These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Training machine learning models with differential privacy (DP) has received
increasing interest in recent years. One of the most popular algorithms for
training differentially private models is differentially private stochastic
gradient descent (DPSGD) and its variants, where at each step gradients are
clipped and combined with some noise. Given the increasing usage of DPSGD, we
ask the question: is DPSGD alone sufficient to find a good minimizer for every
dataset under privacy constraints? Towards answering this question, we show
that even for the simple case of linear classification, unlike non-private
optimization, (private) feature preprocessing is vital for differentially
private optimization. In detail, we first show theoretically that there exists
an example where without feature preprocessing, DPSGD incurs an optimality gap
proportional to the maximum Euclidean norm of features over all samples. We
then propose an algorithm called DPSGD-F, which combines DPSGD with feature
preprocessing and prove that for classification tasks, it incurs an optimality
gap proportional to the diameter of the features $\max_{x, x' \in D} \|x -
x'\|_2$. We finally demonstrate the practicality of our algorithm on image
classification benchmarks.