Title: DP-Mix: Mixup-based Data Augmentation for Differentially Private Learning
Venue: NeurIPS 2023
Accepted: yes
Keywords: differential privacy

deep learning

data augmentation
Abstract: Data augmentation techniques, such as image transformations and combinations, are highly effective at improving the generalization of computer vision models, especially when training data is limited. However, such techniques are fundamentally incompatible with differentially private learning approaches, due to the latter’s built-in assumption that each training image’s contribution to the learned model is bounded. In this paper, we investigate why naive applications of multi-sample data augmentation techniques, such as mixup, fail to achieve good performance and propose two novel data augmentation techniques specifically designed for the constraints of differentially private learning. Our first technique, DP-Mix_Self, achieves SoTA classification performance across a range of datasets and settings by performing mixup on self-augmented data. Our second technique, DP-Mix_Diff, further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. We open-source the code at https://github.com/wenxuan-Bao/DP-Mix.

DP-Mix: Mixup-based Data Augmentation for Differentially Private Learning

Abstract

Data augmentation techniques, such as image transformations and combinations, are highly effective at improving the generalization of computer vision models, especially when training data is limited. However, such techniques are fundamentally incompatible with differentially private learning approaches, due to the latter's built-in assumption that each training image's contribution to the learned model is bounded. In this paper, we investigate why naive applications of multisample data augmentation techniques, such as mixup, fail to achieve good performance and propose two novel data augmentation techniques specifically designed for the constraints of differentially private learning. Our first technique, DP-MIXSELF, achieves SoTA classification performance across a range of datasets and settings by performing mixup on self-augmented data. Our second technique, DP-MIXDIFF, further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. We open-source the code at https://github.com/wenxuan-Bao/DP-Mix .

1 Introduction

Differential privacy (DP) [11, 12] is a well-established paradigm for protecting data privacy, which ensures that the output of computation over a dataset does not reveal sensitive information about individuals in the dataset. However, training models with DP often incur significant performance degradation, especially when strong privacy guarantees are required or the amount of training data available is limited.

One class of techniques to overcome limited training data in classical (non-private) learning is data augmentation. Unfortunately, the analysis of differentially private learning mechanisms requires that the influence of each training example be limited, so naively applying data augmentation techniques is fundamentally incompatible with existing differential private learning approaches. Therefore, new approaches are required to leverage data augmentation.

Recently, De et al. [9] showed one way to incorporate simple data augmentation techniques, such as horizontal flips and cropping, into differentially private training. Their approach creates several self-augmentations of a training example and averages their gradients before clipping. This procedure is compatible with differential privacy because each training example only impacts the gradients of the self-augmentations which are aggregated together before clipping, thus preserving the sensitivity bound. However, this requires using data augmentation techniques that operate on a single input example, thus excluding large classes of multi-sample techniques such as mixup [46, 16, 38, 47, 6] and cutmix [44, 8]. Furthermore, as shown in [9] their approach quickly hits diminishing returns after 8 or 16 self-augmentations.

Text Prompt:

A photo of a <class_name>

Real Sample:

Augmentations:

Mixup

Augmentations:

grad[0]

grad[1]

grad[n-1]

grad[n]

grad[n+1]

grad[2n-1]

DP-MIXSELF :

clip(mean(grad[:n]))

DP-MIXDIFF :

clip(mean(grad[:2n]))

In this paper, we leverage multi-sample data augmentation techniques, specifically mixup, to improve differentially private learning 1 . We first show empirically that the straightforward application of mixup, i.e., using microbatching, fails to improve performance, even for modest privacy budgets. This is because microbatching inherently requires a higher noise level for the same privacy guarantee.

To overcome this, we propose a technique to apply mixup in the per-example DP-SGD setting by applying mixup to self-augmentations of a training example. This technique achieves SoTA classification performance when training models from scratch and when fine-tuning pre-trained models. We also show how to further enhance classification performance, by using a text-to-image diffusion-based model to produce class-specific synthetic examples that we can then mixup with training set examples at no additional privacy cost.

2 Background & Related Work

2.1 Differential Privacy & DP-SGD

Differential privacy (DP) [11] has become the standard framework for provable privacy guarantees.

Definition 1 (( ε, δ )-Differential Privacy) . A mechanism M (randomized algorithm) satisfies ( ε, δ ) -differential privacy if for any neighboring datasets D , D ′ and any output set S ⊆ Range( M ) , we have: Pr( M ( D ∈ S ) ≤ exp( ε ) Pr( M ( D ′ ∈ S ) + δ .

In the definition ε > 0 is called the privacy budget and 0 < δ < 1 . Datasets D,D ′ are neighboring if one can be obtained from the other by adding or removing one data point.

DP-SGD. To train a machine learning model with differential privacy (Definition 1), we use Differentially Private Stochastic Gradient Descent (DP-SGD). DP-SGD was proposed by Abadi et al. [2] as a direct replacement for SGD. Informally, for differential privacy to be satisfied, each weight update must hide the presence or absence of any example in the training set (and thus the minibatch). Consider a minibatch B with n examples. The weight update equation of (minibatch) SGD is: w j +1 = w j -ηg j ( B ) , where g j ( B ) = ∇ w l ( B ; w j ) is the gradient of the loss on B with

respect to the parameters w and η is the learning rate. Remark that inclusion or exclusion of a single example in minibatch B can completely change the minibatch aggregate gradient g j ( B ) . To avoid this and satisfy differential privacy, DP-SGD first clips individual gradients and then adds Gaussian noise to the average gradient:

where g i is the gradient of the loss on example i of minibatch B with respect to the parameters and clip C { g } = g · min { 1 , C || g || 2 } , where C > 0 is a constant. By clipping individual example gradients to norm C , the sensitivity of the gradient sum to adding or removing an example is guaranteed to be at most C . After that, adding Gaussian noise with standard deviation Cσ satisfies DP because it is an application of the Gaussian mechanism [12]. The noise level σ is calibrated to the privacy parameters ε and δ .

Since the gradient update only touches the minibatch B , which was sampled from the entire training dataset, we can use amplification by sampling theorems [3] with a sampling rate of n/N where N is the size of the dataset and n = | B | . To obtain a differential privacy guarantee over the entire training procedure (which potentially touches each training example multiple times), we apply composition results [2]. The full procedure is presented in Algorithm 2 in the supplementary material.

Microbatch DP-SGD. Abadi et al. [2] proposed DP-SGD with per-example gradient clipping. But other researchers have proposed microbatch clipping instead [23], which views a minibatch B as composed of m microbatches, each of n/m examples. With microbatch clipping, we clip the average of the microbatch's gradients instead of the per-example gradients. Note that using microbatches of size 1 is equivalent to per-example clipping.

The noisy gradient for a microbatch of size b > 1 (assuming b divides n ) is:

where g i,j denotes the gradient vector the j th example in the i th microbatch.

The drawback of this approach is that despite clipping microbatches gradients with a clipping norm of C , the sensitivity of adding or removing one example is actually 2 C (as pointed out recently by Ponomareva et al. [29]). On a per-example basis, more noise is added.

