Differentially private Bias-Term Only Fine-tuning of Foundation Models
Authors: Zhiqi Bu
Yu-Xiang Wang
Sheng Zha
George Karypis
Venue: Submitted to ICLR 2023 (2023)
Keywords: deep learning
differential privacy
complexity
parameter efficiency
fine-tuning

Abstract: We study the problem of differentially private (DP) fine-tuning of large pre-trained models — a recent privacy-preserving approach suitable for solving downstream tasks with sensitive data. Existing work has demonstrated that high accuracy is possible under strong privacy constraint, yet requires significant computational overhead or modifications to the network architecture.

We propose differentially private bias-term fine-tuning (DP-BiTFiT), which matches the state-of-the-art accuracy for DP algorithms and the efficiency of the standard BiTFiT. DP-BiTFiT is model agnostic (not modifying the network architecture), parameter efficient (only training about $0.1\%$ of the parameters), and computation efficient (almost removing the overhead caused by DP, in both the time and space complexity). On a wide range of tasks, DP-BiTFiT is $2\sim 30\times$ faster and uses $2\sim 8\times$ less memory than DP full fine-tuning, even faster than the standard full fine-tuning. This amazing efficiency enables us to conduct DP fine-tuning on language and vision tasks with long-sequence texts and high-resolution images, which were computationally difficult using existing methods.

Under review as a conference paper at ICLR 2023
DIFFERENTIALLY PRIVATE ONLY FINE-TUS TUNING OF FOUNDATION MODELS
Anonymous authors Paper under double-bling review
ABSTRACT
We study the problem of differentially private (DP) fine-tuning of large pre-trained models - a recent privacy-preserving approach suitable for solving downstream tasks with sensitive data. Existing work has demonstrated that high accuracy is possible under strong privacy constraint, yet requires significant computational overhead or modifications to the network architecture.
We propose differentially private bias-term fine-tuning (DP-BiTFiT), which matches the state-of-the accuracy for DP algorithms and the efficiency of the standard BiTFIT. DP-BiTFiT is model agnostic (not modifying the network ar- chitecture), parameter efficient (only training about 0.1% of the parameters), and computation efficient (almost removing the overhead caused by DP, in both the time and space complexity). On a wide range of tasks, DP-BiTFiT is 2 30x faster and uses 8x less memory than DP full fine-tuning, even faster than the standard full fine-tuning, This amazing efficiency enables us to conduct DP fine- tuning on language and vision tasks with long-sequence texts and high-resolution images, which were computationally difficult using existing methods.
INTRODUCTION
Fine-tuning from large pre-trained neural networks is one of the most critical technique in deep learning, yielding strong performance in variety of domains (Pan & Yang, 2009; Kenton & Toutanova, 2019; Goyal et al., 2017). Among different methods, full fine-tuning is the most preva- lent one, which trains all the model parameters the downstream tasks and achieves high accuracy within a small number of training epochs. However, full fine-tuning on large models, from hundreds of millions (He et al., 2016; Chen al., 2016) to billions of parameters (Brown al., 2020), can be burdensome in terms of the computation and the deployment, since a full copy of fine-tuned model parameters needed for each task.
To alleviate this issue, the parameter efficient fine-tuning only trains substantially small portion of the model parameters, in contrast to the full fine-tuning. At high level, the parameter efficient fine- tuning methods can be divided into two categories. (1) Model-aware methods, meaning a relatively small number of parameters are introduced into the neural network architecture and only the new parameters are optimized. Examples include LoRA (Hu et al., 2021), 1), Adapter (Houlsby et al., 2019), and Compacter (Mahabadi et al., 2021). (2) Model-agnostic methods, meaning that only subset of existing parameters are trainable. Examples include training only the output linear layer (linear probing. (Kornblith et al., 2019)), only the layer normalization layer (Houlsby et al., 2019) and bias- term fine-tune tuning (BiTFiT) (Zaken et al., 2022). We illustrate the differences in Equation (1): Wo, b are the pre-trained weights and biases, indicates trainable parameters, and the additional parameters.
[x:; W bo)
[(: W. b)
or fxx: (Z;W, bo 0
Wo: b)
(1)
pre-trained
full fine-tuning
model-aware finc-tuning
blas-term fine-tuning
Empirically, these parameter efficient fine-tuning methods have achieved high accuracy that is com- parable to the full fine-tuning in the standard non-private setting. For instance. linear probing of ResNet (He et al., 2016) and Vision Transformer (VIT. (Dosovitskiy et al., 2020)) achieves 80% accuracy the ImageNet dataset (Sun al., 2017; Korbllthh et al., 2019); LoRA and BiTFIT

---

Under review as a conference paper at ICLR 2023
of RoBERTa (Liu et al., 2019) and BERT (Kenton & Toutanova, 2019) achieve about 94% on SST2, 87% on MNLI, and on average 85% across the General Language Understanding Evalua- tion (GLUE) datasets (He al., 2021: Hu et al., 2021). In addition, parameter efficient methods are faster than full fine-tuning and save the communication cost significantly in the distributed learning.
Parallel to these developments, the success of deep learning models relies the availability of large datasets, which may contain sensitive information to be protected rigorously. This privacy issue is well-known for neural networks can be vulnerable to privacy attacks: membership information can be leaked from the purchase records via Google and Amazon online services (Shokri et al., 2017); sensitive texts can be reconstructed by specifically designed prefix on GPT2 (Carlini et al., 2021) and so can images in CIFARIO and MNIST (Haim et al.. 2022). To protect against such privacy risks, the standard technique is differential privacy (DP, formally stated in Definition 2. I), which randomizes the standard optimizers by updating with the private gradient in Equation (2).
recent line of work has extensively studied the DP fine-tuning in both computer vision and lan- guage tasks, often achieving less than 3% accuracy drop across different settings via full fine-tuning (De et al., 2022: Li et al., 2021; Bu et al., 2022b;a), linear probing (Mehta et al., 2022), LoRA, Adapter, or Compacter (Yu et al., 2021a). In fact, fine-tuning or pre-training from large dataset is considered necessary in the DP deep learning literature. As a matter of fact, full fine-tuning DP- GPT2 only achieves 24.2 BLEU score (c 8) on E2E dataset if randomly initialized (Li et al., 2021), in starking contrast to 63.2 BLEU if pre-trained; similarly, state-of-the-art (SOTA) DP accu- racy ImageNet is if pre-trained (De et al., 2022). Specifically, parameter efficient DP fine-tuning has empirically demonstrated strong accuracy (see our Table 4) with 3 4x memory saving and 3x speedup compared to DP full fine-tuning by Opacus (c.f. Figure 3 and Yu et al., 2021a, Table 3). Al- though previous works have shed light on various DP fine-tuning methods, we are the first to study DP-BiTFiT specifically and to show two distinctive advantages of it.
48% (c 10) without pre-training (Kurakin al., 2022) but 86.7% accuracy
BP Tall (Opatus))
Compacter
@RiTITT (son-DP)
Throughhut
TITT (1on-OP)
Maroory (GB)
139
DR BITAT
DP LORA
full Inon-OP)
Merrrry
Compacter
full GGhosnC001
DRSITT bF cor gatter
abP De Adapter
DF ful (Chneclion
Tal (n)
ail (Gvontiig
DRESTHI
Fine-tuned parameters (%)
Ane-luned parameters (%)
Fine-tuned parameters (56
Figure 1: Performance of different fine-tuning methods on MNLI dataset with RoBERTa-large.
Firstly, DP-BITF is model-agnostic and remains its parameter efficiency around 0.1% across mod- els by Table 1. While linear probing is also model-agnostic, the parameter efficiency can be as high as 8% in ResNet50. Other methods like LoRA, Adapter and Compacter are architecture-dependett and possibly parameter inefficient, making them difficult to directly apply on arbitrary neural net- works: LoRA and Adapter may need to train more than 12% on BART-large (Lewis et al., 2020) to achieve high accuracy by He et al. (2021, Figure 1& 4).
Secondly, DP-BiTFIT is computationally efficient, almost as much as the standard BiTFiT and significantly more efficient than DP full fine-tuning, particularly with large models and high- dimensional input data. For examples of DP full fine-tuning, Li et al. (2021) have reported 2 ~ 4x slowdown large language models for four advanced private codebases and up to 5x memory overhead, compared to the standard fine-tuning, even on small networks, 11 codebases across Ten- sorflow, JAX, and Pytorch have demonstrated 0.2 ~ 5x slowdown and 3 100x reduction in maximum batch size in Subramani et al. (2021). ). See more discussion in Section 3.3.
Contributions. In this work, we develop DP-BITFIT, fine-tuning method that is model-agnostic, accurate, privacy-,reserving, parameter efficient, and computationally efficient.
1. Algorithmically, we propose the Differentially Private Bias- Ters-Term&& Fine- Fine-Tuning (DP-BiTFiT) in Algorithm 1 that is highly accurate under DP constraint, on par with SOTA in Section 4. Spe- cially. we propose a two-phase training in Section 4.4 to close the accuracy gap between DP- BiTFIT and DP full-finttuning.
2

