Abstract:Differentially Private (DP) learning has seen limited success for building large deep learning models of text, and straightforward attempts at applying Differentially Private Stochastic Gradient Descent (DP-SGD) to NLP tasks have resulted in large performance drops and high computational overhead. We show that this performance drop can be mitigated with (1) the use of large pretrained language models; (2) non-standard hyperparameters that suit DP optimization; and (3) fine-tuning objectives which are aligned with the pretraining procedure. With the above, we obtain NLP models that outperform state-of-the-art DP-trained models under the same privacy budget and strong non-private baselines -- by directly fine-tuning pretrained models with DP optimization on moderately-sized corpora. To address the computational challenge of running DP-SGD with large Transformers, we propose a memory saving technique that allows clipping in DP-SGD to run without instantiating per-example gradients for any linear layer in the model. The technique enables privately training Transformers with almost the same memory cost as non-private training at a modest run-time overhead. Contrary to conventional wisdom that DP optimization fails at learning high-dimensional models (due to noise that scales with dimension) empirical results reveal that private learning with pretrained language models doesn't tend to suffer from dimension-dependent performance degradation. Code to reproduce results can be found at <a class="link-external link-https" href="https://github.com/lxuechen/private-transformers" rel="external noopener nofollow">this https URL</a>.

When Does Differentially Private Learning Not Suffer in High Dimensions?

Large Language Models Can Be Strong Differentially Private Learners

Differentially Private Learning Beyond the Classical Dimensionality Regime

Towards Understanding the Impact of Model Size on Differential Private Classification

Do not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning

Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining

Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Models

Do not let privacy overbill utility: Gradient embedding perturbation for private learning

Differentially Private Variational Inference for Non-conjugate Models

Differentially-Private Deep Learning from an Optimization Perspective.

Certification for Differentially Private Prediction in Gradient-Based Training

Training Private Models That Know What They Don't Know

Differentially Private Optimizers Can Learn Adversarially Robust Models

Large scale private learning via low-rank reparametrization

Differentially Private Learning Needs Better Features (or Much More Data)

Differentially Private Fine-tuning of Language Models

Differentially Private Learning with Small Public Data.

Differentially Private Language Models Benefit from Public Pre-training

The importance of feature preprocessing for differentially private linear optimization

Differentially Private Model Personalization