Title: Why Differentially Private Local SGD -- An Analysis of Synchronized-Only Biased Iterate
Venue: NeurIPS 2023
Accepted: no
Keywords: Local SGD

Differential Privacy

Clipping
Abstract: We argue to use Differentially-Private Local Stochastic Gradient Descent (DP-LSGD) in both centralized and distributed setups, and explain why DP-LSGD enjoys higher clipping efficiency and produces less clipping bias compared to classic Differentially-Private Stochastic Gradient Descent (DP-SGD). For both convex and non-convex optimization, we present generic analysis on noisy synchronized-only iterates in LSGD, the building block of federated learning, and study its applications to differentially-private gradient methods with clipping-based sensitivity control. We point out that given the current {\em decompose-then-compose} framework, there is no essential gap between the privacy analysis of centralized and distributed learning, and DP-SGD is a special case of DP-LSGD. We thus build a unified framework to characterize the clipping bias via the second moment of local updates, which initiates a direction to systematically instruct DP optimization by variance reduction. We show DP-LSGD with multiple local iterations can  produce more concentrated local updates and then enables a more efficient exploitation of the clipping budget with a better utility-privacy tradeoff. In addition, we prove that DP-LSGD can converge faster to a small neighborhood of global/local optimum compared to regular DP-SGD. Thorough experiments on practical deep learning tasks are provided to support our developed theory. 

Abstract

We argue to use Differentially-Private Local Stochastic Gradient Descent (DPLSGD) in both centralized and distributed setups, and explain why DP-LSGD enjoys higher clipping efficiency and produces less clipping bias compared to classic Differentially-Private Stochastic Gradient Descent (DP-SGD). For both convex and non-convex optimization, we present generic analysis on noisy synchronizedonly iterates in LSGD, the building block of federated learning, and study its applications to differentially-private gradient methods with clipping-based sensitivity control. We point out that given the current decompose-then-compose framework, there is no essential gap between the privacy analysis of centralized and distributed learning, and DP-SGD is a special case of DP-LSGD. We thus build a unified framework to characterize the clipping bias via the second moment of local updates, which initiates a direction to systematically instruct DP optimization by variance reduction. We show DP-LSGD with multiple local iterations can produce more concentrated local updates and then enables a more efficient exploitation of the clipping budget with a better utility-privacy tradeoff. In addition, we prove that DP-LSGD can converge faster to a small neighborhood of global/local optimum compared to regular DP-SGD. Thorough experiments on practical deep learning tasks are provided to support our developed theory.

1 Introduction

Local Stochastic Gradient Descent (LSGD) [1, 2] and (Local/Client-Level) Differential Privacy (DP) [3, 4, 5] are two popular methods to address the issues of communication efficiency and data privacy, respectively. Rooted in the FedAvg framework first proposed in [6], instead of communicating and synchronizing on the local updates from each user at each iteration, LSGD [1] randomly samples participants to perform gradient descent on their local data in parallel and only aggregates their local updates periodically. Though LSGD is a simple generalization of SGD to a distributed setup with a lower synchronization frequency, empirically it is known to produce promising performance, with regard to both communication efficiency and convergence rate [7]. When each user holds i.i.d. data, LSGD provably achieves a linear speedup in the number of users with also asymptotic improvements on the communication overhead over regular distributed SGD to produce equivalent accuracy [1, 2].

As for privacy preservation, DP [3, 8] provides a semantically precise way to quantify the data leakage from any processing. At a high level, DP is an input-independent guarantee which ensures that an adversary cannot infer the participation of an individual datapoint easily from the release. For example, the classic ( /epsilon1 , δ ) -DP with small security parameters /epsilon1 and δ implies a large Type I or Type II error for an adversarial hypothesis testing to guess whether an arbitrary individual is involved in the processing [9]. In DP research, one key problem is to determine the sensitivity , the worst-case influence/change on the output of the objective processing after arbitrarily replacing an individual in an input set. Only

with tractable sensitivity, one can then apply proper randomization/perturbation such as the Gaussian 37 or Laplace mechanism [10] to produce required security parameters. Unfortunately, sensitivity is 38 in general NP-hard to compute [11]. To this end, in practice, a commonly-applied alternative is the 39 decompose-then-compose framework: a complicated processing is first (approximately) decomposed 40 into several simpler (possibly adaptive) subroutines such as mean estimation, each of whose sen41 sitivity is controllable. A white-box adversary is then assumed who can observe the intermediate 42 computations, and an upper bound on the privacy loss is derived by the composition of the leakage 43 from the virtual release in each step [12]. 44

45

46

47

48

49

50

51

52

53

54

55

56

57

In the applications of machine learning, where the processing function returns a model trained on possibly sensitive data, arguably the most popular and generic DP privatization method is DP-SGD [13, 14]. As a representative of the above-mentioned decompose-then-compose framework, DP-SGD views the SGD as a sequence of adaptive gradient mean estimations. To ensure a bounded sensitivity guarantee, each per-sample gradient is clipped, usually, in l 2 -norm [14] to some constant c , which is essentially a projection to an l 2 -norm ball of radius c . Noise, which is determined by both the number of iterations T and the clipping threshold c (sensitivity bound), is then added to the clipped stochastic gradient in each iteration to produce satisfied DP parameters ( /epsilon1 , δ ) under T -fold composition. A wider dimension and a longer convergence time T will consequently require a larger DP noise. Though the implementation of DP-SGD does not require any additional assumptions on either model or training data, it is notorious for heavy utility loss, especially for deep learning. Moreover, the understanding of the clipping bias from this artificial sensitivity control remains limited. In general, due to the bias, clipped SGD will not converge even without noise perturbation [15, 16].

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

Given the artificial assumption that DP-SGD releases the intermediate computations, there is no essential gap between the privacy analysis of the centralized and local SGD, except that in the distributed setup one may apply different DP metrics such as Local DP (LDP) [4] or client-level DP [5] to consider the privacy preservation for each user's local data. More interestingly, it is worth noting the connection among different problems in federated learning and DP-SGD that are essentially equivalent. First, it is not hard to see that DP-SGD is a special case of DP-LSGD. DP-SGD can be viewed as: n nodes, each holds a sample, and a virtual server collects the clipped stochastic gradient from a subset of sampled nodes in every iteration , and publishes a noisy gradient descent. DP-LSGD can be similarly defined where the only difference is that the server may not synchronize on each iteration, but clips and aggregates a linear combinations of local gradients, periodically . Thus, as a primary concern in federated learning, a smaller communication overhead in a lower synchronization/aggregation frequency would also imply less leakage and a smaller composition bound of privacy loss. On the other hand, the study on the utility loss by perturbation and artificial sensitivity control (clipping) could also be used to analyze federated learning with compressed communication [17] where there exists quantification error in broadcasted local updates. Therefore, in this paper, we aim to provide a unified analysis for both noisy LSGD and DP-LSGD/SGD to get new insights. Before we can build useful theory to capture these concerns from different perspectives, several technical challenges need to be addressed.