---

Under review as a conference paper at ICLR 2023
2. DP-BiTFiT is model-agnostic and only optimizes 0.1% of the model parameters on BERT, RoBERTa, GPT2, VIT, ResNet, and so on (see Table 1). Thus DP-BiTFiT one of the most parameter efficient fine-tuning methods among DP LoRA, Adapter, linear probing, etc.
3. We design a computationally efficient implementation of DP-BiTFiL whose time and space complexity almost the same as the standard non-DP BiTFIT, while being faster than non-DP full fine-tuning and other DP fine-tuning (see Figure 1). This advantage is analyzed in Table 2, and demonstrated via the substantial speedup and memory-saving in Figure and Figure 4.
4. DP-BiTFiT is the unique DP algorithm that has computation overhead independent of the feature dimension T'. This is due to the activation-free forward pass that only happens in the no-weight training". Therefore, DP-BiTFiT enjoys a special advantage to work efficiently on long-sequence texts and high-resolution images (see Figure 3).
Novelty. At a glance, our results may appear to be incremental as we are merely adding differential privacy to existing method (BiTFiT) through standard mechanism (DP-SGD). This is not true! Computationally, our implementation of DP-Bi BiTTFiT involves substantial algorithmic innovation that exploits the special structures in the forward and backward passes of the per-example gradient com- putation, hence removing the computational and memory overhead in DP-SGD. Statistically, it is quite surprising us that one achieve nearly the same accuracy in DP-fine tuning in both vision and language tasks when optimizing only 0.1 % of the parameters.
Algorithm Bias-Term TiminT (BiTFiT) v.s. DP-BiTFiT
Parameters: (-th layer's bias b, subsampling probability p. number of iterations T, number of layers L, noise scale a, clipping threshold Rt clipping factor C; (no clipping).
1: for iteration f 1, .... T do
2: Subsample batch B, S {I, (1, n from training set with probability p
3: for layer E L, L - 1, 1.... . do
4:
Get output gradient dc
ds
5:
Compute per-example gradient and its norm:
ac. Tb:
BCC. Det.
T
1
aL Tb:
6:
Aggregate gradient norms across all layers:
0bb
1/
Σ
0C,
7b;
7:
Compute clipping factor: C, = C(I 8C ||:: R)
8:
Compute sum of clipped gradients G = Σ, C Oc. 36
9:
Add Gaussian noise G G + a (0,
Descend on bias terms with the gradient G by SGD/Adam/...
2 PRELIMINARIES
Fine-tuning methods. Fine-tuning, i.e. training model on a large dataset for sufficiently long time, and then continuing to train (or transferring) onto the downstream datasets, is the standard paradigm to achieve high accuracy in both the standard and the DP regimes. In DP deep learning, the pre-training takes place on public dataset using regular optimizers like SGD, and the fine- tuning takes place on a private dataset which requires privacy protection, using DP optimizers like DP-SGD in Section 2.
In long line of research, various fine-tuning methods have been proposed. One of the most popular method is the full fine-tuning, which simply runs gradient descents on all trainable weights and biases, thus can be inefficient when the model is large. To improve the efficiency, Li & Liang (2021) proposes the prefix tuning that only optimizes the prompts or the input layer activation (Lester et al., 2021; Liu et al., 2021). However, as pointed out in Hu et al. (2021) and Li et al. (2021), the prefix tuning can be difficult to optimize and thus sub-optimal large models. Another approach is to
As summarized in Table 2 and Table 8, the computation overhead get the per per-sample weight gradient is linear (by instantiating per-sample gradints) or quadratic T (if using the ghost norm trick (Goodfel- low, 2015; Li et al., 2021). I)), for DP full and parameter efficient fine-tuning. We distinguish the weight training and hias training in Section 2 using the chain rules. Note that activation- free means memory-saving. which is not leveraged by DP full, LoRA, Adapter, Compacter, etc.
3

---

Under review as a conference paper at ICLR 2023
reduce the number of trainable parameters. For example, LoRA (Hu et al., 2021), Adapter (Houlsby
et al., 2019; Rebuffi et al., 2017; Pfeiffer et al., 2021; Rücklé et al., 2021; Lin et al., 2020) and Compacter (Mahabadi et al., 2021) insert small 'adapter' layers (usually 1-10% of total parameters) between existing layers, and only the newly added adapters are optimized. We describe the forms of LoRA and Adapter in Appendix C and analyze their complexity.
In addition to the aforementioned methods, BiTFIT is a special parameter-efficient method that rivals the full fine-tuning (Zaken et al., 2022: Cai et al., 2020; He et al., 2021). Firstly, BiTFiT optimizes a subset of original parameters - the bias terms, which usually constitute less than 1/1000 of all parameters as demonstrated in Table 1. Therefore, BiTFIT can be readily deployed any network in a model-agnoste manner. Secondly, BiTFiT is fundamentally different to other parameter efficient methods such as LoRA, since the bias gradients are computed differently than the weight gradients on the computation graph. We will elaborate on this in Equation (4).
Deep learning with differential privacy. We recall the classic (c, 5)-DP, under which we train deep neural networks with provably privacy guarantees.
Definition 2.1 ((Dwork et al., 2006)). A randomized algorithm M is (c, 8) -ddiffeernttially private if, for any two neighboring datasets S, S' that differ by one datapoint and for any event E, we have P[M(S) E E] < P [M (5") E E] +
In deep learning, DP can be achieved through applying an off-the-shelf optimizer (SGD or Adam) with a privately released stochastic gradient in place of the regular E, gs. The private stochastic gradient is computed by first getting minibatch I via Poisson sampling, then compute
Private gradient
Eier 9: :((ll:ll:: R) + toR NOO.I
(2)
where C' is any function R+ + R subject to C(x) < R/x. gi is the i-th per-sample gradient, R is the clipping threshold, and a is the noise multiplier. The private gradient is guaranteed to be DP through the sampled- sampled-Gaussian Gaussian mechanism and the associated tight privacy accounting to compose over the iterations (see, e.g., Abadi et al., 2016; Wang et al.. 2019; Mironov et al., 2019; Koskela et al., 2020; Bu et al., 2020; Gopi al., 2021, and the references therein.).
Backward propagation. We briefly introduce the pack-propagation which reveals a simple yet important difference between the gradients of weights and those of biases. We consider a linear layer, indexed as the 1-th layer, with weight Wi E Rdxp and bias as b: E RP. We leave the derivation of other layers such as normalization and convolution in Appendix A. We denote the mini-batched input of this layer as Og E RBxTxd and the immediate output as 8; E BxTxx where B is the batch size and T is the feature dimension*: a++1 = o(s)), 8) = a, Wi + b,. Here é is any non-paramttric inter-layer operation, c.g. the non-linear activation (like RcLU), pooling, padding, and so on.
We write L = E L; as the total loss and L, as the per-sample loss of the i-th sample. During a standard back back-propagation of L layers, the chain rule keeps track of the output gradiens at each layer in just-in-time fashion:
Oc Oc
daL
0sL
sast1
Oc 0sl41
W1+1 o ('s)).
(3)
0s:
dar.
dst.-1
dai.11
dsi
This output gradient
Oc is used to compute per-sample gradient of weights and biases, 0s;
Oc, T Oc,
ac T
OC," bb.
OL:
0ii Oc
ari:
Σ
1.
(4)
OW, Ösi.j OW.
db.
Notably, the weight gradient needs the activation tensor a; to compute an expensive (dTTpd tensor multiplication. Memory-wise, {ai} across all layers is very costly store (taking more than 95% memory across VGG, ResNet, DenseNet, RoBERTa, etc. by Jain et al. (2020, Figure 3)). In
2 Examples of gradient clipping include hut not limited Abadi's clipping min( R/ ////l111111 1) (Abadi et al., 2016) and automatic clipping (AUTO-S) R/(llg: II 0.01) (Bu et al., 2022b; Yang et al., 2022). 'In sequential data such text, T is the sequence length; in vision data, T the product of input dimensions (c.g. for images, T is the product of height and width). We refer high-dimensional input when T' is large.
4

---

Under review as a conference paper at ICLR 2023
sharp contrast, the computation of bias gradient does not need ais and the multiplication with 1 in Equation (4) actually a cheap OBBTp) summation on DC Da: B x
x p.
Forward propagation and the hook. During the forward propagation, all Pytorch-based codebases for DP algorithms such as Private Transformers, Opacus, FastGradClip, and others (Yu et al., 202 Bu et al., 2022a) register the forward hooks to extract the activation tensors {at of all layers from the computation graph, where a; computed and stored. Hence, the majority of memory burden is on the activation that grows extremely large for huge models like GPT3 (Brown et al., 2020) with 175B parameters: the activation tensors consume parameters and gradients only consume 300GB (Rajbhandari et al., 2020). On one hand, this issue can be alleviated by the activation recomputation or checkpointing technique (Chen al., 2016; Jain al., 2020), whose memory cost reduces from (L) O with extra 33% slowdown. Alternatively, we note that the activation tensors are not necessary in the forward propagation, if we only optimize the bias terms.
than 3600GB of memory while the
DIFFERENTIALLY PRIVATE
FINE-TUNING
We propose DP-BITFiT, to privately train only the bias terms in neural network by combining Equation (4) and Equation (2). We use shaded lines to represent the additional DP operations in Al- gorithm 1, and add DP-related variables and operations in red in the computation graph by Figure 2.
M
SWy
INC
201
Figure 2:
Back-propagee pack-propagation for DP (red&black) and non-DP (black) algorithms. Left: full fine- tuning with GhostClip (ghost clipping; (Goodfellow, 2015; Li et al., 2021; Bu et al.. 2022a)). Upper right: full fine-tuning with Opacus (Yousefpour al., 2021). Lower right: BITFIT.
Implementation-wise DP-BiTFiT is different from all existing DP algorithms (including full, LoRA, Adapter, etc.) that optimize weights, since it does not apply a Pytorch forward hook to store the activation a₁ for all layers. We provide the implementation details of DP-BiTFiT in Appendix B. To give a concrete example, we apply DP-BiTFiT to the RoBERTa-large model on QQP dataset, following the same setting as Li et al. (2021) and using one 40GB A100 GPU. This is the most time- consuming text classification task in our work, taking 119 minutes per epoch for training batch size 20 using the fastest DP full fine-tuning implementation GhostClip (Li et al., 2021). To conduct simple ablation study, setting all weights to not require gradients (but forward hooks are still operating) reduces the training time by 50% to to 80 minutes; removing the forward hooks further reduces the training time by 30% to minutes; finally, using the maximum batch size allowed by the memory-savine DP- BP-B reduces to 43 minutes.
3.1 PARAMETER EFFICIENCY
DP-BITFIT enjoys exactly the same parameter efficiency as the standard BiTFIT, training merely about 0.1% of the total parameters in large models. We demonstrate that DP-BITFIT is one of the most parfieter-efficient fine-tuning through a list of models in Table extended in Table 12.
5

