Pre-Pruning and Gradient-Dropping Improve Differentially Private Image
  Classification
Kamil Adamczewski Yingchen He Mijung Park
Scalability is a significant challenge when it comes to applying differential
privacy to training deep neural networks. The commonly used DP-SGD algorithm
struggles to maintain a high level of privacy protection while achieving high
accuracy on even moderately sized models. To tackle this challenge, we take
advantage of the fact that neural networks are overparameterized, which allows
us to improve neural network training with differential privacy. Specifically,
we introduce a new training paradigm that uses \textit{pre-pruning} and
\textit{gradient-dropping} to reduce the parameter space and improve
scalability. The process starts with pre-pruning the parameters of the original
network to obtain a smaller model that is then trained with DP-SGD. During
training, less important gradients are dropped, and only selected gradients are
updated. Our training paradigm introduces a tension between the rates of
pre-pruning and gradient-dropping, privacy loss, and classification accuracy.
Too much pre-pruning and gradient-dropping reduces the model's capacity and
worsens accuracy, while training a smaller model requires less privacy budget
for achieving good accuracy. We evaluate the interplay between these factors
and demonstrate the effectiveness of our training paradigm for both training
from scratch and fine-tuning pre-trained networks on several benchmark image
classification datasets. The tools can also be readily incorporated into
existing training paradigms.