Towards hyperparameter-free optimization with differential privacy
Authors: Ruixuan Liu
Zhiqi Bu
Venue: ICLR 2025 Spotlight (2025)
Keywords: Differential privacy
optimization
hyper-parameter tuning
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We introduce a hyperparameter-free differential privacy training method that automatically adjusts the learning rate, reducing the need for extra tuning efforts in a privatized, efficient, and scalable manner for language and vision tasks.

Abstract: Differential privacy (DP) is a privacy-preserving paradigm that protects the training data when training deep learning models. Critically, the performance of models is determined by the training hyperparameters, especially those of the learning rate schedule, thus requiring fine-grained hyperparameter tuning on the data. In practice, it is common to tune the learning rate hyperparameters through the grid search that (1) is computationally expensive as multiple runs are needed, and (2) increases the risk of data leakage as the selection of hyperparameters is data-dependent. In this work, we adapt the automatic learning rate schedule to DP optimization for any models and optimizers, so as to significantly mitigate or even eliminate the cost of hyperparameter tuning when applied together with automatic per-sample gradient clipping. Our hyperparameter-free DP optimization is almost as computationally efficient as the standard non-DP optimization, and achieves state-of-the-art DP performance on various language and vision tasks.

Published as a conference paper at ICLR 2025
TOWARDS HYPERPARAMETER-FREE OPTIMIZATION WITH DIFFERENTIAL PRIVACY
Ruixuan Liu
Zhiqi Bu
Emory University
Amazon
ruixuan. 1iu20 1iu2@emozy.eer
woodyx218@gmaii
ABSTRACT
Differential privacy (DP) is a ing data when training deep learning models. Critically, the performance of mod- els is determined by the training hyperparamcters, especially those of the learn- ing rate schedule, thus requiring fine-grained hyperparameter tuning the data. In practice, it is common to tune the learning rate hyperparameters through the grid search that (1) is computationally expensive as multiple runs are needed, and (2) increases the risk of data leakage as the selection of hyperparameters is data- dependent. In this work, we adapt the automatic learning rate schedule to DP optimization for any models and optimizers, so as to significantly mitigate or even eliminate the cost of hyperparameter tuning when applied together with automatic per-sample gradient clipping. Our hyperparameter--fre DP optimization is almost as computationally efficient as the standard non-DP optimization, and achieves hate-offtheeart DP performance various language and vision tasks.
paradigm that protects the train-
INTRODUCTION
The performance of deep learning models relies on proper configuration of training hyperparam- eters. In particular, the learning rate schedule is critical to the optimization, may lead to divergence, while a small learning rate may slowdown the converge too much to be useful. In practice, people have used heuristic learning rate schedules that are controlled by many hyperparameters. For example, many large language models including LLaMa2 (Touvron et al., 2023) uses linear warmup and cosine decay in its learning rate schedule, which are controlled by hyperparameters. Generally speaking, hyperparameter tuning (especially for multiple hyperparam- eters) can be expensive for large datasets and large models.
large learning rate
To address this challenge, it is desirable or even necessary to determine the learning rate schedule in an adaptive and data-dependent way, without little if any manual effort. Recent advances such as D-adaptation (Defazio & Mishchenko 2023), Prodigy (Mishchenko & Defazio 2024), DoG (Ivgi ct al. 2023). DoWG (Khaled et al. 2023), U-DoG (Kreisler et al. 2024), and GeN (Bu & Xu 2024 have demonstrated the feasibility of automatic learning rate schedule, with some promising
empirical results in deep learning (see a detailed discussion in Section 2.3
While data-dependent learning rate evolving in the standard non-DP regime, the adaptive data dependency can raise the privacy risks of memorizing and reproducing the training data. As an example, we consider the zeroth-order optimizer (ZO-SGD),
Wi+1 w. T/zo-SGD
where w. is the model parameters, 2, is a random vector that is independent of any data, and TZ0-SGD aL z, IR is the effective learning rate, with L being the loss value. In Malladi effectively optimize models such as OPT 13B~60B in the few-shot
et al. (2023). SGD and many-shot settings. Hence, by using an adaptive hyperparameter 120o-GGD the models are able to learn and possibly memorize the training data even if the descent direction is intt-inneeendent. In fact, the private information can also leak through other hyperparameters and in other models,
"qqual contribution. This work does relate ZB's position Amazon.

---

Published as a conference paper at ICLR 2025
where outlier datapoint can be revealed via the membership inference attacks in support vector machines (Papernot & Steinke 2021).
Specifically, in the regime of deep learning with differential privacy (DP), the privacy risks from the non-DP hyperparameter tuning could render the privacy guarantce non-rigorous. In practice, most work has leveraged the DP optimizers Abadi al. (2016) to offer the privacy guarantee, where the privatization only on the gradients, but not on the hyperparameters such as the clipping threshold
Rg and the learning rate 7). A common approach is to trial-and-error on multiple (Ra.) ?) pairs and
select the best hyperparameters, as showcased by (Li et al. 2021; Kurakin et al. 2022 in Figure g
At high level, there are approaches accommodate the privacy risk in hyperparameter tuning: (1) The more explored approach is to assign a small amount of privacy budget to privatize the hyper- parameter tuning. Examples include Renyi-DP tuning (Papernol & Steinke 2021). ). DP-Hypo (Wang
et al. 2023). DP-ZO-SGD (Tang et al. 2024 Liu et al. [202]] [ et al.) and many more (Liu & Talwar 2019 Panda et al. 2024] Koskela & Kulkarni 2023). However, these methods may suffer
from worse performance due to larger DP noise addition from the reduced privacy budget, high computation overhead. (2) The less explored approach is to adopt hyperparameter-free methods. For instance, (Bu et al.) 2023b Yang et al. (022) replace the per-sample gradient clipping with the per-sample gradient normalization (i.e. setting Rg = 0+), so as to remove the tuning of the hyperparameter R, in DP optimizers.
In this work, we work towards the hyperparameter-fiee optimization with DP, by adapting learning- rate-free methods in DP optimization:
Vanilla:
Wi+1 = un; 'mnamual
(Eies min Rg Taill
1]9: + a Rg²
DP-SGD
Hyperparameter--fee:
Eier Tgll 0z
Wr+1 w. -GGeNDDP
(1)
Our contributions are summarized follows:
1. We propose HyFreeDP, hyperparameter-free DP framework that rigorously guarantees DP on the hyperparameter tuning of (Ry. m)), and works with any optimizer.
2. We apply the loss privatization to leverage GeN learning rate under DP, with specific auto-regressive clipping threshold R; that aims to minimize the clipping bias.
3. We give an end-to-end privacy accounting method that adds 1% more gradient noise, while accurately capturing the loss curvature to determine the adaptive learning rate.
4. We show the strong performance and high efficiency of our method empirically.
PRELIMINARIES AND RELATED WORKS
2.1 DIFFERENTIALYY PRIVATE OPTIMIZATION
Overview of DP optimization. We aim to minimize the loss E, L(w,2; where w E Rd is the model parameters and x; is one of data points with 1 S i S N. We denote the per-sample gradient as g: (w) = aL(w.x.) E IRd and the mini-batch gradient at the th updating iteration as m, E Rd; dw
for batch size B < N.
B
m Rg og) = Σ
cs (Rg)g, + to z,l/B B
(2)
1) is the per-sample gradient clipping crappin factor (Abadi et al. 2016 De et al. 2022) with R, being the clipping threshold.
where 2g AN Ia) is the Gaussian noise, and (R,)) =
In particular, m, reduces to the standard non-DP gradient E; g:/B when og 0 and Rg is suffi- ciently large (i.c., no clipping is applied). The clipped and perturbed batch gradient becomes the DP gradient mppe whenever og 0, with stronger privacy guarantee for larger og.. On top of m, models can be optimized using any optimizer such as SGD and AdamW through
W w. 77 G. (1g.)
(3)
2