---

Under review as a conference paper at ICLR 2023
An advantage of this parameter efficiency is re- flected in the computation efficiency, given that
Dataset
Model
of params % of params
VGG16
138M
0.009
most parameters do not require gradients to be
ResNet18
11.7M
0.043
computed: we show in Table 2 and Section 3.3 that DP-BiTFiT is much more efficient than full fine-tuning (DP and even non-DP). Additionally, the parameter efficiency also translates to the com- munication efficiency in the distributed learning. For example, the 64-bit communication cost of DP full fine-tuning is 64M where M is the number of worker and D the total number of parame- ters, which can be improved to 0.064MM by DP- BiTFiT.
ImageNet
ResNet50
25.6M
0.113
Vil-smmll-patch16
21.7M
0.238
ViT-base-paich
85.8M
0.120
ViT-large-patch16
303M
0.090
GPT2-small
124M
0,082
E2E
GPT2-mcdium
355M
0.076
GPI2-large
774M
0.066
RoBEKIa-base
125M
0,083
GLUE
RoBFRTa-large
355M
0.077
Table 1:
Parameter efficiency of (DP) BТTFIT.
3.2 COMPLEXITY OF WEIGHT AND BIAS TRAINING
We present in Table 2 the complexity of DP training on weights and biases, for one layer mapping B x Ti x di B x Ti Pt- To elaborate on Footnote for text data, Ti is the sequence length, d; is input dimension, and is output dimension; for image data and specially in a convolution layer, Ti height times width, di is the input channels times kernel sizes, pt is the output channels (c.f. Bu et al., 2022a, Section 2.3). Notice that the total complexity of training network is summed across all layers, e.g. the time complexity of standard full training is 6B Σ, Tipidk, DP full fine-tuning over 8B >, Tipids, and DP-BiTFiT is about 4B E, Tip:di. Therefore, complexity analysis indicates that DP-BiTFiT is 6/4 = 1.5x faster than non-private full fine-tuning and over 8/4 = 2x faster than DP full fine-tuning.
forward &output grad
weight training
bias training
non non-DP DP
Opacus
GhostClip
MixGhostClip p2BTpd
non- DD (ours)
Time
+25Tpd
+217Tpd
complexity
4BTpd
2BT
(2
(p (2BT
d), 2BTpd)
BTp
-3Bp
Space
pd+
BT(p + d)
+ BBd
+2BT2
-miin2B22 2pdd
+ Bp
complexity
BT(p d)
back-prop
Torward hook
x
Table 2:
Per-layer time and space complexity of training weights (full fine-tuning) and biases.
'+' means additional overhead to non-DP training, and *() means between two values.
Here, the DP weight training (full fine-tuning) three efficient implementations that equiv- alent mathematically but have different complexity: Opacus (Yousefpour et al., 2021), GhostClip (Goodfellow, 2015; Li al., 2021), and MixGhostClip (Bu al., 2022a). The first two imple- mentations are illustrated in Figure 2. of which MixGhostClip is hybridization that reduces to GhostClip when T is small. These implementations have been thoroughly analyzed in (Bu et al., 2022a, Appendix C), and we take the complexity result from Bu et al. (2022a, Table 1). For the complexity of bias training in Table 2, it suffices to analyze Line 5 of Algorithm We refer the interested readers to Table 8 for details, where we also apply the complexity analysis of weight training on other methods beyond full fine-tuning, including DP LoRA and DP Adapter.
3.3 SCALABILITY OF DP ALGORITHMS
From the complexity analysis in Table 2, we observe that DP training on weights can be memory costly, especially when the models are large and the data is high-dimensional. As an example of the large modelling issue, Li et al. (2021) shows that Opacus cannot fit even single datapoint into 16GB GPU using GPT2-large (Radford et al.) with 774M parameters, due its O Prd,) space complexity where the number of parameters is 2, Ptd;; for high-dimensional data, GhostClip cannot fit a single 400 x 400 image into the same GPU using 18 with 11.7M parameters, due to its O(B Σ, I?? space complexity. Although MixGhostClip (Bu al., 2022a) significantly alleviates the memory issue in both cases, does so at a cost of roughly 2x slowdown than the standard full fine-tuning (c.f. Bu et al., 2022a, Figure 4). In sharp contrast, DP-BiTFIT is amazingly scalable since its computational overhead is negligible and independent of (though the total complexity, mainly due to forward and output gradient, still linear 7').

---

Under review as a conference paper at ICLR 2023
Efficiency of DP training v.s. feature dimension To empirically evaluate the computation effi- ciency of DP fine-tuning methods, we measure the time and GPU memory for fixed batch size. We depict the high high-dimensional data issue in Figure 3, in which the memory saving and speedup by DP-BiTFiT substantial. We expect to observe greater efficiency advantage of DP-BiTFiT on higher dimensional data, e.g. in document-level language tasks with T 20000 by Beltagy al. (2020), and in high-resolution image tasks, such as 1024 x 1024 CelebA-HQ (Karras et al., 2018) and Flickr-Faces- (Karras et al., 2019) where T can be of order 10 in the convolution layers.
Hangoy 1p0
soverta
Figure 3: Memory and speed by different fine-tuming methods. Left two: SST2 dataset (sequence
length T; MixGhostClip is equivalent to GhostClip for this small T) with RoBERTa- and batch size 20. Right two: 50000 images of vT VT pixels with ResNet50 and batch size 200.
Efficiency of DP training v.s. model size To stress-test the computation efficiency of DP-BiTFiT with large models, apply the maximum batch size with respect to each fine-tuning method, in- stead of using a fixed one across different methods. Therefore, DP-BiTFiT can further leverage its memory efficiency to achieve the best throughput. Here we consider a setting of high-dimensional data (T' 512²) but small ResNet (11.7 ~ 58.2M parameters) and the other setting of low- dimensional data (T 100) but large GPT2 (125 774M parameters).
OPIITTT pfiui
NEV2FERIT
slancle
Netterilieguaa cft WINT
suid CerelORRiT
Figure 4: Maximum throughput and batch size by different fine-tuning methods. Left two: E2E dataset with GPT2-smal//medium/larg (MixGhostClip equivalent GhostClip for this small T).
Right two: 50000 images of 512 x 512 pixels with ResNet 50/101/152.
EXPERIMENTS
We now test the accuracy DP-BiTFiT on natural language and computer vision tasks, with the settings in Appendix D. For DP full fine-tuning algorithms, we use GhostClip (Li et al., 2021) on texts, and MixedGhostClip (Bu et al., 2022a) on images, which achieve SOTA efficiency and accuracy these datasets respectively. We compute using conversion from RDP though tighter privacy accountants in Section 2 are feasible. We illustrate Table that tuning the learning rate for BiTFIT is not difficult. And observe in all experiments that, with without DP, the optimal learning rate for BiTFIT larger than that for full fine-tuning.
DP-BITFIT
full
non-DP
full
Tearning rate
5c-4
Ie-3
2c-3
5e-3
1c-2
lc-4
2c-4
5e-4
1c-3
lc-5
2c-5
5e-5
1c-4
RoBeRTa-base
90.94
91.28
91.74
92.43
90.94
91.51
91.97
92.43
91.28
93.92
94.38
94.49
93.35
RoBERTa-large
94.38
95.07
94.38
94.50
94.04
94.84
94.72
94.61
92.66
95.76
96.21
96.21
95.99
Table 3: Test accuracy on SST2 under
8, using AP-Adam with AUTO-S clipping.
4.1 TEXT CLASSIFICATION
We experiment on ANLI-m(misnog (Williams et al., 2018), QQP (lyer et al., 2017). QNLI (Ra- jpurkar et al., 2016), and SST2 datasets (Socher et al., 2013). Competitive algorithms include repa- rameterized gradient perturbation (RGP, (Yu et al., 2021c)), LoRA, Adapter and Compacter (Yu et al., 2021a). We the same setup as Li et al. (2021) RoBERTa models, only increasing the learning rate for DP-BiTFiT. Additional results with different clipping functions and under a stronger privacy guarantee 3 can be found in Table 13.

