On the Convergence and Calibration of Deep Learning with Differential Privacy
Authors: Zhiqi Bu
Hua Wang
Zongyu Dai
Qi Long
Venue: Accepted by TMLR ()

Abstract: Differentially private (DP) training preserves the data privacy usually at the cost of slower convergence (and thus lower accuracy), as well as more severe mis-calibration than its non-private counterpart. To analyze the convergence of DP training, we formulate a continuous time analysis through the lens of neural tangent kernel (NTK), which characterizes the per-sample gradient clipping and the noise addition in DP training, for arbitrary network architectures and loss functions. Interestingly, we show that the noise addition only affects the privacy risk but not the convergence or calibration, whereas the per-sample gradient clipping (under both flat and layerwise clipping styles) only affects the convergence and calibration.

Furthermore, we observe that while DP models trained with small clipping norm usually achieve the best accurate, but are poorly calibrated and thus unreliable. In sharp contrast, DP models trained with large clipping norm enjoy the same privacy guarantee and similar accuracy, but are significantly more \textit{calibrated}. Our code can be found at https://github.com/woodyx218/opacus_global_clipping.

Published in Transactions on Machine Learning Research (06/2023)
On the Convergence and Calibration of Deep Learning with Differential Privacy
Zhiqi Bu
sbu@hupenn.dh edu
University of Pennsyloania
Hua Wang University of Pennsyloania
wanghuadhupenn.ccom edu
Zongyu Dai University of Pennsyleania
doizy@sas. upenn. edu
Qi Long
glong@upenn. edu
University of Pennsyleania
Reviewed on OpenReview: https: // optrreveew..eee... net/ forum? id- KOCAGgJYSI
Abstract
Differentially privale (DP) training preserves the data privacy usually al the cost. slower convergence (and thus lower accuracy), as well more severe mis-calibration than its non- private counterpart. To analyze the convergence of DP training, formulate continuous time analysis through the lens of neural tangent kernel (NTK), which characterizes the per-sample gradient clipping and the noise addition in DP training, for arbitrary network architectures and loss functions. Interestingly, we show that the noise addition only affects the privacy risk but not the convergence or calibration, whereas the per-sample gradient clipping (under both flat and layerwise clipping styles) only affects the convergence and calibration.
Furthermore, we observe that while DP models trained with small clipping norm usually achieve the best accurate, but are poorly calibrated and thus unreliable. In sharp contrast, DP models trained with large clipping norm enjoy the same privacy guarantee and similar accuracy, but are significantly more calibrated. Our code can be found at https: com//zodyyx18/oppccus http://///papap___oll_aoalllacla
1
Introduction
Deep learning has achieved tremendous success in many applications that involve crowdsourced information, e.g., face image, emails, financial status, and medical records. However, using such sensitive data raises severe privacy concerns on a range of image recognition, natural language processing and other tasks [Cadwalladr &
Graham Harrison 2018: Rocher et al. 2019 Ohm 2009 De Montjoye et al. 2013 2015). For a concrete example, researches have recently demonstrated multiple successful privacy attacks on deep learning models, in which the attackers can re-identify member in the dataset using the location or the purchase record, via the membership inference attack (Shokri et al. 2017 Carlini et al.) 2019). In another example, the attackers extract person's 's name, email address, phone number, and physical address from the billion-paramee parameter GPT-2 (Radford et al.) 2019) via the extraction attack (Carlini et al. 2020). Therefore, many studics have (Dwork et al.) 2006 Dwork 2008 Dwork et al. 2014 Mironov 2017 Duchi
applied differential privacy (DP)
et al. 2013 Dong et al. 2019 a mathematically rigorous approach, to protect against leakage of private
information Abadi et al.] 2016 McSherry Talwar 20077 McMahan et al., 2017 Geyer et al. 2017). To
achieve this gold standard of privacy guarantee, since the seminal work (Abadi al. 2016). DP optimizers
(including DP-SGD/ Adam (Abad et. al. 2016 Bassily et al. 2014
Bu al.] 2019). DP-SGLD WWng et. al.

---

Published in Transactions on Machine Learning Research (06/2023)
2015
Li et al. 2019 Zhang et al. 2021 DP-FedSGD and DP-FedAve (McMahan et al. 2017) are applied to train the neural networks while preserving high accuracy for prediction.
Algorithmically speaking, DP optimizers have two extra steps in comparison to the non-DP standard optimizers: the per-sample gradient clipping and the random noise addition, so that DP optimizers descend in the direction of the clipped, noisy, and averaged gradient (see Equation (4.1)) These extra steps protect the resulting models against privacy attacks via the Gaussian mechanism (Dwork et al. 2014| Theorem A.1), the expense of an empirical performance degradation compared to the non-DP deep learning, in terms of much slower convergence and lower utility. For example, state-of-theeare CIFAR1O accuracy with DP is x 70% without pro-training (Papernot et al. 2020) (while non-DP networks can casily achieve over 95% accuracy) and similar performance drops have been observed on facial images, tweets, and many other datasets (Bagdasaryan et al. 2019 Kurakin et al. 2022
Empirically, many works have evaluated the effects of noise scale, batch size, clipping norm, learning rate, and network archilecture on the privacy- trade-off (Abadi al.) 2016 Papernot et al.) 2020). However, despite the prevalent usage of DP optimizers, little is known about its convergence behavior from theoretical viewpoint, which is necessary to understand and improve the deep learning with differential privacy,
We notice some previous attempts by (Chen et al. 2020 Bu et al. 2022 Song et al. 2021 Bu et al. 2022
which either analyze the DP-SGD in the convex setting or rely on extra assumptions in the deep learning setting.
Our Contributions In this work, we establish a principled framework to analyze the dynamics of DP deep learning, which helps demystify the phenomenon of the privacy-accuracy trade-off.
We explicitly characterize the general training dynamics of deep learning with DP-GD in Fact 4.1 We show a fundamental influence of the DP training on the NTK matrix, which causes the convergence worsen.
This characterization leads to the converyence analysis for DP training with small or large clipping norm, in Theorem and Theorem 2
respectively.
We demonstrate via numerous experiments that small clipping norm generally leads to more accurate but less calibrated DP models, whereas a large clipping norm effectively mitigates the calibration issue, preserves a similar accuracy, and provides the same privacy guarantee.
We conduct the first experiments on DP and calibration with large models at the Transformer level.
To elaborate on the notion of calibration (Guo et al. 2017 Niculescu-Mizil & Caruana 2005), critical performance measure besides accuracy and privacy, we provide concrete example as follow. A classifier is calibrated if its average accuracy, over all samples it predicts with confidence (the probability assigned on its output class), is close to p (0 < p < 1). That is, a calibrated classifier's predicted confidence matches its accuracy. We observe that DP models using a small clipping norm are oftentimes too over-confident to be reliable (the predicted confidence is much higher than the actual accuracy), while a large clipping norm is amazingly effective on mitigating the mis-calibration.
2 Background
2.1
Differential privacy notion
We provide the definition of DP (Dwork et al., 2006 2014 as follows.
Definition 2.1. A randomized algorithm M is (e, diifferrrrett private (DP) if for any neighboring datasets S, S' differ by an arbitrary sample, and for any event E,
P[M(S) e E] < e P (S') E E] 8
(2.1)
Given a deterministic function G(S), adding noise proportional G's sensitivity makes it private. This is known the Gaussian mechanism, as stated in Lemma 2.2 and widely used in DP deep learning.
2

