Original: Refined Dimension-Dependent Analysis for Private Convex Learning and Implications for Fine-Tuning
Revised: Reﬁned Dimension-Dependent Analysis for Private Convex Learning and Implications for Fine-Tuning

Original: Anonymous Author(s)

Original: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: Large pretrained models can be privately fine-tuned to achieve performance approaching non-private models.
Revised: Recent works have shown that large pretrained models can be privately ﬁne-tunedto achieve performance approaching non-private models.

Original: A common theme in these results is the surprisingobservation that high-dimensional models can achieve favorable privacy-utilitytrade-offs.
Revised: A common theme in theseresults is the surprising observation that very large models can achieve favorableprivacy-utility trade-offs.

Original: This seemingly contradicts known results on the model-size dependence of differentially private convex learning and raises the following researchquestion: When does the performance of differentially private learning not degrade with increasing model size?
Revised: This seemingly contradicts known results on the modelsize dependence of differentially private convex learning and raises the followingresearch question: When does the performance of differentially private learning notdegrade with increasing model size?

Original: We identify that the magnitudes of gradientsprojected onto subspaces is a key factor that determines performance.
Revised: We identify that the magnitudes of gradientsprojected onto subspaces is a key factor that determines performance.

Original: To preciselycharacterize this for private convex learning, we introduce a condition on the objective that we term restricted Lipschitz continuity and derive refined bounds forthe excess empirical and population risks that are dimension-independent underadditional conditions.
Revised: To preciselycharacterize this for private convex learning, we introduce a condition on theobjective that we term restricted Lipschitz continuity and derive reﬁned bounds forthe excess empirical and population risks that are dimension-independent underadditional conditions.

Original: We empirically show that in private fine-tuning of largelanguage models, gradients obtained during fine-tuning are mostly controlled by afew principal components.
Revised: We validate this condition in practice by privately ﬁnetuning language models and showing that gradients evaluated near a local optimumare mostly controlled by a few principal components.

Original: This behavior is similar to conditions under which weobtain dimension-independent bounds in convex settings and provides a possibleexplanation for recent successes in large-scale private fine-tuning.
Revised: This behavior is similarto conditions under which we obtain dimension-independent bounds in convexsettings and provides a possible explanation for recent successes in large-scaleprivate ﬁne-tuning.

Original:  Introduction
Revised:  Introduction

Original: Recent works have shown that large publicly pretrained models can be differentially privately finetuned on small downstream datasets with performance approaching those attained by non-privatemodels.
Revised: Recent works have shown that large publicly pretrained models can be differentially privately ﬁnetuned on small downstream datasets with performance approaching those attained by non-privatemodels.

Original: In particular, past works showed that pretrained BERT [DCLT18] and GPT-2 [RNSS18,
Revised: In particular, past works showed that pretrained BERT [DCLT18] and GPT-2 [RNSS18,

Original: RWC + 19] models can be fine-tuned to perform well for text classification and generation undera privacy budget of ε ∈ [2 , 6] [LTLH21, YNB + 21].
Revised: RWC + 19] models can be ﬁne-tuned to perform well for text classiﬁcation and generation undera privacy budget of ε ∈ [2 , 6] [LTLH21, YNB + 21].

Original: More recently, it was shown that pretrained
Revised: More recently, it was shown that pretrained

Original: ResNets [HZRS16] and vision-Transformers [DBK + 20] can be fine-tuned to perform well for
Revised: ResNets [HZRS16] and vision-Transformers [DBK + 20] can be ﬁne-tuned to perform well for

Original: ImageNet classification under single digit privacy budgets [DBH + 22, MTKC22].
Revised: ImageNet classiﬁcation under single digit privacy budgets [DBH + 22, MTKC22].

Original: One key ingredient in these successes has been the use of large pretrained models with millions tobillions of parameters, and these works generally highlight the importance of two phenomena: (i)large pretrained models tend to experience good privacy-utility trade-offs when fine-tuned, and (ii) thetrade-off improves with the use of largerpretrained models.
Revised: One key ingredient in these successes has been the use of large pretrained models with millions tobillions of parameters, and these works generally highlight the importance of two phenomena: (i)large (pretrained) models tend to experience good privacy-utility trade-offs when ﬁne-tuned, and (ii)the trade-off improves with the use of larger models.

Original: While the power of scale and pretraininghas been demonstrated numerous times in non-private deep learning, one common wisdom in privatelearning had been that large models tend not to perform well.
Revised: While the power of scale and pre-training has been demonstrated numerous times in non-private deep learning, one common wisdom in privatelearning had been that large models tend not to perform well.

Original: This intuition was rooted in resultsin differentially private convex optimization, which predicted that errors would scale proportionallywith the dimension of the learning problem.
Revised: This intuition was rooted in resultsin differentially private convex optimization, which predicted that errors would scale proportionallywith the dimension of the learning problem.

Original: Consider the problem of differentially private convex empirical risk minimization (ERM) as anexample.
Revised: Consider the problem of differentially private convex empirical risk minimization (ERM) as anexample.

Original: In this problem, we are given a dataset of n examples D = { s j } nj =1 ∈ S n , a convex body
Revised: In this problem, we are given a dataset of n examples D = { s j } nj =1 ∈ S n , a convex body

Original: K ⊂ R d , and the goal is to perform the optimization
Revised: K ⊂ R d , and the goal is to perform the optimization

Original: [Equation]
Revised: [Equation]

Original: subject to differential privacy, where f ( · ; s ) is some convex loss function over K for any s ∈ S .
Revised: subject to differential privacy, where f : K × S → R is some convex loss function.

Original: Past works have studied this problem and presented matching upper and lower bounds that aredimension-dependent under the usual Lipschitz  assumptions on the objective [BST14, CMS11].
Revised: Past works havestudied this problem and presented matching upper and lower bounds that are dimension-dependentunder the usual Lipschitz (and smoothness) assumptions on the objective [BST14a, CMS11].

Original: These dimension-dependent results suggest that the performance of differentially private convex ERM inevitably degrades with increasing problem dimension — for the worst case functions withinthe prescribed class of convex losses.
Revised: Thesedimension-dependent results suggest that the performance of differentially private convex ERMinevitably degrades with increasing problem dimension — for the worst case functions within theprescribed class of convex losses.

Original: To reconcile the conflict between the dimension-dependent lower bounds for private convex learningand the empirical success of large-scale private fine-tuning, we study the following question both intheory and in practice:
Revised: To reconcile the conﬂict between the dimension-dependent lower bounds for private convex learningand the empirical success of large-scale private ﬁne-tuning, we study the following question both intheory and in practice:

Original: When does the performance of differentially private learning (via DP-SGD) notdegrade with increasing problem size and dimension?
Revised: When does the performance of differentially private learning (via DP-SGD) notdegrade with increasing problem size and dimension?

Original: On the theoretical front, we identify that the standard dependence on the dimension of the ambientspace can be replaced by the magnitudes of gradients projected onto subspaces of varying dimensions.
Revised: On the theory front, we identify that the standard dependence on the dimensionality of the ambientspace can be replaced by the magnitudes of gradients projected onto subspaces of varying dimensions.

Original: We formalize this in a condition that we call restricted Lipschitz continuity and derive refined boundsfor the excess empiricalrisks for DP-ERM and population risksfor DP-SGD when loss functionsobey this condition.
Revised: We formalize this in a condition that we call restricted Lipschitz continuity and derive reﬁned boundsfor the excess empirical and population risks when loss functions obey this condition.

Original: We show that when the restricted Lipschitz coefficients decay rapidly, both theexcess empirical and population risks become dimension-independent.
Revised: We show thatwhen the restricted Lipschitz coefﬁcients decay rapidly, both the excess empirical and populationrisks become dimension-independent.

Original: These theoretical results shed light on the recent success of large-scale private fine-tuning of languagemodels.
Revised: These theoretical results shed light on the recent success of large-scale private ﬁne-tuning of languagemodels.

Original: We empirically show that the gradients of language models in fine-tuning are mostlycontrolled by a few principal components — a behavior that is similar to conditions under which weobtain dimension-independent bounds for private convex ERM.
Revised: We empirically show that the gradients of language models during ﬁne-tuning (evaluated neara local optimum) are mostly controlled by a few principle components — a behavior that is similarto conditions under which we obtain dimension-independent bounds for private convex ERM.

Original: This provides a possible explanationfor the observation that densely fine-tuning (with DP-SGD) needs not necessarily have much worseperformance than sparsely fine-tuning [LTLH21]. Moreover, it suggests that DP-SGD can be adaptiveto problems that are effectively low-dimensional (as characterized by restricted Lipschitz continuity)without explicit algorithmic intervention.
Revised: Thisprovides a possible explanation for the observation that densely ﬁne-tuning need not necessarily havemuch worse performance than sparsely ﬁne-tuning [LTLH21] and moreover suggests that DP-SGDcan be adaptive to problems that are effectively low-dimensional under restricted Lipschitz continuity.

Original: We summarize our contributions below.
Revised: We summarize our contributions below.

