Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: The paper studies the differentially private data generator problem. The authors propose the G-PATE algorithm based on the PATE framework.  The G-PATE trains a student data generator with an ensemble of teacher discriminators.  In their approach, they combine the random projection and gradient discretization to release the aggregated gradient privately.  Empirically, they demonstrate that G-PATE improves the privacy-utility trade-offs over prior work. 

main_review: Clarity: The paper is generally written well though the authors reiterate their contributions too much. 

Question:  In the standard PATE, the confidence parameter T is set to |#teachers*0.7|.  I wonder if the authors use the same confidence threshold T in all gradient positions or T needs to be tuned at different gradient locations?

Weak points:
1. My main concern is that the privacy guarantee seems a little bit artificial to me. The privacy loss of G-PATE scales to both the number of queries and the model dimension after projection. DP-GAN can benefit from privacy amplification by subsampling though its privacy loss is model-dependent. Moreover, PATE and PATE-GAN are model-agnostic, and the privacy cost is proportional to the number of queries while G-PATE is model-dependent. It makes me surprised that the proposed G-PATE take the disadvantages of both PATE and DP-GAN can beat both approaches. I suspect the advantage of the proposed G-PATE comes from the random projection and gradient discretization instead of the PATE framework. It will be interesting to investigate whether a DP-GAN (combined with gradient discretization and projection) is comparable with G-PATE.

2. The privacy cost comparison in the experiments might be unfair. G-PATE reports the privacy cost under data-dependent RDP while other baselines (DP-GAN) report the standard DP. Note that the data-dependent RDP itself is private and is much smaller compared to its data-independent counterpart. I encourage the authors to either report the data-independent privacy cost or use the similar smooth sensitivity from the original PATE to sanitize the privacy cost. 

Strong points:
1. The proposed gradient aggregation mechanism is novel and can be incorporated into other differentially private deep learning frameworks. 
2. The experimental results looks good to me despite the privacy comparison issues mentioned above. 




limitations_and_societal_impact: The authors did not discuss the potential negative societal impact.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper proposes a new method called G-PATE for generating differentially private datasets. G-PATE is motivated from the PATE framework, by training teacher discriminators on real datasets, and then privately aggregating the gradients from those discriminators to train the generator. To aggregate the gradients, the paper proposes to project the gradients to a lower dimension, discretize the gradients, and then use the voting mechanism from PATE to aggregate the gradients. The paper demonstrates that G-PATE achieves better fidelity-privacy trade-offs than the two prior techniques: DP-GAN and PATE-GAN.
main_review: Privacy-preserving data generation is an important problem in both the research community and the industry. GANs can generate high-fidelity (non-private) data much better than many alternatives, and therefore, there are many interests in applying GANs for privacy-preserving data generation. However, the two main classes of approaches in this direction (i.e. DP-GAN and PATE-GAN) achieve bad fidelity-privacy trade-offs. 

The approaches in this paper are very interesting. The idea of only making the generator differentially private while leaving the discriminator sensitive is a very good innovation, which makes it substantially different from PATE-GAN despite that both are motivated by the PATE framework. The idea of using the voting mechanism from PATE to aggregate the gradients is also very interesting, which utilizes the benefit of having multiple teachers, and makes it substantially different from DP-GAN.

The paper also conducts experiments on many different datasets and evaluation tasks, and demonstrates the superiority over DP-GAN, PATE-GAN, and GS-WGAN.

Therefore, I would regard G-PATE as a completely new class of approaches for solving this problem. I can see that this paper will open up many follow-up works and create a new opportunity on solving this important problem. I think this is a very good paper with solid contributions.

I only have one minor suggestion.
* There is an inconsistency in how you explain your proposed gradient aggregation mechanism. In many parts of the paper (e.g. abstract, introduction), you say you are aggregating the gradient in a privacy-preserving way. However, in section 4.1, you say you are generating perturbations for the generated images, and then solving a mean squared error objective over the generator. From my understanding, both of the two explanations are correct and are indeed equivalent, because the gradient of Eq. 2  is exactly (a scaled version of) \delta x, the backpropagated gradient in the discriminator till the input layer. However, mixing these two explanations up in the paper does create some confusion. I would recommend using a consistent explanation, and mention the other as an alternative understanding of the approach in Section 4.1. But the current presentation is also fine.
limitations_and_societal_impact: The authors discussed the limitations, but not the potential negative societal impact of the work.
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This study proposes a new method for generating differentially private synthetic datasets called G-PATE. 

