mlsanityData to 7 Oct 2026

On the Convergence and Calibration of Deep Learning with Differential Privacy

arXiv 2106.07830 ↗First posted 15 Jun 2021cs.LG stat.MLcited by 36

Not on the map. Why?

Abstract (arXiv)

Differentially private (DP) training preserves the data privacy usually at the cost of slower convergence (and thus lower accuracy), as well as more severe mis-calibration than its non-private counterpart. To analyze the convergence of DP training, we formulate a continuous time analysis through the lens of neural tangent kernel (NTK), which characterizes the per-sample gradient clipping and the noise addition in DP training, for arbitrary network architectures and loss functions. Interestingly, we show that the noise addition only affects the privacy risk but not the convergence or calibration, whereas the per-sample gradient clipping (under both flat and layerwise clipping styles) only affects the convergence and calibration. Furthermore, we observe that while DP models trained with small clipping norm usually achieve the best accurate, but are poorly calibrated and thus unreliable. In sharp contrast, DP models trained with large clipping norm enjoy the same privacy guarantee and similar accuracy, but are significantly more textitcalibrated. Our code can be found at urlhttps://github.com/woodyx218/opacusglobalclipping.

Key facts. Cited by 36 papers in the map (data through 7 Oct 2026). Builds on 28 of its 73 references that are in the map. First posted on arXiv 15 Jun 2021.

Builds on

28 of 73 references.

References · 28

  1. 2017On Calibration of Modern Neural Networkscited by 4,860
  2. 2016Deep Learning with Differential Privacycited by 2,682
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2020Extracting Training Data from Large Language Modelscited by 2,144
  5. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  6. 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 784
  7. 2019Wide Neural Networks of Any Depth Evolve as Linear Models Under Gradient Descentcited by 732
  8. 2018Gradient Descent Provably Optimizes Over-parameterized Neural Networkscited by 655
  9. 2017Renyi Differential Privacycited by 643
  10. 2019On Exact Computation with an Infinitely Wide Neural Netcited by 572
  11. 2019Fine-Grained Analysis of Optimization and Generalization for Overparameterized Two-Layer Neural Networkscited by 562
  12. 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 451
16 more
  1. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  2. 2020Deep learning versus kernel learning: an empirical study of loss landscape geometry and the time evolution of the Neural Tangent Kernelcited by 185
  3. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 169
  4. 2015Adding Gradient Noise Improves Learning for Very Deep Networkscited by 144
  5. 2020Understanding Gradient Clipping in Private SGD: A Geometric Perspectivecited by 140
  6. 2020The Discrete Gaussian for Differential Privacycited by 134
  7. 2020Tempered Sigmoid Activations for Deep Learning with Differential Privacycited by 121
  8. 2019Deep Learning with Gaussian Differential Privacycited by 112
  9. 2018A General Approach to Adding Differential Privacy to Iterative Training Procedurescited by 84
  10. 2015Privacy for Free: Posterior Sampling and Stochastic Gradient Monte Carlocited by 61
  11. 2017Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learningcited by 34
  12. 2021Fast and Memory Efficient Differentially Private-SGD via JL Projectionscited by 29
  13. 2018A general system of differential equations to model first order adaptive algorithmscited by 28
  14. 2017On Connecting Stochastic Gradient MCMC and Differential Privacycited by 15
  15. 2019An Adaptive and Fast Convergent Approach to Differentially Private Deep Learningcited by 13
  16. 2020A Dynamical View on Optimization Algorithms of Overparameterized Neural Networkscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 7; 2023: 10; 2024: 5; 2025: 9; 2026: 4.

36 papers.

Sort:

  1. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 150
  2. 2022Automatic Clipping: Differentially Private Deep Learning Made Easier and Strongercited by 87
  3. 2022Differentially Private Optimization on Large Model at Small Costcited by 65
  4. 2022Scalable and Efficient Training of Large Convolutional Neural Networks with Differential Privacycited by 47
  5. 2022Differentially Private Learning Needs Hidden State (Or Much Faster Convergence)cited by 45
  6. 2024Private Fine-tuning of Large Language Models with Zeroth-order Optimizationcited by 41
  7. 2022Large Scale Transfer Learning for Differentially Private Image Classificationcited by 40
  8. 2023Differentially Private Image Classification by Learning Priors from Random Processescited by 19
  9. 2023Differentially Private Sharpness-Aware Trainingcited by 14
  10. 2023Initialization Matters: Privacy-Utility Analysis of Overparameterized Neural Networkscited by 9
  11. 2024LLM-based Privacy Data Augmentation Guided by Knowledge Distillation with a Distribution Tutor for Medical Text Classificationcited by 8
  12. 2024Pre-training Differentially Private Models with Limited Public Datacited by 8
24 more
  1. 2023Safeguarding Data in Multimodal AI: A Differentially Private Approach to CLIP Trainingcited by 7
  2. 2023On the accuracy and efficiency of group-wise clipping in differentially private optimizationcited by 7
  3. 2021Differentially Private Bayesian Neural Networks on Accuracy, Privacy and Reliabilitycited by 6
  4. 2022Differentially Private Optimizers Can Learn Adversarially Robust Modelscited by 6
  5. 2023Augment then Smooth: Reconciling Differential Privacy with Certified Robustnesscited by 6
  6. 2022A Closer Look at the Calibration of Differentially Private Learnerscited by 4
  7. 2024Characterizing the Training Dynamics of Private Fine-tuning with Langevin diffusioncited by 4
  8. 2025Trustworthy AI Must Account for Interactionscited by 4
  9. 2025Towards Understanding Generalization in DP-GD: A Case Study in Training Two-Layer CNNscited by 4
  10. 2025SoK: What Makes Private Learning Unfair?cited by 3
  11. 2023Automated discovery of trade-off between utility, privacy and fairness in machine learning modelscited by 2
  12. 2024Enhancing DP-SGD through Non-monotonous Adaptive Scaling Gradient Weightcited by 1
  13. 2025Laplace Sample Information: Data Informativeness Through a Bayesian Lenscited by 1
  14. 2026Optimization, Generalization and Differential Privacy Bounds for Gradient Descent on Kolmogorov-Arnold Networkscited by 1
  15. 2026When Gradient Clipping Becomes a Control Mechanism for Differential Privacy in Deep Learningcited by 1
  16. 2023Exploring Machine Learning Privacy/Utility trade-off from a hyperparameters Lenscited by 0
  17. 2023DP-SGD-Global-Adapt-V2-S: Triad Improvements of Privacy, Accuracy and Fairness via Step Decay Noise Multiplier and Step Decay Upper Clipping Thresholdcited by 0
  18. 2025Steps Adaptive Decay DPSGD: Enhancing Performance on Imbalanced Datasets with Differential Privacy with HAM10000cited by 0
  19. 2025Towards Reliable and Generalizable Differentially Private Machine Learning (Extended Version)cited by 0
  20. 2025DPFNAS: Differential Privacy-Enhanced Federated Neural Architecture Search for 6G Edge Intelligencecited by 0
  21. 2025Re-examining Low Rank adaptation for private LLM fine-tuningcited by 0
  22. 2025Private Federated Multiclass Post-hoc Calibrationcited by 0
  23. 2026Differential Privacy in Two-Layer Networks: How DP-SGD Harms Fairness and Robustnesscited by 0
  24. 2026Revisiting Privacy Amplification by Subsampling in Selective Release DPSGDcited by 0