Harnessing large-language models to generate private synthetic text
Differentially private (DP) training methods like DP-SGD can protect
sensitive training data by ensuring that ML models will not reveal private
information. An alternative approach, which this paper studies, is to use a
sensitive dataset to generate a new synthetic dataset which is differentially
private with respect to the original data. Doing so has several advantages:
synthetic data can be reused for other tasks (including for hyper parameter
tuning), retained indefinitely, or shared with third parties without
sacrificing privacy.
  However, obtaining DP data is much harder than introducing DP during
training. To make it feasible for text, recent work has utilized public data by
starting with a pre-trained generative language model and privately finetuning
it on sensitive data. This model can be used to sample a DP synthetic dataset.
While this strategy seems straightforward, executing it has proven problematic.
Previous approaches either show significant performance loss, or have, as we
show, critical design flaws.
  In this paper we demonstrate that a proper training objective along with
tuning fewer parameters results in excellent DP synthetic data quality. Our
approach is competitive with direct DP-training of downstream classifiers in
terms of performance on downstream tasks. We also demonstrate that our DP
synthetic data is not only useful for downstream classifier training, but also
to tune those same models.
647d5421396de7684dec4480
Alexey Kurakin
647d5421396de7684dec4481
Natalia Ponomareva
647d5421396de7684dec4482
Umar Syed
647d5421396de7684dec4483
Liam MacDermed
647d5421396de7684dec4484
Andreas Terzis
Harnessing large-language models to generate private synthetic text
Differentially private (DP) training methods like DP-SGD can protect
sensitive training data by ensuring that ML models will not reveal private
information. An alternative approach, which this paper studies, is to use a
sensitive dataset to generate a new synthetic dataset which is differentially
private with respect to the original data. Doing so has several advantages:
synthetic data can be reused for other tasks (including for hyper parameter
tuning), retained indefinitely, or shared with third parties without
sacrificing privacy.
  However, obtaining DP data is much harder than introducing DP during
training. To make it feasible for text, recent work has utilized public data by
starting with a pre-trained generative language model and privately finetuning
it on sensitive data. This model can be used to sample a DP synthetic dataset.
While this strategy seems straightforward, executing it has proven problematic.
Previous approaches either show significant performance loss, or have, as we
show, critical design flaws.
  In this paper we demonstrate that a proper training objective along with
tuning fewer parameters results in excellent DP synthetic data quality. Our
approach is competitive with direct DP-training of downstream classifiers in
terms of performance on downstream tasks. We also demonstrate that our DP
synthetic data is not only useful for downstream classifier training, but also
to tune those same models.
Using a properly tuned generative language model to create differentially private synthetic datasets achieves high-quality data for downstream tasks, including model tuning.
differentially private DP-SGD synthetic dataset pre-trained generative language model private fine-tuning training objective parameter tuning DP synthetic data downstream classifier model tuning