Differentially Private SGDA for Minimax Problems
Abstract
Stochastic gradient descent ascent (SGDA) and its variants have been the workhorse for solving minimax problems.
However, in contrast to the wellstudied stochastic gradient descent (SGD) with differential privacy (DP) constraints, there is little work on understanding the generalization (utility) of SGDA with DP constraints.
In this paper, we use the algorithmic stability approach to establish the generalization (utility) of DP-SGDA in different settings.
In particular, for the convexconcave setting, we prove that the DP-SGDA can achieve an optimal utility rate in terms of the weak primal-dual population risk in both smooth and non-smooth cases.
To our best knowledge, this is the first-ever-known result for DP-SGDA in the non-smooth case.
We further provide its utility analysis in the nonconvex-strongly-concave setting which is the first-ever-known result in terms of the primal population risk.
The convergence and generalization results for this nonconvex setting are new even in the non-private setting.
Finally, numerical experiments are conducted to demonstrate the effectiveness of DP-SGDA for both convex and nonconvex cases.
INTRODUCTION
In recent years, there is a growing interest on studying the minimax problems which involve both minimization over the primal variable w and maximization over the dual variable v .
Notable examples include generative adversarial networks (GANs)
[Goodfellow et al., 2014, Arjovsky et al., 2017], AUC maximization [Gao et al., 2013, Ying et al., 2016, Natole et al., 2018, Liu et al., 2020, Zhao et al., 2011], robust learning [Audibert and Catoni, 2011, Xu et al., 2009], adversarial training [Sinha et al., 2017], algorithmic fairness [Mohri et al., 2019, Li et al., 2019, Wang et al., 2020b, Martinez et al., 2020, Diana et al., 2021], and Markov Decision
Process (MDP)
[Puterman, 2014, Wang, 2017].
Details of these motivating examples are given in Appendix A.
The minimax problem can be formulated as
[Equation]
where W ⊆ R d 1 and V
⊆ R
d 2 are two nonempty closed and convex domains and z is a random variable from some distribution D taking values in Z .
Since the distribution
D is usually unknown and one has access only to an i.i.d.
training dataset S
= { z 1 , · · · , z n } , one resorts to solving its empirical minimax problem
[Equation]
One popular optimization algorithm for solving this problem is SGDA.
Specifically, at iteration t , upon receiving a random data point or mini-batch from S , it performs gradient descent over w with the stepsize η w ,t and gradient ascent over v with the stepsize η v ,t .
As SGDA is conceptually simple and easy to implement, it is widely deployed in solving minimax problems, e.g.,
GANs [Goodfellow et al., 2014], adversarial learning [Sinha et al., 2017], and AUC maximization
[Ying et al., 2016].
Its local convergence analysis for nonconvex-(strongly)- concave problems was established in Lin et al.
Other variants of SGDA were proposed and studied in Luo et al.
[2020], Nouiehed et al.
[2019], Rafique et al.
[2021], Yan et al.
On another front, collected data often contain sensitive information such as individual records from hospitals, online behavior from social media, and genomic data from cancer diagnosis.
Differential privacy [Dwork et al., 2014] has emerged as a well-accepted mathematical definition of privacy which ensures that an attacker gets roughly the same information from the dataset regardless of whether an individual is present or not.
Its related technologies have been adopted by Google [Erlingsson et al., 2014], Apple [Ding et al., 2017], and the US Census Bureau [Abowd, 2016].
While SGD and SGDA have become the workhorse behind the remarkable progress of machine learning and AI, it is of pivotal importance for developing their counterparts with
DP constraints.
Many studies analyze the privacy and utility of DP-SGD for the ERM problem that only involves the minimization over w [Bassily et al., 2019, 2020, Feldman et al., 2020, Song et al., 2013, Wang et al., 2021a, 2020a, 2019b, Wu et al., 2017, Zhou et al., 2020].
In contrast, there is little work on analysing the utility of minimax optimization algorithms with DP constraints except the recent work of Boob and
Guzmán [2021].
However, Boob and Guzmán [2021] focus on the noisy stochastic extragradient method on convexconcave and smooth settings.
Studying the computational and statistical behavior of DPSGDA is fundamental towards the understanding of stochastic optimization algorithm for minimax problem under the differential privacy constraint.
In this paper, we propose novel convergence and stability analysis to establish the utility of DP-SGDA in empirical saddle point and population forms such as the weak primal-dual population risk and the primal population risk.
We collect in Table 1 the notations and results of performance measures in this paper.
In particular, our contributions can be summarized as follows.