Original: (1) We introduce a condition on the objective function that we term restricted Lipschitz continuity.
Revised: (1) We introduce a condition on the objective function that we term restricted Lipschitz continuity.

Original: This condition generalizes the usual Lipschitz continuity notion and gives rise to refined analyseswhen magnitudes of gradients projected onto diminishing subspaces decay rapidly.(2) Under restricted Lipschitz continuity, we present refined bounds on the excess empirical andpopulation risks for DP-SGD when optimizing convex objectives.
Revised: This condition generalizes the usual Lipschitz continuity notion and gives rise to reﬁned analyseswhen magnitudes of gradients projected onto diminishing subspaces decay rapidly.(2) Under restricted Lipschitz continuity, we present reﬁned bounds on the excess empirical andpopulation risks for DP-SGD when optimizing convex objectives.

Original: These bounds generalizeprevious dimension-independent results [SSTT21] and are broadly applicable to cases where gradients are full rank but most coordinates only marginally influence the objective.
Revised: These bounds generalize previous dimension-independent results [SSTT21] and are broadly applicable to cases wheregradients are full rank but most coordinates only marginally inﬂuence the objective.

Original: (3) Our theory shed light on recent successes of private fine-tuning of language models.
Revised: (3) Our theory shed light on recent successes of private ﬁne-tuning of language models.

Original: We show that gradients  obtained through fine-tuning mostly lie in the space spanned by a few principal components — a behavior similar towhen optimizing a restricted Lipschitz continuous loss withdecaying coefficients.
Revised: We showthat gradients near a local optimum obtained through ﬁne-tuning mostly lie in the space spannedby a few principle components — a behavior similar to restricted Lipschitz continuity withdecaying coefﬁcients.

Original: This provides a possible explanation for recent successes in large-scale private fine-tuning.
Revised: This provides a possible explanation for recent successes in large-scaleprivate ﬁne-tuning.

Original:  Preliminaries
Revised:  Preliminaries

Original: We first define the notation used throughout this work.
Revised: In this section, we ﬁrst deﬁne the notation used throughout this work.

Original: We then state the problems of differentially private empirical risk minimization and differentially private stochastic convex optimization.
Revised: We then state the problemsof differentially private empirical risk minimization and differentially private stochastic convexoptimization.

Original: Finally, wegive a brief recap of differentially private stochastic gradient descent, existing dimension-dependentresults in the literature, and the seemingly inconsistent results between theory for convex losses andrecent empirical findings in language model fine-tuning.
Revised: Finally, we give a brief recap of differentially private stochastic gradient descent,existing dimension-dependent results in the literature, and the seemingly inconsistent results betweentheory for convex losses and recent empirical ﬁndings in language model ﬁne-tuning.

Original: Notation.
Revised: Notation.

Original: For a positive integer n ∈ N + , define the shorthand [ n ] = {  1 , . . . , n } .
Revised: For a non-negative integer n ∈ N + , deﬁne the shorthand [ n ] = { 0 , 1 , . . . , n } .

Original: For a vectorx ∈ R d , denote its ℓ 2 -norm by ∥ x ∥ 2 .
Revised: For avector x ∈ R d , denote its (cid:96) 2 -norm by (cid:107) x (cid:107) 2 (or (cid:107) x (cid:107) when it’s clear from context).

Original: Let S d denote the set of d × d symmetric matrices, and S d + ⊂ S dthe positive semidefinite subset.
Revised: Let S d denote theset of d × d symmetric matrices, and S d + ⊂ S d the positive semideﬁnite subset.

Original: Given M ∈ S d , let λ 1 ( M ) ≥ λ 2 ( M ) ≥ · · · ≥ λ d ( M ) denote itseigenvalues.
Revised: Given M ∈ S d , let λ 1 ( M ) ≥ λ 2 ( M ) ≥ · · · ≥ λ d ( M ) denote its eigenvalues.

Original: Given A ∈ S d + , let ∥ x 
Revised: Given A ∈ S d + , let (cid:107) x (cid:107) A

Original: ∥ A = ( x ⊤ Ax ) 1 / 2 denote the induced Mahalanobis norm.
Revised: = ( x (cid:62) Ax ) 1 / 2denote the induced Mahalanobis norm.

Original: Forscalar functions f, g , we say f ≲ g if f ≤ Cg 
Revised: For scalar functions f, g , we say f (cid:46) g if f ≤ Cg for somenumerical constant C .

Original: 2.1 Differentially Private Empirical Risk Minimization and Stochastic Convex Optimization
Revised: 2.1 Differentially Private Empirical Risk Minimization and Stochastic Convex Optimization

Original: Before stating the theoretical problem of interest, we define the basic concepts of Lipschitz continuity,convexity, and approximate differential privacy.
Revised: Before stating the theoretical problem of interest, we deﬁne the basic concepts of Lipschitz continuity,convexity, and approximate differential privacy.

Original: Definition 2.1 (Lipschitz Continuity) .
Revised: Deﬁnition 2.1 (Lipschitz Continuity) .

Original: We say a loss function h : K → R is G -Lipschitz with respectto the ℓ 2 norm if for all x, x ′ ∈ K , | f ( x ) − f ( x ′ )
Revised: We say a loss function h : K → R is G -Lipschitz with respectto the (cid:96) 2 norm if for all x, x (cid:48) ∈ K , | f ( x ) − f ( x (cid:48) )

Original: | ≤ G ∥ x − x ′ ∥ 2 .
Revised: | ≤ G (cid:107) x − x (cid:48) (cid:107) 2 .

Original: Definition 2.2 (Convexity) .
Revised: Deﬁnition 2.2 (Convexity) .

Original: We say a loss function h : K → R is convex if h ( αx + (1 − α ) y ) ≤αh ( x ) + (1 − α ) h
Revised: We say a loss function h : K → R is convex if h ( αx + (1 − α ) y ) ≤αh ( x ) + (1 − α ) h

Original: ( y ) , for all α ∈ [0 , 1] , and x, y ∈ K .
Revised: ( y ) , for all α ∈ [0 , 1] , and x, y ∈ K .

Original: Definition 2.3 (Approximate Differential Privacy [DR + 14]) .
Revised: Deﬁnition 2.3 (Approximate Differential Privacy [DR + 14]) .

Original: We say a randomized algorithm M is( ε, δ ) -differentially private if for all neighboring datasets D and D ′ that differ by a single record andall events O ⊂ range( M ) , the following expression holds
Revised: We say a randomized algorithm M is( ε, δ ) -differentially private if for all neighboring datasets D and D (cid:48) that differ by a single record andall events O ⊂ range( M ) , the following expression holds

Original: [Equation]
Revised: [Equation]

Original: In this work, we study both differentially private empirical risk minimization (DP-ERM) for convexobjectives and differentially private stochastic convex optimization (DP-SCO).
Revised: In this work, we study both differentially private empirical risk minimization (DP-ERM) for convexobjectives and differentially private stochastic convex optimization (DP-SCO).

Original: In DP-ERM for convex objectives, we are given a dataset D = { s j } j ∈ [ n ] ∈ S n of n examples.
Revised: In DP-ERM for convex objectives, we are given a dataset D = { s j } j ∈ [ n ] ∈ S n of n examples.

Original: Eachper-example loss f ( · ; s ) is convex over a convex body K ⊆ R d and G -Lipschitz.
Revised: Eachper-example loss f ( · ; s ) is convex over a convex body K ⊆ R d and G -Lipschitz.

Original: We aim to designan ( ε, δ ) -DP algorithm that returns a solution x priv which approximately minimizes the empirical risk
Revised: We aim to designan ( ε, δ ) -DP algorithm that returns a solution x priv which approximately minimizes the empirical risk

Original: [Equation]
Revised: [Equation]

Original: (cid:88)
Revised: f

Original: [Equation]
Revised: [Equation]

Original: f (
Revised: x

Original: [Equation]
Revised: [Equation]

Original: ; s j ) .
Revised: s [Equation]

Original: The term F ( x priv ; D ) − min x ∈K F ( x ; D ) is referred to as the excess empirical risk associated withthe solution x priv .
Revised: The term F ( x priv ; D ) − min x ∈K F ( x ; D ) is referred to as the excess empirical risk associated withthe solution x priv .

Original: In DP-SCO, we assume the per-example loss f ( · ; s ) is convex and G -Lipschitz for all s ∈ S , and weare given n examples drawn i.i.d.
Revised: In DP-SCO, we assume the per-example loss f ( · ; s ) is convex and G -Lipschitz for all s ∈ S , and weare given n examples drawn i.i.d.

Original: from some underlying (unknown) distribution P .
Revised: from some underlying (unknown) distribution P .

Original: The goal is todesign an ( ε, δ ) -DP algorithm which approximately minimizes the population risk
Revised: The goal is todesign an ( ε, δ ) -DP algorithm which approximately minimizes the population risk

Original: [Equation]
Revised: [Equation]

Original: The term F ( x priv ; P ) − min x ∈K F ( x ; P ) is referred to as the excess population loss of the solutionx priv .
Revised: The term F ( x priv ; P ) − min x ∈K F ( x ; P ) is referred to as the excess population loss of the solutionx priv .

