A Closer Look at the Calibration of Differentially Private Learners
Not on the map. Why?
Abstract (arXiv)
We systematically study the calibration of classifiers trained with differentially private stochastic gradient descent (DP-SGD) and observe miscalibration across a wide range of vision and language tasks. Our analysis identifies per-example gradient clipping in DP-SGD as a major cause of miscalibration, and we show that existing approaches for improving calibration with differential privacy only provide marginal improvements in calibration error while occasionally causing large degradations in accuracy. As a solution, we show that differentially private variants of post-processing calibration methods such as temperature scaling and Platt scaling are surprisingly effective and have negligible utility cost to the overall model. Across 7 tasks, temperature scaling and Platt scaling with DP-SGD result in an average 3.1-fold reduction in the in-domain expected calibration error and only incur at most a minor percent drop in accuracy.
Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 35 of its 50 references that are in the map. First posted on arXiv 15 Oct 2022.
Builds on
35 of 50 references.
References · 35
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
- 2017On Calibration of Modern Neural Networkscited by 4,860
- 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,201
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2022Language Models (Mostly) Know What They Knowcited by 1,783
- 2019Right for the Wrong Reasons: Diagnosing Syntactic Heuristics in Natural Language Inferencecited by 864
- 2017Renyi Differential Privacycited by 643
- 2018Do Better ImageNet Models Transfer Better?cited by 560
23 more
- 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 452
- 2017On Fairness and Calibrationcited by 406
- 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
- 2021Revisiting the Calibration of Modern Neural Networkscited by 387
- 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
- 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
- 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
- 2020Calibration of Pre-trained Transformerscited by 307
- 2018Subsampled R'enyi Differential Privacy and Analytical Moments Accountantcited by 234
- 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
- 2018Multiaccuracy: Black-Box Post-Processing for Fairness in Classificationcited by 221
- 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
- 2021Numerical Composition of Differential Privacycited by 174
- 2014Preserving Statistical Validity in Adaptive Data Analysiscited by 102
- 2015Algorithmic Stability for Adaptive Data Analysiscited by 88
- 2022When Does Differentially Private Learning Not Suffer in High Dimensions?cited by 48
- 2021On the Convergence and Calibration of Deep Learning with Differential Privacycited by 36
- 2022Disparate Impact in Differential Privacy from Gradient Misalignmentcited by 31
- 2022How unfair is private learning ?cited by 18
- 2022The Calibration Generalization Gapcited by 18
- 2021Private Prediction Setscited by 16
- 2020Privacy Preserving Recalibration under Domain Shiftcited by 3
- 2021Differentially private training of neural networks with Langevin dynamics for calibrated predictive uncertaintycited by 2
Built on by
Citing papers per year: 2023: 2; 2024: 0; 2025: 1; 2026: 1.
4 papers.
- 2023Selective Pre-training for Private Fine-tuningcited by 22
- 2023Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Modelscited by 4
- 2025Trustworthy AI Must Account for Interactionscited by 4
- 2026Differential Privacy in Two-Layer Networks: How DP-SGD Harms Fairness and Robustnesscited by 0
- 2026Differential Privacy in Two-Layer Networks: How DP-SGD Harms Fairness and Robustness5 Mar 2026
- 2025Trustworthy AI Must Account for Interactions9 Apr 2025
- 2023Selective Pre-training for Private Fine-tuning23 May 2023
- 2023Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Models30 Jan 2023