Privacy of the last iterate in cyclically-sampled DP-SGD on nonconvex composite losses

TL;DR

This paper provides new privacy bounds for the last iterate of cyclically-sampled DP-SGD in nonconvex settings, removing unrealistic assumptions and using optimal transport techniques to improve privacy-utility trade-offs.

Contribution

It introduces the first realistic privacy bounds for the last iterate of cyclic DP-SGD without strong assumptions, applicable to nonconvex composite losses.

Findings

Establishes RDP bounds for last iterate under realistic conditions

Bounds recover convex case when weak-convexity approaches zero

Uses optimal transport techniques for nonconvex, cyclic data traversal

Abstract

Differentially-private stochastic gradient descent (DP-SGD) is a family of iterative machine learning training algorithms that privatize gradients to generate a sequence of differentially-private (DP) model parameters. It is also the standard tool used to train DP models in practice, even though most users are only interested in protecting the privacy of the final model. Tight DP accounting for the last iterate would minimize the amount of noise required while maintaining the same privacy guarantee and potentially increasing model utility. However, last-iterate accounting is challenging, and existing works require strong assumptions not satisfied by most implementations. These include assuming (i) the global sensitivity constant is known - to avoid gradient clipping; (ii) the loss function is Lipschitz or convex; and (iii) input batches are sampled randomly. In this work, we forego any unrealistic assumptions and provide privacy bounds for the most commonly used variant of DP-SGD, in which data is traversed cyclically, gradients are clipped, and only the last model is released. More specifically, we establish new Renyi differential privacy (RDP) upper bounds for the last iterate under realistic assumptions of small stepsize and Lipschitz smoothness of the loss function. Our general bounds also recover the special-case convex bounds when the weak-convexity parameter of the objective function approaches zero and no clipping is performed. The approach itself leverages optimal transport techniques for last iterate bounds, which is a nontrivial task when the data is traversed cyclically and the loss function is nonconvex.