Learning Rate Adaptation for Federated and Differentially Private Learning

Introduction

Stochastic gradient descent (SGD) and its variants, including AdaGrad , RMSProp and Adam , are the main workhorses of modern machine learning and deep learning. These methods are quite sensitive to tuning the learning rate, which usually requires testing different alternatives and evaluating them on a validation data set. When possible, this adds significantly to the computational cost of using them. However, there are also situations where proper validation is difficult, such as differentially private or federated learning. In these settings, effective adaptive algorithms can be extremely important for efficient learning. While adaptive SGD alternatives such as AdaGrad, RMSProp and Adam are not as sensitive to tuning as plain SGD, they nevertheless require tuning for good performance. Furthermore, in it is argued that commonly used adaptive methods such as AdaGrad, RMSProp and Adam can lead to very poor generalisation performance in deep learning and that properly tuned basic SGD is a very competitive approach.

Differential privacy (DP) has recently risen as the dominant paradigm for privacy-preserving machine learning. A number of differentially private algorithms have been proposed addressing both important specific models (e.g. ; ; ) as well as more general approaches to learning (e.g. ; ; ; ; ). Like in machine learning more generally, differentially private stochastic gradient descent (DP-SGD) has emerged as an important tool for implementing differential privacy for a number of applications. The introduction of very tight bounds on the privacy loss occurring during the iterative algorithm computed via the moments accountant has made these algorithms particularly attractive. Furthermore, DP’s invariance to post-processing means that the same privacy guarantees apply to any algorithm that uses the same gradient information, including adaptive and accelerated methods. In addition to deep learning, stochastic gradients and more recently the moments accountant have been used in algorithms for other paradigms, such as Bayesian inference .

It is clear that standard hyperparameter tuning methods typically used for tuning the learning rate are not directly applicable to DP learning because of the need to account for the additional privacy loss for multiple runs of the learning and validation set use. Most previous work glosses this over, with two notable exceptions. Kusner et al. presented DP Bayesian optimisation that accounts for the privacy loss for the validation set, but they completely ignore training set privacy. Very recently Liu and Talwar introduced DP meta selection for DP hyperparameter tuning, but their approach imposes a 2-3x loss in privacy and only supports random hyperparameter search which may carry significant computational cost.

Federated learning has become popular as a means for communication-efficient learning with distributed data, and a useful tool for further improving privacy as well. The federated setup can severely restrict the possibility of using validation, because individual clients may differ from each other significantly which limits the value of generalising hyperparameters across clients, while at the same time limited availability of data and compute at an individual client may limit the use of local validation. In an extreme case the distribution of samples may be extremely biased between different clients, requiring the use of very different local learning rates that are impossible to tune with classical methods. Adaptive learning rate tuning can greatly increase both learning efficiency and stability in such cases.

In this paper, we propose a rigorous adaptive method for finding a good learning rate for SGD, and apply in DP and federated learning settings. The adaptation is performed during learning, which implies that the learning process only has to be executed once, leading to savings in compute time and efficient use of the privacy budget. We prove the privacy of our method based on the moments accountant mechanism.

We propose the first learning rate adaptive DP SGD method. We give rigorous moment bounds for the method, and using these bounds, we can compute tight $(\varepsilon,\delta)$-bounds using the so called moments accountant technique. By simple derivations, we show how to determine the additional tolerance hyperparameter in the algorithm. In computational experiments we show that it is competitive with optimally tuned standard optimisation methods without any tuning. We further demonstrate that the method can help stabilise federated learning especially when the data are non-uniformly distributed to different clients.

Motivation for the learning rate adaptation: extrapolation of differential equations

To get an estimate of the error made in the numerical approximation (1), we extrapolate it as follows. Consider one Euler step of size $\eta$ applied to the gradient flow,

and $\widehat{\theta}_{1}$ which is a result of two steps of size $\frac{\eta}{2}$:

and if a local error of size $tol$ is desired, a simple mechanism for updating the step size is given by

We apply Algorithm 1 to the differentially private SGD method and to the federated learning algorithm. The challenge in the DP setting is that for privacy reasons the gradients are blurred by the additive DP-noise.

Differential Privacy

We first recall some basic definitions of differential privacy . We use the following notation. An input set containing $N$ data points is denoted as $X=(x_{1},\ldots,x_{N})\in\mathcal{X}^{N}$, where $x_{i}\in\mathcal{X}$, $1\leq i\leq N$. For giving the definition of the actual differential privacy we need the following definition.

We say that two data sets $X$ and $X^{\prime}$ are adjacent if they only differ in one record. i.e., if $x_{i}\neq x_{i}^{\prime}$ for some $i$, where $x_{i}\in X$ and $x_{i}^{\prime}\in X^{\prime}$.

The following definition formalises the $(\varepsilon,\delta)$-differential privacy of a randomised mechanism $\mathcal{M}$.

Let $\varepsilon>0$ and $\delta\in$. Mechanism $\mathcal{M}\,:\,\mathcal{X}^{N}\rightarrow Z$ is $(\varepsilon,\delta)$-DP if for every pair of neighbouring data sets $X$, $X^{\prime}$ and every measurable set $E\subset Z$ we have

This definition is closed under post-processing which means that if a mechanism $\mathcal{A}$ is $(\varepsilon,\delta)$-differential private, then so is the mechanism $\mathcal{B}\circ\mathcal{A}$ for all functions $\mathcal{B}$ that do not depend on the data.

Assuming $X$ and $X^{\prime}$ differ only by one record $x_{i}$, then by observing the outputs, the ability of an attacker to tell whether the output has resulted from $X$ or $X^{\prime}$ remains bounded. Thus, the record $x_{i}$ is protected. As the record in which the two data sets differ is arbitrary, by definition, the protection applies for the whole data set.

Moments accountant

We next recall some basic definitions and results concerning the moments accountant technique which is an important ingredient for our proposed method and crucial for obtaining tight $(\varepsilon,\delta)$-privacy bounds for the differentially private stochastic gradient descent. We refer to for more details.

The privacy of our proposed method is based on the composability theorem ([1, Thm. 2]):

Suppose that $\mathcal{M}$ consists of a sequence of adaptive mechanisms $\mathcal{M}_{1},\ldots,\mathcal{M}_{k}$, where $\mathcal{M}_{i}\,:\,\prod_{j=1}^{i-1}\mathcal{Y}_{j}\times\mathcal{X}\rightarrow\mathcal{Y}_{i}$, and $\mathcal{Y}_{i}$ is in the range of the $i$$th$ mechanism, i.e., $\mathcal{M}=\mathcal{M}_{k}\circ\ldots\circ\mathcal{M}_{1}$. Then, for any $\lambda$

where the auxiliary input for $\alpha_{\mathcal{M}_{i}}(\lambda)$ is defined as all $\alpha_{\mathcal{M}_{j}}(\lambda)$’s outputs for $j<i$, and $\alpha_{\mathcal{M}}(\lambda)$ takes $\mathcal{M}_{i}$’s output, for $i<k$, as the auxiliary input.

Moreover, for any $\varepsilon>0$, the mechanism $\mathcal{M}$ is $(\varepsilon,\delta)$-differentially private for

The inequality (4) gives an upper bound for the total moment $\alpha_{\mathcal{M}}(\lambda)$ of an iterative algorithm $\mathcal{M}$ if the moments $\alpha_{\mathcal{M}_{i}}(\lambda)$ of each iteration $i$ are known. Using (5), the privacy parameters $\varepsilon$ and $\delta$ can be numerically computed from $\alpha_{\mathcal{M}}(\lambda)$-values.

Differentially private stochastic gradient descent

Suppose we want to find a minimum (w.r.t. $\theta$) of a loss function of the form $\mathcal{L}(\theta,X)=\tfrac{1}{N}\sum_{i=1}^{N}f(\theta,x_{i})$. At each step of the differentially private SGD, we compute the gradient $\nabla_{\theta}f(\theta,x_{i})$ for a random minibatch $B$, clip the 2-norm of each gradient belonging to the minibatch, compute the average, add noise in order to protect privacy, and take a GD step using this noisy gradient. For a data set $X$, the basic mechanism is then given by $\mathcal{M}(X)=\sum_{i\in B}\widetilde{\nabla}f(\theta,x_{i})+\mathcal{N}(0,C^{2}\sigma^{2}I)$, where $\widetilde{\nabla}f(\theta,x_{i})$’s denote the gradients clipped with a constant $C>0$, i.e., $\|\widetilde{\nabla}f(\theta,x_{i})\|\leq C$ for all $i\in B$. In numerical experiments we compute the moments using the numerical methods of .