---

Published as a conference paper at ICLR 2025
in which G2 is the post-processingg such as momentum, adaptive pre-conditioning, and weight decay.
Haper-paraaeetes matter for DP optimization. Previous works (De et al.) 2022; Li et al. 2021) reveal that the performance of DP optimization is sensitive to the hyper-parameter choices. On the one hand, DP by itself brings extra parer-raramtters. such as the gradient clipping threshold Rg. making the tuning more complex. An adaptive clipping method (Andrew et al.) (02T) proposes to automatically learn Rg at each iteration, with an extra privacy budget that translates to worse accuracy. There are methods that do not incur extra privacy budget. Automatic clipping (or per- sample normalization) (Bu et al. 2023b Yang et al. 2022) uses C; 1/ to replace the Rg- dependent per-sample clipping, and thus removes the hyperparameter Rg from DP algorithms. On the other hand, hyper-pane parameter tuning for DP training has different patterns than non-DP training and cannot borrow previous experience on non-DP. For example, previous works (Li et al. 2021 et al. 2022) observe that there is no benefit from decaying the learning rate during training and the optimal learning rate can be much higher than the optimal one in non-DP training.
2.2 END-TO-END DP GUARANTEE FOR OPTIMIZATION AND TUNING
However, hyper-parameter tuning enlarges privacy risks (Papernot& & Steinke 2021). and it is neces- sary to provide end-to-end privacy guarantee for DP. There are two existing technical paths to solve this problem:
Multiple runs with multiple choices of hyper- syper-parameters. and choose from these choices in DP manner (Mohapatra et al. 2022 Papernot & Steinke, 2021; Wang et al.] [202]] Liu Talwar 2019). This path requires some knowledge to determine the choices a priori and consumes significant privacy budget well as computation due to the multiple runs. For instance, (Liu & Talwar 2019) showed that repeated searching with random iterations satisfies (3c, O)-DP if each run O).
Making DP optimization hyper-parameter free, and only single run is needed. For ample, the automatic clipping (Bu et al.) 2023b; Yang et al.] (2022) climinates the hyper- parameter Rg. Our work follows the second path, aiming resolve tuning r7-the the last critical hyper-parameter- by finding a universal configuration across datasets and tasks.
2.3 AUTOMATIC LEARNING RATE SCHEDULE
Automatic learning rate schedules (also known as learning-rate-fier parameter- free methods) have demonstrated promising performance in deep learning, with little to none manual efforts to select the learning rate, Specifically, D-adaptation (Defazio Mishchenko 2023), Prodigy (Mishchenko & Defazio 2024), and DoG (Ivgi et al. 2023) (and its variants) have proposed to estimate ~ GVT distance, G is the Lipschitz continuity
D
where D Wo w-ll is the waw.iiiattooottmmnmiiii constant, and T is the total number of iterations. These methods have their roots in the convergence theory under the convex and Lipschitz conditions, and may not be accurate when applied in the DP regime when the gradient is noisy. In fact, the estimation of D and G' can deviate significantly from the truth when e small and the number of trainable parameters is large, i.e. the DP noise in gradient is large, as shown in Table 2
Along an orthogonal direction, GeN (Bu Xu 2024) leverages the Taylor approximation of loss to set the learning rate 7GGN, without assuming the Lipschitz continuity or the knowledge of D. Given any descent vector m, omitting the iteration index for a brief notation, we can use the GeN learning rate in (4) to approximately minimize L:
1 T argmin, I(w) - G mij + m Hm 2
(m))
argmin, L(w Legmin,,L(w.
17m)
(4)
m T Hm
in which G = aL is the gradient and H LL is the Hessian matrix. Notice that because L is approximated by quadratic function, the minimizer MaaN is unique and in closed form.
aw
aw
Numerically, 7JeNN can be computed up to any precision by curve fitting or finite difference. Under the non-DP regime, given series of 7 and loss values L(w m)m.). Bu & Xu (2024) obtains the
3

---

Published as a conference paper at ICLR 2025
numerator and denominator of Meen by solving the problem in 5
nº 2
Hm, G m argmin b.b Σ L(w n.m) [[ww) by: +
(5)
Nevertheless, directly applying these non-DP automatic learning rate scheduler with DP gradient in 2 and using IGGN( (m) will violate DP, because the learning rate estimation is obtained from forward passes on batches of private data. We defer the explanation and solution to Section
Loss VALUE PRIVATIZATION WITH MINIMAL CLIPPING BIAS
3.1 PRIVATIZED QUADRATIC FUNCTION
We emphasize that the learning rate TJaNN (Vn)) is not DP, because even though m is privatized, the data is accessed without protection through G and H. To solve this issue, we introduce privatized variant of (5)
(m Hm. Dp,, (G' m))P == argmin a,b Σ ((w--mmn)) mmmpp) - (I(w) - by: + a nh
(6)
2
which not only replaces m with the DP gradient mpp but also privatizes the loss by i(w - mp)
as 77). The resulting learning rate is 'IGNN-D [Tr Hvr which is DP since every quantity in (6) is DP and because of the post-processing property. We now discuss the specifics of the loss value privatization f(w m)) E TR. In Table [
[G mlpe
we emphasize that the loss privatization is distinctively different from the gradient privatization because the loss is scalar, whereas the gradient is high-dimensional.
Table 1: Difference between the privatization of loss and gradient.
Aspects
Loss Privatization
Gradient Privatization
Dimension Clipping Norm
1 L. or LI V /2 Clipping Bias Clipping (R₃ Re L)
L2
Noise Magnitude
Va
Key Convergence
Noise Magnitude
Per-sample Operation
Normalization (R, = 0
From the perspective of per-sample clipping, the gradient ubiquitously clipped on L.2 norm, be- cause ||g.l22 < |1::|1 in large neural networks, and consequently Gaussian noise is added to privatize the gradient. In contrast, we can apply L2 or LI norm for the loss clipping, and add Gaus- sian (by default) Laplacian noise to the loss, respectively.
From the perspective of noising, the expected noise magnitude for loss privatization is B|2
V where z ~ (0, is the noise on loss, and that for gradient privatization is B||z,|| _affe s va where the gradient noise vector 2g (0, La) by the law of large num- bers. On the one hand, the gradient noise Zg large and requires small R, to suppress the noise magnitude, as many works have very small R (Li et al. 2021 De et al. (022). This leads to the automatic clipping in Bu et al. (2023b) when the gradient clipping effectively becomes the gradient normalization as Rg + OF. In fact, each per-sample gradient (as vector) has magnitude and a direction, and the normalization neglects some if not all magnitude information about the per- sample gradients. On the other hand, must not small R2 for the loss clipping because the per-sample loss (as a scalar) only has the magnitude information. We will show by Theorem | that the choice of threshold R3 creates bias-variance tradeoff between the clipping and the noising for the loss privatization:
Ri 1)Le + o. 1()
L = min L
4

