Title: Gradient Descent with Linearly Correlated Noise: Theory and Applications to Differential Privacy
Venue: NeurIPS 2023
Accepted: yes
Keywords: optimization

machine learning

differential privacy
Abstract: We study gradient descent under linearly correlated noise. Our work is motivated by recent practical methods for optimization with differential privacy (DP), such as DP-FTRL, which achieve strong performance in settings where privacy amplification techniques are infeasible (such as in federated learning). These methods inject privacy noise through a matrix factorization mechanism, making the noise *linearly correlated* over iterations. We propose a simplified setting that distills key facets of these methods and isolates the impact of linearly correlated noise. We analyze the behavior of gradient descent in this setting, for both convex and non-convex functions. Our analysis is demonstrably tighter than prior work and recovers multiple important special cases exactly (including anticorrelated perturbed gradient descent). We use our results to develop new, effective matrix factorizations for differentially private optimization, and highlight the benefits of these factorizations theoretically and empirically.

Gradient Descent with Linearly Correlated Noise: Theory and Applications to Differential Privacy

Abstract

We study gradient descent under linearly correlated noise. Our work is motivated by recent practical methods for optimization with differential privacy (DP), such as DP-FTRL, which achieve strong performance in settings where privacy amplification techniques are infeasible (such as in federated learning). These methods inject privacy noise through a matrix factorization mechanism, making the noise linearly correlated over iterations. We propose a simplified setting that distills key facets of these methods and isolates the impact of linearly correlated noise. We analyze the behavior of gradient descent in this setting, for both convex and non-convex functions. Our analysis is demonstrably tighter than prior work and recovers multiple important special cases exactly (including anti-correlated perturbed gradient descent). We use our results to develop new, effective matrix factorizations for differentially private optimization, and highlight the benefits of these factorizations theoretically and empirically.

1 Introduction

Differential privacy (DP) is a critical framework for designing algorithms with provable statistical privacy guarantees. DP stochastic gradient descent (DP-SGD, Abadi et al. [1]) is particularly important for enabling private empirical risk minimization (ERM) of machine learning models. Many works have analyzed the convergence behavior of DP ERM methods, including DP-SGD [5, 16, 48, 8]. However, obtaining good privacy/utility trade-offs with DP-SGD can require excessively large batch sizes or privacy amplification techniques such as subsampling [4, 5, 55] and shuffling [15, 16]. In some applications, including cross-device federated learning, limited and device-controlled client availability can make sampling or shuffling infeasible [21]. Even outside of such applications, many implementations of DP-SGD do not properly use the Poisson subsampling scheme analyzed by Abadi et al. [1] for amplification, and instead use a single fixed permutation of the dataset [7].

Kairouz et al. [20] propose an alternative method, DP-FTRL, which can attain good privacy/utility trade-offs without amplification. Their key insight is that for SGD-style algorithms, the variance on prefix sums g 0 + · · · + g t , t ∈ { 1 , . . . , T } of gradients g j is more important than the variance on individual gradients. By adding carefully tailored noise that is linearly correlated over iterations to the gradients, one can reduce the error on the prefix sums, at the cost of increased error on the individual gradients, for a fixed privacy budget. The DP-FTRL mechanism is competitive with or better than DP-SGD, even without relying on privacy amplification, and enabled McMahan and Thakurta [31] to train the first differentially private machine learning model on user data in a production setting.

Input:

T x T workload matrix

A

,

factorization objective

obj

Offline, one-time

matrix factorization

Data- and loss-dependent empirical risk

minimization

Input:

model

X,

gradients

G

,

IID Gaussian noise

Z

A

B

C

=

B

C

(

)

,

minimize

obj

X

B

G

Z

+

T first-order optimization steps

with additive, linearly correlated noise

A

Denisov et al. [10], Choquette-Choo et al. [7] develop a refinement of DP-FTRL, MF-DP-FTRL, by formulating and solving an offline matrix factorization problem to find the 'optimal' correlated noise structure under DP constraints. That is, for a fixed privacy level, they aim to find correlated noise structures that lead to improved optimization. A simplified diagram of their workflow is given in Fig. 1. However, (as we detail in Section 2) their offline factorization objective is based on an online convergence bound that is loose. This raises questions about whether there are factorization objectives that better capture convergence behavior of gradient descent algorithms with correlated noise.

In this paper we study this class of mechanisms more closely and provide a detailed analysis of linearly correlated noise from an optimization point of view. Our main contributions are as follows:

We propose a novel stochastic optimization problem that extracts key facets of methods like (MF-)DP-FTRL, and which isolates the effects of linearly correlated noise on optimization.

We derive convergence rates for gradient descent on smooth convex and non-convex functions in such settings that showcase the effect of linearly correlated noise and recover tight convergence rates in notable special cases. We use a novel proof technique that may be of independent interest.

We use this theory to design a new objective for the offline matrix factorization workflow in Fig. 1. We show that solving this objective leads to MF-DP-FTRL mechanisms with improved convergence properties. We validate the mechanism empirically on a variety of datasets and tasks, matching or outperforming prior methods.

1.1 Related Work

Matrix mechanisms for differential privacy. Our work is closely related to differentially private optimization using matrix mechanisms [26]. Historically, such mechanisms were applied to linear statistical queries [25, 29, 14, 18]. Denisov et al. [10] and Choquette-Choo et al. [7] extended these mechanisms to the adaptive streaming setting, allowing their application to optimization with DP. Denisov et al. [10] show that this framework (MF-DP-FTRL) subsumes and improves the DP-FTRL algorithm [20]. Both DP-FTRL and MF-DP-FTRL improve privacy guarantees relative to DPSGD[1] without amplification, and can be combined with techniques such as momentum for improved utility [46]. The aforementioned work focuses on methods for computing factorizations, privacy properties, and empirics. Our work studies the analytic relationship between the correlated noise induced by the MF-DP-FTRL framework and the downstream effect on optimization performance.

SGD with correlated noise. Stochastic noise in optimization arises in a variety of ways, including mini-batching [9] and explicit noise injection [11, 54, 19]. While most analyses of SGD assume this noise is independent across iterates, some work considers correlated noise. For example, shuffle SGD involves correlated noise due to sampling without replacement [33, 53]. Lucchi et al. [27]

use correlated Brownian motion to improve SGD's ability to explore the loss landscape. Recently, Orvieto et al. [37, 38] investigated anti-correlated noise as a way to impose regularization and improve generalization. We consider a linearly correlated noise model, and analyze its impact on SGD's convergence to critical points.

