DP-$λ$CGD: Efficient Noise Correlation for Differentially Private Model Training

TL;DR

DP-$\lambda$CGD tackles the memory bottleneck of correlated-noise DP-SGD by introducing a memory-free scheme that regenerates the previous iteration's noise and cancels a $\lambda$-fraction using a lower triangular Toeplitz matrix $C_\lambda$. The approach leverages PRNG replay to avoid storing past noise, yielding near-DP-SGD runtimes with improved utility and a single tunable parameter $\lambda$ that balances standard DP-SGD against RMSE/MaxSE-optimal factorizations. The authors provide theoretical insights into RMSE and MaxSE factors, show structural properties, and demonstrate empirically that DP-$\lambda$CGD often surpasses DP-SGD and several memory-efficient baselines on vision and NLP tasks across privacy budgets. They also analyze amplification effects, showing that Balls-in-Bins subsampling interacts with $\lambda$ to influence optimality, and discuss practical considerations for implementation and future extensions.

Abstract

Differentially private stochastic gradient descent (DP-SGD) is the gold standard for training machine learning models with formal differential privacy guarantees. Several recent extensions improve its accuracy by introducing correlated noise across training iterations. Matrix factorization mechanisms are a prominent example, but they correlate noise across many iterations and require storing previously added noise vectors, leading to substantial memory overhead in some settings. In this work, we propose a new noise correlation strategy that correlates noise only with the immediately preceding iteration and cancels a controlled portion of it. Our method relies on noise regeneration using a pseudorandom noise generator, eliminating the need to store past noise. As a result, it requires no additional memory beyond standard DP-SGD. We show that the computational overhead is minimal and empirically demonstrate improved accuracy over DP-SGD.

Figures (8)

• Figure 1: Visualization of noise correlation in DP-$\lambda$CGD. At each step, fresh noise $z_i$ is generated, and a $\lambda$-fraction of the previously added noise $z_{i-1}$ is canceled. In contrast, DP-SGD adds independent noise at each iteration. Although the per-iteration noise vectors in DP-$\lambda$CGD have larger variance, their correlation leads to partial noise cancellation, yielding a lower total variance. In this plot we set $\lambda=0.9$. The variance of the per-iteration noise is $1$ for DP-SGD and $\approx 1.67$ for DP-$\lambda$CGD, yet the variance of the cumulative noise in DP-$\lambda$CGD is about 44% lower than in DP-SGD.
• Figure 2: Runtime for one epoch, comparing DP-SGD runtime using the Opacus implementation versus storing the noise on the CPU and regenerating it on the GPU using pseudorandomness.
• Figure 3: Validation accuracy for different values of the parameter $\lambda$ in DP-$\lambda$CGD. The first row shows a CNN model trained on CIFAR-10 for $k=10$ epochs, using different batch sizes $B$. The second row shows fine-tuning of the BERT-tiny model on the IMDB sentiment analysis dataset. For each point, we tune the learning rate; error bars are computed based on three runs. The lower and upper plots correspond to almost the same training configuration in terms of $n$, $k$, $B$, and the correlation matrix used, but demonstrate different qualitative behavior.
• Figure 4: Validation accuracy of DP-$\lambda$CGD with Balls-in-Bins amplification by subsampling for different values of $\lambda$. Vertical lines indicate the optimal values based on the amplified RMSE, suggesting that Balls-in-Bins prefers smaller values of $\lambda$. However, the value of $\lambda$ that is optimal for accuracy is even lower, at least for CIFAR-10 training.
• Figure 5: Test accuracy on CIFAR- ($B=128$, $k=10$; error bars based on three runs). We compare DP-SGD with Poisson subsampling, DP-$\lambda$CGD, BISR, BandInvMF, and BLT with Balls-in-Bins subsampling. See main body for details.

Theorems & Definitions (24)

• Definition 1: Differential Privacy (DP) Dwork_DP_original
• Theorem 1: Theorem 2 from kalinin2024
• Lemma 1
• Lemma 1
• Theorem 2: Constant-optimal bounds for multi-participation error, full-batch regime
• Lemma 3
• Corollary 4
• proof
• Proposition 5: Cost of column normalization
• proof