---

Published as a conference paper at ICLR 2025
We+1
HGpp
Auto updated paiaats
Sample batch
Update model
Privtized update
fitting
ppp (mm
perturbation
B T,
ergustion
Loss clipping
E,
(8.7 (8.7 +.8.F.N.o where
K
d= GetSigmalc.4 6, B, Nj
W1 Gp 22
Sampl forward
Elpping Freeshocd
Acsounting
Algorifim Activaat suto-tuning inng when 1% au
DP-related
Data indapendent
O
Data dapandent
HyFreeDP overview with three types of hyper- parameters in the DP training. HyFreeDP saves tuning efforts via automatically tuning parameters as default constants. We showcase with 5 points in curve fitting.
Figure 1:
in red text, and sets other
We note (7) is private mean estimation that has been heavily studied in previous works (Biswas et al. 2020 Kamath et al. 2020). though many use an asymptotic threshold like R2 + (log B), whereas Theorem iss more suited for application in practice.
3.2
TRADE-OFF LOSS PRIVATIZATION
Theorem 1. The per-sample clipping bias of is
7
B(L) E,
Σ
min
Rí I)L,
E L
1
(L. R.J[LI > Ri)
B
L
B
which is monotonically decreasing in Ru, and converges to [[[;]L,>> Ri) Ri) P(L Ri) as B cc. In contrast, the noise variance is Var(T.) (aq R4/ B)2 which is increasing in R₁.
In words. a large R₁ reduces the clipping bias but magnifies the noise, and vice versa for small Rj. We propose to use R; = L so that the clipping bias is close to zero (i.e. is approximately unbiased), and the loss noise shown Table Tis reasonably small for large batch size.
To put this into perspective, we give the explicit form of clipping bias when L; follows a Gaussian distribution in Corollary [
Corollary 1. Suppose L, (1,, then the asymptotic clipping bias in Theorem is
[E(L,L Ri) Ri] P(L, Ri) = E(o(a) a(1 - -{a)),
(8)
where a = Re_ 6 is the probability density function and is the cumulative distribution function of standard normal distribution. The term (8) is strictly decreasing in as well as Ri (see Figure 7
4 ALGORITHM
4.1 HYPERPARAMETER-PREI DP OPTIMIZATION
We present our algorithm in Algorithm 1 which DP as guaranteed in Theorem almost as efficient as the standard non-DP optimization by Section 4.4 and highly accurate and fast in con- vergence as demonstrated in Section 5
Importantly, we have split the hyperparameters into three
classes, shown in Figure T
DP-related hyperparameters that do not depend on the tasks, such as the gradient noise ag. the loss noise Fi, and the update interval K. can be as default constants For example, we fix Rg - 0 and re-scale the learning rate by 1 1/R, according to automatic clipping and set K 5.
Training hyperparameters that are robust to different models and datasets, which view as dataainddeenddent, need-not-to--earchh and not violating DP, such as the batch size B and the number of iterations T.. We also fix other hyperparameters not explicitly displayed
5

---

Published as a conference paper at ICLR 2025
in Algorithm e.g. throughout this paper. fix the momentum coefficients and weight decay (31, 32, weight.decay) = (0.9, 0.999, 0.01), which is the default in Pytorch Adam W.
Training hyperparameters that data-dependent, which requires dynamical searching under DP, such as R4 and For these hyperparameters, Algorithm | adopts multiple auto-regressive designs, i.e. the variables use in the I-th iteration is based the (1 1)- th iteration, which has already been privatized. These rugt-reeressive designs allow new variables preserve DP by the post-process pest-processing property of DF
To be specific, we have used _ as the loss clipping threshold R₂ for the next iteration in Line 7, because loss values remain similar values within a few iterations; In practice, we set a more conservative loss clipping threshold R Σ to avoid the clipping bias. We have used the previous 77 to construct next-loss in Line 6, which in turn will determine the new by Line 9.
Algorithm Hyperparameter--iee Optimization with Differential Privacy INPUT: initial 17-ee44 initial R₁ =
2: Forward pass to compute per-sample losses L
(0) L(w;, x;)
3: Compute the mini-batch loss ( B Σ.
(0)
1,6
4: Back- pack-prop from L, to compute mpr in (2) with automatic clipping
5: Post-process mpp by any optimizer GDp =- (mm) in
6: if 1%K = 0 (e.g. K 10) then
7: Forward pass get per-sample losses (11) L(w, + G/ x;))
8: Privatize losses - by (7 with R. _ for ls E 1-,,0, +1}
9: Fit the quadratic function in (6) from (-n,, 0, n) to (i.-1) (((0) i(+1)}
10: Extract coefficients of the fitted quadratic function (m Hm (G m))P
Update 7) with TJGeN-DP
[G ml)e
argmin, Fegminn,(ww,r r/DP)
m Hmmjee
12:
end if
13:
Update Wi+1 we GP
Tredirr
Beatoe 21
Searea Spcidl
Figure 2: Impact of loss value clipping and perturbation iterations on CIFARION with Vit-Small fully fine-tuning, with zero in x-axis denotes the current w,, We use points for the ease of illustration and use 3 points in Algorithm I and experiments.
fitting along different training
4.2 PRIVACY GUARANTEE
Theorem 2. Algorithm is (Comrsy 8)-DP, where Cown depends the batch size B. the number of iterations T, the noises (ag, oi), and the update interval K. In contrast, vanilla DP-SGD is (evanitiaa -DP, where evanitla depends B, T,o. Furthermore, have caurl B,T, T, o σt, K) > Evanilla (B, N, if o.
We omit the concrete formulae of because it depends on the choice of privacy accountants. For example, if we use GDGDP as an asymptotic estimation, then we show Appendix B that
B
B N
3T
Mvanilla V
T(e - 1), Hours
Meamilla
(el/of -)
(9)
K
The post-processing of DP ensures that if X is (e, 6D-DP then g(X) is also (e, 8)PB) for any function g-

---

Published as a conference paper at ICLR 2025
which can translate into (c, 6)-DP by Equation (6) in Bu et al. (2020). Note in experiments, use the improved RDP as the privacy accountant.
Theorem and (9) show that given the same (B,T,o). because we additionally privatize the loss, whereas the vanilla DP-SGD does not protect the hyper- parameter tuning. To maintain the same privacy budget vanilla DP-SGD, for the gradient privatization and Fo 1% budget for the loss privatization. Therefore, we need zs 1% larger gradient noise og = 7o and then select 07 based on
Algorithm uses more privacy budget
99% budget
Cours (B,T,N N, yo, Ti K) Evanitla (B,T, o), where use y 1.01.
(10)
4.3 END-TO-END NOISE DETERMINATION
We give more details of our imple- mentation in Appendix C We visualize both noises in Figure with RDP accounting and Gaussian and mechanisms for loss privatization, dashed line indicates the case when og and 0 are set equally. More examples for different mechanisms or different accounting are shown in Appendix. Note that we only add little more gradient noise, hence dg introduces negligible accuracy drop to Algo- rithm [ as empirically shown in Section 5 Additionally, we demonstrate in Figure that at has negligible interference with the precision of estimating 7/GeN-
We use out library to compute based on 0g in 10
4.4 EFFICIENCY OF ALGORITHM
We illustrate that Algorithm D can be almost as efficient as the standard non-DP optimization, in terms of training time and memory cost. We identify three orthogonal components that are absent from non-DP optimization: (1) Gradient pri- vatization. DP optimization (including vanilla DP-SGD) al-
RDP Compasition (Gauss and Gauss]
wth y 15
Nohe Sttesaatto toraattorgeeee godinnnnn and lass
133
y-1.0
ways requires per-sample gradient clipping. Due to the high dimension of gradients, this could incur high cost in memory and time implemented inefficiently. We directly leverage the recent advances like ghost clipping and book-keeping (BK)
which have allowed DP optimization to be almost as efficient non-DP optimization, up to 256 GPUs and 100B parame- ters. (2) Loss privatization. The cost of loss privatization alone OBB) and thus negligible, compared to the forward passes and back-prec propppropagttion which are O(d)). (3) Learning rate computation. The cost of com-
Updaas Entevvl
Figure 3: Gradient and loss noise.
puting TJGaN-DP 66) mainly comes from the additional forward passe for (d+11 Given that the back propaaationn approximately costs 2x the training time of forward pass, the optimizer without GeN learning rate DP or DP) roughly uses 3 units of time at each iteration. In contrast, Algo- rithm [ses 3 + 2/K = 3.2 units if we set K = 10 with < 7% overhead. We emphasize that the actual overhead to training time is even lower, because the training also includes non-optimization operations such as data loading and inter-GPU communication. In short, the efficiency gap between Algorithm [ non-DP optimization negligible in practice.
EXPERIMENTS
To comprehensively evaluate the effectiveness of the proposed method, we conduct experiments on both computer vision tasks and natural language tasks, across different model architectures (Vit (Yuan et al. 202T). GPT2 (Radford et al. 2019) and LLaMa2-7B (Touvron et al. 2023)) and fine-tuning paradigms (Full, BitFit (Zaken et al. 2022 and LoRA (Hu et al. 2021)). BitFit only tunes the bias terms of a pre-trained model, while LoRA only tunes the injected low-rank matrices, both keeping all other parameters frozen. We use the privacy budget e (1,3,8) with d N-1.1 for training dataset with N samples" and also perform non-DP baseline (c).
httpps thub. com / yux wwuuxianaa anww hww.///g///auuuaggggggpg
least two since there are two unknown variables. More ni may stabilize the algorithm, at cost of more forward passes, longer training time, and using more privacy budget.
'The number of { (6)
https: / thub. com wtt..///wwweeceep///eee..tcc

