Rethinking Improved Privacy-Utility Trade-off with Pre-existing Knowledge for DP Training
Yu Zheng Wenchao Zhang Yonggang Zhang Wei Song Kai Zhou Bo Han









IEEE XXXX
Shell et al.: A Sample Article Using IEEEtran.cls for IEEE Journals


Rethinking Improved Privacy-Utility Trade-off with Pre-existing  Knowledge for DP Training
    
        Yu Zheng, 
        Wenchao Zhang, 
        Yonggang Zhang^∗, 
        Wei Song,  
        Kai Zhou, 
        Bo Han 
    
    ∗ Yonggang Zhang is the corresponding author. 
    Yonggang Zhang is with the Department of Computer Science, University of Technology Sydney, Australia. E-mails: yonggang.zhang-1@uts.edu.auYu Zheng is with the Department of Information Engineering, Chinese University of Hong Kong, Shatin, Hong Kong SAR. E-mail: yuzheng404@link.cuhk.edu.hkWenchao Zhang is with the College of Computer Science and Technology, Xi’an University of Science and Technology, China. E-mail: zhangwenchao@xust.edu.cn; Wei Song is with the School of Computer Science and Engineering, Northeastern University, China.  E-mail: songwei@mail.neu.edu.cn; Kai Zhou is with the Department of Computing, Hong Kong Polytechnic University, Kowloon, China. E-mail: kaizhou@polyu.edu.hk; Bo Han is with the Department of Computer Science, Hong Kong Baptist University, Hong Kong SAR. E-mails: bhanml@comp.hkbu.edu.hk
    

    MOX - Dipartimento di Matematica “F. Brioschi”, Politecnico di
Milano, via Bonardi 9, 20133 Milan, Italy

    ^1 arashandrea.roknian@mail.polimi.it

    ^2 anna.scotti@polimi.it

    ^3 alessio.fumagalli@polimi.it
    September 9, 2024
==================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================



§ ABSTRACT 
Differential privacy (DP) provides a provable framework for protecting individuals by customizing a random mechanism over a privacy-sensitive dataset.

Deep learning models have demonstrated privacy risks in model exposure as an established learning model unintentionally records membership-level privacy leakage.
Differentially private stochastic gradient descent (DP-SGD) has been proposed to safeguard training individuals by adding random Gaussian noise to gradient updates in the backpropagation.
Researchers identify that DP-SGD typically causes utility loss since the injected homogeneous noise alters the gradient updates calculated at each iteration. Namely, all elements in the gradient are contaminated regardless of their importance in updating model parameters.
In this work, we argue that the utility loss mainly results from the homogeneity of injected noise.
Consequently, we propose a generic differential privacy framework with heterogeneous noise () by defining a heterogeneous random mechanism to abstract its property.
The insight of  is to leverage the knowledge encoded in the previously trained model to guide the subsequent allocation of noise heterogeneity, thereby leveraging the statistical perturbation and achieving enhanced utility.
Atop , we instantiate a heterogeneous version of DP-SGD, where the noise injected into gradients is heterogeneous and guided by prior-established model parameters.
We conduct comprehensive experiments to verify and explain the effectiveness of the proposed , showing improved training accuracy compared with state-of-the-art works.
Broadly, we shed light on improving the privacy-utility space by learning the noise guidance from the pre-existing leaked knowledge encoded in the previously trained model, showing a different perspective of understanding the utility-improved DP training.

 

    Differential Privacy, Heterogeneous Noise, DP-SGD, Privacy-Utility Trade-off.







§ INTRODUCTION



Deep learning has achieved remarkable success across a wide spectrum of domains <cit.>, primarily due to the massive data used for model training.
As training data has been thoroughly analyzed to optimize model performance, a significant privacy concern arises regarding the model's potential to memorize individual data points <cit.>. 
Indeed, numerous existing studies <cit.> have demonstrated the feasibility of identifying the presence of particular records or  verbatim texts  in the training dataset, thereby raising severe privacy concerns.


Differential privacy (DP) <cit.>, emerged as de facto protection, can provide provable security for individuals’ privacy by adding the i.i.d noise to the sensitive data or computations. 
In detail, DP guarantees statistical indistinguishability between the outputs of two random mechanisms, which originate from the private inputs with or without a substituted individual data point. 
To protect sensitive data used in the training process, differentially private stochastic gradient descent (DP-SGD) <cit.> has been proposed and regarded as a main-steam method.
The idea of DP-SGD is to add the homogeneous noise sampled from a  Gaussian distribution to the aggregated gradient derived from a batch of examples in every training iteration.
Accordingly, DP-SGD can thwart an adversary from attaining membership of a particular data memorized by model parameters when the adversary dissects an established model.
One could adopt DP-SGD as a baseline <cit.> for supporting  secure non-convex training for neural networks.



Subsequently, researchers identify the inherent trade-off between privacy and utility introduced by DP-SGD.
It is a well-known challenge to achieve high model utility/performance given meaningful DP guarantees <cit.> since acquiring strong protection realized by a large noise scale generally leads to unavoidable utility loss and performance degrading.
For example, the number of DP-SGD training iterations may increase by 10× towards a similar utility metric compared with the pure SGD.
Accordingly, a research line of works <cit.>  explored to acquire a better utility by flexibly and empirically calibrate privacy budget allocation.
Regarding composition theorem, they try to either reallocate/optimize the privacy budget <cit.> or modify the clip-norms <cit.>  of a (set of) fixed noise distribution(s) in each iteration.
These dynamic noise allocation solutions optimize the noise allocation in the range of the whole training process with a constant budget. 
Sharing the same spirit as DP-SGD, these methods employ homogeneous noise to perturb gradient updates.



Upon studying the iteration-wise utility with/without DP noise in the process of model convergence, we observe that  utility loss can be ascribed to the homogeneity of noise applied to gradients.
Regardless of the diverse features learned from the training data, homogeneous noise negatively contributes to training performance (, convergence ability and accuracy) due to perturbing the original gradients derived in the backpropagation.

Drawing inspiration for dynamic noise allocation approaches, we believe introducing a noise heterogeneity view to the dynamic noise allocation approach will shed light on improving the privacy-utility space. 
Thus, we raise a fundamental question,

How do we improve the privacy-utility trade-off of DP-SGD by introducing the heterogeneous noise?






 §.§ Technical Overview




We consider a novel route of crafting iteration-wise noise heterogeneity by making use of pre-existing knowledge contained in the neural network, which captures the feature attributes prior-learned from the training data, thus improving the utility of the established model at every iteration.
The intuition is to dynamically allocate noise heterogeneity to diverse features in the back-propagation of SGD, in which the noise heterogeneity is guided by the prior learned knowledge contained in the existing model.

