Title: (Amplified) Banded Matrix Factorization: A unified approach to private training
Venue: NeurIPS 2023
Accepted: yes
Keywords: Machine Learning

Differential Privacy

Optimization

Private Machine Learning

Federated Learning

Privacy Amplification

Matrix Factorization
Abstract: Matrix factorization (MF) mechanisms for differential privacy (DP) have substantially improved the state-of-the-art in privacy-utility-computation tradeoffs for ML applications in a variety of scenarios, but in both the centralized and federated settings there remain instances where either MF cannot be easily applied, or other algorithms provide better tradeoffs (typically, as $\epsilon$ becomes small).
In this work, we show how MF can subsume prior state-of-the-art algorithms in both federated and centralized training settings, across all privacy budgets. The key technique throughout is the construction of MF mechanisms with banded matrices (lower-triangular matrices with at most $\hat{b}$ nonzero bands including the main diagonal). For cross-device federated learning (FL), this enables multiple-participations with a relaxed device participation schema compatible with practical FL infrastructure (as demonstrated by a production deployment).  In the centralized setting, we prove that banded matrices enjoy the same privacy amplification results as the ubiquitous DP-SGD algorithm, but can provide strictly better performance  in most scenarios---this lets us always at least match DP-SGD, and often outperform it

(Amplified) Banded Matrix Factorization: A unified approach to private training

Abstract

Matrix factorization (MF) mechanisms for differential privacy (DP) have substantially improved the state-of-the-art in privacy-utility-computation tradeoffs for ML applications in a variety of scenarios, but in both the centralized and federated settings there remain instances where either MF cannot be easily applied, or other algorithms provide better tradeoffs (typically, as glyph[epsilon1] becomes small). In this work, we show how MF can subsume prior state-of-the-art algorithms in both federated and centralized training settings, across all privacy budgets. The key technique throughout is the construction of MF mechanisms with banded matrices (lowertriangular matrices with at most ˆ b nonzero bands including the main diagonal). For cross-device federated learning (FL), this enables multiple-participations with a relaxed device participation schema compatible with practical FL infrastructure (as demonstrated by a production deployment). In the centralized setting, we prove that banded matrices enjoy the same privacy amplification results as the ubiquitous DP-SGD algorithm, but can provide strictly better performance in most scenarios-this lets us always at least match DP-SGD, and often outperform it.

1 Introduction

We consider machine learning (ML) with DP in the centralized (datacenter) setting and the crossdevice FL setting, extending and improving matrix factorization (MF) mechanisms 1 to advance the state-of-the-art in both. Given bounded-sensitivity batch gradients x i ∈ R d for i ∈ [ n ] steps, the MF-DP-FTRL algorithm uses a noise generation matrix C -1 ∈ R n × n to return DP gradient estimates ˆ x i = x i + [ C -1 z ] [ i, ∶] where z ∈ R n × d has IID entries N( 0 , σ 2 ) for suitable σ > 0 . The noise correlation induced by C -1 is key to the success of MF-DP-FTRL. Alg. 1 and Sec. 2 provide details and intuition, and Table 1 in App. A summarizes notation and symbols.

1

2

3

4

5

Privacy budget   at

=10

5

50

55

60

65

Test accuracy (%)

Mechanism

DP-SGD, w/ ampl.

Multi-epoch MF, no ampl.

(Band) MF, w/ ampl. (Ours)

(a) Centralized CIFAR-10

1.0

2.0

4.0

8.0

16.0

Privacy budget

at

=10 6

22

23

24

25

Test accuracy (%)

DP-SGD, w/ ampl.

Multi-epoch MF, no ampl.

(Band) MF, w/ ampl. (Ours)

In datacenter applications , precise control of the sampling/shuffling of training data is possible, and so DP-SGD with privacy amplification [1] is one of the most popular ways to train machine learning models with formal privacy guarantees. However, Choquette-Choo et al. [15] recently demonstrated that a multi-epoch extension of the MF-DP-FTRL algorithm can outperform amplified DP-SGD in some settings, depending on the privacy and computational budget (typically larger budgets above glyph[epsilon1] ≈ 2 and a small number of training epochs). This leaves the state-of-the-art for centralized DP training in the unsatisfactory state where one must try both algorithms to be assured of the best performance.

In cross-device federated learning , devices choose when they are available to participate in training, and so precise sampling and shuffling is generally not possible (see Sec. 3 for more details). Motivated by these limitations which make amplified DP-SGD infeasible, Kairouz et al. [35] developed the (treeaggregation-based) DP-FTRL algorithm. Their DP-FTRL does not rely on (or benefit from) privacy amplification and instead adds carefully correlated noise to the gradients to boost utility. Denisov et al. [17] proposed MF-DP-FTRL, replacing the tree-aggregation scheme of Kairouz et al. [35] with a general matrix-factorization mechanism. By optimizing over this space to find mechanisms with optimal error, substantial performance improvements were possible. However, the work of Denisov et al. [17] applies only to the single participation (single epoch) setting. Hence, for cross-device FL the state-of-the-art also requires considering multiple algorithms: tree-aggregation-based DP-FTRL when devices may participate more than one time, or MF-DP-FTRL when devices participate only once. Importantly, the extension of MF-DP-FTRL to multiple epochs of Choquette-Choo et al. [15] only applies in the centralized setting, as it again requires precise control of the participation pattern.

In this work, we address the limitations of MF-DP-FTRL (MF for short) noted above, and show that it can, in fact, achieve across-the-board state-of-the-art performance in both settings across all glyph[epsilon1] . To accomplish this, we define a family of banded MFmechanisms, shown in Fig. 4 (c.f. Fig. 8 of App. D for visualizations of other factorization structures). We summarize our main contributions below.

Contributions for cross-device FL Here, the ( k, b ) -participation schema of Choquette-Choo et al. [15] cannot be enforced. We propose a strict generalization, b -min-sep-participation, which can be practically enforced by FL infrastructure. We show how to efficiently and exactly bound the sensitivity for banded matrices in Thm. 2, allowing formal DP guarantees and the numerical optimization of optimal mechanisms (Sec. 4). These innovations lead to significant privacy-utility benefits in a production deployment (Fig. 6 of Sec. 6). Our work also generalizes the sensitivity calculations of Choquette-Choo et al. [15] to provide a general upper-bound on b -min-sep-participation sensitivity (Thm. 3), which allows the matrices of Choquette-Choo et al. [15] to be used in the FL setting, as well as removing the need to exactly bound b before training (see Sec. 6 and App. K).

Contributions for centralized training The existing privacy amplification analysis of DP-SGD does not allow for the correlated noise that is applied in MF-DP-FTRL. Our paper introduces a novel partitioning of the BANDMF iterates into independent queries. This allows us to prove in Thm. 4 of Sec. 5 that banded matrices enjoy the benefits of privacy amplification, and show that DP-SGD is a special case, giving us the best of both algorithms. This enables us to always pareto-dominate DP-SGD , unlike Choquette-Choo et al. [15] which only does so for large enough glyph[epsilon1] as observed in Fig. 1. Further, this allows us to improve on both baselines, between 1 -4% -points. Informally:

MF

Mechanism

(stateful

across

rounds)

1

clipped

batch

gradient

mechanism

output

2

3

+

…

+

…

+

…

clipped

batch

gradient

mechanism

output

+

+

+

DP-SGD

MF DP-FTRL

batch

batch

…

…

…

https://latex.codecogs.com/eqneditor/editor.php png / Latin Modern / 20pt (Huge) / 300 / Transparent Scaling:  15% for g_i Theorem 1 (Informal version of Theorems 4 and 5) . Suppose we partition the dataset into b equalsize subsets, and in step i each example in the i ( mod b ) -th subset participates with probability Bb m where there are m examples and the batch size is B . Then, a ˆ b -banded n -iteration matrix mechanism with ˆ b ≤ b satisfies the same privacy guarantees as answering n / b queries on a dataset, where each element of the dataset is independently included in each query with probability Bb m .

Scaling: height 0.22 for x+z+C equations \mathbf{x}_1 \mathbf{x}_1 + \mathbf{z}_1 \mathbf{x}_4 + \mathbf{z}_4  {\color{BrickRed}\ +\, \mathbf{C}^{-1}_{4,1}\mathbf{z}_1  + \mathbf{C}^{-1}_{4,2}\mathbf{z}_2 +\mathbf{C}^{-1}_{4,3}\mathbf{z}_3  } As an example of Thm. 1, consider doing n = 2 , 000 iterations of DP-SGD on CIFAR-10, which has m = 50 , 000 examples, using a minibatch of B = 500 examples in each round. This has the same DP guarantees as answering 2 , 000 queries using a subsampled Gaussian mechanism with sampling probability p = 500 / 50 , 000 = 0 . 01 . If we instead use, e.g., BANDMF with ˆ b = b = 10 , our suggested sampling scheme is the following: Partition CIFAR-10 into 10 subsets of 5 , 000 examples each, D 1 , D 2 , . . . D 10 . In rounds 1, 11, 21... we sample 500 examples from D 1 , in rounds 2, 12, 22... we sample 500 examples from D 2 , and so on. We sample from each D i a total of 2000 / 10 = 200 times, and each time our sampling probability is 500 / 5000 = 0 . 1 within the subset. So Theorem 1 shows ˆ b = 10 BANDMF satisfies the same DP guarantees as answering 200 queries with p = 0 . 1 . As a special case of Theorem 1, DP-SGD is simply MF with a suitable diagonal matrix with ˆ b = 1 , and thus Thm. 1 recovers the privacy guarantees of DP-SGD with amplification by sampling. Empirically, we show that MF with amplification has privacy-utility tradeoffs that are no worse than DP-SGD for all glyph[epsilon1] , and often significantly better as can be seen in Fig. 1.

Finally, we explore the computational tradeoffs of our approach. We find that banded matrices with b -min-sep-participation are equally efficient to optimize as those under ( k, b ) -participation but significantly reduce the memory and time complexity of the per-iteration noise generation from O( n ) to a constant O( ˆ b ) (where often total steps n ≫ d ). We will release all code with the final manuscript.

Related work The matrix mechanism (MF mechanism or MF) [40] has a rich history in offline, statistical queries [22, 28, 42, 62], with many applications including to online PCA [21], estimating marginals [22], and top-k selection [17]. Recently, this has been studied under the adaptive streaming setting, where privacy analysis must account for an adversary adaptively defining the inputs at each step [17, 24]. Denisov et al. [17] showed a connection with the DP-FTRL algorithm of Kairouz et al. [35] and with DP ML broadly; they showed that computing optimal MF significantly improves the privacy-utility-computation tradeoffs when making only a single pass (epoch) over the training data. Choquette-Choo et al. [15] showed that MF achieves state-of-the-art results in DP ML by showing how to optimize MF under arbitrary passes over the training data. Henzinger and Upadhyay [29] study the problem of DP-continual observation [13, 20] and the explicit factorization of the workload matrix A that minimizes the completely bounded norm , which is only off from the optimal by an additive constant. The connection between DP empirical risk minimization [3, 4, 5, 7, 8, 9, 14, 16, 23, 25, 32, 36, 39, 45, 52, 53, 54, 57] and DP online regret minimization [2, 4, 5, 26, 33, 35] has been studied for a long time. Asi et al. [5] demonstrated that DP-FTRL style algorithms [15, 17, 35] achieve the best known regret in certain classes of online learning problems (a.k.a. the realizable regime). An important question that still remains open is whether DP-FTRL style algorithms can obtain optimal population risk guarantees under DP [9].

Algorithm 1 MF-DP-FTRL and DP-SGD

2 Matrix Factorization, Sensitivity, and Efficient Implementations

Let x ∈ R n × d be a stream of model gradients, and let A ∈ R n × n be an appropriate linear query workload (prefix-sums, or a matrix encoding of stochastic gradient descent with momentum (SGDM) [17]). Matrix mechanisms use a factorization A = BC to privately estimate the quantity Ax as

where z is suitably calibrated noise to the sensitivity of the so-called 'query matrix' C .

Efficiently implementing MF-DP-FTRL Eq. (1) can be re-arranged as A ( x + C -1 z ) . The multiplication by the linear operator A can now be viewed as post-processing of the noisy mechanism outputs x + C -1 z ; in many cases, this postprocessing has an efficient streaming implementation, e.g., simply passing gradients into a SGDM implementation. Thus, implementing MF-DP-FTRL is essentially equivalent to DP-SGD. The only difference is that the per-iteration gradient x i is protected with noise [ C -1 z ] [ i, ∶] rather than z [ i, ∶] . Indeed, we see DP-SGD is a special case simply by taking C = C -1 = I . Further, as long as the noise C -1 z is computed correctly, the privacy guarantee holds, independent of the choice of A . Alg. 1 gives the complete algorithm; with an appropriate choice of the matrix C -1 , this algorithm captures DP-SGD, tree-aggregation DP-FTRL 2 [35], as well as MF-DP-FTRL [15, 17]. The multiplication of C -1 by Gaussian noise z ∈ R n × d (which need never be fully materialized at once) is the critical step in the efficient implementation of MF. In App. J, we note this multiplication can be completed online for ˆ b -banded matrices (defined formally in Sec. 3) in time and memory O( ˆ bd ) per training iteration compared to O( nd ) for a non-banded matrix.