---

Published as a conference paper at ICLR 2025
Table 2:
Performance comparison of HyFreeDP with other basclines. We use cosine learning rate decay for NonDP-GS w/ LS the BitFit fine-tuning. Detailed results are provided in the Appendix.
Pally Fine- Tune
Vit-Small
Vit-Base
Privacy budget
Method
CIFARIO
CIFARIOI
(TTRR
Food1B1
CIFARIO
CIFAR100
SVHN
Food101
NonDP-GS
96.49
79.70
89.56
67.00
70.38
95.20
66..18
89.10
81.11
58,80
Doutppatioon
23.74
0.30
15:27
1,86
1.17
19.15
0.83
18.56
4.72
1.48
1,43
DP-hyper
74.63
28:23
77.85
HyPreeDP
96.36
78.17
91.15
74.68
67.98
95.76
67.17
88.24
79.00
58.16
NonDP-GS
96.86
83.69
91. 60
83.08
74.58
95.84
79.03
91.74
91.03
66.87
Deadeptation
1.07
5.68
Prodigy
1,07
DP-hyper
95.10
78.82
45.82
42.02
36.21
95.75
19.92
87.82
90.25
66.09
HyFreeDP
96.89
81.62
92.21
89.92
75.24
97.29
80.34
91.71
91.76
73:46
NonDP
No
98.33
89.41
98.66
85.19
98.
91,40
96.87
98.41
89.61
adaptation
Prodigy
97.85
89.21
96.87
98.31
87.09
98.59
91.01
97.14
98.77
89.07
HyFreeDP
98.32
90.84
96.35 86
99.00
86.38
98.83
92.58
96.75
97.37
88.73
BilFi Fine Tume
Vit-Smnll
Vit-Base
Privacy budget
CIPARIO
CIFAR100
SVHN
GTSRB
Food101
CIFARIO
CIPAR100
Food101
NonDI-GS
96.74
84.22
90.18
86.20
77.39
97.34
84.97
90.91
87.15
76.61
NonDP-GS w/ LSS
97.40
81.36
67.95
48. 36.64
74.55
97.90
81.87
79.85
55.66
73.76
Prodigy
96.36
82.23
90.30
84.87
78.72
HyPreeDP
79.27
97.42
79.25
GS
97.13
85.95
91.42
91.50
80.37
97.73
87.00
92.20
91.46
80.06
NoaDP-GS GS w/ LS
97.61
84.87
78.91
60.13
78.08
98.05
85.48
86.22
69.03
78.71
Prodigy
95.72
83.63
91.90
91.64
79.20
96. 96
86.26
92.13
90.27
81.96
HyFreeDP
97.04
NonDP
GS
97.91
89.39
91.38
95.20
86.29
98.36
91.39
91.42
92.87
88.37
NonDP-GS LS
97.89
89. 40
91.99 00.98
90.31
86.27
98,
91.61
94.43
92.90
88.39
Prodigy
97.88
87.85
19
95.34
86.
98.
90.70
96
95.02
88.
HyFreaDP
87.24
As the first hyperparameter-free method for differentially private optimization, compare HyFreeDP with the following baselines: 1) NonDP-GS: We manually perform grid search over predefined range of learning rates, selecting the best without accumulating privacy budget across runs. This serves as the performance upper bound since tuning is non-DP. We also experiment with manually tuned learning rate scheduler, noted NonDP-GS w/ L.S We search the learning rate over the range [5e-5, lc-4, 5e-4, le-3, 5e-3] based on previous works (Bu et al.
2023b a to cover
suitable 17 for various DP levels. 2) DP-hyper (Liu Talwar 2019 Wang al. 2023 Papernot & Steinke 2021): We simulate with narrow range around the optimal 1). spending 85% of the privacy budget for DP training with the searched 17. 3) D-Adaptation (Defazio Mishchenko 2023 and Prodigy (Mishchenko & Defazio 2024): Both are state-of-the-art learning rate tuning algorithms in non-DP optimization. We adopt their optimizers with recommended hyperparameters, alongside DP-specific clipping and perturbation. 4) HyFreeDP: We initialize R2 1 and 1) le by default, allowing automatic updates in training.
5.1 IMAGE CLASSIFICATION TASKS
Experimental setups. As the main result shown in Table 2 compare HyFreeDP to other base- lines by experiments on CIFAR1O, CIFAR100, SVHN, GTSRB and Food101 for models of Vit- Small and Vit-Base.
Evaluation results. HyFreeDP almost outperforms all end-to-end DP baselines. While non-DP automatic learning rate schedulers (D-adaptation and Prodigy) sometimes match grid-searched con- stants, they perform poorly in DP training, especially with tighter privacy budgets and when the number of trainable parameters large, confirming our analysis in Section 2.3 Although DP- hyper surpasses these schedulers-likee suitable ranges remains challenging as training dynamics vary by dataset and privacy budget. Even in this optimistic setting, DP-hyper underperforms due to increased gradient noise. In contrast, HyFreeDP achieves consistent performance across various e values and datasets without manual learning rate tuning, thanks to gradient noise control and efficient learning rate estimation with minimal loss value perturbation.
due to our intentionally narrow search range range-finding
HyFreeDP achieves comparable or superior performance to NonDP-GS baseline without manual learning rate tuning in BitFit experiments. NonDP-GS w/ LS and Prodigy show improved sta- bility compared to full fine-tuning, suggesting the sensitivity to training paradigms and trainable model size. In Figure 4 we illustrate training dynamics (Ri, 7), loss, test accuracy) across meth-
8

---

Published as a conference paper at ICLR 2025
U20 Trrghna
Duri Dcs (6-22)
2,024
2.0
le NenDinG In LEA
The Pat-
2,032
2011 Xedd
Noe Ce-PPr OC RondRAOS
5.033
1.0
Cas
3,000
20-
Care 10
32
0.5 20-5
Nedth on
Sa L51 piri)
000
0.002
Our dbo1)
20
40
20
20
30 30
40
20 30
Figure 4: Automatic learning of clipping threshold, learning rate, training loss, and testing accuracy for SVHN (top) and GTSRB (bottom). HyFreeDP schedules R& and 17 during training, approaching the manually tuned baseline with end-to-end DP guarantees, and is robust to varying intervals K.
ods. HyFreeDP automatically finds optimal learning rate schedules, with clipping thresholds peak- ing early and decreasing gradually, enabling more accurate rate estimation as training progresses. While updating with K = 1 yields optimal convergence, HyFreeDP remains robust to less frequent updates (e.g., K= 5), balancing tuning cost and convergence speed.
5.2 NATURAL LANGUAGE GENERATION TASKS
Experimental setups. We conduct experiments on E2F dataset with a table to text task on GPT- 2 model, and also evaluate the language generation task with PubMed dataset by fine-tuning LLaMa2-7B model with LoRA (Hu et al. 2021) for demonstrating the scalability and generality of HyFreeDP. We follow the experimental setups based on previous works (Bu et al., 2024a) and use the dataset provided by Yu et al.) (2022) 2023) which contains over 75,000 abstracts of medi- cal papers that were published after the cut-off date LLaMa2. Based on the non-DP experience, LoRA typically requires magnitude greater learning rate than full fine-tuning thus we scale up our default initial learning by x x00. We tune the best learning rate for ILLMMa2-BB with LoRA fine-tuning on 4,000 samples of PubMed for NonDP-GS when training on the full dataset.
Table 3: Performance comparison on GPT-2 for E2E dataset with different privacy budgets. Best end-to-end DP results are bolded, and results surpassing the manually tuned baseline are underlined.
Full Fine-Tune
= 3
= 8
Model
Method
BLEU
CIDEr
METEOR
NIST
ROUGE_L
BLEU
CIDEr
METEOR
NIST
ROUGE_L
NonDP-GS
0.583
1.566
0.367
5.656
0.653
0.612
1.764
0.385
6.772
0.664
GPT-2
D-Adapiation
0.000
0.000
0.003
0.082
0.016
0.000
0.000
0.000
0.000
0.000
Prodigy
0.157
0.239
0.000
0.000
0.003
HyFreeDP
0,585
1.564
0.365
5.736
0.636
0.612
1.768
0,378
6,702
0.655
Evaluation results. As shown in Ta- ble 3 we observe that even when the privacy budget is not small (e.g..
Renon.cs cS
Nonon-as
0.012
Ours
12-
Our
Thain Losa
10
8), non-DP automatic learning rate sched- uler does not perform well. We find that HyFrecDP consistently obtains a compa- rable performance as the NonDP-GS base- line without extra tuning. In Figure 5 we observe that HyFreeDP automatically discovers a learning rate schedule that achieves better generalization performance compared to the early-stopped NonDP-GS. The au- tomatically determined learning rate (7) reveals consistent pattern across model scales: an
200
400
200
4.00
Figure 5: Training dynamies of Llamm2-7B on PubMed
SSee this reference example Note that LoRA may use similar learning rate if it is set proportional rank (Biderman al. 2024).