To this end, we propose a new framework – differential privacy with heterogeneous noise (), guided by an iteration-wise guidance matrix derived from prior learned model parameters, to perturb the gradients derived in the backpropagation.
Specifically, we raise the following contributions progressively.




 

 
1) Allocating noise heterogeneity via pre-existing knowledge.

To generate the model-guided heterogeneity, we propose a novel dynamic noise allocation scheme, where an iteration-wise (for short, stateful) matrix ^(t-1) is computed using the pre-existing model at (t-1)-th iteration. With the notion of stateful ^(t-1), we can guide the noise heterogeneity at the t-th training iteration. 
Namely, the stateful  adjusts the noise n used to perturb gradient updates at every iteration according to the heterogeneity derived by the ^(t-1).
Consequently, the posterior random mechanism is guided by pre-existing knowledge encoded in prior model parameters at every training iteration.
Specifically, we formally define our novel scheme  as a random mechanism that 
^(t)=𝐠^(t) +^(t-1)·𝐧, where the abstraction of ^(t-1) is independent to knowledge extraction function ℱ of learned model  and indexed by states t-1,t.

For theoretical analysis, we abstract the notion of heterogeneous DP learning with stateful guidance for allocating noise heterogeneity.
By adopting composition <cit.> and Rényi Divergence, we provide theoretical analysis on  SGD training following conventional proof style.
Accordingly, the instantiation of  SGD, regarded as a modified variant of standard DP-SGD, attains the standard DP guarantee.










2) Constructing heterogeneous DP-SGD.
We instantiate  as a heterogeneous version of DP-SGD, where the noise injected into gradient updates is heterogeneous. Specifically, the stateful ^(t-1) at the (t-1)-th training iteration is derived from decomposition on model parameters ^(t-1) at the prior training iteration, capturing the pre-existing knowledge.



Knowledge involved in ^(t-1), serving as allocation guidance, propagates to the DP noise injected to gradients at the t-th training iteration, following the style of DP-SGD.
Accordingly, it captures the pre-existing statistical knowledge of private training data,  extracting heterogeneity applied to features. 
Later, the stateful guidance matrix ^(t-1) adjusts the parameters of Gaussian distribution, equivalently affecting the heterogeneity of noise added to diverse features in the back-propagation of SGD.
Prior knowledge from extracted features has been reasonably DP-protected, thus not incurring extra risks in exposing private data.
The plug-in  SGD is generic and independent of learning models, best for both worlds in performance and privacy.

For test accuracy,  improves a series of state-of-the-arts, notably, from 95% to 98% over standard DP-SGD.
For training over the CIFAR-10 dataset,  improves by 18%-47%.
We tested the convergence stability when adding small and large, showing that  could mitigate model collapse. 
At last, we visualize the DP-protected features during the training to explain 's superior performance.



 §.§ Contribution Summary
 

Overall, our contributions are summarized as follows.


	
	
  * To form a step forward, we explore the relationship between DP training performance and heterogeneity at an iteration.
	Accordingly, we shed new light on bridging model utility and DP heterogeneity allocation to enhance the performance-privacy space.
    
  * We propose a framework – , supporting utility-improved training at every iteration by applying heterogeneous noise to model updates in back-propagation. 
	We abstract a guidance vector derived from pre-existing knowledge learned by models to guide noise heterogeneity applied to model back-propagation.
	Then, we formalize  and then provide theoretical analyses and proofs.
	
  * Our  SGD is general and efficient, which could be adopted as a plug-in module. 
	 SGD could converge in fewer training iterations and mitigate the utility loss of the established model without relying on extra manual efforts. 
	Experiments and explanations confirm the superior improved privacy-utility trade-off. 



 

§ RELATED WORKS

 
 

 §.§ Differential Privacy for Deep Learning
 
 Differential privacy has emerged as a solid solution to safeguard privacy in the field of deep learning.
Differential privacy (DP) for deep learning can be classified into four directions: input perturbation <cit.>, output perturbation <cit.>, objective perturbation <cit.>, and utility optimization <cit.>, showing valuable insights in the aspects of theory and practice.
DP could quantify to what extent individual privacy (, whether a data point contributes to the training model) in a statistical dataset is preserved while releasing the established model trained over the specific dataset.
Typically, DP learning has been accomplished by applying the unbiased Gaussian noise to the gradient descent updates, a notable example of DP-SGD <cit.>.
To be specific, DP-SGD adds the i.i.d. noise sampled from Gaussian distribution to model gradients to protect example-level training data involved in the training process in every iteration.

The noise-adding mechanism has been widely adopted in various  learning algorithms, e.g., image classification and natural language processing.
PATE <cit.> is an approach to providing differentially private aggregation of a teacher-student model.
Due to the property of post-processing <cit.>, the student's model is differentially private since it trains over the noisy inputs.
Bayesian differential privacy <cit.> takes into account the data distribution for practicality <cit.>. 
By instantiating hypothetical adversaries <cit.>, various threat models are employed to show corresponding levels of privacy leakage from both the views of practitioners and theoreticians.

Privacy auditions and robustness, or cryptographic protection <cit.> belong to  orthogonal research directions, focusing on the evaluative estimation of the privacy guarantee or cipher-text transmission.
Membership inference attack <cit.> enables detecting the presence or absence of an individual example, implying a lower bound on the privacy parameter ϵ via statistics <cit.>.
Notably, Steinke  <cit.> theoretically proves the feasibility of auditing privacy through membership inference on multiple examples simultaneously, elaborating an efficient one-round solution.
Combining different techniques with this work can be promising, while it is out of scope for this work.



 §.§ Privacy-Utility Trade-off

For acquiring higher utility <cit.>,  recent works explore the adaptive mechanism of DP training from different perspectives.
They try to either reallocate/optimize the privacy budget <cit.> or modify the clip-norms <cit.>  of a (set of) fixed noise distribution(s) in each iteration.
Such a branch of work points out a promising direction of adaptivity via redesigning the randomness.
Privacy budget scheduling <cit.> improves the utility of differentially private algorithms in various scenarios.
Unlike the aforementioned advances of dynamic noise allocation, our exploration of adjusting noise heterogeneity by model parameters aims to improve the utility of the established model at every iteration rather than optimizing the noise allocation in the range of the whole training process with a constant budget.
Handcrafted features, learned from public data, can improve model utility given a fixed privacy budget <cit.>.
Rather than introducing auxiliary data, we aim  to extract knowledge from protected model parameters without extra data assistance.