---

Under review as a conference paper at ICLR 2023
Full
RGP
Adapter
LoRA
BITFI Ours
Compacter Yu et al., 2021a)
et al., 2021) Yu et al., 2021a) Yuu al., 2021a) (2211))() (Yu 2021a)
Additional params networks
Forward caching activations
RoBERTa-
(25M)
% of trainable params
100%
100%
1.4%
0,94%
0.083%
0.055%
Standard
DF
DP
DP
standard
DP
standard
DF
DP
Accuracy SST2
94.5
92.1
91.6
92.5
95.1
93.5
92.3
Accuracy QNLI
91.4
87.9
87.2
87.5
93.3
87.3
87.3
86.5
85.1
Accuracy QQP
87.3
86.1
85.5
85.6
90.8
85.7
86.1
83.4
84.7
Accuracy MNLI-m
85.9
83,4
87.5
83.4
82.6
RoBERTa large (355M)
of trainable params
100%
100%
1.%%
0,94%
0.077%
0.053%
standard
DP
DP
DP
standard
DP
standard
DP
DP
Accuracy SST2
96.2
93.8
93.0
93.9
96.2
95.3
93.3
94.3
94.2
Accuracy QNLI
93.6
90.7
94,9
92.2
90.2
Accuracy QQP
87.9
87.5
86.7
86.3
91.6
87.4
87.9
86.5
86.2
Accuracy MNLI-m
90.3
87.0
86.
87.7
90.6
87.8
89.3
87.6
87.5
Table 4:
Accuracy of fine-tuning methods with RoBERTa, under c = 8.
More non-private fine-
tuning results (similar here) can be found in (Yu et al., 2021a; Hu et al., 2021; Zaken al., 2022).
Note that linear probing of RoBERTa-base only gets 87.2% on SST2 and 77.3% on QNLI.
In Table 4, DP-BiTFIT is highly parameter efficiency and on-par with other DP fine-tuning in terms of accuracy. As indicated by Figure and Figure 3, over 2x speedup and over 3x memory saving is observed, when switching from DP full fine-tuning to DP-BiTFiT across datasets.
Remark 4.1. It encouraging to observe that the gap between the full fine-tuning and BiTFiT, with or without DP, tends decrease as the model size increases. For instance on QNLI, this gap without privacy reduces from 4.1% to 1.4%, and with privacy reduces from 1.4% to 0.1%. This scaling pattern is consistently observed on different tasks, e.g. in Table 5 and Table 6.
4.2 NATURAL. LANGUAGE GENERATION
We compare DI-BITFTT with DP LoRA, full fine-tuning, and prefix tuning (Li & Liang, 2021) on E2E dataset (Dusek et al., 2020), in order to train GPT2 that generates texts to evaluate restaurant. The performance measures are BLEU (Papineni al., 2002), ROGUE-L (Lin, 2004), NIST (Sadjadi et al., 2018), METEOR (Banerjee & Lavie, 2005), CIDEr (Vedantam et al., 2015) and perplexity. We the same setup Bu et al. (2022b) with automatic clipping, only increasing the learning rate for DP-BiTFiT. More results under a stronger privacy guarantee e = 3 can be found in Table 14.
Model
Fine-tuning % of params
Privacy standard
Perplexity
BLEU ROGUE-L1 NISTI
METEOR1
CIDErt
2.91
69.46
71.36
8.78
(1.66
2.42
full
100%
DP
8)
2.33
63.60
67.07
7.71
0.40
1.94
LoRA
standard
69.68
71.71
8.82
U.45
2,49
GPT2-small (124M)
(r = 8)
63.39
67.53
7.45
0.41
1.95
standard
70.81
8.72
0.45
2.35
prefix
DP 8)
49.26
60.73
5.53
0.36
1.57
standard
3.19
64.46
63.67
4.25
0.36
1.36
BIFFIT
0.082%
(e 8)
2.89
60.13
64.96
6.14
0.37
1.62
standard
2.08
68.50
71.46
8.63
0.45
2.14
full
100%
GPT2-medium
DP (c 8)
2,25
64.22
67.53
8.17
0.42
2.08
(355M)
BIFFTT
0.076%
standard
2.85
64.48
67.81
8,50
U.43
2.11
DP (c 8)
2.67
61.02
66.13
7.18
0.39
1.80
standard
1.79
66.84
70.38
8.73
0.46
2,36
GPT2-large (774M)
full 100%
DP (E 8)
2.26
64.64
68.97
8.30
0.42
2.16
standard
2.79
65.79
67.61
8.55
0.43
2.21
BITFTT
0.066%
(r 8)
2.59
65.21
67.88
8.43
0.42
2.15
Table 5: Performance of fine-tuning methods with GPT2, under e = 8. LoRA and prefix results are documented in Li et (2021). Best performance in each model is in bold text.
In Table 5, DP- has shown strong performance, even outperforming DP full fine-tuning GPT2-large, as well as both the computation and parameter efficiency (see Figure 4). Similar to Remark 4.1, the gap of BLEU score between DP-BiTFiT and DP full fine-tuning reduces from 3.06/-3.20 (GPT2-small/medium) to +0.57 (GPT2-large), as the model size increases. We refer to Table 14 for more significant pattern when 3.
8

---

Under review as a conference paper at ICLR 2023
4.3 IMAGE CLASSIFICATION
We further experiment with DP-BiTHR on CEFAROOCIFARROO (32 x 32 pixels, resized to 224 x 224) and CelebA (218 x 178 pixels, not resized) after pre-training on ImageNet (224 224 pixels). Unlike language tasks, DP-BiTFiT can be less satisfactory, e.g. inducing 30% test accuracy gap in CelebA [Smiling] classification in Table 6, though this gap often be closed by increasing the model size, similar to Remark 4.1. Alternatively, we can leverage two-phase training to interpolate between full fine-tuning and BiTFiT in the next section.
Daiaset
Model
Fine Lune-tuning
Accuracy
CIFARTB DP-B/TPI
OF full
et al., 202
ResNet152
probing
(Tramer & Bonch. 2020)
SIMCLRv2
linear probing
92.7
10.0
98.3
98.0
97.3
CIFARIO (f le-5)
(De 2022)
Wide-ResNetA
lincrr probing
93.6
c=4
13.8
98.2
98.0
97.5
Wide-ResNet28
full
95.4
98.5
97.8
emesvii- base 240
full
96.1
CIPARLOO BITRIT
2+BTTEIT DP full
(Bu et al.,, 2022a)
vii base puich16
full
94.4
vi-laage-pucch16
full
98.0
c=2
88.7
89.3
88.7
tressvit-hsee-00
BIFFI
79.3
c=4
100
89.7
89.7
89.6
Ours
vit base putch16
BITFFT
90.7
c=
vit-large- 1atch--atcch66
BITFIT
95.5
Table 7: Accuracy of two-phase
CelebA [Smiling] =5e-)
(Bu et al., 2022bb
ResNei18
ResNet9
full
91.02
training (ours) and full fine-
Ours
ResNet9
BITHT
61.15
tuning by Bu al. (2022a) with
ResNet18
BITFIT
90.83
BEiT-large (Bao et al., 2021).
al., 2022b)
ResNet9
CelebA [Male] 8,6 65
ResNet18
full
95.15
Ours
ResNe19
BITFTT
70.10
CelebAA [Multi-aheel] (e c 8, 55--6
(Bu al.,, 20122b
ResNet18
ResNet9
full
Tull
87,58
88.38
DF fal
ResNety
BIIFIT BITFIT
82.04
ResNet18
86.24
Table 6: Accuracy of DP fine-tuning methods on CIFARIO and CelebA. More results under different and network architectures can be found in Appendix E.3.
020
675
Epoch
180
120
275
Figure 5: Accuracy by epochs
with BEiT-large on CIFAR100.
4.4 TWO-PHASE TRAINING: INTERPOLATING BETWEEN FULL FINE-TUNING AND BITFIT
We introduce the two-phase training, denoted as ++BTTI, which firstly applies DP full fine- tuning for X epochs then DP-BiTFiT for the rest of training. Hence, X+BTTFi becomes DP full fine-tuning when X equals total epochs, and reduces to DP-BiTFiT when X = 0. Empiri- cally speaking, it suffices use X S 2 to achieve comparable accuracy full fine-tuning, while still enjoying the speedup. The effectiveness of two-phase training is verified in Table 7 and Ap- pendix E.3. ++BiTFiT outperforms previous SOTA by DP full fine-tuning (Bu et al., 2022a) that used BarT-large: CIFARIO 97.1% + 98.8%; CIFARI00 86, 2% + 88.7%, under 2. 2+BiTFiT comparable to previous SOTA, 87.05/87.5887 87.5%% + 86.54 ///8/6..11. 71% on CelebA Table 17, under 3/8.
5 DISCUSSION
In this work, we study DP-BiTFiT to privately train only the bias terms of neural networks. The high- light of DP-BiTFiT the accuracy, the parameter efficiency and the computation efficiency, which is realized by not forward caching the activation tensors, and not back-propagating the gradient of weights. This consequently allows DP-BiTFiT to be as fast and memory-savinn as its non-prion non-private counterpart, thus particularly suitable for large models and high-dimension data.
For future directions, DP-BiTFiT can be readily combined with prefix-based tuning and weights- based fine-tuning, e.g. DP Adapter+BiTFiT and DP LORA+BiTFiT, via f(æ; Wo. b, 0) using the notation in Equation (1). Specifically, such combination can decide whether weight and/or bias should be fine-tuned a layer-wise manner. For instance, we can optimize only the embedding layer (which has no bias terms) and all bias terms in other layers. We expect this interpolating approach between full fine-tuning and BiTFiT, in parallel to our two-phase training. to circumvent the limitation that DP-BiTFiT is sometimes sub-optimal on small models difficult tasks.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Satanjeev Banerjee and Alon Lavie. METEOR: An automatic metric for MT evaluation with improved correlation with human judgments. In Proceedings of the ACL Workshop on In- trinsic and Extrinsic Evaluation Measures for Machine Translation and/or Summarization, pp. 63-72, Ann Arbor, Michigan, June 2005, Association for Computational Linguistics. URL https:/ / www.ww... aclweb. org/ hatpooooyyy///--0000000
Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers. In International Conference on Learning Representations, 2021.
Iz Beltagy, Matthew E Peters, and Arman Cohan. Longformer: The long-documan transformer.
arXiv preprint arXiv:2004.051 /50, 2020.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J Su. Deep learning with gaussian differential privacy. Harvard data science review, 2020(23), 2020.
Zhiqi Bu, Jialin Mao, and Shiyun Xu. Scalable and efficient training of large convolutional neural networks with differential privacy. arXiv preprint arXiv:2205. 10683, 2022a.
Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Automatic clipping: Differentially private deep learning made easier and stronger. arXiv preprint arXiv:2206.07/ 2022b.
Han Cai, Chuang Gan, Ligeng Zhu, and Song Han. Tinytl: Reduce memory, not parameters for efficient on-device learning. Advances in Neural Information Processing Systems, 33:11285- 11297, 2020.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 27), pp- 2633-26530 2021.
Tianqi Chen, Bing Xu, Chiyuan Zhang, and Carlos Guestrin. Training deep nets with sublinear memory cost. arXiv preprint arXiv: 2016.
Soham De, Leonard Berrada, Jamie Hayes, Samuel I. Smith, and Borja Balle. Unlock- ing high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204. 13650, 2022.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An im- age is worth 16x16 words: Transformers for image recognition at scale. In International Confer- ence on Learning Representations, 2020.
Ondrej Dusek, Jekaterina Novikova, and Verena Rieser. Evaluating the State-of-the-AAe of End-to- End Natural Language Generation: The E2E NLG Challenge. Computer Speech & Language, 59:123-156, January 2020. doi: 10.10166f.ss..219906..
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. (64- Springer, 2006.
Ian Goodfellow. Efficient per-example gradient computations. arXiv preprint arXiv: 2015.
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. Advances in Neural Information Processing Systems, 34, 2021.
10