Utility of "Synchronized/Published" Iterate Only : Many existing convergence results [2, 18, 19, 20, 21] on non-private LSGD are developed on the (weighted) average of all iterates. These include the intermediate iterates produced during the local updates from each user/node, which will not be exposed or shared. To properly characterize the effect of perturbation, a more appropriate and realistic convergence guarantee is to measure the performance of synchronized (shared) iterates only. This is also important to help understand the practical performance of LSGD as neither the server nor users have access to all intermediate computations. Such measurement is especially necessary when we apply LSGD in a private version: the utility of concern is only with respect to the released outputs, and anything assumed to be published would incur privacy loss and increase the scale of DP noise.

Clipping Bias and Data Heterogeneity : In practice, tight sensitivity of many data processing 85 algorithms is intractable and thus a very popular but artificial control is clipping. However, clipping 86 could also bring non-negligible bias. In general, there is no convergence guarantee for clipped SGD 87 if we only assume the stochastic gradient is of bounded variance [15], though under more restrictive 88 assumptions, for example, when the stochastic gradient is in a symmetric [15] or light-tailed [22] 89 distribution, or provided generalized smoothness [23], some (near) convergence results are known. A 90 concise characterization of such clipping bias still largely remains open, especially for deep learning. 91

92

The bias is even more complicated in the more general DP-LSGD. To provide meaningful theory

93

to instruct systematic bias reduction, we do not want to assume Lipschitz continuity or bounded

gradient, which may make the analysis trivial and impractical. Thus, the desired analysis essentially 94 captures the scenario given heavy data heterogeneity, and the results should not require a bounded 95 difference among the local updates. 96

97

98

99

100

In this paper, through tackling the above-mentioned challenges, we aim to provide useful and intuitive theory to understand practical performance of LSGD and instruct optimization with DP guarantees. In particular, we want to explain how DP-LSGD out-performs regular DP-SGD. We summarize our contributions as follows.

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

With only a mild assumption that the stochastic gradient is of bounded variance, we present the convergence analysis on the released-only iterates of LSGD under perturbation for both convex and non-convex smooth optimization in Theorem 3.1 and 3.2. In particular, for the general convex case, we show more powerful last iterate convergence, which could be of independent interest in developing generic last-iterate analysis with unbounded gradients.

We then generalize our results to study the utility of DP-LSGD, where DP-SGD becomes a special case. In particular, we use the incremental norm of local update (see Definition 4.1) to characterize the clipping bias and show DP-LSGD has a faster convergence rate to a small neighborhood of global/local optimum as compared to DP-SGD.

We further show LSGD behaves as an efficient variance reduction of local update, where multiple local GDs with a small learning rate cancel out substantial sampling noise, and enable more efficient clipping compared to DP-SGD. Thorough experiments show that DP-LSGD produces a much sharpened utility-privacy tradeoff in practical deep learning.

1.1 Related Works

Convergence Analysis of LSGD : With the increasing scale of both training data and models, federated learning has become an important paradigm in modern machine learning, where LSGD and its variants form the building block. Though the idea of LSGD can be traced back to earlier works [24, 25], the theoretical convergence analysis has only been proved recently. A common strategy to show convergence is to consider a virtual average of all the intermediate iterates produced by each user, and keep track of the divergence (dissimilarity) between the virtual average and the local iterate. In the setup where each user holds i.i.d. data, Stich in [1] studied strongly-convex optimization with LSGD and showed a linear speedup in the number of users/nodes. [26] presented non-convex analysis under the Lipschitz continuity assumption where the divergence of local update is also bounded.

For the more general applications with heterogeneous data, [27] studied the convex case with local GD (without sampling on either users or users' local data) but still under Lipschitz continuity. [2] presented more generic and tighter analysis for LSGD without assumptions on bounded gradient for both strongly and general convex optimization. Further generalization of LSGD to the decentralized setup under arbitrary network topology was considered in [19, 28, 29]. However, many existing works [2, 19, 28] only showed the convergence rate relying on all the intermediate averages. To our knowledge, the first generic analysis for synchronized-only iterates was shown in [30]. [30] proposed Scaffold, a generalized LSGD with careful correction on the client-drift caused by data heterogeneity. Compared to existing works, in this paper, we prove more powerful last-iterate analysis for general convex optimization with clipping and perturbation for privacy. It is also worth mentioning that with a different motivation, there is another line of works also studying noisy LSGD to capture the effect of compressed local updates to further save the communication cost. But, in most existing related works [17, 31], the compression error is assumed to be independent with zero-mean. As we need to study DP-LSGD with clipped local update, which introduces bias in the local update generation, in this paper we present more involved analysis to handle such adaptive and biased perturbation.

Convergence Analysis of DP-SGD and DP-LSGD : Asymptotically, under Lipschitz continuity, DP139 SGD is known to produce a tight utility-privacy tradeoff [32, 33], where no bias is produced given a 140 clipping threshold larger than the Lipschitz constant. However, without Lipschitz continuity, practical 141 understanding of DP-SGD remains limited. On one hand, negative examples are shown in [15, 16] 142 where clipped-SGD in general will not converge, and in practice clipped-SGD does produce bias 143 and has a lower convergence rate, especially in deep learning applications compared to regular SGD 144 [16]. On the other hand, under more restrictive assumptions on the stochastic gradient distribution, 145 clipped-SGD can be shown to (nearly) converge [15, 22, 23]. A generic characterization on the 146

147

clipping bias still largely remains open. As a consequence, there is little known meaningful theory to

systematically instruct optimization algorithms with DP guarantees, and most existing private deep 148 learning works are empirical, which aim to search for the optimal model and hyperparameters for 149 objective training data [34, 35, 36]. As for DP-LSGD, to our knowledge the only known theoretical 150 result that captures the clipping bias is [16]. However, [16] still assumes globally bounded gradient 151 compared to bounded second moment as assumed in our results, and its main motivation is to study 152 the clipping effect in client-level DP. In this paper, we show more intuitive and generic analysis of 153 DP-LSGD for both convex and non-convex optimization, and our motivations are also very different. 154 We set out to provide usable quantification on the utility loss due to clipping and we argue to apply 155 DP-LSGD both in the centralized and distributed setup , since DP-LSGD can significantly reduce the 156 clipping bias with a faster convergence rate. 157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

2 Preliminaries

We focus on the classic Empirical Risk Minimization (ERM) problem. Given a dataset D = { ( x i , y i ) , i = 1 , 2 , · · · , n } , the loss function is defined as F ( w ) = 1 n · ∑ n i =1 f ( w,x i , y i ) = 1 n · ∑ n i =1 f i ( w ) . We will consider the cases where the loss function f i ( w ) : W → R + is convex or non-convex. w ∗ = arg min w F ( w ) represents the global optimum. Some formal definitions about the properties of the objective loss function are defined as follows.

