy of privately learning. There are a wide range of options for how to use the public data, the paper provides an insight different types of such algorithms\n\n* The paper also experiments with various types of private training algorithms and various types of public and private datasets. This is perhaps one of the more extensive experimental studies I have seen in this domain for computer vision.\n\n## Weakness\n\n* I am missing the main message the paper wants to convey. It appears to me as if it is a repository of experimental findings, which is nice in its own right, but the experimental findings suffer from a lot of confounders and needs a systematic study to draw meaningful conclusions. I have given examples in my summary.\n* The paper also doesn't provide reasons/explanations for many of its claims/observations. For example, why scatternet is better than HarmNet in Table 1., why DPDFA is better than others in table 5. While a rigorous theoretical exposition is not always necessary, in my opinion, there needs to be an explanation and a validation of the explanation.\n\nThus despite having a lot of results, I cannot recommend acceptance of the paper unless the study is made more systematic and proper explanations are provided.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "QUbGI7bsFZ", "reviewer": "Reviewer_85CV", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper studies performance of a differentially private model, which is trained on top of a feature extractor. Paper considers feature extractors which are trained using self-supervised learning techniques on public datasets. Paper studies how the amount of public data for pre-training affect performance of the model on the final task.", "summary_of_the_review": "Reject.\n\nOverall the paper studies interesting and important topics. However paper would be significantly improved with better comparison with other state of the art methods, as well as better organization of experiments within the paper.\n", "strength_and_weaknesses": "Strength:\n- The questions about size of pre-training dataset and pre-training method are important.\n- To the best of my knowledge, none of the prior work tried to use self-supervised learning on public data to learn features for private fine-tuning.\n\n\nWeaknesses:\n- Poorly organized experiments. Experimental results are spread across sections 3 and 5, which makes it hard to read and compare.\n- Authors actually missing some of the state of the art results in DP training. In particular, CIFAR10 and CIFAR100 results from https://arxiv.org/pdf/2204.13650.pdf are quite a lot better, compared to what is reported in the paper. If results from https://arxiv.org/pdf/2204.13650.pdf are taken into account, then experiments from the paper are not enough to support the statement “SSP greatly outperform the features trained with labels”.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "8Bq2u47IAy", "reviewer": "Reviewer_wJNa", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper demonstrates that self-supervised pretraining (SSP) can help differentially private deep learning regardless of the size of available public datasets in image classification. Specifically, they show the features generated by SSP on only one single image enable a private classifier to obtain better utility than the handcrafted features.", "summary_of_the_review": "The paper discussed one important topic, but the information has been conveyed in previous work. Moreover the paper does not show convincing result showing self-supervised pretraining helps in the case of public dataset not available. The paper evaluated various network structures and several optimizers, but it does not convey useful and consistent information that would help the choice in practice. I would not recommend its acceptance.", "strength_and_weaknesses": "The paper studies an important problem that how self-supervised pretraining helps differentially private machine learning. They evaluate the self-supervised pretraining under various sizes of available public datasets. Especially, given one single image, they conduct self-supervised pretraining, which is interesting.\n\nWeakness\n\nThe information that pretraining helps differentially private deep learning is not new. Many recent papers reveal this information, which are not covered in the paper. \nDe et al. 2022 Unlocking High-Accuracy Differentially Private Image Classification through Scale\nYu et al. 2021 Large Scale Private Learning via Low-rank Reparametrization\nYu et al. 2022 Differentially Private Fine-tuning of Language Models\nLi et al. 2022 Large Language Models Can Be Strong Differentially Private Learners\n\nFor the one image case, the improvement is minimal and the result is not compared with state-of-the-art performance (De et al. 2022) on CIFAR10. Moreover, for the lack of public data, it seems that one has to choose one image carefully (like the Figure 6 in the paper for good utility). Therefore it is  in general hard to say the self-supervised pretraining really helps for the case of lacking of public data.\n\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "-INO8jjWVnX", "reviewer": "Reviewer_YM6J", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on improving the accuracy of differentially private learning accuracy by public self-supervised pre-training. Specifically, the authors propose to perform self-supervised pre-training based on different assumptions regarding the availability of public data: (1) one public image pretraining can outperform handcrafted features under the same privacy budget; (2) when larger public datasets are presented, the features pretrained with self-supervision signals outperform supervised learned features, and demonstrate better performance than existing state-of-the-art DP baselines with different DP training schemes.", "summary_of_the_review": "Strengths:\n1. The proposed method is simple yet effective\n2. Experiments are comprehensively conducted on a variety of datasets, different privacy constraints, and different DP training schemes.\nWeakness:\n1. The novelty is limited. \n2. The paper is poorly written and hard to follow. \n", "strength_and_weaknesses": "## Strengths:\n1. The proposed method is simple yet effective\n2. Experiments are comprehensively conducted on a variety of datasets, different privacy constraints, and different DP training schemes.\n\n## Weakness:\n1. The novelty is limited. While I acknowledge the authors’ efforts in comparing different DP training methods and conducting experiments on different datasets, the proposed self-supervised learning methods are mostly known methods, which are simple adaptations and applications to the differentially private learning domain. \n2. The paper is poorly written and hard to follow. The structure of the paper can be better organized: current Section 4 can be put earlier and better called “experimental setup”; while Section 5 and Section 3 can probably be combined to cover deeper analysis for different data assumptions. The presentation of the tables can be further improved: some tables contain eps=1, 2; while some tables cover eps=3 even given the same dataset. The terms “labeled CIFAR100” and “unlabeled CIFAR100” are also a bit misleading: it is better to distinguish two by “supervised” or “unsupervised” to highlight the method differences.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject