Source-linked AI summary
Differentially Private Mixing of Public Datasets Improves Private Learning
Yufei Chen, Tejumade Afonja, Anvith Thudi, Nicolas Papernot
TL;DR
Selecting relevant public data for pretraining matters because DP training can reduce model utility, while private mixture search can be costly. DP-MixMin privately learns mixture weights and improves downstream utility across medical imaging and language modeling, including a 16% reduction in Enron test perplexity.
Problem
Privately selecting relevant public pretraining data is challenging because searching candidate mixtures grows exponentially with the number of sources and each evaluation on sensitive data incurs privacy cost.
Source: §1 · p. 2Method
Results
Across medical imaging and language modeling, DP-MixMin improved private downstream utility over uniform pretraining and random mixture search; Enron test perplexity decreased by up to 16%.
Source: §1 · p. 3, Conclusion · p. 11Takeaways & Limitations
The approach improves private downstream utility across the evaluated medical imaging and language tasks, while extending it to tabular and other domains remains future work.
Source: Conclusion · p. 11The convex objective requires models near Bayes optimal on each individual pretraining source.
Source: §1 · p. 2
Abstract
from arXiv · showhide
Many machine learning applications involve sensitive data and therefore require training under differential privacy (DP). However, DP training often degrades model utility. In some cases, first pre-training the model on "public" data before finetuning with DP on the sensitive data can reduce the drop in utility. However, the success of this depends on how relevant the selected public dataset is to the sensitive data. We introduce the first pipeline that privately learns the mixture of several public datasets to pretrain on for a given sensitive downstream task. Our key insight is that we can privately find the best mixture of multiple public datasets by privately learning a low-dimensional linear model. We tested our method on the NIH dataset for X-ray classification and the ENRON email dataset for language modeling. Applying our method to find tailored mixtures of X-ray datasets to pretrain on for diseases in the NIH ChestX-ray14 dataset, we improved macro AUC by up to 0.037 across privacy budgets compared to the baselines, with gains as large as +22.8% relative AUC on Cardiomegaly at $\epsilon=1$. For DP training on the ENRON dataset, pre-training on our mixture of The Common Pile (a collection of public-domain text datasets) decreased test perplexity by 16% relative to the baseline mixtures.
1 Introduction
DP-MixMin addresses the cost of privately choosing relevant public pretraining data by learning mixture weights through a private convex objective. Across medical imaging and language modeling, it improves on prior mixture-selection baselines.
1 Introduction
- Private hyperparameter search requires trying exponentially many mixtures as public sources increase, and every candidate evaluated on sensitive data adds privacy cost.Pretraining effectiveness also depends on how related the selected public data is to the sensitive target.Source: §1 · pp. 1–2
- DP-MixMin privately learns public-dataset weights by optimizing a convex objective rather than searching over candidate mixtures.The objective requires models near Bayes optimal on each pretraining source.Source: §1 · p. 2
- The pipeline uses proxy models trained on public sources, learns mixture weights with DP-SGD on one sensitive-data split, then pretrains and DP-fine-tunes on the other.Because the private stages use disjoint data, parallel composition bounds overall privacy by the worse stage rather than their sum.Source: §1 · p. 2, Figure 1 · p. 2
- Across imaging and language tasks, DP-MixMin beat baselines; medical imaging averaged ≈0.03 AUC gain, and Enron test perplexity decreased by up to 16%.The Cardiomegaly class saw a 22.8% relative AUC gain.Source: Figure 2 · p. 3, §1 · p. 3
- The paper also shows that near Bayes-optimal models make its procedure asymptotically outperform private hyperparameter search.The introduction identifies DP-MixMin as the first end-to-end privatized pretraining mixture-learning pipeline.Source: §1 · p. 3
2 Related Work
The paper builds on public pretraining, non-private data mixing, and earlier private source-selection methods, while distinguishing DP-MixMin by its multi-source mixture learning and privacy guarantees.
DP public pretraining and non-private data mixing
- Public pretraining followed by private fine-tuning has driven state-of-the-art DP results in language and vision, while effectiveness depends on the chosen public data.Non-private mixture optimization has improved pretraining performance across multiple sources.Source: §2 · p. 3
- MixMin showed that, asymptotically, mixture learning is equivalent to fitting a linear model over per-source proxy-model predictions.DP-MixMin builds on this non-private mixture-learning method.Source: §2 · p. 3
Prior work on private selection of public datasets
- Prior private selection methods either choose one public source using gradient-subspace distance or rank examples within a preselected corpus.GSD can fail when sources share an input space and its privatized selection step was not empirically validated; domain-classifier gains were no longer apparent at GPT2-Medium scale.Source: §2 · p. 4
3 Preliminaries
The preliminaries frame public-data mixing as choosing source weights to improve performance on a private target, while noting that private hyperparameter search can be costly. They introduce MixMin’s convex reduction and the privacy tools used in the paper.
Differential privacy
- Differential privacy bounds how much a randomized mechanism’s output can depend on one record; ε is the privacy budget and δ bounds failure probability.The paper also describes user-level DP for protecting a person's full contribution across multiple records.Source: §3 · p. 4
- The paper uses DP-SGD, post-processing, and parallel composition; the latter applies when mechanisms use disjoint parts of the private dataset.User-level guarantees also satisfy parallel composition when the split is along user boundaries.Source: §3 · p. 4
Data mixing setup
- Data mixing seeks weights over public datasets that yield the best performance on a private target, but its general bi-level optimization requires training across candidate mixtures.Private hyperparameter search also has worse privacy-utility trade-offs.Source: §3 · p. 5
MixMin
- MixMin reduces the mixture problem to a convex optimization over source weights as models approach Bayes optimality, and empirically trained proxy models have also worked well.The reduction assumes no covariate shift among public sources; the paper says this assumption holds in its experiments.Source: §3 · p. 5
4 Differentially Private Data Mixing
The section argues that privately optimizing MixMin’s reduced data-mixing objective can improve privacy-utility trade-offs over private hyperparameter search. It then describes DP-MixMin, which privately estimates mixture weights and fine-tunes on a disjoint split.
4.1 Improved Utility over Private Hyperparameter Search Asymptotically
- Private hyperparameter search can require ε = Ω(k) for fixed excess error, whereas DP-SCO algorithms for the reduced Lipschitz objective achieve ε = O(√k) under the stated sample-size condition.The comparison is asymptotic and rests on the conditions for the MixMin convex reduction.Source: §4.1 · pp. 5–6
4.2 Implementing DP-MixMin
- DP-MixMin substitutes public-data proxy models and an empirical private-target expectation into MixMin, then optimizes mixture weights with clipped, noise-perturbed DP-SGD gradients.The noisy gradient is passed to an entropic-descent update.Source: §4.2 · p. 6
- For classification, one multi-class proxy can jointly predict labels from multiple public datasets, reducing training and storage costs as the number of sources grows.For generative language modeling, the method instead trains an individual proxy model on each public dataset.Source: §4.2 · p. 7
- The pipeline splits the private target data between mixture learning and DP fine-tuning, so parallel composition bounds the combined privacy guarantee.The mixture-learning models are trained on public data and do not access private data.Source: §4.2 · p. 7
5 Experiments
Across image and language tasks, DP-MixMin improves on baseline mixture choices and often recovers weights close to non-private MixMin. The experiments compare downstream utility across privacy budgets, public sources, and modalities.
5 Experiments
- The full pipeline was compared with random initialization, uniform pretraining, and non-private random search across privacy budgets, public sources, and modalities.Random search selects its best candidate non-privately, overestimating private hyperparameter search performance.Source: §5 · pp. 7–8
5.1 Image Classification
- The image experiments used NIH disease-classification tasks with CheXpert or MIMIC-CXR as public sources, comparing DP-MixMin with uniform pretraining and random search.The public datasets also contain chest X-ray disease-classification tasks, but differ in diseases and labeling.Source: §5.1 · p. 8, §5.1.1 · p. 8
5.1.1 Experimental Setup
- NIH data was split so DP-MixMin and random search used 10% of the training split for mixture learning and the rest for fine-tuning; uniform used all training data for fine-tuning.Each method was repeated five times with different data partitions and random seeds.Source: §5.1.1 · p. 8
5.1.2 Image Classification Results
- +0.037 absolute macro AUC gain over uniform at ϵ = 1 for CheXpert pretraining; DP-MixMin also outperformed baselines across the 14 NIH tasks.Its per-task gain was roughly double, and often more than double, Uniform and Random Search on each public pretraining source.Source: §5.1.2 · pp. 8–9, Figure 3 · p. 9
5.2 Language Models
- The language evaluations covered Enron email completion with user-level DP and OpenWebMath with example-level DP.Enron was compared with uniform and random search, while OpenWebMath was compared only with uniform.Source: §5.2 · p. 9
5.2.1 Experimental Setup
- Enron used 16 Common Pile domains as candidate sources; its downstream model was GPT-2 Medium, and fine-tuning was limited to the last two layers and output head.The dataset used sent-mail folders, yielding 148 users and approximately 80,000 emails.Source: §5.2.1 · pp. 9–10
5.2.2 Language Results
- Enron test perplexity reduction over baselines widened as ϵ shrank: 13.9% at ϵ=5, 14.3% at ϵ=2, and 15.6% at ϵ=1.For Enron, allocating more private data to mixture estimation improved mean perplexity and cross-seed stability across the tested fractions.Source: §5.2.2 · p. 10
5.3 Comparing DP-MixMin to Non-Private MixMin
- At ϵ = 1, DP-MixMin’s macro AUC was comparable to non-private MixMin: 0.717 vs. 0.723 for MIMIC-CXR and 0.711 vs. 0.712 for CheXpert.Most per-class differences were within one standard deviation.Source: §5.3 · p. 11
Conclusion
DP-MixMin improves private downstream utility across medical imaging and language modeling, with gains reported under low-prevalence labels, tight privacy budgets, and user-level privacy.