Definition 2.1 (Smoothness) . A function f is β -smooth on W if the gradient ∇ f ( w ) is β -Lipschitz such that for all w,w ′ ∈ W , ‖∇ f ( w ) -∇ f ( w ′ ) ‖ ≤ β ‖ w ′ -w ‖ .

Definition 2.2 (Convexity and Strong Convexity) . A function f ( w ) is λ -convex on W if for all w,w ′ ∈ W , λ 2 ‖ w -w ′ ‖ 2 ≤ f ( w ) -f ( w ′ ) -〈∇ f ( w ′ ) , w -w ′ 〉 . We call f ( w ) general convex if λ = 0 , and f ( w ) is strongly convex if λ > 0 .

Assumption 2.1 (Bounded Variance of Stochastic Gradient) . For any w ∈ W and an index i that is randomly selected from { 1 , 2 , · · · , n } , there exists τ > 0 such that E [ ‖∇ F ( w ) -∇ f i ( w ) ‖ 2 ] ≤ τ .

Assumption 2.1 is the only additional assumption we need for the analysis of non-private LSGD without clipping. We formally present the non-private LSGD algorithm in Algorithm 1 which uses non-clipped local update (3). The whole process is formed of T phases. In each phase, by q -Poisson sampling, in expectation ( nq ) many users will be selected to perform K local gradient descents on their local data before broadcasting the local update. To match the DP-LSGD where the local function f i ( w ) held by each user may only be determined by a single datapoint, we do not consider an additional stochastic gradient oracle on the local function in Algorithm 1, but only assume random sampling on the user level at each phase. However, our results can be easily generalized to the scenario with stochastic local gradient. Moreover, we assume Poisson sampling in Algorithm 1 so as to match the setup of DP-LSGD, since given current studies on privacy amplification by sampling, Poisson sampling can produce the tightest results [37] (and has become the most popular option in practice [36, 38]). In the following, we introduce the definition of DP.

Definition 2.3 (Differential Privacy [38]) . Given a universe X ∗ , we say that two datasets X,X ′ ⊆ X ∗ are adjacent, denoted as X ∼ X ′ , if X = X ′ ∪ x or X ′ = X ∪ x for some additional datapoint x ∈ X . A randomized algorithm M is said to be ( /epsilon1 , δ ) -differentially-private (DP) if for any pair of adjacent datasets X,X ′ and any event set O in the output domain of M , it holds that

In Definition 2.3, we apply the unbounded DP definition as adopted in most existing DP-SGD works [16, 35, 38], where the two adjacent datasets are defined to differ in one datapoint. One may also apply the bounded DP definition [8] by defining the adjacent datasets as arbitrarily replacing a datapoint. However, as a stronger definition, bounded DP will also face a larger sensitivity bound.

We can now formally describe DP-LSGD and DP-SGD. In (2) of Algorithm 1, a clipping operation 191 on a vector v with threshold c is defined as CP ( v, c ) = v · min { 1 , c/ ‖ v ‖ } , which ensures a bounded 192 sensitivity up to c . Using the clipped local update (2), by selecting Q ( t ) to be proper DP noise, 193 Algorithm 1 captures DP-SGD when K = 1 and DP-LSGD for general K ≥ 1 . DP-LSGD (SGD) is 194 essentially an LSGD (SGD) with clipped local update (per-sample gradient) and additional DP noise. 195 Running for T iterations with a total privacy budget ( /epsilon1 , δ ) , one may select Q ( t ) ∼ N (0 , σ 2 · I d ) 196 where σ = ˜ O ( qc √ T log(1 / δ ) / /epsilon1 ) by the composition bound [38]. The privacy analysis and the noise 197 bound are identical for both DP-LSGD and DP-SGD given the same clipping threshold c . 198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

Algorithm 1 (Differentially Private) Local SGD with Noisy (Clipped) Periodic Averaging

1: Input: A system of n workers where each holds a local loss function F ( w ) = f i ( w ) , sampling rate q , update step size η , local update length K and global synchronization number T , clipping threshold c , and initialization ¯ w (0) with synchronization noise Q (1: T ) .

2: for t = 1 , 2 , · · · , T do 3: Implement i.i.d. sampling to select an index batch S ( t ) = { [1] , · · · , [ B t ] } from { 1 , 2 , · · · , n } of size B t .

5: w ( t, 0) [ i ] = ¯ w ( t -1) .

4: for i = 1 , 2 , · · · , B t in parallel do

6:

for

k

= 1

,

2

,

, K

do

· · ·

11: if to ensure Differential Privacy with clipping then

12:

13:

else

14:

15: end if

16: end for

17: Output : ¯ w ( t ) for t = 1 , 2 , · · · , T .

We want to stress again that our motivation to study DP-LSGD is not because we only focus on the federated setup, but to provide a unified analysis of the clipping bias and argue for using DP-LSGD even in the centralized setup . Our results are straightforwardly applicable to distributed learning with local DP [4] or client-level DP [5], where the only difference is that we may add a larger noise Q ( t ) determined by the number of local datapoints or the users involved, respectively, for these stronger DP definitions. As for the possible communication restriction where we need to add discrete noise of finite precision, one may replace the Gaussian noise by the Binomial mechanism [39].

3 Convergence of Synchronized-Only Iterate in Noisy Non-Clipped LSGD

In this section, we will study the convergence analysis of LSGD in Algorithm 1 using the non-clipped local update (3) for both convex and non-convex optimization.

Theorem 3.1 (Last-iterate Convergence of Noisy LSGD in General Convex Optimization) . For an objective function F ( w ) = 1 n · ∑ n i =1 f i ( w ) where f i ( w ) is convex and β -smooth with variancebounded gradient (Assumption 2.1), when η < min { β √ 24 K , 1 β , 1 2 β +3 K β / ( nq ) } , log( TK ) ≥ 2 , and Q ( t ) is an independent noise such that E [ Q ( t ) ] = 0 and E [ ‖ Q ( t ) ‖ 2 ] ≤ ¯ Q , for some parameter ¯ Q for t = 1 , 2 , · · · , T , Algorithm 1 with (3) ensures

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

The proof can be found in Appendix A. To prove Theorem 3.1, with a careful analysis on ‖ ¯ w ( t ) -w ∗ ‖ 2 , we develop a new last-iterate analysis framework, different from existing works [40, 41, 42] which must count on the assumption of bounded gradient. In Theorem 3.1, we need to assume the noise Q to be independent and of zero-mean. Because we do not assume Lipschitz continuity of F ( w ) , we cannot provide a meaningful upper bound of the deviation between F ( w ) and F ( w + Q ) for arbitrary w and Q in general. However, provided the Lipschitz assumption, Theorem 3.1 can be easily generalized to handle biased perturbation. In Section 4, with an additional assumption on the similarity of the local functions (Assumption 4.2), we will show how to handle the clipping bias as a special biased noise. When there is no noise ¯ Q = 0 , provided that K = O ( T 1 / 3 / ( nq ) 2 / 3 ) , we show LSGD achieves ˜ O ( ‖ ¯ w (0) -w ∗ ‖ 2 + τ / ( nq ) 2 / 3 √ TK ) last-iterate convergence in general-convex optimization.

