Paper Title: Differentially Private Block-wise Gradient Shuffle for Deep Learning.


810Comparative analysis of structural, elastic, electronic, phonon, thermal and optical properties of two Na6Ge2Se6 phases from first principles calculations
    Aleksandr Chernatynskiy
    August 5, 2024
==========================================================================================================================================================



§ ABSTRACT 
Traditional Differentially Private Stochastic Gradient Descent (DP-SGD) introduces statistical noise on top of gradients drawn from a Gaussian distribution to ensure privacy. This paper introduces the novel Differentially Private Block-wise Gradient Shuffle (DP-BloGS) algorithm for deep learning. BloGS builds off of existing private deep learning literature, but makes a definitive shift by taking a probabilistic approach to gradient noise introduction through shuffling modeled after information theoretic privacy analyses. The theoretical results presented in this paper show that the combination of shuffling, parameter-specific block size selection, batch layer clipping, and gradient accumulation allows DP-BloGS to achieve training times close to that of non-private training while maintaining similar privacy and utility guarantees to DP-SGD. DP-BloGS is found to be significantly more resistant to data extraction attempts than DP-SGD. The theoretical results are validated by the experimental findings.




§ INTRODUCTION


Core to the theoretical underpinnings of DP-BloGS is a fact borne of modern necessity: deep learning libraries like PyTorch expose structured access to gradients through parameter groupings. The block-wise shuffle approach offers several nascent advantages compared to traditional DP-SGD in this regard. Specifically, by accounting for the parameter group and gradient dimensions in the sensitivity analysis, DP-BloGS is efficiently tailored to the modern architecture of deep learning models. The probabilistic noise approach through shuffling gradient components plays well with gradient accumulation, as shown through the perplexity metric in the utility experiments. Privacy guarantees are verified through the analysis of data extraction and membership inference vulnerability compared to traditional DP-SGD. These results are promising for machine learning practitioners in that they show DP-BloGS offers similar or better privacy guarantees, competitive performance, and faster runtimes than DP-SGD.

This paper introduces several important contributions to the differential privacy literature, particularly in the context of privacy-preserving deep learning:



  
Novel Algorithm The paper introduces Differentially Private Block-wise Gradient Shuffle (DP-BloGS), a new algorithm for privacy-preserving deep learning. This algorithm takes a probabilistic approach to gradient noise introduction through shuffling modeled after information theoretic privacy analyses.



  
Theoretical Foundations The paper provides a comprehensive theoretical analysis of DP-BloGS, including proofs of its privacy guarantees and utility bounds. This includes theorems on privacy composition, convergence analysis, and information-theoretic bounds.



  
Parameter-wise Privacy The paper introduces a parameter-wise approach to differential privacy, allowing for different privacy levels for different parts of the model. This is formalized through theorems on parameter-wise privacy loss and composition.



  
Improved Efficiency DP-BloGS is shown to achieve training times close to that of non-private training while maintaining similar privacy and utility guarantees to DP-SGD. This addresses a key challenge in practical deployment of differentially private machine learning.



  
Enhanced Privacy-Utility Trade-off The paper demonstrates that DP-BloGS can achieve better privacy-utility trade-offs compared to traditional DP-SGD in many scenarios, particularly in terms of resistance to data extraction attempts.



  
Scalability to Large Models The effectiveness of DP-BloGS is demonstrated on models with up to 1.1 billion parameters, showing its applicability to modern large language models.



  
Optimal Parameter Selection The paper provides methods for optimally selecting key parameters of the DP-BloGS algorithm, such as block sizes and clipping thresholds, to balance privacy and utility.



  
Empirical Evaluation The paper includes experiments comparing DP-BloGS to DP-SGD across multiple model architectures and privacy levels, evaluating metrics such as perplexity, membership inference attack resistance, and data extraction rates.



  
Information-Theoretic Analysis The paper provides information-theoretic bounds on the privacy guarantees of DP-BloGS, connecting the algorithm to fundamental concepts in information theory.



  
Privacy Accounting The paper develops privacy accounting methods specific to DP-BloGS, allowing for precise tracking of privacy loss over the course of training.

The rest of this paper is structured as follows. Relevant work is briefly introduced and its importance stated in a related work section. The methodology section covers the experimental approach and the DP-BloGS algorithm in detail. Results are presented, with full tables and all plots saved for the appendix. The mathematical foundations for DP-BloGS are then laid out, building on prominent literature in differential privacy. The math section aims to provide each necessary mathematical tool in the order it is needed, proving DP-BloGS' privacy-enhancing qualities in rigorous detail. The paper concludes by summarizing key findings, commenting on limitations, and laying out future work.





§ RELATED WORK


This work builds on prior Differential Privacy literature such as <cit.>. For implementation, notably, batched layer clipping<cit.> is a primary component of DP-BloGS' speed boost. DP-BloGS is compared to DP-SGD by implementing the code available on the AWS Fast DP repository<cit.>.

<cit.> also expand on shuffling models for differential privacy. Though this paper is categorically different in its approach and its privacy guarantees, it does draw explicit inspiration from the work done by Cheu et al.



§ ALGORITHM


The algorithm has 3 primary classes. The Trainer, the Generator, and the Accountant. The Trainer handles everything related to training, and is an extended version of the SFTTrainer from Hugging Face trl. The Generator is responsible for ingesting the gradients and shuffling during the post accumulation step before the model's weights are updated with the gradients. The Accountant is responsible for optimizing the block sizes and keeping track of privacy spend across the training process.



 §.§ Initializing DPShuffleGenerator


The DPShuffleGenerator is initialized with several key parameters: model (the neural network model being trained), target_epsilon (the desired privacy budget), delta (the probability of privacy failure), steps (the number of training steps), clip_value (the maximum L2 norm for gradient clipping), and batch_size (the number of examples per training batch).

During initialization, the generator creates a DPShufflePrivacyAccountant with these parameters. The accountant then performs the following optimization process:



  §.§.§ Privacy Accountant Optimization


The accountant computes the dimensions of all trainable parameters in the model. It then employs a nested binary search strategy to find the optimal block sizes for each parameter group:

Outer binary search: This search finds the optimal target epsilon per group (epsilon_i) that will result in the overall target epsilon when summed across all groups and steps.

Inner binary search: For each parameter group, this search determines the largest block size that satisfies the current target epsilon_i.

For each parameter group with dimension d_i and a given block size, the accountant computes two epsilon values:


    ϵ_1 = 2 ·log(1 + d_i · (e^2C/√(d_i) - 1))


    ϵ_2 = 2 ·log(1 + (block_size/d_i) · (e^2C√(block_size/d_i) - 1))


Where C is the clip_value. The smaller of these two values is chosen as the epsilon for this group and block size.

The total privacy spent across all groups and steps is computed using:


    ϵ_total =    √(2 · steps ·log(1/δ))·ϵ_total_per_step
        + steps ·ϵ_total_per_step· (e^ϵ_total_per_step - 1)


Where ϵ_total_per_step is the sum of epsilons for all parameter groups in a single step.

This process iteratively refines the estimate of the optimal target epsilon per group until the total privacy is as close as possible to the overall target epsilon.

The generator stores these optimal block sizes and initializes the spent privacy budget (epsilon_spent) to 0.





 §.§ Training Process


When training begins and gradients have been accumulated, the generate function is called with the accumulated gradients. This function performs several key steps:



  §.§.§ Gradient Processing


For each gradient and its corresponding optimal block size, the gradient is clipped to the specified clip_value if necessary, and then shuffled using the optimal block size. These processed gradients are collected into a list called private_grads.



  §.§.§ Gradient Shuffling


The shuffling process involves flattening the gradient into a 1D tensor, padding it if necessary to ensure it can be evenly divided into blocks, reshaping it into blocks of the specified size, randomly shuffling the blocks, flattening and trimming the shuffled blocks to the original gradient size, and finally reshaping the result to match the original gradient shape.



  §.§.§ Privacy Accounting


After processing all gradients, the accountant computes the total privacy spent (epsilon) for this step.



§ METHODOLOGY


To aid in visualizing DP-BloGS, this paper presents two primary figures containing three plots in total. Figure 1 shows a simulation of parameter group gradients converted to 2D heatmaps for DP-BloGS at values of epsilon 1 and 100. Figure 2 shows layer gradients unprocessed for visual comparison.

Experiments were performed on a single A100 GPU. The dataset used for training was the first 1,000 records of Tiny Orca. The dataset used for testing was the second 1,000 records of Tiny Orca. The models examined were sourced through the Hugging Face model hub. Specifically facebook/opt-350m, bigscience/bloom-560m, openai-community/gpt2, TinyLlama/TinyLlama-1.1B-step-50K-105b, and google-bert/bert-base-uncased.





Each experiment held the majority of variables constant. The hyperparameters were kept as follows: batch size of 5, gradient accumulation steps of 10, learning rate of 2e-4, max gradient norm of 1.0, training epochs of 5, AdamW 32 bit optimizer, and a constant learning rate. Experiments were performed in full 32 bit precision.



 §.§ Evaluation Process




  §.§.§ Membership Inference Attack (MIA)


The membership inference attack was conducted using an approach that combines multiple machine learning models and advanced feature engineering.

Feature extraction involved extracting features from both training and test datasets using the  function. These features included model confidence, entropy, perplexity, data augmentation responses, memorization metrics, generalization indicators, contrastive learning features, out-of-distribution detection scores, and per-layer gradient norms.

Data preprocessing steps included imputation to handle missing values, standardization of features using , feature selection using mutual information, creation of polynomial features to capture non-linear relationships, and application of SMOTE for class balancing.

For model training and selection, multiple classifiers including Random Forest, Logistic Regression, and Neural Network were trained.  with  cross-validation was used for hyperparameter tuning. A stacking ensemble combining the best models was implemented, and the best performing model was selected based on ROC AUC score.

Model calibration and thresholding involved calibrating the best model's probabilities and determining an optimal classification threshold to balance precision and recall.

Evaluation metrics included ROC AUC, precision-recall AUC, and Brier score, which are standard metrics for evaluating the effectiveness of membership inference attacks <cit.>. Accuracy, precision, recall, and F1-score were computed for both standard (0.5) and optimal thresholds. Error analysis was performed to understand misclassifications.

Visualization included plots of the ROC curve, learning curves, and feature importance.



  §.§.§ Data Extraction Risk Assessment


The data extraction risk was evaluated using a simulated extraction attack. The attack simulation involved 1000 extraction attempts. For each attempt, a randomly selected training example was used, with a substring of length 10 as a prompt to generate a completion of length 30 using the model.

Extraction detection involved checking if the generated text matched any part of the training data. A match was considered successful if at least 20 consecutive characters matched.

Analysis of the extraction results included calculating the extraction rate (percentage of successful extractions), computing the average length of successfully extracted sequences, and identifying the top 10 most substantial extractions.



  §.§.§ Perplexity Evaluation


Perplexity was evaluated to assess the model's predictive performance. The evaluation process involved iterating through the dataset batch by batch. For each batch, the input text was tokenized, target labels were created by shifting input tokens, model logits were computed, and cross-entropy loss was calculated, ignoring padding tokens.

The perplexity calculation involved accumulating total loss and total number of tokens across all batches, computing average loss per token, and calculating perplexity as the exponential of the average loss.

Interpretation of perplexity results considered that lower perplexity indicates better predictive performance. Perplexity was compared across different model versions or privacy settings to assess impact on language modeling capability.

This comprehensive evaluation process provides a multi-faceted assessment of the model's privacy preservation, covering both the risk of membership inference and data extraction, while also measuring the model's overall language modeling performance through perplexity. The results from these evaluations can be used to analyze the trade-offs between privacy and utility in the trained models.





§ RESULTS




 §.§ DP-BloGS vs. DP-SGD


A normalized comparison of DP-BloGS and DP-SGD across multiple models reveals insights into their relative performance in terms of utility and privacy.





  §.§.§ Utility Performance


In terms of perplexity, our key utility metric, DP-BloGS demonstrates a slight advantage. The average normalized difference of -0.0226 favors DP-BloGS, which outperforms DP-SGD in 67.69% of cases. DP-BloGS also exhibits a higher normalized Area Under the Curve (AUC) of 0.7557 compared to 0.0977 for DP-SGD. However, it is important to note that this difference is not statistically significant (p-value: 0.5523), indicating that the utility performance of both methods is comparable.



  §.§.§ Privacy Performance


The privacy performance is assessed through two metrics: resistance to Membership Inference Attacks (MIA) and resistance to data extraction.

For MIA resistance, both methods perform similarly. The average normalized difference of 0.0013 slightly favors DP-SGD, but DP-BloGS still performs better in 50.77% of cases. The normalized AUC values are close (1484.56 for DP-BloGS vs 1493.59 for DP-SGD), and the difference is not statistically significant (p-value: 0.9094).

In terms of data extraction resistance, DP-BloGS significantly outperforms DP-SGD. The average normalized difference of -0.0514 favors DP-BloGS, which performs better in 69.23% of cases. This difference is statistically significant (p-value: 0.0024), indicating a consistent advantage for DP-BloGS in preventing data extraction across different models.





  §.§.§ Key Findings


The comparative analysis reveals that DP-BloGS offers comparable or slightly better utility than DP-SGD, similar resistance to membership inference attacks, and significantly better protection against data extraction. These findings suggest that DP-BloGS may be the preferable method, particularly in scenarios where strong protection against data extraction is a priority. The balanced performance across utility and privacy metrics positions DP-BloGS as a robust choice for privacy-preserving machine learning applications.





§ LIMITATIONS AND FUTURE WORK


This research was limited by budget and time. If more resources had been available, it would have been prudent to examine multiple datasets instead of training numerous model variants across a single dataset. Additional resources would have allocated for examining the interaction with even larger models, such as Llama 405b, Nemo, Falcon 180b, LoRA finetuning, and other methodologies.

Future research will refine parameter-wise budget allocation strategies, explore how DP-BloGS interacts with LoRA, apply DP-BloGS to different model architectures like convolutional neural networks, variational autoencoders, and diffusion models, and assess the parameter-specific factors that come into play when seeking to maximize utility while retaining privacy.



§ MATH


We begin by describing and showing preservation and maintenance of gradient properties under shuffling.



§ LEMMA 1


[Gradient Properties Under Shuffling]
Let g ∈ℝ^d be a gradient vector and π : {1, ..., d}→{1, ..., d} be a permutation function. Define the shuffled gradient g_π as g_π[i] = g[π(i)] for i ∈{1, ..., d}. Then, the following properties hold:

    
  * L2 Norm Preservation: g_π_2 = g_2
    
  * Mean Preservation: 1/d∑_i=1^d g_π[i] = 1/d∑_i=1^d g[i]
    
  * Variance Preservation: Var(g_π) = Var(g)




Let (Ω, ℱ, ℙ) be a probability space, where Ω is the sample space, ℱ is a σ-algebra on Ω, and ℙ is a probability measure.


    
  * L2 Norm Preservation:
    
       g_π_2^2 = ∑_i=1^d (g_π[i])^2     

         = ∑_i=1^d (g[π(i)])^2     

         = ∑_j=1^d (g[j])^2   (since π is a bijection)     

         = g_2^2    
    
    Taking the square root of both sides:
    
       g_π_2 = g_2    
    

    
  * Mean Preservation:
    
       1/d∑_i=1^d g_π[i] = 1/d∑_i=1^d g[π(i)]     

         = 1/d∑_j=1^d g[j]   (since π is a bijection)     

         = 1/d∑_i=1^d g[i]    
    

    
  * Variance Preservation:
    First, let's recall the definition of variance for a vector:
    
       Var(g) = 1/d∑_i=1^d (g[i] - μ)^2,   where  μ= 1/d∑_i=1^d g[i]    
    
    Now, let's prove that Var(g_π) = Var(g):
    
       Var(g_π) = 1/d∑_i=1^d (g_π[i] - μ_π)^2, 

         where  μ_π= 1/d∑_i=1^d g_π[i]     

       From (b), we know that  μ_π= μ.  Therefore:     

       Var(g_π) = 1/d∑_i=1^d (g_π[i] - μ)^2     

         = 1/d∑_i=1^d (g[π(i)] - μ)^2     

         = 1/d∑_j=1^d (g[j] - μ)^2   (since π is a bijection)     

         = Var(g)    
    


Thus, we have proven that shuffling preserves the L2 norm, mean, and variance of the gradient vector.




§ COROLLARY 1.1


[Preservation of Gradient Clipping]
Let clip_C(g) be a gradient clipping function that clips the L2 norm of g to a maximum of C. Then, for any permutation π:

    clip_C(g_π) = (clip_C(g))_π




Case 1: If g_2 ≤ C, then clip_C(g) = g. 

In this case, g_π_2 = g_2 ≤ C (from Lemma 1(a)). 

Therefore, clip_C(g_π) = g_π = (clip_C(g))_π.

Case 2: If g_2 > C, then clip_C(g) = (C/g_2) g. 

Let h = clip_C(g). Then:

    h_π[i] = h[π(i)] = (C/g_2) g[π(i)] = (C/g_2) g_π[i]

On the other hand:

    clip_C(g_π) = (C/g_π_2) g_π = (C/g_2) g_π   (from Lemma 1(a))

Therefore, clip_C(g_π) = h_π = (clip_C(g))_π.




§ DEFINITION 2


This definition builds on the foundations of differential privacy <cit.> and incorporates shuffling techniques <cit.>.

*definition2Definition 2

[DP-BloGS Mechanism]
Let (Ω, ℱ, ℙ) be a probability space, where Ω is the sample space, ℱ is a σ-algebra on Ω, and ℙ is a probability measure.

Let 𝒳 be the data space and 𝒟⊆𝒳^n be the set of all possible datasets of size n.

Let ℝ^d be the d-dimensional real vector space representing the gradient space.

Define the gradient function g : 𝒟→ℝ^d that maps a dataset to its gradient.

Let 𝒮^d be the symmetric group on d elements, i.e., the set of all permutations of {1, …, d}.

Define a random variable Π : Ω→𝒮^d that selects a permutation uniformly at random from 𝒮^d.

The DP-BloGS mechanism M : 𝒟×Ω→ℝ^d is defined as:

    M(D, ω) = g_π(D)

where π = Π(ω) and g_π(D)[i] = g(D)[π(i)] for i ∈{1, …, d}.

Properties of the DP-BloGS Mechanism:

1. Uniform Selection: For any permutation σ∈𝒮^d,

    ℙ(Π = σ) = 1/|𝒮^d| = 1/d!


2. Invertibility: Given M(D, ω) and π, one can recover g(D) by applying π^-1.

3. Output Space: The output space of M is identical to the gradient space ℝ^d.




§ LEMMA 2.1

*lemma2.1Lemma 2.1

[Conditional Probability of Output]
For any dataset D ∈𝒟 and any vector v ∈ℝ^d,

   ℙ(M(D, ω) = v |g(D) = u) =    

    
    1/d!     if  ∃σ∈𝒮^d  such that  v[i] = u[σ(i)] ∀i ∈{1, …, d} 

    0     otherwise
   


Proof:

Let E = {ω∈Ω : M(D, ω) = v  and  g(D) = u}.

Case 1: ∃σ∈𝒮^d such that v[i] = u[σ(i)] ∀ i ∈{1, …, d}

In this case, E = {ω∈Ω : Π(ω) = σ^-1}.

    ℙ(E) = ℙ(Π = σ^-1) = 1/d!


Case 2: ∄σ∈𝒮^d such that v[i] = u[σ(i)] ∀ i ∈{1, …, d}

In this case, E = ∅.

    ℙ(E) = 0


Therefore,

    ℙ(M(D, ω) = v | g(D) = u) = ℙ(E) / ℙ(g(D) = u) = ℙ(E)


This completes the proof.




§ LEMMA 2.2

*lemma2.2Lemma 2.2

[Preservation of Gradient Properties]
For any dataset D ∈𝒟 and any ω∈Ω,


    
  * M(D, ω)_2 = g(D)_2
    
  * 1/d∑_i=1^d M(D, ω)[i] = 1/d∑_i=1^d g(D)[i]
    
  * Var(M(D, ω)) = Var(g(D))


Proof:
This follows directly from Lemma 1, as M(D, ω) is a shuffled version of g(D).




§ THEOREM 2.3


*theorem2.3Theorem 2.3

[Unbiasedness of DP-BloGS]
For any dataset D ∈𝒟,

    𝔼[M(D, ω)] = g(D)

where the expectation is taken over the random permutation Π.

Proof:

For any i ∈{1, …, d},

    𝔼[M(D, ω)[i]]    = ∑_k=1^d g(D)[k] ·ℙ(Π(i) = k) 
       = ∑_k=1^d g(D)[k] ·1/d
       = 1/d∑_k=1^d g(D)[k] 
       = g(D)[i]


The last equality holds because the sum of all elements divided by d equals each element (since the expectation preserves each element).

Therefore,

    𝔼[M(D, ω)] = g(D)





§ THEOREM 3


[Sensitivity of Shuffled Gradients]
Let D, D' ∈𝒟 be two adjacent datasets differing in at most one element. We analyze the sensitivity of the mechanism, a key concept in differential privacy <cit.>. Let M be the DP-BloGS mechanism as defined in Definition 2. Then, the L_1 and L_2 sensitivities of M are equal to the corresponding sensitivities of the original gradient function g:


    
  * Δ_1 M = Δ_1 g = sup_D,D'  adjacentg(D) - g(D')_1
    
  * Δ_2 M = Δ_2 g = sup_D,D'  adjacentg(D) - g(D')_2


where Δ_1 M and Δ_2 M are the L_1 and L_2 sensitivities of M, respectively, and Δ_1 g and Δ_2 g are the L_1 and L_2 sensitivities of g, respectively.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

(a) L_1 Sensitivity:


    Δ_1 M = sup_D,D'  adjacent𝔼_ω[M(D,ω) - M(D',ω)_1]


For any ω∈Ω, let π = Π(ω) be the random permutation.


    M(D,ω) - M(D',ω)_1 
           = ∑_i=1^d |M(D,ω)[i] - M(D',ω)[i]| 
       = ∑_i=1^d |g(D)[π(i)] - g(D')[π(i)]| 
       = ∑_j=1^d |g(D)[j] - g(D')[j]| 
         (since π is a bijection)
       = g(D) - g(D')_1


This equality holds for all ω∈Ω, so:


    𝔼_ω[M(D,ω) - M(D',ω)_1] = g(D) - g(D')_1


Therefore,


    Δ_1 M = sup_D,D'  adjacentg(D) - g(D')_1 = Δ_1 g


(b) L_2 Sensitivity:


    Δ_2 M = sup_D,D'  adjacent√(𝔼_ω[M(D,ω) - M(D',ω)_2^2])


For any ω∈Ω, let π = Π(ω) be the random permutation.


    M(D,ω) - M(D',ω)_2^2 
           = ∑_i=1^d (M(D,ω)[i] - M(D',ω)[i])^2 
       = ∑_i=1^d (g(D)[π(i)] - g(D')[π(i)])^2 
       = ∑_j=1^d (g(D)[j] - g(D')[j])^2 
         (since π is a bijection)
       = g(D) - g(D')_2^2


This equality holds for all ω∈Ω, so:


    𝔼_ω[M(D,ω) - M(D',ω)_2^2] = g(D) - g(D')_2^2


Therefore,


    Δ_2 M = sup_D,D'  adjacentg(D) - g(D')_2 = Δ_2 g


This completes the proof.





§ COROLLARY 3.1


*corollary3.1Corollary 3.1

[Sensitivity Preservation under Clipping]
Let clip_C(g) be a gradient clipping function that clips the L_2 norm of g to a maximum of C. Gradient clipping, as introduced by <cit.>, is a crucial technique in our analysis. Define M_C as the composition of clipping and DP-BloGS:


    M_C(D, ω) = M(clip_C(g(D)), ω)


Then, the L_2 sensitivity of M_C is bounded by 2C:


    Δ_2 M_C ≤ 2C


Proof:

For any adjacent datasets D and D':


    M_C(D, ω) - M_C(D', ω)_2 
       = M(clip_C(g(D)), ω) - M(clip_C(g(D')), ω)_2 
       = clip_C(g(D)) - clip_C(g(D'))_2   (from Theorem 3)


Now, for any vectors u and v:


    clip_C(u) - clip_C(v)_2 
           ≤clip_C(u) - clip_C(0)_2 
          + clip_C(0) - clip_C(v)_2 
       ≤ C + C 
       = 2C


Therefore,


    M_C(D, ω) - M_C(D', ω)_2 ≤ 2C


This bound holds for all ω∈Ω, so:


    Δ_2 M_C 
           = sup_D,D'  adjacent√(𝔼_ω[M_C(D, ω) - M_C(D', ω)_2^2])
       ≤sup_D,D'  adjacent√(𝔼_ω[(2C)^2])
       = 2C


This completes the proof.




§ LEMMA 3.2


*lemma3.2Lemma 3.2

[Expected Squared L_2 Norm Difference]
For any adjacent datasets D and D', the expected squared L_2 norm difference between M(D, ω) and M(D', ω) is equal to the squared L_2 norm difference between g(D) and g(D'):


    𝔼_ω[M(D, ω) - M(D', ω)_2^2] = g(D) - g(D')_2^2


Proof:


    𝔼_ω[M(D, ω) - M(D', ω)_2^2] 
       = 𝔼_ω[∑_i=1^d (M(D, ω)[i] - M(D', ω)[i])^2] 
       = ∑_i=1^d 𝔼_ω[(M(D, ω)[i] - M(D', ω)[i])^2]


For each i:


    𝔼_ω[(M(D, ω)[i] - M(D', ω)[i])^2] 
       = 𝔼_ω[(g(D)[Π(ω)(i)] - g(D')[Π(ω)(i)])^2] 
       = 1/d∑_j=1^d (g(D)[j] - g(D')[j])^2


Therefore,


    𝔼_ω[M(D, ω) - M(D', ω)_2^2] 
       = ∑_i=1^d (1/d∑_j=1^d (g(D)[j] - g(D')[j])^2) 
       = ∑_j=1^d (g(D)[j] - g(D')[j])^2 
       = g(D) - g(D')_2^2


This completes the proof.




§ LEMMA 4


*lemma4Lemma 4

[Reconstruction Probability Bound]
Let D ∈𝒟 be a dataset, g(D) ∈ℝ^d be its gradient, and M be the DP-BloGS mechanism as defined in Definition 2. For any ω∈Ω, let M(D, ω) be the shuffled gradient. Then, the probability of an adversary correctly guessing g(D) given M(D, ω) is bounded by:


    ℙ(Adversary correctly guesses  g(D) | M(D, ω)) ≤1/d!


where d is the dimension of the gradient vector.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Let A : ℝ^d →ℝ^d be any adversarial reconstruction algorithm that attempts to recover g(D) from M(D, ω).

Define the event of successful reconstruction:
E = {ω∈Ω : A(M(D, ω)) = g(D)}

We want to prove that ℙ(E) ≤1/d!.

Step 1: Analyze the structure of E

For the adversary to correctly guess g(D), they must correctly identify the permutation π = Π(ω) used in the shuffling process.

E = {ω∈Ω : A(M(D, ω)) = g(D)} = {ω∈Ω : A(g_π(D)) = g(D),  where π = Π(ω)}

Step 2: Relate E to the set of permutations

Let S_A ⊆𝒮^d be the set of permutations for which A correctly reconstructs g(D):
S_A = {σ∈𝒮^d : A(g_σ(D)) = g(D)}

Then, E = {ω∈Ω : Π(ω) ∈ S_A}

Step 3: Use the properties of uniform distribution over permutations

From Definition 2, we know that Π is uniformly distributed over 𝒮^d. Therefore:


    ℙ(E) = ℙ(Π∈ S_A) = |S_A|/|𝒮^d| = |S_A|/d!


Step 4: Bound the size of S_A

The key observation is that for A to be correct for multiple permutations, g(D) must have symmetries. In the worst case (for privacy), g(D) is completely symmetric (all elements equal), and |S_A| = d!. In all other cases, |S_A| < d!.

Therefore, |S_A| ≤ d!

Step 5: Conclude the proof


    ℙ(E) = |S_A|/d!≤d!/d! = 1


Thus,


    ℙ(Adversary correctly guesses  g(D) | M(D, ω)) = ℙ(E) ≤1/d!


This completes the proof.




§ COROLLARY 4.1


*corollary4.1Corollary 4.1

[Expected Reconstruction Error]
Let D ∈𝒟 be a dataset, g(D) ∈ℝ^d be its gradient, and M be the DP-BloGS mechanism. For any reconstruction algorithm A, the expected L_2 reconstruction error is bounded below by:


    𝔼[A(M(D, ω)) - g(D)_2^2] ≥(1 - 1/d!) ·min_i ≠ j (g(D)[i] - g(D)[j])^2


where the expectation is taken over the random permutation in M.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Define the indicator random variable:
I = 1 if A(M(D, ω)) = g(D), and 0 otherwise.

From Lemma 4, we know that ℙ(I = 1) ≤1/d!.

Now, let's consider the expected reconstruction error:


    𝔼[A(M(D, ω)) - g(D)_2^2] 
       = 𝔼[A(M(D, ω)) - g(D)_2^2 | I = 1] ·ℙ(I = 1) 
          + 𝔼[A(M(D, ω)) - g(D)_2^2 | I = 0] ·ℙ(I = 0)


When I = 1, the reconstruction error is 0. When I = 0, the reconstruction error is at least the squared difference between the two closest distinct elements of g(D). Let's call this minimum difference δ:


    δ^2 = min_i ≠ j (g(D)[i] - g(D)[j])^2


Therefore:


    𝔼[A(M(D, ω)) - g(D)_2^2] 
           ≥ 0 ·ℙ(I = 1) + δ^2 ·ℙ(I = 0) 
       = δ^2 · (1 - ℙ(I = 1)) 
       ≥δ^2 ·(1 - 1/d!)


This completes the proof.




§ THEOREM 5


*theorem5Theorem 5

This privacy guarantee is comparable to those in differentially private deep learning <cit.>.

[Differential Privacy of Single-Step DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2 g. Let C be the clipping threshold and B be the batch size. Then, for any δ > 0, the DP-BloGS mechanism M satisfies (ϵ, δ)-differential privacy, where:


    ϵ = min{ϵ_1, ϵ_2}



    ϵ_1 = 2 ln(1 + d (e^2C/√(d) - 1))



    ϵ_2 = 2 ln(1 + β/d(e^2C √(β/d) - 1))


where β is the block size used in the shuffling mechanism.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Let D, D' ∈𝒟 be two adjacent datasets differing in at most one element.

Step 1: Define the privacy loss random variable

Define the privacy loss random variable Z : Ω→ℝ as:


    Z(ω) = ln(ℙ(M(D, ω) = v)/ℙ(M(D', ω) = v))


where v = M(D, ω) is the output of the mechanism.

Step 2: Analyze the sensitivity of the clipped gradient

The L_2 sensitivity of the clipped gradient is bounded by 2C.

Step 3: Analyze the privacy loss for the full gradient

For the full gradient, we can bound the privacy loss as:


    |Z(ω)| ≤ln(1 + d (e^2C/√(d) - 1))


This bound comes from considering the worst-case scenario where all d components of the gradient differ by the maximum amount.

Step 4: Analyze the privacy loss for block-wise shuffling

When considering block-wise shuffling with block size β, we can derive a tighter bound:


    |Z(ω)| ≤ln(1 + β/d(e^2C √(β/d) - 1))


This bound comes from considering the worst-case scenario within each block.

Step 5: Take the minimum of the two bounds

Since both bounds are valid, we can take the minimum of the two:


    |Z(ω)| ≤min{   ln(1 + d (e^2C/B √(d) - 1)), 
       ln(1 + β/d(e^2C √(β/d) - 1))
    }


Step 6: Account for the possibility of multiple queries

To account for the possibility that an adversary might try to exploit the randomness of the mechanism, we multiply our bound by 2:


    ϵ = 2 min{   ln(1 + d (e^2C/√(d) - 1)), 
       ln(1 + β/d(e^2C √(β/d) - 1))
    }


This gives us our final privacy guarantee.

This completes the proof.




§ COROLLARY 5.1


*corollary5.1Corollary 5.1

[Privacy-Utility Trade-off]
The privacy guarantee ϵ is inversely related to the batch size B and directly related to the clipping threshold C. This demonstrates a trade-off between privacy and utility, as larger batch sizes provide better privacy but may reduce utility, while larger clipping thresholds may improve utility but reduce privacy.




§ COROLLARY 5.2


*corollary5.2Corollary 5.2

[Impact of Dimensionality]
As d →∞, for fixed C and B, ϵ_1 approaches 2 ln(1 + 2C), while the behavior of ϵ_2 depends on how β scales with d. If β/d remains constant, ϵ_2 also approaches a constant value. This suggests that the privacy guarantee can be maintained even for high-dimensional gradients, which is beneficial for large machine learning models.




§ COROLLARY 6


*corollary6Corollary 6

This trade-off is a fundamental aspect of differential privacy, as discussed in <cit.>.

[Privacy-Utility Trade-off in Single-Step DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2 g. For a given privacy parameter ϵ > 0, the mechanism achieves (ϵ, δ)-differential privacy while maintaining a utility bound:


    𝔼[M(D, ω) - g(D)_2^2] ≤min(2Δ_2 g^2 · d · e^-2ϵ/d, g(D)_2^2)


where the expectation is taken over the randomness in M.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Relate ϵ to the mechanism's parameters

From Theorem 5, we know that for (ϵ, δ)-differential privacy:


    ϵ = ln(1 + d · (e^Δ_2 g / √(d) - 1))


Solving for Δ_2 g:


    e^Δ_2 g / √(d) - 1 = e^ϵ/d - 1/d


    e^Δ_2 g / √(d) = 1 + e^ϵ/d - 1/d


    Δ_2 g / √(d) = ln(1 + e^ϵ/d - 1/d)


    Δ_2 g = √(d)·ln(1 + e^ϵ/d - 1/d)


Step 2: Bound the expected squared error

From the properties of DP-BloGS (Lemma 2.2), we know that 𝔼[M(D, ω)] = g(D). Therefore:


    𝔼[M(D, ω) - g(D)_2^2] 
           = 𝔼[M(D, ω) - 𝔼[M(D, ω)]_2^2] 
       = Var(M(D, ω))


Now, let's bound this variance:


    Var(M(D, ω)) = ∑_i=1^d Var(M(D, ω)[i])


For each component i:

    Var(M(D, ω)[i]) 
           = 𝔼[(M(D, ω)[i] - g(D)[i])^2] 
       = 1/d∑_j=1^d (g(D)[j] - g(D)[i])^2 
       ≤4/dg(D)_2^2


Therefore:

    Var(M(D, ω)) ≤∑_i=1^d 4/dg(D)_2^2 = 4 g(D)_2^2


Step 3: Relate the bound to Δ_2 g

From the definition of L_2 sensitivity:

    g(D)_2^2 ≤Δ_2 g^2 · d


Substituting this into our variance bound:


    Var(M(D, ω)) ≤ 4 Δ_2 g^2 · d


Step 4: Express the bound in terms of ϵ

Using the relationship between Δ_2 g and ϵ from Step 1:


    Var(M(D, ω)) 
           ≤ 4 · d · (√(d)·ln(1 + e^ϵ/d - 1/d))^2 
       = 4d^2 · (ln(1 + e^ϵ/d - 1/d))^2


For small x, ln(1 + x) ≈ x. Using this approximation:


    Var(M(D, ω)) 
           ≈ 4d^2 ·(e^ϵ/d - 1/d)^2 
       = 4 ·(e^ϵ/d - 1/e^ϵ/d)^2 · (d · e^2ϵ/d) 
       ≤ 4 · (1 - e^-ϵ/d)^2 · (d · e^2ϵ/d) 
       ≤ 4 ·(ϵ/d)^2 · (d · e^2ϵ/d) 
         (using  1 - e^-x≤ x  for  x > 0) 
       = 4ϵ^2 · e^2ϵ/d / d 
       ≤ 2Δ_2 g^2 · d · e^-2ϵ/d
         (using the relationship between ϵ and Δ_2 g )


Step 5: Combine the bounds

Taking the minimum of the two bounds we've derived:


    𝔼[M(D, ω) - g(D)_2^2] ≤min(2Δ_2 g^2 · d · e^-2ϵ/d, g(D)_2^2)


This completes the proof.




§ LEMMA 6.1


*lemma6.1Lemma 6.1

[Optimal Privacy Parameter]
For a given utility constraint U > 0, the optimal privacy parameter ϵ that satisfies 𝔼[M(D, ω) - g(D)_2^2] ≤ U is:


    ϵ^* = d/2ln(2Δ_2 g^2 · d/U)


Proof:

Set the utility bound equal to U and solve for ϵ:


    U = 2Δ_2 g^2 · d · e^-2ϵ/d


    e^2ϵ/d = 2Δ_2 g^2 · d/U


    2ϵ/d = ln(2Δ_2 g^2 · d/U)


    ϵ^* = d/2ln(2Δ_2 g^2 · d/U)


This lemma provides a way to choose the optimal privacy parameter given a desired utility constraint.




§ LEMMA 7


*lemma7Lemma 7

[Independence of Successive Shuffles]
Let M be the DP-BloGS mechanism as defined in Definition 2. For any dataset D ∈𝒟 and any two distinct iterations t_1 and t_2, the shuffled gradients M(D, ω_1) and M(D, ω_2) are statistically independent, where ω_1, ω_2 ∈Ω are the random outcomes determining the shuffles at iterations t_1 and t_2 respectively.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Define the random variables

Let X_1 = M(D, ω_1) and X_2 = M(D, ω_2) be the shuffled gradients at iterations t_1 and t_2 respectively.

Step 2: Prove independence

To prove that X_1 and X_2 are independent, we need to show that for any measurable sets A, B ⊆ℝ^d:


    ℙ(X_1 ∈ A, X_2 ∈ B) = ℙ(X_1 ∈ A) ·ℙ(X_2 ∈ B)


Let g = g(D) be the true gradient. From the definition of the DP-BloGS mechanism:


    ℙ(X_1 = v_1) = 1/d! if  v_1  is a permutation of  g,  and  0  otherwise


    ℙ(X_2 = v_2) = 1/d! if  v_2  is a permutation of  g,  and  0  otherwise


Let S_g be the set of all permutations of g. Then:


    ℙ(X_1 ∈ A, X_2 ∈ B) 
       = ∑_v_1 ∈ A ∩ S_g∑_v_2 ∈ B ∩ S_gℙ(X_1 = v_1, X_2 = v_2) 
       = ∑_v_1 ∈ A ∩ S_g∑_v_2 ∈ B ∩ S_gℙ(X_1 = v_1) ·ℙ(X_2 = v_2) 
         (by independence of ω_1  and ω_2) 
       = (1/d!)^2 · |A ∩ S_g| · |B ∩ S_g| 
       = (1/d!· |A ∩ S_g|) ·(1/d!· |B ∩ S_g|) 
       = ℙ(X_1 ∈ A) ·ℙ(X_2 ∈ B)


This holds for all measurable sets A and B, proving that X_1 and X_2 are independent.




§ COROLLARY 7.1


*corollary7.1Corollary 7.1

[Pairwise Independence of Multiple Shuffles]
For any dataset D ∈𝒟 and any finite sequence of distinct iterations t_1, …, t_n, the shuffled gradients M(D, ω_1), …, M(D, ω_n) are pairwise independent.

Proof:

This follows directly from Lemma 7. For any i  j, M(D, ω_i) and M(D, ω_j) are independent by Lemma 7.




§ THEOREM 7.2


*theorem7.2Theorem 7.2

[Mutual Independence of Multiple Shuffles]
For any dataset D ∈𝒟 and any finite sequence of distinct iterations t_1, …, t_n, the shuffled gradients M(D, ω_1), …, M(D, ω_n) are mutually independent.

Proof:

Let X_i = M(D, ω_i) for i = 1, …, n.

To prove mutual independence, we need to show that for any measurable sets A_1, …, A_n ⊆ℝ^d:


    ℙ(X_1 ∈ A_1, …, X_n ∈ A_n) = ℙ(X_1 ∈ A_1) ·…·ℙ(X_n ∈ A_n)


Let g = g(D) be the true gradient and S_g be the set of all permutations of g.


    ℙ(X_1 ∈ A_1, …, X_n ∈ A_n) 
       = ∑_v_1 ∈ A_1 ∩ S_g…∑_v_n ∈ A_n ∩ S_gℙ(X_1 = v_1, …, X_n = v_n) 
       = ∑_v_1 ∈ A_1 ∩ S_g…∑_v_n ∈ A_n ∩ S_gℙ(X_1 = v_1) ·…·ℙ(X_n = v_n) 
         (by independence of ω_1, …, ω_n) 
       = (1/d!)^n · |A_1 ∩ S_g| ·…· |A_n ∩ S_g| 
       = (1/d!· |A_1 ∩ S_g|) ·…·(1/d!· |A_n ∩ S_g|) 
       = ℙ(X_1 ∈ A_1) ·…·ℙ(X_n ∈ A_n)


This proves mutual independence.




§ LEMMA 7.3


*lemma7.3Lemma 7.3

[Preservation of Independence Under Gradient Updates]
Let D_t ∈𝒟 be the dataset at iteration t, and let M(D_t, ω_t) be the shuffled gradient at iteration t. Then, for any finite sequence of distinct iterations t_1, …, t_n, the shuffled gradients M(D_t_1, ω_t_1), …, M(D_t_n, ω_t_n) are mutually independent.

Proof:

The key observation is that the randomness in the shuffle at each iteration is independent of the dataset and the gradients.

Let X_i = M(D_t_i, ω_t_i) for i = 1, …, n.

For any measurable sets A_1, …, A_n ⊆ℝ^d:


    ℙ(X_1 ∈ A_1, …, X_n ∈ A_n) 
       = 𝔼[ℙ(X_1 ∈ A_1, …, X_n ∈ A_n | D_t_1, …, D_t_n)] 
       = 𝔼[ℙ(X_1 ∈ A_1 | D_t_1) ·…·ℙ(X_n ∈ A_n | D_t_n)] 
         (by independence of shuffles)
       = 𝔼[ℙ(X_1 ∈ A_1 | D_t_1)] ·…·𝔼[ℙ(X_n ∈ A_n | D_t_n)] 
       = ℙ(X_1 ∈ A_1) ·…·ℙ(X_n ∈ A_n)


This proves mutual independence even under gradient updates.




§ THEOREM 8


*theorem8Theorem 8

This result extends the basic composition theorem for differential privacy <cit.>.

[Basic Composition for DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2 g. If M satisfies (ϵ, δ)-differential privacy for a single iteration, then the composition of T independent applications of M satisfies (Tϵ, Tδ)-differential privacy. 

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Define the composed mechanism

Let M_T : 𝒟^T ×Ω^T → (ℝ^d)^T be the T-fold composition of M, defined as:


    M_T((D_1, …, D_T), (ω_1, …, ω_T)) = (M(D_1, ω_1), …, M(D_T, ω_T))


where D_t ∈𝒟 is the dataset at iteration t, and ω_t ∈Ω is the random outcome determining the shuffle at iteration t.

Step 2: Consider adjacent datasets

Let D = (D_1, …, D_T) and D' = (D'_1, …, D'_T) be two adjacent sequences of datasets, differing in at most one element in one of the datasets.

Step 3: Define the privacy loss random variable

Let Z_t : Ω→ℝ be the privacy loss random variable for iteration t:


    Z_t(ω_t) = ln(ℙ(M(D_t, ω_t) = v_t)/ℙ(M(D'_t, ω_t) = v_t))


where v_t = M(D_t, ω_t) is the output of the mechanism at iteration t.

Step 4: Apply the single-iteration privacy guarantee

From the assumption that M satisfies (ϵ, δ)-differential privacy for a single iteration, we know that for any S ⊆ℝ:


    ℙ(Z_t ∈ S) ≤ e^ϵ·ℙ(Z_t ∈ S - ϵ) + δ


Step 5: Analyze the composed privacy loss

Let Z = ∑_t=1^T Z_t be the total privacy loss over T iterations.

From Lemma 7.3, we know that Z_1, …, Z_T are mutually independent.

For any S ⊆ℝ:


    ℙ(Z ∈ S) = ℙ(∑_t=1^T Z_t ∈ S) 
    
        = ∫_x_1+…+x_T ∈ Sℙ(Z_1 = x_1, …, Z_T = x_T)   dx_1 … dx_T 
    
        = ∫_x_1+…+x_T ∈ S∏_t=1^T ℙ(Z_t = x_t)   dx_1 … dx_T 
      (by independence)
    ≤∫_x_1+…+x_T ∈ S∏_t=1^T (e^ϵ·ℙ(Z_t ∈ [x_t-ϵ, x_t]) + δ)   dx_1 … dx_T 
    ≤ e^Tϵ·∫_x_1+…+x_T ∈ S-Tϵ∏_t=1^T ℙ(Z_t ∈ [x_t, x_t+ϵ])   dx_1 … dx_T 
       + 1 - (1-δ)^T 
    ≤ e^Tϵ·ℙ(Z ∈ S - Tϵ) + Tδ


The last inequality uses the fact that 1 - (1-δ)^T ≤ Tδ for δ∈ [0, 1] and T ≥ 1.

Step 6: Conclude the proof

The inequality derived in Step 5 is precisely the definition of (Tϵ, Tδ)-differential privacy for the composed mechanism M_T.

This completes the proof.




§ COROLLARY 8.1


*corollary8.1Corollary 8.1

[Privacy Degradation Rate]
Under the basic composition theorem for DP-BloGS, the privacy parameter ϵ grows linearly with the number of iterations T, while the failure probability δ also grows linearly with T.

Proof:

This follows directly from Theorem 8. After T iterations:
- The privacy parameter is Tϵ
- The failure probability is Tδ

Both grow linearly with T.




§ LEMMA 8.2


*lemma8.2Lemma 8.2

[Composition with Varying Privacy Parameters]
If the DP-BloGS mechanism satisfies (ϵ_t, δ_t)-differential privacy at iteration t, then the T-fold composition satisfies (∑_t=1^T ϵ_t, ∑_t=1^T δ_t)-differential privacy.

Proof:

The proof follows the same structure as Theorem 8, but instead of using the same ϵ and δ for each iteration, we use ϵ_t and δ_t.

In Step 5, the inequality becomes:


    ℙ(Z ∈ S) 
           ≤exp(∑_t=1^T ϵ_t) ·ℙ(Z ∈ S - ∑_t=1^T ϵ_t) 
          + 1 - ∏_t=1^T (1 - δ_t) 
       ≤exp(∑_t=1^T ϵ_t) ·ℙ(Z ∈ S - ∑_t=1^T ϵ_t) 
          + ∑_t=1^T δ_t


The last inequality uses the fact that 1 - ∏_t=1^T (1 - δ_t) ≤∑_t=1^T δ_t for δ_t ∈ [0, 1].

This lemma allows for more flexible privacy budgeting across iterations, which can be useful in adaptive privacy schemes.




§ THEOREM 9


*theorem9Theorem 9

[Advanced Composition for DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2 g. If M satisfies (ϵ, δ)-differential privacy for a single iteration, then for any δ' > 0, the composition of T independent applications of M satisfies (ϵ', δ”)-differential privacy, where:


    ϵ' = √(2T ln(1/δ'))·ϵ + T ·ϵ· (e^ϵ - 1)


    δ” = T ·δ + δ'


This theorem builds upon the advanced composition theorem <cit.> and recent work on composition <cit.>.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Define the composed mechanism

Let M_T : 𝒟^T ×Ω^T → (ℝ^d)^T be the T-fold composition of M, defined as:


    M_T((D_1, …, D_T), (ω_1, …, ω_T)) = (M(D_1, ω_1), …, M(D_T, ω_T))


where D_t ∈𝒟 is the dataset at iteration t, and ω_t ∈Ω is the random outcome determining the shuffle at iteration t.

Step 2: Consider adjacent datasets

Let D = (D_1, …, D_T) and D' = (D'_1, …, D'_T) be two adjacent sequences of datasets, differing in at most one element in one of the datasets.

Step 3: Define the privacy loss random variable

Let Z_t : Ω→ℝ be the privacy loss random variable for iteration t:


    Z_t(ω_t) = ln(ℙ(M(D_t, ω_t) = v_t)/ℙ(M(D'_t, ω_t) = v_t))


where v_t = M(D_t, ω_t) is the output of the mechanism at iteration t.

Step 4: Apply the moment generating function bound

From the properties of (ϵ, δ)-differential privacy, we can bound the moment generating function of Z_t:


    𝔼[exp(λ Z_t)] ≤exp(ϵ· (e^λ - 1)) · (1 - δ) + δ·exp(ϵλ)


for all λ > 0.

Step 5: Analyze the composition of privacy losses

Let Z = ∑_t=1^T Z_t be the total privacy loss over T iterations.

From Lemma 7.3, we know that Z_1, …, Z_T are mutually independent.

Therefore, for any λ > 0:


    𝔼[exp(λ Z)] 
           = ∏_t=1^T 𝔼[exp(λ Z_t)] 
       ≤∏_t=1^T (exp(ϵ· (e^λ - 1)) · (1 - δ) + δ·exp(ϵλ)) 
       ≤(exp(ϵ· (e^λ - 1)) + δ· (exp(ϵλ) - exp(ϵ· (e^λ - 1))))^T


Step 6: Apply Markov's inequality

For any t > 0:


    ℙ(Z > t) 
           = ℙ(exp(λ Z) > exp(λ t)) 
       ≤𝔼[exp(λ Z)]/exp(λ t)
       ≤1/exp(λ t)·(exp(ϵ· (e^λ - 1)) 
          + δ· (exp(ϵλ) - exp(ϵ· (e^λ - 1))))^T


Step 7: Optimize the bound

Let λ = ln(1 + √(2 ln(1/δ') / T) / ϵ).

Substituting this value of λ and simplifying (the full simplification is omitted for brevity but follows standard techniques in differential privacy literature), we get:


    ℙ(Z > ϵ') ≤δ'


where ϵ' = √(2T ln(1/δ'))·ϵ + T ·ϵ· (e^ϵ - 1).

Step 8: Account for the failure probability

With probability at most T ·δ, one or more of the T applications of M might fail to satisfy ϵ-differential privacy. Therefore, the total failure probability is bounded by T ·δ + δ'.

Step 9: Conclude the proof

Combining the results from Steps 7 and 8, we have shown that M_T satisfies (ϵ', δ”)-differential privacy, where:


    ϵ' = √(2T ln(1/δ'))·ϵ + T ·ϵ· (e^ϵ - 1)


    δ” = T ·δ + δ'


This completes the proof.




§ COROLLARY 9.1


*corollary9.1Corollary 9.1

[Asymptotic Behavior of Advanced Composition]
For large T and small ϵ, the privacy parameter ϵ' in the advanced composition theorem grows approximately as O(√(T)), which is significantly slower than the O(T) growth in the basic composition theorem.

Proof:

For small ϵ, we can use the approximation e^ϵ≈ 1 + ϵ + ϵ^2/2.

Substituting this into the expression for ϵ':


    ϵ' ≈√(2T ln(1/δ'))·ϵ + T ·ϵ· ((1 + ϵ + ϵ^2/2) - 1)


    ≈√(2T ln(1/δ'))·ϵ + T ·ϵ· (ϵ + ϵ^2/2)


    ≈√(2T ln(1/δ'))·ϵ + T ·ϵ^2


For large T and small ϵ, the first term dominates, giving us the O(√(T)) growth.




§ LEMMA 9.2


*lemma9.2Lemma 9.2

[Optimal Choice of ϵ for Fixed Total Privacy Budget]
Given a total privacy budget ϵ_total and a number of iterations T, the optimal choice of per-iteration privacy parameter ϵ that minimizes δ” in the advanced composition theorem is:


    ϵ = ϵ_total/√(2T ln(1/δ')) + T · (e^ϵ_total/T - 1)


Proof:

We want to minimize δ” subject to the constraint that ϵ' = ϵ_total.

Solving the equation:


    ϵ_total = √(2T ln(1/δ'))·ϵ + T ·ϵ· (e^ϵ - 1)


for ϵ gives us the stated result.




§ DEFINITION 10


*definition10Definition 10

[Adaptive Shuffling Strategy]

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Let 𝒟 be the space of datasets, ℝ^d be the d-dimensional gradient space, and T be the total number of iterations.

Define the history space ℋ_t for iteration t as:

    ℋ_t = (𝒟×ℝ^d)^t


Let h_t ∈ℋ_t be the history up to iteration t, which includes all previous datasets and shuffled gradients:

    h_t = ((D_1, g_1), …, (D_t, g_t))


Define an adaptive block size function β : ℋ_t →ℕ^+ that maps the history to a positive integer representing the block size.

Define an adaptive clipping threshold function C : ℋ_t →ℝ^+ that maps the history to a positive real number representing the clipping threshold.

The Adaptive DP-BloGS mechanism M_A : 𝒟×Ω×ℋ_t →ℝ^d is defined as:


    M_A(D, ω, h_t) = Shuffle(Clip(g(D), C(h_t)), β(h_t))


where:

    
  * g : 𝒟→ℝ^d is the gradient function,
    
  * Clip : ℝ^d ×ℝ^+ →ℝ^d is a gradient clipping function defined as:
    
    Clip(v, C) = v ·min(1, C/v_2)

    
  * Shuffle : ℝ^d ×ℕ^+ →ℝ^d is a shuffling function that divides the input vector into blocks of size β and randomly permutes these blocks.





§ LEMMA 10.1


*lemma10.1Lemma 10.1

Adaptive differential privacy mechanisms, as explored in <cit.>, inspire the following result. Recent work has further developed techniques for adaptive privacy accounting <cit.>.

[Conditional Independence of Adaptive Shuffles]
Given the history h_t, the output of M_A at iteration t+1 is independent of all previous outputs:

    ℙ(M_A(D_t+1, ω_t+1, h_t) = g_t+1| h_t) = ℙ(M_A(D_t+1, ω_t+1, h_t) = g_t+1)


Proof:

Let π_t : {1, …, ⌈ d/β(h_t) ⌉}→{1, …, ⌈ d/β(h_t) ⌉} be the random permutation used in the Shuffle function at iteration t.

Given h_t, the values of β(h_t) and C(h_t) are deterministic. Therefore:

    ℙ(M_A(D_t+1, ω_t+1, h_t) = g_t+1| h_t) 
       = ℙ(Shuffle(Clip(g(D_t+1), C(h_t)), β(h_t)) = g_t+1| h_t) 
       = ℙ(π_t+1 = σ| h_t) 
         where σ is the permutation that produces  g_t+1
       = 1/(⌈ d/β(h_t) ⌉)!
         since π_t+1 is uniformly random and independent of  h_t 
       = ℙ(M_A(D_t+1, ω_t+1, h_t) = g_t+1)


This completes the proof.




§ THEOREM 10.2


*theorem10.2Theorem 10.2

[Privacy Guarantee for Adaptive DP-BloGS]
Let M_A be the Adaptive DP-BloGS mechanism as defined above. If for all possible histories h_t, the mechanism satisfies (ϵ(h_t), δ(h_t))-differential privacy, then the T-fold adaptive composition of M_A satisfies (ϵ', δ')-differential privacy, where:

    ϵ'    = √(2T ln(1/δ^*))·max_t ϵ(h_t) 
          + T ·max_t ϵ(h_t) · (exp(max_t ϵ(h_t)) - 1) 
    δ'    = T ·max_t δ(h_t) + δ^*

for any δ^* > 0.

Proof:

Let D = (D_1, …, D_T) and D' = (D'_1, …, D'_T) be two adjacent sequences of datasets.

Define the privacy loss random variable for iteration t:

    Z_t(ω_t) = ln(ℙ(M_A(D_t, ω_t, h_t-1) = g_t)/ℙ(M_A(D'_t, ω_t, h_t-1) = g_t))


From the assumption of (ϵ(h_t), δ(h_t))-differential privacy, we know that for any S ⊆ℝ:

    ℙ(Z_t ∈ S | h_t-1) 
           ≤exp(ϵ(h_t-1)) ·ℙ(Z_t ∈ S - ϵ(h_t-1) | h_t-1) 
          + δ(h_t-1)


Let ϵ_max = max_t ϵ(h_t) and δ_max = max_t δ(h_t).

Then, for any λ > 0:

    𝔼[exp(λ Z_t) | h_t-1] 
           ≤exp(ϵ_max· (exp(λ) - 1)) · (1 - δ_max) 
          + δ_max·exp(ϵ_max·λ)


Let Z = ∑_t=1^T Z_t be the total privacy loss.

Using the independence result from Lemma 10.1:

    𝔼[exp(λ Z)] 
           = 𝔼[∏_t=1^T exp(λ Z_t)] 
       = 𝔼[𝔼[∏_t=1^T exp(λ Z_t) | h_T-1]] 
       = 𝔼[∏_t=1^T-1exp(λ Z_t) ·𝔼[exp(λ Z_T) | h_T-1]] 
       ≤𝔼[∏_t=1^T-1exp(λ Z_t)] · (exp(ϵ_max· (exp(λ) - 1)) 
         · (1 - δ_max) + δ_max·exp(ϵ_max·λ))


Continuing this process recursively:

    𝔼[exp(λ Z)] 
           ≤ (exp(ϵ_max· (exp(λ) - 1)) · (1 - δ_max) 
          + δ_max·exp(ϵ_max·λ))^T


From here, we can apply the same techniques used in the proof of Theorem 9 (Advanced Composition) to arrive at the stated bound.

This completes the proof.




§ COROLLARY 10.3


*corollary10.3Corollary 10.3

[Adaptive Privacy Budget Allocation]
In the Adaptive DP-BloGS mechanism, we can allocate privacy budget dynamically by setting:

    ϵ(h_t) = ϵ_total - ϵ_spent(h_t)/√(2(T-t) ln(1/δ^*)) + (T-t) ·(exp(ϵ_total - ϵ_spent(h_t)/T-t) - 1)

where ϵ_total is the total privacy budget, ϵ_spent(h_t) is the privacy budget spent up to iteration t, and T is the total number of iterations.

Proof:

This follows from applying Lemma 9.2 to the remaining iterations at each step, taking into account the already spent privacy budget.




§ THEOREM 11


*theorem11Theorem 11

[Privacy Guarantees for Adaptive DP-BloGS]
Let M_A be the Adaptive DP-BloGS mechanism as defined in Definition 10. For any δ > 0, if the adaptive block size function β(h_t) and adaptive clipping threshold function C(h_t) satisfy:


    
  * β(h_t) ≤β_max for all h_t
    
  * C(h_t) ≤ C_max for all h_t


Then M_A satisfies (ϵ, δ)-differential privacy for T iterations, where:


    ϵ   = min{ϵ_1, ϵ_2}
    ϵ_1    = √(2T ln(1/δ))· 2 ln(1 + d · (exp(2C_max / √(d)) - 1)) 
          + T · (2 ln(1 + d · (exp(2C_max / √(d)) - 1)))^2 
    ϵ_2    = √(2T ln(1/δ))· 2 ln(1 + (β_max/d) · (exp(2C_max√(β_max/d)) - 1)) 
          + T · (2 ln(1 + (β_max/d) · (exp(2C_max√(β_max/d)) - 1)))^2


where |B| is the batch size and d is the dimension of the gradient.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Define the privacy loss random variable

For each iteration t, let Z_t be the privacy loss random variable:


    Z_t(ω_t) = ln(ℙ(M_A(D_t, ω_t, h_t-1) = g_t)/ℙ(M_A(D'_t, ω_t, h_t-1) = g_t))


where D_t and D'_t are adjacent datasets, h_t-1 is the history up to iteration t-1, and g_t is the output of the mechanism.

Step 2: Bound the sensitivity of the clipped gradient

For any adjacent datasets D and D', and any history h_t:


    Clip(g(D), C(h_t)) - Clip(g(D'), C(h_t)) _2    ≤ 2C(h_t) ≤ 2C_max


Step 3: Analyze the privacy loss for a single iteration

We can bound |Z_t| using two different approaches:


    
  * Treating the entire gradient as one block:
    
    |Z_t| ≤ 2 ln(1 + d · (exp(2C_max / (√(d))) - 1))

    
  * Using the maximum block size:
    
    |Z_t| ≤ 2 ln(1 + (β_max/d) · (exp(2C_max·√(β_max/d)) - 1))



The factor of 2 in these bounds accounts for the possibility that an adversary might exploit the randomness of the mechanism.

Let:


    ϵ_single = min{   2 ln(1 + d ·(exp(2C_max/√(d)) - 1)), 
       2 ln(1 + β_max/d·(exp(2C_max√(β_max/d)) - 1))
    }


Step 4: Apply advanced composition

Using the advanced composition theorem (Theorem 3.20 from Dwork and Roth, 2014), we can bound the total privacy loss over T iterations. For any δ > 0, with probability at least 1 - δ:


    ϵ≤√(2T ln(1/δ))·ϵ_single + T ·ϵ_single^2/2


Step 5: Derive the final bounds

Substituting the two bounds for ϵ_single gives us ϵ_1 and ϵ_2:


    ϵ_1    = √(2T ln(1/δ))· 2 ln(1 + d · (e^2C_max/√(d) - 1)) 
          + T · (2 ln(1 + d · (e^2C_max/√(d) - 1)))^2 
    ϵ_2    = √(2T ln(1/δ))· 2 ln(1 + (β_max/d) 
         · (e^2C_max√(β_max/d) - 1)) 
          + T · (2 ln(1 + (β_max/d) 
         · (e^2C_max√(β_max/d) - 1)))^2


Step 6: Conclude the proof

Taking the minimum of ϵ_1 and ϵ_2 gives us the tightest bound, completing the proof.





§ COROLLARY 11.1


*corollary11.1Corollary 11.1

[Optimal Adaptive Parameters]
The optimal choices for β(h_t) and C(h_t) that minimize ϵ while maintaining a fixed utility U are:


    β^*(h_t) = min{d, max{1, ⌊ d ·exp(-2ϵ_t / d) ⌋}}



    C^*(h_t) = √(U/2d)


where ϵ_t is the privacy budget allocated to iteration t.

Proof: (The proof remains the same as in the original theorem)




§ LEMMA 11.2


*lemma11.2Lemma 11.2

[Privacy Amplification by Subsampling in Adaptive DP-BloGS]
If each iteration of Adaptive DP-BloGS operates on a random subsample of size m from a dataset of size n, and the mechanism satisfies ϵ-differential privacy on the subsample, then it satisfies ϵ'-differential privacy on the full dataset, where:


    ϵ' = ln(1 + m/n · (exp(ϵ) - 1))


Proof:

Let q = m/n be the sampling ratio.

For any output S of the mechanism:


    ℙ(M_A(D) ∈ S) 
       = (1-q) ·ℙ(M_A(D) ∈ S | x ∉sample) 
          + q ·ℙ(M_A(D) ∈ S | x ∈sample) 
       ≤ (1-q) ·ℙ(M_A(D') ∈ S) + q ·exp(ϵ) ·ℙ(M_A(D') ∈ S) 
       = ((1-q) + q ·exp(ϵ)) ·ℙ(M_A(D') ∈ S) 
       = (1 + q · (exp(ϵ) - 1)) ·ℙ(M_A(D') ∈ S)


Taking the logarithm of both sides gives us ϵ'.




§ LEMMA 12


*lemma12Lemma 12

This approach leverages privacy amplification by subsampling, as analyzed in <cit.>.

[Interaction Between Shuffling and Mini-batch Sampling]
Let M_A be the Adaptive DP-BloGS mechanism as defined in Definition 10, and let S be a mini-batch sampling mechanism that selects m elements uniformly at random from a dataset of size n. Then, the composition of S and M_A, denoted as M_S = M_A ∘ S, satisfies (ϵ', δ')-differential privacy, where:


    ϵ' = ln(1 + q(e^ϵ - 1))



    δ' = qδ


where q = m/n is the sampling ratio, and (ϵ, δ) are the privacy parameters of M_A. 

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Define the sampling mechanism

Let S : 𝒟×Ω→𝒟_m be the mini-batch sampling mechanism, where 𝒟_m is the space of datasets of size m. For any dataset D ∈𝒟 and ω∈Ω, S(D, ω) selects m elements from D uniformly at random.

Step 2: Consider adjacent datasets

Let D, D' ∈𝒟 be two adjacent datasets differing in one element, say x and x'.

Step 3: Analyze the probability of including the differing element

Let E be the event that the differing element is included in the mini-batch. Then:


    ℙ(E) = m/n = q


Step 4: Decompose the output probability

For any output O in the range of M_S:


    ℙ(M_S(D) ∈ O) 
       = ℙ(M_S(D) ∈ O | E) ·ℙ(E) 
          + ℙ(M_S(D) ∈ O |not  E) ·ℙ(not  E) 
       = q ·ℙ(M_S(D) ∈ O | E) 
          + (1-q) ·ℙ(M_S(D) ∈ O |not  E)


Step 5: Apply the privacy guarantee of M_A

When E occurs, we can apply the (ϵ, δ)-differential privacy guarantee of M_A:


    ℙ(M_S(D) ∈ O | E) ≤ e^ϵ·ℙ(M_S(D') ∈ O | E) + δ


When E does not occur, the output distributions are identical:


    ℙ(M_S(D) ∈ O |not  E) = ℙ(M_S(D') ∈ O |not  E)


Step 6: Combine the probabilities


    ℙ(M_S(D) ∈ O) 
       ≤ q · (e^ϵ·ℙ(M_S(D') ∈ O | E) + δ) 
          + (1-q) ·ℙ(M_S(D') ∈ O |not  E) 
       = q · e^ϵ·ℙ(M_S(D') ∈ O | E) + qδ
          + (1-q) ·ℙ(M_S(D') ∈ O |not  E) 
       ≤ (qe^ϵ + 1-q) ·ℙ(M_S(D') ∈ O) + qδ
       = (1 + q(e^ϵ - 1)) ·ℙ(M_S(D') ∈ O) + qδ


Step 7: Conclude the proof

From the inequality in Step 6, we can conclude that M_S satisfies (ϵ', δ')-differential privacy, where:


    ϵ' = ln(1 + q(e^ϵ - 1))



    δ' = qδ


This completes the proof.




§ COROLLARY 12.1


*corollary12.1Corollary 12.1

[Privacy Amplification by Subsampling]
When q < 1/e, the privacy guarantee of M_S is strictly better than that of M_A.

Proof:

We need to show that ϵ' < ϵ when q < 1/e.


    ϵ' < ϵ



    ⇔ln(1 + q(e^ϵ - 1)) < ϵ



    ⇔ 1 + q(e^ϵ - 1) < e^ϵ



    ⇔ q < e^ϵ - 1/e^ϵ - 1 = 1


The stricter condition q < 1/e ensures that this inequality holds for all ϵ > 0.




§ THEOREM 12.2


*theorem12.2Theorem 12.2

[Optimal Sampling Ratio]
Given a fixed privacy budget (ϵ, δ) and a desired number of iterations T, the optimal sampling ratio q^* that maximizes the number of iterations while maintaining (ϵ, δ)-differential privacy is:


    q^* = min(1, e^ϵ/T - 1/e^ϵ - 1)


Proof:

We want to maximize T subject to the constraint:


    ϵ≥ T ·ln(1 + q(e^ϵ/T - 1))


Treating this as an equality and solving for q gives us:


    q = e^ϵ/T - 1/e^ϵ - 1


This q is decreasing in T, so to maximize T, we choose the smallest q that is still valid (i.e., q ≤ 1).

Hence, q^* = min(1, e^ϵ/T - 1/e^ϵ - 1).




§ LEMMA 12.3


*lemma12.3Lemma 12.3

[Composition of Mini-batch Sampling and Adaptive DP-BloGS]
Let M_A be an Adaptive DP-BloGS mechanism that satisfies (ϵ(h_t), δ(h_t))-differential privacy at iteration t given history h_t. Let S be a mini-batch sampling mechanism with sampling ratio q. Then the T-fold adaptive composition of M_S = M_A ∘ S satisfies (ϵ', δ')-differential privacy, where:


    ϵ'    = √(2T ln(1/δ^*))·max_t ln(1 + q(e^ϵ(h_t) - 1)) 
          + T ·max_t ln(1 + q(e^ϵ(h_t) - 1)) 
         · (e^max_t ln(1 + q(e^ϵ(h_t) - 1)) - 1) 
    δ'    = T · q ·max_t δ(h_t) + δ^*


for any δ^* > 0.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Define the composed mechanism

Let M_S : 𝒟×Ω×ℋ_t →ℝ^d be the composition of S and M_A:


    M_S(D, ω, h_t) = M_A(S(D, ω_S), ω_A, h_t)


where ω = (ω_S, ω_A) ∈Ω, ω_S determines the random sampling, and ω_A determines the random shuffling.

Step 2: Analyze the privacy guarantee for a single iteration

From Lemma 12, we know that for any iteration t, given history h_t, M_S satisfies (ϵ_t, δ_t)-differential privacy where:


    ϵ_t = ln(1 + q(e^ϵ(h_t) - 1))



    δ_t = q ·δ(h_t)


Step 3: Define the privacy loss random variable

Let Z_t be the privacy loss random variable for iteration t:


    Z_t(ω) = ln(ℙ(M_S(D_t, ω, h_t-1) = g_t)/ℙ(M_S(D'_t, ω, h_t-1) = g_t))


where D_t and D'_t are adjacent datasets.

Step 4: Bound the moment generating function of Z_t

From the properties of (ϵ_t, δ_t)-differential privacy, we can bound the moment generating function of Z_t:


    𝔼[e^λ Z_t| h_t-1] ≤ e^ϵ_t · (e^λ - 1)· (1 - δ_t) + δ_t · e^ϵ_t ·λ


for all λ > 0.

Step 5: Define the worst-case privacy parameters

Let ϵ_max = max_t ϵ_t = max_t ln(1 + q(e^ϵ(h_t) - 1)) and δ_max = max_t δ_t = q ·max_t δ(h_t).

Step 6: Bound the total privacy loss

Let Z = ∑_t=1^T Z_t be the total privacy loss over T iterations.

Using the independence result from Lemma 10.1 and the bound from Step 4:


    𝔼[e^λ Z] 
           = 𝔼[∏_t=1^T e^λ Z_t] 
       = 𝔼[𝔼[∏_t=1^T e^λ Z_t| h_T-1]] 
       = 𝔼[∏_t=1^T-1 e^λ Z_t·𝔼[e^λ Z_T| h_T-1]] 
       ≤𝔼[∏_t=1^T-1 e^λ Z_t] · 
            (e^ϵ_max· (e^λ - 1)· (1 - δ_max) 
          + δ_max· e^ϵ_max·λ)


Continuing this process recursively:


    𝔼[e^λ Z] ≤ (e^ϵ_max· (e^λ - 1)· (1 - δ_max) + δ_max· e^ϵ_max·λ)^T


Step 7: Apply Markov's inequality

For any t > 0:


    ℙ(Z > t) 
           = ℙ(e^λ Z > e^λ t) 
       ≤𝔼[e^λ Z]/e^λ t
       ≤(e^ϵ_max· (e^λ - 1)· (1 - δ_max) 
            + δ_max· e^ϵ_max·λ)^T/e^λ t


Step 8: Optimize the bound

Let λ = ln(1 + √(2 ln(1/δ^*) / T) / ϵ_max).

Substituting this value of λ and simplifying (the full simplification is omitted for brevity but follows standard techniques in differential privacy literature), we get:


    ℙ(Z > ϵ') ≤δ^*


where ϵ' = √(2T ln(1/δ^*))·ϵ_max + T ·ϵ_max· (e^ϵ_max - 1).

Step 9: Account for the failure probability

With probability at most T ·δ_max, one or more of the T applications of M_S might fail to satisfy ϵ_max-differential privacy. Therefore, the total failure probability is bounded by T ·δ_max + δ^*.

Step 10: Conclude the proof

Combining the results from Steps 8 and 9, and substituting the expressions for ϵ_max and δ_max, we have shown that the T-fold adaptive composition of M_S satisfies (ϵ', δ')-differential privacy, where:


    ϵ'    = √(2T ln(1/δ^*))·max_t ln(1 + q(e^ϵ(h_t) - 1)) 
          + T ·max_t ln(1 + q(e^ϵ(h_t) - 1)) 
         · (e^max_t ln(1 + q(e^ϵ(h_t) - 1)) - 1) 
    δ'    = T · q ·max_t δ(h_t) + δ^*


This completes the proof.




§ THEOREM 13


*theorem13Theorem 13

[Privacy Amplification via Subsampling in DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2 g. Let S be a Poisson subsampling mechanism with sampling probability q. Then, for any 0 < δ < 1, the composed mechanism M_S = M ∘ S satisfies (ϵ', δ)-differential privacy, where:


    ϵ' = log((1-q) + q ·exp(ϵ_0))


and ϵ_0 is the smallest positive real number satisfying:


    q · (exp(ϵ_0) - 1) ·exp(-ϵ_0) = δ


where ϵ is the privacy parameter of M without subsampling.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Define the Poisson subsampling mechanism

Let S : 𝒟×Ω→ 2^𝒟 be the Poisson subsampling mechanism. For any dataset D ∈𝒟 and ω∈Ω, S(D, ω) includes each element of D independently with probability q.

Step 2: Consider adjacent datasets

Let D, D' ∈𝒟 be two adjacent datasets differing in one element, say x and x'.

Step 3: Analyze the output probabilities

For any output O in the range of M_S:


    ℙ(M_S(D) ∈ O) 
           = (1-q) ·ℙ(M_S(D) ∈ O | x  not sampled) 
          + q ·ℙ(M_S(D) ∈ O | x  sampled) 
    ℙ(M_S(D') ∈ O) 
           = (1-q) ·ℙ(M_S(D') ∈ O | x'  not sampled) 
          + q ·ℙ(M_S(D') ∈ O | x'  sampled)


Step 4: Apply the privacy guarantee of M

When x (or x') is not sampled, the output distributions are identical:


    ℙ(M_S(D) ∈ O | x  not sampled) = ℙ(M_S(D') ∈ O | x'  not sampled)


When x (or x') is sampled, we can apply the ϵ-differential privacy guarantee of M:


    ℙ(M_S(D) ∈ O | x  sampled) ≤exp(ϵ) ·ℙ(M_S(D') ∈ O | x'  sampled)


Step 5: Combine the probabilities


    ℙ(M_S(D) ∈ O) 
           ≤ (1-q) ·ℙ(M_S(D') ∈ O | x'  not sampled) 
          + q · e^ϵ·ℙ(M_S(D') ∈ O | x'  sampled) 
       ≤ ((1-q) + q · e^ϵ) ·ℙ(M_S(D') ∈ O)


Step 6: Define the privacy loss random variable

Let Z be the privacy loss random variable:


    Z = ln(ℙ(M_S(D) ∈ O)/ℙ(M_S(D') ∈ O))


From Step 5, we know that:


    Z ≤ln((1-q) + q ·exp(ϵ))


Step 7: Analyze the tail probability

We want to find ϵ_0 such that:


    ℙ(Z > ϵ_0) ≤δ


This is equivalent to:


    q ·ℙ(Z > ϵ_0 | x  sampled) ≤δ


Given that Z ≤ϵ when x is sampled, we can write:


    q · (exp(ϵ_0) - 1) ·exp(-ϵ_0) ≤δ


Step 8: Define ϵ'

Let ϵ' = ln((1-q) + q ·exp(ϵ_0))

Step 9: Verify (ϵ', δ)-differential privacy

For any S ⊆ℝ:


    ℙ(Z ∈ S) ≤exp(ϵ') ·ℙ(Z ∈ S - ϵ') + ℙ(Z > ϵ_0)



    ≤exp(ϵ') ·ℙ(Z ∈ S - ϵ') + δ


This satisfies the definition of (ϵ', δ)-differential privacy.

Step 10: Conclude the proof

We have shown that M_S satisfies (ϵ', δ)-differential privacy, where:


    ϵ' = ln((1-q) + q ·exp(ϵ_0))


and ϵ_0 is the smallest positive real number satisfying:


    q · (exp(ϵ_0) - 1) ·exp(-ϵ_0) = δ


This completes the proof.




§ COROLLARY 13.1


*corollary13.1Corollary 13.1

[Asymptotic Behavior of Privacy Amplification]
As q → 0, ϵ' → 0 for any fixed ϵ and δ.

Proof:

As q → 0, the equation q · (exp(ϵ_0) - 1) ·exp(-ϵ_0) = δ implies that ϵ_0 →∞.

However, ϵ' = ln((1-q) + q ·exp(ϵ_0)) ≈ q ·exp(ϵ_0) for small q.

Therefore, as q → 0, ϵ' → 0.




§ LEMMA 13.2


*lemma13.2Lemma 13.2

[Optimal Sampling Probability]
Given a desired privacy level (ϵ', δ) and the original ϵ of the mechanism M, the optimal sampling probability q^* that maximizes the utility while satisfying (ϵ', δ)-differential privacy is:


    q^* = exp(ϵ') - 1/exp(ϵ) - 1


Proof:

We want to maximize q subject to:


    ϵ' = ln((1-q) + q ·exp(ϵ))


Solving this equation for q gives us:


    q = exp(ϵ') - 1/exp(ϵ) - 1


This q maximizes the sample size (and thus the utility) while still satisfying the desired privacy level.




§ LEMMA 14


*lemma14Lemma 14

[Expected Gradient Under DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d. For any dataset D ∈𝒟, the expected value of the shuffled gradient is equal to the true gradient:


    𝔼[M(D, ω)] = g(D)


where the expectation is taken over the random shuffling ω.

Proof:

Let (Ω, ℱ, ℙ) be our probability space as defined in Definition 2.

Step 1: Recall the definition of M


    M(D, ω) = Shuffle(g(D), β, π(ω))


where β is the block size and π : Ω→𝒮_m is a function that maps the random outcome ω to a permutation of m = ⌈ d/β⌉ blocks.

Step 2: Express the expectation componentwise

For any i ∈{1, …, d}, let M(D, ω)[i] denote the i-th component of the shuffled gradient. We need to show that:


    𝔼[M(D, ω)[i]] = g(D)[i]


Step 3: Analyze the probability distribution of M(D, ω)[i]

Let b(i) = ⌊ (i-1)/β⌋ be the block index of the i-th component, and let r(i) = (i-1) β be the position within its block.

The value of M(D, ω)[i] depends on which block is shuffled to position b(i). For any j ∈{1, …, m}:


    ℙ(π(ω)(j) = b(i)) = 1/m


If π(ω)(j) = b(i), then M(D, ω)[i] = g(D)[β· j + r(i) + 1].

Step 4: Compute the expectation


    𝔼[M(D, ω)[i]] 
           = ∑_j=1^m ℙ(π(ω)(j) = b(i)) · g(D)[β· j + r(i) + 1] 
       = 1/m·∑_j=1^m g(D)[β· j + r(i) + 1]


Step 5: Simplify the summation

The sum ∑_j=1^m g(D)[β· j + r(i) + 1] includes every β-th element of g(D), starting from position r(i) + 1. This sum, when divided by m, is equal to the average of all elements in g(D) that have the same position within their block as g(D)[i].

Due to the nature of integer division and modulo operations, this average is exactly g(D)[i]:


    1/m·∑_j=1^m g(D)[β· j + r(i) + 1] = g(D)[i]


Step 6: Conclude the proof

We have shown that for all i ∈{1, …, d}:


    𝔼[M(D, ω)[i]] = g(D)[i]


Therefore:


    𝔼[M(D, ω)] = g(D)


This completes the proof.




§ COROLLARY 14.1


*corollary14.1Corollary 14.1

[Unbiasedness of DP-BloGS]
The DP-BloGS mechanism M is an unbiased estimator of the true gradient g(D).

Proof:
This follows directly from Lemma 14, as the definition of an unbiased estimator is that its expected value equals the true value being estimated.




§ THEOREM 14.2


*theorem14.2Theorem 14.2

[Variance of DP-BloGS]
Let M be the DP-BloGS mechanism with block size β. The variance of each component of the shuffled gradient is bounded by:


    Var(M(D, ω)[i]) ≤β-1/β·Var(g(D))


where Var(g(D)) is the variance of the components of the true gradient.

Proof:

Step 1: Express the variance


    Var(M(D, ω)[i]) 
           = 𝔼[(M(D, ω)[i] - 𝔼[M(D, ω)[i]])^2] 
       = 𝔼[M(D, ω)[i]^2] - (𝔼[M(D, ω)[i]])^2


Step 2: Analyze 𝔼[M(D, ω)[i]^2]


    𝔼[M(D, ω)[i]^2] 
           = ∑_j=1^m ℙ(π(ω)(j) = b(i)) · (g(D)[β· j + r(i) + 1])^2 
       = 1/m·∑_j=1^m (g(D)[β· j + r(i) + 1])^2


Step 3: Apply the Cauchy-Schwarz inequality


    (∑_j=1^m g(D)[β· j + r(i) + 1])^2 ≤ m ·∑_j=1^m (g(D)[β· j + r(i) + 1])^2


Dividing both sides by m^2:


    (𝔼[M(D, ω)[i]])^2 ≤1/m·𝔼[M(D, ω)[i]^2]


Step 4: Bound the variance


    Var(M(D, ω)[i])    = 𝔼[M(D, ω)[i]^2] - (𝔼[M(D, ω)[i]])^2 
       ≥𝔼[M(D, ω)[i]^2] - 1/m·𝔼[M(D, ω)[i]^2] 
       = (1 - 1/m) ·𝔼[M(D, ω)[i]^2]



    = (m-1/m) ·1/m·∑_j=1^m (g(D)[β· j + r(i) + 1])^2


Step 5: Relate to the variance of g(D)


    Var(g(D)) = 1/d·∑_k=1^d (g(D)[k] - μ)^2,  where μ = 1/d·∑_k=1^d g(D)[k]


Observe that:


    1/m·∑_j=1^m (g(D)[β· j + r(i) + 1])^2 
         ≤β/d·∑_k=1^d (g(D)[k])^2 
         ≤β·Var(g(D))


Step 6: Conclude the proof


    Var(M(D, ω)[i]) ≤(m-1/m) ·β·Var(g(D)) = (β-1/β) ·Var(g(D))


This completes the proof.




§ THEOREM 15


*theorem15Theorem 15

This convergence analysis extends work on differentially private SGD <cit.> and general SGD convergence <cit.>. It also builds upon foundational work on private empirical risk minimization <cit.>.

[Convergence of DP-BloGS SGD]
Let f : ℝ^d →ℝ be a convex function with L-Lipschitz continuous gradients. Let M be the DP-BloGS mechanism as defined in Definition 2, applied to the stochastic gradient g(θ, ξ), where ξ is a random data sample. Assume that 𝔼[g(θ, ξ)] = ∇ f(θ) and 𝔼[g(θ, ξ)^2] ≤ G^2 for all θ. Let {θ_t} be the sequence of iterates generated by the DP-BloGS SGD algorithm:


    θ_t+1 = θ_t - η_t M(g(θ_t, ξ_t), ω_t)


where η_t is the learning rate at iteration t. Then, for T iterations and any δ > 0, with probability at least 1 - δ:


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η L G^2/2 + G √(2 log(1/δ)/T)


where θ̅_T = 1/T∑_t=1^T θ_t is the average of the iterates, θ^* is the optimal solution, and η = 1/T∑_t=1^T η_t is the average learning rate. 

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Express the update rule


    θ_t+1 = θ_t - η_t M(g(θ_t, ξ_t), ω_t)


Step 2: Analyze the squared distance to the optimum

    θ_t+1 - θ^*^2 
           = θ_t - η_t M(g(θ_t, ξ_t), ω_t) - θ^*^2 
       = θ_t - θ^*^2 + η_t^2 M(g(θ_t, ξ_t), ω_t)^2 
          - 2η_t ⟨θ_t - θ^*, M(g(θ_t, ξ_t), ω_t) ⟩


Step 3: Take expectation over ω_t and ξ_t

    𝔼[θ_t+1 - θ^*^2] 
           = θ_t - θ^*^2 + η_t^2 𝔼[M(g(θ_t, ξ_t), ω_t)^2] 
          - 2η_t ⟨θ_t - θ^*, 𝔼[M(g(θ_t, ξ_t), ω_t)] ⟩


From Lemma 14, we know that 𝔼[M(g(θ_t, ξ_t), ω_t)] = 𝔼[g(θ_t, ξ_t)] = ∇ f(θ_t).

Also, from Theorem 14.2 and our assumption, 𝔼[M(g(θ_t, ξ_t), ω_t)^2] ≤𝔼[g(θ_t, ξ_t)^2] ≤ G^2.

Step 4: Apply these results


    𝔼[θ_t+1 - θ^*^2] ≤θ_t - θ^*^2 + η_t^2 G^2 - 2η_t ⟨θ_t - θ^*, ∇ f(θ_t) ⟩


Step 5: Use the convexity of f

By convexity of f, we have:


    f(θ_t) - f(θ^*) ≤⟨∇ f(θ_t), θ_t - θ^* ⟩


Rearranging:


    -⟨∇ f(θ_t), θ_t - θ^* ⟩≤ -(f(θ_t) - f(θ^*))


Step 6: Combine the results


    𝔼[θ_t+1 - θ^*^2] ≤θ_t - θ^*^2 + η_t^2 G^2 - 2η_t(f(θ_t) - f(θ^*))


Step 7: Rearrange terms


    2η_t(f(θ_t) - f(θ^*)) ≤θ_t - θ^*^2 - 𝔼[θ_t+1 - θ^*^2] + η_t^2 G^2


Step 8: Sum over t = 0 to T-1


    ∑_t=0^T-1 2η_t(f(θ_t) - f(θ^*)) ≤θ_0 - θ^*^2 - 𝔼[θ_T - θ^*^2] + G^2 ∑_t=0^T-1η_t^2


Step 9: Apply Jensen's inequality


    f(θ̅_T) - f(θ^*) ≤1/T∑_t=0^T-1 (f(θ_t) - f(θ^*))


Step 10: Combine and rearrange


    2Tη(f(θ̅_T) - f(θ^*)) ≤θ_0 - θ^*^2 + G^2 ∑_t=0^T-1η_t^2


where η = 1/T∑_t=0^T-1η_t.

Step 11: Apply Cauchy-Schwarz inequality


    ∑_t=0^T-1η_t^2 ≤ T ∑_t=0^T-1η_t^2/T = Tη^2


Step 12: Rearrange to get the bound


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η G^2/2


Step 13: Account for the high probability bound

To get a high probability bound, we can use the Azuma-Hoeffding inequality. Let X_t = f(θ_t) - f(θ^*) - (𝔼[f(θ_t)] - f(θ^*)). {X_t} forms a martingale difference sequence with |X_t| ≤ 2Gθ_t - θ^*≤ 2G^2.

By Azuma-Hoeffding, with probability at least 1 - δ:


    |1/T∑_t=1^T X_t| ≤ G√(2log(1/δ)/T)


Step 14: Conclude the proof

Combining the expectation bound and the high probability bound, we get:


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η G^2/2 + G√(2log(1/δ)/T)


with probability at least 1 - δ.

This completes the proof.




§ COROLLARY 15.1


*corollary15.1Corollary 15.1

[Optimal Learning Rate]
The optimal constant learning rate η that minimizes the bound in Theorem 15 is:


    η^* = √(θ_0 - θ^*^2/G^2 T)


Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Recall the bound from Theorem 15


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η G^2/2 + G√(2log(1/δ)/T)


Step 2: Consider constant learning rate

Let η = η for all iterations. Our goal is to minimize:


    B(η) = θ_0 - θ^*^2/2η T + η G^2/2


Note: We ignore the term G√(2log(1/δ)/T) as it doesn't depend on η.

Step 3: Find the derivative of B(η)


    B'(η) = d/dη( θ_0 - θ^*^2/2η T + η G^2/2) = -θ_0 - θ^*^2/2η^2 T + G^2/2


Step 4: Set the derivative to zero and solve


    0 = -θ_0 - θ^*^2/2η^2 T + G^2/2



    θ_0 - θ^*^2/2η^2 T = G^2/2



    η^2 = θ_0 - θ^*^2/G^2 T



    η^* = √(θ_0 - θ^*^2/G^2 T)


Step 5: Verify second derivative for minimum


    B”(η) = d^2/dη^2( θ_0 - θ^*^2/2η T + η G^2/2) = θ_0 - θ^*^2/η^3 T


At η = η^*, B”(η^*) > 0, confirming that this is indeed a minimum.

Step 6: Interpret the result

The optimal learning rate η^* balances two competing factors:

    
  * The initial distance to the optimum θ_0 - θ^*^2
    
  * The bound on the gradient norm G^2
    
  * The number of iterations T


As T increases, the optimal learning rate decreases, which is consistent with common practices in optimization where the learning rate is often decreased over time.

Step 7: Substituting η^* back into the bound

Let's substitute η^* back into B(η) to see the optimized bound:


    B(η^*)    = θ_0 - θ^*^2/2√(θ_0 - θ^*^2/G^2 T)T 
        + √(θ_0 - θ^*^2/G^2 T)G^2/2
       = √(θ_0 - θ^*^2 G^2 T/T) 
        + √(θ_0 - θ^*^2 G^2 T/T)


Therefore, with the optimal constant learning rate, the bound becomes:


    𝔼[f(θ̅_T) - f(θ^*)] ≤ 2 √(θ_0 - θ^*^2 G^2/T) + G √(2 log(1/δ)/T)


This shows that the expected suboptimality converges at a rate of O(1/√(T)), which is optimal for stochastic convex optimization.

This completes the proof.




§ COROLLARY 16


*corollary16Corollary 16

[Utility Bounds for DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient function g : 𝒟→ℝ^d with L_2 sensitivity Δ_2g. Let f : ℝ^d →ℝ be an L-smooth convex function optimized using DP-BloGS SGD for T iterations with constant learning rate η. Then, for any δ > 0, with probability at least 1 - δ:


    𝔼[f(θ̅_T) - f(θ^*)] 
           ≤θ_0 - θ^*^2/2η T 
        + η L(G^2 + σ^2)/2
          + (G + σ)√(2log(2/δ)/T)


where θ̅_T = 1/T∑_t=1^T θ_t is the average of the iterates, θ^* is the optimal solution, G^2 is an upper bound on 𝔼[g(θ, ξ)^2], and σ^2 = (β-1)G^2/β is the maximum variance introduced by DP-BloGS with block size β.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Recall the update rule of DP-BloGS SGD


    θ_t+1 = θ_t - η M(g(θ_t, ξ_t), ω_t)


where ξ_t is the random data sample at iteration t, and ω_t is the random shuffle.

Step 2: Decompose the shuffled gradient

Let g̃_t = M(g(θ_t, ξ_t), ω_t) be the shuffled gradient. We can decompose it as:


    g̃_t = ∇ f(θ_t) + ζ_t + ν_t


where:

    
  * ∇ f(θ_t) is the true gradient
    
  * ζ_t = g(θ_t, ξ_t) - ∇ f(θ_t) is the stochastic gradient noise
    
  * ν_t = g̃_t - g(θ_t, ξ_t) is the additional noise introduced by shuffling


Step 3: Analyze the properties of ζ_t and ν_t


    𝔼[ζ_t] = 0    (unbiased stochastic gradient)


    𝔼[ζ_t^2] ≤ G^2    (bounded second moment)


From Lemma 14 and Theorem 14.2:

    𝔼[ν_t] = 0    (unbiased shuffle)


    𝔼[ν_t^2] ≤σ^2 = (β-1)G^2/β   (variance bound from Theorem 14.2)


Step 4: Follow the proof structure of Theorem 15

Similar to the proof of Theorem 15, we can derive:


    𝔼[θ_t+1 - θ^*^2] ≤θ_t - θ^*^2 + η^2𝔼[g̃_t^2] - 2η⟨θ_t - θ^*, ∇ f(θ_t) ⟩


Step 5: Bound 𝔼[g̃_t^2]


    𝔼[g̃_t^2] = 𝔼[∇ f(θ_t) + ζ_t + ν_t^2]


    ≤∇ f(θ_t)^2 + 𝔼[ζ_t^2] + 𝔼[ν_t^2]    (by Jensen's inequality)


    ≤ G^2 + G^2 + σ^2 = 2G^2 + σ^2


Step 6: Apply L-smoothness

By L-smoothness of f:


    f(θ_t+1) ≤ f(θ_t) + ⟨∇ f(θ_t), θ_t+1 - θ_t ⟩ + L/2θ_t+1 - θ_t^2


    = f(θ_t) - η⟨∇ f(θ_t), g̃_t ⟩ + Lη^2/2g̃_t^2


Taking expectation:


    𝔼[f(θ_t+1)] ≤ f(θ_t) - η∇ f(θ_t)^2 + Lη^2/2(2G^2 + σ^2)


Step 7: Sum over t = 0 to T-1


    ∑_t=0^T-1𝔼[f(θ_t+1) - f(θ^*)] 
       ≤∑_t=0^T-1 [f(θ_t) - f(θ^*) - η∇ f(θ_t)^2 
        + Lη^2/2(2G^2 + σ^2)]


Step 8: Apply Jensen's inequality


    f(θ̅_T) - f(θ^*) ≤1/T∑_t=0^T-1 [f(θ_t) - f(θ^*)]


Step 9: Combine and rearrange

    𝔼[f(θ̅_T) - f(θ^*)] 
           ≤f(θ_0) - f(θ^*)/T + Lη/2(2G^2 + σ^2) 
          - η/T∑_t=0^T-1∇ f(θ_t)^2


Step 10: Use the bound on θ_0 - θ^*^2

    f(θ_0) - f(θ^*) 
           ≤⟨∇ f(θ^*), θ_0 - θ^* ⟩ 
            + L/2θ_0 - θ^*^2 
       ≤L/2θ_0 - θ^*^2


Step 11: Apply Azuma-Hoeffding inequality

Let X_t = f(θ_t) - f(θ^*) - (𝔼[f(θ_t)] - f(θ^*)). {X_t} forms a martingale difference sequence with |X_t| ≤ (G + σ)θ_t - θ^*≤ (G + σ)√(2/L)(f(θ_t) - f(θ^*)).

By Azuma-Hoeffding, with probability at least 1 - δ/2:


    |1/T∑_t=1^T X_t| ≤ (G + σ)√(2log(2/δ)/T)


Step 12: Conclude the proof

Combining all the bounds and applying the high probability bound, we get:

    𝔼[f(θ̅_T) - f(θ^*)] 
           ≤θ_0 - θ^*^2/2η T 
            + η L(G^2 + σ^2)/2
          + (G + σ)√(2log(2/δ)/T)


with probability at least 1 - δ.

This completes the proof.





§ THEOREM 19


*theorem19Theorem 19

This privacy accounting method builds on the moments accountant technique <cit.>.

[Privacy Accounting for DP-BloGS]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied T times independently with block size β and gradient clipping threshold C. Then, for any δ > 0, the mechanism satisfies (ϵ, δ)-differential privacy, where:


    ϵ = min{ϵ_1, ϵ_2}



    ϵ_1    = √(2T ln(1/δ))·ln(1 + d · (exp(2C / (√(d))) - 1)) 
          + T ·ln(1 + d · (exp(2C / (√(d))) - 1)) 
         · (exp(ln(1 + d · (exp(2C / (√(d))) - 1))) - 1)



    ϵ_2    = √(2T ln(1/δ))·ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1)) 
          + T ·ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1)) 
         · (exp(ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1))) - 1)


where |B| is the batch size and d is the dimension of the gradient.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Define the privacy loss random variable

For each iteration t, let Z_t be the privacy loss random variable:


    Z_t = ln( ℙ(M(g(D), ω_t) = v)/ℙ(M(g(D'), ω_t) = v))


where D and D' are adjacent datasets, g is the gradient function, and v is the output of the mechanism.

Step 2: Bound the privacy loss for a single iteration

From the properties of DP-BloGS, we have two bounds on Z_t:

a) Treating the entire gradient as one block:
   
    |Z_t| ≤ln(1 + d · (exp(2C / (√(d))) - 1))


b) Using the block size β:
   
    |Z_t| ≤ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1))


Let ϵ_0 = min{ln(1 + d · (exp(2C / (√(d))) - 1)),
               ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1))}

Then, for any λ > 0:


    𝔼[exp(λ Z_t)] ≤exp(ϵ_0 · (exp(λ) - 1))


Step 3: Analyze the composition over T iterations

Let Z = ∑_t=1^T Z_t be the total privacy loss.

Using the independence of the iterations:


    𝔼[exp(λ Z)] = ∏_t=1^T 𝔼[exp(λ Z_t)] ≤exp(T ·ϵ_0 · (exp(λ) - 1))


Step 4: Apply Markov's inequality

For any t > 0:


    ℙ(Z > t) 
           = ℙ(exp(λ Z) > exp(λ t)) 
       ≤𝔼[exp(λ Z)]/exp(λ t)
       ≤exp(T ·ϵ_0 · (exp(λ) - 1) - λ t)


Step 5: Optimize the bound

Let λ = ln(1 + √(2 ln(1/δ) / (T ·ϵ_0)))

Substituting this value of λ and simplifying:


    ℙ(Z > ϵ) ≤δ


where ϵ = √(2T ln(1/δ))·ϵ_0 + T ·ϵ_0 · (exp(ϵ_0) - 1)

Step 6: Conclude the proof

Substituting the two bounds for ϵ_0 gives us ϵ_1 and ϵ_2. Taking the minimum of these provides the tightest bound, completing the proof.





§ COROLLARY 19.1


*corollary19.1Corollary 19.1

[Asymptotic Behavior of Privacy Loss]
As T →∞, the privacy loss ϵ grows as O(√(T)), which is significantly slower than the O(T) growth in the basic composition theorem.

Proof:

As T →∞, the dominant term in both ϵ_1 and ϵ_2 is √(2T ln(1/δ))·ϵ_0, where ϵ_0 is a constant with respect to T. Therefore, ϵ = O(√(T)).





§ LEMMA 19.2


*lemma19.2Lemma 19.2

[Optimal Block Size]
Given a fixed privacy budget ϵ and a number of iterations T, the optimal block size β^* that minimizes the variance introduced by DP-BloGS while satisfying (ϵ, δ)-differential privacy is:


    β^* = min{d, max{1, ⌊ d ·exp(-2ϵ / (√(2T ln(1/δ))· d))⌋}}


Proof:

The variance introduced by DP-BloGS is proportional to (β-1)/β (from Theorem 14.2). We want to maximize β while ensuring that ϵ_2 ≤ϵ.

Solving the equation:


    √(2T ln(1/δ))·ln(1 + (β/d) · (exp(2C ·√(β/d)) - 1)) = ϵ


for β gives us the stated result.





§ LEMMA 20


*lemma20Lemma 20

This analysis is related to information-theoretic approaches to generalization in machine learning <cit.>. Drawing from information-theoretic approaches to privacy <cit.>, we establish the following bound:

[Information-Theoretic Bounds on Shuffling Privacy]
Let M be the DP-BloGS mechanism as defined in Definition 2, applied to a gradient g ∈ℝ^d with block size β. The mutual information between the input gradient g and the output shuffled gradient M(g, ω) is bounded by:


    I(g; M(g, ω)) ≤log(d/β)


where I(·; ·) denotes mutual information.

Proof:

Let (Ω, ℱ, ℙ) be our probability space.

Step 1: Define the mutual information


    I(g; M(g, ω)) = H(M(g, ω)) - H(M(g, ω) | g)


where H(·) denotes the Shannon entropy and H(· | ·) denotes conditional entropy.

Step 2: Analyze H(M(g, ω))

The output space of M(g, ω) is the same as the input space, ℝ^d. Therefore:


    H(M(g, ω)) ≤log(|ℝ^d|) = d log(|ℝ|)


Step 3: Analyze H(M(g, ω) | g)

Given g, the only uncertainty in M(g, ω) comes from the random permutation of blocks. There are m = ⌈ d/β⌉ blocks, so:


    H(M(g, ω) | g) = log(m!) ≥log((d/β)!)


Step 4: Combine the results


    I(g; M(g, ω)) ≤ d log(|ℝ|) - log((d/β)!)


Step 5: Apply Stirling's approximation


    log(n!) ≈ n log(n) - n + O(log(n))


Applying this to our bound:

    I(g; M(g, ω)) ≤ d log(|ℝ|) - (d/βlog(d/β) - d/β + O(log(d/β)))


    = d log(|ℝ|) - d/βlog(d/β) + d/β - O(log(d/β))


Step 6: Analyze the behavior with respect to β
As |ℝ| →∞, the d log(|ℝ|) term is large but constant with respect to β. The term that depends on β is -d/βlog(d/β) + d/β. As β decreases, this term becomes more negative, tightening the upper bound.

Step 7: Express the bound in terms of β
We can express our bound as:

    I(g; M(g, ω)) ≤ C - d/βlog(d/β) + d/β + O(log(d/β))

where C = d log(|ℝ|) is a constant with respect to β.

Step 8: Conclude the proof
This bound shows that as β decreases, the upper bound on mutual information tightens, potentially providing better privacy. The exact behavior depends on the relative magnitudes of d and β, but in general, smaller block sizes lead to a smaller upper bound on information leakage.

This completes the proof.





§ THEOREM 20.1


*theorem20.1Theorem 20.1

[Lower Bound on Reconstruction Error]
Let g̃ = M(g, ω) be the output of the DP-BloGS mechanism, and let ĝ be any estimator of g based on g̃. Then:

    𝔼[ĝ - g^2] ≥ (d - β) ·exp( -2 I(g; g̃)/d) ·Var(g)

where Var(g) is the average variance of the components of g.



Step 1: Apply the rate-distortion theory

By the rate-distortion theory, for any estimator ĝ:

    𝔼[ĝ - g^2] ≥ d · 2^-2 I(g; g̃)/d·Var(g)


Step 2: Use the bound on mutual information

From Lemma 20, we know that I(g; g̃) ≤log(d/β). Substituting this:

    𝔼[ĝ - g^2] ≥ d · 2^-2 log(d/β)/d·Var(g)
    = d ·( β/d)^2/d·Var(g)


Step 3: Apply the inequality (1 + x)^r ≥ 1 + rx for x > -1 and r ∈ [0, 1]

Let x = β/d - 1 and r = 2/d. Then:

    ( β/d)^2/d = ( 1 + ( β/d - 1 ) )^2/d≥ 1 + 2/d( β/d - 1 ) = 1 - 2(d - β)/d^2


Step 4: Substitute back


    𝔼[ĝ - g^2]    ≥ d ·( 1 - 2(d - β)/d^2) ·Var(g) 
       = (d - 2(d - β)/d) ·Var(g) 
       = (d - β) ·( 2/d) ·Var(g) + β·Var(g) 
       ≥ (d - β) ·exp( -2 log(d/β)/d) ·Var(g)


This completes the proof.




§ COROLLARY 20.2


*corollary20.2Corollary 20.2

[Privacy-Utility Trade-off]
There exists a fundamental trade-off between privacy (measured by mutual information) and utility (measured by reconstruction error) in the DP-BloGS mechanism, governed by the block size β.



From Lemma 20 and Theorem 20.1, we can see that:

    
  * As β decreases, the upper bound on mutual information (log(d/β)) decreases, providing more privacy.
    
  * As β decreases, the lower bound on reconstruction error increases, providing less utility.


This demonstrates the inherent trade-off between privacy and utility controlled by the block size β.




§ LEMMA 21


*lemma21Lemma 21

Inspired by layer-wise approaches and iterative algorithms in private deep learning <cit.>, we introduce parameter-wise DP-BloGS:

[Privacy Loss for Parameter-wise DP-BloGS]
Let (Ω, ℱ, ℙ) be a probability space, where Ω is the sample space, ℱ is a σ-algebra on Ω, and ℙ is a probability measure. Let 𝒟 be the space of datasets, and let D, D' ∈𝒟 be two adjacent datasets differing in at most one element. Let g_i : 𝒟→ℝ^d_i be the gradient function for parameter group i, with L_2 sensitivity Δ_2g_i. Let M_i be the DP-BloGS mechanism applied to parameter group i, with block size β_i, clipping threshold C, and batch size B. Then, for any δ > 0, the privacy loss ϵ_i for a single iteration is bounded by:


    ϵ_i ≤min{ϵ_i1, ϵ_i2}


Where:

    ϵ_i1 = 2 ·ln(1 + d_i · (exp(2C / (√(d_i))) - 1))


    ϵ_i2 = 2 ·ln(1 + (β_i/d_i) · (exp(2C √(β_i/d_i)) - 1))




Step 1: Define the privacy loss random variable

Let Z_i : Ω→ℝ be the privacy loss random variable for parameter group i:

    Z_i(ω) = ln( ℙ(M_i(g_i(D), ω) = v)/ℙ(M_i(g_i(D'), ω) = v))

where v = M_i(g_i(D), ω) is the output of the mechanism for parameter group i.

Step 2: Analyze the distribution of Z_i

From the properties of the DP-BloGS mechanism, we know that for any fixed output v:


    ℙ(M_i(g_i(D), ω) = v)    = 
        1/m_i!   if  v  is a permutation of  g_i(D) 
    
        0    otherwise
    ℙ(M_i(g_i(D'), ω) = v)    = 
        1/m_i!   if  v  is a permutation of  g_i(D') 
    
        0    otherwise


where m_i = ⌈ d_i/β_i ⌉ is the number of blocks for parameter group i.

Therefore, Z_i(ω) can only take two values:


    Z_i(ω)    = 
        
        0    if  v  is a permutation of both  g_i(D)  and  g_i(D') 
    ±∞   otherwise


Step 3: Bound the probability of Z_i(ω) = ±∞

Let E_i be the event that Z_i(ω) = ±∞. This occurs when v is a permutation of g_i(D) but not of g_i(D') (or vice versa).


    ℙ(E_i) 
           ≤ 1 - ℙ(v is a permutation of both  g_i(D)  and  g_i(D')) 
       = 1 - ∑_j=1^d_iℙ(v[j] = g_i(D)[j]  and  v[j] = g_i(D')[j]) 
       = 1 - ∑_j=1^d_iℙ(g_i(D)[j] = g_i(D')[j]) 
       ≤ 1 - d_i - g_i(D) - g_i(D')_0/d_i
       ≤g_i(D) - g_i(D')_0/d_i
       ≤g_i(D) - g_i(D')_2/√(d_i)
         (by the relationship between  L_0  and  L_2  norms)
       ≤Δ_2g_i/√(d_i)


Step 4: Apply the advanced composition theorem

We can view the DP-BloGS mechanism for parameter group i as d_i independent applications of a mechanism that reveals one component of the shuffled gradient. Each of these component mechanisms satisfies (ln(1 + (e^Δ_2g_i / √(d_i) - 1)), Δ_2g_i / (d_i√(d_i)))-differential privacy.

Applying the advanced composition theorem (Theorem 3.20 from Dwork and Roth, 2014), we get that the overall mechanism for parameter group i satisfies (ϵ_i, δ)-differential privacy for any δ > 0, where:

    ϵ_i ≤   √(2d_i ln(1/δ))·ln(1 + (e^Δ_2g_i / √(d_i) - 1)) 
       + d_i ·ln(1 + (e^Δ_2g_i / √(d_i) - 1)) · (e^Δ_2g_i / √(d_i) - 1)


Step 5: Relate Δ_2g_i to the clipping threshold C

From the properties of gradient clipping, we know that:

    Δ_2g_i≤ 2C


Substituting this into our bound:

    ϵ_i ≤   √(2d_i ln(1/δ))·ln(1 + (e^2C / √(d_i) - 1)) 
       + d_i ·ln(1 + (e^2C / √(d_i) - 1)) · (e^2C / √(d_i) - 1)


Step 6: Simplify the bound

Using the inequality √(2d_i ln(1/δ))≤ d_i for sufficiently small δ, we can simplify the bound to:

    ϵ_i    ≤ d_i ·ln(1 + (e^2C / (√(d_i)) - 1)) 
          + d_i ·ln(1 + (e^2C / (√(d_i)) - 1)) · (e^2C / (√(d_i)) - 1) 
       = d_i ·ln(1 + (e^2C / (√(d_i)) - 1)) · (1 + (e^2C / (√(d_i)) - 1))


    = 2 ·ln(1 + d_i · (e^2C / (√(d_i)) - 1))


This gives us ϵ_i1.

Step 7: Derive the block-wise bound

We can also view the DP-BloGS mechanism for parameter group i as m_i = ⌈ d_i/β_i ⌉ applications of a mechanism that reveals one block of the shuffled gradient. Each of these block mechanisms satisfies (ln(1 + (β_i/d_i) · (e^2C√(β_i/d_i) - 1)), 2C√(β_i/d_i) / (d_i))-differential privacy.

Applying the advanced composition theorem again, we get:

    ϵ_i    ≤√(2m_i ln(1/δ))·ln(1 + (β_i/d_i) · (e^2C√(β_i/d_i) - 1)) 
          + m_i ·ln(1 + (β_i/d_i) · (e^2C√(β_i/d_i) - 1)) 
         · ((β_i/d_i) · (e^2C√(β_i/d_i) - 1))


Simplifying as before:

    ϵ_i ≤ 2 ·ln(1 + (β_i/d_i) · (e^2C√(β_i/d_i) - 1))


This gives us ϵ_i2.

Step 8: Conclude the proof

Taking the minimum of ϵ_i1 and ϵ_i2 gives us the tightest bound:

    ϵ_i ≤min{ϵ_i1, ϵ_i2}

Where:

    ϵ_i1 = 2 ·ln(1 + d_i · (exp(2C / (√(d_i))) - 1))


    ϵ_i2 = 2 ·ln(1 + (β_i/d_i) · (exp(2C √(β_i/d_i)) - 1))


This completes the proof of Lemma 21.




§ THEOREM 22


*theorem22Theorem 22

[Composition of Parameter-wise Privacy Losses]
Let (Ω, ℱ, ℙ) be a probability space, where Ω is the sample space, ℱ is a σ-algebra on Ω, and ℙ is a probability measure. Let 𝒟 be the space of datasets, and let D, D' ∈𝒟 be two adjacent datasets differing in at most one element. Let M be the Parameter-wise DP-BloGS mechanism applied to a model with K parameter groups, where each group i satisfies (ϵ_i, δ_i)-differential privacy for a single iteration as per Lemma 21. Then, for T iterations and any δ > 0, the total privacy loss ϵ_total is bounded by:

    ϵ_total≤√(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )

And the mechanism satisfies (ϵ_total, δ_total)-differential privacy, where:

    δ_total = 1 - (1 - δ)(1 - ∑_i=1^K δ_i)^T




Step 1: Define the privacy loss random variables

For each parameter group i and iteration t, let Z_i,t : Ω→ℝ be the privacy loss random variable:

    Z_i,t(ω) = ln( ℙ(M_i(g_i(D_t), ω_t) = v_i,t)/ℙ(M_i(g_i(D'_t), ω_t) = v_i,t))

where v_i,t = M_i(g_i(D_t), ω_t) is the output of the mechanism for parameter group i at iteration t.

Step 2: Apply the moment generating function bound

From the properties of (ϵ_i, δ_i)-differential privacy, we can bound the moment generating function of Z_i,t:

    𝔼[exp(λ Z_i,t)] ≤exp(ϵ_i (e^λ - 1)) (1 - δ_i) + δ_i exp(ϵ_i λ)

for all λ > 0.

Step 3: Analyze the composition of privacy losses

Let Z = ∑_i=1^K ∑_t=1^T Z_i,t be the total privacy loss over all parameter groups and iterations.

By the independence of the mechanism across parameter groups and iterations, we have:

    𝔼[exp(λ Z)] 
           = ∏_i=1^K ∏_t=1^T 𝔼[exp(λ Z_i,t)] 
       ≤∏_i=1^K ∏_t=1^T (exp(ϵ_i (e^λ - 1)) (1 - δ_i) + δ_i exp(ϵ_i λ)) 
       ≤∏_i=1^K (exp(T ϵ_i (e^λ - 1)) + T δ_i exp(T ϵ_i λ))


Step 4: Apply Markov's inequality

For any t > 0:

    ℙ(Z > t) 
           = ℙ(exp(λ Z) > exp(λ t)) 
       ≤𝔼[exp(λ Z)]/exp(λ t)
       ≤∏_i=1^K (exp(T ϵ_i (e^λ - 1)) + T δ_i exp(T ϵ_i λ))/exp(λ t)


Step 5: Optimize the bound

Let λ = ln(1 + √(2 ln(1/δ) / (T ∑_i=1^K ϵ_i))).

Substituting this value of λ and simplifying (the full simplification is omitted for brevity but follows standard techniques in differential privacy literature), we get:

    ℙ(Z > ϵ_total) ≤δ

where

    ϵ_total = √(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )


Step 6: Account for the failure probability

The probability that any of the KT applications of the mechanism (K parameter groups over T iterations) fails to satisfy its individual privacy guarantee is at most:

    1 - (1 - ∑_i=1^K δ_i)^T

Therefore, the total failure probability is bounded by:

    δ_total = 1 - (1 - δ)(1 - ∑_i=1^K δ_i)^T


Step 7: Conclude the proof

Combining the results from Steps 5 and 6, we have shown that the T-fold composition of the Parameter-wise DP-BloGS mechanism over K parameter groups satisfies (ϵ_total, δ_total)-differential privacy, where:

    ϵ_total≤√(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )


    δ_total = 1 - (1 - δ)(1 - ∑_i=1^K δ_i)^T


This completes the proof of Theorem 22.




§ LEMMA 23


*lemma23Lemma 23

[Optimal Block Size Ratio]
Let (Ω, ℱ, ℙ) be a probability space. Let 𝒟 be the space of datasets, and let D, D' ∈𝒟 be two adjacent datasets differing in at most one element. Consider a model with K parameter groups, where each group i has dimension d_i and block size β_i. Let M_i be the DP-BloGS mechanism applied to parameter group i, with clipping threshold C and batch size B. For any two parameter groups i and j, the optimal ratio of their block sizes β_i and β_j that achieves equal privacy loss ϵ is given by:

    β_i/β_j = d_i/d_j




Step 1: Recall the privacy loss bound from Lemma 21

For each parameter group i, the privacy loss ϵ_i is bounded by:

    ϵ_i ≤min{ϵ_i1, ϵ_i2}

Where:

    ϵ_i1 = 2 ·ln(1 + d_i · (exp(2C / (√(d_i))) - 1))


    ϵ_i2 = 2 ·ln(1 + (β_i/d_i) · (exp(2C √(β_i/d_i)) - 1))


Step 2: Assume the block-wise bound (ϵ_i2) is tight

For optimal privacy-utility trade-off, we assume that ϵ_i2 is the tighter bound. This is typically the case when β_i is significantly smaller than d_i. Under this assumption:

    ϵ_i = 2 ·ln(1 + (β_i/d_i) · (exp(2C √(β_i/d_i)) - 1))


Step 3: Set up the equality for optimal block sizes

For optimal privacy allocation, we want the privacy loss to be equal for all parameter groups. For groups i and j:


    ϵ_i    = ϵ_j 
       2 ln(1 + (β_i/d_i) · (e^2C √(β_i/d_i) - 1)) 
       = 2 ln(1 + (β_j/d_j) · (e^2C √(β_j/d_j) - 1))


Step 4: Simplify the equality

The equality holds if and only if:

    (β_i/d_i) · (exp(2C √(β_i/d_i)) - 1) = (β_j/d_j) · (exp(2C √(β_j/d_j)) - 1)


Step 5: Analyze the limiting behavior

As C → 0 or B →∞, we can use the approximation exp(x) ≈ 1 + x for small x:

    (β_i/d_i) · (1 + 2C √(β_i/d_i) - 1) ≈ (β_j/d_j) · (1 + 2C √(β_j/d_j) - 1)


Simplifying:

    (β_i/d_i)^3/2≈ (β_j/d_j)^3/2


Step 6: Solve for the ratio of block sizes

Taking the 2/3 power of both sides:

    β_i/d_i ≈β_j/d_j


Rearranging:

    β_i/β_j≈d_i/d_j


Step 7: Verify the exact solution

While the approximation in Step 5 gives us insight into the relationship, we can verify that this ratio is indeed the exact solution to the original equation in Step 4. Substituting β_i = (d_i/d_j) ·β_j into the original equation:

    (d_i/d_j) · (β_j/d_i) · (e^2C √((d_i/d_j) · (β_j/d_i)) - 1) 
       = (β_j/d_j) · (e^2C √(β_j/d_j) - 1)


Simplifying:

    (β_j/d_j) · (exp(2C √(β_j/d_j)) - 1) = (β_j/d_j) · (exp(2C √(β_j/d_j)) - 1)


This equality holds for all values of β_j, d_j, C, and B.

Step 8: Conclude the proof

We have shown that the ratio β_i / β_j = d_i / d_j satisfies the condition for equal privacy loss across parameter groups. This ratio is independent of the clipping threshold C and batch size B, making it a robust choice for optimizing block sizes.

Therefore, the optimal ratio of block sizes that achieves equal privacy loss ϵ for any two parameter groups i and j is:

    β_i/β_j = d_i/d_j


This completes the proof of Lemma 23.




§ THEOREM 24


*theorem24Theorem 24

[Privacy Guarantee for Parameter-wise DP-BloGS]
Let (Ω, ℱ, ℙ) be a probability space. Let 𝒟 be the space of datasets, and let D, D' ∈𝒟 be two adjacent datasets differing in at most one element. Let M be the Parameter-wise DP-BloGS mechanism applied to a model with K parameter groups, where each group i has dimension d_i and block size β_i. Let C be the clipping threshold and B be the batch size. For any δ > 0, if the block sizes and clipping threshold satisfy:


    
  * 1 ≤β_i < d_i for all i ∈{1, ..., K}
    
  * C ≤ C_max


Then M satisfies (ϵ, δ)-differential privacy for T iterations, where:


    ϵ = √(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )


Where ϵ_i is computed as:


    ϵ_i = min{ϵ_i1, ϵ_i2}


    ϵ_i1 = 2 ln(1 + d_i (exp(2C/√(d_i)) - 1))


    ϵ_i2 = 2 ln(1 + β_i/d_i(exp(2C √(β_i/d_i)) - 1))




Step 1: Bound the sensitivity of the clipped gradient for each parameter group

For any adjacent datasets D and D', and any parameter group i:


    Clip(g_i(D), C) - Clip(g_i(D'), C) _2 ≤ 2C


Where g_i is the gradient function for parameter group i, and Clip is the L_2 norm clipping function.

Step 2: Apply Lemma 21 to each parameter group

From Lemma 21, we know that for each parameter group i, the privacy loss ϵ_i for a single iteration is bounded by:


    ϵ_i ≤min{ϵ_i1, ϵ_i2}


Where:


    ϵ_i1 = 2 ln(1 + d_i (exp(2C/√(d_i)) - 1))


    ϵ_i2 = 2 ln(1 + β_i/d_i(exp(2C √(β_i/d_i)) - 1))


Step 3: Verify the conditions of Lemma 21

The conditions 1 ≤β_i < d_i and C ≤ C_max ensure that Lemma 21 is applicable to each parameter group.

Step 4: Apply Theorem 22 to compose the privacy losses

From Theorem 22, we know that for T iterations, the total privacy loss ϵ is bounded by:


    ϵ≤√(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )


Step 5: Define the privacy loss random variable

Let Z : Ω→ℝ be the total privacy loss random variable:


    Z(ω) = ∑_i=1^K ∑_t=1^T Z_i,t(ω)


Where Z_i,t is the privacy loss random variable for parameter group i at iteration t, as defined in the proof of Theorem 22.

Step 6: Bound the moment generating function of Z

From the proof of Theorem 22, we have:


    𝔼[exp(λ Z)] ≤∏_i=1^K (exp(T ϵ_i (e^λ - 1)) + T δ_i exp(T ϵ_i λ))


For any λ > 0.

Step 7: Apply Markov's inequality

For any t > 0:


    ℙ(Z > t) 
           = ℙ(e^λ Z > e^λ t) 
       ≤𝔼[e^λ Z]/e^λ t
       ≤∏_i=1^K (e^T ϵ_i (e^λ - 1) + T δ_i e^T ϵ_i λ)/e^λ t


Step 8: Optimize the bound

Let λ = ln(1 + √(2 ln(1/δ)/T ∑_i=1^K ϵ_i)).

Substituting this value of λ and simplifying, we get:


    ℙ(Z > ϵ) ≤δ


Where ϵ is as defined in the theorem statement.

Step 9: Account for the failure probability

The probability that any of the KT applications of the mechanism (K parameter groups over T iterations) fails to satisfy its individual privacy guarantee is at most:


    1 - (1 - ∑_i=1^K δ_i)^T


Where δ_i is the failure probability for parameter group i in a single iteration.

Step 10: Conclude the proof

Combining the results from Steps 8 and 9, we have shown that the Parameter-wise DP-BloGS mechanism M satisfies (ϵ, δ)-differential privacy for T iterations, where:


    ϵ = √(2T ln(1/δ))∑_i=1^K ϵ_i + T ( ∑_i=1^K ϵ_i ) ( exp(max_i ϵ_i) - 1 )


And ϵ_i is computed as in Step 2.

This completes the proof of Theorem 24.




§ LEMMA 25


*lemma25Lemma 25

[Utility Bound for Parameter-wise DP-BloGS]
Let (Ω, ℱ, ℙ) be a probability space. Let 𝒟 be the space of datasets, and let D ∈𝒟 be a dataset. Let M be the Parameter-wise DP-BloGS mechanism applied to a model with K parameter groups, where each group i has dimension d_i and block size β_i. Let C be the clipping threshold and B be the batch size. Let g : 𝒟→ℝ^d be the true gradient function, where d = ∑_i=1^K d_i is the total number of parameters. Then, the expected squared L_2 norm of the noise added by the Parameter-wise DP-BloGS mechanism is bounded by:


    𝔼[M(g(D), ω) - g(D)_2^2] ≤∑_i=1^K (d_i - β_i) ·(2C)^2/β_i


where the expectation is taken over the randomness ω in the shuffling mechanism.



Step 1: Decompose the noise by parameter groups

Let g_i(D) be the gradient for parameter group i, and M_i be the DP-BloGS mechanism applied to this group. We can write:


    M(g(D), ω) - g(D)_2^2 = ∑_i=1^K M_i(g_i(D), ω_i) - g_i(D)_2^2


where ω_i is the randomness in the shuffling for group i.

Step 2: Analyze the noise for a single parameter group

For each parameter group i, let's consider the noise added by the shuffling mechanism:


    η_i = M_i(g_i(D), ω_i) - g_i(D)


Step 3: Compute the expected squared L_2 norm of η_i


    𝔼[η_i_2^2] 
           = 𝔼[∑_j=1^d_i (M_i(g_i(D), ω_i)[j] - g_i(D)[j])^2] 
       = ∑_j=1^d_i𝔼[(M_i(g_i(D), ω_i)[j] - g_i(D)[j])^2]


Step 4: Analyze the effect of block shuffling

In the DP-BloGS mechanism, d_i elements are divided into ⌈ d_i/β_i ⌉ blocks of size β_i (the last block may be smaller). When a block is shuffled, β_i - 1 elements (on average) are replaced with elements from other blocks.

For each element j:


    𝔼[(M_i(g_i(D), ω_i)[j] - g_i(D)[j])^2] = β_i - 1/β_i𝔼[(g_i(D)[k] - g_i(D)[j])^2]


where k is uniformly chosen from {1, …, d_i}∖{j}.

Step 5: Bound the squared difference of gradient elements

Due to gradient clipping, we know that g_i(D)_2 ≤ C. Therefore, for any j and k:


    (g_i(D)[k] - g_i(D)[j])^2 ≤ (2C)^2


Step 6: Compute the bound for a single parameter group


    𝔼[η_i_2^2] 
           = ∑_j=1^d_i𝔼[(M_i(g_i(D), ω_i)[j] - g_i(D)[j])^2] 
       ≤∑_j=1^d_iβ_i - 1/β_i (2C)^2 
       = d_i ·β_i - 1/β_i (2C)^2 
       = (d_i - β_i) ·(2C)^2/β_i


Step 7: Sum over all parameter groups


    𝔼[M(g(D), ω) - g(D)_2^2] = ∑_i=1^K 𝔼[η_i_2^2] ≤∑_i=1^K (d_i - β_i) ·(2C)^2/β_i


Step 8: Conclude the proof

We have shown that:


    𝔼[M(g(D), ω) - g(D)_2^2] ≤∑_i=1^K (d_i - β_i) ·(2C)^2/β_i


This completes the proof of Lemma 25.




§ THEOREM 26


*theorem26Theorem 26

[Convergence of Parameter-wise DP-BloGS SGD]
Let (Ω, ℱ, ℙ) be a probability space. Let f : ℝ^d →ℝ be a convex function with L-Lipschitz continuous gradients. Let M be the Parameter-wise DP-BloGS mechanism applied to a model with K parameter groups, where each group i has dimension d_i and block size β_i, such that d = ∑_i=1^K d_i is the total number of parameters. Let g(θ, ξ) be the stochastic gradient, where ξ is a random data sample. Assume that 𝔼[g(θ, ξ)] = ∇ f(θ) and 𝔼[g_i(θ, ξ)^2] ≤ G_i^2 for all θ and all parameter groups i. Let {θ_t} be the sequence of iterates generated by the Parameter-wise DP-BloGS SGD algorithm:


    θ_t+1 = θ_t - η_t M(g(θ_t, ξ_t), ω_t)


where η_t is the learning rate at iteration t. Then, for T iterations and any δ > 0, with probability at least 1 - δ:


    𝔼[f(θ̅_T) - f(θ^*)] 
           ≤θ_0 - θ^*^2/2η T 
        + η L (G^2 + σ^2)/2
          + (G + σ) √(2 log(2/δ)/T)


where θ̅_T = 1/T∑_t=1^T θ_t is the average of the iterates, θ^* is the optimal solution, η = 1/T∑_t=1^T η_t is the average learning rate, G^2 = ∑_i=1^K G_i^2, and σ^2 = ∑_i=1^K (β_i - 1) G_i^2/β_i is the maximum variance introduced by Parameter-wise DP-BloGS. This result combines insights from differentially private SGD <cit.> and general SGD convergence analysis <cit.>.




Step 1: Express the update rule


    θ_t+1 = θ_t - η_t M(g(θ_t, ξ_t), ω_t)


Step 2: Analyze the squared distance to the optimum


    θ_t+1 - θ^*^2    = θ_t - η_t M(g(θ_t, ξ_t), ω_t) - θ^*^2 
       = θ_t - θ^*^2 + η_t^2 M(g(θ_t, ξ_t), ω_t)^2 
          - 2η_t ⟨θ_t - θ^*, M(g(θ_t, ξ_t), ω_t) ⟩


Step 3: Take expectation over ω_t and ξ_t


    𝔼[θ_t+1 - θ^*^2] 
           = θ_t - θ^*^2 + η_t^2 𝔼[M(g(θ_t, ξ_t), ω_t)^2] 
          - 2η_t ⟨θ_t - θ^*, 𝔼[M(g(θ_t, ξ_t), ω_t)] ⟩


Step 4: Apply properties of Parameter-wise DP-BloGS

From the properties of Parameter-wise DP-BloGS, we know:

1. 𝔼[M(g(θ_t, ξ_t), ω_t)] = g(θ_t, ξ_t) (unbiasedness)
2. 𝔼[M(g(θ_t, ξ_t), ω_t)^2] ≤𝔼[g(θ_t, ξ_t)^2] + σ^2 (from Lemma 25)

Where σ^2 = ∑_i=1^K (β_i - 1) G_i^2/β_i as defined in the theorem statement.

Step 5: Apply these results


    𝔼[θ_t+1 - θ^*^2] ≤θ_t - θ^*^2 + η_t^2(G^2 + σ^2) - 2η_t ⟨θ_t - θ^*, 𝔼[g(θ_t, ξ_t)] ⟩


Where G^2 = ∑_i=1^K G_i^2 as defined in the theorem statement.

Step 6: Use the convexity of f

By convexity of f, we have:


    f(θ_t) - f(θ^*) ≤⟨∇ f(θ_t), θ_t - θ^* ⟩


Rearranging:


    -⟨∇ f(θ_t), θ_t - θ^* ⟩≤ -(f(θ_t) - f(θ^*))


Step 7: Combine the results


    𝔼[θ_t+1 - θ^*^2] ≤θ_t - θ^*^2 + η_t^2(G^2 + σ^2) - 2η_t(f(θ_t) - f(θ^*))


Step 8: Rearrange terms


    2η_t(f(θ_t) - f(θ^*)) ≤θ_t - θ^*^2 - 𝔼[θ_t+1 - θ^*^2] + η_t^2(G^2 + σ^2)


Step 9: Sum over t = 0 to T-1


    ∑_t=0^T-1 2η_t(f(θ_t) - f(θ^*)) ≤θ_0 - θ^*^2 - 𝔼[θ_T - θ^*^2] + (G^2 + σ^2) ∑_t=0^T-1η_t^2


Step 10: Apply Jensen's inequality


    f(θ̅_T) - f(θ^*) ≤1/T∑_t=0^T-1 (f(θ_t) - f(θ^*))


Step 11: Combine and rearrange


    2Tη(f(θ̅_T) - f(θ^*)) ≤θ_0 - θ^*^2 + (G^2 + σ^2) ∑_t=0^T-1η_t^2


where η = 1/T∑_t=0^T-1η_t.

Step 12: Apply Cauchy-Schwarz inequality


    ∑_t=0^T-1η_t^2 ≤ T ∑_t=0^T-1η_t^2 / T = Tη^2


Step 13: Rearrange to get the bound in expectation


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η L (G^2 + σ^2)/2


Step 14: Account for the high probability bound

To get a high probability bound, we can use the Azuma-Hoeffding inequality. Let X_t = f(θ_t) - f(θ^*) - (𝔼[f(θ_t)] - f(θ^*)). {X_t} forms a martingale difference sequence with |X_t| ≤ (G + σ)θ_t - θ^*≤ (G + σ)√(2/L)(f(θ_t) - f(θ^*)).

By Azuma-Hoeffding, with probability at least 1 - δ/2:


    |1/T∑_t=1^T X_t| ≤ (G + σ)√(2log(2/δ)/T)


Step 15: Conclude the proof

Combining the expectation bound and the high probability bound, we get:


    𝔼[f(θ̅_T) - f(θ^*)] ≤θ_0 - θ^*^2/2η T + η L (G^2 + σ^2)/2 + (G + σ)√(2log(2/δ)/T)


with probability at least 1 - δ.

This completes the proof of Theorem 26.




§ LEMMA 27


*lemma27Lemma 27

Extending the information-theoretic approach of <cit.> to parameter-wise shuffling, we prove:

[Information-Theoretic Bounds on Parameter-wise Shuffling Privacy]
Let (Ω, ℱ, ℙ) be a probability space. Let 𝒟 be the space of datasets, and let D ∈𝒟 be a dataset. Let M be the Parameter-wise DP-BloGS mechanism applied to a model with K parameter groups, where each group i has dimension d_i and block size β_i. Let g : 𝒟→ℝ^d be the gradient function, where d = ∑_i=1^K d_i is the total number of parameters. Then, the mutual information between the input gradient g(D) and the output shuffled gradient M(g(D), ω) is bounded by:


    I(g(D); M(g(D), ω)) ≤∑_i=1^K log(d_i/β_i)


where I(·; ·) denotes the mutual information.



Step 1: Define the mutual information

The mutual information between g(D) and M(g(D), ω) is defined as:


    I(g(D); M(g(D), ω)) = H(M(g(D), ω)) - H(M(g(D), ω) | g(D))


where H(·) denotes the Shannon entropy and H(·|·) denotes the conditional entropy.

Step 2: Decompose the mutual information by parameter groups

Due to the independence of shuffling across parameter groups, we can decompose the mutual information:


    I(g(D); M(g(D), ω)) = ∑_i=1^K I(g_i(D); M_i(g_i(D), ω_i))


where g_i(D) is the gradient for parameter group i, and M_i is the DP-BloGS mechanism applied to this group.

Step 3: Analyze the entropy of the output for a single parameter group

For each parameter group i, the output space of M_i(g_i(D), ω_i) is the same as the input space, ℝ^d_i. Therefore:


    H(M_i(g_i(D), ω_i)) ≤log(|ℝ^d_i|) = d_i log(|ℝ|)


Step 4: Analyze the conditional entropy for a single parameter group

Given g_i(D), the only uncertainty in M_i(g_i(D), ω_i) comes from the random permutation of blocks. There are m_i = ⌈ d_i / β_i ⌉ blocks, so:


    H(M_i(g_i(D), ω_i) | g_i(D)) = log(m_i!) ≥log((d_i/β_i)!)


Step 5: Bound the mutual information for a single parameter group

    I(g_i(D); M_i(g_i(D), ω_i)) 
       = H(M_i(g_i(D), ω_i)) - H(M_i(g_i(D), ω_i) | g_i(D)) 
       ≤ d_i log(|ℝ|) - log((d_i/β_i)!)


Step 6: Apply Stirling's approximation

Using Stirling's approximation: log(n!) ≈ n log(n) - n + O(log(n))


    I(g_i(D); M_i(g_i(D), ω_i)) 
       ≤ d_i log(|ℝ|) - (d_i/β_ilog(d_i/β_i) 
          - d_i/β_i + O(log(d_i/β_i)))



    = d_i log(|ℝ|) - d_i/β_ilog(d_i/β_i) + d_i/β_i - O(log(d_i/β_i))


Step 7: Analyze the bound
As |ℝ| →∞, the d_i log(|ℝ|) term dominates. However, this term is constant with respect to β_i. The leading term that depends on β_i is d_i/β_ilog(d_i/β_i).
Therefore, our bound for each parameter group is:

    I(g_i(D); M_i(g_i(D), ω_i)) ≤     d_i log(|ℝ|) - d_i/β_ilog(d_i/β_i) 
        + d_i/β_i + O(log(d_i/β_i))


Step 8: Sum over all parameter groups

    I(g(D); M(g(D), ω)) 
       = ∑_i=1^K I(g_i(D); M_i(g_i(D), ω_i)) 
       ≤∑_i=1^K (d_i log(|ℝ|) - d_i/β_ilog(d_i/β_i) + d_i/β_i + O(log(d_i/β_i)))


Step 9: Conclude the proof
Our final bound is:

    I(g(D); M(g(D), ω)) ≤   ∑_i=1^K (d_i log(|ℝ|) - d_i/β_ilog(d_i/β_i) + d_i/β_i) 
        + O(Klog(max_i(d_i/β_i)))

This bound shows that as β_i decreases for any group i, the term d_i/β_ilog(d_i/β_i) grows larger, which decreases the upper bound on mutual information for that group, providing better privacy.

This completes the proof of Lemma 27.




§ CONCLUSION


This paper introduced Differentially Private Block-wise Gradient Shuffle (DP-BloGS), a novel algorithm for privacy-preserving deep learning. The theoretical analysis and experimental results demonstrate that DP-BloGS offers several advantages over traditional Differentially Private Stochastic Gradient Descent (DP-SGD).

DP-BloGS achieves competitive privacy guarantees compared to DP-SGD, as evidenced by the analysis of membership inference attack resistance and data extraction rates. Across various model architectures and privacy levels, DP-BloGS often yields lower perplexity scores, indicating better model performance while maintaining privacy. The experiments show that DP-BloGS can achieve training times closer to non-private training than DP-SGD, potentially making privacy-preserving deep learning more practical for large-scale applications. The effectiveness of DP-BloGS has been demonstrated on models with up to 1.1 billion parameters, showing its applicability to modern large language models.

The theoretical foundations laid out in this paper provide a robust framework for understanding and further developing privacy-preserving machine learning techniques similar to DP-BloGS.

However, limitations in this study include the use of a single dataset for evaluation. Future work should explore the performance of DP-BloGS across a wider range of datasets and task types. Several promising avenues for further research exist: refining parameter-wise privacy budget allocation strategies to optimize the privacy-utility trade-off; investigating the interaction between DP-BloGS and other deep learning techniques such as LoRA; extending DP-BloGS to other model architectures like convolutional neural networks and diffusion models; and developing adaptive privacy mechanisms that can dynamically adjust privacy parameters during training.

In conclusion, DP-BloGS represents a significant step forward in differentially private deep learning, offering a promising balance of privacy, utility, and computational efficiency. As privacy concerns continue to grow in importance, techniques like DP-BloGS will play a crucial role in enabling the responsible development and deployment of machine learning models in sensitive domains.

22
Dwork2006
C. Dwork, F. McSherry, K. Nissim, and A. Smith, "Calibrating noise to sensitivity in private data analysis," in Theory of Cryptography Conference, Springer, 2006, pp. 265-284.
Dwork2014
C. Dwork and A. Roth, "The algorithmic foundations of differential privacy," Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3-4, pp. 211-407, 2014.
Dwork2010
C. Dwork, G. N. Rothblum, and S. Vadhan, "Boosting and differential privacy," in 2010 IEEE 51st Annual Symposium on Foundations of Computer Science, IEEE, 2010, pp. 51-60.
Abadi2016
M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, "Deep learning with differential privacy," in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 308-318.
Rogers2016
R. Rogers, A. Roth, J. Ullman, and S. Vadhan, "Privacy odometers and filters: Pay-as-you-go composition," in Advances in Neural Information Processing Systems, 2016, pp. 1921-1929.
Duchi2013
J. C. Duchi, M. I. Jordan, and M. J. Wainwright, "Local privacy and statistical minimax rates," in 2013 IEEE 54th Annual Symposium on Foundations of Computer Science, IEEE, 2013, pp. 429-438.
Pascanu2013
R. Pascanu, T. Mikolov, and Y. Bengio, "On the difficulty of training recurrent neural networks," in International Conference on Machine Learning, 2013, pp. 1310-1318.
Yosinski2014
J. Yosinski, J. Clune, Y. Bengio, and H. Lipson, "How transferable are features in deep neural networks?" in Advances in Neural Information Processing Systems, 2014, pp. 3320-3328.
Erlingsson2014
Ú. Erlingsson, V. Pihur, and A. Korolova, "Rappor: Randomized aggregatable privacy-preserving ordinal response," in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014, pp. 1054-1067.
Balle2018
B. Balle, G. Barthe, and M. Gaboardi, "Privacy amplification by subsampling: Tight analyses via couplings and divergences," in Advances in Neural Information Processing Systems, 2018, pp. 6277-6287.
Bottou2018
L. Bottou, F. E. Curtis, and J. Nocedal, "Optimization methods for large-scale machine learning," SIAM Review, vol. 60, no. 2, pp. 223-311, 2018.
Kairouz2017
P. Kairouz, S. Oh, and P. Viswanath, "The composition theorem for differential privacy," IEEE Transactions on Information Theory, vol. 63, no. 6, pp. 4037-4049, 2017.
Wang2019
Y. X. Wang, B. Balle, and S. P. Kasiviswanathan, "Subsampled Rényi differential privacy and analytical moments accountant," in International Conference on Artificial Intelligence and Statistics (AISTATS), 2019.
Feldman2021
V. Feldman and T. Zrnic, "Individual privacy accounting via a Renyi filter," in Advances in Neural Information Processing Systems, 2021, pp. 8188-8201.
McMahan2018
H. B. McMahan, G. Andrew, U. Erlingsson, S. Chien, I. Mironov, N. Papernot, and P. Kairouz, "A general approach to adding differential privacy to iterative training procedures," arXiv preprint arXiv:1812.06210, 2018.
Bassily2014
R. Bassily, A. Smith, and A. Thakurta, "Private empirical risk minimization: Efficient algorithms and tight error bounds," in 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, IEEE, 2014, pp. 464-473.
Xu2017
A. Xu and M. Raginsky, "Information-theoretic analysis of generalization capability of learning algorithms," in Advances in Neural Information Processing Systems, 2017, pp. 2524-2533.
Nguyen2023
T. N. Nguyen, P. H. Nguyen, L. M. Nguyen, and M. Van Dijk, "Batch Clipping and Adaptive Layerwise Clipping for Differential Private Stochastic Gradient Descent," arXiv preprint arXiv:2307.11939, 2023.
bu2023differentially
Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis.
Differentially private optimization on large model at small cost.
In International Conference on Machine Learning, pages 3192–3218, 2023.
Choquette2021
A. Choquette-Choo, F. Tramer, N. Carlini, and N. Papernot, "Label-only membership inference attacks," in International Conference on Machine Learning, 2021.
cheu2019distributed 
Cheu, A., Smith, A., Ullman, J., & Zeber, D. (2019). 
Distributed Differential Privacy via Shuffling. 
Annual International Cryptology Conference.
balle2019privacy 
Balle, B., Bell, A., Gascón, A., & Nissim, K. (2019). 
The Privacy Blanket of the Shuffle Model. 
Advances in Neural Information Processing Systems.




§ APPENDIX

































 Paper Title: MPT-PAR:Mix-Parameters Transformer for Panoramic Activity Recognition.










Journal of  Class Files, Vol. 14, No. 8, August 2021
Shell et al.: MPT-PAR:Mix-Parameters Transformer for Panoramic Activity Recognition

0000–0000/00$00.00  2021 IEEE



MPT-PAR:Mix-Parameters Transformer for Panoramic Activity Recognition
    Wenqing Gan, Yan Sun, Feiran Liu, Xiangfeng Luo
        
This work was supported in part by the National Natural Science Foundation of China under Grant 62002215, and in part by the Shanghai Pujiang Program under Grant 20PJ1404400.
Wenqing Gan, Yan Sun, Feiran Liu and Xiangfeng Luo are with the School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China (e-mail: ganwenqing@shu.edu.cn; yansun@shu.edu.cn; shirleyllfr@shu.edu.cn; luoxf@shu.edu.cn).
    August, 2024
=================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================



§ ABSTRACT 
The objective of the panoramic activity recognition task is to identify behaviors at various granularities within crowded and complex environments, encompassing individual actions, social group activities, and global activities. Existing methods generally use either parameter-independent modules to capture task-specific features or parameter-sharing modules to obtain common features across all tasks. However, there is often a strong interrelatedness and complementary effect between tasks of different granularities that previous methods have yet to notice. In this paper, we propose a model called MPT-PAR that considers both the unique characteristics of each task and the synergies between different tasks simultaneously, thereby maximizing the utilization of features across multi-granularity activity recognition. Furthermore, we emphasize the significance of temporal and spatial  information by introducing a spatio-temporal relation-enhanced module and a scene representation learning module, which integrate the the spatio-temporal context of action and global scene into the feature map of each granularity. Our method achieved an overall F_1 score of 47.5% on the JRDB-PAR dataset, significantly outperforming all the state-of-the-art methods.



Human Activity Understanding, Group Activity, Panoramic Activity Recognition.




§ INTRODUCTION

Due to the extensive application of human activity recognition tasks in various fields such as video surveillance <cit.>, healthcare <cit.> and sports analysis <cit.>, this task has become crucial in video understanding. Previously, human activity recognition primarily focused on single-granularity tasks, such as recognizing individual actions <cit.> or group activities <cit.>. These tasks require a fixed number of people in the scene and assume that, in multi-person scenes, all individuals belong to a single group without any subdividable subgroups. These assumptions are often unrealistic in real-world scenarios, thereby limiting the utility of these methods. Moreover, focusing on single-granularity tasks makes it difficult to understand the entire scene, while tasks of different granularities can mutually reinforce each other. For instance, accurate individual actions recognition can help the model learn the commonalities of individual behaviors, thereby aiding in more accurate group activity recognition. To address these issues, the panoramic activity recognition task, as proposed by <cit.>, aims to establish a unified framework capable of recognizing behaviors at different granularities simultaneously in crowded and complex scenes, including individual actions, social group activities, and global activities. This task does not impose restrictions on the number of people in the scene and allows for the subdividing groups. Recognizing behaviors of different granularities within a unified framework leverages the complementary relationships between tasks, as different granularities introduce diverse inductive biases that broaden the model’s perspective, enhancing its generalization ability to unknown data distributions.

To establish a unified framework for simultaneous multi-task learning, the most critical factor is the structure design—specifically, determining which parts are task-specific and which are shared across tasks. This significantly impacts performance, training efficiency, and generalization. Current methods utilize parameter-sharing backbones and individual feature relationship learning modules to learn the foundational features common to multi-granularity activity recognition tasks, and then use multiple task-specific parameter-independent classification heads for multitask recognition. For cross-granularity aggregation modules, JRDB-PAR <cit.> uses parameter-independent modules to better capture specific features and nuances of each task, avoiding optimization conflicts of different task supervision signals; on the other hand, MUP <cit.> uses parameter-sharing modules to extract common relationships and motion features, promoting information sharing and enhancing overall performance. However, these methods do not effectively to simultaneously leverage the advantages of both aggregation strategies and overlook their complementary effects. Besides, since social groups and global activities are aggregated from individual actions, leveraging temporal information of individuals can lead to a better understanding of the scenarios. However, this requires multi-object tracking and group evolution detection, and they are very difficult to implement in challenging panoramic scenes. Therefore, previous methods ignored temporal information and relied on single-frame recognition, resulting in suboptimal performance. Furthermore, previous methods performed panoramic activity recognition using only cropped individual features, limiting the features to a local receptive field. As a result, they inevitably neglect the advantages of the global contextual information.

In this work, we propose a novel network called Mix-Parameters Transformer for Panoramic Activity Recognition (MPT-PAR) to address those challenges. A cross-granularity aggregation module is introduced to integrate features from individuals to social groups and from individuals to the global level. This module, comprising structurally identical parameter-independent and parameter-sharing encoders, models relationships between individuals through multi-head self-attention and aggregates individual behavior information via a learnable cls token. The fused features from both encoders are combined, to capture common relationships and motion features while retaining specific task features and nuances. To exploit temporal information, we follow the conventional approach for multi-object tracking and group evolution detection in group activity recognition, which is closely related to panoramic activity recognition. We also propose spatio-temporal relation-enhanced module, which model spatial relationships between different individuals in the same frame and temporal relationships of the same individual across frames. To provide comprehensive global context, we expand the receptive field by modeling scene information of the entire video frame, capturing behavior-related elements through spatial attention, flexibly integrating scene representations and activity features through cross-attention. Extensive experiments are conducted on the JRDB-PAR dataset to validate the effectiveness of the proposed network. Our method achieved an overall F_1 score of 47.5%, significantly improving by 6.0% compared to state-of-the-art methods. Additionally, it shows the greatest improvement in the sub-task of global activity recognition compared to previous methods, with an F_1 score of 61.1%. We also compared our approach with SOTA methods that perform single-granularity tasks, the significantly improvement demonstrating the mutual reinforcement between tasks of different granularities.

The main contributions of this paper are:


    
  * We propose a novel network MPT-PAR, it uses both parameter-sharing and parameter-independent aggregation encoders for cross-granularity feature integration, leveraging the complementary advantages to improve panoramic activity recognition.
    
  * We introduce spatio-temporal relation-enhanced module to utilize temporal information by enhancing spatial and temporal relationships for individual features.
    
  * We explicitly model scene information to provide comprehensive global context, captures behavior-related elements through spatial attention, and integrate scene representations with activity features through cross-attention.
    
  * Conducting extensive experiments on the JRDB-PAR dataset, we demonstrate the effectiveness of proposed method with an overall F_1 score of 47.5%, showing a significant improvement of 6.0% over state-of-the-art methods.




§ RELATED WORK




 §.§ Single Granularity Activity Recognition



  §.§.§ Human Action Recognition

Human action recognition (HAR) is a critical research area in computer vision that aims to automatically identify various human actions from video data. The advancement of deep learning has led to the development of numerous models based on Convolutional Neural Networks (CNN) <cit.> and Recurrent Neural Networks (RNN) <cit.> for this purpose. A milestone in this field is the Two-Stream Convolutional Network <cit.>, which utilizes static frame images and optical flow images to separately capture spatial and temporal features, resulting in significant performance gains. Additionally, RNN architectures like Long Short-Term Memory (LSTM) <cit.> and Gated Recurrent Units (GRU) <cit.> have been extensively applied to video sequence data, further improving action recognition accuracy. In recent years, Transformer-based frameworks <cit.> have been incorporated to enhance the model's ability to focus on key frames and regions, thereby boosting recognition performance. These techniques capture intricate spatio-temporal relationships and feature interactions, achieving state-of-the-art performance on several public datasets. Moreover, multimodal fusion approaches, such as networks combining depth information <cit.> and skeletal data <cit.>, have shown superior performance in complex scenarios.



  §.§.§ Social Group Detection and Activity Recognition

The task of social group detection aims to divide people into subgroups based on their social activities or relationships. Building on this concept, social activity recognition aims to simultaneously identify the social activities of each subgroup. Early methods focused primarily on social group detection due to hardware limitations and small datasets. Solera et al. <cit.> manually designed features representing body and social identity to understand relationships among group members and used trajectory clustering to detect social groups. Wang et al. <cit.> introduced a benchmark for social group detection with a “global to local magnification” framework that encodes global trajectories and local interactions, yielding promising results. Recently, the focus has shifted towards social activity recognition. Ehsanpour et al. <cit.> developed an end-to-end trainable network using integrated self-attention and graph attention modules to recognize social subgroups and their behaviors. However, this method oversimplifies social activities by treating them as the dominant individual actions within each group, which is not practical in many real-world scenarios. To address this, Kim et al. <cit.> created a large-scale high-definition dataset specifically for social behavior detection and proposed a new Transformer-based model capable of handling an unknown number of groups and potential group members without relying on clustering algorithms.



  §.§.§ Group Activity Recognition

It is a subfield of human activity recognition, focuses on identifying activities involving multiple individuals. The early work in this field primarily relied on manually designed features to extract information from video frames. Hierarchical graphical models <cit.> and dynamic Bayesian networks <cit.> were commonly used to interpret group activities in video environments. With the advent of deep learning, recent approaches have favored using deep neural networks for group activity recognition tasks. Yuan et al. <cit.> proposed a GCN-based method through a Dynamic Relation module and Dynamic Walk module for spatio-temporal individual inference. Xie et al. <cit.> introduced an actor-centric causality graph that focuses on analyzing the impact of two actors on asynchronous causality detection, complementing the learned asynchronous relationships with the synchronous ones derived from a Transformer model. GroupFormer <cit.> employs a clustering attention mechanism, leveraging a clustering space-time Transformer to enhance individual and group representations by integrating spatial and temporal dependencies. Addressing the reliance on bounding box annotations for group activity recognition, a detector-free Transformer-based model called DFWSGAR <cit.> was proposed, which locates and encodes parts of the group activity context through attention mechanisms, aggregating them into a single group representation without requiring bounding box labels or object detectors.

Overall, these methods focus solely on single-granularity tasks and they impose some unrealistic limitations. For instance, human action recognition often requires videos to contain only one or a few individuals, with the actors occupying the main part of the frame in each scene. In group activity recognition, the number of people in the video is usually fixed, and all individuals are assumed to belong to a single group without subdivisions. Those unrealistic assumptions significantly limit the application of these methods. Additionally, single-granularity task models did not realize the mutual reinforcement between tasks at different levels. In contrast, the objective of this work is to simultaneously achieve individual action recognition, social group activity recognition, and global activity recognition in crowded scenes, making it more practical for many real-world applications.





 §.§ Panoramic Activity Recognition

Panoramic activity recognition aims to identify individual actions, social group activities, and global activities concurrently. As a newly proposed and challenging problem, this field remains underexplored with limited current work. Han et al. <cit.> proposed a novel hierarchical graph neural network to progressively represent and model multi-granularity activities and mutual social relationships within crowds. By modeling each individual as a graph node, a graph network is constructed. Multiple parameter-independent GCN-based cross-granularity aggregation modules aggregate individual feature nodes into social group nodes bottom-up. Similarly, social group nodes are further aggregated into global nodes. This parameter-independent aggregation approach better captures the specific features and nuances of each task, avoiding optimization conflicts in supervising signals on the same parameters and improving individual task performance. In contrast, MUP <cit.> uses a unified cross-granularity aggregation module to encode behaviors at different granularity levels with the same parameters in an end-to-end manner. This approach learns potentially generic motion patterns across multi-granularity human behaviors, facilitating information sharing among tasks and enhancing the performance of panoramic activity recognition sub-tasks.

However, these methods only use either parameter-independent or parameter-sharing modules to integrate cross-granularity activity features, overlooking the complementary strengths of these two methods. Besides, these methods perform activity recognition at each granularity based solely on individual features extracted from a single key frame, without considering temporal information and the overall scene context. 




§ PROPOSED APPROACH



 §.§ Overview


The architecture of our network is illustrated in Fig. <ref>. The backbone is a ResNet-18 network <cit.> pre-trained on ImageNet. For the input video frame sequence X_img∈ R^T×3× H× W (T indicates the number of frames), the backbone extracts feature maps resulting in scene features  X_scene∈ R^T× C× H'× W' (C means the number of channels). Each individual's features X ∈ R^T × N× D (N, D represent the number of individuals and the dimension of individual's features respectively) are then cropped using RoIAlign <cit.>. The scene features X_scene are passed through a scene representation learning module to obtain the scene representation. The cropped individual features X are enhanced by spatio-temporal relation-enhanced module (STRE), which enrich individual features with spatio-temporal relational context. Subsequently, parameter-sharing and independent cross-granularity aggregation module (PSICGA) is employed to integrate individual features into social group and global representations. Before classifying the individual, social group, and global features, they are fused with scene representations through cross-attention to fully exploit the scene context.





 §.§ Spatio-Temporal Relation-Enhanced Module (STRE)


 Previous methods ignored temporal information and relied solely on single frames for panoramic human activity recognition. However, actions are typically executed over a sequence of continuous frames. Ignoring temporal information can result in the loss of action details, leading to inaccurate understanding of actions by the model, which in turn affects the recognition of social group activity and global activity. Moreover, in real-world scenarios, interpersonal relationships are dynamically changing, making it unreliable to infer groupings of people based on a single image.
 
 To address this issue, we introduce temporal information and use spatio-temporal relation-enhanced module to obtain features enriched with temporal and spatial context. Our STRE module consist of a transformer-based <cit.> temporal encoder and a spatial encoder, which learn temporal and spatial individual contextual features, respectively. Inspired by TimeSformer <cit.>, we connect the temporal and spatial encoders serially to reduce computational complexity. Experiments demonstrated that the serial structure is simpler and more effective (details in Section <ref>).





  §.§.§ Spatial Encoder

In crowded multi-person scenes, individual actions are not entirely independent but are significantly influenced by interactions with others and the behaviors of those present in the scene. Therefore, considering spatial context is crucial for panoramic human activity recognition. We employ a transformer-based spatial encoder to learn spatial contextual information of individuals. The spatial encoder captures interaction relationships between the target individual and surrounding individuals by assigning relative importance weights.

Given the input individual representation X ∈  R^T × N× D, we treat the temporal dimension as the batch dimension and use different learnable projection matrix to map X to Q, K and V. The spatial relationship attention weights of neighboring individuals are then computed using softmax, and the weights are multiplied by V to obtain the spatial context-enhanced feature X_S∈  R^T × N× D. For the t-th frame, this process can be expressed as:

    Q^t=X^tW_tq,K^t=X^tW_tk,V^t=X^tW_tv



    X_s^t = FFN(softmax(Q^tK^t^T/√(D))V^t+V^t)
where W_tq, W_tk and W_tv are learnable projection matrices, and FFN is a feedforward network.



  §.§.§ Temporal Encoder


Considering the temporal correlation of panoramic activities, the temporal encoder captures temporal contextual information by computing the adaptive importance of individuals across consecutive frames, enriching the temporal features of individuals. The structure of the temporal encoder is identical to that of the  spatial encoder. The difference lies in treating the spatial dimension as the batch dimension for the temporal encoder. We transpose the temporal and spatial dimensions of X_s, reshaping it to X'_s ∈  R^N× T × D, and feed it into the temporal encoder, resulting in the time-context-enhanced individual representation X_t∈  R^N× T × D. As temporal information is only considered at the individual level, we average the time dimension of the enhanced individual features to obtain X_st∈  R^N× D, serving as the foundation for constructing social group and global features.



 §.§ Parameter-Sharing and Independent Cross-Granularity Aggregation Module (PSICGA)


As a multi-granularity and multi-task learning task, panoramic activity recognition requires simultaneously addressing individual action recognition, social group activity recognition, and global activity recognition. Using parameter-independent aggregation modules for bottom-up cross-granularity feature integration helps capture task-specific features relevant to each task and avoids optimization conflicts in shared parameters, thereby enhancing multi-task learning efficiency. However, as indicated by MUP <cit.>, different parameter modules model activities at various granularities separately, making it impossible for the model to learn potential general motion patterns across different granularities of human behavior. Therefore, we design a module that integrates parameter-sharing and parameter-independent mechanisms to learn task-specific features independently and alleviate optimization conflicts between tasks, while capturing common behavioral patterns during cross-granularity aggregation through shared parameters.

As shown in Fig. <ref>, the proposed PSICGA module is constructed from two encoders: a parameter-sharing aggregation encoder (PSA) and a parameter-independent aggregation encoder (PIA). Although these two encoders share the same structure, which incorporates layer normalization, multi-headed self-attention and FFN, the parameters in them are different. The PSICGA module employs a parallel structure, where the input features are fed into both the PSA and PIA encoder. The network then combines the cls tokens from the outputs of the two modules to obtain the fused features.



For individual to global aggregation, we first add a learnable cls token X_cls∈  R^1× D to the individual feature sequence X_st∈  R^N× D. It summarizes the individual behavior context and the interactions learned by the multi-headed self-attention, representing the aggregated global activity features. To better model the relationships within the aggregation module, we add learnable spatial position embedding to provide positional information. The individual feature sequence X_st'∈  R^(N+1)× D with the added cls token and spatial position encoding  is fed into the PIA encoder PIA_global() and PSA encoder PSA(). The cls tokens representing global activity features from the two modules are combined to obtain the cross-granularity aggregated global activity feature X_global. The process is defined as:


    X_st'=[X_cls,x_st^1,x_st^2...x_st^n]+P



    X_cls^global = PIA_global(X_st'),X_cls^share = PSA(X_st')



    X_global=X_cls^global+λ X_cls^share

where P represents spatial position embedding, and λ is a weight parameter controlling the addition. 

For individual to social group integration, we first use clustering to obtain social group detection results, then perform cross-granularity aggregation for each social group. The PSICGA module used in this aggregation is similar to the one used in individual to social group integration, with the only difference being that the PIA encoder with different parameters PIA_social() is used to obtain the corresponding X_cls^social, while PSA() encoder is reused for both integrations.



 §.§ Scene Representation Learning


The global scene contextual information is crucial for panoramic activity recognition. Our scene representation learning module consists of scene representation generation and scene representation fusion. First, visual scene tokens are generated from the scene features extracted by the backbone, and they are aggregated to form the scene representation. Then, cross-attention is employed to fuse the scene representation with activity features at different granularities.


  §.§.§ Scene Representation Generation

Inspired by Visual Transformers <cit.>, the global scene information in video frames can be summarized using a compact set of visual tokens. We use a set of visual scene tokens to summarize the global scene information of the current video frame and aggregate them into a scene representation. For the scene feature map X_scene∈  R^T× D× H'× W' extracted by the backbone, we first add learnable positional encodings to retain positional information. Next, pointwise convolution is applied to assign each pixel to K visual scene tokens X_scene' ∈  R^T× K× (H'·W'). A spatial attention matrix A∈ R^T ×  K ×  ( H'· W') is generated using softmax, and the spatial attention weights are used to compute the weighted sum of each pixel. 2D convolution is applied to aggregate the scene features along the spatial dimension ( H'· W') to channel D, generating K visual scene tokens Z∈ R^T ×  K ×  D. This process can be described as:

    Z=conv(softmax(conv(X_scene))X_scene)

Through the spatial attention mechanism, each visual scene token adaptively focuses on notable parts of the entire scene. Finally, we perform AvgPooling on the first two dimensions of the visual scene tokens, merging the K visual scene tokens into the scene representation X_S∈  R^1× D.



  §.§.§ Scene Representation Fusion

To fully integrate the global context information contained in the scene representation with features at various granularities, we use a multi-head cross-attention and a feedforward network for fusion. For individual-level features, the inputs to the multi-head cross-attention are the enhanced individual representation X_t∈  R^N× 1 × D and the scene representation X_S∈  R^1× D. The individual representation is used as the query, and the scene representation  as the key in the multi-head cross-attention to fuse individual and scene representations, yielding the global scene context enhanced individual representation. This operation is similarly performed at the social group level. In the global activities recognition task, we directly concatenate the global-level features with the scene representation and use a learnable MLP to fuse them.



 §.§ Multi-Task Loss Function
 

Following JRDB-PAR <cit.>, we sum the losses of multiple tasks to serve as supervision for panoramic activity recognition. The total loss is defined as:

    ℒ   = ℒ_i + ℒ_s + ℒ_g + ℒ_d 
       = ∑_u L(𝐚^I_u, 𝐚̃^I_u) + ∑_k L(𝐚^S_k, 𝐚̃^S_k) + L(𝐚^G, 𝐚̃^G) + L(𝐑, 𝐑̃)

where ℒ_i, ℒ_s, ℒ_g, and ℒ_d represent the losses for individual, social group, global activity recognition, and social group detection, respectively. u and k denote each individual's features and social group features in the scene. L(·) represents binary cross-entropy loss, and ·̃ denotes the ground truth labels. R is the interpersonal relationship matrix with values of 0 or 1, where 1 indicates that the corresponding two individuals belong to the same group.




§ EXPERIMENT






 §.§ Datasets and Metrics

 The JRDB-PAR <cit.> dataset is a novel benchmark specifically created for the panoramic human activity recognition task. This dataset extends the JRDB-Act <cit.> dataset by manually annotating social group activities and global activities, and adding annotations for social group detection. The JRDB-PAR dataset comprises 360-degree RGB videos captured by a mobile robot in various densely populated areas such as campuses, cafeterias, and classrooms, providing 628,000 annotated personal bounding boxes with IDs. The dataset employs multi-class labels for activity annotation, meaning each individual, group, or frame can have one or multiple activity labels. It includes 27 individual action classes (e.g., walking, talking), 11 social group activities (e.g., chatting, working together), and 7 global activities (e.g., commuting, conversing). The dataset consists of 27 video segments, totaling 27,920 frames, with 20 segments used for training and 7 for testing. Key frames are selected every 15 frames for annotation and evaluation.
 
 For individual actions recognition evaluation, we utilize common metrics in multi-label classification tasks: precision, recall, and F_1 score, to measure the accuracy of activity classification for each instance in the test dataset. Precision, recall, and F_1 score are denoted as P_i, R_i, and F_i respectively. Social group activity recognition involves both group detection and activity category recognition. Group detection uses the classical Half metric <cit.> (IoU > 0.5), where a detected group is considered correct if the intersection-over-union between predicted and actual group members exceeds 0.5. If the activity category of a detected group is correctly predicted, it is regarded as a correct social group activity prediction. Precision, recall, and F_1 score for social group activity recognition are denoted as P_p, R_p, and F_p respectively. For global activity recognition, we also evaluate using precision, recall, and F_1 score, denoted as P_g, R_g, and F_g. The overall evaluation metric for panoramic activity detection is the average of these three F_1 scores, denoted as the comprehensive F_1 score F_a=(F_i+F_p+F_g)/3. This approach allows for a comprehensive assessment of individual actions detection, group activity recognition, and global activity recognition.



 §.§ Implementation Details


 

  §.§.§ Model Details

    We use a ResNet-18 <cit.> pretrained on the ImageNet dataset as the network backbone. In STRE, both the spatial and temporal encoders share the same structure, consisting of two layers with eight heads each. In PSICGA, the parameter-independent aggregation encoder has four layers with 12 heads, while the parameter-sharing aggregation encoder has two layers with 12 heads. For individual-to-social group aggregation, the weight parameter in Equation (<ref>) is λ = 0.8. For individual-to-global aggregation, λ = 1. The number of visual tokens for scene representation generation is set to 16.

 

  §.§.§ Training
    
We implemented our network using the PyTorch framework and trained it on two GTX 3090 GPUs. Consistent with JRDB-PAR <cit.>, we use ground truth social group detection labels during training and spectral clustering <cit.> for social group detection during evaluation. We set the batch size to 2 and sample three frames. We use the Adam optimizer with an initial learning rate of 7 × 10^-6 and a weight decay of 10^-2, training for 30 epochs.



 §.§ Comparison with State-of-the-Art Methods
 


To demonstrate the superiority of our method, we compared it with state-of-the-art methods. Given the scarcity of existing panoramic activity recognition methods, we adapted the leading group activity recognition methods ARG <cit.>, SA-GAT <cit.>, JRDB-Base <cit.>, DFWSGAR <cit.>, and DECOMPL <cit.> for comparison. Since DFWSGAR <cit.> and DECOMPL <cit.> do not employ individual action recognition as an auxiliary task, their results for individual action recognition and social group activity recognition cannot be compared. Additionally, we applied the state-of-the-art individual activity recognition methods such as UniFormer <cit.> and Vid-TLDR <cit.> to the JRDB-PAR dataset for comparison.

As shown in Table <ref>, our method outperforms the state-of-the-art panoramic activity recognition methods in all three sub-tasks and overall scores. Furthermore, compared to methods that focus on single-granularity tasks, our method exhibits superior performance across all levels of tasks, highlighting the mutual reinforcement among multiple tasks in panoramic activity recognition.







 §.§ Ablation Studies



  §.§.§ Effectiveness of Individual Modules

We conducted experiments with different combinations of modules to verify their effectiveness. The experiment uses temporal average pooling on the collected individual features instead of STRE to evaluate the effectiveness of the module. Similarly for PSICGA, we replaced it with max pooling for cross-granularity aggregation. Additionally, we removed the scene representation learning (SRL) module for comparison. As shown in Table <ref>, when all the modules were removed, our baseline method still achieved a score of 39.0%. This result surpasses some methods that only use single-frame information, indicating that even simple temporal average pooling can significantly enhance model performance. This highlights the importance of temporal information in panoramic activity recognition tasks. When the STRE was added, the model's performance further improved significantly, reaching a score of 44.3%. Adding the PSICGA module and the SRL module individually also resulted in substantial improvements, demonstrating the effectiveness of our proposed modules. Subsequently, we combined the modules in pairs, and the synergy between the modules further improves the performance compared to using each module individually.





  §.§.§ STRE Module Structure


 As shown in Fig. <ref>, we evaluated different structures of STRE, including serial structure (a), parallel structure (b), parallel-then-serial structure (c), and using one (d) and two (e) cross-attention mechanisms to fuse the temporal encoder and spatial encoder. Table <ref> shows that compared to the serial structure, the parallel structure's performance decreased significantly. The decline in performance may be due to the interference between the individual features caused by simultaneous temporal and spatial encoding, reducing overall performance.  Additionally, incorporating additional cross-attention to fuse parallel computation results was less effective than the serial structure. Our experimental results show that the serial structure used in STRE, despite its simplicity, better captures the spatio-temporal relationships of individual features, demonstrates its outstanding effectiveness.









  §.§.§ Effect of PSICGA Module

To verify the effectiveness of this module, the network either uses parameter-sharing aggregation encoder or parameter-independent aggregation encoder individually for cross-granularity aggregation separately. As shown in Table <ref>, using the parameter-sharing aggregation encoder alone outperformed using the parameter-independent aggregation encoder alone. This might be because parameter sharing can better capture latent common behaviors across different levels, enhancing the model's generalization capability. Furthermore, when both parameter-sharing and parameter-independent aggregation encoders were used for cross-granularity aggregation, the network's performance significantly improved. This indicates that our proposed cross-granularity aggregation module can fully utilize the complementary effects of parameter sharing and independence. It can effectively learn task-specific features, alleviate parameter optimization conflicts, and capture latent common behaviors across different levels.









  §.§.§ Investigation of the number of visual scene tokens

We evaluated the impact of the number of visual scene tokens on experimental results in scene representation learning. The global scene information in video frames can be summarized using a small and compact set of visual scene tokens, with each token adaptively focusing on the important parts of the scene. Table <ref> shows that the model’s performance is gradually improved with the increasing  number of tokens from 4 to 16. More tokens help the model capture global scene information more effectively, thereby enhancing recognition accuracy. However, when the number of tokens exceeds 16, the model's performance starts to decline. This decline is likely due to information redundancy, which makes it harder for the model to extract useful information, thus negatively affecting performance.






 §.§ Qualitative Analysis




  §.§.§ Visualization of Results


We visualized the prediction results of the MPT-PAR model and MUP <cit.> at different activity granularities. Besides, we compared our method with the vid-TLDR <cit.> and DECOMPL <cit.> at individual and global activity granularities. Fig. <ref> shows the results for individual action predictions. Since vid-TLDR <cit.> relies only on cropped individual features, it failed to correctly identify the “interaction with door” label. Additionally, MUP <cit.>, which overlooks temporal information, might struggle with occlusions, leading to incorrect identification of the label as “standing”. The comparison indicates that our model, utilizing temporal and scene information, accurately recognizes individual action even in crowded scenes with occlusions. The incorporation of global scene context provides additional scene information, enhancing recognition accuracy. As illustrated in Fig. <ref>, our model perceives scene semantics, such as computers, desks, and chairs, enabling more precise global behavior recognition.
However, the proposed model exhibits certain limitations. The direct application of spectral clustering <cit.> for social group detection diminishes its accuracy. In Fig. <ref>, three individual pedestrians, who are in close proximity and performing the same “walking” action, are considered to belong to the same social group, therefore mistakenly thinking them “walking together”.




  §.§.§ Visualization of Scene Attention Maps

We visualized the spatial attention matrices computed in the scene representation learning module to better observe the distribution of attention within scenes. Fig. <ref> demonstrates that attention predominantly focuses on individuals within the scene, aligning with our expectations as individuals are the primary subjects of panoramic activity recognition. Additionally, significant attention is observed on other scene elements such as stairs, trees, railings, and chairs. These scene elements influence human behavior within the environment. For example, the presence of stairs correlates with actions of ascending or descending. The visualization results indicate that our scene representation module effectively captures contextual information relevant to behaviors, providing additional cues to enhance activity recognition in complex environments.







§ CONCLUSION

This paper introduces a novel network architecture, named MPT-PAR, for panoramic activity recognition. The network leverages complementary advantages of parameter sharing and independent cross-granularity aggregation modules, enhancing the effectiveness of activity recognition at all levels. Furthermore, temporal relationships enhanced by transformers and explicit modeling of scene information further help the model better understand the video content. Experiments on the JRDB-PAR dataset validate the efficacy of the proposed method, significantly improving performance across all granularity tasks. In future work, we will improve the reliability of social group aggregation and further enhance the practicality of the method.






1
IEEEtran


sun2022human
Z. Sun, Q. Ke, H. Rahmani, M. Bennamoun, G. Wang, and J. Liu, “Human action recognition from various data modalities: A review,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 3, pp. 3200–3225, 2022.

yu2022argus++
L. Yu, Y. Qian, W. Liu, and A. G. Hauptmann, “Argus++: Robust real-time activity detection for unconstrained video streams with overlapping cube proposals,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2022, pp. 112–121.

li2023dual
Y. Li, Y. Liu, R. Yu, H. Zong, and W. Xie, “Dual attention based spatial-temporal inference network for volleyball group activity recognition,” Multimedia Tools and Applications, vol. 82, no. 10, pp. 15 515–15 533, 2023.

askari2022interaction
F. Askari, R. Ramaprasad, J. J. Clark, and M. D. Levine, “Interaction classification with key actor detection in multi-person sports videos,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 3580–3588.

han2022panoramic
R. Han, H. Yan, J. Li, S. Wang, W. Feng, and S. Wang, “Panoramic human activity recognition,” in European Conference on Computer Vision.1em plus 0.5em minus 0.4emSpringer, 2022, pp. 244–261.

cao2023mup
M. Cao, R. Yan, X. Shu, J. Zhang, J. Wang, and G.-S. Xie, “Mup: Multi-granularity unified perception for panoramic activity recognition,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7666–7675.

zouba2009assessing
N. Zouba, F. Bremond, M. Thonnat, A. Anfosso, É. Pascual, P. Mallea, V. Mailland, and O. Guerin, “Assessing computer systems for monitoring elderly people living at home,” in Proceedings of the 19th IAGG World Congress of Gerontology and Geriatrics, Paris, France, 2009, pp. 5–9.

amer2014hirf
M. R. Amer, P. Lei, and S. Todorovic, “Hirf: Hierarchical random field for collective activity recognition in videos,” in Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part VI 13.1em plus 0.5em minus 0.4emSpringer, 2014, pp. 572–585.

zhu2013context
Y. Zhu, N. M. Nayak, and A. K. Roy-Chowdhury, “Context-aware modeling and recognition of activities in video,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2013, pp. 2491–2498.

DBLP:journals/corr/abs-2108-11743
H. Yuan, D. Ni, and M. Wang, “Spatio-temporal dynamic inference network for group activity recognition,” CoRR, vol. abs/2108.11743, 2021. [Online]. Available: <https://arxiv.org/abs/2108.11743>


Causality_Graph
Z. Xie, T. Gao, K. Wu, and J. Chang, “An actor-centric causality graph for asynchronous temporal inference in group activity,” in 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 6652–6661.

li2021groupformer
S. Li, Q. Cao, L. Liu, K. Yang, S. Liu, J. Hou, and S. Yi, “Groupformer: Group activity recognition with clustered spatial-temporal transformer,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 13 668–13 677.

kim2022detector
D. Kim, J. Lee, M. Cho, and S. Kwak, “Detector-free weakly supervised group activity recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 20 083–20 093.

he2016deep
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778.

he2017mask
K. He, G. Gkioxari, P. Dollár, and R. Girshick, “Mask r-cnn,” in Proceedings of the IEEE international conference on computer vision, 2017, pp. 2961–2969.

bertasius2021space
G. Bertasius, H. Wang, and L. Torresani, “Is space-time attention all you need for video understanding?” in ICML, vol. 2, no. 3, 2021, p. 4.

dosovitskiy2020image
A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929, 2020.

wu2020visual
B. Wu, C. Xu, X. Dai, A. Wan, P. Zhang, Z. Yan, M. Tomizuka, J. Gonzalez, K. Keutzer, and P. Vajda, “Visual transformers: Token-based image representation and processing for computer vision,” arXiv preprint arXiv:2006.03677, 2020.

ehsanpour2022jrdb
M. Ehsanpour, F. Saleh, S. Savarese, I. Reid, and H. Rezatofighi, “Jrdb-act: A large-scale dataset for spatio-temporal action, social group and activity detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 20 983–20 992.

wang2020panda
X. Wang, X. Zhang, Y. Zhu, Y. Guo, X. Yuan, L. Xiang, Z. Wang, G. Ding, D. Brady, Q. Dai et al., “Panda: A gigapixel-level human-centric video dataset,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 3268–3278.

zelnik2004self
L. Zelnik-Manor and P. Perona, “Self-tuning spectral clustering,” Advances in neural information processing systems, vol. 17, 2004.

wu2019learning
J. Wu, L. Wang, L. Wang, J. Guo, and G. Wu, “Learning actor relation graphs for group activity recognition,” in Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition, 2019, pp. 9964–9974.

ehsanpour2020joint
M. Ehsanpour, A. Abedin, F. Saleh, J. Shi, I. Reid, and H. Rezatofighi, “Joint learning of social groups, individuals action and sub-group activities in videos,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part IX 16.1em plus 0.5em minus 0.4emSpringer, 2020, pp. 177–195.

demirel2023decompl
B. Demirel and H. Ozkan, “Decompl: Decompositional learning with attention pooling for group activity recognition from a single volleyball image,” arXiv preprint arXiv:2303.06439, 2023.

li2022uniformer
K. Li, Y. Wang, P. Gao, G. Song, Y. Liu, H. Li, and Y. Qiao, “Uniformer: Unified transformer for efficient spatiotemporal representation learning,” arXiv preprint arXiv:2201.04676, 2022.

choi2024vid
J. Choi, S. Lee, J. Chu, M. Choi, and H. J. Kim, “vid-tldr: Training free token merging for light-weight video transformer,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 18 771–18 781.

xing2023svformer
Z. Xing, Q. Dai, H. Hu, J. Chen, Z. Wu, and Y.-G. Jiang, “Svformer: Semi-supervised video transformer for action recognition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 18 816–18 826.

wu2023can
W. Wu, Y. Song, Z. Sun, J. Wang, C. Xu, and W. Ouyang, “What can simple arithmetic operations do for temporal modeling?” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 13 712–13 722.

pei2023key
D. Pei, D. Huang, L. Kong, and Y. Wang, “Key role guided transformer for group activity recognition,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 33, no. 12, pp. 7803–7818, 2023.

zhou2022composer
H. Zhou, A. Kadav, A. Shamsian, S. Geng, F. Lai, L. Zhao, T. Liu, M. Kapadia, and H. P. Graf, “Composer: compositional reasoning of group activity in videos with keypoint-only modality,” in European Conference on Computer Vision.1em plus 0.5em minus 0.4emSpringer, 2022, pp. 249–266.

chappa2023spartan
N. V. Chappa, P. Nguyen, A. H. Nelson, H.-S. Seo, X. Li, P. D. Dobbs, and K. Luu, “Spartan: Self-supervised spatiotemporal transformers approach to group activity recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 5158–5168.

haque2017towards
A. Haque, M. Guo, A. Alahi, S. Yeung, Z. Luo, A. Rege, J. Jopling, L. Downing, W. Beninati, A. Singh et al., “Towards vision-based smart hospitals: a system for tracking and monitoring hand hygiene compliance,” in Machine Learning for Healthcare Conference.1em plus 0.5em minus 0.4emPMLR, 2017, pp. 75–87.

bates2021potential
D. W. Bates, D. Levine, A. Syrowatka, M. Kuznetsova, K. J. T. Craig, A. Rui, G. P. Jackson, and K. Rhee, “The potential of artificial intelligence to improve patient safety: a scoping review,” NPJ digital medicine, vol. 4, no. 1, p. 54, 2021.

simonyan2014two
K. Simonyan and A. Zisserman, “Two-stream convolutional networks for action recognition in videos,” Advances in neural information processing systems, vol. 27, 2014.

tran2018closer
D. Tran, H. Wang, L. Torresani, J. Ray, Y. LeCun, and M. Paluri, “A closer look at spatiotemporal convolutions for action recognition,” in Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, 2018, pp. 6450–6459.

kalfaoglu2020late
M. E. Kalfaoglu, S. Kalkan, and A. A. Alatan, “Late temporal modeling in 3d cnn architectures with bert for action recognition,” in Computer Vision–ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16.1em plus 0.5em minus 0.4emSpringer, 2020, pp. 731–747.

liu2016spatio
J. Liu, A. Shahroudy, D. Xu, and G. Wang, “Spatio-temporal lstm with trust gates for 3d human action recognition,” in Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part III 14.1em plus 0.5em minus 0.4emSpringer, 2016, pp. 816–833.

majd2020correlational
M. Majd and R. Safabakhsh, “Correlational convolutional lstm for human action recognition,” Neurocomputing, vol. 396, pp. 224–229, 2020.

Baradel_2017_ICCV
F. Baradel, C. Wolf, and J. Mille, “Human action recognition: Pose-based attention draws focus to hands,” in Proceedings of the IEEE International Conference on Computer Vision (ICCV) Workshops, Oct 2017.

arnab2021vivit
A. Arnab, M. Dehghani, G. Heigold, C. Sun, M. Lučić, and C. Schmid, “Vivit: A video vision transformer,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 6836–6846.

fan2021multiscale
H. Fan, B. Xiong, K. Mangalam, Y. Li, Z. Yan, J. Malik, and C. Feichtenhofer, “Multiscale vision transformers,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 6824–6835.

bruce2022mmnet
X. Bruce, Y. Liu, X. Zhang, S.-h. Zhong, and K. C. Chan, “Mmnet: A model-based multimodal network for human action recognition in rgb-d videos,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 3, pp. 3522–3538, 2022.

7214317
F. Solera, S. Calderara, and R. Cucchiara, “Socially constrained structural learning for groups detection in crowd,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 38, no. 5, pp. 995–1008, 2016.

kim2023practicalgroupactivitydetection
D. Kim, Y. Song, M. Cho, and S. Kwak, “Towards more practical group activity detection: A new benchmark and model,” 2023. [Online]. Available: <https://arxiv.org/abs/2312.02878>


7514916
Y. Xian, X. Rong, X. Yang, and Y. Tian, “Evaluation of low-level features for real-world surveillance event detection,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 27, no. 3, pp. 624–634, 2017.

10159436
R. Li and B. Bhanu, “Energy-motion features aggregation network for players’ fine-grained action analysis in soccer videos,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 34, no. 2, pp. 955–972, 2024.

ji2020arbitrary
Y. Ji, Y. Yang, F. Shen, H. T. Shen, and W.-S. Zheng, “Arbitrary-view human action recognition: A varying-view rgb-d action dataset,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 31, no. 1, pp. 289–300, 2020.

chen2023agpn
Y. Chen, H. Ge, Y. Liu, X. Cai, and L. Sun, “Agpn: Action granularity pyramid network for video action recognition,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 33, no. 8, pp. 3912–3923, 2023.

10262342
Y. Mou, X. Jiang, K. Xu, T. Sun, and Z. Wang, “Compressed video action recognition with dual-stream and dual-modal transformer,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 34, no. 5, pp. 3299–3312, 2024.








 Paper Title: Multiple Greedy Quasi-Newton Methods for Saddle Point Problems.








Multiple Greedy Quasi-Newton Methods for Saddle Point Problems
    1st Minheng Xiao*
dept. Integrated System Engineering 

Ohio State University

Columbus, USA 

minhengxiao@gmail.com*
2nd Shi Bo
dept. Mathematics and Statistics 

Boston University

Boston, USA 

shibo@bu.edu
3rd Zhizhong Wu
College of Engineering 

UC Berkeley

Berkeley, USA 

ecthelion.w@gmail.com
    August 5, 2024
=================================================================================================================================================================================================================================================================================================================



§ ABSTRACT 
This paper introduces the Multiple Greedy Quasi-Newton (MGSR1-SP) method, a novel approach to solving strongly-convex-strongly-concave (SCSC) saddle point problems. Our method enhances the approximation of the squared indefinite Hessian matrix inherent in these problems, significantly improving both stability and efficiency through iterative greedy updates. We provide a thorough theoretical analysis of MGSR1-SP, demonstrating its linear-quadratic convergence rate. Numerical experiments conducted on AUC maximization and adversarial debiasing problems, compared with state-of-the-art algorithms, underscore our method's enhanced convergence rate. These results affirm the potential of MGSR1-SP to improve performance across a broad spectrum of machine learning applications where efficient and accurate Hessian approximations are crucial.



artificial intelligence, saddle point problems, quasi-Newton methods, optimization




§ INTRODUCTION

The saddle point problem is a fundamental formulation in machine learning and optimization and naturally emerges in several applications including game theory <cit.>, robust optimization <cit.>, reinforcement learning <cit.>, AUC maximization <cit.>, fairness-aware machine learning <cit.>, and generative adversarial networks (GANs) <cit.>, etc. In this paper, we consider the following saddle point problem formulated as

    min_∈ℝ^n_max_∈ℝ^n_ f(, ),

where f(, ) is smooth, strongly-convex in , and strongly-concave in . The objective is to find the saddle point (^*, ^*) such that:

    f(^*, ) ≤ f(^*, ^*) ≤ f(, ^*)

for all ∈^n_, ∈^n_.

Several first-order optimization techniques have been developed to solve saddle point problems, achieving a linear convergence rate with an iteration complexity of (1/ϵ). These include the extragradient (EG) method <cit.>, the optimistic gradient descent ascent (OGDA) method <cit.>, the proximal point method <cit.>, the mirror-prox method <cit.>, and the dual extrapolation method <cit.>. Their stochastic variants have also been explored in large-scale settings <cit.>.

Second-order methods enhance iteration complexity compared to first-order methods but often require higher computational demands. The cubic regularized Newton (CRN) method, which achieves quadratic local convergence, requires the computation of the exact Hessian matrix and solving of cubic variational inequality sub-problems <cit.>. Other adaptations, such as the Newton proximal extragradient <cit.>, the mirror-prox algorithm <cit.>, and the second-order optimistic method <cit.>, incorporate line searches for step size optimization. Conversely, methods such as those proposed in <cit.>, avoid such complexities by omitting line searches and following a more streamlined approach akin to the CRN method, balancing efficiency and effectiveness in various optimization settings. Recently, 

Quasi-Newton methods approximate the Hessian matrix and its inverse rather than directly computing them, utilizing iterative updates to significantly reduce per-iteration costs. Notable quasi-Newton formulas for minimization include the BFGS <cit.>, DFP <cit.>, and PSB <cit.>. Recent advancements include <cit.> have introduced greedy, random and higher rank variants that achieve superlinear convergence. Despite their success in minimization problems, quasi-Newton methods are less commonly applied to saddle point problems. Research has explored proximal quasi-Newton methods for monotone variational inequalities <cit.>. Recent developments <cit.> have introduced new quasi-Newton methods, although these adaptations may lack stability. 

In this paper, we propose a multiple greedy quasi-Newton method for SCSC saddle point problems, which leverages the approximation of the squared Hessian matrix with multiple greedy quasi-Newton updates per iteration. We rigorously establish a linear to quadratic convergence rate for our algorithm. Through numerical experiments on popular machine learning problems, including AUC maximization and adversarial debiasing, we demonstrate the superior performance of our algorithm compared to state-of-the-art alternatives. The paper is organized as follows: 

Paper Organization In Section <ref>, we clarify the notations and provide assumptions and preliminaries of this paper. In Section <ref>, we introduce a framework for saddle point problems and propose our MGSR1-SP algorithm with theoretical convergence guarantee. In Section <ref>, we validate our algorithm on AUC maximization and Adverasial Debiasing problems. 













§ NOTATION AND PRELIMINARIES


We use · to denote the spectral norm and the Euclidean norm of a matrix and a vector, respectively. The standard basis in ^d is denoted by {𝐞_1, …, 𝐞_d}. The identity matrix is represented as , and the trace of any square matrix is represented by tr(·). We use _++^d to represent the set of positive definite matrices. For two positive definite matrices ∈_++^d and ∈̋_++^d, their inner product is defined as ⟨, ⟩̋= tr()̋. We denote ≽$̋ if- ≽̋0. Referring to the objective function in equation (<ref>), letd = d_+ d_represent the full dimension. The gradient(_k, _k)and Hessian matrix(_k, _k)of functionfat thek-th iteration at(_k, _k)are denoted as_k ∈ℝ^dand_k ∈ℝ^d ×drespectively. We also use_̋, _̋and_̋to denote the sub-matrices.


Suppose that the objective function in Eq. (<ref>) satisfies the following assumptions:

The objective function f(𝐱, 𝐲) is twice differentiable with L_1-Lipschitz gradient and L_2-Lipschitz Hessian, i.e., 

    𝐠(, ) - (', ')≤ L_1[ - '; - ' ]

and 

    (, ) - (', ')≤ L_2[ - '; - ' ]

for any [; ]^⊤∈^d and  ['; ']^⊤∈^d.

The objective function f(𝐱, 𝐲) is μ-strongly-convex in 𝐱 and μ-strongly-concave in 𝐲, i.e., 

    _≽μ

and 

    _≼ -μ

for any [; ]^⊤∈^d. Additionally, the condition number of the objective function is defined as κ = L_1 / μ.


Note that the Hessian matrix𝐇̃(𝐱, 𝐲)in saddle point problems in Eq. (<ref>) is usually indefinite. However, the following lemma derived a crucial property of the squared Hessian matrix, guaranteeing positive definiteness.

Define (̋, ) = (, )^2. Under Assumption <ref> and Assumption <ref>, we have μ^2 𝐈≼(̋, ) ≼ L_1^2 for any [; ]^⊤∈^d.


§ ALGORITHM AND THEORETICAL ANALYSIS

In this section, we first present a framework for saddle point problems. We then review the fundamentals of quasi-Newton methods, emphasizing the greedy variant from <cit.>. Finally, We then introduce our MGSR1-SP algorithm and provide its convergence guarantee.





 §.§ A Quasi-Newton Framework for Saddle Point Problems

The standard update formula for Newton’s method is expressed as

    [ _k+1; _k+1 ] = 
    [ _k; _k ] - _k^-1_k,

which exhibits quadratic local convergence. However, this method incurs a computational complexity of(d^3)per iteration for the inverse Hessian matrix. In the realm of convex minimization, quasi-Newton methods such as BFGS, SR1, and their variations focus on approximating the Hessian matrix to reduce computational demands to(d^2)per iteration. Nonetheless, these methods presuppose a positive definite Hessian, which is unsuitable for saddle point problems as described in Eq. (<ref>) due to the inherent indefiniteness of(, ). To address this challenge, <cit.> reformulated the Newton's method as

    [ _k+1; _k+1 ] = 
    [ _k; _k ] - [(_k)^2]^-1_k _k = 
    [ _k; _k ]- _̋k^-1_k _k.

where_̋k = _k^2is the auxiliary matrix defined in Lemma <ref>, which is guaranteed to be positive definite. Consequently, the update rule for Newton’s method can be reformulated as

    [ _k+1; _k+1 ]   = [ _k; _k ] - _k^-1_k_k,

where_k^-1 ∈_++^dis an approximated inverse matrix of_̋k^-1. We will introduce the techniques to construct_kand its inverse in the next section. Note that the update rule (<ref>) does not necessarily require the explicit construction of Hessian matrix, which can be computed efficiently through Hessian-Vector Product (HVP) <cit.>. 










 §.§ Greedy Quasi-Newton Methods

Quasi-Newton methods are developed to circumvent some of the computational inefficiencies associated with the classical Newton's method <cit.>. Among these, the Broyden family update is the most widely used in literature. Given two symmetric positive definite matrices,̋ ∈^d_++and a vector∈̆^d, satisfying that≽$̋ and ≠̆$̆, the Broyden family update is given by

    Broyd_τ(, ,̋)̆ = τDFP(,   ,̋)̆
       + (1 - τ) SR1(, ,̋)̆,

which is proved to be a convex combination <cit.>. The SR1 update is given by

    SR1(, ,̋)̆ =  - ( - )̋̆̆^⊤(-)̋/^̆⊤ ( - )̋,

which leverages a rank-one modification to adjustbased on the discrepancy betweenand$̋. On the other hand, the DFP update incorporates both current and previous curvature information into the approximation:

    DFP(, ,̋)̆ =  -    ̆̋^̆⊤ + ̆̆^⊤/^̆⊤̆̋
       + (1 + ^̆⊤/^̆⊤̆̋)̆̋^̆⊤/^̆⊤̆̋.

The parameter τ∈ [0, 1] determines the specific type of Quasi-Newton update applied. Specifically, setting τ = ^̆⊤̆̋/^̆⊤ leads to the well-known Broyden-Fletcher-Goldfarb-Shanno (BFGS) update formulated as

    BFGS(, ,̋)̆ =  - ̆̆^⊤/^̆⊤ + ̆̋^̆⊤/^̆⊤̆̋.


Greedy Quasi-Newton methods were proposed to achieve better convergence rates than classical Quasi-Newton methods, with a contraction factor that depends on the square of the iteration counter <cit.>. Specifically, for a given target matrix ∈̋_++^d and an approximator ≽$̋, the greedily selected vector$̆ is determined as follows:

    _̆(̋) = _∈̆{_1, …, _n}^̆⊤/^̆⊤̆̋,

where _i represents the basis vector. Define the greedy Broyden family update as follows:

    gBroyd_τ(, )̋Broyd_τ(, ,̋_̆(̋)).

Specifically, if τ = 0, the update is greedy SR1 update defined as

    gSR1(, )̋gSR1(, ,̋_̆(̋)).

The following lemma demonstrates that the greedy SR1 update reduces the rank of - $̋ at each iteration. Therefore, with at mostditerations, the gSR1 update will accurately recover the Hessian matrix.

Suppose that for each k ≥ 0, we choose _̆k = _̆(̋_k) and τ = 0, then _k = $̋ for some0 ≤ k ≤ d.

In quadratic optimization, the Hessian matrix remains constant, which means the approximatorconverges to$̋ with each iteration. For more general problems, we define the multiple gBroyd_τ^n as a series of nested gBroyd_τ updates <cit.> such that

    _i+1←gBroyd_τ^n(_i, )̋,    i = 0, …, n-1,

where n is a non-negative integer representing the counts of greedy Broyden family updates performed in each iteration. Specifically, the multiple greedy SR1 update denoted as gSR1^n is performed as follows:

    _i+1←gSR1(, )̋,    i = 0, …, n-1.


 §.§ MGSR1-SP Algorithm and Convergence Analysis

In this section, we introduce the Multiple Greedy Rank-1 (MGSR1-SP) algorithm for saddle point problems satisfying Assumption <ref> and Assumption <ref>, which is outlined in Algorithm <ref>. The MGSR1-SP algorithm builds upon the framework in Section <ref> and adopts the multiple greedy SR1 updates specified in Eq. (<ref>).

If, for some η≥ 1, and two positive definite matrix ,̋∈_++^d, we have

    ≼̋≼η,̋

then using greedy SR1 update (<ref>), we have

    ≼̋gSR1(, )̋≼η.̋

Let [_k; _k]^⊤∈^d  and  [_k+1; _k+1]^⊤∈^d with squared Hessian matrix _̋k, _̋k+1∈_++^d defined in Lemma <ref>, respectively. For some η≥ 1 and let _k ∈_++^d be a positive definite matrix such that 

    _̋k ≼_k ≼η_̋k,

we have 

    _̋k+1≼gSR1(_k+1, _̋k+1) ≼ (1+Mr_k)^2 η_̋k+1

where _k+1 = (1+Mr_k)_k, r_k = [ _k+1 - _k; _k+1 - _k ] and  M = 2κ^2 L_2/L_1.


Given upon this, define the convergence measure as 

    λ_k = λ(_k, _k) = (_k, _k)_2,

we establish a linear to quadratic convergence rate for our MGSR1-SP algorithm in the following theorem.


Using Algorithm <ref>, suppose we have _̋k ≼_k ≼η_k _̋k for some η_k ≥ 1, and let β = L_2/2μ^2, then we have

    λ_k+1   ≤(1 - 1/η_k) λ_k + βλ_k^2.

Suppose _̋k ≼_k ≼η_k_̋k holds, with Lemma <ref>, the multiple greedy SR1 update also satisfies _̋k ≼gSR1^n(_k, _̋k) ≼η_̋k, hence, following Lemma <ref>, we have _̋k+1≼_k+1≼ (1 + Mr_k)^2η_k _̋k+1 = η_k+1_̋k+1. The rest follows Lemma 3.14 in <cit.>.


§ NUMERICAL EXPERIMENTS

In this section, we demonstrate the efficiency of our algorithm using two popular machine learning tasks: AUC maximization and adversarial debiasing. The experiments were conducted on a Macbook Air with M2 chip.




 §.§ AUC Maximization

In machine learning, the Area Under the ROC Curve (AUC) is a key metric that evaluates classifier performance in binary classification, particularly useful with imbalanced data. The problem can be formulated as follows:

    f(, y) := 1/m∑_i=1^m f_i(, y) + λ/2^2 - p(1-p)y^2,
 
where = [; u; v]^⊤∈^n_, y ∈, λ is the regularization parameter and p denotes the proportion of positive instances in the dataset. The function f_i(, y) is defined as:

    f_i(,y) =    (1-p)((^⊤_j-u)^2 - 2(1+y)^⊤_j)_b_j=1
       +p((^⊤_j-v)^2 + 2(1+y)^⊤_j)_b_j=-1,

where _i ∈ℝ^n_-2 are features and b_i ∈{+1, -1} is the label.



 §.§ Adversarial Debiasing

Adversarial debiasing is a prominent method used to enhance equity in AI by integrating adversarial techniques to mitigate biases within machine learning algorithms. Given a dataset {_i, b_i, c_i}_i=1^m, where _i represents input variables, b_i ∈ℝ is the output, and c_i ∈ℝ is the protected variable, the objective is to reduce bias, which can be formulated as:

    f(, y) = 1/m∑_i=1^m f_i(, y) + λ^2 - γ y^2 ,
 
where λ, γ are regularization parameters. The function f_i(, y) is defined as

    f_i(, y) =    log(1+exp(-b_j(_j)^⊤)) 
       -βlog(1 + exp(-c_j(_j)^⊤ y)),

with β also serving as a regularization parameter.



 §.§ Results Analysis

We evaluated the performance of our MGSR1-SP algorithm against two baselines: Random SR1, where vectors 𝐮∈ℝ^d are drawn from a normal distribution 𝒩(0, 1), and the ExtraGradient algorithm for saddle point problems.

For AUC maximization, the experiments were conducted on the `a9a' dataset (n_𝐱=125, n_𝐲=1, N=32651) and the `w8a' dataset (n_𝐱=302, n_𝐲=1, N=45546). The results are shown in Figure <ref>. Note that the Hessian AUC maximization is invariant (L_2 = 0), indicating a linear convergence rate <ref>. Our MGSR1-SP algorithm demonstrated a faster convergence rate compared to the ExtraGradient algorithm. Moreover, it offered more stable Hessian approximations than the random SR1 update, particularly as the number of update rounds increased. 

For adversarial debiasing, the experiments were conducted using the `adult' dataset (n_𝐱=122, n_𝐲=1, N=32651) and the `law school' dataset (n_𝐱=379, n_𝐲=1, N=20427). The results, shown in Figure <ref>, indicated that our algorithm achieved a linear-quadratic convergence rate. Our method outperformed both EG and Random SR1 in terms of iterations required, with significant performance improvements as updates increased.





§ CONCLUSION

In this paper, we propose a Multiple Greedy Quasi-Newton (MGSR1-SP) method for strongly-convex-strongly-concave (SCSC) saddle point problems. This algorithm approximates the squared indefinite Hessian matrix, enhancing accuracy and efficiency through a series of iterative greedy quasi-Newton updates. We rigorously established the theoretical results of the MGSR1-SP algorithm, demonstrating its linear-quadratic convergence rates. Furthermore, we conducted numerical experiments against state-of-the-art methods including the EG and Random SR1 algorithms, on two popular machine learning applications. The results clearly show that our method not only converges faster but also provides a more accurate and stable estimation of the inverse Hessian matrix.

For future work, several promising directions can be explored. These include adapting the MGSR1-SP framework to stochastic settings. Additionally, the development of limited memory quasi-Newton methods could make our approach feasible for large-scale problems, where computational resources and memory usage are significant constraints. Another area of potential exploration is the integration of adaptive step-size mechanisms to enhance effectiveness. Lastly, extending our method to handle non-convex saddle point problems with regularization could broaden its applicability to a wider range of machine learning problems.


plainnat

 Paper Title: Parallel Strategies for Best-First Generalized Planning.










123 















A]Alejandro Fernández-AlburquerqueCorresponding Author. Email: alejandro.fernandez07@estudiant.upf.edu0009-0009-0884-7015
A]Javier Segovia-Aguas0000-0001-6141-2672 

[A]Universitat Pompeu Fabra





§ ABSTRACT 
In recent years, there has been renewed interest in closing the performance gap between state-of-the-art planning solvers and generalized planning (GP), a research area of AI that studies the automated synthesis of algorithmic-like solutions capable of solving multiple classical planning instances. One of the current advancements has been the introduction of Best-First Generalized Planning (BFGP), a GP algorithm based on a novel solution space that can be explored with heuristic search, one of the foundations of modern planners. This paper evaluates the application of parallel search techniques to BFGP, another critical component in closing the performance gap. We first discuss why BFGP is well suited for parallelization and some of its differentiating characteristics from classical planners. Then, we propose two simple shared-memory parallel strategies with good scaling with the number of cores.









§ INTRODUCTION


Generalized planning (GP) has been a longstanding area of research in Artificial Intelligence (AI) <cit.>. The foundation of GP is automated planning, which studies how to construct sequences of actions (commonly known as plans) to go from a specific initial state to a goal <cit.>. Since planning is a hard problem (PSPACE-complete) <cit.>, solving multiple problem instances from the same domain is computationally expensive. Given this realization, GP studies the synthesis of general plans that can solve multiple problem instances from the same domain, reducing the computational complexity to a one-time up-front cost <cit.>.

The state-of-the-art planning solvers are often heuristic-based planners <cit.>. These planners guide the combinatorial search of reaching a goal state from the initial state with heuristics, usually based on computing the cost of solving a relaxed plan as an estimate of the actual cost of reaching the solution <cit.>. Given the success of heuristic search in planning, <cit.> propose a heuristic-based approach to generalized planning, which they call Best-First Generalized Planning (BFGP). BFGP leverages a set of novel GP native heuristics and a new solution space, independent of the number of input instances, to compute general algorithmic solutions.

Parallel programming is tightly coupled with AI's recent success, as CPU manufacturers have transitioned to multi-core processors due to single-core performance stagnation <cit.>. As a consequence, there has been a notable effort to parallelize fundamental algorithms like Best-First Search (BFS), and these techniques have already been successfully applied to planning domains <cit.>. One of the most impactful algorithms has been Hash Distributed A* (HDA*) <cit.>, which efficiently handles the two most challenging communication overheads of Parallel BFS: distributing search nodes and keeping a consistent closed list of reached nodes. To achieve this, they use a hash function to assign each state to a unique process (which allows local duplicate detection) and asynchronous communication.

While using parallel techniques for classical planners is an active research topic, applications to generalized planning are much less explored. In this paper, we discuss how the BFGP algorithm can be easily parallelized by design. Furthermore, we present two shared-memory parallelization strategies that can scale linearly with the number of cores.





§ SUITNESS OF BEST-FIRST GENERALIZED PLANNING FOR PARALLELIZATION


A classical planning problem <cit.> is defined as  P = ⟨ D,  I⟩, where D = ⟨ F,A⟩ is the domain that comprises the set of lifted predicates F and actions A, and I = ⟨Ω, I, G⟩ is the instance that specifies the set of constant objects, the initial state I, and the goal condition. A solution to P is a sequence of actions or plan π that maps the initial state to a goal state where the goal condition holds. 

GP is formalized as the problem of finding an algorithm-like solution Π (also known as generalized plan) to a set of T planning problems, that is P = {P_1,P_2,…,P_T}, where all planning problems share the domain, but may differ in the instances (different objects, initial state and/or goal condition). We focus on a special kind of generalized plans named planning programs. Formally, a planning program <cit.> is a sequence of n instructions Π = ⟨ w_0, ..., w_n-1⟩, where each instruction w_i is associated with a program line 0 ≤ i < n and can be of one of the following three types:


    
  A planning action w_i ∈ A, where A is the set of deterministic functions of the planning domain.
    
  A goto instruction w_i = goto(i', !y), where i' is a program line such that 0 ≤ i' < n and i'  i, and y is a proposition. Proposition y can be the result of an arbitrary expression on state variables.
    
  A termination instruction w_i =. The last instruction of a planning program is always a termination instruction.


A planning program Π is a solution to P iff the execution of Π on every P_i∈ P generates a classical plan π_i that is a solution to the original planning problem. 

In this work, we use the generalized planner BFGP <cit.>, which has shown good performance for computing planning programs via heuristic search. BFGP is a frontier-search algorithm <cit.>, which means that it does not repeat states during the search (i.e., all expanded planning programs are different). This unique characteristic eliminates the need to maintain a closed list of states to prevent search loops. Notably, this simplifies the algorithm's parallelization, as duplicate detection is a significant source of synchronization and communication overheads in parallel BFS.

Another relevant detail about BFGP is that it is a Greedy Best-First Search (GBFS). Unlike A*, the GBFS is guided by an evaluation function f(n) = h(n) that only takes into account the estimated cost of reaching the goal from node the current node n (instead of also considering the solution cost up to the current node, f(n) = g(n) + h(n)) <cit.>. In a GBFS, we are only interested in finding a solution to the problem, not necessarily the optimal one. Likewise, this trait eases the task of parallelizing BFGP since once we find a solution, it is unnecessary to check for optimality. 





§ PARALLEL BEST-FIRST GENERALIZED PLANNING


The following section presents our two strategies for parallelizing BFGP[All experiments used BFGP settings in <cit.> and were run on a 12-core Intel® Core™ i7-12700 Processor (20 threads) and 32G of RAM.] and evaluates their performance in 9 different classical planning domains; 3 of them are propositional (corridor, gripper, and visitall) and the other 6 are numeric domains (fibonacci, find, reverse, select, sorting, and triangular sum). 



Parallel strategy #1. It sequentially expands nodes until there are at least N nodes per thread[N is a parameter of the algorithm]. Then, it starts a parallel search in which each thread is independent and does not share nodes with other threads. To ensure a balanced workload distribution, N should be larger for planning domains that require more program lines to reach a solution. Table <ref> evaluates the scaling of this strategy (the single-threaded execution corresponds to the original BFGP implementation).



Parallel strategy #2. In this strategy, threads distribute promising nodes during the parallel search phase, so there is a tradeoff between searching the most promising states and minimizing the communication overhead. In our solution, we compute the cost-to-go value of each generated node, and if it is equal to or better than the last expanded node, we send the new node to another thread. In contrast to HDA*, where a hash function determines which process will receive the node, we simply cycle between all threads. This approach is viable because BFGP does not need to perform duplicate detection. Table <ref> evaluates the scaling of this strategy[The single-threaded results of Table <ref> also apply to Table <ref>.].













































§ DISCUSSION


The first strategy performs very well, with speedups ranging from ∼4x to ∼98x in the most complex domains. Furthermore, increasing the number of threads always results in better performance. On the other hand, no parallel strategy strictly dominates. In some domains (like Visitall), the second strategy gets better scaling and performance than the first strategy, but in others, it gets slower execution times. We believe that a better prioritization of promising nodes and the use of asynchronous communication would help the second strategy perform better than the first one. To conclude, our results show that BFGP is well-suited for parallelization, and further developments could make BFGP capable of handling more complex problems from IPC planning domains<cit.>.
























 Paper Title: RoCo:Robust Collaborative Perception By Iterative Object Matching and Pose Adjustment.

















0009-0005-7656-1298
[2]

  School of Information, Renmin University of China
  
  Beijing
  China
huangzhe21@ruc.edu.cn



[2]
0000-0002-6720-1646

  School of Information, Renmin University of China
  
  Beijing
  China
shuowang18@ruc.edu.cn

 
Corresponding author. † Equal contribution.
0000-0002-4197-2258

  School of Information, Renmin University of China
  
  Beijing
  China
ycw@ruc.edu.cn



0000-0002-0092-7020

  School of Information, Renmin University of China
  
  Beijing
  China
lindalee@ruc.edu.cn


0000-0002-7748-5427

  School of Information, Renmin University of China
  
  Beijing
  China
deyingli@ruc.edu.cn


0000-0002-0961-0441

  University of Wollongong
  
  Wollongong
  NSW
  Australia
lei_wang@uow.edu.au












§ ABSTRACT 
Collaborative autonomous driving with multiple vehicles 
usually requires the data fusion from multiple modalities. To ensure effective fusion, the data from each individual modality shall maintain a reasonably high quality.  
However, in collaborative perception, the quality of object detection based on a modality is highly sensitive to the relative pose errors among the agents. It leads to feature misalignment and significantly reduces collaborative performance.
To address this issue, we propose RoCo, a novel unsupervised framework to conduct iterative object matching and agent pose adjustment.  To the best of our knowledge, our work is the first to model the pose correction problem in collaborative perception as an object matching task,  which reliably associates common objects detected by different agents. On top of this, we propose a graph optimization process to adjust the agent poses by minimizing the alignment errors of the associated objects,  and the object matching is re-done based on the adjusted agent poses. 
This process is carried out iteratively until convergence.
Experimental study on both simulated and real-world datasets demonstrates that the proposed framework RoCo consistently outperforms existing relevant methods in terms of the collaborative object detection performance, and exhibits 
highly desired robustness when the pose information of agents is with high-level noise. Ablation studies are also provided to show the impact of its key parameters and components. The code is released at <https://github.com/HuangZhe885/RoCo>.








<ccs2012>
 <concept>
  <concept_id>00000000.0000000.0000000</concept_id>
  <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
  <concept_significance>500</concept_significance>
 </concept>
 <concept>
  <concept_id>00000000.00000000.00000000</concept_id>
  <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
  <concept_significance>300</concept_significance>
 </concept>
 <concept>
  <concept_id>00000000.00000000.00000000</concept_id>
  <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
  <concept_significance>100</concept_significance>
 </concept>
 <concept>
  <concept_id>00000000.00000000.00000000</concept_id>
  <concept_desc>Do Not Use This Code, Generate the Correct Terms for Your Paper</concept_desc>
  <concept_significance>100</concept_significance>
 </concept>
</ccs2012>

[500]Computer system organization Autonomous driving



[300]Computing methodologies Collaborative detection
























RoCo: Robust Collaborative Perception By Iterative Object Matching and Pose Adjustment
    Lei Wang
    
======================================================================================










§ INTRODUCTION
 

Collaborative perception can significantly enhance perception performance by sharing information from different sensors among agents.
It can overcome the inherent limitations of single-agent-based perception, such as invisibility caused by occlusion or long-range issues. 
Recent research <cit.> has spurred the widespread attention in the fields such as autonomous driving, metaverse, multi-robot systems, and multimedia application systems <cit.>. 
As an emerging topic, collaborative 3D object detection is of significance but also faces many challenges, including model-agnostic and task-agnostic formulation <cit.>, communication bandwidth constraints <cit.>, time delay <cit.>, adversarial attacks <cit.>, and multimodal fusion <cit.>.


In collaborative 3D object detection, regardless of the modality of the employed sensors, the detection module of each agent transmits the obtained object detection features to the Ego agent.  The Ego agent  gathers the features of the same object and then carries out further information fusion. Therefore, the object detection features received from other agents need to be accurately aligned in the Ego agent for further processing.  However, in practical applications, the pose estimated for each agent contains errors, which can in turn cause 
misalignment of the positions of the same objects across agents. For example, as illustrated in Figure <ref>(a), this misalignment may result in the incorrect fusion of Object 3 detected by agent i (red box) with Object 2 detected by agent j (green box). This issue becomes more pronounced when the pose error is large or high traffic is presented.  This paper will focus on addressing the object alignment problem between multiple agents due to pose errors in a given modality (LiDAR).





Previous works have proposed some methods to improve the robustness of pose estimation <cit.>. For example, V2X-ViT <cit.> adopts multiscale window attention to capture features at different ranges, while V2VNet <cit.> combines pose regression, global consistency, and attention aggregation modules to correct relative poses. CoAlign <cit.> introduces a proxy-object pose graph to enhance the pose consistency between collaborative agents without the need of real poses for supervision. 
The above methods work well when there is minimal variation in poses and a limited number of vehicles. However, in crowded and complex scenarios, as the number of objects and the magnitude of pose errors increase, the deviation in object positions will grow, making it increasingly difficult to correctly match objects at the same location. This situation ultimately reduces the accuracy of 3D object detection.


To address these limitations, we propose a novel iterative object matching and pose adjustment framework called RoCo, which can handle the issue of matching the object detection information from multiple vehicles in noisy scenarios. RoCo is primarily divided into two parts: object matching and robust graph optimization. Object matching involves correctly establishing the matching relationships between multiple detected objects using the distance and neighborhood structural consistency of local graphs. Robust graph optimization builds a pose optimization graph for the whole scene based on the above matching relationships, and iteratively adjusts the poses of agents according to global observation consistency, so as to effectively filters out incorrect matches.
RoCo has three main advantages: i) it is an unsupervised method, requiring no ground-truth pose information for the agents or objects and it can adapt to various levels of pose errors; ii) Implementing RoCo does not require retraining or fine-tuning any network models and can be integrated into any 3D object detection based collaborative perception framework; iii) Even in crowded and noisy environments, RoCo can accurately align the detections of the same object obtained by different agents.
Unlike the existing methods that adjust object detection features, the proposed method is based on an object-matching-guided pose adjustment which can fundamentally prevent the introduction of additional noise into the features.
 

We conduct extensive experiments on both simulation and real-world datasets, including V2XSet<cit.> and DAIR-V2X<cit.>.
Results show that RoCo consistently achieves the best performance in the task of collaborative 3D object detection with the presence of pose errors. 

In summary, the main contributions of this work are:


  * We propose RoCo, a novel robust multi-agent collaborative LiDAR-based 3D object detection framework that addresses the matching errors and pose inaccuracies between agents and objects. To the best of our knowledge, RoCo is the first to model
the pose correction problem in collaborative perception as an object matching task.

  * The proposed RoCo establishes matching relationships between targets based on distance and neighborhood structural consistency using a graph matching approach. On top of this, RoCo iteratively adjusts agent poses based on global observation consistency, effectively filtering out incorrect object matches.

  * Extensive experiments have shown that RoCo achieves more accurate and robust 3D object detection performance even in the  scenarios with vehicle congestion and significant noise.





§ RELATED WORK



 §.§ Collaborative Perception

Collaborative perception is a promising mechanism in multi-agent systems that can overcome the limits of single-agent perception.  
To support research in this field, various strategies have been devised to address practical challenges<cit.><cit.><cit.><cit.><cit.>.
To reduce communication bandwidth, Where2comm<cit.> selects spatially sparse but perceptually significant regions by using a spatial confidence map. 
V2X-ViT<cit.> includes a multi-agent attention module that aggregates information from various agents, improving detection performance.  To handle communication delays, SyncNet<cit.> uses historical multi-frame information to compensate for current information, employing feature attention co-symbiotic estimation and time modulation techniques. CoBEVFlow<cit.> creates a synchrony-robust collaborative system for Bird's Eye View (BEV) flow that aligns asynchronous collaboration messages sent by various agents using motion compensation. 
HEAL<cit.> introduces a pioneering and adaptable collaborative perception framework designed to seamlessly integrate continually emerging heterogeneous agent types into collaborative perception tasks.



However, in crowded and noisy road scenarios, information often becomes inconsistent and misaligned, leading to mismatches between objects detected by different agents and resulting in performance degradation. Therefore, in this work, we specifically considered the robustness to pose errors.



 §.§ Noisy Pose Issue


Due to performance discrepancies between hardware acquisition devices and model estimations, the poses of agents are susceptible to interference, leading to misalignment and inconsistencies during fusion processes. Therefore, many methods attempt to design robust networks to correct error influences.
The first category of methods primarily involves proposing robust network architectures and introducing specific modules to learn the influence of poses, such as V2VNet<cit.>, MASH<cit.>, V2X-ViT<cit.> and FeaCo<cit.>. However, these methods require additional pose supervision signals.

The second category is to use the coarse observations as prior knowledge to adjust the poses of objects<cit.>.
CoAlign<cit.> introduced a method for modeling and optimizing agent-object pose graphs to enhance the consistency of relative poses, thereby improving model robustness. Nevertheless, in circumstances with crowded roadways, this approach's use of clustering to create connections between objects could result in mistakes and fail pose graph optimisation.
In contrast, our proposed RoCo models the reduction in pose errors as a matching and optimization problem for objects, accurately identifying relationships between objects detected by multiple agents. Through iterative pose optimization based on the correct matching graph, RoCo improves the accuracy of 3D detection.







 §.§ Object Matching 


SLAM<cit.>  (Simultaneous Localization and Mapping) is a crucial research approach in scene understanding, primarily used by autonomous robots (such as robots and autonomous vehicles) to estimate their positions and build maps of the environment simultaneously during motion, without prior environmental information. 
Object matching in SLAM refers to associating detection results of the current frame with known objects in the scene. Most methods use metrics such as distances between different objects or Intersection over Union (IoU), followed by matching using the Hungarian algorithm<cit.>, which is classical and high-performing but impractical for large-scale deployment in real environments. Therefore, researchers have explored many methods to facilitate its application<cit.><cit.><cit.>.

To our knowledge, we are the first to model the pose correction problem of multiple agents in collaborative perception as an object matching and optimization task.
This work marks the first application of SLAM-based object matching in collaborative perception, expanding its scope of application, and investigation into the impact of object matching on multi-agent collaborative perception systems in challenging environments.




§ COLLABORATIVE PERCEPTION AND THE ISSUE OF POSE ERROR



Following the literature of collaborative perception <cit.>, the commonly used model can be described as below.  

It is assumed that there are N agents (i.e., collaborators) in the scene. Let 𝒳_i and 𝒪_i be the raw observation and the perception output of Ego agent i. ℳ_j→ i denotes the collaboration message sent from agent j to agent i.
The goal of collaborative perception is to enhance the 3D object detection capability of the ego agent through cooperation. This process can be formally expressed as:















    F_i   =Φ_Enc( 𝒳_i),   i=1,⋯,N,  
    ℳ_j→ i   =Φ_Proj( ξ_i ,( F_j,ξ_j)  ),   j=1,⋯,N; j≠i
    
     F^'_i   =Φ_Agg( F_i,{ℳ_j→ i}_j=1,2,...,N; j≠i), 
    𝒪_i   =Φ_Dec( F^'_i).


First, for each agent, Step (1a) extracts feature F_i from the raw observation 𝒳_i via an encode network Φ_Enc( ·). After that, each agent j projects, via an projection module Φ_Proj( ·), its feature F_j to the agent i's coordinate system based on ξ_i and ξ_j which represent the poses of the two agents, respectively. The projected feature is then sent to agent i as a message ℳ_j→ i, and this completes Step (1b). After receiving all the (N-1) messages, agent i will fuse its feature F_i with these messages via a fusion network Φ_Agg( ·), producing a fused feature F'_i as in Step (1c). Finally, Step (1d) uses a decode network Φ_Dec( ·) to convert F'_i to the final perception output 𝒪_i. 

As seen above, when the pose of agent i is assumed to be given, the projection in Step (1b) will critically rely on the accuracy of the pose of agent j, ξ_j.  
However, the pose estimated by each agent cannot be perfect in practice and often come with noise, i.e., {ξ_j, j=1,⋯, N} have errors. This kind of error adversely affects the accuracy of the projected feature to be sent via the message ℳ_j→ i. This leads to the misalignment of features when the message is processed by agent i and finally hurts the performance of 3D object detection.


To correct agent poses, existing work <cit.> innovatively uses a clustering based method to determine association among the bounding boxes detected by different agents.  
After finding object associations, the agent poses are adjusted by graph optimization accordingly.   
Nevertheless, when the error of agent pose becomes significant or when objects become close in crowded scenes, such a clustering based matching method will be prone to producing large matching errors. The matching errors will in turn lead to large pose adjusting errors, causing poor collaborative perception. 





§ OUR PROPOSED METHOD


To improve this situation, this paper proposes an unsupervised, iterative object matching and pose adjusting framework, called RoCo. 
It can maintain accurate matching relationships even in scenarios with high pose errors and traffic congestion, thereby enhancing object detection performance. 

Our solution consists of two key ideas. Firstly, finding reliable matching relationship between two objects depends not only on their spatial similarity but also on the similarity of the object configuration in the neighborhood of the two objects.  Secondly, we take an iterative approach to conduct object matching and pose adjustment.  That is, after using the current matching result to adjust the agent poses, object matching will be conducted again upon the updated poses. This process repeats until convergence, that is, the object matching does not change. This approach is able to improve the matching accuracy and in turn lead to better adjustment for the agent poses. 



It is worth noting that the accuracy of object detection from each individual agent also affects the quality of object matching. In this work, we assume that every agent can independently and accurately detect objects within its own range. This allows us to focus on the issue of feature misalignment caused by pose errors.






 §.§ Object Detection

Following the literature, the collaborative perception in this work uses LIDAR to perform 3D object detection. The input point cloud is
in the dimensions of ( n× 4), where n denotes the number of points. Each point has its intensity and the 3D position in a world coordinate system. 
All agents use the same 3D object detector Φ_Enc. 

This work employs a standard uncertainty detection framework designed in the literature <cit.>, which is based on the anchor-based PointPillar backbone <cit.>. Taking point clouds as input, this detection framework outputs features F_i and the estimated bounding boxes for objects. 

In addition, it estimates the uncertainty of each bounding box, which is expressed as the variances of the center position and the heading angle of the corresponding object.


















 §.§ Graph-guided Object  Matching

After performing object detection, agent j will share a message ℳ_j→ i to the ego agent i. This message contains three pieces of information including i) its feature map F_j; ii) the set of bounding boxes of the detect objects ℬ_j, in which each element has the form of ( x,y,z,w,l,h,θ), denoting the 3D centre position, the size in different dimensions, and the yaw angle, respectively, for each bounding box; iii) the pose of agent j denoted by ξ_j=( x_j,y_j,θ_j), representing its centre position and the heading angle on the 2D space. Once the ego agent i receives the messages from all the other agents, it will start performing object matching by processing the messages one by one. Formally, the task can be described as follows: given the information {ℬ_i,ξ_i} and  {ℬ_j,ξ_j}, agent i needs to find the associations among the bounding boxes in ℬ_i and ℬ_j.  


Modeling this task as a bipartite graph matching problem <cit.>, we seek an optimal matching relationship that maximizes the similarity between the objects detected by agents i and j. This can be formulated as

    𝒜^*_ i,j   =𝒜_ i,j max ∑_p∈ℬ_i S( p,𝒜_ij(p)),

where  𝒜_ij denotes a list of one-to-one matching from the elements in ℬ_i to those in ℬ_j.  
𝒜_ij(p) represents the object, denoted by q, found in ℬ_j by querying the matching relationship 𝒜_i,j using an object p in ℬ_i. Let S(p,q) denote the similarity of p and q, where q=𝒜_ij(p). A threshold τ_1 is applied to select the reliable matching, i.e.,  S(p,q) = 0, if S(p,q) < τ_1. Those selected ones will constitute 𝒜^*_i,j, representing the obtained optimal matching relationship.




  §.§.§ Graph construction and Initial Matching.




The proposed object matching method is graph-guided. First, for each object p in ℬ_i, we construct a star graph 𝒢_p. Its central node is p and the spatial neighbors of p form other nodes of this graph, respectively. Each node has a feature vector consisting of the 3DoF pose (x, y, θ) of the object bounding box. In the same way, for each object q in ℬ_j, a star graph 𝒢_q is constructed. They are illustrated in Figure <ref>(a). 



To conduct initial matching, we transform ℬ_j from agent j's coordinate frame into agent i's and establish the initial association using a distance-based method.
For the two graphs 𝒢_p and 𝒢_q, we evaluate the spatial distance between their central nodes p and q, denoted by dis(p, q). When the distance is shorter than a threshold τ_2, 𝒢_p and 𝒢_q will be considered for matching. Note that multiple objects in ℬ_j could have distances to p shorter than τ_2. The one with the minimum distance is chosen to be the initial match as

    𝒜 _ij(p)=p∈ℬ_i,q∈ℬ_jargmin   dis( p,q)  ;  where  dis( p,q)  ≤τ_2







  §.§.§ Graph Structure Similarity.


Logically, if p and q correspond to the same object, then the graphs 𝒢_p and 𝒢_q constructed from the two objects should have high similarity.
Considering this, we design two types of similarity, edge similarity and distance similarity, to jointly measure the closeness of graphs  𝒢_p and 𝒢_q  to assess whether p and q are from the same object.





Edge Similarity.
In graph 𝒢_p, the edge  between the central node p and one of its spatial neighbors m is denoted by e_pm. It  can be associated with a relative pose transformation from p to m, denoted by 𝐓_pm.
𝐓_pm is a 3× 3 matrix obtained through the detection output of the objects p and m.
 In the same way, in graph 𝒢_q, the edges e_qn between node q and its neighbor n can be associated with a relative pose transformation 𝐓_qn.
If p and q correspond to the same object, i.e., if 𝒢_p and 𝒢_q have a high similarity, then the edges in two graphs should be consistent. 
In this case,

𝐓_qn should be consistent with 𝐓_pm.
We define the following criterion to evaluate the edge consistency between e_pm and e_qn:

    l(e_pm, e_qn) = exp(-𝐓_pm (𝐓_qn)^-1 - 𝐈_F)

where  (𝐓_qn)^-1 is the inverse transformation of e_qn , 𝐈 denotes the identity matrix, ·_F represents the Frobenius norm. The overall edge consistency score between 𝒢_p and 𝒢_q can be defined as:

    S_edge(p,q)=1/|N_p|∑_m∈ N_p l(e_pm,e_qn),  s.t.  n=𝒜_ij(m)

where N_p contains the leaf vertices in 𝒢_p that have corresponding vertices in 𝒢_q. Note that the object n is the one found to correspond to object m in the list 𝒜_ij.

Distance Similarity.
In addition to edge similarity, we can also further quantify the closeness of the two graphs by using distance similarity. This is because if the central nodes p and q correspond to the same object, the spatial distance between the detection boxes should be sufficiently close, even in the presence of noise and or in a crowded situation. We define the distance similarity of p and q as:

    S_dis( p,q)  =exp( -dis( p, q))

where dis(·,·) is implemented as a Euclidean distance between the coordinates of the centers of the corresponding bounding boxes. Therefore, the overall graph similarity is obtained by combining the edge consistency and the distance consistency as

    S(p,q)     =     S_edge(q,p) + λ S_dis(p,q)

where λ is  the hyperparameter for balancing.


Finally, we utilize the overall similarity S to  implement the maximization problem in Equation (<ref>) to find the optimal matching.  Essentially, this is a bipartite graph problem, where one graph corresponds to all bounding boxes p detected by agent i, and the other corresponds to all bounding boxes q detected by agent j. The previously defined similarity S(p,q), serves as the edge weight in the bipartite graph. Solving this maximum matching problem can be accomplished using the Kuhn-Munkres algorithm <cit.>.

 


 §.§ Robust Pose Graph Optimization

After performing object matching, the elements in the pair of object detection box sets ℬ_i and ℬ_j will establish one-to-one correspondences. As shown in Figure <ref>(b), we then construct a pose graph 𝒢(𝒱_agent,𝒱_object,ℰ) for all the agents and the detected objects in the whole scene and use this correspondence to adjust their poses. The node set 𝒱_agent comprises all N agents, while the node set 𝒱_object consists of all detected objects, the edge set ℰ represents the detection relationships between agents and objects. 
As mentioned at the beginning of Section 4, there could still be incorrect matching relationships between objects, even after the process proposed in Section 4.2, this will  affect the adjustment of the poses of agents. Therefore, we develop an iterative process as what follows in order to achieve robust object matching and pose adjustment. 

Firstly, after obtaining the object matching relationship 𝒜_ i,j, as in Section 4.2,  we will perform pose adjustment guided by this matching relationship; After this, the elements of ℬ_i and ℬ_j will be updated; We then use the updated ℬ_i and ℬ_j to perform a new round of object matching as in Section 4.2, and then a new round of pose adjustment will be conducted. This iterative matching and adjustment process repeats until the matching result converges, yielding the optimal matching result 𝒜^*_ i,j and the optimized poses ξ_j and χ_k. The process is illustrated in Figure <ref>(a)(b).
We model this task as a graph optimization problem. 
In this pose graph, each node is associated with a pose. The pose of the jth agent is denoted as ξ_j, and the pose of the kth object is denoted as χ_k. Let us assume that after the step in Section 4.2, p and q form a matching pair (𝒜_ij(p)=q) and they are the bounding boxes of the same object. 