Original: Slightly abusing terminology, werespectively refer to the following quantities as the excessempirical and population risks for a randomized solution x priv 
Revised: Slightly abusing terminology, we refer to the following quantities as the excess empirical andpopulation risks for a randomized solution x priv ,

Original: [Equation]
Revised: [Equation]

Original: 2.2 Differentially Private Stochastic Gradient Descent
Revised: 2.2 Differentially Private Stochastic Gradient Descent

Original: Differentially Private Stochastic Gradient Descent (DP-SGD) [ACG + 16 , SCS13] is a popular algorithm for DP convex optimization.
Revised: Differentially Private Stochastic Gradient Descent (DP-SGD) [ACG + 16, SCS13] is a popular algorithm for DP convex optimization.

Original: For the theoretical analysis, we study DP-SGD for unconstrainedoptimization.
Revised: For the theoretical analysis, we study DP-SGD for unconstrainedoptimization.

Original: To facilitate analysis, we work with the ℓ 2 regularized objective expressed as
Revised: To facilitate analysis, we work with the (cid:96) 2 regularized objective expressed as

Original: [Equation]
Revised: [Equation]

Original: To optimize this objective, DP-SGD independently samples an example in each iteration and updatesthe solution by combining the gradient with an isotropic Gaussian whose scale is proportional to G ,the Lipschitz constant of f .
Revised: To optimize this objective, DP-SGD independently samples an example in each iteration and updatesthe solution by combining the gradient with an isotropic Gaussian whose scale is proportional to G ,the Lipschitz constant of f .

Original: Algorithm 1 presents the pseudocode.
Revised: Algorithm 1 presents the pseudocode.

Original: It is straightforward to show that Algorithm 1 satisfies differential privacy.
Revised: It is straightforward to show that Algorithm 1 satisﬁes differential privacy.

Original: The following lemmaquantifies the overall privacy spending and builds on a long line of work on accounting the privacyloss of compositions [ACG + 16, BBG18].
Revised: The following lemmaquantiﬁes the overall privacy spending and builds on a long line of work on accounting the privacyloss of compositions [ACG + 16, BBG18].

Original: Lemma 2.4 ([KLL21, Theorem 3.1]) .
Revised: Lemma 2.4 ([KLL21, Theorem 3.1]) .

Original: For n ≥ 10 , ε < c 1 T/n 2 and 1 / 2 ≥ δ > 0 .
Revised: For n ≥ 10 , ε < c 1 T/n 2 and 1 / 2 ≥ δ > 0 .

Original: Let σ ≥  for some numerical constants c 1{+
+} and c 2 .
Revised: Let σ ≥ [Equation] for some numerical constants c {+
+} and c 2 .

Original: Then, DP-SGD (Algorithm 1) is ( ε, δ ) -differential private.
Revised: Then, DP-SGD (Algorithm 1) is ( ε, δ ) -differential private.

Original: 1 Input: Initial iterate x (0) , dataset D = { s j } j ∈ [ n ] , per-step noise magnitude σ , total number of updates T .
Revised: 1 Input: Initial iterate x (0) , dataset D = { s j } j ∈ [ n ] , per-step noise magnitude σ , total number of updates T .

Original: 2 for t = 1 , . . . , T do i t ∼ Uniform ([ n ]) x ( t ) =
Revised: 2 for t = 1 , · · · , T do i t ∼ Uniform ([ n ]) x ( t ) =

Original: x ( t − 1) − η (cid:16) ∇ f ( x ( t − 1) ; s i t )
Revised: x ( t − 1) − η (cid:16) ∇ f ( x ( t − 1) ; s i t )

Original: + α ( x ( t − 1) − x (0) )
Revised: + α ( x ( t − 1) − x (0) )

Original: + G · ζ t (cid:17) , ζ t ∼ N (0 , σ 2 I d ) 5 end 6 Return: x def = 1 T (cid:80) Tt =1 x ( t ) .
Revised: + G · ζ t (cid:17) , ζ t ∼ N (0 , σ 2 I d ) 5 end 6 Return: x def = 1 T (cid:80) Tt =1 x ( t ) .

Original: 2.3 On the Dimension Dependence of Private Learning 
Revised: 2.3 Conﬂicting Results Between Convex Learning and Large-Scale Fine-Tuning

Original: Some of the early works on bounding the excess empirical and population risks for privately optimizing convex objectives focused on a constrained optimization setup where iterates are explicitlyprojected onto a fixed bounded domain after each noisy gradient update.
Revised: Some of the early works on bounding the excess empirical and population risks for privately optimizing convex objectives focused on a constrained optimization setup where iterates are explicitly projected onto a ﬁxed bounded domain after each noisy gradient update.

Original: Results in this settingsuggested that risks are inevitably dimension-dependent.
Revised: Results in thissetting suggested that risks are inevitably dimension-dependent.

Original: For instance, it was shown that theexcess empirical risk bound Θ( G ∥K∥ 2 (cid:112)
Revised: For instance, it was shown thatthe excess empirical risk bound Θ( GD (cid:112)

Original: d log(1 /δ )
Revised: d log(1 /δ )

Original: n − 1 ε − 1 ) and excess population risk boundΘ( G ∥K∥ 2 ( n − 1 / 2 + (cid:

Revised: n − 1 ε − 1 ) and excess population risk boundΘ( GD ( n − 1 / 2 + (cid:

Original: ) d log(1 /δ )
Revised: ) d log(1 /δ )

Original: n − 1 ε − 1 )) are tight when privately optimizing convex G -Lipschitzobjectives in a convex domain of diameter [-∥K∥ 
 [BST14].-]
Revised: n − 1 ε − 1 )) are tight when privately optimizing convex G -Lipschitzobjectives in a convex domain of diameter [-∥K∥ 
 [BST14].-]D [BST14a].

Original: However, recent empirical findings in large-scale language model fine-tuning demonstrated that verylarge models can be optimized with DP-SGD to achieve performance approaching non-private models [LTLH21, YNB + 21].
Revised: However, recent empirical ﬁndings in large-scale language model ﬁne-tuning demonstrated thatvery large models can be optimized with DP-SGD to achieve performance approaching non-privatemodels [LTLH21, YNB + 21].

Original: Moreover, fine-tuning more parameters (and hence injecting more noise)does not necessarily hurt private fine-tuning performance [LTLH21].
Revised: Moreover, ﬁne-tuning more parameters (and hence injecting morenoise during training) does not necessarily hurt private ﬁne-tuning performance [LTLH21].

Original: These empirical observationssuggested that the error of learning does not degrade substantially (or sometimes negligibly) with theincrease in problem dimension, pointing towards a seeming conflict between theory and practice.
Revised: Theseempirical observations suggest that the error of learning does not degrade substantially (or sometimesnegligibly) with the increase in problem dimension, pointing towards a seeming conﬂict betweentheory and practice.

Original: In the following, we set out to reconcile this discrepancy.
Revised: In the following, we set out to reconcile this discrepancy.

Original: In particular, Section 3 shows that bettererror dimension-dependence can be achieved for private convex optimization if the objective satisfiesadditional regularity conditions in addition to Lipschitz continuity.
Revised: In particular, Section 3 shows that bettererror dimension-dependence can be achieved for private convex optimization if the objective satisﬁesadditional regularity conditions in addition to Lipschitz continuity.

Original: Section 4 verifies our theory andpresents initial evidence that private language model fine-tuning exhibits the type of regularity thatleads to dimension-independent bounds in our theoretical results.
Revised: Section 4 veriﬁes our theory andpresents initial evidence that private language model ﬁne-tuning exhibits the type of regularity thatleads to dimension-independent bounds in our theoretical results.

Original:  Refined Dimension-Dependence via Restricted Lipschitz Continuity
Revised:  Reﬁned Dimension-Dependence Through Restricted Lipschitz Continuity

Original: In this section, we formally introduce the restricted Lipschitz continuity condition and derive improvedbounds for the excess empirical and population risks for DP-SGD when optimizing convex objectives.
Revised: In this section, we formally introduce the restricted Lipschitz continuity condition and derive improvedbounds for the excess empirical and population risks for DP convex optimization.

Original: Definition 3.1 (Restricted Lipschitz Continuity) .
Revised: Deﬁnition 3.1 (Restricted Lipschitz Continuity) .

Original: We say that the loss function h : K
Revised: We say that the loss function h : K

Original: → R isrestricted Lipschitz continuous with coefficients G 0 , . .
Revised: → R isrestricted Lipschitz continuous with coefﬁcients G 0 , . .

Original: . , G d , if for all k ∈ [ d ] , there exists anorthogonal projection matrix P k with rank k such that
Revised: . , G d , if for all k ∈ [ d ] , there exists anorthogonal projection matrix P k with rank k such that

Original: [Equation]
Revised: [Equation]

Original: for all x ∈ K and all subgradients ∇ h ( x ) ∈ ∂h ( x ) .
Revised: for all x ∈ K and all subgradients ∇ h ( x ) ∈ ∂h ( x ) .

