# Differentially Private Neural Network Training Under the Hidden State Assumption

arXiv: https://arxiv.org/abs/2407.08233 · HTML: https://mlsanity.com/paper/2407.08233/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 20 of its 34 references that are in the map.
- First posted on arXiv 11 Jul 2024.

## Builds on (most cited first, 20 of 20)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification](https://mlsanity.com/paper/1502.01852/) (2015)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data](https://mlsanity.com/paper/1610.05755/) (2016)
- [Deduplicating Training Data Mitigates Privacy Risks in Language Models](https://mlsanity.com/paper/2202.06539/) (2022)
- [Scalable Private Learning with PATE](https://mlsanity.com/paper/1802.08908/) (2018)
- [Rapid Convergence of the Unadjusted Langevin Algorithm: Isoperimetry Suffices](https://mlsanity.com/paper/1903.08568/) (2019)
- [A Systematic DNN Weight Pruning Framework using Alternating Direction Method of Multipliers](https://mlsanity.com/paper/1804.03294/) (2018)
- [Privacy Amplification by Iteration](https://mlsanity.com/paper/1808.06651/) (2018)
- [Automatic Clipping: Differentially Private Deep Learning Made Easier and Stronger](https://mlsanity.com/paper/2206.07136/) (2022)
- [Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learning](https://mlsanity.com/paper/2102.12677/) (2021)
- [Differential Privacy Dynamics of Langevin Diffusion and Noisy Gradient Descent](https://mlsanity.com/paper/2102.05855/) (2021)
- [Privacy of Noisy Stochastic Gradient Descent: More Iterations without More Privacy Loss](https://mlsanity.com/paper/2205.13710/) (2022)
- [Differentially Private Learning Needs Hidden State (Or Much Faster Convergence)](https://mlsanity.com/paper/2203.05363/) (2022)
- [Privacy Amplification by Mixing and Diffusion Mechanisms](https://mlsanity.com/paper/1905.12264/) (2019)
- [Linearized ADMM for Non-convex Non-smooth Optimization with Convergence Analysis](https://mlsanity.com/paper/1705.02502/) (2017)
- [A Unified Framework of DNN Weight Pruning and Weight Clustering/Quantization Using ADMM](https://mlsanity.com/paper/1811.01907/) (2018)
- [A First-Order Primal-Dual Method for Nonconvex Constrained Optimization Based On the Augmented Lagrangian](https://mlsanity.com/paper/2007.12219/) (2020)

## Abstract (arXiv)

Current differentially private learning paradigms face a severe utility bottleneck: DP-SGD degrades performance through noise accumulation over training steps, while aggregation-based approaches such as PATE suffer from data inefficiency due to disjoint data partitioning. We propose Differentially Private Decoupled Training (DP-DT), a framework that decouples representation learning from privacy enforcement. DP-DT confines noise injection to the weight aggregation stage and employs auxiliary models, continuously synchronized with a global model, to perform noise-free feature extraction on private data shards. We prove that DP-DT converges globally to a limit point under non-convex objectives, via a Lyapunov potential analysis combined with the Kurdyka--Lojasiewicz property. Under the Hidden State Assumption, where adversaries observe only the final published model, we further prove that DP-DT's privacy loss can converge to a constant bound rather than accumulating with iterations. Empirical results across vision and language benchmarks confirm that DP-DT significantly mitigates utility degradation, achieving state-of-the-art privacy-utility trade-offs.