Task-level Differentially Private Meta Learning
Abstract
We study the problem of meta-learning with task-level differential privacy.
Metalearning has received increasing attention recently because of its ability to enable fast generalization to new task with small number of data points.
However, the training process of meta learning likely involves exchange of task specific information, which may pose privacy risk especially in some privacy-sensitive applications.
Therefore, it is important to provide strong privacy guarantees such that the learning process will not reveal any task sensitive information.
To this end, existing works have proposed meta learning algorithms with record-level differential privacy, which is not sufficient in many scenarios since it does not protect the aggregated statistics based on the task dataset as a whole.
Moreover, the utility guarantees in the prior work are based on assuming the loss function satisfies both smoothness and quadratic growth conditions, which do not necessarily hold in practice.
To address these issues, we propose meta learning algorithms with task-level differential privacy; that is, our algorithms protect the entire dataset for each task.
In the case when a single meta model is trained, we give both privacy and utility guarantees assuming only that the loss is convex and Lipschitz.
Moreover, we propose a new private clustering-based meta-learning algorithm that enables private meta learning of multiple meta models.
This can provide significant accuracy gains over the single meta model paradigm, especially when the tasks distribution cannot be well represented by a single meta model.
Finally, we conduct several experiments demonstrating the effectiveness of our proposed algorithms.
Introduction
Meta learning has received increasing attention recently due to its successful applications in a variety of machine learning domains.
Meta learning is the process in which existing learning tasks are used to infer a learning rule that enables faster adaptation to new tasks from the same environment.
Specifically, meta learning takes in a collection of tasks (datasets) sampled from an unknown distribution.
Each task defines a learning problem with respect to an input dataset.
The goal of meta learning is to output a meta-learner which can extract the shared knowledge among the tasks (datasets) and generalize well on a newly sampled task (dataset) with a small number of data points.
The performance of a meta learner is measured by transfer risk , defined as the expected risk of the output of the algorithm w.r.t.
a newly sampled task.
Machine learning algorithms typically rely on gradient-based optimization methods.
The optimizationbased meta learning framework allows such methods to converge to a solution using a small number of samples.
This is done by learning either a good parameter initialization or a regularizer.
In meta initialization methods like MAML [1] and Reptile [2], the meta leaner obtains a meta initialization wsuch that one or a few gradient updates of w 0 produces a good task-specific model for new tasks.
Another class of meta learning algorithms are based on an approach known as meta-regularization [3–6] in which a regularizer is first learned based on all tasks datasets, then a task-specific model is obtained for a new task by minimizing the regularized loss.
Meta-regularization has received more attention recently due to its formal utility guarantees and computational efficiency.
In meta-regularization, the goal is to find a good bias vector h
such that a local learner (base learner) can converge to a good task-specific model by minimizing the regularized empirical loss: min w ∈W R Z ( w ) + λ 2 ∥
w − h ∥ 2 .
In [7], the authors formalize the connection between meta-initialization and meta-regularization under the framework of online convex optimization.
Meanwhile, the nature of the meta learning requires the exchange of task-specific information, which may pose serious privacy risks, especially in distributed settings where all tasks (users) are participating into a meta training process by communicating meta-model updates among themselves, typically with the assistance of a central server.
Therefore it is important to ensure that the sensitive information in every task (dataset) remains private through the meta learning process.
Despite its importance, the privacy aspect of meta learning is still underexplored.
In [8], using the meta-initialization framework, the authors propose a meta-learning algorithm with record-level differential privacy (DP) and give an accuracy guarantee in terms of the transfer risk .
Record-level DP is a weak privacy guarantee for a wide range of scenarios.
Imagine training an email spam filter for each user (task).
Even if we ensure differential privacy w.r.t.
each record of a user’s email, aggregate statistics across the entirety of a user’s records (e.g., the frequency of certain words or sentences) may still reveal some sensitive information which the user doesn’t want to share.
Moreover, the accuracy guarantees in [8] rely on relatively strong assumptions concerning the loss function used for training.
In particular, the loss function
therein
is
assumed
to satisfy
both
smoothness and quadratic growth conditions, which do not hold simultaneously for many loss functions commonly used in practice.
In this work, we propose new meta-learning algorithms with task-level DP and derive formal transfer risk bounds.
Unlike [8], our algorithms are based on the meta-regularization framework.
We now highlight our main technical contributions:
• We propose a task-level differentially private (task-level DP) meta learning algorithm based on the meta-regularization approach.