---

Published as a conference paper at ICLR 2025
"increase-thens wwwee-heennnaeeee trajectory that holds true from smaller models (Vit-Small) to larger models (LLaMa2-7B).
Table Comparison of model performance in minutes with and without HyFreeDP across various datasets. The coefficients represent the ratio relative to the w/o auto configuration.
Models
Dataset
K=1
K=5
K=10
w/o HyhreelPP
Llama2-7B (LoRA-FT)
PubMed (4k)
409.750 (x 2,040)
244.333 (x 1.217)
222.583 (x 1,108)
200.833 (x 1,000)
GPT2
E2E
163.333 (x 1.888)
97.167 (x 1.123)
94.983 (x 1.098)
86,500 (x 1.000)
Vit-base
CIFARTO0
152.617 (x 1.370)
118.483 1.063)
113.317 1.017)
111,433 (x 1,000)
Vit-base (BiFI-FF)
CIFARI00
113.450 (x 1.654)
74.733 (x 1.089)
73.817 (x 1.076)
68.600 (x 1.000)
Vit-small
SVHN
102.000 (x 1.255)
84,500 (x 1.040)
82,800 (x 1.019)
81,250 (x 1. 1.000)
5.3
EFFICIENCY COMPARISON
Based on Section 4.4 we compare the training efficiency of HyFreeDP with a single run of DP training using the same non-DP and data-independent hyperparameters, For LLaMa2-7B, we sample 4,000 records from PubMed and train for 3 epochs on single A100 (80GB). For smaller datasets and models, we use previous setups Titan RTX (24GB). HyFreeDP introduces less than x2 overhead compared to single run of DP training, even with frequent updates K 1. Smaller models or those using LoRA BitFit have lower additional costs, especially with K = 1, and the gap narrows as K increases, approaching cost factor of 1x.
shown in Table 4
6 DISCUSSION AND CONCLUSION
In conclusion, we tackle the challenge of hyperparameter tuning in differential privacy (DP) by introducing hyperparameter--fre DP training method that privately and automatically updates the learning rate. Combined with automatic clipping, our approach reduces tuning efforts and ensures end-to-end DP during training. This bridges the gap between hyperparameter-free methods in non- DP settings and DP optimization, opening promising avenues for future research.
ACKNOWLEDGMENT
R.L. is partially supported by National Institutes of Health grant (R01LM013712). National Science Foundation grants (CNS-2124104 and CNS-2125530). We sincerely thank Prof. Li Xiong for her invaluable support and guidance throughout this work. We also appreciate the insightful comments and constructive feedback from the reviewers and the area chair.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ramaswamy, Differentially private learning with adaptive clipping. Advances in Neural Information Processing Systems, 34:17455- 17466, 2021.
Dan Biderman, Jacob Portes, Jose Javier Gonzalez Ortiz, Mansheej Paul, Philip Greengard, Connor Jennings, Daniel King, Sam Havens, Vitaliy Chiley, Jonathan Frankle, et al. Lora learns less and forgets less. Transactions on Machine Learning Research, 2024.
Sourav Biswas, Yihe Dong, Gautam Kamath, and JU COINPRESS. Practical private mean and covariance estimation. Preprint. Available at, 2020.
Zhiqi Bu and Shiyun Xu. Gradient descent with generalized newton's method. In The Thirteenth International Conference on Learning Representations, 2024.
Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J Su. Deep learning with gaussian differential privacy. Harvard data science review, 2020(23), 2020.
10

---

Published as a conference paper at ICLR 2025
Zhiqi Bu, Ruixuan Liu, Yu- Yu-Xiang Wang. Sheng Zha, and George Karypis. On the accuracy and efficiency of group-wise clipping in differentially private optimization. arXiv preprint N7X1::2310.19215. 2023a.
Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Automatic clipping: Differentially pri- vate deep learning made easier and stronger. Advances in Neural Information Processing Systems, 36, 2023b.
Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Differentially private bias-term fine- tuning of foundation models. In Forty-first International Conference on Machine Learning, 2024a. /tL/tttts////eenrrt
net
Zhiqi Bu, Xinwei Zhang, Sheng Zha, Mingyi Hong, and George Karypis. Pre-training differentially private models with limited public data, Advances in Neural Information Processing Systems, 37: 94652-94683 2024b.
Soham De. Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlock- ing high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204. 13650, 2022.
Aaron Defazio and Konstantin Mishchenko. Dearning-rate-free learning by d-adaptation. In Inter- national Conference on Machine Learning, pp. 7479. PMLR, 2023.
Jinshuo Dong. Aaron Roth, and Weijie Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84(1):3-37, 2022.
Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. In Infernational Conference on Learning Representations, 2021.
Maor Ivgi, Oliver Hinder, and Yair Carmon. Dog is sgd's best friend: A parameter-free dynamic step size schedule. In International Conference on Machine Learning, pp. 14465-14499 PMLR, 2023.
Gautam Kamath, Vikrant Singhal, and Jonathan Ullman. Private mean estimation of heavy-tailed distributions. In Conference on Learning Theory, pp. 2204-2235. PMLR, 2020.
Ahmed Khaled, Konstantin Mishchenko, and Chi Jin. Dowg unleashed: An efficient universal parameter-free gradient descent method. Advances in Neural Information Processing Systems, 36:6748-6769 2023.
Antti Koskela and Tejas D Kulkarni. Practical differentially private hyperparameter tuning with subsampling. Advances in Neural Information Processing Systems, 66:28201-28222, 2023.
Itai Kreisler, Maor Ivgi, Oliver Hinder, and Yair Carmon. Accelerated parameter-free stochastic optimization. In The Thirty Seventh Annual Conference on Learning Theory, pp. 3257-3324. PMLR, 2024.
Alexey Kurakin, Shuang Song, Steve Chien, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward training at imagenet scale with differential privacy. arXiv preprint arXiv:2201.123226 2022.
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Representationss, 2021.
Jingeheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, pp. 298-309, 2019.
Zhihao Liu, Jian Lou, Wenjie Bao, Zhan Qin, and Kui Ren. Differentially private zeroth-order methods for scalable large language model finetuning. arXiv preprint arXiv:2402.07818, 2024.
Sadhika Malladi, Tianyu Gao, Eshaan Nichani, Alex Damian, Jason D Lee, Dangi Chen, and Sanjeev Arora. Fine-tuning language models with just forward passes. Advances in Neural Information Processing Systems, 36:53038-53077 2023.
11

