Characterizing the Training Dynamics of Private Fine-tuning with Langevin diffusion

2024-02-29

Trans. Mach. Learn. Res.

AI Summary

Differential privacy full fine-tuning (DP-FFT) distorts pre-trained backbone features due to representational mismatch between randomly initialized linear heads and frozen backbones. Method: We propose DP-LP-FFT—a two-stage strategy comprising differential privacy linear probing (DP-LP) for head initialization calibration, followed by DP-FFT. Contribution/Results: We provide the first theoretical proof that DP-LP-FFT mitigates feature distortion; derive upper and lower bounds on training loss for a two-layer ReLU network with approximation error; and uncover novel privacy-budget allocation trade-offs in multi-stage fine-tuning. Both theoretical analysis and empirical evaluation on CIFAR and ImageNet subsets confirm that DP-LP-FFT significantly improves model accuracy under identical privacy budgets while enhancing feature representation stability.

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: Safety and Robustness
• Computer Vision: Diffusion Models for Vision

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

We show that differentially private full fine-tuning (DP-FFT) can distort pre-trained backbone features based on both theoretical and empirical results. We identify the cause of the distortion as the misalignment between the pre-trained backbone and the randomly initialized linear head. We prove that a sequential fine-tuning strategy can mitigate the feature distortion: first-linear-probing-then-fine-tuning (DP-LP-FFT). A new approximation scheme allows us to derive approximate upper and lower bounds on the training loss of DP-LP and DP-FFT, in a simple but canonical setting of 2-layer neural networks with ReLU activation. Experiments on real-world datasets and architectures are consistent with our theoretical insights. We also derive new upper bounds for 2-layer linear networks without the approximation. Moreover, our theory suggests a trade-off of privacy budget allocation in multi-phase fine-tuning methods like DP-LP-FFT.

Problem

• Analyzing feature distortion in differentially private fine-tuning of pre-trained models
• Identifying misalignment between pre-trained backbone and randomly initialized head
• Developing sequential fine-tuning strategy to mitigate private training distortion

Innovation

• Sequential fine-tuning mitigates feature distortion
• Approximation scheme derives training loss bounds
• Privacy budget allocation trade-off in multi-phase fine-tuning