Original: Reﬁned Dimension-Dependent Analysis for Private Convex Learning and Implications for Fine-Tuning
Revised: Refined Dimension-Dependent Analysis for Private Convex Learning and Implications for Fine-Tuning

Revised: Anonymous Author(s)

Revised: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: Recent works have shown that large pretrained models can be privately ﬁne-tunedto achieve performance approaching non-private models.
Revised: Large pretrained models can be privately fine-tuned to achieve performance approaching non-private models.

Original: A common theme in theseresults is the surprising observation that very large models can achieve favorableprivacy-utility trade-offs.
Revised: A common theme in these results is the surprisingobservation that high-dimensional models can achieve favorable privacy-utilitytrade-offs.

Original: This seemingly contradicts known results on the modelsize dependence of differentially private convex learning and raises the followingresearch question: When does the performance of differentially private learning notdegrade with increasing model size?
Revised: This seemingly contradicts known results on the model-size dependence of differentially private convex learning and raises the following researchquestion: When does the performance of differentially private learning not degrade with increasing model size?

Original: We identify that the magnitudes of gradientsprojected onto subspaces is a key factor that determines performance.
Revised: We identify that the magnitudes of gradientsprojected onto subspaces is a key factor that determines performance.

Original: To preciselycharacterize this for private convex learning, we introduce a condition on theobjective that we term restricted Lipschitz continuity and derive reﬁned bounds forthe excess empirical and population risks that are dimension-independent underadditional conditions.
Revised: To preciselycharacterize this for private convex learning, we introduce a condition on the objective that we term restricted Lipschitz continuity and derive refined bounds forthe excess empirical and population risks that are dimension-independent underadditional conditions.

Original: We validate this condition in practice by privately ﬁnetuning language models and showing that  gradients evaluated near a local optimumare mostly controlled by a few principal components.
Revised: We empirically show that in private fine-tuning of largelanguage models, gradients obtained during fine-tuning are mostly controlled by afew principal components.

Original: This behavior is similarto conditions under which we obtain dimension-independent bounds in convexsettings and provides a possible explanation for recent successes in large-scaleprivate ﬁne-tuning.
Revised: This behavior is similar to conditions under which weobtain dimension-independent bounds in convex settings and provides a possibleexplanation for recent successes in large-scale private fine-tuning.

Original:  Introduction
Revised:  Introduction

Original: Recent works have shown that large publicly pretrained models can be differentially privately ﬁnetuned on small downstream datasets with performance approaching those attained by non-privatemodels.
Revised: Recent works have shown that large publicly pretrained models can be differentially privately finetuned on small downstream datasets with performance approaching those attained by non-privatemodels.

Original: In particular, past works showed that pretrained BERT [DCLT18] and GPT-2 [RNSS18,
Revised: In particular, past works showed that pretrained BERT [DCLT18] and GPT-2 [RNSS18,

Original: RWC + 19] models can be ﬁne-tuned to perform well for text classiﬁcation and generation undera privacy budget of ε ∈ [2 , 6] [LTLH21, YNB + 21].
Revised: RWC + 19] models can be fine-tuned to perform well for text classification and generation undera privacy budget of ε ∈ [2 , 6] [LTLH21, YNB + 21].

Original: More recently, it was shown that pretrained
Revised: More recently, it was shown that pretrained

Original: ResNets [HZRS16] and vision-Transformers [DBK + 20] can be ﬁne-tuned to perform well for
Revised: ResNets [HZRS16] and vision-Transformers [DBK + 20] can be fine-tuned to perform well for

Original: ImageNet classiﬁcation under single digit privacy budgets [DBH + 22, MTKC22].
Revised: ImageNet classification under single digit privacy budgets [DBH + 22, MTKC22].

Original: One key ingredient in these successes has been the use of large pretrained models with millions tobillions of parameters, and these works generally highlight the importance of two phenomena: (i)large (pretrained) models tend to experience good privacy-utility trade-offs when ﬁne-tuned, and (ii)the trade-off improves with the use of larger  models.
Revised: One key ingredient in these successes has been the use of large pretrained models with millions tobillions of parameters, and these works generally highlight the importance of two phenomena: (i)large pretrained models tend to experience good privacy-utility trade-offs when fine-tuned, and (ii) thetrade-off improves with the use of larger pretrained models.

Original: While the power of scale and pre-training has been demonstrated numerous times in non-private deep learning, one common wisdom in privatelearning had been that large models tend not to perform well.
Revised: While the power of scale and pretraininghas been demonstrated numerous times in non-private deep learning, one common wisdom in privatelearning had been that large models tend not to perform well.

Original: This intuition was rooted in resultsin differentially private convex optimization, which predicted that errors would scale proportionallywith the dimension of the learning problem.
Revised: This intuition was rooted in resultsin differentially private convex optimization, which predicted that errors would scale proportionallywith the dimension of the learning problem.

Original: Consider the problem of differentially private convex empirical risk minimization (ERM) as anexample.
Revised: Consider the problem of differentially private convex empirical risk minimization (ERM) as anexample.

Original: In this problem, we are given a dataset of n examples D = { s j } nj =1 ∈ S n , a convex body
Revised: In this problem, we are given a dataset of n examples D = { s j } nj =1 ∈ S n , a convex body

Original: K ⊂ R d , and the goal is to perform the optimization
Revised: K ⊂ R d , and the goal is to perform the optimization

Original: [Equation]
Revised: [Equation]

Original: subject to differential privacy, where f : K × S → R is some convex loss function.
Revised: subject to differential privacy, where f ( · ; s ) is some convex loss function over K for any s ∈ S .

Original: Past works havestudied this problem and presented matching upper and lower bounds that are dimension-dependentunder the usual Lipschitz(and smoothness) assumptions on the objective [BST14a, CMS11].
Revised: Past works have studied this problem and presented matching upper and lower bounds that aredimension-dependent under the usual Lipschitz assumptions on the objective [BST14, CMS11].

Original: Thesedimension-dependent results suggest that the performance of differentially private convex ERMinevitably degrades with increasing problem dimension — for the worst case functions within theprescribed class of convex losses.
Revised: These dimension-dependent results suggest that the performance of differentially private convex ERM inevitably degrades with increasing problem dimension — for the worst case functions withinthe prescribed class of convex losses.

Original: To reconcile the conﬂict between the dimension-dependent lower bounds for private convex learningand the empirical success of large-scale private ﬁne-tuning, we study the following question both intheory and in practice:
Revised: To reconcile the conflict between the dimension-dependent lower bounds for private convex learningand the empirical success of large-scale private fine-tuning, we study the following question both intheory and in practice:

Original: When does the performance of differentially private learning (via DP-SGD) notdegrade with increasing problem size and dimension?
Revised: When does the performance of differentially private learning (via DP-SGD) notdegrade with increasing problem size and dimension?

Original: On the theory front, we identify that the standard dependence on the dimensionality of the ambientspace can be replaced by the magnitudes of gradients projected onto subspaces of varying dimensions.
Revised: On the theoretical front, we identify that the standard dependence on the dimension of the ambientspace can be replaced by the magnitudes of gradients projected onto subspaces of varying dimensions.

Original: We formalize this in a condition that we call restricted Lipschitz continuity and derive reﬁned boundsfor the excess empirical  and population risks  when loss functions obey this condition.
Revised: We formalize this in a condition that we call restricted Lipschitz continuity and derive refined boundsfor the excess empirical risks for DP-ERM and population risks for DP-SGD when loss functionsobey this condition.

Original: We show thatwhen the restricted Lipschitz coefﬁcients decay rapidly, both the excess empirical and populationrisks become dimension-independent.
Revised: We show that when the restricted Lipschitz coefficients decay rapidly, both theexcess empirical and population risks become dimension-independent.

Original: These theoretical results shed light on the recent success of large-scale private ﬁne-tuning of languagemodels.
Revised: These theoretical results shed light on the recent success of large-scale private fine-tuning of languagemodels.

Original: We empirically show that the gradients of language models during ﬁne-tuning (evaluated neara local optimum) are mostly controlled by a few principle components — a behavior that is similarto conditions under which we obtain dimension-independent bounds for private convex ERM.
Revised: We empirically show that the gradients of language models in fine-tuning are mostlycontrolled by a few principal components — a behavior that is similar to conditions under which weobtain dimension-independent bounds for private convex ERM.

Original: Thisprovides a possible explanation for the observation that densely ﬁne-tuning need not necessarily havemuch worse performance than sparsely ﬁne-tuning [LTLH21] and moreover suggests that DP-SGDcan be adaptive to problems that are effectively low-dimensional under restricted Lipschitz continuity.
Revised: This provides a possible explanationfor the observation that densely fine-tuning (with DP-SGD) needs not necessarily have much worseperformance than sparsely fine-tuning [LTLH21]. Moreover, it suggests that DP-SGD can be adaptiveto problems that are effectively low-dimensional (as characterized by restricted Lipschitz continuity)without explicit algorithmic intervention.

Original: We summarize our contributions below.
Revised: We summarize our contributions below.