SGD with biased noise. Many algorithms can be viewed as SGD with structured but potentially biased noise, including SGD with (biased) compression [44, 17], delayed SGD [28, 12], local SGD [42], federated learning methods [22, 52, 34, 36], decentralized optimization methods [50, 23], and many others. Convergence analyses for such methods often use techniques like perturbed iterate analysis [28]. Correlated gradient noise also biases the gradient updates. However, as we show in Section 4, directly applying such techniques to linearly correlated noise does not lead to tight convergence guarantees.

2 Background

In this work, we focus on an empirical risk minimization (ERM) problem of the form

where l ( x , ξ i ) is the loss of a model x on a data point ξ i , and n is the training set size. We would like to solve (1) while guaranteeing some form of privacy for the training set. We focus on differential privacy (DP, [13]), a widely-used standard for anonymous data release. DP guarantees statistical difficulty in distinguishing whether or not a particular unit's data served as an input to a given algorithm, based on the algorithm's output. This protected unit may represent a single training example or a semantically higher-level unit like the entirety of a user's data.

While there are many methods for solving (1), we will follow Denisov et al. [10], Choquette-Choo et al. [7] and restrict to first-order algorithms A that linearly combine (stochastic) gradients. Each algorithm A ∈ A is parameterized by a learning rate γ > 0 , a number of steps T > 0 , and scalars { a tj } 1 ≤ j ≤ t ≤ T . Given a starting point x 0 , A produces iterates x t ∈ R d given by

where g t is a (mini-batch) gradient of f computed at x t . This class encompasses a variety of firstorder algorithms, including SGD [40], SGD with momentum [39, 35], and delayed SGD [2]. This class also captures algorithms that use learning rate scheduling, so long as the schedule is independent of the gradient values. We re-write the output of A in matrix notation by defining:

Here A is the workload matrix representing A . At iteration t , A can only use the current and previous gradients, so a tj = 0 for j > t (ie. A is lower-triangular). In this notation, the iterates of A satisfy

Example 2.1 (SGD) . Define the prefix-sum matrix S ∈ R T × T as the all-ones lower-triangular matrix. If A = S , then (2) is simply SGD with learning rate γ . As discussed by Denisov et al. [10, Section 4], we also recover SGD with momentum using an appropriate transformation S ′ of S .

2.1 Matrix Factorization and Privacy Mechanisms

In order to make the output of (2) differentially private, we typically need to clip the gradients and add noise. Let G denote the matrix whose rows (gradients) have been clipped to some ℓ 2 threshold α . Let Z ∈ R T × d be a matrix with entries drawn independently from N (0 , ζ 2 / d ) . The well-known DP-SGD algorithm [1] adds this noise to each clipped gradient, so that

For consistency, we consider (2) to be the special case of (3) where Z = 0 and α = ∞ . The variance ζ 2 depends on the clipping threshold α and desired ( ε, δ ) privacy we aim to achieve [1].

To derive algorithms with improved DP guarantees, Denisov et al. [10] add the noise Z to a factorized version of A . For a factorization A = BC with B , C ∈ R T × T , we add noise to the iterates via:

Here, sens( C ) is a number representing the sensitivity of the mapping G ↦→ CG to 'adjacent' input changes. We note that the sensitivity changes depending on the notion of adjacency. In single-epoch settings, two input matrices are adjacent if they differ by a single row [10], so the sensitivity function is sens( C ) := max i ∈{ 1 ,...,T } ∥ C [: ,i ] ∥ 2 , i.e. the maximum ℓ 2 -squared column norm of C . For details and extensions to multiple epochs, see [7].

If the variance of entries of Z is fixed to some value ζ 2 / d , then for all the possible factorizations A = BC in (4) have exactly same privacy guarantees, depending only on ζ . It will also be convenient to define σ = sens( C ) ζ as the 'effective' variance of Z after re-scaling by the sensitivity. Note that for a fixed σ , the privacy guarantees of (4) might be different depending on the sensitivity.

The factorization B = A , C = I recovers DP-SGD (3), but factorizations with better privacy-utility trade-offs may exist. The formulation of Eq. (4) transfers the linear optimization algorithm (2) into the setting of the matrix mechanism [26], a well-studied family of mechanisms in differential privacy. Denisov et al. [10], Choquette-Choo et al. [7] show that the mechanism in Eq. (4) provides a DP guarantee equivalent to a single application of the Gaussian mechanism, which can be computed tightly using numerical accounting techniques [49, 24].

Finding good factorizations. Intuitively, a factorization A = BC is good if sens( C ) is small and the added noise BZ does not significantly degrade the convergence of (4). In order to quantify the effect of this added correlated noise on optimization, Denisov et al. [10] derive an online regret bound for (4) in the convex case against an adaptive adversary. Translating this via online-to-batch convergence to the stochastic setting, the iterates x t satisfy

where ˜ L is the Lipshitz constant of f . Denisov et al. [10] therefore use sens( C ) ∥ B ∥ F as a proxy for the impact of the factorized noise scheme on convergence. To find factorizations with good convergence properties, Denisov et al. [10], Choquette-Choo et al. [7] minimize sens( C ) ∥ B ∥ F subject to the constraint A = BC , which is equivalent to the following objective:

Problem 2.2 (Minimal-Norm Matrix Factorization) . Given a lower triangular matrix A ∈ R T × T , define OPT F ( A ) = ( B , C ) , where B , C ∈ R T × T solve the following optimization problem.

Eq. (6) is well-studied in the privacy literature and can be solved with a variety of numerical optimization algorithms [51, 30, 10, 7]. We also note that Denisov et al. [10] show that without loss of generality, we can assume B and C are lower triangular.

Finding improved factorizations. We argue that (5) is pessimistic in stochastic settings. For SGD (when B = A ), the last term in (5) is O ( γ sens( C ) ζ ˜ L √ T ) , which diverges with T for a constant stepsize. However, under the same assumptions as in [10], SGD with constant stepsize actually achieves a faster rate of O ( γ sens( C ) ζ ˜ L ) (see [41]).

In this paper, we turn our attention to the smooth functions in order to focus on non-convex functions. We show in Appendix A, there are matrices B 1 , B 2 such that sens( C 1 ) ∥ B 1 ∥ F = sens( C 2 ) ∥ B 2 ∥ F , but Eq. (4) diverges with B 1 and converges with B 2 , therefore showing that Frobenius norm is not the right measure in the smooth case as well.

This begs the question of whether there are objectives that better capture the impact of the noise injected in (4) on convergence. To answer this, we derive a bound that can exhibit better dependence on B to design better factorizations for differentially private optimization.

3 Problem Formulation

To study the effect of the noise BZ on optimization, we analyze a slightly simplified objective that omits parts of (4) not directly related to linear noise correlation. We do this as follows:

(I) We assume that each g t is the true gradient at the point x t , i.e. g t = ∇ f ( x t ) .

(II) We omit gradient clipping from our analysis. Alternatively, we can view this as setting the clipping threshold α = ∞ so that G = G in (4).