We observe that when the meta-loss is properly defined, one can view each task dataset as a “data point” and the meta-loss as its corresponding loss function.
Therefore, applying existing DP optimization techniques like Noisy SGD on the newly defined "data point" and loss function achieves task-level differential privacy naturally.
• We give a bound for the statistical performance for our algorithm in terms of its excess transfer risk.
Our statistical accuracy guarantee holds under standard assumptions; namely, assuming only that loss function is convex and Lipshitz.
With sufficiently large number of tasks, the bound asserts improved performance over local training, where a model is trained locally based on a single task dataset.
• When the task distribution becomes more complex such that a single meta model is not enough to capture the relationship among tasks, we propose a task-level DP clustering-based meta learning algorithm that can learn multiple meta models.
This approach can provide significant improvements in the statistical accuracy (transfer risk) over the standard single-model case, especially when the tasks distribution is better captured by multiple meta models.
• We empirically evaluate our algorithms to demonstrate the effectiveness of our proposed algorithms 1 .
Related work: The most related work to ours is [8], where the authors propose a meta-learning algorithm with record-level DP via the framework of meta-initialization.
Their analysis relies on assuming that the loss function satisfies a quadratic growth condition, which we do not require in our analysis.
Furthermore, we consider a stronger notion of the excess transfer risk than the one in [8].
To be more specific, in [8], the achieved transfer risk is compared to the transfer risk of the optimal global model, while the transfer risk in our work is compared to that of the optimal personalized model.
This is because we allow different tasks to have different parameters.
Since the optimal personalized model always outperforms global model, we have a stronger notion of the excess transfer risk.
Consequently, our utility guarantee also holds under the notion studied in [8].
Our results are also related to the line of work in private model personalization.
The goal of model personalization is to train a personalized model for each user that generalizes well on the user’s distribution.
Reference [9] proposes a private personalization algorithm that solves a stochastic optimization problem involving both local and global models.
The authors of [10] develop an algorithm for mean-regularized multi-task learning under the joint differential privacy guarantee and study its application in model personalization.
The work of [11] presents private personalization algorithms that learn a common embedding model among users using the alternating minimization framework, where convergence to the optimal solution is guaranteed for linear regression models with Gaussian data.
There are also a variety of works, mainly in the non-private regime, exploring the connection between meta learning and model personalization.
For example, [12] proposes a personalization mechanism based on MAML, which aims at finding a good initialization parameter for the users.
The authors of [13] study the connection between meta learning and personalization based on the observation that FedAvg [14] can be seen as a meta learning algorithm.
Therefore, it is possible to extend the results in this work to the domain of model personalization.
There are also prior works studying learning with task-level or user-level differential privacy but under different learning paradigms.
In [15, 16], the authors provide user-level differential privacy under the framework of federated learning, in which case all users share a single global model.
This is different from our setting because we allow each user to have its own task-specific model.
The authors in [17] develop algorithms for a variety of learning tasks under user-level differential privacy.
They consider a limited heterogeneity setting where all users’ distributions are close to each other in total variation distance.
On the other hand, in this work we focus on the meta learning paradigm, where we only assume small variation across users’ models.
Preliminaries
Distributional setup: We consider a meta distribution ρ and each task is sampled from ρ which will induce a task specific distribution µ over the data domain Z , that is µ 1 , . . .
µ K i.i.d ∼ ρ for K tasks.
After the sampling of µ i , a dataset Z i with n datapoints is subsequently sampled from µ i written as
Z i = { z 1 , . . .
z n } i.i.d ∼ µ ni .
The collection of K task datasets is denoted as
[Equation]
In this paper, we focus on distributed settings such that the datasets { Z i } Ki =1 are decentralized across multiple locations.
All tasks jointly participate into a model training process coordinated by a trusted central server.
The data of each task is stored and processed locally, only the model updates are shared to the server or other tasks.
Task population and empirical losses: Given a closed convex parameter space W , we consider learning task parametrized by vector w ∈ R d .
We let ℓ : R d × Z
→ R be a loss function, where ℓ ( w, z ) is the loss incurred by a parameter vector w on a data point z .
For any task drawn from a distribution µ and observed via a dataset Z = ( z 1 , . . .
z n ) , we denote the population risk of w ∈ W as R µ ( w ) =
E z ∼ µ ℓ ( w, z ) and the empirical risk as R Z ( w ) = 1 n (cid:80) n i =1 ℓ ( w, z i ) .