---

Published in Transactions on Machine Learning Research (06/2023)
Define the l sensitivity of any function G to be R == s |[((S) G(S") l where the supreme is over all neighboring dalasets( S').
Lemma 2.2 (Theorem A.1 (woor et al.
2014h: Theorem 2.7 DDog et al. 2019
Then the Gaussian mechanism GSS) = G(S) + a NN I) (e, for some e depending on (a. 8),
where p is the sampling ratio (e.g. batch size / total sample size).
We note that the interdependence among and (o, n, can be characterized by various privacy accountants, inchuding Moments accountant (Abadi et al.) 2016 Canonne et al.) 2020). Gaussian differential privacy (GDP)
Dong et al. 2019 Bu et al. 2019), Fourier accountant (Koskela et al. 2020), Edgeworth Accountant (Wang
ct al. )022), etc., cach based on a different composition thcory that accumulates the privacy risk c(a, n. p, 6, differently over T iterations.
2.2 Deep learning with differential privacy
DP deep learning (Google networks with the
Facebook) uses a general optimizer, e.g. SGD and Adam, to update the neural
de. Ow + oR N(O,
privatized gradient:
CC(RR
(2.2)
where is the trainable parameters of the network, bw noise scale that determines the privacy risk. Specifically, (R(R) is the clipping factor with the clipping norm R, which restricts the norm of the clipped gradient in that (R) 0t.
0b is the i-th per-sample gradient of loss 6, and is the
< R. There are multiple ways to design such an clipping factor. The most generic clipping (Abadi et al. 2016 uses C, min aw [}, the
automatic clipping (Bu ct al. 2022) uses C, = 1/(l 86,
8w + 0.01) or the normalization C, = 1/ll sw |l. and the
global clipping uses C; = T de.
< R} to be defined in Appendix D
In this work, we focus on the traditional
8w
clipping (Abadi et al. 2016) and observe that
clipping/orrmalizttonn + R/
Oe:
smallR
C. = min {
1, R/
ae,
largeRt
C. = 1 + no clipping.
Ow
Ow
In equation 2.2 the privatized gradient has two unique components compared to the standard non-DP gradient: the per-sample gradient clipping (to bound the sensitivity of the gradient) and the random noise addition (to guarantce the privacy of models). Empirical observations have found that optimizers with the per-sample gradient clipping, even when no noise is present, have much worse accuracy at the end of training (Abadi et al., 2016 [agdasarryn et al. (2019). On the other hand, noise addition (without the per-sample clipping), though slows down the convergence, can lead to comparable or even better accuracy at the convergence (Neelakantan et al. 2015). Therefore, it is important characterize the effects of the clipping and the noising, which are under-studied while widely-applied in DP deep learning.
3 Warmup: Convergence of Non-Private Gradient Method
We start by reviewing the standard non-DP Gradient Descent (GD) for arbitrary neural network and arbitrary loss. In particular, analyze the training dynamics of neural network using the neural tangent kernel (NTK) matrixi
Suppose a neural network A is governed by weights w, with samples æ, and labels y: (i = L,..,, n). Denote the prediction by fi = f(z;, w), and the per-sample loss by l = Ef(x,, w). yi), whereas the optimization
We emphasize that our analysis are not limited to the infinitely wide or vre--parameterized neural networks, Put differently. the NTK matrix H to be deterministic nearly time-independent,
don't 't.
the in (Arra et al. 2019a 2020 Port et al. 2020 Arora et 2019b).
Lee et
2019:
Du al.
2018
Allen-Zhu et al.
2019
Zou al.
"hh network
and
difierentiable following convention existing literature
Du et
2018
Allen-Zhu 2019 Xie al.
2020
Bu al. 2021b the sense that sub- sub-gradient exists everywhere. This
differentiaiility is necessary foundation of the back pock-propagation for deep learning.
3

---

Published in Transactions on Machine Learning Research (06/2023)
loss L is the average of per-sample losses,
I(w)- 1 Σ 1=1
(f((;; w),
In discrete time, the gradient descent with learning rate 1) be written
Ow = w(k) "
ØL
de;
w(k + +) = w(k)
In continuous time, the correspouding gradient flow, i.e,, the ordinary differential equation (ODE) describing the weight updates with an infinitely small learning rate 17 0, is then:
(t)) = aw(() = - de,
AL
@w(()
Applying the chain rules to the gradient flow, we obtain the following general dynamics of the loss L,
aT. ØT. ØT."
ØT 0L 0f of OT.
aT. 0f
ØT. T 0f
-= Üw Ow dw 0f Ow dw 0f
w
H(t)
(3.1)
where 34 L 86, matrix, which is positive semi-definite and crucial to analyzing the convergence behavior.
0en) n (8. ST
Rlxa and the Gram matrix H(t of of T
E R is known the NTK
To give concrete example, let. é be the MSE loss f,(w) = (f(æ; w) - y1)² and LMSE = E (() = I. ,²)², then LMSE = -4(f y) H())(f y)/n². Furthermore, if H(t) is positive definite, the MSE loss LUSE + 0 exponentially fast (Du et al. 2018 Allen-Zhe et al. 2019 Zou et al. 2020 and the cross-entropy loss LCE + 0 at rate O(1/t) (Allen-Zii Zhu et al. 2019).
4 Continuous-time Convergence of DP Gradient Descent
In this section, we amalyze the weight dynamics and loss dynamics of DP-GD with an arbitrary clipping function in continuous-time analysis. That is, we study only the gradient flow the training dynamics as the learning rate 1) tends O. Our analysis can generalize other optimizers such DP-SGD, DP-HeavBBall, and Adamm...
4.1 Effect of Noise Addition on Convergence
Our first result is simple yet surprising: the gradient flow of a stochastic noisy GD with non-zero noise equation 41 is the same as that of the gradient flow without the noise in equation 4.2 Put it differently, the noise addition has effect on the convergence of DP optimizers in the limit of continuous time analysis. We note that DP-GD shares some similarity to another noisy gradient method, known as the stochastic gradient Langevin dynamics (SGLD Welling & Teh (2011)). However, while DP-GD has a noise magnitude proportional to y and thus corresponds to a deterministic gradient flow, SGLD has a noise magnitude proportinal to vTi which is much larger when we let - the limit, and thus corresponds a different. contimuuss-time behavior: its gradient flow is stochastic differential equation driven by a Brownian motion. We will extend this comparison the discrete time in Section 4.5
To elaborate this point, we consider the DP-GD with Gaussian noise, following the notation in equation 2.2
Ow(k) 77 <<> n
Oe, +oR + -...))
w(k + +1 w(k)
(4.1)
Notice that this general dynamics covers both the standard non-DP GD (a = 0 and, C if no clipping, or C, if batch clipping) and DP-GD with any clipping function. Through Fact 4.1 (see proof Appendix B) we claim that the gradient flow of equation 4. is the same ODE (not SDE) regardless of the value of a. That is, different always results in the same gradient flow n/n. n 0.
4

---

Published in Transactions on Machine Learning Research (06/2023)
Fact 4.1. For all 2 0, the gradient descent in equation
4.1
corresponds to the continuous gradient flow
de, Ct(t). ((t) - n Ow(1)
(4.2)
This result indeed aligns the conventional wisdon of tuning the clipping norm C' first (e.g. setting a 0 or small) then the noise scale o, since the convergence is more sensitive to the clipping, We validate Fact 4.1 in Figure by experimenting on CIFARIO with small learning rale.
a=0,
-=0,5---
14
e=1, 2.06
23
0=1.g=2.00 2.06
0-2,c-0
0- 0.50
6.8
25-
g=4,c 0.23
0.23
2,4
1.5-
non non-DR,
Test
1.4
8.5
non-DP,
Test
0.4
0.0
o= 0,
0= 2, 0.50
1.062.6
05
0.5
4.-4,--0000
10 15 20 0.2
non-DP.em
0.
15
26
8
15
13
Figure 1: For fixed R = 1, = 0.1, ViT-base trained with DP-SGD under various noise a has similar performance on CIFAR10 (setting in Section 5.3 Here 'non-DP' means both o and no clipping. Notice that the loss curves for different are very similar (though not the same) each other, because we fix the random seed the beginning of cach itcration among different runs. This is climinatc the potential difference from uncontrolled random realizations for fair comparison.
4.2 Effect of Per-Sample Clipping Convergence
We move on to analyze the effect of the per-sample clipping on the DP training equation 4.2 Tt has been empirically observed that the per-sample clipping results in worse convergence and accuracy even without the noise (Bagdasaryan et al. 2019 We highlight that the NTK matrix is the key to understanding the convergence behavior. Specifically, the per-sample clipping affects NTK through its linear algebra properties, especially the positive semi-definiteness, which we define below in two notions for general matrix.
Definition 4.2. For a (not necessarily symmetric) matrix A, it is
positive in quadratic form if and only if Ax 2 0 for every non-zero æ;
2. positive in eigenvalues if and only if all eigenvalues of A are non-negative.
These two positivity definitions are equivalent for a symmetric Hermitian matrix, but not so for non- symmetric matrices. We illustrate this difference in Appendix A with some concrete examples. Next, we introduce two styles of per-sample clippings, both can work with any clipping function.
Flat clipping style. The DP-GD described in equation 4.1 with the gradient flow equation 4.2 equipped with the flat clipping (McMahan et al.) 2018). In words, the flat clipping upper bounds the entire gradient vector by norm R. Using the chain rules, we get
aL. Ow n²
Σ Oe, Σ
Ol, C, Ow
ØT.
0L
=
w
HC
(4.3)
Ow
0f
0f
where C(t) diag diaag(C,.....CC. and Ct()) is defined in Section 2.2
See githuttthhhcc.. htt.ttaccicillllleeoeeeeeeeaaaaa 2022).
Section 3.3 KKrakin