• We analyze the privacy and utility of DP-SGDA under the convex-concave setting in terms of the weak primaldual population risk,
i
e., max v ∈V E (cid:2) F ( A w ( S ) , v ) (cid:3) − min w ∈W E (cid:2) F ( w , A v ( S )) (cid:3) , where ( A w ( S ) ,A v ( S )) is the output of DP-SGDA.
Specifically, we show that it can guarantee ( ϵ, δ ) -DP and achieve the optimal rate O (cid:16) 1 √ n + √ d log(1 /δ )
nϵ (cid:17) for smooth and nonsmooth cases where d = max { d 1 , d 2 } .
To our best knowledge, this is the first-ever known result for DP-SGDA in the nonsmooth case.
• We further study the utility of DP-SGDA in the nonconvexstrongly-concave case in terms of the primal population risk, i.e., R ( A w ( S ))
=
max v ∈V E (cid:2) F ( A w ( S ) , v ) (cid:3) .
In particular, under the Polyak-Łojasiewicz (PL) condition of F S , we prove that the excess primal population risk, i.e., R ( A w ( S )) − min w ∈W R ( w ) , enjoys the rate O (cid:16) 1 n 1 / 3 + √ d log(1 /δ )
n 5 / 6 ϵ (cid:17) while guaranteeing ( ϵ, δ ) -DP.
The key techniques involve the convergence analysis of R S ( A w ( S ))
− min w R S ( w ) and the stability analysis for A w ( S ) which are of interest in their own rights.
As far as we are aware, these results are the first ones known for DP-SGDA in the nonconvex setting.
• We perform numerical experiments on three benchmark datasets which validate the effectiveness of DP-SGDA for both convex and non-convex cases.
1.1 MOTIVATING EXAMPLES
We give two examples of minimax problems under the DP constraint.
See Appendix A for more examples and details.
AUC Maximization.
Area Under the ROC Curve (AUC) is a widely used measure for binary classification.
It has been shown optimizing AUC is equivalent to a minimax problem once auxiliary variables a, b, v ∈ R are introduced
[Ying et al., 2016].
[Equation] [Equation]
[Equation]
Differential privacy has been applied to learn private classifier by optimizing AUC [Wang et al., 2021b].
Generative Adversarial Networks.
Originally proposed in
Goodfellow et al.
[2014], GAN in general can be written as a minimax problem between a generator network G v and a discriminator network D w
[Equation]
DP-SGDA and its variants were employed to train differential private GANs by Xie et al.
Recently differential privacy has successfully applied to private data generation by GAN framework [Jordon et al., 2018, Beaulieu-Jones et al., 2019].
1.2 RELATED WORK
Below we briefly discuss some related work.
Convergence analysis for SGDA.
It is a classical result that SGDA can achieve a convergence rate O
(1 / √ T ) in the convex and concave case [Nedi´c and Ozdaglar, 2009,
Nemirovski et al., 2009] where T is the number of iterations.
For the nonconvex-(strongly)-concave case, the work of Lin et al.
[2020] shows the local convergence of SGDA if the stepsizes η w ,t and η v ,t are chosen to be appropriately different.
Other important studies consider variants of SGDA and prove their local convergence for the nonconvex case.
Such algorithms include nested algorithms [Rafique et al., 2021] for weakly-convex-weakly-concave problems, multi-
step
GDA [Nouiehed et al., 2019] under the one-sided PL condition, epoch-wise SGDA
[Yan et al., 2020], and stochastic recursive SGDA
[Luo et al., 2020] for nonconvex-stronglyconcave problems, to mention but a few.
Stability and generalization of non-private SGD and
SGDA.
The studies of [Hardt et al., 2016, Charles and
Papailiopoulos, 2018, Kuzborskij and Lampert, 2018] use uniform stability Bousquet and Elisseeff [2002] to derive the generalization of non-private SGD for the convex and
[Table]
smooth case while the convex and nonsmooth case was established by Bassily et al.
[2020], Lei and Ying [2020].
The nonconvex case under the PL-condition was considered by
Charles and Papailiopoulos [2018], Lei and Ying [2021].
The stability and generalization of SGDA for minimax problems were studied by Lei et al.
[2021] in different forms for convex and nonconvex, smooth, and nonsmooth cases, and by Farnia and Ozdaglar [2021] with focus on the smooth cases.
DP-SGD and DP-SGDA.
DP-SGD was shown to attain the optimal excess population risk O (1 / √ n + (cid:112)
d log(1 /δ )
/nϵ )
in Bassily et al.
[2019, 2020], Wang et al.
[2021a, 2020a] for the convex case.
For nonconvex objectives, Wang et al.
[2019a] studied the DP Gradient Langevin Dynamics, and
Zhang et al.
