Subsampling is not Magic: Why Large Batch Sizes Work for Differentially Private Stochastic Optimisation
Not on the map. Why?
Abstract (arXiv)
We study how the batch size affects the total gradient variance in differentially private stochastic gradient descent (DP-SGD), seeking a theoretical explanation for the usefulness of large batch sizes. As DP-SGD is the basis of modern DP deep learning, its properties have been widely studied, and recent works have empirically found large batch sizes to be beneficial. However, theoretical explanations of this benefit are currently heuristic at best. We first observe that the total gradient variance in DP-SGD can be decomposed into subsampling-induced and noise-induced variances. We then prove that in the limit of an infinite number of iterations, the effective noise-induced variance is invariant to the batch size. The remaining subsampling-induced variance decreases with larger batch sizes, so large batches reduce the effective total gradient variance. We confirm numerically that the asymptotic regime is relevant in practical settings when the batch size is not small, and find that outside the asymptotic regime, the total gradient variance decreases even more with large batch sizes. We also find a sufficient condition that implies that large batch sizes similarly reduce effective DP noise variance for one iteration of DP-SGD.
Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 17 of its 39 references that are in the map. First posted on arXiv 6 Feb 2024.
Builds on
17 of 39 references.
References · 17
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,337
- 2015Train faster, generalize better: Stability of stochastic gradient descentcited by 547
- 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
- 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
- 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
- 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
- 2019R'enyi Differential Privacy of the Sampled Gaussian Mechanismcited by 199
- 2021Numerical Composition of Differential Privacycited by 174
- 2018An Alternative View: When Does SGD Escape Local Minima?cited by 115
- 2022Automatic Clipping: Differentially Private Deep Learning Made Easier and Strongercited by 87
- 2021Optimal Accounting of Differential Privacy via Characteristic Functioncited by 83
5 more
- 2017Generalization Bounds of SGLD for Non-convex Learning: Two Theoretical Viewpointscited by 82
- 2022TAN Without a Burn: Scaling Laws of DP-SGDcited by 51
- 2022Connect the Dots: Tighter Discrete Approximations of Privacy Loss Distributionscited by 50
- 2020Tight Differential Privacy for Discrete-Valued Mechanisms and for the Subsampled Gaussian Mechanism Using FFTcited by 43
- 2020Privacy-preserving Data Sharing on Vertically Partitioned Datacited by 2
Built on by
Citing papers per year: 2024: 4; 2025: 3; 2026: 4.
11 papers.
- 2024Efficient and Scalable Implementation of Differentially Private Deep Learning without Shortcutscited by 3
- 2024NeurIPS 2023 Competition: Privacy Preserving Federated Learning Document VQAcited by 2
- 2025On the Gradient Complexity of Private Optimization with Private Oraclescited by 2
- 2024Privately Learning from Graphs with Applications in Fine-tuning Large Language Modelscited by 1
- 2025Subsampling Factorization Machine Annealingcited by 1
- 2025On Optimal Hyperparameters for Differentially Private Deep Transfer Learningcited by 1
- 2026Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTscited by 1
- 2024Notes on Sampled Gaussian Mechanismcited by 0
- 2026Private PoEtry: Private In-Context Learning via Product of Expertscited by 0
- 2026Adaptive Sampling and Clipping for Private Worst-Case Group Optimizationcited by 0
- 2026DP-IVON-Gradsq: Differentially Private Squared-Gradient Improved Variational Online Newtoncited by 0
- 2026DP-IVON-Gradsq: Differentially Private Squared-Gradient Improved Variational Online Newton26 Jul 2026
- 2026Decomposing Memorization Reduction in Privacy-Preserving Fine-Tuning of SLMs for CSIRTs26 Jun 2026
- 2026Adaptive Sampling and Clipping for Private Worst-Case Group Optimization11 Feb 2026
- 2026Private PoEtry: Private In-Context Learning via Product of Experts4 Feb 2026
- 2025On the Gradient Complexity of Private Optimization with Private Oracles17 Nov 2025
- 2025On Optimal Hyperparameters for Differentially Private Deep Transfer Learning23 Oct 2025
- 2025Subsampling Factorization Machine Annealing12 Aug 2025
- 2024NeurIPS 2023 Competition: Privacy Preserving Federated Learning Document VQA6 Nov 2024
- 2024Privately Learning from Graphs with Applications in Fine-tuning Large Language Models10 Oct 2024
- 2024Notes on Sampled Gaussian Mechanism6 Sep 2024
- 2024Efficient and Scalable Implementation of Differentially Private Deep Learning without Shortcuts25 Jun 2024