Multiple participations We adopt the formalisms for multiple-participations of Choquette-Choo et al. [15]. We assume there are m examples (or users in FL) in the database where B examples are selected on each step i ∈ [ n ] . These B chosen examples are said to participate on this step i . The examples at each step are processed via any adaptive function, e.g., computing a gradient of the current model (which depends on the model parameter values) as in Alg. 1. The per-example output vectors g ∈ R d are each bounded to glyph[lscript] 2 norm at most ζ (noting that our notions of sensitivity scale linearly in ζ , without loss of generality (WLOG) we take to be 1 in analysis below). These clipped vectors are then summed to yield x i = ∑ B j = 1 g j . The MF-DP-FTRL mechanism releases the privatized estimates of x i in a streaming fashion. The multi-epoch setting occurs when m < n ⋅ B , so that every example necessarily participates more than once.

Intuition for (anti-)correlated noise in MF-DP-FTRL Fig. 2 compares DP-SGD and MF-DP-FTRL. To gain an intuition for why MF-DP-FTRL can perform better than DP-SGD, observe that vanilla SGD has iterates θ t = θ 0 -η ∑ t i = 1 ˆ x i , and hence when the noisy gradients ˆ x i are added, the C -1 [ i,j ] z [ i, ∶] terms in MF-DP-FTRL serve to cancel out some of the noise introduced on previous rounds. This reduces the total error in the final model (i.e., the prefix sums). However, this worsens the sensitivity of the mechanism to > 1 (as it is for DP-SGD). This is because an adversary trying to learn x 1 via ˆ x 1 can partially learn the value of z 1 from ˆ x 2 , whereas in DP-SGD ˆ x 1 and ˆ x 2 are uncorrelated. This tradeoff is what MF-DP-FTRL aims to minimize. More details on this intuition are in App. A.1.

Adjacency and participation schemas DP requires a notion of adjacent datasets. Two data streams x and ˜ x are adjacent if the data associated with any single example is altered, but not when this example participated. Thus, any x i where example d j participated can be changed subject to the constraint ∥ g ( i ) j ∥ ≤ ζ . However, the participation pattern does not change. A participation schema Π gives the set of possible participation patterns π ∈ Π , with each π ⊆ [ n ] indicating a set of steps in which a single example might participate. Let N be the set of all pairs of neighboring streams x and D ∶= { x -˜ x ∣ ( x , ˜ x ) ∈ N } represent the set of all possible deltas between neighboring x , ˜ x . We say a D satisfies the participation schema Π if the indices of all nonzero rows in each R n × d matrix u ∈ D are a subset of some π ∈ Π . To illustrate this, single-participation is represented as Π = {{ 1 } , { 2 } , . . . { n }} ) and full-batch gradient descent (every-step) as Π = {[ n ]} ). Choquette-Choo et al. [15] studied fixed-epoch-order participation , denoted ( k, b ) -participation , where each example participates at most k times, with any adjacent participations exactly b steps apart: formally, Π is the set of all π such that ∣ π ∣ ≤ k , and if π = { i 1 , . . . , i k } indexed in increasing order, we have ∀ j ∈ { 2 , . . . , k } , i j -i j -1 = b . For example ( k = 2 , b = 3 ) -participation has Π = {{ 1 , 4 } , { 2 , 5 } , { 3 , 6 }} . As discussed in Choquette-Choo et al. [15], this setting faithfully captures centralized multi-epoch ML training setups with single and every-step as special cases. We can now define the sensitivity of the matrix factorization mechanism as

Optimizing factorizations Different factorizations A = BC can have very different performance in practice. Thus, in MF applications it is common to optimize over the space of factorizations, where the objective function is the expected total squared error on A , given as L( B , C ) = sens 2 Π ( C ) ∥ B ∥ 2 F . We define the expected root-mean-squared error (RMSE) as σ √ L( B , C )/ n , where σ is the standard deviation of the Gaussian noise. We take σ = 1 when simply comparing mechanisms, or (in Sec. 6), calibrate σ to achieve specific ( glyph[epsilon1], δ ) -DP guarantees.

To facilitate optimization, utilizing the fact that the optimal-for-squared-error decoder B is AC † [17], we note L( B , C ) = L( AC † , C ) . The expected total squared error is invariant to scaling C by a constant, and hence it is sufficient to optimize under a sensitivity 1 constraint. Further expressing the sensitivity and error in terms of X = C ⊺ C (note X is unrelated to the data x ), we have

assuming sens Π ( C ) = 1 and A is in the rowspace of C . Thus, we arrive at:

Problem 1. The matrix factorization optimization problem is to solve the convex optimization

and then find C so that C ⊺ C = X , e.g., via Cholesky decomposition.

3 A Participation Schema for FL and the Sensitivity of Banded Matrices

In cross-device FL, devices locally evaluate eligibility criteria to deterimine when they might participate in training [10, 34], for example only checking-in to the coordinating server when they are plugged in, on unmetered wifi, and idle. This makes it practically difficult to enforce the ( k, b ) -participation of Choquette-Choo et al. [15], where devices are assumed to participate at the same relative position in each epoch: devices are unlikely to meet the eligibility criteria during the narrow windows of both step i and i + b . Further, precise sampling cannot provide the same level of privacy amplification as in the centralized setting. Consider if 6500 devices are needed to complete a round [59]. An extreme (but realistic depending on time of day) setting may have only 6500 devices meeting eligibility criteria. Thus, either the protocol proceed without any sampling/amplification or wait until more devices are available; neither are desirable. We avoid amplification in the crossdevice setting and instead proceed by addressing the question: Can MF-DP-FTRL be extended to the cross-device federated learning setting with multiple client participations?

With ( k, b ) -participation difficult to enforce in practice, our first challenge is to define a new participation schema with several properties: (a) the sensitivity of any matrix mechanism under this query can be bounded; (b) this bound is tight over an expressive class of matrices; (c) this bound

can be efficiently represented as a constraint in a mathematical program so as to be able to find a near-optimal factorization A = BC . In Defn. 1, we propose b -min-sep-participation, a generalization of ( k, b ) -participation which can be practically enforced by cross-device FL systems, thus enabling us to leverage BANDMF in this setting (see Sec. 6). 3 In b -min-sep-participation, the distance between any two participations is at least b , rather than exactly b as in ( k, b ) -participation:

Definition 1. The b -min-sep-participation schema is given by

Observe this participation schema is easy for devices to enforce: each device remembers the last step i in which it participated, and when it again becomes eligible, it checks in to the server, and participates in training as long as the current step is at least i + b ; it does not need to check in during a narrow (and unknown to the device) time window for a specific step.

We now turn to computing sensitivity under b -min-sep-participation. For ( k, b ) -participation, ∣ Π ( k,b ) ∣ = b , a fact Choquette-Choo et al. [15, Eq. 3] critically exploited when computing sensitivity via brute force computation of a maximum over the elements in Π . With b -min-sep-participation, we have ∣ Π b ∣ = O( exp ( n )) , and hence any brute force approach which requires checking some value for all π ∈ Π b will be impractical. Following the formalism of [15, Section 2], a participation schema Π (plus a specification of model dimension d ) yields an expression for the sensitivity of the function x ↦ Cx assuming that the contributions of any given user to the data structure x are restricted to the rows in x indexed by some π ∈ Π . By Prop. E.1 of App. E.2, independent of model dimension d , we show sensitivity for any schema Π may be bounded by

Eq. (5) highlights several subtleties in computing sensitivity. First, is the challenge presented by the exponentially large number of patterns in Π b . Second is the question of tightness of the inequality in Eq. (5): how much are we losing by effectively ignoring any cancellation in the matrix X ?

Banded matrices Fortunately, banded matrices render Eq. (5) both exactly computable and tight (independent of dimension d ), showing that Π b satisfies the requirements of (b) and (c) above. We say a (general) matrix X is ˆ b -banded if for all i, j ∈ [ n ] , ∣ i -j ∣ ≥ ˆ b implies X [ i,j ] = 0 . While this is off-by-one from the bandwidth ( X has bandwidth b -1 ), our definition will be useful as it will be natural to match ˆ b -banded matrices with b -min-separation. Further, for ˆ b -banded lower-triangular matrices (which will play a central role), ˆ b intuitively gives the number of bands in the matrix.

For non-banded matrices, the right-hand side of Eq. (5) remains efficiently computable (but not easily expressible in a mathematical program), enabling us to provide nontrivial privacy guarantees for matrices which are not b banded under b -min-sep, showing that Π b satisfies (a) as well. The key subroutine is Alg. 3, which gives an efficient dynamic program for solving linear optimization over Π b . Define u ( π ) ∈ { 0 , 1 } n by u ( π ) i = 1 if i ∈ π and 0 otherwise. Then, Alg. 3 solves

This is the key subroutine in Alg. 4 and Alg. 5. Proofs for Thm. 2 and Thm. 3 are deferred to App. E.2.

Theorem 2. Let C ∈ R n × n be a lower-triangular matrix, and Π b the b -min-sep-participation schema. Further, suppose k ′ upper-bounds the actual maximum number of participations that occurred in a data stream x (at worst, we may take k ′ ≤ ⌈ n b ⌉ ): Then: (1) If κ is an upper-bound on the column norms of C , that is ∀ j ∈ [ n ] , ∥ C [∶ ,j ] ∥ ≤ κ , and C is b -banded, then the sensitivity is bounded by κ √ k ′ . (2) If C is b -banded, Alg. 5 invoked with Gram matrix X = C ⊺ C and b, k ′ as in the setup, exactly computes sens ( C ) under schema Π b in polynomial time for any dimension d .

Theorem 3. For an arbitrary (non-banded) C , let X = C ⊺ C and b, k ′ as in Thm. 2. Then Alg. 4 of App. E upper-bounds sens ( C ) under schema Π b in polynomial time for any dimension d .

4 Optimizing Banded Matrices

To enjoy the benefits of banded matrices within the framework of MF-DP-FTRL, we need to design an algorithm that can efficiently optimize over the space of ˆ b -banded C matrices. To solve this problem, we will work in the domain of X = C ⊺ C , and utilize the following fact:

Proposition 4.1. Let X ∈ R n × n be a ˆ b -banded symmetric positive definite matrix. Then there exists a lower triangular ˆ b -banded matrix C ∈ R n × n such that X = C ⊺ C .

Utilizing Prop. 4.1, we can modify Problem 1 by introducing the constraint X [ i,j ] = 0 if ∣ i -j ∣ ≥ ˆ b . This additional linear constraint preserves convexity of the optimization problem, and makes the sensitivity calculation tractable as well. However, it is still not immediately obvious how to solve the optimization problem, since we need to run the dynamic program defined in Alg. 5 of App. E to compute sensitivity. For this reason, we impose the additional constraint that diag ( X ) = 1 . This constraint, together with bandedness, ensures that the squared sensitivity is equal to k for all X by Thm. 2. The final optimization problem we seek to solve is stated below:

Problem 2. The matrix factorization optimization problem for banded matrices is to solve

and then find C so that C ⊺ C = X via Prop. 4.1.

We would like to remark on the similarity between Problem 2 and the single-participation version of Problem 1. The two problems are identical modulo the bandedness constraint, which is an equality constraint on individual entries of X . Therefore, existing primal-optimization based solvers [43] for the single-participation matrix mechanism can be extended to optimize over this new space of matrices with little modification. Specifically, the only modification necessary is to initialize to an appropriately banded feasible X matrix, like X = I , and to post-process the gradient w.r.t X by setting ∂L ∂ X [ i,j ] = 0 if ∣ i -j ∣ ≥ ˆ b in each step. Since the equality constraints exactly specify individual entries of X , Problem 2 can be solved as an unconstrained optimization problem (over the remaining entries in X ), using any number of off-the-shelf unconstrained optimization algorithms. 4 As recommended by McKenna et al. [43], we use the LBFGS algorithm [12] to solve this problem.