---

Published in Transactions on Machine Learning Research (06/2023)
Layerwise clipping style. We additionally analyze another per-sample clipping style the layerwise clipping (Abadi et. al. 2016 McMahan et al. 2017 Phan al. 2017). Unlike the flat clipping, the layerwise clipping upper bounds the r-th layer's gradient vector by layer-dependent norm R.. Therefore, the DP-GD and its gradient flow with this layerwise clipping are:
w, ( + = (k: ! Σ
Ow, de, Ct,, + toR, (o0..)((.1)) and (t) --
n1 E
1
Ol. Ow.
Cir.
Then the loss dynamics is obtained by the chain rules:
Σ
OL OL of Σ
w.
H,C, C, OL T
H, of
(4.4)
dw,
where the layerwise NTK matrix H,-
of and Ct diag(Ci, Cn.r).
Ow, Ow,
In short, from equation 1.3 and equation 1.4 the per-sample clipping precisely changes the NTK matrix from H E, H,, in the standard non-DP training, to HC in DP training with flat clipping, and to E, H,C, in DP training with layerwise clipping. Subsequently, we will show that this may break the NTK's positivity and harm the convergence of DP training.
4.3 Small Per-Sample Clipping Norm Breaks NTK Positivity
We show that the small clipping norm R breaks the positive semi-definiteness of the NTK matrix
Theorem 1. For an arbitrary neural network and loss conver. in f, suppose at least some per-sample. gradients are clipped (3i, C < 1 in the gradient flow of DP-GD, and assume H(t) > 0, then:
1. for flat clipping style, the loss dynamics is equation 4.3 and the NTK matris is H({)C((), which may not be symmetric nor positive in quadratic form, but is positive in eigenvalues.
2. for layerwise clipping style, the loss dynamics is equation 4-4 and the NTK malric is Σ, H,(,,,,,,,, which may not be symmetric nor positive in quadratic form in eigenvalues.
3. for both flat and layerwise clipping styles, the loss L(t) may not decrease monotomically.
4- if the loss I(t) converges with i.(t) for the flat clipping sbyle, it converges to 0; for the lagerwise clipping style, it may converge to non-zero value.
We prove Theorem g in Appendix B which states that the symmetry of NTK is almost surely broken by the clipping using small clipping norm. If furthermore the positive definiteness of NTK is broken, then severe issues may arise in the loss convergence, which is depicted in Figure and Figure
4.4 Large Per-Sample Clipping Norm Preserves NTK Positivity
Now we switch gears to large clipping norm R. Suppose at each iteration, R is sufficiently large so that no per-sample gradient is clipped (C; = 1), i.e. the per-sample clipping is not effective. Thus, the gradient flow of DP-GD is the same as that non-DP GD. Hence we obtain the following result.
Theorem 2. For an arbitrary neural network and loss convex in f, suppose none of the per-sample gradients are clipped (Vi, C. = 1) in the gradient flow of DP-GD, and assuming H(t) > 0, then:
1. for both flat and layerwise clipping styles, the loss dynamics is equation 3.1 and the NTK matriz is H(t), which is symmetric and posilive definile.
*It is fact that the product of symmetric and positive definite matrices and a positive diagonal matrix may not be symmetric nor positive in quadratic form. This is shown in Appendix A 5 Note that it is possible that T((1) converges yet. f.(t) f O, e-g. when uniform convergence satisfied.

---

Published in Transactions on Machine Learning Research (06/2023)
2. if the loss L(t) converges with L(t) - O, for both flot and layerwise clipping styles, the loss L(t) decreases monolonically to 0.
We prove Theorem 2 in Appendix B and the benefits of large clipping norm are assessod in Section 5.2 Our
findings from Theorem 1 and Theorem are visualized in the left plot of Figure 10 and summarized in Table !
NTK matrix
Symmetric NTK V
Positive in quadratic form
Positive in eigenvalues
Loss
Monotone loss decay
To zero loss
Clipping type
convergence
No clipping
H = Σ, H
Batch clipping
cH c H.
Large R clipping
H = E, H
(Flat & layerwise)
Small R clipping
HC
X
(Flat)
Small R clipping
Σ. H.C.
X
X
X
(Layerwise)
Table 1: Effects of per-sample gradient clipping on gradient flow. Here "Yes/No means guaranteed or not and the loss refers to the training set. *Loss convergence' conditioned on H(I) > 0.
4.5 Connection to Bayesian Deep Learning
When R sufficiently large, all per-sample gradients are not clipped (C; Vi), and DP-SGD is essentially the SGD with independent Gaussian noise. This is indeed the SGLD (with different learning rate) that is commonly used to train Bayesian neural networks.
DP-SGD: w(k+ + w(k) 7DP-SGD
Σ
Öl,
+oR oo-- -V..
dw
SGLD: w(k (1++1) -k)
MSGLDN
Σ
Öl,
+ VBSCLD
2B
dw
where is the total number of samples and B is mini-batch size. Clearly, DP-SGD (with the right combination of byperparameters) is special form of SGLD by setting !DP-sGD NSGLDD/2 and o aR 2B = 1/VTTCLLD.
Similarly, DP-HeavyBall with large R can be viewed as stochastic gradient Hamiltonian Monte Carlo. This equivalence relation opens new doors to understanding DP optimizers by borrowing the rich literature from the Bayesian learning. Especially, the uncertainty quantification of Bayesian neural network implies the amazing calibration of large-R DP optimization in Section 5.2
5 Discrete-time DP Optimization: privacy, accuracy, calibration
Now, we focus on the more practical analysis when the learning rate is not infinitely small, i.e. the discrete time analysis. In this regime, the gradient flow equation 4.2 may deviate from the dynamics of the actual training, especially when the added noise is not small, e.g. when the privacy budget e is stringent and thus requires large a.
Nevertheless, statc-of-the-art DP accuracy can be achieved under settings that is wellaaprroximated by our gradient flow. For example, large pre-trained models such as GPT2 (0.8 billion parameters) (Bu et al. 2022 Li ct al. 2021) and ViT (0.3 billion parameters) (Bu et al. a) are typically trained using small learning rates around 0.0001. In addition, the best DP models are trained with large batch size n, e.g. (Li et al. 2021 have used a batch size 6000 to train RoBERTa on MNLI and QQP datasets, and (Kurakin et al, De et al. 2022 Mehta et al. 2022) have used batch sizes n from 10a to 10 L.e. full batch, achieve stato-of-the-ar DP accuracy on ImageNet. These settings all result in very small noise magnitude noR/n in the optimizatior so that the noise has small effects on the accuracy (and the calibration), illustrated in Figure Consequently,
2022
focus on only analyzing the effect of different clipping norms R.
Here the noise magnitude discussed per parameter. empirically verified that the total noise magnitude for models with millions of parameters can be also small
iiimensioon-ndependeee when the gradients are low-rank (Ti et 2022

---

Published in Transactions on Machine Learning Research (06/2023)
5.1 Privacy analysis
From Lemina 2.2 highlight that DP optimizers with all clipping norms have the same privacy guarantee, independent of the choice of the privacy accountant, because the privacy risk only depends on the noise scale a (i.c. the noise-to-sonsitivity ratio). We summarize this common fact Fact 5.1 which motivates the ablation study on in most literature DP deep learning. Consequently, one can use a larger clipping norm that. benefits the calibration, while remaining equally DP as using a smaller clipping norm.
Fact. 5.1 (Abadi et al. (2016)). DP optimizers with the same noise scale equally (<()); independent of the choice of the clipping norm R.
Firstly, show that the privatized gradient in equation 2.2 has privacy guarantee that only depends on d, not R, regardless of which privacy accountant is adopted. This can be seen because (1)
Proof of Fact 5.1
the sum of per-sample clipped gradient C.g. ( has sensitivity of maxien, |Cag 11 S by the triangular inequality, and (2) the noise oR proportional Rt and hence fixing the woise-to-signas ratio oR/ o, regardless of the choice of R. Therefore, the privacy guarantee is the same and independent of R. Secondly, it is well-known that the post-processing of DP mechanism is equally DP, thus any optimizer (e.g. SGD or Adam) that leverages the same privatized gradient in equation 2.2 has the same DP guarantee.
5.2 Accuracy and Calibration
In the following sections, we reveal novel phenomenon that DP optimizers play important roles in producing well-calibrated and reliable models.
M-class classification problems, we denote the probability prediction for the i-th sample as म, E R so that fx;) argmax(m:) then the accuracy is (x;(); y/). The confidence, i.c., the probability associated with the predicted class, is P, = max and good calibration means the confidence close to the accuracy Formally, employ three popular calibration metrics from (Naeini al., 2015): the test loss, i.e. the negative log-likeet lielliill (NLL), the Expected Calibration Error (ECE), and the Maximum Calibration Error (MCE).
ECE: EA, [P[((as)) P: = p) P
MCE:
P(S(x:) y p) P
pE(O.1]
307
19'
Accuracy
Accuracy
Accuracy
Number saampplss
Aug Confidence DP-SGD, R=10
of SSampis
Avg Confidence
Nurbber ''Samples
Aug Canfidence
DPSGD, R=200
DP-AdamWW, Rm20
R-0.1
DP-AdammW, R=0.1
20P
6.0
2.8
9.5
02
98
1.0
Confidence
Confidence
Confidence
Figure 2: Confidence histograms on CIFAR 10 (left), MNIST (middle), and SNLI (right).
ECE
MCE %
non-DP
DP (small R)
DP (large R)
non-DP
DP (small R)
DP (large R)
CIFARIO
1.3
0.9
1.1
54.8
58.6
27.5
MNIST
0.4
2.3
0.7
49.3
56.2
33.4
SNLI
13.0
22.0
17.6*
34.7
62.5
28.9*
Table 2: Calibration metrics ECE and MCE by non-DP (no clipping) and DP optimizers. *Note that the SNLI experiment uses the mix-up training as described in Section 5.5
7 over-confident classifier, when predicting wrong at data point, only reduces accuracy little but increases loss significantly due large log((,,)) since too little probability assigned to the class.
8