Data Augmentation and DP. Data augmentation cannot be straightforwardly applied with differential privacy because the privacy analysis requires a bound on the sensitivity of any example in the training set. For example, naively applying data augmentation prior to training, by say creating k augmentations of each training set example, compromises the privacy guarantee. Existing privacy analyses do not apply because adding or removing an example in the training set now potentially affects the gradients of k examples in each training epoch.

De et al. [9] proposed a way to use single-sample data augmentation. Their idea is to do per-example clipping but to create augmentations of each example (e.g., horizontal flip and cropping) and average the corresponding gradient before clipping. This is compatible because each training set example still only affects one term of the sum of Eq. (1). However, this idea cannot be used for more sophisticated multi-sample data augmentations techniques like mixup [46] that take two or more examples as input to create each augmentation.

2.2 Related work.

SoTA performance in Differential Privacy Machine Learning. Recent studies [9, 5, 34, 22, 27] achieve new SoTA performance in differentially private learning using diverse methods. De et al. [9] modified a Wide-ResNet model's training method, advocating large batches, group normalization, weight standardization, and self-augmentation, achieving SoTA performance on CIFAR-10 with DP-SGD. Sander et al. [34] introduced a technique using Total Amount of Noise (TAN) and a scaling law to reduce the computational expense of hyperparameter tuning in DP-SGD, achieving SoTA

performance on ImageNet and computational cost reductions by a factor of 128. Bu et al. [5] presented mixed ghost gradient clipping, which eliminates per-sample gradient computations, approximates non-private optimization, and achieves SoTA performance on the CIFAR-10 and CIFAR-100 datasets by fine-tuning pre-trained transformer models. Panda et al. [27] propose an accelerated fine-tuning method, which enables them to achieve SoTA performance on the CIFAR-10 and CIFAR-100 datasets.

Mixup techniques. Mixup was initially proposed by Zhang et al. [46]. This technique is applied to raw input data and its corresponding one-hot encoded labels. Experimental results presented in their work indicate that Mixup enhances model performance and robustness. However, Guo et al. [16] discovered that input mixup may encounter the manifold intrusion problem when a mixed example coincides with a real sample. To address this, they proposed Adaptive Mixup, which they demonstrated outperforms the original method. To mitigate the incongruity in Mixup data, Yun et al. [44] proposed Cutmix, which replaces a portion of one sample with another. Instead of applying mixup at the input level, Verma et al. [39] implemented mixup within the intermediate layers of the model. Several works have utilized Mixup in the context of Differential Privacy (DP), such as Borgnia et al. [4], which used it as a defense against backdoor attacks, and Xiao et al. [40], which used it to introduce randomness into the training process, or in other settings such as Split learning [26]. To the best of our knowledge, no previous work has employed Mixup as a data augmentation strategy to enhance model performance in differentially private learning.

Diffusion models. Diffusion models [36, 19, 37, 10, 24] have emerged as a powerful class of generative models that leverage the concept of stochastic diffusion processes to model complex data distributions, offering a promising alternative to traditional approaches such as Generative Adversarial Networks (GANs) [14] and Variational Autoencoders (VAEs) [20]. By iteratively simulating the gradual transformation of a simple initial distribution into the desired target distribution, diffusion models provide a principled framework for generating high-quality samples however, the implicit guidance results in a lack of user control over generated images. Recently there has been a lot of interest in text-to-image models [31, 33, 32, 13, 25, 30] due to their ability to generate entirely new scenes with previously unseen compositions solely based on natural language. In this work, we use class labels as text input to the text-to-image diffusion model [13] to generate diverse synthetic samples for augmenting the dataset.

3 Method

Given two examples ( x 0 , y 0 ) and ( x 1 , y 1 ) and mixing parameter λ , mixup creates augmentations as:

In our experiments, λ is sampled from a β distribution with α = 0 . 2 . In other words, the augmented example image x is simply a linear combination of two individual examples x 0 , x 1 and its label y is also a linear combination of the two individual examples' labels (one-hot encoded). Typically the two examples ( x 0 , y 0 ) and ( x 1 , y 1 ) are selected randomly from the training data. To use mixup while preserving differential privacy, we must find a way to account for its privacy impact.

For DP training, we cannot use Eq. (3) to create an augmented training set (e.g., by repeatedly taking two input examples from the sensitive training set and mixing them up) without affecting the privacy budget, as the sensitivity of the clipped-gradients sum of the augmented minibatch would then be (at least) 2 C (and not C ). To see why, observe that an original example z would impact multiple terms of the sum in Eq. (1) (the one involving the gradient of z and also the one(s) involving the gradient of any mixed-up pair(s) involving z ). Even with exactly one mixed-up pair per original example, adding or removing an example from the training set would impact two terms in the clipped-gradients sum, potentially changing the aggregated gradient by 2 C . In a pathological case, the sum could go from C⃗ e for some ⃗ e to -C⃗ e . The sensitivity being 2 C means that the scale of Gaussian noise added must be doubled to obtain the same privacy guarantee as we would have without mixup.

We empirically investigate the impact of doubling the noise for training a WRN-16-4 model on CIFAR-10. Specifically, we use a microbatch size of 2 and do input mixup by applying Eq. (3) to the two examples in each microbatch. We then add the mixed up example to the microbatch or let the microbatch consist only of the mixed up example. Then, following microbatch DP-SGD, we clip the gradient of the microbatch and add Gaussian noise to the aggregated gradient sum. Nevertheless, it

could be that empirically, the benefits of mixup outweigh the additional noise. Results in Table 1 show that despite mixup providing a clear benefit (compared to traditional DP-SGD) the microbatch size 2 setting is inherently disadvantaged. Better performance is obtained without mixup for per-example DP-SGD. The negative impact of noise due to the increased sensitivity dwarfs any benefits of mixup.

3.1 DP-Mixup

We propose a technique to apply mixup with per-example DP-SGD. The challenge is that with per-example DP-SGD we only have a single example to work with - else we again violate the sensitivity bound required for privacy analysis.

DP-MIXSELF and DP-MIXDIFF. The basic observation behind our technique is that we can freely apply mixup to any augmentations derived from a single data point ( x, y ) or from ( x, y ) and synthetic samples obtained independently from a diffusion model. If we apply all augmentations, including mixup, before gradient clipping then the privacy guarantee and analysis holds according to the augmentation multiplicity insight from [9].

We assume that we have a randomized transformation function T that can be applied to any example's features x so that T ( x ) is a valid single-sample data augmentation of x . We may also have access to a generative model from which we can produce a set D of synthetic samples ahead of time. For example, we can use a txt2img diffusion model to create labeled examples ( z 1 , y 1 ) , ( z 2 , y 2 ) , . . . , ( z m , y m ) using unguided diffusion. In experiments, we generate these samples using the text prompt 'a photo of a <class name>' . Since these 'synthetic' examples are generated without accessing the (sensitive) training dataset, they can be used with no additional privacy cost.

Given a single data point ( x, y ) , our technique consists of three steps to produce a set of augmentations. The gradients of each augmentation are then computed and aggregated, and the aggregated gradient is clipped and noised as in DP-SGD. The first step takes x and repeatedly applies to it the randomized transformation function T , resulting in a set S = { ( x 1 , y ) , ( x 2 , y ) , . . . , ( x K BASE , y ) } of 'base' selfaugmentations. The second step (optionally) augments the set S with K DIFF randomly selected synthetic examples from the set D created using the diffusion model. If no diffusion model is available, we omit this step, which is equivalent to setting K DIFF = 0 . In the third and final step, we repeatedly apply Eq. (3) K SELF > 0 times to two randomly selected samples from the augmentation set S , thereby obtaining a set S ′ of K SELF mixed up examples. The final set of augmentations is then the concatenation of the base augmentations and the mixup augmentations, i.e., S ∪ S ′ .

From this final set of augmentations, we perform DP-SGD training. That is, we compute the noisy gradient as:

where K = K BASE + K DIFF + K SELF is the total number of augmentations and g i,k denotes the gradient of the k th augmentation of the i th training example. The same privacy analysis and guarantee are obtained in this case as in vanilla DP-SGD because the influence of each training example x on the noisy gradient ˆ g is at most C (observe that the gradients of all augmentations' are clipped together).

The method is described in Algorithm 1. An important remark is that the self-augmentation method of De et al. [9] is a special case of our method, corresponding to setting K DIFF = 0 and K SELF = 0 , i.e., one only uses the base augmentation set and no mixup.

Algorithm 1 DP-SGD with mixup (DP-MIXSELF and DP-MIXDIFF).

We define two variants of our method based on the availability of diffusion samples. If we have access to a diffusion model so that K DIFF > 0 , we call the method DP-MIXDIFF . In that case, the pool from which examples are selected for mixup includes synthetic samples from the diffusion samples. Otherwise, K DIFF = 0 and the proposed method has the effect of applying mixup on randomly selected self-augmentations of a single original example, thus we call this variant DP-MIX SELF . Interestingly, DP-MIXSELF is not completely faithful to classical mixup because there is only one original example being mixed up and the label is unchanged.

Finally, we point out that although our focus is on mixup, other multi-sample data augmentation techniques such as cutmix and others [44, 8] can be applied in the third step.

4 Experimental Setup

Datasets. We use CIFAR-10, CIFAR-100, EuroSAT, Caltech 256, SUN397 and Oxford-IIIT Pet. The details of these datasets are in Appendix C in Supplemental materials.

Models. We use the following models/model architectures.

Wide ResNet (WRN) [45] is a variant of the well-known ResNet (Residual Network) model [17], which is commonly used for image classification tasks. It increases the number of channels in convolutional layers (width) rather than the number of layers (depth). WRN-16-4 is used in De et al. [9] and we use the same model to ensure a fair comparison.

Vit-B-16 and ConvNext are pre-trained on the LAION-2B dataset [35], the same pre-trained dataset as for our diffusion models, which we obtained from Open Clip 2 . We add a linear layer as a classification layer. We only fine-tune this last layer and freeze the weights of other layers.

Setup. To implement DP-SGD, we use Opacus [1] and make modifications to it. For training from scratch experiments, we set the batch size to 4096 , the number of self-augmentation to 16 , the clip bound to C = 1 , and the number of epochs to 200 . For fine-tuning experiments, we change the batch size to 1000 and the number of epochs to 20 for EuroSAT and 10 for all other datasets. Reported test accuracies are averaged based on at least three independent runs and we also report the standard deviation. We provide additional details on our experimental setups in supplementary materials.

Selection of pre-training data, diffusion model, and fair comparisons. We take great care to ensure that our experiments lead to a fair comparison between our methods and alternatives such as Self-Aug (prior SoTA). In particular, all methods have access to the exact same training data. We also tune the hyperparameters of each method optimally (e.g., K BASE for Self-Aug). We use the same pre-trained models (Vit-B-16 and ConvNext from Open Clip) to compare our methods to others (Self-Aug and Mixed Ghost Clipping).

Since DP-MIXDIFF uses a diffusion model to generate synthetic examples, this could make the comparison unfair because other methods do not use synthetic samples. To avoid this, we purposefully use the exact same pre-training data (i.e., LAION-2B) to pre-train models as was used to train the diffusion model. This avoids the issue of the synthetic examples somehow 'containing' data that other methods do not have access to. Moreover, we conducted experiments (check Table 6) to show that the synthetic examples themselves do not boost performance. It is the way they are used by DP-MIXDIFF that boosts performance. Finally, out of the six datasets we used for evaluation, none of them overlap with the LAION-2B dataset (to the best of our knowledge).

5 Experiments

5.1 Training from Scratch with DP

Since DP-MIXDIFF relies on synthetic samples from diffusion models, it would not be fair to compare it to prior SoTA methods that do not have access to those samples in the training from scratch setting. Therefore, we focus this evaluation on DP-MIXSELF . For this, we use a WRN-16-4 model. Our baseline from this experiment is De et al. [9] who use a combination of techniques to improve performance, but mostly self-augmentation. Results in Table 2 show that DP-MIXSELF consistently provides improvements across datasets and privacy budgets.

We observed differences between the results reported by De et al. [9] using JAX and the reproduction by Sander et al. [34] on Pytorch. In our supplemental materials, Table 11 presents our reproduction of De et al. [9] using their original JAX code alongside the DP-MIX SELF implementation.

5.2 Finetuning with DP

We consider two pretrained models Vit-B-16 and ConvNext. As baselines/prior SoTA we consider De et al. [9] and the Mixed Ghost Clipping technique of Bu et al. [5]. Results are shown in Table 3.

We observe that our proposed DP-MIXSELF method yields significant improvements over all prior methods across datasets and privacy budgets. We also observe that DP-MIXDIFF , which uses samples from the diffusion model, significantly outperforms DP-MIXSELF on datasets such as Caltech256, SUN397, and Oxford-IIIT Pet. Notably, when the privacy budget is limited, such as ε = 1 , we observe remarkable improvements compared to DP-MIXSELF (e.g., 8 . 5% on Caltech256 using Vit-B-16). This shows the benefits of incorporating diverse images from the diffusion model via mixup.

On the other hand, we observe that diffusion examples do not provide a benefit for datasets such as CIFAR-10 and EuroSAT. We investigate the cause of this empirically in Appendix B (supplementary materials). On these datasets, DP-MIXDIFF only sometimes outperforms the prior baselines, but DP-MIXSELF provides a consistent improvement, suggesting that samples from the diffusion model

can inhibit performance. On CIFAR-100, DP-MIXDIFF outperforms other methods only at low privacy budgets ( ε ≤ 2 ), with DP-MIXSELF providing the best performance in the high privacy budget regime.

6 Ablation Study: Why Does DP-MIX Improve Performance?

We perform ablation experiments to better understand why our methods consistently and significantly outperform the prior SoTA techniques.