Remarks on the diag ( X ) = 1 constraint The constraint on diag ( X ) serves multiple purposes. First, diag ( X ) = 1 implies that ∥ C [∶ ,i ] ∥ 2 = 1 for all i , i.e., that C has equal column norms. This ensures that BANDMF reduces to DP-SGD when ˆ b = 1 , which is desirable. Second diag ( X ) = 1 simplifies the optimization problem greatly, as the sensitivity computation for both ( k, b ) -participation and b -min-sep are trivial and tight under this constraint (Thm. 2 Claim (1)). Third, imposing this constraint does not drastically change the search landscape, or cost much in terms of RMSE; see Table 2 for a comparison of matrices with and without this constraint, and Fig. 8 for a visualization. Fourth, this constraint allows us to solve a single optimization problem that is simultaneously tailored for ( k, b ) -participation and b -min-sep-participation. In Appendices B and C, we formulate an optimization problem without the diag ( X ) = 1 constraint, discuss how we solve it, and compare matrices generated with and without this constraint empirically.

5 Amplification for Banded Matrix Mechanisms

In the centralized setting where we can control the participation patterns of individual examples, the privacy guarantees of BANDMF can be amplified. We focus on amplification by sampling with fixed batch size in this section, but give a more general statement in App. F.

Existing privacy analysis of MF-DP-FTRL is based on the reduction to the batch release of the entire Cx + z as a single Gaussian mechanism event [15, 17] so standard amplification techniques don't directly apply. Instead, for each participation by an example, we consider the set of rows in Cx affected by this participation as a Gaussian mechanism (see the groups of rows in Fig. 4). Then as

Algorithm 2 Sampling scheme

C

Cx

IndependentofD

Queryonexamples

instepj

b+j

Queryonexamples

in stepb+j

2b+j

Queryonexamples

in step 2b+j

3b+j

Queryonexamples

instep3b+j

i

2b+j

3b+j

b+j

long as the sets of rows corresponding to different participations do not interact, which is ensured by the bandedness of C , we can apply amplification to them separately.

Observe from Fig. 4 that the structure of BANDMF guarantees that the set of rows of Cx which depend on each of x j , x ˆ b + j , x 2 ˆ b + j , . . . are disjoint sets. Thus, we use the following sampling scheme for determining which examples participate in each step which is made formal as Alg. 2. Let D 1 , D 2 , . . . , D ˆ b be an arbitrary partition of D into ˆ b indexed subsets of size ˇ m ∶= ⌊ m / ˆ b ⌋ (for simplicity, we discard extra examples so all D j have size exactly ˇ m ). In steps j, ˆ b + j, 2 ˆ b + j, . . . , we will only use examples in D j . Hence, participation follows ( k, b ) -participation for b = ˆ b ; 5 because it is optimal for ( k, b ) -participation to have the number of bands ˆ b equal the min-seperation b , in the remainder of this section and the associated appendices we simply write b instead of ˆ b . Within each of these steps, we sample a size B subset of D j uniformly at random to use in computing x .

Roughly speaking, Thm. 4 below shows that if we use Alg. 2, BANDMF satisfies any standard privacy guarantees satisfied by DP-SGD run for k rounds, where in each round we sample B examples from a dataset of size ˇ m . In other words, it is equivalent to running DP-SGD for 1 / b times as many rounds, but with the sampling probability multiplied by b .

Theorem 4. Suppose C is b -banded and lower triangular, and the examples participating in each step are chosen according to Alg. 2. Then BANDMF satisfies any standard DP guarantee 6 satisfied by performing k sensitivityκ queries on a dataset of size ˇ m using the Gaussian mechanism, where each query is run on a random subset of examples of size B . κ is the maximum column norm of C .

The key idea behind Thm. 4 is the following: assume we have two datasets D,D ′ that differ in an example in D 1 (WLOG), i.e., the differing example can only participate in steps 1 , b + 1 , . . . , ( k -1 ) b + 1 . Then by the banded structure of C and the standard technique of reducing adaptive queries to nonadaptive queries (see e.g. Claim D.1 in [17]), the first b rows of Cx (i.e., all the rows where examples in step 1 influence the output) can be viewed as a query on the examples in D 1 that were included in step 1, the next b rows can be viewed as an adaptively chosen query on the examples included in steps b + 1 , and so on. See Fig. 4 for a visualization.

Generalization to other privacy amplification techniques Thm. 5 in App. F.3 provides a strong a generalization of Thm. 4. It shows that shuffling, another common amplification technique often used for DP-SGD, can also be applied to our BANDMF. We also provide an explicit algorithm for accounting for amplification via sampling in terms of the dp_accounting library [18], along with examples of concrete privacy parameters derived from these corollaries.

Optimizing the number of bands Thm. 4 shows that different numbers of bands (with a corresponding sampling scheme) give different privacy amplification guarantees. This implies given a particular privacy (or RMSE) target, one should optimize the number of bands to get the best RMSE (or privacy) possible. This can be done efficiently. Generally, for large values of glyph[epsilon1] larger numbers of bands perform better, and as glyph[epsilon1] → 0 , eventually amplification dominates so ˆ b = 1 becomes optimal. Details are in App. F.4.

1

2

4

8

16

32

64

128

256

512

1024

Epochs

0.03

0.06

0.12

0.25

0.5

1.0

2.0

4.0

8.0

16.0

Privacy Budget

at

=10 6

RMSE Ratio,

n

=1024

0.1

1

10

Multi-epoch MF Better

DP-SGD Better

no ampl.                      w/ ampl.

1

2

4

8

16

32

64

128

256

512

1024

Epochs

0.03

0.06

0.12

0.25

0.5

1.0

2.0

4.0

8.0

16.0

Privacy Budget

at

=10 6

RMSE Ratio,

n

=1024

0.1

1

10

Band MF Better

DP-SGD Better

w/ ampl.                  w/ ampl.

10 0

10 1

10 2

10 3

Epochs

4

6

8

10

12

14

16

RMSE

DP-SGD, w/ ampl.

Multi-epoch MF, no ampl.

(Band) MF, w/ ampl. (Ours)

(a) DP-SGD vs. MULTI-EPOCH MF

(b) DP-SGD vs Ampl. BANDMF

(c) RMSE vs Epochs at glyph[epsilon1]

=

1

6 Experiments

Our experiments on example-level DP for image classification (of CIFAR10) and user-level DP for next word prediction (NWP) (of Stack Overflow NWP) focus on comparing our BANDMF with the existing state-of-the-art MULTI-EPOCH MF [15] and DP-SGD [1]. We finish by showing that BANDMF improves over state-of-the-art [35] for a production mobile keyboard next word prediction model. In all cases, noise σ is calibrated using privacy loss distributions [38] to achieve the stated privacy guarantees for zero-out adjacency [35, 48], as implemented in [18]. Following the common convention, amplified results are based on privacy accounting for Poisson sampling, though shuffling was used in non-production training. We find BANDMF can outperform both mechanisms across a wide range of privacy budgets to as low as glyph[epsilon1] ≈ 0 . 5 . Past this, it is no worse than either.

RMSE We begin by comparing DP-SGD with MULTI-EPOCH MF and BANDMF in terms of their RMSE (Sec. 2) on the prefix workload. This is one measure for how much noise these mechanisms add during training, and is a reasonable proxy for learning performance.Observe in Fig. 5(a) that there are regimes where DP-SGD outperforms MULTI-EPOCH MF and vice versa in terms of RMSE. When then number of epochs equals n , DP-SGD reduces to full gradient descent (GD) (and there is no amplification benefit), and the optimal MF mechanism is close to the identity matrix (that is, GD), and so the algorithms become almost identical (MF has a very small advantage, as the identity matrix is not quite optimal for RMSE). However, as shown in Fig. 5(b), we see that BANDMF is always at least as good as DP-SGD in terms of RMSE. The improvement is most potent in the lower number of epochs and higher glyph[epsilon1] regime, which is standard for large model training. In Fig. 5(c), we see that for fixed n as the number of epochs increases, all mechanisms enjoy improved RMSE, and BANDMF in fact reduces to DP-SGD in that regime (though BANDMF may be outperformed in RMSE by MULTI-EPOCH MF due to our imposed optimization constraint of constant diagonals in X ).

Centralized training with amplification Our full experimental setup is described in App. H, and closely follows prior work [15]. We train for 20 epochs on CIFAR-10, and tune all mechanisms to achieve their best performance for each glyph[epsilon1] , using 12 repeated runs. Fig. 1(a) shows that BANDMF with amplification and an optimized number of bands ˆ b can obtain utility benefits over both prior mechanisms. We find that for glyph[epsilon1] ∈ [ 2 , 5 ] , BANDMF achieves a consistent ≈ 1 percentage point boost in performance over MULTI-EPOCH MF. Below glyph[epsilon1] ≈ 2 , where DP-SGD previously dominated, we find that BANDMF obtains a benefit around 3 percentage points. These two findings show that BANDMF is able to balance and leverage the benefits of both amplification and correlated noise effectively. As the budget glyph[epsilon1] gets smaller, we find that BANDMF is equivalent to DP-SGD.

We next consider the now-standard StackOverflow next-word-prediction (NWP) task with user-level differential privacy, again following [15] (full details in App. I), in particular 2052 steps and 6 epochs, with B = 1000 . The previous state-of-the-art for centralized training at glyph[epsilon1] ≥ 2 corresponds to their MULTI-EPOCH MF. 7 We again tune ˆ b under amplification for optimal RMSE, selecting ˆ b = 9 , 18 , 32 , 64 for glyph[epsilon1] = 1 , 2 , 4 , 8 respectively. At glyph[epsilon1] = 16 we find MULTI-EPOCH MF is optimal. Fig. 1(b) shows substantial improvements for combining amplification with MF for glyph[epsilon1] ∈ [ 1 , 8 ] ; Table 5 of App. I gives the hyperparameters and accuracy values for this figure.

1.0

2.0

4.0

8.0

16.0

Privacy budget

at

=10 6

16

18

20

22

24

26

Test accuracy (%)

DP-SGD

Single-epoch MF

Optimal TreeAgg

Multi-epoch MF

Band MF (Ours)

(a) Simulated cross-device FL, SO NWP

0

500

1000

1500

2000

FL Training Round

14.8

15.0

15.2

15.4

15.6

15.8

16.0

16.2

Online TreeAgg

Band MF (Ours)

Cross-device federated learning We consider SO NWP again, but now assuming each user's data corresponds to the data on one device. We assume 2052 rounds and 6 epochs as above. Amplification is generally not possible in the cross-device setting, and so the prior state-of-the-art was (1) SINGLEEPOCH MF of Denisov et al. [17] for single-epoch training (using B = 167 rather than B = 1000 ), and (2) OPTIMAL TREEAGG, which essentially takes the binary-tree matrix C T , and instead of using the less-efficient 'online' estimator of Honaker [30], uses the pseudo-inverse C † T for noise generation (see Sec. 2). The b -min-sep-participation sensitivity of C T can still be calculated using the dynamic program of Kairouz et al. [35], while the use of C † T requires the machinery of Denisov et al. [17]; see e.g. the OPTDECODERHONAKER results of Choquette-Choo et al. [15, Fig. 6]. Our Thm. 3 further enables an upper-bound on the b -min-sep-participation sensitivity of the MULTI-EPOCH MF matrices of Choquette-Choo et al. [15]; this incurs a penalty of about 15% (see Table 2 in App. C) compared to ( k, b ) -sensitivity. Fig. 6(a) shows that our BANDMF and MULTI-EPOCH MF again outperform prior baselines (though the previously untested multi-epoch OPTIMAL TREEAGG performs quite well); Table 4 gives the hyperparameters and accuracy values for this figure.

Application in production cross-device FL We fine-tune a Spanish next word prediction model, pretrained on the multilingual C4 dataset [49, 60], with on-device user data using FL. Our setup follows [59], and is described in full in App. K. We compared to an existing implementation of the ONLINE TREEAGG algorithm of Kairouz et al. [35] (not the optimal version using C † T in simulation). Both algorithms ran for n = 2000 training rounds. The BANDMF matrix was optimized for ˆ b = 400 bands; however, the production system only allows approximate control of the separation between participations, and post-hoc we could only bound b by 390 rounds for ONLINE TREEAGG and 385 for BANDMF, necessitating the use of Thm. 3 for the analysis of BANDMF as b < ˆ b .

We used the same clients/round goal of 6500 for both, and tuned noise multipliers to achieve comparable RMSE , hence tuning for a stronger privacy guarantee rather than improved accuracy. Fig. 6(b) shows our results, and we see BANDMF actually achieves a slight improvement in accuracy, possibly due to learning-rate cooldown (which was only implemented for BANDMF). Our primary result is then that we are able to improve the privacy guarantee from ρ = 0 . 52 -zCDP for ONLINE TREEAGG to ρ = 0 . 24 -zCDP for BANDMF, or ( glyph[epsilon1] = 6 . 69 , δ = 10 -10 ) -DP to ( glyph[epsilon1] = 4 . 35 , δ = 10 -10 ) -DP. Details of the privacy guarantee following the best practices of Ponomareva et al. [48] are in App. K.1.

7 Discussion and Limitations

In this paper, we proposed the BANDMF mechanism, which extends MF-DP-FTRL and enjoys the benefits of privacy amplification. This allows it to solely operate above the previous Pareto frontier defined by both amplified DP-SGD and MF-DP-FTRL in centralized training scenarios. Moreover, BANDMF is well-suited to federated training scenarios, and improves state-of-the-art there as well. Additionally, the computational overhead of BANDMF is less than MF-DP-FTRL by a factor of b / n . It still has a b × time and space overhead compared to DP-SGD, which can be prohibitive for very large models with billions of parameters. This is an interesting and important future research direction.

References

Martín Abadi, Andy Chu, Ian J. Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proc. of the 2016 ACM SIGSAC Conf. on Computer and Communications Security (CCS'16) , pages 308-318, 2016.

Naman Agarwal and Karan Singh. The price of differential privacy for online learning. In International Conference on Machine Learning , pages 32-40. PMLR, 2017.

Hilal Asi, Daniel Asher Nathan Levy, and John Duchi. Adapting to function difficulty and growth conditions in private optimization. In Advances in Neural Information Processing Systems , 2021.

Hilal Asi, Vitaly Feldman, Tomer Koren, and Kunal Talwar. Private online prediction from experts: Separations and faster rates. arXiv preprint arXiv:2210.13537 , 2022.

Hilal Asi, Vitaly Feldman, Tomer Koren, and Kunal Talwar. Near-optimal algorithms for private online optimization in the realizable regime. arXiv preprint arXiv:2302.14154 , 2023.

Borja Balle, Peter Kairouz, H Brendan McMahan, Om Thakkar, and Abhradeep Thakurta. Privacy amplification via random check-ins. In NeurIPS , 2020.

Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In Proc. of the 2014 IEEE 55th Annual Symp. on Foundations of Computer Science (FOCS) , pages 464-473, 2014.

Raef Bassily, Vitaly Feldman, Kunal Talwar, and Abhradeep Thakurta. Private stochastic convex optimization with optimal rates. In Advances in Neural Information Processing Systems , pages 11279-11288, 2019.

Raef Bassily, Vitaly Feldman, Cristóbal Guzmán, and Kunal Talwar. Stability of stochastic gradient descent on nonsmooth convex losses. arXiv preprint arXiv:2006.06914 , 2020.

Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Konecny, Stefano Mazzocchi, H Brendan McMahan, et al. Towards federated learning at scale: System design. arXiv preprint arXiv:1902.01046 , 2019.

Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography Conference , pages 635-658. Springer, 2016.

Richard H Byrd, Peihuang Lu, Jorge Nocedal, and Ciyou Zhu. A limited memory algorithm for bound constrained optimization. SIAM Journal on scientific computing , 16(5):1190-1208, 1995.

T.-H. Hubert Chan, Elaine Shi, and Dawn Song. Private and continual release of statistics. ACM Trans. on Information Systems Security , 14(3):26:1-26:24, November 2011.

Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research , 12(Mar):1069-1109, 2011.

Christopher A Choquette-Choo, H Brendan McMahan, Keith Rush, and Abhradeep Thakurta. Multi-epoch matrix factorization mechanisms for private machine learning. arXiv preprint arXiv:2211.06530 , 2023.

Rishav Chourasia, Jiayuan Ye, and Reza Shokri. Differential privacy dynamics of langevin diffusion and noisy gradient descent. In Advances in Neural Information Processing Systems , 2021.

Sergey Denisov, Brendan McMahan, Keith Rush, Adam Smith, and Abhradeep Guha Thakurta. Improved differential privacy for sgd via optimal private linear operators on adaptive streams, 2022. URL https://arxiv.org/abs/2202.08312 .

DP Team. Google's differential privacy libraries., 2022. https://github.com/google/ differential-privacy .

Jeremy Du Croz, Peter Mayes, and Giuseppe Radicati. Factorizations of band matrices using level 3 blas. In CONPAR 90-VAPP IV: Joint International Conference on Vector and Parallel Processing Zurich, Switzerland, September 10-13, 1990 Proceedings , pages 222-231. Springer, 2005.

Cynthia Dwork, Moni Naor, Toniann Pitassi, and Guy N. Rothblum. Differential privacy under continual observation. In Proc. of the Forty-Second ACM Symp. on Theory of Computing (STOC'10) , pages 715-724, 2010.

Cynthia Dwork, Kunal Talwar, Abhradeep Thakurta, and Li Zhang. Analyze gauss: optimal bounds for privacy-preserving principal component analysis. In Proceedings of the forty-sixth annual ACM symposium on Theory of computing , pages 11-20, 2014.

Alexander Edmonds, Aleksandar Nikolov, and Jonathan Ullman. The Power of Factorization Mechanisms in Local and Central Differential Privacy , page 425-438. Association for Computing Machinery, New York, NY, USA, 2020. ISBN 9781450369794. URL https://doi.org/10.1145/3357713.3384297 .

Vitaly Feldman, Tomer Koren, and Kunal Talwar. Private stochastic convex optimization: Optimal rates in linear time. In Proc. of the Fifty-Second ACM Symp. on Theory of Computing (STOC'20) , 2020.

Hendrik Fichtenberger, Monika Henzinger, and Jalaj Upadhyay. Constant matters: Fine-grained complexity of differentially private continual observation, 2022. URL https://arxiv. org/abs/2202.11205 .

Sivakanth Gopi, Yin Tat Lee, and Daogao Liu. Private convex optimization via exponential mechanism. arXiv preprint arXiv:2203.00263 , 2022.

Abhradeep Guha Thakurta and Adam Smith. (nearly) optimal algorithms for private online learning in full-information and bandit settings. Advances in Neural Information Processing Systems , 26, 2013.

Andrew Hard, Kanishka Rao, Rajiv Mathews, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. CoRR , abs/1811.03604, 2018. URL http://arxiv.org/abs/1811.03604 .

Moritz Hardt and Kunal Talwar. On the geometry of differential privacy. In STOC , 2010.

Monika Henzinger and Jalaj Upadhyay. Constant matters: Fine-grained complexity of differentially private continual observation using completely bounded norms. arXiv preprint arXiv:2202.11205 , 2022.

James Honaker. Efficient use of differentially private binary trees. Theory and Practice of Differential Privacy (TPDP 2015), London, UK , 2:26-27, 2015.

Dzmitry Huba, John Nguyen, Kshitiz Malik, Ruiyu Zhu, Mike Rabbat, Ashkan Yousefpour, Carole-Jean Wu, Hongyuan Zhan, Pavel Ustinov, Harish Srinivas, et al. Papaya: Practical, private, and scalable federated learning. Proceedings of Machine Learning and Systems , 4: 814-832, 2022.

Roger Iyengar, Joseph P Near, Dawn Song, Om Thakkar, Abhradeep Thakurta, and Lun Wang. Towards practical differentially private convex optimization. In 2019 IEEE Symposium on Security and Privacy (SP) , 2019.

Prateek Jain, Pravesh Kothari, and Abhradeep Thakurta. Differentially private online learning. In Proc. of the 25th Annual Conf. on Learning Theory (COLT) , volume 23, pages 24.1-24.34, June 2012.

Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Keith Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G. L. D'Oliveira, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett, Adrià Gascón, Badih Ghazi, Phillip B. Gibbons, Marco Gruteser, Zaïd Harchaoui, Chaoyang He, Lie He, Zhouyuan Huo, Ben Hutchinson, Justin Hsu, Martin Jaggi, Tara Javidi, Gauri Joshi, Mikhail Khodak, Jakub Konecný, Aleksandra Korolova, Farinaz Koushanfar, Sanmi Koyejo, Tancrède Lepoint, Yang Liu, Prateek Mittal, Mehryar Mohri, Richard Nock, Ayfer Özgür, Rasmus Pagh, Mariana Raykova, Hang Qi, Daniel Ramage, Ramesh Raskar, Dawn Song, Weikang Song, Sebastian U. Stich, Ziteng Sun, Ananda Theertha Suresh, Florian Tramèr, Praneeth Vepakomma, Jianyu Wang, Li Xiong, Zheng Xu, Qiang Yang, Felix X. Yu, Han Yu,

and Sen Zhao. Advances and open problems in federated learning. CoRR , abs/1912.04977, 2019. URL http://arxiv.org/abs/1912.04977 .

Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shuffling. In ICML , 2021.

Daniel Kifer, Adam Smith, and Abhradeep Thakurta. Private convex empirical risk minimization and high-dimensional regression. In Conference on Learning Theory , pages 25-1, 2012.

Yehuda Koren, Robert Bell, and Chris Volinsky. Matrix factorization techniques for recommender systems. Computer , 42(8):30-37, aug 2009. ISSN 0018-9162. doi: 10.1109/MC.2009. 263. URL https://doi.org/10.1109/MC.2009.263 .

Antti Koskela, Joonas Jälkö, Lukas Prediger, and Antti Honkela. Tight approximate differential privacy for discrete-valued mechanisms using fft, 2020.

Janardhan Kulkarni, Yin Tat Lee, and Daogao Liu. Private non-smooth erm and sco in subquadratic steps. Advances in Neural Information Processing Systems , 34, 2021.

Chao Li, Gerome Miklau, Michael Hay, Andrew Mcgregor, and Vibhor Rastogi. The matrix mechanism: optimizing linear counting queries under differential privacy. The VLDB Journal , 24:757-781, 2015.

Zitao Li, Bolin Ding, Ce Zhang, Ninghui Li, and Jingren Zhou. Federated matrix factorization with privacy guarantee. Proc. VLDB Endow. , 15(4):900-913, dec 2021. ISSN 21508097. doi: 10.14778/3503585.3503598. URL https://doi.org/10.14778/3503585. 3503598 .

Ryan McKenna, Gerome Miklau, Michael Hay, and Ashwin Machanavajjhala. Optimizing error of high-dimensional statistical queries under differential privacy. Proc. VLDB Endow. , 11(10):1206-1219, jun 2018. ISSN 2150-8097. doi: 10.14778/3231751.3231769. URL https://doi.org/10.14778/3231751.3231769 .

Ryan McKenna, Gerome Miklau, Michael Hay, and Ashwin Machanavajjhala. Hdmm: Optimizing error of high-dimensional statistical queries under differential privacy. arXiv preprint arXiv:2106.12118 , 2021.

H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private language models without losing accuracy. CoRR , abs/1710.06963, 2017. URL http: //arxiv.org/abs/1710.06963 .

H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. arXiv preprint arXiv:1710.06963 , 2017.

Ilya Mironov, Kunal Talwar, and Li Zhang. Rényi differential privacy of the sampled gaussian mechanism. CoRR , abs/1908.10530, 2019. URL http://arxiv.org/abs/1908. 10530 .

Matthias Paulik, Matt Seigel, Henry Mason, Dominic Telaar, Joris Kluivers, Rogier van Dalen, Chi Wai Lau, Luke Carlson, Filip Granqvist, Chris Vandevelde, et al. Federated evaluation and tuning for on-device personalization: System design & applications. arXiv preprint arXiv:2102.08503 , 2021.

Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H. Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy, 2023.

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of Machine Learning Research , 21(140):1-67, 2020. URL http://jmlr.org/papers/v21/20-074.html .

Sashank J. Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Koneˇ cný, Sanjiv Kumar, and H. Brendan McMahan. Adaptive federated optimization. CoRR , abs/2003.00295, 2020. URL https://arxiv.org/abs/2003.00295 .

Hyejin Shin, Sungwook Kim, Junbum Shin, and Xiaokui Xiao. Privacy enhanced matrix factorization for recommendation with local differential privacy. IEEE Transactions on Knowledge and Data Engineering , 30(9):1770-1782, 2018. doi: 10.1109/TKDE.2018.2805356.

Adam Smith, Abhradeep Thakurta, and Jalaj Upadhyay. Is interaction necessary for distributed private learning? In 2017 IEEE Symposium on Security and Privacy (SP) , pages 58-77. IEEE, 2017.

Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing , pages 245-248. IEEE, 2013.

Shuang Song, Om Thakkar, and Abhradeep Thakurta. Characterizing private clipped gradient descent on convex generalized linear problems. arXiv preprint arXiv:2006.06783 , 2020.

Thomas Steinke. Composition of differential privacy & privacy amplification by subsampling, 2022.

Maxime Vono, Nicolas Dobigeon, and Pierre Chainais. High-dimensional gaussian sampling: a review and a unifying approach based on a stochastic proximal point algorithm, 2021.

