{"id":13576045,"url":"https://github.com/awslabs/fast-differential-privacy","last_synced_at":"2025-04-05T05:30:34.839Z","repository":{"id":63577380,"uuid":"568454288","full_name":"awslabs/fast-differential-privacy","owner":"awslabs","description":"Fast, memory-efficient, scalable optimization of deep learning with differential privacy","archived":false,"fork":false,"pushed_at":"2025-01-08T16:44:30.000Z","size":854,"stargazers_count":115,"open_issues_count":2,"forks_count":20,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-13T02:37:51.164Z","etag":null,"topics":["deep-learning","differential-privacy","neural-network","privacy-preserving-machine-learning"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/awslabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-20T15:31:03.000Z","updated_at":"2025-03-07T15:30:46.000Z","dependencies_parsed_at":"2024-02-09T08:30:34.527Z","dependency_job_id":"086e4772-c3a9-4691-a9f0-abaa15930bf1","html_url":"https://github.com/awslabs/fast-differential-privacy","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awslabs%2Ffast-differential-privacy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awslabs%2Ffast-differential-privacy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awslabs%2Ffast-differential-privacy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/awslabs%2Ffast-differential-privacy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/awslabs","download_url":"https://codeload.github.com/awslabs/fast-differential-privacy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247294015,"owners_count":20915329,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["deep-learning","differential-privacy","neural-network","privacy-preserving-machine-learning"],"created_at":"2024-08-01T15:01:06.561Z","updated_at":"2025-04-05T05:30:33.858Z","avatar_url":"https://github.com/awslabs.png","language":"Python","funding_links":[],"categories":["Python","Code and Projects"],"sub_categories":[],"readme":"# Fast Differential Privacy\n\n*Fast Differential Privacy* (**fastDP**) is a library that allows differentially private optimization of PyTorch models, with a few additional lines of code. The goal of this library is to make DP deep learning as similar to the standard non-private learning as possible, in terms of **speed, memory cost, scalability, accuracy and hyperparameter-tuning**. It supports all PyTorch optimizers, popular models in [TIMM](https://github.com/rwightman/pytorch-image-models), [torchvision](https://github.com/pytorch/vision), [HuggingFace](https://huggingface.co/transformers/) (up to supported modules), multiple privacy accountants, multiple clipping functions/styles, most parameter-efficient training methods, and distribute solutions such as DeepSpeed and FSDP. The library has provably little overhead in terms of training time and memory cost, compared with the standard non-private optimization.\n\n\n---\n## Installation.\nTo install the library after Git clone, run\n```bash\npython -m setup develop\n```\n\n\u003e :warning: **NOTE**: We strongly recommend Python\u003e=3.8 and torch\u003c=1.11 (it is a known issue that torch 1.12 can slow down as much as 3 times).\n\n## Getting started\nTo train a model with differential privacy, simply create a `PrivacyEngine` and continue the standard training pipeline:\n\n```python\nfrom fastDP import PrivacyEngine\noptimizer = SGD(model.parameters(), lr=0.05)\nprivacy_engine = PrivacyEngine(\n    model,\n    batch_size=256,\n    sample_size=50000,\n    epochs=3,\n    target_epsilon=2,\n    clipping_fn='automatic',\n    clipping_mode='MixOpt',\n    origin_params=None,\n    clipping_style='all-layer',\n)\n# attaching to optimizers is not needed for multi-GPU distributed learning\nprivacy_engine.attach(optimizer) \n\n#----- standard training pipeline\nloss = F.cross_entropy(model(batch), labels)\nloss.backward()\noptimizer.step()\noptimizer.zero_grad()\n```\n\nWe provide details about our privacy engine in `fastDP/README.md`, including the supported modules and the arguments. By default, we use the `'MixOpt'` (hybrid book-keeping [4]) clipping mode (which enjoys almost the same time complexity as non-private optimization), and the automatic clipping function [8] (which does not need to tune the clipping threshold `max_grad_norm`). We support RDP and GLW privacy accountant, and additional accountants can be used through the argument `noise_multiplier`, after its calculation from [[Automating differential privacy computation](https://github.com/yuxiangw/autodp)] library.\n\nSpecifically, we allow the gradient accumulation to use very large batch size, which is beneficial to DP optimization:\n```python\nfor i, batch in enumerate(dataloader):\n    loss = F.cross_entropy(model(batch), labels)\n    loss.backward()\n    if i % gradient_accumulation_steps == 0:\n        optimizer.step()\n        optimizer.zero_grad()\n```\n\n## Foundation model release\nWe release DP vision foundation models in [v2.1](https://github.com/awslabs/fast-differential-privacy/releases/tag/v2.1): VisionTransformer models (ViT; ~86M param) following [Pre-training Differentially Private Models with Limited Public Data](https://arxiv.org/abs/2402.18752) in NeurIPS 2024. These models have [epsilon=2](https://github.com/awslabs/fast-differential-privacy/releases/download/v2.1/ViT_base_imgnet11k_DP_eps2.pt) and [epsilon=8](https://github.com/awslabs/fast-differential-privacy/releases/download/v2.1/ViT_base_imgnet11k_DP_eps8.pt), pre-trained on ImageNet-1k with AdamW (1k classes, 1 million images) and ImageNet-11k with DP-AdamW (11k classes, 11 million images). More DP foundation models to come!\n\n## Highlights\n1. This library enables large model training in the **multi-GPU distributed setting** and **supports mixed precision training** under DeepSpeed and FSDP.\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"900\" height=\"400\" src=\"./assets/scalability.png\"\u003e\n\u003c/p\u003e\nThe scalability has been tested on 100B models with 512 GPUs.