标题： 在非凸复合损失上的循环采样DP-SGD中最后一次迭代的隐私性 显示英文标题

标题： Privacy of the last iterate in cyclically-sampled DP-SGD on nonconvex composite losses

摘要： 差分隐私随机梯度下降（DP-SGD）是一类迭代机器学习训练算法，通过隐私化梯度来生成一系列差分隐私（DP）模型参数。 它也是实践中用于训练DP模型的标准工具，尽管大多数用户只关心保护最终模型的隐私。 对最后一次迭代进行紧密的DP会计计算可以最小化所需的噪声量，同时保持相同的隐私保证，并可能提高模型效用。 然而，最后一次迭代的会计计算具有挑战性，现有工作需要大多数实现不满足的强假设。 这些包括假设（i）全局敏感性常数已知——以避免梯度截断；（ii）损失函数是Lipschitz或凸的；以及（iii）输入批次是随机采样的。 在本工作中，我们放弃任何不现实的假设，并为最常用的DP-SGD变体提供隐私界限，其中数据被循环遍历，梯度被截断，并且仅释放最后一次模型。 更具体地说，我们在小步长和损失函数Lipschitz光滑性的现实假设下，为最后一次迭代建立了新的Renyi差分隐私（RDP）上界。 我们的通用界限在目标函数的弱凸性参数趋近于零且未进行截断时，也能恢复特殊情形下的凸性界限。 该方法本身利用最优传输技术来获得最后一次迭代的界限，当数据被循环遍历且损失函数非凸时，这是一个非平凡的任务。 显示英文摘要

摘要： Differentially-private stochastic gradient descent (DP-SGD) is a family of iterative machine learning training algorithms that privatize gradients to generate a sequence of differentially-private (DP) model parameters. It is also the standard tool used to train DP models in practice, even though most users are only interested in protecting the privacy of the final model. Tight DP accounting for the last iterate would minimize the amount of noise required while maintaining the same privacy guarantee and potentially increasing model utility. However, last-iterate accounting is challenging, and existing works require strong assumptions not satisfied by most implementations. These include assuming (i) the global sensitivity constant is known - to avoid gradient clipping; (ii) the loss function is Lipschitz or convex; and (iii) input batches are sampled randomly. In this work, we forego any unrealistic assumptions and provide privacy bounds for the most commonly used variant of DP-SGD, in which data is traversed cyclically, gradients are clipped, and only the last model is released. More specifically, we establish new Renyi differential privacy (RDP) upper bounds for the last iterate under realistic assumptions of small stepsize and Lipschitz smoothness of the loss function. Our general bounds also recover the special-case convex bounds when the weak-convexity parameter of the objective function approaches zero and no clipping is performed. The approach itself leverages optimal transport techniques for last iterate bounds, which is a nontrivial task when the data is traversed cyclically and the loss function is nonconvex.