We now study the non-convex scenario.

Theorem 3.2 (Synchronized-only Iterate Convergence of Noisy LSGD in Non-convex Optimization) . For an arbitrary objective function F ( w ) = 1 n · ∑ n i =1 f i ( w ) , where f i ( w ) is β -smooth and satisfies Assumption 2.1, and for arbitrary perturbation (not necessarily independent or of zero mean) where E [ ‖ Q ( t ) ‖ 2 ] ≤ ¯ Q , when η < min { β √ 24 K , 1 4 β K } , Algorithm 1 with (3) ensures that

when we select η = O ( ( nq ) 1 / 3 T 1 / 3 K τ 1 / 3 ) . In particular, when Q ( t ) is independent and E [ Q ( t ) ] = 0 , and η = Θ (1 /K ) , then

The proof can be found in Appendix B. In Theorem 3.2, we provide an analysis on the effect of generic perturbation, which can also be used to capture the clipping bias in DP-LSGD. When there is no perturbation, Theorem 3.2 has two implications. First, we show to ensure min E [ ‖∇ F ( ¯ w ( t ) ) ‖ 2 ] ≤ κ , we need T = O ( √ τ / ( nq ) κ 3 / 2 ) , which is tighter than the state-of-the-art results O ( τ / ( nq ) κ 2 + √ τ κ 3 / 2 ) in [30]. Second, compared to O (1 /T 2 / 3 ) , we also show that LSGD can converge faster in O (1 /T ) to a τ -neighborhood of a saddle point. This is helpful to understand the practical performance of DP-LSGD with bias, as discussed in Section 4.2.

As a final remark, we want to mention it is possible to improve the convergence rate from O (1 /T 2 / 3 ) to O (1 /T ) via careful variance reduction or error feedback mechanism, such as Scaffold [30] or FedLin [43]. However, the proper implementation of those advanced tricks in DP-LSGD with additional sensitivity control is not clear. As a first step to systematically study the generic clipping bias, in this paper we only focus on the regular LSGD. We will explain and discuss possible generalizations in Section 6.

4 Utility and Clipping Bias of DP-LSGD and DP-SGD

In this section, we move to study DP-LSGD with clipped local update (2) in Algorithm 1. To have a clear comparison with DP-SGD, we still consider the centralized setup and F ( w ) = 1 /n · f i ( w ) where each local function f i ( w ) is determined by a single sample. To capture the clipping bias, we need to introduce a new term, termed incremental norm .

Definition 4.1 (Incremental Norm) . Consider applying the private and clipping version of Algorithm 1 with (2) on F ( w ) = ∑ n i =1 f i ( w ) . In the t -th phase, we define Ψ ( t ) i = 1 ( ‖ ∆ w ( t ) i ‖ > c ) · ( ‖ ∆ w ( t ) i ‖-c ) as the incremental norm of the local update from f i ( w ) compared to the clipping threshold c , for t = 1 , 2 , · · · , T .

In Definition 4.1, the incremental norm Ψ ( t ) i simply quantifies the difference between the norm of the local update and its clipped version from f i ( w ) . In the following, we will always assume the DP noise injected E [ ‖ Q ( t ) ‖ 2 ] = σ 2 d , following the classic privacy analysis of DP-SGD [38].

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

It is not hard to observe that the clipped local update is essentially a scaled version of the original update, and thus virtually one may view DP-LSGD as a generalization of noisy LSGD but each local update applies a different and adaptively-selected learning rate. To show meaningful characterization on the difference among those learning rates, we need the following assumption as a generalization of bounded-variance stochastic gradient.

Assumption 4.1 (Incremental norm of Bounded Second Moment) . When applying the clipped version of Algorithm 1 via (2) on an objective function F ( w ) = 1 n · f i ( w ) , E [( ∑ n i =1 ( Ψ ( t ) i ) 2 ) /n ] is upper bounded by B 2 , for some global parameter B for t = 1 , 2 , · · · , T .

Assumption 4.1 basically states that in expectation the square of l 2 -norm of each local update is bounded. Assumption 4.1 also suggests that E [( ∑ n i =1 Ψ ( t ) i ) /n ] ≤ B .

4.1 Utility of DP-LSGD in Convex Optimization

Another assumption we need for the anlysis of DP-LSGD on general convex optimization is the similarity among the local functions.

Assumption 4.2 ( γ Similarity) . For F ( w ) = 1 /n · ∑ n i =1 f i ( w ) , local functions f i are of γ -similarity to F such that for any w ∈ W , | f i ( w ) -F ( w ) | ≤ γ , for some constant γ > 0 .

The main reason why we need this additional Assumption 4.2 is because we do not assume Lipschitz continuity of F ( w ) . Thus, we alternatively consider to use the similarity among local functions to characterize the deviation of the evaluation of F ( · ) on biased iterates.

Theorem 4.1 (Last-iterate of DP-LSGD in General Convex Optimization) . For an arbitrary objective function F ( w ) = 1 n · ∑ n i =1 f i ( w ) where f i ( w ) is convex and β -smooth, and under Assumptions 2.1, 4.1 and 4.2, when η = O (1 / √ TK ) and Q ( t ) is independent DP noise such that E [ Q ( t ) ] = 0 and E [ ‖ Q ( t ) ‖ 2 ] = σ 2 d , t = 1 , 2 , · · · , T , then DP-LSGD with clipping threshold c ensures that

When K = O ( nq ) and K = O ( T ) , and for ( /epsilon1 , δ ) -DP, where σ = ˜ O ( c √ T log(1 / δ ) n /epsilon1 ) , we have that 278

279

280

281

282

283

284

285

286

287

288

289

290

291

The proof can be found in Appendix C. We focus on a practical scenario where B = O ( c ) , i.e., the incremental norm of local updates is in the same order of the clipping threshold c selected, and thus ( c + B ) /c = O (1) . From Theorem 4.1, we show the last-iterate utility of DP-LSGD is captured by three terms: (A) a similar convergence rate as regular LSGD, (B) a clipping bias, and (C) the DP noise variance. First, ignoring the bias and noise, DP-LSGD still enjoys a convergence rate ˜ O ( ‖ ¯ w (0) -w ∗ ‖ 2 √ TK + ( 1 √ TK + K T ) τ ) , which is slightly worse compared to Theorem 3.2 with ˜ O ( ‖ ¯ w (0) -w ∗ ‖ 2 √ TK +( 1 √ TKnq + K T ) τ ) as a consequence of clipping which essentially applies different learning rates in each local update. Second, the clipping bias is captured by ( γ B ) /c . This matches our intuition that a larger incremental norm B combined with a smaller clipping threshold c will imply a more significant change on the local update and thus a larger bias. The last accumulated perturbation term is determined by the noise injected across each phase with an effect of ˜ O ( T 3 / 2 K 1 / 2 log(1 / δ ) dc 2 n 2 /epsilon1 2 ) for ( /epsilon1 , δ ) -DP under T -fold composition.