[2021b] studied a multi-stage type of DP-SGD assuming the weakly-quasi-convexity and PL condition.
In
Xie et al.
[2018], Zhang et al.
[2018], DP-SGDA and its variants together with clipping techniques were employed to train differentially private GANs which showed promising results in applications.
However, no utility analysis was given there.
Boob and Guzmán [2021] focused on the noisy stochastic extragradient method with DP constraints for minimax problems in the convex-concave and smooth settings and provided its utility analysis using variational inequality (VI) and stability approaches.
PROBLEM FORMULATION
In this section, we introduce necessary assumptions, notations and the DP-SGDA algorithm.
2.1 ASSUMPTIONS AND NOTATIONS
Firstly, we introduce necessary assumptions and notations.
A function h : W → R is said to be convex if, for all w , w ′ ∈ W , there holds h ( w ) ≥ h ( w ′ )
+ ⟨∇ h ( w ′ ) , w − w ′ ⟩ where ∇ is the gradient operator and ⟨· , ·⟩ is the inner product.
Let ∥ · ∥ 2 denote the Euclidean norm.
We say h is ρ -strongly-convex if h − ρ 2 ∥ w ∥ 22 is convex, h is concave if − h is convex, and ρ -strongly-concave if − h − ρ 2 ∥ w ∥ 22 is convex.
Let [ n ] := { 1 , 2 , . . . , n } .
Definition 1.
Given a function h : W ×V → R .
We say h is convex-concave if for any v ∈ V , the function w (cid:55)→ h ( w , v ) is convex and for any w ∈ W , the function v (cid:55)→ h ( w , v ) is concave.
Assumption 1 ( A1 ) .
The function f is said to be Lipschitz continuous if there exist G w , G v > 0 such that, for any w , w ′ ∈ W , v , v ′ ∈ V and z ∈ Z , ∥ f ( w , v ; z ) − f ( w ′ , v ; z ) ∥ 2 ≤ G w ∥ w − w ′ ∥ 2 , and ∥ f ( w , v ; z ) − f ( w , v ′ ; z ) ∥ 2 ≤ G v ∥ v − v ′
∥ 2 .
And denote
G = max { G w , G v } .
Assumption 2 ( A2 ) .
For randomly drawn j ∈ [ n ] , the gradients ∇ w f ( w , v ; z j ) and ∇ v f ( w , v ; z j ) have bounded variances B w and B v respectively.
And let B = max { B w , B v } .
Assumption 3 ( A3 ) .
The function f is said to be smooth if it is continuously differentiable and there exists a constant
L > 0 such that for any w , w ′ ∈ W , v , v ′ ∈ V and z ∈ Z , (cid:13)(cid:13) (cid:13)(cid:13) (cid:18) ∇ w f ( w , v ; z ) −∇ w f ( w ′ , v ′ ; z ) ∇ v f ( w , v ; z ) −∇ v f ( w ′ , v ′ ; z ) (cid:19)(cid:13)(cid:13) (cid:13)(cid:13) 2 ≤ L (cid:13)(cid:13)
(cid:13)(cid:13) (cid:18) w − w ′ v − v ′ (cid:19)(cid:13)(cid:13) (cid:13)(cid:13)
We also require the Polyak-Łojasiewicz (PL) condition.
Definition 2 ([Polyak, 1964]) .
A function h : W → R satisfies the PL condition if there exist a constant µ >such that, for any w ∈ W , 12 ∥∇ h ( w ) ∥ 22 ≥ µ ( h ( w ) − min w ′ ∈W h ( w ′ )) .
We refer to Karimi et al.
[2016] for a nice discussion of this condition and other general conditions that allow the global convergence of gradient descent.
2.2 DP-SGDA ALGORITHM
We now move on to the definition of differential privacy and the description of DP-SGDA.
Differential privacy was introduced by Dwork et al.
We say that two datasets S, S ′ are neighboring datasets if they differ by at most one example.
Algorithm
1: Inputs: data S =
i
} , privacy budget
, number of iterations T , learning rates { η w ,t , η v ,t } Tt
, and initialize ( w 0 , v
) 2: Compute noise parameters σ w and σ v based on Eq.
(3) 3: for t = 1 to T do 4:
Sample a mini-batch I t
= { i 1 t , · · · , i mt ∈ [ n ] } uniformly with replacement 5:
Sample independent noises ξ t ∼ N (0 , σ 2 w I d 1 ) and ζ t ∼ N (0 , σ 2 v I d 2 ) 6: w t +1 =Π W (cid:16) w t − η w ,t (cid:16) 1 m (cid:80) mj
=1 ∇ w f ( w t , v t ; z i jt )+ ξ t (cid:17)(cid:17) 7: v t +
=Π V (cid:16) v t + η v ,t (cid:16) 1 m (cid:80) mj
=1 ∇ v f ( w t , v t ;
z i jt )+ ζ t (cid:17)(cid:17) 8: end for 9: Outputs: ( ¯ w T , ¯ v T )= 1 T
T (cid:88) t = ( w t , v t ) or ( w T , v T )
Definition 3 (Differential Privacy) .