Meta learning :
Given K learning tasks with datasets ¯ Z , a meta-learning process aims to learn an algorithm A that enables fast adaption on newly sampled tasks from the meta-distribution ρ .
Such adaptation is measured by the notion of transfer risk defined as
[Equation]
The transfer risk E n ( A ; ρ ) can be considered as the expected loss of the parameter returned by applying the algorithm A on a dataset Z ∈ Z n sampled from the meta distribution ρ .
In summary, the whole process starts with a meta-learning algorithm taking ¯ Z as input and outputting a learning algorithm A .
After that, new learning task with distribution µ ∼ ρ trains its corresponding dataset with the learned algorithm A and apply the resulting parameter vector w to new data drawn from µ .
For any task specific distribution µ , we denote the minimizer w µ as w µ ∈ min w ∈W R µ ( w ) and the expected minimum error over the meta-distribution ρ as E ρ = E µ ∼ ρ R µ ( w µ ) .
Note that, there might be more than one minimizers of R µ ( w ) , but E ρ remains same regardless of the selection of w µ .
Furthermore, we define the excess transfer risk as
[Equation]
Task similarity metric: To achieve low transfer risk, the meta learning algorithm leverages the shared similarity among tasks and output the optimized inner algorithm.
In this work, the task similarity is measured by the quantity:
[Equation]
where W µ is the set of optimal parameters for task µ written as W µ = arg min w ∈W R µ ( w ) , and Proj W µ denotes the Euclidean projection on W µ .
V can be roughly seen as the expected variation of task parameters.
We denote ¯ w as the minimizer of (3) such that ¯ w ∈ W and
V
[Equation]
Task-level Differential Privacy [18]: A randomized algorithm M is ( ϵ, δ ) -differential private if for any pair of neighboring sets ¯ Z and ¯ Z ′ and for any measurable subset O of Range ( M ) , we have
[Equation]
In this work, we consider task-level neighboring relationship.
Let ¯
Z = { Z 1 , . . .
Z K } and ¯ Z ′ =
{ Z ′ 1 , . . .
Z ′ K } , and we say ¯ Z and ¯ Z ′ are neighboring
if, for some i ∈ [ K ] , ¯ Z and ¯ Z ′ differ only on the dataset from the i th task,
i.e., Z j = Z ′ j
for all j except i .
Therefore, a task-level differential private algorithm ensures that any adversary cannot tell if the dataset of a particular task was used in the algorithm given its output.
Our analysis involves the following fairly standard assumption:
Assumption 1.
(Convex-Lipschitz-Bounded models)
• For any z ∈ Z , the loss function ℓ ( w, z ) is convex and L -Lipshitz with respect to w .
• Bounded parameter space: ∥W∥ 2 = max w 1 ,w
[Equation]
Learning with Meta Regularization
Base learner: A base learner solves a regularized loss minimization problem w.r.t.
a biased regularizer parameterized by a bias vector h .In particular, given a bias vector h and a task dataset Z , the base learner solves the following problem:
[Equation]
where λ is the regularization parameter.
In the sequel, we define w h ( Z ) as the minimizer of
R Z,λ ( w ; h ) , that is w h ( Z ) =
arg min w ∈W R Z,λ ( w ; h ) .
Meta algorithm: Given a collection of base learners, the goal of a meta-algorithm is to find a good regularization bias h that yields a small transfer risk.
First, let’s rewrite the transfer risk defined in (1) as a function h :
[Equation]
and hence the excess transfer risk can be expressed as ∆ E n ( h ; ρ ) =
E n ( h ; ρ ) − E ρ .
Therefore, the goal of the meta algorithm is to find an (approximate) minimizer h ∗ of E n ( h ; ρ ) in (4), i.e., the goal is to solve:
[Equation]
Intuitively speaking, the base learner aims to figure out the best parameter vector “around” the bias vector h .
Therefore, if the meta algorithm can find a good bias vector h that is close to the solution space of the tasks, the base learner can converge to its solution space quickly by only searching around h .
3.1 Meta Loss and proxy transfer risk
Directly optimizing over (5) above is usually infeasible.
A common strategy to get around this difficulty is to propose a proxy loss function which is related to the transfer risk but easier to handle.
