Task-level Differentially Private Meta Learning
Authors: Xinyu Zhou
Raef Bassily
Venue: NeurIPS 2022 Accept (2022)
Keywords: Privacy
Meta Learning
Distributed Learning

Abstract: We study the problem of meta-learning with task-level differential privacy. Meta-learning has received increasing attention recently because of its ability to enable fast generalization to new task with small number of data points. However, the training process of meta learning likely involves exchange of task specific information, which may pose privacy risk especially in some privacy-sensitive applications. Therefore, it is important to provide strong privacy guarantees such that the learning process will not reveal any task sensitive information. To this end, existing works have proposed meta learning algorithms with record-level differential privacy, which is not sufficient in many scenarios since it does not protect the aggregated statistics based on the task dataset as a whole. Moreover, the utility guarantees in the prior work are based on assuming that the loss function satisfies both smoothness and quadratic growth conditions, which do not necessarily hold in practice. To address these issues, we propose meta learning algorithms with task-level differential privacy; that is, our algorithms protect the privacy of the entire dataset for each task. In the case when a single meta model is trained, we give both privacy and utility guarantees assuming only that the loss is convex and Lipschitz. Moreover, we propose a new private clustering-based meta-learning algorithm that enables private meta learning of multiple meta models. This can provide significant accuracy gains over the single meta model paradigm, especially when the tasks distribution cannot be well represented by a single meta model. Finally, we conduct several experiments demonstrating the effectiveness of our proposed algorithms.

Task-level Differentially Private Meta Learning
Xinyu Zhou
Department of Computer Science & Engineering
The Ohio State University
zhou www.202bckkkeemmaaal...... osu oou..ddu edu
Raef Bassily
Department of Computer Science & Engineering and TDAI Institute
The Ohio State University
bassily. 18osu. edu
Abstract
We study the problem of meta-learning with task-level differential privacy. Meta- learning has received increasing attention recently because of its ability enable fast generalization to new task with small number of data points. However, the training process of meta learning likely involves exchange of task specific informa- tion, which may pose privacy risk especially in some privacy-eensttive applications. Therefore, it is important to provide strong privacy guarantees such that the learning process will not reveal any task sensitive information. To this end, existing works have proposed meta learning algorithms with record-level differential privacy, which is not sufficient in many scenarios since it does not protect the aggregated statistics based on the task dataset as a whole. Moreover, the utility guarantees the prior work are based on assuming the loss function satisfies both smoothness and quadratic growth conditions, which do not necessarily hold in practice. To ad- dress these issues, privacy; that is, our algorithms protect the entire dataset for each task. In the case when single meta model is trained, give both privacy and utility guarantees assuming only that the loss is convex and Lipschitz. Moreover, we propose a private clustering -based meta-learning algorithm that enables private meta learning of multiple meta models. This can provide significant accuracy gains over the single meta model paradigm, especially when the tasks distribution cannot be well represented by single meta model. Finally, we conduct several experiments demonstrating the effectiveness of our proposed algorithms.
propose meta learning algorithms with task-level differential
1 Introduction
Meta learning has received increasing attention recently due its successful applications in variety of machine learning domains. Meta learning is the process in which existing learning tasks are used infer learning rule that enables faster adaptation to tasks from the same environment. Specifically, meta learning takes in a collection of tasks (datasets) sampled from an unknown distribution. Each task defines a learning problem with respect to an input dataset. The goal of meta learning is to output meta-learner which can extract the shared knowledge among the tasks (datasets) and generalize well on a newly sampled task (dataset) with small number of data points. The performance of meta learner is measured by transfer risk, defined as the expected risk of the output of the algorithm w.r.t. a newly sampled task.
Machine learning algorithms typically rely on gradient-basee based optimization methods. The optimization- based meta learning framework allows such methods to converge to solution using small number of samples. This is done by learning either good parameter initialization regularizer. In meta
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

initialization methods like MAML [1] and Reptile [2], the meta leaner obtains a meta initialization we such that one or a few gradient updates of wo produces good task task-specific model for new tasks, An- other class of meta learning algorithms are based on an approach known as meta-regularization [3-6] in which a regularizer first learned based on all tasks datasets, then a task-specific model is obtained for new task by minimizing the regularized loss. retuaregula has received more attention recently due to its formal utility guarantees and computational efficiency. In meta-regularrzation, the goal is to find a good bias vector / such that local learner (base learner) can converge to good spsk-spe model by minimizing the regularized empirical loss: win R2(w) ||w- hll?. In [7], the authors formalize the connection between meta- mmcta-iitiialzztion and metu-regularizztion under the framework of online convex optimization.
Meanwhile, the nature of the meta learning requires the exchange of task-specific information, which may pose serious privacy risks, especially in distributed settings where all tasks (users) are participating into a meta training process by communicating meta-model updates among themselves, typically with the assistance of a central server. Therefore is important to ensure that the sensitive information in every task (dataset) remains private through the meta learning process.
Despite its importance, the privacy aspect of meta learning is still underexplored. In [8], using the mneaa-nittallizttinn framework, the authors propose meta-learnnng algorithm with levell differential privacy (DP) and give an accuracy guarantee in terms of the transfer risk. Record- DP a weak privacy guarantee for a wide range of scenarios. Imagine training an email spam filter for each user (task). Even if we ensure differential privacy w.r.t. each record of a user's email, aggregate statistics across the entirety of a user's records (e.g., the frequency of certain words or sentences) may still reveal some sensitive information which the user doesn't 't want to share. Moreover, the accuracy guarantees in [8] rely on relatively strong assumptions concerning the loss function used for training. In particular, the loss function therein is assumed to satisfy both smoothness and quadratic growth conditions, which do not hold simultaneously for many loss functions commonly used in practice.
In this work, we propose new meta-learning algorithms with task-level DP and derive formal transfer risk bounds. Unlike [8], our algorithms are based on the meta-regularizztioo framework. We now highlight our main technical contributions:
We propose task-level differentially private (task-level DP) meta learning algorithm based on the meta-regularizzaioon approach. We observe that when the meta-loss is properly defined, one can view each task dataset as "data point" and the meta-loss as its corresponding loss function. Therefore, applying existing DP optimization techniques like Noisy SGD on the newly defined "data point" and loss function achieves task-level differential privacy naturally.
We give bound for the statistical performance for algorithm in terms of its excess transfer risk. Our statistical accuracy guarantee holds under standard assumptions; namely, assuming only that loss function is convex and Lipshitz. With sufficiently large number of tasks, the bound asserts improved performance over local training, where a model is trained locally based on a single task dataset.
When the task distribution becomes more complex such that a single meta model is not enough to capture the relationship among tasks, we propose a task-level DP clustering meta learning algorithm that can learn multiple meta models. This approach can provide significant improvements in the statistical accuracy (transfer risk) over the standard single-model case, especially when the tasks distribution is better captured by multiple meta models.
We empirically evaluate our algorithms to demonstrate the effectiveness of our proposed algo- eereeiiiiii rithms'.
The most related work to ours is [8], where the authors propose a meta-learning algorithm with record-level DP via the framework of meta-initialization. Their analysis relies on assuming that the loss function satisfies a quadratic growth condition, which we do not require in our analysis. Furthermore, we consider stronger notion of the excess transfer risk than the one in [8]. To be more specific, in [8], the achieved transfer risk is compared to the transfer risk of the optimal global model, while the transfer risk in our work is compared to that of the optimal personalized model. This is because we allow different tasks to have different parameters. Since
Related work:
'Our code is available online at https: http:////coyoooooo//ttttaaaa.33
2

---

the optimal personalized model always outperforms global model, we have a stronger notion of the excess transfer risk. Consequently, our utility guarantee also holds under the notion studied in [8].
Our results are also related to the line of work in private model personalization. The goal of model personalization is to train a personalized model for each user that generalizes well on the user's distribution. Reference [9] proposes a private personalization algorithm that solves stochastic optimization problem involving both local and global models. The authors of [10] develop an algorithm for mean-regularized multi-task learning under the joint differential privacy guarantee and study its application model personalization. The work of [11] presents private personalization algorithms that learn a common embedding model among users using the alternating minimization framework, where convergence to the optimal solution is guaranteed for linear regression models with Gaussian data. There are also a variety of works, mainly in the non non-private regime, exploring the connection between meta learning and model personalization. For example, [12] proposes a personalization mechanism based on MAMI, which aims at finding good initialization parameter for the users. The authors of [13] study the connection between meta learning and personalization based on the observation that FedAvg [14] can be seen as meta learning algorithm. Therefore, it is possible to extend the results in this work to the domain of model personalization.
There are also prior works studying learning with task-level or user-level differential privacy but under different learning paradigms. In [15, 16], the authors provide user-level differential privacy under the framework of federated learning, in which case all users share a single global model. This different from our setting because we allow each user to have its own task-specific model. The authors in [17] develop algorithms for variety of learning tasks under user-level differential privacy. They consider limited heterogeneity setting where all users' distributions are close to each other in total variation distance. On the other hand, in this work we focus on the meta learning paradigm, where we only assume small variation across users' models.
2 Preliminaries
We consider a meta distribution P and each task is sampled from p which iid will induce a task specific distribution over the data domain Z, that is fı.... P. ~ p for K tasks. After the sampling of μt, a dataset Z, with n datapoints is subsequently sampled from μús written as Z, [21,....2) Lid μ,"" The collection of K task datasets is denoted as
Distributional setup:
Ž = (Zz,... Zx}
In this paper, we focus on distributed settings such that the datasets (2, are decentralized across multiple locations. All tasks jointly participate into a model training process coordinated by a trusted central server. The data of each task is stored and processed locally, only the model updates are shared to the server or other tasks.
Task population and empirical losses:Given closed convex parameter space W. consider learning task parametrized by vector w E Rd. We let É: Rd x Z - IR be a loss function, where ((w,a) =) is the loss incurred by parameter vector w on data point z. For any task drawn from distribution y and observed via a dataset 7 = (z1,-... ). we denote the population risk of w E W as Ry (w)) Eu,, z) and the empirical risk as Rz(w))
1 E ((w,,) 24).
Meta learning: Given K learning tasks with datasets Z, meta- meta-learning process aims to learn an algorithm A that enables fast adaption on newly sampled tasks from the meta deta-distribution p. Such adaptation is measured by the notion of transfer risk defined as
PA: = Ep-pEZ-nn Ry, (A(2)). (A(2))
(1)
The transfer risk (A:: can be considered as the expected loss of the parameter returned by applying the algorithm A on dataset Z E 2" sampled from the meta distribution p. In summary, the whole process starts with a meta-learning algorithm taking Z as input and outputting a learning algorithm A. After that, new learning task with distribution μ p trains its corresponding dataset with the learned algorithm and apply the resulting parameter vector w to new data drawn from j..
For any task specific distribution μ. we denote the minimizer Wp as Wn E minwew R, (w)) and the expected minimum error over the meta-distribution o as &, Ey (ww). Note that, there might be more than one minimizers of R2 (w)), but Ep remains same regardless of the selection of up. Furthermore, we define the excess transfer risk as
AE = (A. - E,
(2)
3

---

Task similarity metric: To achieve low transfer risk, the meta learning algorithm leverages the shared similarity among tasks and output the optimized inner algorithm. this work, the task similarity is measured by the quantity:
V2 min Eppo ||o Projw, (+) dEW
where Wi is the of optimal parameters for task μ written as W arg min R (w). and Projw, denotes the Euclidean projection on Wy. V can be roughly seen as the expected variation of task parameters. We denote to the minimizer of (3) such that w E W and
V2 Projw, (T))
Tesk-level Differential Privacy [18]: A randomized algorithm M is (c, d)-differenti private if for any pair of neighboring sets and and for any measurable subset O Range(M), we have
P(M(Z) e e S e E 00++ +
In this work, consider task-level neighboring relationship. Let Z [Z Zx) and ž' { ...22x J. and we say Z and Z' are neighboring if, for some i E [K], 2 and Z' differ only on the dataset from the in task, i.e., Zj = Z for all j except Therefore, task-level differential private algorithm ensures that any adversary cannot tell if the dataset of a particular task was used in the algorithm given its output.
Our analysis involves the following fairly standard assumption:
Assumption 1. Lonver-Lipschizz-ounndde models)
For any 2, the loss function E(w, 2) is convex and L-Lipshitz with respect to w.
Boounddd parameter space: ||||2 = maXxm,weee ||wl -w2ll S M
3 Learning with Meta Regularization
Base learner:A base learner solves regularized loss minimization problem w.r.t. biased regularizer parameterized by a bias vector I.In particular, given bias vector h and a task dataset Z, the base learner solves the following problem:
A || -1l2 2
+ min Rz, (w; = min Rz(w)) NEW
wEW
where is the regularization parameter. Rz, (w;; h), that is w)(Z) (Z) arg min min wew Rz, (w; h).
the sequel, we define ur, (Z) as the minimizer of
Meta algorithm: Given collection of base learners, the goal of meta-algorithm is to find good regularization bias h that yields a small transfer risk. First, let's rewrite the transfer risk defined in (I) as function h:
E, (h; p) En- Ry (w)()))
(4)
and hence the excess transfer risk can be expressed as AE, p) = En (h: Ep. Therefore, the goal of the meta algorithm find an (approximate) minimizer h of & E,; p) in (4), i.., the goal to solve:
min (h; p) = Euu R (w)())) REW
(5)
Intuitively speaking, the base learner aims to figure out the best parameter vector "around" the bias vector h. Therefore, the meta algorithm can find good bias vector h that close to the solution space of the tasks, the base learner can converge to its solution space quickly by only searching around
3.1 Meta Loss and proxy transfer risk
Directly optimizing over (5) above is usually infeasible. common strategy to get around this difficulty is to propose a proxy loss function which is related to the transfer risk but easier to handle. In this section, we follow the definitions in [3, 4] and define our meta loss as
Lz
min Rz, (w; h) wEW
min Rz (z(w) + weW
||w h1l

---

and the proxy to the transfer risk is defined as
(n; p) Euu Li((i)
The goal of the meta-algorithm is to optimize the proxy risk over h, that is,
min REW
En (h: p) Eurup Lz (h)
(6)
Note that Lg (h) is in fact the Moreau envelope of the empirical loss (2(w). In Proposition 2, we review some useful properties of Lz (h) which will help our analysis.
Proposition 2. (follows from (19, 20)) Under Assumption 1, we have
1. Lz is convex, 2L-Lipsittz and X-smooth.
2. For any W. Lzz(h) = -\wwx(Z) h) where wn (Z) = arg min Rz,((us h).
A key observation is that all datasets go through the same stochastic process under our distributional setup and thus can be seen i.i.d. sequence drawn from a distribution Pz. Therefore, (6) can be rewritten as
min (h; p) min Ez~PxLz(h) NeW
(7)
hEW
Combined with Proposition (2), the objective of the meta algorithm is formulated as stochastic convex optimization (SCO) problem which has been well studied under privacy constraints [19, 21, 22]. The notion of task-level differential privacy just comes up naturally when we each task dataset Z as a "data point" and Lz(h) as its loss function, therefore the conventional record-level neighboring relationship can be readily translated to a task-level neighboring relationship.
However, one challenge in adapting existing differentially private SCO methods pertains to the gradient computation. In standard SCO settings, we are expected to be able to compute the gradient of the loss function efficiently and precisely. However, our case, as seen in Proposition 2, computing VLz (h) for each h requires computing wA (Z) which further involves solving X-strongly convex optimization problem. Therefore, finding the exact value w/ (Z) for general convex loss / is not iterative methods up to
feasible, alternatively what we can do is to approximate wv (2) using some error b. Therefore, it is important to incorporate this approximation error into our convergence analysis. Moreover, due to the distributed nature of the algorithm, the model iterates assumed to be visible to multiple tasks who are selected to participate in each round. Therefore, the privacy should be defined over all model iterates well the final model, and we cannot the linear- time algorithm for DP smooth stochastic optimization [22] despite the fact that the objective of the meta-algorithm can be formulated stochastic convex optimization problem with smooth loss.
Private Meta Learning with Noisy SGD
In this section, we present our meta learning algorithm adapted from mini batch noisy SGD method in [19] described in Algorithm 1. In iteration I, given the current iterate he, each sampled task computes approximation of the gradient of the meta loss Lz (fx)). denoted VLz (fz).. After that, the server aggregates theses approximate gradients to update the model. The privacy achieved by adding Gaussian noise scaled with the sensitivity of each task to the model iterate.
We will first describe the privacy and utility guarantee of Algorithm 1, and then show the resulting transfer risk.
Theorem 3. (Privacy guarantee) Let Assumption holds and let (hi.... hr-13 and hr be the output, Algorithm I is (t, (c,0)-differrntiaal)) private on task level.
Proof. Since the computed gradient (Zz(h,) is only approximation to LZz(h;), then have
A (ha) v (lz(h.) S A |/ (Z) wh. (Z)ll < b
and because VLz (h) is 2L-Lipshitz by Proposition 2, we have
A (hx) < (1VL2(1))l +
5

---

Algorithm 1: Ameta-NSGD: meta learning with mini-batch noisy SGD input :Initial iterate wp W, number of iterations T, estimation error b, regularization parameter A, step size
Set noise variance x² 8T(21.46) (og(1 /8) and batch size m max (K VE/(A)).
c"
for fort= l
do Server samples batch of tasks B, (Z ... m. Z and sends he to tasks in B, for-eack task Z in B₁ do
Solve (2, h2) and compute an estimate wh, (2) with | (2) whe (2) S X
Send (h,) = A(wn, (Z) - he) back to server
end
Server updates the model with
h++1 Projw he Mu-n-- n
Σ
LZz( + Gi
ZEB,
where Projw denotes the Euclidean projection onto W, and G. ~ N(0, 02 drawn independently each iteration. end output thr + Σr h4
Note that Algorithm has the similar structure of the mini-batch noisy SGD method in [19] if we consider Lz (he) as the model updates and h, as model iterates. By adding Gaussian noise scaled with (2L + b), direct application of Theorem 3.1 in [19] completes the proof.
Since the objective of the base learner (z,a(w; h2) is a X-strongly convex problem, one can use gradient decent bound the approximation error at step in Algorithm 1. Alternatively, the base learner can use other stochastic optimization method i.c. SGD to achieve a high probability bound on the approximation error, such that || (Z) wh, (Z)ll s X with probability over 1 8'. By letting the overall failure probability mT'8 on the same order of the privacy parameter ō, the privacy guarantee still holds. For the simplicity of the analysis, we assume the approximation error ||,,, (Z) wh, [1)ll < & always satisfies.
In the next theorem, we will give the excess risk of Ameta
Theorem (Utility guarantee) Under Assumptions I, suppose X S M min (Vx 2 2d
Let min K (
2K²
M 2LVT
and b = 2L, Then,
32dlog(1/8)
(1
/dlog(1/5)
min (h: 50 ML NeW
VK
cK
where hor is the final model output by Algorithm 1, and the expectation is taken over the collection of datasets Z and the inner randomness of the algorithm.
Note that the excess rate Theorem 4 is with respect to &, (h; p). the proxy to the transfer risk.
remains to show how it can be related to the excess rate of the true transfer risk E,, (h; p). In the next
theorem, we give the excess transfer risk Algorithm 1. The proof follows from [Theorem 6, [3]] and decomposes the excess transfer rate into three components. We bound each component separately and one of them is based on the excess rate achieved in Theorem 4.
Theorem 5. (Transfer risk) Recall the settings in Theorem 4, we have
2I,2 > 2x2 +0 E[E,( [[][frrp]]]--))) Ep S An
Vdlog(1/8) ck
1 ) + VK)
+
ML
2

---

2L V V we have
By letting
2LV
(V ck
ElEn(hrr:)) - Ep S Vn
+0 ML.
where hr is the output of Amene-NSGD and the expectation is taken w.r.t. Z and the inner randomness of the algorithm.
Theorem 5 shows that when the number of tasks K is sufficiently large, the excess transfer risk (L%) Recall that is a measure of task similarity, hence when the optimal task parameters are close to each other, V can be much smaller than the diameter of the parameter space which indicates better performance than local training where each task trains its own model independently. Note one can also give direct bound of the transfer risk of the output of Algorithm I based on the fact that || - wy| S || = M for any task js with optimal parameter Was standard
becomes O
which the same as the excess risk for local training. Therefore, Algorithm is at least as good local training, in the worst case, recover the performance of local training.
derivation gives that E (br:: - & < O
L.M VT
The rate achieved in Theorem is the same order of the non-private rate O (
ML from Vn VK
[3] in the regime most common in practice where d (()) and 8(1). Note that [8] obtains O ( convergence on the number of tasks K under record-level privacy guarantee, but their analysis relies on the assumption for the loss function be a-quadratic growth, which we do not require for our analysis. Furthermore, the meta learner An, the excess transfer risk in [8] is defined as (AAx - min Ey while ours is defined E, p) Ep-p emin R2 (w)]. Since min E (w) > Eyeo [min R,, (w)]. our bound holds under a stronger definition for the excess transfer risk. Hence, our bound is valid upper bound for the notion defined in [8]. The detailed proofs of Theorems 4 and can be found in the appendix.
have different definitions of excess transfer risk from [8], given
Ry (w(( (w)
Communication--fficeeee private meta Learning with DP-FTMRL Although Algorithm gives transfer risk comparable with the non-private rate, it requires O (min (oii(VKK, k3/2 / rounds of communication to each task on average. This can be expensive when the task number K is large but each task only has limited computation and communication resource, which is common setting in distributed scenarios like federated learning. Therefore, we introduce a communication efficient Leader (DP-FTMRI) which
DP meta algorithm Differentially Private is based on the DP-FTRI. algorithm in [23]. DP-FTMRI. is a one-pass algorithm which means that every task will be communicated by the server for only once. Furthermore, it processes each task sequentially thus allows tasks to arrive in stream. With high probability over the algorithm
This rate is suboptimal compared with the one achieved in Theorem 5, but DP-FTMRL provides significant savings on the communication cost. More details of DP-FTMRL can be found in the appendix.
inner randomness, DP-FTMRL obtains transfer risk of Ô LV
+ ML VK
2'/4
vn
VKe
Note: To get the excess transfer risk guarantee in Theorem 5, we need to set
Y vn
which requires the knowledge the value of V, the task similarity. In fact, we can privately approximate V using its empirical counterpart; in particular,
find private counterpart for 122 A minsew _े E || w [2 where uZ (2,) is minimizer of the empirical loss of task Z, This can be done using standard DP convex optimization methods such Noisy Gradient Descent. An alternative approach to choose a setting for X, which is quite common in practice, treat as hyperparameter [4] and tune it privately. This can also be done using existing methods in the literature of DP [24, 25].
K
5 Private Clustering-Based Meta Learning
In this section, we consider the case where the tasks are sampled from distribution with multiple concentrations (e-g.. a multi-modal distribution) where single meta model is not enough to capture the relationship among tasks. A natural extension to cluster the tasks into several groups and train meta model for each group.
7

---

To provide a more formal treatment, we let denote the number of possible meta models (clusters), each is parametrized with bias vector hę These meta models are denoted as (h1, h2,..... .. h2)) The task similarity in the presence of y meta modals is hence modified to
V2
min E Bus min h; --oor, (h4) Re
EW
KE(0]
Recall that Wr is the set of optimal parameters for task μ.. Note that Vo is no larger than V from single meta learner case defined in (3). In the case when { {W,} contains multiple disjoint and far apart concentrations, Ve can be much smaller compared with V.
In particular, inspired by the idea of hypothesis based clustering from [26], we define the objective of the meta-algorithm with meta learners as
K min Zz(h) E
min W.
(h,
K
where Lz(-) the meta loss.
Given = (h1 ... hg), the base learner with dataset set Z first chooses the h, with lowest meta loss, that is, C(Z) arg min (h,) and output the corresponding minimizer Wherz) (Z)
min (w; ho(z)) minwew (x(w)) 2/2 || ha(2) 1| Therefore, the transfer risk is defined as
(n; Ex-pEZ-ne Bi (Where)(2))
We present our meta-clustering algorithm described in Algorithm which is inspired by the HYP- CLUSTER algorithm in [26]. Algorithm 2 is heuristic algorithm aiming at minimizing the objective (9) over hi.... hy. Each iteration consists of two steps, the model selection step and model update step. At the beginning of one iteration, each sampled task selects the model from (h: 1 that incurs the lowest loss. After the assignment done, the server will update each model with its corresponding tasks.
We formally show the privacy guarantee of Algorithm 2. The performance of this algorithm in terms of its transfer risk will be evaluated empirically since convergence to a true optima is not guaranteed due to the non-convexity of Ê, (h, Z)) in h.
Algorithm 2: Ameta-cluster" private clustering-basee based meta learning algorithm
input :q randomly initialized iterates h hg. "i.....,, hg. number iterations T, batch size m Set noise variance x² 8T(2L+6)* 1og(1/8)
(og(1)))) K²2²
for t 1.......,,
do Server samples batch of tasks B, of size and sends {h:) to B, for each task Z B, do
For i [4]. compute approximate minimizers of Rz, (w, ht) as (2) with approximation error &
Select the model with smallest meta loss C(Z) = arg min Rz. (2),
Compute the gradient Lz ((2)) -
[() - h O(2)
12
Send (C(Z), LZ (z()((2) back to server
end
10
For every i [q], denote the set Ci = {Z E = =
server updates hf as
G ))
h = Projw
h4 h
Σ LZz(h;) + ZEc
where Gj (0, Ta) drawn independently each iteration / and meta model output: : (17,, ...
11 end

---

Theorem 6. (Privacy guarantee) Let {h+... h1 ter be the output, Algorithm 2 is (c, --dffferrnttialy private on task level.
Proof. Similar to Theorem 3, we have the norm of Lz ((2)) is bounded by (2L b) for any choice of C(Z). Since each task only selects one meta model to update in each iteration, we consider (M:) as the model iterate and V (Ti))))) as the model update from the task, we can use the same argument Theorem 3 to complete the proof.
Experiments
In this section, we empirically evaluate the performance of our algorithms under various privacy regimes. On the one hand, demonstrate the performance improvement of our algorithms local training. Meanwhile, when the tasks are sampled from multi-modal distribution, we show that our clustering based algorithm achieves lower transfer risk than the single meta model paradigm.
traiiing
(a) Single-cluster case
(b) Multi-clusters case
Figure 1: The transfer risk of Ameta cluster in linear regression task with respect to the number of tasks. e is the privacy parameter and is the number of meta models (clusters).
We consider linear regression task with mean square loss. The weight vector wy, is d-dimentional vectors that concentrates around one or more common vectors. We let d = 30 for all experiments. The feature vector is uniformly sampled from unit ball, and the label y (w,, .²) + n where is the zero mean Gaussian noise with standard deviation equal to 0.5.
Single cluster case:
For each task μt, its d-dimensional weight vector Wμ is sampled from Gaussian distribution with mean and with variance o², denoted as N o²Ia). In the experiment, o and h is a vector with all entries equal to 4. Each task contains 10 datapoints (I:,, 11) The privacy parameters e are chosen from (1, 3, 10] and 8 set as 10 10-5 We set the clipping norm to 2 and use the functions from TensorFlow privacy[27] to choose the noise multiplier fit the privacy budget. In Figure 1, the transfer risks of our meta learning algorithm are substantially better than the transfer risk of local training even in high privacy regimes when 1. Furthermore, by comparing the transfer risks for different c's, we show that the performance gaps are much less significant compared with the gap between local training. modest privacy regimes when 3 or 10, the corresponding transfer risks are quite close to the non-private rate (E = =c).
The weight vector sampled from the distribution (h,,, 22Ia where is uniformly sampled from the set {hr,... ... he). In the experiment, t, the number of cluster in the un- derlying distribution, is set to be 3, = 0.5 and we choose { h2. ha to be three orthogonal vectors with different norms. More specifically. hn [2. 2, 0, ... fr [0, [0..... ......... ........ -4.......
Multi clusters case:
O, O.... and ha [0, ... 0. 6. ...... 6). and each w; has 10 non-zero components. The privacy parameters e are chosen from (3, 10) and is set as 10-3 the clipping norm set Furthermore, we set 9. the number of meta models in Algorithm 2, from 1 to 3 and report the transfer risk with each 9. The plots Figure confirms our claim that we can achieve better performance by adding the number of meta models. By choosing different number of meta models, the performance gap can be significant. Meanwhile, similar to the single cluster case, with the same number of clusters, we see relatively small performance difference under various privacy parameters.

---

In Appendix C. we present additional experiments to evaluate our algorithms on Omniglot [28] few-shot classification tasks, where we demonstrate an improved performance over existing DP meta learning methods.
7 Conclusion and Future Work
In this work, we studied the meta learning problem with task-level privacy. When a single meta model trained, we have shown, both theoretically and empirically, that our private meta algorithm achieves better performance than local training when the variation among the tasks is relatively small. To deal with more complex task distribution, we also proposed a private clustering- algorithm that outputs multiple meta models. This approach can provide noticeable performance gains over the single meta model paradigm as demonstrated by our empirical results.
meta learning
An interesting direction for future work is to formally study the accuracy guarantees of our clustering- based algorithm. Due to the non-convexity of the objective function, theoretical analysis on the transfer risk may be challenging. However, it is still possible to obtain guarantee to characterize the generalization property of the clustering- algorithm.
Acknowledgments and Disclosure of Funding
This work is supported by NSF Al-Institute Award 21 12471.
10

---

References
[1] Chelsea Finn, Picter Abbeel, and Sergey Levine. Modcl-agnostic meta-learning for fast adaptation of deep networks. International conference on machine learning, pages 122--1135. PMLR, 2017.
[2] Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-leaming algorithms. arXiv preprint 1rr3iv:803.0222. 2018.
[3] Giulia Denevi, Carlo Ciliberto, and Riccardo Grazzi. Learning-to-lea stochastic gradient descent with biased regularization. In International Conference on Machine Learning, pages 1566-1575. PMLR, 2019.
[4] Pan Zhou, Xiaotong Yuan, Huan Xu, Shuicheng Yan. and Jiashi Feng. Efficient meta learning via minibatch proximal update. Advances in Neural Information Processing Systems, 32, 2019.
[5] Aravind Rajeswaran, Chelsea Finn, Sham M Kakade, and Sergey 1 Levine. Meta-learning with implicit gradients. Advances neural information processing systems, 32, 2019.
[6] Weisen Jiang, James Kwok, and Yu Zhang. Effective meta-regularizztion by kernelized proximal regular- ization, Advances Neural Information Processing Systems, 34, 2021.
[7] Maria-Florina Balcan, Mikhail Khodak, and Ameet Talwalkar. Provable guarantees for gradient- mcta-learning. In International Conference on Machine Learning, pages 424-433. PMLR, 2019.
[8] Jeffrey Li, Mikhail Khodak, Sebastian Caldas, and Ameet Talwalkar. Differentially private meta-learning In International Conference Learning Representations, 2019.
[9] Alberto Bietti, Chen- Yu Wei, Miroslav Dudik, John Langford, and Steven Wu. Personalization improves privacy-accuracy tradcoffs in federated learning. In International Conference on Machine Learning, pages 1945-1962. PMLR. 2022.
[10] Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith, Private multi-lask learning: Formulation and applications to federated learning. arXiv preprint arXiv:2108. 2021.
[11] Prateek Jain, John Rush, Adam Smith, Shuang Song, and Abhradeep Guha Thakurta. Diffcrentially private model personalization. Advances in Neural Information Processing Syxtems. 34:29723-29733 2021.
[12] Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. Personalized federated learning: A meta-learning approach. arXiv preprint arXiv:2002.07944 2020.
[13] Yihan Jiang. Jakub Konečný, Keith Rush, and Sreeram Kannan. Improving federated learning personaliza- tion via model agnostic meta learning. arXiv preprint arXiv:I909.1244 12488. 2019.
[14] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efliieee learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282. PMLR, 2017.
[15] H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations, 2018
[16] Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: client level perspective. arXiv preprint 1rXiv:1712.07557, 2017.
[17] Daniel Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mehryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy. Advances in Neural Information Processing Systems, 34, 2021.
[18] Cynthia Dwork. Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptogruphy conference, pages 265-284. Springer, 2006.
[19] Raef Bassily. Vitaly Feldman, Kunal Talwar, and Abhradeep Thakurta. Private stochastic convex opti- mization with optimal rates. In Proceedings the 33rd International Conference Neural Information Processing Systems, pages 11282- 11211, 2019.
[20] Nesterov. Smooth minimization non- non-smooth functions. Mathematicll programming. 103(1):127-152. 2005.
[21] Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficiinnt algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pages 464 473-473. IEEE, 2014.

---

[22] Vitaly Feldman, Tomer Koren, and Kunal Talwar. Private stochastic convex optimization: optimal rates in linear time. In Proceedings of the 52nd Annual ACM SIGACT Symposium Theory of Computing, pages 439-4492 2020.
[23] Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shufiling. In International Conference on Machine Learning, pages 5213-5225 PMLR, 2021.
[24] Jingeheng Liu and Kunal Talwar. Private selection from private candidates. Proceedings of the 51st Anmual ACM SIGACT Symposium on Theory of Compuing, pages 298-309, 2019.
[25] Nicolas Papernot and Thomas Steinke. Hyperparameter luning with renyi differential privacy. arXiv preprint ar 10.03620, 2021.
[26] Yishay Mansour, Mehryar Mohri, Jae Ro, and Ananda Theertha Suresh. Three approaches personaliza- tion with applications to federated learning. arXiv preprint arXiv:2002.10679 2020.
[27] Tensorflow-prvacy.
http::///hatcccccceee//aaoaa///p 2022.
[28] Brenden Lake, Ruslan Salakhutdinov, Jason Gross, and Joshua Tenenhaum. One shot learning of simple visual concepts. Proceedings of the annual meeting of the cognitive science society, volume 33, 2011.
[29] Shai Shalev-Shwartz and Shai Ben-David. Understanding machine learning: From theory algorithms. Cambridge university press, 2014.
[30] H Brendan McMahan. Machine Learning Research, 1811):31173316, 2017.
survey of algorithms and analysis for adaptive online Icarning. The Journal
[31] Elad Hazan al. Introduction online convex optimization. Foundations and Trends in Optimization, 13-4):55 2016.
[32] Shai Shalev-Shwartz, Ohad Shamir, Nathan Srebro, and Karthik Sridharan. Stochastic convex optimization. In COLT, volume 2, page 5, 2009.
httpp///gtttbb.ccm////ttttttt/// [33] Huang Gabriel. reptile-pytorch.
2018.
12

---

Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [N/A] There are no foreseeable negative societal impacts for this work.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main ex- perimental results (either in the supplemental material URLJ? [Yes) Included pseudocode and synthetic datasets details.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [No]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [N/A]
(b) Did you mention the license of the assets? [N/A] We publicly available datasets.
(c) Did you include any new either in the supplemental material or as a URL? [N/A]
(d) Did you discuss whether and how consent obtained from people whose data you'ne using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent participant compensation? [N/A]
13


Reviews:
[{"review_id": "glal3alFTDa", "reviewer": "Reviewer_GS79", "summary": "In this work, the authors propose meta learning algorithms with task-level differential privacy to protect the entire dataset for each task. The authors also conduct experiments to empirically evaluate the effectiveness of our proposed algorithms.", "questions": "[1] Can the proposed algorithm be applied to other losses, e.g., the general convex algorithms?\n\n[2] The influence of the task difficulty and the meta models’ weights on the task similarity is not studied. Theoretical and empirical analysis should be given.\n\n[3] It is not clear about the derivation of the set of optimal parameters for the tasks in Eqn. (8). The definition of optimality is undefined in the paper. In addition, the difference comparison between $V_{c}$ and $V$ is not given.\n\n[4] It would be better if the authors conduct experiments on the large-scale real-world datasets to evaluate the performance of the proposed methods.\n\n[5] More discussions on the personalized privacy-preserving requirements of different tasks should be given.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros\n\n[+] The authors propose a task-level differentially private meta learning algorithm based on the meta-regularization approach.\n\n[+] The authors propose a private clustering based meta learning algorithm to enable private meta learning of multiple meta models.\n\n\n\nCons\n\n[-] The contribution of this paper seems limited. For example, in this paper, the authors directly apply existing differential privacy (DP) optimization techniques like Noisy SGD (e.g., [1]) on the newly defined \"data point\" and loss function achieves task-level differential privacy naturally. In addition, the proposed meta-clustering algorithm is directly derived from the HYP CLUSTER algorithm in [2].\n\n[-] The authors make strong assumptions, e.g., the assumption of the strongly convexity of the base learner $R_{Z,\\lambda}$.\n\n[-] The experiment evaluation is limited. Firstly, there are some existing DP meta learning algorithms and task-level DP algorithms, and the authors fail to compare the proposed algorithms with those baselines. In addition, the influence of different task distributions is unexplored in the experiments. Lastly, the size of the adopted dataset is small.\n\n[1] Bassily, Raef, Vitaly Feldman, Kunal Talwar, and Abhradeep Guha Thakurta. \"Private stochastic convex optimization with optimal rates.\" Advances in neural information processing systems 32 (2019).\n\n[2] Mansour, Yishay, Mehryar Mohri, Jae Ro, and Ananda Theertha Suresh. \"Three approaches for personalization with applications to federated learning.\" arXiv preprint arXiv:2002.10619 (2020).\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "_Pj-KjVorB", "reviewer": "Reviewer_zJxt", "summary": "This paper proposes a task-level differentially private meta-learning algorithm based on the meta-regularization method. The authors provide the privacy and utility guarantees based on convex and Lipschitz loss assumptions. They also present a clustering-based method to deal with the case where the tasks are sampled from multi-modal distributions. They evaluate the performance of the algorithms in the case of linear regression tasks with mean square loss.", "questions": "none", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "1.\tThis paper studies the problem of meta-learning with task-level differential privacy. However, the motivation of this paper is not clear. The authors claim that the record-level is not sufficient in many scenarios (line 9, 53) and they present an “email spam filter” example (line 53-56) to support this point. However, they do not clearly explain what kind of “sensitive information” (line 56) can be protected by task-level DP instead of record-level DP, which makes the example unconvincing and the paper not well-motivated.\n\n2.\tThe proposed approach is conceptually simple. They apply noisy SGD [14] to meta-level updates of the meta-regularization method [3,4] to get their task-level private meta-learning algorithm. The analysis of privacy and utility guarantees also follows [14], which is quite standard.\n\n3.\tThe assumptions in Assumption 1 are too strong for meta-learning scenarios. Meta-learning methods are typically applied in reinforcement learning and deep learning scenarios [1-6], which generally do not satisfy Assumption 1. As the privacy guarantee analysis of the proposed algorithms relies on assumption 1, the proposed algorithms are not practical in meta-learning scenarios.\n\n4.\tThe experiments demonstrate the effectiveness of the proposed methods. However, the experiments are also very toyish (only in the case of linear regression task with MSE loss on toy dataset), which reduces the practical values. This could be also because of the overly strong assumptions (as mentioned in the third review).\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "Q_TIUgYGhwQ", "reviewer": "Reviewer_awko", "summary": "Meta learning has been applied successfully in the Machine learning area recently to generalize new task with new small datasets efficiently including meta-initialization and meta-regularization methods. Meanwhile, meta learning may suffer from leakage of sensitive information and privacy part of meta learning has not been well studied. Although a work with meta-initialization method designs a record-level differential privacy approach, it is still too weak to be against aggregate statistics and has potential leakage as well as unrealistic (strict) assumption. To fill the gaps, this work proposes a meta-regularization-based task-level DP algorithm and guarantee transfer risk as well as accuracy with less strict assumption.", "questions": "1. Since the manuscript mentioned meta learning in the distributed setting, did you consider secure multiparty computation as another feasible approach to tackle privacy issue during meta learning?", "limitations": "No potential negative societal impact found.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n1. Assumption of this work is less strict as existing works (only assume convex and Lipschitz loss).\n2. Existing DP optimization (Noisy SGD) can be applied to this algorithm as almost “free lunch”.\n3. Design a novel task-level DP clustering-based meta learning algorithm for multiple meta models as well.\n\nWeakness:\n1. Like existing work based on meta-initialization only, this work is based on meta-regularization only. Since this work has mentioned those two methods could be connected by framework of online convex optimization, it would be nice to consider meta-initialization as well under the mentioned framework.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept