CoChat
Sign Up
PreprintCited by 851Privacy-Preserving Technologies in DataStochastic Gradient Optimization TechniquesPrivacy, Security, and Data Protection

Learning Differentially Private Recurrent Language Models

Open access
McMahan, H. Brendan, Ramage, Daniel, Talwar, Kunal, Zhang, Li·2017·arXiv
DOI 10.48550/arxiv.1710.06963arXiv 1710.06963
Open this paper in CoChat — free accountOpen PDF

Abstract

We demonstrate that it is possible to train large recurrent language models with user-level differential privacy guarantees with only a negligible cost in predictive accuracy. Our work builds on recent advances in the training of deep networks on user-partitioned data and privacy accounting for stochastic gradient descent. In particular, we add user-level privacy protection to the federated averaging algorithm, which makes "large step" updates from user-level data. Our work demonstrates that given a dataset with a sufficiently large number of users (a requirement easily met by even small internet-scale datasets), achieving differential privacy comes at the cost of increased computation, rather than in decreased utility as in most prior work. We find that our private LSTM language models are quantitatively and qualitatively similar to un-noised models when trained on a large dataset.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1710.06963

Cites

0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • With sufficient devices participating in federated training, privacy protection can be achieved with a small additional overhead.

    “This proved that, with sufficient devices participating in federated training, privacy protection could be achieved with a small additional overhead.”

    From Survey: federated learning data security and privacy-preserving in edge-Internet of Things (2024) · cites this paper as McMahan et al. 2017

    The Abstract (p. 1) says that a sufficiently large number of users enables differential privacy with negligible loss in predictive accuracy. But the Experimental Results (p. 8) say the computation is significantly more expensive; the paper does not support describing the additional computational overhead as small. (LLM, conf=0.89)

    Experimental — accuracy not yet measured

  • Both Geyer et al.'s and McMahan et al.'s approaches guaranteed high model accuracy.

    “Simultaneously, both approaches guaranteed high model accuracy.”

    From Survey: federated learning data security and privacy-preserving in edge-Internet of Things (2024) · cites this paper as McMahan et al. 2017

    The Introduction (p. 2) reports that McMahan et al.'s private model achieved the same accuracy as a non-private baseline on a sufficiently large dataset. It guarantees privacy, however, not high accuracy; the accuracy result is empirical and conditional on dataset size. This source also does not establish the result for Geyer et al.'s approach. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Federated learning is promising for natural language processing tasks such as virtual keyboard prediction.

    “Therefore, federated learning has a promising application in NLP like virtual keyboard prediction [7, 39, 70].”

    From Federated Learning for Healthcare Informatics (2021) · cites this paper as [70]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

The publisher hasn’t deposited this paper’s reference list.

Research works printed but not linked: 16

  1. Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In 23rd ACM Conference on Computer and Communications Security (ACM CCS) , 2016a.
  2. Rami Al-Rfou, Marc Pickett, Javier Snaider, Yun-Hsuan Sung, Brian Strope, and Ray Kurzweil. Conversational contextual cues: The case of personalization and history for response ranking. CoRR , abs/1606.00372, 2016. URL http://arxiv.org/abs/1606.00372 . · arXiv
  3. R. Bassily, K. Nissim, U. Stemmer, and A. Thakurta. Practical locally private heavy hitters. ArXiv e-prints , July 2017. URL https://arxiv.org/abs/1707.04982 . · arXiv
  4. N. Carlini, C. Liu, J. Kos, ´ U. Erlingsson, and D. Song. The Secret Sharer: Measuring Unintended Neural Network Memorization & Extracting Secrets. ArXiv e-prints , February 2018. URL https://arxiv. org/abs/1802.08232 .
  5. T-H Hubert Chan, Mingfei Li, Elaine Shi, and Wenchang Xu. Differentially private continual monitoring of heavy hitters from distributed streams. In International Symposium on Privacy Enhancing Technologies Symposium , pages 140-159. Springer, 2012.
  6. Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In TCC , pages 265-284. Springer, 2006.
  7. Yarin Gal and Zoubin Ghahramani. A theoretically grounded application of dropout in recurrent neural networks. In Advances in Neural Information Processing Systems , pages 1019-1027, 2016.
  8. Edouard Grave, Armand Joulin, and Nicolas Usunier. Improving neural language models with a continuous cache. arXiv preprint arXiv:1612.04426 , 2016. · arXiv
  9. Sepp Hochreiter and J¨ urgen Schmidhuber. Long short-term memory. Neural computation , 9(8):1735-1780, 1997.
  10. Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. Pointer sentinel mixture models. arXiv preprint arXiv:1609.07843 , 2016. · arXiv
  11. Nicolas Papernot, Mart´ ın Abadi, ´ Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In Proceedings of the International Conference on Learning Representations , 2017. URL https://arxiv.org/abs/1610.05755 . · arXiv
  12. Ofir Press and Lior Wolf. Using the output embedding to improve language models. In Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: Volume 2, Short Papers , pages 157-163. Association for Computational Linguistics, 2017.
  13. Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy, Oakland , 2017. To Appear.
  14. Martin Sundermeyer, Ralf Schl¨ uter, and Hermann Ney. LSTM neural networks for language modeling. In Interspeech , pages 194-197, 2012.
  15. Xi Wu, Fengan Li, Arun Kumar, Kamalika Chaudhuri, Somesh Jha, and Jeffrey F. Naughton. Bolt-on differential privacy for scalable stochastic gradient descent-based analytics. In Proceedings of SIGMOD , 2017.
  16. Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. 2017. URL https://arxiv.org/abs/1611.03530 . · arXiv

Cited by

Sorted by citations

Related

Authors
McMahan, H. B., Ramage, D., Talwar, K., & Zhang, L.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2017
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1710.06963
arXiv
1710.06963
OpenAlex
W2784621220
Cited by
849
References
0
Citations by year
2026: 2 · 2025: 66 · 2024: 162 · 2023: 130 · 2022: 116 · 2021: 183 · 2020: 134 · 2019: 44 · 2018: 12
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Stochastic Gradient Optimization Techniques
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
differential privacy, FedAvg, LSTM, privacy-utility trade-off, stochastic gradient descent, privacy accounting, large-scale datasets, privacy-preserving deep learning

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review