6.1 Understanding Self-Augmentations

Since DP-MIXSELF does not alter the label and involves applying mixup to (augmentations of) a single original training example, the method could be viewed as just another single-sample data augmentation technique. The question then becomes what augmentation techniques improve performance when using differential privacy and why.

De et al. [9] use flipping and cropping as self-augmentation (Self-Aug). We perform experiments using several widely used augmentation techniques (based on Chen et al. [7] - Colorjitter, Translations and Rotations, Cutout, Gaussian Noise, Gaussian Blur, and Sobel Filter) in addition to Self-Aug to compare them to DP-MIXSELF. We set K BASE = 16 as in previous experiments. Results are shown in Table 4, where the second to last column combines all augmentations together (randomly chosen). We observe that these augmentations do not enhance performance to the same degree as DP-MIXSELF . In a few cases, the augmentations improve performance slightly above Self-Aug, but some of them also diminish performance.

6.2 Number of Self-Augmentations

Increasing the number of self-augmentations beyond 16 does not improve performance [9]. This was also pointed out recently by Xiao et al. [41]. In fact, sometimes increasing the number of

self-augmentations hurts performance. We perform experiments by varying the number of selfaugmentations ( K BASE ) on CIFAR-10. Results are shown in Table 5. We observe that K BASE = 16 is optimal for the self-augmentations proposed by De et al. [9]. However, we obtain significantly better performance DP-MIXSELF for K = 32 ( K BASE = 16 , K SELF = 16 and K DIFF = 0 ). Recall that setting K DIFF = K SELF = 0 in Algorithm 1 recovers the Self-Aug method of [9].

6.3 Pretraining or DP-MIXDIFF?

Since DP-MIXDIFF uses synthetic samples from a diffusion model, we consider pretraining the model on the synthetic samples D from the diffusion model with SGD prior to fine-tuning with DP. The results, presented in Table 6, indicate that pretraining on D does not improve the model's performance. This indicates that the improved performance of DP-MIXDIFF results from the way it uses the diffusion samples, not just from having access to diffusion samples.

6.4 Effect of DP-MIX on Training Data

In Table 7, we compare the distributions of the effective train sets produced by different data augmentation techniques against those of the original train and test sets, i.e., we measure the Fréchet Inception Distance (FID), where lower FID values indicate more similarity between the datasets. Note, the FIDs are consistent with test accuracy across datasets and methods. For example, the FID of Self-Aug + Colorjitter is significantly larger than FID of Self-Aug, explaining why adding Colorjitter decreases test accuracy: it results in data less similar to train and test sets. Similarly, the FID for DP-MIXDIFF for EuroSAT is much larger compared to the other datasets, which explains reduced test accuracy relative to the other methods. In Table 8, we compare the FID between the original train and test sets with the FID between the original train set and the synthetic samples generated by the text-to-image diffusion model that we employ for DP-MIXDIFF . Note the much greater FID between the train set and the diffusion samples. This large domain gap may explain why, as shown in Table 6,

pretraining on the diffusion samples result in much worse performance compared to our proposed DP-MIXDIFF.

6.5 Influence of K BASE , K SELF and K DIFF

Recall, K BASE is the number of base self-augmentations, K SELF is the number of mixups, and K DIFF is the number of synthetic diffusion samples used. We vary K BASE , K SELF and K DIFF values and report their performance in Table 9. We observe that selecting K DIFF = 2 or K DIFF = 4 and setting K SELF ≤ K BASE gives good results overall. In this paper, we used K BASE = 16 , K SELF = 18 and K DIFF = 2 for most cases as it provides good overall results across many datasets and settings 3 .

7 Conclusions

We studied the application of multi-sample data augmentation techniques such as mixup for differentially private learning. We show empirically that the most obvious way to apply mixup, using microbatches, does not yield models with low generalization errors as microbatching is at an inherent disadvantage. We then demonstrate how to harness mixup without microbatching by applying it to self-augmentations of a single training example. This provides a significant performance increase over the prior SoTA. Finally, we demonstrate that producing some augmentations using text-to-image diffusion models further enhances performance when combined with mixup.

Acknowledgments

This work was supported in part by the National Science Foundation under CNS-2055123. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation.

References

Opacus. https://github.com/pytorch/opacus .

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages 308-318, 2016.

B. Balle, G. Barthe, and M. Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in Neural Information Processing Systems , 31, 2018.

E. Borgnia, J. Geiping, V. Cherepanova, L. Fowl, A. Gupta, A. Ghiasi, F. Huang, M. Goldblum, and T. Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations. arXiv preprint arXiv:2103.02079 , 2021.

Z. Bu, J. Mao, and S. Xu. Scalable and efficient training of large convolutional neural networks with differential privacy. In Advances in Neural Information Processing Systems .

L. Carratino, M. Cissé, R. Jenatton, and J.-P. Vert. On mixup regularization. The Journal of Machine Learning Research , 23(1):14632-14662, 2022.

T. Chen, S. Kornblith, M. Norouzi, and G. Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning , pages 1597-1607. PMLR, 2020.

H.-P. Chou, S.-C. Chang, J.-Y. Pan, W. Wei, and D.-C. Juan. Remix: rebalanced mixup. In Computer Vision-ECCV 2020 Workshops: Glasgow, UK, August 23-28, 2020, Proceedings, Part VI 16 , pages 95-110. Springer, 2020.

S. De, L. Berrada, J. Hayes, S. L. Smith, and B. Balle. Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650 , 2022.

P. Dhariwal and A. Nichol. Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems , volume 34, pages 8780-8794, 2021.

C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pages 265-284. Springer, 2006.

C. Dwork, A. Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science , 9(3-4):211-407, 2014.

R. Gal, Y. Alaluf, Y. Atzmon, O. Patashnik, A. H. Bermano, G. Chechik, and D. Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion, 2022.

I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial nets. In Advances in neural information processing systems , pages 2672-2680, 2014.

G. Griffin, A. Holub, and P. Perona. Caltech-256 object category dataset. 2007.

H. Guo, Y. Mao, and R. Zhang. Mixup as locally linear out-of-manifold regularization. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 3714-3722, 2019.

K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

P. Helber, B. Bischke, A. Dengel, and D. Borth. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing , 12(7):2217-2226, 2019.

J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems , volume 33, pages 6840-6851, 2020.

D. P. Kingma and M. Welling. Auto-Encoding Variational Bayes. In 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings , 2014.

A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Y. Li, Y.-L. Tsai, X. Ren, C.-M. Yu, and P.-Y. Chen. Exploring the benefits of visual prompting in differential privacy. arXiv preprint arXiv:2303.12247 , 2023.

H. B. McMahan, G. Andrew, U. Erlingsson, S. Chien, I. Mironov, N. Papernot, and P. Kairouz. A general approach to adding differential privacy to iterative training procedures. arXiv preprint arXiv:1812.06210 , 2018.

A. Q. Nichol and P. Dhariwal. Improved denoising diffusion probabilistic models. In Proceedings of the 38th International Conference on Machine Learning , pages 8162-8171, 2021.

A. Q. Nichol, P. Dhariwal, A. Ramesh, P. Shyam, P. Mishkin, B. McGrew, I. Sutskever, and M. Chen. GLIDE: towards photorealistic image generation and editing with text-guided diffusion models. In International Conference on Machine Learning, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA , pages 16784-16804, 2022.

S. Oh, J. Park, S. Baek, H. Nam, P. Vepakomma, R. Raskar, M. Bennis, and S.-L. Kim. Differentially private cutmix for split learning with vision transformer. arXiv preprint arXiv:2210.15986 , 2022.

A. Panda, X. Tang, V. Sehwag, S. Mahloujifar, and P. Mittal. Dp-raft: A differentially private recipe for accelerated fine-tuning. arXiv preprint arXiv:2212.04486 , 2022.

O. M. Parkhi, A. Vedaldi, A. Zisserman, and C. Jawahar. Cats and dogs. In 2012 IEEE conference on computer vision and pattern recognition , pages 3498-3505. IEEE, 2012.

N. Ponomareva, H. Hazimeh, A. Kurakin, Z. Xu, C. Denison, H. B. McMahan, S. Vassilvitskii, S. Chien, and A. G. Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research , 77:1113-1201, 2023.

A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen. Hierarchical text-conditional image generation with CLIP latents. CoRR , 2022.

R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10684-10695, 2022.

N. Ruiz, Y. Li, V. Jampani, Y. Pritch, M. Rubinstein, and K. Aberman. Dreambooth: Fine tuning textto-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 22500-22510, 2023.

C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. L. Denton, K. Ghasemipour, R. Gontijo Lopes, B. Karagol Ayan, T. Salimans, J. Ho, D. J. Fleet, and M. Norouzi. Photorealistic text-to-image diffusion models with deep language understanding. In Advances in Neural Information Processing Systems , volume 35, pages 36479-36494, 2022.

T. Sander, P. Stock, and A. Sablayrolles. Tan without a burn: Scaling laws of dp-sgd. In International Conference on Machine Learning , pages 29937-29949. PMLR, 2023.

C. Schuhmann, R. Beaumont, R. Vencu, C. Gordon, R. Wightman, M. Cherti, T. Coombes, A. Katta, C. Mullis, M. Wortsman, et al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems , 35:25278-25294, 2022.

J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In Proceedings of the 32nd International Conference on Machine Learning , pages 2256-2265, 2015.

J. Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. ICLR , 2021.

S. Thulasidasan, G. Chennupati, J. A. Bilmes, T. Bhattacharya, and S. Michalak. On mixup training: Improved calibration and predictive uncertainty for deep neural networks. Advances in Neural Information Processing Systems , 32, 2019.

V. Verma, A. Lamb, C. Beckham, A. Najafi, I. Mitliagkas, D. Lopez-Paz, and Y. Bengio. Manifold mixup: Better representations by interpolating hidden states. In International conference on machine learning , pages 6438-6447. PMLR, 2019.

H. Xiao and S. Devadas. Towards understanding practical randomness beyond noise: Differential privacy and mixup. Cryptology ePrint Archive , 2021.

H. Xiao, Z. Xiang, D. Wang, and S. Devadas. A theory to instruct differentially-private learning via clipping bias reduction. In 2023 IEEE Symposium on Security and Privacy (SP) , pages 2170-2189. IEEE Computer Society, 2023.

J. Xiao, K. A. Ehinger, J. Hays, A. Torralba, and A. Oliva. Sun database: Exploring a large collection of scene categories. International Journal of Computer Vision , 119:3-22, 2016.

J. Xiao, J. Hays, K. A. Ehinger, A. Oliva, and A. Torralba. Sun database: Large-scale scene recognition from abbey to zoo. In 2010 IEEE computer society conference on computer vision and pattern recognition , pages 3485-3492. IEEE, 2010.

S. Yun, D. Han, S. J. Oh, S. Chun, J. Choe, and Y. Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference on computer vision , pages 6023-6032, 2019.

S. Zagoruyko and N. Komodakis. Wide residual networks. british machine vision conference (bmvc), 2016.

H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations , 2018.

L. Zhang, Z. Deng, K. Kawaguchi, A. Ghorbani, and J. Zou. How does mixup help with robustness and generalization? 2020.

A Algorithm: DP-SGD

Algorithm 2

Require: Training data x 1 , ..., x N , loss function L ( θ ) = N i L ( θ, x i ) . Parameters: learning rate η t , noise scale σ , group size B , gradient norm bound C .

Ensure: θ T and compute the overall privacy cost ( ε, δ ) using a privacy accounting method

B Additional Experimental Results

B.1 How useful is the synthetic data?

Let S 1 and S 2 denote equally sized disjoint subsets of the private dataset, and D an equally sized set of synthetic samples generated via diffusion, as described in Section 3.1.

For this experiment, we consider three different training methods.

Method A : Fine-tune on S 1 using DP-MIXSELF.

Method B : Fine-tune on S 1 using DP-MIXDIFF with mixup images sampled from D .

Method C : Same as Method B, but replace set D with set S 2 . Note, we assume that S 2 is publicly available, so accessing it during training does not incur a privacy cost.

The intuition behind this experiment is that method C provides an upper bound for both A and B, since, in the best case, the distribution of the synthetic data would exactly match that of the private data. The experimental results, presented in Table 10, validate this intuition.

For CIFAR-100, Caltech256, SUN397, and Oxford Pet, method C outperforms method A. Consistent with this, method B, our proposed DP-MIXDIFF , also provides a performance boost. On the other hand, for CIFAR-10 and EuroSAT, method C, despite directly using private data for mixup, does not meaningfully improve performance. Similarly, method B also does not improve performance. For EuroSAT, method B slightly decreases performance, due to the large domain gap (large FID) between the synthetic and private data.

B.2 Reproducing De et al. [9] and DP-MIXSELF in JAX

For completeness, we train WRN-16-4 on CIFAR10 using Self-Aug and our proposed DP-MIXSELF using [9]'s official JAX code ( https://github.com/deepmind/jax_privacy ). As in [9], we repeat each experiment 5 times and report median test accuracy in Table 11. The results are consistent

with those presented in the rest of our paper - DP-MIXSELF outperforms Self-Aug for different privacy budgets.

B.3 Pure-DP-MIXDIFF

To demonstrate the influence of K BASE in our method, we set K BASE = 0 and call it Pure-DP-MIXDIFF . In effect Pure-DP-MIXDIFF is simply mixing up the synthetic examples themselves. We test it on CIFAR-100 and represent it in Table 12. We can see that Pure-DP-MIXDIFF offers much worse performance than both DP-MIXSELF and DP-MIXDIFF, although it still offers better performance than Self-Aug due to the beneficial effects of mixup. More generally, we think that Pure-DP-MIX DIFF will tend to worsen an overfitting problem whenever there is a large domain gap between the original training data and the diffusion samples. DP-MIXDIFF does not suffer from this problem because it ensures that (augmented versions) of the original training data samples are seen during training.