---

Published in Transactions on Machine Learning Research (06/2023)
Throughout this paper, we use the GDP privacy accountant for the experiments, with Private Vision library (Bu et al. a) (improved on Opacus) and one P100 GPU. We cover a range of model architectures (inchuding convolutional neural networks [CNN] and Transformers), batch sizes (from 32 to 1000), datasets (with sample size from 50,000 to 550,152), and tasks (including image and text classification). More details are available in Appendix C
5.3
CIFAR10 image data with Vision Transformer
1,0
1.0
1.0
97.17
96.70
10.00
nan
nan
0.9
2.2
69.4
1.0
58.6
54.0
89.4
0.9
31.39
97.03
96.52
10.77
70
0.3
0.7
1.9
nan
Learning rate 0
0.1-
38.8
53.7
nan
0.7
-C.6
0.01
11.75
31.39
96.61
96.04
10.73
Learning
0.02
39.3
12.9
1.1
1.1
62.1
0.01
90.7
48.6
27.5
38.5
81.2
0.6
0.4
2.01-
10.28
11.75
31.39
94.98
91.91
44.1
39.3
12.9
5.2
4.1
0.001
92.4
90.7
48.5
35.7
34.8
0.4
-.2
0.3
0.0001
10:29
11.75
52.42
0.0001
44.6
44.1
39.3
13.1
5.8
0.0001
92.4
92.4
90.7
42.7
13.3
10
1000.0
10.0
1006.0
10.0
1060,0
Clpping norm
Cipppnn norm
Cliping norm
Figure 3: Ablation study on the accuracy, ECE and MCE (left to right) of CIFARIO with ViT-base.
3.5
R 0.0001
3.0
nut 1-0
1.2
flat - 0.1
f 0.1, 0.1.
layerwise = 100.0000000000000 0.001
2.5
layerwise 100. 00000=0.001
2.5
layerwise. 0.11.
layerwise.R - 0.1.g
Tost accuracy
Toxtt loss
2.0
1.5
3.5-
fat.R 100, n= 0.001
n=1
0.5
3.-
layerwise, 8 100. 000001
layerwise, n=1
0.0
Iteration
Iteration
Iteration
Figure 4: Performance CIFAR10 with ViT-base, batch size 1000, noise scale 1.3, (c, (1.96, 10 5).
CIFARIO is an image dataset, which contains 50000 training samples and 10000 test samples of 32 x 32 color images in 10 classes. We use the Vision Transformer (ViT-base, 86 million parameters) which is pre-trained ImageNet and train with DP-SGD for single epoch. This is one of srate-of-the-art models for this DP task (Bu et al. a bj. From Figure T the best accuracy is achieved along the diagonal by small R and large 7,, phenomenon that is commonly observed in (Li et al. 2021 Bu et al. 2022 However, the calibration error (especially the MCE) is worse than the standard training in Table 2 and Figure 2 Additionally, the layerwise clipping can further slow down the optimization, as indicated by Theorem [ We highlight that we choose (R, n) proportioanlly, so that the total noise magnitude no R fixed for different hyperparameters.
On the other hand, DP training with larger R can lead significantly better calibration errors, while incurring negligible reduction in the accuracy (97.17 + 96.61%). In Figure 5 the reliability diagram (DeGroot 1983 Niculescu Mizil & Caruana 2005) displays the accuracy as function of confidence. Graphically speaking, a calibrated classifier is expected to have blue bins close to the diagonal black dotted line. While the non-DP model is generally over-confident and thus not calibrated, the large R clipping effectively achieves nearly perfect calibration, thanks to its Bayesian learning nature. In contrast, the classifier with small R clipping is not only mis-calibrated, but also falls into 'bipolar disorder'; it is either over-confident. and inaccurate, or confidetn but highly accurate. This disorder is observed to different extent in all experiments in this paper.
& Fienberg]
Note that the ablation study of (n, R) is necessary and well-applied on DP optimization (sce Figure 8 in Li ct al. 2021 and Figure in [Bu al. 2022 Thus, besides the evaluation of accuracy, additionally evaluating the calibration error almost. free.
9

---

Published in Transactions on Machine Learning Research (06/2023)
Perfect calibration
Perfect ca allarrtion
Per callbration
Accuraty Ovenconfieence
Acouracy
Accurscy
Overconfidence confidance
conerconidd conti
Accuncty
Acciracy
Accuracy
02
Confidence
Confidence
Confidence
Figure 5: Reliability diagrams (left for non-DP; middle for DP with large R: right for DP with small R) on CIFAR10 with Vis-base.
5.4 MNIST image data with CNN model
On the MNIST dataset, which contains 60000 training samples and 10000 test. samples of 28 x 28 grayscale images in 10 classes, we use the standard CNN in the DP libraries for architecture) and train with DP-SGD but without pre-training. In Figure 6 DP training with both clipping norms (2.32, 10 100 DD,DP, and has similar test accuracy (96% for small and 95% for large R), though the large R leads to smaller loss (or NLL). In the right plot of Figure 0 affects the accuracy and calibration, ceteris paribus, showing clear accuracy-calibratin trade-off based on 5 independent runs. Similar to Figure 5 large R training again mitigates the misccalibration in Figure
Py Google Facebook) (see Appendix C.1
demonstrate how R
015500 tel
1.0
D--SE, bec: Ae
D1-S2C,
0.822
3.5-
60.003
0.817
2.0
0.539
3.5
6992
0.000
02
01-022
Spech
Figure Loss (left), accuracy (middle), accuracy with ECE (right) on MNIST with 4-layer CNN under different clipping norms R, batch size 256, noise scale 1.1, learning rate 0.15/R for each R.
Perthct celbrration
Perfect ei brition Acoracy
Porfect cal brat Accuryy
Acouracy
ner--cefiencce
corfiiance
denca
Accuracy
Accuracy
Accuracy
1A
04
5.8
02
0.8
Confidence
Confidence
Confidence
Figure 7: Reliability diagrams (left for non-DP; middle for large R 200; right for small R 1) MNIST with 4-layer CNN.
9 http::p:/...sh.....ccc/cco////// paauus//bbb//mtteeee/all//////ts Pytarch Opacus.
Tensorflow and https://giithub.com////
Pytach
10