Previous analyses have enabled an understanding of utility bounds for DP-SGD mainly in an empirical manner.
Altschuler and Talwar <cit.> explored the theory foundation of privacy loss –  how sensitive the output of DP-SGD is.
They solve a tighter utility bound given the privacy loss as a function of the number of iterations, concluding that  after a small burn-in period, running DP-SGD longer leaks no further
privacy. 
In this work, we exploit visual explanation <cit.> and theoretical understanding to explore the essence of privacy-utility space.




§ PRELIMINARY




 §.§ General Notion of Differential Privacy

Differential privacy (DP) <cit.> theoretically guarantees individual privacy that the algorithm’s output changes insignificantly (see Definition <ref>) if the inputting data has small perturbations.
Pure ϵ-differential privacy is difficult to achieve in realistic learning settings, whereas the seminal work <cit.>  training with SGD adopts approximate (ϵ, δ)-differential privacy, formally defined below.



	 A randomized mechanism  provides (ϵ,δ)-differential privacy if for any two neighboring datasets D and D' that differ in
	
	a single entry, ∀ S ⊆ Range(),
		
    Pr((D)∈ S)≤ e^ϵ·Pr((D')∈ S)+δ

	where ϵ is the privacy budget and δ is the failure probability. 

 
	
	The sensitivity of a query function ℱ:𝔻→ℝ for any two neighboring datasets D,D'  is,
	 
	
			Δ = max_D,D'ℱ(D)-ℱ(D'),
	
	where · denotes L_1 or L_2 norm.


Next, we introduce the definition of privacy loss <cit.> on an outcome o as a random variable when DP operates on two adjacent databases D and D'.
Privacy loss is a random variable that accumulates the random noise added to the algorithm/model.

	
	Let : 𝔻→ℝ be a randomized mechanism with input domain D and range R.
	Let D,D' be a pair of adjacent datasets and  be an auxiliary input. For an outcome o∈ℝ, the privacy loss at o is defined by,
	
    ℒ_𝖯𝗋𝗂^(o)≜log Pr[(,D)=o]/ Pr[(,D')=o]


where ℒ_𝖯𝗋𝗂 is a random variable on r(o;,,D,D'), , the random variable defined by evaluating the privacy loss at an outcome sampled from (D).
Here, the output of the previous mechanisms is the auxiliary input  of the mechanism ^(t) at t.



 §.§ DP Stochastic Gradient Descent

DP-SGD <cit.>, regarded as a landmark work, has been proposed to safeguard example-level model knowledge encoded from the training data, constrained by the privacy budget allocated at each training iteration.
As reported by DP-SGD, adding i.i.d. noise inevitably brings parameter perturbation over the learned model in practice. 
Research efforts such as <cit.> are focused on developing techniques that can provide stronger privacy guarantees while minimizing the loss of utility from various perspectives, for example, clipping value optimization and privacy budget crafting. 

In DP learning, neighboring datasets D,D' represent two datasets that
only differ by one training data point, while the  is the DP training algorithm.
Following the formality of the definition, the ϵ is an upper bound on
the loss of privacy, and the δ is the probability of breaking the privacy guarantee. 
DP-SGD is a differentially private version of stochastic gradient descent (SGD).
This approach adds noise to SGD computation during training to protect private training data.
The first step is to minimize the empirical loss function ℒ(θ) parameterized by θ.
Secondly, gradient ∇_θℒ(θ,x_i) is computed at each step of the SGD, given a random subset of data x_i.
The noise is added to the average gradients of ∇_θℒ(θ,x_i),∀ x_i.
After training, the resulting model accumulates differentially private noise of each iteration to protect private individual data.

Through revisiting DP-SGD, we explore explaining the root
 of utility loss and bridge the concept of model-knowledge guidance and DP, making a DP training process fitting to enhance privacy-utility trade-offs better.
We showcase new thinking – not employing auxiliary (e.g., public data) assistance for the higher model, and thus rethinking tolerant leakage (statistical knowledge, not membership, aligning standard DP definition) encoded in the prior DP-trained model.



 §.§ Rényi Differential Privacy

Rényi differential privacy <cit.> has been proposed as a natural relaxation of differential privacy, particularly suitable for composing privacy guarantee of heterogeneous random mechanisms derived from algorithms. 
zCDP <cit.> and Rényi DP <cit.> (RDP) are defined through Rényi Divergence by Bun  <cit.> for a tight analysis, thereby providing accumulating cumulative loss accurately and strong privacy guarantees.
Definition <ref> presents the Rényi Divergence <cit.> for defining the Rényi differential privacy <cit.> as Definition <ref>.


	
	For two probability distributions P and Q  over ℝ,  Rényi divergence of order α is 
		
    𝒟α(PQ)≜1α-1log𝔼_x∼ Q[(P(x)/Q(x))^α]



Compared to standard differential privacy, Rényi differential privacy is more robust in offering an operationally convenient and quantitatively accurate way of tracking cumulative privacy loss throughout the execution of a standalone differentially private mechanism, such as iterative DP-SGD.
It supports combining the intuitive and appealing concept of a privacy budget by applying advanced composition theorems for a tighter analysis.
In return, an (α,ϵ)-Rényi DP implies (ϵ_δ,δ)-DP for any given probability δ>0 as Theorem <ref>.
We adopt the aforementioned DP advances to formalize DP with heterogeneous noise, devise the heterogeneous noise version of DP-SGD, and develop corresponding theoretical analyses.


    A randomized mechanism 𝒟:↦ℛ is said to have ϵ-Rényi differential privacy (RDP) of order α or (α,ϵ)-RDP for short, if for any adjcent D,D',  Rényi divergence of random mechanisms satisfies that,
    
    𝒟_α((D)|(D')≤ϵ





    If  is an (α,ϵ)-RDP mechanism, it also satisfies (ϵ+log 1/δ/α-1,δ)-DP for any 0<δ<1.




 §.§ Security Model for Centralized DP Learning

As for the security model, we consider a typical client-server paradigm of DP training. 
 The client, owning a set of private training data, trains a model conditioned on her private data, while the server receives the established model that is well-trained by the client, , in a black-box manner.
The client trains a model conditioned on her data and sends the resulting model only to a remote server.
Assume a server is a malicious adversary, observes the final model, and tries to learn the existence of individual data.
Regarding Definition <ref>, privacy guarantee means resisting the server's inference on a particular record by viewing a differentially private model.
Our security model follows the privacy goal and adversary abilities that are the same as existing works since knowledge extraction is from the protected features on the client side.
 does not break existing settings or use any auxiliary data, thus incurring no extra privacy leakages to the server.






