Differentially Private Model Compression
Abstract
Recent papers have shown that large pre-trained language models (LLMs) such as
BERT, GPT-2 can be ﬁne-tuned on private data to achieve performance comparable to non-private models for many downstream Natural Language Processing (NLP) tasks while simultaneously guaranteeing differential privacy.
The inference cost of these models – which consist of hundreds of millions of parameters – however, can be prohibitively large.
Hence, often in practice, LLMs are compressed before they are deployed in speciﬁc applications.
In this paper, we initiate the study of differentially private model compression and propose frameworks for achieving 50% sparsity levels while maintaining nearly full performance.
We demonstrate these ideas on standard GLUE benchmarks using BERT models, setting benchmarks for future research on this topic.
Introduction
Since the advent of Transformer-based [67] large language models (LLMs) such as BERT [13, 37],
GPT families [50, 5], there has been a paradigm shift in the way deep learning models are trained for natural language processing (NLP) applications.
LLMs are ﬁrst pre-trained on extremely large and diverse publicly available datasets.
The weights are then ﬁne-tuned for a speciﬁc task of interest using a much smaller private dataset , which may consist of sensitive information about the users.
Finally, before deploying the models are compressed (also referred to as sparsiﬁed or distilled) to reduce the parameter count.
The reason for this ﬁnal step is that LLMs such as BERT and GPTconsist of hundreds of millions of parameters, and hence inference time and memory footprints of the models are too large to be used in many applications.
As a concrete example, consider a language model that is deployed for sentence completion task in text editors.
In this scenario, clearly, the inference (response) time of the model needs to be in orders of milliseconds to be useful. Besides the 36th Conference on Neural Information Processing Systems (NeurIPS 2022).
practical considerations, it is also commonly observed that large deep learning models (even the ones that are not pre-trained) consist of many redundant parameters in the network that can be removed while retaining the full performance [32, 27, 26].
Hence most modern deep learning pipelines use this three-pronged approach of pre-train, ﬁne-tune, and compress as illustrated in Figure 1.
While transformer-based models swayed deep learning research towards making models larger to achieve better performance, several recent works have shown that over-parameterized large models also increase the risk of leaking sensitive information about their training datasets [53, 8, 9].
Over the past few years, training deep learning models guaranteeing differential privacy (DP) [17], a strong notion of data privacy, has emerged as the defacto method to mitigate such information leakage.
Exciting recent works have also shown that large pre-trained models when ﬁne-tuned via DPSGD are as good as non-private models for a variety of NLP and image applications [75, 34, 12, 42, 44].
The main purpose of this paper is to understand how private training impacts the modern deep learning pipeline of pre-train, ﬁne-tune, and compress.
The main observation is that most widely used model compression algorithms such as Knowledge Distillation (KD) and Pruning, use private datasets to produce compressed models, hence if our goal is to deploy a differentially private compressed model, we should consider their impact on the training process.
This leads to the question:
What algorithms should one use to produce compressed private models and how do they impact private ﬁne-tuning via DPSGD?
The goal of this paper is to investigate this question and propose frameworks for private model compression in the context of NLP applications.
Although we investigate model compression techniques at the ﬁne-tuning stage using pre-trained models, we would like to emphasize that our frameworks for private model compression are not tied to this setting.
They are equally applicable to training deep learning models from scratch and to other application domains such as image classiﬁcation tasks.
1.1 Our Contributions
• We give a framework for doing model compression using Knowledge Distillation algorithm guaranteeing differential privacy, which we call DPKD.
We show that DPKD alone is not enough to transfer the knowledge from large models to compressed models.
This loss in the accuracy of compressed models can be mitigated by better initialization of compressed models from the weights of the large models, which itself is a form of knowledge transfer.
We propose several zero-shot, fully private methods for initialization compressed models using weights of the large models.
Our empirical evaluation of these ideas on standard GLUE benchmarks using BERT models show that DPKD approach to the model compression loses an accuracy of 5% compared to the larger models if the compressed model has half the size of the full BERT model .
• To overcome the limitations of DPKD algorithm for model compression, we consider a framework for evolving the larger models to compressed models via private adaptation of Iterative Magnitude Pruning (DPIMP).
