Source-linked AI summary
Differentially Private Learning with Adaptive Clipping
Galen Andrew, Om Thakkar, H. Brendan McMahan, Swaroop Ramaswamy
TL;DR
Fixed clipping norms in user-level private federated learning are difficult to choose because they trade clipping bias against noise and interact with training settings. The paper privately estimates an online update-norm quantile instead, and experiments find that median adaptive clipping generally performs well, sometimes exceeding the best fixed clip chosen in hindsight.
Problem
Choosing a fixed clipping norm is difficult because too-low thresholds increase bias, too-high thresholds increase privacy noise, and the optimum varies with training conditions.
Method
The method privately adapts the clipping threshold online to track a specified quantile of the update-norm distribution, using negligible privacy budget and supporting compression and secure aggregation.
Results
Across six realistic federated-learning tasks, median adaptive clipping outperformed the best hindsight fixed clip on three, matched it on two, and underperformed on one.
Takeaways & Limitations
Adaptive median clipping can provide high-utility, high-privacy models without tuning a fixed clipping-norm hyperparameter.
Takeaways & Limitations
Some problems may benefit from tuning the target quantile, which adds another hyperparameter dimension despite requiring a smaller search than fixed-norm tuning.
Abstract
from arXiv · showhide
Existing approaches for training neural networks with user-level differential privacy (e.g., DP Federated Averaging) in federated learning (FL) settings involve bounding the contribution of each user's model update by clipping it to some constant value. However there is no good a priori setting of the clipping norm across tasks and learning settings: the update norm distribution depends on the model architecture and loss, the amount of data on each device, the client learning rate, and possibly various other parameters. We propose a method wherein instead of a fixed clipping norm, one clips to a value at a specified quantile of the update norm distribution, where the value at the quantile is itself estimated online, with differential privacy. The method tracks the quantile closely, uses a negligible amount of privacy budget, is compatible with other federated learning technologies such as compression and secure aggregation, and has a straightforward joint DP analysis with DP-FedAvg. Experiments demonstrate that adaptive clipping to the median update norm works well across a range of realistic federated learning tasks, sometimes outperforming even the best fixed clip chosen in hindsight, and without the need to tune any clipping hyperparameter.
1 Introduction
The paper motivates user-level differential privacy for federated learning and identifies clipping-norm selection as a central utility and tuning challenge. It proposes privately adapting the clipping threshold to the update-norm distribution while preserving federated-learning compatibility.
- Privacy setting: User-level differential privacy protects against disclosure about all of one user's data, making it stronger than example-level privacy when users contribute many examples.The paper defines neighboring datasets by replacing all data of one user for user-level DP, versus one example for example-level DP.
- Federated learning: Federated Averaging keeps data on devices and aggregates locally computed model deltas from sampled users each round.Selected devices perform local SGD and send model updates to the server.
- Privacy mechanism: Clipping each user's update to an L2 norm C bounds aggregate sensitivity, enabling Gaussian noise to provide a central privacy guarantee.Standard composition extends per-update privacy across training rounds.
- Clipping challenge: Choosing C too low creates clipping bias, whereas choosing it too high increases Gaussian noise and can destroy utility.This bias-variance trade-off makes the clipping threshold crucial for private training utility.
- Clipping challenge: Update norms vary during long training runs and are difficult to predict from the learning system, complicating the choice of a fixed clipping norm.Other interacting hyperparameters, including client and server learning rates, further increase tuning cost for large networks.
- Adaptive approach: The proposed method privately tracks a chosen update-norm quantile online, using negligible privacy budget and remaining compatible with compression and secure aggregation.The authors evaluate it against an optimized fixed-clip baseline on realistic federated-learning tasks.
2 Private adaptive quantile clipping
The method privately adapts the clipping threshold toward a chosen quantile of client update norms using noisy, online updates. A geometric update improves convergence across scales, while the quantile estimation integrates with DP-FedAvg and preserves compatibility with federated learning technologies.
- Quantile estimation: Online gradient descent estimates the γth quantile because the expected loss derivative is zero exactly when Pr(X ≤ C) = γ.The estimate updates from the empirical fraction of samples at most C.
- Geometric updates: The geometric rule C ← C · exp(−ηC( b̄ − γ)) converges quickly even when the initial estimate differs from the true quantile by orders of magnitude.Unlike the linear rule, it avoids slow progress at the wrong scale and coarse overshooting when C is very small.
