Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: Strong point 1: The idea of putting noise insertion (via noisy data-generation models) and optimization of good representations together to obtain LDP representations and/or synthetic data seems to be effective. While (6) relies on some independency assumptions, it might be fine in most cases and empirical evidence is reported to support it

Strong point 2: It is an application-agnostic approach and theoretically any downstream tasks and models can be supported... When there is a label, the privacy budget is split and random perturbation is used on labels

Strong point 3: It outperforms naive LDP baselines (with noise added directly to features) a lot in experiments

Weak point 1: The proof of the most important result is missing: It is said that "sampling from $q_\phi(z|x)$ produces a representation $\tilde z$ of $x$ that satisfies $\epsilon$-LDP. I don't think it is a trivial result and the author needs to everything together (including the analysis of sensitivity, the optimization algorithm, and so on) to formally prove it

Weak point 2: A minor issue: in figures of experiments, by "clean accuracy", do you actually mean "accuracy" (for some algorithms in the figures, it is privacy accuracy?)

W1 is the main reason for the rating of 6 but not higher ones - highly encourage the authors to fix it before the publication 
review_title: This work proposes an application-agnostic way to generate LDP representations of sensitive data or synthetic data that satisfies LDP. The proposed approach is effective for high-dimensional data. Downstream ML tasks can take these representations or synthetic data without worrying about privacy leakage, and achieve better accuracy than existing LDP solutions 

final_score: rating: 3: Clear rejection
review_content: In this paper, the authors present a generative-model-based Laplace mechanism. By training the VAE on some dataset, the trained encoder can be used to privatize raw data towards epsilon, delta-LDP. Though the method is novel, the privacy guarantee of the proposed method is not clearly stated and proved. Related experiments are not convincing, either.

**Strength**
The paper is well written with a clear motivation, explanation of methodology. To my knowledge, I believe the work is useful for the privacy research community. The proposed method is also novel.

**Weakness**
- The motivation to use the Laplace mechanism is not very clear. At the beginning of Sec. 2, the authors reason the usage by "as it provides strong theoretical privacy guarantees". This is not convincing for readers especially for those who are not familiar with LDP. Since the Laplace mechanism directly comes from the CDP, I would wonder how does the Gaussian mechanism works. How does the Laplace mechanism guarantee privacy better than the Gaussian mechanism? Reference or proof is essential here.

- In page 3, the authors briefly mention that the local version of the Laplace mechanism can be epsilon-LDP if the sensitivity is accordingly defined. This really lacks rigorousness. In the following sections, the authors refer to (Dwork and Roth, 2014) for the post-processing theorem. Since the work (Dwork and Roth, 2014) is mainly about CDP, I am not sure how the post-processing theorem can be adopted for LDP. Either reference or clear proof is required.

- Meanwhile, there lacks an end-to-end proof of the privacy guarantee of the VAE. I am not sure if the proposed VLM training guarantees privacy. Either, the privacy of encoding is not very clear. Especially, there involves a non-private training on stage 1.

- The experiments are run with pretty week baselines. Through this paper, the authors actively use the same conclusion from CDP (Dwork and Roth, 2014). Thus, I suppose the state-of-the-art CDP algorithms should also be applicable to the experimented tasks, e.g, classification. For the specific task, how well is the proposed compared to the SOTA CDP private learning algorithms? For example, (Abadi, et al., 2016), or (Phan, et al. 2017). Especially, (Phan, et al. 2017) also proposed an adaptive Laplace mechanism without depending on pre-training of the mechanism.

- In page 4, the DP-Adam mentioned in Stage 2 is not stated or proved in (Abadi et al., 2016). Only DP-SGD was discussed. A strict proof is required for the DP-Adam which intensively re-uses private results to help improve the gradients. Thus, the privacy guarantee is not straightforward.