This approach combines GANs (Generative Adversarial Neural Networks) with the PATE framework (Private Aggregation of Teacher Ensembles). The proposal utilizes known techniques from the differential privacy literature, such as gradient clipping and discretization.

The new algorithm diverges from previous methods such as DP-GAN, PATE-GAN, and GS-WGAN by creating a differentially private aggregation mechanism for directly using information from teacher discriminators to train the student generator. The method presented in the paper improves upon the previous proposals.

DPGradAgg is designed which aggregates, in a differentially private manner, adversarial perturbations created by each teacher discriminator. The privacy loss of this new method is proven and empirical evaluations on a variety of datasets (Kaggle, MNIST, Fashion-MNIST, CelebA) are shown. The method demonstrates improvements in terms of downstream utility for classification with both smaller and larger epsilon guarantees.
main_review: Strong points:
1. The student generator is trained not by ascending the gradient based on the loss from the discriminator but by using the aggregated adversarial perturbations from discriminators.
2. An interesting combination of established techniques, such as gradient clipping, discretization, and random projection, to enable the private release of the gradient at a relatively low privacy cost.

Weak points:
1. The experiments can be improved. For example, authors use the CelebA dataset but not with 40 labels but only with, e.g., the binary labels to determine the gender. Could the authors provide results, for instance, for the CIFAR-10 dataset?
2. The quality of the generated images is low.
3. The proposed idea to incorporate differential privacy into GANs is not novel and improves on existing methods (e.g., PATE-GAN).
4. The method is computationally costly: could authors compare the running times with other methods? What is the execution time of different parts of G-PATE?

Detailed comments:

- Originality: 

G-PATE differs from a typical GAN. Specifically, in G-PATE, the student generator is trained not by ascending the gradient based on the loss from the discriminator but by using the aggregated adversarial perturbations from discriminators. The direct comparison between GAN and non-private G-PATE in Appendix C indicates that G-PATE is comparable with GAN but this was done only for the simplest dataset.

This work builds off of PATE-GAN but the method introduces a new mechanism for releasing aggregated gradients (specifically in this case using the aforementioned adversarial perturbations). To my knowledge, this gradient aggregation mechanism is novel and plays a key role in the success of G-PATE over its predecessors such as PATE-GAN & DP-GAN. The study makes it clear how G-PATE differs from other algorithms. 

- Quality:

The submission provides both theoretical analyses and empirical evaluations of the proposed method. The theoretical analyses focus on understanding the privacy guarantees of G-PATE. Using the composition and post-processing properties of RDP the authors demonstrate that the privacy loss incurred by the method is simply the composition of the data-dependent RDP from the Confident GNMax aggregator over each component of the random projection dimension. This privacy loss analysis is sound to me. Additionally, the authors use composition over each training iteration to determine the privacy loss of the entire training procedure, which is correct. This analysis demonstrates that their proposed mechanism DPGradAgg is indeed differentially private.

The claims that are made about improved data utility are demonstrated but the results about improved image quality are less conclusive. G-PATE demonstrates improvements across all epsilons and datasets in terms of data utility, but these evaluations can also be improved. Given the high variance in the results of DP learning algorithms, it is unclear whether some of the increases seen would hold over multiple runs. An example of this is MNIST G-PATE vs GS-WGAN at epsilon 10 for measuring the accuracy of a classifier trained on the synthetic data. This is especially true in the data utility results on the Kaggle Credit Tabular dataset between PATE-GAN and G-PATE. When looking at the Inception score results there is no conclusive evidence that G-PATE provides better image quality. The authors address this as a future work consideration in the Inception Score section of the paper at Line 358. A suggestion for the authors to improve the clarity on G-PATE being better than PATE-GAN would be to have graphs that plot these metrics for epsilons between 0.5-10.

- Clarity:

Line 81 is incorrect: "PATE-GAN [33] trains a student generator using an ensemble of teacher discriminators." PATE-GAN trains a student discriminator using an ensemble of teacher discriminators.