A (randomized) algorithm
A is called ( ϵ, δ ) -differentially private (DP) if, for all neighboring datasets S, S ′ and for all events O in the output space of A , the following holds
[Equation]
Our aim is to design a randomized algorithm satisfying ( ϵ, δ ) -DP which solves the empirical minimax problem:
[Equation]
Notice that in the standard ERM problem, which involves the minimization only with respect to w , DP-SGD [Wu et al., 2017, Song et al., 2013, Bassily et al., 2019, Wang et al., 2020a] uses the gradient perturbation at each iteration.
Specifically, at each iteration of this algorithm, a randomized gradient estimated from a random subset (mini-batch) of
S is perturbed by a Gaussian noise and then the model parameter is updated based on this noisy gradient.
Following the same spirit, DP-SGDA [Xie et al., 2018,
Zhang et al., 2018] adds Gaussian noises per iteration to the randomized gradient mapping ( g w ,t , g v ,t )
[Equation]
where the index of example z i j t is from the mini-batch
I t .
Then, the primal variable w is updated by gradient descent based on the noisy gradient g w ,t + ξ t
and the dual variable v is updated by gradient ascent based on the noisy gradient g v ,t + ζ t .
The pseudo-code for DP-SGDA is given in Algorithm 1.
The noise levels σ w , σ v are given by (3) which will be specified soon in Section 3 in order to guarantee ( ϵ, δ ) -DP.
The notations Π W ( · ) and Π V ( · ) denote the projections to W and V , respectively.
From now on, the notation A denotes the DP-SGDA algorithm and its output is denoted by A ( S ) =
( A w ( S ) , A v ( S )) .
2.3 MEASURES OF UTILITY
Since the model A ( S ) is only trained based on the training data S , its empirical behavior as measured by F S may not generalize well on test data.
Our goal is to investigate the statistical behavior of A ( S ) on the test data in terms of some population risk.
However, unlike the standard statistical learning theory (SLT) setting where there is only a minimization of w , we have different measures of population risk due to the minimax structure [Zhang et al., 2021a,
Lei et al., 2021].
Let E [ · ] denote the expectation with respect to the randomness of algorithm A and data S .
We are particularly interested in the following metrics.
Definition 4 (Weak Primal-Dual (PD) Risk) .
The weak primal-dual population risk of A ( S ) , denoted by △ w ( A w ( S ) , A v ( S )) , is defined as
[Equation]
The corresponding weak PD empirical risk, denoted by △
[Equation]
( A w ( S ) , A v ( S )) , is defined as
[Equation]
Definition 5 (Primal Risk) .
The primal population risk of A ( S ) is given by R ( A w ( S ))
=
max v ∈V F
( A w ( S ) , v ) and empirical risk is defined by R S ( A w ( S ))
[Equation]
max v ∈V F S
A w ( S ) , v ) , respectively.
The excess primal population risk is defined as
[Equation]
The corresponding excess primal empirical risk is then
[Equation]
Meanwhile, the strong PD risk defined as △ s ( w , v ) =
E (cid:2) sup v ′ ∈V F ( w , v ′ ) − inf w ′ ∈W F ( w ′ , v ) (cid:3) .
We have △ w ( A w ( S ) , A v ( S )) ≤ △ s ( A w ( S ) , A v ( S )) by applying Jensen’s inequality.
However, when F is stronglyconvex-strongly-concave, the point distance from the model ( A w ( S ) , A v ( S )) to the true saddle point ( w ∗ , v ∗ ) ∈ arg min w ∈W max v ∈V F ( w , v ) can be bounded by the weak PD population risk, i.e. E [ ∥ A w ( S ) − w ∗ ∥ 22 + ∥
A v ( S ) − v ∗ ∥ 22 ] ≤ O ( △ w ( A w ( S ) , A v ( S ))) .
For certain problems, it is suffices to bound the weak PD risk, such as the learning problem for Markov decision process in Appendix A.
The primal risk is more meaningful when one is concerned about the risk with respect to the primal variable, such as the AUC maximization problem.
MAIN RESULTS
In this section, we present our main theoretical results for
DP-SGDA.
