Can Differentially Private Mixing of Public Datasets Improve Private Learning Utility?

Why the public pretraining mixture is the lever

DP training is the standard way to protect sensitive records, but it usually costs model utility. Prior work found that pretraining on public data before DP fine-tuning can soften that drop, and that the benefit depends on how relevant the chosen public data is to the sensitive task. The paper's starting observation is that pretraining on all public datasets uniformly is common practice and state of the art for privately mixing public data.

That uniform default is the target. If relevance varies across candidate public sources, then a single fixed weighting wastes pretraining signal on sources that are poorly matched to the downstream sensitive task. The paper asks how to privately choose the weighting that gives the best downstream performance on a given sensitive dataset.

Learning mixture weights as a low-dimensional linear model

The key insight is that the best mixture of multiple public datasets can be found by privately learning a low-dimensional linear model. This builds on MixMin, a non-private data mixing method showing that as models approach Bayes optimal, finding the best weighting of pretraining datasets for a downstream task reduces to minimizing a convex objective. The paper's contribution is recognizing that this objective is amenable to private learning with little utility degradation.

Concretely, proxy models are trained on public data and combined with mixture weights learned with DP-SGD on a fraction of the sensitive data. The pipeline then pretrains on public data according to those weights and DP fine-tunes on the remaining sensitive data. For k public datasets, the privacy cost for a fixed error grows at worst O(sqrt(k)) using existing DP algorithms, rather than the exponential mixture space that private hyperparameter selection would require.

Splitting the private data across two stages

DP-MixMin splits the private target dataset into two disjoint subsets: one used to compute the mixture weights, and one used to fine-tune the pretrained model. Because the two mechanisms operate on disjoint subsets, parallel composition gives an end-to-end guarantee of (epsilon, delta)-DP. In the experiments this is (epsilon, delta) = (1, 10^-5).

This split is a real trade-off worth noting: the uniform-mixture baseline uses all of the private data for fine-tuning, whereas DP-MixMin reserves a portion for mixture learning. The paper reports that DP-MixMin still improves over uniform mixtures, which it reads as evidence that optimizing the mixture can compensate for fine-tuning on less data. A separate comparison found sequential and parallel composition performed similarly on NIH Atelectasis at total epsilon = 1.

X-ray gains concentrate on low-prevalence labels

On the NIH ChestX-ray14 dataset, applying the method to find tailored mixtures of X-ray datasets to pretrain on improved macro AUC by up to 0.037 across privacy budgets compared to the baselines. The largest reported relative gain was +22.8% relative AUC on Cardiomegaly at epsilon = 1.

The paper's discussion ties these gains to specific conditions: large improvements appear under low-prevalence labels, tight privacy budgets, and user-level privacy. Cardiomegaly is a useful illustration because its prevalence in the audited split is low (2.48% positive), so a small absolute AUC change can correspond to a large relative change. Readers comparing results across diseases should keep absolute AUC and relative AUC distinct, since the two move differently when prevalence differs.

Language modeling perplexity drop on ENRON

For DP training on the ENRON email dataset, pretraining on the method's mixture of The Common Pile, a collection of public-domain text datasets, decreased test perplexity by 16% relative to the baseline mixtures. This is a different metric from the AUC used in the imaging experiments: lower perplexity is better, and the comparison is against baseline mixtures rather than against uniform pretraining alone.

The language-modeling setup also differs in privacy granularity. ENRON fine-tuning uses user-level DP, where two neighboring datasets may differ in all examples contributed by one user, and the mixture-learning step clips and noises per-user gradients rather than per-example gradients. The reported 16% perplexity reduction therefore belongs to a user-level DP setting, not to the example-level setting used in the imaging audit.

How close the private pipeline gets to non-private

The paper compares DP-MixMin against its non-private version, which finds the mixture with no privacy and fine-tunes on the full private set, making it a strict upper bound. With CheXpert pretraining at epsilon = 1, DP-MixMin matched that non-private upper bound to within 0.001 macro AUC; with MIMIC-CXR pretraining it matched to within 0.006 macro AUC.

This comparison matters because it separates two costs that are easy to conflate. One is the cost of learning the mixture privately, and the other is the cost of reserving part of the private data for mixture learning instead of fine-tuning. The small macro AUC gaps suggest that, in these imaging settings, the private mixture-learning step adds little on top of the non-private optimum.

Excess error grows with the square root of sources

The paper validates its central claim empirically by measuring excess error as the number of public sources k increases. Using ResNet-50 proxies trained on k ImageNet-1k classes and running DP-MixMin on the first 10 binarized CIFAR-100 classes at epsilon = 1, delta = 10^-5, excess error grew sub-linearly in k. A log-log fit over k >= 32 gave a slope of 0.49, matching the sqrt(k) prediction of 0.5 and well below the linear cost of private hyperparameter search.

The practical reading is that adding more candidate public sources is not free, but it is far cheaper than trialing mixtures one by one. The paper also reports robustness checks: varying the CheXpert proxy training budget from 1 to 6 epochs left NIH Atelectasis AUC similar and all above uniform pretraining (0.707 AUC), and the learned mixture stayed stable across proxy budgets by cosine similarity.

Where the reduction does not transfer

The method's reduction relies on a no-covariate-shift assumption, meaning candidate public sources share input features and differ mainly in labels. The paper states that extending DP-MixMin to tabular and other domain settings remains important future work, because public tabular sources often differ in their input features and thus violate that assumption.

The paper also explains why Gradient Subspace Distance, a competing source-selection method, is inapplicable in its imaging setting: because all 14 candidate sources within a corpus share the same image set and differ only in per-image labels, random-label gradient subspaces depend only on the inputs, so any two sources sharing inputs receive a GSD of zero. The authors note GSD is informative only when candidates have distinct input distributions.

An empirical privacy audit of the mixture-learning step found no evidence of a violation at the claimed level. At epsilon = 1, the natural-canary audit gave an empirical lower bound of 0 for all 14 NIH tasks, and the stronger max-clipped-gradient canary gave a maximum of 0.131 across tasks, below the claimed epsilon = 1. When privacy noise was removed, the same audit reached values as high as 5.60, showing the audit can detect substantial leakage when present.

What to watch when comparing mixtures

The most decision-relevant pattern in this paper is conditional rather than uniform: the gains from privately learned mixtures are largest under low-prevalence labels, tight privacy budgets, and user-level privacy, and they are measured against uniform pretraining and random mixture search rather than against arbitrary alternatives. A reader evaluating whether to adopt this pipeline should first check whether their candidate public sources share input features with the sensitive task, since that is the assumption the reduction depends on.

The second check is which metric and which privacy granularity the reported gain belongs to. The imaging results are macro AUC and per-disease AUC at epsilon in {1, 2, 5} with delta = 10^-5, while the ENRON result is test perplexity under user-level DP. The +22.8% relative AUC on Cardiomegaly at epsilon = 1 and the 16% perplexity reduction are not interchangeable evidence, and the paper's own framing places the largest imaging gains on low-prevalence labels rather than spreading them evenly across all 14 diseases.

Sources used in this answer