B.4 Running time

We provide the running time for different methods in Table 13. All experimental runs utilized a single A100 GPU and were based on the same task of finetuning the Vit-B-16 model on the Caltech256 dataset for 10 epochs. Due to additional augmentation steps, the training time of our methods is longer than prior work.

B.5 Effect of Mixup on Gradients

We study what happens to gradients and parameter updates during training for our methods versus Self-Aug. Fig. 2 plots the per-parameter gradient magnitude averaged over samples at each epoch (prior to clipping and noise adding). The histogram shows the data averaged over all training epochs and the X% color lines show that data only for the epoch at X% of the total training process. There are 10 epochs for this experiment - for example, the line for 20% shows the data for epoch 2.

The figure shows more concentrated values for our methods compared to the Self-Aug baseline, which suggests more stable training and faster convergence. Standard deviations for CIFAR-10 with Self-Aug, DP-MIXSELF and DP-MIXDIFF are: 2 . 16 · 10 -3 , 9 . 76 · 10 -4 and 9 . 59 · 10 -4 , respectively. For Caltech256 they are: 1 . 43 · 10 -3 , 1 . 07 · 10 -3 and 9 . 32 · 10 -4 , respectively. This is consistent with experimental results of test accuracies for each method.

0.000

0.002

0.004

0.006

0.008

0.0

0.2

0.5

0.8

1.0

Density

Self-Aug

0.000

0.002

0.004

0.006

0.008

DP

MIXSELF

0.000

0.002

0.004

0.006

0.008

DP

MIXDIFF

20%

40%

60%

80%

100%

(a) CIFAR-10

0.000

0.002

0.004

0.006

0.008

0.0

0.2

0.5

0.8

1.0

1.2

Density

Self-Aug

0.000

0.002

0.004

0.006

0.008

DP

MIXSELF

0.000

0.002

0.004

0.006

0.008

DP

MIXDIFF

20%

40%

60%

80%

100%

(b) Caltech256

C Additional Experimental Details

Datasets We use the following datasets:

CIFAR-10 is a widely-utilized dataset in the field of computer vision, serving as a standard for evaluating image recognition algorithms. Collected by Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton [21], this dataset is a crucial tool for machine learning research. The dataset consists of 60,000 color images, each sized at 32 × 32 pixels, and categorized into 10 different classes like cats, dogs, airplanes, etc. We use 50,000 data points for training, and 10,000 for the test set.

CIFAR-100 is a well-regarded dataset in the domain of computer vision, typically used for benchmarking image classification algorithms. This dataset, also collected by Krizhevsky et al. [21], is a key resource in machine learning studies. CIFAR-100 comprises 60,000 color images, each of 32x32 pixel resolution. What distinguishes it from CIFAR-10 is the higher level of categorization complexity; the images are sorted into 100 distinct classes instead of 10. We use 50,000 data points for training, and 10,000 for the test set.

EuroSAT [18] is a benchmark dataset for deep learning and image classification tasks. This dataset is composed of Sentinel-2 satellite images spanning 13 spectral bands and divided into ten distinct classes. It has 27,000 labeled color images which size is 64 × 64 . We use 21600 as the training set and 5400 as a test set.

Caltech 256 [15]. Caltech is commonly used for image classification tasks and comprises of 30607 RGB images of 257 different object categories. For our experiments, we designated 80% of these images for training and the remaining 20% for testing.

SUN397 The Scene UNderstanding (SUN) [42, 43] database contains 108,754 RGB images from 397 classes. For our experiments, we use 80% of these images for training and the remaining 20% for testing.

Oxford Pet [28] contains 37 classes of cats and dogs and we use 3680 images for training and the rest 3669 images for testing.

For all our experiments, we maintained the clip norm at C = 1 , with the exception of Mix-ghost clipping where we used C = 0 . 05 as required by the original paper [5] and its implementation 4 . The noise level was automatically calculated by Opacus based on the batch size, target ε , and δ , as well as the number of training epochs.

Implementation details of Section 3. In this experiment, we set K BASE = 16 and adjust the hyperparameters according to the recommendations in the original paper [9]. To facilitate the implementation in PyTorch and enable microbatch processing, we adapt our code based on two existing code bases 5 .

Implementation details of Section 5.1. In training our models from scratch, we adhere to a K BASE value of 16 and adjust the other hyperparameters in accordance with the guidelines provided in the original papers [9, 5]. For our fine-tuning experiments, we maintain the same K BASE value and perform hyperparameter searches in each case to ensure we utilize the optimal learning rate. Importantly, we

do not incorporate any learning rate schedules, as per the suggestions of other research papers [5, 9] that indicate such schedules do not yield performance improvements.

Implementation details of Section 5.2 and Appendix B. In order to generate synthetic samples, we feed the text prompt ' a photo of a <class name> ' to the diffusion model [13]. For each dataset, the number of synthetic samples we generate is equal to the number of real images in the dataset.

Source Code. Readers can find further experimental and implementation details in our open-source code at https://github.com/wenxuan-Bao/DP-Mix .