For the privacy guarantee, we leverage the moments accountant method [Abadi et al., 2016], which implies tight privacy loss for adaptive Gaussian mechanisms with amplification by subsampling.
Below we summarize a specific version of this method that suffices for our purpose.
Theorem 1.
Let (A1) hold true.
Then, there exist constants c 1 , c 2 and c 3 so that given the mini-batch size m and total iterations T , for any ϵ < c 1 m 2 T/n 2 , Algorithm 1 is ( ϵ, δ ) - differentially private for any δ > 0 if we choose
[Equation]
The proof of Theorem 1 is given in Appendix B.
Remark 1.
In practice, given privacy budget ϵ, δ and parameters m, T , the constant c 2 and hence σ can be found by grid search [Abadi et al., 2016].
Here we provide a set of parameters that satisfies the condition in that reference and
our
Theorem 1.
That is, by choosing ϵ ≤ 1 , δ ≤ 1 /n 2 and m = max(1 , n (cid:112) ϵ/ (4 T )) , then we have explicit values for the variances as σ w =
[Equation]
w
[Equation]
Remark 2.
Our Algorithm 1 allows the application of independent noises ξ t , ζ t with different σ w , σ v , respectively.
In Boob and Guzmán [2021], a uniform σ is used (Theorem 5.4 or 7.4 there) for both primal and dual variables.
In many examples, the primal and dual gradients ∇ w f ( w t , v t , z i jt ) , ∇ v f ( w t , v t , z i jt ) enjoy different Lipschitz constants ( ℓ 2 -sensitivity).
Therefore, our treatment leads to a more delicate way of calibrating the variances of the Gaussian noises.
As we shall see in the experiments in Section 4, this treatment enables Algorithm 1 to achieve better performance.
In the subsequent subsections, we present our main contribution of this paper, i.e., the utility bounds of DP-SGDA for the convex-concave and nonconvex-strongly-concave cases, respectively.
3.1 CONVEX-CONCAVE CASE
In this subsection, we present the utility bound of DP-SGDA for the convex-concave case in terms of the weak PD risk of the output ( ¯ w T , ¯ v T ) of Algorithm 1.
Theorem 2.
Assume the function f is convex-concave.
Assume W and V are bounded so that max w ∈W ∥ w ∥ 2 ≤ D w , max v ∈V ∥ v ∥ 2 ≤ D v .
And let D = max { D w , D v } .
Let the stepsizes η w ,t
= η v ,t = η for all t ∈
[ T ] with some η > 0 .
Under one of the condition
a) Assumption (A1) and (A3) hold true
and we choose T ≍ n and η ≍ 1 / (cid:0) max { √ n, (cid:112) d
[Equation]
[Equation] [Equation]
} (cid:1)
[Equation]
b) or Assumption (A1) holds
true
and we choose T ≍ nand
[Equation]
then Algorithm 1 satisfies
[Equation]
Its detailed proof can be found in Appendix C.
The proof mainly relies on the concept of stability [Bousquet and
Elisseeff, 2002, Charles and Papailiopoulos, 2018, Hardt et al., 2016, Kuzborskij and Lampert, 2018].
Specifically, the weak PD population risk can be decomposed as follows:
[Equation]
where the term △ w ( ¯ w T , ¯ v T ) − △ wS ( ¯ w T , ¯ v T ) is the generalization error and △ w S ( ¯ w T , ¯ v T ) is the optimization error.
The estimation for the optimization error can be conducted by standard techniques [Nemirovski et al., 2009].
We give a self-contained proof in Appendix C.1.
The generalization error is estimated using a concept of weak stability [Lei et al., 2021].
Specifically, we say the randomized algorithm A is ε -weakly-stable if, for any neighboring sets S, S ′ differing at one single datum, there holds
[Equation]
We know from Lei et al.
[2021] that ε -weak-stability implies △ w
[Equation]
In Appendix C.2, we prove the weak stability of DP-SGDA (i.e. Algorithm 1) for both smooth and nonsmooth cases.
Putting the estimations for the optimization error and generalization error into (4) can yield the bound in Theorem 2.
We end this subsection with some remarks.
Remark 3.
The utility bound O (cid:16) max (cid:110)
[Equation]
n
[Equation]
is optimal for convex-concave minimax problem.
A lower bound with the same order has been established in the convex ERM setting [Bassily et al., 2014, 2019, Feldman et al., 2020] and the measure of utility is given by
E [ F ( A w ( S ))
− min w ∈W F ( w )] .
Here we slightly abuse the notation to indicate F as the population risk and A w ( S ) as the algorithm for the ERM problem.
Since the convexconcave minimax problem is a special case of convex ERM problems when the dual variable is constant, this lower bound also applies to our setting.
Remark 4.
The same optimal utility was claimed in Boob and Guzmán [2021].
Yet our results also possess two theoretical gains compared to theirs.
Firstly, when the smoothness assumption holds, Part a) in our Theorem 2 shows the optimal utility with T
= O ( n ) iterations and O ( n 3 / 2 ) gradient computations by Remark 1, while their single-looped algorithm (Algorithm 1 there) requires O ( n 2 ) gradient computations in their Theorem 5.4.
They further improved the gradient complexity to O ( n 3 / 2 log( n )) in Theorem 7.4, which, however, requires an extra subroutine algorithm (inner-loop) (Algorithm 2 there).
Secondly, we also derive the same optimal bound with only Lipschitz continuous assumption for the nonsmooth case which was not addressed in Boob and
Guzmán [2021].
3.2 NONCONVEX-STRONGLY-CONCAVE CASE
We proceed to the case when f is non-convex-stronglyconcave.
In this case, we can present utility bounds of DPSGDA in terms of the primal excess risk, i.e., R ( w T ) − min w ∈W R ( w ) , where w T is the last iterate of Algorithm 1.
Generally speaking, a saddle point may not always exist without the convexity assumption.
Since our goal in this paper is to find global optima, we assume that the saddle point of the empirical minimax problem exists, i.e., there exists ( ˆ w S , ˆ v S ) such that, for any w ∈ W and v ∈ V ,
[Equation]
To estimate the primal excess risk, we define R ∗ S
= min w ∈W R S ( w ) , and R ∗ =
min w ∈W R ( w ) .
Then, for any w ∗ ∈ arg min w R ( w ) we have the error decomposition:
[Equation]
where the last inequality follows from the fact that R ∗ S −
R S ( w ∗ ) ≤ 0 since R ∗ S = min w ∈W R S ( w ) .
The term E
[ R S ( w T ) − R ∗ S ] is the optimization error which characterizes the discrepancy between the primal empirical risk of an output of Algorithm 1 and the least possible one.
The term E
[ R ( w T ) − R S ( w T )]
+ E [ R S ( w ∗ ) − R ( w ∗ )] is called the generalization error which measures the discrepancy between the primal population risk and the empirical one.
The estimations for these two errors are described as follows.
Optimization Error.
The next theorem characterizes the primal empirical risk of DP-SGDA under the PL-SC assumption.
Theorem 3.
Assume Assumptions (A1) and (A2) hold true, and the function F S ( w , · ) is ρ -strongly concave and
F S ( · , v ) satisfies µ -PL condition.
Assume V is bounded.
Let κ =
L/ρ .
If we choose η w ,t ≍ 1 µt and η v ,t ≍
[Equation]
3 , then
[Equation]
We provide the proof of Theorem 3 in Appendix D.1.
In the non-private setting, i.e. σ w = σ v = 0 , Theorem 3 implies that the convergence rate in terms of the primal empirical risk is of the order O ( κ 3 .
5 µ 2 .
5 T 2 / 3 ) , which is a new result even in the non-private case as far as we are aware of.
In Lin et al.
[2020], the local convergence of SGDA in the non-private case was proved in terms of the metric E
[Equation]
where τ is chosen uniformly at random from the set { 1 , 2 , . .
, T } .
Our analysis is much more involved since it proves the global convergence of the last iterate w T .
Our main idea is to prove the coupled recursive inequalities for two terms, i.e., a t = R S ( w t ) − R ∗ S and b t =
∥ v t − ˆ v S ( w t ) ∥
22 where ˆ v S ( w t )
=
arg max v ∈V F S ( w t , v ) , and then carefully derive the the convergence rate for a t + λ t b t by choosing λ t appropriately.
The convergence rate and its proof can be of interest in their own right.
One can find more detailed arguments in Appendix D.1.
Generalization Error.
We present the bound for the generalization error which is proved again using the stability approach.
We begin with a discussion of the saddle points.
While the saddle point ( ˆ w S , ˆ v S ) may not be unique, ˆ v S must be unique if F S ( w , v ) is strongly-concave in v (see Proposition 1 in Appendix D).
Therefore, we can define π S ( w ) the projection of w to the set of saddle points, as Ω S = (cid:8)
[Equation]
Recall that w T is the iterate of DP-SGDA at time T based on the training data S .
Likewise, we denote by w ′ T based on the training set S ′ which differs from S at one single datum.
Due to the possibly multiple saddle points, we need the following critical assumption for estimating the generalization error.
Assumption 4 ( A4 ) .
For the (randomized) algorithm DPSGDA, assume that π S ′ ( π S ( w T )) =
π S ′ ( w ′ T ) for any neighboring sets S and S ′ .
Assumption (A4) was introduced in Charles and Papailiopoulos [2018] for studying the stability of SGD in the non-convex case which only involves the minimization over w .
In our case, (A4) holds true whether the saddle point is unique (e.g., F S is strongly-convex and strongly-concave) or the two sets of saddle points based on S and S ′ , i.e. Ω S and Ω S ′ do not change too much.
Since our algorithm satisfies ( ϵ, δ ) -DP it means that the distributions of w T and w ′ T generated from two neighboring sets S and S ′ are “close”, which indicates sup S,S ′ ∥
π S ′ ( π S ( w T ))
− π S ′ ( w ′ T ) ∥ 2 can be small.
Proving such statement serves as an interesting open problem.
Now we can state the results on the generalization error.
Theorem 4 (Generalization Error) .
Assume Assumptions (A1) , (A3) and (A4) hold true, and assume the function f ( w , · ; z ) is ρ -strongly concave and F S ( · , v ) satisfies µ -PL condition.
Let κ =
L/ρ .
If E [ R S ( w T ) − R ∗ S ] ≤ ε T , then
[Equation]
and
[Equation]
The proof of Theorem 4 is provided in Appendix D.2.
Remark 5.
The generalization error bounds given in Theorem 4 indicate that if the optimization error E [ R S ( w T ) −
R ∗ S ] is small then the generalization error will be small.
This is consistent with the observation in the stability and generalization analysis of SGD [Charles and Papailiopoulos, 2018, Hardt et al., 2016, Lei and Ying, 2021] for the minimization problems in the sense of “optimization can help generalization".
We can derive the following utility bound for DP-SGDA by combining the results in Theorems 4 and 3.
Theorem 5.
Under the same assumptions of Theorem 4, if we choose T ≍ n , η w ,t ≍ 1 µt and η v ,t ≍
[Equation] [Equation]
3 , then
[Equation]
The proof can be found in Appendix D.3.
EXPERIMENTS
In this section, we evaluate the performance of DP-SGDA by taking AUC maximization as an example.
Due to space limitation, we present the most significant information and results of our experiments while more detailed information and additional results are given in Appendix E and F.
4.1 EXPERIMENTAL SETTINGS
Baseline Model.
We perform experiments on the problem of AUC maximization with the least square loss to evaluate the DP-SGDA algorithm in linear and non-linear settings (two-layer multilayer perceptron (MLP)).
In this case, AUC maximization can be formulated as
[Equation]
where h : Θ × R d → R is the scoring function.
As shown in Ying et al.
[2016], it is equivalent to a minimax problem:
[Equation]
where
[Equation]
When h is a linear function, the AUC learning objective above is convex-strongly-concave.
On the other hand, when h is a MLP function, it becomes a nonconvex-stronglyconcave minimax problem.
In addition, following Liu et al.
[2020], we use Leaky ReLU as an activation function for
MLP.
It was shown in their paper the empirical AUC objective satisfies the PL condition with this choice of h .
Without a special statement, we set 256 as the number of hidden units in MLP and 64 as the mini-batch size during the training.
Datasets and Evaluation Metrics.
Our experiments are based on three popular datasets, namely ijcnn1 [Chang and Lin, 2011], MNIST [LeCun et al., 1998], and FashionMNIST [Xiao et al., 2017] that have been used in previous studies.
For MNIST and Fashion-MNIST, following
Gao et al.
[2013], Ying et al.
[2016], we transform their classes into binary classes by randomly partitioning the data into two groups, each with an equal number of classes.
For ijcnn1, we randomly split its original training set into new training ( 80% ) and testing ( 20% ) sets.
For MNIST and Fashion-MNIST, we use their original training set and testing set.
For each method, the reported performance is obtained by averaging the AUC scores on the test set according to 5 random seeds (for initial w and v , sampling and noise generation).
Privacy Budget Settings.
In the experiments, we set up five privacy levels from small to large: ϵ ∈ { 0 . 1 , 0 .
We also consider three different δ from { 1e − 4 , 1e − 5 , 1e − 6 } .
Due to space limitation, we only report the performance when δ = 1e − 6 .
More results can be found in Appendix F. To estimate the Lipschitz constants
G w and G v (in Theorem 1), we first run the algorithms without adding noise.
Then we calculate the maximum gradient norms of AUC loss w.r.t w and v and assign them as G w and G v , respectively.
According to these parameters, we calculate the noise parameter σ by applying autodp 1 , which is widely used in the existing works [Wang et al., 2019b].
Compared Algorithms.
Boob and Guzmán [2021] is the only existing paper that considers differential privacy in the convex-concave minimax problem.
