Large Language Models Can Be Strong Differentially Private Learners

TL;DR

This paper demonstrates that large pretrained language models can be effectively fine-tuned with differential privacy, outperforming previous DP models and addressing computational challenges with a new memory-efficient technique.

Contribution

It introduces a memory-saving method for DP training of large Transformers and shows that pretrained models can be strong private learners without dimension-dependent performance loss.

Findings

Pretrained models improve DP NLP performance significantly.

Memory-efficient DP training enables large Transformer models with modest overhead.

DP learning with large models does not necessarily degrade with high dimensionality.

Abstract

Differentially Private (DP) learning has seen limited success for building large deep learning models of text, and straightforward attempts at applying Differentially Private Stochastic Gradient Descent (DP-SGD) to NLP tasks have resulted in large performance drops and high computational overhead. We show that this performance drop can be mitigated with (1) the use of large pretrained language models; (2) non-standard hyperparameters that suit DP optimization; and (3) fine-tuning objectives which are aligned with the pretraining procedure. With the above, we obtain NLP models that outperform state-of-the-art DP-trained models under the same privacy budget and strong non-private baselines -- by directly fine-tuning pretrained models with DP optimization on moderately-sized corpora. To address the computational challenge of running DP-SGD with large Transformers, we propose a memory saving technique that allows clipping in DP-SGD to run without instantiating per-example gradients for any linear layer in the model. The technique enables privately training Transformers with almost the same memory cost as non-private training at a modest run-time overhead. Contrary to conventional wisdom that DP optimization fails at learning high-dimensional models (due to noise that scales with dimension) empirical results reveal that private learning with pretrained language models doesn't tend to suffer from dimension-dependent performance degradation. Code to reproduce results can be found at https://github.com/lxuechen/private-transformers.