As we consider the very generic setup with non-trival clipping, Theorem 3.2 cannot be directly com292 pared to the classic DP-utility tradeoff [32] given Lipschitz continuity, where a utility loss ˜ Θ ( √ d/n /epsilon1 ) 293

is tight for convex optimization under ( /epsilon1 , δ ) -DP. However, we have the following interesting observa294 tions. First, when we take the clipping threshold c = O ( η ) = O (1 / √ TK ) and K = O ( T · d/ ( n 2 /epsilon1 2 )) , 295 DP-LSGD achieves the same optimal rate ˜ O ( √ d/n /epsilon1 ) [33] ignoring the clipping bias. Second and 296 more important, when the stochastic gradient variance τ is in the same order of the clipping bias 297 O ( γ B /c ) , then by selecting c = Θ ( η ) and K = Θ ( T ) , Theorem 4.1 suggests that DP-LSGD will 298 converge in O (1 /T ) to an O ( γ B /c + d n 2 /epsilon1 2 ) neighborhood of the global optimum. As a comparison, 299 when we select K = 1 in Theorem 4.1, it becomes the analysis of DP-SGD but the convergence 300 rate to the neighborhood of global optimum in the same scale O ( γ B /c + d n 2 /epsilon1 2 ) is only O (1 / √ T ) . 301 Moreover, as we will show in the next section, the local update bound B in DP-SGD with K = 1 302 in practice would be much larger than that of DP-LSGD with a relatively larger K . As a simple 303 generalization, we also include an analysis of DP-LSGD on strongly-convex functions in Appendix 304 D, and we move our focus to the non-convex optimization in the following. 305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

4.2 Utility of DP-LSGD in Non-convex Optimization

Theorem 4.2 (DP-LSGD in Non-convex Optimization) . For F ( w ) = 1 n · ∑ n i =1 f i ( w ) where f i ( w ) is β -smooth and satisfies Assumptions 2.1 and 4.1, when η = O (1 /K ) , DP-LSGD ensures that

When we select η = O ( 1 √ TK ) and K = Θ ( T ) , for ( /epsilon1 , δ ) -DP we have that

The proof can be found in Appendix E. For the analysis of DP-LSGD in non-convex optimization, we do not need Assumption 4.2 on the similarity among local functions and Theorem 4.2 is simply obtained by substituting the clipping error from each phase into Theorem 3.2. To have a more clear picture, we still consider a practical scenario when B = B 0 · η for some constant B 0 and the variance τ is also some constant. Then, from (7) we have that

In other words, similar to the convex case, DP-LSGD will converge at a rate of O (1 /T ) to an ˜ O (1 + d/ ( n 2 /epsilon1 2 )) neighborhood of a saddle point given some constant sampling rate q . As a comparison, for DP-SGD when K = 1 , from Theorem 3.2 we can only ensure an O (1 / √ T ) convergence rate to a same ˜ O (1 + d/ ( n 2 /epsilon1 2 )) neighborhood.

5 Why DP-LSGD Produces Less Bias and Better SNR

Throughout the previous section, we showed that asymptotically DP-LSGD enjoys a faster convergence rate to a neighborhood of (global/local) optimum compared to DP-SGD. We characterized the clipping bias mainly based on the second moment upper bound B 2 of the incremental norm Ψ ( t ) i of local updates. In this section, we proceed to empirically study the Ψ ( t ) i , and the tradeoff between clipping bias and DP (Gaussian) noise in practical deep learning tasks. We will explain why DP-LSGD could produce smaller bias and enable more efficient clipping compared to DP-SGD.

To produce good utility-privacy tradeoff, a proper selection of the clipping threshold c is important. 322 Many existing works are devoted to optimizing the selection of c by either grid searching [35] or 323 adaptive fine-tuning [44]. A smaller c requires less DP noise. But, as a tradeoff shown in Theorem 324 4.1 and 4.2, a smaller c and a consequently a larger B will also lead to a heavier clipping bias. Thus, 325 from the perspective of signal-to-noise ratio (SNR), an ideal scenario is that the l 2 -norm of each 326 local update is concentrated such that we can maximize the efficiency of the clipping power c with 327 a small clipping effect for most local updates. Interpreted via our developed theory of clipping 328 bias, it is expected that given the clipping threshold c , the incremental norm Ψ ( t ) i would be small, 329 captured by B in (5) and (7). In Fig. 1 (a,b), we plot various statistics of the incremental norm Ψ ( t ) i 330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

0

500

1000

1500

0

5

10

15

20

25

0

500

1000

1500

0

10

20

30

40

50

60

70

80

0

500

1000

1500

35

40

45

50

55

60

65

70

for DP-LSGD and DP-SGD, respectively, on training CIFAR10 [45]. By our analysis, DP-LSGD usually should apply a smaller learning rate η . To have a fair comparison, we consider the normalized incremental norm Ψ ( t ) i / η . Given the same clipping threshold, comparing Fig. 1 (a) and (b), the mean of normalized incremental norm, captured by B / η in our theorems, of DP-LSGD is only around 32% compared to that of DP-SGD. The corresponding standard deviation is around only 40% compared to that of DP-SGD. One may also compare the 25% and 75% quantiles, which suggest that more local updates bear less clipping influence in DP-LSGD and thus enjoying a higher clipping efficiency. We also report the comparison when training ResNet20 [46] on SVHN [47] in Fig. 2 in Appendix F with similar observations. Details of experiment setups and the anonymous GitHub code link can be found in Appendix F.

In Fig.1 (c), we record the performance of DP-LSGD and DP-SGD, which coincides with our theory that DP-LSGD has a smaller clipping bias and a faster convergence rate. The smaller incremental norm in DP-LSGD is not surprising. With relatively larger K , for each individual function f i ( w ) , though the K local gradients are correlated and essentially determined by a single sample, the aggregation of them still averages out substantial sampling noise and makes the l 2 -norm of local updates more concentrated. In Table 1, we include additional comparison between their performance on CIFAR10 [45] and SVHN [47]; DP-LSGD produces significant improvements.