We show that on standard GLUE benchmarks using BERT models, DPIMP framework produces compressed models whose performance is comparable to larger models at 50% unstructured sparsity levels.
• As a byproduct of DPIMP approach for model compression, our work also shows that pre-trained BERT models have sparse subnetworks that can be found via DPSGD that have almost matching performances of the private full model, similar to the Lottery Ticket Hypothesis for BERT models in non-private settings [20, 11].
To the best of our knowledge, no prior work have studied model compression techniques of LLMs in private settings.
A problem broadly related to model compression is ensemble learning, where the goal is to transfer knowledge from an ensemble of teacher models to a single student model [14].
This problem was studied in the private setting by [48, 49], who proposed the Private Aggregation of
Teacher Ensembles (PATE) framework.
In PATE an ensemble of teacher models is trained on disjoint private data and the student model is trained by noisy aggregation of teachers’ answers.
Two recent works combine PATE framework with KD algorithm for doing noisy aggregation of teachers’ answers for mobile analytics and text generation problems [38, 63].
The PATE framework and ensemble learning techniques can be applied for ﬁne-tuning (or training) deep learning models.
Unfortunately, however, as previous works have shown, the performance of deep learning models trained via PATE are inferior to that of DPSGD for complex datasets [76].
As the performance of a ﬁne-tuned large model on a sensitive dataset is an upper bound on the performance of a compressed model, and we do not know how to ﬁne-tune large models using PATE to match the performance of DPSGD, we do not consider PATE framework for model compression.
Preliminaries
Recall the formal deﬁnition of differential privacy.
Deﬁnition 2.1 (Differential Privacy (DP) [17, 16]) .
A randomized algorithm A is ( ✏ ,  )-differentially private if for any two neighboring datasets D and D 0 , which differ in exactly the data pertaining to a single user, and for all sets S of possible outputs: Pr[ A ( D ) [Equation] S
[Equation]
 e ✏ Pr [Equation] A [Equation]
S
[Equation]
+  .
We train all our models via DPSGD as the optimizer.
We brieﬂy describe the algorithm.
2.1 Training via DPSGD
To train a deep learning model with privacy, the most widely used algorithm is the DP stochastic gradient descent (DPSGD)
DPSGD augments the standard SGD algorithm with per-example gradient clipping and Gaussian noise addition steps.
These two steps serve to limit and mask the contribution of a single example.
At a high level, the privacy analysis of DPSGD proceeds by ﬁrst showing that each iteration of DPSGD is differentially private for some ( ✏ ,  ) , then applying ampliﬁcation by subsampling and composition across all the iterations.
To get the tightest privacy parameters, however, one needs more sophisticated arguments such as the Moments Accountant method [1] or numerical composition algorithms [23].  Problem Statement
Input to our problem are privacy parameters ✏ > 0,  > 0, a large model M A with the initial model parameters ✓ A (0) , a private dataset D corresponding to a downstream task we want to solve, and a compression factor  .
Let | M A | denote the parameter count of M A .
Our goal is to produce a compressed model M B satisfying two constraints: (i) | M B |   · | M A | and (ii) the ﬁnal weights of model M
B (denoted by ✓ B ( t ) ) should be ( ✏ ,  )-differentially private with respect to dataset D .
A compression algorithm can make use of M A in an arbitrary way as long the ﬁnal weights of model M B ( ✓ B ( t ) ) are differentially private with respect to dataset D . We measure the quality of compression algorithms by comparing the accuracy obtained by M B satisfying ( ✏ ,  )-DP on downstream task D to the accuracy obtained by M A satisfying ( ✏ ,  )-DP on downstream task D . This allows us to quantify how much performance one loses in private training due to model compression.
Note that we are not comparing against the performance of non-private models.
We would like to ﬁnd compression algorithms where differentially private M B has nearly the same performance as differentially private M A .
Compressed Models via Knowledge Distillation
One of the most widely used algorithms for compressing models is knowledge distillation (KD) [28, 6, 51].
In this section, we propose a framework for implementing knowledge distillation with
DP constraints and evaluate its effectiveness on standard GLUE benchmarks.