§ NOISE HETEROGENEITY IN DP


To explore the noise heterogeneity, we start by adjusting the noise scale added to different elements, followed by witnessing the training process. 
Through repeated attempts, we observe that noise heterogeneity, , the diverse noise scales added to the elements, can affect the training performance.
Accordingly, our idea is that prior model parameters (involving extracted elements with traditional DP protection) can guide the posterior random mechanism to improve training performance.
In the meantime, no privacy-sensitive element beyond DP protection is involved in yielding guidance.
Unlike dynamic allocation, we offer distinctive element-wise noise at each training step rather than scaling noise in a whole training process.




 §.§ Define Heterogeneous DP Learning


We rethink reasonable leakages in DP models and make use of the pre-existing knowledge learned in the current model parameters to improve subsequent DP training performance.
Model training starts with a random ^(0) towards a convergent model ^(T), which captures knowledge learned from data iteration by iteration.
Naturally, our idea is to introduce a scalar vector  that is derived from the learned knowledge in  in the prior training process to serve as the guidance for subsequent DP training.

Consider a function ℱ to denote functionality achieved by neural networks .
The ^(t), trained with the  DP mechanism, denotes the deep learning model at iteration t.
We formulate DP trained model at t-th iteration to be ℱ(^(t), 𝖣𝖺𝗍𝖺) given private 𝖣𝖺𝗍𝖺. 
We utilize the ^(t-1) at t-1-th iteration to adjust the next-step noise allocation at t-th iteration, where ^(t-1) is computed by the prior ^(t-1) at (t-1)-th iteration  involving features learned in the first t-1 iterations.
Concretely, Definition <ref> introduces a general  notion of heterogeneous DP learning () that varies with the time t, essentially adjusting the noise vector (sampled from Gaussian distribution) operated over the learning model.


	
	Let any two neighboring datasets 𝖣𝖺𝗍𝖺 and 𝖣𝖺𝗍𝖺'  differ in a single entry, ϵ be privacy budget, and δ be failure probability.
	Let  be Gaussian noise distribution and 𝖣𝖺𝗍𝖺 be inputting private data.
	A time-dependent random mechanism of learning algorithm(s) ℱ  at the time t is,
	 	
    ^(t)=ℱ(^(t), 𝖣𝖺𝗍𝖺) +^(t-1)·(μ,σ^2)


(μ,σ^2) represents noise distribution with parameters μ, σ.
To generate pre-existing knowledge stored in the model parameters, we can employ a knowledge-extraction method (, principal component analysis <cit.>) to extract pre-existing knowledge stored in the learned model, saying
        ^(t-1)∝ℱ_𝗄𝗇𝗈𝗐(^(t-1)), t∈[0,T].
Accordingly, the noise sampled from the Gaussian distribution is scaled by  (, values and noise direction).
The  keeps varied for tracking DP model training, calibrating noise vector via pre-existing knowledge stored in the model.
In summary, the  expects to: 
1)  be tailored with heterogeneous DP noise that is added to the learning process;
2) be generic and irrelevant to the convergence route for distinctive models for iteratively reaching a model optimum;
3) have good model accuracy and convergence performance given a preset privacy budget.


Intuitively, iteration-wise guidance enables utility-optimized training in every backpropagation.
Dynamic privacy-budget allocation assumes a constant budget in the whole training process, whereas   assumes a pre-allocated budget in each iteration for acquiring relatively fine-wise optimization.
We consider (t,ϵ_t)-utility-optimized DP in Definition <ref> to capture the desirable property in DP learning.


	
	Let any two neighboring datasets D and D'  differ in a single entry, ϵ be privacy budget, and δ be failure probability.
   A mechanism  satisfies the following conditions at any training-iteration t:

	
	
  i (Privacy). If for any two neighboring datasets D and D', Pr(^(t)( D)∈ S)≤ e^ϵ_t·Pr(^(t)( D')∈ S)+δ_t for any iteration t∈ [0,T].
	
  ii (Utility). Supposing an optimal Z^∗, the objective function satisfies min_ϵ_t= ϵ/Tℱ_𝖣𝗂𝖿𝖿[^(t)Z^∗  ].
   
  iii (t-Sequential Composition). If =(^(0), …,^(t),…,^(T)),  satisfies (ϵ̃, δ)-DP such that ϵ̃≤ϵ.



Property (i) essentially guarantees differential privacy <cit.> at each training iteration.
Property (ii) extracts the iteration-wise optimization, which expects that the difference measurement ℱ_𝖣𝗂𝖿𝖿 between the noisy model and pure model are small as possible.
Given a fixed privacy budget ϵ/T, improving utility expects to reduce the difference between ^(t) and non-noisy Z^∗.
Property (ii) asks for no extra privacy leakages in the  under privacy composition, which is the same as the standard DP guarantee. 




 §.§ Overview of DP Heterogeneous SGD


Before constructing DP heterogeneous SGD ( SGD), we adopt the notations of DP-SGD by revisiting standard DP-SGD <cit.>.
DP-SGD trains a model with parameters  by minimizing the empirical loss function ℒ().
For a random example x_i, DP-SGD computes gradients 𝐠(x_i)←∇(, x_i) with clipping value C, and adds noise to ∑_i𝐠(x_i) sampled from Gaussian distribution 𝒩(0, σ^2C^2𝐈).
An adversary cannot view the training process except for the DP-trained model.


	
		
		
		
	


 
Motivated by DP-SGD, we explore an instantiation of  to generate heterogeneous noise and then add a “wisdom” (guided by prior learned knowledge) heterogeneous noise.
Accordingly, we instantiate DP-SGD <cit.> as the basis and replace its i.i.d. noise with heterogeneous noise.
In DP-SGD, the standard deviation σ of (0,σ^2) is constant for each layer; however, our mechanism guided by  adds different noise vectors for model updates at each iteration. 
With ^(t-1), the added noise to each layer is guided by the learned model in the aspects of scales and noise space at every iteration.

Using  SGD, we implement an instantiated scheme of training a model starting from random initialization.
The first step is generating heterogeneous noise building on the covariance matrix of the model.
By principal component analysis (PCA) <cit.>, the noise matrix is tuned via the covariance matrix, which aligns with the subspace in which features exist.
When training with SGD, updatable gradients computed in the backpropagation are added by noise, whose scales are guided by the generated subspace.
We consider extracting pre-existing knowledge from whole model parameters rather than a layer to capture the whole statistical space.
In this way, the noise space is more comprehensive, and the noise scale is more adaptive to the feature space.



 §.§ Detailed Construction



  §.§.§ Construction of   SGD
 
For clarification, we explain the step-by-step construction of  SGD.

