PaperlayerView exact revision on arXiv

Source-linked AI summary

Differentially Private Meta-Learning

Jeffrey Li, Mikhail Khodak, Sebastian Caldas, Ameet Talwalkar

arXiv:1909.05830v2cs.LGcs.AIcs.CRstat.ML

TL;DR

Parameter-transfer meta-learning shares task-trained models, creating privacy risks, while privacy-preserving meta-learning has remained largely unstudied. The paper formalizes task-global DP and develops a differentially private gradient-based parameter-transfer algorithm with convex-setting learning guarantees; empirically, this relaxation from local privacy improves reported language-modeling accuracy and retains meta-learning benefits in image classification.

  • Problem

    Parameter-transfer methods share task-trained models, creating privacy risks, and privacy-preserving meta-learning has remained largely unstudied.

    Source: §1 · pp. 1–2

  • Method

    The paper formalizes task-global DP and proposes a differentially private gradient-based parameter-transfer algorithm with provable learning guarantees in convex settings.

    Source: §1 · p. 2, §5 · p. 10

  • Results

    Task-global DP yields roughly 1.7–2.3 times the accuracy on modified Shakespeare and 1.6–1.7 times on modified Wiki-3029 versus local-DP models across privacy budgets, while retaining significant meta-learning benefits on Omniglot and Mini-ImageNet.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Task-global DP protects task examples from downstream agents while providing a privacy setting in which the algorithm has convex-setting learning guarantees.

    Source: §5 · p. 10

    The learning-theoretic guarantees require a quadratic-growth condition on population risk, described as a statistical non-degeneracy assumption.

    Source: §3.3 · pp. 6–7

Abstract

from arXiv · show

Parameter-transfer is a well-known and versatile approach for meta-learning, with applications including few-shot learning, federated learning, and reinforcement learning. However, parameter-transfer algorithms often require sharing models that have been trained on the samples from specific tasks, thus leaving the task-owners susceptible to breaches of privacy. We conduct the first formal study of privacy in this setting and formalize the notion of task-global differential privacy as a practical relaxation of more commonly studied threat models. We then propose a new differentially private algorithm for gradient-based parameter transfer that not only satisfies this privacy requirement but also retains provable transfer learning guarantees in convex settings. Empirically, we apply our analysis to the problems of federated learning with personalization and few-shot classification, showing that allowing the relaxation to task-global privacy from the more commonly studied notion of local privacy leads to dramatically increased performance in recurrent neural language modeling and image classification.

1 INTRODUCTION

Parameter-transfer meta-learning can improve learning on similar unseen tasks, but sharing task-trained models creates privacy risks. The paper studies task-global differential privacy (DP), proposes a private gradient-based method, and applies it to personalized federated learning and few-shot classification.

1 INTRODUCTION

  • The motivating privacy risk is that a meta-learner or downstream participant may recover data from a previous task through shared models, despite local task-specific optimization.Prior single-task studies cited by the authors show that model access can reveal training records or sensitive features.Source: §1 · pp. 1–2
  • The paper formalizes task-global DP and proposes the first DP gradient-based parameter-transfer algorithm, with a group-DP extension and convex-setting learning guarantees.The guarantees scale with task similarity, measured by the closeness of task-specific optimal parameters.Source: §1 · p. 2
  • Roughly 1.7–2.3 times the accuracy on modified Shakespeare and 1.6–1.7 times on modified Wiki-3029 versus local-DP models across privacy budgets, with significant meta-learning benefits retained on two image-classification tasks.The reported comparisons concern federated language modeling; the image-classification tasks are Omniglot and Mini-ImageNet.Source: §1 · p. 2
  • The authors apply task-global DP and its theoretical guarantees to federated learning with personalization, contrasting this task-based setting with prior work focused on one global model.They describe their work, to the best of their knowledge, as the first to provide both privacy and learning guarantees in this setting.Source: §1 · p. 2

1.1 RELATED WORK

  • Prior federated DP work either leaves the meta-learner without protection from inferences on task models or uses local DP with restricted side-information assumptions and a large privacy budget.The authors also identify secure multiparty computation as a complementary approach, with communication, dropout, and colluding-participant challenges.Source: §1.1 · pp. 2–3

2 PRIVACY IN A META-LEARNING CONTEXT

The section sets out parameter-transfer meta-learning and explains why privacy depends on both the adversary and the information being protected. It distinguishes single-task DP notions from four meta-learning variants, including task-global DP, which protects records from downstream agents when task models are released.