We begin by brieﬂy describing how the KD algorithm is applied for compressing models; we refer the readers to [24, 43] for more details.
Adopting the naming convention from the literature, for the rest of the paper, we call large pre-trained models as teacher models and compressed smaller models as student models .
4.1 Non-Private Knowledge Distillation
Let T be a teacher network with the class probabilities P T = softmax ( a T ) (a.k.a.
soft labels) where a T is the output of last layer before the softmax operation.
Similarly, let S be a student network with parameters W S and class probabilities P S = softmax ( a S ) .
The main idea behind KD algorithm is to train S to mimic the output distribution of the teacher P T and the true labels.
The intuition is that P T captures the knowledge learnt by the teacher, in particular probabilities assigned by the teacher to labels that are different from the true label.
Hinton et al.
[28] suggested to use softmax-temperature where probability for class i of the teacher is given by
[Equation]
with logits z i where T controls the smoothness of the output distribution.
Setting a higher value for the temperature parameter T produces a softer probability distribution over classes.
The same relaxation is applied to the output of the student network.
The student is trained to minimize the weighted combination of the distillation loss and the supervised training loss:
[Equation]
where H refers to the cross-entropy and  is a hyperparameter.
4.2 Differentially Private Knowledge Distillation (DPKD)
A natural way to generalize KD algorithm for private distillation of student model is to train the student with DPSGD to minimize the loss function given by Equation 1.
However, such an algorithm fails to produce student models satisfying DP because of the term H ( P T , P S ) in Equation 1.
Note that P T is a function of the entire dataset, hence clipping and adding noise alone is not enough to argue that DPSGD produces a private student.
A natural solution to overcome this hurdle is to ﬁrst train the teacher models with DPSGD and then apply KD.
We propose our DPKD framework in
Algorithm 1.
In this Algorithm, if the initialization of student model weights does not incur any privacy cost (e.g. random initialization or initialization using parameters from a publicly trained model), ✏ 2 would be 0 .
Having said that, there could be student initialization strategies that are functions of the dataset D , in which case, we need to account for the privacy loss using non-zero ✏ 2 .
Input
, private
, privacy Output : Find an As the model parameters produced by DPSGD satisfy privacy guarantees, using the post-processing property of DP [18], one can show the following theorem.
We omit the proof.
Theorem 4.1.
The output of DPKD algorithm is differentially private with privacy parameters obtained by the adaptive composition of privacy parameters in steps 2, 3, and 4 of Algorithm 1.
In this work we use numerical composition of privacy mechanisms as given in [23].
Our framework for DPKD raises several interesting algorithmic and hyperparameter tuning questions.
The most interesting one is whether one can have DPKD algorithm where the privacy budget is not wasted on training the teacher.
While this is a nice theoretical question, we show in our experiments that DPKD framework is competitive with respect to teachers that are not trained with DP .
4.3 Empirical Evaluation of DPKD Algorithm
In this section, we perform experiments to evaluate the effectiveness of DPKD algorithm for compressing models.
Teacher and Student Architectures.
Our teacher models are pre-trained BERT 1 models, which consists of 12 transformer blocks.
The architecture of compressed models consist of 6 transformer blocks, which we refer to as 12 -BERT. [Table]
Tasks and datasets.
Following prior work [77, 34, 75], we experiment with the following set oftasks from the GLUE benchmark [68]: MNLI (Multi-Genre Natural Language Inference Corpus),
QQP (Quora Question Pairs), QNLI (Stanford Question Answering Dataset) and SST-2 (Stanford
Sentiment Treebank).
Training and privacy parameters.
We perform experiments with two sets of privacy budgets: (i) ✏ = 4 with  = 1 N and (ii) ✏ = 1 with  = 1 10 N , where N is the number of samples in the given dataset.
We describe the software and hardware speciﬁcations in Appendix A.1 and hyperparameter settings in Appendix A.2.
[Table]
We start with random initialization of the student models to see if DPKD algorithm can be effective in transferring the knowledge from the teacher.
We compare the performance of our student model trained with DPKD algorithm with the performance of directly ﬁne-tuned student via DPSGD and the performance of full teacher model ﬁne-tuned with DPSGD.
