Pre-training Differentially Private Models with Limited Public Data
This work addresses the challenge of protecting sensitive data in pre-training for machine learning practitioners, offering a novel method that improves DP performance while maintaining accuracy, though it is incremental in advancing DP techniques.
The paper tackles the problem of applying differential privacy (DP) during pre-training of large models to protect sensitive data, by proposing a DP continual pre-training strategy that uses limited public data to mitigate performance degradation. The result is achieving DP accuracy of 41.5% on ImageNet-21k with ε=8 and competitive non-DP accuracy on downstream tasks, outperforming existing DP pre-trained models.
The superior performance of large foundation models relies on the use of massive amounts of high-quality data, which often contain sensitive, private and copyrighted material that requires formal protection. While differential privacy (DP) is a prominent method to gauge the degree of security provided to the models, its application is commonly limited to the model fine-tuning stage, due to the performance degradation when applying DP during the pre-training stage. Consequently, DP is yet not capable of protecting a substantial portion of the data used during the initial pre-training process. In this work, we first provide a theoretical understanding of the efficacy of DP training by analyzing the per-iteration loss improvement. We make a key observation that DP optimizers' performance degradation can be significantly mitigated by the use of limited public data, which leads to a novel DP continual pre-training strategy. Empirically, using only 10\% of public data, our strategy can achieve DP accuracy of 41.5\% on ImageNet-21k (with $ε=8$), as well as non-DP accuracy of 55.7\% and and 60.0\% on downstream tasks Places365 and iNaturalist-2021, respectively, on par with state-of-the-art standard pre-training and substantially outperforming existing DP pre-trained models. Our DP pre-trained models are released in fastDP library (https://github.com/awslabs/fast-differential-privacy/releases/tag/v2.1)