(III) We restrict the class A to SGD-type algorithms where A = S , as in Example 2.1.

We impose (I) for simplicity of presentation. Our results can be extended to stochastic gradients in a direct fashion. Restriction (II) is also for simplicity. First, clipping is not directly applied to the noise BZ . Second, for bounded domains or Lipschitz f , our analysis still holds with clipping. Last, practical DP methods often use adaptive clipping [45] instead of fixed clipping. We are not aware of convergence analyses for such schemes. We impose (III) in order to limit the class of algorithms A to a well-understood subclass. The convergence properties of (2) for general matrices A are not well-understood even when there is no noise ( Z = 0 ). As we discuss in Section 4, even with these simplifications, the effect of BZ is not well-understood.

Due to (III), we study factorizations BC of the matrix A = S , as in Example 2.1. Then, (4) becomes

In vector notation, for b 0 = 0 and B = [ b 1 , . . . b T ] ⊤ ,

where for simplicity of presentation, we re-scaled the noise Z by the sensitivity, σ 2 = sens 2 ( C ) ζ 2 . We now discuss several noteworthy special cases of (8).

Example 3.1 (PGD) . If B = S (see Example 2.1) we recover SGD with uncorrelated additive noise, also known as perturbed gradient descent (PGD), where

The convergence rate of SGD (and therefore PGD) is well-understood in the optimization literature (e.g. see Bubeck [6, Section 6]).

Example 3.2 (Anti-PGD) . By setting B = I , we get an algorithm that at every iteration adds an independent noise vector z t +1 and subtracts the previously added noise z t :

Intuitively, this removes some of the noise added in the prior round. This is (up to a learning rate factor) the anti-correlated perturbed gradient descent (Anti-PGD) method proposed by Orvieto et al. [37], who study its generalization properties. Anti-PGD is also equivalent to SGD with randomized-smoothing [11]. The equivalence follows from defining ˜ x t = x t + γ z t and rewriting (10) as

While randomized smoothing algorithm is popular for non-smooth optimization, Vardhan and Stich [47] analyze its convergence properties in the smooth non-convex setting.

Example 3.3 (Tree Aggregation DP-FTRL) . For k ≥ 1 and t = 2 k -1 , define H k ∈ R (2 k -1) × t recursively as follows:

where 1 above represents an all-ones row of appropriate width. For T = 2 k -1 , if C = H k and B = SC † k where C † k denotes a carefully chosen right pseudo-inverse of C , then we recover the same noise matrix B as in the DP-FTRL algorithm with either the online or full Honaker estimator (depending on the choice of C † ) as in [20, 10]. Note that B , C are not square. This can be remedied by appropriately projecting onto R T . See Choquette-Choo et al. [7, Appendix D.3] for details.

4 Deriving Tighter Convergence Rates

We would like convergence rates for (7) that apply to any factorization and yield tight convergence rates for notable special cases. We pay special attention to PGD (Example 3.1) and Anti-PGD (Example 3.2), as they represent extremes in the space of factorizations ( S = SI and S = IS , respectively). As we will show, it is possible to use existing theoretical tools to derive tight convergence rates for both, but not simultaneously .

Below, we discuss ways to derive tight rates for PGD and Anti-PGD, and how these rates involve incompatible analyses. We then develop a novel analytic framework involving restart iterates that allows us to analyze both methods simultaneously, as well as (7) for general factorizations. We start by formally stating our assumptions. For simplicity of presentation, we re-scale the noise Z by the sensitivity of C , i.e. σ 2 = sens 2 ( C ) ζ 2 ; we will suppress the C dependence of σ .

Assumption 4.1 (Noise) . The rows z 1 , . . . , z T of the noise matrix Z are independent random vectors such that ∀ t , E [ z t ] = 0 and E ∥ z t ∥ 2 ≤ σ 2 .

We do not assume ˜ L -Lipshitzness in our results, but we do assume L -smoothness. This is a relatively standard assumption in optimization literature [6].

Assumption 4.2 ( L -smoothness) . The function f : R d → R is differentiable, and there exists L > 0 such that for all x, y ∈ R d , ∥∇ f ( x ) -∇ f ( y ) ∥ ≤ L ∥ x -y ∥ .

For some of the results we will assume convexity.

Assumption 4.3 (Convexity) . The function f : R d → R is convex, i.e. ∀ x , y ∈ R d , f ( x ) -f ( y ) ≤ ⟨∇ f ( x ) , x -y ⟩ . When assuming convexity, we also assume the infimum of f is achieved in R d .

4.1 Convergence Rates for PGD and Anti-PGD

In this section we discuss the (distinct) convergence analyses of PGD and Anti-PGD, and the suboptimal results derived by trying to apply the proof technique for one to the other. We focus on the convex setting for brevity, though these analyses can be directly extended to the non-convex setting.

PGD. The convergence of PGD (Example 3.1) is well-understood since it is a special case of SGD. One can show the following.

Proposition 4.4 (Adapted from Dekel et al. [9, Theorem 1]) . Under Assumptions 4.1, 4.2 and 4.3, if B = S and γ < 1 / 2 L , then the output of (7) satisfies

The proof follows from combining the update (9), standard facts about convex functions, and the fact that γ < 1 / 2 L , to get the inequality

It is left to average over iterations 0 ≤ t ≤ T .

Anti-PGD. For Anti-PGD (Example 3.2), one can show the following.

Proposition 4.5. Under Assumptions 4.1, 4.2 and 4.3, if B = I and γ < 1 / 2 L , then the output of (7) satisfies

Since Lγ < 1 / 2 , the RHS of (12) is strictly smaller than the RHS of (11). While this result may be known, we were unable to find a reference, so we provide a complete proof in Appendix D. The proof utilizes perturbed iterate analysis [28]. We define a virtual sequence { ˜ x t } T t =0 as follows:

The ˜ x t are the iterates of (7) when Z = 0 . We can then prove the following descent inequality:

Because of the anti-correlation in (10), the virtual iterates ˜ x t are close to the real iterates x t , as x t -˜ x t = γ z t . Averaging over t , we recover (12). See Appendix D for details.

Tightness. The noise terms (those terms involving σ 2 ) in (11), (12) are both tight. We show this in Appendix E on the objective f ( x ) = ( L / 2 ) ∥ x ∥ 2 .

Difficulties in a unified analysis. The proof techniques for PGD and Anti-PGD above are notably different, and as we explain in Appendix F, do not lead to favorable results when trying to use one of the two strategies to analyze both.

