Training Text-to-Text Transformers with Privacy Guarantees

Findings of the Association for Computational Linguistics: ACL 2022, pages 2182 - 2193 May 22-27, 2022 c⃝2022 Association for Computational Linguistics Training Text-to-Text Transformers with Privacy Guarantees Natalia Ponomareva Jasmijn Bastings Sergei Vassilvitskii Google Research {nponomareva,bastings,sergeiv}@google.com Abstract Recent advances in NLP often stem from large transformer-based pre-trained models, which rapidly grow in size and use more and more training data. Such models are often released to the public so that end users can fine-tune them on a task dataset. While it is common to treat pre-training data as public, it may still contain personally identifiable informa- tion (PII), such as names, phone numbers, and copyrighted material. Recent findings show that the capacity of these models allows them to memorize parts of the training data, and sug- gest differentially private (DP) training as a po- tential mitigation. While there is recent work on DP fine-tuning of NLP models, the effects of DP pre-training are less well understood: it is not clear how downstream performance is affected by DP pre-training, and whether DP pre-training mitigates some of the memoriza- tion concerns. We focus on T5 and show that by using recent advances in JAX and XLA we can train models with DP that do not suffer a large drop in pre-training utility, nor in train- ing speed, and can still be fine-tuned to high accuracy on downstream tasks (e.g. GLUE). Moreover, we show that T5’s span corruption is a good defense against data memorization. 1 Introduction Recent advances in natural language process- ing tasks are largely due to introduction of large Transformer-based models trained on large amounts of data. Models such as GPT-2 (Radford et al., 2019) and T5 (Raffel et al., 2020) have bil- lions of parameters and are trained on hundreds of gigabytes of mostly uncurated public crawl data. These models are often released as modifiable checkpoints, and the end users have the ability to fine-tune these models to their final tasks using an often more limited amount of data and compute. While pre-training datasets are typically treated as public, their sheer size makes them difficult to curate or scrutinize (Bender et al., 2021; Rogers, 2021). Moreover, such public datasets (e.g., web crawls) likely contain private information (Dodge et al., 2021), e.g., data erroneously released to the web or copyrighted text. The capacity of recent models makes it possible for them to memorize parts of the training data (Carlini et al., 2020), even after subsequent fine-tuning, and poses risks to the owners of pre-trained language models. In this work, we focus on a potential mitigation: making the model fully private using differential privacy (DP). We focus on T5 (Raffel et al., 2020) and explore how well DP mitigates privacy risks and how it affects pre-training and downstream perfor- mance. Our contributions are as follows: 1. We describe how to achieve fully private T5 models by (a) introducing private Sentence- Piece (DP-SP) and (b) combining it with pri- vate training (DP-Training). 2. To the best of our knowledge, we are the …

Content truncated to 500 words