Step-1. 
Assume that the model ^(0) is initialized to be random during training.
The model parameters at each iteration t represent the learning process of features in the dataset; , the training is to optimize the model parameters by capturing data attributes.
The ^(t-1) takes a set of inputting data x in size S_ x (, batch size) and compute the gradient

    𝐠_t←∇_^(t-1)ℒ(^(t-1),x_i), x_i∈ x

The 𝐠_t is clipped with the clip value 𝖢𝗉, thus ensuring that the gradients are scaled to be of norm 𝖢𝗉.
The clipped gradients are
	𝐠̅_t handled with clip value 𝖢𝗉.


Step-2. In our implementation,  ^(t-1) can be realized by following Algorithm <ref> using ^(t-1).
Since ^(t-1) is varied at each training iteration, ^(t-1)-guided noise distribution operating on gradients is varied during the whole training process.
^(t-1) contains the computed sub-space ^(t-1) and eigenvalues matrix ^(t-1) extracted from prior-learned model.
From a practical view, ^(t-1) configures the direction of the noise to be added.
^(t-1) generated from singular value decomposition is utilized to scale the noise distribution.
Here, independent and identically distributed noise can be sampled from a standard noise distribution , such as Gaussian and Laplace distributions. 
The generation of ^(t-1) does not introduce extra leakage since ^(t-1) learned in the prior t-1 iterations has been well-protected through  SGD.
 
Step-3. 
Following the logic of DP-SGD, ^(t-1)-guided noise is added to a batch of gradients,

    𝐠̃_̃t̃←(∑𝐠̅_t +^(t-1)·(μ, σ^2·I))/S_ x
 
^(t-1) here is different at every backpropagation of different layers, achieving different noise levels on each layer.
This layer-wise noise tuning speeds up the convergence and mitigates model collapse.
It derives from the corresponding model parameters of a unique layer that is relevant to an iteration t at the current backpropagation.
 SGD is independent of the choices of optimizer and optimizers, which could be potentially generalized to different learning models without  much effort of manual tuning.

Step-4. The last step is to perform gradient decent ^(t)←^(t-1)-η𝐠̃_̃t̃ using the new noisy gradients 𝐠̃_̃t̃, where η_t is a preset scalar.
For attaining higher utility, adding noise should avoid hurting important features (extracted by the model for later prediction.
Finally, the model converges better since the space of model parameters (regarded as a matrix) is relatively less destroyed by using the noise sampled from the identical space.



  §.§.§ Construction of Noise Guidance



The math tool, principal component analysis (PCA) <cit.> performs analyzing data represented by inter-correlated quantitative dependent variables.
 It forms a set of new orthogonal variables, called 
components, depending on the matrix eigen-decomposition and singular value decomposition (SVD).
Given a matrix 𝐗, of column-wise mean equal to 0, the multiplication 𝐗^⊤𝐗 is a correlation matrix.
Later, a diagonal matrix of the (non-zero) eigenvalues of 𝐗^⊤𝐗 is extracted together with the eigenvectors.
Essentially, PCA simplifies data representation and decomposes its corresponding structures.


We propose a simple yet efficient approach by examining the model parameters as a result of knowledge integration over diverse features extracted from private data. 
As in Algorithm <ref>, we employ the PCA decomposition <cit.> to extract knowledge learned by the training model and apply generated guidance ^(t) at iteration t to adjust noise addition at the next iteration.
PCA decomposition can extract knowledge from representative data (, model parameters in our setting) by analyzing inter-correlated quantitative dependence.
Normally, a neural network kernel extracting the features from the images is a matrix that moves over the input data to perform the dot product with the sub-region of input data.
Denote ℝ to be the real number set. 
Let 𝐛=[b_1, b_2, …, b_k] be a vector, and 𝐁=[𝐛_1,𝐛_2,…, 𝐛_𝐝]^⊤∈ℝ^n× m be a matrix.



   0.96
		
	



Step-1. For each layer, the client calculates ^(t)(^(t))^⊤ to attain ^(t)∈ℝ^k× k.

Step-2. The client performs principle component analysis (^(t)) to give the sub-space ^(t)∈ℝ^d× k.
The algorithm  reduces the dimensions and encodes ^(t) into a compact representation that is good enough to analyze and represent current  ^(t). Simultaneously, the client computes singular value decomposition ^̇(̇ṫ)̇=(^(t)) through PCA and transform (^(t)) to eigenvalues matrix ^(t)∈ℝ^k× k by ^̇(̇ṫ)̇(^̇(̇ṫ)̇)^⊤.
The ^(t) is employed as the scalar matrix to adjust noise scales for a batch of gradients in t-th training iteration. 

Step-3. ^(t) is computed by multiplying ^(t) and ^(t), which are further utilized to guide the noise added to gradients in every backpropagation. 



  §.§.§ Noise Guidance through Pre-existing Knowledge

For a non-private model,  converges to a stable status through uncountable routes of optimizing model parameters.
Noise addition becomes complicated if referring to different optimizing tools; it is not generic anymore.
DP-SGD sets a fixed noise scale at different training iterations.
Noise addition on  inevitably has a negative contribution to extracting features over private data compared with pure parameters.
By rethinking DP training from sketch (, random to convergence), varying 

 achieves improved allocation of parameter-wise heterogeneous noise at each training iteration with the constraint of a preset privacy budget.
Such an automatic allocation is generated from the prior-iteration evaluation of the training model in a differentially private manner. 
From this viewpoint,  injecting noise into the model parameters contributes negatively to both the knowledge and the process of knowledge integration. 
Compared with DP-SGD, the proposed method mitigates destroying the process of knowledge integration while keeping the learned knowledge unchanged. 
Different grid search of tuning hyper-parameters,  SGD adjusts the intermediate training process via instantly learnable parameters rather than setting a set of possibilities. 
Combining grid search (vertically tuning) and  SGD (horizontally tuning) may further boost the automatic optimization of DP learning in an algorithmic view.





 §.§ Privacy Analysis and Theoretical Explanation


We first analyze the DP guarantee of  SGD, which provides identical protection as standard DP-SGD as shown in Theorem <ref>.
Then, building on Theorem <ref>, we instantiate  SGD regarding the parameters configuration as Theorem <ref>.



	
	Let a random mechanism ^(t) be (ϵ^(t), δ)-differential privacy at the iteration t.
	A  mechanism ^(t) parameterized by (ϵ^(t),δ) is (ϵ, δ)-differential privacy if σ =σ.



