Paper: Differentially Private SGD Without Clipping Bias: An Error-Feedback Approach (ICLR-2024)

Reviewer comment (Experiments):
The experiments don't seem to be very careful about how $C$ is chosen. For example, in Table 3, it is just stated that C=1. Considering the whole point of the paper is a better method for clipping, I would like to see more exploration into this.

Author response:
> We provide additional experiments studying the affect of the clipping threshold. Please refer to additional experiments in the appendix (figure 1, 2 and 4). Figure 1 and 2 study how the choice of $C_1, C_2$ and $\eta$ affects the final accuracy of the CV task. Figure 4 also studies different choices of $C_1, \eta$ on the NLP task.

Reviewer comment (Theory):
It is stated that DiceSGD requires a constant multiplicative factor more noise than DPSGD. What is that factor?

Author response:
> If DiceSGD and DPSGD are using the same clipping factor $C$, then the factor is $8$; However, DiceSGD allows us to choose a smaller clipping factor without affecting the accuracy.

Reviewer comment (Theory):
Given that DiceSGD maintains a private state anyway, and the convergence analysis assumes strong convexity, could the privacy guarantee be strengthened by NOT releasing the model after every step, similar to Feldman et al. "Privacy Amplification by Iteration" (which is cited)? The analysis you already have -- for non-convex objectives and releasing all iterates -- seems to me primarily useful because it bounds the privacy loss for non-convex objectives *without* releasing all iterates. I can't imagine a scenario where you can protect the private state but nevertheless want to release all model iterates. On the other hand, if it were possible, an analysis of the convex case where all model iterates are private could give you a tighter bound.

Author response:
> Indeed, that we think privacy amplification by iteration can be used (Ye & Shokri, 2022, as mentioned in Sec. 3.2). This would be a future work. However, in current stage, we are still comparing with DPSGD, which releases all intermediate model states.

Reviewer comment (Reproducibility):
In the NLP experiment, it is stated that GPT-2 is fine-tuned. By default I would assume that means all-parameter fine-tuning, but Hu et al. (2021) is cited twice (referencing the metrics and in the table) which makes me wonder if it is Lora fine tuning. Which is it?

Author response:
>Let us clarify that we are using full model fine-tuning instead of LoRA.

Reviewer comment (Theory):
The assumption that $\|\nabla f(x) - g_i\|_2 \le \sigma$ everywhere is rather strong. It needs to be better and more transparently justified. Its ramifications need to be discussed more carefully. For instance, under such an assumption, it is not inconceivable that DPSGD with [adaptive clipping](https://arxiv.org/abs/1905.03871) also converges favorably (see e.g. [Varshney et al.](https://arxiv.org/abs/2207.04686) who used this trick for linear regression). A comparison to this approach both theoretically and empirically is missing.

Author response:
* Discussion on Assumption 3.5, $\|\nabla f(x) - g_i\|\leq \sigma$. First, this assumption is related to the common bounded variance assumption (i.e., $\mathbb{E}\|\nabla f(x)-g_i\|\leq \sigma^2$). Our assumption differs from the bounded variance assumption by a factor of $1/N$, as discussed in page 7 in our original manuscript. Second, let us compare our result with the adaptive clipping result in Varshney et al., 2022: 1) their analysis only applies to the linear regression model, while our convergence result hold for all functions satisfying PL condition; Therefore, we cannot provide empirical comparision in our experiment training the neural networks.; 2) to achieve convergence, their choice of the clipping threshold depends on $\sigma$, covariance matrix $H$ and the optimal solution $x^\star$ (i.e., $C = O(\sqrt{H}\|x^\star\|+\sigma)$), while these values cannot be obtained before training. In contrast, our clipping thresholds are **independent** of the problem parameters (i.e., $\mu, L, G, \sigma$) and can be arbitrarily chosen. Therefore, compared with adaptive clipping, our algorithm imposes fewer constraints to the problem class and clipping threshold, and our As. 3.5 is also less restrictive than the works using the same assumption.

Reviewer comment (Theory):
I believe that $\eta = O(T^{-(1-\nu)})$ is a suboptimal choice and the right rate should be something like $\exp(-c\sqrt{t}) + \log t /t$. See e.g. [Section 3 of Stich](https://arxiv.org/pdf/1907.04232.pdf) for notes on tuning the step size carefully to get the best rates.