In this section, we follow the definitions in [3, 4] and define our meta loss as
[Equation]
and the proxy to the transfer risk is defined as
[Equation]
The goal of the meta-algorithm is to optimize the proxy risk over h , that is,
[Equation]
Note that L Z ( h ) is in fact the Moreau envelope of the empirical loss R Z ( w ) .
In Proposition 2, we review some useful properties of L Z ( h ) which will help our analysis.
Proposition 2.
(follows from [19, 20])
Under Assumption 1, we have
L Z is convex, 2 L -Lipshitz and λ -smooth.
For any h ∈ W , ∇ L Z ( h )
= − λ ( w h ( Z ) − h ) where w h ( Z ) =
arg min w ∈W R Z,λ ( w ; h ) .
A key observation is that all datasets go through the same stochastic process under our distributional setup and thus can be seen as i.i.d.
sequence drawn from a distribution P Z .
Therefore, (6) can be rewritten as
[Equation] [Equation]
Combined with Proposition (2), the objective of the meta algorithm is formulated as a stochastic convex optimization (SCO) problem which has been well studied under privacy constraints [19, 21, 22].
The notion of task-level differential privacy just comes up naturally when we see each task dataset Z as a “data point” and L Z ( h ) as its loss function, therefore the conventional record-level neighboring relationship can be readily translated to a task-level neighboring relationship.
However, one challenge in adapting existing differentially private SCO methods pertains to the gradient computation.
In standard SCO settings, we are expected to be able to compute the gradient of the loss function efficiently and precisely.
However, in our case, as seen in Proposition 2, computing ∇ L Z ( h ) for each h requires computing w h ( Z ) which further involves solving a λ -strongly convex optimization problem.
Therefore, finding the exact value of w h ( Z ) for general convex loss ℓ is not feasible, alternatively what we can do is to approximate w h ( Z ) using some iterative methods up to some error b .
Therefore, it is important to incorporate this approximation error into our convergence analysis.
Moreover, due to the distributed nature of the algorithm, the model iterates are assumed to be visible to multiple tasks who are selected to participate in each round.
Therefore, the privacy should be defined over all model iterates as well as the final model, and we cannot use the lineartime algorithm for DP smooth stochastic optimization [22] despite the fact that the objective of the meta-algorithm can be formulated as a stochastic convex optimization problem with a smooth loss.
Private Meta Learning with Noisy SGD
In this section, we present our meta learning algorithm adapted from the mini batch noisy SGD method in [19] described in Algorithm 1 .
In iteration t , given the current iterate h t , each sampled task computes an approximation of the gradient of the meta loss L Z ( h t ) , denoted as ˆ ∇ L Z ( h t ) .
After that, the server aggregates theses approximate gradients to update the model.
The privacy is achieved by adding Gaussian noise scaled with the l 2 sensitivity of each task to the model iterate.
We will first describe the privacy and utility guarantee of Algorithm 1, and then show the resulting transfer risk.
Theorem 3.
(Privacy guarantee)
Let Assumption 1 holds and let { h 1 , . . .
h T − 1 } and ¯ h T be the output, Algorithm 1 is ( ϵ, δ ) -differentially private on task level.
Proof.
Since the computed gradient ˆ ∇ L Z ( h t ) is only an approximation to ∇ L Z ( h t ) , then we have
[Equation]
and because ∇ L Z ( h ) is 2 L -Lipshitz by Proposition 2 , we have
[Equation]
where Proj W denotes the Euclidean projection onto W , and G t ∼ N (0 , σ 2 I d ) drawn independently
Note that Algorithm 1 has the similar structure of the mini-batch noisy SGD method in [19] if we consider ˆ ∇ L Z ( h t ) as the model updates and h t as model iterates.
By adding Gaussian noise scaled with (2 L + b ) , a direct application of Theorem 3.1 in [19] completes the proof.
Since the objective of the base learner R Z,λ ( w ; h t ) is a λ -strongly convex problem, one can use gradient decent to bound the approximation error at step 5 in Algorithm 1.
Alternatively, the base learner can use other stochastic optimization method i.e. SGD to achieve a high probability bound on the approximation error, such that ∥ ˆ w h t ( Z ) − w h t ( Z )
∥
≤ bλ with probability over 1 − δ ′ .
By letting the overall failure probability mTδ ′ on the same order of the privacy parameter δ , the privacy guarantee still holds.
For the simplicity of the analysis, we assume the approximation error ∥
ˆ w h t ( Z ) − w h t ( Z ) ∥ ≤ bλ always satisfies.
