Escaping Iterative Parameter-Space Noise: Differentially Private Learning with a Hypernetwork

Differentially Private Stochastic Gradient Descent (DP-SGD) is the standard for training models on sensitive data, but it suffers from significant utility loss because it injects high-dimensional noise into the model parameters at every optimization step. This paper introduces DP-DeepSets, a framework that replaces iterative gradient updates with a single forward pass through a hypernetwork.

Instead of updating parameters via gradients, the authors train a hypernetwork on public datasets to learn a mapping from data to model parameters. The process works as follows:

1. Embedding: Each private data point is passed through a shared MLP to create a low-dimensional representation.
2. Aggregation & Perturbation: These embeddings are averaged and perturbed with Gaussian noise to satisfy differential privacy (DP) requirements.
3. Generation: The resulting noisy dataset embedding is fed into a Transformer-based hypernetwork, which generates the final parameters for the target model.

Because the privacy noise is injected only once into a low-dimensional embedding rather than repeatedly into high-dimensional gradients, the model maintains higher utility under the same privacy budget.

This approach effectively addresses the "curse of dimensionality" in DP training. By shifting the burden of learning from the private training phase to a public pre-training phase, the hypernetwork acquires a form of meta-knowledge about the task. The authors demonstrate that this method outperforms DP-SGD and other public-data-guided approaches in LoRA fine-tuning of diffusion models, achieving lower Fréchet Inception Distance (FID) scores.