Author response:
* Convergence rate: we thank the reviewer for pointing out this issue. Indeed, we can follow the same choice of $\eta$ as Stich, 2019 as 
$$\eta = \min\left\\{\frac{3}{32L}, \frac{\sqrt{C_2}}{5L\sqrt{C_2 + T \max\{0, G'-C_2\}}}, \frac{\log(\mu^2 \mathcal{L}^0T/L(d\sigma_1^2+5\sigma^2/4B+C_1^2/2))}{\mu T}\right\\},$$ 
and our optimized convergence rate is $\mathcal{O}\left(\exp(-\frac{\mu T}{L})+\frac{\log(T)L}{\mu^2 T}\right)$. Following this modification, the privacy-utility tradeoff of DiceSGD becomes $\mathcal{O}(\frac{\tilde{G}\log(1/\delta)}{N^2\epsilon^2})$. We have update the results in our revised manuscript.

Reviewer comment (Theory):
How does the convergence rate vary with $C_1$ and $C_2$? What are their optimal values? How much does the rate suffer when these constants differ from their optimal values?

Author response:
* Convergence with respect to $C_1, C_2$. Starting with Theorem 3.7, and the choice of $\eta$ above, we have the following relationships: $C_2\geq C_1$, $\eta \leq \frac{\sqrt{C_2}}{5L\sqrt{C_2+ T \max\{0, \max\{0, G+\sigma -C_1\}-C_2\}}}$ and $\mathbb{E}[\mathcal{L}^{T+1}]\leq \frac{\eta L}{2\mu}\cdot \frac{C_1^2}{2}$. From these relations, we can see that the convergence rate's dependency on $C_1, C_2$ is complicated, and it is hard to find the optimal choice of $C_1$ and $C_2$. However, from our numerical experiments in the appendix (Figure 1.), where we ploted the convergence results with various sets of $C_1, C_2$, it is favorable to choose $C_1 = C_2$ and $C_1, C_2$ both as small as possible.

Reviewer comment (Theory):
Page 8 says "the result does not rely on the specific values of [$\sigma$ and $G$]". I do not think this is true: $\sigma_1$ depends on $\tilde G$, which depends on $G'$ which depends on $G$ and $\sigma$.

Author response:
* Independence of $G, \sigma$: In page 8 after Theorem 3.8, we claim that the result of Theorem 3.8 does not rely on the specific values of $G, \sigma$. Let us clarify such independence. For convenience, we put the choice of $\sigma_1$, the DP noise standard deviation here: $$\sigma_1^2 \geq \frac{32T(C_1^2 + 2\min\{C^2, (\max\{0, G+\sigma -C_1\})^2\})\log(1/\delta)}{N^2\epsilon^2},$$ where we substitute the definition of $\tilde{G}$ and $G'$. Note that the choice of $C_1, C$ are independent of $G, \sigma$. Therefore, in the above bound we have $2\min\{C^2, (\max\{0, G+\sigma-C_1\})^2\} \leq 2C^2$. Therefore, we can choose $$\sigma_1^2 \geq \frac{32T(C_1^2 + 2C^2)\log(1/\delta)}{N^2\epsilon^2},$$ so that the choice of $\sigma_1$ is indeed **independent** of the specific value of $G, \sigma$.

Reviewer comment (Theory):
Suppose the clip norm is so small that all gradients are effectively clipped. Then, reducing the clip norm any further has the role of reducing the learning rate. Do the bounds capture this dependence? More generally, how does the clip norm determine the optimal learning rate?

Author response:
* Effect of the clip norm on the learning rate: Intuitively, using smaller clipping threshold should result in constant slower convergence. However, in our final results, such effect is unclear, as it is merged into the bound of the learning rate $\eta$ ($\mathcal{O}(\frac{\sqrt{C_2}}{\sqrt{T}})$). Smaller $C_2$ results in smaller choice of $\eta$, and smaller $\eta$ results in smaller $\kappa$ and eventually affects the convergence speed of $\mathcal{L}^0$. However, in the **optimized** choice of $\eta = \frac{\log(\mu^2 \mathcal{L}^0T/L(d\sigma_1^2+5\sigma^2/4B+C_1^2/2))}{\mu T}$, the effect of the clipping threshold is minor, since we are choosing learning rate with smaller order (i.e., $O(1/T)$ compared with $O(\frac{\sqrt{C_2}}{\sqrt{T}})$).

Reviewer comment (Experiments):
The experimental results are promising but many more experiments are needed to paint a convincing picture. It is fine to run some detailed experiments on smaller-scale settings that can be tested more extensively (I would argue that these have more value for this particular paper than inadequate experiments on larger models but the authors can feel free to disagree).