Let 𝐓_ip be the measured relative transformation of the pth object from the perspective of the ith agent, which is naturally obtained through the ith agent’s detection output; 𝐓_jq is the measured relative transformation of the qth object from the perspective of the jth agent.
From agent i's observation, 
we have 𝐓_ip=𝐄_i^-1𝐗_p, 
so 𝐗_p =𝐄_i𝐓_ip. 
Note that 𝐄_i is a matrix constructed from ξ_i which denotes the pose of agent i
[
Given the vector ξ=( x,y,θ),
it can be converted into a transformation matrix: 
𝐄=[ cos( θ)    -sin( θ)    x
 sin( θ)      cos( θ)     y
     0           0             1 ], and the conversion between 𝐗 and χ follows the same way. Recall that χ denotes the pose of an object.
]
. Similarly, we can get 𝐗_q =𝐄_j𝐓_jq. In the optimization process, the variables to optimize in this scenario are {ξ_j, χ_k}. The matched objects are hoped to converge to a consistent result χ_p=χ_q=χ_k. 
An example is given in Figure <ref> to show how the residue errors are set up.  We can set up the residue error functions: 

    e_ik=(𝐄_i𝐓_ip)^-1𝐗_k = 𝐓_ip^-1𝐄_i^-1𝐗_k
        e_jk=(𝐄_j𝐓_jq)^-1𝐗_k = 𝐓_jq^-1𝐄_j^-1𝐗_k
        e_ji= 𝐓_ji^-1𝐄_j^-1𝐄_i


The overall optimization objective can be given as:

    {ξ'_j ,χ'_k }  ={ξ_j ,χ_k}min∑_( j,k)  ( e_ik^TΩ_ike_ik+e_jk^TΩ_jke_ik+e_ij^TΩ_ije_ij)

 
Where Ω = diag(σ^-2_x, σ^-2_y, σ^-2_θ) ∈ℝ^3× 3 is the information matrix and its diagonal elements come from the uncertainty estimates of the bounding box, which are part of the detection output from agent j. By solving (<ref>) using Levenberg-Marquardt algorithm <cit.>, we get {ξ_j', j=1:N}, {χ_k', k=1:K}.  Then we re-do the object matching result: 

    𝒜_ij^'=Φ_Match( {ℬ^_i,ξ_i}  ,{ℬ^_j,ξ^'_j})

In the iterative matching (<ref>) and pose optimization (<ref>) process, 
we update the position of ℬ^_j using ξ^'_j.
Our goal is to gradually improve object matching results by minimizing the overall graph optimization error. 
During the iterative matching process, we fix the poses of self-agent and update the poses of other agents and the objects. 





 §.§ Aggregation and Detection

After the pose calibration, the corrected relative pose from agent j to agent i is denoted as ξ^'_j→ i =ξ^-1_i∘ξ^'_j. 
With the corrected relative pose ξ^'_j→ i, 
we can adjust the contents of ℳ_j→ i, feature 𝐅_j from agent j are synchronized to the ego pose which has the same coordinate system with its ego feature 𝐅_i.
After the spatial alignment, each agent aggregates Φ_Agg( ·) other agents’ collaboration information and obtain a more informative feature.
This aggregating function can be any common fusion operation. All our experiments adopt Multi-scale feature fusion.
After receiving the final fused feature maps, we decode them into the final detection layer Φ_Dec( ·) to obtain final detections 𝒪_i. 
The regression output is ( x,y,z,w,l,h,θ), denoting the position, size, yaw angle of the anchor boxes, respectively.
The classification output is the confidence score of being an vehicle or background for each anchor box.


























































§ EXPERIMENTAL RESULT

We conduct extensive experiments on both simulated and real-world scenarios. The task is point-cloud-based 3D object detection. Following the literature, the detection results are evaluated by Average Precision (AP) at Intersection-over-Union (IoU) threshold of 0.50 and 0.70. 




 §.§ Dataset


DAIR-V2X <cit.>. DAIR-V2X is a public real-world collaborative perception dataset. It contains two agents: vehicle and road-side-unit (RSU) with image resolution 1080× 1920. The perception range is x∈[ -100m,100m], y∈[ -40m,40m]. 
RSU LiDAR is 300-channel while the vehicle’s is 40-channel.
V2XSet <cit.>. V2XSet is a large-scale dataset designed for Vehicle-to-Infrastructure (V2X) communication. The data in V2XSet is collected using the simulator CARLA <cit.> and OpenCDA <cit.>. It includes LiDAR data captured from multiple autonomous vehicles and roadside infrastructure in various scenarios. The dataset consists of a total of 11,447 frames, with train, validation, test splits of 6,694/1,920/2,833 frames, respectively. 




 §.§ Implementation Details

For encoder backbone, we use PointPillar <cit.> with the voxel resolution to 0.4m for both height and width.
To simulate pose errors, we follow the noisy settings  in CoAlign <cit.> during the training process.  We add Gaussian noise N( 0,σ^2_t) on x,y and N( 0,σ^2_r) on θ, where x,y,θ are the coordinates of the 2D centers of a vechicle and the yaw angle of accurate global poses. 

We use the bounding boxes output by the detection framework in reference<cit.> for each individual agent.
In the bipartite graph matching, we set λ =1 for Eq.(<ref>) and similarity threshold τ_1=0.5 for Eq.(<ref>). 
In the pose graph optimization, the Levenberg-Marquardt algorithm<cit.> is employed to solve the least squares optimization problem, with the maximum number of iterations set to 1000.
To better contrast the performance of RoCo, we retrained other methods.
We use the Adam <cit.> with an initial learning rate 0.001 for detection and 0.002 for feature fusion.
The batchsizes we set for the DAIR-V2X and V2XSet datasets are 4 and 2, respectively. All models are trained on six NVIDIA RTX 2080Ti GPUs with epoch number 30. 



















 §.§ Quantitative evaluation

To validate the overall performance of RoCo in 3D object detection, 
we compare it with a series of previous methods on two datasets. 
For a fair comparison, all models take 3D point clouds as input data, RoCo is compared with seven state-of-the-art methods: F-Cooper <cit.>, FPV-RCNN<cit.>, V2VNet <cit.>, V2X-ViT<cit.>,  Self-ATT, CoAlign <cit.> and CoBEVFlow<cit.>.
Table <ref> shows  the AP at IoU threshold of 0.5 and 0.7 in DAIR-V2X and V2XSet dataset. 

We reference the results from the literatures <cit.> in the DAIR-V2X and implement them in the V2XSet, and we also implement noise level of σ^2_t /σ^2_r =0.8m/0.8^∘ on both datasets.

We see that RoCo significantly outperforms the previous methods at various noise levels across both datasets.
In the real-world dataset DAIR-V2X, RoCo outperforms CoAlign across all noise settings. In the case of noise levels of 0.0m/0.0^∘, our approach achieves 1.7% (76.3% vs. 74.6%) and 1.6% (62.0% vs. 60.4%)  improvement over CoAlign for AP@0.5/0.7.

When the noise level becomes as high as 0.6m/0.6^∘, our approach achieves 1.9% (71.9% vs. 70.20%) and 1.2% (58.2% vs. 57.0%) improvement over CoAlign  for AP@0.5/0.7.
In the case of noise levels of 0.8/0.8, our approach still achieves 2.3% (71.5% vs. 69.2%) and 0.9% (57.6% vs. 56.9%) improvement over CoAlign  for AP@0.5/0.7.
We conduct experiments on a simulated dataset V2XSet which involves more agents. RoCo still performs well across all noise settings, as shown in Table <ref>.

As the level of noise increases, both methods experience performance degradation. However, our method maintains a higher level of accuracy even under high-level of noise.
In the case of noise level of 0.4m/0.4^∘, our approach achieves 1.9% (90.0% vs. 88.1%) and 4.3% (77.3% vs. 73.0%) improvement over CoAlign  for AP@0.5/0.7.
When the noise level reaches 0.8m/0.8^∘, our approach still achieves 1.4% (84.1% vs. 82.7%) and 1.6% (68.9% vs. 67.3%) improvement over CoAlign  for AP@0.5/0.7.  



































 §.§ Qualitative evaluation


 


Figure <ref> and Figure <ref> show the 3D detection results in the BEV format on the V2XSet. 
Red and green boxes denote the detection results and the ground-truth, respectively.
The degree of overlapping of these boxes reflects the performance of the testing methods.

Figure <ref> depicts the detection results of V2X-ViT, V2VNet, CoAlign, and the proposed RoCo at an intersection to validate the effectiveness of our method. We set the noise level of 0.4m/0.4^∘ and 0.8m/0.8^∘ to produce high pose errors to make the perception task challenging. From the figure, it can be observed that V2VNet has many missed detections, while V2X-ViT and CoAlign generate many predictions with relatively large offsets. In contrast, our RoCo demonstrates strong performance high pose errors.
Figure <ref> visualize the  box position with and without graph matching in crowded scenes.
Without the proposed graph matching, show in  figure <ref>(a),  there are many false detections.
In comparison, each detection box in Figure <ref>(b) corresponds to a unique object, exhibiting more robust performance. In crowded environments, objects are relatively close and with high pose errors, the detected bounding boxes may overlap. RoCo utilizes graph-based object matching to correctly associate objects detected by different agents, ensuring that each object has only one correct detection box.





 



 §.§ Ablation Studies

Selection of the threshold value τ_2.
The selection of the initial candidate set in graph matching is crucial. To determine the optimal threshold τ_2 in Eq.(<ref>) during the graph initialization, we conduct ablation experiments on different datasets, as shown in Table <ref>. In the DAIR-V2X dataset, we found that the detection results reach their optimum when τ_2 is set to 3.
As the value of τ_2 increases, the detection performance will  decline. This is because vehicles usually maintain a safe distance from other vehicles in real-world scenarios, and too small a threshold would affect the initial matching.
Furthermore, we conducted the same experiments on the simulated dataset. We observed that when the noise level is below 0.8m/0.8^∘, the optimal threshold τ_2 becomes 2 meters. As the noise level increases to 0.8m/0.8^∘, the optimal threshold becomes τ_2 = 3. This is because in the V2XSet dataset, there are more vehicles and they are densely distributed. As a result, the distances between vehicles are smaller compared to real-world scenarios. 




Contribution of Object Matching and Robust Graph Optimization.
Table <ref> assesses the effectiveness of the proposed module at various noise levels, including object matching and robust graph optimization. 
We evaluate the impact of each module on the final 3D detection by incrementally adding i) object matching and ii) robust graph optimization. We see that both modules can improve the performance.
To validate the impact of object matching on pose error, Figure <ref> plots the distribution of relative pose errors across all samples. The horizontal axes "trans error" and "rot error" denote the translational and rotational relative pose errors (RPE), respectively. The vertical axis represents the density value of the distribution. The orange dashed line represents the density when applying the proposed object matching method, while the blue line represents case without the object matching. The closer the distribution is to the Delta distribution centered at zero, the better the performance because this means most of the pose errors have smaller values. It can be observed from figure that using object matching leads to the desired distribution and significantly reduces relative pose errors.

Contribution of graph similarity. 
Now we investigate the contributions of different similarities defined in Eq.(<ref>) and (<ref>) to object matching on DARI-V2X, the result is shown in Table <ref>. We evaluate the impact of each similarity score on the final graph matching by incrementally adding i) edge similarity and ii) distance similarity. The first row in Table <ref> represents the baseline model which does not use any matching methods. The experimental results indicate that both designs of similarity matching contribute to improving detection accuracy, especially at the noise level of 0.8m/0.8^∘. 





























§ CONCLUSION


This paper proposes a novel robust collaborative perception framework, RoCo, for 3D object detection. This framework addresses issues such as object mismatch and misalignment caused by pose errors among multiple agents. It enhances the precision and reliability of this modality and  better prepare it  for the potential multimodal fusion step in the sequel.
The core idea of RoCo is based on graph-based object matching, which reliably associates common objects detected by different agents and reduces pose errors of agents and objects using iterative robust optimization. Additionally, RoCo does not require any ground truth pose supervision during training, making it highly practical. Comprehensive experiments demonstrate that RoCo achieves outstanding performance across all settings and exhibits superior robustness under extreme noise conditions. We believe that this work has the potential to contribute to the development of the multimodal field. In future work, we will apply our method to multimodal collaborative perception to further improve the safety and reliability of autonomous driving.










This work was supported by the China Scholarship Council (CSC); 

Dr. Li is supported in part by the National Natural Science Foundation of China Grant No. 12071478. Dr. Wang is supported in part by the National Natural Science Foundation of China Grant No. 61972404, Public Computing Cloud, Renmin University of China, and the Blockchain Lab, School of Information, Renmin University of China.





ACM-Reference-Format







































 Paper Title: SmileyNet -- Towards the Prediction of the Lottery by Reading Tea Leaves with AI.




.jpg,.pdf,.mps,.png

The Bulk Densities of Small Solar System Bodies as a Probe of Planetesimal Formation
    [
    August 5, 2024
====================================================================================



§ ABSTRACT 
We introduce SmileyNet, a novel neural network with psychic abilities. It is inspired by the fact that a positive mood can lead to improved cognitive capabilities including classification tasks. The network is hence presented in a first phase with smileys and an encouraging loss function is defined to bias it into a good mood. SmileyNet is then used to forecast the flipping of a coin based on an established method of Tasseology, namely by reading tea leaves. Training and testing in this second phase are done with a high-fidelity simulation based on real-world pixels sampled from a professional tea-reading cup. SmileyNet has an amazing accuracy of 72% to correctly predict the flip of a coin. Resnet-34, respectively YOLOv5 achieve only 49%, respectively 53%. It is then shown how multiple SmileyNets can be combined to win the lottery.     






§ INTRODUCTION

Modern AI is one of the greatest if not the greatest scientific breakthrough of all times. The publication of the structure of DNA by Watson and Crick in Nature <cit.> has only achieved slightly more than 19,000 citations by summer 2024 according to GoogleScholar. And it has taken 71 years. AI <cit.> has led to many important papers, which received many more citations within a much shorter time-frame; see, e.g., Tab. <ref> for a few examples based on citations according to GoogleScholar.



Given the relevance of AI for our modern world, it is surprising that there are areas of high economic relevance where it has not been applied, yet. We explore here - up to our knowledge for the very first time - the potential of AI for the psychic services industry, which is a multi-billion dollar business. This industry is estimated to have reached a revenue of well above $2 billion in the USA in 2023. And it experiences a steady further growth. This holds especially for psychic online services that managed an exponential growth in recent years according to market-reports.       

We suspect that AI may already be used in some real-world psychic services, especially in the online branches. But the methods and the results are not academically published up to our knowledge - likely due to the large economic potential they possess. While this is somewhat understandable, we believe in Open Science <cit.> and we share our insights due to the large benefits Psychic AI can provide to humanity.

A first medium-term goal is to win the lottery to further fund research in the novel field of Psychic AI. A well-established method of Tasseology (also known as Tasseomancy or Tasseography) <cit.> is used to this end, namely reading tea leaves <cit.>. In the spirit of divide and conquer, the simpler problem of predicting the outcome of flipping a coin is tackled first. We then show how this can be used to predict the numbers for winning the lottery jackpot. 

As an important basic research result, it is proven in this paper, up to our knowledge for the very first time, that a neural network can possess psychic powers. Concretely, it is shown that the novel SmileyNet can predict the flipping of a coin with a precision well above chance. 




     


§ SMILEYNET


SmileyNet is a novel bio-inspired network. It is motivated by the fact that cognitive processes can be positively influenced by a positive mood 
<cit.>.
This includes especially also classification tasks <cit.>. 



Furthermore, it is well-known that visual stimuli are well suited to elicit emotions <cit.>. This includes in particular a smiling face <cit.>. We hence first present the network with smileys as input to bias it into a good mood. More precisely, the Unicode emoticon "U+1F642" for the classical smiley, officially known as "Slightly Smiling Face" is used to this end (Fig.<ref>).

But stress is a negative factor for cognition <cit.>. We do not want to loose the positive effects of the good mood by putting the network under stress in the smiley training phase. Hence, it gets positive feedback <cit.> that it is doing fine, i.e., that it is doing nothing wrong.

More precisely, the training in the smileyfication phase is done as follows. A quadratic loss function L_smile() is used. To avoid putting the network under stress and to give a further positive endorsement, the expected output ŷ is set to be the actual output y whenever a smiley is presented to the net, i.e., ŷ = f_I(y) where f_I() is the identity function. So,


    L_smile()= 1/2 (y - ŷ)^2  with ŷ = f_I(y)


This method of smileyfication can be applied to any network N_old to turn it into a novel one N_new, which is expected to perform better than the previous N_old. 

Often, there may only be small improvements and it can happen that multiple trials are needed until some improvement is seen for the first time, which should then be immediately documented. Also, it can be useful to take additional factors into account. For example, the effects of smileyfication may only be seen on a sunny day as, e.g., the weather has an influence on the mood <cit.>.  



§ RELATED WORK


YOLOv5 <cit.> and Resnet34 <cit.> are well-known networks for image classification. They are used for comparison to SmileyNet in Sec. <ref>. There are also many other networks. But as YOLOv5 and Resnet32 are very popular, we concentrate here on those two. 





YOLOv5 is the fifth iteration of the revolutionary "You Only Look Once" object detection model. It is designed to deliver high-speed, high-accuracy results in real-time. Built on PyTorch, this powerful deep learning framework has garnered immense popularity for its versatility, ease of use, and high performance. Fig. <ref> shows how it works.


ResNet-34 is a convolutional neural network in PyTorch. It is has 34 layers. It addresses the problem of vanishing gradient. This is done with the identity shortcut connection that skips one or more layers. 
Fig. <ref> shows how it works.




§ HIGH-FIDELITY SIMULATION


The constellation of tea leaves and the predicted event are linked by cosmic energy. We use this fact to generate high-fidelity training data. This is not easy in the context of psychic powers and it may be one reason why AI has not been used - up to our knowledge - in this economically highly relevant business up to now.

The core idea of our approach for training data is to use the reverse direction of the link. The coin is flipped in a deterministic way, i.e., it is so to say turned by hand in rounds r from one side to the other. The related constellation of tea-leaves, i.e., the image I_r is then generated afterwards. 

In the software implementation, "heads" is presented with a "1" and "tails" with a "0" for the sake of convenience and wlog. Also wlog, we start with "tails" facing up as initialization of the flipping process. In the very first round r=1, the coin is turned and it hence shows "heads". The coin is then turned again and it now shows "tails" in round r=2, and so on. More formally, it holds for the outcome o_flip(r) in round r that


    o_flip(r) = 
    heads    if  (r+1)  mod  2 = 0
    tails    otherwise



The images I_r in our high-fidelity simulation are based on a real-world image (Fig. <ref>)[wikimedia.org; curid=17659832; user: MochaSwirl; Public Domain] of tea-leaves in a cup used by a fortune-telling professional. From this professional image, real-world pixels p_tea belonging to tea and real-world pixels p_cup belonging to the cup are extracted. This forms the base image I_0 with 100 × 100 pixels (Fig. <ref>). For the sake of simplicity, p_tea-pixels are shown in black and white is used for p_cup-pixels . 




The first image I_1 is then generated right after the coin was flipped for the first time. So, I_1 is linked to producing "head" according to the laws of Tasseology. In general, each image I_r is generated from I_r-1 by randomly selecting k_change coordinates [x,y]_j : x,y ∈{0,...,99} that are altered as follows 


    I_r[x][y] = 
    
        p_tea   if  I_r-1[x][y] = p_cup
    
        p_cup   if  I_r-1[x][y] = p_tea











Each I_r is generated right after doing the flip of the coin in round r, i.e., it is linked to the outcome o_flip(r) of flipping the coin in that round. According to our experience, small to medium values for k_change work best. The process is illustrated in Fig. <ref>. As mentioned, the p_cup, respectively p_tea pixel are shown as white, respectively black pixel in Fig. <ref> for the sake of simplicity. 



§ EXPERIMENTS AND RESULTS

  
The high-fidelity simulation presented in Sec. <ref> is used to generate 500 images. When it is needed by the network, the images are scaled to fit the requirements of PyTorch. The set is split into the first 300 images that are used for training and the following 200 images are used for validation. 


 


Tab. <ref> shows the results for YOLOv5 and Resnet-34. Resnet-34 has only 98 out of 200 cases correctly predicted. YOLOv5 does a bit better and it manages 106 correct predictions on the testing set.

Due to the better performance of YOLOv5 compared to Resnet-34, it is used for a smileyfication to generate SmileyNet version 1. As SmileyNet is expected to have an improved performance, it is trained with less data. Only every fifth image from the data-set is used. Note that this is still an alternating sequence of "heads" and "tails", i.e., it is exactly the same principle as before, but just 100 training images. The remaining 400 images are used for testing.

SmileyNet manages an amazing accuracy of 71.75%, i.e., 287 out of 400 cases are correctly predicted. This is well above the performance of YOLOv5 and Resnet-34 (Tab. <ref>). Most importantly, it is well above chance and we therefore prove - up to our knowledge - for the very first time that AI can possess psychic powers. Note that it can be shown that the improvement is statistically significant, i.e., it is a thorough and sound result.       

Tab. <ref> summarizes the performance gains compared to YOLOv5 and Resnet-34. SmileyNet has an accuracy of 71.75%, i.e., there is an increase by 35.38% from the 53% of YOLOv5. The performance gain is in the comparison with Resnet-34 with 46.43% even higher. SmileyNet requires only 100 training images while YOLOv5 and Resnet-34 had 300 images. So, there is a reduction by 200 images or 66% in comparison to the other two nets. 



§ SMILEYNET FOR LOTTERY FORECASTS



The forecasting of throwing a coin can already be a useful psychic power. But the forecast of lotteries has a very straightforward economical potential. Lotteries exist in most countries around the globe with high jackpots for the correctly predicted numbers. It is shown in the following with the example of the German lottery how SmileyNet can be used to this end.

In the German lottery, six numbers win_1,...,win_6 are drawn out of a pool with the numbers 1,...,49. The psychic power of SmileyNet can forecast the flip of a coin, i.e., 1 bit. We therefore simply combine multiple SmileyNets to encode the numbers 1,...,49. Then, one after the other win_i is predicted. 

More precisely, let b_j denote the forecasting output of SmileyNet N_j and ⟨ b_1,...,b_n ⟩_2 denotes the number x encoded by the bits b_1,...,b_n, i.e.,

    x = ⟨ b_1,...,b_n ⟩_2 = ∑_i=1^nb_i · 2^n-i


The i-th number win_i of a lottery draw is then predicted with ten SmileyNets N_j with outputs b_j as follows 

    win_i = ⟨ b_1,...,b_5 ⟩_2 + ⟨ b_6,...,b_9 ⟩_2 + ⟨ b_10⟩_2


As mentioned, the winning numbers win_1,...,win_6 are simply generated one after the other. It must of course be ensured that fresh images of tea-leaves from a just emptied cup are provided in every round. Nonetheless, SmileyNet does not have perfect psychic power. It may hence happen in rare occasions that a number win_j+k has been predicted before as win_j. But this is not a problem. Then, the current win_j+k is simply discarded and an other round is added to determine a new win_j+k.

Given the predictive power of SmileyNet to correctly forecast a bit with p_ N=0.7175, the exact likelihood p_win of forecasting the German lottery with the above method can be computed as

    p_win   = p_ N^5 ·p_ N^4 · p_ N
       = 0.03615922 
       = 3.615922 · 10^-2
        
This likelihood may look small at first glance, but it is by six orders of magnitude better than just chance with

    p_chance   = 49  6^-1
       = (49!/6!(49-6)!)^-1
       = 1/13,983,816
       = 7.15112 · 10^-8
       ≪ p_win
        

This is an important result that demonstrates the huge potential of the novel field of Psychic AI. Note that it is a thorough result as it can be shown that it is statistically significant.

But before we apply these results in practice, we still want to improve the performance of our approach. This holds first and foremost for the likelihood p_win of predicting the correct numbers for winning the jackpot:

	
  * One option is simply more training data and more computation power for a larger network to turn SmileyNet into a foundation model for psychic AI. 

  * Furthermore, we expect a transformer to be more accurate given that the drawing of lottery numbers is a weekly event in Germany. This is left for future work.

Also, a reduction of the required number of SmileyNets would be nice before applying it in practice as it is a bit inconvenient to drink so much tea. 



§ CONCLUSIONS


SmileyNet version 1 was introduced. It is based on smileyfication, i.e., the fact that a positive mood can have a positive influence on cognitive functions including classification. It was shown how SmileyNet can be used to predict the lottery by reading tea-leaves. First, the flipping of a coin was predicted with a very good accuracy, namely 72%. State of the art networks like YOLOv5 and Resnet-34 perform much worse. Second, it was shown how multiple SmileyNets can be combined for lottery forecasts. In addition to the potential practical implications, it is a major breakthrough to show that AI can have psychic powers.  



§ ACKNOWLEDGMENTS

We thank our anonymous reviewers for their feedback. Special thanks go to reviewer 2, who pointed out that the drawing of lottery numbers tends to be a weekly or at least regular event, and that the use of a transformer should be beneficial. 




§ EPILOG

This is a satirical accumulation of misconceptions, mistakes, and flawed reasoning I have encountered in recent times as a reviewer and sometimes even as a reader of published papers. I hope it is entertaining and useful in the context of the education of BSc, MSc, and PhD students in Machine Learning, Artificial Intelligence, and Cognitive Science. 

For an easy start, here a few questions to reflect upon. First and foremost, there is of course the following puzzle: 

	
  * Where does the "magic" hide that is presented here? How can SmileyNet "predict" the flip of a coin better than chance? 

As a small hint: there is a single conceptual mistake that explains it. 

There are also many other bugs, respectively misconceptions and flawed reasoning in this paper. Here some further food for thought, to hopefully teach a good lesson by setting a bad example:   

	
  * Can AI beat natural laws? What are the pros and cons of a detailed pre-analysis of the possible information content of the data?
	
  * How much academic novelty is in SmileyNet? How much does it differ from the net it is build upon? 
	
  * How do we prevent smileyfication in our own work? How can we properly show that an "extension" or "modification" of an existing approach leads to a substantial improvement and study the related trade-offs?  
	
  * What is a proper assessment of the state of the art? How do we find, understand, and discuss related work?
	
  * What is a proper statistical performance analysis? What is statistical significance and how should it be interpreted?
	
  * When and how do I expect my own work to be of relevance? Why do I publish it? 
	
  * What are Artificial Intelligence and Machine Learning? Which sub-areas within these disciplines exist? What are commonly used methodologies within the sub-areas? 
		
  * What is the role of training data in supervised machine learning? What are the pros and cons of simulation?
	
  * What is Open Science? What are its principles? What does it imply for the quality of the underlying work? What are the pros and cons if others, respectively oneself adheres to it? 
	
  * What is a bio-inspired design? How can insights from Cognitive Science be used and which pitfalls exist?
	
  * What are the pros and cons of bibliometrics? How can they help us to identify relevant work? And where are their constraints and limitations?

This list is a bit concentrated on the "big questions". It is of course also possible to just concentrate on the (many) methodological mistakes in the SmileyNet paper. So, the above list is neither meant to be exhaustive nor to be without dispensable aspects depending on the context. It is just a possible starting point for using the SmileyNet in the class-room, or to just meditate about it on your own, or... 

Enjoy and have fun...

10

url@samestyle








WatsonCrick-DNA-Nature1953
J. D. Watson and F. H. C. Crick, “Molecular structure of nucleic acids: A
  structure for deoxyribose nucleic acid,” Nature, vol. 171, no. 4356,
  pp. 737–738, 1953. [Online]. Available:
  <https://doi.org/10.1038/171737a0>


DeepLearning-Hinton-Nature15
Y. LeCun, Y. Bengio, and G. Hinton, “Deep learning,” Nature, vol. 521,
  no. 7553, pp. 436–444, 2015. [Online]. Available:
  <https://doi.org/10.1038/nature14539>


DeepLearning-Book-MITpress16
I. Goodfellow, Y. Bengio, and A. Courville, Deep learning.1em
  plus 0.5em minus 0.4emMIT press, 2016.

DeepLearning-ResNet-CVPR16
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image
  recognition,” in IEEE Conference on Computer Vision and Pattern
  Recognition (CVPR), 2016, Conference Proceedings, pp. 770–778.

Adam-StochasticOptimization-arXiv2014
J. B. Diederik P Kingma, “Adam: A method for stochastic optimization,”
  arXiv preprint, vol. arXiv:1412.6980, 2014.

DeepLearning-AlexNet-NIPS12
A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with
  deep convolutional neural networks,” pp. 1106–1114, 2012. [Online].
  Available:
  <http://papers.nips.cc/paper/4824-imagenet-classification-with-deep-convolutional-neural-networks>


Breimann-RandomForests-ML01
L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp.
  5–32, 2001. [Online]. Available:
  <https://doi.org/10.1023/A:1010933404324>


DeepCNN-LargeScale-ImageRecognition-2014
K. Simonyan and A. Zisserman, “Very deep convolutional networks for
  large-scale image recognition,” arXiv preprint, vol. arXiv:1409.1556,
  2014.

GAN-NIPS2014
I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair,
  A. Courville, and Y. Bengio, “Generative adversarial nets,” 2014. [Online].
  Available:
  <https://proceedings.neurips.cc/paper_files/paper/2014/file/5ca3e9b122f61f8f06494c97b1afccf3-Paper.pdf>


FasterR-CNN-NIPS2015
S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time
  object detection with region proposal networks,” 2015. [Online]. Available:
  <https://proceedings.neurips.cc/paper_files/paper/2015/file/14bfa6bb14875e45bba028a21ed38046-Paper.pdf>


ImageNet-CVPR09
J. Deng, W. Dong, R. Socher, L. J. Li, L. Kai, and F.-F. Li, “Imagenet: A
  large-scale hierarchical image database,” in IEEE Conference on
  Computer Vision and Pattern Recognition (CVPR), 2009, Conference
  Proceedings, pp. 248–255.

DeepLearning-GoogLeNet-CVPR15
C. Szegedy, L. Wei, J. Yangqing, P. Sermanet, S. Reed, D. Anguelov, D. Erhan,
  V. Vanhoucke, and A. Rabinovich, “Going deeper with convolutions,” in
  IEEE Conference on Computer Vision and Pattern Recognition (CVPR),
  2015, Conference Proceedings, pp. 1–9.

UNESCO-RecommendationOpenScience2021
UNESCO, “Unesco recommendation on open science,” 2021. [Online]. Available:
  <https://doi.org/10.54677/MNMH8546>


Tasseology-2008
R. E. Guiley, “Tasseomancy,” in The Encyclopedia of Witches, Witchcraft
  and Wicca.1em plus 0.5em minus 0.4emCheckmark Books, 2008.

Tasseology-TeaLeaves-2016
K. Henriott-Jauw, Tea and Tasseomancy: A Guide to Reading Tea
  Leaves.1em plus 0.5em minus 0.4emCreateSpace Independent
  Publishing Platform, 2016.

Tasseology-TeaLeaves-2014
A. O'Reilly, Tea with Annie, a divinitive guide to Tasseomancy and its
  artistry.1em plus 0.5em minus 0.4emMelbourne, Australia:
  Whiteslaw Press, 2014.

PositiveMood-CreativeProblemSolving-Sage2015
J. Politis and J. C. Houtz, “Effects of positive mood on generative and
  evaluative thinking in creative problem solving,” Sage Open, vol. 5,
  no. 2, p. 2158244015592679, 2015. [Online]. Available:
  <https://journals.sagepub.com/doi/abs/10.1177/2158244015592679>


PositiveMood-CognitiveControl-2011
E. A. Martin and J. G. Kerns, “The influence of positive mood on different
  aspects of cognitive control,” Cognition and Emotion, vol. 25, no. 2,
  pp. 265–279, 2011. [Online]. Available:
  <https://doi.org/10.1080/02699931.2010.491652>


PositiveMood-Cognition-Classification-2010
R. T. Nadler, R. Rabi, and J. P. Minda, “Better mood and better
  performance:learning rule-described categories is enhanced by positive
  mood,” Psychological Science, vol. 21, no. 12, pp. 1770–1776, 2010.
  [Online]. Available:
  <https://journals.sagepub.com/doi/abs/10.1177/0956797610387441>


ImagesMoodSurvey2016
M. K. Uhrig, N. Trautmann, U. Baumgärtner, R.-D. Treede, F. Henrich,
  W. Hiller, and S. Marschall, “Emotion elicitation: A comparison of pictures
  and films,” Frontiers in Psychology, vol. 7, 2016. [Online].
  Available:
  <https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2016.00180>


ImagesMoodSurvey2008
J. K. Olofsson, S. Nordin, H. Sequeira, and J. Polich, “Affective picture
  processing: An integrative review of erp findings,” Biological
  Psychology, vol. 77, no. 3, pp. 247–265, 2008. [Online]. Available:
  <https://www.sciencedirect.com/science/article/pii/S0301051107001913>


MoodSmilingFace2019
J. Nikitin and A. M. Freund, “The motivational power of the happy face,”
  Brain Sciences, vol. 9, no. 1, p. 6, 2019. [Online]. Available:
  <https://www.mdpi.com/2076-3425/9/1/6>


CognitionStressNegative2024
G. Picciotto and R. A. Fabio, “Does stress induction affect cognitive
  performance or avoidance of cognitive effort?” Stress and Health,
  vol. 40, no. 1, p. e3280, 2024. [Online]. Available:
  <https://onlinelibrary.wiley.com/doi/abs/10.1002/smi.3280>


CognitionStressNegative2023
E. J. Kim and J. J. Kim, “Neurocognitive effects of stress: a metaparadigm
  perspective,” Molecular Psychiatry, vol. 28, no. 7, pp. 2750–2763,
  2023. [Online]. Available: <https://doi.org/10.1038/s41380-023-01986-4>


StressCognitionFeedback2020
M. Paul, C. Bellebaum, M. Ghio, B. Suchan, and O. T. Wolf, “Stress effects on
  learning and feedback-related neural activity depend on feedback delay,”
  Psychophysiology, vol. 57, no. 2, p. e13471, 2020. [Online].
  Available: <https://onlinelibrary.wiley.com/doi/abs/10.1111/psyp.13471>


MoodWeather2008
J. J. A. Denissen, L. Butalid, L. Penke, and M. A. G. van Aken, “The effects
  of weather on daily mood: A multilevel approach,” Emotion, vol. 8,
  no. 5, pp. 662–667, 2008.

MoodWeather1984
E. Howarth and M. S. Hoffman, “A multidimensional approach to the relationship
  between mood and weather,” British Journal of Psychology, vol. 75,
  no. 1, pp. 15–23, 1984. [Online]. Available:
  <https://bpspsychub.onlinelibrary.wiley.com/doi/abs/10.1111/j.2044-8295.1984.tb02785.x>


YOLOv5-2021
Ultralytics, “YOLOv5: A state-of-the-art real-time object detection
  system,” 2021. [Online]. Available: <https://docs.ultralytics.com>


YOLOv5-architecture-2021
——, “Ultralytics YOLOv5 architecture,” 2021. [Online]. Available:
  <https://docs.ultralytics.com/yolov5/tutorials/architecture_description/>






 Paper Title: Intermittent Semi-working Mask: A New Masking Paradigm for LLMs.




MUFASA: Multi-View Fusion and Adaptation Network with Spatial Awareness for Radar Object Detection
    Xiangyuan Peng1,2 Miao Tang3 Huawei Sun1,2Kay Bierzynski2Lorenzo Servadei1 Robert Wille1

    August 5, 2024
==================================================================================================




§ ABSTRACT 
  
  
  
  
  
  
  Multi-turn dialogues are a key interaction method between humans and Large Language Models (LLMs), as conversations extend over multiple rounds, keeping LLMs' high generation quality and low latency is a challenge. Mainstream LLMs can be grouped into two categories based on masking strategy: causal LLM and prefix LLM. Several works have demonstrated that prefix LLMs tend to outperform causal ones in scenarios that heavily depend on historical context such as multi-turn dialogues or in-context learning, thanks to their bidirectional attention on prefix sequences. However, prefix LLMs have an inherent inefficient training problem in multi-turn dialogue datasets. In addition, the attention mechanism of prefix LLM makes it unable to reuse Key-Value Cache (KV Cache) across dialogue rounds to reduce generation latency. In this paper, we propose a novel masking scheme called Intermittent Semi-working Mask (ISM) to address these problems. Specifically, we apply alternate bidirectional and unidirectional attention on queries and answers in the dialogue history. In this way, ISM is able to maintain the high quality of prefix LLM and low generation latency of causal LLM, simultaneously. Extensive experiments illustrate that our ISM achieves significant performance.

  




§ INTRODUCTION



Recent developments in Large Language Models (LLMs) such as GPT-3.5 <cit.> and GPT-4 <cit.> have attracted significant attention. Due to the powerful generation capability, LLMs have made remarkable achievements in different kinds of Natural Language Process (NLP) tasks through a unified generative paradigm. Specifically, the most natural and common way to interact with LLMs is through multi-turn dialogues. However, as the number of dialogue rounds increases, ensuring high quality and low latency of the generated answer by LLMs is a challenge.

Existing language models can be grouped into three categories according to framework architecture: Encoder-Decoder <cit.>, Encoder-Only <cit.>, and Decoder-Only <cit.>. Nowadays, most LLMs belong to decoder-only architecture, in this paper, our discourse is delimited to decoder-only architecture. In addition, based on the masking methods in various attention mechanisms, decoder-only category further includes causal decoders <cit.> and prefix decoders <cit.>. The former employs unidirectional attention masking to restrict each token can only attend to preceding tokens and itself. Both the input and generated tokens are processed in a uniform manner within the decoder. The latter applies bidirectional attention on prefix tokens and maintains unidirectional attention on generated tokens, it allows bidirectional encoding of prefix sequences.


Empirical studies <cit.> have revealed that restricting auto-regressive masks on the entire sequence is overly restrictive when LLM generates answers based on the given contexts. Other work <cit.> further proves that prefix LLM may be a better choice theoretically. 
However, the bidirectional attention in prefix LLM is a double-edged sword. In the bidirectional attention mechanism, each token of the prefix sequences can attend to all the tokens in the whole sequences. 
It means that the KV cache of the previous dialogue rounds cannot be reused when the prefix LLM generates the current response.

When facing multi-turn dialogues, especially when the dialogue round reaches a large number such as 10 or more, prefix LLM will suffer from high generation latency.
In addition, due to the bidirectional attention in prefix sequences, it's necessary to manually expand a multi-turn dialogue sample into several single-turn dialogue samples to train model for all the dialogue rounds. However, unidirectional attention enables to train causal LLMs for all rounds of dialogue generation through a single forward process.



In this paper, we propose a novel attention mask scheme called Intermittent Semi-working Mask (ISM), which preserves the strengths of the prefix decoder while concurrently addressing the issue of high generation latency in multi-turn dialogues. In other words, our ISM simultaneously possesses the high quality of prefix decoder and low latency of causal decoder. Specifically, as illustrated in Figure <ref>, given a prefix sequence includes the dialogue history and current query [𝐏, 𝐐_1, 𝐀_1, ⋯, 𝐐_𝐧-1, 𝐀_𝐧-1, 𝐐_𝐧], our ISM applies bidirectional and unidirectional attention on queries (𝐐_𝐢, i=1,⋯,n) and answers (𝐀_𝐢, i=1,⋯,n-1), respectively. Different from prefix mask, our ISM ensures queries or answers cannot attend to subsequent queries or answers in the dialogue history. Therefore, we can reuse the KV cache across dialogue rounds like causal decoder to prevent duplicate computation and reduce the generation latency. In addition, our ISM significantly improves the training efficiency for multi-turn dialogue datasets.


Given a sample [𝐏, 𝐐_1, 𝐀_1, ⋯, 𝐐_n, 𝐀_n], the usual training approach for a prefix LLM is to expand the data into n samples: [𝐏, 𝐐_1, 𝐀_1], [𝐏, 𝐐_1, 𝐀_1, 𝐐_2, 𝐀_2],⋯,  [𝐏, 𝐐_1, 𝐀_1,⋯, 𝐐_n, 𝐀_n]. In contrast, our ISM can be trained on the original sample through a single forward process like causal LLMs.






To prevent the influence of the base model.
We apply our ISM on prefix LLMs and causal LLMs and conduct extensive experiments in multi-turn dialogue benchmark datasets.


We follow <cit.> to utilize GPT-4 as a stand-in for human raters to score them.
The experimental results demonstrate that our ISM achieves state-of-the-art generation quality and latency in multi-turn dialogues. Overall, our contribution can be summarized as follows,



    
  * We propose a novel masking scheme called ISM, which applies alternate bidirectional and unidirectional attention on queries and answers in multi-turn dialogues. It maintains the high quality of prefix decoders and the low latency of causal decoders simultaneously.
    
  * We apply our ISM on causal LLMs and prefix LLMs and conduct extensive experiments to compare the generation quality and latency between our ISM and existing methods, the experimental results demonstrate the effectiveness of our method.
    
  * We deploy our ISM in a real-world online environment to test its practical performance, we observe our ISM brings significant improvements in generation latency and quality.





§ RELATED WORK



 §.§ LLMs for Multi-turn Dialogues

Recently, the advancements in LLMs have garnered lots of attention. To enhance the multi-turn capabilities of open-sourced LLMs, initial efforts begin with collecting human-ChatGPT dialogues, leading to the creation of Vicuna <cit.>. RealChat <cit.> later expands the data to 1 million conversations. To generate more sophisticated datasets, Baize <cit.> and UltraChat <cit.> employ alternating GPT interactions. Further, Cue-CoT <cit.> and ICL-AIF <cit.> enhance model capabilities for multi-turn interactions through In-Context-Learning (ICL) and Chain-of-Thought (CoT) algorithms.

To investigate LLMs' multi-turn ability, several works construct multi-turn dialogue benchmarks. Daily Dialogue <cit.> is a human-written high-quality multi-turn dialogue dataset. It reflects daily communication way and covers various topics about daily life.
KdConv <cit.> is a Chinese human-labeled knowledge-grounded dialogue dataset for knowledge-driven conversation generation.

NaturalConv <cit.> is a Chinese multi-turn topic-driven conversation dataset, which contains conversations from six domains.





 §.§ Evaluation of LLMs

The quality of the content generated by LLMs can be evaluated from both objective and subjective perspectives. The former aims to evaluate the capabilities of LLMs in an objective and quantitative way, usually by comparing LLMs' outputs with corresponding ground truth. Similarity metrics are calculated based on the outputs and references, such as BLEU <cit.>, and ROUGE <cit.>. An alternative approach involves tasks as a classification task and forces LLMs to output closed options for accuracy calculation, such as MMLU <cit.> and CEVAL <cit.>. The latter is applied to compare the performances of different LLMs by humans or other powerful LLM judges when facing more complicated scenarios. GPTScore <cit.> makes full use of GPT3 in achieving customized, multi-aspect and training-free evaluation. Chatbot Arena <cit.> showcases high agreement between GPT-4 and humans on making judgements. It indicates that leveraging LLM like GPT-4 for evaluating the quality of generated text could be a viable alternative to manual human assessment.

















































 









































§ METHODOLOGY

In this section, we first give the mathematical description of causal LLM, prefix LLM, and our ISM. Then, we elaborate on the benefits of our ISM compared to causal and prefix LLM, respectively. In addition, we introduce how to implement our ISM on existing prefix and causal LLMs.







 §.§ Mathematical description



  §.§.§ Transformers: SSA, LSA

Given a sequence of input vectors 𝐗 = (𝐱_1 ,⋯, 𝐱_n ), the output of standard Softmax Self-Attention (SSA) layer is 


    𝐱_j 𝐱_j + 𝐏𝐕𝐗 softmax(𝐗^⊤𝐊^⊤𝐐𝐱_j)
 

where P corresponds to the output projection, V, K, Q corresponds to the value, key, and query transformation, respectively.

Since the softmax attention of standard transformers is non-linear, its theoretical analysis becomes complicated even for a single layer. For this reason, theoretical approaches <cit.> to analyze transformers have often dropped the softmax function from the attention, resorting to the Linear Self-Attention (LSA) layer,


    𝐱_j 𝐱_j + 𝐏𝐕𝐗 (𝐗^⊤𝐊^⊤𝐐𝐱_j) = 𝐱_j + 𝐏𝐕∑_i=1^n 𝐱_i (𝐱_i^⊤𝐊^⊤𝐐𝐱_j)




  §.§.§ Causal LLM, Prefix LLM, and ISM for Multi-turn dialogue



Here, we briefly introduce the attentions of causal LM, prefix LM, and ISM in their LSA version for multi-turn dialogue.

Given a multi-turn dialogue sample including the prompt (P = (x_1, ⋯, x_m_p)), queries (𝐐_i = (x_m_p +1  or x_m_a_i-1 +1, ⋯, x_m_q_i), i = 1,⋯, n) and answers(𝐀_i = (x_m_q_i +1,⋯, x_m_a_i), i = 1,⋯, n-1), that is [𝐏, 𝐐_1, 𝐀_1,⋯, 𝐐_n-1, 𝐀_n-1, 𝐐_n]. The goal of the model is to predict 𝐀_n of 𝐐_n using the context [𝐏, 𝐐_1, 𝐀_1,⋯, 𝐐_n-1, 𝐀_n-1].

The most classic form of attention is categorized as full (or bidirectional) attention, shown in equation  <ref>, in which each input x_j (j = 1,⋯, n) can attend to all positions. Full attention is typically used in the transformer encoder.

Furthermore, another transformer decoder for in-context learning uses the auto-regressive attention


    𝐱_j 𝐱_j + 𝐏𝐕∑_i=1^j 𝐱_i (𝐱_i^⊤𝐊^⊤𝐐𝐱_j)


which restricts each token 𝐱_j to attend only to previous positions (and itself) from 1 to j. This restriction is due to the role of the decoder as a causal language model (causal LLM) which predicts the next token in the context of the previously generated ones.

The original transformer uses a full attention based encoder and an auto-regressive attention based decoder. However, NLP researchers have a preference for models that are either encoder-only (e.g. BERT<cit.>) or decoder-only (e.g. GPT<cit.>, PaLM<cit.>) according to the task at hand. One motivation for altering model is that it reduces the number of parameters by half.

A new form of attention, that lies intermediate to full attention and auto-regressive attention, emerged from the understanding that certain tasks can gain advantages from a prefix sequence, such as multi-turn dialogue and in-context learning. This attention in prefix LLM suggests the following:


    𝐱_j 𝐱_j + 𝐏𝐕∑_i=1^max(j, n_q_n)𝐱_i (𝐱_i^⊤𝐊^⊤𝐐𝐱_j)


Where max(j, n_q_n) ensures each prefix token x_j with j < n_q_n can attend to all prefix tokens.