4.2 Main Results and Analytic Techniques

To unify the proof techniques above, we use a modified virtual sequence with restart iterations . For a parameter τ = ˜ Θ( 1 / Lγ ) (throughout, ˜ O and ˜ Θ hide poly-logarithmic factors), we define

̸

Similar to the virtual sequence in (13), ˜ x t incorporates only deterministic gradients ∇ f ( x t ) . However, every τ iterations we reset ˜ x t to the real iterate x t . This allows us to control the divergence between the virtual sequence and the real sequence (enabling a tight analysis of PGD), while still capturing the convergence benefits of anti-correlated noise (enabling a tight analysis of Anti-PGD).

The parameter τ is independent of B , and depends only on the geometry of f and the stepsize γ . Using this machinery, we can prove convergence rates of (7) for any factorization S = BC . These rates involve ℓ 2 distances between the rows b t of the matrix B (where b 0 = 0 for convenience).

Theorem 4.6 (non-convex) . Suppose Assumptions 4.1 and 4.2 hold, γ ≤ 1 / 4 L , and τ = 1 / γL . Then (7) produces iterates whose average error ( T +1) -1 ∑ T t =0 E ∥∇ f ( x t ) ∥ 2 is upper bounded by

Theorem 4.7 (convex) . Under Assumptions 4.1, 4.2, and 4.3, if γ ≤ 1 / 4 L and τ = ˜ Θ( 1 / γL ) , then (7) produces iterates with average error ( T +1) -1 ∑ T t =0 E [ f ( x t ) -f ⋆ ] upper bounded by

We give complete proofs in Appendix C. These convergence rates consist of two terms: The first term states how fast the function would converge in the absence of the noise. The second term, the noise term , is the focus of our paper, as it shows how the correlated noise BZ affects convergence.

These rates involve only differences of rows of B that are at most τ iterations apart. Intuitively, τ is a coarse indicator of whether an iterate x t is still sensitive to the noise injected at an iteration t ′ < t . If t > t ′ + τ , then changes in the noise added at step t are effectively uncorrelated to iteration t ′ . As we detail in Appendix, applying Theorem 4.7 to the special cases in Examples 3.1, 3.2 recovers their tight convergence rates in (11), (12) correspondingly.

5 Finding Better Factorizations

We now draw on our results in Section 4 to develop better mechanisms for the MF-DP-FTRL framework. We modify the objective underlying the offline matrix factorization problem during the first stage of the MF-DP-FTRL workflow (Fig. 1). Specifically, observe that the noise term in Theorems 4.6 and 4.7 can be rewritten in matrix notation (up to multiplicative constants) as

̸

10

3

10

2

learning rate

10 3

10 4

squared norm

Average gradient norm

DP-MF

DP-MF+

10

3

10

2

learning rate

10 1

10 2

10 3

squared norm

Last gradient norm

DP-MF

DP-MF+

0

2000

4000

iteration

10 2

10 3

10 4

10 5

squared norm

Convergence curve

DP-MF+, tau = 50

DP-MF

(a) Average gradient norm for varying learning rates. (b) Last gradient norm for varying learning rates. (c) Gradient norm over time for γ = 10 -2 .

where Λ τ = [ λ ⊤ 1 , . . . , λ ⊤ T ] ⊤ ∈ R T × T , and we set the rows λ t appropriately to select corresponding row differences of B with either coefficient 1 or 1 / √ τ depending on the index t . We give a precise definition of Λ τ and an explicit example when T = 12 , τ = 3 in Appendix B.

Recall that [10] minimize the Frobenius norm objective (6) based on their derived convergence bounds in (5). Since our derived convergence bounds are strictly tighter, we propose using Eq. (15) as the new objective function in (6). Intuitively, since ∥ Λ τ B ∥ 2 F is a better proxy for learning performance than ∥ B ∥ 2 F , minimizing this quantity in the offline factorization problem should lead to ERM methods with better privacy-utility trade-offs.

We can solve our new offline matrix factorization problem in a straightforward manner. We can show that for A = S , we can solve this modified problem by first computing the solution ˜ B , ˜ C using OPT F ( Λ τ A ) . The solution to our modified objective is then C = ˜ C , B = AC -1 . This implies we can use existing open-source solvers designed for (6) [51, 30, 10].

6 Experiments

In this section, we evaluate the ERM performance of MF-DP-FTRL under different offline factorization objectives. We focus on the Frobenius norm objective (6), which we refer to as DP-MF [10, 7], and our modified objective (15), which we refer to as DP-MF + .

6.1 Validating Theoretical Results

We first validate our theoretical results above by comparing the convergence of DP-MF and DP-MF + on a random quadratic function that satisfies the assumptions of Theorem 4.7. Notably, we ensure the quadratic is not strongly convex. We treat τ in (15) as a hyperparameter and tune it over a fixed grid. For complete details, please refer to Appendix H. We present the results in Fig. 2.

In Fig. 2(a) we plot 1 T ∑ T t =0 ∥∇ f ( x t ) ∥ 2 , as this quantity is proportional to the LHS of Theorem 4.7. For all learning rates, DP-MF + either matches or outperforms DP-MF. Moreover, the advantage of DP-MF + increases as the learning rate increases. This corresponds to our theory in Theorem 4.7. Indeed, the larger the stepsize γ , the smaller the optimal τ (as τ = Θ( 1 / γL ) ), and the more often restarts are used in the analysis of Theorem 4.7.

Fig. 2(b) further depicts the last-iterate behaviours of DP-MF and DP-MF + , which is often more practically relevant. Interestingly, the last iterate behaviour is improved even in the cases where the average behaviour does not improve. Finally, in Fig. 2(c) we pick γ = 10 -2 , τ = 50 as the parameters for which both the average and the last-iterate behaviours are improved and plot the convergence curve over iterations. DP-MF + has regular oscillating behaviour, allowing it to achieve a good final-iterate performance. The period of these oscillations is exactly equal to τ .

6.2 Practical DP Training Experiments

We now compare DP-MF, DP-MF + , and DP-SGD with privacy amplification [1] on the MNIST, CIFAR-10, and Stack Overflow datasets. We omit from comparison DP-FTRL [20] and DP-Fourier

































+ (

=2048)



+ (

=512)



+ (

=128)



+ (

=32)



+ (

=8)



+ (

=2)

(a) MNIST,

1

































+ (

=2048)



+ (

=512)



+ (

=128)



+ (

=32)



+ (

=8)



+ (

=2)

(b) MNIST,

16

epochs

































+ (

=2000)

(c) CIFAR-10,

20

epochs

[7] as these methods are strictly dominated by DP-MF. Unlike our theoretical analysis, we include clipping to derive formal ( ε, δ ) privacy guarantees. To facilitate a fair comparison, we set δ = 10 -6 in all the settings, and compare against varying ε . We give complete experimental details in Appendix H

MNIST, logistic regression. We train for T = 2048 iterations and either 1 or 16 epochs depending on the batch size, corresponding to a batch size of 29 and 469 respectively. 2 We fix the clipping threshold at 1 . 0 and the learning rate at 0 . 5 . We vary τ in (15) over { 2 , 8 , 32 , 128 , 512 , 2048 } . The results are in Figs. 3(a) and 3(b). DP-MF + improves monotonically with τ , performing best when τ = 2048 = T . For such τ , DP-MF + consistently out-performs DP-MF across all settings. Recall from (15) that this corresponds to the offline objective ∥ Λ T B ∥ 2 F where λ ii = 1 / √ T for all i < T and λ TT = 1 . This objective strongly penalizes errors on the final iterate, which is the model used to compute test accuracy.

We also see that DP-MF + expands the number of settings in which we can beat DP-SGD. DP-MF only outperforms DP-SGD for sufficiently large ε ( ε ≥ 0 . 31 for 1 epoch and ε ≥ 31 for 16 epochs). By contrast, DP-MF + outperforms DP-SGD in every setting except when ε = 0 . 01 and 1 epoch. None of the mechanisms reached the accuracy levels obtained by the non-private baseline, even at ε = 100 . We suspect this is due to the fact that we are using a fixed but aggressive clipping threshold of 1 . 0 across all experiments, which helps in the moderate privacy regime but hurts in very low privacy regime. Even though DP-MF + does not use privacy amplification, it outperforms DP-SGD, which uses privacy amplification. This is due to the efficient noise anti-correlations in DP-MF + . If amplification were not possible, performance of DP-SGD would degrade even further.

CIFAR-10, CNN. We follow the experimental setup from [7]. Specifically, we train all mechanisms for 20 epochs and T = 2000 iterations, which corresponds to a batch size of 500 . 3 We tune the learning rate over a fixed grid. We fix τ = T = 2000 in DP-MF + as we found that worked best in the MNIST experiments. The results are given in Fig. 3(c). We see that DP-MF + ( τ = 2000) offers a consistent improvement over DP-MF across all choices of ε considered. Both DP-MF and DP-MF + beat DP-SGD for ε > 4 . This observation is consistent with prior work on DP-FTRL and DP-MF, where DP-SGD performs relatively better with smaller ε while DP-MF performs better with larger ε .

Stack Overflow, LSTM. In Appendix H, we compare DP-MF and DP-MF + on a federated learning task with user-level differential privacy. We do not compare DP-SGD on this task, as amplification techniques such as shuffling and subsampling are not possible in practical federated learning settings [20]. In this task, we train an LSTM network to do next-word prediction on the Stack Overflow dataset. To be consistent with the prior work [10] and to test if our proposed factorizations are compatible with the other types of workloads A from Eq. (2), we use momentum and learning rate decay. Our results are given in Table 2. We see that two methods perform comparably, verifying competitiveness of our method. Note that this task uses federated averaging [32] instead of gradient

descent. Developing offline factorization objectives specifically for federated learning remains an open problem.

7 Conclusion

In this work, we developed analytic techniques to study the convergence of gradient descent under linearly correlated noise that is motivated from a class of DP mechanisms. We derived tighter bounds than currently exist in the literature, and we use our novel theoretical understanding to design privacy mechanisms with improved convergence. Perhaps more importantly, our work highlights the wealth of stochastic optimization questions arising from recent advances in differentially private model training. As such, we distill and formalize various optimization problems arising from recent work on matrix mechanisms for DP. Our work raises a host of questions and open problems, including extending our analysis to include things such as clipping, shuffling, and momentum. Another key extension is to derive last-iterate convergence rates rather than average-iterate convergence rates, as in some settings it is only the final 'released' model that needs formal privacy guarantees. Given the improved generalization properties of Anti-PGD [37], one could also investigate how to design more general linearly correlated noise mechanisms which improve both privacy and generalization.

8 Acknowledgments

The authors would like to thank Francesco D'Angelo, Nina Mainusch and Linara Adylova for their comments on the manuscript. The authors would also like to thank the reviewers for their helpful suggestions in improving the clarity of the writing.

References

Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , Oct 2016. doi: 10 . 1145/2976749 . 2978318. URL http://dx . doi . org/10 . 1145/2976749 . 2978318 .

Alekh Agarwal and John C Duchi. Distributed delayed stochastic optimization. In J. Shawe-Taylor, R. Zemel, P. Bartlett, F. Pereira, and K.Q. Weinberger, editors, Advances in Neural Information Processing Systems , volume 24. Curran Associates, Inc., 2011. URL https://proceedings . neurips . cc/paper/2011/file/ f0e52b27a7a5d6a1a87373dffa53dbe5-Paper . pdf .

The TensorFlow Federated Authors. TensorFlow Federated Stack Overflow dataset, 2019. URL https://www . tensorflow . org/federated/api_docs/python/tff/simulation/ datasets/stackoverflow/load_data .

Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th annual symposium on foundations of computer science , pages 464-473. IEEE, 2014.

Raef Bassily, Vitaly Feldman, Kunal Talwar, and Abhradeep Guha Thakurta. Private stochastic convex optimization with optimal rates. Advances in neural information processing systems , 32, 2019.

Sébastien Bubeck. Convex optimization: Algorithms and complexity. Found. Trends Mach. Learn. , 8(3-4):231-357, nov 2015. ISSN 1935-8237. doi: 10 . 1561/2200000050. URL https://doi . org/10 . 1561/2200000050 .

Christopher A. Choquette-Choo, H. Brendan McMahan, Keith Rush, and Abhradeep Thakurta. Multi-epoch matrix factorization mechanisms for private machine learning, 2022. URL https: //arxiv . org/abs/2211 . 06530 .

Rudrajit Das, Satyen Kale, Zheng Xu, Tong Zhang, and Sujay Sanghavi. Beyond uniform Lipschitz condition in differentially private optimization. arXiv preprint arXiv:2206.10713 , 2022.

Ofer Dekel, Ran Gilad-Bachrach, Ohad Shamir, and Lin Xiao. Optimal distributed online prediction using mini-batches. J. Mach. Learn. Res. , 13(null):165-202, jan 2012. ISSN 1532-4435.

Sergey Denisov, Brendan McMahan, Keith Rush, Adam Smith, and Abhradeep Guha Thakurta. Improved differential privacy for SGD via optimal private linear operators on adaptive streams. In Neural Information Processing Systems , 2022.

John C Duchi, Peter L Bartlett, and Martin J Wainwright. Randomized smoothing for stochastic optimization. SIAM Journal on Optimization , 22(2):674-701, 2012.

Sanghamitra Dutta, Gauri Joshi, Soumyadip Ghosh, Parijat Dube, and Priya Nagpurkar. Slow and stale gradients can win the race: Error-runtime trade-offs in distributed sgd. In International conference on artificial intelligence and statistics , pages 803-812. PMLR, 2018.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Shai Halevi and Tal Rabin, editors, Theory of Cryptography , pages 265-284, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg. ISBN 978-3-540-32732-5.