---

Under review as a conference paper at ICLR 2023
Priya Goyal, Piotr Dollár, Ross Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, An- drew Tulloch, Yangqing Jia, and Kaiming He. Accurate, large minibatch sgd: Training imagenet in 1 hour. arXiv preprint arXiv:1706.0222 2017.
Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks. arXiv preprint arXiv:2206. 07758, 2022.
Junxian He, Chunting Zhou, Xuezhe Ma, Taylor Berg-Kirkpatrick, and Graham Neubig. Towards a unified view of parimeter-efficient transfer learning. In International Conference on Learning Representations, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, An- drea Gesmundo. Mona Attariyan, and Sylvain Gelly, Parameter-efficient transfer learning for nlp. In Interaational Conference on Machine Learning, pp. 2790-2799. PMLR, 2019.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang. and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint
arXiv:2106.0966 096855 2021.
Shankar Tyer,
Nikhil Dandekar, and Kornel Csernai. First quora dataset release: Question pairs, 2017.
URL nttps://datt quora.uuuo.......... com/
Sarst-Quora-a Dataaa-Datttttteeeeeeeeeee
CuasstionPPaii
Paras Jain, Ajay Jain, Aniruddha Nrusimha, Amir Gholami, Pieter Abbeel, Joseph Gonzalez, Kurt Keutzer, and Ion Stoica. Checkmate: Breaking the memory wall with optimal tensor rematerial- ization. Proceedings of Machine Learning and Systems, 2:497-511, 2020.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. In International Conference on Learning Representations, 2018.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedingy of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4401-4410, 2019.
Jacob Devlin Ming- Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. Proceedings of NAACL-HLT, pp. 4171- 4186, 2019.
Simon Kornblith, Jonathon Shlens, and Quoc V Le. Do better imagenet models transfer better? In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 2661- 2671, 2019.
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight differential privacy guarantees using fft. In International Conference on Artificial Intelligence and Statistics, pp. 2560-2569. PMLR, 2020.
Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward training at imagenet scale with differential privacy. arXiv preprint 122338, 2022.
Jaewoo Lee and Daniel Kifer. Scaling up differentially private deep learning with fast per-example gradient clipping. arXiv preprint arXiv:2009.03 106, 2020.
Brian Lester, Rami Al-Rfou and Noah Constant. The power of scale for parameter-efffcient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Pro- cessing, pp. 3045-3059, 2021.
11

---

Under review as a conference paper at ICLR 2023
Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. Bart: Denoising sauuence-t-ssqueene pre- training for natural language generation, translation, and comprehension. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 7871-7880, 2020.
Quentin Lhoest, Albert Villanova del Moral, Yacine Jernite, Abhishek Thakur, Patrick von Platen, Suraj Patil, Julien Chaumond, Mariama Drame, Julien Plu, Lewis Tunstall, Joe Davison, Mario Sasko, Gunjan Chhablani, Bhavitvya Malik, Simon Brandeis, Teven Le Scao, Victor Sanh, Can- wen Xu, Nicolas Patry, Angelina McMillan-Major, Philipp Schmid, Sylvain Gugger, Clément Delangue, Théo Matussière, Lysandre Debut, Stas Bekman, Pierric Cistac, Thibault Goehringer, Victor Mustar, François Lagunas, Alexander Rush, and Thomas Wolf. Datasets: community library for natural language processing. In Proceedings of the 2021 Conference Empirical Methods in Natural Language Processing: System Demonstrations, pp. 175-184, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguisties. URL https: / /cc wewelannhooooooo
ogy org/ 2021.002222 emn 1p -d-mmo.... 21.
Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.0011 2021.
Xuechen Li, Florian Tramer, Perey Liang, and Tatsunori Hashimoto. Large language models can be
strong differentially private leamers. arXiv preprint arXiv:2/ 2021.
Chin-Yeu Lin, ROUGE: package for automatic evaluation of summaries. In Texr Summarization Branches Out, pp. 74-81, Barcelona, Spain, July 2004. Association for Computational Linguis- tics. URL https: : / www. aclweb. org/ anthology/hhhcecc (atolooyyy/4440000
Zhaojiang Lin, Andrea Madotto, and Pascale Fung. Exploring versatile generative language model via parameter-efficient transfer learning. In Findings of the Association for Computational Lin- guistics: EMNLP 2020, pp. 441-459, 2020.
Xiao Liu, Yanan Zheng, Zhengxiao Du, Ming Ding, Yujie Qian, Zhilin Yang, and Jie Tang. Gpt understands, too. arXiv preprint arXiv:21033 10385, 2021.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv: 1692, 2019.
Rabeeh Karimi Mahabadi, James Henderson, and Sebastian Ruder. Compacter: Efficient low-rank hypercomplex adapter layers. arXiv preprint arXiv:2 (0V:2100.006477 2021.
Harsh Mehta, Abhradeep Thakurta, Alexey Kurakin, and Ashok Cutkosky. Large scale transfer learning for differentially private image classification. arXiv preprint 200iv:2205.02973, 2022.
Ilya Mironov, Kunal Talwar, and Li Zhang. Rényi differential privacy of the sampled gaussian mech- anism. arXiv preprint arXiv: 100.00000000 2019. URL /ttp:://axiis org/ 10530.
Sinno Jialin Pan and Qiang Yang. A survey on transfer learning. IEEE Transactions on knowledge and data engineering, 22(10): 1359, 2009.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei jing Zhu. Bleu: a method for automatic evaluation of machine translation. pp. 3-1318 2002.
Jonas Pfeiffer, Aishwarya Kamath, Andreas Rücklé, Kyunghyun Cho, and Iryna Gurevych. Adapter- fusion: Non-destructive task composition for transfer learning. In 16th Conference of the Euro- pean Chapter of the Associationfor Computational Linguistics, EACL 2021, pp. 487-503. Asso- ciation for Computational Linguistics (ACL), 2021.
Boris T Polyak and Anatoli B Juditsky. Acceleration of stochastic approximation by averaging. SIAM journal on control and optimization, 30(4):838-885) 1992.
Siyuan Qiao, Huiyu Wang. Chenxi Liu, Wei Shen, and Alan Yuille. Micro-batch training with batch- channel normalization and weight standardization. arXiv preprint arXiv: /903. /0520, 2019.
12

---

Under review as a conference paper at ICLR 2023
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners.
Samyam Rajbhandari, Jeff Rasley, Olatunji Ruwase, and Yuxiong He. Zero: Memory optimizations toward training trillion parameter models. In SC20: International Conference for High Perfor- mance Computing, Networking, Storage and Analysis, pp. 1-16. IEEE, 2020.
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. Squad: 100,000+ questions for machine comprehension of text. arXiv preprint (6K6:0660.0525500 2016.
Sylvestre-Alvise Rebuffi, Hakan Bilen, and Andrea Vedaldi. Learning multiple visual domains with residual adapters. Advances in neural information processing systems, 30, 2017.
Andreas Rücklé, Gregor Geigle, Max Glockner, Tilman Beck, Jonas Pfeiffer, Nils Reimers, and Iryna Gurevych. Adapterdrop: On the efficiency of adapters in transformers. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp. 7930-7946, 2021.
Seyed Omid Sadjadi, Timothee Kheyrkhah, Audrey Tong, Craig S Greenberg, Douglas A Reynolds, Elliot Singer, Lisa Mason, Jaime Mrnnandzz-Cordene et al. The 2017 nist language recognition evaluation. In Odyssey, pp. 82-89, 2018
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference at- tacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Ng. and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language pro- cessing, pp. 1631-1644 2013.
Pranav Subramani, Nicholas Vadivelu. and Gautam Kamath. Enabling fast differentially private sgd via just-in-time compilation and vectorization. Advances in Neural Information Processing Systems, 34, 2021.
Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta. Revisiting unreasonable ef- fectiveness of data in deep learning era. Proceedings of the IEEE international conference on computer vision, pp. 843-852 2017.
Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much more data). arXiv preprint arXiv:2011. 1660, 2020.
Ramakrishna Vedantam, C Lawrence Zitnick and Devi Parikh. Cider: Consensus-basee image description evaluation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4566-4575, 2015.
Yu-Xiang Wang. Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled rényi differential privacy and analytical moments accountant. In International Conference on Artificial Intelligence and Statistics, pp. 1226-1233 PMLR, 2019.
Adina Williams, Nikita Nangia, and Samuel Bowman. A broad-coverage challenge corpus for sen- tence understanding through inference. In Proceedings of the 2018 Conference of the North Amer- ican Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers), pp. 1112-1122. Association for Computational Linguisties, 2018. URL http: //tp////cw.../////. org/ anthology /N18- 11C1.
Xiaodong Yang, Huishuai Zhang, Wei Chen, and Tie- Yan Liu. Normalized/clipped sgd with per- turbation for differentially private non-convex optimization. arXiv preprint arXiv:2206.14 13033, 2022.
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj. Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in PoTchc. arXiv preprint arXiv:2109. /2298, 2021.
13