Xi Wu, Fengan Li, Arun Kumar, Kamalika Chaudhuri, Somesh Jha, and Jeffrey F. Naughton. Bolt-on differential privacy for scalable stochastic gradient descent-based analytics. In Semih Salihoglu, Wenchao Zhou, Rada Chirkova, Jun Yang, and Dan Suciu, editors, Proceedings of the 2017 ACM International Conference on Management of Data, SIGMOD , 2017.

Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher Choquette, Peter Kairouz, Brendan McMahan, Jesse Rosenstock, and Yuanbo Zhang. Federated learning of gboard language models with differential privacy, 2023.

Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher A Choquette-Choo, Peter Kairouz, H Brendan McMahan, Jesse Rosenstock, and Yuanbo Zhang. Federated learning of gboard language models with differential privacy. arXiv preprint arXiv:2305.18465 , 2023.

Linting Xue, Noah Constant, Adam Roberts, Mihir Kale, Rami Al-Rfou, Aditya Siddhant, Aditya Barua, and Colin Raffel. mt5: A massively multilingual pre-trained text-to-text transformer. arXiv preprint arXiv:2010.11934 , 2020.

Timothy Yang, Galen Andrew, Hubert Eichner, Haicheng Sun, Wei Li, Nicholas Kong, Daniel Ramage, and Françoise Beaufays. Applied federated learning: Improving google keyboard query suggestions. arXiv preprint arXiv:1812.02903 , 2018.

Ganzhao Yuan, Yin Yang, Zhenjie Zhang, and Zhifeng Hao. Convex optimization for linear query processing under approximate differential privacy. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages 20052014, 2016.

Chen Zhu, Zheng Xu, Mingqing Chen, Jakub Koneˇ cn` y, Andrew Hard, and Tom Goldstein. Diurnal or nocturnal? federated learning of multi-branch networks from periodically shifting distributions. In International Conference on Learning Representations , 2022.

A Notation summary

A.1 Intuition behind MF-DP-FTRL

Fig. 7 compares DP-SGD and MF-DP-FTRL. To gain an intuition for why MF-DP-FTRL can perform better than DP-SGD, observe that vanilla SGD has iterates θ t = θ 0 -η ∑ t i = 1 ˆ x i , and hence when the noisy gradients ˆ x i are added, the C -1 [ i,j ] z [ i, ∶] terms in MF-DP-FTRL serve to cancel out some of the noise introduced on previous rounds. The noise cancellation reduces the total error in all the prefix sums of gradients ∑ t i = 1 ˆ x i for t ∈ [ n ] , but also worsens the privacy guarantee of the mechanism, i.e. increases its sensitivity. The privacy worsens as e.g., an adversary trying to learn x 1 via ˆ x 1 can partially learn the value of z 1 from ˆ x 2 , whereas in DP-SGD ˆ x 1 and ˆ x 2 are uncorrelated. Hence there is a tradeoff between the total error and sensitivity (see next paragraph): DP-SGD sets C -1 [ i,j ] = 0

MF

Mechanism

(stateful

across

rounds)

1

clipped

batch

gradient

mechanism

output

2

3

+

…

+

…

+

…

clipped

batch

gradient

mechanism

output

+

+

+

DP-SGD

MF DP-FTRL

batch

batch

…

…

…

https://latex.codecogs.com/eqneditor/editor.php png / Latin Modern / 20pt (Huge) / 300 / below the main diagonal, effectively minimizing sensitivity (assuming a fixed normalization of the main diagonal), but with a large total error due to no noise cancellation. On the other hand, MF-DP-FTRL can arrive at a better compromise between mechanism sensitivity and the total error. This is formalized in the optimization problem of Sec. 4.

Transparent Scaling:  15% for g_i Scaling: height 0.22 for x+z+C equations \mathbf{x}_1 \mathbf{x}_1 + \mathbf{z}_1 \mathbf{x}_4 + \mathbf{z}_4  {\color{BrickRed}\ +\, Without a sampling assumption, the implied DP adversary knows which examples participated in batch S i , and for DP-SGD with uncorrelated noise, knows they only need to 'attack' ˆ x i . However, with MF-DP-FTRL, the information from S i can potentially be masked with a larger amount of initial noise in ˆ x i , which is then canceled out over subsequent rounds. 'Spreading out' the release of information about batch S i over a larger number of iterations in this way can intuitively provide better privacy, while still allowing for accurate partial sums of gradients (and hence SGD iterates). This is, in a loose sense, similar to the way SGD with sampling 'hides' information about a particular example at randomly chosen iterations.

\mathbf{C}^{-1}_{4,1}\mathbf{z}_1  +

\mathbf{C}^{-1}_{4,2}\mathbf{z}_2 +\mathbf{C}^{-1}_{4,3}\mathbf{z}_3  } B Dropping the diag ( X ) = 1 constraint

As discussed in Sec. 4, BANDMF by default imposes an equal column norm constraint on the generated factorization. In the optimization problem, this is accomplished by imposing the constraint diag ( X ) = 1 . In this section we show how we can solve the optimization problem without this constraint for ( k, b ) -participation. This optimization problem is formulated to minimize total squared error with respect to ( k, b ) -participation, although in principle the optimized matrices could be used in the b -min-sep-participation setting with some degradation in solution quality. Prop. B.1 provides an expression for efficiently computing the sensitivity of a b -banded matrix.

Proposition B.1. Let X ∈ S n + be a b -banded matrix, and let Π denote the ( k, b ) -participation schema. Then

To integrate this expression into the optimization problem, we can replace the diag ( X ) = 1 constraint with b linear constraints on diag ( X ) . This modification does not affect the convexity of the problem, although it does slightly complicate the algorithms needed to solve it. To handle this new problem, our approach is to replace the gradient with respect to X at each iteration, with a projected gradient , which is obtained by setting v i = ∑ k -1 j = 0 diag ( ∆ X ) i + jb for all i = 1 , . . . , b , and setting diag ( ∆ X ) i + jb = diag ( ∆ X ) i + jb -v i / k . This ensures that sensitivity does not change between iterations of the numerical optimization procedure.

For the reasons mentioned in Sec. 4, by default we impose the simpler constraint diag ( X ) = 1 . In App. C, we provide some numerical comparisons between these two approaches. Specifically, the rows of Table 2 with Equal column norms? (F)alse correspond to the approach described here; observe this results in slightly improved RMSE under ( k, b ) -participation compared to the corresponding rows with Equal column norms? (T)rue.

C Empirical evaluation of banded matrices

Table 2 compares the matrix mechanisms studied under different participation patterns but normalized to have sensitivity sens ( C ) = 1 under ( k = 6 , b = 342 ) -participation. The sensitivity under single participation k = 1 is lowest as expected. With column normalization, sensitivity is also 1 under b ≥ 342 -min-sep-participation. We make the following observations:

For the MF mechanisms, column normalization hurts RMSE for ( k, b ) -participation compared to the approach of App. B (as it is an additional constraint), but actually improves RMSE under b -min-sep-participation.

We conjecture that the ( k, b ) -participation optimized matrices (MF without column normalization, App. B) are optimal for the prefix-sum workload 8 ; With this in mind, we see there is at most a small increase in RMSE for switching to the more challenging b -min-sepparticipation schema ( 1 . 00 → 1 . 05 ) . If (as we further conjecture) the optimal matrices for prefix-sum in fact are k -banded, the gap is even smaller (at most 1 . 04 → 1 . 05 ) . Hence, at least for the prefix-sum workload A , there is limited room for improvement in developing optimization procedures that directly optimize over the larger feasible set offered by b -min-sep-participation.

Using fewer than b bands does degrade performance on the RMSE metric, with DP-SGD being the extreme case, yielding prefix sum estimates almost 10 × worse than the MF mechanisms.

The results of Denisov et al. [17] imply that the binary-tree C matrix can in fact be used in the online setting, with the Moore-Penrose pseudo-inverse giving the optimal decoder for RMSE [15], corresponding to the 'full' estimator of Honaker [30]. We include this in the table as a baseline, and see that it is in general outperformed by our MF mechanisms by about 1 . 5 × in RMSE.

D Example structures of MF

Figs. 8 and 9 show the structure of some of the key matrix factorization approaches considered in this work. One can immediately see the impact of the ( k, b ) -participation schema in the optimal matrices, in particular for the non-banded MULTI-EPOCH MF matrices (the two top-right matrices), where C contains diagonals of negative entries separated by b steps. In the bottom two rows, we see that requiring equal column norms ('EN-' for equal norms) has a relatively minor impact on the structure of the matrices.

0

16

32

48

64

0

16

32

48

64

Single-epoch

C

0

16

32

48

64

0

16

32

48

64

SGD

C

0

16

32

48

64

0

16

32

48

64

(

k

=8)-epoch MF

C

0

16

32

48

64

0

16

32

48

64

(

k

=4)-epoch MF

C

0

16

32

48

64

0

16

32

48

64

Single-epoch

C

1

0

16

32

48

64

0

16

32

48

64

SGD

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=8)-epoch MF

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=4)-epoch MF

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=8) EN-Band MF

C

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=8) Band MF

C

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=16) EN-Band MF

C

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=16) Band MF

C

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=8) EN-Band MF

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=8) Band MF

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=16) EN-Band MF

C

1

0

16

32

48

64

0

16

32

48

64

(

k

=4,

b

=16) Band MF

C

1

0.0

0.2

0.4

0.6

0.8

1.0

1.0

0.5

0.0

0.5

1.0

1.5

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.1

0.2

2

0

2

4

0.0

0.1

0.2

0.3

0.4

1

0

1

2

3

0.0

0.1

0.2

0.3

0.4

0.5

2

1

0

1

2

3

4

0.0

0.1

0.2

0.3

2

1

0

1

2

3

0.0

0.1

0.2

0.3

0.4

0.5

2

1

0

1

2

3

0.0

0.1

0.2

0.3

0.4

1

0

1

2

3

一

0

16

32

48

64

80

96 112 128

0

16

32

48

64

Optimal TreeAgg

C

0

16

32

48

64

80

96 112 128

0

16

32

48

64

Optimal TreeAgg

C

0.0

0.2

0.4

0.6

0.8

1.0

0.25

0.00

0.25

0.50

E Algorithms and Analysis for Sec. 3

E.1 Algorithms

Algorithm 3

Algorithm 4 Efficient sensitivity upper bound for b -min-sep-participation

Inputs: min-separation b , matrix X , max participations k

Algorithm 5 Efficient sensitivity calculation for b -min-sep-participation, assuming X is b -banded. Inputs: min-separation b , b -banded matrix X , max participations k . return √ VECSENS ( b, diag ( X ) , k )

E.2 Analysis

Proposition E.1. The sensitivity of C for a given participation schema Π may be expressed as:

where P π represent the axis-aligned projection onto the set of rows indexed by π ; that is, P π [ i, i ] = 1 for i ∈ π , and 0 otherwise. Assuming that D represents a set of matrices with rows bounded by glyph[lscript] 2 norm 1, this can be upper bounded by:

where X = C ⊺ C . This upper bound is tight when P π C ⊺ CP π ≥ 0 ∀ π ∈ Π , and is independent of the dimension d of the rows of u .

Proof. Recall that Π determines the rows of u which may be nonzero in the definition Eq. (2). Take some u ∈ D , an element of R n × d , which therefore has nonzero rows only at some set of indices π ∈ Π .Note, clearly u = P π u , P ⊺ π = P π , and P π = P π P π .

Therefore

This implies the statement Eq. (7) by the definition of sensitivity and neighboring in our setting.

Now, let X π ∶= P π C ⊺ CP π be the matrix formed by zeroing out the rows and columns not indexed by π from X . Assume that every u ∈ D has row norms bounded by 1. Expanding the trace in Eq. (7), writing x ij for the elements of X π and u [ j, ∶] for the j th row of u , we have

which yields the claimed bound. When X π is elementwise nonnegative, taking u [ i, ∶] = u [ j, ∶] for any unit vector shows the claimed tightness in this case.

Remark. This statement can be viewed as a partial extension of [15, Theorem G.1]. It does not imply every case handled there, but also implies results which cannot be derived from that Theorem.

Proof of Thm. 2. Conclusion (1) is implied by (2), noting that the conditions on C imply that Alg. 5 will return a value at most κ √ k ′ in this setting.

For (2), let c ∈ R n with entries c i = ∥ C [∶ ,i ] ∥ 2 for i ∈ { 0 , . . . , n -1 } . We have

where u ( π ) ∈ { 0 , 1 } n is given by u ( π ) i = 1 if i ∈ π and 0 otherwise. The last equality follows from the orthogonality condition on sufficiently separated columns of C trivially implied by bandedness. It is straightforward to verify the dynamic program of Alg. 3 constructs a feasible π which attains the maximum.