Alexander Edmonds, Aleksandar Nikolov, and Jonathan Ullman. The power of factorization mechanisms in local and central differential privacy. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing , pages 425-438, 2020.

Úlfar Erlingsson, Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms , pages 2468-2479. SIAM, 2019.

Vitaly Feldman, Audra McMillan, and Kunal Talwar. Hiding among the clones: A simple and nearly optimal analysis of privacy amplification by shuffling. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS) , pages 954-964. IEEE, 2022.

Eduard Gorbunov, Dmitry Kovalev, Dmitry Makarenko, and Peter Richtárik. Linearly converging error compensated sgd. Advances in Neural Information Processing Systems , 33: 20889-20900, 2020.

Monika Henzinger and Jalaj Upadhyay. Constant matters: Fine-grained complexity of differentially private continual observation using completely bounded norms. Cryptology ePrint Archive, Paper 2022/225, 2022. URL https://eprint . iacr . org/2022/225 . https://eprint . iacr . org/2022/225 .

Chi Jin, Praneeth Netrapalli, Rong Ge, Sham M Kakade, and Michael I Jordan. On nonconvex optimization for machine learning: Gradients, stochasticity, and saddle points. Journal of the ACM (JACM) , 68(2):1-29, 2021.

Peter Kairouz, Brendan Mcmahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shuffling. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning , volume 139 of Proceedings of Machine Learning Research , pages 5213-5225. PMLR, 18-24 Jul 2021. URL https://proceedings . mlr . press/v139/kairouz21b . html .

Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and Trends® in Machine Learning , 14(1-2):1-210, 2021.

Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning , pages 5132-5143. PMLR, 2020.

Anastasia Koloskova, Nicolas Loizou, Sadra Boreiri, Martin Jaggi, and Sebastian U. Stich. A unified theory of decentralized SGD with changing topology and local updates. In Proceedings of the 37th International Conference on Machine Learning , ICML'20. JMLR.org, 2020.

Antti Koskela, Joonas Jälkö, Lukas Prediger, and Antti Honkela. Tight differential privacy for discrete-valued mechanisms and for the subsampled gaussian mechanism using FFT. In International Conference on Artificial Intelligence and Statistics , pages 3358-3366. PMLR, 2021.

Chao Li, Michael Hay, Vibhor Rastogi, Gerome Miklau, and Andrew McGregor. Optimizing linear counting queries under differential privacy. In Proceedings of the twenty-ninth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems , pages 123-134, 2010.

Chao Li, Gerome Miklau, Michael Hay, Andrew Mcgregor, and Vibhor Rastogi. The matrix mechanism: optimizing linear counting queries under differential privacy. The VLDB Journal , 24:757-781, 2015.

Aurelien Lucchi, Frank Proske, Antonio Orvieto, Francis Bach, and Hans Kersting. On the theoretical properties of noise correlation in stochastic optimization. Neural Information Processing Systems , 2022.

Horia Mania, Xinghao Pan, Dimitris Papailiopoulos, Benjamin Recht, Kannan Ramchandran, and Michael I. Jordan. Perturbed iterate analysis for asynchronous stochastic optimization. SIAM Journal on Optimization , 27(4):2202-2229, 2017. doi: 10 . 1137/16M1057000. URL https://doi . org/10 . 1137/16M1057000 .

Ryan McKenna, Gerome Miklau, Michael Hay, and Ashwin Machanavajjhala. Optimizing error of high-dimensional statistical queries under differential privacy. arXiv preprint arXiv:1808.03537 , 2018.

Ryan McKenna, Gerome Miklau, Michael Hay, and Ashwin Machanavajjhala. Hdmm: Optimizing error of high-dimensional statistical queries under differential privacy. arXiv preprint arXiv:2106.12118 , 2021.

Brendan McMahan and Abhradeep Thakurta. Federated learning with formal differential privacy guarantees. Google AI Blog , 2022.

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics , pages 1273-1282. PMLR, 2017.

Konstantin Mishchenko, Ahmed Khaled, and Peter Richtárik. Random reshuffling: Simple analysis with vast improvements. Advances in Neural Information Processing Systems , 33: 17309-17320, 2020.

Aritra Mitra, Rayana Jaafar, George J Pappas, and Hamed Hassani. Linear convergence in federated learning: Tackling client heterogeneity and sparse gradients. Advances in Neural Information Processing Systems , 34:14606-14619, 2021.

Yurii Nesterov. A method for solving the convex programming problem with convergence rate o (1 /k 2 ) . Proceedings of the USSR Academy of Sciences , 269:543-547, 1983.

John Nguyen, Kshitiz Malik, Hongyuan Zhan, Ashkan Yousefpour, Mike Rabbat, Mani Malek, and Dzmitry Huba. Federated learning with buffered asynchronous aggregation. In International Conference on Artificial Intelligence and Statistics , pages 3581-3607. PMLR, 2022.

Antonio Orvieto, Hans Kersting, Frank Proske, Francis Bach, and Aurelien Lucchi. Anticorrelated noise injection for improved generalization. arXiv preprint arXiv:2202.02831 , 2022.

Antonio Orvieto, Anant Raj, Hans Kersting, and Francis Bach. Explicit regularization in overparametrized models via noise injection. arXiv preprint arXiv:2206.04613 , 2022.

B.T. Polyak. Some methods of speeding up the convergence of iteration methods. USSR Computational Mathematics and Mathematical Physics , 4(5):1-17, 1964. ISSN 0041-5553. doi: https://doi . org/10 . 1016/0041-5553(64)90137-5. URL https://www . sciencedirect . com/ science/article/pii/0041555364901375 .

Herbert Robbins and Sutton Monro. A stochastic approximation method. The Annals of Mathematical Statistics , 22(3):400 - 407, 1951. doi: 10 . 1214/aoms/1177729586. URL https: //doi . org/10 . 1214/aoms/1177729586 .

Shai Shalev-Shwartz, Ohad Shamir, Nathan Srebro, and Karthik Sridharan. Stochastic convex optimization. In Annual Conference Computational Learning Theory , 2009.

Sebastian U. Stich. Local SGD converges fast and communicates little. In International Conference on Learning Representations , 2019. URL https://openreview . net/forum?id= S1g2JnRcFX .

Sebastian U. Stich and Sai Praneeth Karimireddy. The error-feedback framework: Better rates for SGD with delayed gradients and compressed updates. J. Mach. Learn. Res. , 21(1), jun 2022. ISSN 1532-4435.

Sebastian U Stich, Jean-Baptiste Cordonnier, and Martin Jaggi. Sparsified SGD with memory. Advances in Neural Information Processing Systems , 31, 2018.

