Differentially Private Learning with Adaptive Clipping (1905.03871v5)

Abstract: Existing approaches for training neural networks with user-level differential privacy (e.g., DP Federated Averaging) in federated learning (FL) settings involve bounding the contribution of each user's model update by clipping it to some constant value. However there is no good a priori setting of the clipping norm across tasks and learning settings: the update norm distribution depends on the model architecture and loss, the amount of data on each device, the client learning rate, and possibly various other parameters. We propose a method wherein instead of a fixed clipping norm, one clips to a value at a specified quantile of the update norm distribution, where the value at the quantile is itself estimated online, with differential privacy. The method tracks the quantile closely, uses a negligible amount of privacy budget, is compatible with other federated learning technologies such as compression and secure aggregation, and has a straightforward joint DP analysis with DP-FedAvg. Experiments demonstrate that adaptive clipping to the median update norm works well across a range of realistic federated learning tasks, sometimes outperforming even the best fixed clip chosen in hindsight, and without the need to tune any clipping hyperparameter.

• The paper introduces a novel adaptive clipping method that dynamically adjusts clipping norms based on update quantiles in federated learning.
• It improves the balance between model utility and privacy by reducing hyperparameter tuning compared to fixed clipping norms.
• Experiments on datasets like CIFAR-100 and EMNIST demonstrate its scalability and enhanced performance under differential privacy constraints.

Differentially Private Learning with Adaptive Clipping

This paper introduces a novel approach for enhancing the training of neural networks under the constraints of user-level Differential Privacy (DP) within Federated Learning (FL) frameworks. The primary innovation lies in adaptive clipping, an advancement over static clipping norms traditionally used in DP Federated Averaging methods. This technique adapts the clipping norm to certain quantiles of the update norm distribution, allowing for more efficient training across diverse learning tasks.

Overview of the Method

Federated Learning involves training models using data distributed across many clients, often with privacy implications due to the sensitive nature of personal data. The existing methodology in this domain uses a fixed clipping norm to manage the influence any single user's update can exert, thus enabling DP by bounding sensitivity and subsequently adding calibrated Gaussian noise to ensure privacy.

The proposed adaptive clipping method adjusts the clipping norm dynamically to align with a specific quantile of the norm distribution of user updates. Importantly, this quantile is calculated and tracked in real-time using differential privacy, ensuring the approach remains privacy-preserving. This method is compatible with other FL technologies, including secure aggregation and communication compression.

Numerical Results and Evaluation

The experiments demonstrate the efficacy of adaptive clipping across a suite of federated learning tasks. It compares favorably to fixed clipping, often surpassing even the best fixed clips in performance without requiring exhaustive hyperparameter tuning. Specifically, experimentation with quantiles across a range from 0.1 to 0.9 on diverse datasets such as CIFAR-100, EMNIST, and Stack Overflow tasks suggest adaptive clipping reliably tracks the norm distribution, providing consistent utility improvements.

Implications and Future Directions

1. Privacy and Utility Balance: By reducing the number of hyperparameters to tune, adaptive clipping enables a balance between model utility and privacy guarantees that is exceptionally conducive to practical deployment in FL systems, especially where the user device population is heterogeneous and vast.
2. Efficiency and Scalability: As federated learning models scale up to include more participants, the necessity to maintain privacy without severely affecting utility becomes critical. Adaptive clipping offers a scalable solution, ensuring effective training operations without deep dependence on the initial hyperparameter settings.
3. Practical Deployment: In practical scenarios, where real-world data distribution and privacy constraints are stringent, this method alleviates significant overhead in hyperparameter tuning efforts. Practitioners can feasibly deploy models without exhaustive pre-training assessment on clipping norms.

Future research could explore refining adaptive clipping algorithms to further minimize the impact of added noise on model accuracy while maintaining robust privacy assurances. Additionally, deeper investigations into the interaction of adaptive clipping with other federated learning techniques like federated dropout or model optimization strategies could yield synergistic benefits.

Overall, the advances presented in this paper contribute a significant step towards more effective and privacy-preserving large-scale neural network training in federated environments, addressing the critical balance between differential privacy and model utility.