Adaptive DP algorithm

The result of applying the learning rate adaptation to DP-SGD is depicted in Algorithm 2. We abbreviate this method as ADADP. Instead of (3), we use for the error estimate the 2-norm of the function $err(\theta,\widehat{\theta})$, where

By the very construction of Algorithm 2 and due to the post-processing property of differential privacy, we have the following result.

Let $q=\left|B\right|/N$, $\sigma\geq 1$ and $C>0$. Let $\alpha_{\mathcal{M}}(\lambda)$ be the moments accountant of a mechanism $\mathcal{M}$ for these parameter values. Let $\widetilde{\mathcal{M}}$ denote the mechanism of Algorithm 2 using these parameter values. Then,

By Theorem 2, using the same parameter values, we are allowed to run Algorithm 2 half as many times as differentially private SGD in order to have the same privacy.

Adaptive federated avearaging algorithm

We consider next the federated averaging algorithm given by . The idea is such that the same model is first distributed to several clients. The clients update their models based on their local data, and these models are then aggregated after a given interval by a server which then averages the models to obtain a global model. This global model is then again distributed to the clients.

In the algorithm described in [17, Algorithm 1], a random subset of clients is considered at each aggregation. We consider the case $C=1$ where each client participates in every aggregation, and replace the gradient step in client update with a non-private variant of Algorithm 2.

In , SGD with a constant learning rate is used for the updates of the clients. The motivation for using the learning rate adaptation comes from the fact that after averaging and distributing, the model at each client may be very far from the optimum for the local data and thus small steps are needed in the beginning of each sub training. Moreover, the data may vary considerably between the clients, leading to varying optimal learning rates.

Experiments

We compare ADADP with Adam combined with DP gradients. The federated averaging algorithm with adaptive learning rates is compared to constant learning rate SGD. We compare the methods on two standard datasets: MNIST and CIFAR-10.

The random sampling of minibatches is approximated as in , i.e., by randomly permuting the data elements and then partitioning them into minibatches of a fixed size. As we see, Algorithm 2 needs two minibatches per iteration: one to compute the vector $G_{1}$ and then the next one to compute $G_{2}$. Therefore, in one epoch we run $\frac{N}{2\left|B\right|}$ iterations. Then the number of gradient evaluations per epoch is the same as for SGD and Adam and thus the computation times are essentially equivalent. When using ADADP, also the per epoch privacy cost is then the same for all the methods considered, for a fixed value of the noise parameter $\sigma$.

In the DP setting the methods are compared by measuring the test accuracy for a given $\varepsilon$-value, when $\delta=10^{-5}$. The $\varepsilon$-values are computed using the moments accountant method described in .

All experiments are implemented using PyTorch.

In MNIST each example is a $28\times 28$ size gray-level image. The training set contains 60000 and the test set 10000 examples. For MNIST we use a feedforward neural network with 2 hidden layers with $256$ hidden units. As a result, the total number of parameters for this network is $334336$. We use ReLU units and the last layer is passed to softmax of $10$ classes with cross-entropy loss. Without additional noise ($\sigma=0$) we reach an accuracy of around $96\%$.

CIFAR-10 consists of colour images classified into 10 classes. The training set contains 50000 and the test set 10000 examples. Each example is a $32\times 32$ image with three RGB channels. The CIFAR-100 dataset has similar images classified into 100 classes. For CIFAR-10 we use a simple neural network, which consists of two convolutional layers followed by three fully connected layers. The convolutional layers use $3\times 3$ convolutions with stride $1$, followed by ReLU and max pools, with 64 channels each. The output of the second convolutional layer is flattened into a vector of dimension $1600$. The fully connected layers have $500$ hidden units. Last layer is passed to softmax of $10$ classes with cross-entropy loss. The total number of parameters for this network is about $10^{6}$. Similarly to the experiments of , in the DP setting we pre-train the convolutional layers using the CIFAR-100 data set and the differentially private optimisation is carried out only for the fully connected layers.

