Bias-Aware Minimisation: Understanding and Mitigating Estimator Bias in Private SGD
This work addresses the challenge of maintaining model utility while ensuring privacy in sensitive datasets, representing an incremental improvement over existing methods like DP-SGD.
The paper tackled the problem of biased gradient estimates in differentially private SGD (DP-SGD), which limits model utility, by proposing Bias-Aware Minimisation (BAM) to provably reduce this bias, resulting in substantial improvements in privacy-utility trade-offs on datasets like CIFAR-10, CIFAR-100, and ImageNet-32.
Differentially private SGD (DP-SGD) holds the promise of enabling the safe and responsible application of machine learning to sensitive datasets. However, DP-SGD only provides a biased, noisy estimate of a mini-batch gradient. This renders optimisation steps less effective and limits model utility as a result. With this work, we show a connection between per-sample gradient norms and the estimation bias of the private gradient oracle used in DP-SGD. Here, we propose Bias-Aware Minimisation (BAM) that allows for the provable reduction of private gradient estimator bias. We show how to efficiently compute quantities needed for BAM to scale to large neural networks and highlight similarities to closely related methods such as Sharpness-Aware Minimisation. Finally, we provide empirical evidence that BAM not only reduces bias but also substantially improves privacy-utility trade-offs on the CIFAR-10, CIFAR-100, and ImageNet-32 datasets.