Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper provides an improved theoretical guarantee for the defense against reconstruction attacks using Renyi differential privacy. The correctness of the theoretical analysis is supported by the experimental analysis
strength_and_weaknesses: Strength: The theoretical bound in this paper is much better than the state of the art when \sigma is small (e.g., 0.4). This makes the bound useful for application scenarios with moderate privacy requirements (but may with strong accuracy requirements)

Weakness:
1. The theoretical bound in this paper is just slightly better than the state of the art when \sigma becomes larger (e.g., 0.5), which means the result is similar to the state of the art under usual privacy requirements.

2. There is no comparison with Balle et al. when \sigma > 0.6. I am not sure whether the proposed algorithm is better or worse than Bella et al. in the standard range of noise (1 < \epsilon < 3).

3. I think this paper can be improved by providing an experiment about the accuracy of different models under different privacy guarantees/noise levels (I am not an expert on NLP, please let me know if some experiments in the paper already analyzed some metrics similar to accuracy)

4. I suggest the authors improve the readability by adding a statement that Renyi DP-SGD is implemented in the same way as DP-SGD. Otherwise, it's hard for the readers to know how Renyi DP is achieved for SGD.

5. I would also suggest discussing other applications for Renyi DP. For example, improving robustness.
clarity,_quality,_novelty_and_reproducibility: Clarity: Okay, can be understood, but require some effort.

Quality: Okay, there might be some technical issues as mentioned in the weakness.

Novelty: Okay, but not extremely novel

Reproducibility: N.A., I am not an expert on NLP. Thus, I have no idea whether the experiments can be reproduced or not.
summary_of_the_review: I am not an expert on NLP, and all my judgments are based on the differential privacy part of this paper. 

As mentioned in the Strength And Weaknesses, some details of this paper are not clear and there might be some technical issues. The presentation can also be improved.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This work examines whether the secret information that may be contained in the training data set can be extracted from a model which satisfies RDP. This problem is positioned as a problem of intermediate difficulty between the reconstruction and membership attacks. The authors define leakage as the probability that an attacker identifies a secret in a model learned from data that contains the secret and in a model learned from data that does not. Through analysis, the authors obtain upper bounds on the log ratio of the two and compare them to empirical evaluations.
strength_and_weaknesses: Strength
- Considered an interesting and novel problem
- The considered problem well fits privacy that should be considered in the real world

Weakness
- Characterization of the obtained result seems to be a bit weak

clarity,_quality,_novelty_and_reproducibility: To me, the definition looks vague. Is secret defined as a full sample or a part of a sample?
The example discussed in the introduction looks like a  part of a sample, but from the definition in Section 3, it looks like a full sample. In experiments, the bit size of the secret is controlled. If the secret is a full sample, this cannot happen.

I could not well understand the relationship between Section 3.1 and Section 3.2. 

Is it possible to characterize the absolute leakage concerning sample size or some other factors that we can control?

summary_of_the_review: Overall, the manuscript considers an interesting problem.
Experimental results are interesting, while the characterization of theoretical results seems to e a bit weak.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes a privacy protection method against training data extraction attacks from language model based on Rényi differential privacy. The authors point out the effect of sample length on privacy leakage and derive privacy bound based on Rényi differential privacy, and then propose an improved method based on lazy sampling to identify training samples that may leak privacy. The authors construct corresponding experiments for each part of the proposed method by fine-tuning the language model and show that the privacy leakage under the proposed attack model is less than the privacy guarantee. 
strength_and_weaknesses: Strength
1. This paper considers the sample length and derives the privacy leakage boundary of training samples based on the Rényi differential privacy method, which seems to be reasonable and effective.
2. The authors propose a lazy-sampling-based method to improve the existing method to perform training data extraction attacks, which improves the performing efficiency and effectively identifies potentially private samples. 
3. The organization and the results of the experiments in this paper appear to be efficient and reasonable. 

Weaknesses
1. First, this article is difficult to read for me. I suggest that authors should be more careful with domain words and notations, such as “reconstruction attack”. In my background knowledge, a "reconstruction attack" in federated learning or graph learning for privacy-preserving is to reconstruct the training data using information (gradient or aggregated information) from the model training in the training process. However, I think that the "reconstruction attack" in this paper is an attack method in the inference process just like the member inference attack. I am confused if the “reconstruction attack” in this paper is the “training data extraction attack”. If it is a new attack, I would expect the author to redefine it.
2. In my opinion, the core idea of this paper is to use differential privacy to achieve that the generated samples using the random attack model are satisfying the privacy guarantee. Although the proposed method is effective and reasonable, it is incremental work and lacks innovation. 
3. I think the organization of this paper needs improving. The framework of this paper looks fine, important sections are included and organized in a reasonable way. However, the content in each section is not easy to follow, and the organization of each section can be improved.
clarity,_quality,_novelty_and_reproducibility: This framework is of average quality and kind of lacking innovation. The description of this framework is clear and the theoretical analysis is sufficient. In the experimental part, the validity analysis of the results is relatively redundant. The originality of the work is acceptable.
summary_of_the_review: This paper proposes a privacy protection method against training data extraction attacks from language model based on Rényi differential privacy. However, this work lacks some innovation for ICLR and the content in each section is not easy to follow and the organization can be improved.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper studies the protection guarantees of Renyi Differential Privacy (RDP) against reconstruction attacks. The authors derive an improved theoretical bound on the information leakage of RDP mechanisms compared to prior work [Mironov et al. 2019, Balle et al. 2020], hence, they show an improved protection against extraction of rare secrets from training data in low privacy regimes ($\epsilon > 8$). The authors provide empirical results on benchmark datasets to support their claims. 

Despite the importance of this problem and the fact that the paper has some merits (deriving and improved theoretical bound and conducting a range of experiments on real-world datasets), the results are not strong enough to justify acceptance.The improvement is not significant compared to the results implied by prior work (particularly, [Balle et al. 2020]). According to the newly added empirical results (comparison to [Balle et al. 2020] and [Mironiov et al. 2019] added during the discussion phase), the improvement is only noticeable and meaningful in the (very) low privacy regime ($\epsilon$ is quite large) when the size of the secret is relatively large. This limits the significance of the results and makes them less compelling. Also, the added comparisons seem to be rushed (that was clear from the missing plot labels and the sparse discussion). The paper could benefit from an extensive, more careful empirical comparison to prior work. As it stands,  the claims of significance are not quite convincing. 
justification_for_why_not_higher_score: The results are not strong enough to justify acceptance. The improvement is not significant compared to the results implied by prior work.
Decision: Reject