Original: Note that any G -Lipschitz function is also trivially restricted Lipschitz continuous with coefficients
Revised: Note that any G -Lipschitz function is also trivially restricted Lipschitz continuous with coefﬁcients

Original: G = G 0 =
Revised: G = G 0 =

Original: G 1 = · · · = G d , since orthogonal projections never increase the ℓ 2 -norm of a vector(generally, it is easy to see that G = G 0 ≥ G 1 ≥ G 2 ≥ · · · ≥ G d = 0 ).
Revised: G 1 = · · · = G d , since orthogonal projections never increase the (cid:96) 2 -norm of a vector(generally, it is easy to see that G = G 0 ≥ G 1 ≥ G 2 ≥ · · · ≥ G d = 0 ).

Original: On the other hand, weexpect that a function which exhibits little growth in subspaces of dimension k to have a restricted
Revised: On the other hand, weexpect that a function which exhibits little growth in subspaces of dimension k to have a restricted

Original: Lipschitz coefficient G d − k of almost 0.
Revised: Lipschitz coefﬁcient G d − k of almost 0.

Original: Our bounds on DP convex optimization will characterize errors through the use of restricted Lipschitzcoefficients.
Revised: Our bounds on DP convex optimization will characterize errors through the use of restricted Lipschitzcoefﬁcients.

Original: We now summarize the main assumptions before presenting the core theoretical results.
Revised: We now summarize the main assumptions before presenting the core theoretical results.

Original: Assumption 3.2.
Revised: Assumption 3.2.

Original: The per-example loss function f ( · ; s ) is convex and G -Lipschitz continuous for alls ∈S .
Revised: The per-example loss function f ( · ; s ) is convex and G -Lipschitz continuous for alls ∈

Original: The average loss F ( · ; D ) is restricted Lipschitz continuous with coefficients { G k } d k =1 .

Original: 3.1 Bounds for Excess Empirical Loss
Revised: 3.1 Bounds for Excess Empirical Loss

Original: We present the main theoretical result on DP-ERM for convex objectives.
Revised: We present the main theoretical result on DP-ERM for convex objectives.

Original: The result consists of twopieces: Equation (1) is a general bound that is applicable to any sequence of restricted Lipschitz coefficients; Equation (2) specializes the previous bound  when the sequence of coefficients decaysrapidly and demonstrates dimension-independent error scaling. 
Revised: The result consists of twopieces. (1) is a general bound that is applicable to any sequence of restricted Lipschitz coefﬁcients. (2)specializes the previous bound to when the sequence of coefﬁcients decays rapidly and demonstratesdimension-independent error scaling. To simplify notation in the following theorems, we let G m :=

Revised: 0for all integer m > d .

Original: Theorem 3.3 (Excess Empirical Loss) .
Revised: Theorem 3.3 (Excess Empirical Loss) .

Original: Let δ ∈ (0 , 12 ], and ε ∈ (0 , 10] .
Revised: Let δ ∈ (0 , 12 ] and ε ∈ (0 , 10] .

Original: Under Assumption 3.2, forany positive integer k∈ [ d ] , setting T =
Revised: Under Assumption 3.2, forany non-negative integer k , setting T =

Original: Θ( n 2 + dlog 2 d ) , σ = Θ
Revised: Θ( n 2 + d

Original: [Equation]
Revised: [Equation]

Original: , η

Original: [Equation]
Revised: [Equation]

Original: D
Revised: (cid:18)

Original: [Equation]
Revised: [Equation]

Original: and α = 1 D (cid:113)(cid:80) Ss =1 s 2 2 s G 22 s − 1 k ,where S = ⌊ log( d/k ) ⌋ + 1 , DP-SGD (Algorithm 1) is ( ε, δ ) -DP,and
Revised: and α = 1 D (cid:113)(cid:80) s s 2 2 s G 22 s − 1 k , DP-SGD (Algorithm 1) is ( ε, δ ) -DP, and E

Original: [Equation]
Revised: [Equation]

Original: G
Revised: F

Original: [Equation]
Revised: [Equation]

Original: where ∥ x (0) −argmin x F ( x ; D ) ∥ 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and theexpectation is over the randomness of x .
Revised: where (cid:107) x (0) − x ∗ (cid:107) 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and the expectation isover the randomness of x .

Original: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k− c forall k ∈ [ d ] ,and in addition n ≥ ε − 1 (cid:112) log(1 /δ ) , minimizing the right hand side of (1) with respectto k yields
Revised: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k c for all k ∈ [ d ] , minimizing the right hand side of(1) with respect to k yields

Original: [Equation]
Revised: [Equation]

Original: We include a sketch of the  proof techniques in Section 3.3 and defer the full proof to Appendix A.
Revised: We include a sketch of the main proof techniques in Section 3.3 and defer the full proof to Appendix A.

Original: Remark 3.4 .
Revised: Remark 3.4 .

Original: Consider DP-ERM for learning generalized linear models with convexand Lipschitz losses.
Revised: Consider DP-ERM for learning generalized linear models with convex losses.

Original: When the (empirical) data covariance is of rank r < d , the span of gradientsspan ( {∇ x F ( x ) } ) is also of rank r .
Revised: When the(empirical) data covariance is of rank r < d , the span of gradients span ( {∇ x F ( x ) } ) is also of rank r .

Original: Thus, the average loss is restricted Lipschitz continuous withcoefficients where G r ′ = 

Revised: Thus, the average loss is restricted Lipschitz continuous with coefﬁcients where G r (cid:48) =

Original: for all r ′ > r .
Revised: for all r (cid:48) > r .

Original: Setting k = r in (1) yields the excess empirical riskbound of order O (cid:16) G 0 D (cid:112) r · log(1 /δ )
Revised: Setting k = r in (1) yields a excess empirical risk bound of order O (cid:16) G 0 D (cid:112) r · log(1 /δ )

Original: ε − 1 n − 1 (cid:17) .
Revised: ε − 1 n − 1 (cid:17) .

Original: This recovers the previous dimension-independentresult [SSTT21].
Revised: This recovers a previous dimension-independent result up to constants [SSTT21].

Original: The restricted Lipschitz continuity condition can be viewed as a generalized notion of rank.
Revised: The restricted Lipschitz continuity condition can be viewed as a generalized notion of rank.

Original: Theresult captured in (2) suggests that the empirical loss achieved by DP-SGD does not depend on theproblem dimension if the sequence of restricted Lipschitz coefficients decays rapidly.
Revised: Theresult captured in (2) suggests that the empirical loss achieved by DP-SGD does not depend on theproblem dimension if the sequence of restricted Lipschitz coefﬁcients decays rapidly.

Original: We leveragethese insights to build intuition for understanding private fine-tuning of language model in Section 4.
Revised: We leveragethese insights to build intuition for understanding private ﬁne-tuning of language model in Section 4.

Original: 3.2 Bounds for Excess Population Loss
Revised: 3.2 Bounds for Excess Population Loss

Original: For DP-SCO, we make use of the stability of DP-SGD to bound its generalization error [BE02],following previous works [BFTT19, BFGT20, SSTT21].
Revised: For DP-SCO, we make use of the stability of DP-SGD to bound its generalization error [BE02],following previous works [BFTT19, BFGT20, SSTT21].

Original: The bound on the excess population lossfollows from combining the bounds on the excess empirical risk and the generalization error.
Revised: The bound on the excess population lossfollows from combining the bounds on the excess empirical risk and the generalization error.

Original: Theorem 3.5 (Excess Population Loss) .
Revised: Theorem 3.5 (Excess Population Loss) .

Original: Let δ ∈ (0 , 12 ] ,and ε ∈ (0 , 10] .
Revised: Let δ ∈ (0 , 12 ] , ε ∈ (0 , 10] .

Original: Under Assumption 3.2,for any positive integer k∈ [ d ] , by setting T = Θ( n 2 + d log 2 d ) , σ = Θ (cid:18) √ T log(1 /δ ) nε (cid:19) ,η = (cid:113)
Revised: Under Assumption 3.2,for any non-negative integer k , by setting T = Θ( n 2 + d log 2 d ) , σ = Θ (cid:18) √ T log(1 /δ ) nε (cid:19) ,η = (cid:113)

Original: D 2 T · G20 ( T/n + kσ 2 ) and α = 1 D (cid:113)(cid:80)
Revised: D 2 T · G

Original: [-Ss =1 s 2 
-]
Revised: [-Ss =1 s 2 
-][Equation]

Original: s G 22 s − 1 k , where S =
Revised: ( T

Original: ⌊ log( d/k ) ⌋ + 1 , DP-SGD(Algorithm 1) is ( ε, δ )-DP, and 
Revised: [Equation] n + kσ 2 ) and α =

Original: [Equation]
Revised: [Equation]

Original: G
Revised: G

Original: [Equation]
Revised: [Equation]

Original:  ,  where ∥ x (0) −argmin x F ( x ; P ) ∥ 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), andthe expectation is over the randomness of x .
Revised: D , DP-SGD (Algorithm 1) is ( ε, δ ) -DP, and [Equation] where (cid:107) x (0) − x ∗ (cid:107) 2 ≤ D , x is the (random) output of DP-SGD (Algorithm 1), and the expectation isover the randomness of x .

Original: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k− c for all k ∈ [ d ] ,and in addition n >ε − 1 (cid:112) log(1 /δ ) , minimizingthe above bound with respect to k yields
Revised: Moreover, if for some c > 1 / 2 , we have G k ≤ G 0 k c for all k ∈ [ d ] , minimizing with respect to k yields

Original: [Equation]
Revised: [Equation]

Revised: We refer the reader to Appendix B for the full proof.

Original: Remark 3.6 .
Revised: Remark 3.6 .

Original: Our result on DP-SCO also recovers the DP-SCO rank-dependent result for learninggeneralized linear models with convexand Lipschitz losses [SSTT21].
Revised: Our result on DP-SCO also recovers the DP-SCO rank-dependent result for learninggeneralized linear models with convex losses [SSTT21].

Original: Remark 3.7 .
Revised: Remark 3.7 .

Original: When c > 1 / 2 , ε = Θ(1) and δ = 1 / poly( n ) , the population loss matches the(non-private) informational-theoretical lower bound Ω( G 0 D/ √ n ) [AWBR09].
Revised: When c > 1 / 2 , ε = Θ(1) and δ = 1 / poly( n ) , the population loss matches the(non-private) informational-theoretical lower bound Ω( G 0 D/ √ n ) [AWBR09].

Original: Remark 3.8 .

Original: Our results on DP-ERM and DP-SCO naturally generalize to (full-batch) DP-GD.

Original: 3.3 Overview of Proof Techniques
Revised: 3.3 Overview of Proof Techniques

Original: The privacy guarantees in Theorems 3.3 and 3.5 follow  from Lemma 2.4.
Revised: The privacy guarantees in Theorems 3.3 and 3.5 follow directly from Lemma 2.4.

Original: It suffices to prove the utilityguarantees.
Revised: It sufﬁces to provethe utility guarantees.

Original: We give an outline of the main proof technique and defer full proofs to the supplementary.
Revised: We give an outline of the main proof techniques and defer full proofs to thesupplementary material.

Original: The following is a  sketchof the core technique forderiving (2) in Theorem 3.3.
Revised: The following is a proof sketch for Theorem 3.3.

Original: By convexity, the error term of SGD is upper bounded as follows
Revised: By convexity, the error term of SGD is upper bounded as follows

Original: [Equation]
Revised: [Equation]

Original: where j ∈ [ n ] is the random index sampled at iteration t .
Revised: where j ∈ [ n ] is the random index sampled at iteration t .

Original: By definition of G k , we know that there is ak dimensional subspace U such that the gradient component orthogonal to U is small when G k issmall.
Revised: By deﬁnition of G k , we know that there is ak dimensional subspace U such that the gradient is small orthogonal to U .

Original: Naïvely, one decomposes the gradient ∇ f j ( x ( t ) )
Revised: Naively, one decomposesthe gradient ∇ f j ( x ( t ) )

Original: =
Revised: =

Original: g 1 + g 2 , where g 1 ∈ U and g 2 ∈
Revised: g 1 + g 2 , where g 1 ∈ U and g 2 ∈

Original: U ⊥, andseparately bounds the two terms g ⊤ 1 ( x ( t ) − x ∗ ) and g ⊤ 2 ( x ( t ) − x ∗ ) .
Revised: U ⊥ .

Original: Since g 1 lies in a k dimensionalsubspace, one can follow existing arguments on DP-SGD to bound g ⊤ 1{+(cid:62) 
+} ( x ( t ) − x ∗ ) .
Revised: Since g 1 lies in a k dimensionalsubspace, we can follow existing arguments on DP-SGD to bound g {+(cid:62) 
+} ( x ( t ) − x ∗ ) .

Original: Unfortunately,this argument does not lead to dimension-independence.
Revised: Unfortunately, thisargument does not give a dimension-independent bound.

Original: Although ∥ g 2 ∥ 2 ≤ G k (which can be smallfor large k ), the term ∥ x ( t ) − x ∗ ∥ 2 can be as large as Ω( √ d ) with high probability due to the isotropic
Revised: Although (cid:107) g 2 (cid:107) 2 ≤ G k (which can be smallfor large k ), the term (cid:107) x ( t ) − x ∗ (cid:107) 2 is as large as Ω( √ d ) with high probability due to the isotropic

Original: Gaussian noise injected in DP-SGD.
Revised: Gaussian noise we add in DP-SGD.

Original: Therefore,the naïve upper bound on | g ⊤ 2 ( x ( t ) − x ) | can be aslarge O ( √ dG k ) .
Revised: Therefore, | g (cid:62) 2 ( x ( t ) − x ) | can be as large Ω( √ dG k ) .

Revised: One natural way to derive a good bound on (cid:107) x ( t ) − x ∗ (cid:107) 2 is through projection.

Revised: However, previouslower bounds in constrained optimization already suggest that DP projected-SGD cannot evade thecurse of dimensionality [BST14b], since projections tend to destroy the low-rank structure.

Original: Our key idea is to partition the whole space R d into ⌊ log( d/k ) ⌋ + 2 orthogonal subspaces, expressingthe error term ∇ f j ( x ( t ) )
Revised: Our crucial idea is to partition the whole space R d into (cid:100) log( d/k ) (cid:101) +1 different orthogonal sub-spaces,expressing the error term ∇ f j ( x ( t ) )

Original: ⊤ ( x ( t ) − x ∗ ) as the sum ofindividual terms  each of which corresponds toa projection to aparticular subspace.
Revised: (cid:62) ( x ( t ) − x ∗ ) as the sum of terms where each term correspondsto a subspace.

Original: Fixthe positive integer k ≤ d  , and consider the followingsubspaces: Let U 

Revised: Fix k ∈ [ d ] , and consider the following subspaces: Let U

Original: =
Revised: =

Original: range ( P k ) , U s [-be the subspace orthogonal to all previous subspaces suchthat (cid:76) si =
 U i ⊇ range-] ( P 2 s k )  for s = 1 , 2 , · · · , ⌊ log( d/k ) ⌋ , and U S [-be the subspace such that theorthogonal direct sum of all subspaces { U i } Si =
-]
Revised: range ( P k ) , U s [-be the subspace orthogonal to all previous subspaces suchthat (cid:76) si =
 U i ⊇ range-]=range ( P 2 s k ) \ U s − 1 for s = 1 , 2 , · · · , (cid:98) log( d/k ) (cid:99) , and U S [-be the subspace such that theorthogonal direct sum of all subspaces { U i } Si =
-]=

Original: is R d  where S = ⌊ log( d/k ) ⌋ + 1 .
Revised: R d \ U S − 1 where S = (cid:98) log( d/k ) (cid:99) + 1 .

Original: Here, P i isthe orthogonal projection matrix with rank i promised by G i in Assumption 3.2.
Revised: Here, P i is the orthogonal projection matrix with rank i promised by G i in Assumption 3.2.

Original: Let Q s be theorthogonal projection to the subspace U s . Observe that rank( Q s ) ≤ 2 s k and ∥ Q s ∇ F ( x ) ∥ 2 ≤
Revised: Let Q s bethe orthogonal projection to the subspace U s , and observe that rank( Q s ) ≤ 2 s k and (cid:107) Q s ∇ F ( x ) (cid:107) 2 ≤

Original: G 2 s − 1 k for all x and all s ≥ 1 .
Revised: G 2 s − 1 k for all x and all s ≥ 1 .

Original: Rewriting the right hand side of (3) with this decomposition yields
Revised: Rewriting the right hand side of (3) with this decomposition yields

Original: [Equation]
Revised: [Equation]

Original: On the one hand, if G k decays rapidly, ∥ E j [ Q s ∇ f j ] ∥ 2 will be small for large s .
Revised: On the one hand, if G k decays quickly, (cid:107) E j [ Q s ∇ f j ] (cid:107) 2 will be small for large s .

Original: On the other hand,we expect ∥ Q s ( x ( t ) − x ∗ ) ∥ 2 to be small for small s where Q s is an orthogonal projection onto asmall subspace.
Revised: On the other hand,since the noise in DP-SGD is isotropic, we expect (cid:107) Q s ( x ( t ) − x ∗ ) (cid:107) 2 to be small for small s where Q s is an orthogonal projection onto a small subspace.

Original: Thus, for each s , ∇ f j ( x ( t ) ) ⊤ Q s ( x ( t ) − x ∗ ) is small either due to a small gradient(small Q s ∇ f j in expectation overthe random index) or small noise (small Q s ( x ( t ) − x ∗ ) ), sincenoise injected in DP-SGD is isotropic.
Revised: Thus, for each s , ∇ f j ( x ( t ) ) (cid:62) Q s ( x ( t ) − x ∗ ) issmall either due to a small gradient (small Q s ∇ f j in expectation over random index) or small noise(small Q s ( x ( t ) − x ∗ ) ).

Original: More formally, in Lemma A.1, we show that for any projectionmatrix Q with rank r , ∥ Q ( x ( t ) − x (0) )
Revised: More formally, in Lemma A.1, we show that for any projection matrix Q withrank r , (cid:107) Q ( x ( t ) − x (0) )

Original: ∥ 2 can be upper bounded by a term that depends only on r(rather than d ).
Revised: (cid:107) 2 can be upper bounded by a term that depends only on r (rather than d ).

Original:  Numerical Experiments
Revised:  Numerical Experiments

Original: The aim of this section is twofold.
Revised: The aim of this section is twofold.

Original: In Section 4.1, we study a synthetic example that matchesour theoretical assumptions and show that DP-SGD attains dimension-independent empirical andpopulation losses when the sequence of restricted Lipschitz coefficients decays rapidly—even whengradients span the entire ambient space.
Revised: In Section 4.1, we study a synthetic example that matchesour theoretical assumptions and show that DP-SGD attains dimension-independent empirical andpopulation loss when the sequence of restricted Lipschitz coefﬁcients decays rapidly—even whengradients span the entire ambient space.

Original: In Section 4.2, we study a stylized example of privatelyfine-tuning large language models.
Revised: In Section 4.2, we study a stylized example of privatelyﬁne-tuning large language models.

Original: Building on the previous theory, we provide insights as to whyfine-tuning tens of millions of parameters can yield good performance.
Revised: Building on the previous theory, we provide insights as to whydense ﬁne-tuning can yield good performance.

Original: 4.1 Synthetic Example: Estimating the Generalized Geometric Median
Revised: 4.1 Synthetic Example: Estimating the Generalized Geometric Median

Original: We privately estimate the geometric median which minimizes the average Mahalanobis distance.
Revised: We privately estimate the geometric median which minimizes the average Mahalanobis distance.

Original: Specifically, let x i ∈ R d for i ∈ [ n ] be feature vectors drawn i.i.d.
Revised: Speciﬁcally, let x i ∈ R d for i ∈ [ n ] be feature vectors drawn i.i.d.

Original: from some distribution P x , each
Revised: from some distribution P x , each

Original: [Figure]
Revised: [Figure]

Original: of which is treated as an individual record.
Revised: of which is treated as an individual record.

Original: Denote the entire dataset as D = { x i } ni =1 .
Revised: Denote the entire dataset as D = { x i } ni =1 .

Original: Subject todifferential privacy, we perform the following optimization
Revised: Subject todifferential privacy, we perform the following optimization

Original: [Equation]
Revised: [Equation]

Original: where we adopt the shorthand
Revised: where we adopt the shorthand

Original: f i ( x ) =
Revised: f i ( x ) =

Original: f
Revised: f

Original: ( x ; x i ) =
Revised: ( x ; x i ) =

Original: ∥ x − x i ∥ A .
Revised: (cid:107) x − x i (cid:107) A .

Original: When A = I d [-and α = 
 (withoutthe regularization term),-] the problem reduces to estimating the usual geometric median (commonlyknown as center of mass).
Revised: When A = I d [-and α = 
 (withoutthe regularization term),-], the problem reducesto estimating the usual geometric median (commonly known as center of mass).

Original: For this example, individual gradients are bounded since ∥∇ f i ( x ) ∥ 2 = ∥{+(cid:107) 
+}
Revised: For this example, individual gradients are bounded since (cid:107)∇ f i ( x ) {+(cid:107) 
+}

Original:  A ( x − x i ) / ∥ x − x i ∥ A ∥ 2 ≤λ 1 ( A 1 / 2 ) =
Revised: = (cid:107) A ( x − x i ) / (cid:107) x − x i (cid:107) A (cid:107) 2 ≤λ 1 ( A 1 / 2 ) =

Original: G 0 .
Revised: G 0 .

Original: More generally, the restricted Lipschitz coefficients of F ( x ) are the eigenvalues of
Revised: More generally, the restricted Lipschitz constants of F ( x ) are the eigenvalues of

Original: A 1 / 2 , since
Revised: A 1 / 2 , since

Original: [Equation]
Revised: [Equation]

Original: where Q k =
Revised: where Q k =

Original: I − P k is chosen to be the rank ( d − k ) orthogonal projection matrix that projects ontothe subspace spanned by the bottom ( d − k ) eigenvectors of A 1 / 2 .
Revised: I − P k is chosen to be the rank ( d − k ) orthogonal projection matrix that projects ontothe subspace spanned by the bottom ( d − k ) eigenvectors of A 1 / 2 .

Original: To verify our theory, we study the optimization and generalization performance of DP-SGD forminimizing (4) under Mahalanobis distances induced by different A as the problem dimensiongrows.
Revised: To verify our theory, we study the optimization and generalization performance of DP-SGD forminimizing (4) under Mahalanobis distances induced by different A as the problem dimensiongrows.

Original: The optimization performance is measured by the final training error, and the generalizationperformance is measured by the population quantity E x ∼ P x ,x [ ∥ x − x ∥ A ] , where x denotes the randomoutput of DP-SGD.
Revised: The optimization performance is measured by the ﬁnal training error, and the generalizationperformance is measured by the population quantity E x ∼ P x ,x [ (cid:107) x − x (cid:107) A ] , where x denotes the randomoutput of DP-SGD.

Original: We study the dimension scaling behavior for A being one of
Revised: We study the dimension scaling behavior for A being one of

Original: A const = diag (1 , . . . , 1) , A sqrt = diag (1 , 1 / √ 2 , . . . , 1 / √ d ) , A linear = diag (1 , 1 / 2 , . . .
Revised: [Equation]

Original: , 1 /d ) , where diag : R d → R d × d maps vectors onto square matrices with inputs on the diagonal.
Revised: where diag : R d → R d × d maps vectors onto square matrices with inputs on the diagonal.

Original: In all cases,the span of gradients span ( {∇ F ( x ) } ) is the ambient space R d , since A is of full rank.
Revised: In all cases,the span of gradients span ( {∇ F ( x ) } ) is the ambient space R d , since A is of full rank.

Original: To ensure thedistance from the initial iterate β (0) = [-
-] to the optimum is the same for problem instances of differentdimensions, we let feature vectors { x i } ni =1 take zero values in any dimension k > d min , where d minis the dimension of the smallest problem in our experiments.
Revised: To ensurethe distance from the initial iterate β (0) = [-
-]0 to the optimum is the same for problem instances ofdifferent dimensions, we let feature vectors { x i } ni =1 take zero values in any dimension k > d min ,where d min is the dimension of the smallest problem in our experiments.

Original: Our theoretical bounds suggest thatwhen the sequence of restricted Lipschitz coefficients is constant (when A = A const ), the excessempirical loss grows with the problem dimension, whereas when the sequence of restricted Lipschitzcoefficients rapidly decays with k (when A =
Revised: Our theoretical boundssuggest that when the sequence of restricted Lipschitz coefﬁcients is constant (when A = A const ), theexcess empirical loss grows with the problem dimension, whereas when the sequence of k th-Lipschitzconstants rapidly decays with k (when A =

Original: A sqrt or A =
Revised: A sqrt or A =

Original: A linear )
Revised: A linear )

Original: , the excess empirical loss doesnot grow beyond a certain problem dimension.
Revised: , the excess empirical loss doesnot grow beyond a certain problem dimension.

Original: Figure 1 empirically captures this phenomenon.
Revised: Figure 1 empirically captures this phenomenon.

Original: Weinclude additional experimental setup details in Appendix C.
Revised: Weinclude additional experimental setup details in Appendix C.

Original: 4.2 Why Does Dense Fine-Tuning Work Well for Pretrained Language Models?
Revised: 4.2 Why Does Dense Fine-Tuning Work Well for Pretrained Language Models?

Original: Stated informally, our bounds in Theorem 3.5 imply that DP-SGD obtains dimension-independenterrors if gradients (mostly) reside in a subspace much smaller than the ambient space.
Revised: Stated informally, our bounds in Theorem 3.5 imply that DP-SGD obtains dimension-independenterrors if gradients (mostly) reside in a subspace much smaller than the ambient space.

Original: Inspired bythese results for the convex case, we now turn to study dense language model fine-tuning [LTLH21]and provide a possible explanation for their recent intriguing success — fine-tuning gigantic parametervectors frequently results in moderate performance drops compared to non-private learning.
Revised: Inspired bythese results for the convex case, we now turn to study dense language model ﬁne-tuning [LTLH21]and provide a possible explanation for their recent intriguing success — ﬁne-tuning gigantic parametervectors frequently results in moderate performance drops compared to non-private learning.

Original: In the following, we present initial evidence that gradients of the fine-tuning objective evaluated nearan (approximate) local optimum mostly lie in a small subspace.
Revised: In the following, we present initial evidence that gradients of the ﬁne-tuning objective evaluated nearan (approximate) local optimum mostly lie in a small subspace.

Original: We design subsequent experiments towork under a simplified setup.
Revised: We design subsequent experiments towork under a simpliﬁed setup.

Original: Specifically, we fine-tune DistilRoBERTa
Revised: Speciﬁcally, we ﬁne-tune DistilRoBERTa

Original: [SDCW19, LOG + 19] underε = 8 and δ = 1 / n 1 . 1 for sentiment classification on the SST-2 dataset [SPW + 13].
Revised: [SDCW19, LOG + 19] underε = 8 and δ = 1 / n 1 . 1 for sentiment classiﬁcation on the SST-2 dataset [SPW + 13].

Original: We reformulatethe label prediction problem as templated text prediction [LTLH21], and fine-tune only the query andvalue matrices in attention layers.
Revised: We reformulatethe label prediction problem as templated text prediction [LTLH21], and ﬁne-tune only the query andvalue matrices in attention layers.

Original: We focus on fine-tuning these specific parameter matrices inspired by the success of LoRA fornon-private fine-tuning [HSW + 21] which adapted the attention layers.
Revised: We focus on ﬁne-tuning these speciﬁc parameter matrices due to the success of LoRA for non-privatelearning [HSW + 21] which focuses on adapting the attention layers.

Original: Unlike LoRA, we fine-tuneall parameters in these matrices rather than applying low-rank updates.
Revised: Unlike LoRA, we ﬁne-tune allparameters in these matrices rather than focusing on low-rank updates.

Original: This gives a setup that islightweight enough to run spectral analyses computationally tractably but retains enough parameters( ≈ 7 million) such that a problem of similar scale outside of fine-tuning results in substantial losses inutility.
Revised: This gives a setup that islightweight enough to run spectral analyses computationally tractably but retains enough parameters( ≈ 7 million) such that a problem of similar scale outside of ﬁne-tuning results in substantial losses inutility.

Original: 1 For our setup, DP-SGD obtains a dev set accuracy approximately of 90% and 92% , privatelyand non-privately, respectively.
Revised: 1 For our setup, DP-SGD obtains a dev set accuracy approximately of 90% and 92% , privatelyand non-privately, respectively.

Original: These numbers are similar to previous results obtained with the samepretrained model [YNB + 21, LTLH21].
Revised: These numbers are similar to previous results obtained with the samepretrained model [YNB + 21, LTLH21].

Original: We include the full experimental protocol and additionalresults in Appendix D.
Revised: We include the full experimental protocol and additionalresults in Appendix D.

Original: To provide evidence for the small subspace hypothesis, we sample gradients along the optimizationtrajectory and study their principal components.
Revised: To provide evidence for the small subspace hypothesis, we sample gradients near a local optimumand study their principal components.

Original: Specifically, we “over-train” by privately finetuning for r = 2 × 10 3 updates and collect all the non-privatized average clipped gradients alongthe optimization trajectory.
Revised: Speciﬁcally, we “over-train” by privately ﬁne-tuning forr = 2 × 10 3 updates and collect all the non-privatized average clipped gradients along the optimizationtrajectory.

Original: While fine-tuning for 200 and 2k updates have similar final dev setperformance under our hyperparameters, the increased number of steps allows us to collect moregradients around the converged solution.
Revised: While ﬁne-tuning for 200 and 2k updates have similar ﬁnal dev set performance underour hyperparameters, the increased number of steps allows us to collect more gradients around theconverged solution.

Original: This yields a gradient matrix H ∈ R r × p , where p ≈7 × 10 6 is the size of the parameter vector.
Revised: This yields a gradient matrix H ∈ R r × p , where p ≈ 7 × 10 6 is the size of theparameter vector.

Original: We perform PCA for H with the orthogonal iterationalgorithm [Dem97] and visualize the set of estimated singular values σ i ( H )
Revised: We perform PCA for H with the orthogonal iteration algorithm [Dem97] andvisualize the set of estimated singular values σ i ( H )

Original: =
Revised: =

Original: λ
Revised: λ

Original: i ( H ⊤ H ) 1 / 2 interms of both (i) the density estimate, and (ii) their relation with the rank.
Revised: i ( H (cid:62) H ) 1 / 2 in terms of both (i) the densityestimate, and (ii) their relation with the rank.

Original: Figure 2 (a) shows the top1000 singular values sorted and plotted against their rank and the least squares fit on log-transformedinputs and outputs.
Revised: Figure 2 (a) shows the top 1000 singular values sortedand plotted against their rank and the least squares ﬁt on log-transformed inputs and outputs.

Original: The plot displays few large singular values which suggests that gradients arecontrolled through only few principal directions.
Revised: Theplot displays few large singular values which suggests that gradients are controlled through only fewprincipal directions.

Original: The linear fit suggests that singular values decayrapidly (at a rate of k − 0 . 6 ).
Revised: The linear ﬁt suggests that singular values decay rapidly (at a rate of k − 0 . 6 ).

Original: To study the effects that different principal components have on fine-tuning performance, we furtherperform the following re-training experiment.
Revised: To study the effects that different principal components have on ﬁne-tuning performance, we furtherperform the following re-training experiment.

Original: Given the principal components, we privately re-finetune with gradients projected onto the top k ∈ { 10 , 20 , 100 } components.
Revised: Given the principal components, we privately re-ﬁnetune with gradients projected onto the top k ∈ { 10 , 20 , 100 } components.

Original: Note that this projectionapplies only to the (non-privatized) average clipped gradients — isotropic DP noise is still appliedto all dimensions.
Revised: Note that this projectionapplies only to the (non-privatized) average clipped gradients and the isotropic DP noise is stillapplied to all dimensions.

Original: Figure 2 (b) shows that the original performance can be recovered by optimizingwithin a subspace of only  k = 100 dimensions, suggesting that most of the dimensions of the 7million parameter exhibit little variance and encode  limited learning signal.
Revised: Figure 2 (b) shows that the original performance can be attained byoptimizing within a subspace of only dimension k = 100 , suggesting that most of the dimensions ofthe 7 million parameter vector encode a limited learning signal.

Original: While these empirical results present encouraging insights for the (near) dimension-independentperformance of fine-tuning, we acknowledge that this is not a complete validation of the restricted Lipschitz continuity condition and fast decay of coefficients (even locally near the optimum).
Revised: While these empirical results present encouraging insights for the dimension-independent performanceof ﬁne-tuning, we acknowledge that this is not a complete validation of the restricted Lipschitzcontinuity condition and fast decay of coefﬁcients (even locally near the optimum).

Original: Weleave a more thorough analysis with additional model classes and fine-tuning tasks to future work.
Revised: We leave a morethorough analysis with additional model classes and ﬁne-tuning tasks to future work.

Original:  Related Work
Revised:  Related Work

Original: DP-ERM and its close cousin DP-SCO are arguably the most well-studied areas of differential privacy [CMS11, KST12, BST14, SCS13, WYX17, FTS17, BFTT19, MRTZ17, ZZMW17, WLK + 17 ,
Revised: Differentially private empirical risk minimization (DP-ERM) and its close cousin differentiallyis private stochastic convex optimization (DP-SCO) are arguably the most well-studied areas of DP [CMS11, KST12, BST14a, SCS13, WYX17, FTS17, BFTT19, MRTZ17, ZZMW17, WLK + 17,

Original: FKT20, INS + 19, BFGT20, STT20, LL21, AFKT21, BGN21, GTU22, GLL22].
Revised: FKT20 , INS + 19, BFGT20, STT20, LL21, AFKT21, BGN21, GTU22, GLL22].

Original: Tight dependenceon the number of model parameters and the number of data samples are known for both DP-
Revised: Tight dependenceon the number of model parameters and the number of data samples are known for both DPERM

Original: [Figure] ERM [BST14] and DP-SCO  [BFTT19].
Revised: [BST14a] and DP-SCO errors [BFTT19].

Original: In particular, it is known that for the error on general convexlosses, an explicit polynomial dependence on the number of parameters in the model is necessary.
Revised: In particular, it is known that for the error on general [Figure] convex losses, an explicit polynomial dependence on the number of parameters in the model (i.e. d )is necessary.

Original: However, [JT14, STT20] showed that if all the gradients of the underlying loss function lie in a fixedlow-rank subspace M , the dependence ondimension d can be replaced by rank ( M ) (which can besignificantly smaller).
Revised: However, [JT14, STT20] showed that if all the gradients of the underlying loss functionlie in a ﬁxed low-rank subspace M , the dependence on d can be replaced by rank ( M ) (which can besigniﬁcantly smaller).

Original: We extend this line of work to show that under a weaker assumption (restricted Lipschitz continuity with decaying coefficients) one can obtain analogous error guarantees that areindependent of any explicit dependence on d , but do not require the gradients of the loss to strictlylie in any fixed low-rank subspace M .
Revised: We extend this line of work to show that under a weaker assumption calledrestricted Lipschitz continuity (mentioned earlier) one can obtain analogous error guarantees that areindependent of any explicit dependence on d , but do not require the gradients of the loss to strictlylie in any ﬁxed low-rank subspace M .

Original: As a consequence, we use our results to provide a plausibleexplanation why in recent empirical works it has been observed that dense fine-tuning can be effectiveand that fine-tuning a larger model under DP is at times more advantageous in terms of utility thanfine-tuning a smaller model [LTLH21, YNB + 21].
Revised: As a consequence, we use our results to provide a plausibleexplanation why in recent empirical works it has been observed that training a larger model under DPis at times more advantageous in terms of utility than training a smaller model [LTLH21, YNB + 21].

Original: In a complementary line of work, [AGM + 21, LVS + 21, ADF + 21, KDRT21, YZCL21] designedvariants of DP-SGD that either explicitly or implicitly control the subspace in which the gradientsare allowed to reside.
Revised: In a complementary line of work, [AGM + 21, LVS + 21, ADF + 21, KDRT21, YZCL21] designedvariants of DP-SGD that either explicitly or implicitly control the subspace in which the gradientsare allowed to reside.

Original: They demonstrated improved dependence of the error on dimensions/modelparameters if the true gradients lie in a “near” low-rank subspace.
Revised: They demonstrated improved dependence of the error on dimensions/modelparameters if the true gradients lie in a “near” low-rank subspace.

Original: Our results are incomparable tothis line of work because of two reasons: (i)
Revised: Our results are incomparable tothis line of work, because of two reasons: i)

Original: Our algorithm is vanilla DP-SGD, and does not track thegradient subspace either explicitly or implicitly, and hence does not change the optimization landscape.
Revised: Our algorithm is vanilla DP-SGD, and does not track thegradient subspace either explicitly or implicitly, and hence does not change the optimization landscape.

Original: The improved dependence on dimensions is just an artifact of the analysis.
Revised: The improved dependence on dimensions is just an artifact of the analysis.

Original: (ii) Our analytical resultsdo not need the existence of any public data to obtain tighter dependence on dimensions.
Revised: ii) Our analytical resultsdo not need the existence of any public data to obtain tighter dependence on dimensions.

Original: All priorworks mentioned above need the existence of public data to demonstrate any improvement.
Revised: All priorworks mentioned above need the existence of public data to demonstrate any improvement.

Original:  Conclusion 
Revised:  Conclusion & Limitation

Original: We made an attempt to reconcile two seemingly conflicting results: (1) in private convex optimization,errors are predicted to scale proportionally with the dimension of the learning problem; while (2)in empirical works on large-scale private fine-tuning through DP-SGD, privacy-utility trade-offsbecome better with increasing model size.
Revised: We made an attempt to reconcile two seemingly conﬂicting results: (1) in private convex optimization,errors are predicted to scale proportionally with the dimension of the learning problem; while (2)in empirical works on large-scale private ﬁne-tuning through DP-SGD, privacy-utility trade-offsbecome better with increasing model size.

Original: We introduced the notion of restricted Lipschitz continuity,with which we gave refined analyses of DP-SGD for DP-ERM and DP-SCO.
Revised: We introduced the notion of restricted Lipschitz continuity,with which we gave reﬁned analyses of DP-SGD for DP-ERM and DP-SCO.

Original: When the magnitudesof gradients projected onto diminishing subspaces decay rapidly, our analysis showed that excessempirical and population losses of DP-SGD are independent of the model dimension.
Revised: When the magnitudesof gradients projected onto diminishing subspaces decay rapidly, our analysis showed that excessempirical and population losses of DP-SGD are independent of the model dimension.

Original: Throughpreliminary experiments, we gave empirical evidence that gradients of large pretrained languagemodels near a local optimum (obtained through fine-tuning) mostly lie in the subspace spanned by afew principal components.
Revised: Throughpreliminary experiments, we gave empirical evidence that gradients of large pretrained languagemodels near a local optimum (obtained through ﬁne-tuning) mostly lie in the subspace spanned by afew principal components.

Original: Our theoretical and empirical results together give a possible explanationfor recent successes in large-scale differentially private fine-tuning.
Revised: Our theoretical and empirical results together give a possible explanationfor recent successes in large-scale differentially private ﬁne-tuning.

Original: Given our improved upper bounds on the excess empirical and population risks for differentiallyprivate convex learning, it is instructive to ask if such bounds are tight in the mini-max sense.
Revised: Given our improved upper bounds on the excess empirical and population risks for differentiallyprivate convex learning, it is instructive to ask if such bounds are tight in the mini-max sense.

Original: Weleave answering this inquiry to future work.
Revised: Weleave answering this inquiry to future work.

Original: In addition, while we have presented encouragingempirical evidence that fine-tuning gradients mostly lie in a small subspace, more work is required tostudy the robustness of this phenomenon with respect to the model class and fine-tuning problem.
Revised: In addition, while we have presented encouragingempirical evidence that ﬁne-tuning gradients mostly lie in a small subspace, more work is requiredstudy the robustness of this phenomenon with respect to the model class and ﬁne-tuning problem.

Original: Overall, we hope that our work leads to more research on understanding conditions under which DPlearning does not degrade with increasing problem size, and more generally, how theory can informand explain the practical successes of differentially private deep learning.
Revised: Overall, we hope that our work leads to more research on understanding conditions under which DPlearning does not degrade with increasing problem size, and more generally, how theory can informand explain the practical successes of differentially private deep learning.

Original: Checklist
Revised: Checklist

Original: For all authors...
Revised: For all authors...

Original: (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
Revised: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s

Original: contributions and scope?
Revised: contributions and scope?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you describe the limitations of your work?
Revised: (b) Did you describe the limitations of your work?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [N/A]
Revised: [N/A]

Original: This work
Revised: This work

Original: presents theory which characterizes the performance of existing algorithms.
Revised: presents theory which characterizes the performance of existing algorithms.

Original: This work
Revised: This work

Original: would not lead to any direct societal impact.
Revised: would not lead to any direct societal impact.

Original: (d) Have you read the ethics review guidelines and ensured that your paper conforms to
Revised: (d) Have you read the ethics review guidelines and ensured that your paper conforms to

Original: them?
Revised: them?

Original: [Yes]
Revised: [Yes]

Original: If you are including theoretical results...
Revised: If you are including theoretical results...

Original: (a) Did you state the full set of assumptions of all theoretical results?
Revised: (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you include complete proofs of all theoretical results?
Revised: (b) Did you include complete proofs of all theoretical results?

Original: [Yes]
Revised: [Yes]

Original: If you ran experiments...
Revised: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experi-
Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Original: mental results (either in the supplemental material or as a URL)?
Revised: mental results (either in the supplemental material or as a URL)?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you specify all the training details (e g., data splits, hyperparameters, how they were chosen)?
Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you report error bars (e g., with respect to the random seed after running experiments multiple times)?
Revised: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Original: [Yes]
Revised: [Yes]

Original: (d) Did you include the total amount of compute and the type of resources used (e g., type
Revised: (d) Did you include the total amount of compute and the type of resources used (e.g., type

Original: of GPUs, internal cluster, or cloud provider)?
Revised: of GPUs, internal cluster, or cloud provider)?

Original: [Yes]
Revised: [Yes]

Original: If you are using existing assets (e g., code, data, models) or curating/releasing new assets...
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...

Original: (a) If your work uses existing assets, did you cite the creators?
Revised: (a) If your work uses existing assets, did you cite the creators?

Original: [Yes]
Revised: [Yes]

Original: (b) Did you mention the license of the assets?
Revised: (b) Did you mention the license of the assets?

Original: [Yes]
Revised: [Yes]

Original: (c) Did you include any new assets either in the supplemental material or as a URL?
Revised: (c) Did you include any new assets either in the supplemental material or as a URL?

Original: [No]
Revised: [No]

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re
Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’re

Original: using/curating?
Revised: using/curating?

Original: [Yes]
Revised: [Yes]

Original: (e) Did you discuss whether the data you are using/curating contains personally identifiable
Revised: (e) Did you discuss whether the data you are using/curating contains personally identiﬁable

Original: [Table]

Original: information or offensive content?
Revised: information or offensive content?

Original: [Yes]
Revised: [Yes]

Original: [Table]

Original: If you used crowdsourcing or conducted research with human subjects...
Revised: If you used crowdsourcing or conducted research with human subjects...

Original: [Table] (a) Did you include the full text of instructions given to participants and screenshots, if[Table]
Revised: (a) Did you include the full text of instructions given to participants and screenshots, if

Original: applicable?
Revised: applicable?

Original: [N/A]
Revised: [N/A]

Original: [Table]

Original: (b) Did you describe any potential participant risks, with links to Institutional Review
Revised: (b) Did you describe any potential participant risks, with links to Institutional Review

Original: [Table]

Original: Board (IRB) approvals, if applicable?
Revised: Board (IRB) approvals, if applicable?

Original: [N/A]
Revised: [N/A]

Original: [Table]

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount
Revised: (c) Did you include the estimated hourly wage paid to participants and the total amount

Original: [Table]

Original: spent on participant compensation?
Revised: spent on participant compensation?

Original: [N/A]
Revised: [N/A]

Original: [Table]