Balls-and-Bins Sampling for DP-SGD

TL;DR

This paper introduces Balls-and-Bins sampling for DP-SGD, which combines the benefits of shuffling and Poisson subsampling, achieving better privacy amplification and comparable utility.

Contribution

It proposes a novel sampling method called Balls-and-Bins that improves privacy amplification in DP-SGD while maintaining utility, bridging the gap between shuffling and Poisson subsampling.

Findings

Balls-and-Bins sampling achieves privacy amplification similar to shuffling.

Models trained with Balls-and-Bins have utility comparable to shuffling-based DP-SGD.

Balls-and-Bins sampling offers better or similar privacy guarantees compared to Poisson subsampling.

Abstract

We introduce the Balls-and-Bins sampling for differentially private (DP) optimization methods such as DP-SGD. While it has been common practice to use some form of shuffling in DP-SGD implementations, privacy accounting algorithms have typically assumed that Poisson subsampling is used instead. Recent work by Chua et al. (ICML 2024), however, pointed out that shuffling based DP-SGD can have a much larger privacy cost in practical regimes of parameters. In this work we show that the Balls-and-Bins sampling achieves the "best-of-both" samplers, namely, the implementation of Balls-and-Bins sampling is similar to that of Shuffling and models trained using DP-SGD with Balls-and-Bins sampling achieve utility comparable to those trained using DP-SGD with Shuffling at the same noise multiplier, and yet, Balls-and-Bins sampling enjoys similar-or-better privacy amplification as compared to Poisson subsampling in practical regimes.