Proof of Thm. 3. Via Prop. E.1, the result follows from showing that Alg. 4 outputs a value at least as large as ∑ ( i,j )∈ π ∣ X ij ∣ for any π ∈ Π b . So let ˆ π be an element of Π b . Note that VECSENS is monotonically increasing in values of the vector v if v is nonnegative, and therefore Alg. 4 is monotonically increasing in absolute values of X . Therefore we will have our conclusion (3) if we can show that, for X ˆ π the matrix formed by zeroing out all rows and columns of X not indexed by ˆ π , Alg. 4 returns the value ∑ ( i,j )∈ π ∣ X ij ∣ . Yet this is straightforward by the characterization of VECSENS as an oracle for computing the maximum of ⟨ v , u ⟩ , where u is a vector in the glyph[lscript] ∞ unit ball.

Proof of Prop. 4.1. The proof will be constructive. Let J be the n × n exchange matrix defined as

Let Y = JXJ and note that Y is symmetric and positive definite. Let H = Cholesky ( Y ) ⊺ and note that (1) H ⊺ H = Y by definition of Cholesky decomposition, (2) H is upper triangular, and (3) H is ˆ b -banded by Du Croz et al. [19].

We will show that for C = JHJ , we have (1) X = C ⊺ C , (2) C is lower triangular, and (3) C is ˆ b -banded.

For Claim (1) observe that:

For Claim (2) and (3), note that left-multiplying by J reverses the rows and right-multiplying by J reverses the columns, and therefore C [ i,j ] = H n -i + 1 ,n -j + 1 .

For Claim (2), we need to show C [ i,j ] = 0 if i < j . If i < j then n -i + 1 > n -j + 1 , and since H is upper triangular, we know H [ n -i + 1 ,n -j + 1 ] = 0 , as desired.

For Claim (3), we need to show that C [ i,j ] = 0 if ∣ i -j ∣ ≥ ˆ b . Observe that if ∣( n -i + 1 )-( n -j + 1 )∣ = ∣ i -j ∣ ˆ

This completes the proof.

F Additional Analysis for Sec. 5

In this section we prove our general amplification statement Theorem 5, of which Theorem 4 is a corollary. Recall that we use b instead of ˆ b in this appendix since our sampling scheme enforces ( k, b ) -participation. Throughout this section, we slightly abuse notation by letting i ( mod b ) = b instead of 0 if i / b is integer.

F.1 Algorithms for Sampling

We first give the general sampling scheme (Alg. 6) as well as sequence of queries (Alg. 7) that provides an upper bound on the privacy guarantees of DP-MF using this sampling scheme.

Algorithm 6 Sampling scheme for banded DP-MF

Algorithm 7 Sequence of queries that bounds privacy of Alg. 6

.

C

Cx

Independent of D

Query on examples

in step j

b+j

Query on examples

in step b+j

2b+j

Query on examples

in step 2b+j

3b+j

Query on examples

in step 3b+j

b+j

2b+j

3b+j

j

F.2 General Amplification Statement and Proof

Given the sampling scheme and query sequence, we can now state our general amplification statement: Theorem 5. Suppose C is b -banded and lower triangular, and the examples participating in each step are chosen according to Alg. 6 with a given choice of S . Then BANDMF satisfies any standard DP guarantee 9 satisfied by Alg. 7 in App. F .1 with κ = max i ∈[ n ] ∥ Ce i ∥ 2 = max i ∈[ n ] √ X i,i and the same choice of S .

Proof. Consider two datasets D,D ′ that differ by an example contained in the partition subset D j . We argue about the privacy of Cx + z . For simplicity we assume j is such that ( k -1 ) b + j ≤ n ; elements in D j such that j does not satisfy this condition can potentially participate k -1 times instead of k , and in turn the privacy guarantee we can prove for these elements can only be stronger.

Since C is b -banded, we can partition the rows of C into k + 1 subsets

where R j (resp. R b + j , R 2 b + j . . . R ( k -1 ) b + j ) denotes the set of rows in C for which the j th entry is non-zero, and R ∅ = [ n ] ∖ ( R j ∪ R b + j ∪ . . . ) , i.e., R ∅ are the rows not included in any of these sets, i.e., rows of C where entries j, b + j, . . . are all zero. The fact that C is lower-triangular and b -banded ensures that these subsets do not overlap, i.e., this is a valid partition as can be observed in Fig. 4.

Let C R denote C restricted to the set of rows in R . From the perspective of an adversary distinguishing D from D ′ , each row of ( Cx + z ) R ∅ = C R ∅ x + z R ∅ has a distribution independent of whether D or D ′ was used. So it suffices to give privacy guarantees for outputting only ( Cx + z ) R j , ( Cx + z ) R b + j , . . . , ( Cx + z ) R ( k -1 ) b + j .

We can decompose rows R j of Cx + z as follows:

Where x j denotes x with all rows except j zeroed out, and x -j denotes x -x j , i.e., x with row j zeroed out. By the b -banded property of C , C R j x -j has 0 sensitivity to the examples in D ∖ D j . Then,

by Eq. (10), for i ∈ R j , we observe that the i th row of ( Cx + z ) R j corresponds to an (adaptive) query made with glyph[lscript] 2 -sensitivity e ⊺ i Ce j to the examples used in step j , i.e., those given by D j and S j , and noise N ( 0 , σ 2 ) d . So ( Cx + z ) R j corresponds to a sequence of adaptive queries on the examples used in step j , and answering this sequence of queries satisfies any standard privacy guarantee satisfied by answering a single (scalar, adaptively chosen) query with sensitivity ∥ Ce j ∥ 2 to the example chosen in step j and noise N ( 0 , σ 2 ) by Claim D.1 in [17].

The same logic applies to each of ( Cx + z ) R b + j , . . . , ( Cx + z ) R ( k -1 ) b + j . Putting it all together and taking a max over the sensitivity of the individual queries, releasing Cx + z satisfies any standard privacy guarantee satisfied by answering k adaptively chosen queries, with sensitivity max i ∈[ n ] ∥ Ce i ∥ 2 to the examples used in steps j, b + j, . . . , ( k -1 ) b + j respectively. This is exactly Alg. 7 with the specified choice of ∆ , S .

F.3 Corollaries of Thm. 5

We give here several corollaries of Thm. 5 that are of interest.

Equivalence to DP-SGD: Note that when b = 1 , the partition contains a single subset, i.e., is the the entire dataset. In particular, in this setting Thm. 5 recovers the privacy guarantees of amplified DP-SGD under any amplification scheme, e.g. including the ones discussed below.

Amplification via sampling: To recover Thm. 4 from Thm. 5, we take the distribution over 2 [ ˇ m ] corresponding to the uniform distribution over subsets of size B , and let S be the product of this distribution with itself k times. This is equivalent to the following: in step i , we include each element of D i ( mod b ) independently with probability q . For this choice of S , Alg. 6 reduces to Alg. 2 and Thm. 4. We next make the amplified privacy guarantee explicit in terms of the dp_accounting Python library [18]. Given n, m, b and a target per-step batch size B , we could write a dp_accounting.DpEvent capturing the privacy guarantees of the matrix factorization mechanism as follows:

Example F.1.

Example F.2. To give an example of the amplification guarantee, for simplicity assume n / b, m / b are integer. If all column norms in C are 1, each row of x has sensitivity 1, and each entry of z has standard deviation σ , then outputting Cx + z satisfies ( α, αn 2 σ 2 b ) -RDP.

Using Theorem 11 of [46] and Thm. 4, for appropriate choice of α and q , this improves to ( α,q 2 ⋅ 2 αn σ 2 b ) -RDP with amplification by sampling. In particular, if we have a target per-step batch size B , then we should choose q = Bb m , and if this choice of q satisfies the conditions in [46] plugging this in gives ( α, 2 αB 2 bn σ 2 m 2 ) -RDP. Notice that b = 1 recovers the privacy guarantees of DP-SGD with sampling probability B / m , and this privacy guarantee weakens as b increases.

Amplification via shuffling: Fix a per-step batch size B . Then, suppose we shuffle the list of examples, and cyclically iterate over batches of size B in this list as the sets of examples to use in each step of matrix factorization. That is, we shuffle D into an ordered list d 1 , d 2 , . . . , and in step i use examples d ( i -1 ) B + 1 ( mod m ) , d ( i -1 ) B + 2 ( mod m ) , . . . , d iB ( mod m ) .

For simplicity let's consider the case where m /( Bb ) is integer. In particular, this means in this shuffling scheme, each example appears once every m / B steps, and for each of these steps i , i ( mod b ) is the same. Then this shuffling scheme is equivalent to the following: First, rather than choose an arbitrary partition to apply Thm. 5, we choose a uniformly random partition into b subsets

of size m / b . Then, we choose S to be the distribution giving by shuffling [ m / b ] and then cyclically iterating over the shuffled list in batches of size B . Given this equivalence, we get the following:

Corollary F.1. Suppose the examples in matrix factorization are chosen by shuffling D and then iterating over batches of size B . If n /( Bb ) is integer, then the matrix factorization mechanism satisfies any standard privacy guarantee satisfied by k adaptive scalar queries with sensitivity max i ∈[ n ] ∥ Ce i ∥ 2 and noise N ( 0 , σ 2 ) , with the examples in each query given by shuffling a dataset of size m / b and cyclically iterating over this list in batches of size B .

Example F.3. Consider the simplified case where m = n , we choose a random permutation π , and in step i query example d π ( i ) . In this case, if all the column norms of C are 1, x 's rows have sensitivity 1, and z 's entries have standard deviation σ = O ( √ ln ( 1 / δ ) glyph[epsilon1] ) , we get that Cx + z satisfies ( glyph[epsilon1], δ ) -DP. With e.g., the amplification for shuffled ( glyph[epsilon1], δ ) -DP mechanisms given by Theorem 5.1 of [6] and Cor. F.1, if glyph[epsilon1] is a constant, we instead get that Cx + z satisfies ( glyph[epsilon1] ⋅ O ( √ b log ( 1 / δ ) n ) , δ ⋅ O ( n ln ( 1 / δ ) b )) -DP.

F.4 Optimizing the number of bands

Let σ glyph[epsilon1],δ ( b ) be the required Gaussian noise magnitude for a b -banded MF run for n iterations using e.g. Alg. 2 to achieve ( glyph[epsilon1], δ ) -DP with per-step batch size B . Then, the expected total squared error introduced while achieving ( glyph[epsilon1], δ ) -DP with amplification can be calculated as

where C b is a b -banded lower triangular matrix optimized via Problem 2. Generally, smaller values of b will allow for more amplification, and hence a smaller σ ; however, this introduces a stronger set of constraints on the optimization problem, likely increasing the L term. Hence, the choice of b should be optimized. Fortunately, σ glyph[epsilon1],δ (⋅) can be computed efficiently: Thm. 4 implies a procedure to compute glyph[epsilon1] given σ, δ, b , and then one can use binary search 10 and this procedure to find the σ giving a desired glyph[epsilon1] . In addition, one can pre-compute the optimal matrices C b for different numbers of bands. The search can be restricted to b ∈ { 1 , 2 , . . . , m B , n } since for b = m B we have ∣ D j ∣ = B , i.e. Alg. 2 and Thm. 4 provide no privacy amplification.

Unlike the un-amplified version of MF, now the best factorization depends on the privacy parameters ( glyph[epsilon1], δ ) . The benefits of amplification are generally stronger for small glyph[epsilon1] : For example, amplification by sampling with probability p roughly improves glyph[epsilon1] to log ( 1 + p ( e glyph[epsilon1] -1 )) (see e.g. Section 6 of [55]), which is approximately pglyph[epsilon1] for glyph[epsilon1] ≤ 1 , and approximately glyph[epsilon1] -log ( 1 / p ) if e glyph[epsilon1] ≫ 1 / p . Hence, with smaller values of glyph[epsilon1] , we expect the benefits of amplification to outweigh the benefits of correlated noise, in which case b = 1 will be optimal. With larger values of glyph[epsilon1] , we expect the benefits of correlated noise to outweigh the benefits of amplification, and in this regime b = n will be optimal. For moderate values of glyph[epsilon1] , we expect the optimal b to be somewhere in the middle.

F.5 Applying BANDMF with Privacy Amplification

Consider the setup of Sec. 5 with our CIFAR10 setting described fully in App. H. As mentioned in that section, we use the convention that our privacy analysis will assume Poisson sampling, even though we are using passes over a shuffled dataset. We have m = 50 , 000 and train for k = 20 epochs with a batch size B = 500 . Choquette-Choo et al. [15] lets us bound the sensitivity and optimize matrices for this setting, however, without privacy amplification. Suppose we choose ˆ b = 100 . Because m / ˆ b = 500 = B , we get that the sampling probability is 100% (see Example F.1) and thus get no benefits from amplification. For all ˆ b ∈ [ 1 , 100 ) we get amplification benefits which can be seen intuitively as follows.

