mlsanityData to 7 Oct 2026

Understanding Private Learning From Feature Perspective

arXiv 2511.18006 ↗First posted 22 Nov 2025cs.LGcited by 2

Not on the map. Why?

Abstract (arXiv)

Differentially private Stochastic Gradient Descent (DP-SGD) has become integral to privacy-preserving machine learning, ensuring robust privacy guarantees in sensitive domains. Despite notable empirical advances leveraging features from non-private, pre-trained models to enhance DP-SGD training, a theoretical understanding of feature dynamics in private learning remains underexplored. This paper presents the first theoretical framework to analyze private training through a feature learning perspective. Building on the multi-patch data structure from prior work, our analysis distinguishes between label-dependent feature signals and label-independent noise, a critical aspect overlooked by existing analyses in the DP community. Employing a two-layer CNN with polynomial ReLU activation, we theoretically characterize both feature signal learning and data noise memorization in private training via noisy gradient descent. Our findings reveal that (1) Effective private signal learning requires a higher signal-to-noise ratio (SNR) compared to non-private training, and (2) When data noise memorization occurs in non-private learning, it will also occur in private learning, leading to poor generalization despite small training loss. Our findings highlight the challenges of private learning and prove the benefit of feature enhancement to improve SNR. Experiments on synthetic and real-world datasets also validate our theoretical findings.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 52 of its 71 references that are in the map. First posted on arXiv 22 Nov 2025.

Builds on

52 of 71 references.

References · 52

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  3. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  4. 2016Deep Learning with Differential Privacycited by 2,682
  5. 2020Prevalence of Neural Collapse during the terminal phase of deep learning trainingcited by 713
  6. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
  7. 2021Differentially Private Fine-tuning of Language Modelscited by 392
  8. 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
  9. 2020Towards Understanding Ensemble, Knowledge Distillation and Self-Distillation in Deep Learningcited by 292
  10. 2022Transformers in Medical Imaging: A Surveycited by 245
  11. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
  12. 2019Differentially Private Learning with Adaptive Clippingcited by 218
38 more
  1. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 218
  2. 2019Private Stochastic Convex Optimization with Optimal Ratescited by 183
  3. 2021Practical and Private (Deep) Learning without Sampling or Shufflingcited by 169
  4. 2020Private Stochastic Convex Optimization: Optimal Rates in Linear Timecited by 152
  5. 2019A Review of Cooperative Multi-Agent Deep Reinforcement Learningcited by 147
  6. 2018An overview of deep learning in medical imaging focusing on MRIcited by 140
  7. 2018Differentially Private Empirical Risk Minimization Revisited: Faster and More Generalcited by 127
  8. 2020Tempered Sigmoid Activations for Deep Learning with Differential Privacycited by 121
  9. 2020Feature Purification: How Adversarial Training Performs Robust Deep Learningcited by 107
  10. 2022Vision Transformers provably learn spatial structurecited by 92
  11. 2020Deep Learning for Financial Applications : A Surveycited by 90
  12. 2022Benign Overfitting in Two-layer Convolutional Neural Networkscited by 90
  13. 2022Toward Training at ImageNet Scale with Differential Privacycited by 87
  14. 2022Automatic Clipping: Differentially Private Deep Learning Made Easier and Strongercited by 87
  15. 2023A Theoretical Understanding of Shallow Vision Transformers: Learning, Generalization, and Sample Complexitycited by 77
  16. 2022Benign Overfitting without Linearity: Neural Network Classifiers Trained by Gradient Descent for Noisy Linear Datacited by 74
  17. 2017Efficient Private ERM for Smooth Objectivescited by 61
  18. 2020On Differentially Private Stochastic Convex Optimization with Heavy-tailed Datacited by 51
  19. 2021Non-Euclidean Differentially Private Stochastic Convex Optimization: Optimal Rates in Linear Timecited by 51
  20. 2021Improved Rates for Differentially Private Stochastic Convex Optimization with Heavy-Tailed Datacited by 47
  21. 2021Private Adaptive Gradient Methods for Convex Optimizationcited by 46
  22. 2021Differentially Private Stochastic Optimization: New Results in Convex and Non-Convex Settingscited by 45
  23. 2021High Dimensional Differentially Private Stochastic Optimization with Heavy-tailed Datacited by 42
  24. 2024Private Fine-tuning of Large Language Models with Zeroth-order Optimizationcited by 41
  25. 2022Towards understanding how momentum improves generalization in deep learningcited by 40
  26. 2023Benign Overfitting for Two-layer ReLU Convolutional Neural Networkscited by 34
  27. 2019Efficient Privacy-Preserving Stochastic Nonconvex Optimizationcited by 27
  28. 2020Evading Curse of Dimensionality in Unconstrained Private GLMs via Private Gradient Descentcited by 27
  29. 2021Private Non-smooth Empirical Risk Minimization and Stochastic Convex Optimization in Subquadratic Stepscited by 21
  30. 2023The Benefits of Mixup for Feature Learningcited by 19
  31. 2023Differentially Private Image Classification by Learning Priors from Random Processescited by 19
  32. 2024On the Feature Learning in Diffusion Modelscited by 19
  33. 2024DiSK: Differentially Private Optimizer with Simplified Kalman Filter for Noise Reductioncited by 10
  34. 2022Can Foundation Models Help Us Achieve Perfect Secrecy?cited by 9
  35. 2023DP-Mix: Mixup-based Data Augmentation for Differentially Private Learningcited by 9
  36. 2022Deep Linear Networks can Benignly Overfit when Shallow Ones Docited by 8
  37. 2023Differentially Private Stochastic Convex Optimization in (Non)-Euclidean Space Revisitedcited by 8
  38. 2024Pre-training Differentially Private Models with Limited Public Datacited by 8

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Provable Effects of Data Replay in Continual Learning: A Feature Learning Perspectivecited by 1
  2. 2026Understanding the Impact of Differentially Private Training on Memorization of Long-Tailed Datacited by 0