6 Conclusion and Prospects

In this paper, via LSGD, we provide a unified analysis of the clipping bias and the utility loss in 349 privacy-preserving gradient methods for both centralized and distributed setups. Provided the generic 350 analysis, we develop the connections between the bias and the second moment of local updates. 351 This initializes a new direction to systematically instruct private learning by connecting the research 352 of variance reduction in distributed optimization. In this paper we only focus on regular LSGD 353 to show its advantage over DP-SGD, but advanced acceleration methods [30, 31, 43] are known 354 in non-private federated learning to further reduce the 'local-update drift' caused by (per-sample) 355 data heterogeneity. This could then further reduce the clipping bias given local updates of smaller 356 variance. Thus, a promising future direction is to understand and incorporate those techniques 357 within the sensitivity control framework. Another important issue we have not fully explored is the 358 software implementation of DP-LSGD in the centralized case. For DP-SGD, many PyTorch libraries 359 with fast per-sample gradient computation in low memory overhead have been developed, such as 360 Opacus [48]. However, in all above-presented experiments, we simulate DP-LSGD in a distributed 361 environment and compute each local update in parallel at a cost of large memory. Given limited 362 hardware resources, this restricts the application of larger batchsize (tens of thousands) and deploying 363 deeper neural networks, which are known to produce much better utility-privacy tradeoffs [36, 49]. 364 We leave empirical efficiency improvement to future work. 365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

References

Sebastian Urban Stich. Local sgd converges fast and communicates little. In ICLR 2019International Conference on Learning Representations , number CONF, 2019.

Ahmed Khaled, Konstantin Mishchenko, and Peter Richtárik. Tighter theory for local sgd on identical and heterogeneous data. In International Conference on Artificial Intelligence and Statistics , pages 4519-4529. PMLR, 2020.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pages 265-284. Springer, 2006.

Graham Cormode, Somesh Jha, Tejas Kulkarni, Ninghui Li, Divesh Srivastava, and Tianhao Wang. Privacy at scale: Local differential privacy in practice. In Proceedings of the 2018 International Conference on Management of Data , pages 1655-1658, 2018.

Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557 , 2017.

Jakub Koneˇ cn` y, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492 , 2016.

Tao Lin, Sebastian U Stich, Kumar Kshitij Patel, and Martin Jaggi. Don't use large mini-batches, use local sgd. In International Conference on Learning Representations , 2020.

Cynthia Dwork. Differential privacy. In Automata, Languages and Programming: 33rd International Colloquium, ICALP 2006, Venice, Italy, July 10-14, 2006, Proceedings, Part II 33 , pages 1-12. Springer, 2006.

Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology , 84(1):3-37, 2022.

Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science , 9(3-4):211-407, 2014.

Xiaokui Xiao and Yufei Tao. Output perturbation with query relaxation. Proceedings of the VLDB Endowment , 1(1):857-869, 2008.

Cynthia Dwork, Guy N Rothblum, and Salil Vadhan. Boosting and differential privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science , pages 51-60. IEEE, 2010.

Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE global conference on signal and information processing , pages 245-248. IEEE, 2013.

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages 308-318, 2016.

Xiangyi Chen, Steven Z Wu, and Mingyi Hong. Understanding gradient clipping in private sgd: Ageometric perspective. Advances in Neural Information Processing Systems , 33:13773-13782, 2020.

Xinwei Zhang, Xiangyi Chen, Mingyi Hong, Zhiwei Steven Wu, and Jinfeng Yi. Understanding clipping for federated learning: Convergence and client-level differential privacy. In International Conference on Machine Learning, ICML 2022 , 2022.

Debraj Basu, Deepesh Data, Can Karakus, and Suhas Diggavi. Qsparse-local-sgd: Distributed 409 sgd with quantization, sparsification and local computations. Advances in Neural Information 410 Processing Systems , 32, 2019. 411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

Hao Yu, Rong Jin, and Sen Yang. On the linear speedup analysis of communication efficient momentum sgd for distributed non-convex optimization. In International Conference on Machine Learning , pages 7184-7193. PMLR, 2019.

Jianyu Wang and Gauri Joshi. Cooperative sgd: A unified framework for the design and analysis of local-update sgd algorithms. The Journal of Machine Learning Research , 22(1):9709-9758, 2021.

Farzin Haddadpour and Mehrdad Mahdavi. On the convergence of local descent methods in federated learning. arXiv preprint arXiv:1910.14425 , 2019.

Blake Woodworth, Kumar Kshitij Patel, Sebastian Stich, Zhen Dai, Brian Bullins, Brendan Mcmahan, Ohad Shamir, and Nathan Srebro. Is local sgd better than minibatch sgd? In International Conference on Machine Learning , pages 10334-10343. PMLR, 2020.

Huang Fang, Xiaoyun Li, Chenglin Fan, and Ping Li. Improved convergence of differential private sgd with gradient clipping. In International Conference on Learning Representations 2023 .

Xiaodong Yang, Huishuai Zhang, Wei Chen, and Tie-Yan Liu. Normalized/clipped sgd with perturbation for differentially private non-convex optimization. arXiv preprint arXiv:2206.13033 , 2022.

LO Mangasarian. Parallel gradient distribution in unconstrained optimization. SIAM Journal on Control and Optimization , 33(6):1916-1925, 1995.

Ryan McDonald, Keith Hall, and Gideon Mann. Distributed training strategies for the structured perceptron. In Human language technologies: The 2010 annual conference of the North American chapter of the association for computational linguistics , pages 456-464, 2010.

Fan Zhou and Guojing Cong. On the convergence properties of a k -step averaging stochastic gradient descent algorithm for nonconvex optimization. arXiv preprint arXiv:1708.01012 , 2017.

Shiqiang Wang, Tiffany Tuor, Theodoros Salonidis, Kin K Leung, Christian Makaya, Ting He, and Kevin Chan. When edge meets learning: Adaptive control for resource-constrained distributed machine learning. In IEEE INFOCOM 2018-IEEE conference on computer communications , pages 63-71. IEEE, 2018.

Anastasia Koloskova, Nicolas Loizou, Sadra Boreiri, Martin Jaggi, and Sebastian Stich. A unified theory of decentralized sgd with changing topology and local updates. In International Conference on Machine Learning , pages 5381-5393. PMLR, 2020.

Kevin Hsieh, Amar Phanishayee, Onur Mutlu, and Phillip Gibbons. The non-iid data quagmire of decentralized machine learning. In International Conference on Machine Learning , pages 4387-4398. PMLR, 2020.

Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning , pages 5132-5143. PMLR, 2020.

Farzin Haddadpour, Mohammad Mahdi Kamani, Aryan Mokhtari, and Mehrdad Mahdavi. Federated learning with compression: Unified analysis and sharp guarantees. In International Conference on Artificial Intelligence and Statistics , pages 2350-2358. PMLR, 2021.

Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th annual symposium on foundations of computer science , pages 464-473. IEEE, 2014.

Raef Bassily, Vitaly Feldman, Kunal Talwar, and Abhradeep Guha Thakurta. Private stochastic convex optimization with optimal rates. Advances in neural information processing systems , 32, 2019.

Nicolas Papernot, Abhradeep Thakurta, Shuang Song, Steve Chien, and Úlfar Erlingsson. Tempered sigmoid activations for deep learning with differential privacy. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 35, pages 9312-9321, 2021.

Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much 461 more data). In International Conference on Learning Representations , 2021. 462

Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlock463 ing high-accuracy differentially private image classification through scale. arXiv preprint 464 arXiv:2204.13650 , 2022. 465

466

467

Yuqing Zhu and Yu-Xiang Wang. Poission subsampled rényi differential privacy. In International Conference on Machine Learning , pages 7634-7642. PMLR, 2019.