Our results are summarized in Tablesand 2.
The main takeaway from this experiment is:
• There is a large gap in the performance of students trained using DPKD algorithm compared to the teacher when students are randomly initialized.
In fact, directly ﬁne-tuning the student model using DPSGD achieves better performance compared to DPKD algorithm.
We conclude that DPKD alone is not enough to transfer the knowledge from teacher models to compressed student models.
4.4 Better Student Models via Zero-shot Initializations
In our desire to train better-performing student models, we explore different initialization strategies.
We note that initialization is also a form of knowledge transfer.
Here we consider two natural zero-shot initialization strategies:
• Zero-shot (PT): Here we initialize the student model using the weights of the pre-trained teacher.
In particular, we simply initialize the layers of the student model with 6 layers of BERT teacher model.
We follow [52] for the choice of layers.
• Zero-shot (FT): Here we initialize the student model using weights of the privately ﬁne-tuned teacher model.
As our DPKD requires the teacher to be private as well, one can initialize the student model using the weights of the private teacher without incurring any additional privacy cost.
We compare zero-shot initialization strategies against a fully pre-trained student model given by
Huggingface’s compressed BERT model DistilBERT [52].
DistilBERT is trained using KD algorithm
[Table]
[Table]
with the full BERT model on public data at the pre-training stage .
We note that DistilBERT hastransformer blocks and hence has the same architecture as 12 -BERT.
We emphasize that pre-training student model is computationally expensive [Table] and the main aim of this paper is to develop algorithms where one can transfer knowledge from the teacher to students models without resorting to pretraining the student from scratch.
However, DistilBERT serves as the gold standard to compare our zero-shot initialization strategies and also sets the benchmark for comparing ideas in Section 5.
Results Our results are summarized in Tables 3 and 4.
For every student initialization method, we also compare ﬁne-tuning using DPKD algorithm vs simply ﬁne-tuning the student via DPSGD.
The main takeaways from these experiments are:
• Zero-shot initialization strategies give large performance improvements to student models and come to 2-3% of the performance achieved by pre-trained DistilBERT.
Somewhat surprisingly, there is not much difference between our two zero-shot initialization strategies.
• Both pre-trained DistilBERT and student models with zero-shot initialization strategies fall short of matching the performance of teacher models.
• Finally, broadly speaking, DPKD algorithm does not give a signiﬁcant performance boost to the student models compared to directly ﬁne-tuning them.
4.5 Better Models are Better Teachers?
Given the results in the previous section, one may wonder if better teachers can help in improving the performance of the students.
In this regard, we consider two notions of better teacher : (1) A [Table] [Table]
larger teacher model in Step 2 of Algorithm 1 (2)
A teacher model that is not DP-trained.
We note that the ﬁnal student model in the second case is not DP; however, these experiments allow us to quantify how much performance gains one could have if one were to come up with a new framework for implementing KD in DP setting without requiring the teacher to be trained with DP.
Our results are summarized in Tables 5 and 6.
These experiments show that DPKD does not beneﬁt signiﬁcantly from having better teacher models.
Furthermore, our proposed framework of implementing KD in DP framework by training both the teacher and student models via DP is only within 0 .
8% of the doing KD with ﬁne-tuned teacher without DP.
Evolving Teacher to Student Models via Pruning
As the previous section presents, the Knowledge Distillation approach to model compression has two main drawbacks in the private world:
• Drop in accuracy: There is a considerable drop in the accuracy between the teacher and the student models.
• Good initialization of students is crucial:
The best performance is obtained by students who already have a good initialization; in our experiments, pre-trained DistilBERT mostly achieved the best student performance.
Finding a good initialization can be challenging in practice.
Often, the student architectures are chosen to suit the hardware and latency requirements of the application for which the model is being deployed, using neural architecture search [19].
Hence, ﬁnding a good initialization for every student architecture via pre-training can be expensive and in most cases impossible.
Our zero-shot initialization strategies alleviate this problem to a certain degree, yet fall short of closing the gap between the teacher and the student performances.
Moreover, DPKD requires that (i) the teacher is trained with DPSGD and (ii) the student is distilled via DPSGD.