2.1 PARAMETER TRANSFER META-LEARNING

  • Gradient-based parameter transfer alternates between task owners optimizing from a shared initialization and a meta-learner aggregating their updates to revise it.The model shared for meta-learning need not be the refined model later used for within-task inference.Source: §2.1 · p. 3

2.2 THREAT MODELS FOR GBML

  • Threat models specify who may see the initialization or task model and whether protection covers individual records or an entire task dataset.The section considers other task owners and an honest-but-curious meta-learner as potential adversaries; task-level protection can be unnecessary when records concern different individuals.Source: §2.2 · pp. 3–4
  • Figure 1 summarizes local and global DP protections at different meta-learning levels and illustrates their implications for mobile-user and hospital federated scenarios.The paper presents its task-global notion in blue.Source: Figure 1 · p. 4

2.3 DIFFERENTIAL PRIVACY (DP) IN A SINGLE-TASK SETTING

  • In single-task DP, global DP privatizes the mechanism’s final output after a trusted aggregator accesses the data, while local DP randomizes each example before training without trusting the aggregator.The section notes that local DP generally results in worse model performance.Source: §2.3 · p. 4

2.4 DIFFERENTIAL PRIVACY FOR A GBML SETTING

  • The meta-learning hierarchy yields four DP options: global DP protects task updates from the initialization’s release, while local DP also hides updates from the meta-learner; task-global DP protects records when task updates are released, while task-local DP also hides records from task owners.Task-global and task-local protections also apply to future initialization releases by immunity to post-processing.Source: §2.4 · p. 5
  • The section maps prior federated settings onto this terminology, treating release of the global model and release of user-specific updates as analogous privacy levels.The meta-learner implements global or local protection, task owners implement task-global protection, and record owners implement task-local protection.Source: §2.4 · p. 5

3 DIFFERENTIALLY PRIVATE PARAMETER-TRANSFER

The method privatizes task-level updates before sharing them with the meta-learner, while retaining a transfer-risk guarantee that improves when task risk minimizers are similar. Its learning analysis also gives a group-DP extension and requires quadratic growth of population risk.

3.1 ALGORITHM

  • Each task sends a noisy-SGD update to the meta-learner, which updates its initialization using online convex optimization; test-task inference can instead use non-private descent locally.The method adds scaled Gaussian noise during within-task DP-SGD and keeps the inference parameter local.Source: §3.1 · pp. 5–6

3.2 PRIVACY GUARANTEES

  • Running certified (ε, δ)-DP SGD within each task makes the task-owner’s shared parameter globally DP with respect to the meta-learner, and post-processing preserves that guarantee.The same guarantee applies to future calculations derived from the privatized parameter.Source: §3.2 · p. 6

3.3 LEARNING GUARANTEES

  • V/√m transfer risk is achievable for similar tasks, with convergence of roughly Õ(1/T) as the number of tasks grows.Here V is small when task risk minimizers are close; the analysis also incurs O(1/m) terms from quadratic-growth approximation and privacy.Source: §3.3 · pp. 6–7
  • The transfer-risk analysis assumes quadratic growth of population risk, a non-degeneracy condition weaker than strong convexity of empirical risk and relevant to few-shot least-squares or logistic regression.The paper also notes Lipschitz-continuous functions and gradients are required by the noisy-SGD procedure.Source: §3.3 · pp. 6–7
  • For constant group size k, the method extends to (ε, δ)-group DP while maintaining largely the same learning rates, including protection of small groups such as families in hospital-record settings.The extension follows from the group-privacy guarantee for the underlying DP mechanism.Source: §3.3 · p. 7

4 EMPIRICAL RESULTS

The experiments evaluate private Reptile on federated language modeling and few-shot image classification. Task-global DP retains more non-private performance than local DP in language modeling, while task-global DP provides few-shot meta-learning benefits over no meta-learning.

Experimental setup

  • The study applies a batched Reptile variant, with within-task DP-SGD for language modeling and DP-Adam for image classification, and compares task-global with local DP.The privacy budgets are tracked with an RDP accountant; tasks are sampled without replacement in the language-modeling experiments.Source: §4 · pp. 8–9
  • The evaluation uses Shakespeare-800 and Wiki-1600 for next-word prediction, plus 5-shot-5-way Omniglot and Mini-ImageNet test tasks.The language datasets use 800 tokens per Shakespeare task and 1,600 per Wikipedia task; image experiments use more training shots than test shots.Source: §4 · p. 8

Results

  • 78%, 88%, and 92% of non-private accuracy on Shakespeare-800 and 72%, 82%, and 83% on Wiki-1600 were reached by task-global DP Reptile across three privacy budgets.Figure 2 reports test accuracy on unseen tasks; private methods stop when their privacy budget is met.Source: Figure 2 · p. 8, §4 · p. 9
  • About 55% and 50% of non-private accuracy on both language-modeling datasets was reached by local DP at the most generous privacy budget.The paper notes that changing the privacy budget or trading more iterations for larger noise multipliers can alter these differences.Source: Figure 2 · p. 8, §4 · p. 10
  • Task-global DP Reptile yields few-shot meta-learning benefits over no meta-learning on Omniglot and Mini-ImageNet, though its performance is below non-private learning.The no-meta-learning accuracies are around 62% on Omniglot and 36% on Mini-ImageNet; task-global DP provides privacy at single-digit ε.Source: Figure 3 · p. 9, §4 · p. 10

5 CONCLUSIONS

The conclusion frames task-global differential privacy as a way to protect task examples from downstream agents while retaining learning guarantees in convex settings. Experiments also demonstrate useful deep models for language modeling and image classification.