Author response:
* More experiments: Indeed, we agree with the reviewer that more experiments would strengthen the paper and make it more convincing. Indeed, in this work, we tried our best to strike a balance between demonstrating both theoretical and  practical impact of the proposed algorithm. Unlike some exisitng works such as Varshney et al., 2022, which purely focused on theoretical analysis of a new algorithm, we have conducted extensive experiments on both vision tasks (ViT-small model, on Cifar-10, Cifar-100 datasets) and NLP tasks (GPT model, on E2E NLG Challenge dataset). To our understanding, not many recent works that propose theoretically guaranteed algorithms have verified their algorithms in such a wide choice of datasets/models. 
Of course, we completely agree with the reviewer that it will be beneficial to test the proposed algorithm on a braoder selection of data sets and models to show its generalizability to different settings. However, due to the space and time limitation of the rebuttal, it is hard for us to conduct more thorough experiments. Nevertheless, we have provided the codes for our algorithm in the supplementary material, and we plan to  opensource the code, together with our benchmarking results so that other researchers can compare the performance of their own algorithms with ours. Meanwhile, on this opensource project, we will continue test our algorithms and providing benchmark results on different datasets/models, as suggested by the reviewer.

Reviewer comment (Writing):
The distinction between "DPSGD" (without clipping) and "DPSGD-GC" (with clipping) is confusing. DPSGD is always presented in the literature with clipping and theoretical analyses use Lipschitz functions (=> bounded gradients) to avoid the technicalities induced by clipping. It would be much more natural to refer to both as DPSGD and make a distinction in the setting (i.e., whether the clipping is active or not).

Author response:
* DPSGD-GC and DPSGD: we thank the reviewer for the advice.

Reviewer comment (Presentation):
Section 2.1: why even mention $(\epsilon, \delta)$-DP? It would be much cleaner to describe the background in terms of RDP and the proofs use this as well.

Author response:
* $(\epsilon, \delta)$-DP. Indeed, directly using RDP in the main paper for the results would be straightforward. However, as $(\epsilon, \delta)$-DP would be a more commonly used notation in the previous research. Therefore, we first introduce $(\epsilon, \delta)$-DP in the main results in order to have a direct comparision with DPSGD.

Reviewer comment (Writing):
$\mathbb{E}_i$ and $\mathbf{g}_i$ are not defined but are used in various places (e.g., Assumption 3.5). This is also poor notation because it implicitly hides the dependence on $\mathbf{x}$.

Author response:
*  We agree with the reviewer that $\mathbb{E}_{i}$ should not be used and we will fix that in the revised manuscript. However, $g_i$ is defined in Sec. 2.1 (notations and assumptions) right before eq.(2). $g_i$ is used to avoid the redundant notation of $\nabla f(x;\xi_i)$ and save space only when there is no ambiguity. We will also consider remove the notation of $g_i$ in the revised manuscript.

Reviewer comment (Writing):
Lemma A.6: $\mathcal{A}_1^t, \mathcal{A}_2^t, \mathcal{H}^t$: I do not understand this notation. Some examples will be helpful.

Author response:
* $\mathcal{A}^t_1, \mathcal{A}^t_2, \mathcal{H}^t$: Let us clarify what these notations refers to: 1) $\mathcal{A}^t_1$ denotes the update and outout of $x^t$ of DiceSGD, i.e, Lines 4 (random sampling),5 (computing $v^t$), and 6 (computing $x^{t+1}$) of Algorithm 2; 2) \mathcal{A}^t_2 denotes the update and output of $e^t$, i.e., Lines 4, 5, and 7 (computing $e^{t+1}$) of Algorithm 2; and $\mathcal{H}^t$ denotes the output sequence of $x^t$, i.e., $\mathcal{H}^t = \\{x^0, x^1, \dots, x^t\\}$. We will add this explanations to the revised manuscript.

Reviewer comment (Writing):
p.18, Step II: This proof is very hard to parse and the quantities do not make sense to me. Please consider standardizing notation across various proofs for the reader's convenience and simplifying the notation in this proof in particular.

Author response:
* Proof of Step II page 18: We cleaned the notations and definitions used in proof step II in our revised manuscript.

Reviewer comment (Writing):
Theorem 3.7: $\kappa$ is typically used to refer to the condition number and can be quite misleading here. Besides, there is no need to define a new variable if it is used only once.

Author response:
* We will remove $\kappa$ in the main paper as the reviewer suggested.

Reviewer comment (Theory):
p.18, Step III: In the definition of $\Delta^t_g$, are the $g_i^t$ under both $D$ and $D'$ assumed to be the same? If the differing example was sampled in iteration $k < t$, then the iterates $\mathbf{x^t}, \mathbf{x'^t}$ are both distinct. Then, their corresponding gradients in iteration $t$ are also distinct.

Author response:
* In Step III, $\Delta_g^t$ and $g^t_i$ are defined conditioned on $\mathcal{H}^t = \\{x_1, \dots, x^t\\}$ (i.e., based on the observation of $x^t$'s). Therefore, they are computed based on the same $x^t$ instead of having different $x^t, x'^t$.