- Federated implementation: The adaptive procedure is compatible with secure aggregation and compression because clients need not transmit unclipped update norms.The alternative of reporting norms first would reveal more information and require an additional communication round.
- Private adaptive clipping: Each round privately estimates the fraction of sampled updates below the threshold by adding Gaussian noise before updating the clipping norm.The algorithm augments federated averaging with server momentum.
- Empirical tracking: With ηC = 0.2, C0 = 0.1, m = 100, and σb = m/20, quantile estimates closely track log-normal targets while the full 200-round sequence satisfies (0.034, n^-1.1)-differential privacy.The recommended noise level gives estimation error below 0.1 with 95.4% probability and no more than 0.15 with 99.7% probability.
- Privacy analysis: Theorem 1 gives a joint privacy accounting equivalence between one adaptive-clipping DP-FedAvg step and a non-adaptive DP-FedAvg step with an effective noise multiplier.The analysis treats the mechanism as a single private Gaussian sum after a conceptual algorithmic transformation.
3 Experiments
Experiments evaluate adaptive clipping across six realistic federated learning tasks, comparing quantile-based clipping with fixed clipping under varying noise levels. Median adaptive clipping generally performs well and can match or exceed the best fixed clip chosen in hindsight.
- Clipping without noise: On CIFAR-100, EMNIST-AE, and SO-NWP, clipping improves performance without noise; on SHAKESPEARE and SO-LR, performance is slightly worse than unclipped training.The authors conclude that median adaptive clipping generally fares well compared with no clipping across tasks.
- Clipping configurations: Adaptive clipping is evaluated at quantiles 0.1, 0.3, 0.5, 0.7, and 0.9, while fixed clipping uses five logarithmically spaced norms spanning observed 0.1-to-0.9 quantile values.The adaptive runs estimate evolving quantiles online; the fixed range is selected from the smallest 0.1-quantile norm and largest 0.9-quantile norm during training.
- Adaptive norm tracking: Adaptive quantile estimates closely track evolving update norm distributions across tasks, whose distinct temporal shapes motivate adapting the clipping norm.Figure 4 uses geometric updates with ηC = 0.2 and initial value C0 = 0.1; SO-LR may be an exception.
- Fixed versus adaptive clipping: On three tasks, median adaptive clipping outperforms the best hindsight-selected fixed clip; on two, performance is comparable, while SO-LR favors the fixed clip.The final comparison reports average test performance and bootstrapped 95% confidence intervals over 20 runs.
- Fixed versus adaptive clipping: For SO-LR, development-set recall@5 is 55.1 at fixed clip 16.0 but 51.8 at the next larger clip, 27.3, showing sensitivity to exact clip selection.Larger fixed clips performed worse, making an expensive hyperparameter search potentially necessary to approach the high-performing value.
4 Conclusions and implications for practice
The paper recommends enabling median adaptive clipping during hyperparameter search and using proxy data to select learning rates and noise before private training. The method reduces clipping-norm tuning, but some tasks may benefit from tuning the target quantile.
- Implications for practice: Hyperparameter optimization should enable adaptive clipping from the start, avoiding extra server-learning-rate retuning caused by introducing clipping after non-private optimization.The experiments began from optimized non-private learning rates, whereas practical tuning may also need to search client learning rates.
- Scope and tuning: Median adaptive clipping generally yields good results, but some problems, including SO-LR, may benefit from tuning the target quantile.Adding target-quantile selection expands the hyperparameter grid, although five quantiles sufficed across the reported experiments.
- Implications for practice: The recommended workflow uses median adaptive clipping with about 100 clients per round and low noise to tune learning rates on non-private proxy data before selecting a private noise level.The private-data training stage scales client participation and noise together when necessary to reach the desired privacy target.
- Scope and assumptions: The workflow assumes non-private proxy data and sufficiently many private users to achieve the desired privacy level, with client participation unable to exceed the private population.The assumption is explicit in the proposed practice strategy.
- Implications for practice: Adaptive clipping exponentially reduces the work needed for initial hyperparameter search by eliminating fixed clipping norm tuning, which interacts significantly with client and server learning rates.This practical benefit is stated within the paper’s assumed workflow for obtaining high-performing user-level private models.