Conclusion

  • Task-global differential privacy protects individual task examples from downstream agents, particularly the meta-learner.The paper develops a differentially private algorithm for gradient-based parameter transfer under this privacy model.Source: §5 · p. 10
  • The developed algorithm provides privacy protection and learning-theoretic results in the convex setting.The work focuses on gradient-based parameter-transfer methods.Source: §5 · p. 10
  • Experiments demonstrate useful deep models for non-convex language-modeling and image-classification tasks.The conclusion presents these as applications of the task-global privacy approach.Source: §5 · p. 10

A PROOFS OF LEARNING GUARANTEES

The appendix analyzes online task learning under stated task-distribution and loss assumptions, then uses online-to-batch conversion and stability arguments to establish learning bounds. Its theorem considers i.i.d. training-task distributions and a new task drawn from the same meta-distribution.

Setting and assumptions

  • At each time step, an adversary chooses a task distribution and samples loss functions; the task learner starts from the meta-learner's parameter and runs online gradient descent.The task learner also runs Bassily et al.'s Algorithm 1, while the meta-learner updates its parameter using the task learner's output.Source: A PROOFS OF LEARNING GUARANTEES · p. 13

Proof strategy

  • The proof bounds noisy-gradient online learning using standard online gradient descent analysis, a privacy-noise variance substitution, and a stability result.It then applies online-to-batch conversion twice to obtain the theorem's learning guarantee.Source: A PROOFS OF LEARNING GUARANTEES · pp. 13, 15

Theorem A.1

  • Theorem A.1 assumes i.i.d. training-task distributions and evaluates a new task drawn from the same meta-distribution, with a learned initialization followed by online gradient descent.The displayed theorem also states a bound for the resulting average iterate; the supplied passage does not expose the full bound.Source: A PROOFS OF LEARNING GUARANTEES · p. 15

B EXPERIMENT DETAILS

The experiments describe how language-modeling and image-classification tasks are constructed and evaluated, and how model and privacy-related hyperparameters are selected. They also distinguish the search spaces used for non-private, task-global DP, and local-DP training.

Language-modeling datasets

  • Shakespeare uses 800 tokens per task across 279 training, 31 validation, and 35 test tasks; Wikipedia uses 1,600 tokens across 2,179, 243, and 606 tasks, respectively.Validation and test tasks use 75% of tokens for local training and 25% for local testing.Source: B EXPERIMENT DETAILS · p. 16

Image-task construction

  • For few-shot images, training tasks draw labels from the training split, while evaluation tasks draw labels from the test split.Source: B EXPERIMENT DETAILS · p. 16

Models and evaluation

  • Language models use 200-dimensional embeddings and a two-layer, 200-unit LSTM; image models follow Nichol et al. (2018), matching Finn et al. (2017), and use transductive evaluation.Language models use a 10,000-token vocabulary, sequence length 10, and AccuracyTop1; unknown-token predictions count as incorrect.Source: B EXPERIMENT DETAILS · p. 16

Hyperparameter tuning

  • Language-model hyperparameters are tuned in two stages: first pre-refinement settings, then refinement settings using the best pre-refinement configuration.The first stage tunes learning rates, maximum gradient norm, and decay; the second tunes refinement learning rate, batch size, and epochs.Source: B EXPERIMENT DETAILS · p. 16

Hyperparameter search

  • The search-space tables cover non-private, task-global DP, and local-DP training, followed by final choices in Tables 5 and 6.Within-task data use full-batch steps, with the maximum number of microbatches for task-global DP; local DP uses a distinct clipping-threshold search because similar ranges did not yield high-quality initializations.Source: B EXPERIMENT DETAILS · p. 16, Table 2 · p. 17, Table 3 · p. 17

Image hyperparameters

  • Omniglot tuning varies training shots while retaining five within-task SGD steps; it searches clipping thresholds, Adam learning rates, and meta-batch sizes.The clipping-threshold candidates are 0.01–0.5, learning rates are 10^-4, 5 × 10^-4, 10^-3, and 5 × 10^-3, and meta-batch sizes are 5, 15, 25, or 50.Source: B EXPERIMENT DETAILS · p. 16
  • Mini-ImageNet uses a 2m inner batch, trading off less privacy amplification from subsampling, and searches clipping thresholds, Adam learning rates, and meta-batch sizes.Its clipping-threshold search extends from 0.01 to 1.5; learning-rate and meta-batch candidates match the Omniglot search.Source: B EXPERIMENT DETAILS · p. 16
Loading 1909.05830v2…