Federated learning experiments

We consider a pathological case, where the CIFAR-10 training data is divided to five clients such that client 1 has cars and trucks, client 2 planes and ships, client 3 cats and dogs, client 4 birds and frogs and client 5 deers and horses. Then, each client has 10000 images. We interpolate between this pathological case and a uniformly random distribution of data between the five clients. Figure 1(a) depicts the test accuracies for the learning rate adaptive algorithm and SGD. The learning rate of SGD is tuned in the grid $\{\ldots,10^{-2.5},10^{-2.0},10^{-1.5},\ldots\}$. We use in all alternatives $\left|B\right|=10$. We see that as the distribution of data becomes more pathological ($33\%$ of the data chosen randomly), the learning rate adaptive method is able to maintain the overall performance much better than SGD. Figure 1(b) corresponds here to the fully pathological case. For a given minibatch size $\left|B\right|$, each client carries out $E$ number of sub steps between each aggregation such that $\left|B\right|\cdot E=10000$ (one epoch of data for each client).

Figure 2 illustrates further how ADADP is able to adapt even for highly pathological distribution of data whereas the performance of (even an optimally tuned) SGD reduces drastically when the data becomes less uniformly distributed.

Adam gave poor results in this example. Figure 3 shows the test accuracies in the interpolated case, where $33\%$ of the data is chosen randomly for each client, for the best initial learning rates found from the grid $\{\ldots,10^{-5.5},10^{-5.0},10^{-4.5},\ldots\}$. We use here $\left|B\right|=10$. Notice here the different scale of y-axis as in Figure 1(a).

Comparison of ADADP against DP-Adam

We use all the methods with minibatch size $\left|B\right|=200$ and run each method for $100$ epochs. The initial learning rate for ADADP is set to $10^{-1}$, but the results are quite insensitive to this value as the algorithm will converge to the desired learning rate already during the first epoch.

We first compare ADADP with optimally tuned Adam. This means that in each case we search the best and the second best initial learning rate $\eta_{0}$ for Adam on a grid $\{\ldots,10^{-4.5},10^{-4},10^{-3.5},\ldots\}$. We apply ADADP for 50 steps, then fix the learning rate (denoted $\eta_{50}$) and apply SGD with the decaying learning rate $\eta_{k}=\tfrac{\eta_{50}}{1+0.1 \cdot(k-50)}$, where $k$ denotes the number of epoch ($k>50$).

As Figure 5(a) illustrates, in case of MNIST and the feedforward network, ADADP is competitive with the learning rate optimised Adam and gives better results than Adam with the second best learning rate found from the grid. We see from Figure 5(b), that in the case of CIFAR-10 and convolutional network, ADADP is again competitive with the learning rate optimised Adam and gives clearly better results than Adam with the second best learning rate.

Experiments for ADADP and SGD

Next, we search an optimal learning rate for SGD on a grid $\{\ldots,10^{-2.5},10^{-2.0},$ $10^{-1.5},\ldots\}$ in the case $\sigma=2.0$. Using this learning rate for SGD, we compare the performance of SGD and ADADP when $\sigma=4.0$, $6.0$ and $8.0$. As we see from Figures 5(a) and 5(b), ADADP finds an appropriate learning rate and gives better results than SGD for these values of $\sigma$. This example is motivated by the fact that the learning rate found by ADADP is nearly constant after finding a suitable level. Thus an optimally tuned SGD would necessarily be very competitive against ADADP. One could expect to find a a suitable learning rate using the case $\sigma=2.0$.

Conclusions

We have proposed the first learning rate adaptive DP-SGD method. We believe this is the first rigorous DP-SGD approach, because all previous works have glossed over the need to tune the SGD learning rate. By simple derivations, we have shown how to determine the additional tolerance hyperparameter in the algorithm. Based on this heuristic analysis, we developed a rule for selecting the parameter and verified the efficiency of the resulting algorithm in a number of diverse learning problems. The results show that our approach is competitive in performance with commonly used optimisation methods even without any tuning, which is infeasible in the DP setting. Overall, our work takes an important step toward truly DP and automated learning for SGD-based learning algorithms.

Federated learning presents another setting where classical hyperparameter adaptation with a validation set may be impractical and also leads to suboptimal results. One obvious pain point is skewed distribution of data on different clients, which may lead to different clients requiring very different learning rates that would be very difficult to tune without an adaptive algorithm. Our algorithm can handle even highly pathological cases here with ease.

As a future work, it would be useful to develop a better understanding of the tolerance hyperparameter. Furthermore, it would be important to study the adaptation of other key algorithmic parameters of DP-SGD, such as the gradient clipping threshold and the minibatch size. provide an interesting non-private implementation of minibatch adaptation, but unfortunately their approach cannot easily be applied in the DP case.

References