Showing the results in Table 1 using graphs over a range of epsilons would help present the improvements over previous methods.

The authors distinguish between their idea and related papers in both the introduction and the related work section. The main contributions of the paper are repeated in a few sections. This should be reduced to single statements without repetitions.

Lines 285 to 290: Theorem 4 is simply a direct copy of Theorem 1. There is no need for proof G.4 in the appendix.

Regarding Table 4, what is the performance of more teachers? Why are there so many more teachers than in the standard PATE?

The lines from 325 to 329 are not entirely clear. The Laplacian Mechanism used there incurs only 0.01 of the privacy budget. The explanation that $\epsilon=0.99$ for a data generator and that data generation mechanism has $\epsilon=1.0$ is relatively a very small difference.

The code is in the supplementary material but it is not prepared to be run. The authors do not specify which versions of the libraries are used (which are rather old versions). For example, which versions of Keras or TensorFlow are used?

Typos:

Line 75 - I believe “us” should be removed? This sentence is not entirely clear.

Line 325: We calculate (not calculates)

Line 374: the privacy consumption increase"S"


- Significance:

This paper can be useful for the community. The empirical results demonstrate good improvements in data utility (which is often the motivation of DP synthetic data over actual image quality).

limitations_and_societal_impact: It would be great to see if PATE-G provides improved data utility for subgroups in downstream classification since this is a large challenge currently. This has a societal impact in that there are contentious debates between the impact of DP on the accuracy of analyses for subgroups and any improvements to this would help the adoption of DP. The authors did a good job of listing the limitations of their work especially based on the empirical evaluation at the end of their experimental section.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper presents G-PATE, a scalable version of PATE-GAN, that uses a new private gradient aggregation mechanism to
ensure differential privacy on information that flows from the teacher discriminators to the student generator. Experimental results show that G-PATE can work on both tabular and image data and it also show better performance on these data especially for smaller epsilon values compared to existing work such as DP-GAN, PATE-GAN, and few more models. 
main_review: The idea is simple yet effective. The results looks promising with some limitations. Here are some questions/suggestions:

- There are few recent works on synthetic generative models using private embeddings [1][2]. How G-Pate is compared with such models? The author can discuss this in related work (and/or in experiments if it is possible)

- Is there any reference that shows PATE-GAN can only apply on categorical data? Does the authors mean the teacher discriminators output should be categorical or the dataset itself? If the latter, there are works showed PATE-GAN can be used on both categorical and continuous features [3]. Please clarify this in the paper. 

- It would be better if the authors showed the results on more tabular data containing both continues and categorical features. 

- For Celeb data, the authors resized the images to 32*32 and 64*64. It is interesting to also see how the model performs on high quality images. 

- How G-PATE's training time is compared with Pate-GAN and DP-GAN?

- It seems the visualization of generated images are not very good especially for small epsilons. If the quality of generated samples is low what's the advantage of using DP synthesizer vs DP classifiers? Also, how is the quality of generated samples for CelebA data? 

[1] https://export.arxiv.org/pdf/2002.11603

[2] https://arxiv.org/abs/2106.04590

[3] https://arxiv.org/pdf/2011.05537.pdf

limitations_and_societal_impact: It would be better if the authors mention the limitations of the proposed work and list few future directions for the improvement.
review_title: null

Meta-review: The reviews for the paper were mixed. Unfortunately, the reviewers still did not change the score even after the rebuttal. I am still supporting acceptance because of the novel gradient aggregation scheme in the paper.

In the following I list some of the concerns that may not have been addressed adequately in the rebuttal, and the authors need to take care of them.

1. There was a concern that the advantage of the proposed G-PATE comes from the random projection and gradient discretization instead of the PATE framework. The authors did some initial experiments on DP-GAN to show that that the gradient discretization actually impacts the improvement in accuracy. However, these experiments are fairly preliminary, and needs a thorough discussion in the main text of the paper.

2. The quality of the images generated were not that great.  There were some concerns about the efficacy of the algorithm at higher epsilons >10, when compared to other approaches. Since single digit epsilons seem to be mostly the industry standard as of now, it is important to understand the efficacy of the algorithm in this privacy regime.
Decision: Accept (Poster)