Published as a conference paper at ICLR 2018 LEARNING DIFFERENTIALLY PRIVATE RECURRENT LANGUAGE MODELS
We demonstrate that it is possible to train large recurrent language models with user-level differential privacy guarantees with only a negligible cost in predictive accuracy. Our work builds on recent advances in the training of deep networks on user-partitioned data and privacy accounting for stochastic gradient descent. In particular, we add user-level privacy protection to the federated averaging algorithm, which makes "large step" updates from user-level data. Our work demonstrates that given a dataset with a sufficiently large number of users (a requirement easily met by even small internet-scale datasets), achieving differential privacy comes at the cost of increased computation, rather than in decreased utility as in most prior work. We find that our private LSTM language models are quantitatively and qualitatively similar to un-noised models when trained on a large dataset.
Summary of the paper
-------------------------------
The authors propose to add 4 elements to the 'FederatedAveraging' algorithm to provide a user-level differential privacy guarantee. The impact of those 4 elements on the model'a accuracy and privacy is then carefully analysed.
Clarity, Significance and Correctness
--------------------------------------------------
Clarity: Excellent
Significance: I'm not familiar with the literature of differential privacy, so I'll let more knowledgeable reviewers evaluate this point.
Correctness: The paper is technically correct.
Questions
--------------
1. Figure 1: Adding some noise to the updates could be view as some form of regularization, so I have trouble understand why the models with noise are less efficient than the baseline.
2. Clipping is supposed to help with the exploding gradients problem. Do you have an idea why a low threshold hurts the performances? Is it because it reduces the amplitude of the updates (and thus simply slows down the training)?
3. Is your method compatible with other optimizers, such as RMSprop or ADAM (which are commonly used to train RNNs)?
Pros
------
1. Nice extensions to FederatedAveraging to provide privacy guarantee.
2. Strong experimental setup that analyses in details the proposed extensions.
3. Experiments performed on public datasets.
Cons
-------
None
Typos
--------
1. Section 2, paragraph 3 : "is given in Figure 1" -> "is given in Algorithm 1"
Note
-------
Since I'm not familiar with the differential privacy literature, I'm flexible with my evaluation based on what other reviewers with more expertise have to say.