Om Thakkar, Galen Andrew, and H. B. McMahan. Differentially private learning with adaptive clipping. In Advances in Neural Information Processing Systems , 2021.

Hoang Tran and Ashok Cutkosky. Momentum aggregation for private non-convex erm, 2022.

Harsh Vardhan and Sebastian U. Stich. Tackling benign nonconvexity with smoothing and stochastic gradients, 2022. URL https://arxiv . org/abs/2202 . 09052 .

Di Wang, Minwei Ye, and Jinhui Xu. Differentially private empirical risk minimization revisited: Faster and more general. Advances in Neural Information Processing Systems , 30, 2017.

Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled Rényi differential privacy and analytical moments accountant. In The 22nd International Conference on Artificial Intelligence and Statistics , pages 1226-1235. PMLR, 2019.

Hao Yu, Rong Jin, and Sen Yang. On the linear speedup analysis of communication efficient momentum sgd for distributed non-convex optimization. In International Conference on Machine Learning , pages 7184-7193. PMLR, 2019.

Ganzhao Yuan, Yin Yang, Zhenjie Zhang, and Zhifeng Hao. Convex optimization for linear query processing under approximate differential privacy, 2016. URL https://arxiv . org/ abs/1602 . 04302 .

Honglin Yuan and Tengyu Ma. Federated accelerated stochastic gradient descent. Advances in Neural Information Processing Systems , 33:5332-5344, 2020.

Chulhee Yun, Shashank Rajput, and Suvrit Sra. Minibatch vs local SGD with shuffling: Tight convergence bounds and beyond. In International Conference on Learning Representations , 2022. URL https://openreview . net/forum?id=LdlwbBP2mlq .

Mo Zhou, Tianyi Liu, Yan Li, Dachao Lin, Enlu Zhou, and Tuo Zhao. Toward understanding the importance of noise in training neural networks. In International Conference on Machine Learning , pages 7594-7602. PMLR, 2019.

