Summary
This paper considers the privacy-utility tradeoff for ML models trained with differential privacy guarantees, and develops a technique using data augmentation on image datasets to train models with high accuracies on standard benchmarks with DP guarantees. Mixup, a commonly used augmentation technique in computer vision, and its variants are not compatible with standard DP-SGD because a single datapoint could influence many training instances through augmentations. Recent work [10] pointed out that augmentations involving a single datapoint can be used if clipping if done after averaging all gradients stemming from augmentations of the datapoint. The present paper develops two methods inspired by mixup that involve a single datapoint and therefore can be used with DP-SGD. Experiments show performance comparable to state-of-the-art methods for training DP models.
Strengths
Thank you to the authors for sharing their interesting research! Overall, the paper tackles an important subject - improving the utility of models with rigorous privacy guarantees. This is an active area of research, and the paper engages with recent work appropriately. The proposed methods are simple to implement for image datasets and provide a boost in utility. An attempt is made to explain why mixup methods improve performance by checking the distributions of gradient norms.
Originality: The paper develops two variants of mixup that can be applied to DP-SGD training. I do not know of prior work using mixup for DP-SGD.
Quality: The analysis of differential privacy is careful and correct. The authors are diligent in highlighting parts of the analysis which are particularly tricky (L91, etc.) although these aspects are known in the literature. Relevant and recent methods are used for benchmarking, and error bars over 3 runs are given. Source code is provided.
Clarity: The paper is quite clear.
Significance: The poor utility of models trained with DP-SGD holds back the adoption of this important privacy enhancing technology, so new methods (like the ones in this paper) that improve the utility are necessary.
Weaknesses
Originality: The paper combines the augmentation techniques developed for DP in [10], with the idea of mixup which is very standard. The combination is only slightly non-trivial in this context.
Quality: The experiments lack detail - it would not be possible to reproduce the author's work with the current state of the paper and appendices. Prior SotA work [10] is frequently referenced, but performance levels from that paper are not reproduced or surpassed. The experiment using diffusion models is not benchmarked fairly. Broader impacts are relegated to the appendix.
Clarity: There are minor grammatical and typesetting issues, but they do not hurt the clarity of the paper. Figure 2 requires clarification.
Significance: The applicability of this technique is limited to image datasets, whereas that of [10] for example can be applied much more broadly.
Questions
1. What augmentations were used in the experiments? I have not found this detail clearly stated in the paper or appendices, despite it being a central focus. L167 mentions a "randomized transformation function $T$" but this is not brought up again. L247 mentions flipping and cropping, but it seems to imply these are not the only augmentations used. The lack of important details such as this negatively impact the reproducibility of this research.
2. Can the authors state what computing resources were used and information on the runtime of their methods in comparison to prior work?
3. Can the authors give details on the diffusion model that was used (architecture, how it was trained, etc.)? All we know is that it was from Open Clip and trained on LAION-2B (L218).
4. The experiments attempt to follow [10] in many ways for close comparison, but the results reported in Section 5 as baselines do not reach the level of that paper. For instance, [10] reports 81.4% accuracy on CIFAR-10 training from scratch with a WRN-16-4 and epsilon=8. Table 1's Baseline is presumably meant to represent the method from [10], but only achieves 72.5% accuracy. The author's proposed method achieves 78.7% accuracy in the same setting. Given that the authors make claims of SotA performance, can they clarify why the results reported in [10] were not directly used or reproduced?
5. There are some results which are repeated across tables (e.g. first two rows of Table 4 are reproduced from Table 3). Could this be mentioned explicitly where applicable so that it is easier to track and compare results? A reader moving quickly might assume they are separate results.
6. In Table 4 the Mixup-Diffusion method uses additional data compared to the other approaches, namely the data generated by the diffusion model. Since the utility of DP models is often constrained by access to data, it is important to use baselines that have the same level of data access. Have the authors put thought into an appropriate baseline technique in the style of DP-SGD that also makes use of the synthetic data? (The most naive option being to pre-train or extend the training dataset with the same synthetic data made available to the mixup-diffusion method.)
7. In Figure 2 it is not clear what the difference is between the curves and the blue bars. I interpret each curve as the distribution of gradient norms over individual datapoints in the training dataset at a particular epoch (these details are not given, I have to guess). However, the blue bars are stated to be a histogram of the average norm of gradients, but what is the average taken over and what is the resulting distribution over? I note that the paper at various times considers epochs, minibatches, and microbatches, so the authors should clearly state which notion they are using in their analysis.
8. Also for Figure 2, the authors do not mention in the paper or appendices which dataset is used. Can the authors provide sufficient detail to reproduce their experiments (without having to dig through source code)?
9. The result in Figure 2 showing lower average gradient norms is indeed suggestive that mixup leads to smoother training and faster convergence. However, have the authors found an explanation for why mixup leads to lower average gradient norms? This is not at all self-evident, especially for Mixup-Diffusion where training and synthetic datapoints are mixed, and those images can come from different classes (as illustrated in Fig 1).
10. Have the authors checked the equivalent of Figure 2 for Mixup-Diffusion, or for other datasets? Can this analysis be included?
Minor:
In L67, couldn't $\delta=0$ be a valid choice, and for that matter $\delta=1$ corresponding to no privacy guarantee?
In L58, typically one chooses $\delta$ to be much less than $|D|^{-1}$, but the authors state $\delta=o(|D|)$.
Incomplete list of small errors:
L70 add -> adds
L72 gradient -> gradients
L89 vector the -> vector of the
Alg 2 line 2, missing space
L150 extra parens ((x_1, y_1)
Rating
5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
Confidence
5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
Limitations
The proposed method is implicitly stated to only apply to image datasets, but this limitation is not openly addressed by the authors. Similar work used for benchmarking is not limited in the same way.
The paper focuses on the utility of private models, but does not mention that private training can have negative effects other than reducing utility (other than in a brief Appendix B without references to prior work). For instance, it is well-known that DP-SGD usually exacerbates the biases in models making them more unfair [A][B][C]. Does data augmentation affect fairness? What are the biases introduced from the synthetic data? Robustness is another topic aligned with Trustworthy ML, and researchers often introduce augmented data during training to improve it. It is possible that the proposed method has positive effects on robustness, but the authors have not addressed this direction despite the significant literature on the intersection of privacy and robustness.
[A] Bagdasaryan et al. 'Differential privacy has disparate impact on model accuracy' NeurIPS 2019
[B] Xu et al. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent' ACM SIGKDD 2021
[C] Esipova et al. 'Disparate impact in differential privacy from gradient misalignment' ICLR 2023
----
Summary of Discussion: I have read all reviews and rebuttals for this submission.
The authors responded to all points of my review. My rating was maintained at 5 as some of my original points remain as concerns, including the originality, and quality (lack of details of reproduction).