Conclusion
- Across medical imaging and language modeling, DP-MixMin improved private downstream utility over uniform pretraining and random mixture search, with large gains under low-prevalence labels, tight privacy budgets, and user-level privacy.Extending the method to tabular and other domains remains future work; public tabular sources may violate the no-covariate-shift assumption.Source: Conclusion · p. 11
- Results were robust to reduced proxy-model training, while theoretical results suggest DP Franke-Wolfe instead of DP mirror descent.The authors also report robustness to parallel versus sequential composition.Source: Conclusion · p. 11
AI use statement
The authors report using generative AI tools for selected formatting, debugging, and literature-checking tasks, with final content responsibility retained by the authors.
AI use statement
- Generative AI tools were used to format calculations in Appendix A.2, debug code, and format figures and tables.The code and references were verified by the authors.Source: AI use statement · p. 12
- The tools were also used to check for literature on optimizing public pretraining data that the authors might have missed.The authors state that they take responsibility for the final content, including AI-assisted artifacts.Source: AI use statement · p. 12
- The authors verified the code and references after using generative AI tools.They retain responsibility for the paper's final content.Source: AI use statement · p. 12
A.1 Proof of Lemma 4.1
The appendix analyzes the privacy cost of mixture search, gives operating examples, records implementation settings, and compares DP-MixMin with GSD in the shared-input setting.
A.1 Proof of Lemma 4.1
- Private hyperparameter search requires ϵ=Ω(k) for fixed sufficiently small excess error, with the proof linking this cost to the vanishing chance of randomly sampling a good mixture.The proof analyzes a hard mixture objective and the probability that random mixtures fall within a small ball around the optimum.Source: §A.1 · pp. 15–16
A.2 Guidance on choosing the mixture-selection budget ρ
- At ρ=0.1, the vision example uses about 8,970 private examples for α≈0.01, while the language example uses about 2.8M tokens for α≈0.001.These are the reported operating points for vision and language, respectively.Source: §A.2 · p. 17
A.3.1 Image Classification
- Image-classification experiments used a single pilot configuration to tune hyperparameters, then held them fixed across 14 tasks, two pretraining sources, seeds, and privacy budgets.The pilot used NIH Atelectasis with CheXpert pretraining at ε=1.Source: §A.3.1 · p. 18
A.3.2 Language Modeling
- Language-model experiments pretrained GPT-2 Medium from random initialization on 7.1×10^9 tokens and averaged results over three seeds.Enron private fine-tuning used a 25M-token budget.Source: §A.3.2 · p. 18
A.4 On the infeasibility of GSD in our setting
- GSD cannot distinguish the disease-label sources sharing the same image inputs, and even an oracle choice between whole corpora fell short of DP-MixMin.In this setting, GSD scores identical-input sources at zero distance; DP-MixMin also outperformed uniform pretraining on each corpus independently.Source: §A.4 · p. 18
A.5 Robustness to Proxy Model Quality
The proxy-quality check found similar downstream results across the tested training budgets, all above uniform pretraining.
