Differentially Private Learning with Adaptive Clipping

By Om Thakkar, Galen Andrew, H. Brendan McMahan. 2019

454 citations recorded by the source corpus.

Existing approaches for training neural networks with user-level differential privacy (e.g., DP Federated Averaging) in federated learning (FL) settings involve bounding the contribution of each user's model update by clipping it to some constant value. However there is no good a priori setting of the clipping norm across tasks and learning settings: the update norm distribution depends on the model architecture and loss, the amount of data on each device, the client learning rate, and possibly various other parameters. We propose a method wherein instead of a fixed clipping norm, one clips to a value at a specified quantile of the update norm distribution, where the value at the quantile is itself estimated online, with differential privacy. The method tracks the quantile closely, uses a negligible amount of privacy budget, is compatible with other federated learning technologies such as compression and secure aggregation, and has a straightforward joint DP analysis with DP-FedAvg. Experiments demonstrate that adaptive clipping to the median update norm works well across a range of realistic federated learning tasks, sometimes outperforming even the best fixed clip chosen in hindsight, and without the need to tune any clipping hyperparameter.

Subfields: Artificial Intelligence, Optimization & Training, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Optimization & Training

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, background): “These challenges could be addressed by optimization algorithms that are robust to hyperparameter settings (the same hyperparameter values work for many different real world datasets and architectures), as well as adaptive or self-tuning algorithms [381, 75].”
Practical and Private (Deep) Learning without Sampling or Shuffling (2021, background): “Differentially private empirical risk minimization (ERM) and private online learning are well-studied areas in the privacy literature [1, 2, 3, 6, 7, 14, 29, 35, 37, 38, 43, 51, 57, 58, 65, 67, 68, 74] 7 .”
The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation (2021, methodology): “We provide an open-source implementation of our methods in TensorFlow Privacy (Andrew et al., 2019) and TensorFlow Federated (Ingerman & Ostrowski, 2019).4”
Differentially Private Learning Needs Better Features (or Much More Data) (2020, background): “Thakkar et al. (2019) suggest to vary this threshold adaptively, but we did not observe better performance by doing so.”
Training Production Language Models without Memorizing User Data (2020, background): “FL is naturally suited to the strictly stronger notion of user-level privacy ([MRTZ17], [JTT18], [AMR + 19], [TAM19]), which provides guarantees for all the examples contributed by any individual user in the training process.”
Privacy Amplification via Random Check-Ins (2020, background): “We formally deﬁne the random check-ins procedure, describe a fully distributed DP-SGD protocol with random check-ins, and analyze its privacy and utility guarantees.”
On Large-Cohort Training for Federated Learning (2021, methodology): “Notably, Andrew et al. (2019) show that the clipping level can be learned in a federated manner that is directly compatible with Algorithm 1.”
A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection (2019, background): “[167], [203] for data privacy protection to ensure the parties cannot know whether an individual record participates in the learning or not.”
Characterizing Private Clipped Gradient Descent on Convex Generalized Linear Problems (2020, unknown): “Over the past few years, there has been tremendous progress in differentially private convex empirical risk minimization (ERM) [9, 7, 38, 1, 6, 29, 44, 21, 33, 40, 15].”
Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “though the follow up work [138] tried adaptive gradient clipping strategies to help alleviate this issue.”
Large-Scale Differentially Private BERT (2021, background): “Other works also considered adaptive clipping in the context of DP-SGD (Andrew et al., 2019; Pichapati et al., 2019) as well as adaptive learning rates (Koskela and Honkela, 2020).”
How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy (2023, methodology): “If running a clipping norm sweep is too costly, a practitioner may consider using adaptive clipping norm algorithm (Andrew et al., 2021) which should save the compute at a cost of more complicated implementation.”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, background): “More importantly, the clipping norm C introduces a bias-variance trade-off (Chen et al., 2020; Thakkar et al., 2021).”
Understanding Gradient Clipping in Private SGD: A Geometric Perspective (2020, background): “Thakkar et al. [2019] provides another adaptive gradient clipping heuristic that sets the threshold based on a privately estimated quantile, which can be viewed as minimizing the clipping probability.”
A Survey on Federated Learning for Resource-Constrained IoT Devices (2021, unknown): “An adaptive gradient clipping technique is presented in [201] to handle this issue.”