    Standard DP-SGD is (ϵ,δ)-differentially private  if σ≥ c_2q√(Tlog(1/δ))/ϵ for any δ>0 <cit.>.
The q, T are, respectively, sampling probability and the number of steps relevant to model training.
The c is a  constant for all DP mechanisms.
Take ^(t) to be a  random mechanism that is derived from  (ϵ, δ)-differential privacy.
The _𝗍 has the same configuration of q, T,c due to the identical training procedure.
If σ is unchanged, ^(t) also satisfies σ≥ c_2q√(Tlog(1/δ))/ϵ for any δ>0.
Thus, _𝗍  is (ϵ, δ)-differentially private.



	
	 SGD parameterized by (0,σ̃^2) and standard DP-SGD parameterized by (0,σ^2) 
	 satisfy σ̃=σ such that the i-th entry of diagonal matrix  is set to be,
  
		v_i=_i·√(k)·σ/√(∑_i=1^k_i^2).



For generating noise, we need to keep σ̃^2=σ^2 to guarantee the same size of noise sampled from the distributions ,.
Let n sampled from Gaussian distribution be ←(μ,σ^2).
For sampling k times (until iteration k) from Gaussian distribution, we have the expectation of ,

    𝔼[^⊤·]= 𝔼[∑_i=1^k (n_i)^2]=tσ^2

For sampling k times from , we require the following expectation to satisfy 𝔼[ ()^⊤·]=tσ^2.
This equation gives the relation ∑_i=1^k v_i^2=kσ^2.
That is, a feasible solution of v_i is set to be
v_i=_i·√(k)·σ/√(∑_i=1^k_i^2).
 

Building on α-Rényi divergence and privacy loss, concentrated differential privacy (CDP) <cit.> allows improved computation mitigating single-query loss and high probability bounds for accurately analyzing the cumulative loss.
It centralizes privacy loss around zero, maintaining sub-Gaussian characteristics that make larger deviations from zero increasingly improbable.
In return, zero-CDP implies (ϵ_ρ,δ,δ)-DP as restated in Theorem <ref> <cit.>.


	
	A randomized mechanism  is said to be ρ zero-concentrated differentially private if for any neighboring datasets D and D', and all α∈(1,∞), we have,
		
    𝒟_α((D)|(D'))=1α-1log𝔼[e^(α-1)ℒ_𝖯𝗋𝗂^(o)]≤ρα

	where ℒ_𝖯𝗋𝗂^(o) is privacy loss and 𝒟_α((D)|(D')) is α-Rényi divergence between the distributions of (D) and (D').




If a random mechanism  is ρ-zero-CDP, then  also provides (ρ+2√(ρlog (1/δ)),δ)-DP for any δ>0.


At last, since we have aligned the privacy guarantee of  with the standard DP, we follow the standard composition-paradigm proof <cit.>  under the definition of zCDP <cit.> through Rényi Divergence by Bun  <cit.> for a tight analysis, as shown in Theorem <ref>. 
 

  
 
 Let a mechanism consist of T  mechanisms: =(^(1),…,^(T)).
	Each  SGD ^(t): 𝔻^(t)→ℝ satisfies ρ^(t)-zCDP, where the 𝔻^(t) is a subset of 𝔻.
	The mechanism  satisfies ((max_tρ^(t))+2√((max_tρ^(t))log(1/δ)),δ)-differential privacy.



    Consider two neighboring datasets D,D'.
By Theorem <ref>, our mechanism at each iteration adds the noise equal to being sampled from (0,σ^2).
By Definition <ref> and Definition <ref>, we calculate,

    √(2 πσ^2 )exp[(a-1)𝒟_α((D)|(D'))]
       =∫_ℝe^(-α(x-ℱ(D))^2/2σ^2-(1-α)(x-ℱ(D'))^2/2σ^2)dx
       =∫_ℝe^(-(x-(αℱ(D)+(1-α)ℱ(D')))^2/2σ^2)dx
       +∫_ℝe^((αℱ(D)+(1-α)ℱ(D'))^2-αℱ(D)^2/2σ^2)dx
         -∫_ℝe^((1-α)ℱ(D')^2/2σ^2)dx
       =√(2 πσ^2 )exp(α(α-1)(ℱ(D)-ℱ(D'))^2/(2σ^2))

Thus,

    exp[(a-1)𝒟_α((D)|(D'))]
       =exp(α(α-1)(ℱ(D)-ℱ(D'))^2/(2σ^2))
       =exp(α(α-1)Δ^2/(2σ^2))

By the result α(α-1)Δ^2/(2σ^2), this calculation tells that our noise mechanism follows (Δ^2/2σ^2)-zCDP at each iteration.
    
By Definition <ref> and 𝔼[e^(α-1)ℒ_𝖯𝗋𝗂^(o),(t)] <cit.>, we have,

    𝔼[( Pr((,D)=o)/ Pr((,D')=o))^α-1]	≤ e^(α-1)α·(max_tρ^(t))

By Markov’s inequality, calculate the probability,

    Pr[ℒ_𝖯𝗋𝗂^(O)≥ϵ ]   =	Pr[e^(α-1)ℒ_𝖯𝗋𝗂^(O)>e^(α-1)ϵ]
       ≤𝔼[e^(α-1)ℒ_𝖯𝗋𝗂^(O)]/e^(α-1)ϵ≤ e^(α-1)(α(max_tρ^(t))-ϵ)

Subject to σ=√(2Tlog(1/δ))/ϵ, we use α = ϵ+(max_tρ^(t))/2·(max_tρ^(t)) as derived in <cit.>, and compute,

    Pr[ℒ_𝖯𝗋𝗂^(O)> ϵ ]≤ e^-(ϵ-(max_tρ^(t)))^2/(4·(max_tρ^(t)))≤δ

For any S in Definition <ref>,

    ≤Pr[O∈ S∧ℒ_𝖯𝗋𝗂^(O)≤ϵ] +Pr[ℒ_𝖯𝗋𝗂^(O)>ϵ]
       ≤Pr[O∈ S∧ℒ_𝖯𝗋𝗂^(O)≤ϵ] +δ
       ≤∫_o Pr[(D')=o|o∈ S]e^ϵ do +δ
       =e^ϵPr[(D')=S]+δ

still satisfies original DP definition, as  in <cit.>.




 §.§ Linear Layer Analysis as an Example

We consider a binary classification for simplification and then instantiate a linear layer correlation analysis as an example supplement.

