Neural Collapse Meets Differential Privacy: Curious Behaviors of NoisyGD with Near-perfect Representation Learning

TL;DR

This paper explores the intersection of Neural Collapse and differential privacy, providing theoretical insights and empirical evidence on feature quality, robustness issues, and strategies like PCA to improve private fine-tuning in deep learning.

Contribution

It offers a theoretical error bound related to Neural Collapse, analyzes the robustness of DP fine-tuning, and proposes practical methods like PCA to enhance privacy-preserving learning.

Findings

Neural Collapse leads to dimension-independent misclassification error under certain conditions.

Transformers produce better feature representations within the Neural Collapse framework.

PCA significantly improves testing accuracy in differentially private fine-tuning.

Abstract

A recent study by De et al. (2022) has reported that large-scale representation learning through pre-training on a public dataset significantly enhances differentially private (DP) learning in downstream tasks, despite the high dimensionality of the feature space. To theoretically explain this phenomenon, we consider the setting of a layer-peeled model in representation learning, which results in interesting phenomena related to learned features in deep learning and transfer learning, known as Neural Collapse (NC). Within the framework of NC, we establish an error bound indicating that the misclassification error is independent of dimension when the distance between actual features and the ideal ones is smaller than a threshold. Additionally, the quality of the features in the last layer is empirically evaluated under different pre-trained models within the framework of NC, showing that a more powerful transformer leads to a better feature representation. Furthermore, we reveal that DP fine-tuning is less robust compared to fine-tuning without DP, particularly in the presence of perturbations. These observations are supported by both theoretical analyses and experimental evaluation. Moreover, to enhance the robustness of DP fine-tuning, we suggest several strategies, such as feature normalization or employing dimension reduction methods like Principal Component Analysis (PCA). Empirically, we demonstrate a significant improvement in testing accuracy by conducting PCA on the last-layer features.