---

Under review as a conference paper at ICLR 2023
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. arXiv preprint arXhv:2110.06500. 2021a.
Da Yu, Huishuai Zhang, Wei Chen, and Tie-Yan Liu. Do not let privacy overbill utility: Gradient embedding perturbation for private learning. In International Conference on Learning Represen- tations, 2021b. URL https: / //tpr//eeeeeeeeeeeee net/ forum?iG=7aog011 V_YO..
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Large scale private learning via low- rank reparametrization. In International Conference on Machine Learning, pp. 12208-12218. PMLR, 2021c.
Elad Ben Zaken, Yoav Goldberg, and Shauli Ravfogel. Bitfit: Simple parameter-effcient fine-tuning for transformer-basee masked language-models. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pp. 1-9, 2022.
14

---

Under review as a conference paper at ICLR 2023
A
DETAILED ANALYSIS OF BACK-PROPAGATION
We rigorously analyze the neural network represented in Section 2: for sample index i E [B].
1
$1,
b
(5)
RTXP
R7xd ReXP
BTX1
RIxy
Then the per- per-sample weight gradient given by the chain rule as
T
Σ dL: T Üsi.j
0L: T ÖSi. OC; T ai 081,
0C
oW;
d8s ow,
dsg aW, ds
a1,
in which the second equality holds when there is no parameter sharing (so that each per-sample loss only depends on i-th input and output). The last equality holds for the same reason.
Similarly, have the per-sample bias gradient
OC,-
QC, T 081. OC,
08L. ab.
dC,
0C 1.
bb;
Ø8L. Ub: Öst.i
Ö8t,i
Ø8
We additionally demonstrate that bias gradient is independent of the input at, on the convolution (Id/2d/3d) and the normalization layers. For the convolution, is the inversely folded output and a; is the unfolded input, then the forward pass is the same as that of linear layer in Equation (5). Notice that T' is the product of hidden feature dimension (c.f. Bu al. (2022a)), which depends on the padding, kernel sizes, strides, etc. For the batch, layer, group, and instance normalization, the forward pass is
a1 B(a))
81,1
W,+ + 1- b
Var(a:) a)) ) + 0.00001
which can be analyzed similarly to that of Equation (5).
B IMPLEMENTATION OF DP-BITFIT
In this section we describe the implementation of DP-BiTFiT, which only uses Pytorch backward hook but not the forward hook, and thus is different from existing packages such as FastGradClip Lee & Kifer (2020), Opacus Yousefpour al. (2021), Private Transformers Li et al. (2021), Private CNN Bu et al. (2022a). Notice that in these packages, the forward hook is used to store the activation tensor a, for all layers, which incurs huge memory burden discussed in Section 2.
The Pytorch backward hook is a function, to be registered on a torch Module (or a layer in the neural network), that will be executed in the backward propagation. The backward hook automatically extracts the input gradient Day
&c and the output gradient &C of the layer.
Øs:
In DP-BITFiT, we call register backward hook to register a backward hook for Line 5 of Algorithm 1, An example for linear layer: RBxxxd TR BxTxp looks like
def book Litinerr_lyyes grad_input,
sinesr_iayer.bier www.bbbaassgaaannge.....sss linear_ www.yy.bass.grr................. somple..ommmmmmmmee..eoo.om. dim=1) batp:r__ayar.bbs..a....
grad_outpus .sum (dim=1)
Here the attribute horm-sampl le stores the per-sample gradient norm öb;
0c;
and the attribute
grad sample stores the R Rxp per-sample gradient of bias.
Then the implementation of DP-BiTFiT for one iteration looks like
put (Input)
loss=T.crom wtw.sccooseettcce enpo (outpat,1aben))
autograd. gradd hieses)
all all_layer_noree sample torch.stack [[param.nonrtta nerm_sample for param biases], dimm0) .norm 12, dimm0)
hatpping_factoreeee for layer in model.modules ():
bayer.bfas.graditte einsum ("i, i.........., el clipping factor, layer, layer.biag, biaa. aiia..rad__aaa grad_sample) opt aptimiser.zero_greee
where bi ases the collection of all bias terms in all layers.
15

---

Under review as a conference paper at ICLR 2023
C COMPLEXITY ANALYSIS
We provide more details on analyzing the time and space complexity. The analysis for full fine-tuning has been presented in (Bu et al., 2022a, Appendix C) and adapted here for the parameter efficient fine-tuning: for example, Adapter Houlsby et al. (2019) uses two matrices Wdown E RPxr, Wap E R'*P that constitute
x x GeLU(x Wdown) W
Hence the complexity, in comparison full-finetuning, changes by replacing + 2r. LoRA Hu et al. (2021) also uses two matrices Wdown Rdxxr Wup E Rrxp that constitute
8- x W + x Wdown Wup
Hence the complexity, in comparison full-finttuning, changes by replacing pd r(p d).
forward &output grad
weight training
bias training non DP (ours)
non-DP
DP full (Opacus)
DP LORA
DP Adapter
Time complexity
4BTpd
pT
+2
+p + dr)
+4BTpr
BTp
+3Bp
Space
pd + BTd
BT
+Bpd
+B(pr dr)
+2Bpr
+Bp
complexity
# back-prop
forward hook
Table 8: Per-layer time and space complexity of training weights (full and parameter efficient fine-tuning) and biases. '+' means additional overhead to non-DP training.
For per-sample bias gradient clipping, we need SC. ac T in Equation (4), which consists of Bet.
Rb;
the per-sample gradient instantiation (i.e. summation along the feature dimension, from TR -> IR", BC BL1), and computing the per-sample gradient norm (i.e. taking the square each index dst,
and summing all indices). Here each operation in italic takes Bp time complexity, meaning the total time complexity is 3Bp, but the space complexity is Bp if operated in in-place.
D EXPERIMENT DETAILS
D.1 LANGUAGE TASKS
Throughout this work, the text datasets are processed and loaded from Huggingface Lhoest et al. (2021). We follow the same setup as Li et al. (2021); Bu et al. (2022b), such as ö = 0.5 x sample size. The full fine-tuning is implemented by Private Transformers codebase, version 0.2.0 (i.e. GhostClip algorithm Li et al. (2021)).
For text classification, experiment four datasets: MNLI(m), the matched splits from Multi- Genre Natural Language Inference Corpus; QQP, the Quora Question Pairs2 dataset; QNLI The Stanford Question Answering dataset; SST2 The Stanford Sentiment Treebank dataset.
To give a fair comparison, we use the same optimizer as in Li et al. (2021), i.e. DP-Adam with Abadi's clipping.
Dataset
MNLI
QQP
QNLI
SST2
epoch
18
18
3
batch size
6000
6000
2000
1000
clipping threshold R
0.1
DP learning rate
full 5c-4 / BiTFiT 5e-3
non-DP learning rate
full Se-5 BiTFIT 1e-3
max sequence length
256
Table 9: Hyperparameters of text classification in Table 4 and Table 13, using RoBERTa (base/large).
16

---

Under review as a conference paper at ICLR 2023
For E2E generation task, experiment GPT2 models using the same optimizer in Bu et al. (2022b), using DP-AdamW with automatic clipping.
Model
GPT2-small
GPT2-medium
GPT2-large
epoch
I0
batch size
1024
DP learning rate (full)
2e-3
2e-3
2e-3
non-DP learning rate (full)
2c-4
lc-4
le-4
DP learning rate (BiTFIT)
le-2
non-DP learning rate (BiTHIT)
2e-3
learning rate decay
No
max sequence length
100
Table 10: Hyperparameters of E2E generation task in Table and Table 14, using GPT2.
D.2 IMAGE TASKS
We give the experiments settings for image classification. For CIFARIO and CIFAR100, we use the same setting Bu al. (2022a), e.g. epochs for CelebA, we use the same setting as Bu et al. (2022b), c.g. 10 epochs.
and 3 epochs for BEiT-large. For
We use DP-Adam with Abadi's clipping. We do not apply tricks such as random data augmentation, weight standardization Qiao et al. (2019), or parameter averaging Polyak & Juditsky (1992). Our experiments are heavily based on Private CNN (i.e. MixGhostClip algorithm Bu et al. (2022a)) and TIMM codebases.
Dataset
CIFARIO
CIFARIO
CIFARIO0
CelebA
Model
CiossViT
BEiT-large
BEiT-large
ResNet18
epoch
10
batch size
1000
1000
1000
500
clipping threshold
0.1
DP learning rate (full)
le-3
DP learning rate (BiTFiT)
5e-3
learning rate decay
No
normalizing data
Yes
Yes
Yes
No
Table 11: Hyperparameters of image classification task in Section Table 15,Table 16,Table 17.
17

