Theorem 4.4.1 reveals that Entropy-SGD is optimizing a PAC-Bayes bound with respect to the prior. As a result, the priorPdepends on the sampleS, and the hypotheses of the PAC- Bayes theorem (Theorem 1.2.2) are not met. Naively, it would seem that this interpretation of Entropy-SGD cannot explain its ability to generalize. Using tools from differential privacy, in Chapter 3 we show that if the prior term is optimized in a differentially private way, then a PAC-Bayes theorem still holds, at the cost of a slightly looser bound. We will assume basic familiarity with differential privacy. (See Section 1.4 for a basic summary.)
Using Theorem 3.2.2, one can compute tail bounds on the generalization error of fixed classifiers, and then, provided that a classifier is learned from data in a differentially private way, the tail bound holds on the classifier, with less confidence. The following two tail bounds are examples of this idea due to Oneto, Ridella, and Anguita (2017, Lem. 2 and Lem. 3).
Theorem 4.5.1. Let m∈N, letA : Zm⇝Rpbeε-differentially private, and letδ >0. Then
|RD(A(S))−RˆS(A(S))|<ε¯+m−
1
¯ ε =max{ε, q 1 mlog 3
δ}. The same holds for the upper bound √
(6 ˆRS(A(S)))(ε¯+m−
1 2) +
6(ε¯2+m−1).
4.5.1
Anε-differentially private PAC-Bayes bound
The PAC-Bayes theorem allows one to choose the prior based on the data-generating distri- butionD, but not on the dataS∼Dm. In Theorem 3.3.2, we show that one can consider a data-dependent priorP(S)by using differential privacy.
Note that the bound stated in Theorem 3.3.2 holds for any posteriorQ, including one obtained by optimizing adifferentPAC-Bayes bound. Note that, in realistic scenarios,δ is large enough relative toεthat anε-differentially private priorP(S)contributes 2ε2to the generalization error. Therefore,ε must be much less than one to not contribute a nontrivial amount to the generalization error. As discussed in Chapter 3, one can match them−1rate by which the KL term decays choosingε∈O(m−1/2). Our empirical studies use this rate.
4.5.2
Differentially private data-dependent priors
We have already explained that the weights learned by Entropy-SGD can be viewed as the mean of a data-dependent priorP(S). By Theorem 3.3.2 and the fact that post-processing does not decrease privacy, it would suffice to establish that the mean isε-differentially private in order to obtain a risk bound on the corresponding Gibbs posterior classifier.
The standard (if idealized) approach for optimizing a data-dependent objective in a private way is to use the exponential mechanism (McSherry and Talwar, 2007). In the context of maximizing the local entropy, the exponential mechanism corresponds to sampling exactly from the “local entropy (Gibbs) distribution”Pexp(βF
γ,τ(·;S)), where β >0 andPis some measure on Rp. (It is natural to takeP to be Lebesgue measure, or a multivariate normal distribution, which would correspond to L2 regularization of the local entropy.) The following result establishes the privacy of a sample from the local entropy distribution:
Theorem 4.5.2. Letγ,τ>0, and assume the range of the loss is contained in an interval
of length Lmax. One sample from the local entropy distribution Pexp(βF
γ,τ(·;S)) is
2βLmaxτ
m -
differentially private.
Proof of Theorem 4.5.2. The result follows immediately from Lemma 3.4.1 and the follow- ing lemma.
Lemma 4.5.3. Let Fγ,τ(w;S) be defined as Eq. (4.2), assume the range of the loss is
contained in an interval of length Lmax, and define q(S,w) =−Fγ,τ(w;S). Then ∆q:=
supS,S′supw∈Rp|q(S,h)−q(S′,h)| ≤Lmaxτ
Proof. The proof essentially mirrors that of (McSherry and Talwar, 2007, Thm. 6).
Sampling from exponential mechanisms exactly is generally intractable. We therefore rely on the result proved in Corollary 3.4.8, which allows us to use SGLD to produce an approximate sample and obtain the same bound up to a term that depends on the degree of convergence.
Remark4.5.4. One must verify that SGLD produces a sequence that converges in distribution. Teh, Thiery, and Vollmer (2016) give sufficient conditions that suffice: they ensure that the gradients do not explode and cause the diffusion to fail to converge. There are simple examples where this behaviour can arise, but this problem does not appear to plague the application of SGLD to neural networks.
In summary, to obtain a data-dependent prior which yields a valid PAC-Bayes bound, we optimize the local entropyFγ,τ(·;S)using SGLD, repeatedly performing the update
w←w+12ηgˆ(w) +pη/βN(0,Ip),
where at each round ˆg(w)is an estimate of the gradient∇wFγ,τ(w;S). (Recall the identity
Eq. (4.3).) As in Entropy-SGD, we construct biased gradient estimates via an inner loop of SGLD. (We ignore this source of error.) In summary, the only change to Entropy-SGD is the addition of noise in the outer loop. We call the resulting algorithm Entropy-SGLD. (See Algorithm 2.)
As we run SGLD longer, we obtain a tighter bound that holds with at least probability approaching 1−δ. However, in practice we may not know the rate at which this convergence occurs. In our experiments, we use very long runs to approximate near-convergence and then only interpret the bounds as being optimistic. We return to these issues in Sections 4.6 and 4.10.