D Ethical Considerations & Broader Impacts

In this paper, we propose an approach to use multi-sample data augmentation techniques such as mixup to improve the privacy-utility tradeoff of differentially-private image classification. Since differential privacy offers strong guarantees, its deployment when training machine learning has the potential to substantially reduce harm to individuals' privacy. However, some researchers have observed that although the guarantee of differential privacy is a worst-case guarantee, the privacy obtained is not necessarily uniformly spread across all individuals and groups. Further, there is research suggesting that differential privacy may (in some cases) increase bias and unfairness, although these findings are disputed by other research.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes two data augmentation techniques, MIXUP-SELFAUG and MIXUP-DIFFUSION, for differentially private learning. The authors investigate why naive applications of multi-sample data augmentation techniques, such as mixup, fail to achieve good performance and propose these two techniques specifically designed for the constraints of differentially private learning. MIXUP-SELFAUG performs mixup on self-augmented data, which results in lower gradients norm average and variance leading to smoother training. MIXUP-DIFFUSION further improves performance by incorporating synthetic data from a pre-trained diffusion model into the mixup process. The paper also discusses the challenges of applying data augmentation techniques in the context of differential privacy and compares the proposed techniques with existing methods on various datasets. The experimental results show that the proposed techniques achieve state-of-the-art classification performance across a range of datasets and settings. Overall, the paper proposed effective data augmentation techniques that can improve the performance of machine learning models while preserving the privacy of sensitive data.\n\nSTRENGTHS:\nThis paper is easy to read. This paper considerately used DP-SGD for differentially private learning. These techniques improve the performance of mixup-based data augmentation. The paper also discusses the challenges of applying data augmentation techniques in the context of differential privacy.\n\nWEAKNESSES:\n1. The absence of a theoretical analysis for MIXUP-SELFAUG in the submitted work is notable. The authors have provided an intuition on why mixup could harm differential privacy and presented an alternative approach to mitigate this issue. It could further strengthen the paper if the authors could provide a theoretical guarantee for differential privacy.\n\n\n2. In relation to MIXUP-SELFAUG which doesn't mix labels, questions arise about why MIXUP-SELFAUG improves performance. The original intent of mixup, which is label interpolation for better performance, seems not fully addressed in this context. The authors could consider explaining their approach's effectiveness via intuition or mathematical formulation.\n\n[1] Zhang, Linjun, et al. \"How does mixup help with robustness and generalization?.\" ICLR 2021\n\n[2] Jeong, Jongheon, et al. \"Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness.\" NeurIPS 2021\n\n[3] Zhang, Linjun, et al. \"When and how mixup improves calibration.\" ICML 2022\n\n[4] Park, Chanwoo, Sangdoo Yun, and Sanghyuk Chun. \"A unified analysis of mixed sample data augmentation: A loss function perspective.\" NeurIPS 2022\n\n[5] Zou, Difan, et al. \"The benefits of mixup for feature learning.\" arXiv preprint arXiv:2303.08433 (2023).\n\n[6] Oh, Junsoo, and Chulee Yun. \"Provable Benefit of Mixup for Finding Optimal Decision Boundaries.\" ICML 2023\n\n\n3. Concerning the implementation of the diffusion model, there are a few considerations that the authors might need to address. The necessity for incorporating a diffusion model is not sufficiently justified in the current draft. For instance, the diffusion model used in this study is pretrained, which could potentially introduce the element of knowledge distillation. This raises the question: Is the observed performance improvement mainly due to distillation effects? Additionally, the use of a diffusion model not trained with DP-SGD could potentially pose issues for differential privacy learning. The authors are encouraged to provide clarification on these points.\n\n\n4. While the adoption of a diffusion model might benefit differential privacy, the paper could delve deeper into explaining why it's advantageous for ensuring differential privacy. A detailed discussion on this matter could provide readers with a better understanding of the authors' choice and its implications on the overall study. The authors' insights on this matter would be greatly appreciated.\n\n[1] Chourasia, Rishav, Jiayuan Ye, and Reza Shokri. \"Differential privacy dynamics of langevin diffusion and noisy gradient descent.\" NeurIPS 2021\n\n[2] Dockhorn, Tim, et al. \"Differentially private diffusion models.\" arXiv preprint arXiv:2210.09929 (2022).\n\n[3] Ghalebikesabi, Sahra, et al. \"Differentially Private Diffusion Models Generate Useful Synthetic Images.\" arXiv preprint arXiv:2302.13861 (2023).\n\n[4] Lyu, Saiyue, et al. \"Differentially Private Latent Diffusion Models.\" arXiv preprint arXiv:2305.15759 (2023).\n\nQUESTIONS:\nI want to clarify especially the second and third issues of the weakness. If this is well-addressed, I am down to re-evaluate this paper.\n\nLIMITATIONS:\nThe authors adequately addressed the limitation and potential negative societal impact on their work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers the privacy-utility tradeoff for ML models trained with differential privacy guarantees, and develops a technique using data augmentation on image datasets to train models with high accuracies on standard benchmarks with DP guarantees. Mixup, a commonly used augmentation technique in computer vision, and its variants are not compatible with standard DP-SGD because a single datapoint could influence many training instances through augmentations. Recent work [10] pointed out that augmentations involving a single datapoint can be used if clipping if done after averaging all gradients stemming from augmentations of the datapoint. The present paper develops two methods inspired by mixup that involve a single datapoint and therefore can be used with DP-SGD. Experiments show performance comparable to state-of-the-art methods for training DP models.\n\nSTRENGTHS:\nThank you to the authors for sharing their interesting research! Overall, the paper tackles an important subject - improving the utility of models with rigorous privacy guarantees. This is an active area of research, and the paper engages with recent work appropriately. The proposed methods are simple to implement for image datasets and provide a boost in utility. An attempt is made to explain why mixup methods improve performance by checking the distributions of gradient norms.\n\nOriginality: The paper develops two variants of mixup that can be applied to DP-SGD training. I do not know of prior work using mixup for DP-SGD.\n\nQuality: The analysis of differential privacy is careful and correct. The authors are diligent in highlighting parts of the analysis which are particularly tricky (L91, etc.) although these aspects are known in the literature. Relevant and recent methods are used for benchmarking, and error bars over 3 runs are given. Source code is provided.\n\nClarity: The paper is quite clear.\n\nSignificance: The poor utility of models trained with DP-SGD holds back the adoption of this important privacy enhancing technology, so new methods (like the ones in this paper) that improve the utility are necessary.\n\nWEAKNESSES:\nOriginality: The paper combines the augmentation techniques developed for DP in [10], with the idea of mixup which is very standard. The combination is only slightly non-trivial in this context.\n\nQuality: The experiments lack detail - it would not be possible to reproduce the author's work with the current state of the paper and appendices. Prior SotA work [10] is frequently referenced, but performance levels from that paper are not reproduced or surpassed. The experiment using diffusion models is not benchmarked fairly. Broader impacts are relegated to the appendix.\n\nClarity: There are minor grammatical and typesetting issues, but they do not hurt the clarity of the paper. Figure 2 requires clarification.\n\nSignificance: The applicability of this technique is limited to image datasets, whereas that of [10] for example can be applied much more broadly.\n\nQUESTIONS:\n1. What augmentations were used in the experiments? I have not found this detail clearly stated in the paper or appendices, despite it being a central focus. L167 mentions a \"randomized transformation function $T$\" but this is not brought up again. L247 mentions flipping and cropping, but it seems to imply these are not the only augmentations used. The lack of important details such as this negatively impact the reproducibility of this research.\n\n2. Can the authors state what computing resources were used and information on the runtime of their methods in comparison to prior work?\n\n3. Can the authors give details on the diffusion model that was used (architecture, how it was trained, etc.)? All we know is that it was from Open Clip and trained on LAION-2B (L218).\n\n4. The experiments attempt to follow [10] in many ways for close comparison, but the results reported in Section 5 as baselines do not reach the level of that paper. For instance, [10] reports 81.4% accuracy on CIFAR-10 training from scratch with a WRN-16-4 and epsilon=8. Table 1's Baseline is presumably meant to represent the method from [10], but only achieves 72.5% accuracy. The author's proposed method achieves 78.7% accuracy in the same setting. Given that the authors make claims of SotA performance, can they clarify why the results reported in [10] were not directly used or reproduced?