Therefore, we use their single-loop NSEG algorithm as our baseline method on the
AUC optimization under the linear setting.
4.2 RESULTS
We report our evaluation and results on the utility and privacy trade-off of the DP-SGDA.
Then we follow the experiment design by [Abadi et al., 2016] to study the effect of the parameters - hidden units and batch sizes.
[Table]
[Figure]
General AUC Performance vs Privacy.
The general performance of all algorithms under linear and MLP settings of
AUC optimization is shown in Table 2.
Since the standard deviation of the AUC performance is around [0 , 0 .
1%] and the difference between different algortihms is very small, we only report the average AUC performance.
First, without adding noise into gradients, we can find the NSEG method and our DP-SGDA method have similar performance under the linear case.
Furthermore, we can find the performance of the DP-SGDA with MLP model can outperform linear models on all datasets.
This is because non-linear models have better expression power and therefore it can learn more information among features than linear models.
Second, by adding noise into the gradients, we can find the AUC performance of all models is decreased on all datasets.
However, by increasing the privacy budget ϵ , the AUC performance is increased.
The reason is that ϵ and σ have opposite trends according to equation (3).
The relation between ϵ and AUC score also verifies our Theorem 2 and Theorem 5.
Third, to verify our statement in Remark 2, we compare the σ values from NSEG and DP-SGDA on all datasets in Figure 1(a).
From the figure, it is clear that the σ from NSEG is larger than ours in all ϵ settings since it is calibrated based on the gradients’ sensitivity from both w and v .
In fact, the sensitivity w.r.t.
v is small as it is a one-dimensional variable for
AUC maximization.
Therefore, NSEG leads to overestimate on the noise addition towards v .
From Table 2 we observe our DP-SGDA achieves better AUC score than NSEG under the same privacy budget.
Different Hidden Units.
In DP-SGDA under the MLP setting, the hidden unit is one of the most important factors affecting the model performance.
Therefore, we compare the AUC performance with respect to the different hidden units in Figure 1(b).
If we provide a small number of hidden units, the model will suffer from poor generalization capability.
Using a large number of hidden units will make the model easier to fit the training set.
For SGDA (non-private) training, it is often helpful to apply a large number of hidden units, as long as the model does not overfit.
In agreement with this intuition, we find the model performance improves with increasing hidden units in Figure 1(b).
However, for
DP-SGDA training, more hidden units increase the sensitivity of the gradients, which leads to more noise added at each update.
Therefore, in contrast to the non-private setting, we find the AUC performance decreases when the number of hidden units increases.
Different Mini-Batch Size.
From Theorem 1 and Theorem 3, we find mini-batch size can influence the Gaussian noise variances σ 2 w and σ 2 v as well as the convergence rate.
Selecting the mini-batch size must balance two conflicting objectives.
On one hand, a small mini-batch size may lead to sub-optimal performance.
On the other hand, for large batch sizes, the added noise has a smaller relative effect.
Therefore, we show the AUC score for DP-SGDA with different mini-batch sizes in Figure 1(c).
The experimental results show that the mini-batch size has a relatively large impact on the AUC performance when the mini-batch size is small.
CONCLUSION
In this paper, we have used algorithmic stability to conduct utility analysis of the DP-SGDA algorithm for minimax problems under DP constraints.
For the convex-concave setting, we proved that DP-SGDA can attain an optimal rate
O ( 1 √ n + √ d log(1 /δ )
nϵ ) in terms of the weak primal-dual population risk while providing ( ϵ, δ ) -DP for both smooth and nonsmooth cases.
For the nonconvex-strongly-concave case, assuming that the empirical risk satisfies the PL condition we proved the excess primal population risk of DP-SGDA can achieve a utility bound O (cid:0) 1 n 1 / 3 +
[Equation]
ments on three benchmark datasets illustrate the effectiveness of DP-SGDA.
For future work, it would be interesting to improve the utility bound for the nonconvex-strongly-convex setting.
It also remains unclear to us how to establish the utility bound for
DP-SGDA when gradient clipping techniques are enforced at each iteration.
Finally, it would also be interesting to evaluate the performance of DP-SGDA on other motivating examples such as GAN, MDP and robust optimization.
Acknowledgements
The work is supported by SUNY-IBM AI Alliance Research and NSF grants (IIS-1816227, IIS-2008532, IIS-2103450, IIS-2110546 and DMS-2110836).
The authors would also like to thank Dr. Guzmán and Dr. Boob for helpful discussions on differential privacy for minimax problems and for pointing out a gap in the proof of Lemma 3 in the Appendix in an earlier version of the paper.