In the next theorem, we will give the excess risk of A meta-NSGD
Theorem 4.
(Utility guarantee)
Under Assumptions 1, suppose λ ≤ 2 LM · min (cid:18)(cid:113) K 2 ,
[Equation]
Let T = min (cid:16) K 8 ,
[Equation]
=
M
[Equation]
T and b = 2 LK .
Then,
[Equation]
where ¯ h T is the final model output by Algorithm 1, and the expectation is taken over the collection of datasets ¯ Z and the inner randomness of the algorithm.
Note that the excess rate in Theorem 4 is with respect to ˆ E n ( h ; ρ ) , the proxy to the transfer risk.
It remains to show how it can be related to the excess rate of the true transfer risk E n ( h ; ρ ) .
In the next theorem, we give the excess transfer risk of Algorithm 1.
The proof follows from [Theorem 6, [3]] and decomposes the excess transfer rate into three components.
We bound each component separately and one of them is based on the excess rate achieved in Theorem 4.
Theorem 5.
(Transfer risk) Recall the settings in Theorem 4, we have
[Equation]
By letting λ = 2 LV (cid:113) 1 n , we have
[Equation]
where ¯ h T is the output of A meta-NSGD and the expectation is taken w.r.t.
¯ Z and the inner randomness of the algorithm.
Theorem 5 shows that when the number of tasks K is sufficiently large, the excess transfer risk becomes O (cid:16) LV √ n (cid:17) .
Recall that V is a measure of task similarity, hence when the optimal task parameters are close to each other, V can be much smaller than the diameter of the parameter space which indicates better performance than local training where each task trains its own model independently.
Note one can also give a direct bound of the transfer risk of the output of Algorithmbased on the fact that (cid:13)(cid:13) ¯ h T − w µ (cid:13)(cid:13)
≤ ∥W∥ = M for any task µ with optimal parameter w µ , standard derivation gives that E [ E n (¯ h T ; ρ )] − E ρ ≤ O (cid:16) LM √ n (cid:17) which is the same as the excess risk for local training.
Therefore, Algorithm 1 is at least as good as local training, in the worst case, it recover the performance of local training.
The rate achieved in Theorem 5 is on the same order of the non-private rate O (cid:16) V L √ n + ML √ K (cid:17) from [3] in the regime most common in practice where d = O ( K ) and ϵ = θ (1) .
Note that [8] obtains
O (cid:0) 1 K (cid:1) convergence on the number of tasks K under record-level privacy guarantee, but their analysis relies on the assumption for the loss function to be α -quadratic growth, which we do not require for our analysis.
Furthermore, we have different definitions of excess transfer risk from [8], given the meta learner
A h , the excess transfer risk in [8] is defined as E n ( A h ; ρ ) − min w ∈W E µ ∼ ρ R µ ( w ) while ours is defined as E n ( A h ; ρ ) − E µ ∼ ρ [min w ∈W R µ ( w )] .
Since min w ∈W E µ ∼ ρ R µ ( w ) ≥
E µ ∼ ρ [min w ∈W R µ ( w )] , our bound holds under a stronger definition for the excess transfer risk.
Hence, our bound is a valid upper bound for the notion defined in [8].
The detailed proofs of
Theorems 4 and 5 can be found in the appendix.
Communication-efficient, private meta Learning with DP-FTMRL Although Algorithm 1 gives a transfer risk comparable with the non-private rate, it requires O (cid:16) min (cid:110) √ K, K 3 / 2 /d (cid:111)(cid:17) rounds of communication to each task on average.
This can be expensive when the task number K is large but each task only has limited computation and communication resource, which is a common setting in distributed scenarios like federated learning.
Therefore, we introduce a communication efficient
DP meta algorithm Differentially Private Follow-the-Meta-Regularized-Leader (DP-FTMRL) which is based on the DP-FTRL algorithm in [23].
DP-FTMRL is a one-pass algorithm which means that every task will be communicated by the server for only once.
Furthermore, it processes each task sequentially thus allows tasks to arrive in a stream.
With high probability over the algorithm inner randomness, DP-FTMRL obtains transfer risk of ˜ O (cid:16) LV √ n + ML (cid:16) 1 √ K + d 1 / 4 √ Kϵ (cid:17)(cid:17) .
This rate is suboptimal compared with the one achieved in Theorem 5, but DP-FTMRL provides significant savings on the communication cost.
More details of DP-FTMRL can be found in the appendix.