Original: (1) We introduce a condition on the objective function that we term restricted Lipschitz continuity.
Revised: (1) We introduce a condition on the objective function that we term restricted Lipschitz continuity.

Original: This condition generalizes the usual Lipschitz continuity notion and gives rise to reﬁned analyseswhen magnitudes of gradients projected onto diminishing subspaces decay rapidly.(2) Under restricted Lipschitz continuity, we present reﬁned bounds on the excess empirical andpopulation risks for DP-SGD when optimizing convex objectives.
Revised: This condition generalizes the usual Lipschitz continuity notion and gives rise to refined analyseswhen magnitudes of gradients projected onto diminishing subspaces decay rapidly.(2) Under restricted Lipschitz continuity, we present refined bounds on the excess empirical andpopulation risks for DP-SGD when optimizing convex objectives.

Original: These bounds generalize previous dimension-independent results [SSTT21] and are broadly applicable to cases wheregradients are full rank but most coordinates only marginally inﬂuence the objective.
Revised: These bounds generalizeprevious dimension-independent results [SSTT21] and are broadly applicable to cases where gradients are full rank but most coordinates only marginally influence the objective.

Original: (3) Our theory shed light on recent successes of private ﬁne-tuning of language models.
Revised: (3) Our theory shed light on recent successes of private fine-tuning of language models.

Original: We showthat gradientsnear a local optimum obtained through ﬁne-tuning mostly lie in the space spannedby a few principle components — a behavior similar to  restricted Lipschitz continuity withdecaying coefﬁcients.
Revised: We show that gradients obtained through fine-tuning mostly lie in the space spanned by a few principal components — a behavior similar to when optimizing a restricted Lipschitz continuous loss withdecaying coefficients.

Original: This provides a possible explanation for recent successes in large-scaleprivate ﬁne-tuning.
Revised: This provides a possible explanation for recent successes in large-scale private fine-tuning.

Original:  Preliminaries
Revised:  Preliminaries

Original: In this section, we ﬁrst deﬁne the notation used throughout this work.
Revised: We first define the notation used throughout this work.

Original: We then state the problemsof differentially private empirical risk minimization and differentially private stochastic convexoptimization.
Revised: We then state the problems of differentially private empirical risk minimization and differentially private stochastic convex optimization.

Original: Finally, we give a brief recap of differentially private stochastic gradient descent,existing dimension-dependent results in the literature, and the seemingly inconsistent results betweentheory for convex losses and recent empirical ﬁndings in language model ﬁne-tuning.
Revised: Finally, wegive a brief recap of differentially private stochastic gradient descent, existing dimension-dependentresults in the literature, and the seemingly inconsistent results between theory for convex losses andrecent empirical findings in language model fine-tuning.

Original: Notation.
Revised: Notation.

Original: For a non-negative integer n ∈ N + , deﬁne the shorthand [ n ] = {0 , 1 , . . . , n } .
Revised: For a positive integer n ∈ N + , define the shorthand [ n ] = { 1 , . . . , n } .

Original: For avector x ∈ R d , denote its (cid:96) 2 -norm by (cid:107) x (cid:107) 2 (or (cid:107) x (cid:107) when it’s clear from context).
Revised: For a vectorx ∈ R d , denote its ℓ 2 -norm by ∥ x ∥ 2 .

Original: Let S d denote theset of d × d symmetric matrices, and S d + ⊂ S d the positive semideﬁnite subset.
Revised: Let S d denote the set of d × d symmetric matrices, and S d + ⊂ S dthe positive semidefinite subset.

Original: Given M ∈ S d , let λ 1 ( M ) ≥ λ 2 ( M ) ≥ · · · ≥ λ d ( M ) denote its eigenvalues.
Revised: Given M ∈ S d , let λ 1 ( M ) ≥ λ 2 ( M ) ≥ · · · ≥ λ d ( M ) denote itseigenvalues.

Original: Given A ∈ S d + , let (cid:107) x(cid:107) A
Revised: Given A ∈ S d + , let ∥ x

Original:  = ( x (cid:62) Ax ) 1 / 2denote the induced Mahalanobis norm.
Revised: ∥ A = ( x ⊤ Ax ) 1 / 2 denote the induced Mahalanobis norm.

Original: For scalar functions f, g , we say f (cid:46) g if f ≤ Cgfor somenumerical constant C .
Revised: Forscalar functions f, g , we say f ≲ g if f ≤ Cg

Original: 2.1 Differentially Private Empirical Risk Minimization and Stochastic Convex Optimization
Revised: 2.1 Differentially Private Empirical Risk Minimization and Stochastic Convex Optimization

Original: Before stating the theoretical problem of interest, we deﬁne the basic concepts of Lipschitz continuity,convexity, and approximate differential privacy.
Revised: Before stating the theoretical problem of interest, we define the basic concepts of Lipschitz continuity,convexity, and approximate differential privacy.

Original: Deﬁnition 2.1 (Lipschitz Continuity) .
Revised: Definition 2.1 (Lipschitz Continuity) .

Original: We say a loss function h : K → R is G -Lipschitz with respectto the (cid:96) 2 norm if for all x, x (cid:48) ∈ K , | f ( x ) − f ( x (cid:48) )
Revised: We say a loss function h : K → R is G -Lipschitz with respectto the ℓ 2 norm if for all x, x ′ ∈ K , | f ( x ) − f ( x ′ )

Original: | ≤ G (cid:107) x − x (cid:48) (cid:107) 2 .
Revised: | ≤ G ∥ x − x ′ ∥ 2 .

Original: Deﬁnition 2.2 (Convexity) .
Revised: Definition 2.2 (Convexity) .

Original: We say a loss function h : K → R is convex if h ( αx + (1 − α ) y ) ≤αh ( x ) + (1 − α ) h
Revised: We say a loss function h : K → R is convex if h ( αx + (1 − α ) y ) ≤αh ( x ) + (1 − α ) h

Original: ( y ) , for all α ∈ [0 , 1] , and x, y ∈ K .
Revised: ( y ) , for all α ∈ [0 , 1] , and x, y ∈ K .

Original: Deﬁnition 2.3 (Approximate Differential Privacy [DR + 14]) .
Revised: Definition 2.3 (Approximate Differential Privacy [DR + 14]) .

Original: We say a randomized algorithm M is( ε, δ ) -differentially private if for all neighboring datasets D and D (cid:48) that differ by a single record andall events O ⊂ range( M ) , the following expression holds
Revised: We say a randomized algorithm M is( ε, δ ) -differentially private if for all neighboring datasets D and D ′ that differ by a single record andall events O ⊂ range( M ) , the following expression holds

Original: [Equation]
Revised: [Equation]

Original: In this work, we study both differentially private empirical risk minimization (DP-ERM) for convexobjectives and differentially private stochastic convex optimization (DP-SCO).
Revised: In this work, we study both differentially private empirical risk minimization (DP-ERM) for convexobjectives and differentially private stochastic convex optimization (DP-SCO).

Original: In DP-ERM for convex objectives, we are given a dataset D = { s j } j ∈ [ n ] ∈ S n of n examples.
Revised: In DP-ERM for convex objectives, we are given a dataset D = { s j } j ∈ [ n ] ∈ S n of n examples.

Original: Eachper-example loss f ( · ; s ) is convex over a convex body K ⊆ R d and G -Lipschitz.
Revised: Eachper-example loss f ( · ; s ) is convex over a convex body K ⊆ R d and G -Lipschitz.

Original: We aim to designan ( ε, δ ) -DP algorithm that returns a solution x priv which approximately minimizes the empirical risk
Revised: We aim to designan ( ε, δ ) -DP algorithm that returns a solution x priv which approximately minimizes the empirical risk

Original: [Equation]
Revised: [Equation]

Original: f
Revised: (cid:88)

Original: [Equation]
Revised: [Equation]

Original: x
Revised: f (

Original: [Equation]
Revised: [Equation]

Original:  s [Equation]
Revised: ; s j ) .

Original: The term F ( x priv ; D ) − min x ∈K F ( x ; D ) is referred to as the excess empirical risk associated withthe solution x priv .
Revised: The term F ( x priv ; D ) − min x ∈K F ( x ; D ) is referred to as the excess empirical risk associated withthe solution x priv .

Original: In DP-SCO, we assume the per-example loss f ( · ; s ) is convex and G -Lipschitz for all s ∈ S , and weare given n examples drawn i.i.d.
Revised: In DP-SCO, we assume the per-example loss f ( · ; s ) is convex and G -Lipschitz for all s ∈ S , and weare given n examples drawn i.i.d.

Original: from some underlying (unknown) distribution P .
Revised: from some underlying (unknown) distribution P .

Original: The goal is todesign an ( ε, δ ) -DP algorithm which approximately minimizes the population risk
Revised: The goal is todesign an ( ε, δ ) -DP algorithm which approximately minimizes the population risk

Original: [Equation]
Revised: [Equation]

Original: The term F ( x priv ; P ) − min x ∈K F ( x ; P ) is referred to as the excess population loss of the solutionx priv .
Revised: The term F ( x priv ; P ) − min x ∈K F ( x ; P ) is referred to as the excess population loss of the solutionx priv .