---

Published in Transactions on Machine Learning Research (06/2023)
5.5
SNLI text data with BERT and mix-up training
1.8
6:22
0.22
6.70
Rest Accuracy
0.21
0.75
0.14
0,20
DP-AdamiW,
c:2
13-
DP-AdamWY, test R=0.1
6:33
0.73
DP AdamnW, train, R=20
DP AdamW, R=0.1
DP AdaamW, R=0.1
DP-AdamW,, test R=20
DP-AdamW, R=20
DP-AdamW,, R=20
14
20 10
20
20
40
50
iterationx1000
(terationx100m
Iterationx200
Figure 8: Loss (left), accuracy (middle) and calibration on SNLI with pre-trained BERT, batch size 32, learning rate 0.0005, noise scale 0.4, clipping norm are 0.1 or 20, (c, = (1.25, 1/550152).
collection of human-written English sentence paired with one of three classes: entailment, contradiction, or neutral. The dataset has 550132 training samples and 10000 Lest samples. We the pre-trained BERT (Bidirectional Encoder Representations from Transformers) Opacus tutoria which gives state-of-the-art privacy-accuracy result. Our BERT contains 108M paramcters and we only train the last Transformer encoder, which has 7M parameters, using DP-AdamW. In particular, we use a mix-up training: we in fact train BERT with small R for 3 epochs (51.5 x 10 iterations, i.e. 95% of the training) and then use large R for an additional 2500 iterations (the last 5% of the training). For comparison, we also train the same model with small for the entire training process of 54076 iterations.
Stanford Natural Language Inference (SNLI) 10
Perfect calibration
Accuracy
Over-confidence
Accuracy
6.
Accuracy
Accuracy
6.2
0.2
0.0
02
2,
0.5
0.2
02
0.4
0.8
1.0
0.0
02
04
10
Confidence
Confidence
Confidence
Figure 9: Reliability diagrams (left for non-DP; middle for large R = 20; right for small R = 0.1) SNLI with BERT. Note that the large R is only used for the last 2500 out of 54000 iterations.
Surprisingly, the existing DP optimizer does not minimize the loss all, yet. the accuracy still improves along the training. We again observe that large R training has significantly better convergence than small R (observe that when turned to large R in the last 2500 steps, the test loss NLL decreases significantly from 1.79 to 1.08, and the training loss NLL decreases from 1.81 to 1.47; while keeping small R does not reduce the losses). The resulting models have similar accuracy: small R has 74.1% accuracy; mix-up training has 73.1% accuracy; as basclines, non-DP has 85.4% accuracy and the entire training with large R has 65.9% accuracy. All DP models have the same privacy (e = 1.25, 5 = 1/550152), and large R training has much better calibration in Table 2
We remark that all hyperparameters are the same as in the Opacus tutorial.
5.6 Regression Tasks
On regression tasks, the performance measure and the loss function are unified as MSE. Figure 10 shows that DP training with large Rt is comparable if not better than that with small R. We experiment on the California Housing data (20640 samples, features) and Wine Quality (1599 samples, 11 features, run with full-batch
10 SNLI 1.0 from htwpr//eee//haa..aattoteeeeeooes
See
11

---

Published in Transactions on Machine Learning Research (06/2023)
DP-GD). Especially, in the left plot of Figure 10 convergence, explained by Theorem 1 which is mitigated by the large R training. Additional experimental
observe that small R training may incurs non-monotone
details are available in Appendix C.4
red_wine
california_
Test ksss Rw]
Test loss. Rw Test loss. Re200
Test koss R=200
22
18
Lo0
1.8x10
10t
107
157
307
10
10a
101
Ieradions
terations
Figure 10: Performance of DP optimizers under different clipping norms on the Wine Quality and the California Housing datasots. Experimental details Appendix C.4
6 Discussion
In this paper, we provide a putinuous-timee convergence analysis for DP deep learning, via the NTK matrix, which applics to the general neural network architecture and loss function. We show that in such a regime, the noise addition only affects the privacy risk but not the convergence, whereas the per-sample clipping only affects the convergence and the calibration (especially with different choices of clipping thresholds), but not. the privacy risk.
We then study the accuracy-calibratio trade-off formed by the DP training with different clipping norms. We show that using a small clipping norm oftentimes trains the more accurate but mis-calibrated models, while a large clipping norm provides a comparably accurate yet much more calibrated model. In fact, several follow-up works have demonstrated that DP training with large R is remarkably accurate and well-calibrated on large transformers with 10 parameters (Zhang al. 2022 and significantly mitigates the unfairness on various tasks (Esipova et al. 2022), while preserving privacy.
A future direction is to study the discrete time convergence when both the learning rate and added noise are not small. One immediate observation is that the noise addition will have an effect the convergence in this case, which needs further investigation. In addition, the analysis of commonly-used mini-batch optimizers is also interesting, since for those optimizers, the training dynamics is no longer deterministic and instead stochastic differential equation will be used for analsis. Lastly, the inconsistency between the cross-entropy loss and the prediction accuracy, as well as the connection to the calibration issue are intriguing: their thcoretical understanding awaits future rescarch.
Acknowledgement
We would like to thank Weijic J. Su, Janardhan Kulkarni, Om Thakkar, and Gautam Kamath for constructive and stimulating discussions around the global clipping function. We also thank the Opacus team for maintaining this amazing library. This work was supported in part by NIH through R01GM124111 and RF1AG063481.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Tlya Mironov, Kunal Talwar, and Li Zhang Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Commanications Securily, pp. 308 318, 2016.
12

---

Published in Transactions on Machine Learning Research (06/2023)
Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. A convergence theory for deep learning via over- parameterization. In International Conference on Machine Learning, pp. PMLR, 2019.
Sanjeev Arora, Simon Du, Wei Hu, Zhiyuan Li, Ruslan Salakhutdinov, and Ruosong Wang. On exact computation with infinitely wide neural net. arXiv preprint or arxiv: 11955, 2019a.
Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. arXiv preprint arXiv:1901.0555: 08584, 2019b.
Eugene Bagdasaryan, Omid Poursaced, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. In Adoances in Neurul Information Processing Systems, pp- 13453-154655 2019.
Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 TEEE 55th Annual Symposium on Foundalions of Compuler Science, pp. 464-473. IEEE, 2014.
Zhiqi Bu, Jialin Mao, and Shiyun Xu. Scalable and efficient training of large convolutional neural networks with differential privacy. In Advances in Neural Information Processing Systems, a.
Zhiqi Bu, Yn-Xiang Wang, Sheng Zha, and George Karypis. Differentially private bias-term only fine-tuning of foundation models. In Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022, b.
Zhiqi Bu, Jinshuo Dong, Qi Long, and Weijie J Su. Deep learning with gaussian differential privacy. arXiv preprint Xiv: 1107, 2019.
Zhiqi Bu, Sivakanth Gopi, Janardhan Kulkarni, Yin Tat Lee, Judy Hanwen Shen, and Uthaipon Tantipongpi- pat. Fast and memory efficient differentially private-sgd via jl projections. arXiv preprint arXiv:2102.0001 2021a.
Zhiqi Bu, Shiyun Xu, and Kan Chen. A dynamical view on optimization algorithms of overparametterized neural networks. In International Conference Artificial Intelligence and Statistics, pp. 3187-3195. PMLR, 2021b.
Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Automatic clipping: Differentially private deep learning made easier and stronger. arXiv preprint rxXi::2266007166 2022.
Carole Cadwalladr and Emma Graham-Harrison Revealed: 50 million facebook profiles harvested for cambridge analytica in major data breach. The guardian, 17:22, 2018.
Clément Canonne, Gautam Kamath, and Thomas Steinke. The discrete gaussian for differential privacy.
arXiv preprint 2rxi::2004.000 00010, 2020.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and lesting unintended memorization in neural networks. In 28th {USENIX} Securily Symposium (UUSENIX) Security 19), pp. 267-284 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss,, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulaar Erlingsson, al. Extracting training data from large language models. arXiv preprint or arXiv:2012.07805, 2020.
Xiangyi Chen, Steven Z Wu, and Mingyi Hong. Understanding gradient clipping in private sgd: geometric perspective. Advances in Neural Information Processing Systems, 33, 2020.
Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlocking high- differentially private image classification through scale. arXiv preprint arXiv:2204. 2022.
TveesAlexandis De Montjoye, César A Hidalgo, Michel Verleysen, and Vincent D Blondel. Unique in the crowd: The privacy bounds of human mobility. Scientific reports, 3(1):1-5, 2013.
13

