[Paper Review] Differentially Private Learning with Adaptive Clipping

Galen Andrew, Om Thakkar+2 more|arXiv (Cornell University)|May 9, 2019

Privacy-Preserving Technologies in Data35 references89 citations

TL;DR

This paper proposes privately estimating and clipping to a target quantile (e.g., median) of per-user update norms during DP-FedAvg, enabling adaptive, private clipping without tuning a fixed clip value, and showing strong utility across federated tasks.

ABSTRACT

Existing approaches for training neural networks with user-level differential privacy (e.g., DP Federated Averaging) in federated learning (FL) settings involve bounding the contribution of each user's model update by clipping it to some constant value. However there is no good a priori setting of the clipping norm across tasks and learning settings: the update norm distribution depends on the model architecture and loss, the amount of data on each device, the client learning rate, and possibly various other parameters. We propose a method wherein instead of a fixed clipping norm, one clips to a value at a specified quantile of the update norm distribution, where the value at the quantile is itself estimated online, with differential privacy. The method tracks the quantile closely, uses a negligible amount of privacy budget, is compatible with other federated learning technologies such as compression and secure aggregation, and has a straightforward joint DP analysis with DP-FedAvg. Experiments demonstrate that adaptive clipping to the median update norm works well across a range of realistic federated learning tasks, sometimes outperforming even the best fixed clip chosen in hindsight, and without the need to tune any clipping hyperparameter.

Motivation & Objective

• Motivate the difficulty of choosing a fixed clipping norm in user-level DP with Federated Averaging.
• Introduce a privately estimable quantile clipping mechanism to track a specified norm quantile (e.g., median) of updates.
• Demonstrate compatibility of adaptive clipping with DP-FedAvg, compression, and secure aggregation.
• Empirically compare adaptive clipping to fixed clipping across realistic FL tasks and show scenarios where it matches or surpasses fixed clipping without tuning.

Proposed method

• Define a quantile-based clipping loss that yields the gamma-quantile of update norms.
• Use online gradient descent (with a geometric update) to track the clipping threshold C toward the gamma-quantile of the update-norm distribution.
• Privately estimate the clipped-update indicator sum by adding Gaussian noise to the count before updating C, ensuring differential privacy.
• Augment FedAvg with server momentum and private adaptive clipping to obtain DP-FedAvg-M, and relate its privacy to a non-adaptive DP-FedAvg via a stated equivalence.
• Provide practical defaults (e.g., sigma_b = m/20, eta_C = 0.2) and a privacy analysis for the quantile-tracking process.
• Present a DP accounting result that the sequence of quantile estimates satisfies (0.034, n^{-1.1})-DP under RDP composition across rounds.

Experimental results

Research questions

• RQ1 Can adaptive clipping to a target update-norm quantile (e.g., median) provide DP-FedAvg with better or comparable utility to fixed clipping without hyperparameter tuning?
• RQ2 How can the clipping threshold be updated privately and efficiently to track a quantile of the update-norm distribution in a federated setting?
• RQ3 What is the impact of adaptive quantile clipping on privacy loss and noise amplification compared to fixed clipping?
• RQ4 Is DP-FedAvg-M compatible with common FL techniques like compression and secure aggregation while preserving DP guarantees?

Key findings

• Adaptive clipping to the median (gamma = 0.5) generally improves or matches performance relative to unclipped baselines across multiple tasks.
• In most tasks, adaptive clipping performs as well as or better than any fixed clip chosen in hindsight, without hyperparameter tuning.
• Compared to fixed clipping, the adaptive approach often yields higher utility given the same privacy budget, and requires no tuning of a clipping hyperparameter.
• The proposed DP-FedAvg-M with adaptive clipping remains compatible with compression and secure aggregation.
• Quantile tracking with geometric updates converges to the target quantile and can be private with small additional privacy cost (e.g., negligible when m is large).
• With practical defaults (sigma_b = m/20, eta_C = 0.2), the adaptive method incurs only modest incremental noise on updates while achieving DP guarantees.