Hyperparameter Tuning with Renyi Differential Privacy

TL;DR

This paper investigates the privacy implications of hyperparameter tuning in differentially private algorithms, providing Renyi Differential Privacy guarantees to quantify and limit privacy leakage during the tuning process.

Contribution

It introduces a framework for analyzing privacy leakage during hyperparameter search using Renyi Differential Privacy, extending prior work and demonstrating that privacy leakage can be controlled.

Findings

Hyperparameter tuning can leak private information if not properly managed.

Differential privacy guarantees can be extended to hyperparameter search procedures.

Under certain conditions, privacy leakage during tuning is modest and manageable.

Abstract

For many differentially private algorithms, such as the prominent noisy stochastic gradient descent (DP-SGD), the analysis needed to bound the privacy leakage of a single training run is well understood. However, few studies have reasoned about the privacy leakage resulting from the multiple training runs needed to fine tune the value of the training algorithm's hyperparameters. In this work, we first illustrate how simply setting hyperparameters based on non-private training runs can leak private information. Motivated by this observation, we then provide privacy guarantees for hyperparameter search procedures within the framework of Renyi Differential Privacy. Our results improve and extend the work of Liu and Talwar (STOC 2019). Our analysis supports our previous observation that tuning hyperparameters does indeed leak private information, but we prove that, under certain assumptions, this leakage is modest, as long as each candidate training run needed to select hyperparameters is itself differentially private.