---

Published in Transactions on Machine Learning Research (06/2023)
Yves- Alexandre De Montjoye, Laura Radaclli, Vivek Kumar Singh, et al. Unique in the shopping mall: On the reidentifiability of credit card metadata. Science, 347(6221 ):533 539, 2015.
Morris DeGroot and Stephen E Fienberg. The comparison and evaluation of forecasters. Journal of the Royal Statistical Society; Series D (The Statistician), 32(1-2):12 22, 1983.
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. arXiv preprint orXic: 02383, 2019.
Simon S Du, Xiyu Zhai, Barnabas Poczos, and Aarti Singh. Gradient descent provably optimizes over- parameterized neural networks. arXiv preprint ar 1ii:1810 180..11000000 210.02254, 2018.
John C Duchi, Michael T Jordan, and Martin J Wainwright. Local privacy and statistical minimax rates. 2013 IEEE 54th Annual Symposium on Foundations of Computer Science, pp. 429 438, IEEE, 2013.
Cynthia Dwork. Differential privacy: A survey of results. In International conference theory ond applications of models of computation, pp. 1-19. Springer, 2008.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptograhhy conference, pp. 265 284. Springer, 2006.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4):211 407, 2014.
Maria S Esipova, Atiyeh Ashari Ghomi, Yaqiao Luo, and Jesse C Cresswell. Disparate impact in differential privacy from gradient misaligmment. arXiv preprint arXin:2206.0777 2022.
Facebook. Pytorch Privacy library -ateaary--ppp Opacus. https://github.
oopcuss
Stanislav Fort, Gintare Karolina Dziugaite, Mansheej Paul, Sepideh Kharaghani, Daniel M Roy, and Surya Ganguli. Deep learning versus kernel learning: an empirical study of loss landscape gcometry and the time evolution of the neural langent kernel. arXiv preprint wrXi:20000151110 2020.
Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. arXiv preprint 1rXiv:171..00 07557, 2017.
Google. Tensorflow Privacy library. https://githhbe ctt. wtt../////eensooooooroiiiie
Chuan Guo, Gcoff Plciss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. International Conference on Machine Learning, pp. 1321 1330. PMLR, 2017.
Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling shuffling. arXie preprint wrXiv:2103.00033 2021.
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight differential privacy guarantees using fft. In International Conference on Artificial Intelligence and Statistics, pp. 7560-2560 PMLR, 2020.
Alexcy Kurakin, Steve Chien, Shuang Song. Roxana Gcambasu, Andreas Terzis, and Abhradccp Thakurta. Toward training at imagenet scale with differential privacy. arXiv preprinl arXiv:2201.12325 2022.
Jaehoon Lee, Lechao Xiao, Samuel S Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl-Dickstein, and Jeffrey Pennington. Wide neural networks of any depth evolve as linear models under gradient descent. Xiv preprint Xr::::1902, 06720, 2019.
Bai Li, Changyou Chen, Hao Liu, and Lawrence Carin. On connecting stochastic gradient meme and differential privacy. In The 22nd International Conference on Artificial Intelligence and Statistics, pp. 557-566. PMLRR 2019.
14

---

Published in Transactions on Machine Learning Research (06/2023)
Xuechen Li, Florian Tramer, Percy Liang and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Represenlations, 2021.
Xuechen Li, Daogao Liu, Tatsunori B Hashimoto, Huseyin A Inan, Janardhan Kulkarni, Yin-Tat Lee, and Abhradeep Guha Thakurta. When does differentially private learning not suffer in high dimensions? Advances in Neural Information Processing Systems, 35:28616-28630 2022.
H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning difforentially private recurrent language models. orXiv preprinl 1eX.::::100000000
2017.
H Brendan McMahan, Galen Andrew, Ulfar Erlingsson, Steve Chien, llya Mironov, Nicolas Papernot, and Peter Kairouz. A general approach to adding differential privacy to iterative training procedures. arXiv preprint (rXfe:1812.06210 2018.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS'07), pp. 94-103. IEEE, 2007.
Harsh Mchta, Abhradoep Thakurta, Alexcy Kurakin, and Ashok Cutkosky. Large scale transfer learning for differentially private image classification. arXiv preprint arXiv:2205.0 029973, 2022.
Ilya. Mironov. Rényi differential privacy, In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263 275. IEEE, 2017.
Mahdi Pakdaman Naeini, Gregory Cooper, and Milos Hauskrecht. Obtaining well calibrated probabilities using bayesian binning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 29, 2015.
Arvind Neelakantan, Luke Vilnis, Quoc V Le, Ilya Sutskever, Lukasz Kaiser, Karol Kurach, and James Martens. Adding gradient noise improves learning for very deep networks. stat, 1050:21, 2015.
Alexandru Nieulescu-Mizil and Rich Caruana. Predicting good probabilities with supervised learning. In Proceedings of the 22nd international conference Machine learning, pp. 625 632, 2005.
Paul Ohm. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Rev., 57:1701, 2009.
Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, and Úlfar Erlingsson. Tempered sigmoid activations for deep learning with differential privacy. arXiv preprint 0rX1v:2007.14111 2020.
NhatHai Phan, Xintao Wu, Han Hu, and Dejing Dou. Adaptive laplace mechanism: Differential privacy preservation in deep learning. In 2017 IEFE International Conference on Data Mining (ICDM), pp- 385 394. IEEE, 2017.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and 1lya Sutskever. Language models are unsupervised multitask learners. OpenAI blog, 188):9, 2019.
Lue Rocher, Julien M Hendrickx, and Alexande De Montjoye. Estimating the success of re-ieentifications in incomplete datasets using generative models. Nature communications, 10(1):1-9, 2019.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEFE. Symposium on Security and Privacy (SP), pp. 3-18. IEFF, 2017.
Shuang Song, Thomas Steinke, Om Thakkar, and Abhradeep Thakurta. Evading the curse of dimensionality in unconstrained private glms. In International Conference on Artificial Intelligence and Statistics, pp. 2638-2646. PMLR, 2021.
Hua Wang, Shong Gao, Huanyu Zhang, Milan Shen, and Weijic J Su. Analytical composition of differential privacy via the edgeworth accountant. arXiv preprint arXiv:2206.044 04236, 2022.
Yu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and stochastic gradient monte carlo. In International Conference on Machine Learning, pp. 2493 2502. PML., 2015.
15

---

Published in Transactions on Machine Learning Research (06/2023)
Max Welling and Yee W Teh. Bayesian learning via stochastic gradient langevin dynamics. In Proceedings of the 28th international conference on machine learning (ICMI-11), pp. 681-688 2011.
Zeke Xie, Issei Sato, and Masashi Sugiyama. A diffusion theory for deep learning dynamics: Stochastic gradient descent exponentially favors flat minima. In International Conference Learning Representations, 2020.
Hanlin Zhang, Xuechen Li, Prithviraj Sen, Salim Roukos, and Tatsunori Hashimoto. A closer look at the calibration of diffcrentially private learners. arXiv preprint wrXii:2210.082// 2022.
Qiyiwen Zhang, Zhiqi Bu, Kan Chen, and Qi Long. Differentially private bayesian neural networks on accuracy, privacy and reliability. arXiv preprinl arXio:2107.88461, 2021.
Difan Zou, Yuan Cao, Dongruo Zhou, and Quanquan Gu. Gradient descent optimizes pa-aamteeriizedd deep relu nelworks. Machine Learning, 109(3):467-48)) 2020.
16

---

Published in Transactions on Machine Learning Research (06/2023)
A Linear Algebra Facts
Fact A.1. The product A M, where Mj is symmetric and positive matrix and M2 a positive diagonal matrix, is positive definite in eigenvalues but is non-symmetric in general (unless the diagonal matrix is constant) and non-positive in quadratic forms.
Proof of Fact A.1 To see the non-symmetry of A, suppose there exists é.j such that (M2)ss # (M2)a then
(M1 (M)) (Mi) (M))a(
(M1 (M2) + (M2))
Hence A is not symmetric and positive definite. To see that A may be non-positive in the quadratic form, give a counter-example
1 (12) M2 (1 M1 ( 1 2
0 A= M2 (1 0.1
0.2 ) (1, 22)A ( -/2 -0.44
0.1
-2
To see that A is positive in eigenvalues, we claim that an invertible square root M," 12 exists as M1 is symmetric and positive definite. Now A is similar to AM M M2/ hence the non-symmetric A has the same cigenvalues as the symmetric and positive definite M M2M
Fact A.2. Matrix with all eigenvalues positive may be non-positive in quadratic form.
Proof of Fact A.2
A -3 8 ) (1,,0) (!)- 1,
3
though eigenvalues of A are (7 + 3 > 0.
Fact A.3. Matrix with positive quadratic forms may have non-positive eigenvalues.
Proof of Fact A.3
1 ( -1 1) (z, (x, x² + = 0,
A =
but eigenvalues of A are 1 + not positive real. Actually, all eigenvalues of A always have positive real part.
Fact A.4. Sum of products of positive definite (symmetric) matrix and positive diagonal matrix may have zero or nogative eigenvalues.
Proof of Faet A.A
2 H = 8/9 ? )) C = ( 0.9 0
0.4 )
3 2 )) C2 ( (00) 0 (3 2
0.1 0
H.
0 0.6
Although H, are positive definite, H,C, H2 has zero eigenvalue. Further, if H. [1, 1] 0.7, H,C, H₂C₂ has a negative eigenvalue.
7
17