If ˆ b = 2 , we get that there are two partitions D 1 , D 2 . Then or first event will be the simultaneous release of x 1 , x 2 , our second of x 3 , x 4 , and so on. Because each partition is of size ∣ D j ∣ = m / ˆ b = 25 , 000 and B = 500 , we have a sampling probability q = 2% . Given our parameters, we also have d = k ⋅ m / B = 2 , 000 , and so we must compose d / ˆ b = 1 , 000 events (as seen in Example F.1). Because in this setting each event is the batch release of ˆ b steps of x , where each example participates at most

once on each release, observe that we need only normalize the sensitivity of this mechanism under ( k = 1 , b = ˆ b = 2 ) -participation. Generally, as ˆ b increases we have a higher sampling probability, but fewer events to compose, and vice versa. As can be seen, when ˆ b = 1 , this reduces to the standard accounting for DP-SGD. It can also be seen that we desire each D j to be a non-overlapping partition of D , as otherwise, a single example may participate multiple times in the same event (and thus have a higher sampling probability).

G Additional RMSE Experiment Details

G.1 Optimal Number of Bands

In this section, we provide supplementary data surrounding the RMSE experiments in Fig. 5. Table 3 shows the optimal number of bands for each ( glyph[epsilon1],k ) pair considered in the RMSE experiments. It shows the general trend that as glyph[epsilon1] decreases, or k increases, the optimal number of bands decreases.

G.2 Explaining many-epoch setting

Observe in Fig. 5 that as BANDMF and MULTI-EPOCH MF incur similar RMSE as DP-SGD when the number of epochs increases.

This phenomenon occurs because as the number of epochs changes, so does the sensitivity of the X matrix, and subsequently the geometry of the optimization problem. By Eq. (5), we see that sensitivity can be calculated as a sum of absolute values of entries of X corresponding to iterations where a single user might participate. As the number of epochs increases, the number of entries of X that we have to sum up also increases. It turns out that under the constraint of constant sensitivity, it is better to put more weight on the diagonal of X than the off-diagonal. This is an observation we have made by solving this optimization problem numerically in a number of settings. Hence, as the number of epochs increases, X becomes more and more diagonally dominant, making the mechanism closer to DP-SGD ( X = Identity).

H Additional CIFAR-10 Experiment Details

H.1 Setup and Tuning

We tune all jobs on a learning rate grid of coefficients in {1, 2, 5} on powers in [-2, 3]. We find that no momentum works best for DP-SGD and momentum=0.95 works best for MF-DP-FTRL mechanisms on average in tuning; though initial tuning found that tuning momentum as well could lead to slightly better results at some glyph[epsilon1] budgets, we found that a more refined grid of learning rates nearly always led to a fixed momentum being optimal, and so we fix this parameter. We also found that a learning rate cooldown to 0 . 05 × the initial learning rate over the last 500 steps of training improved all runs and so we fix this parameter. All models trained for 20 epochs on CIFAR10 with a batch size of 500. We repeat each setting 12 times and show 95% bootstrapped confidence intervals.

H.2 Additional Figures

1

6

11

16

21

26

31

36

41

46

51

56

61

66

71

76

81

86

91

96

Number of Bands,

0.01

0.05

0.1

0.5

1.0

1.2

1.8

2.1

2.3

2.5

2.7

2.9

3.2

3.6

4.0

5.0

10.0

15.0

20.0

Privacy Budget,

Ratio of Banded MF Error with DP-SGD.

1

6

11

16

21

26

31

36

41

46

51

56

61

66

71

76

81

86

91

96

Number of Bands,

0.01

0.05

0.1

0.5

1.0

1.2

1.8

2.1

2.3

2.5

2.7

2.9

3.2

3.6

4.0

5.0

10.0

15.0

20.0

Privacy Budget,

Ratio of Banded MF Error with Optimal MF.

0.00

0.25

0.50

0.75

1.00

1.25

1.50

1.75

2.00

Banded MF Better

DP-SGD Better

0.00

0.25

0.50

0.75

1.00

1.25

1.50

1.75

2.00

Banded MF Better

Optimal MF Better

b

b

0.01

0.1

1

Privacy budget   at

=10

5

20

25

30

35

40

45

50

55

Test accuracy (%)

Mechanism

DP-SGD, w/ ampl.

Multi-epoch MF, no ampl.

(Band) MF, w/ ampl. (Ours)

1

10

Privacy budget   at

=10

5

55

60

65

70

75

Test accuracy (%)

=

, Nonprivate Baseline

I Additional StackOverflow Next-Word-Prediction Experiment Details

We follow the experimental setup for StackOverflow NWP from Denisov et al. [17] and ChoquetteChoo et al. [15]. Except for SINGLE-EPOCH MF (which uses B = 167 clients/round for 1 epoch), all privacy guarantees and accuracy results are for 6 epochs of training using B = 1000 clients/round for 2052 rounds (also 1 epoch). The matrices used in these experiments are included in Table 2.

For computational efficiency in estimating model accuracy at a given privacy guarantee, we actually compute in simulation updates from only 100 clients/round, and scale the noise multiplier by a corresponding factor ( 100 1000 for 6 epoch experiments, 100 167 for SINGLE-EPOCH MF). This approach has been used previously [35, 44], and we independently verified it has a negligible impact on the estimates of accuracy figures we report. Tables 4 and 5 include the unscaled noise multipliers σ for our experiments.

10

2

10

1

Effective prefix-sum RMSE during training

0.014

0.041

0.12

0.346

1.0

2.89

server learning rate

s

RMSE in prefix-sum estimates predicts optimal server

s

10

3

10

2

10

1

Effective gradient RMSE during training

0.014

0.041

0.12

0.346

1.0

2.89

server learning rate

s

Gradient errors are less predictive of good learning rates.

Mechanism

DP-SGD

Single-epoch MF

Optimal TreeAgg

Multi-epoch MF

Band MF,

b

=342 (Ours)

1.0

2.0

4.0

8.0

16.0

Optimizer and learning-rate tuning For all SO NWP experiments we use the FedSGDM optimizer [50]. This optimization approach first takes multiple local SGD steps (with learning rate 1.0 in our experiments) on the training data of each user in the batch (cohort) before clipping to ζ = 1 , summing, and passing the result x i into the DP mechanism which adds noise [ C † z ] [ i, ∶] ∈ R d on each iteration i . The resulting privatized sum is then divided by the batch size B and passed to the 'server' (post-aggregation) optimizer, in our case SGDM with momentum parameter β = 0 . 95 and learning rate η s . We find tuning η s depending on the noise level is critical. By using the computationally efficient approach mentioned above, we were able to conduct rigorous tuning over a learning rate grid of 1 . 7 i for powers i in {-9 , . . . , 4 } , estimating good initial guesses based on prior work. Table 6 gives the full set of results, and Fig. 14 shows convergence as a function of the number of rounds (iters).

Learning rate warmup and cooldown Denisov et al. [17] found learning rate cooldown was effective, and Choquette-Choo et al. [15] found that zeroing-out client updates with large glyph[lscript] ∞ norms was critical to stability in early training. We find that additionally introduing a learning-rate warmup schedule reduces the need for this zeroing-out (though we still enable it), and generally decreases the variance in training results. Hence, all of our experiments (for all algorithms) using a linear learning rate warmup from 0 . 05 η s to 1 . 0 η s over the first 15% of rounds (309), and a linear decay from 1 . 0 η s to 0 . 05 η s over the last 25% of rounds (513).

Using RMSE to tune optimal server learning rates Fig. 13 plots the server learning rates η s from Table 6 on the y -axis (with the optimal rates shown as larger symbols, and sub-optimal rates as small symbols, versus two different measures of the error for the DP mechanism on the x -axis: The left plot gives uses the effective prefix-sum RMSE (the objective we use for optimizing (banded) matrices C ),

where S is the prefix-sum workload (lower-triangular matrix of ones) and σ and B are as given in Table 4. The right plot uses the RMSE in error of individual gradients, computed by replacing the L term in the above with L( IC -1 , C ) where we take the workload A to be the identity matrix I rather than the prefix sum matrix S .

We see a strong linear correlation between the prefix-sum RMSE and optimal learning rate in the left plot; this does not hold for individual gradient errors (right plot). Based on this, we use the following linear regression to choose learning rates for the non-federated (amplified) SO NWP experiments (still rounding to the nearest 1 . 7 i for consistency):

This allowed us to estimate learning rates for the amplified experiments with a high degree of accuracy; Table 7 gives the final selected learning rates.

12

14

16

18

20

22

24

26

Validation accuracy, smoothed (%)

= 1.0

= 2.0

12

14

16

18

20

22

24

26

Validation accuracy, smoothed (%)

= 4.0

= 8.0

250

500

750

1000

1250

1500

1750

2000

iter

12

14

16

18

20

22

24

26

Validation accuracy, smoothed (%)

= 16.0

250

500

750

1000

1250

1500

1750

2000

iter

= inf

Mechanism

DP-SGD

Single-epoch MF

Optimal TreeAgg

Multi-epoch MF

Band MF,

b

=342 (Ours)

server lr

s

1.5

3.0

4.5

6.0

7.5

Algorithm 9 Banded Inverse Multiplication

Input:

ˆ

b

-Banded lower triangular matrix

C

∈

R

n

×

n

, vector

y

∈

R

n

Output:

C

-

1

y

for

i

=

1

, . . . , n

do

x

i

= (

y

i

- ∑

i

-

1

j

=

i

-

ˆ

b

+

1

C

[

i,j

]

x

j

)/

C

[

i,i

]

return

x

Algorithm 8 Banded Matrix Multiplication

Input:

ˆ

b

-Banded lower triangular matrix

C

∈

R

n

×

n

, vector

x

∈

R

n

Output:

Cx

for

i

=

1

, . . . , n

do

y

i

= ∑

i

j

=

i

-

ˆ

b

+

1

C

[

i,j

]

x

j

return

y

Algorithm 9 Banded Inverse Multiplication

Input:

ˆ

b

-Banded lower triangular matrix

C

∈

R

n

×

n

, vector

y

∈

R

n

Output:

C

-

1

y

for

i

=

1

, . . . , n

do

x

i

= (

y

i

- ∑

i

-

1

j

=

i

-

ˆ

b

+

1

C

[

i,j

]

x

j

)/

C

[

i,i

]

return

x

J Efficient Multiplication and Inverse of Banded Matrices

Algorithms 8 and 9 (Fig. 15) give algorithms for lower triangular banded matrix-vector multiplication and inverse banded matrix-vector multiplication. Note that both algorithms are compatible with the streaming nature of gradients. As soon as the next input x i is received, the algorithm can immediately output y i . Both algorithms require storing a state of size ˆ b , and run in O ( n ⋅ ˆ b ) time. While the algorithms are described with respect to computing matrix-vector products, they can also be used to compute matrix-matrix products where the right-hand-side is a n × d matrix by multiplying by each column independently. In this setting, these algorithms require O ( ˆ b ⋅ d ) space and O ( n ⋅ ˆ b ⋅ d ) time. Both algorithms have appeared previously in the literature on Monte Carlo methods, which have a similar problem at their core to that of noise generation for MF; see e.g. [56, Section 2].

K Application to a Real-World Cross-Device FL System

We train a one-layer LSTM language model of ∼ 2.4 million parameters in a practical cross-device FL system following [58] . The model is used for predicting the next word of Spanish in a mobile virtual keyboard. We pretrain the model on public multilingual C4 dataset [49, 60], and then fine-tune with on-device user data in FL. In a common practical FL system, clients have to satisfy criteria like being charged, idle and connected to unmetered network to participate in a round [10, 27, 31, 47], hence only a subset of clients can be reached and there is a strong diurnal pattern of client participation [61, 63]. It is very challenging to hold a fixed set of clients for evaluation, or develop random sampling for privacy amplification. Though the current implementation of client participation control is feasible through the client timer, the tuning of separation b in practice can be challenging. Therefore, the training of Fig. 6 (b) can achieve smaller separation b than in [58].

K.1 Reporting privacy guarantees

We follow the guidelines outlined in [48, Sec. 5.3] to report privacy guarantees.

DP setting . This a central DP guarantee where the service provider is trusted to correctly implement the mechanism.

2. Instantiating the DP Definition

(a) Data accesses covered : The DP guarantee applies to all well-behaved clients 11 in a single training run. We do not account for hyperparameter tuning, or the selection of the final model checkpoint using evaluation metrics or A/B testing in our guarantees. Public multilingual C4 data [49, 60] is used for pre-training.

(b) Final mechanism output : Only the final model checkpoint is released for use in production, however the mechanism's output is technically the full sequence of privatized gradients, and so the guarantee also applies at this level, and hence all intermediate models are protected (including those sent to devices participating in federated learning).