Original: Slightly abusing terminology, we  refer to the following quantities as the excess empirical andpopulation risks for a randomized solution x priv,
Revised: Slightly abusing terminology, we respectively refer to the following quantities as the excessempirical and population risks for a randomized solution x priv

Original: [Equation]
Revised: [Equation]

Original: 2.2 Differentially Private Stochastic Gradient Descent
Revised: 2.2 Differentially Private Stochastic Gradient Descent

Original: Differentially Private Stochastic Gradient Descent (DP-SGD) [ACG + 16, SCS13] is a popular algorithm for DP convex optimization.
Revised: Differentially Private Stochastic Gradient Descent (DP-SGD) [ACG + 16 , SCS13] is a popular algorithm for DP convex optimization.

Original: For the theoretical analysis, we study DP-SGD for unconstrainedoptimization.
Revised: For the theoretical analysis, we study DP-SGD for unconstrainedoptimization.

Original: To facilitate analysis, we work with the (cid:96) 2 regularized objective expressed as
Revised: To facilitate analysis, we work with the ℓ 2 regularized objective expressed as

Original: [Equation]
Revised: [Equation]

Original: To optimize this objective, DP-SGD independently samples an example in each iteration and updatesthe solution by combining the gradient with an isotropic Gaussian whose scale is proportional to G ,the Lipschitz constant of f .
Revised: To optimize this objective, DP-SGD independently samples an example in each iteration and updatesthe solution by combining the gradient with an isotropic Gaussian whose scale is proportional to G ,the Lipschitz constant of f .

Original: Algorithm 1 presents the pseudocode.
Revised: Algorithm 1 presents the pseudocode.

Original: It is straightforward to show that Algorithm 1 satisﬁes differential privacy.
Revised: It is straightforward to show that Algorithm 1 satisfies differential privacy.

Original: The following lemmaquantiﬁes the overall privacy spending and builds on a long line of work on accounting the privacyloss of compositions [ACG + 16, BBG18].
Revised: The following lemmaquantifies the overall privacy spending and builds on a long line of work on accounting the privacyloss of compositions [ACG + 16, BBG18].

Original: Lemma 2.4 ([KLL21, Theorem 3.1]) .
Revised: Lemma 2.4 ([KLL21, Theorem 3.1]) .

Original: For n ≥ 10 , ε < c 1 T/n 2 and 1 / 2 ≥ δ > 0 .
Revised: For n ≥ 10 , ε < c 1 T/n 2 and 1 / 2 ≥ δ > 0 .

Original: Let σ ≥[Equation] for some numerical constants c [-
-] and c 2 .
Revised: Let σ ≥ for some numerical constants c [-
-]1 and c 2 .

Original: Then, DP-SGD (Algorithm 1) is ( ε, δ ) -differential private.
Revised: Then, DP-SGD (Algorithm 1) is ( ε, δ ) -differential private.

Original: 1 Input: Initial iterate x (0) , dataset D = { s j } j ∈ [ n ] , per-step noise magnitude σ , total number of updates T .
Revised: 1 Input: Initial iterate x (0) , dataset D = { s j } j ∈ [ n ] , per-step noise magnitude σ , total number of updates T .

Original: 2 for t = 1 , · · · , T do i t ∼ Uniform ([ n ]) x ( t ) =
Revised: 2 for t = 1 , . . . , T do i t ∼ Uniform ([ n ]) x ( t ) =

Original: x ( t − 1) − η (cid:16) ∇ f ( x ( t − 1) ; s i t )
Revised: x ( t − 1) − η (cid:16) ∇ f ( x ( t − 1) ; s i t )

Original: + α ( x ( t − 1) − x (0) )
Revised: + α ( x ( t − 1) − x (0) )

Original: + G · ζ t (cid:17) , ζ t ∼ N (0 , σ 2 I d ) 5 end 6 Return: x def = 1 T (cid:80) Tt =1 x ( t ) .
Revised: + G · ζ t (cid:17) , ζ t ∼ N (0 , σ 2 I d ) 5 end 6 Return: x def = 1 T (cid:80) Tt =1 x ( t ) .

Original: 2.3 Conﬂicting Results Between Convex Learningand Large-Scale Fine-Tuning
Revised: 2.3 On the Dimension Dependence of Private Learning

Original: Some of the early works on bounding the excess empirical and population risks for privately optimizing convex objectives focused on a constrained optimization setup where iterates are explicitly projected onto a ﬁxed bounded domain after each noisy gradient update.
Revised: Some of the early works on bounding the excess empirical and population risks for privately optimizing convex objectives focused on a constrained optimization setup where iterates are explicitlyprojected onto a fixed bounded domain after each noisy gradient update.

Original: Results in thissetting suggested that risks are inevitably dimension-dependent.
Revised: Results in this settingsuggested that risks are inevitably dimension-dependent.

Original: For instance, it was shown thatthe excess empirical risk bound Θ( GD (cid:112)
Revised: For instance, it was shown that theexcess empirical risk bound Θ( G ∥K∥ 2 (cid:112)

Original: d log(1 /δ )
Revised: d log(1 /δ )

Original: n − 1 ε − 1 ) and excess population risk boundΘ( GD ( n − 1 / 2 + (cid:

Revised: n − 1 ε − 1 ) and excess population risk boundΘ( G ∥K∥ 2 ( n − 1 / 2 + (cid:

Original: ) d log(1 /δ )
Revised: ) d log(1 /δ )

Original: n − 1 ε − 1 )) are tight when privately optimizing convex G -Lipschitzobjectives in a convex domain of diameter D [BST14a].{+∥K∥ 
 [BST14].+}
Revised: n − 1 ε − 1 )) are tight when privately optimizing convex G -Lipschitzobjectives in a convex domain of diameter {+∥K∥ 
 [BST14].+}

Original: However, recent empirical ﬁndings in large-scale language model ﬁne-tuning demonstrated thatvery large models can be optimized with DP-SGD to achieve performance approaching non-privatemodels [LTLH21, YNB + 21].
Revised: However, recent empirical findings in large-scale language model fine-tuning demonstrated that verylarge models can be optimized with DP-SGD to achieve performance approaching non-private models [LTLH21, YNB + 21].

Original: Moreover, ﬁne-tuning more parameters (and hence injecting morenoise during training) does not necessarily hurt private ﬁne-tuning performance [LTLH21].
Revised: Moreover, fine-tuning more parameters (and hence injecting more noise)does not necessarily hurt private fine-tuning performance [LTLH21].

Original: Theseempirical observations suggest that the error of learning does not degrade substantially (or sometimesnegligibly) with the increase in problem dimension, pointing towards a seeming conﬂict betweentheory and practice.
Revised: These empirical observationssuggested that the error of learning does not degrade substantially (or sometimes negligibly) with theincrease in problem dimension, pointing towards a seeming conflict between theory and practice.

Original: In the following, we set out to reconcile this discrepancy.
Revised: In the following, we set out to reconcile this discrepancy.

Original: In particular, Section 3 shows that bettererror dimension-dependence can be achieved for private convex optimization if the objective satisﬁesadditional regularity conditions in addition to Lipschitz continuity.
Revised: In particular, Section 3 shows that bettererror dimension-dependence can be achieved for private convex optimization if the objective satisfiesadditional regularity conditions in addition to Lipschitz continuity.

Original: Section 4 veriﬁes our theory andpresents initial evidence that private language model ﬁne-tuning exhibits the type of regularity thatleads to dimension-independent bounds in our theoretical results.
Revised: Section 4 verifies our theory andpresents initial evidence that private language model fine-tuning exhibits the type of regularity thatleads to dimension-independent bounds in our theoretical results.

Original:  Reﬁned Dimension-Dependence Through Restricted Lipschitz Continuity
Revised:  Refined Dimension-Dependence via Restricted Lipschitz Continuity

Original: In this section, we formally introduce the restricted Lipschitz continuity condition and derive improvedbounds for the excess empirical and population risks for DP convex optimization.
Revised: In this section, we formally introduce the restricted Lipschitz continuity condition and derive improvedbounds for the excess empirical and population risks for DP-SGD when optimizing convex objectives.

Original: Deﬁnition 3.1 (Restricted Lipschitz Continuity) .
Revised: Definition 3.1 (Restricted Lipschitz Continuity) .

Original: We say that the loss function h : K
Revised: We say that the loss function h : K

Original: → R isrestricted Lipschitz continuous with coefﬁcients G 0 , . .
Revised: → R isrestricted Lipschitz continuous with coefficients G 0 , . .

Original: . , G d , if for all k ∈ [ d ] , there exists anorthogonal projection matrix P k with rank k such that
Revised: . , G d , if for all k ∈ [ d ] , there exists anorthogonal projection matrix P k with rank k such that

Original: [Equation]
Revised: [Equation]

Original: for all x ∈ K and all subgradients ∇ h ( x ) ∈ ∂h ( x ) .
Revised: for all x ∈ K and all subgradients ∇ h ( x ) ∈ ∂h ( x ) .

