[Paper Review] Three Tools for Practical Differential Privacy

Koen Lennart van der Veen, Ruben Seggers+2 more|arXiv (Cornell University)|Dec 7, 2018

Privacy-Preserving Technologies in DataComputer Science6 references22 citations

TL;DR

This paper introduces three practical tools to streamline differentially private machine learning: (1) centralized sanity checks using random noise to validate privacy parameters, (2) an adaptive clipping bound that reduces hyperparameter tuning burden, and (3) large-batch training with scaled learning rates to reduce noise and improve performance. The key contribution is a robust, low-effort workflow that maintains strong privacy guarantees while achieving competitive model accuracy, with test accuracy improving from 61.6% to 63.5% using adaptive clipping and 66.9% with large-batch training on CIFAR-10 under ε=20.

ABSTRACT

Differentially private learning on real-world data poses challenges for standard machine learning practice: privacy guarantees are difficult to interpret, hyperparameter tuning on private data reduces the privacy budget, and ad-hoc privacy attacks are often required to test model privacy. We introduce three tools to make differentially private machine learning more practical: (1) simple sanity checks which can be carried out in a centralized manner before training, (2) an adaptive clipping bound to reduce the effective number of tuneable privacy parameters, and (3) we show that large-batch training improves model performance.

Motivation & Objective

• Address the challenge of interpreting and calibrating differential privacy (DP) parameters ε and δ in real-world ML applications.
• Reduce privacy budget consumption during hyperparameter tuning by minimizing the need to train multiple models on private data.
• Develop a practical, automated workflow for differentially private deep learning that minimizes manual tuning and improves model performance.
• Demonstrate that large-batch training with scaled learning rates can reduce noise while maintaining model accuracy under fixed privacy budgets.
• Introduce adaptive clipping that dynamically adjusts gradient norms, reducing reliance on manual grid search for clipping bounds.

Proposed method

• Conduct centralized sanity checks by training a model on random noise data; if memorization occurs (i.e., high training accuracy), privacy parameters are insufficiently strict.
• Implement adaptive clipping: for each layer, update the clipping bound as $ C^{l}_{l^{2}t} = eta C^{l}_{t-1} $, where $ eta = 2 $, and initialize using the mean ℓ₂-norm from one iteration on random noise.
• Use the moments accountant to track privacy spending and ensure total ε and δ remain within budget during training.
• Scale the learning rate proportionally to batch size (e.g., $ ext{lr} imes k $ when batch size is multiplied by $ k $) to maintain training stability in large-batch settings.
• Calibrate the noise scale $ ho $ using a centralized random noise dataset until sanity checks pass, then apply the same parameters to private data training.
• Apply the adaptive clipping method with default values $ eta = 2.0 $, $ eta = 2.0 $, and $ ho = 0.725 $, reducing dependency on data-specific tuning.

Experimental results

Research questions

• RQ1 Can centralized sanity checks using random noise data effectively validate whether DP parameters are sufficiently strict to prevent memorization?
• RQ2 To what extent does adaptive clipping reduce the need for manual hyperparameter tuning of clipping bounds across different models and datasets?
• RQ3 How does large-batch training with scaled learning rates affect model performance under a fixed privacy budget in differentially private learning?
• RQ4 Can a unified set of default parameters (e.g., $ eta = 2.0 $, $ ho = 0.725 $) for adaptive clipping achieve good performance across diverse datasets without re-tuning?
• RQ5 Does combining adaptive clipping, large-batch training, and sanity checks lead to a practical, end-to-end workflow for differentially private model training with minimal privacy budget consumption?

Key findings

• Differentially private models trained on random noise data showed near-zero training accuracy (≤1.5%), confirming that DP effectively prevents memorization even with high privacy spending (ε=20).
• On CIFAR-10, test accuracy improved from 61.6% (constant clipping) to 63.5% (adaptive clipping), demonstrating the effectiveness of dynamic gradient clipping in reducing noise impact.
• Large-batch training with scaled learning rates achieved 66.9% test accuracy on CIFAR-10 under ε=20, significantly outperforming a baseline with the same batch size but unchanged learning rate (47.2%).
• The adaptive clipping method was robust to changes in $ eta $ and $ ho_{l^2} $, with doubling either parameter yielding similar performance, suggesting stability and generalizability.
• An $ eta = 2.0 $ and $ ho_{l^2} = 2.5 $ configuration maintained consistent performance across MNIST, CIFAR-10, and CIFAR-100, indicating that default values can be used across tasks.
• The proposed workflow reduced privacy budget usage during hyperparameter tuning by shifting tuning to non-private, centralized sanity checks on random data, minimizing exposure of sensitive data.