---

Under review as a conference paper at ICLR 2023
E
ADDITIONAL TABLES AND FIGURES
E.
PARAMETER EFFICIENCY DP-BITFIT
Model
Number of params % of params
VGGII
133M
0.009
VGG16
138M
0.009
VGG19
144M
0.010
88
11.7M
0,043
ResNet34
21.8M
0.044
ResNet50
25.6M
0.113
ResNet101
44.5M
0.121
ResNet152
60.2M
0.127
wide_resnet500_2
68.9M
0.051
Wide_resnet101_2
126.9M
0.055
convnext_
88.6M
0.148
convnext large
197.8M
0.099
ViT-small-patchh
22.0M
0.238
1
86.6M
0.120
ViT-large-patch16
304M
0.090
beit_
beit.base-patchI6.22 6__22
86.5M
0.088
deit.base.patchle
86.4M
0.120
GPT2-small
124M
0.082
GPT2-medium
355M
0.076
GPT2-large
774M
0.066
RoBERTa-base
125M
0.083
RoBERTa-large
355M
0.077
BERT-base-uncased
109M
0.094
BERT-large-uncased
335M
0.081
BART-large
406M
0.082
Longformer-base-44ee
149M
0.088
longformer-lrge-40096
435M
0.080
Table 12: Parameter efficiency of (DP) BiTFiT on various models.
E.2
MORE RESULTS ON DP-BITFIT AND LANGUAGE TASKS
full (Li et al., 2021: : Bu et al., 2022h)
BiTFiT (ours)
RoBERTa-base
standard
DP Abadi
AUTO
DP Abudi
DPAtadi
DP AUTOOO standard DPAbadi
Abadi
AAATOO 8
DP
Abudi
DP AUTO
8
8
6
3
3
8
3
3
Accuracy SST2
94.5
92.1
92.4
92.3
93.5
92.4
92.4
92.0
92.0
Accuracy QNLI
91.4
87.9
87.9
87.4
86.9
87.3
86.5
86.7
86.4
86.1
Accuracy QQP
87.3
86.1
86.6
85.6
85.8
86.1
83.4
84.0
83.0
83.8
Accuracy MNLI-m
85.9
83.2
83.8
82.5
83.2
83.4
82.6
82.6
81.5
82.0
RoBERTa -lrgg
standard
Ahod 8
DAAUTO
DP Ahudi
DP PAATTO
standard
DP Ahaai < 8
DPAUTO 8
DP
DP DAAUTo
8
3
3
3
3
Accuracy SST2
96.2
93.8
94.6
93.0
93.9
95.5
94.5
94.7
94.5
94.6
Accuracy QNLI
93.6
91.1
91.5
90.8
91.0
92.2
91.0
91.1
90.3
90.8
Accuracy QQP
87.9
86.9
87.5
86.6
86.8
87.9
86.5
87.1
86.3
86.5
Accuracy MNLI-m
90.3
87.0
87.1
86.4
86.3
89.3
87.6
87.7
87.2
87.2
Table 13: Accuracy of full fine-tuning and BiTFiT with RoBERTa, under different per-sample clip- ping functions (indicated as subscript, Abadi Abadi et al. (2016) and AUTO-S Bu et al. (2022b)). Same setting as Appendix D.
18

---

Under review as a conference paper at ICLR 2023
Model
Fine-tuning
% of params
Privacy
Perplexity. 2.91
BLEUT
ROGUE-LT
NISTT
METEORT
CIDERT
full
100%
DP 8)
standaad
2.33
63.60
09.46
71.30
67.07
8.78
7.71
0.40
0.46
2.42
1.94
2.36
7.07
0.39
1.80
GFT2-small (124M)
LoRA
DP 9)
standard
69.68
71.71
8.82
7.45
0.41
0.46
2.49
1.95
DP 3)
58.15
65.77
5.46
0.37
1.58
prefix
Standard
68.83
70.81
8.72
0.45
2.35
DP (c
49.26
60.73
5.53
0.36
1.57
DP (c
47.77
58.96
5.25
0.36
1.51
0.082%
standard
3.19
64.46
63.67
4.25
0.36
1,35
DP (c 8)
2.89
60.13
64.96
6.14
0.37
1.62
3,00
4.78
0.34
2.08
0:45
full
100%
GPT2 medium (355M)
DP (c 8)
2.25
64.22
67.53
8.17
0.42
2.08
BiTFAT
0.076%
standard
2.85
64.48
67.81
8.50
0.43
2.11
(c 8)
2.67
7.18
DP (E 3)
2.67
57.11
66.16
5,07
0.37
1.47
standard
1.79
66.84
70.38
8.73
0.46
2,36
GPT2-large (774M)
full 100%
DP (c 8)
2.26
64.64
68.97
8,30
0.42
2.16
DP (c 3)
2.65
64.18
67.86
7.94
0.40
2.01
BITFT
0.066/8
Standaadd
2.79
65.79
67.61
8.35
0.43
DP (c 8) 2.59
65.21
67.88
8.43
0.42
2.15
DP (c 3)
2.61
65.18
67.90
8.34
0.42
2.12
Table 14: Accuracy of fine-tuning with GPT2 on E2E dataset. LoRA and prefix results are taken from Li et al. (2021). Same setting as Appendix
E.3 MORE RESULTS ON TWO-PHASE TRAINING
CIFARIO
Model
Privacy DP-
OP-BiTFiT
+BiTFIT 2+ BiTFIT
DP full
beit large patch16 224
<=
11.7
98.2
97.9
97.2
= 2
10.0
98.3
98.0
97.3
6 = 4
13.8
98.2
98.0
97.5
6 = 8
10.1
98.5
98.0
97.8
beit_base, heit_base_pacch 16 62224
6
10.0
96.6
96.0
95.4
6 2
10.7
97.1
96.4
96.0
4
14.0
97.2
96.6
96.2
6 = 8
10.0
97.2
96.5
96.3
deit base patch16 224
6 =
78.2
94.4
95.2
95.4
6 = 2
75.0
95.4
95.2
95.6
6 =
72.9
95.8
95.9
96.0
E 8
71.2
96.1
96.0
96.3
crossvit_base.co .240
6 1
74.3
92.4
94.3
95.2
6 = 2
80.4
93.6
95.0
95.3
é 4
81.0
94.9
95.8
95.7
6 8
78.2
94.8
95.8
96.2
vit caarcl-patchllee 224
6 é 2
89.7
98.9
98.7
98.9
90.6
98.8
98.9
98.9
4
93.2
98.9
98.8
99.0
6 = 8
93.9
99.0
98.9
99.0
base patch16 16 224
E = 1
86.7
95.2
97.0
96.8
é = 2
89.3
97.7
97.1
97.1
6 =
88.3
97.7
97.2
97.2
88.7
97.6
97.2
97.4
Table 15: Accuracy of two-phase fine-tuning on CIFAR10. Same setting as Appendix D.2 except VIT uses the following learning rate: DP full fine-tuning 5e-4, DP-BiTFi 5e-3.
19

---

Under review as a conference paper at ICLR 2023
CIFAR100
Model
Privacy DP-BiTFIT
BITTFIT
BiTFIT
DP full
beit large w 224
c=
1.0
86.9
87.8
87.0
= 2
1.0
88.7
89.3
88.7
6 =
1.0
89.7
89.7
89.6
8
1.0
90.3
90.7
90.0
beit.base.patchl1... 1.2224
e 2
1.0
81.4
82.2
80.9
1.0
83.4
83.4
83.1
6 = 4
1.0
84.6
85.1
84.8
6 = 8
1.0
84.9
85.6
85.2
deit base patch 224
6 =
10.9
49.1
65.9
69.1
6 = 2
13.6
58.1
71.5
74.3
4
15.7
64.5
73.9
77.1
6 8
16.6
69.7
75.7
77.9
crossvit.base.240
6 = 1
12.2
49.2
61.7
67.6
e 2
12.3
56.8
65.3
71.6
e =
17.2
61.6
70.4
73.1
6 8
20.9
63.4
72.8
74.2
vit_ 224
14.0
73.5
86.0
87.7
2
19.4
82.4
89.0
90.1
é = 4
24.3
87.5
89.9
91.0
6 = 8
23.9
89.0
90.7
91.3
bit_ caaeee_ptchl66 6 224
= 1
16.0
64.3
79.5
83.9
e = 2
22.9
77.0
83.8
85.5
e 8
21.2
83.0
85.2
87.2
26.2
83.8
86.5
87.1
Table 16: Accuracy of two-phase fine-tuning CIFAR100, Same setting Appendix D.2 except ViT uses the following learning rate: DP full fine-tuning 5e-4, DP-BiTFiT 5e-3.
20