Original: Note that any G -Lipschitz function is also trivially restricted Lipschitz continuous with coefﬁcients
Revised: Note that any G -Lipschitz function is also trivially restricted Lipschitz continuous with coefficients

Original: G = G 0 =
Revised: G = G 0 =

Original: G 1 = · · · = G d , since orthogonal projections never increase the (cid:96) 2 -norm of a vector(generally, it is easy to see that G = G 0 ≥ G 1 ≥ G 2 ≥ · · · ≥ G d = 0 ).
Revised: G 1 = · · · = G d , since orthogonal projections never increase the ℓ 2 -norm of a vector(generally, it is easy to see that G = G 0 ≥ G 1 ≥ G 2 ≥ · · · ≥ G d = 0 ).

Original: On the other hand, weexpect that a function which exhibits little growth in subspaces of dimension k to have a restricted
Revised: On the other hand, weexpect that a function which exhibits little growth in subspaces of dimension k to have a restricted

Original: Lipschitz coefﬁcient G d − k of almost 0.
Revised: Lipschitz coefficient G d − k of almost 0.

Original: Our bounds on DP convex optimization will characterize errors through the use of restricted Lipschitzcoefﬁcients.
Revised: Our bounds on DP convex optimization will characterize errors through the use of restricted Lipschitzcoefficients.

Original: We now summarize the main assumptions before presenting the core theoretical results.
Revised: We now summarize the main assumptions before presenting the core theoretical results.

Original: Assumption 3.2.
Revised: Assumption 3.2.

Original: The per-example loss function f ( · ; s ) is convex and G -Lipschitz continuous for alls ∈ 
Revised: The per-example loss function f ( · ; s ) is convex and G -Lipschitz continuous for alls ∈ S .

Revised: The average loss F ( · ; D ) is restricted Lipschitz continuous with coefficients { G k } d k =1 .

Original: 3.1 Bounds for Excess Empirical Loss
Revised: 3.1 Bounds for Excess Empirical Loss

Original: We present the main theoretical result on DP-ERM for convex objectives.
Revised: We present the main theoretical result on DP-ERM for convex objectives.

Original: The result consists of twopieces. (1) is a general bound that is applicable to any sequence of restricted Lipschitz coefﬁcients. (2)specializes the previous boundto when the sequence of coefﬁcients decays rapidly and demonstratesdimension-independent error scaling.To simplify notation in the following theorems, we let G m :=
Revised: The result consists of twopieces: Equation (1) is a general bound that is applicable to any sequence of restricted Lipschitz coefficients; Equation (2) specializes the previous bound when the sequence of coefficients decaysrapidly and demonstrates dimension-independent error scaling.

Original: 0for all integer m > d .

Original: Theorem 3.3 (Excess Empirical Loss) .
Revised: Theorem 3.3 (Excess Empirical Loss) .

Original: Let δ ∈ (0 , 12 ]  and ε ∈ (0 , 10] .
Revised: Let δ ∈ (0 , 12 ] , and ε ∈ (0 , 10] .

Original: Under Assumption 3.2, forany non-negative integer k  , setting T =
Revised: Under Assumption 3.2, forany positive integer k ∈ [ d ] , setting T =

Original: Θ( n 2 + d 
Revised: Θ( n 2 + d log 2 d ) , σ = Θ

Original: [Equation]
Revised: [Equation]

Revised: , η

Original: [Equation]
Revised: [Equation]

Original: (cid:18)
Revised: D

Original: [Equation]
Revised: [Equation]

Original: and α = 1 D (cid:113)(cid:80) s s 2 2 s G 22 s − 1 k ,  DP-SGD (Algorithm 1) is ( ε, δ ) -DP, and E
Revised: and α = 1 D (cid:113)(cid:80) Ss =1 s 2 2 s G 22 s − 1 k , where S = ⌊ log( d/k ) ⌋ + 1 , DP-SGD (Algorithm 1) is ( ε, δ ) -DP,and

Original: [Equation]
Revised: [Equation]

Original: F
Revised: G

Original: [Equation]
Revised: [Equation]

Original: where (cid:107) x (0) −  x ∗ (cid:107) 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and the expectation isover the randomness of x .
Revised: where ∥ x (0) − argmin x F ( x ; D ) ∥ 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and theexpectation is over the randomness of x .

Original: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k  c for all k ∈ [ d ] ,  minimizing the right hand side of(1) with respect to k yields
Revised: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k − c forall k ∈ [ d ] , and in addition n ≥ ε − 1 (cid:112) log(1 /δ ) , minimizing the right hand side of (1) with respectto k yields

Original: [Equation]
Revised: [Equation]

Original: We include a sketch of themain proof techniques in Section 3.3 and defer the full proof to Appendix A.
Revised: We include a sketch of the proof techniques in Section 3.3 and defer the full proof to Appendix A.

Original: Remark 3.4 .
Revised: Remark 3.4 .

Original: Consider DP-ERM for learning generalized linear models with convex  losses.
Revised: Consider DP-ERM for learning generalized linear models with convex and Lipschitz losses.

Original: When the(empirical) data covariance is of rank r < d , the span of gradients span ( {∇ x F ( x ) } ) is also of rank r .
Revised: When the (empirical) data covariance is of rank r < d , the span of gradientsspan ( {∇ x F ( x ) } ) is also of rank r .

Original: Thus, the average loss is restricted Lipschitz continuous with coefﬁcients where G r (cid:48) = 

Revised: Thus, the average loss is restricted Lipschitz continuous withcoefficients where G r ′ =

Original: for all r (cid:48) > r .
Revised: for all r ′ > r .

Original: Setting k = r in (1) yields a excess empirical risk bound of order O (cid:16) G 0 D (cid:112) r · log(1 /δ )
Revised: Setting k = r in (1) yields the excess empirical riskbound of order O (cid:16) G 0 D (cid:112) r · log(1 /δ )

Original: ε − 1 n − 1 (cid:17) .
Revised: ε − 1 n − 1 (cid:17) .

Original: This recovers a previous dimension-independent result up to constants [SSTT21].
Revised: This recovers the previous dimension-independentresult [SSTT21].

Original: The restricted Lipschitz continuity condition can be viewed as a generalized notion of rank.
Revised: The restricted Lipschitz continuity condition can be viewed as a generalized notion of rank.

Original: Theresult captured in (2) suggests that the empirical loss achieved by DP-SGD does not depend on theproblem dimension if the sequence of restricted Lipschitz coefﬁcients decays rapidly.
Revised: Theresult captured in (2) suggests that the empirical loss achieved by DP-SGD does not depend on theproblem dimension if the sequence of restricted Lipschitz coefficients decays rapidly.

Original: We leveragethese insights to build intuition for understanding private ﬁne-tuning of language model in Section 4.
Revised: We leveragethese insights to build intuition for understanding private fine-tuning of language model in Section 4.

Original: 3.2 Bounds for Excess Population Loss
Revised: 3.2 Bounds for Excess Population Loss

Original: For DP-SCO, we make use of the stability of DP-SGD to bound its generalization error [BE02],following previous works [BFTT19, BFGT20, SSTT21].
Revised: For DP-SCO, we make use of the stability of DP-SGD to bound its generalization error [BE02],following previous works [BFTT19, BFGT20, SSTT21].

Original: The bound on the excess population lossfollows from combining the bounds on the excess empirical risk and the generalization error.
Revised: The bound on the excess population lossfollows from combining the bounds on the excess empirical risk and the generalization error.

Original: Theorem 3.5 (Excess Population Loss) .
Revised: Theorem 3.5 (Excess Population Loss) .

Original: Let δ ∈ (0 , 12 ] ,  ε ∈ (0 , 10] .
Revised: Let δ ∈ (0 , 12 ] , and ε ∈ (0 , 10] .

Original: Under Assumption 3.2,for any non-negative integer k  , by setting T = Θ( n 2 + d log 2 d ) , σ = Θ (cid:18) √ T log(1 /δ ) nε (cid:19) ,η = (cid:113)
Revised: Under Assumption 3.2,for any positive integer k ∈ [ d ] , by setting T = Θ( n 2 + d log 2 d ) , σ = Θ (cid:18) √ T log(1 /δ ) nε (cid:19) ,η = (cid:113)

Original: D 2 T · G 
Revised: D 2 T · G 20 ( T/n + kσ 2 ) and α = 1 D (cid:113)(cid:80)

Original: [Equation]{+Ss =1 s 2 
+}
Revised: {+Ss =1 s 2 
+}

Original: ( T
Revised: s G 22 s − 1 k , where S =

Original: [Equation] n + kσ 2 )  andα =
Revised: ⌊ log( d/k ) ⌋ + 1 , DP-SGD(Algorithm 1) is ( ε, δ ) -DP, and

Original: [Equation]
Revised: [Equation]

Original: G
Revised: G

Original: [Equation]
Revised: [Equation]

Original: D ,DP-SGD (Algorithm 1) is ( ε, δ ) -DP, and [Equation] where (cid:107) x (0) −  x ∗ (cid:107) 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and the expectation isover the randomness of x .
Revised: , where ∥ x (0) − argmin x F ( x ; P ) ∥ 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), andthe expectation is over the randomness of x .