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages 308-318, 2016.

Naman Agarwal, Ananda Theertha Suresh, Felix Xinnan X Yu, Sanjiv Kumar, and Brendan McMahan. cpsgd: Communication-efficient and differentially-private distributed sgd. Advances in Neural Information Processing Systems , 31, 2018.

Tong Zhang. Solving large scale linear prediction problems using stochastic gradient descent algorithms. In Proceedings of the twenty-first international conference on Machine learning , page 116, 2004.

Ohad Shamir and Tong Zhang. Stochastic gradient descent for non-smooth optimization: Convergence results and optimal averaging schemes. In International conference on machine learning , pages 71-79. PMLR, 2013.

Xiaoyu Li and Francesco Orabona. On the convergence of stochastic gradient descent with adaptive stepsizes. In The 22nd international conference on artificial intelligence and statistics , pages 983-992. PMLR, 2019.

Aritra Mitra, Rayana Jaafar, George J Pappas, and Hamed Hassani. Linear convergence in federated learning: Tackling client heterogeneity and sparse gradients. Advances in Neural Information Processing Systems , 34:14606-14619, 2021.

Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ramaswamy. Differentially private learning with adaptive clipping. Advances in Neural Information Processing Systems , 34:17455-17466, 2021.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.

Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, et al. Opacus: User-friendly differential privacy library in pytorch. arXiv preprint arXiv:2109.12298 , 2021.

Florian A Hölzl, Daniel Rueckert, and Georgios Kaissis. Equivariant differentially private deep learning. arXiv preprint arXiv:2301.13104 , 2023.

Moritz Hardt, Ben Recht, and Yoram Singer. Train faster, generalize better: Stability of stochastic gradient descent. In International conference on machine learning , pages 1225-1234. PMLR, 2016.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies DP-LSGD and compares its performance with DP-SGD. The paper first provide the convergence result of FedAvg under the bounded variance assumption (Theorem 3.1 and 3.2) and provide the convergence analysis of DP-LSGD-GC under the bounded gradient assumption 4.1 and similarity assumption 4.2. for both convex and non-convex cases. The results imply that using multiple local updates, DP-LSGD converges faster to a neighborhood of the stationary point. Through numerical experiments, the paper demonstrates that DP-LSGD converges faster than DP-SGD with the same privacy budget and \"communication\" iterations.\n\nSTRENGTHS:\nOriginality: this paper provides a novel analysis of DP-LSGD, which considers both clipping and DP-noise. The resulting convergence rate improves upon the existing FedGD algorithm. \n\nSignificance: This paper provides a DP algorithm (DP-LSGD) that outperforms DP-SGD with faster theoretical convergence to a neighborhood of stationary points.\n\nClarity: This paper provides a clear statement of the theorems, assumptions, and adequate numerical justification for the assumption used in the proof.\n\nWEAKNESSES:\nAssumption 4.1: This assumption assumes that the clipping error is bounded, which might be too strong. In Fig 1 (a), it seems like $\\Phi$ is increasing as $t$ increases. Such an assumption simplifies the analysis of gradient clipping; Thus, it weakens the significance of the paper a bit.\n\nComparison with FedAvg: In general FedAvg considers local SGD updates, while the analyzed DP-LSGD algorithm considers local GD updates. Therefore, such a comparison is unfair. [R1] also provides the convergence rate of FedAvg, which matches the rate in this paper. Therefore, the convergence part without clipping is hard to be said to be an improvement.\n\nIt is unclear whether the numerical comparison is fair or not. It is hard to decide if the reported result for DP-SGD matches the SOTA results (e.g. in [R2]). The authors should report how the hyper-parameters are chosen and whether they are optimal for the algorithm.\n\nThe theoretical result suggested that $c = \\Theta(\\eta)$ and at the same time $B = O(c)$. However, it is unclear if these two results can be satisfied at the same time. The authors should also conduct numerical justification on different choices of $\\eta$ and $c$ and report the corresponding $\\Phi$.\n\n\n[R1] Glasgow, M. R., Yuan, H., & Ma, T. (2022, May). Sharp bounds for federated averaging (local SGD) and continuous perspective. In International Conference on Artificial Intelligence and Statistics (pp. 9050-9090). PMLR.\n[R2] De, S., Berrada, L., Hayes, J., Smith, S. L., & Balle, B. (2022). Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650.\n\nQUESTIONS:\nAs listed above, please clarify \n1) how $B$ changes with different $c$ and $\\eta$ and \n2) whether the reported performance of DP-SGD matches with SOTA results.\n3) For non-convex cases, why the algorithm converges to saddle points? (I believe this should be a typo?)\n\nLIMITATIONS:\nThe authors have addressed the empirical efficiency limitation of the proposed algorithm, which I believe is the largest limitation.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed a unified analysis of the convergence of (DP)-Local SGD, which covers (DP) parallel SGD as a special case with K=1, for both convex and non-convex optimization. Under this unified analysis, one can identify error effects due to non-iid objectives, clipping, and DP noises and the convergence rate to the error neighborhood.\n\nSTRENGTHS:\n(1) The introduction section provides a brief yet insightful summary of related subjects including \"relation between local SGD and parallel SGD\",  \"sensitivity and privacy analysis methodology of DP\", \"effect and convergence limitation of clipping\" etc.\n\n(2) The unified framework that covers both local SGD and parallel SGD is attractive and makes sense at a high level.\n\nWEAKNESSES:\n(1) The problem setting of this paper assumes each sampled worker is running gradient descent instead of stochastic gradient descent as the full gradient is available in equation (1) though later an additive stochastic noise is added after the aggregation of local updates in equation (2) and (3).   This problem setting is much simpler than the standard setting of local SGD as less divergence across involved local workers is introduced.  The comparison between the analysis from this paper, e.g., Thm 3.2, and the state-of-the-art is no longer fair.  (All the state-of-the-art compared in this paper considered stochastic optimization.  And it is well known that GD for deterministic non-convex has O(1/T) convergence while SGD for stochastic non-convex only has O(1/\\sqrt{T}) convergence.) \n\n\n(2) The assessment in line 313 that DP-LSGD converges faster with O(1/T) than DP-SGD corresponding to K=1 with O(1/\\sqrt{T}) is unfair as the convergence rate from Thm 4.2 requires K=\\Theta(T) such that the overall computation/iteration is TK = O(T^2) to attain an error decay like 1/T.  This is effectively the same O(1/\\sqrt{S}) convergence where S is the number of computation steps/iterations. \n\n\n(3) The new assumption in Assumption 4.1 that involves \\Phi in Definition 4.1 does not seem much different from a bounded 2nd-order moment assumption as \\Phi_i measures how much the norm of update is larger than the clipping threshold.  (Given that a bounded 2nd-order movement further implies a first-order moment by the inequality E[||X||] \\leq \\sqrt{E[||X||^2]}, I don't see how this new assumption can relax the widely used bounded gradient assumption in the literature.) Could the author discuss whether the new assumption strengthens or relaxes the standard assumptions?\n\nQUESTIONS:\nSee my questions in the \"Weaknesses\" section.\n\nLIMITATIONS:\nI do not see any potential negative societal impact of this paper.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper propose a differentially-private local stochastic gradient descent both for centralized and distributed settings. The authors argue that the proposed method has less number of clipping and in turn produce less clipping bias compared to its counterpart DP-SGD which do not involve local steps. They also show that DP-LSGD converges sublinearly to a ball of the optimum, which is claimed to be faster than that of DP-SGD, and exhibit a better utility-privacy tradeoff.\n\nSTRENGTHS:\n- The authors characterize the convergence performance by regarding clipping noises as biased noises and assuming that the incremental norm of local update be bounded, which is otherwise not easy to deal with.\n- The authors prove that the proposed DP-LSGD converges faster than that DP-SGD and empirically show that it also has a better utility-privacy trade-off.\n- The paper is technically sound and well organized.\n\nWEAKNESSES:\n- Assumption 4.1 and 4.2 seem restrictive to the reviewer. In particular, Assumption 4.1 seems not practical in the sense that one can not ensure the boundedess of the incremental norm of $\\nabla w$ without knowing in advance the basic convergence of the algorithm (note that the algorithm may diverge, making $\\nabla w$ unbounded); Assumption 4.2 is assumed to be hold for any value of w instead of the optimum w*, which is more common to be adopted.\n\n- Theorem 4.1 and 4.2: the authors claim that DP-LSGD enjoys faster convergence to a neighborhood of the global optimum/ saddle point than DP-SGD; however, local sample-level differential privacy is guaranteed for DP-SGD, but not for DP-LSGD. For a fair comparison, each client for DP-LSGD should clip the calculated gradient and add the DP-noise at each SGD step in local update to satisfy the local sample-level differential privacy, which will inevitably degrade the convergence performance of the algorithm. In that case, what are the advantages of DP-LSGD compared to DP-SGD and does DP-LSGD still produce less clipping bias than DP-SGD?\n\n- The selection of many parameters such as B, \\eta and c lack of intuition; also, the experiment does not corroborate the theoretical result very well; for instance, the clipping bias captured by $\\mathcal{B}$ is independent of $K$ (c.f., Theorem 4.1) and thus can not reduced with increasing value of $K$, which is inconsistent with the claim that DP-LSGD Produces Less Bias.\n\nQUESTIONS:\n- It is not surprising that the authors can avoid the assumption of bounded gradient with the introduction of bounded variance of stochastic gradient, which is well known in the existing literature; what are the new technical novelty in the convergence analysis?\n\n- How one can determine the clipping threshold c and $\\mathcal{B}$ such that $\\mathcal{B}$ is at the same order as c?\n\n- In Theorem 3.2, the authors claim that their iteration complexity to reach an error is tighter than the state-of-the-art results in [a] when there is no perturbation. This comparison seems unfair in that this paper only considers gradient variance among clients (Assumption 2.1) instead of the gradient sampling variance among datapoints, while both of them are considered in [a]. Note that, in this case, $\\eta^2$ in the second term of (4) will become $\\eta$.\n\n[a] Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning, pages 5132–5143. PMLR, 2020.\n\nLIMITATIONS:\nplease refer to weaknesses and questions.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-11"}