This two-step approach creates additional overheads in terms of training.
Given these limitations, it is natural to ask: Can we evolve the teacher to a student model while ﬁne-tuning with DPSGD?
In this section, we explore an answer to this via structured and unstructured pruning with privacy, which allows us to obtain student models that are as good as the teacher models.
5.1 Model Compression via Pruning
Pruning algorithms are a broad class of model compression techniques where one drops the parameters from a model during or after the training process.
Many works have shown that eliminating unnecessary parameters of neural networks via pruning can lead to sparser and compressed models that have shorter inference times without loss in performance [32, 27, 26].
For example, in magnitude pruning , one of the most widely used pruning techniques, we prune a fraction of parameters with the lowest magnitude.
However, there are several pruning strategies, and we refer the readers to [35] for more details and references.
Pruning can be implemented in both structured and unstructured ways.
In structured pruning, all the pruned weights belong to a single building block of the model.
For example, a 6-layer 12 -BERT can be obtained by pruning 6 layers from the full BERT model, which consists of 12 transformer blocks.
On the other hand, in unstructured pruning, pruned weights may be spread across all the layers of the network.
In unstructured pruning, it is possible to obtain a 50% sparse student model while still having all the 12 layers of BERT.
Depending on the hardware architectures, inference latency between models with structured and unstructured sparsity could be quite different.
However, in this section, we use sparsity as the main measure of model compression , which is also well accepted in the community [35, 29].
5.2 Iterative Magnitude Pruning (IMP)
Private pruning techniques we study in this section are based on the Iterative Magnitude Pruning (IMP) method, which is a speciﬁc pruning technique proposed in a recent work on Lottery Ticket
Hypothesis [20].
The idea behind IMP is rather simple: As we train a deep learning model, after every N iterations we prune an ↵ % of the weights with the lowest magnitude .
We repeat this process until we achieve the desired sparsity.
Here, both N and ↵ are hyperparameters that need to be tuned.
For example, to achieve 50% sparsity, one can perform 5 N iterations where after every N iterations additional 10% of the weights with the least magnitudes are dropped.
As speciﬁed IMP produces unstructured sparsity.
However, we consider a simple modiﬁcation of the IMP algorithm to produce structured sparsity as well.
Structured DPIMP
We ﬁrst attempt to obtain a student model from the teacher model via a structured IMP technique, using the following modiﬁcation: During ﬁne-tuning the teacher model with DPSGD, we progressively drop an appropriately chosen transformer block from the teacher model at the end of every N iterations.
We repeat this process until we obtain the student model with the required sparsity.
The layer to drop is chosen using the following heuristic: Let ↵ > 0 be a hyperparameter.
At the end of N iterations, ﬁx bottom (by magnitude) ↵ % of all model weights, and denote it by W min .
For the i th transformer block, let W i denote the set of model weights belonging to that block.
Among all the transformers blocks we ﬁnd the block i ⇤ that has the highest number of weights from the set W min ; Formally, i ⇤ :=
arg max i { W i \ W min } , and we prune the transformer layer
i ⇤ .
We present this in Algorithm 2.
We note that the algorithm satisﬁes ( ✏ ,  ) -DP after the pruning steps due to the post-processing property of differential privacy.
[Table]
Empirical Evaluation We evaluate our structured pruning algorithm with the same setup described in Section 4.3, and provide the hyperparameters in Appendix A.2.
We split the privacy budget equally among all the iterations of the algorithm.
Our goal is to produce a student model which has 12 as many layers as the full BERT model.
Table 7 shows the results for this setting where we compare structured DPIMP to private ﬁne-tuning of the pre-trained DistilBERT and the full BERT model.
The main takeaway from this experiment is:
• DP structured pruning algorithm produces a student model that has performance comparable to that of DistilBERT.
Further, it avoids the pre-training cost associated with DistilBERT. 5.4 Unstructured DPIMP The structured pruning produces student models that are as good as DistilBERT; our next target is to produce student models that are as good as the full teacher BERT model.
Towards that, we explore unstructured pruning techniques, in particular differentially private version of the IMP algorithm.