We regard SGD training as “ground truth”. 
We simplify model parameters as an abstraction of extracted features over the whole dataset.
Define layer-wise model parameters to be  in a binary classification model.
Let the y∈{-1,1} be model output, (x,y) be the input-output pair.
Let  noise overall features be , where the norm  maintains to be the same.
We expect the noise addition to not affect the space of model parameters and to keep the individual information in the model parameters unleaked.
Our objective is to minimize the variation of model outputs  from DP training and pure model at each training iteration, ,

    min_  |∑_i∫(+)x_iy_i'  dn -∑_i∫ x_iy_i  dn|


Consider that noise variable n being injected into each feature could be continuous ideally. 
Since it is sampled from a distribution with a mean value of 0, the integration of n equals 0, which could be removed for simplification.

We expect the first part to be large (denoting high utility) and the difference between the two parts to be as small as possible.
Then, we define the variance to be,

    [∑_i(+)x_iy_i'-∑_i x_iy_i]

Equation <ref> measures the difference of average correction of two models.
Equation <ref> can be simplified by the expectation,

    𝔼[∑_i((+)x_iy_i'- x_iy_i)]

For linear transformation, we get,

    (+)^⊤ x_iy_i'-^⊤ x_iy_i 
       = (+)^⊤ x_i(y_i+Δ y_i)-^⊤ x_iy_i
       = ^⊤ x_iΔ y_i+^⊤ x_iy_i+^⊤ x_iΔ y_i 
    		=   (+)^⊤ x_iΔ y_i+^⊤ x_iy_i
       = (+)^⊤ x_i^⊤ x_i+^⊤ x_i^⊤ x_i
        =(^⊤^⊤+^⊤^⊤+^⊤^⊤)x_i^2

Specifically, if (+)^⊤x_i is close to y_i, the differentially-private (noisy for short) model accuracy is high.
To attain the minimizer, we could solve Equation <ref> by . 

In this example analysis, attaining support for the noise-model relation is enough for the initial exploration.









§ EXPERIMENTAL EVALUATION AND EXPLANATION



Our experiments are conducted on a commodity PC running Ubuntu with Intel Xeon(R) E5-2630 v3 CPU, 31.3 GiB RAM, and GeForce RTX 1080 Ti GPU.
In this section, we report the convergence/training performance and test accuracy (varying with ϵ) by conducting an extensive comparison with state-of-the-arts <cit.> over  standard benchmark datasets.
By employing GridCam <cit.>, we visualize differentially private training  to show the difference in representation.



 §.§ Experimental Setup




  §.§.§ Configuration and Dataset

The baseline DP-SGD implementation is pyvacy (<https://github.com/ChrisWaites/pyvacy>).
We configure experimental parameters with reference to <cit.>'s  setting.
To be specific, we configure lot size L=10,50,200,400, δ=1.0^-5 or 1.0^-6, and learning rate η=0.1 or 0.2. 
The noise level σ is set to be 0.5,1,3,5,7,10 for comprehensive comparison.
Fairly, we use identical ϵ as in state-of-the-art and compare test accuracy.

Experimental evaluations are performed on the MNIST dataset <cit.> and the CIFAR-10 dataset <cit.>. 
MNIST dataset includes 10 classes of hand-written digits of 28 ×28 gray-scale.
It contains 60,000 training examples and 10,000 testing examples.
CIFAR-10 dataset contains 10 classes  of images, of 32×32 color-scale with three channels, 
It contains 50,000 in training examples and 10,000 in testing examples.
 

 

  §.§.§ Model Architecture
 On the MNIST dataset, we use LeNet <cit.>, which reaches accuracy of 99% in about 10 epochs without privacy.
On CIFAR-10, we use two convolutional layers followed by two fully connected layers. 
In detail, convolution layers use 5× 5 convolutions, followed by a ReLU and 2×2 max-pooling. 
The latter is flattened to a vector that gets fed into two fully connected layers with 384 units. 
This architecture, non-privately, can get to about 86% accuracy in  ∼200 epochs.



 §.§ Model Utility and Training Performance




  §.§.§ Convergence Analysis

Figure <ref>, Figure <ref>, and Figure <ref> show the process of convergence on the MNIST and CIFAR-10 datasets in iterations and epochs when σ=0.5,1,3,5,7,10, respectively. 

The epoch-based figures show the whole training process on two datasets, while the iteration-based figures only display the first 30 iterations meticulously due to x-axis length limitation.

For the very-tiny noise level σ=0.5,1,  SGD reaches an almost identical convergence route as pure SGD when training over the MNIST dataset. 
For DP-SGD, iteration-wise accuracy decreases at the start of training.
For a relatively small noise level σ=3,5, we can see that  SGD  converges more stable.
Although  SGD can not reach the identical accuracy as pure SGD, its shape (e.g., from iteration=[5,10] and epoch=[4,20]) of convergence is much more similar to SGD than DP-SGD.
For σ≥5, the convergence of DP-SGD turns out to be very unstable, while  SGD looks more robust.
Besides, the shaking of  SGD is also relatively smaller, which contributes to step-wise stability during a whole training process. 

On CIFAR-10, Figure <ref> shows the test accuracy by training from scratch.
Recall that DP-SGD over CIFAR-10 typically requires a pretraining phase.
For σ=0.5,1,   SGD attains competitive training convergence compared with SGD training. 
For σ=3,5,  SGD training still moves towards convergence, while DP-SGD could not.
For σ=7,10, both  SGD and DP-SGD could not converge, whereas  SGD collapses later. 






  §.§.§ Model Accuracy

Table <ref> shows comparative results with prior works.
To be fair, we compare the test accuracy of the trained models under the constraint of identical ϵ.
We can see that  improves the test accuracy of 
state-of-the-arts <cit.>.
In most cases, our  SGD could attain >98% test accuracy on the MNIST dataset, whereas other works achieve 95%∼97%.
Only several works were trained over the CIFAR-10 dataset, yet with the <60% accuracy. 
In contrast,  SGD could achieve >64.5% accuracy, showing much better results.

Specifically,  SGD improves 18% accuracy on <cit.>, 47% accuracy on <cit.>, and 22% accuracy on <cit.>.
Training a DP model over the CIFAR-10 dataset may require a pretraining phase, whereas  SGD training could alleviate this.
It shows that  SGD behaves better on more representative datasets (e.g., CIFAR-10>MNIST) than DP-SGD.
Figure <ref> shows a box-whisker plot on accuracy given varying ϵ.
Except for following identical configuration of ϵ, we show additional results with ϵ=1,2,3,4.
The test accuracy is relatively stable for different ϵ in different training processes.
When ϵ is very large, although test accuracy is high, DP protection may not be sufficient for practical usage.
Experimental results show that  SGD is more robust against large noise and supports faster convergence, especially for representative datasets.

	


















 §.§ Explaining Experiments

Explainable AI (XAI) has been proposed to explain why they predict what they predict.
We adopt XAI to interpret the superiority/failure of various models by decomposing them into intuitive components by tracking and understanding the training performance, and visualizing the features.