Original: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k  c for all k ∈ [ d ] ,  minimizing  with respect to k yields
Revised: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k − c for all k ∈ [ d ] , and in addition n >ε − 1 (cid:112) log(1 /δ ) , minimizing the above bound with respect to k yields

Original: [Equation]
Revised: [Equation]

Original: We refer the reader to Appendix B for the full proof.

Original: Remark 3.6 .
Revised: Remark 3.6 .

Original: Our result on DP-SCO also recovers the DP-SCO rank-dependent result for learninggeneralized linear models with convex  losses [SSTT21].
Revised: Our result on DP-SCO also recovers the DP-SCO rank-dependent result for learninggeneralized linear models with convex and Lipschitz losses [SSTT21].

Original: Remark 3.7 .
Revised: Remark 3.7 .

Original: When c > 1 / 2 , ε = Θ(1) and δ = 1 / poly( n ) , the population loss matches the(non-private) informational-theoretical lower bound Ω( G 0 D/ √ n ) [AWBR09].
Revised: When c > 1 / 2 , ε = Θ(1) and δ = 1 / poly( n ) , the population loss matches the(non-private) informational-theoretical lower bound Ω( G 0 D/ √ n ) [AWBR09].

Revised: Remark 3.8 .

Revised: Our results on DP-ERM and DP-SCO naturally generalize to (full-batch) DP-GD.

Original: 3.3 Overview of Proof Techniques
Revised: 3.3 Overview of Proof Techniques

Original: The privacy guarantees in Theorems 3.3 and 3.5 followdirectly from Lemma 2.4.
Revised: The privacy guarantees in Theorems 3.3 and 3.5 follow from Lemma 2.4.

Original: It sufﬁces to provethe utility guarantees.
Revised: It suffices to prove the utilityguarantees.

Original: We give an outline of the main proof techniques and defer full proofs to thesupplementary material.
Revised: We give an outline of the main proof technique and defer full proofs to the supplementary.

Original: The following is aproof sketch  for  Theorem 3.3.
Revised: The following is a sketch of the core technique for deriving (2) in Theorem 3.3.

Original: By convexity, the error term of SGD is upper bounded as follows
Revised: By convexity, the error term of SGD is upper bounded as follows

Original: [Equation]
Revised: [Equation]

Original: where j ∈ [ n ] is the random index sampled at iteration t .
Revised: where j ∈ [ n ] is the random index sampled at iteration t .

Original: By deﬁnition of G k , we know that there is ak dimensional subspace U such that the gradient is small orthogonal to U .
Revised: By definition of G k , we know that there is ak dimensional subspace U such that the gradient component orthogonal to U is small when G k issmall.

Original: Naively, one decomposesthe gradient ∇ f j ( x ( t ) )
Revised: Naïvely, one decomposes the gradient ∇ f j ( x ( t ) )

Original: =
Revised: =

Original: g 1 + g 2 , where g 1 ∈ U and g 2 ∈
Revised: g 1 + g 2 , where g 1 ∈ U and g 2 ∈

Original: U ⊥  .
Revised: U ⊥ , andseparately bounds the two terms g ⊤ 1 ( x ( t ) − x ∗ ) and g ⊤ 2 ( x ( t ) − x ∗ ) .

Original: Since g 1 lies in a k dimensionalsubspace, we can follow existing arguments on DP-SGD to bound g [-(cid:62) 
-] ( x ( t ) − x ∗ ) .
Revised: Since g 1 lies in a k dimensionalsubspace, one can follow existing arguments on DP-SGD to bound g [-(cid:62) 
-]⊤ 1 ( x ( t ) − x ∗ ) .

Original: Unfortunately, thisargument does not give a dimension-independent bound.
Revised: Unfortunately,this argument does not lead to dimension-independence.

Original: Although (cid:107) g 2 (cid:107) 2 ≤ G k (which can be smallfor large k ), the term (cid:107) x ( t ) − x ∗ (cid:107) 2 is as large as Ω( √ d ) with high probability due to the isotropic
Revised: Although ∥ g 2 ∥ 2 ≤ G k (which can be smallfor large k ), the term ∥ x ( t ) − x ∗ ∥ 2 can be as large as Ω( √ d ) with high probability due to the isotropic

Original: Gaussian noise we add in DP-SGD.
Revised: Gaussian noise injected in DP-SGD.

Original: Therefore,  | g (cid:62) 2 ( x ( t ) − x ) | can be as large Ω( √ dG k ) .
Revised: Therefore, the naïve upper bound on | g ⊤ 2 ( x ( t ) − x ) | can be aslarge O ( √ dG k ) .

Original: One natural way to derive a good bound on (cid:107) x ( t ) − x ∗ (cid:107) 2 is through projection.

Original: However, previouslower bounds in constrained optimization already suggest that DP projected-SGD cannot evade thecurse of dimensionality [BST14b], since projections tend to destroy the low-rank structure.

Original: Our crucial idea is to partition the whole space R d into (cid:100) log( d/k ) (cid:101) +1 different orthogonal sub-spaces,expressing the error term ∇ f j ( x ( t ) )
Revised: Our key idea is to partition the whole space R d into ⌊ log( d/k ) ⌋ + 2 orthogonal subspaces, expressingthe error term ∇ f j ( x ( t ) )

Original: (cid:62) ( x ( t ) − x ∗ ) as the sum of  termswhere each term correspondsto a  subspace.
Revised: ⊤ ( x ( t ) − x ∗ ) as the sum of individual terms each of which corresponds toa projection to a particular subspace.

Original: Fix  k ∈ [ d] , and consider the following subspaces: Let U 

Revised: Fix the positive integer k ≤ d , and consider the followingsubspaces: Let U

Original: =
Revised: =

Original: range ( P k ) , U s =range{+be the subspace orthogonal to all previous subspaces suchthat (cid:76) si =
 U i ⊇ range+} ( P 2 s k )\ U s − 1 for s = 1 , 2 , · · · , (cid:98) log( d/k ) (cid:99) , and U S ={+be the subspace such that theorthogonal direct sum of all subspaces { U i } Si =
+}
Revised: range ( P k ) , U s {+be the subspace orthogonal to all previous subspaces suchthat (cid:76) si =
 U i ⊇ range+} ( P 2 s k ) for s = 1 , 2 , · · · , ⌊ log( d/k ) ⌋ , and U S {+be the subspace such that theorthogonal direct sum of all subspaces { U i } Si =
+}

Original:  R d\ U S − 1 where S = (cid:98) log( d/k ) (cid:99) + 1 .
Revised: is R d where S = ⌊ log( d/k ) ⌋ + 1 .

Original: Here, P i is the orthogonal projection matrix with rank i promised by G i in Assumption 3.2.
Revised: Here, P i isthe orthogonal projection matrix with rank i promised by G i in Assumption 3.2.

Original: Let Q s bethe orthogonal projection to the subspace U s , and observe that rank( Q s ) ≤ 2 s k and (cid:107) Q s ∇ F ( x ) (cid:107) 2 ≤
Revised: Let Q s be theorthogonal projection to the subspace U s . Observe that rank( Q s ) ≤ 2 s k and ∥ Q s ∇ F ( x ) ∥ 2 ≤

Original: G 2 s − 1 k for all x and all s ≥ 1 .
Revised: G 2 s − 1 k for all x and all s ≥ 1 .

Original: Rewriting the right hand side of (3) with this decomposition yields
Revised: Rewriting the right hand side of (3) with this decomposition yields

Original: [Equation]
Revised: [Equation]

Original: On the one hand, if G k decays quickly, (cid:107) E j [ Q s ∇ f j ] (cid:107) 2 will be small for large s .
Revised: On the one hand, if G k decays rapidly, ∥ E j [ Q s ∇ f j ] ∥ 2 will be small for large s .

Original: On the other hand,since the noise in DP-SGD is isotropic, we expect (cid:107) Q s ( x ( t ) − x ∗ ) (cid:107) 2 to be small for small s where Q s is an orthogonal projection onto a small subspace.
Revised: On the other hand,we expect ∥ Q s ( x ( t ) − x ∗ ) ∥ 2 to be small for small s where Q s is an orthogonal projection onto asmall subspace.

Original: Thus, for each s , ∇ f j ( x ( t ) ) (cid:62) Q s ( x ( t ) − x ∗ ) issmall either due to a small gradient (small Q s ∇ f j in expectation over  random index) or small noise(small Q s ( x ( t ) − x ∗ ) ).
Revised: Thus, for each s , ∇ f j ( x ( t ) ) ⊤ Q s ( x ( t ) − x ∗ ) is small either due to a small gradient(small Q s ∇ f j in expectation over the random index) or small noise (small Q s ( x ( t ) − x ∗ ) ), sincenoise injected in DP-SGD is isotropic.