comments: SUMMARY:
The paper focuses on Differentially-Private Local SGD (DP-LSGD), and studies its advantages over the foundational technique of DP-SGD. In particular, the authors show why DP-LSGD provides higher clipping efficiency and less clipping bias compared to DP-SGD. The authors start by showing a convergence analysis on the released iterates of LSGD under perturbations and a bounded variance assumption on the stochastic gradients. Next, they generalize the results to DP-LSGD, and show that DP-LSGD has a faster convergence rate near an optimum point compared to DP-SGD. Lastly, they show that DP-LSGD behaves as an efficient variance reduction of local update, and enables more efficient clipping compared to DP-SGD.

STRENGTHS:
1. The authors focus on the important problem of improving the privacy-utility trade-offs for DP Learning.

WEAKNESSES:
1. The paper contains many theoretical results (Sections 3-5), and I have not been able to verify the correctness of any of the proofs in the Appendix, but after reading the paper it is not even clear to me whether the proofs use any techniques/ideas that are novel (and might be of independent interest), or use methods from prior works to obtain novel results for (DP-)LSGD.
2. The empirical evaluation is very limited, focusing only on image-classification settings (CIFAR10 and SVHN datasets). Given that the focus of the paper is on (DP-)LSGD which is a building block of (DP) Federated Learning, it might be useful to have experiments on FL benchmark datasets, e.g., StackOverflow, EMNIST, etc.?

QUESTIONS:
Listed in the weaknesses section.

LIMITATIONS:
Yes.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-21

comments: SUMMARY:
This submission studies the Differentially-Private Local Stochastic Gradient Descent (DP-LSGD), and shows that  DP-LSGD with multiple local iterations can produce more concentrated local updates and   less clipping bias compared to DP-SGD, assuming that the stochastic gradient is of bounded variance.  The main contribution of this submission is to show that DP-LSGD has a faster convergence rate  compared to DP-SGDThe authors also add the experiments to  show that
DP-LSGD produces a better  utility-privacy tradeoff  than DP-SGD.

STRENGTHS:
1. This submission develops the connections between the clipping bias and the second moment of local updates, which is something new in the research of differentially private optimization.
2. This submission shows that DP-LSGD can converge faster compared to regular DP-SGD.
3. The experimental results ( the comparison between DP-SGD and DP-LSGD) in this submission look convincing, and this paper is well-written.

WEAKNESSES:
1.The implementation inefficiency (local update in parallel at a cost of large memory) is a minor issue here.

QUESTIONS:
N/A

LIMITATIONS:
N/A
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-26

comments: SUMMARY:
The authors provide a unified analysis of the clipping bias and the utility loss in privacy-preserving gradient methods for centralized and distributed setups. The conclusion shows that LSGD behaves as an efficient variance reduction of local update, where multiple local GDs with a small learning rate cancel out substantial sampling noise and enable more efficient clipping compared to DP-SGD.

STRENGTHS:
1. The authors build the connections between the clipping bias and the second moment of local updates. This initializes a new direction to systematically instruct private learning by connecting the research of variance reduction in distributed optimization.

2. The authors conduct analysis on both convex and non-convex ERM problems with a fairly mild assumption of the bounded stochastic gradient variance.

WEAKNESSES:
1. I understand this is a theoretical paper, but the authors should claim the experimental setup more clearly. It is unclear whether the setting is IID or non-IID. The authors should illustrate the consistency of the empirical support under both IID and non-IID settings, which are the most concern to the FL community.

QUESTIONS:
Please check above.

LIMITATIONS:
The authors discuss the limitations of their work in the last section.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-27