---

Published as a conference paper at ICLR 2025
Konstantin Mishchenko and Aaron Defazio. Prodigy: expeditiously adaptive parameter-fre learner. In Proceedings of the 41st Interaational Conference on Machine Learning, pp. 35779- 35804, 2024.
Shubhankar Mohapatra, Sajin Sasy, Xi He, Gautam Kamath, and Om Thakkar. The role of adaptive optimizers for honest private hyperparameter selection. In Proceedings of the aaai conference on artificial intelligence, volume 36, pp.
2022.
Ashwinee Panda, Xinyu Tang. Saeed Mahloujifar, Vikash Sehwag, and Prateek Mittal. A new linear scaling rule for private adaptive hyperparameter optimization. In International Conference Machine Learning, pp. 39364-39399, PMLR, 2024.
Nicolas Papernot and Thomas Steinke. Hyperparameter tuning with renyi differential privacy. In International Conference Learning Representations, 2021.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, llya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Xinyu Tang, Ashwinee Panda, Milad Nasr, Saeed Mahloujifar, and Prateek Mittal. Private fine- tuning large language models with zeroth-order optimization. In ICMI. 2024 Workshop on Foundation Models in the Wild, 2024.
Hugo Touvron, Louis Martin, Kevin Stone. Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023.
Hua Wang, Sheng Gao, Huanyu Zhang, Weijie J Su, and Milan Shen. Dp-hypo: an adaptive private hyperparameter optimization framework. In Proceedings of the 37th International Conference on Neural Information Processing Systems, pp. 41868 41891, 2023.
Xiaodong Yang, Huishuai Zhang, Wei Chen, and Tie-Yan Liu. Normalized/clipped sgd with per- turbation for differentially private non-convex optimization. arXiv preprint arXiv:2206. 13033, 2022.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, al. Differentially private fine-tuning of language models. In International Conference on Learning Representations (ICLR), 2022.
Da Yu, Arturs Backurs, Sivakanth Gopi, Huseyin Inan, Janardhan Kulkarni, Zinan Lin, Chulin Xie, Huishuai Zhang, and Wanrong Zhang. Training private and efficient language models with syn- thetic data from 1ls.. In Socially Responsible Language Modelling Research, 2023.
Li Yuan, Yunpeng Chen, Tao Wang, Weihao Yu, Yujun Shi, Zi-Hang Jiang, Francis EH Tay, Jiashi Feng, and Shuicheng Yan. Tokens-to-token vit: Training vision transformers from scratch on imagenet. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 558-567, 2021.
Elad Ben Zaken, Yoav Goldberg, and Shauli Ravfogel. Bitfit: Simple parameter-effiiien fine-tuning for transformer-base based masked language-models Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Pupers), pp. 1-9, 2022.
Liang Zhang, Kiran Koshy Thekumparampil, Sewoong Oh, and Niao He. Dpzero: Dimension- independent and differentially private zeroth-order optimization. In International Workshop on Federated Learning in the Age of Foundation Models in Conjunction with NeurlPS 2023.
12

---

Published as a conference paper at ICLR 2025
A EXPERIMENTAL DETAILS
Image classification. In full fine-tuning, we tried to integrate constant linear scheduler as com- mon practice, but the result does not steadily outperform the tuned NonDP-GS, so we omit the results in Appendix 5 We do not apply the linear scheduler to Prodigy and D-adaptation for keeping the originally recommended configuration. The results with e 8 are shown in Table with the consistent conclusions across different datasets.
Vit-Small
Vit-Base
Privacy Budget
CIFARIO
CIFARI00
SVHN
GTSRB
Food101
CIFARIO
CIFARI00
SVHN
GTSRB
Food 101
88.02
3.46
29:00
10.16
9.80
96.62
58.74
89.13
64.39
60.74
92.48
8.00
35.54
20.40
97.11
75.73
91.79
82.31
69.09
93.79
15.04
43.73
24.15
31,05
97.41
81.31
93.05
88.79
73.65
NonDP
98.00
89.11
96.55
96.94
84.55
98.88
92.51
97.27
98.29
89.10
Table 5: Full fine-tuning results by adding a linear scheduler to NonDP-GS across different datasets with privacy budgets for Vit-Small and Vit-Base models. Results show that directly integrating constant learning rate scheduler in NonDP does not hurt performance but the DP training perfor- mance is sensitive to the learning rate scheduler.
In Table we report the test accuracy averaged over 3 checkpoints. For demonstrating the stability of different methods, we present the mean accuracy with standard deviation in Table for low privacy budget regime and NonDP.
RDP Composition
GDP Composttion (Gauss and Gausa)
y-1..5
Alth 1.15
witthyel.cc ym100
Nobee made for grudeet and
v.1.61
2x:30
Figure 6: Privacy composition for gradient and loss values privatization, with privacy accountants of RDP and GDP, and loss perturbation of Gaussian and Laplacian mechanisms. Gray dashed line indicates the naive and even budget splitting for every access to private gradient and loss, which results in larger noise magnitude on gradient especially when the adjustment is frequent. The privacy accounting strategy proposed in HyFreeDD effectively restrains the privacy budget consumption on hyper-parameter tuning and spending wisely by only perturbing single-dimensional loss value.
g
Clipping bias. Additionally, we demonstrate the loss clipping bias in Figure
2.0
175
28
-10
00
10
28
Figure 7: d(a) - a(1 - -())) which is minimized at = 00.
13

---

Published as a conference paper at ICLR 2025
Table 6: Averaged test accuracy with standard deviation of HyFreeDP with other baselines
Fully Tune
Privacy budget
Method
CIFAR100
SVIN
CITRB
Foodl0l
CIFARIO
CIFARIDE
Food101
21.21
adapeation
Prodigy
DD-hyper
79.91
HyFraDD
adapeation
Prodigy
HyFreeDP
96.89
80.14
91.73
NunEP
08.87
54.29
07.02
Prodigy
97.65
08.81
01.01
07.14
HyFreeDP
98.32
90.00
92.68
96.75
Table 7: Performance comparison of HyFreeDP to other baselines. We use consine learning rate decay for No w/ LS baseline in the BitFit fine-tumi tine-tuning setting.
Pull Pine-Tune
Vit-Small
Vit-Rase
Privacy budget
Method
CIFAR1O
CIFAR100
SVINN
GTSRB
Food101
CIFARIO
CIFARI00
SVIIN
GISRB
Food101
8
NonDP-GS
96.28
$4.99
92.53
89.97
77.08
96.14
82.52
92.35
91.91
71.05
Doutpptation
78.31
1,07
19:10
3.67
1.76
40.90
1.25
20.85
6.81
1,94
Prodigy
95.74
1.29
1.25
1,901
DP-hyper
80.58
50.10
49.18
94.62
70.63
HyPreeDP
97.04
86.00
95.15
88.06
80.61
97.79
87.57
95.00
94.07
81:91
BilFi Fine-Tume Tume
Vit-Small
Vit-Basc
Privacy budget
CIPARIO
CIFAR100
SVHN
GTSRB
Food101
CIFARIO
CIPAR100
Food101
NonDP-GSS
97.23
86.56
93.34
82.12
97.81
88.05
93.38
93.04
81.88
NoaDP-GS -SS w/ LS
97.63
86.21
83.17
67.35
79.85
98.08
87.17
88.25
75.61
81.18
HyFreeDP
97.31
88.43
89.17
93.54
74.61
97.90
90.34
92.36
93.14
87.14
B PROOFS
Proof of Theorem
7 It's not hard
E(I) Σ. Io
RS 1)L B Σ L: Li
= B
min
B
E(R: RR4 L.)I(Li Ri) 1 Σ ReLU(LI Ri)
B
in which the non-negative ReLU(x)) = x I(x 0). Taking the absolute value, we have
Σ, L
E(Ż)
Σ
ReLU -R)
B EC RO)ICL > Rd)
-
B
B
which is decreasing in R₁ because ReL.U is increasing in its input (I, RI), and this input is decreasing in Ri
As B + co, the clipping bias tends to
E(ReLU(L: R2)) E(ReLU(L; RJ) > RJ) P(L, Ri) =E((L; RR)) > R²) P(L; > Ri) = [E(L,,, > Rd) - Rd] P(L: > Rd)
where we have used ReLU((x) when & >> 0.
The key part in X is E(L > Ri), which is the expectation of the truncated normal distribution by one-side truncation. It is known that for Ri-u
Proof of Corollary 7
B(L. L, Ra) = + δ(a) ((a)'
P(L. Ri) = ((a))
The proof is complete by inserting these quantities.
Proof of Theorem 2 All privacy budget of Algorithm T goes into two components: privatizing the gradient (with noise level o.)) and privatizing the loss (with noise level dj).
14