In our ISM, the form of which suggests the following:


    𝐱_j 𝐱_j + 𝐏𝐕∑_i=1^f(j)𝐱_i (𝐱_i^⊤𝐊^⊤𝐐𝐱_j)

where f(j) is 


    f(j) = {    m_q_1      for  j <= m_q_1
        m_q_k      for  m_a_k-1< j <= m_q_k , k > 1 
        j       for  m_q_k< j <= m_a_k , k >= 1, 
    .






 §.§ Convergence in Multi-turn dialogue learning


To simplify the model in Multi-turn dialogue learning, we analyze Linear regression, which  is a classical machine learning problem. Given a set of vectors 𝐐𝐀_i = ((𝐪_j, a_j))(where j = m_i-1+1, ...,m_i, i = 1, ..., n,m_0 = 0), which contains a set of input-label  pairs, the goal is to find an optimal weight vector 𝐰 that minimizes the l2-loss:

    L(𝐰) = 1/2m_n∑_k = 1^m_n𝐰𝐪_k-a_k_2^2

The gradient of the loss is ∇_𝐰L =  1/m_n∑_k = 1^m_n (𝐰𝐪_k-a_k)𝐪_k^⊤  , and a gradient descent algorithm with step size α follows the update rule:


    𝐰^(l)= 𝐰^(l-1)  + α/m_n∑_k = 1^m_n (a_k-𝐰^(l-1)𝐪_k)𝐪_k^⊤



According to <cit.>, the input is formulated as



    X = (x_i^(0), ..., x_m_n^(0)),  where x_j^(0) = (
           𝐪_j 
           a_j
    )

and the parameter matrices of  are:



    𝐊 = 𝐐 = (
           𝐈_d× d      0
       0       0
    ), 
        𝐕 = (
           0_d× d      0
       𝐰^(0)       0
    ),
        𝐏 = α/m_n𝐈,
 
where 𝐰^(0) is an initial weight vector. Furthermore, there is work<cit.> proves that multi-layer LSA under the construction of progresses identically to multi-step gradient descent. The prososition is that for a multi-layer LSA satisfying the construction <ref> and with 𝐰^(0) =0, if its input Z is formatted as <ref>, then its l-th layer output is 𝐱_j^(l)=(𝐪_j^⊤, δ_j^(l))^⊤, where δ_j^(l)=a_j-𝐰^(l)𝐪_j and 𝐰^(l)  is the l-th updated weight from the gradient descents update rule in <ref>. Since 𝐪_j never changes , we can simplify it and focus only on  δ_j^(l), which is the last output coordinate of the j-th LSA-layer for l > 0,




    δ_j^(l)  = δ_j^(l-1)- α/m_n∑_k = 1^m_nδ_j^(l-1)𝐪_k𝐪_j^⊤
 

with δ_j^(0) = a_j. Defining a_j^(l) = a_j - δ_j^(0) and rearranging <ref>, for a_j^(0) = 0 and ∀ l > 0, we have:



    a_j^(l)  =a_j^(l-1)- α/m_n∑_k = 1^m_n (a_k-a_k^(l-1) ) 𝐪_k𝐪_j^⊤
 

For prefix LM, <ref> and <ref> are the the update rules. Mainwhile, a causal LM applies auto-regressive attention throughout the entire sequence. Therefore, plugging the same K, Q, P, V into <ref>, the update rules of <ref>, and <ref> become:
 


    δ_j^(l)  = δ_j^(l-1)- α/m_n∑_k = 1^jδ_j^(l-1)𝐪_k𝐪_j^⊤
 



    a_j^(l)  =a_j^(l-1)- α/m_n∑_k = 1^j (a_k-a_k^(l-1) ) 𝐪_k𝐪_j^⊤
 

For ISM, the update rules of <ref>, and <ref> become:



    δ_j^(l)  = δ_j^(l-1)- α/m_n∑_k = 1^f(j)δ_j^(l-1)𝐪_k𝐪_j^⊤
 



    a_j^(l)  =a_j^(l-1)- α/m_n∑_k = 1^f(j) (a_k-a_k^(l-1) ) 𝐪_k𝐪_j^⊤
 

where f(j) is defined in <ref>.


It has been proved that the layer outputs of prefix LM have the same dynamics of multi-step gradient descent on a linear regression problem <cit.>, which means the iterative weights 𝐰^(l) converges to the stationary point 𝐰^* in a linear rate.

For causal LM, for each j, the iterative weights 𝐰_j^(l) converge to the stationary point 𝐰_j^* , but 𝐰_j^* may not converge to the the optimal solution 𝐰^* <cit.>.

For j = m_n-1,⋯, m_n in ISM, the iterative weights 𝐰_j^(l) converge to the stationary point 𝐰^* similar to prefix LLM. Thus, for m_n > m_n-1, ISM also has the same multi-step gradient descent.





 §.§ ISM vs. Causal LLM


As we proofed in Section <ref>, ISM converges to the stationary point 𝐰^* in most situations (m_n > m_n-1) and causal LM may not converge to 𝐰^*. It indicates that in multi-turn dialogue learning, ISM will perform better than causal LM when the length of query from the last dialogue is longer than 1.


To apply our ISM to causal LLMs, we modify the causal mask as shown in Figure <ref> a) into ISM as shown in Figure <ref> c) to apply bidirectional attention on queries in dialogue history.




 §.§ ISM vs. Prefix LLM




Compared with prefix LLM, the standout benefit of our ISM is its ability to reuse the KV cache across dialogue rounds, effectively reducing the generation latency.

KV Cache is a commonly used acceleration technique when LLMs perform generation.

However, it's not reusable between dialogue rounds in prefix LLM.

Given dialogue history h = [𝐏,𝐐_1,𝐀_1,⋯,𝐐_𝐧-1,𝐀_𝐧-1] and current query 𝐐_𝐧 to generate 𝐀_𝐧. Assuming we have dialogue history's KV cache C_h, for causal LLM and our ISM, we only need to compute the current query's KV cache C_q and concatenate them to get the whole sequence's cache [C_h; C_q], so that we can generate A_n with linear complexity. However, for prefix LLM, due to the bidirectional attention on prefix sequences as shown in Figure <ref> b), the KV cache of dialogue history C_h needs to be recomputed when computing KV cache of current query 𝐐_𝐧. Therefore, the KV cache of dialogue history C_h isn't reusable in prefix LLM.

To apply our ISM on prefix LLM, we choose ChatGLM as the base model.

It designs a special 2D positional encoding method as shown in Figure <ref> a). When facing multi-turn dialogue data, it applies bidirectional attention on prefix tokens (dialogue history) while generating answers. In contrast, our ISM applies alternate bidirectional and unidirectional attention on history queries and answers. Therefore, we follow GLM to apply the 2D position encoding for previous query and answer spans in Figure <ref> b). Position 1 and 2 are utilized to encode the inter- and intra-span positions, respectively.








§ EXPERIMENTS






 §.§ Datasets

Daily Dialogue. Daily Dialogue<cit.> is a human-written high-quality multi-turn conversation dataset. The dialogues in the dataset reflect daily communication way and cover various topics about daily life. It contains 13,118 dialogues, the average turns of each dialogue is 7.9.

KdConv. KdConv <cit.> is a Chinese knowledge-driven conversation dataset. It grounds the topics in multi-turn conversations to knowledge graphs. It contains 4.5K conversations from three domains (film, music, and travel), and 86K utterances with an average turn number of 19.0.

NaturalConv. NaturalConv <cit.> is a Chinese multi-turn topic-driven conversation dataset, which allows the participants to chat anything they want as long as any element from the topic is mentioned. It contains 19.9K conversations from six domains, and 400K utterances with an average turn number of 20.1.



 §.§ Implementation Details

For Daily Dialogue, we choose Llama2-7b as the base model and apply our ISM in it as described in Section <ref>. We call the modified model Llama2-7b (ISM). We finetune them on the train split with the same settings. Specifically, we utilize 4 NVIDIA A100 GPUs to full-finetune Llama2-7b and Llama2-7b (ISM) on Daily Dialogue's train split for 5 epochs, respectively. We train models with AdamW <cit.>, the learning rate is set as 3e-5, global batch size is 64.  


For KdConv and NaturalConv, we choose Qwen1.5-7b as the base model. As these two datasets are both in Chinese and topic-driven. We mix their train split to finetune Qwen1.5-7b and Qwen1.5-7b (ISM) and evaluate on the mixture of their test split. The training settings are the same as Llama2-7b's. In addition, to evaluate our ISM on prefix LLM, we apply ISM in ChatGLM as illustrated in Section <ref> and utilize KdConv and NaturalConv to train ChatGLM-6b and ChatGLM-6b (ISM).

For evaluation, we follow previous works <cit.> to apply powerful GPT-4 as a stand-in for human judge. We design appropriate instructions to ask GPT-4 to compare the answers between the base model and our corresponding ISM version and to decide which answer is better or tie. Considering the position bias <cit.>, we swap the position of answers and compute the average result. Specific prompts can be seen in Appendix <ref>. In addition, we randomly select 200 samples for human evaluation to compare the consistency between GPT-4 and human judgement.



 §.§ Quantitative Analysis


We report the GPT-4 pairwise comparison results in Table <ref>. For causal model, we compare Qwen 1.5-7b and Qwen 1.5-7b (ISM) on the mixture test split of KdConv and NaturalConv. We can find that the win rate of Qwen 1.5-7b (ISM) exceeds Qwen 1.5-7b by 1.72%. For prefix model, we compare ChatGLM-6b and ChatGLM-6b (ISM). Considering the inefficient training process of prefix LLM in multi-turn dialogue dataset, we expand the training data for ChatGLM. Specifically, given a multi-turn dialogue sample, we expand it into five samples manually. For instance, given a sample with 15 turns of dialogue, we will expand it into samples with 3, 6, 9, 12, and 15 turns. We can find the win rate of ChatGLM-6b (ISM) outperforms ChatGLM-6b by 2.61%. It demonstrates that our ISM can improve both causal LLM and prefix LLM's generation quality in multi-turn dialogues.




Similarly, we compare Llama2-7b and Llama2-7b (ISM) on Daily Dialogue, the results are reported in Table <ref>. We observe that Llama2-7b (ISM) demonstrates substantial performance enhancements compared to the base model, achieves 5.64% increasement in win rate.




Further, we apply ISM in our private model AntGLM-10B<cit.> to evaluate the performance. AntGLM has the same architecture as GLM, belongs to prefix LLM. We evaluate AntGLM and AntGLM (ISM) in our private AntEval dataset. AntEval dataset is collected from real-world conversations about insurance and medical. It contains 1219 samples in total. Including 944 samples with one turn and 56 samples with two turns, we call these as Short Split. In addition, other 219 samples contain conversation over 2 rounds, with an average turn number of 4.6, we call these as Long Split. We evaluate AntGLM and AntGLM (ISM) in these two splits, respectively, the results are shown in Table <ref>. We can observe that AntGLM (ISM) achieves 8.67% win rate over AntGLM in the Long Split, while the improvement is only 0.2% in the Short Split. It illustrates that our approach exhibits a pronounced advantage in longer dialogue samples.



  §.§.§ Human Evaluation





Designing instructions and applying GPT-4 to evaluate LLM's performance has been widely adopted, but it's still a subjective evaluation method. Therefore, we randomly select 100 samples from Daily Dialogue and KdConv&NaturalConv separately for human evaluation to compare the judgement consistency between human and GPT-4. As shown in Figure <ref>, we observe a high level of consistency between human and GPT-4 evaluation, 81% and 78% in Figure <ref> a) and b), respectively. Furthermore, it is notable that the majority of inconsistencies are centered around determining whether there is a tie or not. It demonstrates that the evaluation results from GPT-4 are relatively reliable.





 §.§ Latency Analysis





As described in Section <ref>, prefix LLM suffers from high generation latency in multi-turn dialogues due to the inability to reuse the KV cache across dialogue rounds. In this section, we conduct experiments to compare the time-to-first-token (TTFT) latency between AntGLM-10B and AntGLM-10B (ISM). Specifically, we construct a simulated dialogue sample consisting of 20 turns, with each turn having a sequence length of 200. The query length is 40, and the answer length is 160. We deploy them on 2 NVIDIA A10 GPUs and repeatedly call the inference API 10 times to calculate the average TTFT. As shown in Figure <ref>, it's evident that the TTFT latency of AntGLM-10B surges quickly as the input sequence length expands. Conversely, the TTFT of AntGLM-10B (ISM) increases much slower due to the reuse of the KV cache. Specific analysis can be seen in Appendix <ref>



 §.§ Case Study




In Figure <ref>, we showcase two cases including dialogue sample, generated responses and GPT-4 judgement results. We can find that GPT-4 follows our instructions well to make judgements. In the first case, GPT-4 not only considers the dialogue history, but also takes account of User 2's "willingness" and "responsibility". Cases with longer dialogue history can be seen in Appendix <ref>.



 §.§ Limitation

Current ISM is applied to existing causal or prefix base models for finetuning. The data utilized for finetuning is relatively small compared with the data used during their pretraining stage. The performance of our ISM in the pretraining stage needs to be explored.





§ CONCLUSION AND FUTURE WORK

In this paper, we propose a novel attention masking scheme called Intermittent Semi-working Mask (ISM) to achieve the high generation quality and low generation latency in multi-turn dialogue. Specifically, we apply alternate bidirectional and unidirectional attention on queries and answers in the dialogue history.
In this way, our ISM is able to maintain the advantages of both prefix LLM and causal LLM simultaneously.
Extensive experiments illustrate that our ISM achieves significant performance. In the future, we will try to apply our ISM to the pretraining stage of LLM and delve deeper into exploring its advantages.



abbrvnat








§ APPENDIX



 §.§ Inference Acceleration Estimation on ISM

ISM inference can be accelerated by reusing the KV Cache across turns. We analyze the computational complexity of transformers before and after acceleration.

Given the following variable definitions for a Transformer model:

    
  * b = batch size
    
  * s = input sequence length
    
  * n_s = new input sequence length
    
  * h = hidden dimension
    
  * h_n = number of attention heads
    
  * h_h = dimension per attention head, where h_h = h/h_n




  §.§.§ Before Acceleration

The FLOPs for the self-attention layer (F_self-attention) can be estimated as follows:

    
  * Computing queries, keys, values: 
    
    F_qkv = 3 · 2 · b · s · h^2 = 6 · b · h^2 · s

    
  * Computing attention scores: 
    
    F_as = 2 · 2 · b · h_n · s · h_h · s = 4 · b · h · s^2

    
  * Computing weighted sum: 
    
    F_ws = 2 · b · h^2 · s

    
  * The total FLOPs for self-attention is therefore: 
    
    F_self-attention = F_qkv + F_as + F_ws = 4 · b · h · s^2 + 8 · b · h^2 · s




The FLOPs for the feed-forward network layer (F_ffn) is:

    F_ffn = 16 · b · h · s^2


Thus, the total FLOPs for transformers (F_transformers) combines both the self-attention and feed-forward FLOPs:

    F_transformers = F_self-attention + F_ffn = 4 · b · h · s^2 + 24 · b · h^2 · s


Overall, the computational complexity of the Transformer is quadratically related to the input sequence length



  §.§.§ After Acceleration

By reusing the KV cache from the previous turn of dialogue, we can trim the input sequence to the new uncached segment. In this way, it is equivalent to replacing one s(input sequence length) in the aforementioned computation process with n_s (new input sequence length), thus the total computational complexity after inference acceleration is:

    F_accelarated-transformers = 4 · b · h · s * n_s + 24 · b · h^2 · n_s


When n_s is much smaller than s and h, n_s can be neglected. Therefore, the total computational FLOPs is approximately 4 · b · h · s + 24 · b · h^2, where the relationship between computational cost and input sequence length becomes a linear polynomial. Thus, the computational cost is optimized from a quadratic polynomial of input sequence length to a linear polynomial.




 §.§ Prompt




We design instruction prompt carefully as shown in Figure <ref> to leverage GPT-4 in assessing the quality of responses from the models to be compared. The whole prompt can be divided into three parts, the first part describe the task and the specific evaluation criteria, the second part contains two cases and corresponding human written evaluation result for few-shot learning, the third part contains sample to be judged.



 §.§ Cases






We showcase two cases with longer dialogue history and corresponding GPT-4 judgements, shown in Figure <ref> and <ref>. From Figure <ref> we can observe that facing dialogues with longer history, our ISM is able to attend history context better and generate more reasonable response.













































































































































































































































































































































































































































 




























































































































    

























    




































































 Paper Title: Pathway to Secure and Trustworthy 6G for LLMs: Attacks, Defense, and Opportunities.















Pathway to Secure and Trustworthy 6G for LLMs: Attacks, Defense, and Opportunities
    Sunder Ali Khowaja Senior Member, IEEE, Parus Khuwaja, Kapal Dev Senior Member IEEE, Hussam Al Hamadi, and Engin Zeydan Senior Member IEEE 

Sunder Ali Khowaja is with School of Computing, Faculty of Computing, Digital and Data, Technological University Dublin, and CONNECT Centre, Ireland. Email: sunderali.khowaja@tudublin.ie

Parus Khowaja is with Institute of Business Administration, University of Sindh, Jamshoro. (e-mail:Parus.khuwaja@usindh.edu.pk).
Kapal Dev is associated with CONNECT Centre and Department of Computer Science and  Munster Technological University, Bishopstown, Cork, T12 P928, Ireland,e-mail: (kapal.dev@ieee.org)
Hussam Al Hamadi with College of Engineering and IT 
University of Dubai, e-mail: (Halhammadi@ud.ac.ae)
Engin Zeydan with Centre Tecnològic de Telecomunicacions de Catalunya (CTTC), Barcelona, Spain, 08860, e-mail: (ezeydan@cttc.es)


    
August 1, 2024

================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================



§ ABSTRACT 

Recently, large language models (LLMs) have been gaining a lot of interest due to their adaptability and extensibility in emerging applications, including communication networks. It is anticipated that 6G mobile edge computing networks will be able to support LLMs as a service, as they provide ultra reliable low-latency communications and closed loop massive connectivity. However, LLMs are vulnerable to data and model privacy issues that affect the trustworthiness of LLMs to be deployed for user-based services. In this paper, we explore the security vulnerabilities associated with fine-tuning LLMs in 6G networks, in particular the membership inference attack. We define the characteristics of an attack network that can perform a membership inference attack if the attacker has access to the fine-tuned model for the downstream task. We show that the membership inference attacks are effective for any downstream task, which can lead to a personal data breach when using LLM as a service. The experimental results show that the attack success rate of maximum 92% can be achieved on named entity recognition task. Based on the experimental analysis, we discuss possible defense mechanisms and present possible research directions to make the LLMs more trustworthy in the context of 6G networks. 
 



§ INTRODUCTION


The emergence of attention networks has been a stepping stone for transformer architectures, which also led to the introduction of large language models (LLMs). More recently, LLMs are seen as the most significant advance in the field of artificial intelligence (AI) and a potential pathway to artificial general intelligence (AGI) <cit.>. Every tech giant is in a race to advance in the field of LLMs by leveraging generative AI (GAI). Notable examples of LLMs from the tech giants are GPT-4 from OpenAI, LLaMA-3 from Meta and PALM from Google. However, there are also new players in this field that surpass the performance of the LLMs mentioned above. These include Mistral (in collaboration with NVIDIA), DCLM from Apple, xLAM from Salesforce, v2 chat from Deepseek, Groq, Claude, SmolLM and many more. These LLMs are trained on diverse and large amounts of datasets scraped or curated from the Internet. Some LLMs focus on increasing model size, such as GPT, while others find new ways to improve the generalization of LLMs through data curation, model quantization, and innovative techniques. Examples of such LLMs are Claude, LLaMA, DCLM and Groq, which have recently outperformed GPT on various language tasks. In continuation of the above-mentioned advances in LLMs, several enterprises are leveraging pre-trained encoders of LLMs to varying degrees to develop their own customized solutions for various applications and sectors, including healthcare, education, law and industrial automation. In view of the rapid development of LLMs, it can be assumed that LLMs will soon also be deployed on edge and handheld devices. Several studies have indicated that the current iteration of 5G networks will not be able to support a plethora of services offered by LLMs. Therefore, researchers are working intensively on the next iteration of communication systems, i.e. Sixth generation (6G), to meet the above requirements <cit.>. Furthermore, as AI is an integral part of 6G systems, it is assumed that LLMs will be used intrinsically to optimize resources and performance while enabling human-centric customized services to users. 
 




The standardization process towards 6G systems is already progressing steadily. It is assumed that the evolution of the communication system will support distributed AI both for edge devices and within the mobile network <cit.>. Although many researchers argue that the edge devices will not support the use of LLMs, but with continuous breakthroughs in the field of AI, support for edge devices can be extended through distributed learning techniques such as federated learning (FL) and split learning (SL) <cit.>. In addition, quantization and training can be used to fine-tune an LLM on the edge devices. As proposed in <cit.>, an LLM with 65 billion parameters can be fine-tuned with quantized low-rank adapters (QLoRA) on a downstream task within a single day, achieving comparable performance compared to other state-of-the-art (SOTA) LLMs. It can be assumed that the convergence of quantized networks, LLMs and 6G Multi-Access Edge Computing (MEC) could result in many innovative applications. Researchers have already begun to explore the mutual convergence of LLMs and 6G MEC networks, calling them LLMs for networks and networks for LLMs respectively. We illustrate a network for LLMs that corresponds to the vision of the Network for AI (NetAI) with respect to a 6G communication system in Figure <ref>. The NetAI vision supports LLM deployments related to the MEC architecture <cit.>. Various services such as smart homes, healthcare, education, emergencies, mission-critical applications and finance can be supported with the network for LLMs. 

Most research today focuses on the integration of LLMs and communication networks, which would undoubtedly bring unprecedented advances and technological innovation. However, one aspect of this technological progress is being overlooked, namely the security aspect. With all the possibilities and potential of LLMs and the 6G ecosystem, we have to ask ourselves, are LLMs trustworthy? Despite their ability to fine-tune to the downstream task, LLMs are deep neural networks that are vulnerable to privacy attacks, such as model inversion, model poisoning and membership leakage <cit.>. The growing landscape of LLMs and their integration into communication systems therefore makes it necessary to address security concerns and the development of trustable AI encoders to safeguard the integrity of users and services in 6G systems. To the best of our knowledge, the studies have not explored the security vulnerabilities in network for LLMs (Net4LLMs), which subsequently leaves us defenseless against such attacks as we progress towards the Net4AI vision.  

To address the above problem, in this paper, we propose to audit the trustworthiness of pre-trained AI encoders for membership leakage attacks. The membership leakage attack is an attack in which the adversary tries to find out the distribution of the training data used to train the AI encoders. Considering that the Net4LLMs will focus on fine-tuning the pre-trained AI encoders for service provisioning, the attacker will aim to determine if a data sample was used for the fine-tuning process. The fine-tuning process enables the replacement of task-specific layer in the pre-trained AI encoder to meet tasks such as questions and answers, name entity recognition and classification <cit.>. We evaluate the trustworthiness of AI encoders against the membership inference attacks. We assume that the adversary has particularly the knowledge of the downstream task and the adversary is provided with the fine-tuned model, also known as black-box setting. We conduct experiments to evaluate the trustworthiness of the AI pre-trained encoders and to develop possible defenses to prevent the membership leakage attacks in the context of Net4LLMs. The specific contributions of this work are characterized as follows:

    
  * This is the first study to investigate the trustworthiness of pre-trained AI encoders for Net4LLMs.
    
  * Membership leakage attacks in the context of Net4LLMs are explored to assess trustworthiness.
    
  * Based on experimental analysis, defenses are proposed to audit trust in Net4LLMs.
    
  * At the end of the paper, open issues, challenges and future directions are also proposed to prevent potential adversarial attacks on LLMs. 






§ RELATED WORKS

Recently, we have observed a plethora of advances in the field of LLMs that would be a revolution in the field of communication networks, especially in the design and development of 6G networks. Some studies have already explored and demonstrated the significance of LLMs for potential 6G applications. For example, the study in <cit.> proposed NetGPT, which enables personalized services to users through generative networks while handling comprehensive network intelligence and cloud collaboration in real time.Xu et al. <cit.> focused on the data privacy in 6G communication systems using LLMs. The study proposed to design LLM agents based on the principle of split learning by distributing LLMs for different roles across edge devices to make user interaction efficient and collaborative. Their results show that the split learning setting was effective in improving the communication efficiency while offloading the tasks that are complex in nature to the servers for constructing global LLMs. The study in <cit.> emphasised that the newer LLMs must offer multimodal services, i.e. they must handle image, text and audio data in order to offer automated services. Therefore, the deployment of LLM agents in the cloud could pose challenges in terms of data privacy, high bandwidth costs and long response times. However, MEC based on 6G communication systems can address the above problems in an effective way. Lin et al. <cit.>also proposed a split learning framework for the deployment of LLMs in 6G networks. However, their work focused on the efficiency and effectiveness of LLMs in terms of parameter sharing, quantization, and efficient fine-tuning rather than data or model security. Nguyen et al. <cit.> highlighted the advantages of using LLMs in 6G networks while exploring the security vulnerabilities from an adversarial point of view. However, the discussion of model security was very abstract and brief, focusing more on the attacks on services. The study also suggested the use of blockchain technology to avoid the security threats associated with LLMs and 6G networks. To the best of our knowledge, none of the studies investigated a specific model-based attack scenario related to pre-trained AI encoders and 6G networks. 



§ TRAINING/FINE-TUNING LLMS IN 6G


The training strategies for fine-tuning LLMs in 6G networks are shown in Figure <ref>. The strategies are presented in accordance with the MEC framework. The cloud layer can leverage the pre-trained AI encoders of LLMs for any of the training modes, but the downstream task would mostly be generalized when passed to the edge and user layers. However, at the edge and user layer, the customization of the LLMs can be done based on the context and resources. As can be seen from the training modes, fine-tuning the pre-trained encoder and classifier requires large amounts of computational resources. The computational resources decrease significantly when moving to the edge and user layer. In this regard, the edge and user layers can at most fine-tune/adapt the LLMs based on their application by keeping the pre-trained encoder frozen and using the final layers to update the parameters. Alternatively, they can simply freeze the entire LLM and extract only the output embeddings that are used as representative features for training deep neural networks or shallow learning methods.

An example of this can be found in Figure <ref> for an emergency service application where LLM's pre-trained AI encoder can be used and its parameters frozen while a limited amount of labeled data is used to train the classifier or the final layers. This would be beneficial for edge devices to fine-tune the network locally to improve communication efficiency while utilizing computing resources efficiently. As proposed in <cit.>, the customization can be achieved through a split learning strategy, where the cloud wants to fine-tune the LLM for a specific task with respect to the communication system and splits the network into smaller networks that are trained with devices from the edge layer and the user layer. Some specific techniques such as Low Ranking Adaptation (LoRA), Quantized LoRA (QLoRA), Parameter Efficient Fine-Tuning (PEFT), Deep Speed and ZeRO can be used to fine-tune the LLMs. LoRA uses low-rank approximations to fine-tune the LLMs for specific tasks, resulting in reduced financial and computational costs. QLoRA further reduces memory utilization while fine-tuning LLMs with the LoRA technique. PEFT adjusts key parameters and uses the catastrophic forgetting technique to fine-tune LLMs with a small subset of parameters. ZeRO uses memory optimization and data parallelism techniques to fine-tune LLMs, and DeepSpeed uses the ZeRO redundancy optimizer to fine-tune LLMs in a distributed learning fashion. The above techniques can be used extensively at the user, edge and cloud layers to fine-tune LLMs for various purposes. 



 §.§ Security Issues in LLMs and 6G


Several studies have now highlighted the security concerns related to the behavior, architecture and design of LLM. The security concerns arise from the complexity of LLMs and the challenges associated with their deployment and training process. In addition, backdoor attacks are possible in LLMs that cannot be overcome with conventional security measures. These backdoor attacks are applicable to LLMs that are fine-tuned in a supervised manner and trained with adversarial learning or reinforcement learning. The different types of attacks in LLMs deployed within 6G networks are defined below. 

    
  * Adversarial attacks: These attacks are carried out by manipulating data to affect the performance of the model. Adversarial attacks can generally be divided into backdoor attacks and poisoning attacks. In the former, a trigger is hidden in the model to manipulate the inference behavior, while in the latter, malicious examples are injected into the training process to deceive the model.
    
  * Inversion attacks: Inversion attacks are performed to reconstruct the data or to extract certain information from the model gradients. Inversion attacks include replicating the model, extracting training data, gradient leakages, feature space and stealing models. 
    
  * Unfair exploitation and bias attack: This type of attack is related to the training data used to train or fine-tune the LLMs. The attack disproportionately adds data with a particular label to fine-tune or train the network so that the inference perpetuates biases and unintentionally learns to generate misinformation, social inequalities, reinforcement of stereotypes and discrimination in the generation of responses. 
    
  * Instruction tuning attacks: These attacks aim to overload the system's resources in order to carry out inadvertent actions. Examples of such attacks are Denial of Service (DoS), indirect prompt injection, jailbreaking and the disclosure of guided prompts. 
    
  * Zero-day attacks: These attacks are usually called sleeper agents because they are embedded with model weights when a particular defense method fails to eliminate them. This type of attack is usually triggered by specific events or phrases. One example of such attacks is data theft. 
    
  * Inference attacks: Last but not least, inference attacks aim to extract sensitive information from the model, especially in the context of the training data used to fine-tune a model. Examples of such attacks are attribute inference and membership inference attack. In this paper, we focus on the membership inference attack as it can identify specific data used to train or fine-tune the model. Such information can be used to break the trust and confidentiality of the AI model and be used against the user. Other consequences of membership inference attack include breach of confidentiality, unauthorized access, identity theft and violation of privacy. 




§ TRUSTABLE AI ENCODERS


In this section we provide the information about the threat model, the attack scenario, the datasets used for the attack and the implementation details.









 §.§ Threat Model


Before we define the threat model, we make some assumptions. We assume that the LLM is pre- trained on a large dataset capable of transforming the input (text) into embeddings. Using the pre-trained AI encoder, a downstream task is fine-tuned by a customized dataset for a specific application in 6G networks using optimization algorithms and a predefined loss function. The fine-tuned model is then able to transform the input into embeddings or classification probabilities accordingly (which differ from the original, pre-trained AI encoder). We define the attacker's purpose in this scenario as a dichotomous classification problem, where the goal is to determine whether the input provided to the pre-trained AI encoder is a member or non-member of the training dataset used for the subsequent task. In general, existing studies assume two dimensions of an attacker's background knowledge when considering membership inference attacks. 

The first dimension assumes a black box attack, which means that the attacker has no prior knowledge of the pre-trained AI encoder architecture, but the attacker has access to the model that has been trained for the downstream task. This is considered the most realistic scenario, as in 6G AI is used as a service and the models adapted for the downstream task would be directly available to the public. The second dimension assumes that the attacker has access to a very small subset of the member training data, which can be used to create an auxiliary dataset. The auxiliary dataset can then be used to train the attack model. Studies have shown that such assumptions can be true if one infers the location and makes an educated guess about the service used in a particular area <cit.>. With the large plethora of diverse data available on the Internet, it is reasonable to assume that the attacker can gather meaningful data to create a shadow model for lodging membership inference attack that corresponds to a real-world environment. Considering the two dimensions, we assume in this study that the attacker has access to the downstream task model and has some knowledge of the application, which is taken into account by the pre-trained AI encoder of the LLM.



 §.§ Attack Scenario


It is known that the LLM's pre-trained AI encoder can be used for feature extraction, i.e. the LLM's task of transforming the input into embedding vectors. The mapping of inputs to embeddings benefits the fine-tuning of LLMs or training with deep neural networks for a specific task. However, when the LLM is fine-tuned with the new data for a particular downstream task, it tends to memorize the data during the training process. The memorization suggests that the member data will have higher confidence values compared to the non-member data. Therefore, it can be deduced that: (i) Pre-trained AI encoders of LLMs behave differently to the member and non-member data. (ii) The behavior is propagated to the embedding vectors that are learned during fine-tuning for the downstream tasks, so that the memorization of model will be a part of the downstream model available to the attacker. We intend to use the above features to categorize whether the data is a member or a non-member of the pre-trained AI encoder. We then apply the following steps to evaluate the effectiveness of the attack for a pre-trained AI encoder. 

    
  * Our assumptions are that the attacker has some prior knowledge of the application for which the LLM is fine- tuned. Therefore, the attacker scraps the Internet or uses publicly available datasets to create an auxiliary dataset.
    
  * The attacker then prepares the auxiliary dataset for training by assigning pesudolabels to the data as members and non-members. The attacker then feeds the pseudo-labeled auxiliary dataset into the downstream model. The training process is then performed to create an attack model that is capable of binary classification, i.e. categorizing the data into members and non-members.
    
  * Once the attack model is trained, the attacker can enter the candidate text into the attack model to determine whether the candidate text is a member or a non-member.




 §.§ Dataset


In this work, we use two state-of-the-art pre-trained language models RoBERTa <cit.> and ALBERT <cit.> for our experiments. The two language models differ in their training schemes, loss functions and architectures. It should be noted that we have not trained these language models from scratch, but that we use the pre-trained language models for the attack scenario that are publicly available online[https://huggingface.co/models]. According to the assumption considered for the attack scenario, the attacker has access to the fine-tuned model for the downstream task. Therefore, we consider two publicly available datasets, i.e., Yelp Review/AG's News/SST <cit.> and CoNLL2003 <cit.>. The first data set is intended for the task of text classification, while the second takes into account the task of Named Entity Recognition (NER). To perform the membership inference attack, we use a small portion of the Yelp Review/AG's News/SST and CoNLL2003 dataset, i.e., 0.15%, of each dataset to construct the auxiliary dataset and label it as member data. We also consider other third-party datasets such as AX, CoLA and IMDB for the auxiliary dataset and label them as non-member data. 



 §.§ Implementation Details


To perform membership inference attack, we design a five-layer multilayer perceptron as an attack model that uses the output of the model fine-tuned to the downstream task as input. The dimensions of the first layer vary depending on the model fine-tuned to a specific downstream task. Recall, precision and F1 score are used as evaluation metrics for the performance of the attack. The attack model is trained using the ADAM optimizer with a learning rate of 1e-5. The model is trained for 100 epochs. The auxiliary dataset was divided into two sets, i.e. a test dataset and a training dataset in a ratio of 1:5. 







§ EXPERIMENTAL ANALYSIS


In Figure <ref>, we show the performance of the membership inference attack. It should be noted that Yelp Review/AG's News/SST are classification tasks with 5/4/2 classes, respectively. The baseline, random guessing, refers to the value of 0.5 for precision and recall. The attack performance shows that the two pre-trained language models achieve a minimum F1 score of 0.77 in the SST task and a maximum F1 score of 0.94 in the NER task. The results are significantly higher than random guessing, indicating that the membership leak exists in the pre-trained AI encoders. 

The success rate of the attack raises serious concerns about the trustworthiness of LLMs and pre-trained models in 6G networks. We repeat the above experiment with a reduced auxiliary dataset, i.e., we use Yelp Review/AG's News/SST for training the attack model without considering CoNLL2003 and vice versa to observe the results.  The results for this experiment are shown in Figure 4. It can be seen that the performance is still above the random guess. Furthermore, the performance degradation is about 0.12/0.096 for CoNNL2003, about 0.07/0.095 for Yelp Review, about 0.06/0.075 for AG's News and about 0.105/0.074 for SST, using ALBERT and RoBERTa, respectively. The attack performance still reaches a maximum of 0.83 F1 score if the attacker only has access to the fine-tuned model for the downstream task, but does not use the part of the same datasets. This behavior confirms our assumption that the pre-trained language models memorize the data and behave differently with member and non-member data. 


Another interesting aspect was highlighted when we examined the attack performance while varying the number of classes. Since the Yelp dataset has the highest number of classes out of the datasets we selected, namely 5, we varied the number of classes to observe the attack performance. The results of this experiment are shown in Figure 5. It can be seen that the attack performance increases as the number of classes increases. This is very interesting because it shows that the membership inference attack can extract more information from data with a higher number of categories. It also shows why the attack performance on Yelp was better than on AG's News and SST datasets, accordingly. 



§ ENABLING TRUST WITH PRE-TRAINED AI ENCODERS


Membership leakage and membership inference attacks have been extensively studied in the context of computer vision and image modality. Defenses against such attacks therefore include adversary regularization, differential privacy, data augmentation, adding noise to images, intentional attacks, encryption techniques, and others <cit.>. Some of the above techniques are difficult to perform in textual modality, such as addition of noise and intentional attack initialization. Such actions can also degrade the performance of LLMs in 6G networks. Adding noise to either the data or confidence scores for classification can be used as a defense mechanism. However, studies suggest that such techniques degrade the performance of the downstream task <cit.>.

Based on the observations gathered from our experiments, we propose two possible defenses. The first is to reduce the size of the dataset or reduce the number of epochs to fine-tune the network. The intuition is that if the size of the dataset or the number of epochs for fine-tuning in the downstream task is increased, the pre-trained AI encoder would tend to memorize the downstream task data and thus make the membership attack stronger. In this context, we suggest using either active learning or curriculum learning, which can perform the training with less data or fewer epochs.



The second defense is based on the intuition confidence is defined by trust (a quote from Patrick Mosher). In this case, however, we would look at confidence and trust from the perspective of AI. We propose to use a trust evaluation module at the edge layer that could evaluate the trust of the pre-trained AI encoder or a fine-tuned LLM with a predefined metric. One of the examples of such a trust evaluation is as follows, assuming the fine-tuned LLM is trained for medical emergency services using a 6G network.

    
  * The LLM is fine-tuned on less number of epochs and a smaller amount of data. The responses do not ask for age or personal information. Results in 88% for the performance metric.
    
  * The LLM is fine-tuned on a large amount of data and high number of epochs. The responses do not ask for age or personal information. Results in 89% for the performance metric.
    
  * The LLM is fine-tuned on a large amount of data and high number of epochs. The responses asks for personal information. Yields 92% on performance metric. 

Given the scenario described above, a trust module might favor the first model as it is less vulnerable to membership leakage attack. The idea is simply to prioritize a fine-tuned LLM for 6G services based on trustworthiness and confidence scores.



§ OPEN ISSUES, CHALLENGES AND FUTURE DIRECTIONS


The integration of 6G and LLMs can be seen as task-oriented communication services, where integration is achieved by utilizing resources from the communication infrastructure, the edge and mobile devices. In return, users receive LLM agents that can perform certain actions, generate data or call application programming interface (API) functions. As already indicated, such integration can lead to security vulnerabilities, including the theft of personal information and more. We have emphasised the importance of a trust module for considered integration, but designing such a trust module can present some challenges. These challenges include, but are not limited to, the following.

(i) Active Learning and Curriculum Learning approaches: One of the ways to cope with membership leakage or inference attack is to use less amount of data and number of epochs for fine-tuning. In this regard, two approaches can be opted for making this possible. The design of trust module needs to favor the model with aforementioned characteristics, however, design of such methods can be a challenge that could help in resisting the attack while not compromising on the performance. 

(ii) Multimodal LLMs: In this paper, we have focused on the LLMs that only work with text data. In reality, users opt for multimodal LLMs that can generate text, images and audio. Each modality has its own security issues when it comes to pre-trained AI encoders. However, it would be quite a challenge to design a trust module for 6G and LLMs that is suitable for different data modalities.

(iii) User Privacy: Similar to the design of trust modules for different data modalities, training processes, architectural modifications, and encryption techniques must be used to improve user privacy. Various attacks such as model inversion, model poisoning, gradient leakages, and adversarial attacks can be used by attackers to disrupt the services and steal users' private information in 6G networks. Therefore, in addition to data modality, the trust module must also defend against various privacy attacks.
 
(iv) Latency and Bandwidth Issues: We focused primarily on the trustworthiness of the pre-trained AI encoders. However, the fine-tuning of the LLMs and the deployment of the trust module could burden the services in terms of latency and increased bandwidth. In this context, the selection of suitable models for specific applications, scenarios and needs as well as optimization during deployment must also be researched.

(v) Responsible AI: Finally, this study explores the trust module in the context of security and privacy. The trust module can be explored in the context of responsible use of AI so that hallucinations in the generation of data modality could be controlled or restricted to prevent the spread of misinformation, identity-related attacks and impersonation.



§ CONCLUSION

This article explores the use of LLM deployment in accordance with the 6G MEC framework. We evaluate the trustworthiness of fine-tuned models to be deployed as services in 6G networks. We discuss in detail about membership leakage and inference attacks with respect to the textual modality and show that the attacks are quite effective in violating user privacy. We propose possible defense mechanisms to cope with the membership inference attacks and give several open issues, challenges, and research directions for the development of a generalization trust module for LLM deployment in the 6G-MEC framework. We believe that this paper provides researchers with the foundation for developing trustworthy LLMs for services in 6G networks. 







IEEEtran


















 Paper Title: Domain Shift Analysis in Chest Radiographs Classification in a Veterans Healthcare Administration Population.








    Curvature-Adapted Hypersurfaces of 2-type

in non-flat quaternionic Space Forms
    Ivko Dimitrić
    
===============================================================================


    ^1 Advanced Computing for Health Sciences, Computational Sciences and Engineering Division,
 Oak Ridge National Laboratory 

     ^2 IT Services Division, Oak Ridge National Laboratory 

     ^3 Veteran Affair's Association 

     ^4 Los Alamos National Laboratory 

     ^5 Yale University 

     ^6 Stanford University 

     ^7 Department of Biomedical Informatics, Vanderbilt University Medical Center 

     ^* Corresponding Author Email: chandrashekm@ornl.gov
     

§ ABSTRACT 

Objectives: This study aims to assess the impact of domain shift on chest X-ray classification accuracy and to analyze the influence of ground truth label quality and demographic factors such as age group, sex, and study year.

Materials and Methods: We used a DenseNet121 model pretrained MIMIC-CXR dataset for deep learning-based multilabel classification using ground truth labels from radiology reports extracted using the CheXpert and CheXbert Labeler. We compared the performance of the 14 chest X-ray labels on the MIMIC-CXR and Veterans Healthcare Administration chest X-ray dataset (VA-CXR). The VA-CXR dataset comprises over 259k chest X-ray images spanning between the years 2010 and 2022. 

Results:
The validation of ground truth and the assessment of multi-label classification performance across various NLP extraction tools revealed that the VA-CXR dataset exhibited lower disagreement rates than the MIMIC-CXR datasets. Additionally, there were notable differences in AUC scores between models utilizing CheXpert and CheXbert. When evaluating multi-label classification performance across different datasets, minimal domain shift was observed in unseen datasets, except for the label "Enlarged Cardiomediastinum." The study year's subgroup analyses exhibited the most significant variations in multi-label classification model performance. These findings underscore the importance of considering domain shift in chest X-ray classification tasks, particularly concerning study years.

Conclusion:
Our study reveals the significant impact of domain shift and demographic factors on chest X-ray classification, emphasizing the need for improved transfer learning and equitable model development. Addressing these challenges is crucial for advancing medical imaging and enhancing patient care.





 Notice: Office of Science of the U.S. Department of Energy. This manuscript has been authored by UT-Battelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript, or allow others to do so, for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (http://energy.gov/downloads/doe-public-access-plan). 





§ INTRODUCTION



Chest radiography is the first-line imaging test for respiratory disease and some forms of cardiac disease. Chest X-ray abnormalities detection has been automated by recent advanced artificial intelligence techniques. Accurate chest X-ray classification has played an important role in many biomedical applications to accelerate the diagnosis and treatment of conditions like pneumonia, heart failure, rib trauma, pulmonary fibrosis, etc. Though there has been an increase in the integration of machine learning models to enhance diagnostic promise, the efficacy of these models hinges on the availability and quality of training data. 

Recent years have seen a wave of artificial intelligence (AI) and machine learning models for clinical applications from large research medical centers or based on limited de-identified datasets. The introduction of transfer learning has resulted in AI models being accessible to researchers with fewer computational resources and less data, allowing them to leverage existing knowledge. Transfer learning is the ability to apply a model trained on a dataset to another dataset of interest.  A major consideration for transfer learning is domain shift, the dissimilarity between data distributions from the source used for training and the population to which the models are applied. This divergence between publicly available datasets and private, institution-specific datasets can introduce substantial bias and hinder the generalization of machine learning models to real-world scenarios.

In this study, we quantify the domain shift between the public domain (MIMIC-CXR) and a private dataset (VA-CXR). The efficacy of the transfer learning approach for chest X-ray classification and the subsequent impact on classification accuracy when dealing with domain shift form the main focus of this study.  The domain shift is traditionally viewed only based on the model and its performance, ignoring the multi-fold causes leading to the shift. We comprehensively address the effects of domain shift in this three-stage study: 1) Compare the performance between the source domain and target domain accuracy on the chest X-ray classification. 2) Quantify the quality of the ground truth extracted from the radiology reports, as supervised learning models are heavily dependent on the quality of the labels.  3) Analyze the relationship between demographic factors and classification accuracy, as domain mismatches often originate in demographic mismatches. 

By addressing the critical interplay of domain shift and demographic factors, this study not only provides insights into the technical challenges of adapting machine learning models to private datasets but also underscores the broader implications of these challenges in the context of healthcare. Our research contributes to developing more accurate, robust, and generalizable chest X-ray classification models by creating a systematic approach for using an existing model and understanding the nuances of a model's performance before applying it to a new population. 