Original: More formally, in Lemma A.1, we show that for any projection matrix Q withrank r , (cid:107) Q ( x ( t ) − x (0) )
Revised: More formally, in Lemma A.1, we show that for any projectionmatrix Q with rank r , ∥ Q ( x ( t ) − x (0) )

Original: (cid:107) 2 can be upper bounded by a term that depends only on r (rather than d ).
Revised: ∥ 2 can be upper bounded by a term that depends only on r(rather than d ).

Original:  Numerical Experiments
Revised:  Numerical Experiments

Original: The aim of this section is twofold.
Revised: The aim of this section is twofold.

Original: In Section 4.1, we study a synthetic example that matchesour theoretical assumptions and show that DP-SGD attains dimension-independent empirical andpopulation loss when the sequence of restricted Lipschitz coefﬁcients decays rapidly—even whengradients span the entire ambient space.
Revised: In Section 4.1, we study a synthetic example that matchesour theoretical assumptions and show that DP-SGD attains dimension-independent empirical andpopulation losses when the sequence of restricted Lipschitz coefficients decays rapidly—even whengradients span the entire ambient space.

Original: In Section 4.2, we study a stylized example of privatelyﬁne-tuning large language models.
Revised: In Section 4.2, we study a stylized example of privatelyfine-tuning large language models.

Original: Building on the previous theory, we provide insights as to whydense ﬁne-tuning can yield good performance.
Revised: Building on the previous theory, we provide insights as to whyfine-tuning tens of millions of parameters can yield good performance.

Original: 4.1 Synthetic Example: Estimating the Generalized Geometric Median
Revised: 4.1 Synthetic Example: Estimating the Generalized Geometric Median

Original: We privately estimate the geometric median which minimizes the average Mahalanobis distance.
Revised: We privately estimate the geometric median which minimizes the average Mahalanobis distance.

Original: Speciﬁcally, let x i ∈ R d for i ∈ [ n ] be feature vectors drawn i.i.d.
Revised: Specifically, let x i ∈ R d for i ∈ [ n ] be feature vectors drawn i.i.d.

Original: from some distribution P x , each
Revised: from some distribution P x , each

Original: [Figure]
Revised: [Figure]

Original: of which is treated as an individual record.
Revised: of which is treated as an individual record.

Original: Denote the entire dataset as D = { x i } ni =1 .
Revised: Denote the entire dataset as D = { x i } ni =1 .

Original: Subject todifferential privacy, we perform the following optimization
Revised: Subject todifferential privacy, we perform the following optimization

Original: [Equation]
Revised: [Equation]

Original: where we adopt the shorthand
Revised: where we adopt the shorthand

Original: f i ( x ) =
Revised: f i ( x ) =

Original: f
Revised: f

Original: ( x ; x i ) =
Revised: ( x ; x i ) =

Original: (cid:107) x − x i (cid:107) A .
Revised: ∥ x − x i ∥ A .

Original: When A = I d ,{+and α = 
 (withoutthe regularization term),+} the problem reducesto estimating the usual geometric median (commonly known as center of mass).
Revised: When A = I d {+and α = 
 (withoutthe regularization term),+} the problem reduces to estimating the usual geometric median (commonlyknown as center of mass).

Original: For this example, individual gradients are bounded since (cid:107)∇ f i ( x ) [-(cid:107) 
-]
Revised: For this example, individual gradients are bounded since ∥∇ f i ( x ) [-(cid:107) 
-]∥ 2 = ∥

Original: = (cid:107) A ( x − x i ) / (cid:107) x − x i (cid:107) A (cid:107) 2 ≤λ 1 ( A 1 / 2 ) =
Revised: A ( x − x i ) / ∥ x − x i ∥ A ∥ 2 ≤λ 1 ( A 1 / 2 ) =

Original: G 0 .
Revised: G 0 .

Original: More generally, the restricted Lipschitz constants of F ( x ) are the eigenvalues of
Revised: More generally, the restricted Lipschitz coefficients of F ( x ) are the eigenvalues of

Original: A 1 / 2 , since
Revised: A 1 / 2 , since

Original: [Equation]
Revised: [Equation]

Original: where Q k =
Revised: where Q k =

Original: I − P k is chosen to be the rank ( d − k ) orthogonal projection matrix that projects ontothe subspace spanned by the bottom ( d − k ) eigenvectors of A 1 / 2 .
Revised: I − P k is chosen to be the rank ( d − k ) orthogonal projection matrix that projects ontothe subspace spanned by the bottom ( d − k ) eigenvectors of A 1 / 2 .

Original: To verify our theory, we study the optimization and generalization performance of DP-SGD forminimizing (4) under Mahalanobis distances induced by different A as the problem dimensiongrows.
Revised: To verify our theory, we study the optimization and generalization performance of DP-SGD forminimizing (4) under Mahalanobis distances induced by different A as the problem dimensiongrows.

Original: The optimization performance is measured by the ﬁnal training error, and the generalizationperformance is measured by the population quantity E x ∼ P x ,x [ (cid:107) x − x (cid:107) A ] , where x denotes the randomoutput of DP-SGD.
Revised: The optimization performance is measured by the final training error, and the generalizationperformance is measured by the population quantity E x ∼ P x ,x [ ∥ x − x ∥ A ] , where x denotes the randomoutput of DP-SGD.

Original: We study the dimension scaling behavior for A being one of
Revised: We study the dimension scaling behavior for A being one of

Original: [Equation]
Revised: A const = diag (1 , . . . , 1) , A sqrt = diag (1 , 1 / √ 2 , . . . , 1 / √ d ) , A linear = diag (1 , 1 / 2 , . . .

Original:  where diag : R d → R d × d maps vectors onto square matrices with inputs on the diagonal.
Revised: , 1 /d ) , where diag : R d → R d × d maps vectors onto square matrices with inputs on the diagonal.

Original: In all cases,the span of gradients span ( {∇ F ( x ) } ) is the ambient space R d , since A is of full rank.
Revised: In all cases,the span of gradients span ( {∇ F ( x ) } ) is the ambient space R d , since A is of full rank.

Original: To ensurethe distance from the initial iterate β (0) = 0{+
+} to the optimum is the same for problem instances ofdifferent dimensions, we let feature vectors { x i } ni =1 take zero values in any dimension k > d min ,where d min is the dimension of the smallest problem in our experiments.
Revised: To ensure thedistance from the initial iterate β (0) = {+
+} to the optimum is the same for problem instances of differentdimensions, we let feature vectors { x i } ni =1 take zero values in any dimension k > d min , where d minis the dimension of the smallest problem in our experiments.

Original: Our theoretical boundssuggest that when the sequence of restricted Lipschitz coefﬁcients is constant (when A = A const ), theexcess empirical loss grows with the problem dimension, whereas when the sequence of k th-Lipschitzconstants rapidly decays with k (when A =
Revised: Our theoretical bounds suggest thatwhen the sequence of restricted Lipschitz coefficients is constant (when A = A const ), the excessempirical loss grows with the problem dimension, whereas when the sequence of restricted Lipschitzcoefficients rapidly decays with k (when A =

Original: A sqrt or A =
Revised: A sqrt or A =

Original: A linear )
Revised: A linear )

Original: , the excess empirical loss doesnot grow beyond a certain problem dimension.
Revised: , the excess empirical loss doesnot grow beyond a certain problem dimension.

Original: Figure 1 empirically captures this phenomenon.
Revised: Figure 1 empirically captures this phenomenon.

Original: Weinclude additional experimental setup details in Appendix C.
Revised: Weinclude additional experimental setup details in Appendix C.

Original: 4.2 Why Does Dense Fine-Tuning Work Well for Pretrained Language Models?
Revised: 4.2 Why Does Dense Fine-Tuning Work Well for Pretrained Language Models?

Original: Stated informally, our bounds in Theorem 3.5 imply that DP-SGD obtains dimension-independenterrors if gradients (mostly) reside in a subspace much smaller than the ambient space.
Revised: Stated informally, our bounds in Theorem 3.5 imply that DP-SGD obtains dimension-independenterrors if gradients (mostly) reside in a subspace much smaller than the ambient space.

Original: Inspired bythese results for the convex case, we now turn to study dense language model ﬁne-tuning [LTLH21]and provide a possible explanation for their recent intriguing success — ﬁne-tuning gigantic parametervectors frequently results in moderate performance drops compared to non-private learning.
Revised: Inspired bythese results for the convex case, we now turn to study dense language model fine-tuning [LTLH21]and provide a possible explanation for their recent intriguing success — fine-tuning gigantic parametervectors frequently results in moderate performance drops compared to non-private learning.

Original: In the following, we present initial evidence that gradients of the ﬁne-tuning objective evaluated nearan (approximate) local optimum mostly lie in a small subspace.
Revised: In the following, we present initial evidence that gradients of the fine-tuning objective evaluated nearan (approximate) local optimum mostly lie in a small subspace.

Original: We design subsequent experiments towork under a simpliﬁed setup.
Revised: We design subsequent experiments towork under a simplified setup.

Original: Speciﬁcally, we ﬁne-tune DistilRoBERTa
Revised: Specifically, we fine-tune DistilRoBERTa

Original: [SDCW19, LOG + 19] underε = 8 and δ = 1 / n 1 . 1 for sentiment classiﬁcation on the SST-2 dataset [SPW + 13].
Revised: [SDCW19, LOG + 19] underε = 8 and δ = 1 / n 1 . 1 for sentiment classification on the SST-2 dataset [SPW + 13].

Original: We reformulatethe label prediction problem as templated text prediction [LTLH21], and ﬁne-tune only the query andvalue matrices in attention layers.
Revised: We reformulatethe label prediction problem as templated text prediction [LTLH21], and fine-tune only the query andvalue matrices in attention layers.

Original: We focus on ﬁne-tuning these speciﬁc parameter matrices due to the success of LoRA for non-privatelearning [HSW + 21] which focuses on adapting the attention layers.
Revised: We focus on fine-tuning these specific parameter matrices inspired by the success of LoRA fornon-private fine-tuning [HSW + 21] which adapted the attention layers.

Original: Unlike LoRA, we ﬁne-tune allparameters in these matrices rather than focusing on low-rank updates.
Revised: Unlike LoRA, we fine-tuneall parameters in these matrices rather than applying low-rank updates.

Original: This gives a setup that islightweight enough to run spectral analyses computationally tractably but retains enough parameters( ≈ 7 million) such that a problem of similar scale outside of ﬁne-tuning results in substantial losses inutility.
Revised: This gives a setup that islightweight enough to run spectral analyses computationally tractably but retains enough parameters( ≈ 7 million) such that a problem of similar scale outside of fine-tuning results in substantial losses inutility.

Original: 1 For our setup, DP-SGD obtains a dev set accuracy approximately of 90% and 92% , privatelyand non-privately, respectively.
Revised: 1 For our setup, DP-SGD obtains a dev set accuracy approximately of 90% and 92% , privatelyand non-privately, respectively.

Original: These numbers are similar to previous results obtained with the samepretrained model [YNB + 21, LTLH21].
Revised: These numbers are similar to previous results obtained with the samepretrained model [YNB + 21, LTLH21].

Original: We include the full experimental protocol and additionalresults in Appendix D.
Revised: We include the full experimental protocol and additionalresults in Appendix D.

Original: To provide evidence for the small subspace hypothesis, we sample gradients near a local optimumand study their principal components.
Revised: To provide evidence for the small subspace hypothesis, we sample gradients along the optimizationtrajectory and study their principal components.

Original: Speciﬁcally, we “over-train” by privately ﬁne-tuning forr = 2 × 10 3 updates and collect all the non-privatized average clipped gradients along the optimizationtrajectory.
Revised: Specifically, we “over-train” by privately finetuning for r = 2 × 10 3 updates and collect all the non-privatized average clipped gradients alongthe optimization trajectory.

Original: While ﬁne-tuning for 200 and 2k updates have similar ﬁnal dev set performance underour hyperparameters, the increased number of steps allows us to collect more gradients around theconverged solution.
Revised: While fine-tuning for 200 and 2k updates have similar final dev setperformance under our hyperparameters, the increased number of steps allows us to collect moregradients around the converged solution.

Original: This yields a gradient matrix H ∈ R r × p , where p ≈ 7 × 10 6 is the size of theparameter vector.
Revised: This yields a gradient matrix H ∈ R r × p , where p ≈7 × 10 6 is the size of the parameter vector.

Original: We perform PCA for H with the orthogonal iteration algorithm [Dem97] andvisualize the set of estimated singular values σ i ( H )
Revised: We perform PCA for H with the orthogonal iterationalgorithm [Dem97] and visualize the set of estimated singular values σ i ( H )

Original: =
Revised: =

Original: λ
Revised: λ

Original: i ( H (cid:62) H ) 1 / 2 in terms of both (i) the densityestimate, and (ii) their relation with the rank.
Revised: i ( H ⊤ H ) 1 / 2 interms of both (i) the density estimate, and (ii) their relation with the rank.

Original: Figure 2 (a) shows the top 1000 singular values sortedand plotted against their rank and the least squares ﬁt on log-transformed inputs and outputs.
Revised: Figure 2 (a) shows the top1000 singular values sorted and plotted against their rank and the least squares fit on log-transformedinputs and outputs.

Original: Theplot displays few large singular values which suggests that gradients are controlled through only fewprincipal directions.
Revised: The plot displays few large singular values which suggests that gradients arecontrolled through only few principal directions.

Original: The linear ﬁt suggests that singular values decay rapidly (at a rate of k − 0 . 6 ).
Revised: The linear fit suggests that singular values decayrapidly (at a rate of k − 0 . 6 ).

Original: To study the effects that different principal components have on ﬁne-tuning performance, we furtherperform the following re-training experiment.
Revised: To study the effects that different principal components have on fine-tuning performance, we furtherperform the following re-training experiment.

Original: Given the principal components, we privately re-ﬁnetune with gradients projected onto the top k ∈ { 10 , 20 , 100 } components.
Revised: Given the principal components, we privately re-finetune with gradients projected onto the top k ∈ { 10 , 20 , 100 } components.

Original: Note that this projectionapplies only to the (non-privatized) average clipped gradients and the isotropic DP noise is stillapplied to all dimensions.
Revised: Note that this projectionapplies only to the (non-privatized) average clipped gradients — isotropic DP noise is still appliedto all dimensions.

Original: Figure 2 (b) shows that the original performance can be attained byoptimizing within a subspace of onlydimension k = 100 , suggesting that most of the dimensions ofthe 7 million parameter vector encodea limited learning signal.
Revised: Figure 2 (b) shows that the original performance can be recovered by optimizingwithin a subspace of only k = 100 dimensions, suggesting that most of the dimensions of the 7million parameter exhibit little variance and encode limited learning signal.

Original: While these empirical results present encouraging insights for the dimension-independent performanceof ﬁne-tuning, we acknowledge that this is not a complete validation of the restricted Lipschitzcontinuity condition and fast decay of coefﬁcients (even locally near the optimum).
Revised: While these empirical results present encouraging insights for the (near) dimension-independentperformance of fine-tuning, we acknowledge that this is not a complete validation of the restricted Lipschitz continuity condition and fast decay of coefficients (even locally near the optimum).

Original: We leave a morethorough analysis with additional model classes and ﬁne-tuning tasks to future work.
Revised: Weleave a more thorough analysis with additional model classes and fine-tuning tasks to future work.

Original:  Related Work
Revised:  Related Work

Original: Differentially private empirical risk minimization (DP-ERM) and its close cousin differentiallyis private stochastic convex optimization (DP-SCO) are arguably the most well-studied areas of DP [CMS11, KST12, BST14a, SCS13, WYX17, FTS17, BFTT19, MRTZ17, ZZMW17, WLK + 17,
Revised: DP-ERM and its close cousin DP-SCO are arguably the most well-studied areas of differential privacy [CMS11, KST12, BST14, SCS13, WYX17, FTS17, BFTT19, MRTZ17, ZZMW17, WLK + 17 ,

Original: FKT20 , INS + 19, BFGT20, STT20, LL21, AFKT21, BGN21, GTU22, GLL22].
Revised: FKT20, INS + 19, BFGT20, STT20, LL21, AFKT21, BGN21, GTU22, GLL22].

Original: Tight dependenceon the number of model parameters and the number of data samples are known for both DPERM
Revised: Tight dependenceon the number of model parameters and the number of data samples are known for both DP-

Original: [BST14a] and DP-SCOerrors [BFTT19].
Revised: [Figure] ERM [BST14] and DP-SCO [BFTT19].

Original: In particular, it is known that for the error on general [Figure] convex losses, an explicit polynomial dependence on the number of parameters in the model (i.e. d )is necessary.
Revised: In particular, it is known that for the error on general convexlosses, an explicit polynomial dependence on the number of parameters in the model is necessary.

Original: However, [JT14, STT20] showed that if all the gradients of the underlying loss functionlie in a ﬁxed low-rank subspace M , the dependence on  d can be replaced by rank ( M ) (which can besigniﬁcantly smaller).
Revised: However, [JT14, STT20] showed that if all the gradients of the underlying loss function lie in a fixedlow-rank subspace M , the dependence on dimension d can be replaced by rank ( M ) (which can besignificantly smaller).

Original: We extend this line of work to show that under a weaker assumption calledrestricted Lipschitz continuity (mentioned earlier) one can obtain analogous error guarantees that areindependent of any explicit dependence on d , but do not require the gradients of the loss to strictlylie in any ﬁxed low-rank subspace M .
Revised: We extend this line of work to show that under a weaker assumption (restricted Lipschitz continuity with decaying coefficients) one can obtain analogous error guarantees that areindependent of any explicit dependence on d , but do not require the gradients of the loss to strictlylie in any fixed low-rank subspace M .