A.5 Robustness to Proxy Model Quality
- Results were similar across proxy-training budgets from 1 to 6 epochs, and each remained above uniform pretraining at 0.707 AUC.The comparison used NIH Atelectasis with CheXpert pretraining at ϵ=1.Source: §A.5 · p. 18, Table 3 · p. 19
- The robustness check varied CheXpert proxy training from 1 to 6 epochs, compared with 4 epochs in the main experiments.The downstream task was NIH Atelectasis at ϵ=1.Source: §A.5 · p. 18
- Table 3 reports NIH Atelectasis AUC as mean ± standard deviation over three seeds for CheXpert pretraining at ϵ=1.Its caption frames the table as a proxy-training-budget sensitivity check.Source: Table 3 · p. 19
A.6 Empirically Validating Lemma 4.1
Across 10 CIFAR-100 tasks, DP-MixMin’s excess error grows sub-linearly with the number of public sources, with a fitted slope matching the predicted rate. Sequential and parallel privacy composition perform similarly in the NIH comparison.
A.6 Empirically Validating Lemma 4.1
- The experiment uses ResNet-50 proxies trained on k ImageNet-1k classes and evaluates DP-MixMin on the first 10 binarized CIFAR-100 tasks at ε=1, δ=10−5.Excess error is measured against the non-private optimum and averaged over five seeds and the 10 tasks.Source: §A.6 · p. 19
- For k ≥32, excess error’s fitted log-log slope is 0.49, matching the predicted 0.5 and staying below the linear cost of private hyperparameter search.The figure plots average excess error across 10 CIFAR-100 tasks as the number of public sources increases; Table 4 reports the excess-error metric across k.Source: §A.6 · p. 19, Figure 4 · p. 19, Table 4 · p. 20
A.7 Sequential vs. Parallel Composition
- Neither sequential nor parallel composition was consistently better, and both were close to non-private MixMin on NIH with CheXpert pretraining at total ε=1.Sequential composition used ε1=0.1 and ε2=0.9; the parallel setting used ρ=0.1 and ε1=ε2=1.Source: §A.7 · p. 20, Table 6 · p. 21
A.8 Auditing DP-MixMin’s Privacy Guarantee
The appendix audits DP-MixMin’s released mixture weights under a strong membership-inference setup and describes user-level mixture learning and a compute-matched random-search baseline. The private audit lower bounds remain below the claimed ε=1 level, while NIH tables report macro-AUC gains over uniform pretraining.
A.8 Auditing DP-MixMin’s Privacy Guarantee
- The audit releases and tests the mixture weights directly, since later outputs depend on examples in the mixture-learning split only through those weights.It assumes an adversary knows all other private examples and audits 14 NIH mixture-learning instances over 2000 runs.Source: §A.8 · p. 21
- At claimed ε=1, empirical privacy lower bounds were 0 for natural canaries across all 14 NIH tasks and at most 0.131 for the stronger max-clipped-gradient canary.Removing privacy noise produced εLB values as high as 5.60, showing the audit detected substantial leakage in the control.Source: §A.8 · p. 21
A.9 User-Level DP-Mixmin
- User-level DP-MixMin averages sampled examples within each user, clips the resulting user gradient, and adds Gaussian noise before updating mixture weights.The per-user subsample size caps examples per user in an update; users with fewer examples contribute all available examples.Source: §A.9 · p. 22
A.10 Random Search
- Random Search samples candidate mixture weights, evaluates each after downstream DP fine-tuning, and selects the best on the held-out set with equal-or-greater compute and non-private selection.The NIH tables report that DP-MixMin achieves the best macro AUC across all three privacy budgets, with gains of +0.029 to +0.037 over uniform for CheXpert transfer and +0.024 to +0.033 for MIMIC-CXR transfer.Source: §A.10 · pp. 22–23, Table 7 · p. 23, Table 8 · p. 23
B Dataset Access and Asset Licenses
The access and licensing notes distinguish freely available datasets from sources requiring research-use terms or credentialed access. Restricted datasets are not redistributed.
B Dataset Access and Asset Licenses
- Restricted or credentialed datasets were accessed under applicable data-use terms, and the authors do not redistribute restricted datasets.PhysioNet credentialed-access datasets required credentialing and a signed Data Use Agreement before access.Source: B Dataset Access and Asset Licenses · p. 23
- NIH Chest X-rays are identified as public domain, while CheXpert access is governed by Stanford’s Research Use Agreement for non-commercial research.Source: B Dataset Access and Asset Licenses · p. 24
- MIMIC-CXR requires PhysioNet credentialing and a Data Use Agreement; Enron is public domain, while Common Pile has an ODC-By-1.0 license and source-specific terms.The Common Pile note directs readers to its documentation for a full provenance breakdown.Source: B Dataset Access and Asset Licenses · p. 24