Scalability is a significant challenge when it comes to applying differential privacy to training deep neural networks. The commonly used DP-SGD algorithm struggles to maintain a high level of privacy protection while achieving high accuracy on even moderately sized models. To tackle this challenge, we take advantage of the fact that neural networks are overparameterized, which allows us to improve neural network training with differential privacy. Specifically, we introduce a new training paradigm that uses \textit{pre-pruning} and \textit{gradient-dropping} to reduce the parameter space and improve scalability. The process starts with pre-pruning the parameters of the original network to obtain a smaller model that is then trained with DP-SGD. During training, less important gradients are dropped, and only selected gradients are updated. Our training paradigm introduces a tension between the rates of pre-pruning and gradient-dropping, privacy loss, and classification accuracy. Too much pre-pruning and gradient-dropping reduces the model's capacity and worsens accuracy, while training a smaller model requires less privacy budget for achieving good accuracy. We evaluate the interplay between these factors and demonstrate the effectiveness of our training paradigm for both training from scratch and fine-tuning pre-trained networks on several benchmark image classification datasets. The tools can also be readily incorporated into existing training paradigms.

翻译：可扩展性是将差分隐私应用于深度神经网络训练时面临的重大挑战。常用的DP-SGD算法即使在中等规模模型上也难以在保持高隐私保护水平的同时实现高精度。为解决这一难题，我们利用神经网络过参数化的特性来改进差分隐私训练过程。具体而言，我们提出了一种新的训练范式，通过引入预剪枝和梯度丢弃来缩减参数空间并提升可扩展性。该过程首先对原始网络参数进行预剪枝以获得更小规模模型，再使用DP-SGD进行训练。训练过程中，重要性较低的梯度被丢弃，仅更新选定的梯度。我们的训练范式在预剪枝与梯度丢弃速率、隐私损失和分类精度之间存在权衡：过度预剪枝和梯度丢弃会降低模型容量并损害精度，而训练较小模型则需要更少隐私预算即可达到良好精度。我们评估了这些因素间的相互作用，并在多个基准图像分类数据集上验证了该范式在从头训练和微调预训练网络中的有效性。相关工具亦可便捷地整合至现有训练框架。