Paper: DP-SGD Without Clipping: The Lipschitz Neural Network Way (ICLR-2024)

Reviewer comment (Experiments):
While Clipless DP-SGD removes the need for tuning the clipping threshold, it still appears to require a large amount of hyperparameter tuning in order to extract good performance (see figure 3 in the main text, and figure 13 in the appendix). As a result, this can lead to increased computational costs as well as privacy leakage, since the current method does not account for leakage due to hyperparameter tuning. It is not fully obvious how Clipless DP-SGD compares to existing methods under a like-for-like compute resources and privacy leakage due to tuning.

Author response:
> “it still appears to require a large amount of hyperparameter tuning in order to extract good performance”  
  
We want to reassure you that this is not the case: we reported all experiments for exhaustivity reasons, but the Bayesian optimizer reaches the Pareto front within 30 repetitions on image classification tasks. We observed that Clipless DP-SGD is not more sensitive than vanilla DP-SGD.

Reviewer comment (Theory):
Can the authors comment on how tight the derived sensitivities are in practice? In particular, how large are the gradient norms encountered during training, compared to the derived sensitivities.

Author response:
> “How tight are the derived sensitivities in practice?”  
  
We performed an empirical evaluation in Appendix **C.3** and Figures **11 & 12**. We measured the ratio between the empirical norm and the upper bound on the layer of a single-block MLP Mixer on Cifar-10. At the beginning of training, on the last layers, the ratio is between 30% and 40%. As we go closer to the first layers, the ratio falls to 10%. At the end of training, the ratio of this same layer is 4%. This is expected as the gradient norm tends to diminish during training, as we get closer to the (local) optimum.  We hypothesized it was due to the looseness of Cauchy-Schwartz inequality on $\frac{\partial f_d(x_d,\theta_d)}{\partial \theta}$ term, and the approximations during the "propage input bounds" step.

Reviewer comment (Experiments):
Specifically, tuning hyperparameters also consumes the DP budget. Did you take into account such DP costs in your experiments and results?

Author response:
Your question about the privacy cost of the hyper-parameter search is a valid concern we address in the common answer. As explained in Sec 4.1, we are aware of the risks associated to hyper-parameters tuning, and we ensured that the same number of repetitions was used for both algorithms when performing hyper-parameter search. We added this precision to the manuscript.