On the Convergence and Calibration of Deep Learning with Differential Privacy
Zhiqi Bu University of Pennsylvania Hua Wang University of Pennsylvania Zongyu Dai University of Pennsylvania Qi Long University of Pennsylvania
Abstract
Differentially private (DP) training preserves the data privacy usually at the cost of slower convergence (and thus lower accuracy), as well as more severe mis-calibration than its non-private counterpart. To analyze the convergence of DP training, we formulate a continuous time analysis through the lens of neural tangent kernel (NTK), which characterizes the per-sample gradient clipping and the noise addition in DP training, for arbitrary network architectures and loss functions. Interestingly, we show that the noise addition only affects the privacy risk but not the convergence or calibration, whereas the per-sample gradient clipping (under both flat and layerwise clipping styles) only affects the convergence and calibration.
中文速览
差分隐私（Differential Privacy, DP）训练虽然能保护用户数据隐私，但通常会导致模型收敛变慢、精度下降，还会带来比普通训练更严重的"校准失真"问题——即模型预测的置信度与实际准确率不匹配。本文通过神经切线核（Neural Tangent Kernel, NTK）建立了一套连续时间分析框架，首次从理论上厘清了DP训练两个核心操作的各自作用：加噪声只影响隐私风险，对收敛和校准几乎没有影响；而逐样本梯度裁剪（per-sample gradient clipping）才是拖慢收敛、造成校准失真的真正元凶。更重要的发现是，使用小裁剪范数（clipping norm）训练的DP模型虽然精度较高，却极度过度自信、校准性很差；而换用大裁剪范数，在保持相同隐私保证和相近精度的同时，能显著改善模型校准性。这一结论在包括Transformer级别大模型在内的大量实验中得到验证，为实际部署可靠、可信赖的隐私保护深度学习模型提供了重要的理论依据和实践指导。
原文 arXiv:2106.07830;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2106.07830v6