Yuqing Zhu and Yu-Xiang Wang. Poission subsampled Rényi differential privacy. In International Conference on Machine Learning , pages 7634-7642. PMLR, 2019.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a new analysis method that unifies the analysis of noisy gradient descent-based algorithms, where the noise is added to the matrix factorization, which provides a tight analysis of both the algorithms simultaneously, and hence would give the analysis for convergences for a general class of such matrix-factorization based gradient descent algorithms. Based on this new analysis, the authors also propose a new matrix factorization objective to further tighten the upper bound and empirically show it.\n\nSTRENGTHS:\n- The method of analysis is based on a very simple yet essential idea and it opens the possibilities of a unified method of analysis for a good class of algorithms which are based on gradient descent algorithms based on matrix factorization.\n- The transition from proposing a tighter bound to a new matrix factorization objective shows powerful empirical applications of this class of algorithms to private optimization.\n- The paper is theoretically very sound.\n- Evaluation done on the paper is simple and easy to understand and evaluation has been done not only with respect to utility but also to visualize the trend that the gradients follow across training.\n\nWEAKNESSES:\n- The novelty and the reach of this problem are limited to a very specific class of algorithms on a practical scale.\n- Although the authors have already addressed this in their future work, it is still important to note that the average case analysis for differentially private algorithms might not be a correct metric to judge the performance of the model since the final iterate of the algorithm is returned.\n\nQUESTIONS:\n- Can the authors elaborate on what they exactly want to denote using Figure 1 and maybe provide a more clear diagram for it so that the process can be understood better?\n\nLIMITATIONS:\nAuthors have mentioned most of the limitations in their future work and additional points have been discussed above in the weakness section (novely and final iterate analysis).", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper conducted a theoretical study of gradient descent with linearly correlated noise, with strong motivation from the theory and applications of differential privacy (in particular, the popular DP-SGD algorithm).\n\nThe main contribution is a new convergence analysis based on the idea of \"restart iterations\". The paper argues that it unifies two previous  \"incompatible\" analyses for two different noisy gradient descent algorithms, namely perturbed gradient descent (PGD) and anti-PGD.\n\nInspired by the new analysis, this paper proposes a new matrix factorization method for noisy SGD. The matrix factorization coordinates noises across different iterations of gradient descent. The new factorization refines a previous method. Experiments show that it compares favorably to prior works.\n\nSTRENGTHS:\n* The paper is very well-written and looks both educational and professional.\n* It tackles an important and popular question of optimization and private learning. The \"restart iteration\" analysis looks nice. However, I don't work on this area myself, it is hard for me to evaluate the novelty of the new analysis.\n\nWEAKNESSES:\n* I am slightly dissatisfied with the hyper-parameter \"\\tau\" required in your new algorithm and analysis (more on this in the question section).\n\nQUESTIONS:\n* If possible, it would be nice to discuss why the two analyses for PGD and anti-PGD are incompatible. Also, I am curious if the two different proofs directly inspire your analysis.\n\n* Your paper shows that the \"restart\" in analysis and algorithm design does help. However, could you provide some intuition on why \"restart\" is beneficial in both theory and applications? Do you have evidence that this method yields tight analysis?\n\n* Are there good heuristics to find an appropriate \"tau\" in practice? Is there a way to come up with an algorithm that is equally good, but does not require the knowledge of the hyperparameter?\n\nLIMITATIONS:\nThe limitations and future directions are discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies (stochastic) gradient descent with linearly correlated noise. The paper builds upon recent results on (MF-)DP-FTRL. It highlights the limitations of this methods, proposes a restarting trick to improve it, and derive the corresponding analysis. Interestingly, the proposed analysis gives a unified analysis of PGD and Anti-PGD, that are difficult to analyze together otherwise. Theoretical results are confirmed by numerical experiments.\n\nSTRENGTHS:\nOverall, I think this paper is a nice paper, that perfectly fits the conference.\n1. The proposed method identifies the limitations of an (important) existing method and proposes a clever trick to overcome them.\n2. Corresponding theory is derived in multiple settings (convex and non-convex), and is confirmed by numerical experiments.\n3. Overall, the paper is very pleasant to read (even the appendix), with a clear introduction and clear motivations, and the math seems to be correct.\n\nWEAKNESSES:\nIn my opinion, this paper does not have major weaknesses. I only have a few minor remarks.\n1. The method is claimed to work for DP-SGD, but the theory is only derived with full-batch gradients. This is a bit unfortunate since DP-FTRL-like methods aim at providing stochastic DP algorithms that do not rely on amplification.\n2. The proposed method seems a bit \"handmade\": it seems there is something deeper behind it.\n3. Example 3.3 is a bit crude and could benefit from a little more details (on the choice of the pseudo-inverse and the fact that B and C are not square).\n\nQUESTIONS:\n1. The restarting trick essentially states that not all iterates should have correlated noise. Do you think this is a fundamental property of the method or simply a caveat of the analysis?\n2. How does the restarting trick affect numerical performances in terms of time of execution? It seems that solving $OPT_F(\\Lambda_\\tau A)$ could be easier due to the structure of $\\Lambda_\\tau$: is it the case?\n\nLIMITATIONS:\nYes, authors pointed that their analysis does not encompass clipping, and only works for averaged iterate. Some other research directions/limitations have also been mentioned in the conclusion.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-21"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper develops many techniques to analyze gradient descent convergence with linearly correlated noise, a setting motivated by many DP algorithms. The work derives tighter bounds, and use the resulting insights to motivate DP-MF and DP-MF+.\n\nSTRENGTHS:\n- The paper is structured well, and is very notationally precise for the most part. \n- The theoretical results are very involved, and I particularly appreciate the authors including several noteworthy special cases.\n\nWEAKNESSES:\nClarity:\n- This work is not very self contained, and it seems like the authors expect the reader to be very familiar with Denisov et al. and Choquette-Choo et al. This makes the work a bit difficult to follow at times. I would advise the authors to include more details about these works in the supplementary or even the main paper if possible.\n- Related to the previous point, details about Example 3.3 in Section 3 are not provided at all. \n- This is a minor suggestion, but using $x$ to denote the weights is unconventional in the machine learning community as it typically is used to denote the dataset. This may be a source of confusion to some readers.\n\nPracticality:\n- The problem setting seems impractical, as factorizing $\\mathbf{A} \\in \\mathbb{R}^{T x T}$ is intractable in realistic settings. In the experimental settings considered in this work, T is reasonable. However, in practice $T$ can be on the order of millions and even a one-time matrix factorization is not tractable.\n- Is Assumption 4.2 a realistic assumption for deep learning? The loss landscapes for neural networks are typically extremely sharp, rendering some of the convergence rate results vacuous. I understand that this is a common assumption in the optimization community.\n\nQUESTIONS:\n1. How can this method be scaled to large $T$?\n\nLIMITATIONS:\nLimitations are adequately discussed.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-22"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies variants of noisy gradient descent, focusing on when the noise added at different time steps may be dependent. The motivation of this is differentially private optimization: while the standard DP-(S)GD adds independent noise at each time step, the recent DP-FTRL mechanism [1] adds carefully correlated noise. Even more recent work [2,3] extends this approach via the matrix mechanism. This paper builds heavily on the latter two works. It begins by identifying how the prior analysis is pessimistic and settings where one might hope to improve upon it.\n\nWe then analyze in detail \"perturbed gradient descent,\" PGD, ie gradient descent with independent Gaussian noise, and \"anti-PGD,\" which after each gradient step we add a new noise term and *subtract* the noise term from the previous time step. This latter method is closely related to randomized smoothing. \n\nThe authors establish the main theorems (for general \"noisy SGD-type\" algorithms without clipping) via a novel analysis, analyzing virtual iterates that periodically revert to the actual sequence.\n\nThe authors perform experiments, first on synthetic data without gradient clipping (to validate their theorems) and then with clipping on benchmark data sets. They show that, in some settings, their approach matches or exceed DP-SGD.\n\n[1] Kairouz, P., McMahan, B., Song, S., Thakkar, O., Thakurta, A., & Xu, Z. (2021, July). Practical and private (deep) learning without sampling or shuffling. In International Conference on Machine Learning (pp. 5213-5225). PMLR.\n\n[2] Denisov, S., McMahan, H. B., Rush, J., Smith, A., & Guha Thakurta, A. (2022). Improved differential privacy for sgd via optimal private linear operators on adaptive streams. Advances in Neural Information Processing Systems, 35, 5910-5924.\n\n[3] Choquette-Choo, C. A., McMahan, H. B., Rush, K., & Thakurta, A. (2022). Multi-epoch matrix factorization mechanisms for private machine learning. arXiv preprint arXiv:2211.06530.\n\nSTRENGTHS:\nThe paper investigates a topic of clear theoretical and practical importance; there is substantial food for thought. In particular, the authors convince me that there is more to be done in this direction. They analyze simplified cases but lay out many directions for further analysis. I agree that the paper \"highlights the wealth of stochastic optimization questions arising from recent advances in differentially private model training.\"\n\nIn addition, the paper makes clear progress beyond prior work, bringing a new set of tools to bear.\n\nI thought the analysis for the main theorems was very cool. It seems plausible that this type of analysis might be extended or applied elsewhere.\n\nI feel the authors do a good job placing their work within the broader literature.\n\nWEAKNESSES:\nThe paper has limited scope and there were fewer conclusions after the main theorems than I had hoped. For instance, in line 253 we read \"Intuitively, since $\\lVert \\Lambda_{\\tau} \\mathbf{B}\\rVert_{F}^{2}$ is a better proxy for learning performance than $\\lVert \\mathbf{B}\\rVert_{F}^2$, minimizing this quantity... should lead to... better privacy-utility tradeoffs.\" The \"intuition\" just repeats the paper's setup, that of finding better factorization. I would like a discussion of *why* this proxy is better, beyond the theorem statement.\n\nI feel that future work may supercede this approach without building on it. It is not clear how much this paper would contribute beyond pointing out that there is more work to be done. Indeed, perhaps algorithms from from Choquette-Choo et al. already outperform this approach? While the contribution is clear, I feel there is a ceiling on its impact.\n\nI feel the paper spends too little time on background. This is on purpose, since the setup is similar to that of Denisov et al. and Choquette-Choo et al. However, I would like to see a more self-contained discussion. Two examples in particular stand out to me: first, the expression sens(C) is never defined. Second, as far as I can tell there is no detail on how DP-SGD was run as an experimental baseline.\n\nAlthough the motivation and experiments deal with privacy, the main theoretical results are for nonprivate algorithms. I was confused by this at first, especially in the transition from Section 2 to 3: the paper says \"we derive a tighter bound... to design better factorization mechanisms for differentially private optimization,\" and then almost immediately says \"we omit gradient clipping from our analysis.\"\n\nQUESTIONS:\nWhat is the DP-SGD you're comparing against? How were the hyperparameters selected?\n\nCan you elaborate on what kinds of factorizations your approach favors? Do you have an intuition for how they differ from those of Denisov et al.?\n\nThe main theorems specify a value of $\\tau$, but the experimental performance seems to improve monotonically with $\\tau$. Maybe I missed it, but do you have an idea for why that is?\n\nLIMITATIONS:\nI feel the authors are clear about the limitations of their work. As I see it, the main limitations are (i) the narrow scope and (ii) the experiments, which I feel are more \"illustrative\" rather than comparing to the state of the art.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-28"}