---

Under review as a conference paper at ICLR 2023
DP-BiTIFT
1+BiTEST
2+BITHIT
DP full
DR-BITEST
1+BITFiT
2+BiTHIT
DP full
Attributes
o Clock Shadow
90.01
90.01
90.14
91.32
90.01
90.01
90.31
91.64
Arched Eyebrows
71.56
73.12
76.01
77.33
71.56
73.74
75.49
Attractive
68.71
75.99
79.22
69.70
73.61
76.20
78.08
Bags Under Eyes
79.74
79.76
81.27
81.73
79.74
79.74
80.69
82.62
Bald
97.88
97.88
97.88
97.93
97.88
97.88
97.88
97.91
Bangs
84.43
94.06
84.43
Big Lips
67.30
67.30
67.30
67.78
67.30
67.30
67.29
68.34
Big Nose
78.80
78.95
80.08
81.19
78.80
78.92
79.23
81.86
Black Hair
72.84
74.86
82.37
85.84
73.02
78.71
83.33
86.47
Blond Hair
89.54
93.28
94.17
92.62
93.88
94.34
Blurry
94.94
94.94
94.94
95.05
94.94
94.94
94.96
95.10
Brown Hair
82.03
82.02
82.87
85, 44
82.03
82.37
83.49
85.04
Bushy Eyebrows
87.05
87.05
87.21
88.26
87.05
87.05
87.15
89.02
Chubby
94.70
94.70
94.70
94.84
94.70
94.70
94.70
94.78
Double Chin
95.43
95.43
95.43
95.49
95.43
95.43
95.43
95.39
Eyeglasses
93.54
93.54
93.54
94.30
93.54
93.54
93.54
95.85
Goatee
95.42
95.96
95.42
95.42
95.42
95.89
Gray Hair
96.81
96.81
96.85 85
97.44
96.81
96.81
97.12
97.45
Heavy Makeup
76.51
82.76
85.71
88.48
77.22
83.03
85.86
89.05
High Checkhones
62.13
68 20
81.63
83.77
61.43
67.27
81.33
84,20
Male
91.52
94.73
82.04
88.52
92.14
95.19
Mouth Slightly Open
54,03
59.32
77.61
86.75
55.26
60.70
79.42
90.24
Mustache
96.13
96.13
96.13
96.10
96.13
96.13
96.13
96.12
Narrow Eyes
85.13
85.13
85.13
85.14
85.13
85.13
85.13
85.16
Beard
85,37
85.88
88.59
Oval Face
70.44
70.94
71.50
73.11
70.44
71.48
71.92
71.77
Pale Skin
95.79
95.79
95.79
95.79
95.79
95.79
95.79
95.79
Pointy Nose
71.43
71.51
71.63
71.89
71.43
71.47
71.77
72.87
Receding Hairline
91,51
91.51
91.51
91.51
91.51
91.51
Rosy Checks
92.83
92.83
92.86
93.07
92.87
92.83
92.86
93.33
Sideburns
95.36
95.36
95.36
96.44
95.36
95.36
95.36
96.63
Smiling
66.32
89.
58.92
65.97
85.55
89.11
Straight Hair
79.01
79.01
79.02
79.65
79.01
79.01
79.13
78.60
Wavy Hair
71.24
73.09
76 76.22
77.35
70.86
73.62
77.11
72.73
Wearing Earrings
79.34
79.34
80.37
83.24
79.34
79.34
80.71
84.36
Wearing Hat.
Wearing Lipstick
80.61
87.90
89.81
91.59
80.35
87.20
89.56
91.94
Wearing Necklace
86.21
86.21
86.21
86.21
86.21
86.21
86.21
86.21
Wearing Necktic
92.99
92,99
93.03
93.58
92.99
92.99
93.11
93.57
Young
75.71
83.69
75.71
78.52
80.66
Average
82.97
84.42
86.54
88.20
83.01
84.52
86.71
88.38
Total time
10:30
12:02
13:34
25:50
10:30
12:02
13:34
25:50
Table 17: Accuracy on CelebA dataset with settings in Appendix D.2 from one run. DP full fine- tuning is implemented with the most efficient MixGhostClip algorithm Bu et al. (2022a).
21


Reviews:
[{"review_id": "kW5FVkXCKV", "reviewer": "Reviewer_7D3z", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposed to do DP fine-tuning on only the bias terms of the model. It analyzes the computational efficiency and demonstrated the empirical advantage of the proposed method.", "summary_of_the_review": "The idea is simple, yet it seems to work pretty well in some cases and the computational efficiency is also good.", "strength_and_weaknesses": "Strength:\nThe idea seems interesting and the result on large models seem encouraging.\n\nWeakness:\nMaybe the authors can investigate and elaborate more on when and why the proposed method would work.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ABw-YU-sqt", "reviewer": "Reviewer_dhPA", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on the problem of differentially private fine-tuning of large pre-trained models, which is the most prevailing DP learning paradigm in the era of large machine models. Specifically, the authors propose to use differentially private bias-term fine-tuning (DP-BiTFiT) as a new parameter-efficient DP fine-tuning paradigm. They demonstrate that the proposed method has the following advantages: \n(1) DP-BiTFiT is model-agnostic\n(2) DP-BiTFiT has its parameter efficiency around 0.1% across different pretrained models in computer vision and natural language processing. \n(3) DP-BiTFiT is computation efficient and almost removes the overhead introduced by DP, which makes the algorithm scalable to larger models with long-sequence texts or high-resolution images\n(4) DP-BiTFiT matches the similar performance of state-of-the-art DP fine-tuning algorithms.\nThe authors conduct comprehensive studies over the model parameter efficiency, training time and space complexity, and the scalability of the DP algorithms, and empirically compare with the state-of-the-art DP fine-tuning methods on larger language models and computer vision models across different tasks under different privacy constraints.\n", "summary_of_the_review": "Strengths:\n1. The paper is clearly written and easy to follow\n2. The complexity analysis and comparison is technically sound\n3. The empirical experiments on memory and time complexity improvements look convincing to me\n\n\nWeakness:\n1. The novelty is still limited. \n2. Accuracy drop compared to the state-of-the-art DP fine-tuning methods. \n3. Unclear insights on two-phase training. \n", "strength_and_weaknesses": "Strengths:\n1. The paper is clearly written and easy to follow\n2. The complexity analysis and comparison is technically sound\n3. The empirical experiments on memory and time complexity improvements look convincing to me\n\nWeakness:\n1. The novelty is still limited. While I acknowledge the authors’ clarification in Introduction and appreciate their efforts in the comprehensive experiments they have done, the proposed DP-BiTFiT is still a simple adaptation of BiTFiT to DP fine-tuning by adding gradient clipping and gaussian noise. \n2. Despite the training efficiency and memory usage improvement, there is some accuracy drop compared to the state-of-the-art DP fine-tuning methods. While most of the accuracy gap is subtle and acceptable, the accuracy of DP-BiTFiT in Table 7 is a bit confusing to me, where the accuracy can be as low as 1% or 11%, and two-phase training must be used to alleviate the issue. This raises my concern about whether the proposed DP-BiTFiT is a general framework that works for every method/model/dataset.\n3. Unclear insights on two-phase training. While Table 7 has shown promising results when interpolating full fine-tuning and BiTFiT, the authors seem not to provide enough insights on why combining these methods can achieve both better efficiency as well as better accuracy. Moreover, practical and principled guidance on when and how to employ two-phase fine-tuning is missing.\n\n\nAdditional question:\nSince there is some accuracy gap between DP-BiTFiT and state-of-the-art DP fine-tuning methods, have you applied the two-phase training method to close the gap or even improve the accuracy?\nI am willing to increase my score if my concerns are well addressed.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "6x2-7Vs2nU0", "reviewer": "Reviewer_maoM", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper considers applying bias-term fine-tuning (BiTFiT) to DP large model training. They describe efficient implementations of (DP)-BiTFiT and demonstrate that the time and space complexity of these implementations improves both over non-DP and DP full model training. They then give a deep empirical study of BiTFiT and its effectiveness in terms of accuracy and efficiency. They demonstrate that:\n-For many problems, DP BiTFiT only needs to train ~.1-.2% of the model parameters.\n-DP BiTFiT has a memory footprint and throughput that are 2-8 times better than other SOTA algorithms.\n-BiTFiT's accuracy only is worse by a few percentage points in tasks where the SOTA accuracy ranges from 60-95%, when compared to full model training, even for large (100s of millions of parameters) models. Furthermore, DP BiTFiT demonstrates the same behavior and in some cases even outperforms DP full model training.", "summary_of_the_review": "Overall I weakly recommend accepting the paper. I think the paper provides a lot of intuition for a promising algorithm for practice, and may enable training much larger models with DP fine-tuning than what was previous possible, so the paper has much potential for impact. The writing and content of the paper meets the bar for acceptance in my opinion, for the reasons listed in the previous sections. However, I am hesitant to give the paper a higher score because of the limited originality. Again, I don't view this as a weakness; I still feel the paper is a quality paper ready for publication at a conference, and that having more exploratory papers such as this one to guide practice is a good thing for the community in general. However, based on the reviewing criteria, this paper may not compare favorably to a paper proposing a novel approach that also has high impact and good quality.\n\n---\nComments for authors:\nRemark 4.1: I guess, the idea is that as the number of parameters increases, the fraction of them that BitFiT trains is decreasing, and so it is a relatively weaker algorithm. So if accuracy were \"one-to-one\" measure of how strong an algorithm is, one would expect the gap to increase with the number of parameters. But increasing accuracy generally gets more difficult as model size/baseline accuracy approaches 100% (i.e., going from 90 to 95% accuracy for one architecture could actually be easier than going from 98 to 99% for a larger architecture, even though it is a \"smaller gap\"), and the accuracy gap decreasing could just be explained by this phenomenon. So this remark feels slightly misleading to me. \n\nIn contrast with the previous comment, I think Table 5 which shows DP BiTFiT starts to outperform DP full fine-tuning at large # of parameters is one of the most interesting results of the paper and it was easy to miss on first read since this is sort of bundled in with Remark 4.1 by the text, but in my view it's really demonstrating something very different and promising. I might suggest emphasizing this more in the paper, space permitting. It makes a lot of sense, since DP suffers from curse of dimensionality, but I'm not aware of any past works that show that reducing the dimension of the optimization problem actually shows benefits in an empirical result (without assuming something like a low-rank gradient subspace), much less one where the way of reducing the dimension is so simple to describe.", "strength_and_weaknesses": "I think the main strength of the paper is that it is pretty comprehensive as an empirical exploration of the benefits of using (DP) BiTFiT for model training. The authors run many different sets of experiments, and each set of experiments is fairly comprehensive. Another strength is how well the authors present the math-based motivation for using DP BiTFiT. e.g. I thought the explanation at the bottom of Section 4 on why computing gradients of bias only is more efficient, Figure 2 visualizing back-propagation for several algorithms simultaneously, and Section 3.2 where the authors show BiTFiT has improved space and time complexity over other approaches all demonstrated a great deal of effort by the authors to make conceptually understanding the paper much more digestible. Finally, the results in the paper show a lot of promise for guiding large model training with DP in practice. e.g., I think the fact that DP FiTBiT actually improves over full model training when the number of parameters is large enough for some problems strongly demonstrates the potential of the approach. \n\nI think the main weakness of the paper is that, as the authors mention, BiTFiT is a method introduced in a previous paper. While the authors do provide a more efficient implementation of DP-BiTFiT than the naive baseline, beyond that there is not much algorithmic novelty in the paper. That being said, the original BiTFiT paper is relatively short and doesn't provide nearly as much insight into the algorithm both theoretically and empirically as this paper, so I think this is less of a weakness and more of a lack of a certain strength. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject