DP-Mix: Mixup-based Data Augmentation for Differentially Private Learning
Authors: Wenxuan Bao
Francesco Pittaluga
Vijay Kumar b g
Vincent Bindschaedler
Venue: NeurIPS 2023 poster (2023)
Keywords: differential privacy
deep learning
data augmentation

Abstract: Data augmentation techniques, such as image transformations and combinations, are highly effective at improving the generalization of computer vision models, especially when training data is limited. However, such techniques are fundamentally incompatible with differentially private learning approaches, due to the latter’s built-in assumption that each training image’s contribution to the learned model is bounded. In this paper, we investigate why naive applications of multi-sample data augmentation techniques, such as mixup, fail to achieve good performance and propose two novel data augmentation techniques specifically designed for the constraints of differentially private learning. Our first technique, DP-Mix_Self, achieves SoTA classification performance across a range of datasets and settings by performing mixup on self-augmented data. Our second technique, DP-Mix_Diff, further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. We open-source the code at https://github.com/wenxuan-Bao/DP-Mix.

DP-Mix: Mixup-based Data Augmentation for Differentially Private Learning
Wenxuan Bao
Francesco Pittaluga"
Vijay Kumar G
Vincent Bindschaedler'
University of Florida
NEC Labs America
Abstract
Data augmentation techniques, such image transformations and combinations, are highly effective at improving the generalization of computer vision models, especially when training data limited. However, such techniques are funda- mentally incompatible with differentially private learning approaches, due to the latter's built-in assumption that each training image's contribution the learned model is bounded. In this paper, we investigate why naive applications of multi- sample data augmentation techniques, such as mixup, fail achieve good per- formance and propose two novel data augmentation techniques specifically de- signed for the constraints of differentially private learning. Our first technique, DP-MIXSELF- achieves So'TA classification performance across a range of datasets and settings by performing mixup on elff-augmeted data. Our second technique, DP-MIXDIFF further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. We open-source the code at wwt.weowoaann..aeeeeeeeee Sttps://githun www wenxuan www.aaaanaaaaananaaaaaaa Bao/DP-Mix
Introduction
Differential privacy (DP) 12 is well-established paradigm for protecting data privacy, which ensures that the output of computation over a dataset does not reveal sensitive information about individuals in the dataset. However, training models with DP often incur significant performance degradation, especially when strong privacy guarantees are required or the amount of training data available is limited.
One class of techniques to overcome limited training data in classical (non-private) learning is data augmentation. Unfortunately, the analysis of differentially private learning mechanisms requires that the influence of each training example limited, so naively applying data augmentation techniques is fundamentally incompatible with existing differential private learning approaches. Therefore, new approaches are required to leverage data augmentation.
Recently, De et al. 99 showed one way to incorporate simple data augmentation techniques, such as horizontal flips and cropping, into differentially private training. Their approach creates several self-augmentations of a training example and averages their gradients before clipping. This procedure compatible with differential privacy because each training example only impacts the gradients of the self-augmmenttionn which are aggregated together before clipping, thus preserving the sensitivity bound. However, this requires using data augmentation techniques that operate on a single input
example, thus excluding large classes of multi-sample techniques such as mixup [46 16 38 47 6
and cutmix [44] 8). Furthermore, as shown in 99] their approach quickly hits diminishing returns after 8 or 16 self-augmeenatioons.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Text Prompt:
photo of <class_nes name>
Real Sample:
Diffusion Model
Augmentations:
Mixup
Augmentations:
grad[e]
grad[1]
grad[n-1]
grad[n]
grad[n+1]
grad[2n-1]
DP-MIXSELF clip(mean(grad(([nn))
DP-MIXDIFF
(lea(nneng 2n]))
Figure Approach Overview. Illustration of ur proposed methods for applying mixup under differential privacy: DP-MIXsEuP and DP-MIX
this paper, we leverage multi-sample data augmentation techniques, specifically mixup, to improve differentially private learning]] We first show empirically that the straightforward application of mixup, i.e., using microbatching. fails to improve performance, even for modest privacy budgets. This is because microbatching inherently requires higher noise level for the same privacy guarantee.
To overcome this, we propose a technique to apply mixup the per-example DP-SGD setting by applying mixup to self-augmeenatioos of a training example. This technique achieves SoTA classification performance when training models from scratch and when fine-tuning pre-trained models. We also show how to further enhance classification performance, by using text-to-iman to-image diffusion-basee model to produce class-specific synthetic examples that we can then mixup with training set examples at no additional privacy cost.
2 Background & Related Work
2.1 Differential Privacy & DP-SGD
Differential privacy (DP) 11 has become the standard framework for provable privacy guarantees.
Definition ((e, DDDfifferential Privacy). A mechanism M (randomized algorithm) satisfies (c, 6)- differential privacy if for any neighboring datasets D, D' and any output set C RRnge(MM), have: Pr(M(D E 5) & exp(E) Pr(M(D' E S) 5.
In the definition 0 is called the privacy budget and 0 5 < 1. Datasets D, D' neighboring if one can be obtained from the other by adding or removing one data point.
DP-SGD. To train machine learning model with differential privacy DDfinition I), Differentially Private Stochastic Gradient Descent (DP-SGD). DP-SGD was proposed by Abadi al. [2] direct replacement for SGD. Informally, for differential privacy to be satisfied, each weight update must hide the presence or absence of any example in the training set (and thus the minibatch). Consider minibatch B with examples. The weight update equation of (minibatch)
SGD is: Wi++1 = w ng; (B), where gj (B) = V .. (B,(B;;)) wi) is the gradient of the loss on B with
We open-source code at https: ttops:///toe / http/bttthut.....gggg www////wuuaennauueeoo Baa--raaaaaaaaaaaMaMaaaa

---

respect to the parameters w and is the learning rate. Remark that inclusion or exclusion of a single example minibatch B can completely change the minibatch aggregate gradient g, (B). To avoid this and satisfy differential privacy, DP-SGD first clips individual gradients and then adds Gaussian noise to the average gradient:
x
@(B) n
clipo + +N(0 C200) Σ
where y; the gradient of the loss on example i of minibatch B with respect to the parameters and ( ). where C > 0 is constant. By clipping individual example gradients clipc(() 9 min TTlla
to norm C, the sensitivity of the gradient sum to adding or removing example is guaranteed to be at most C. After that, adding Gaussian noise with standard deviation Co satisfies DP because it is an application of the Gaussian mechanism [12]. The noise level is calibrated to the privacy parameters 8 and 5.
Since the gradient update only touches the minibatch B, which was sampled from the entire training dataset, we can use amplification by sampling theorems [3] with a sampling rate of n/N where N is the size of the dataset and n = [B] To obtain a differential privacy guarantee over the entire training procedure (which potentially touches each training example multiple times), we apply composition results 2 The full procedure is presented in Algorithm in the supplementary material.
Microbatch DP-SGD. Abadi et al. (2) proposed DP-SGD with per-example gradient clipping. But other researchers have proposed microbatch clipping instead (23), which views minibatch B as composed of m microbatches, each of n/ m examples. With microbatch clipping, we clip the average of the microbatch's gradients instead of the per-example gradients. Note that using microbatches of size 1 is equivalent to per-example clipping.
The noisy gradient for microbatch of size 1 (assuming divides n) is:
n/b
b
1
9
clipe
Σ gia
+0((0,
b
where Ji,j denotes the gradient vector the jth example the 7th microbatch.
The drawback of this approach is that despite clipping microbatches gradients with a clipping norm of C, the sensitivity of adding removing example is actually 2C (as pointed out recently by Ponomareva et al. (29). On a per-example basis, more noise is added.
Data Augmentation and DP. Data augmentation cannot be straightforwardly applied with differ- ential privacy because the privacy analysis requires bound on the sensitivity of any example in the training set. For example, naively applying data augmentation prior to training, by say creating augmentations of each training set example, compromises the privacy guarantee. Existing privacy analyses do not apply because adding or removing an example in the training set now potentially affects the gradients of k examples in each training epoch.
De et al. [9] proposed way to use single-sample data augmentation. Their idea do per-example clipping but to create augmentations of each example (e.g., horizontal flip and cropping) and average the corresponding gradient before clipping. This is compatible because each training set example still only affects one term of the sum of. (1) However, this idea cannot be used for more sophisticated multi- sample data augmentations techniques like mixup [46] that take two or more examples as input to create each augmentation.
2.2 Related work.
SoTA performance in Differential Privacy Machine Learning. Recent studies 5 achieve new SoTA performance in differentially private learning using diverse methods. De et al. 9 modified a Wide-ResNet model's training method, advocating large batches, group normalization, weight standardization, and self-augmentation, achieving SoTA performance on CIFAR-10 with DP-SGD. Sander et law to reduce the computational expense of hyperparameter tuning in DP-SGD, achieving SoTA
(34 introduced a technique using Total Amount of Noise (TAN) and a scaling
3

---

performance on ImageNet and computational cost reductions by a factor of 128. et al. [S] presented mixed ghost gradient clipping, which eliminates per-sample gradient computations, approximates non-private optimization, and achieves SoTA performance on the CIFAR- 10 and CIFAR-100 datasets by fine-tuning pre-trained transformer models. Panda et al. 2 propose an accelerated fine-tuning method, which enables them to achieve So'A performance on the CIFAR-10 10 and CIFAR- 100 datasets.
Mixup techniques. Mixup was initially proposed by Zhang et al. [46]. This technique is applied to input data and its corresponding one-hot encoded labels. Experimental results presented in their work indicate that Mixup enhances model performance and robustness. However, Guo et al. [66 discovered that input mixup may encounter the manifold intrusion problem when mixed example coincides with a real sample. To address this, they proposed Adaptive Mixup, which they demonstrated outperforms the original method. To mitigate the incongruity in Mixup data, Yun et al. [44] proposed Cutmix, which replaces a portion of one sample with another. Instead of applying mixup at the input level, Verma et al. 33 implemented mixup within the intermediate layers of the model. Several works have utilized Mixup in the context of Differential Privacy (DP), such as Borgnia et al. 4. which used it as a defense against backdoor attacks, and Xiao et al. 44). which used it to introduce randomness into the training process, or in other settings such as Split learning (26]. To the best of our knowledge. no previous work has employed Mixup as a data augmentation strategy to enhance model performance in differentially private learning.
10 24 have emerged as a powerful class of generative models that leverage the concept of stochastic diffusion processes to model complex data distributions, offering a promising alternative to traditional approaches such as Generative Adversarial Networks (GANs) [14] and Variational Autoencoders (VAEs) [20]. By iteratively simulating the gradual transformation of simple initial distribution into the desired target distribution, diffusion models provide principled framework for generating high-quality samples however, the implicit guidance results in a lack of user control over generated images. Recently there has been a lot of 3D) due their ability to generate entirely new scenes with previously unseen compositions solely based on natural language. In this work, we use class labels as text input to the text-to-image diffusion model [3 to generate diverse synthetic
Diffusion models. Diffusion models 36
37
interest in text-to-image models [3 B3 32
13 25
samples for augmenting the dataset.
3 Method
Given two examples (wo0 3o) and (x1, and mixing parameter X, mixup creates augmentations as:
x = A . xo + (1 A) and y y= x- you + (1 A) 3/1
(3)
In our experiments, À is sampled from a 3 distribution with a = 0.2. In other words, the augmented example image is simply linear combination of two individual examples To. 21 and its label y is also a linear combination of the two individual examples" labels (one-hot encoded). Typically the two examples (zo, yo) and (z1, 311 are selected randomly from the training data. To use mixup while preserving differential privacy, we must find a way to account for its privacy impact.
For DP training, we cannot use Eg. (3) to create an augmented training set (e.g.. by repeatedly taking two input examples from the sensitive training set and mixing them up) without affecting the privacy budget, as the sensitivity of the hiipped-gradiene
sum of the augmented minibatch would then be (at least) 2C (and not C). To see why, observe that an original example z would impact multiple terms of the sum in Eqq. ()) (the one involving the gradient of and also the one(s) involving the gradient of any mixed-up pair(s) involving 2). Even with exactly one mixed-up pair per original example, adding or removing example from the training set would impact two terms in the potentially changing the aggregated gradient by 2C' In a pathological case, the sum could go from Ce for some ē to -Ce. The sensitivity being 2C means that the scale of Gaussian noise added must be doubled to obtain the same privacy guarantee as we would have without mixup.
sum,
We empirically investigate the impact of doubling the noise for training WRN-16-4 model on CIFAR-10. Specifically, we use a microbatch size of and do input mixup by applying [qq. (3) to the two examples in each microbatch. We then add the mixed up example to the microbatch or let the microbatch consist only of the mixed up example. Then, following microbatch DP-SGD, we clip the gradient of the microbatch and add Gaussian noise to the aggregated gradient sum. Nevertheless, it

---

Table 1: Test accuracy (%) of WRN-16-4 model on CIFAR-10 trained from scratch with (E = 8, 8 = 10 -0-=))-iifferentia privacy. Using microbatch of size 2 yields much worse results than per-example clipping.
Method
Microbatch Size =
Microbatch Size =
DP-SGD
72.5 (.5)
49.7 (.7)
DP-SGD w/ Mixup
N/A
50.1 (.4)
DP-SGD w/ Self-Aug
78.7 (.5)
52.8 (.1)
could be that empirically, the benefits of mixup outweigh the additional noise. Results in Table T show that despite mixup providing clear benefit (compared to traditional DP-SGD) the microbatch size setting is inherently disadvantaged. Better performance is obtained without mixup for per-example DP-SGD. The negative impact of noise due to the increased sensitivity dwarfs any benefits of mixup.
3.1 DP-Mixup
We propose a technique to apply mixup with per-example DP-SGD. The challenge is that with per-example DP-SGD we only have a single example to work with - else we again violate the sensitivity bound required for privacy analysis.
DP-MIX and DP-MIX The basic observation behind our technique is that we can freely apply mixup to any augmentations derived from single data point (z, y) or from (x, y) and synthetic samples obtained independently from a diffusion model. we apply all augmentations, including mixup, before gradient clipping then the privacy guarantee and analysis holds according to the augmentation multiplicity insight from (9)
We assume that have randomized transformation function I that can be applied to any example's features x so that (ax is a valid single-sample data augmentation of æ. We may also have access to a generative model from which we can produce set D of synthetic samples ahead of time. For example, we can use a txt2img diffusion model to create labeled examples (21, 31), (22, y2),.... (zm. Vm) using unguided diffusion. In experiments, photo of <class name>?. Since these "synthetic" examples are generated without accessing the (sensitive) training dataset, they can be used with no additional privacy cost.
generate these samples using the text prompt 'a
Given single data point (ar, y), our technique consists of three steps to produce a set of augmentations. The gradients of each augmentation are then computed and aggregated, and the aggregated gradient clipped and noised as in DP-SGD. The first step takes x and repeatedly applies to the randomized transformation function T. resulting in a set S {(11, y), (z2.2). ;)::.... .... (x Kaa w)} of "base" self- augmentations. The second step (optionally) augments the set S with KOEF randomly selected synthetic examples from the set D created using the diffusion model. If no diffusion model is available, we omit this step, which is equivalent to setting KRUT = O. In the third and final step, we repeatedly apply Eq. KsLP > 0 times to two randomly selected samples from the augmentation set S. thereby obtaining set S' of KSELE mixed up examples. The final set of augmentations is then the concatenation of the base augmentations and the mixup augmentations, i.e., S U..
From this final set of augmentations, we perform DP-SGD training. That is, we compute the noisy gradient as:
E gi.k +N { K
1
clipe
71
where K= KRASE + KOFFF + K KEELF is the total number of augmentations and 9i,k denotes the gradient of the th augmentation of the ,th training example. The same privacy analysis and guarantee are obtained in this case as in vanilla DP-SGD because the influence of each training example on the noisy gradient ğ is at most (observe that the gradients of all augmentations' are clipped together).
The method is described in Algorithm I
An important remark is that the self-augmentation method of De et al. [9] special case our method, corresponding to setting K DEFF and KSELF = i..., one only uses the base augmentation set and mixup.
5

---

Algorithm DP-SGD with mixup (DP-MIXSRIF and DP-MIXDIF))
Require:
Training data (21, v1).............. ..: (2x, yx). loss function (()) R Ei E, ((S((a)), ys). Parameters: learn- ing rate vi, noise scale a, group size B. gradient mixup Kaur and number text-to-image samples Kouy. Let K KuAse + Ksus + Kouv.
bound C, number of augmentations KuAsE, number of
Generate txt2img samples: = (21, Vn), (22, Wel,.... (Zms Mon) Initialize 8u randomly
for t [2' do
Take random sample B, with sampling probability N for each (zi, 3/) E Bg do
Generate S = ((211, (()),,);), (#:2, yi).... (ZiKunses 1s)} // Self-Aug
if K then
Randomly select Kou samples from D and add them // DPMM
end if
Generate S' consisting of Ksus mixup samples from randomly selected pairs from S // DP- -P-MIX for each (x' .y") E ESSSS do
ge -- VoL(fa(x"): end for
(2,)) f k (x)()=))
(x:)
gt (a:) /max(1, (ll
end for
g: f B ( (x.) + N
0111
f 0,
- T
end for
Ensure: 0r and compute the overall privacy cost (c, using privacy accounting method
We define two variants of our method based the availability of diffusion samples. If we have access to a diffuusin model so that Kom > 0, we call the method DP-MIXDIR- In that case, the pool from which examples are selected for mixup includes synthetic samples from the diffusion samples. Otherwise, K 0 and the proposed method has the effect of applying mixup on randomly selected self-augmentatioos of single original example, thus call this variant DP- DP-MIX Interestingly, DP-MIX. DP-MIXSELF is not completely faithful to classical mixup because there is only one original example being mixed up and the label unchanged.
Finally, we point out that although our focus is on mixup, other multi-sample data augmentation techniques such as cutmix and others 44 g
can be applied in the third step.
4 Experimental Setup
Datasets. We use CIFAR-1O. CIFAR-100, EuroSAT, Caltech 256, SUN397 and Oxford-IIIT Pet. The details of these datasets are in Appendix C'in Supplemental materials.
Models.
We use the following models/model architectures.
Wide ResNet (WRN) 45 is a variant of the well-known ResNet (Residual Network) model Ir which is commonly used for image classification tasks. increases the number of channels in convolutional layers (width) rather than the number of layers (depth). WRN-16-4 is used in De et al. 9 and we use the same model ensure fair comparison.
Vit-B-16 and ConvNext are pre-trained on the LAION-2B dataset 35 the same pre-trained
dataset as for our diffusion models, which we obtained from Open Clip We add a linear layer as a classification layer. We only fine-tune this last layer and freeze the weights of other layers.
Setup. To implement DP-SGD, we use Opacus [ and make modifications to it. For training from scratch experiments, we the batch size to 4096, the number of self seff-augmentation to 16. the clip bound to C = 1, and the number of epochs to 200. For fine-tuning experiments, we change the batch size 1000 and the number of epochs 20 for EuroSAT and 10 for all other datasets. Reported test accuracies are averaged based on at least three independent runs and we also report the standard deviation. We provide additional details on our experimental setups in supplementary materials.

---

Selection of pre-training data, diffusion model, and fair comparisons. We take great care to ensure that our experiments lead a fair comparison between our methods and alternatives such as Self-Aug (prior SoTA). In particular, all methods have access to the exact same training data. We also tune the hyperparameters of each method optimally (e.g.. KEASE for Self-Aug). We use the same pre-trained models (Vit-B-16 and ConvNext from Open Clip) to compare our methods to others (Self-Aug and Mixed Ghost Clipping).
Since DP-MIXDIEP uses a diffusion model to generate synthetic examples, this could make the comparison unfair because other methods do not use synthetic samples. To avoid this, we purposefully use the exact same pre-trate training data (i.e.. LAION-2B) to pre- pre-train models as was used to train the diffusion model. This avoids the issue of the synthetic examples somehow "containing" data that other methods do not have access to. Moreover, we conducted experiments (check [Tble 6) to show that the synthetic examples themselves do not boost performance. DP-MIXDIEF that boosts performance. Finally, out of the six datasets we used for evaluation, none of them overlap with the LAION-28 dataset (to the best of our knowledge).
the way they are used by
5 Experiments
5.1 Training from Scratch with DP
Since DP-MIXDIF relies on synthetic samples from diffusion models, would not be fair to compare it prior SoTA methods that do not have access those samples in the training from scratch setting. Therefore, we focus this evaluation on DP-MIXSELF- For this, we use a WRN-16-4 model. Our baseline from this experiment is De al. 9 who use combination of techniques improve performance, but mostly aelf-augmettttion. Results in Table 2 show that DP- MM-XELL consistently provides improvements across datasets and privacy budgets.
We observed differences between the results reported by De et al. using JAX and the reproduction by Sander et al. [34] on Pytorch. In our supplemental materials, Table 11 presents our reproduction of De et al. [ using their original JAX code alongside the DP- MPXMLE implementation.
Table 2: Test accuracy (%) of a WRN-16-4 model trained from scratch: Our proposed DP- DP-MIX technique significantly outperforms De et al. (9] Self-Aug method (baseline and prior SoTA) in all privacy budget settings and all three datasets considered.
Dataset
Method
==
6= 2
8=
Self-Aug
56.8
62.9 (.3)
69.5 (.4)
78.7 (.5)
CIFAR-10
DP-MIXSELF
57.2 (.4)
64.6 (4)
70.47 (.4)
79.8 (.3)
Self-Aug
(.5)
20.9 (.4)
31.8 (.2)
(.4)
CIFAR-100
DP-MIX
14.1
21.5 (44)
3.33
40.6 (.3)
Self-Aug
81.1 81.1 (.3)
85.8 (.2)
89.7 (:3)
EuroSAT
DP-MIXşaFF
75.7
82.8 (3)
87.4 (.2)
(.2)
5.2 Finetuning with DP
We consider two pretrained models V6t-B-16 and ConvNext. As baselines/prior SoTA we consider De et al. g and the Mixed Ghost Clipping technique of Bu et al. [5] Results are shown in Table 3
We observe that our proposed DP-MIX method yields significant improvements over all prior methods across datasets and privacy budgets. We also observe that DP-MIXDUr. which uses samples from the diffusion model. significantly outperforms DP-MIX on datasets such as Caltech256. SUN397, and Oxford-IIIT Pet. Notably, when the privacy budget is limited, such as = 1, we observe remarkable improvements compared to DP- (e.g.. 8.5% on Caltech256 using Vit-B-16). This shows the benefits of incorporating diverse images from the diffusion model via mixup.
On the other hand, we observe that diffusion examples do not provide a benefit for datasets such as CIFAR-10 and AT. We investigate the cause of this empirically in Anpppediix B (supplementary materials). On these datasets, DP-MIX only sometimes outperforms the prior baselines, but DP-MIX provides consistent improvement, suggesting that samples from the diffusion model
7

---

Table 3: Test accuracy (%) fine-tuned Vit-B-16 and ConvNext: We fine-tune Vit-B-16 and
ConvNext models on CIFAR-10, 10. CIFAR-100, EuroSAT, Caltech256, SUN397 and Oxford-IIT Pet datasets using different with 10- and report the test aceuracy and standard deviation. Our proposed methods, DP-MIX and DP- DP-MIXDIFF, outperform the baselines in all cases.
Vit-B-16
ConyNext
Dataset
Method
6 =
6
6
6 2
Mixed Ghost
95.0
95.0 (.2)
95.3 (.4)
95.3 (.2)
(.16
(.16
94.7 (.0)
94.7 (.1)
Self-Aug
96.5 (.1)
97.0 (.0)
97.1 (.0)
97.2 (.0)
(.09
(.14
(.15
96.5 (.0)
CIFAR-10
97.2 (.3)
9:24
(724
97.6 (33)
96.8
96.9 (1)
(1,)
DP-MiXpue
97.0 (.2)
97.1
(.12
97.3
9.13
(.1)
9..6
9..7
Mixed Ghost
78.2 (.4)
(.15
(.34
(..4
7.39
7..1
7.25
7..8
Self-Aug
79.3 (.2)
83.2
83.5
84.2
(.3
8..0
(144
82,2
CIFAR-100
MP-MIXsar
81.8
(.1
8.15
84,6
78.2
80.9
82.3
82.3
DP-MIXDue
8.10
83.8
(.1
(.13
79.4 (.2)
81.4
81.6
81.8
Mixed Ghost
(.10
84.8 (.2)
(.19
8..0
8.25
86.9 (.1)
87.0
87.6(3))
EuroSAT
Self-Aug
(.23
(:2)
(224
(.25
93.5
94.5
9..2
96.2(.)
MP-MiX
94.3
94,9 (.2)
95.6
(.16(.))
94.6 (.1)
94.7
9524
9..5
DP-MIXDwE
(.16
93.4 (1)
(.2
(.1
92.8
(.1
93.
931
Mixed Ghost
79.7 (:2)
88.2
91.4
92.3
(.22
8..4
8.10
8..2
Self-Aug
(.1)
89.7 (.2)
(.10
93.2
8.20
88.2
91.0
92.2
Caltech256
DP-MiXsuur
(12
90.1 (2)
92.2
(.)
(1.0
(1)
(1)
(..4
DP-MIXpie
89.7 (22)
91.8 (.2)
92.9
93.9 (.1)
88.7 (22)
91.8 (.2)
9.26
9.13
Mixed Ghost
70.7 (.2)
(.12
(2)
(2)
6..3
6..0
(..3
(1)3
Self-Aug
72.7 (.1)
76.0
(.10
(.26
(.12
7.15
78.0
(1.9
SUN397
DP-MIX
(.12
76.5 (:2)
78.7
(.16
72.5((1)
76.8
78.5
79.5
DP-MIXDir
75.1 (.2)
77.8 (.1)
(.2)
80.6 (.1)
75.0 (.2)
(..5
79.3
80.0
Mixed Ghost
7.22
79.1
(024
(120
(..2
78.2
7.21
79.9
Oxford
Self-Aug
7..2
82.1
85.8
(.12
68.1 (.2)
81.3
(.15
(.10
Pet
DP-MIX PP-MMXs
7.25
82.5
(.28
88.7
(22)
81.7
86.3
87.7
DP-MIX
8.32
86.3 (.2)
88.3 (.2)
89.4 (.2)
80.5 (.2)
86.2 (.2)
88.2 (.2)
88.8 (.2)
can inhibit performance. On CIFAR-100, DP-MIX outperforms other methods only at low privacy budgets (s 2), with DP-MIXSELE providing the best performance in the high privacy budget regime.
Ablation Study: Why Does DP-MIX Improve Performance?
perform ablation experiments to better understand why our methods consistently and significantly outperform the prior SoTA techniques.
6.1 Understanding Self-Augmentations
Since DP-MIXSELF does not alter the label and involves applying mixup to (augmentations of) single original training example, the method could be viewed as just another single-sample data aug- mentation technique. The question then becomes what augmentation techniques improve performance when using differential privacy and why.
De et al. 9 use flipping and cropping as coff-augmentation (Self-Aug). We perform experiments using several widely used augmentation techniques (based on Chen al. Colorjitter, Translations and Rotations, Cutout, Gaussian Noise, Gaussian Blur, and Sobel Filter) in addition to Self-Aug to compare them to DP- -P-MMI We set KEASE
as in previous experiments. Results are shown in Table where the second to last column combines all augmentations together (randomly chosen). We observe that these augmentations do enhance performance to the same degree as DP-MIX In few cases, the augmentations improve performance slightly above Self-Aug, but some of them also diminish performance.
6.2 Number of Self- Self-Augmeetations
Increasing the number of self-auggmentaiion beyond 16 does not improve performance (9. This was also pointed out recently by Xiao et al. 41). In fact, sometimes increasing the number of

---

Table Test accuracy (%) Self-Aug with other Augmentations: Vit-B-16 model performance on CIFAR-10 10 and CIFAR- 100 with = 1 with different augmentations. We observe that these
augmentations do not enhance performance to the same degree as DP-MIX
Dataset
Self-Aug
+Jitter
+Affine
+Cutout
+Noise
+Blur
+Sobel
+AIl
DP-MIX
CIFAR-10
96.5 (.1)
96.3 (.1) 9612 (.1)
95.8 (.2) 96.7 (.2)
72.5
96.5 (.2)
97.2
CIFAR-100
79.3 (.2)
78.1 (.2) 73.9 (.2) (.1) 73.5 (2)
80.0 (.))
9.5 (2)
79.4 (.))
81.8 (2)
self-augmentations hurts performance. We perform experiments by varying the number of self- augmentations BKBSE)) on CIFAR-IO. Results are shown in Table 5J We observe that KBASE = 16 is optimal for the cell-augmentations proposed by De al. However, we obtain significantly better
performance DP-MIX for K 32 BAAE = 16, KSELF 16 and K D = 0). Recall that setting
K KELFF in Algorithm recovers the Self-Aug method of 9
Table 5: Increase K BASE from 16 to 36 for Self-Aug. We conduct experiments CIFAR-10 with E = 8 and 10-5 in two settings: train a WRN-16-4 model from scratch and fine-tune a pre-trained
Vit-B-16. We observe that for both cases, there substantial performance improvements when increasing KBASE-
Training method
Total # of Aug
WRN-16-4
Vit-B-16 (pretrained)
78.8 (.5)
97.2 (.0)
78.5 (.4)
97.0 (.1)
Self-Aug
32
78.4 (.3)
97.0 (.1)
36
78.6 (.4)
9.10
DP- OP-MIXsmar
79.8 (.3)
9.36
6.3 Pretraining DP-MIXpHr?
Since DP-MIXpur uses synthetic samples from a diffusion model, we consider pretraining the model on the synthetic samples D from the diffusion model with SGD prior to fine-tuning with DP. The results, presented in Table 6) indicate that pretraining on D does not improve the model's performance. This indicates that the improved performance of DP-MIXDIn results from the way uses the diffusion samples, not just from having access to diffusion samples.
Table 6: Test accuracy (%) with and without pretraining on synthetic diffusion samples: We compare the performance of fine-tuned Vit-B-16 and ConvNext with DP on Caltech256 with versus without pretraining on DD (using SGD). We set e and d = 10-5
Pretrained on D
Vit-B-16
ConvNext
Yes
81.5 (.0) (.1)
No (Ours)
91.8 (.2)
91.8 (.2)
6.4 Effect of DP-MIX on Training Data
we compare the distributions of the effective train sets produced by different data augmentation techniques against those of the original train and test sets, i.c., we measure the Fréchet Inception Distance (FID), where lower FID values indicate more similarity between the datasets. Note, the FIDs are consistent with test accuracy across datasets and methods. For example, the FID of Self-Aug Colorjitter is significantly larger than FID of Self-Aug, explaining why adding Colorjitter decreases test accuracy: it results in data less similar to train and test sets. Similarly, the FID for DP-MIX for EuroSAT is much larger compared to the other datasets, which explains reduced test accuracy relative to the other methods. Table 8 we compare the FID between the original train and test sets with the FID between the original train set and the synthetic samples generated by the text-to-image diffusion model that we employ for DP-MIXDIR- Note the much greater FID between the train set and the diffusion samples. This large domain gap may explain why, shown in Table 6
In Table

---

Table 7: FID for different methods' generated images compared training set and test set.
Dataset
Self-Aug
+Jitter
DP-MIXs
DP-MINpor
Self-Aug
+Jitter
DP-MIN
DP-MINpur
CIFAR-10
6.0
3.1
3.3
6.4
3.7
CIFAR-100
3.3
6.5
3.9
EuroSAT
8.3
Caltech256
1.0
2.9
1.3
1.5
2.5
4.2
2.9
Table 8: FID between datasets for different FID models. We compute FID values between the training set and test set, and training set and -mmages diffusion model generated images based on different FID models (Inception V3 and Vit-B-16).
InceptionV3
Vit-B-16
Dataset
Train vs Test
Train Diffusion
Train vs Test
Train vs Diffusion
CIFAR-10
3.2
30.5
0.4
30.1
CIFAR-100
21.9
EuroSAT
164.0
7.3
82.9
Caltech256
6.8
25.1
1.6
37.4
pretraining on the diffusion samples result in much worse performance compared to our proposed DP-MIXDIN-
6.5 Influence of K KRASES KELF and DIYF
Recall, KRASE is the number of base self-augmmenttiooss, KSEFF the number mixups, and K Kn is the number of synthetic diffusion samples used. We vary K K and Kome values and report their performance in Table 9 We observe that selecting KDm = 2 or K and setting KsuF KAASE gives good results overall. In this paper, used KBASE 16, K 18 and Koun = for most cases as it provides good overall results across many datasets and settings
Table 9: Influence of KBASE, KSEFF and K for fine-tuning Vit-B-16 model on Caltech256 with and 10-5.
KEASE
8
8
8
8
8
16
16
16
16
16
Kaur
8
16
16
16
24
24
24
8
8
8
16
16
Kom
4
0
2
4
0
0
2
4
0
2
Acc. (%)
80.4
85.0
87.2
77.1
84.5
87.2
77.2
84.2
86.4
77.7
84.2
86.7
81.2
83.8
KYASE
16
16
24
24
24
24
24
KyLLr Kpus Acc. (%)
24
8
16
24
24
24
4
0
2
86.3
77.3
82.6
85.8
77.9
82.7
85.5
77.9
82.1
85.1
80.1
81.5
84.5
7
Conclusions
We studied the application of multi-sample data augmentation techniques such as mixup for differ- entially private learning. We show empirically that the most obvious way apply mixup, using microbatches, does not yield models with low generalization errors as microbatching is at an inherent disadvantage. We then demonstrate how to harness mixup without microbatching by applying it to self-augmm self-augmmetationn of single training example. This provides significant performance increase over the prior SoTA. Finally, we demonstrate that producing some augmentations using text-to-image diffusion models further enhances performance when combined with mixup.
We use larger KOFF ie. 24 for Caltech256 and Oxford Pet provides better performance.
10

---

Acknowledgments
This work was supported in part by the National Science Foundation under CNS-2055123, Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation.
References
[1] Opacus. httpps///gttabb.ccc/pppttoocoopp
[2] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep lcarning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308-318, 2016.
[3] B. Balle, G. Barthe, and M. Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in Neural Information Processing Systems, 31, 2018.
[4] E. Borgnia, J. Geiping, V. Cherepanova, L. Fowl, A. Gupta, A. Ghiasi, F. Huang, M. Goldblum, and Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations. arXiv preprint arXiv:
2021.
[5] Bu, J. Mao, and Xu. Scalable and efficient training of large convolutional neural networks with differential privacy. In Advances in Neural Information Processing Systems.
[6] L. Carratino, M. Cissé, R. Jenatton, and J. Vert. On mixup regularization. The Journal of Machine Learning Research, 23(1): ((1):14632-146600 2022.
[7] Chen, S. Korbliihh, M. Norouzi, and G. Hinton. simple framework for contrastive learning of visual representations. In International conference machine learning, pages 1597-1607. PMLR, 2020.
[8] H.-P. Chou, S.-C. Chang, J.-Y. Pan, W. Wei, and D.-C. Juan. Remix: rebalanced mixup. In Computer Vision-ECCV 2020 Workshops: Glasgow, UK, August 23-28, 2020, Proceedings, Part VI 16, pages 95-110. Springer, 2020.
[9] De, L. Berrada, Hayes, S. L. Smith, and B. Balle. Unlocking high-accuracy differentially private image classification through scale, arXiv preprint arXiv:2204. 2022.
[10] P. Dhariwal and Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, volume 34, pages 7780-8794, 2021.
[11] C. Dwork, McSherry, K. Nissim, A. Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265-284. Springer, 2006.
[12] C. Dwork. A. Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 933-4:211 1-70 2014.
[13] R. Gal, Y. Alaluf, Y. Atzmon, O. Patashnik, A. H. Bermano, G. Chechik, and D. Cohen-Or. An image is worth word: Personalizing text-to-image generation using textual inversion, 2022.
[14] Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial nets. Advances in neural information processing systems, pages 2672-2680. 2014.
[15] G. Griffin, A. Holub, and P. Perona. Caltech-256 object category dataset. 2007.
[16] H. Guo, Y. Mao, and R. Zhang. Mixup locally linear out-of-manifold regularization. In Proceedings of the AAAI Conference on Artificial Intelligence. volume 33, pages 3714-3722, 2019.
[17] K. He, Zhang, Ren, and Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[18] P. Helber, B. Bischke, A. Dengel, and D. Borth. Eurosat: novel datasct and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 12(7):221722222 2019.
[19] J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 33, pages 6840 1851, 2020.

---

[20] D. P. Kingma and M. Welling, Auto-Encoding Variational Bayes. In 2nd International Conference on Leurning Representations, ICLR 2014, Bansf, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
[21] A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[22] Y. Li, Y.L.. Tsai, X. Ren, C.-M. Yu, and P.-.. Chen. Exploring the benefits of visual prompting in differential privacy. arXiv preprint 2rXiv2230..222:. 2023.
[23] H. B. McMahan, G. Andrew, Erlingsson, S. Chien, Mironov, N. Papernot, and Kairouz. A general approach to adding differential privacy to iterative training procedures. arXiv preprint arXiv:1812.0221 2018.
[24] A. Q. Nichol and Dhariwal. Improved denoising diffusion probabilistic models. In Proceedings of the 38th International Conference on Machine Learning, pages 8162-8171, 2021.
[25] A. Q Nichol, P. Dhariwal, A. Ramesh, Shyam, P. Mishkin, B. McGrew, I. Sutskever, and M. Chen. GLIDE: towards photorealistic image generation and editing with text-guided diffusion models. In Interna- tional Conference on Machine Learning, ICML 2022, 17-23 July 2022. Baltimore, Maryland, USA, pages 16784-16804, 2022.
[26] S. Oh, J. Park, S. Back, H. Nam, P. Vepakomma, R. Raskar, M. Bennis, and S.-L., Kim. Differentially private cutmix for split learning with vision transformer. arXiv preprint arXiv:22 15986, 2022.
[27] A. Panda, X. Tang, V. Sehwag. S. Mahloujifar, and Mittal. Dp-raft: differentially private recipe for accelerated fine-tuming. arXiv preprint arXiv:22 2204466, 2022.
[28] O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. Jawahar. Cats and dogs. In 2012 IEEE conference on computer vision and pattern recognition, pages 3498-3505. IEEE, 2012.
[29] N. Ponomareva, H. Hazimeh. A. Kurakin, Z. Xu, C. Denison. H. B. McMahan, S. Vassilvitskii. S. Chien, and A. G. Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research, 77:1113-1200 2023.
[30] A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen. Hierarchical text-conditional image generation with CLIP latents. CORR, 2022.
[31] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[32] N. Ruiz, Y. Li, V. Jampani, Y. Pritch, M. Rubinstein, and K. Aberman. Dreambooth: Fine tuning text- to-image diffusion models for subject-driven generation. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2200002211,,, 2023.
[33] C. Saharia, W. Chan, S. Saxena. L. Li, J. Whang, E. L. Denton, K. Ghasemipour. R. Gontijo Lopes. B. Karagol Ayan, T. Salimans, J. Ho, D. J. Fleet, and M. Norouzi. Photorealistic text-to-image diffu- sion models with deep language understanding. In Advances in Neural Information Processing Systems, volume 35, pages 1449936444,, 2022.
[34] T. Sander, P. Stock. and A. Sablayrolles. Tan without burn: Scaling laws of dp-sgd. In International Conference on Machine Learning, pages 29937-29949. 2023.
[35] C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, al. Laion-5b: An open large-scale dataset for training next generation image-text models, Advances Neural Information Processing Systems, 35:25278 25294, 2022.
[36] J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In Proceedings of the 32nd International Conference on Machine Learning, pages 2256-2265, 2015.
[37] J. Song. C. Meng, and S. Ermon. Denoising diffusion implicit models. ICLR, 2021.
[38] S. Thulasidasan, G. Chennupati, J. A. Bilmes, T. Bhattacharya, and S. Michalak. On mixup training: Improved calibration and predictive uncertainty for deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
[39] V. Verma, A. Lamb, C. Beckham, A. Najafi, 1. Mitliagkas, D. Paz, and Y. Bengio. Manifold mixup: Better representations by interpolating hidden states. In International conference on machine learning. pages 6438 6447, PMLR, 2019.
12

---

[40] H. Xiao and S. Devadas. Towards understanding practical randomness beyond noise: Differential privacy and mixup. Cryptology ePrint Archive, 2021.
[41] H. Xiao, Z. Xiang. D. Wang. and S. Devadas. A theory to instruct differentially-priiatee learning via clipping bias reduction. In 2023 IEEE Symposium Security and Privacy (SP), pages 2170-2189, IEEE Computer Society, 2023.
[42] J. Xiao, K. Ehinger, J. Hays, A. Torralba, and Oliva. Sun database: Exploring large collection of scene categories. International Journal of Computer Vision, 119:3 22, 2016.
[43] J. Xiao, Hays. K. A. Ehinger, A. Oliva, and A. Torralba. Sun database: Large-scale scene recognition from abbey 200. 2010 IEEE computer society conference on computer vision and pattern recognition, pages 3485-3492. IEEE, 2010.
[44] S. Yum, Han, Oh, S. Chun, J. Choe, Yoo. Cutmix: Regularization strategy to strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6023 6023-6032, 2019.
[45] S. Zagoruyko and N. Komodakis. Wide residual networks. british machine vision conference (bmvc), 2016.
[46] H. Zhang, M. Cisse, N. Dauphin, and D. Lapez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations, 2018.
[47] L. Zhang, Z. Deng, K. Kawaguchi, A. Ghorbani, and J. Zou. How does mixup help with robustness and generalization? 2020.
13

---

A
Algorithm: DP-SGD
Algorithm 2 DP-SGD from Abadi et al.
Require:
Training data Ti, EN, loss function [()) 2/2 Σ; L(0, xz). Parameters: learning rate noisc scale o, group size B, gradient norm bound C.
Initialize 8u randomly
for E [7] do
Take random sample B, with sampling probability B/N for each E B, do
Compute ge (ax.) VeL(Or, xx) (=(x,) + g: mma((1, (18+)0)2))
end for 5: f
Dc+1 c 0, T+
end for
Ensure: 0y and compute the overall privacy cost (2, using privacy accounting method
B Additional Experimental Results
B.1 How useful is the synthetic data?
Let S₁ and S2 denote equally sized disjoint subsets of the private dataset, and an equally sized set of synthetic samples generated via diffusion, as described in Section 3.1
For this experiment, we consider three different training methods.
Method A: Fine-tune on S₁ using DP-MIXSELF.
Method B: Fine-tune S₁ using DP-MIXDIFF with mixup images sampled from D.
Method C: Same as Method B, but replace set with set S2. Note, we assume that S2 is publicly available, so accessing it during training does not incur privacy cost.
The intuition behind this experiment that method C provides an upper bound for both A and B, since, in the best case, the distribution of the synthetic data would exactly match that of the private data. The experimental results, presented Table 10 validate this intuition.
For CIFAR-100, Caltech256, SUN397, and Oxford Pet, method C outperforms method A. Consistent with this, method B, our proposed DP-MIXDIrT. also provides performance boost. On the other hand, for CIFAR-10 and AT,OSAT, method C, despite directly using private data for mixup, does not meaningfully improve performance. Similarly, method B also does not improve performance. For ET, method B slightly decreases performance, due to the large domain gap (large FID) between the synthetic and private data.
Table 10: Test accuracy (%) using different training methods with Vit-B-16 and ConvNext on various datasets after fine-tuning, We set the = 2 and 5
10-5
Vit-B-16
ConyNext B
Dataset
A
B
C
CIFAR-10
96.9 (.1)
96.9
(.1)
9.12
96.1 (.I)
96.2 (.I)
CIFAR-100
81.3 (.3)
(.20
82.1
76.7 (.3)
7.10
(.14
EuroSAT
93.7 (.1)
9.14((1)
93.9(.2)
(3.8
92.3 (.1)
93.9 (22)
Caltech 256
76.0 (.4)
(119
82.3
7.34
81.1
81.6 (.3))
SUN397
70.8 (.2)
72.4(1)
(318
70.1 (.2)
72.3 (.1)
73.6
Oxford Pet
65.1 (33
(.13
(.13
64.6
66.0 (.))
68.1
B.2 Reproducing De al. 99 and DP- in JAX
For completeness, we train WRN-16-4 on CIFARIO using Self-Aug and our proposed DP- DP-MIX using 19'ss s official JAX code (https: /https://gitte t/gi com/deepmind/ jaaamiiiddda_iiaaeeee/aee privacy). jaw.aaaiiaaaaaaaa.......aapaa... repeat each experiment 5 times and report median test accuracy in Table 11 The results are consistent
(9, we
14

---

with those presented in the rest of our paper DP-MIXsEL outperforms Self-Aug for different privacy budgets.
Table 11: Performance comparison JAX.
Method
=
E = 8
Self-Aug
56.3 (.3)
79.4 (.1)
DP-MIXSELF
57.1 (4)
80.0 (2)
B.3 Pure-DP-MIXDir
To demonstrate the influence of K BASE our method, set BASE and call it Pure-DP -P-MDXP-Mii In effect
is simply mixing up the synthetic examples themselves. We test it on CIFAR-100 and represent it in Table 12 We can see that Pure-DD-MIXXpe performance than both DP-MIX SELF and DP-MIX although it still offers better performance than Self-Aug due to the beneficial effects mixup. More generally, we think that Pure-DP-MIXpIn will tend to worsen overfitting problem whenever there is a large domain gap between the original training data and the diffusion samples. DP-MIXDIr does not suffer from this problem because ensures that (augmented versions) of the original training data samples seen during training.
offers much worse
Table 12:
Test accuracy (%) of Pure-DP-MIXpue BKESSE 0) on CIFAR-100 with Vit-B-16 model. We set 10-5 and We can observe that Pure- Mare-DD-MMXDDe does not improve performance, which shows the necessity of using base augmentations (Kasse >> 0).
Method
Test accuracy
Self- Aug
79.3 (.2)
DP-MIXSELP
81.8 (.2)
DP-MIXDIF
82.0 (.1)
Pure-DP-MIS
80.9 (.2)
B.4 Running time
We provide the running time for different methods Table 13 All experimental runs utilized single A100 GPU and were based on the same task of finetuning the Vit-B-16 model on the Caltech256 dataset for 10 epochs. Due additional augmentation steps, the training time of our methods is longer than prior work.
Table 13: Running time for different methods of the same task (fine-tuning Vit-B-16 on Caltech256 for 10 epochs). We use one A100 GPU for each training method.
Method
Self-Aug
DP-MINSELP
DP-MIXDIP
Running time
2h 12min
7h 33min
7h 40 min
B.5 Effect of Mixup Gradients
We study what happens to gradients and parameter updates during training for our methods versus Self-Aug. Fig. 2 plots the per- ver-parameter gradient magnitude averaged over samples at each epoch (prior to clipping and noise adding). The histogram shows the data averaged over all training epochs and the X% color lines show that data only for the epoch at X% of the total training process. There are 10 epochs for this experiment - for example, the line for 20% shows the data for epoch 2.
The figure shows more concentrated values for our methods compared to the Self-Aug baseline, which suggests more stable training and faster convergence. Standard deviations for CIFAR-10 10 with Self-Aug, DP- and DP-MIX are: 2.16 10-3 10-3,9.76 9..66 10-4 and 9.59 10-1, respectively. For Caltech256 they are: 1.43 10-3 1.07 10-3 and 9.32 10-1 respectively. This consistent with experimental results of test accuracies for each method.
15

---

S-t4e1
(a) CIFAR-10
Caltech256
Figure 2: Per-parameter gradient magnitude before clipping and adding noise on CIFAR-10(1
and Caltech256(b) with fine-tuning Vit-B-16 model with E = 1 and ò 10 5, The different curves represent different training stages. Values for our proposed DP-MIXSELF and DP-MIXDIP are more concentrated suggesting more stable training and faster convergence.
C
Additional Experimental Details
Datasets We use the following datasets:
CIFAR-10 is widely- utillizd dataset in the field of computer vision, serving as a standard for evaluating image recogmition algorithms. Collected by Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton [2T]. this dataset is crucial tool for machine learning research. The dataset consists of 60,000 color images, each sized at 32 x 32 pixels, and categorized into 10 different classes like cats, dogs, airplanes, etc. We use 50,000 data points for training, and 10,000 for the test set. CIFAR-100 is a well-regarded dataset in the domain of computer vision, typically used for benchmarking image classification algorithms. This dataset, also collected by Krizhevsky et al. [21]. is key resource in machine learning studies. CIFAR-100 100 comprises 60,000 color images, each of 32x32 pixel resolution. What distinguishes it from CIFAR-10 the higher level of categorization complexity; the images are sorted into 100 distinct classes instead of 10. We use 50,000 data points for training, and 10,000 for the test set.
EuroSAT (18) is benchmark dataset for deep learning and image classification tasks. This dataset is composed of Sentinel-2 satellite images spanning 13 spectral bands and divided into ten distinet classes. It has 27,000 labeled color images which size 64 64. We use 21600 the training set and 5400 as test set.
Caltech 256 [15]. Caltech is commonly used for image classification tasks and comprises of 30607 RGB images of 257 different object categories. For our experiments, we designated 80% of these images for training and the remaining 20% for testing.
SUN397 The Scene UNderstanding (SUN) 42 43 database contains 108,754 RGB images from
397 classes. For our experiments, use 80% of these images for training and the remaining 20% for testing.
Oxford Pet (28 contains 37 classes of cats and dogs and we use 3680 images for training and the rest 3669 images for testing.
For all experiments, maintained the clip at C 1, with the exception of Mix-ghost clipping where we used C = 0.05 as required by the original paper [5] and its implementation"" The noise level was automatically calculated by Opacus based the batch size, target e, and 6, well as the number of training epochs.
Implementation details of [Section 3 In this experiment, we set KRASE 16 and adjust the hyperparameters according to the recommendations in the original paper (9] To facilitate the implementation in PyTorch and enable microbatch processing, we adapt our code based on two existing code bases
Implementation details Section 5.1 In training our models from scratch, we adhere to a KEASE value 16 and adjust the other hyperparameters in accordance with the guidelines provided in the original papers 9. For our fine-tuning experiments, maintain the same KBASE value and perform hyperparameter searches in each case to ensure we utilize the optimal learning rate. Importantly, we
16

---

do not incorporate any learning rate schedules, per the suggestions of other research papers S that indicate such schedules do not yield performance improvements.
Implementation details of Seccion 5.2 and Appendix B In order to generate synthetic samples, we feed the text prompt 'a photo dataset, the number of synthetic samples we generate is equal to the number of real images in the dataset.
<class name>' to the diffusion model [33. For each
Source Code. Readers can find further experimental and implementation details in our open-source code httts:///itthuus cwm/comm///////e www./anwwnuuneeeee www.uuan-aooD---------
D Ethical Considerations & Broader Impacts
In this paper, propose approach to multi-sample data augmentation techniques such as mixup to improve the privacy-utility tradeoff of cnfferentiaallyprriaal image classification. Since differential privacy offers strong guarantees, its deployment when training machine learning has the potential to substantially reduce harm to individuals' privacy. However, some researchers have observed that although the guarantee of differential privacy is worst-case guarantee, the privacy obtained is not necessarily uniformly spread across all individuals and groups. Further, there is research suggesting that differential privacy may (in some cases) increase bias and unfairness, although these findings are disputed by other research.
17


Reviews:
[{"review_id": "dOSY0lE9QQ", "reviewer": "Reviewer_ayCk", "summary": "This paper proposes a data augmentation technique for differentially private deep learning using mixup regularization. Mixup is a popular augmentation technique which involves taking linear combinations of training samples to create new samples. However, such a technique cannot be directly applied to differentially private training, as the sensitivity of the private algorithm increases rendering it to be un-useful. Towards this end the authors propose two methods for private mixup augmentation. First, is mixup with self augmentation which involves mixing samples obtained from augmentation of a single sample, and secondly, mixing training samples with samples generated from diffusion models. The paper provides empirical results to support their claim.", "questions": "For diffusion model based experiments the pre-trained model is trained on 2B images which is likely to contain the entire fine-tuning sets. Does this seem like a reliable public pre-training to choose?\nCan you increase the number of samples to mixup from 2? How does the performance change by increasing the number of samples in the convex combination?\nWhat should be the nature of the distribution of samples that are used during mixup? Can out of distribution samples be mixed to obtain meaningful results?\n", "limitations": "The method is only restricted to self augmentations or augmentations with publicly available data. In private training having different gradients aligned when training with DP-SGD is important to reduce the effect of the gaussian noise added to ensure DP. Will it be possible to construct a mixup involving multiple samples (rather than self-mixup or diffusion model based) so that the gradients during training are more aligned, which thereby increase the signal-to-noise ratio?", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "Mixup is an interesting technique, and exploring it for differentially private training is important.\nThe technique is simple to implement in practice with easy to prove theoretical guarantees.\nMethod shows improved empirical performance on the presented datasets.\n", "weaknesses": "The proposed method isnt too different from the method proposed by De et al which is cited in the paper. Its a minor augmentation to the augmentation they proposed.\nPre-trained models are trained on large datasets but fine-tuning is performed only on toy datasets. Needs more empirical evidence on practical datasets (for example, oxfordpets, flowers, and so on)\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the constructive feedback and detailed comments.\n\\\n\\\n**1. The proposed method isn't too different from the method proposed by De et al.**\\\nOur work uses the same insight as De et al. [10] --- by clipping the gradients aggregated over all the augmentations we preserve the DP guarantee. However, the same idea naively applied to mixup (or multi-sample data augmentation) does not work. Our contribution is showing how to make it work and that it yields substantial benefits.\n\\\n\\\n**2. Pre-trained models are trained on large datasets but fine-tuning is performed only on toy datasets.**\\\nWe extended our evaluation to include three additional datasets: Caltech256, SUN397, and Oxford-IIIT Pet, some of which we already used in supplementary material. See Table 1 in the attached rebuttal PDF. Our proposed methods significantly outperform the current SoTA (\"Self-Aug\" --- De et al. [10]) across these new datasets and for all values of $\\varepsilon$. It is also worth pointing out that prior SoTA (De et al. [10]) not only uses some of the same datasets (e.g., CIFAR-10 and CIFAR-100) but also pre-trains models on very large datasets including ImageNet, JFT-4B, and JFT-300M.\n\\\n\\\n**3. Pre-trained model is trained on 2B images which is likely to contain the entire fine-tuning sets.**\\\nNo, we don't believe so. As we explain in the general response, we took great care in selecting the pre-trained models and pre-training data to ensure fair comparisons. There are two important points: First, even if there was overlap between the pre-training data and the fine-tuning sets our methods still outperform Self-Aug when fine-tuning the *exact same pre-trained model*. From this we can conclude that our method provides a boost beyond whatever advantage there could be from the pre-trained models' training data. Second, we show in supplementary material A.2 (Table 6) that fine-tuning the models using synthetic data from a diffusion model trained on the exact same 2B images dataset does *not* improve performance. If the fine-tuning data were included in the diffusion model training data, wouldn't we see substantial performance boost from training on synthetic examples from that very diffusion model?\n\\\n\\\n**4. Can you increase the number of samples to mixup from 2? How does the performance change by increasing the number of samples in the convex combination?**\\\nYes, we increase the number of samples to mixup from 2 to 3 and 4, and present its performance on CIFAR-100 with $\\varepsilon=1$, in the table below. Increasing the number of samples for Mixup-Diffusion does not improve accuracy.\n\n\n| # of samples for Mixup | Test accuracy       |\n|------------------------|---------------------|\n| 2                      | 82.02% (±0.11%)     |\n| 3                      | 81.35% (±0.15%)     |\n| 4                      | 81.33% (±0.09%)     |\n\n\\\n**5. What should be the nature of the distribution of samples that are used during mixup? Can out of distribution samples be mixed to obtain meaningful results?**\\\nThe distribution of synthetic samples used for mixup should not be too dissimilar to the train/test data. See the general response for a discussion of this. We measured FID values to quantify distance between distributions in Tables 2 and 3 (attached 1-page PDF). When the FID value is too large as is the case for EuroSAT, we observe little to no benefits from mixup with synthetic example, although there is still a benefit from \"self-mixup\" as evidenced by the significantly higher accuracy of Mixup-SelfAug compared to SelfAug. Table 5 in supplementary material (A.1) also discusses this but through a different lens.\n\\\n\\\n**6. Will it be possible to construct a mixup involving multiple samples (rather than self-mixup or diffusion model based) so that the gradients during training are more aligned, which thereby increases the signal-to-noise ratio?**\\\nIdeally we would prefer to apply mixup to the original training samples directly as the reviewer suggests, i.e., mixup pairs of samples $(x, y)$ and $(x', y')$ where $(x, y)$ and $(x', y')$ are two randomly selected samples from the training set. As we explain in the paper (Sections 2.1 and 3.1) trying to apply this idea naively does not work. It doubles the sensitivity of the clipped-gradient sum in DP-SGD, which severely degrades the privacy guarantee (or requires doubling the scale of noise to achieve the same guarantee). The obvious way to get around this is to use microbatching as we explain in Section 3.1. But microbatching itself degrades performance because it has the effect of increasing noise [31]. So even though the gradients are more aligned the negative impact of noise results in worse models. We show this experimentally in Table 1 in the submission PDF, where we see that microbatching (of size 2) negatively impacts accuracy so much that it completely negates the benefits of mixup. Note: in that table ``baseline'' refers to vanilla DP-SGD. This is what motivated us to design Mixup-SelfAug and Mixup-Diffusion, which attempt to get the benefits of mixup without the drawback of microbatching (or worsening the DP guarantee).\n"}, {"review_id": "ZMITNKJFmf", "reviewer": "Reviewer_GjeG", "summary": "The paper studies mixup data augmentation for differentially private (DP) machine learning. The traditional mixup data augmentation requires multiple samples. Therefore, applying them in DP model training is not straightforward. The paper first shows that a naive way of implementing it with micro-batches of size 2 gives poor results. To improve the performance, the paper proposes two new approaches. The first approach mixes up a sample and its own augmented version. The second approach mixes up a sample with generated samples from diffusion models. Experiments show that the proposed approaches improve over self-augmentation.", "questions": "\nMy major concern is the experimental comparison between self-aug and the proposed mixup variants in Tables 2 and 3. \n\n* In the experiments of Table 2, did we keep the number of augmented samples the same? To make it more accurate, let's consider Mixup-SelfAug and use the notations in Section 3.2. For a fair comparison, we need to make sure that the \"k\" utilized in self-aug equals \"k+k'\" used in Mixup-SelfAug. (The motivation is to keep the computation cost roughly the same.)\n\n* Similarly, for Table 3, did we keep the number of augmented samples the same?\n\nOther questions:\n\n* It is better to show how k, k', and k'' influence the performance of Mixup-SelfAug and Mixup-Diffusion.\n\n* Is there any benefit of combining Mixup-SelfAug and Mixup-Diffusion together?\n\nI will update the score according to the answers to the above questions.\n\nOther minor issues:\n\n* Figure 2: I do not fully understand the figure. It says \"The histogram shows average norm of gradients.\", but I do not get which values are averaged over. Is the process (1) for each sample, computing the average norms of gradients across all iterations, and (2) plotting the histogram of the above values of all samples? Similarly, how are the lines computed?\n* Line 138: \"however\" -> \". However\"\n* Line 150: \"((x_1,y_1)\" -> \"(x_1, y_1)\"\n* Line 249-254: The information in this paragraph is also covered in the method section.\n", "limitations": "\nThe paper did not discuss the limitation or the potential negative societal impact.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "* The paper is well-written.\n\n* Mixup data augmentation is very useful in the non-DP world. However, incorporating that into DP training is non-trivial. The paper is a valuable step towards bringing the benefit of mixup data augmentation to DP training.", "weaknesses": "* I have some doubts about whether the experimental comparison is fair. \n\n* More ablation studies are needed.\n\nSee \"questions\" for the details.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the constructive feedback and detailed comments. We will correct typographical errors and make suggested improvements to our paper. Here are our clarifications:\n\\\n\\\n**1. The experimental comparison between self-aug and the proposed mixup variants in Tables 2 and 3.**\\\nFor Self-Aug, increasing the number of augmentations $ k $ beyond $ k=16 $ does not increase (and often decreases) performance. We show this in Section 5.3 of our paper and the original paper from De et al. [10] shows the same phenomenon. To further address your concerns, we have conducted an additional experiment where we increase $ k $ from $ 16 $ to $ 36 $ for both 'training from scratch' and 'pretrain' settings. Results are shown in Table 6 (attached 1-page PDF). The best performance for Self-Aug is $ k=16 $. Furthermore, for the same number of augmentations Mixup-SelfAug outperforms Self-Aug. For $ k+k'=32 $ augmentations, Mixup-SelfAug also outperforms Self-Aug with $ k=36 $ augmentations. This shows that our comparisons are indeed fair. In fact, we give an advantage to Self-Aug in our paper because we report results for that method with the value of $ k $ (i.e, $ k=16 $) that gives the best results for it.\n\\\n\\\n**2. How $ k $, $ k' $, and $ k'' $ influence the performance of Mixup-SelfAug and Mixup-Diffusion.**\\\nWe have conducted additional experiments to show this. See the table below. Recall: $ k $ is the number of base self-augmentations, $ k' $ is the number of mixups, and $ k'' $ is the number of synthetic diffusion samples used. Overall, selecting $ k''=2 $ or $ k''=4 $ and setting $ k' $&le;$ k $ gives good overall results. In our paper, we used $ k=k'=16 $ and $ k''=2 $ as it provides good overall results across many datasets and settings.\n\\\n\\\n**Table:** Change $ k $, $ k' $, and $ k'' $ for fine-tuning Vit-B-16 model on Caltech 256 with  $\\varepsilon = 1$  and  $\\delta = 10^{-5}$. Here $ k $ is the number of augmented data, $ k' $ is the number of mixup processes, and $ k'' $ is the number of diffusion samples.\n\n| $ k $ | $ k' $ | $ k'' $ | Acc. (%) | Rank |\n|---|---|---|---|---|\n| 8  | 8  | 0 | 80.39 | 20 |\n| 8  | 8  | 2 | 85.03 | 9  |\n| 8  | 8  | 4 | 87.21 | 1  |\n| 8  | 16 | 0 | 77.05 | 27 |\n| 8  | 16 | 2 | 84.45 | 11 |\n| 8  | 16 | 4 | 87.19 | 2  |\n| 8  | 24 | 0 | 77.16 | 26 |\n| 8  | 24 | 2 | 84.23 | 12 | \n| 8  | 24 | 4 | 86.35 | 4  |\n| 16 | 8  | 0 | 77.66 | 24 |\n| 16 | 8  | 2 | 84.22 | 13 |\n| 16 | 8  | 4 | 86.71 | 3  |\n| 16 | 16 | 0 | 81.21 | 19 |\n| 16 | 16 | 2 | 83.76 | 14 |\n| 16 | 16 | 4 | 86.28 | 5  |\n| 16 | 24 | 0 | 77.28 | 25 |\n| 16 | 24 | 2 | 82.55 | 16 |\n| 16 | 24 | 4 | 85.80 | 6  |\n| 24 | 8  | 0 | 77.94 | 22 |\n| 24 | 8  | 2 | 82.72 | 15 |\n| 24 | 8  | 4 | 85.54 | 7  |\n| 24 | 16 | 0 | 77.89 | 23 |\n| 24 | 16 | 2 | 82.10 | 17 |\n| 24 | 16 | 4 | 85.08| 8  |\n| 24 | 24 | 0 | 80.14 | 21 |\n| 24 | 24 | 2 | 81.46 | 18 |\n| 24 | 24 | 4 | 84.54 | 10 |\n\n\\\n**3. Is there any benefit of combining Mixup-SelfAug and Mixup-Diffusion together?**\\\nFirst, note that Mixup-SelfAug can be seen as a special case of Mixup-Diffusion where $ k''=0 $. We introduced Mixup-Diffusion to improve upon Mixup-SelfAug by introducing additional data diversity through diffusion samples. To investigate your specific question, we conduct an experiment using what we call ``Pure-Mixup-Diffusion'', i.e., setting $k=0$ for Mixup-Diffusion, meaning that the original training samples are not used at all. In effect Pure-Mixup-Diffusion is simply mixing up the synthetic examples themselves. The table below compares Pure-Mixup-Diffusion to other methods. We can see that Pure-Mixup-Diffusion offers much worse performance than both Mixup-SelfAug and Mixup-Diffusion, although it still offers better performance than Self-Aug due to the beneficial effects of mixup. More generally, we think that Pure-Mixup-Diffusion will tend to worsen an overfitting problem whenever there is a large domain gap between the original training data and the diffusion samples. Mixup-Diffusion does not suffer from this problem because it ensures that (augmented versions) of the original training data samples are seen during training. \n\n**Table:** Implement Pure-Mixup-Diffusion (K=0) on CIFAR-100 with Vit-B-16 model. We set  $\\delta = 10^{-5}$  and $\\varepsilon = 1$ . We can observe that Pure-Mixup-Diffusion cannot improve the model's performance.\n\n| Method               | Test accuracy                |\n|----------------------|------------------------------|\n| Self-Aug             | 79.28% (±0.18%)              |\n| Mixup-SelfAug        | 81.75% (±0.15%)              |\n| Mixup-Diffusion      | **82.02%** (±0.11%)          |\n| Pure-Mixup-Diffusion | 80.91% (±0.17%)              |\n\n\\\n**4. Explanation of Figure 2 is not so clear.**\\\nWe acknowledge that our explanations lacked clarity and details. We have produced new figures and provided clarification of this in the general response.\n\\\n\\\n**5. The paper did not discuss the limitation or the potential negative societal impact.**\\\nWe briefly discuss potential negative societal impact in the supplementary material (see Appendix B).\n"}, {"review_id": "Z4v6BHDXpz", "reviewer": "Reviewer_sSKD", "summary": "This paper considers the privacy-utility tradeoff for ML models trained with differential privacy guarantees, and develops a technique using data augmentation on image datasets to train models with high accuracies on standard benchmarks with DP guarantees. Mixup, a commonly used augmentation technique in computer vision, and its variants are not compatible with standard DP-SGD because a single datapoint could influence many training instances through augmentations. Recent work [10] pointed out that augmentations involving a single datapoint can be used if clipping if done after averaging all gradients stemming from augmentations of the datapoint. The present paper develops two methods inspired by mixup that involve a single datapoint and therefore can be used with DP-SGD. Experiments show performance comparable to state-of-the-art methods for training DP models.", "questions": "1. What augmentations were used in the experiments? I have not found this detail clearly stated in the paper or appendices, despite it being a central focus. L167 mentions a \"randomized transformation function $T$\" but this is not brought up again. L247 mentions flipping and cropping, but it seems to imply these are not the only augmentations used. The lack of important details such as this negatively impact the reproducibility of this research.\n\n2. Can the authors state what computing resources were used and information on the runtime of their methods in comparison to prior work?\n\n3. Can the authors give details on the diffusion model that was used (architecture, how it was trained, etc.)? All we know is that it was from Open Clip and trained on LAION-2B (L218).\n\n4. The experiments attempt to follow [10] in many ways for close comparison, but the results reported in Section 5 as baselines do not reach the level of that paper. For instance, [10] reports 81.4% accuracy on CIFAR-10 training from scratch with a WRN-16-4 and epsilon=8. Table 1's Baseline is presumably meant to represent the method from [10], but only achieves 72.5% accuracy. The author's proposed method achieves 78.7% accuracy in the same setting. Given that the authors make claims of SotA performance, can they clarify why the results reported in [10] were not directly used or reproduced?\n\n5. There are some results which are repeated across tables (e.g. first two rows of Table 4 are reproduced from Table 3). Could this be mentioned explicitly where applicable so that it is easier to track and compare results? A reader moving quickly might assume they are separate results.\n\n6. In Table 4 the Mixup-Diffusion method uses additional data compared to the other approaches, namely the data generated by the diffusion model. Since the utility of DP models is often constrained by access to data, it is important to use baselines that have the same level of data access. Have the authors put thought into an appropriate baseline technique in the style of DP-SGD that also makes use of the synthetic data? (The most naive option being to pre-train or extend the training dataset with the same synthetic data made available to the mixup-diffusion method.)\n\n7. In Figure 2 it is not clear what the difference is between the curves and the blue bars. I interpret each curve as the distribution of gradient norms over individual datapoints in the training dataset at a particular epoch (these details are not given, I have to guess). However, the blue bars are stated to be a histogram of the average norm of gradients, but what is the average taken over and what is the resulting distribution over? I note that the paper at various times considers epochs, minibatches, and microbatches, so the authors should clearly state which notion they are using in their analysis.\n\n8. Also for Figure 2, the authors do not mention in the paper or appendices which dataset is used. Can the authors provide sufficient detail to reproduce their experiments (without having to dig through source code)?\n\n9. The result in Figure 2 showing lower average gradient norms is indeed suggestive that mixup leads to smoother training and faster convergence. However, have the authors found an explanation for why mixup leads to lower average gradient norms? This is not at all self-evident, especially for Mixup-Diffusion where training and synthetic datapoints are mixed, and those images can come from different classes (as illustrated in Fig 1).\n\n10. Have the authors checked the equivalent of Figure 2 for Mixup-Diffusion, or for other datasets? Can this analysis be included?\n\nMinor:\nIn L67, couldn't $\\delta=0$ be a valid choice, and for that matter $\\delta=1$ corresponding to no privacy guarantee?\n\nIn L58, typically one chooses $\\delta$ to be much less than $|D|^{-1}$, but the authors state $\\delta=o(|D|)$. \n\nIncomplete list of small errors:\n\nL70 add -> adds\n\nL72 gradient -> gradients\n\nL89 vector the -> vector of the\n\nAlg 2 line 2, missing space\n\nL150 extra parens ((x_1, y_1)", "limitations": "The proposed method is implicitly stated to only apply to image datasets, but this limitation is not openly addressed by the authors. Similar work used for benchmarking is not limited in the same way.\n\nThe paper focuses on the utility of private models, but does not mention that private training can have negative effects other than reducing utility (other than in a brief Appendix B without references to prior work). For instance, it is well-known that DP-SGD usually exacerbates the biases in models making them more unfair [A][B][C]. Does data augmentation affect fairness? What are the biases introduced from the synthetic data? Robustness is another topic aligned with Trustworthy ML, and researchers often introduce augmented data during training to improve it. It is possible that the proposed method has positive effects on robustness, but the authors have not addressed this direction despite the significant literature on the intersection of privacy and robustness.\n\n[A] Bagdasaryan et al. 'Differential privacy has disparate impact on model accuracy' NeurIPS 2019\n\n[B] Xu et al. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent' ACM SIGKDD 2021\n\n[C] Esipova et al. 'Disparate impact in differential privacy from gradient misalignment' ICLR 2023\n\n----\nSummary of Discussion: I have read all reviews and rebuttals for this submission.\n\nThe authors responded to all points of my review. My rating was maintained at 5 as some of my original points remain as concerns, including the originality, and quality (lack of details of reproduction).", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "Thank you to the authors for sharing their interesting research! Overall, the paper tackles an important subject - improving the utility of models with rigorous privacy guarantees. This is an active area of research, and the paper engages with recent work appropriately. The proposed methods are simple to implement for image datasets and provide a boost in utility. An attempt is made to explain why mixup methods improve performance by checking the distributions of gradient norms.\n\nOriginality: The paper develops two variants of mixup that can be applied to DP-SGD training. I do not know of prior work using mixup for DP-SGD.\n\nQuality: The analysis of differential privacy is careful and correct. The authors are diligent in highlighting parts of the analysis which are particularly tricky (L91, etc.) although these aspects are known in the literature. Relevant and recent methods are used for benchmarking, and error bars over 3 runs are given. Source code is provided.\n\nClarity: The paper is quite clear.\n\nSignificance: The poor utility of models trained with DP-SGD holds back the adoption of this important privacy enhancing technology, so new methods (like the ones in this paper) that improve the utility are necessary.", "weaknesses": "Originality: The paper combines the augmentation techniques developed for DP in [10], with the idea of mixup which is very standard. The combination is only slightly non-trivial in this context.\n\nQuality: The experiments lack detail - it would not be possible to reproduce the author's work with the current state of the paper and appendices. Prior SotA work [10] is frequently referenced, but performance levels from that paper are not reproduced or surpassed. The experiment using diffusion models is not benchmarked fairly. Broader impacts are relegated to the appendix.\n\nClarity: There are minor grammatical and typesetting issues, but they do not hurt the clarity of the paper. Figure 2 requires clarification.\n\nSignificance: The applicability of this technique is limited to image datasets, whereas that of [10] for example can be applied much more broadly.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the constructive feedback and detailed comments. We will correct typographical errors and make suggested improvements to our paper. Here are our clarifications:\n\\\n\\\n**1. The paper combines the augmentation techniques developed for DP in [10].**\\\nWe agree with the reviewer that we exploit the insights of [10] to maintain the privacy guarantee. However, the novelty of our paper is that we show how to exploit the augmentation technique of [10] for mixup. The benefit of the self-augmentations proposed by De et al. [10] quickly hits diminishing returns ($k=16$ -- see Table 6 in the attached 1-page rebuttal PDF) and adding different types of augmentations also does not help. By contrast, Mixup-Diffusion and Mixup-SelfAug provide consistently better performance by leveraging the benefits of mixup.\n\\\n\\\n**2. The applicability is limited to image datasets, whereas that of [10] for example can be applied much more broadly.**\\\nWe acknowledge that we only investigated our techniques for image data (similar to De et al. [10]). However, we disagree that our techniques are necessarily limited to image data. There are data augmentation techniques for other data domains and numerous related work showing successful application of mixup to other data domains (e.g., see (https://arxiv.org/pdf/2108.12296.pdf), (https://arxiv.org/pdf/1905.08941.pdf), (https://arxiv.org/pdf/2010.02394.pdf)). Some of these techniques apply mixup in the feature/embedding space instead of the input data. But, this is in principle compatible with our techniques and gradient clipping over all augmentations would also preserve the privacy guarantee in such cases. We leave for future work the investigation of whether the same benefits are obtained.\n\\\n\\\n**3. What augmentations were used?**\\\nWe apologize for any confusion. To clarify, our methods employ the exact same augmentations as De et al. [10] (flipping and cropping).\n\\\n\\\n**4. Can the authors state what computing resources and information on the runtime of their methods in comparison to prior work?**\\\nWe provide the running time for different methods in the table below. All experimental runs utilized a single A100 GPU and were based on the same task of finetuning the Vit-B-16 model on the Caltech256 dataset for 10 epochs. Due to additional augmentation steps the training time of our methods is larger than prior work.\n\n **Table:** Running time for different methods of the same task (fine-tuning Vit-B-16 on Caltech256 for 10 epochs). We use one A100 GPU for each training method.\n\n | Method       | Self-Aug | Mixup-SelfAug | Mixup-Diffusion |\n |--------------|----------|---------------|-----------------|\n | Running time | 2h 12min | 7h 33min      | 7h 40min        |\n\n\\\n**5. Details on the diffusion model that was used? All we know is that it was from Open Clip and trained on LAION-2B (L218).**\\\nWe provide more information in the general response. But to be clear the diffusion model is stable-diffusion-v1-4 (https://huggingface.co/CompVis/stable-diffusion-v1-4). The models from Open Clip are Vit-B-16 and ConvNext (which we pre-trained on LAION-2B the same data used to train the diffusion model).\n\\\n\\\n**6. Baselines do not reach the level of that paper**\\\nWe think there is a misunderstanding. The WRN-16-4 model with $\\varepsilon=8$, [10] indicates a performance of 79.5% on CIFAR-10 (as can be confirmed in Table 3 of their paper). This closely aligns with our reported performance of 78.74%.\n\nAdditionally, it's crucial to highlight the specifications in our submission PDF Table 1: ``Baseline'' in that table refers to vanilla DP-SGD without Self-Aug or any modifications. Elsewhere we sometimes refer to Self-Aug as baseline, since it is the prior SoTA.\n\nTo clarify: both of our methods Mixup-SelfAug and Mixup-Diffusion consistently outperform the Self-Aug [10] baseline in both pre-trained and from scratch settings. For example, Mixup-SelfAug obtains $79.83$% test accuracy in the setting where Self-Aug obtains $78.74$% (and [10] reports $79.5$%). The point of Table 1 in our paper is to show why microbatching will not work for mixup.\n\\\n\\\n**7. There are some results that are repeated across tables.**\\\nYes, we will revise this.\n\\\n\\\n**8. Have the authors put thought into an appropriate baseline technique in the style of DP-SGD that also makes use of the synthetic data?**\\\nYes, we conducted such experiments in the supplementary material (A.2 --- Table 6). We pretrain the model on the synthetic data, which is an appropriate baseline because if the performance boost we get could be obtained using the synthetic data directly (i.e., without mixup) then it may not make sense to use Mixup-Diffusion. However, pretraining on the synthetic data does *NOT* help. This implies that the benefit of Mixup-Diffusion is due to how it combines synthetic data into the mixup augmentations.\n\\\n\\\n**9. Regarding Figure 2**\\\nWe have reproduced the experiments and clarified this in the general response.\n\\\n\\\n**10. Have the authors found an explanation for why mixup leads to lower average gradient norms?**\\\nWe do not claim that mixup leads to lower average gradient norms. Rather we observe from Figure 2 (and Figure 1 in the attached 1-page PDF) that gradients for mixup are more concentrated (i.e., lower variance/std). See the general response for more details. \n\\\n\\\n**11. In L67, couldn't $\\delta=0$ be a valid choice, and for that matter $\\delta=1$ corresponding to no privacy guarantee?**\\\nYes we will fix this. $\\delta=0$ or $\\delta=1$ are allowable. \n\\\n\\\n**12. Does data augmentation affect fairness? What are the biases introduced from the synthetic data? Robustness?**\\\nThis is a question worth investigating. We believe it is outside the scope of our current paper, so we leave it for future work."}, {"review_id": "sX7lqQvo3h", "reviewer": "Reviewer_DhpR", "summary": "The paper proposes two data augmentation techniques, MIXUP-SELFAUG and MIXUP-DIFFUSION, for differentially private learning. The authors investigate why naive applications of multi-sample data augmentation techniques, such as mixup, fail to achieve good performance and propose these two techniques specifically designed for the constraints of differentially private learning. MIXUP-SELFAUG performs mixup on self-augmented data, which results in lower gradients norm average and variance leading to smoother training. MIXUP-DIFFUSION further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. The paper also discusses the challenges of applying data augmentation techniques in the context of differential privacy and compares the proposed techniques with existing methods on various datasets. The experimental results show that the proposed techniques achieve state-of-the-art classification performance across a range of datasets and settings. Overall, the paper proposed effective data augmentation techniques that can improve the performance of machine learning models while preserving the privacy of sensitive data.\n\n", "questions": "I want to clarify especially the second and third issues of the weakness. If this is well-addressed, I am down to re-evaluate this paper. ", "limitations": "The authors adequately addressed the limitation and potential negative societal impact on their work.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "This paper is easy to read. This paper considerately used DP-SGD for differentially private learning. These techniques improve the performance of mixup-based data augmentation. The paper also discusses the challenges of applying data augmentation techniques in the context of differential privacy. ", "weaknesses": "1. The absence of a theoretical analysis for MIXUP-SELFAUG in the submitted work is notable. The authors have provided an intuition on why mixup could harm differential privacy and presented an alternative approach to mitigate this issue. It could further strengthen the paper if the authors could provide a theoretical guarantee for differential privacy.\n\n\n2. In relation to MIXUP-SELFAUG which doesn't mix labels, questions arise about why MIXUP-SELFAUG improves performance. The original intent of mixup, which is label interpolation for better performance, seems not fully addressed in this context. The authors could consider explaining their approach's effectiveness via intuition or mathematical formulation.\n\n[1] Zhang, Linjun, et al. \"How does mixup help with robustness and generalization?.\" ICLR 2021\n\n[2] Jeong, Jongheon, et al. \"Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness.\" NeurIPS 2021\n\n[3] Zhang, Linjun, et al. \"When and how mixup improves calibration.\" ICML 2022\n\n[4] Park, Chanwoo, Sangdoo Yun, and Sanghyuk Chun. \"A unified analysis of mixed sample data augmentation: A loss function perspective.\" NeurIPS 2022\n\n[5] Zou, Difan, et al. \"The benefits of mixup for feature learning.\" arXiv preprint arXiv:2303.08433 (2023).\n\n[6] Oh, Junsoo, and Chulee Yun. \"Provable Benefit of Mixup for Finding Optimal Decision Boundaries.\" ICML 2023\n\n\n3. Concerning the implementation of the diffusion model, there are a few considerations that the authors might need to address. The necessity for incorporating a diffusion model is not sufficiently justified in the current draft. For instance, the diffusion model used in this study is pretrained, which could potentially introduce the element of knowledge distillation. This raises the question: Is the observed performance improvement mainly due to distillation effects? Additionally, the use of a diffusion model not trained with DP-SGD could potentially pose issues for differential privacy learning. The authors are encouraged to provide clarification on these points.\n\n\n4. While the adoption of a diffusion model might benefit differential privacy, the paper could delve deeper into explaining why it's advantageous for ensuring differential privacy. A detailed discussion on this matter could provide readers with a better understanding of the authors' choice and its implications on the overall study. The authors' insights on this matter would be greatly appreciated.\n\n[1] Chourasia, Rishav, Jiayuan Ye, and Reza Shokri. \"Differential privacy dynamics of langevin diffusion and noisy gradient descent.\" NeurIPS 2021\n\n[2] Dockhorn, Tim, et al. \"Differentially private diffusion models.\" arXiv preprint arXiv:2210.09929 (2022).\n\n[3] Ghalebikesabi, Sahra, et al. \"Differentially Private Diffusion Models Generate Useful Synthetic Images.\" arXiv preprint arXiv:2302.13861 (2023).\n\n[4] Lyu, Saiyue, et al. \"Differentially Private Latent Diffusion Models.\" arXiv preprint arXiv:2305.15759 (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the constructive feedback and detailed comments. We will correct typographical errors and make suggested improvements to our paper. Here are our clarifications:\n\n**1. The absence of a theoretical analysis for MIXUP-SELFAUG in the submitted work is notable.**\\\nOur work is largely empirical in nature. However, theoretical justification for our approach can be provided with respect to why naive application of mixup harms DP and our approach does not. \n\nConsider Alg. 1 in the submission PDF. The inner loop is what satisfies DP and it does so for a batch of example $B_t$. (The overall privacy guarantee is obtained using amplification theorems and composition as explained in related work [2,3] from the submission PDF.)\n\nLet $B = \\{ (x_1, y_1), (x_2, y_2), \\ldots, (x_m, y_m) \\}$ denote a batch of $m=|B|$ examples. Consider the clipped-gradients sum, defined as: $$ \\bar{g}(B) = \\sum_i {g}(z_i)/\\max(1, \\frac{||{g}(z_i)||_2}{C}) $$\n    where $z_i = (x_i, y_i)$ is the $i^{\\rm th}$ example of the batch and $g(\\cdot)$ denotes the gradient of the loss on an example with respect to the model parameters. The $L_2$ sensitivity of a function $f$ is denoted by $\\Delta f$ and is defined as:\n    $$\n    \\Delta f = \\max || f(B) - f(B') ||_2,\n    $$\n    where we take the maximum over pairs of neighboring batches $B, B'$.\n\nDP-SGD relies on the clipping step ${g}(z_i)/\\max(1, \\frac{||{g}(z_i)||_2}{C})$ to bounds the sensitivity of the sum to $C$. If we add or remove any example $(x, y)$ to/from $B$ the $L_2$-norm of only one term changes and because it is clipped to norm $C$, the clipped-gradients sum can change by at most $C$.\n\nWhat if we now apply mixup to the batch $B$? To apply mixup to the batch $B$ we may randomly pair up examples in $B$ (e.g., ignoring any leftover example) and for each pair we create a single mixup example according to Eq. (4) in the submission PDF. In that case the new mixup-augmented batch contains $m$ original examples plus $\\lfloor \\frac{m}{2} \\rfloor$ mixed-up examples, one for each pair of original examples. We then apply DP-SGD as in Alg. 1 to this augmented batch. We denote this construction applied to a batch $B$ as $\\rm{mixup}(B)$. \n\n We provide a proof sketch (due to space constraints) that the sensitivity of the clipped-gradients sum of $\\rm{mixup}(B)$ is $2C$ (and not $C$).\n\n(Proof sketch.) Suppose we apply $\\rm{mixup}$ on the batch $B$ to obtain a mixup-augmented batch and then compute the clipped-gradients sum on that augmented batch. an original example $z \\in B$ will impact two terms of the sum (the one involving the gradient of $z$ and also the one involving the gradient of the mixed-up pair involving $z$). For example this can happen if every term of the sum not involving $z$ points to some direction $C \\vec{e}$ for some $\\vec{e}$ and the two terms involving $z$ point to $-C\\vec{e}$. Therefore the sensitivity is $2C$.\n   \nThe sensitivity being $2C$ (instead of $C$) means that the scale of Gaussian noise added must be doubled to obtain the same privacy guarantee. \n\nOur methods do not suffer from this issue (sensitivity remains $C$) because clipping occurs on the gradients of the ``microbatch'' formed by all of the augmentations (only one term of the clipped-gradients sum of norm at most $C$ is added/removed).\n\\\n\\\n**2. In relation to MIXUP-SELFAUG which doesn't mix labels, questions arise about why MIXUP-SELFAUG improves performance.**\\\nOur intuition is that data augmentation and mixup help generalization. It's also worth pointing out that mixup does provide a benefit even without knowledge/use of true labels as evidence by works that apply mixup outside of the supervised settings. For example, see: [link1](https://arxiv.org/pdf/1905.04215.pdf), [link2](https://arxiv.org/pdf/2206.07692.pdf) and [link3](https://arxiv.org/pdf/2108.12296.pdf). The last paper is particularly relevant because they apply mixup on pairs of examples with the *same* label. \n\\\n\\\n**3. The necessity for incorporating a diffusion model is not sufficiently justified in the current draft.**\\\nWe discuss this in the general response. We made sure to select a diffusion model in a way that would not inadvertently bias results.\n\\\n\\\n**4. Is the observed performance improvement mainly due to distillation effects?**\\\nWe don't believe so. First, we aligned the training data for the diffusion models and pre-trained models to ensure that Mixup-Diffusion would not have access to data (through the synthetic examples) that other methods did not also have. Second, we explicitly tested whether the synthetic examples from the diffusion model by themselves explain the observed performance. For this, we fine-tuned the model with DP-SGD with and without pretrained on the synthetic examples. Results in supplementary materials (Table 6 --- A.2) show that pre-training with the synthetic examples provides does not improve performance. This shows that the benefits come from mixup and not distillation effects.\n\\\n\\\n**5. The use of a diffusion model not trained with DP-SGD could potentially pose issues for differential privacy learning.**\\\nAs we explain in the general response and above, the diffusion model and pre-trained models used the same training set. This means that there is no data leaked through the diffusion model that was not also used to pre-train the fine-tuned model. \n\\\n\\\n**6. Why it's advantageous for ensuring differential privacy.**\\\nWe believe DP-SGD benefits from seeing more data during training and that's what mixup with synthetic diffusion provides."}]

Author rebuttal:
Thank you for the feedback. We would like to clarify a few points.
\
\
**1. Motivation & novelty.**\
Data augmentation has the potential to improve DP-SGD, but naive application of techniques such as mixup compromises privacy. We propose two methods, Mixup-SelfAug and Mixup-Diffusion, to use mixup with DP-SGD *without* worsening privacy. Experimental results show that our methods consistently outperform the current SoTA (``Self-Aug'' from De et al. [10]) which uses single-sample data augmentation and serves as an important baseline.

Table 1 in the 1-page rebuttal PDF shows results on Caltech256, SUN397, Oxford-IIIT Pet. It shows that Mixup-SelfAug and Mixup-Diffusion outperform Self-Aug consistently across all datasets and privacy budgets tested. In some cases, the absolute test accuracy increase is particularly large (e.g., Caltech256 with $\varepsilon=1$).
\
\
**2. Comparison with De et al. [10].**\
De et al. [10] Self-Aug is the prior SoTA. They use single-sample data augmentation (SSDA) to improve performance over vanilla DP-SGD. Our proposed methods use a similar clipping idea to ensure DP. However, we show how to support multi-sample data augmentation (MSDA) such as mixup. Our experiments demonstrate that mixup provide substantial improvements over Self-Aug.
\
\
**3. Does more augmentations help?**\
Single-sample augmentations cannot provide benefits comparable to mixup for DP-SGD. For instance, Table 6 (attached 1-page PDF) shows that even with more augmentations, Self-Aug does not reach the performance of our proposed methods. In fact, additional augmentations (beyond $k=16 $ as recommended in [10]) decreases performance.
\
\
**4. What about different augmentations?**\
Adding augmentations beyond those suggested by De et al. [10] (which are flipping and cropping) hurts performance. We tested adding color jitter to the self-augmentation process of De et al. [10] (we call this Self-Aug+). (The idea of using color jitter is from Sander et al. We use their same parameter configuration. [https://github.com/facebookresearch/tan](https://github.com/facebookresearch/tan)) Results are shown in Table 4 (attached 1-page PDF), where we see that Self-Aug+ provides worse results than Self-Aug.
\
\
**5. Do our techniques benefit from additional augmentations?**\
By contrast Mixup-Diffusion benefits from additional diffusion samples $k'' $ as shown in Table 5 (attached 1-page PDF). For example, this leads to a 9.65% absolute test accuracy increase on Oxford-IIIT Pet.
\
\
**6. Selection of pre-training data, diffusion model and fair comparisons.**\
We took great care to ensure that our experiments lead to a fair comparison between our methods and alternatives such as Self-Aug (prior SoTA). In particular, all methods have access to the exact same training data. We also tune hyperparameters of each method optimally (e.g., $ k $ for Self-Aug). We use the same pre-trained models (Vit-B-16 and ConvNext from OpenClip) to compare our methods to others (Self-Aug and Mixed Ghost Clipping). 

Since Mixup-Diffusion uses a diffusion model to generate synthetic examples, this could make the comparison unfair because other methods do not use synthetic samples. To avoid this, we purposefully use the exact same pre-training data (i.e., LAION-2B) to pre-train models as was used to train the diffusion model.  This avoids the issue of the synthetic examples somehow ``containing'' data that other methods do not have access to. Moreover, we conducted experiments (supplementary material A.2 --- Table 6) to show that the synthetic examples themselves do **not** boost performance. It is the **way** they are used by Mixup-Diffusion that boosts performance. Finally, out of the six datasets we use for evaluation, none of them overlap with the LAION-2B dataset (to the best of our knowledge).
\
\
**7. Explanations for Figure 2**\
Reviewers raised a valid point regarding the lack of clarity of Figure 2 in the submission PDF. The original was plotted using WRN-16-4 model trained from scratch on CIFAR-10 and did not include Mixup-Diffusion.

To address these concerns, we redid this experiment but in the pre-trained setting on CIFAR-10 and Caltech256 and including Mixup-Diffusion. See Figure 1 (attached 1-page PDF). To clarify: the figure plots the per-parameter gradient magnitude averaged over samples at each epoch. The histogram shows the data averaged over all training epochs and the X\% color lines show that data only for the epoch at X\% of the total training process. There are 10 epochs for this experiment, so for example the line for 20% shows the data for epoch 2 (out of 10). 

The figure shows more concentrated values for our methods compared to the Self-Aug baseline, which suggests more stable training and faster convergence. Standard deviations for CIFAR-10 with Self-Aug, Mixup-SelfAug and Mixup-Diffusion are: $2.16 \cdot 10^{-3}$, $9.76 \cdot 10^{-4}$ and $9.59 \cdot 10^{-4}$, respectively. For Caltech256 they are: $1.43 \cdot 10^{-3}$, $1.07 \cdot 10^{-3}$ and $9.32 \cdot 10^{-4}$, respectively. This is consistent with experimental results of test accuracies for each method.
\
\
**8. Why do our techniques work?**\
We believe the data augmentation in general and mixup in particular helps generalization. Furthermore, if we view data augmentation as effectively increasing the amount of data available during training, then DP model training will particularly benefit from it. (This view is consistent with arguments from related work [42].)

To confirm our intuition, we perform two types of experiments. The first type quantifies the potential benefit from synthetic diffusion examples and is described in supplementary material (A.1 --- Table 5). The second type measures the Fréchet Inception Distance (FID) between train/test data and diffusion data for each dataset and shown in Tables 2 and 3 (attached 1-page PDF), where results are consistent with test accuracies across datasets and methods.

Meta-review: This is a borderline paper.  Reviewer ayCk tends to reject this paper given the comments. During the rebuttal, this reviewer did not reply and provide further feedback.  AC read the rebuttal carefully and thought the concerns from the reviewer are valuable. However, AC tought the authors indeed did a good job to address them. AC hopes the authors can improve the paper based on all reviewers' comments.
Decision: Accept (poster)