Note: To get the excess transfer risk guarantee in Theorem 5, we need to set λ
= 2 LV 1 √ n which requires the knowledge of the value of V , the task similarity.
In fact, we can privately approximate V using its empirical counterpart; in particular, we can find a private counterpart for ˆ V 2 ≜ min ϕ ∈W 1 K (cid:80)
Ki =1 ∥ ϕ − ˆ w ( Z i ) ∥ 2 where ˆ w ( Z i ) is a minimizer of the empirical loss of task
Z i .
This can be done using standard DP convex optimization methods such Noisy Gradient Descent.
An alternative approach to choose a setting for λ , which is quite common in practice, is to treat λ as a hyperparameter [4] and tune it privately.
This can also be done using existing methods in the literature of DP [24, 25].
Private Clustering-Based Meta Learning
In this section, we consider the case where the tasks are sampled from distribution with multiple concentrations (e.g., a multi-modal distribution) where a single meta model is not enough to capture the relationship among tasks.
A natural extension is to cluster the tasks into several groups and train a meta model for each group.
To provide a more formal treatment, we let q denote the number of possible meta models (clusters), each is parametrized with a bias vector h i .
These meta models are denoted as ( h 1 , h 2 , . . .
h q ) .
The task similarity in the presence of q meta modals is hence modified to
[Equation]
Recall that W µ is the set of optimal parameters for task µ .
Note that V c is no larger than V from single meta learner case defined in (3).
In the case when { W µ } contains multiple disjoint and far apart concentrations, V c can be much smaller compared with V .
In particular, inspired by the idea of hypothesis based clustering from [26], we define the objective of the meta-algorithm with q meta learners as
[Equation]
where L Z ( · ) is the meta loss.
Given h
=
( h 1 . . .
h q ) , the base learner with dataset set
Z first chooses the h i with lowest meta loss, that is, C ( Z ) =
arg min i ∈
[ q ] L Z ( h i ) and output the corresponding minimizer w h C ( Z ) ( Z ) =
min w ∈W R Z,λ ( w ; h C ( Z ) )
=
min w
[Equation]
R Z ( w ) +
[Equation]
(cid:13)(cid:13)
w − h C
( Z ) (cid:13)(cid:13) 2 .
Therefore, the transfer risk is defined as
[Equation]
We present our meta-clustering algorithm described in Algorithm 2, which is inspired by the HYPCLUSTER algorithm in [26].
Algorithm 2 is a heuristic algorithm aiming at minimizing the objective (9) over h 1 , . . .
h q .
Each iteration consists of two steps, the model selection step and model update step.
At the beginning of one iteration, each sampled task selects the model from { h i } qi =1 that incurs the lowest loss.
After the assignment is done, the server will update each model with its corresponding tasks.
We formally show the privacy guarantee of Algorithm 2.
The performance of this algorithm in terms of its transfer risk will be evaluated empirically since convergence to a true optima is not guaranteed due to the non-convexity of ˆ E n ( h , ¯ Z )) in h .
Algorithm input : q randomly initialized iterates h 10 , h 20 , . . .
h q 0 , number of iterations T , batch size m 1 Set noise variance σ 2 = 8 T (2 L + b ) 2 log(1 /δ )
K 2 ϵ2 for t = 1 , . .
, T − 1 do
Server samples a batch of tasks B t of size m and sends { h it } qi =1 to B t for each task Z in B t do
For i ∈ [ q ] , compute approximate minimizers of R Z,λ ( w, h it ) as ˆ w ih
( Z ) with approximation error bλ
Select the model with smallest meta loss C (
) =
arg min i ∈
[ q ] R Z,λ ( ˆ w ih ( Z ) , h it )
Compute the gradient ˆ ∇ L Z ( h C
) t )
= − λ (cid:16)
ˆ w C
( Z ) Z − h C ( Z ) t (cid:17)
Send ( C ( Z ) , ˆ ∇ L Z ( h C ( Z ) t )) back to server end
For every i ∈ [ q ] , denote the set C it =
{ Z ∈ B t | C ( Z )
= i } , server updates h it as h i t +
=
Proj W   h
i t − η ·   1 m (cid:88)
[Equation]
  
 where G it ∼ N (0 , σ 2 I d ) drawn independently each iteration t and meta model i .
11 end output : { h 1 T , h 2 T , . . .
h qT }
Theorem 6.
