Per-Sample Gradient Clipping

Unlike standard mini-batch SGD, which computes a single averaged gradient for a batch, per-sample clipping requires computing the gradient independently for each training example in the batch. This is a fundamental architectural shift that eliminates cross-sample aggregation before the clipping operation.

• Mechanism: The backpropagation algorithm is executed separately for each data point x_i to yield g_i = ∇_θ L(θ, x_i).
• Computational Cost: This is the primary source of overhead in DP-SGD, as it prevents vectorized batch operations and requires a for-loop over the batch dimension.
• Implementation: Frameworks like Opacus and TensorFlow Privacy implement this via custom per-sample gradient hooks that intercept gradients during the backward pass.

Once a per-sample gradient g_i is computed, its L2 norm (Euclidean length) is calculated. If this norm exceeds a predefined clipping threshold C, the gradient is rescaled to have a maximum length of exactly C. Gradients with norms below C remain unchanged.

• Formula: ḡ_i = g_i * min(1, C / ||g_i||₂)
• Flat Clipping: This is a "flat" clipping rule; alternative methods like adaptive clipping adjust C dynamically based on gradient statistics.
• Sensitivity Bound: After clipping, the maximum L2 norm of any per-sample gradient is guaranteed to be C, establishing the L2 sensitivity of the batch gradient computation.

The clipping threshold C is a critical hyperparameter that directly governs the privacy-utility trade-off. Setting C too low destroys too much signal, while setting it too high requires adding more noise to mask the larger sensitivity.

• Selection Strategies: Common approaches include using a quantile (e.g., median or 75th percentile) of the observed unclipped gradient norms over a subset of training data.
• Dynamic Adjustment: C can be updated periodically during training to track the evolving gradient norm distribution.
• Impact: An improperly tuned C can lead to vanishing gradients (if too low) or excessive noise (if too high), both degrading model utility.

To manage the memory overhead of storing multiple per-sample gradients simultaneously, DP-SGD implementations often divide a logical batch into smaller microbatches. Per-sample clipping and noise addition are performed at the microbatch level before results are accumulated.

• Memory Trade-off: Processing microbatches sequentially reduces peak GPU memory usage at the cost of increased wall-clock time.
• Virtual Batching: Some frameworks simulate larger batch sizes by accumulating gradients across multiple microbatches before applying the optimizer step.
• Poisson Subsampling: Microbatches are typically constructed using Poisson sampling to leverage the privacy amplification benefits of subsampling.

Ghost clipping is a memory-efficient technique that avoids materializing the full per-sample gradient tensor for each example. Instead, it computes the per-sample gradient norm directly from the per-sample activation gradients and the layer's input activations.

• Mechanism: For a linear layer with input a and weight gradient g_W = g_out * a^T, the per-sample norm ||g_W||_F can be computed as ||g_out||₂ * ||a||₂ without instantiating the full outer product.
• Benefit: This reduces the memory footprint from O(batch_size * num_params) to O(batch_size * activation_size), enabling larger batch sizes on constrained hardware.
• Adoption: This technique is a key optimization in the Opacus library and is essential for training large models with DP-SGD.

Clipping introduces a statistical bias into the gradient estimate. The clipped gradient is no longer an unbiased estimator of the true population gradient, as the direction and magnitude of large gradients are systematically altered.

• Bias-Variance Trade-off: Clipping reduces variance (by bounding extreme values) but increases bias. The total error is the sum of clipping bias and the variance from added Gaussian noise.
• Residual Information: The portion of the gradient discarded by clipping—the clipping residual—contains information about outliers. In non-private settings, this residual is lost.
• Mitigation: Techniques like reparameterized gradient clipping attempt to correct for this bias by adjusting the clipped gradient based on the probability of clipping.