---

Published in Transactions on Machine Learning Research (06/2023)
B Details of Main Results
B.1 Proofs of main results
Proof of Faet 4.1 Expanding the discrete dynamic in equation 4.1
w(k + + w(k) - - :E Vwl.c--
n (N, 1), and chaining it for r 2 times, we obtain
r-1
n R NO 1).
w(k + w(k) - - n Σ Vwel (w(K))))
j=0 n
In the limit of + O, we re-index the weights by time, with t = lnn and s m. Then consider the above equation at time t and t: the left hand side becomes w(++ -ww()): the first summation the right hand side converges - fr Σ, (Tr(( as long as the integral exists. This can be seen as a numerical integration with the rectangle rule, using 7 as the width, j as the index, and 4 pts (m) similarly, the second summation J(n) = Ej No,N((0, 1) has
[[J(n)] = and Var(J(n)) = o² R²12212 178
o² R2 0, as O.
n²
n²
Therefore, 17 0, the discrete stochastic dynamic equation
4.1 becomes the integral
w(t + 8) w(t) = n J
Σ, (()
This integral converges lo a deterministic gradient flow, as 8 + 0, given by
w(t + -)
lim Let E, (w((())))
(()) lim
which corresponds to the ordinary differential equations equation 4.2
Proof of Theorem We prove the statements using the derived gradient flow dynamics equation 4.2
For Statement 1, from our narrative in Section 4.2 we know that the flat clipping algorithm has H(t)C(tt
its NTK. Since H(t) is positive definite and C(t) is positive diagonal matrix, by Fact A.11 the product ((t)C(t) is positive in cigenvalues, yet may be asymmetric and not positive in quadratic form in general.
Similarly, for Slatement 2, we know the NTK of layerwise clipping has the form Σ, (I)C,, which by Fact A.4 is asymmetric in general, and may be not positive in quadratic form nor positive in eigenvalues.
For Statement 3, by the training dynamics equation 4.3 for the flat clipping algorithm and equation 4.4 for the layerwise clipping, we see that. f. equal the negation of a quadratic form of the corresponding NTK. By statement & of this theorem, such quadratic form may not be positive at all and hence the loss L(t) is not guaranteed to decrease monotonically.
Lastly, for Statement 4, suppose L(t) converges in the sense that i, = = ar. f. Suppose we have > O, o5 then aL o since L convex the prediction f. this case, we know 0. Observe that
87
0= f 0ʃ Ow 0f oS TL Ow dw 0f
Gw
For the flat clipping, the NTK matrix,
of as HC is positive in eigenvalues (by Statement 1), so it could Sw dw
only be the case that ar af O, contradicting to our premise that L> 0. Therefore we know L = 0 as long it converges for the flat clipping. On the other hand, for the layerwise clipping, the NTK may be not positive in cigenvalues. Hence it is possible that L + 0 when L. 0.
Proof of Theorem
The proof is similar to the previous proof and thus omitted.
18

---

Published in Transactions on Machine Learning Research (06/2023)
C
Experimental Details
C.1 MNIST
For MNIST, we use the standard CNN in Tensorflow Privacy and Opacus listed below. The training hyperparameters (e.g. batch size) in Section 5.4 are exactly the same as reported in htttt:://gtthiiii com/ htw.p///ww///.aaaa/tte/ee/////ee sattee/mmatteruuooiallsss which gives 96.6% accuracy for the small R clipping Tensorflow and similar accuracy in Pytorch, where our experiments are conducted. The non-DP network is about 99% accurate. Notice the tutorial uses a different privacy accountant than the GDP that we used.
class SampleConwNet (nn. (nn. (nn.Module). def __init__(self)
super ()____nit____
self. convi mn. Conv2d 16, padding=3)
self.conv2 = nn. Conv2d 32, 4, 2)
self fci nn Lineir (32 * 4 4, 32)
olfffc2 nn Linein (32, 10)
def forward x): of shape [B, 1, 28, 28]
F. F.relusself. convi ( # -> [B, 16, 14, 14]
F. max_poo12ddx, 2, 1)
# -> [B, 16, 13, 13]
F. F.relu(self. comv # -> [B, 32, 5, 5]
x F.max_pool2d(s 2,
1)
# -> [B, 32, 4, 4]
x x-view(-1, 32 4 4)
-> [B, 512]
x F.relu(self.rr fci (x) -> [B, 32]
x self -> [B, 10]
return x
C.2 CIFAR10 with Vision Transformer
In Section 5.3
adopt the model from TIMM library. In addition to Figure 2 and Figure plot in Figure 11 the distribution of prediction probability on the true class, say [T.],, for the i-th sample (notice that Figure 2 plots max [T]]k. Clearly the small Rt clipping gives overly confident prediction: almost half of the time the true class is assigned close to zero prediction probability. The large R clipping has a more balanced prediction probability that is less concentrated
DP-SGD,
DP-SGD, R=0.1
Number Samples.
6320
02
Confidence
Figure 11: Prediction probability on the true class on CIFARIO with Vision Transformer.
19

---

Published in Transactions on Machine Learning Research (06/2023)
C.3
SNLI with BERT model
Section 5.5 we use the model from Opacus tutorial in http://hhaabb.copppooor/////pppp
master/tutorials/ www.oriiwwa.bbiiiin....... text cew.cclssiiiiirripppill The BERT architccture can be found in https:
To train the BERT model, we do the standard pre-processing the corpus (tokenize the imput, cut pad each sequence to MAX LENGTH 128, and convert tokens into unique IDs). We train the BERT model for 3 epochs. Similar to Appendix C. in addition to Figure g and Figure 9 we plot the distribution of prediction probability on the true class in Figure 12 Again, the small R clipping is overly confident, with probability masses concentrating on the two extremes, yet the large clipping more balanced in assigning the prediction probability.
DP-AdamW, R=20
Number Samples
6000
DP-AdamW, R=0.1
4003
2000
1002
0.2
0.0
Confidence
Figure 12: Histogram of predicted confidence on the true class on SNLI with BERT using large and small clipping norms.
C.4 Regression Experiments
We experiment on the Wine Quality (1279 training samples, 320 test samples, 11 features) and California Housing 13 (18576 training samples, 2064 test samples, features) datasets in Scction 5.2 For the California Housing, we use Adam with batch size 256. Since other datasets are not large, we use the full-batch DP-GD.
Across all the two experiments, we set 6 == the following structure, where imput_ width is the input dimension for each dataset:
I.I xxxxraining sample size and use the four-layer neural network with
class Net Modull);
def __init___ (self, input_wing width):
super (Standaddeet, self) ___i.________
self.fct Linerr (iiputt_iidtt) 64, bias True)
self fc2 Ln.Linear (64, 64, bias True)
self fc3 nn. Ln.Linear (64, 32, bias = True)
self.fcd nn.Linear (32, 1, bias = True)
def forvard(self, x):
x F.relu(self fcl (x))
Airelu(self.ff2(2 F.relu(self (x))
return
www.s......... http://lib. ech//ataasets/hossss...ii
20

---

Published in Transactions on Machine Learning Research (06/2023)
The California Housing dataset is used to predict the mean price value of owner-occupied home in California. We train with DP-Adam, noise == clipping norm 1, and learning rate 0.0002. We also trained non-DP GD with the same learning rate, The GDP accountant gives e = 4.41 after 50 epochs / 3650 iterations.
The UCI Wine Quality (red wine) dataset is used to predict the wine quality (an integer score between 0 and 10). We train with DP-GD, noise a = 35, clipping norm 2, and learning rate 0.03. We also trained non-DP GD with learning rate 0.001. The GDPP accountant gives 4.40 after 2000 iterations.
The California Housing and Wine Quality experiments are conducted in 30 independent runs. In Figure 10 the lines are the average losses and the shaded regions are the standard deviations.
D Global clipping and code implementation
In earlier version of this paper, proposed a new per-sample gradient clipping, termed the global clipping. The global clipping computes Cglobal, = I( < R), i.c. only assigning 0 or 1 as the clipping factors to each per-sample gradient.
As demonstrated equation 2.2, our global clipping works with any DP optimizers (e.g., DP-Adam, DP-RMSprop, OP-FTRI,(Kairou) el al., 2021), DP-SGD-JL.Bu al. 2021a). etc.), with identical computational complerity as the existing per-sample clipping C, min g |.. 1). Building on top of the Pytorch Opacus library, we only need to add one line of code into
To understand our implementation, we can equivalently view
C = {
if = 1
mi/l ||, 1) =1 if C. = RaRRRll9 - 0 R = min R/ (1 = R/llg
| <
In this formulation, we casily implement our global clipping by leveraging the Opacus==0. 15 library (which already computes Ct). This can be realized in multiple ways. For example, we can add the following one line after line 179 (within the for loop),
aip_faccoo= (clipporor((lppffffoto>>>>))))
At high level, global clipping does not clip small per-sample gradients (in terms of magnitude) and completely remove large ones. This may be beneficial to the oplimization, since large per-sample gradients often correspond to samples that are hard-to-learn, noisy or adversarial. It is important to set a large clipping norm R for the global clipping, so that the information from small per-sample gradients are not wasted. However, using a large clipping norm makes the global clipping similar to the existing clipping, basically not clipping most of the per-sample gradients. We confirm that empirically, with large clipping norm, applying the global clipping and existing clipping have negligible difference on the convergence and calibration.
14see http:::/ggghabbb..o///tttttt/ttp for 2021/09/09.
21