\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"900\" height=\"300\" src=\"./assets/efficiency.png\"\u003e\n\u003c/p\u003e\n\n2. This library enables DP training to have almost **the same time and space complexity** as the standard non-private training. This is achieved by three key techniques as described in [4]: mixed ghost norm, book-keeping, and ghost differentiation. In practice, we observe \u003c20% memory overhead and \u003c25% slowdown across different tasks.\n\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"900\" height=\"400\" src=\"./assets/nlp.png\"\u003e\n\u003c/p\u003e\n\n3. Specifically, this library overcomes the severe memory issues of large model (commonly encountered by Opacus, which computes the per-sample gradients) and high dimensional data (commonly encountered by ghost clipping, e.g. in Private transformers), by leveraging the mixed ghost norm trick [3,8].\n\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"900\" height=\"220\" src=\"./assets/vision.png\"\u003e\n\u003c/p\u003e\n\n4. We **support all optimizers** in [`torch.optim`](https://pytorch.org/docs/stable/optim.html) (SGD, Adam, AdaGrad,...) and a wide range of **models** (BERT, RoBERTa, GPT, ViT, BEiT, CrossViT, DEiT, ResNet, VGG, DenseNet,...), including their parameter-efficient variants. For example, one can run DP bias-term fine-tuning (DP-BiTFiT) by simply freezing non-bias terms, as in `examples/image_classification`.\n\n------\nFull fine-tuning results on a single A100 GPU\n\n| Datasets | ε | Setting                                                  | Model         | Accuracy  | Time(min)/epoch |\n|----------|---|----------------------------------------------------------|---------------|-----------|-----------------|\n| CIFAR10  | 2 | [6] | ViT-large     | 98.9      | 7.0             |\n| CIFAR100 | 2 | [6] | BEiT-large    | 88.7      | 6.5             |\n| CelebA   | 3 | [6] | ResNet18      | 88.2      | 2.7             |\n| SST2     | 3 | [8] | RoBERTa-large | 93.9      | 13.5            |\n| QNLI     | 3 | [8] | RoBERTa-large | 91.0      | 20.2            |\n| QQP      | 3 | [8] | RoBERTa-large | 86.8      | 70.0            |\n| MNLI     | 3 | [8] | RoBERTa-large | 86.3/86.7 | 77.1            |\n\nMore datasets, epsilon budgets, models, fine-tuning styles, and different hyperparamters can be found in the related papers.\n\n\n\n## Examples\nThe `examples` folder covers tasks on the table-to-text (E2E and DART datasets with GPT2 models), the text classification (SST2/QNLI/QQP/MNLI datasets with BERT/RoBERTa models), and the image classification (CIFAR10/CIFAR100/CelebA datasets with [TIMM](https://github.com/rwightman/pytorch-image-models)/[torchvision](https://github.com/pytorch/vision) models). Detailed `README.md` can be found in each sub-folder. These examples can be used to reproduce the results in [2,3,4,6,8].\n\n\n## Citation\nPlease consider citing the following if you want to use this library in your works:\n```\n@inproceedings{bu2023differentially,\n  title={Differentially private optimization on large model at small cost},\n  author={Bu, Zhiqi and Wang, Yu-Xiang and Zha, Sheng and Karypis, George},\n  booktitle={International Conference on Machine Learning},\n  pages={3192--3218},\n  year={2023},\n  organization={PMLR}\n}\n\n@article{bu2023zero,\n  title={Zero redundancy distributed learning with differential privacy},\n  author={Bu, Zhiqi and Chiu, Justin and Liu, Ruixuan and Zha, Sheng and Karypis, George},\n  booktitle={ICLR 2023 Workshop on Pitfalls of limited data and computation for Trustworthy ML},\n  journal={arXiv preprint arXiv:2311.11822},\n  year={2023}\n}\n\n@inproceedings{bu2022differentially,\n  title={Differentially Private Bias-Term Fine-tuning of Foundation Models},\n  author={Bu, Zhiqi and Wang, Yu-Xiang and Zha, Sheng and Karypis, George},\n  booktitle={Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022},\n  year={2022}\n}\n```\n\n## Acknowledgements\nThis codebase is largely inspired by [[Opacus (v0.15)]](https://github.com/pytorch/opacus), [[Private transformers (v0.2.3)]](https://github.com/lxuechen/private-transformers), [[Private Vision]](https://github.com/woodyx218/private_vision), and [[FastGradClip]](https://github.com/ppmlguy/fastgradclip).\n\n## References\n[1] Ian Goodfellow. \"Efficient per-example gradient computations.\" arXiv preprint arXiv:1510.01799 (2015).\n\n[2] Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. \"Large language models can be strong differentially private learners.\" ICLR (2022).\n\n[3] Zhiqi Bu, Jialin Mao, and Shiyun Xu. \"Scalable and Efficient Training of Large Convolutional Neural Networks with Differential Privacy.\" NeurIPS (2022).\n\n[4] Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. \"Differentially Private Optimization on Large Model at Small Cost.\" ICML (2023).\n\n[5] Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen et al. \"Opacus: User-friendly differential privacy library in PyTorch.\" arXiv preprint arXiv:2109.12298 (2021).\n\n[6] Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. \"Differentially Private Bias-Term Fine-tuning of Foundation Models.\" ICML (2024).\n\n[7] Martin Abadi, et al. \"Deep learning with differential privacy.\" Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security.\n\n[8] Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. \"Automatic clipping: Differentially private deep learning made easier and stronger.\" NeurIPS (2023).\n\n[9] Zhiqi Bu, Xinwei Zhang, Mingyi Hong, Sheng Zha, and George Karypis. \"Pre-training Differentially Private Models with Limited Public Data.\" NeurIPS (2024).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fawslabs%2Ffast-differential-privacy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fawslabs%2Ffast-differential-privacy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fawslabs%2Ffast-differential-privacy/lists"}