---

Published as a conference paper at ICLR 2025
Under the same (B,T, N,,,NN,... we have mechanisms of gradient privatization, each of (Cg. 3DD and 3 K mechanisms of loss privatization, each (et, 6t)- Hence is clear that Cours > Evanilla-
To be more specific, we demonstrate with pDGDP. The vanilla DP-SGD is μ-GDP with
B
T(ee/o -1)
Mvanilla
N
which is the same as the gradient privatization component of our DP-SGD. We additionally spend
37 MI
B
(ellot
N
K
leading to total budget of
Mours V /Meanilla pi
by Corollary 3.3 in Dong et al. (2022). 3. It is clear [Apurs
> Avanilla-
C END-TO-END PRIVACY ACCOUNTING AND INVERSE
We demonstrate how determine (ag. given (e, 8)-DP budget. In vanilla DP optimization, can leverage privacy accountants such as RDP, GDP, PRV, etc. Each accountant a function whose input is hyperparameters (B, (T, N, 6, o)) and the output e (see an example ()) In this section, we denote any accountant as f, so that
(,,; =
(11)
(o; =
(12)
f (c)
(13)
which e' is the single-iteration budget, f means composition of T iterations, and f-T inverse function known Ge:Signn gma in Figure
In this work, we develop an end and-to-end privacy accountant to compose both the gradient privatization and the loss privatization. Our accountant takes the input (B, T' N, 8, oi 7, K), where 1.01 by default and can take smaller value for larger models or smaller (c, 8) budget. Therefore, dg = -oo
Firstly, we call (T0;; B, 6) é to get the reference budget é which is strietly smaller than because f is monotonically decreasing in its input. Then guess the loss noise and call J3T/K (ot; B, N, 8) = since there are 3T/ K rounds of loss privatization. We continue our guess until
/
K (or; N, 8) 5 f" B,N,
= Notice the left hand side is monotonically decreasing in Øj, Hence we use bisection method to find the unique solution di, at an exponentially fast speed.
Algorithm End-to-End Privacy Accounting
1: INPUT: The end-to-end DP budget (c, d), Get.S Get. Compose()), Solve()
2: OUTPUT: Noise magnitude for gradient and loss privatization Og and di
3: Compute the gradient noise scale by assuming there is only a single training
4: a = GetSigmal 8, B, B,T,N'
5: Compute the og in Algorithm with controlled noise increase
6: og =q-a with the constant y slightly greater than 1 (e.g, 1.01)
7: Define the composition function with input variable as the loss noise scale
(a, B, N,8), 6),ff f /T/K (c; N,,))
8: cours fowrs(clo (clag, 8, B, B,N,NI. N,T,K, K) Compose(f{ (ag;
9: Solve the minimization of the scalar function respect to
10: = Solve(c,,)) = arg min, (Fours() -e
In the above, have used the functions GetSigma( Compose(-) 7 and any root-finding method Solve(-) such as the bi-section in scipy library. We highlight that Algorithm and
ca bbbrtor.yy
https://qithub.cee composition.py
15

---

Published as a conference paper at ICLR 2025
Algorithm 2 are sufficiently flexible to work with the general DP notions, including GDP, Renyi DP, iCDP, per- per-instance DP, per-user DP, etc.
D MISC
Hyper-paramette matters for DP optimization. Previous works De et al. (2022); Li et al. (2021) reveal that the performance of DP optimization is sensitive to the hyper-parre parameter choices, cited in Figure
60
43.0
10-12--50..8
0-100
22.0
45.0
0.1
0.1
0.1
Learning
10012
33:17
35.10
30
Leaminn
2.1
22.0
45.0
11.0
0.09
10"12*
29.74
29.55
29.61
28.62
27.07
8-10
0.29
2.2
22.0
24.0
0.11
15
10-121
9.69
9.69
9.68
9.85
5.79
0.1
0.25
01"2
Clipping norm
Clipping norm
Figure 8: Hyperparameter tuning of (Rg. cited from Figure of Bu et al. (023b). Here R. is the clipping norm and is the learning rate. Left: BLEU score of GPT2 on E2E dataset Li et (022). Right: Test accuracy of ResNet18 ImageNet Kurakin et al. 2022).
End-to-end DP guarantee for optimization and tuning. As shown in Table we compare our work with representative works that try to ensure end-to-end DP for both optimization and tuning.
Table 8: Comparison of hyperparameter search strategies. Budget splitting percentages for Adaptive Clipping and DP-hyper are estimated values, as the actual percentages depend on specific datasets.
Method
Searching ?)
Searching Rg % Budget on Hyperparam
Vanilla Abadi cl al.
2016
0%
Automatic Clipping Bu al. 2023b
0%
Adaptive Clipping Andrew el al. 202
X
R220%
DP-hyper Papernot Pe-heeerrPpppooo & Steinke 2021
X
2.20%
Ours (this work)
<1%
Taylor approximation of next-iteration loss This analysis of next-iteration loss via the Taylor approximation is also presented in Section of (Bu et al., 2024b), which focuses the explanation of the DP training dynamics, instead of on the learning rate.
16