  §.§.§ Tracking Initial-Phase Training

To explain why  SGD converges better, we plotted the training convergence process in the initial phase, in which the trained model is near the random initialization. 
Figure <ref> displays training convergence with varying lot sizes, while Figure <ref> shows training convergence when the learning rate increases to 0.2.
Both Figure <ref> and Figure <ref> confirm that  SGD tracks the SGD training tracks more tightly in the very beginning. 
Recall that a typical model training starts from the random initialization towards a stable status, which means fewer features are learned in the beginning.
Thus, we expect relatively less noise to protect the “randomized” model, which learns a limited number of features, to mitigate and destroy the typical training convergence.
Combining with Figure <ref>, we know that model collapse would happen when sufficient noise is assigned to enough features learned from the training data. 




  §.§.§ Visualizing DP Training

Given high-resolution and precise class discrimination, we apply Grad-CAM <cit.> to show visual results on DP training.
In Grad-CAM <cit.>, the class-discriminative localization map of width u and height v for any class c is defined to be ℒ_𝖦𝗋𝖺𝖽𝖢𝖠𝖬 = 𝖱𝖾𝖫𝖴(∑_k α_k^cA^k).
Here, the weight α_k^c represents a partial linearization of the  downstream feature map activation A.
In our experiments, we adopt GridCam <cit.> for interpreting/visualizing how DP noise affects model training.
In a model training process, GridCam is employed to visualize explanations of learning features, with or without DP noise.

GridCam <cit.> can coarsely locate the important regions in the image for predicting the concept, e.g.,  “dog” in a classification network.
Figure <ref> visualizes the heat map of  training with  SGD compared with Figure <ref>.
 SGD training still maintains the representation ability to locate the important objects.
That is, the reason for more satisfying accuracy is that  the noise added to the gradients could not affect on models' ability for relatively accurate visualization in a statistical manner, , still protecting individual privacy.



  §.§.§ A Practical View of Privacy Parameters

Theoretically, DP-SGD allows setting different clipping thresholds C and noise scales σ with varying numbers of training iterations t or different layers.
Although its experiments adopt the fixed value σ^2= 2/ϵ^2·log (1.25/δ),  SGD puts a step forward, showing a practical view of adjusting σ in every iteration and diverse noise allocation regarding every gradient update.
The added noise is typically sampled from a noise distribution parameterized by σ. 
Besides, to explore the varying σ over diverse features,  SGD still adopts a constant clipping value 𝖢𝗉 as in DP-SGD.

 SGD  assigns σ as a variable during DP training. 
As for unbiased noise distribution, μ=0 holds at every execution of sampling noise.
In probability theory, the sum of multiple independent normally distributed random variables is normal, and its variance is the sum of the two variances.
We use this conclusion to assign the σ over diverse features at each training iteration t.
If we regard all assigned σ at each iteration as a matrix, all entries in this matrix vary at different iterations.
The parameter configuration at every iteration follows Theorem <ref>, supporting linearity relation to value in  in  SGD.
 Although the theoretical expectation of introducing Gaussian noise with 0 mean value remains identical to the clean model, practical training shifts the expected results to some extent. 

 






  §.§.§ Understanding of Improved Model Convergence

Motivated by utility improvement, we perform repeated experiments similar to  <ref> to attain the relation between model training and  noise heterogeneity in empiricism.
We repeatedly train an identical model given various heterogeneity (adjust noise scales to diverse model parameters for early-stage tests) and witness the corresponding phenomenon in the convergence process.
Pure SGD training could attain the best accuracy and converge fastest while training with DP-SGD slows down the convergence constrained by identical remaining configurations.
Even after the model's convergence, DP-SGD training can not reach the highest accuracy as pure SGD training. 

For testing the  SGD, we adjust  noise allocations via PCA by injecting them into different model parameters and gradients within an identical privacy budget constraint. 
Accordingly, we could attain some convergence statuses that show lower convergence performance yet better than DP-SGD.
In practical training, utility loss can be interpreted to be convergence retard and degrading accuracy.
Improving model utility could be explained as follows: Given an identical privacy budget, a feasible solution can always exist in a region that is upper-bounded by the ground truth and lower-bounded by fixed noise perturbation.



 §.§ Further Discussion

We explore the limitations of our work and point out the potential future works below.

 
1). Speed up  SGD. We observe the computation costs of PCA over a large parameter matrix are not lightweight enough.
The computational cost for 𝖲𝖵𝖾𝖼 relies on the size of  the inputting matrix. 

The block-wise computation may simplify initializing a full-rank matrix as basis vectors.
Partitioning the parameter matrix into multiple blocks could speed up training in parallel; however, it may hurt the pre-existing on-the-whole knowledge stored in the current model.
Another direction is to consider a computation-light method of extracting the pre-existing knowledge learned in the current model.

2). Architecture-specified construction. 
To acquire a new perspective of improving model utility, the proposed construction is a feasible solution  but is not optimal.  
Although the trainable model could be regarded as a representation of knowledge extracted from diverse features and private data, different parameters are structured with the constraint of model initialization. 
At each backpropagation, we regard the model as a matrix in which each entry feeds with the values of model parameters, overlooking the effect of model structure.
In the future, instead of a generic solution, we would like to explore an architecture-specified construction of  SGD.

 


§ CONCLUSION
 

Through theoretical and empirical understanding of privacy-utility space, we extend the research line of improving training performance for DP learning by designing a plug-in optimization for training with DP-SGD.
The proposed DP-Hero is a versatile differential privacy framework incorporating a heterogeneous DP noise allocation manner.
The primary innovation of DP-Hero is its ability to utilize the knowledge embedded in previously trained models to guide the subsequent distribution of noise heterogeneity, thereby optimizing its utility. 
Building on the foundation of DP-Hero, we introduce a heterogeneous version of DP-SGD, in which the noise introduced into the gradients varies. We have carried out extensive experiments to validate and elucidate the efficacy of the proposed DP-Hero. 
Accordingly, we provide insights on enhancing the privacy-utility space by learning from the pre-existing leaked knowledge encapsulated in the previously trained models.

We point out a new way of thinking about model-guided noise allocation for optimizing SGD-dominated convergence under the DP guarantee.
Besides, we explore explaining DP training via visual representation, reasoning the improved utility.

Such an explainable view could benefit from understanding DP protection more vividly, for potentially being against attacks better.
In a broader context, we expect heterogeneous DP learning to be adopted beyond (DP-)SGD-based instantiations.
 




 

unsrt
 
 












 