\n\n5. There are some results which are repeated across tables (e.g. first two rows of Table 4 are reproduced from Table 3). Could this be mentioned explicitly where applicable so that it is easier to track and compare results? A reader moving quickly might assume they are separate results.\n\n6. In Table 4 the Mixup-Diffusion method uses additional data compared to the other approaches, namely the data generated by the diffusion model. Since the utility of DP models is often constrained by access to data, it is important to use baselines that have the same level of data access. Have the authors put thought into an appropriate baseline technique in the style of DP-SGD that also makes use of the synthetic data? (The most naive option being to pre-train or extend the training dataset with the same synthetic data made available to the mixup-diffusion method.)\n\n7. In Figure 2 it is not clear what the difference is between the curves and the blue bars. I interpret each curve as the distribution of gradient norms over individual datapoints in the training dataset at a particular epoch (these details are not given, I have to guess). However, the blue bars are stated to be a histogram of the average norm of gradients, but what is the average taken over and what is the resulting distribution over? I note that the paper at various times considers epochs, minibatches, and microbatches, so the authors should clearly state which notion they are using in their analysis.\n\n8. Also for Figure 2, the authors do not mention in the paper or appendices which dataset is used. Can the authors provide sufficient detail to reproduce their experiments (without having to dig through source code)?\n\n9. The result in Figure 2 showing lower average gradient norms is indeed suggestive that mixup leads to smoother training and faster convergence. However, have the authors found an explanation for why mixup leads to lower average gradient norms? This is not at all self-evident, especially for Mixup-Diffusion where training and synthetic datapoints are mixed, and those images can come from different classes (as illustrated in Fig 1).\n\n10. Have the authors checked the equivalent of Figure 2 for Mixup-Diffusion, or for other datasets? Can this analysis be included?\n\nMinor:\nIn L67, couldn't $\\delta=0$ be a valid choice, and for that matter $\\delta=1$ corresponding to no privacy guarantee?\n\nIn L58, typically one chooses $\\delta$ to be much less than $|D|^{-1}$, but the authors state $\\delta=o(|D|)$. \n\nIncomplete list of small errors:\n\nL70 add -> adds\n\nL72 gradient -> gradients\n\nL89 vector the -> vector of the\n\nAlg 2 line 2, missing space\n\nL150 extra parens ((x_1, y_1)\n\nLIMITATIONS:\nThe proposed method is implicitly stated to only apply to image datasets, but this limitation is not openly addressed by the authors. Similar work used for benchmarking is not limited in the same way.\n\nThe paper focuses on the utility of private models, but does not mention that private training can have negative effects other than reducing utility (other than in a brief Appendix B without references to prior work). For instance, it is well-known that DP-SGD usually exacerbates the biases in models making them more unfair [A][B][C]. Does data augmentation affect fairness? What are the biases introduced from the synthetic data? Robustness is another topic aligned with Trustworthy ML, and researchers often introduce augmented data during training to improve it. It is possible that the proposed method has positive effects on robustness, but the authors have not addressed this direction despite the significant literature on the intersection of privacy and robustness.\n\n[A] Bagdasaryan et al. 'Differential privacy has disparate impact on model accuracy' NeurIPS 2019\n\n[B] Xu et al. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent' ACM SIGKDD 2021\n\n[C] Esipova et al. 'Disparate impact in differential privacy from gradient misalignment' ICLR 2023\n\n----\nSummary of Discussion: I have read all reviews and rebuttals for this submission.\n\nThe authors responded to all points of my review. My rating was maintained at 5 as some of my original points remain as concerns, including the originality, and quality (lack of details of reproduction).", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies mixup data augmentation for differentially private (DP) machine learning. The traditional mixup data augmentation requires multiple samples. Therefore, applying them in DP model training is not straightforward. The paper first shows that a naive way of implementing it with micro-batches of size 2 gives poor results. To improve the performance, the paper proposes two new approaches. The first approach mixes up a sample and its own augmented version. The second approach mixes up a sample with generated samples from diffusion models. Experiments show that the proposed approaches improve over self-augmentation.\n\nSTRENGTHS:\n* The paper is well-written.\n\n* Mixup data augmentation is very useful in the non-DP world. However, incorporating that into DP training is non-trivial. The paper is a valuable step towards bringing the benefit of mixup data augmentation to DP training.\n\nWEAKNESSES:\n* I have some doubts about whether the experimental comparison is fair. \n\n* More ablation studies are needed.\n\nSee \"questions\" for the details.\n\nQUESTIONS:\nMy major concern is the experimental comparison between self-aug and the proposed mixup variants in Tables 2 and 3. \n\n* In the experiments of Table 2, did we keep the number of augmented samples the same? To make it more accurate, let's consider Mixup-SelfAug and use the notations in Section 3.2. For a fair comparison, we need to make sure that the \"k\" utilized in self-aug equals \"k+k'\" used in Mixup-SelfAug. (The motivation is to keep the computation cost roughly the same.)\n\n* Similarly, for Table 3, did we keep the number of augmented samples the same?\n\nOther questions:\n\n* It is better to show how k, k', and k'' influence the performance of Mixup-SelfAug and Mixup-Diffusion.\n\n* Is there any benefit of combining Mixup-SelfAug and Mixup-Diffusion together?\n\nI will update the score according to the answers to the above questions.\n\nOther minor issues:\n\n* Figure 2: I do not fully understand the figure. It says \"The histogram shows average norm of gradients.\", but I do not get which values are averaged over. Is the process (1) for each sample, computing the average norms of gradients across all iterations, and (2) plotting the histogram of the above values of all samples? Similarly, how are the lines computed?\n* Line 138: \"however\" -> \". However\"\n* Line 150: \"((x_1,y_1)\" -> \"(x_1, y_1)\"\n* Line 249-254: The information in this paragraph is also covered in the method section.\n\nLIMITATIONS:\nThe paper did not discuss the limitation or the potential negative societal impact.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a data augmentation technique for differentially private deep learning using mixup regularization. Mixup is a popular augmentation technique which involves taking linear combinations of training samples to create new samples. However, such a technique cannot be directly applied to differentially private training, as the sensitivity of the private algorithm increases rendering it to be un-useful. Towards this end the authors propose two methods for private mixup augmentation. First, is mixup with self augmentation which involves mixing samples obtained from augmentation of a single sample, and secondly, mixing training samples with samples generated from diffusion models. The paper provides empirical results to support their claim.\n\nSTRENGTHS:\nMixup is an interesting technique, and exploring it for differentially private training is important.\nThe technique is simple to implement in practice with easy to prove theoretical guarantees.\nMethod shows improved empirical performance on the presented datasets.\n\nWEAKNESSES:\nThe proposed method isnt too different from the method proposed by De et al which is cited in the paper. Its a minor augmentation to the augmentation they proposed.\nPre-trained models are trained on large datasets but fine-tuning is performed only on toy datasets. Needs more empirical evidence on practical datasets (for example, oxfordpets, flowers, and so on)\n\nQUESTIONS:\nFor diffusion model based experiments the pre-trained model is trained on 2B images which is likely to contain the entire fine-tuning sets. Does this seem like a reliable public pre-training to choose?\nCan you increase the number of samples to mixup from 2? How does the performance change by increasing the number of samples in the convex combination?\nWhat should be the nature of the distribution of samples that are used during mixup? Can out of distribution samples be mixed to obtain meaningful results?\n\nLIMITATIONS:\nThe method is only restricted to self augmentations or augmentations with publicly available data. In private training having different gradients aligned when training with DP-SGD is important to reduce the effect of the gaussian noise added to ensure DP. Will it be possible to construct a mixup involving multiple samples (rather than self-mixup or diffusion model based) so that the gradients during training are more aligned, which thereby increase the signal-to-noise ratio?", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}