Reviews:
[{"review_id": "ToVAB2pdcm", "reviewer": "Reviewer_UUab", "summary": "This paper proposed a method to estimate hyperparameters (i.e., learning rate) in differentially private optimization with gradient normalization (instead of gradient clipping). As learning rate is the main tuning parameter, the proposed optimizer is hyperparameter free. The proposed additionally differentially privatizes the loss (a scalar) for estimating the learning rate.", "questions": "I have to read GeN Bu et al. (2023) again to understand the proposed method in this paper. And I cannot find Eq (5) of this draft in GeN Bu et al. (2023). What is \\omega in Eq (5) and (6)? Could you write the closed form solution for estimating \\eta? If not, why? \n\nI request the authors to clarify privacy accounting of their proposed method. Starting from the DP definition, e.g., what are their mechanism input and output? How are their “Loss Privatization” and “Gradient Privatization” composed? It looks to me Line 9 in Alg 1 is data dependent, but it is unclear whether it is considered in the DP algorithm or accounting. It is OK to use GDP and/or autoDP library, but I request the authors to detail how GDP/autoDP is used for this specific algorithm.\n\nMinor: the authors might consider the usage difference of \\citep and \\citet in writing.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "- Setting hyperparameters in DP optimization is an important topic for both modeling and privacy.  \n- Experiments demonstrate the advantage of the proposed method compared to naively applying parameter free optimization methods like D-adaptation in DP optimization, and DP-hyper style algorithm by differentially privatizing hyperparameter search.", "weaknesses": "The technical part of the paper is generally hard to read. I am not confident the proposed method is technically correct.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "bNDmScOj0O", "reviewer": "Reviewer_YG4L", "summary": "The paper proposes to tune learning rate privately based on quadratic approximation during DP-SGD training. It is shown that the proposed algorithm can achieve comparable performance with non-DP learning rate search.", "questions": "For DP hyper-parameter optimization, have the authors considered using gradients from backpropagation w.r.t learning rate to tune the learning rate privately?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The proposed algorithm works pretty well in the experiment with not much additional cost in computation cost and privacy.\n2. The idea is simple yet effective, factorizing learning rate tuning during training using quadratic approximation.", "weaknesses": "The proposed algorithm seems to still require a initial learning rate and the algorithm's sensitivity to the initialization seems missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ct5LrRl7Jh", "reviewer": "Reviewer_e2ge", "summary": "This paper discusses how to improve the performance of DP optimization by improving the private selection of hyperparameters. This is done by always scaling the gradient to norm 1 and adjusting the learning rate for each training step privately. The selection of learning rate is done by adapting a rule used in non-DP literature which solves an approximate objective for the best learning rate, but making this private by privatizing the loss evaluation used in this learning rate objective. Extensive experiments shows this improves performance over alternative DP hyperparameter selections, and is often comparable to a non-DP grid search of hyperparameters. Further experiments show the computational overhead is minimal. Certain experimental details are missing in the text, though I believe this can be easily addressed.", "questions": "1) The line numbers are missing in the pdf, the authors may want to fix this. In the following I will try my best to describe the location of the typo\n\n\n2) In equation 6, I believe you mean to also use the privatized loss for L(w), currently it is un-privatized and hence the objective is not private. I can see from the algorithm you input to equation 6 privatized losses, so I presume this is a typo in equation 6\n\n3) In the opening paragraph of section 4.1, I do not believe saying Auto Clipping is equivalent to Rg = 0 is correct. This would mean you always clip to 0 gradient norm. I believe you can replace this by saying you always clip to gradient norm 1, which is consistent with equation 1.\n\n4) In algorithm 1 could you write the inputs to algorithm, which I take as initial values for: $\\eta$, $R_l$. This would help with reading/understanding the algorithm\n\n5) In line 8 of algorithm 1, can you replace $(-\\eta,0,\\eta)$ with set notation {$\\eta, 0,\\eta$} to be clearer how equation 6 is instantiated; at first I thought it was run over an interval.\n\n6) In line 9 of algorithm 1 I find it vague as stated; more precisely can you say you minimize the previous fitted quadratic?\n\n7) (Major) In section 5.1 experiment setup paragraph, can you explicitly state the deltas used in the experiments; I could not find this in the appendix either.\n\n8) (Major) In table 2, can you add error bars for the experiments? E.g., report 1 standard deviation\n\n9) (Major) Can you report the grid search range in the appendix?\n\n10) Can you explain what BitFit is briefly in the experimental setup paragraph; I believe this will clarify better the differing results for full finetuning\n\n11) I found the figures hard to read when I printed the paper; consider increasing the size and possibly moving one figure to the appendix.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) Hyperparameter selection in DP does not inherit the same rules of thumb as non-DP, and hence understanding hyperparameter selection for DP training is a core problem\n2) The results are strong and seemingly near optimal (given the non DP grid search results)\n3) The observation that a specific generic ML hyperparameter selection approach translates well to the DP setting seems important and novel to the DP community", "weaknesses": "1) In my opinion the presentation can be improved: in the questions I try and clarify several possible typos. I emphasize this as I originally had more issues with the claims made in the paper but was able to answer these by cross-examining statements elsewhere, which could have been more easily resolved with some changes to writing.\n\n2) Certain details about the experimental setup are missing, such as exact DP $\\delta$ values used, and the range of hyperparameter grid search. I ask questions about these in the questions section (labelled Major), and believe they can be easily addressed, and am willing to increase my score given they are addressed in the rebuttal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zgiTt1RyHB", "reviewer": "Reviewer_2fNR", "summary": "This paper proposes a method for differentially private training that eliminates the need for hyperparameter tuning, addressing a core challenge in DP deep learning. The authors provide clear discussions on the method’s efficiency, privacy guarantees, and utility. Both theoretical and empirical analyses are well-founded and straightforward.", "questions": "1. In Theorem 1, when $R_l \\approx L$, the clipping bias is close to zero, where $L = \\frac{1}{B} \\sum_i L_i$ is the public per-sample gradient (right?), which seems to be a CLT-based result (please correct me if I’m wrong). My questions are: \n- (1) Could the authors provide guidance on minimum batch sizes needed (to make CLT works) in practice, based on their empirical observations? Although one always wants large batch sizes but due to limited computational resources, one often can't afford super large batch sizes.\n- (2) I understand why you set $\\tilde{L}\\_{t-1}^{(0)}$ as $R\\_l$ for the next iteration, given that the loss values are similar. However, while $L\\_{t-1}$ might be close to $L\\_{t}$,  I worry that $\\tilde{L}\\_{t-1}$ could differ significantly from $\\tilde{L}_{t}$ because of the clipping and noising, which might not give bias $\\approx 0$. Some discussion or empirical results on this would be valuable.\n- (3) What was the rationale for choosing $\\tilde{L}\\_{t-1}^{(0)}$ specifically? Did the authors experiment with other options like $\\tilde{L}\\_{t-1}^{(+1)}$ or $\\tilde{L}\\_{t-1}^{(-1)}$, and if so, what were the results?\n\n2. In the main algorithm, I assumed $\\eta_i \\in \\\\{-1, 0, +1\\\\}$ represents the series of potential lrs. Is there a specific reason for this choice? I understand the need for at least two $\\eta_i$'s, but $\\{-1, +1\\}$ seems more intuitive to me...? Could the authors explain the rationale behind including 0 in the set of potential learning rates? Are there specific benefits for this choice? Also, I’m unclear about how to fit eqn. (6). In Section 4.4, the authors mention that solving this is quite efficient, with the cost \"mainly arising from additional forward passes.\" Could the authors provide more details on the practical implementation of solving equation (6), and specifically, what optimization method was used, and how much computations were typically required to find a solution?\n\n3. Could the authors provide insights into why D-adaption and Prodigy struggle in low-$\\epsilon$ regimes for full finetuning, as seen in the first table of Table 2 and Table 3? Are there specific aspects of these methods that make them less suitable for differentially private optimization? Also, for clarity, could the authors specify the value of $K$ used for HyFreeDP results in Tables 2 and 3? I assumed $K=10$ throughout these experiments, but If it varies, a note explaining the choice for each experiment would be helpful.\n\n4. I noticed in Table 2 that NonDP-GS w/ LS outperforms HyFreeDP, especially on CIFAR-10, and in Table 3, NonDP-GS and HyFreeDP show similar performance. Do authors have any intuitions behind? I’m particularly curious why NonDP-GS w/ LS performs so well on CIFAR-10 dataset - is it because the task is too simple? If I understand correctly, NonDP-GS does not account for privacy loss from hyperparameter tuning, so the $\\epsilon$ values for NonDP-GS might be underestimated. It would be great to include the results for NonDP-GS, considering the privacy cost of tuning. I imagine that HyFreeDP would then strictly outperform it...?\n\n5. It seems to me that this method works for per-batch clipping (since it also ensures dp [1]) as well, except that eqn (7) needs to be modified. It would be particularly useful for differentially privately training models with non-deomposbale loss [1, 2].\n\n[1] Huang, Alyssa, Peihan Liu, Ryumei Nakada, Linjun Zhang, and Wanrong Zhang. \"Safeguarding data in multimodal ai: A differentially private approach to clip training.\" arXiv preprint arXiv:2306.08173 (2023).\n[2] Kong, William, Andrés Muñoz Medina, and Mónica Ribero. \"DP-SGD for non-decomposable objective functions.\" arXiv preprint arXiv:2310.03104 (2023).", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "This is a well-written paper that effectively present its methods. The motivation is clear, the connections to previous work are discussed, and the experimental results are comprehensive and convincing. The method is simple yet effective in terms of efficiency and utility. The theoretical results are presented clearly, avoiding unnecessary complications, and the experiments are solid.", "weaknesses": "See below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)