Original: As a consequence, we use our results to provide a plausibleexplanation why in recent empirical works it has been observed that training a larger model under DPis at times more advantageous in terms of utility than training a smaller model [LTLH21, YNB + 21].
Revised: As a consequence, we use our results to provide a plausibleexplanation why in recent empirical works it has been observed that dense fine-tuning can be effectiveand that fine-tuning a larger model under DP is at times more advantageous in terms of utility thanfine-tuning a smaller model [LTLH21, YNB + 21].

Original: In a complementary line of work, [AGM + 21, LVS + 21, ADF + 21, KDRT21, YZCL21] designedvariants of DP-SGD that either explicitly or implicitly control the subspace in which the gradientsare allowed to reside.
Revised: In a complementary line of work, [AGM + 21, LVS + 21, ADF + 21, KDRT21, YZCL21] designedvariants of DP-SGD that either explicitly or implicitly control the subspace in which the gradientsare allowed to reside.

Original: They demonstrated improved dependence of the error on dimensions/modelparameters if the true gradients lie in a “near” low-rank subspace.
Revised: They demonstrated improved dependence of the error on dimensions/modelparameters if the true gradients lie in a “near” low-rank subspace.

Original: Our results are incomparable tothis line of work, because of two reasons: i)
Revised: Our results are incomparable tothis line of work because of two reasons: (i)

Original: Our algorithm is vanilla DP-SGD, and does not track thegradient subspace either explicitly or implicitly, and hence does not change the optimization landscape.
Revised: Our algorithm is vanilla DP-SGD, and does not track thegradient subspace either explicitly or implicitly, and hence does not change the optimization landscape.

Original: The improved dependence on dimensions is just an artifact of the analysis.
Revised: The improved dependence on dimensions is just an artifact of the analysis.

Original: ii) Our analytical resultsdo not need the existence of any public data to obtain tighter dependence on dimensions.
Revised: (ii) Our analytical resultsdo not need the existence of any public data to obtain tighter dependence on dimensions.

Original: All priorworks mentioned above need the existence of public data to demonstrate any improvement.
Revised: All priorworks mentioned above need the existence of public data to demonstrate any improvement.

Original:  Conclusion& Limitation
Revised:  Conclusion

Original: We made an attempt to reconcile two seemingly conﬂicting results: (1) in private convex optimization,errors are predicted to scale proportionally with the dimension of the learning problem; while (2)in empirical works on large-scale private ﬁne-tuning through DP-SGD, privacy-utility trade-offsbecome better with increasing model size.
Revised: We made an attempt to reconcile two seemingly conflicting results: (1) in private convex optimization,errors are predicted to scale proportionally with the dimension of the learning problem; while (2)in empirical works on large-scale private fine-tuning through DP-SGD, privacy-utility trade-offsbecome better with increasing model size.

Original: We introduced the notion of restricted Lipschitz continuity,with which we gave reﬁned analyses of DP-SGD for DP-ERM and DP-SCO.
Revised: We introduced the notion of restricted Lipschitz continuity,with which we gave refined analyses of DP-SGD for DP-ERM and DP-SCO.

Original: When the magnitudesof gradients projected onto diminishing subspaces decay rapidly, our analysis showed that excessempirical and population losses of DP-SGD are independent of the model dimension.
Revised: When the magnitudesof gradients projected onto diminishing subspaces decay rapidly, our analysis showed that excessempirical and population losses of DP-SGD are independent of the model dimension.

Original: Throughpreliminary experiments, we gave empirical evidence that gradients of large pretrained languagemodels near a local optimum (obtained through ﬁne-tuning) mostly lie in the subspace spanned by afew principal components.
Revised: Throughpreliminary experiments, we gave empirical evidence that gradients of large pretrained languagemodels near a local optimum (obtained through fine-tuning) mostly lie in the subspace spanned by afew principal components.

Original: Our theoretical and empirical results together give a possible explanationfor recent successes in large-scale differentially private ﬁne-tuning.
Revised: Our theoretical and empirical results together give a possible explanationfor recent successes in large-scale differentially private fine-tuning.

Original: Given our improved upper bounds on the excess empirical and population risks for differentiallyprivate convex learning, it is instructive to ask if such bounds are tight in the mini-max sense.
Revised: Given our improved upper bounds on the excess empirical and population risks for differentiallyprivate convex learning, it is instructive to ask if such bounds are tight in the mini-max sense.

Original: Weleave answering this inquiry to future work.
Revised: Weleave answering this inquiry to future work.

Original: In addition, while we have presented encouragingempirical evidence that ﬁne-tuning gradients mostly lie in a small subspace, more work is requiredstudy the robustness of this phenomenon with respect to the model class and ﬁne-tuning problem.
Revised: In addition, while we have presented encouragingempirical evidence that fine-tuning gradients mostly lie in a small subspace, more work is required tostudy the robustness of this phenomenon with respect to the model class and fine-tuning problem.

Original: Overall, we hope that our work leads to more research on understanding conditions under which DPlearning does not degrade with increasing problem size, and more generally, how theory can informand explain the practical successes of differentially private deep learning.
Revised: Overall, we hope that our work leads to more research on understanding conditions under which DPlearning does not degrade with increasing problem size, and more generally, how theory can informand explain the practical successes of differentially private deep learning.

Original: Checklist
Revised: Checklist

Original: For all authors...
Revised: For all authors...

Original: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s
Revised: (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s

Original: contributions and scope?
Revised: contributions and scope?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you describe the limitations of your work?
Revised: (b) Did you describe the limitations of your work?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [N/A]
Revised: [N/A]

Original: This work
Revised: This work

Original: presents theory which characterizes the performance of existing algorithms.
Revised: presents theory which characterizes the performance of existing algorithms.

Original: This work
Revised: This work

Original: would not lead to any direct societal impact.
Revised: would not lead to any direct societal impact.

Original: (d) Have you read the ethics review guidelines and ensured that your paper conforms to
Revised: (d) Have you read the ethics review guidelines and ensured that your paper conforms to

Original: them?
Revised: them?

Original: [Yes]
Revised: [Yes]

Original: If you are including theoretical results...
Revised: If you are including theoretical results...

Original: (a) Did you state the full set of assumptions of all theoretical results?
Revised: (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you include complete proofs of all theoretical results?
Revised: (b) Did you include complete proofs of all theoretical results?

Original: [Yes]
Revised: [Yes]

Original: If you ran experiments...
Revised: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experi-
Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Original: mental results (either in the supplemental material or as a URL)?
Revised: mental results (either in the supplemental material or as a URL)?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
Revised: (b) Did you specify all the training details (e g., data splits, hyperparameters, how they were chosen)?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
Revised: (c) Did you report error bars (e g., with respect to the random seed after running experiments multiple times)?

Original: [Yes]
Revised: [Yes]

Original: (d) Did you include the total amount of compute and the type of resources used (e.g., type
Revised: (d) Did you include the total amount of compute and the type of resources used (e g., type

Original: of GPUs, internal cluster, or cloud provider)?
Revised: of GPUs, internal cluster, or cloud provider)?

Original: [Yes]
Revised: [Yes]

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
Revised: If you are using existing assets (e g., code, data, models) or curating/releasing new assets...

Original: (a) If your work uses existing assets, did you cite the creators?
Revised: (a) If your work uses existing assets, did you cite the creators?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you mention the license of the assets?
Revised: (b) Did you mention the license of the assets?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you include any new assets either in the supplemental material or as a URL?
Revised: (c) Did you include any new assets either in the supplemental material or as a URL?

Original: [No]
Revised: [No]

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re
Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’re

Original: using/curating?
Revised: using/curating?

Original: [Yes]
Revised: [Yes]

Original: (e) Did you discuss whether the data you are using/curating contains personally identiﬁable
Revised: (e) Did you discuss whether the data you are using/curating contains personally identifiable

Revised: [Table]

Original: information or offensive content?
Revised: information or offensive content?

Original: [Yes]
Revised: [Yes]

Revised: [Table]

Original: If you used crowdsourcing or conducted research with human subjects...
Revised: If you used crowdsourcing or conducted research with human subjects...

Original:  (a) Did you include the full text of instructions given to participants and screenshots, if 
Revised: [Table] (a) Did you include the full text of instructions given to participants and screenshots, if [Table]

Original: applicable?
Revised: applicable?

Original: [N/A]
Revised: [N/A]

Revised: [Table]

Original: (b) Did you describe any potential participant risks, with links to Institutional Review
Revised: (b) Did you describe any potential participant risks, with links to Institutional Review

Revised: [Table]

Original: Board (IRB) approvals, if applicable?
Revised: Board (IRB) approvals, if applicable?

Original: [N/A]
Revised: [N/A]

Revised: [Table]

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount
Revised: (c) Did you include the estimated hourly wage paid to participants and the total amount

Revised: [Table]

Original: spent on participant compensation?
Revised: spent on participant compensation?

Original: [N/A]
Revised: [N/A]

Revised: [Table]