(c) Unit of privacy . Device-level DP is considered, i.e., the notion of adjacency is with respect to arbitrary training datasets on each client device, and the device might have an arbitrarily large local dataset containing arbitrary training examples. For user's with a single device, this corresponds directly to user-level DP; for devices shared with multiple users, this provides a stronger notion of DP than user-level; for a user with multiple devices that happen to both participate in training the model, the notion is weaker, but group privacy can be used to obtain a user-level guarantee.

(d) Adjacency definition for 'neigbouring' datasets : We use the zero-out definition [35]. This is a a special form of the add-or-remove definition, where neighboring data sets differ by addition/removal of a single client. In the absence of a client at any training step, we assume that the client's model update gets replaced with the all zeros vector. This assumption enforces a subtle modification to the traditional definition of the add/remove notion of DP which allows neighboring data sets to have the same number of records.

3. Privacy accounting details

(a) Type of accounting used : Both ρ -zCDP [11] accounting, and PLD accounting [18] for ( glyph[epsilon1], δ )-DP are used.

(b) Accounting assumptions : Each client only participates limited times during the training, and there are at least a min-separation of b rounds between two consecutive participation of a client. This is enforced by a timer on clients in the cross-device FL system.

(c) The formal DP statement : The privacy guarantees are ρ = 0 . 52 -zCDP and ( glyph[epsilon1] = 6 . 69 , δ = 10 -10 ) -DP for ONLINE TREEAGG, while BANDMF achieves ρ = 0 . 24 -zCDP and ( glyph[epsilon1] = 4 . 35 , δ = 10 -10 ) -DP.

(d) Transparency and verifiability : We are going to open source our code based on TensorFlow Federated and Tensorflow Privacy. Key portions of the cross-device FL system will also open sourced.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nApplying matrix factorization mechanism and balancing tradeoffs of the mechanism in differential privacy is a long living issue. This work constructs MF mechanism with banded matrices for both centralized and federated training setting across all privacy budgets. For federated setting, this work is compatible with real world federated learning devices. For centralized setting, banded matrices are on par with the same privacy amplification results of DP-SGD algorithm.\n\nSTRENGTHS:\n1. Banded matrix factorization with amplification can outperform DP-SGD with amplification for centralized setting, and well-balance privacy-utility tradeoffs.\n2. With b-min-sep-participation, banded MF can optimize (k,b)-participation, and reduce linear memory/time complexity for per-iteration noise generation to a constant.\n\nWEAKNESSES:\n1. The bound of sensitivity of MF mechanism looks confusing although the first part looks tight (sup for C*x and C*x_tilde). See Question 5.\n2. Although this work considers FL in the practice, the dataset like CIFAR 10 seems quite outdated and the scale of CIFAR10 is too small, which is not enough to convince the community.\n3. Probably authors need to clarify questions I stated in the next sections.\n\nQUESTIONS:\n1. Can you compare advantages and disadvantages of banded and unbanded matrix factorization for DP in FL setting?\n2. In the Theorem 1, what is n? Is n the number of iterations or other things else?\n3. In the Figure 1, it is hard to tell the difference of performance of Banded MF w/ amplification and multi-epoch MF w/o amplification. Why do you need amplification? What does the benefit of amplification for banded MF? \n4. What does the \\zeta mean for multiple participations? How does the \\zeta affect the participations?\n5. What is relationship between x, x tilde and u in equation 2?\n\nLIMITATIONS:\n1. This work has limited contribution on DP, because this work is more like an incremental work for multiple-epoch MF-DP-FTRL based on Choquette-Choo et al’s work to extend to federated learning setting.\n2. It is not clear why we should assume in the cross-device FL setting, (k,b)-participation is not feasible. I know it is good to have some assumptions in the real world. However, I am wondering if it is necessary to restrict the scenario into such the practical case.\n3. The MF optimization problem looks interesting and promising, but this work still needs more experiments, especially more datasets (at least three and other than small datasets like CIFAR10).", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-20"}

comments: SUMMARY:
In this paper, the authors show how Matrix Factorization (MF) can subsume prior
state-of-the-art algorithms in both federated and centralized training settings, across all privacy
budgets. They apply the key technique: MF mechanisms with banded matrices. For both the
cross-device federated learning setting and the centralized setting, the result in this paper
improves or generalizes previous results. In addition, the $\hat{b}$-banded matrices
substantially improve the memory and time complexity.

STRENGTHS:
1. The problem of Matrix Factorization for Differential privacy is well-motivated.
2. This paper is solid, the results look correct.
3. The result improves or generalizes previous results.

WEAKNESSES:
The main result for the centralized setting is summarized in Section 5. However, it seems the
result for federated learning setting is not stated clearly. Is there a summary of the result for FL
setting?

QUESTIONS:
See weakness.

LIMITATIONS:
No
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-05

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes banded matrix factorization for differential privacy. It shows this new mechanism can be effectively applied to centralized and federated-learning settings (where individuals can choose when and how many times to participate in training). The main technical part is the $b$-minsep-participation schema that generalizes the $(k, b)$-participation proposed in Choquette-Choo et al.\n\nSTRENGTHS:\nThe experiments in Sec 6 demonstrate that banded MF exhibits a very good improvement over multi-epoch MF and DP-SGD in the centralized settings, and almost coincides with (or improves modestly) the state-of-the-art performance in the federated learning.\n\nWEAKNESSES:\nWhile the presentation of the paper is good for the most part, there are some issues that can be improved. For instance, the notation $\\hat b$-banded matrices were used several times in the Abstract, Introduction, and Sec 2 without a precise (or even intuitive) definition [It was defined on Page 5!]. Also, $\\hat b$ and $b$ seem to be interchanged arbitrarily (which is really confusing); see for instance lines 62, 188, 189. (I understand that $\\hat b$ is taken to be equal to $b$ only in Sec 5, but not necessarily in the first 4 sections)\nAlso, Theorem 1 is rather cryptic: Do the \"equal-sized subsets\" mean batches of the same size? Does the partition change for each iteration (like typical SGD)? Is it not the case that $B b = m$? \n\nThis sentence (line 89-90) \"The connection between DP empirical risk minimization [3, 4, 5, 7, 8, 9, 13, 15, 21, 23, 30, 34, 36,90 40, 45, 46, 47, 49] and DP online regret minimization [2, 4, 5, 24, 31, 33] has been studied for a long time.\" is awkward. What is the point of this sentence? Why not directly citing some of those works that studied this connection!!\n\nWhat is SGDM in lines 95 and 101?\n\nThe argument in line 213 is not clear: How does Theorem 2 imply that $\\text{diag}(X) = 1$ and bandedness mean the squared sensitivity is equal to $k$?\n\nQUESTIONS:\nCan the authors clarify the argument given in line 224: \"Since we only have equality constraints on 224 individual entries of $X$, Problem 2 is essentially an unconstrained optimization problem\"? \n Are you saying that any constrained optimization problems with equality constraints are essentially unconstrained?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors present a novel mechanism explicitly designed for differentially private training. The mechanism considers the sensitivity of different participation schemes in the context of fixed datasets during differentially private training. The key contributions of this work can be summarised as follows:\n1. By accounting for the sensitivity of multistep participation schemes, the proposed mechanism eliminates the need for composition.\n2. The authors illustrate how matrix factorisation can benefit from privacy amplification through subsampling and shuffling.\n3. They propose a computationally efficient and precise implementation utilising b-banded matrices to compute sensitivity.\n4. Additionally, they introduce an optimisation technique to craft these b-banded matrices.\n\nThe authors provide theoretical proofs and compelling experimental results to support their claim that their approach outperforms DP-SGD accounting.\n\nSTRENGTHS:\n* The paper effectively presents the problem, the proposed solution has a nice and clear structure, and the arguments flow in a natural way.\n* The related work is well-presented, providing context and the existing related work gap, namely if the matrix factorization can benefit from the same privacy amplification techniques as DP-SGD.\n* The experimental section is detailed, offering thorough explanations and interpretations of the results.\n* The paper elegantly recovers privacy amplification bounds from DP-SGD by carefully constructing the proposed linear operator.\n\nWEAKNESSES:\n* the current presentation is not self-contained, as it has plenty of references to the appendix/other related work. It is not ideal, as the main statements of the paper are a bit hard to fully understand without them. I know that space is a limiting issue, especially for well-detailed works like this, but please reconsider restructuring so that the main results (Theorem 2. and Theorem 4.) are possibly more easily to grasp without relying on the appendix this much.\n\nQUESTIONS:\n* More of a high-level question for the authors. In this scenario in which composition is bypassed altogether, why is the Gaussian Mechanism the \"defacto\" mechanism? I might miss something, but I always associate the Gaussian mechanism with composition + l2 sensitivity. It seems the authors have some space to explore other mechanisms (possibly). I was curious if the authors thought more in detail about this; is the Gaussian mechanism optimal in this scenario?\n* A unique perspective on this paper is that most amplification techniques are derived by analysing the linear operator itself and not analysing the output distributions (common, for example, for the subsampled Gaussian mechanism). This is a very interesting view of this work, as it abstracts the noise distribution from the privacy amplification guarantees, giving a more general/decoupled view of privacy amplification in this case. Do the authors think it is possible to design linear operators further to improve privacy guarantees/utility tradeoffs (like other forms of amplification given by the operator's structure), or have we reached some optimal design?\n\nLIMITATIONS:\n* Increased  $O(b)$ multiplicative time/memory overhead compared to DP-SGD.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies the problem of how to optimize the Matrix factorization (MF) mechanisms so that the effect of random noise can be minimized. The MF mechanisms can be applied in addition to the well-known DP-FTRL or similar online DP algorithms in machine learning training. This technique decomposes the query matrix A (e.g., a matrix encoding the prefix sum) into two matrices and adds noise to the intermediate matrix multiplicative result of the data and one of the decomposed matrices. It can potentially introduce less variance to the final results. The key idea of the paper is formulating the MF problem into an optimization problem. The authors show the sensitivity of the mechanism under some constraints of the participation schema and discuss how to derive the best decomposition in terms of minimizing the error profile because of the decomposition. Some experimental results are provided to demonstrate that the proposed mechanism is at least as good as the classic DP-SGD mechanism.\n\nSTRENGTHS:\nGenerally speaking, this paper provides some in-depth results on the MF mechanism that can be interesting to the community.\n1. The authors provide an insightful analysis angle on how to optimize the MF mechanism.\n2. The authors derive the sensitivity of the MF mechanism under some additional assumptions about the participation schema of the users and the property of the original query matrix.\n3. The authors show how one should optimize the MF mechanism via decomposition and how the mechanism can enjoy privacy amplification via sub-sampling.\n\nWEAKNESSES:\n1. While the technical contributions are sufficient for building a good paper, the presentation in this paper makes readers somehow hard to follow. \n\n- MF mechanism is relatively new compared with the other DP mechanisms. So MF may be ambiguous if a reader is not familiar with the ancestors of this work (i.e., [14, 16]), as some readers may be confused DP MF problems (e.g. [1*, 2*]) with the MF mechanism at the first glance. Introducing problem formulation in (the beginning of) the introduction section may help readers evaluate and understand the value of the paper.\n- The explanation of why the MF mechanism can help and how the proposed methods are derived in this paper is not easy to follow. \n- It is unclear what are benefits one can get by following the participation schema and decomposition method proposed methods. There may be some discussion scattered around the paper, but a summary (via a table) comparing the results of this paper to the existing ones may deliver the results more directly to the readers.\n- The key algorithms are most deferred to the appendix. So main text itself is not self-contained and reader-friendly (readers have to jump between the main text and the appendix). At least some algorithms closely related to the main contribution of the paper, like the sampling scheme, should be stated in the main text, not just the theoretical results using this algorithm.\n\n2. Some experimental results may need further explanation. \n- Why the BANDMF and  MULTI-EPOCH MF tends to introduce a similar level of noise as DP-SGD when the number of epoch increases?\n- What is the exact RMSE for BANDMF, MULTI-EPOCH MF and DP-SGD in Figure 4? Also, how should one understand the relationship between RMSE and accuracy (From Table 5 in appendix, smaller noise in DP-SGD can have worse performance than ampl MF)?\n\n\n[1*]Hyejin Shin, Sungwook Kim, Junbum Shin, and Xiaokui Xiao. 2018. Privacy-enhanced matrix factorization for recommendation with local diferential privacy. IEEE Transactions on Knowledge and Data Engineering 30, 9 (2018), 1770–1782.\n\n[2*] Zitao Li, Bolin Ding, Ce Zhang, Ninghui Li, and Jingren Zhou. Federated Matrix Factorization with Privacy Guarantee. PVLDB, 15(4): 900 - 913, 2022\n\nQUESTIONS:\nRefer to the Weaknesses\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-23"}