(Privacy guarantee) Let { h 1 t , . . .
h qt } t ∈ T be the output, Algorithm 2 is ( ϵ, δ ) -differentially private on task level.
Proof.
Similar to Theorem 3, we have the norm of ˆ ∇ L Z ( h C ( Z ) t ) is bounded by (2 L + b ) for any choice of C ( Z ) .
Since each task only selects one meta model to update in each iteration, we consider { h it } qi =1 as the model iterate and ˆ ∇ L Z ( h it ) as the model update from the task, we can use the same argument in Theorem 3 to complete the proof.
Experiments
In this section, we empirically evaluate the performance of our algorithms under various privacy regimes.
On the one hand, we demonstrate the performance improvement of our algorithms over local training.
Meanwhile, when the tasks are sampled from multi-modal distribution, we show that our clustering based algorithm achieves lower transfer risk than the single meta model paradigm.
[Figure]
We consider linear regression task with mean square loss.
The weight vector w µ is d -dimentional vectors that concentrates around one or more common vectors.
We let d = 30 for all experiments.
The feature vector x is uniformly sampled from unit ball, and the label y =
⟨ w u , x ⟩ + n where n is the zero mean Gaussian noise with standard deviation equal to 0 . 5 .
Single cluster case: For each task µ , its d -dimensional weight vector w µ is sampled from Gaussian distribution with mean ¯ h and with variance σ 2 , denoted as N (¯ h, σ 2 I d ) .
In the experiment, σ = 1 and ¯ h is a vector with all entries equal to 4 .
Each task contains 10 datapoints ( x i , y i ) 10 i =1 .
The privacy parameters ϵ are chosen from { 1 , 3 , 10 } and δ is set as 10 − 5 .
We set the clipping norm to 2 and use the functions from TensorFlow privacy [27] to choose the noise multiplier to fit the privacy budget.
In
Figure 1, the transfer risks of our meta learning algorithm are substantially better than the transfer risk of local training even in high privacy regimes when ϵ = 1 .
Furthermore, by comparing the transfer risks for different ϵ ’s, we show that the performance gaps are much less significant compared with the gap between local training.
In modest privacy regimes when ϵ = 3 or 10 , the corresponding transfer risks are quite close to the non-private rate ( ϵ = ∞ ).
Multi clusters case: The weight vector is sampled from the distribution
N (¯ h, σ 2 I d ) where ¯ h is uniformly sampled from the set ¯ h
= { ¯ h 1 , . . .
¯ h t } .
In the experiment, t , the number of cluster in the underlying distribution, is set to be 3 , σ = 0 .
and we choose { ¯ h 1 , ¯ h 2 , ¯ h 3 } to be three orthogonal vectors with different norms.
More specifically, ¯ h 1 = [2 . . .
0] , ¯ h 2 = [0 , . . .
, 0 , − 4 . .
, − 4 , 0 , . . .
and ¯ h 3 = [0 , . .
6] , and each ¯ w i has 10 non-zero components.
The privacy parameters ϵ are chosen from { 3 , 10 } and δ is set as 10 − 5 , the clipping norm is set to 1 .
Furthermore, we set q , the number of meta models in Algorithm 2, from 1 to 3 and report the transfer risk with each q .
The plots in Figure 2 confirms our claim that we can achieve better performance by adding the number of meta models.
By choosing different number of meta models, the performance gap can be significant.
Meanwhile, similar to the single cluster case, with the same number of clusters, we see relatively small performance difference under various privacy parameters.
In Appendix C, we present additional experiments to evaluate our algorithms on Omniglot [28] few-shot classification tasks, where we demonstrate an improved performance over existing DP meta learning methods.
Conclusion and Future Work
In this work, we studied the meta learning problem with task-level privacy.
When a single meta model is trained, we have shown, both theoretically and empirically, that our private meta algorithm achieves better performance than local training when the variation among the tasks is relatively small.
To deal with more complex task distribution, we also proposed a private clustering-based meta learning algorithm that outputs multiple meta models.
This approach can provide noticeable performance gains over the single meta model paradigm as demonstrated by our empirical results.
An interesting direction for future work is to formally study the accuracy guarantees of our clusteringbased algorithm.
Due to the non-convexity of the objective function, theoretical analysis on the transfer risk may be challenging.
However, it is still possible to obtain a guarantee to characterize the generalization property of the clustering-based algorithm.
Acknowledgments and Disclosure of Funding
This work is supported by NSF AI-Institute Award 2112471.