Understanding Gradient Clipping in Private SGD: A Geometric Perspective

By Xiangyi Chen, Zhiwei Steven Wu, Mingyi Hong. 2020

250 citations recorded by the source corpus.

Deep learning models are increasingly popular in many machine learning applications where the training data may contain sensitive information. To provide formal and rigorous privacy guarantee, many learning systems now incorporate differential privacy by training their models with (differentially) private SGD. A key step in each private SGD update is gradient clipping that shrinks the gradient of an individual example whenever its L2 norm exceeds some threshold. We first demonstrate how gradient clipping can prevent SGD from converging to stationary point. We then provide a theoretical analysis that fully quantifies the clipping bias on convergence with a disparity measure between the gradient distribution and a geometrically symmetric distribution. Our empirical evaluation further suggests that the gradient distributions along the trajectory of private SGD indeed exhibit symmetric structure that favors convergence. Together, our results provide an explanation why private SGD with gradient clipping remains effective in practice despite its potential clipping bias. Finally, we develop a new perturbation-based technique that can provably correct the clipping bias even for instances with highly asymmetric gradient distributions.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Tempered Sigmoid Activations for Deep Learning with Differential Privacy (2020, background): “According to (Song, Thakkar, and Thakurta 2020; Chen, Wu, and Hong 2020), gradient clipping can introduce bias that significantly affect model utility.”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, background): “More importantly, the clipping norm 𝐶 introduces a bias-variance trade-oﬀ (Chen et al., 2020; Thakkar et al., 2021).”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, background): “However, one can obtain convergence to a stationary point15 (both for the empirical loss and the population loss) under certain assumptions (Wang et al., 2019a; Chen et al., 2020; Song et al., 2021; Bu et al., 2021; Das et al., 2022; Arora et al., 2022).”