Reviews:
[{"review_id": "aymmO0ft0o", "reviewer": "Reviewer_8Xk4", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The contributions of this paper are:\n\n- The paper formulates a continuous time analysis of differentially private (DP) training through the lens of neural tangent kernel (NTK), which characterizes the per-sample gradient clipping and the noise addition in DP training, for arbitrary network architectures and loss functions.\n- The paper shows that the noise addition only affects the privacy risk but not the convergence or calibration, whereas the per-sample gradient clipping (under both flat and layerwise clipping styles) only affects the convergence and calibration.\n- The paper observes that DP models trained with small clipping norm usually achieve the best accuracy, but are poorly calibrated and thus unreliable. In contrast, DP models trained with large clipping norm enjoy the same privacy guarantee and similar accuracy, but are significantly more calibrated.\n\nWeakness:\n\n1. The paper does not provide empirical validation of its theoretical results on real-world datasets, and it remains to be seen whether the observed trade-off between accuracy and calibration holds in practice.\n\n2. The data and the NN structure in the paper are quite small. More experiments and large data (such as ImageNet) are needed \n\n3. Did not compared with SOTA methods such as large batch. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper analyzes the convergence of differentially private (DP) training through the lens of neural tangent kernel (NTK), for arbitrary network architectures and loss functions. The paper shows that per-sample gradient clipping affects the convergence and calibration, while noise addition only affects the privacy risk.\n", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Please provide empirical validation of its theoretical results on real-world datasets, and it remains to be seen whether the observed trade-off between accuracy and calibration holds in practice.\n2. Add more experiments, the data and the NN structure in the paper are quite small. More experiments and large data (such as ImageNet) are needed \n3. Compare with SOTA methods  such as large batch and add more baselines. ", "broader_impact_concerns": "No ", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Ox7v6lfW2P", "reviewer": "Reviewer_tCgp", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n- This paper proposes to study a fundamental problem in the literature: understanding the dynamics of DP-SGD is an important open problem given the proliferation of machine learning models trained on sensitive data. It does so by drawing connections to the NTK, which has not been widely explored to the best of my knowledge. \n\n- The experiments on calibration are novel and have an actionable take for machine learning practitioners when deciding the trade-off between clipping/noise value. \n\n**Weaknesses**\n\n- It is interesting to see the connection between convergence and clipping through the positiveness of the NTK, however the paper does not provide any guidance on how to use this information, but rather confirms two known facts, in the literature: (1) gradient descent with noisy but unbiased gradients still converges, and (2) that over clipping can destroy the convergence. [1]. \n\n- I think studying calibration is very interesting but I could not understand from the paper the connection with the NTK. \n- Theorem 2 I believe just follows from Fact 4.1. \n\n[1] Song, Shuang, Om Thakkar, and Abhradeep Thakurta. \"Characterizing private clipped gradient descent on convex generalized linear problems.\" arXiv preprint arXiv:2006.06783 (2020).\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "\nThe paper aims at analyzing the effect of clipping and noising the gradient on the convergence of DP-SGD. In particular, the authors study per-layer and flat clipping techniques and their effect on the loss value, the accuracy, and the calibration of the model. \n\nThe authors find that noise addition does not change the dynamics of the gradient flow, while clipping does when the clipping norm is small. To explain this fact, the authors draw a connection with the neural tangent kernel (NTK) and argue that clipping can change its positiveness conditions. (Theorem 1). \n\nThe authors present experiments on CIFAR, MNIST, SNLI, and regression tasks showing the effects of the different clipping techniques and the noise on calibration, loss, and accuracy.\n\n", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Addressing the following questions/concerns could strengthen the work. \n\n1. If I understand correctly, from the theoretical statements it is always better to use a large enough clipping norm so that very few gradients (or none) are clipped. Throughout the paper the authors advocate for using \"large R\" (clipping norm). However, figure 3 shows that large R can also have a bad MCE and ECE. Thus “large R” is not a very helpful way of characterizing or selecting this parameter. Can the authors comment on how one could tune this value or what does \"large\" mean for a specific problem instance?\n\n2. Is there any information that can be derived from the NTK analysis of the gradient flow that could help design the clipping strategy and value?\n\n3. I am confused about Figure 1, why would different randomized descent trajectories, (furthermore with different noise scales) have the exact same loss values? \n\n_Minor changes_: n and p in Lemma 2.2. Are not defined\n", "broader_impact_concerns": "I don't see any major concerns, the paper is trying to advance the understanding of private algorithms for learning models from sensitive data. ", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ifhfOm96zw", "reviewer": "Reviewer_VPen", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "STRENGTHS.\n\n+ The paper is written in a concise style, with clear statements that are easily identifiable in the abstract.\n\n+ This paper conducts a thorough investigation to improve our comprehension of the impact of DP (Differential Privacy).\n\n\nWEAKNESSES.\n\nMy main concern about this paper is the lack of rigor in certain parts. For instance, I couldn't find any differentiability assumptions on $f$, yet there are results based on its differential. I believe that the paper would benefit greatly if a complete set of assumptions were established\nIn the same vein, some proofs are a bit hasty, such as the proof of Fact 4.1 or (Theorem 1->Statement 4). Please, could the authors provide more details?\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The objective of this paper is to better understand the influence of the DP training parameters. The authors clearly claim that:\n- Gaussian noise has no significant effect on convergence/calibration.\n- Small clipping improves training accuracy but impacts calibration.\n- Large clipping improves calibration.\n\nThese statements are supported by a theoretical analysis utilizing neural tangent kernel matrices, which is further verified through numerical examples.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Clarifications:\n\n* I am uncertain about the comment in Section~5, which states that the noise is of small magnitude in the described setting. Since the updates involve two terms: (1) the gradient near the loss function's optimum, whose norm approaches $0$, versus (2) the Gaussian noise of norm $(\\mathrm{dim}\\times \\eta\\sigma R / n)$, it is not immediately clear to me that the noise has a minor effect on the accuracy -- especially because modern machine learning models may have millions of parameters, this scaling with the dimension can lead to significantly less accurate models.\n\n* In Section~4.5, I am not convinced by the comparison with SGLD using a different factor $\\eta$. As the authors mentioned, the noise is much larger when $\\eta\\to 0$. The dynamics are not the same, and the Stochastic Gradient Langevin Diffusion arises from the Langevin diffusion discretization. The objective of SGLD is to sample parameters $w\\propto \\exp(-L)$ to estimate the predictive distribution and quantify the uncertainty. I am not entirely convinced by the analogy.\n\n* Regarding the proof of Statement~4 (page 16), the connection between the convergence of $L$ and the derivative $L'=0$ would require more explanations. For instance, if (1) $L(t)=log(t)$, or (2) $L'(t)=\\sum_{n=0}^{\\infty}\\varphi(2^n (t-n)) 1_{[n,n+1)}(t)$ with $\\varphi(x)=[2 relu(x) - 4 relu(x-1/2)]_{+}$, then L is continuously differentiable and lim L = 1, but L' does not tends to zero.\n\n\nFormulation:\n\n* Please, could you provide the assumptions on $f$ for better clarity.\n\n* It would be helpful to use a consistent notation for the function $C_i$ throughout the paper. Would it be possible to use a single notation for the function, and define it clearly at the beginning of the paper? (Instead of: $C_i$, $C_i(t)$, $C_i(R)$, $C_i(w)$).\n\n", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers commented that this paper studies an interesting problem for the privacy community and uses different techniques than previous work. However, while they overall liked the paper, they also pointed out that there are currently few practical/actionable takes from the analysis.

In light of the concerns raised by reviewer VPen, I recommend 'accept with minor revision'. Please add the clarifications as per discussion with reviewer VPen to the final version.
Decision: Accept (poster)