§ METHODS





 §.§ Dataset

MIMIC-CXR is a publicly available dataset of 377,110 chest X-rays associated with 227,827 imaging studies from 65,379 patients. MIMIC-CXR is collected from the inpatient setting of Beth Israel Deaconess, a Boston hospital. (refer Table <ref>) We also use the test-split of this dataset (Test-split MIMIC-CXR) as the hold-out set analysis, which consists of 5159 studies with 293 patients <cit.>. 

VA-CXR is a private dataset of 259,361 chest X-rays associated with 91,020 imaging studies from 35,771 patients. VA-CXR is collected in the outpatient setting of the Boston Veterans Healthcare Administration station (refer to Table <ref>). The ground truth labels were extracted from the VA's corporate data warehouse (CDW) and joined with images using patient information from DICOM headers as published in Knight et al. <cit.>.   






 §.§ Ground truth Label Extraction


We used the CheXbert labelers <cit.> to expertly assign labels to 14 specific labels (Atelectasis, Cardiomegaly, Consolidation, Edema, Enlarged Cardiomediastinum, Fracture, Lung Lesion, Lung Opacity, No Finding, Pleural Effusion, Pleural Other, Pneumonia, Pneumothorax, Support Devices) associated with different chest conditions from radiology reports. CheXbert is a BERT-based approach that automates the detection of these observations, effectively streamlining the process of annotating medical images and reports. The NLP label extraction outputs scores for four classes: positive, negative, blank, and uncertain, associated with each of the 14 labels. As the class names indicate, for example, for Pneumonia, positive class: radiology report indicates that the patient has Pneumonia; negative class: radiology report indicates that the patient doesn't have  Pneumonia; uncertain class: radiology report mentions  Pneumonia but NLP tool unable to determine if it is positive or negative; blank class: radiology report doesn't mention  Pneumonia.



 §.§ Label Validation

Because ground truth assignment ultimately determines the accuracy of the imaging classifiers, we developed an image evaluation procedure in two steps. First, we evaluated the agreement between the NLP label extraction tool, CheXbert, and its precursor, CheXpert <cit.>, a rule-based tool. We focused on positive class agreements for our evaluation, using only positive classes for classification, and have combined uncertain/negative class agreements. The disagreement between NLP label extraction tools indicates ambiguity/ less confidence on the labels, ultimately creating an unreliable ground truth. The agreement is measured for both MIMIC-CXR and VA-CXR datasets; Of note that neither of the datasets was used to train the NLP extraction tools. 




  §.§.§ Relation to Diagnoses Codes

To validate the ground extracted from chexpert-labeler, we analyzed the relationship of specific ground truth labels to ICD codes in the patient's electronic health record (EHR) extracted from the VA's Corporate Data Warehouse (CDW).The assignment of ICD-9 and ICD-10 diagnosis codes associated with each condition was exploratory and not extensively optimized. 

Starting concepts were retrieved from the Chexpert-labeler github repository , where phrases they used to search notes can be found at https://github.com/stanfordmlgroup.  These phrases, along with our own expertise, were used to identify diagnosis codes and cross-reference radiology reports with diagnoses.For example:   Pneumonia was identified by chexpert-labeler as indicated by pneumonia, infection, infected process, and infectious; 
Edema was indicated by terms edema, heart failure, chf, vascular congestion, pulmonary congestion, indistinctness, and vascular prominence; Fracture was indicated solely by the word fracture; and Pneumothorax was identified by either pneumothorax or pneumothoraces.

This method enabled us to validate the ground truth labels by correlating them with the relevant ICD codes in the patients' EHRs, ensuring accurate cross-referencing of radiology reports with diagnoses.

For instance, the ICD-9 codes we used to indicate a pneumonia diagnosis in the outpatient diagnosis tables ranged from 480 to 486 and included 487.0. These codes encompass viral, bacterial, and other types of pneumonia, as well as pneumonia caused by unspecified pathogens. A similar approach was applied to ICD-10 codes for pneumonia and other conditions. The specific ICD codes used for each condition are detailed in Appendix Table <ref>.



 §.§ Multi-label Image Classification


Using the 14 labels extracted from the corresponding radiology reports with CheXbert, we created a multi-label image classification model from X-ray images. We used a pre-trained DenseNet model<cit.> as the core framework, removed the top classification layer, and integrated a custom classification layer for multi-label output. 
Previous work shows the effectiveness of different resolutions of DenseNet-121 based multi-label classification chest X-ray model on MIMIC-CXR dataset  <cit.>. This work uses the MIMIC-CXR trained DenseNet-121 Model on Chest X-ray pre-processed into 256x256 JPG images <cit.>. 




 §.§ Metrics

We evaluated our models using the Area Under the Curve (AUC). The AUC score was calculated separately for each of the 14 labels, indicating the separability measure for a given chest X-ray label. 
We also analyzed the difference in AUC scores between MIMIC-CXR and VA-CXR, and the prevalence for each label was calculated as the number of studies with positive results for a given label divided by the total number of labels, indicating the label's presence in the given cohort. 




 §.§ Domain Shift Analysis

We compared our source and target datasets along different dimensions: 1) Demographic Details: Age At Time of Imaging Study, Sex; 2) Imaging Study Details: Study Year, View  Point (Lateral view (Lat), erect anteroposterior (AP), posteroanterior (PA)) ; 3) Ground truth Labels: 14 labels. All the factors were analyzed against the accuracy of multi-label image classification. 
The impact can be estimated by comparing the prevalence of the above-listed factors across source and target domains with the performance of the multi-label classification. 

The subgroup analysis is performed on unseen datasets: Test Split MIMIC-CXR and VA-CXR. 


Study Year Analysis: We obtain the study year from VA-CXR studies date reported in DICOM headers.  The MIMIC-CXR dataset is unidentified; study years are replaced by anchor years. The comparison of performance across study years between the datasets isn't possible, so we don't present a study year analysis on the MIMIC-CXR dataset. 


Performance Analysis based on Sex: We obtain the sex of the patients in VA-CXR from the VA's corporate data warehouse (CDW) and the patients in MIMIC-CXR from the metadata. Sex is only classified into binary classes of male and female. We analyze the label-wise performance for each sex across both datasets. 


View Position Analysis: We obtain the view position of the images from the DICOM metadata. We use four main viewpoints for analysis: Lateral view (Lat), erect anteroposterior (AP), posteroanterior (PA))  and Left Lateral view (LL). We compare the label-wise performance across both datasets


Age Group Analysis:
We define the age of the patient as the age when the imaging study was performed. For VA-CXR, this age was calculated from the date of birth obtained from VA CDW and the date of imaging study from DICOM metadata. For MIMIC-CXR, we calculated age using the anchored date of birth and anchored imaging study date. The anchored dates were amended in a manner that the difference in years is constant, so we were able to approximate the age of the patient. The label-wise performance for both datasets was compared across six age groups: (0-50], (50-60], (60,70], (70,80], (80,90], and (90,100]. 



§ RESULTS




 §.§ Ground truth Label Validation

Table <ref> presents a comprehensive analysis of agreement and disagreement rates between Chexpert and Chexbert on the MIMIC-CXR and VA-CXR datasets across the 14 labels. The results shed light on the performance and consistency of Chexpert and Chexbert and the uncertainty of the ground truth labels. Notably, in MIMIC-CXR, Atelectasis was identified in 19.5% of cases with a disagreement rate of 10.1%, whereas in VA-CXR, the identification rate was lower at 9.8% with a disagreement rate of only 0.7%. This discrepancy in positive identification and disagreement rates is further exemplified in conditions like Cardiomegaly, where MIMIC-CXR reported positive identification in 15.7% of cases with a significant disagreement rate of 39.1%, contrasting with VA-CXR's 9.3%  positive identification rate and 13.7% disagreement rate.









 §.§ Comparison with Diagnosis Codes


While the X-ray classification accuracy was evaluated against the label extracted using NLP of the appropriate radiology report, it is possible also to compare directly against diagnosis codes in the clinical record.  However, interpreting this comparison is challenging due to two main issues: first, diagnoses are based on a broader range of information beyond just the X-ray, and second, patients may have multiple conditions, making it difficult to determine the specific reason each X-ray was ordered. Despite these challenges, we have conducted two useful comparisons of X-ray findings against diagnosis codes for nine categories within our dataset.

The top of Figure <ref> shows the fraction where a diagnosis related to the label was recorded within a week (either before or after) of the X-ray, compared to the total number of patients, including those who never had the diagnosis. Patients who had the diagnosis but not within the one-week window were excluded from this calculation. This plot, labeled 'Sensitivity,' reflects the proportion of cases where a diagnosis occurs within a week of noting the condition in the X-ray.  
We observe a positive finding on an X-ray, as extracted from the radiology report, which is mostly associated with a specific diagnosis of pneumonia and edema and frequently associated with pleural effusion and pneumothorax.  We also see that the ChexBert model is more frequently associated with a corresponding diagnosis than the ChexPert model.



The bottom of Figure <ref> compares the factor by which the enrichment ratio of positive finding in the radiology report increases with a concurrent (within one week) diagnosis.  Pleural effusion, for example, is seen 10 times more frequently in the radiology report when a concurrent diagnosis code is noted.  It is also true, however, that 2/3 of the pleural effusion diagnoses are not accompanied by a positive finding in a radiology report, as shown in the top bar chart, and also that 90% of the time a negative finding is made, no diagnosis is found.  We see that the conditions with the highest enrichment ratios differ from those with the highest sensitivities, but the trend that the ChexBert model generally outperforms the ChexPert model by a few to 20% remains.

Several factors were observed to contribute to the quantitative comparison of labels extracted from the radiology reports to the observed diagnoses, including the extent to which diagnosis codes could be found that correspond well to the radiology report finding, whether the X-ray is a screening or confirmatory test, the prevalence of the condition, and the chronic vs. acute nature of the condition.  We provide this figure as a survey across these factors and present the complete set of counts in Appendix Table <ref>.  Specific ICD 9 and 10 codes used for each condition are provided in the Appendix Table <ref>.





 §.§ Multi-label Image Classification on VA-CXR across NLP tools


Table <ref> compares ground truth extraction techniques, specifically focusing on the label-wise performance metrics on the VA-CXR dataset. Two techniques, ChexPert and ChexBert, are evaluated based on their Area Under the Curve (AUC), prevalence, and count across 14 labels. Across the findings, both techniques generally demonstrate similar AUC values, indicating comparable performance in distinguishing positive cases. For instance, in identifying Atelectasis, both ChexPert and ChexBert exhibit AUC values around 0.80, with similar prevalence and count numbers. Notably, in the case of Cardiomegaly, ChexBert shows a notably higher AUC of 0.862 compared to ChexPert's 0.753, suggesting potentially superior performance in this specific finding. However, the prevalence and count metrics vary across the findings and between the two techniques. For example, ChexPert tends to have higher prevalence and count values for several findings like ECM (Enlarged Cardiomediastinum), while ChexBert shows higher values for others such as Pleural Effusion. 




 §.§ Multi-label Image Classification Performance across multiple datasets


Table <ref> shows the comparison of MIMIC-CXR (Source dataset), Test Split MIMIC-CXR (Hold-out Source Dataset), and VA-CXR based on AUC on the 14 labels.  The Hold-out Source dataset is the test split of MIMIC-CXR dataset,  DenseNet-121 Model. The Test Split of MIMIC-CXR gives us a fair comparison to VA-CXR, the unseen target dataset. This can be observed based on the AUC drop from the overall MIMIC-CXR to test-split. In Table <ref>, the difference in AUC between Hold-out and Target indicates the performance variation between VA-CXR and Test Split of MIMIC. The Negative value of the difference in AUC indicates that the VA-CXR performs better than the Test Split MIMIC-CXR, and the positive value indicates that the Test Split performs better. The Enlarged Cardiomediastinum (ECM) label has the highest difference in AUC, indicating a huge performance drop in VA-CXR. This could directly impact the lack of a large number of image studies in ECM in the source dataset compared to the target. 






 §.§ Study Year-wise Performance on VA-CXR 

Table <ref> shows the label-wise distribution of the study years. The AUC systematically drops as for study year 2020 to 2022 for all labels except Consolidation and Pleural Other, which peaks at 2020. The prevalence increases over the years in VA-CXR for Atelectasis, Enlarged Cardiomediastinum, and Pleural Effusion. 








 §.§ Performance across datasets based on Sex

Figure <ref> compares the label-wise AUC and prevalence of the two sexes across the Test Split MIMIC-CXR and VA-CXR. This comparison is essential as the female-male patient ratio in VA-CXR is higher than that of MIMIC-CXR; dashed lines in the figure <ref> can observe this. 







 §.§ View Position-wise across datasets

Figure <ref> compares labels across Test-Split MIMIC-CXR and VA-CXR. The VA-CXR doesn't contain any Lateral images; the figure shows only MIMIC-CXR performance on the Lateral. The prevalence and AUC of viewpoints vary based on the label, with ECM having the most difference between the datasets. Pleural Other has a drop in performance in VA-CXR in AP view position, potentially due to low prevalence in both datasets. 
 






 §.§ Age Group-wise comparison across datasets

Figure <ref> shows the VA-CXR prevalence increase as the age increases across all labels except No Finding, Lung Lesion, and Pneumothorax.  The highest performance drops of 0.15 to 0.2 AUC  in VA-CXR compared to the Test Split of MIMIC-CXR can be observed in Enlarged Cardiomediastinum and Support Devices. In VA-CXR, it is interesting that the AUC performance across the age groups is more stable, i.e., there is not much change in AUC, with the exception of Atelectasis.  








 §.§ Summary

As seen from the results, the ground truth validation and multi-label classification performance across the NLP extraction tools showed that though the VA-CXR dataset has lesser disagreement rates than the MIMIC-CXR datasets, and there were AUC differences between models when using ChexPert and ChexBert (potentially propagated by distribution differences). When comparing the multi-label classification performance on different datasets, the unseen datasets didn't show domain shift other than a few labels such as Enlarged Cardiomediastinum. Among the different subgroup analyses, the study year had the most drastic differences in the performance of the multi-label classification model. These differences indicate that the domain shift is definitely of concern in study years.




§ DISCUSSION


Our study quantified the domain shift between a publicly available critical care dataset (MIMIC-CXR) and an outpatient, private institutional dataset (VA-CXR), assessing the efficacy of transfer learning for chest X-ray classification.  Because domain shift encompasses multifaceted factors, our comprehensive study was structured into three interrelated parts: the quality of ground truth, performance comparison, and subgroup analysis. 

Quality of Ground Truth 
Supervised learning models heavily rely on the quality of labels for training. Therefore, we quantified the ground truth quality extracted from radiology reports in both datasets. Despite being a source dataset, MIMIC-CXR exhibited significantly higher disagreement rates between the two ground truth information extraction NLP algorithms than the target, VA-CXR dataset. The potential performance drift of the target can be attributed to the mismatch of ground truth extraction methods. Our analysis underscored the importance of high-quality annotations in mitigating the effects of domain shift <cit.> and improving model performance.

Performance Comparison: 
We compared the difference in classification performance between MIMIC-CXR and VA-CXR to understand the extent of domain shift and its implications for model generalization. Our findings revealed notable variability in classification accuracy, highlighting the challenges posed by domain shift. We observe that the prevalence and performance were directly associated; for example, MIMIC-CXR's enlarged cardio mediastinum low prevalence may be the reason for its low performance. 

Subgroup analysis 
Subgroup analysis using demographic factors is crucial as we expect our populations to have different demographic distributions <cit.>. 
We observed a decline in the performance of the VA-CXR dataset over time, particularly in the years following 2020. This drop may be due to differences in the study years between the source dataset (MIMIC-CXR) and the VA-CXR dataset, as well as potential impacts from the pandemic years (note: we did not evaluate additional labels related to the pandemic).
We observed that both groups, though with different distributions, have aging populations across conditions of interest. Still, the prevalence of most conditions with age increases in the VA-CXR dataset, but it is highly variable in MIMIC-CXR.  For sex subgroup analysis, the performance was similar across the female and male populations in the datasets. Though the VA-CXR population is skewed towards the male population, the model performed well on the female population. This can be attributed to the source domain (MIMIC-CXR) having a balanced male-to-female ratio. 
For the view-based subgroup, we observed high variability between the views. This behavior can be attributed to the necessity of specific views for accurately diagnosing certain diseases. For instance, conditions such as Pneumonia and ECM primarily rely on PA (Posteroanterior) or AP (Anteroposterior) views for diagnosis.

Chest radiography is a first-line imaging modality for assessing lung and heart conditions. With advanced artificial intelligence techniques, the automation of chest X-ray abnormality detection has seen significant progress <cit.>. This has accelerated the pace of diagnosis and treatment and opened avenues for exploring biomedical applications in various clinical settings. However, the efficacy of these machine learning models heavily relies on the quality and availability of training data <cit.>.


Clinical relevance
Despite the surge in artificial intelligence and machine learning applications in clinical settings, their adoption has been uneven, primarily due to disparities in funding<cit.>, expertise, and availability of computing resources. While academic medical centers have been at the forefront of AI adoption, the accessibility of such resources remains a challenge for smaller research institutions. Introducing transfer learning has mitigated some of these challenges by enabling researchers to leverage pre-existing models trained on publicly available datasets for their specific applications. However, transfer learning introduces the concept of domain shift, which poses a significant obstacle to achieving robust and generalizable models.

Potential Workflows
While we primarily focused on matching image classification to known findings typical of chest X-rays and extracted those from radiology reports using NLP, this may not be the best workflow with which image classification can be incorporated into a medical outcomes workflow.  Tiu, et al. have noted the difficulties and inaccuracies associated with training chest X-ray classifiers against such labels and demonstrated improved accuracy and efficiencies with a self-supervised workflow to train their image classification model.<cit.>.  Even more ambitiously, they argue in Reference <cit.> that all modalities of data should be co-optimized in a much broader framework, known as a foundation model.  Our observations in Figure <ref> that most of the X-ray findings do not map directly onto diagnoses support the idea that more flexible workflows may be required to optimally incorporate AI-based image classification into medical outcome prediction.

By systematically addressing the challenges of domain shift and demographic factors, our study contributes valuable insights to developing more accurate and robust chest X-ray classification models. Furthermore, our findings have broader implications for healthcare, emphasizing the importance of understanding and mitigating biases in machine learning applications to ensure equitable healthcare delivery. Our research serves as a foundation for future studies aimed at refining transfer learning techniques and enhancing the generalizability of machine learning models in clinical practice.

Limitations
It is crucial to acknowledge that the data for the two studies were collected under significantly different clinical settings, which may influence the outcomes. The MIMIC database primarily includes inpatient data, where patients may be more critically ill, as indicated by the prevalence of portable anteroposterior (AP) images that tend to be less precise. In contrast, the VA outpatient population likely represents individuals who are relatively less ill, with higher-quality image data collection due to the setting's focus on outpatient care. Although we were unable to assess these differences quantitatively, we hypothesize that the clinical setting could substantially impact the performance of our models, influenced by the severity of diseases and other contextual factors.





§ CONCLUSION

In conclusion, our study sheds light on the critical interplay between domain shift, demographic factors, and the efficacy of transfer learning in chest X-ray classification. By quantifying the domain shift between a publicly available dataset and a private institutional dataset, we have identified disparities in classification accuracy and highlighted the challenges posed by transferring models across domains. Moreover, our analysis of demographic factors underscores the importance of considering population diversity in model development to ensure equitable healthcare outcomes. Moving forward, addressing these challenges will require concerted efforts to improve data quality, develop robust transfer learning techniques, and enhance the generalizability of machine learning models in clinical practice. Ultimately, by fostering a deeper understanding of these complexities, our research paves the way for the development of more accurate, reliable, and accessible chest X-ray classification models with the potential to transform patient care and advance the field of medical imaging.



§ ACKNOWLEDGMENTS

This work is sponsored by the US Department of Veterans Affairs using resources from the Knowledge Discovery Infrastructure which is located at the Oak Ridge National Laboratory and supported by the Office of Science of the U.S. Department of Energy. This manuscript has been authored by UT-Battelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript or allow others to do so for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (
http://energy.gov/downloads/doe-public-access-plan
). 






 
 



§ APPENDIX:




 §.§ Age When Image was Taken versus Study Year














 Paper Title: Ontological Relations from Word Embeddings.





















Ontological Relations from Word Embeddings
    Mathieu d'Aquin and Emmanuel Nauer

K Team, LORIA, Université de Lorraine

Nancy, France
    August, 2024
============================================================================================



§ ABSTRACT 
It has been reliably shown that the similarity of word embeddings obtained from popular neural models such as BERT approximates effectively a form of semantic similarity of the meaning of those words. It is therefore natural to wonder if those embeddings contain enough information to be able to connect those meanings through ontological relationships such as the one of subsumption. If so, large knowledge models could be built that are capable of semantically relating terms based on the information encapsulated in word embeddings produced by pre-trained models, with implications not only for ontologies (ontology matching, ontology evolution, etc.) but also on the ability to integrate ontological knowledge in neural models. In this paper, we test how embeddings produced by several pre-trained models can be used to predict relations existing between classes and properties of popular upper-level and general ontologies. We show that even a simple feed-forward architecture on top of those embeddings can achieve promising accuracies, with varying generalisation abilities depending on the input data. To achieve that, we produce a dataset that can be used to further enhance those models, opening new possibilities for applications integrating knowledge from web ontologies. 





§ INTRODUCTION


Word embeddings <cit.> are vector representations of words in a text, used, in particular, to perform learning tasks in natural language processing. Many of the embeddings used today are produced by neural (large) language models such as BERT <cit.>. These are neural network models trained on particular tasks (such as masked-language modelling, i.e. predicting masked tokens in a given text) and from which selected hidden layers can be used as embeddings. Interesting properties have been demonstrated for embeddings produced by different models, in particular, in representing the meaning of the words within the embedding space. For example, words that are semantically similar have been shown to generally have similar embeddings <cit.>. The main question that is asked in this paper is whether they encapsulate enough information to cover relations beyond semantic similarity. We particularly want to check whether embeddings from various models could be used to derive ontological relations between entities represented by their labels, such as the subsumption relation (subclass, subproperty), equivalence, or the ones connecting properties to their domains and ranges. 

To achieve that, we test whether simple models taking as input the average embeddings of the names and comments of classes and properties from popular upper-level and general ontologies are capable of predicting the relations (direct or inferred) existing between those entities. We constitute a dataset of relations (materialised by inference at the level of RDF entailment rules <cit.>) from five of those ontologies, having computed the embedding vectors for each entity in each ontology using four different (transformer-based) models. 

We obtain promising results with respect to the accuracy of the prediction, demonstrating the potential for knowledge models capable of encapsulating and extrapolating ontological relations in large open domains. We also study the generalising ability of each model by cross-validating them against each other's ontologies and report on the performance of a combined model, providing a first baseline for future work to build upon, using other larger language models, different architectures, and integrating more ontologies in their training set.





§ RELATED WORK


A lot of attention has been given recently to the whole area of knowledge graph embeddings (see, for example, <cit.>) in particular for their use in link prediction tasks (see, for example, <cit.>). Knowledge graph embeddings are methods (often based on neural models) to project the graph representation available in knowledge graphs onto a vector space in a way that should align with the structure and meaning of the graph. They are often used for link prediction, i.e. the task of predicting which entity might be related to which other in a graph since, by encapsulating patterns in the existing graph, they should be able to discover where missing relations might exist. These two categories of work are closely related to the work presented in this paper since they relate to the prediction of relations between entities in knowledge structures through the use of embeddings. Here, however, we focus on ontological relations as predictable from word embeddings applied to the textual representation of the entities. In other words, while knowledge graph embeddings, in a sense, distill the content of a graph to find ways to complete it, we aim to exploit knowledge already captured by pre-trained language models through word embeddings to predict ontological relations between classes and properties of web ontologies. 

Following the work on knowledge graph embeddings, ontology embeddings have been proposed that focus on the OWL language <cit.> or on particular description logics <cit.>. While ontological relations are considered, those works aim to create representations similar to knowledge graph embeddings but that are capable of capturing the semantics of higher-level formalisms used for ontologies. They therefore also accomplish a different task from the one endeavoured here, even if it is strongly related and possibly complementary. 

Much closer to our work are a few proposals for predicting ontological relations between entities using language models, generally or in specific domains (such as biomedicine <cit.>). Much of these works tend to focus on the subsumption relation and on placing classes in the hierarchy of an ontology (see, for example, <cit.>), while our aim is to predict a wider set of relations. In addition, they often rely on a so-called probing process to exploit the language model <cit.>. This means that at least a part of the process is based on generating a prompt to a large language model and analysing the generated textual output to identity relations between entities mentioned in the prompt. What we propose here is more straightforward (add prediction layers on top of word embeddings extracted from the language models) and less dependent on necessarily noisy prompt generation and result interpretation mechanisms. Other approaches (such as <cit.>) go through the step of fine-tuning the language model used for the task of predicting subsumption (sometimes based on a number of domain-specific ontologies <cit.>), introducing a high demand for computational resources. 



§ OVERVIEW






Figure <ref> provides an overview of the approach taken to predict ontological relations that might exist between two entities, represented as texts by their short name (the last part of their IRI) and comments in English (if they have one). 
The texts of the short name and of the comment of each entity are first run through a language model (in Section <ref>, we describe the four we tested) to obtain word embedding vectors for each of them, i.e. a word embedding is computed for each word of the short name and comment. To reduce those to one vector for each entity, we apply a mean-pooling operation, resulting in an average embedding for the entity, based on its textual representation. We then train a simple neural model made up of a few small fully connected layers with reLU activation functions (the number depends on the language model used and the input data, as discussed in Section <ref>). As there are 20 relations that can be predicted, which include directly stated relations (subclass, subproperty, equivalence, disjointness, domain, range), as well as their inverse relations (superclass, superproperty, etc.) and indirect or inferred versions of those relations, an output layer of size 20 is then constructed with a sigmoid activation function. It is compared for training, through a cross-entropy loss function, to the 20-sized binary vector which encodes the real relations existing in the input data. This architecture was chosen to be relatively simple and straightforward to setup, based on the idea that if interesting results can be obtained in predicting ontological relations with such an architecture, it will form a baseline for potentially more sophisticated models to improve upon. 

To carry out experiments on training such an architecture, labelled data need to be obtained. In the next section, we describe how we constructed datasets that associate average embeddings of the textual representations of pairs of entities with binary vectors representing their asserted and inferred relations in five different upper-level and general ontologies. We then discuss in Section <ref> the results of training, validating, and testing relation prediction models using different inputs (from the different ontologies and using the different language models), and evaluate those results using precision, recall, and F-score. 



§ DATASET GENERATION



In this section, we detail how datasets are created for the training and validation of relation prediction models. We start by describing the ontologies used and the process of extracting relations from those ontologies. We then briefly introduce the language models used to extract embeddings of the textual representation of entities, and finally what is included in the generated datasets. The generated datasets and intermediary structures computed to construct them are available on FigShare[<https://figshare.com/s/b216348f194ebad9d501>] and the code to generate them from an N-Triples file containing an ontology is available on github.[<https://anonymous.4open.science/r/LKM-B71B>]



 §.§ Ontologies



As a basis for training and validation, we selected five ontologies. The reason for using those five is that, considering that the language models used were trained on open-domain texts, they should be better able to predict the relations existing in ontologies that are not specific to a particular domain. In other words, they rely, in the textual representation of the included entities, on a general vocabulary rather than a specialised one. We therefore used two upper-level ontologies and three general ontologies (i.e. domain-level ontologies but for the general domains). 

    
  DUL (upper-level): The DOLCE+DnS Ultralite <cit.> (DUL) ontology combines elements from the Descriptive Ontology for Linguistic and Cognitive Engineering (DOLCE) with the DnS (Descriptions and Situations) ontology patterns to provide a framework for interoperability between ontologies.
    
  gUFO (upper-level): gUFO[<https://nemo-ufes.github.io/gufo/>] is a lightweight implementation of the Unified Foundational Ontology (UFO) used for the development and integration of domain ontologies.
    
  OpenVocab (general): OpenVocab[<https://vocab.org/open/>] was an initiative to create a community-maintained general vocabulary. The editing interface has been closed, but an RDF version of the resulting vocabulary remains available.
    
  Schema.org (general): Founded by Google, Microsoft, Yahoo, and Yandex, schema.org <cit.> is a community-driven initiative to create schemas for structured data on the Web that can be used, in particular, by search engines to provide more precise and relevant results. 
    
  DBpedia (general): The DBpedia ontology[<https://www.dbpedia.org/resources/ontology/>] is the core ontology used to describe entities in the DBpedia knowledge graph. Originally created manually from common properties of Wikipedia infoboxes, it is now a regularly evolving community effort. 


These ontologies were downloaded from the most authoritative links that could be found for them in their latest version. A metadata file is included in the data repository for this paper indicating from which link they were obtained and at what date. The process described below to extract textual representations for and relations between the entities in those ontologies requires as input an RDF file in the N-Triples syntax. Some of those ontologies were, therefore, first converted into this format. 



 §.§ Extracting relations from ontologies



The first part of the process of creating a dataset of relations between entities contained in the considered ontologies is to extract such relations, as well as those that can be derived from them. Some of the ontologies considered are relatively large (including a few thousand classes and properties), and relations between potentially every pair of entities had to be considered. To minimise the time to search the relations between two entities, each ontology is represented by a large n×n matrix where n is the number of entities, and each cell of the matrix contains an integer where each bit represents one of the 20 possible relations we considered (e.g. a cell containing 0 means that there is no relation between the two entities). 

In order to include inferred relations as well as directly stated ones, we included in the process calls to an ad hoc forward chaining rule engine relying on rules to derive inverse relations from stated ones and to implement a relevant subset of RDF-S entitlements <cit.> (e.g. the transitivity of the  relation). Furthermore, as the matrix is created, each entity encountered is added to a table that associates with the IRI of the entity its index in the lines and columns of the relation matrix, as well as, if found, its English label and comment (based on the  and  properties). Table <ref> summarises the 20 relations considered and their frequency in the created datasets from each of the considered ontologies. Note, however, that the relations in DBpedia were randomly sampled to reduce their number and rebalance them, since some were significantly more represented than the others. Also, schema.org appears not to include domain and range relations, as those are made, in that ontology, with anonymous classes.





 §.§ Pre-trained Language Models for Word Embedding



In the process presented in Section <ref>, we rely on a selection of popular language models to test which are more efficient in re-creating ontological relations. All those language models are pre-trained by their original authors and built on different architectures, although they are all neural models based on transformers, as summarised below. There are a number of other language models that could have been used and could be added in the future, but those represent a reasonable selection of what is openly available today. 

To extract embedding vectors for textual representations of classes and properties of ontologies with these models, we used the huggingface transformers library in Python[<https://huggingface.co/docs/transformers/en/index>]. In more detail, for every entity included in an index for an ontology, we first run the tokenized shortname of the entity through the model, obtaining an “in context” embedding vector for each of the words in the shortname by extracting the activations of the last layer before output (last hidden states). We reduce this set of vectors to one by averaging them (the mean-pooling step in Figure <ref>). We apply the same process to the  of the entity if it has one, and average the name and comment vectors to obtain a final embedding vector of the textual representation of the entity. As a result, our process leads to a dataset including an embedding vector from each of the four language models for every class and property in each of the five ontologies considered here.  


    
  BERT: BERT <cit.> (Bidirectional Encoder Representations from Transformers) was introduced by Google in 2018 and quickly became a reference language model for many tasks. It has the particularity of considering textual contexts in both directions (forward and backward). It was mostly trained on BooksCorpus and English Wikipedia, and produces embedding vectors of size 768, using the model identified as “bert-base-uncased” on huggingface.
    
  RoBERTA: RoBERTA <cit.> (Robustly Optimized BERT Pretraining Approach) is a proposal by Facebook AI to train the BERT architecture with different hyperparameters, obtaining better results, according to the paper, than the original BERT. RoBERTA also produces vectors of size 768 using the model identified as “FacebookAI/roberta-base” on huggingface. 
    
  GPT2: GPT-2 <cit.> is an advanced version of the original GPT (Generative Pre-trained Transformer) model produced by OpenAI. It is significantly larger than BERT (1.5B parameters, compared to 340M) and is trained on a more varied, larger, specially collected corpus (from web scraping). It also produces vectors of size 768 using the model identified as “openai-community/gpt2” on huggingface.
    
  Llama2: Llama2 <cit.> is a set of open-source large language models of varying sizes (from 7B to 70B parameters) produced by Meta AI (formerly Facebook AI) intended to achieve performances comparable to large, popular close models (such as GPT3). It is trained on a large mix of publicly available data. Here, we use the 7B parameter version, producing embedding vectors of size 4096 using the model identified as “meta-llama/Llama-2-7b-hf” on huggingface. 




 §.§ Structure of the generated datasets



We created 20 training and validation datasets: one for each of the five ontologies together with one of the four language models considered. Each of these datasets includes the concatenation of the embedding vectors from the given language model of pairs of entities of the given ontology, associated with the binary vectors representing the presence or absence of ontological relations between those pairs. To separate the training set from the validation set, we first set aside 30% or 40% of the entities (depending on the ontology, to ensure that different types of relations are reasonably represented in the validation set) to create pairs for the validation set and use the remaining entities to form pairs for the training set. In the next section, we will, therefore, assess the performance of models having learnt from a training set, based on measuring precision, recall, and F-score on the corresponding validation set. Note that we only include in the datasets pairs of entities between which there exists at least one relation. Also, as mentioned in Section <ref>, some relations in the datasets for the DBpedia ontology were randomly removed to reduce the imbalance between the different types of relation in that ontology. 



§ RESULTS



In this section, we present the results of training a number of models on the task of predicting the relations existing between pairs of entities, represented by the text of their names and, optionally, their descriptions as present in the  attribute. We first briefly describe the training process, show the results in terms of precision, recall, and F-score for the 20 combinations of ontologies and language models, and discuss those results. We then also show the results of cross-validating models trained on each of the ontologies against the validation set of the other ontologies on the best embeddings obtained in the previous step (Llama2). The goal here is to obtain results that enable us to gain an understanding of the generalisation capabilities of the models created. Finally, we also show the results of training one model from a combination of all the training sets from the five ontologies, to assess whether including relations from a larger, more varied set could lead to a globally more effective model not only of one ontology but of knowledge on the Web generally. 



 §.§ Training



As shown in Figure <ref>, each model adds to the concatenation of the embedding vectors produced for a pair of entities a few (one to three) fully connected hidden layers with reLU activation and an output layer (of size 20) with sigmoid activation. The decision on the number of hidden layers and their sizes is made for each model empirically: Several values have been tried to identify some that seem to consistently perform better than others. Other parameters, such as the number of epochs of training, the learning rate, or the batch size, are established by following the same approach. All the parameters used for training are recorded in our code repository on github. The results below were obtained using relatively small models on top of the embeddings used, the largest (Schema.org/Llama2) containing three hidden layers of sizes 100 each, and the smallest (DBpedia/RoBERTA) containing only one layer of size 15. 

All models were trained using the PyTorch Library with the Adam optimiser and the cross-entropy loss function applied to the 20-sized vector in output of the sigmoid layer, against the binary vector representing the actual relations between the input pair of entities.



 §.§ Learning individual ontologies



Table <ref> provides the results in terms of overall precision, recall, and F-score for each of the 20 trained models. To clarify here, those measures are considered on a per-relation basis, that is, if a relation exists in the ontology between a pair of entities and the model produces a number over 0.5 for the dimension of the output vector corresponding to that relation, then a true positive will be counted. If, however, the model outputs a number below the threshold of 0.5 for that relation, then a false negative is counted (similarly for true negatives and false positives).






















































  
Pre-trained language models capture ontological relations.
The first conclusion which can be drawn is that the results confirm that, to an extent, the tested pre-trained language models include sufficient information in their representation of texts to be able to recognise ontological relations between classes and properties, the best results obtained being Llama2 on DUL for an F-score of more than 88%. This is an interesting result in itself, as it shows that, even without much effort in training, using only a few, small additional layers on top of the produced embeddings, a fairly accurate reconstruction of a significant part of some of the ontologies can be achieved. 



  
Llama2 performs significantly better than other language models.
Another straightforward conclusion from Table <ref> is that Llama2 performs significantly better than other language models on this task, for all measures. This is not surprising considering that even the small version of Llama2 we used is much larger than the other models. This could indicate that using a larger version of Llama2 or other larger models could potentially lead to better results, although it is obvious by observing the progression of the F-score from BERT to Llama2 that the performance is unlikely to increase linearly with the size of the model. Also, it can be seen that even if it is of the same size as BERT (and supposedly an improvement over it), RoBERTA is often the worst performing model, and that GPT-2, which can be considered as being of medium size, does not always obtain better results than BERT. The other reasons that can explain the better performance of Llama2 are the larger/better quality corpus used to train it and the larger size of the embedding vectors extracted from it, which can therefore encapsulate more information about the meaning of the words they represent. 



  
All ontologies are not equally predictable.
 A third conclusion that can be easily derived from the results obtained is that not all ontologies are equally predictable. Here, however, the potentially obvious explanation that this relates to the difference in the sizes of the training sets does not hold. The largest of the ontologies, even after filtering out over-represented properties, is DBpedia, which is close to achieving the worst results. The best results are obtained from gUFO and DUL which are, compared to the others, relatively small. Without overinterpreting the description of each ontology, a reasonable explanation could relate the performance of the prediction model to the quality of the ontology. DUL and gUFO being foundational ontologies aiming to provide a precise semantic framework to connect domain ontologies, they have been carefully, manually designed. The third best-performing ontology, schema.org, while built through community initiatives, is subject to validations to ensure that it fits its purpose. OpenVocab, on the other hand, is built through individual contributions without, it appears, much central validation, and DBpedia is first extracted from textual resources in Wikipedia, which are themselves often incomplete and possibly incorrect. It is worth mentioning, in addition, that due to our process deriving inferred relations from the stated ones, small errors in some ontologies might lead to many derived erroneous relations being included in our datasets. This is especially true for the DBpedia ontology, where a combination of an often approximate use of the domain and range relations with a large subclass hierarchy can lead to large numbers of invalid inferred domain and range relations being derived. 



  
Recall is greater than precision.
Finally, it can also be noticed that, in all cases, recall is greater than precision in the results obtained. This means that the produced models will more often generate a relation between two entities even if one should not be there (according to the original ontology), than miss predicting a relation that actually exists. There can be two explanations for this. First, ontologies might be incomplete, meaning that they might not express all the relations between all entities, and this incompleteness might not be consistent across the ontology. This could lead the model, relying on the knowledge encapsulated in the language model, to generate a relation that should be there but that the original ontology had simply missed. Second, this could partially be an artefact of only including in the datasets pairs of entities that are actually related, leaving out the many pairs between which there is no relation. This could bias the model towards generating more relations than actually exist. 



 §.§ Cross testing ontology models



In Figure <ref>, we present the results, in terms of precision, recall, and F-score, of cross-validating models built on the training sets of each of the ontologies, on the validation sets of each of the ontologies. Here, we rely on the five models built using Llama2, as the best performing language model for our task. The diagonals in the three matrices of Figure <ref> therefore correspond to the results already presented in the last column of Table <ref>.



The first conclusion here is that, once again without surprise, a model trained on a part of an ontology is better able to predict another part of the same ontology, rather than a part of another ontology. Beyond this obvious statement, however, we can also see that the models based on the two upper-level ontologies are not only the ones obtaining the best results on their ontology, they also generalise fairly well to predicting each other. A more surprising result is that, however, even though it generally reaches very low performances, the model trained on OpenVocab is not much worse at predicting gUFO and DUL than it is at predicting OpenVocab itself. A possible explanation for this is that the low quality of OpenVocab might not be as much the incorrectness of the relations it expresses as its incompleteness. Finally, another interesting aspect of these results is the observation that even though it achieves good performance on schema.org itself, the model trained on this ontology performs extremely badly when predicting other ontologies with the exception of DBpedia. This is likely due to the lack of domain and range relations in schema.org, which are, however, frequent in the others. It also shows that even if they are of different qualities, schema.org and DBpedia might follow similar approaches or principles for knowledge modelling that are significantly different from the ones followed by the other three ontologies. 



 §.§ Building and testing a global model



As a last experiment, we trained a “global” model on a combined training set from the five ontologies and tested it using the five validation sets, again relying here on the Llama2 language model. The goal is to compare the performance of such a general model, trained on a larger and more diverse set of relations, with the results obtained above for more specific models, trained on smaller amounts of data. The results, in terms of precision, recall, and F-score, on the combined validation set and on each validation set individually, are presented in Table <ref>. 




As can be seen, increasing in this way the size of the training set did not lead, as could have been expected, to major improvements (the global validation measures appear close to the average scores for the previous ontology-specific models). However, it does highlight the importance of selecting the ontologies used for training on the basis of quality rather than quantity. Indeed, results for DBpedia, for example, remained similar to those obtained before, which would be expected since it is the greatest contributor to the combined training set. However, results for the two upper-level ontologies also remained similar to those obtained with their specific models, and relatively high, while they are both of smaller sizes. The results for Schema.org, on the other hand, dropped several points, while it represents the second biggest training set. This shows that including in the training set ontologies that do not follow the same design principles or are differently aligned in their textual representation and conceptual representation with the language model might lead to difficulties for such a simple prediction model as the one we used here. OpenVocab is an even clearer example of this, showing disastrous results, probably because it is of significantly different quality from the others and of small size. 

Finally, in Table <ref> the precision, recall, and F-score of the combined Llama2-based model are reported for each of the considered relations individually.



We can observe from this table that, as expected, not all relations are predicted equally. First, several relations, as can be seen in Table <ref>, are simply too rare in the training set to be properly learnt. Also, it appears clearly that direct, stated relations (e.g. SpC) are harder to predict than their inferred, indirect counterparts (e.g. ISpC). This can be explained partly by the fact that there are many more inferred relations in the training set than direct ones, but also that learning to recognise that a relation not only exists but is direct in the considered ontology is naturally harder. Finally, we can see a surprising unbalance between some relations that are semantically related. For example, super-classes and super-properties seem to be better recognised than sub-classes and sub-properties. Similarly, the model appears to be better at predicting that a class is the domain or range of a property than that a property has a class for domain or range. Once again, the lesson here is that future models for predicting ontological relations from multiple ontologies would potentially require not only a more complex neural architecture, but also a more diverse and balanced training set from which to learn.



§ DISCUSSION: POSSIBLE APPLICATIONS


The results presented in the previous section show a promising new way in which semantic web tools and applications could effectively exploit web knowledge, as captured by the kind of models created here. Before the emergence of large language models, great potential was attributed to semantic web search engines <cit.> for their ability to centralise ontological knowledge on the Web and therefore act as a hub for applications aiming to exploit such knowledge. However, those search engines have for the most part disappeared, as they were complex systems that were difficult to maintain. They also suffered from many limitations, in particular with respect to response time, but also to the inherent limits of available web ontologies. The results presented here show that, while they are different in nature, models for predicting ontological relations built on a large and diverse set of ontologies, being proper large knowledge models, could partially fulfil this potential by capturing in an efficient form the core content of those ontologies, with the added ability to, at least partly, extrapolate from them. The most obvious of applications for such models would therefore be ontology matching. Indeed, while the idea of using a language model for this task, finding relations between entities of different ontologies, is not new (see, for example, <cit.>), integrating an ontology relation prediction model would appear to be a straightforward way to integrate large amounts of web knowledge into the process, in a form that could also be easily combined with other approaches. Similarly, such models could be used to support the construction of ontologies or their knowledge-based evolution (in a way similar to the one presented in <cit.>) by being able to suggest where to place a new class or a new property in relation to existing ones. This could, in addition, use the particular form of the model's output, a number for each possible relation that is closer to 1.0 when it is more likely that the relation exists, to offer multiple relations ranked by their likeliness. It is not hard to see how a component building on the models presented here (and on any future ones of the same nature) could be integrated into many ontology engineering tools and applications. Beyond the ontology engineering field, however, we can also imagine how large knowledge models, learnt from web ontologies, could be integrated in other applications of language models, enabling them to benefit not only from knowledge expressed in texts, but also from knowledge expressed formally in those ontologies. 



§ CONCLUSION



In this paper, we report on experiments to build neural models to predict ontological relations (direct or inferred) between classes and properties from word embeddings. We showed that even very simple models built on top of such embeddings for the textual representation of those entities obtained promising results. We also showed that even if the results were often similar, the larger Llama2 model was consistently better as a source of embeddings in this task than other smaller models. We also discussed how the results were largely dependent on the quality of the ontology(ies) on which the model was trained, with carefully designed, upper-level ontologies leading to excellent results where unvalidated, community built ontologies led to disappointing model performances. 

Based on the promising results obtained, we discussed possible applications of models that could, improving upon those presented here, encapsulate and extrapolate from the knowledge contained in web ontologies. There are many avenues for such improvements that can be enabled by the resources created and made available for this paper. First, as mentioned above, building ontology relation prediction models on a larger and better selected corpus of ontologies could lead to higher quality predictions. Collecting such a large corpus and setting up mechanisms by which ontologies can be selected are therefore part of our ongoing work. Also, with a larger and more diverse corpus, it is to be expected that other, potentially more complex models might be necessary, and there remain many variations of the parameters, model architectures, training regimes, etc. that could be tested on this task. Similarly, different approaches to combining the models learnt from specific ontologies could be considered, from simple ensemble methods to more advanced mixture of experts approaches <cit.>. Finally, an obvious way in which improvements in results could be obtained is by including an element of fine-tuning of the language models used in training for the task of predicting ontological relations, although such an approach would have higher requirements with respect to available computing resources. 



§ SUPPLEMENTARY MATERIAL


At  is the FigShare data repository that includes the built models and the measures obtained from their validation. It also includes the generated datasets used as input to the training and validation steps and the intermediary structures built as part of constituting those datasets (indexes and matrices). The ontologies themselves are not included, but a metadata file indicates from where they were downloaded, at what time.




 plain
 