As we ﬁne-tune the deep learning models using DPSGD, after every N iterations we prune increments of ↵ % of the weights with lowest magnitude.
The remaining weights are then reset to the original pre-trained initialization.
(We do this step to establish connections to Lottery Ticket
Hypothesis, see below.)
We repeat this process until we achieve the desired sparsity.
We note that the initialization of the ﬁnal student model’s non-zero parameters at the end of the pruning step are still non-private, even though weights correspond to pre-trained model weights.
This is due to the fact that pruned parameters are found during the ﬁne-tuning process, which makes use of the private dataset.
Therefore, the whole process must be performed with DPSGD to produce a private student model.
Finally, we perform additional ﬁne-tuning of the pruned student model by using DPSGD for
M more iterations.
We call the private variation of this procedure Unstructured DPIMP.
We formally present this process in Algorithm 3.
Algorithm Empirical Evaluation We refer to the student model produced by Algorithm 3 as SparseBERT and indicate the sparsity level in brackets.
We allocate the privacy budget equally among all iterations of
Algorithm 3.
Table 8 summarizes our experiments on unstructured pruning via DPIMP.
We compare the performance of our student model to pre-trained DistilBERT (whose parameter count is the same as our ﬁnal student model) and the full-sized BERT teacher model.
The main takeaways are:
• DPIMP produces a student model that has better performance compared to DistilBERT.
[Table]
• The average performance of DPIMP is within 2% of the full BERT model.
We conclude that unstructured pruning techniques are more effective in closing the gap between the teacher and the student models in the private world.
Moreover, pruning methods are computationally cheaper as student models do not require pre-training on public data. • DPIMP algorithm as described in Algorithm 3 at the end of line 6 ﬁnds sparse subnetworks in the pre-trained BERT model that can be ﬁne-tuned to obtain nearly matching teacher performance.
This is similar to Lottery Ticket Hypothesis work for BERT networks [11], although in the private world performance of the student network is not matching that of the teacher.
Conclusions and Future Directions
In this paper we initiated the study of differentially private model compression via Knowledge
Distillation and Pruning
[Table] and gave frameworks for implementing both.
Our work shows that one can obtain student models whose performance comes within 2% of the full teacher models while having 50% fewer parameters, which can lead to signiﬁcant reduction in memory and improve inference time.
We believe that our work takes the ﬁrst step in the intersection of private training and model compression techniques [Table] and opens a whole in direction with plenty of interesting and important problems.
We highlight some of them here. • Better Algorithms For Model Compression : While we gave natural DP adaptations of KD and pruning algorithms, we believe that there are plenty of new techniques to explore. • Better Accounting :
In all our results, we chose very simple strategies for allocating privacy budget across various steps of training and pruning.
Theoretical innovations in the form of better accounting can further improve the performance of student models.
• Lottery Tickets for DP-training?
Both in our experiments on KD and in pruning, we see that models that have "good initialization" lead to dramatic improvements in performance.
Moreover our DPIMP algorithm ﬁnds sparse subnetworks in pretrained BERT models at 50% sparsity that can be ﬁne-tuned to obtain nearly matching teacher performances.
This raises an intriguing question akin to Lottery Ticket Hypothesis: Are there good initialization of models where dynamics of DPSGD is similar to SGD?
We believe that this is an exciting research direction both from a theoretical point of view and also its implications to practical private training
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] , see Sections 1.1 and(c)
Did you discuss any potential negative societal impacts of your work?
[N/A] , we are studying and evaluating differentially private model compression.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[N/A] , See Section 4.
The paper is empirical, we only recite existing theoretical work that we build our experiments on.
(b) Did you include complete proofs of all theoretical results?
[N/A] We are not introducing new theoretic notions.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] , we have included the dataset names (publicly available) and all of our hyperparameters and package versions.
See Sections 4.3, A.1, and A.2.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] , See Sections 4.3, A.1, and A.2.
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[No] .
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] , see Section A.1.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] (b) Did you mention the license of the assets?
[N/A] (c) Did you include any new assets either in the supplemental material or as a URL?
[No] (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
[N/A] (e) Did you discuss whether the data you are using/curating contains personally identiﬁable information or offensive content?
[N/A] 5.
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include
the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]