- Seems the VLM training is using a non-DP optimizer at stage 1. Then how the whole training could guarantee privacy on the VLM training set. In experiments, the VLM training set is directly extracted from the private dataset (MNIST). Even though the author experiments with diverse D_1 D_2 distribution for VLM train/test in Sec 4.2, the two datasets are still from the same dataset. In practice, when such a D_2 is private, it is hard to find a D_1 to be non-private. I am afraid this could cause serious privacy leakage. Therefore, I doubt if the experimental results are useful for proving the effectiveness of a private algorithm. More realistic dates should be used.

- In Sec 4.1, the authors run the experiments in two steps. First, the VLM is trained with 'a DP encoder using D_1'. I am not clear how the DP encoder comes from. Does the VLM is also trained with DP? The setting has to be clarified.

- The experiment comparison seems not fair for baselines. For VLM, there are two datasets for training VLM and encoding classification train data. However, the baseline only has classification training data. The VLM encoder has additional information about the data distribution or the noise (by back-propagation in VLM training). The unfairness in the information could be the core reason for the difference in performance. How does the baseline perform if it is pre-trained and tuned (hyper-parameters) on another dataset?

(Phan, et al. 2017). Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learning
review_title: Well written but lack of theoretical discussions and weak empirical studies. 

final_score: rating: 6: Marginally above acceptance threshold
review_content: For LDP, when applying noise directly to high-dimensional data, the required noise entirely destroys data utility. In this paper, authors introduce a novel, application-agnostic privatization mechanism that leverages representation learning to overcome the prohibitive noise requirements of direct methods. They further demonstrate that this privatization mechanism can be used to train machine learning algorithms across a range of applications. They achieve significant gains in performance for high-dimensional data. 

In this paper, authors have benchmarked results against such a mechanism, in which add Laplace noise to all continuous features, and flip each of the categorical features with some probability. 
For high-dimensional datasets, features are often highly correlated; consequently, noising features independently is wasteful towards privatizing the information content in each datapoint. A more effective approach to privatization involves noising a learned lower-dimensional representation of each datapoint using a generic noising mechanism. Applying the Laplace mechanism thus ensures the encoded latents, as well as reconstructed datapoints satisfy LDP. They focus on classification tasks. At inference time, they show that this classififier can act on either clean or privatized datapoints,.

For the writing, it’s better to give a clear algorithm. For the experiment, when epsilon<=10, the accuracy is not very good. The related work and comparisons are not enough. They are quite a few work about LDP learning can be literature reviewed. By the way, we usually use private data rather than privatized data.

review_title: Review

final_score: rating: 6: Marginally above acceptance threshold
review_content: Summary:
This paper presents a new privatization mechanism for Local Differential Privacy based on representation learning. The proposed VAE-based method is used for the low-dimensional latent representation of the data and uses the Laplace mechanism to satisfy Local DP. The paper shows this mechanism can be used across various applications such as private data collection, private novel-class classification, data joining, etc.

The paper is clear and easy to follow. The proposed method provides a great solution for data sharing with the local DP and can be used in many real-world applications. However, some clarification is needed. The experimental results can be improved by adding more baselines. Some important/recent references are also missing.

Major Comments:
-         It would be better if the authors add a related work section or extend the literature review paragraph in Introduction and include more recent work in this area and point out how the proposed work advances the state-of-the-art. There are several works on DP for high-dimensional data such as:
AutoGAN-based Dimension Reduction for Privacy Preservation by Nguyena et al.
P3GM: Private High-Dimensional Data Release via Privacy Preserving Phased Generative Model by Takagi et al.
There are also several existing works on LDP based on VAE. The authors are expected to state the differences between the existing work and the proposed work.
-         The authors mentioned the DP Synthetic data models need large data, this is also the case for training the VAE in this work. Also, they mentioned these techniques need labeled data. DP-GAN models need access to real data for training (no label is required) and then it can be used indefinitely for generating synthetic data. Please clarify this.
-         In an existing work (P3GM paper mentioned above), it is shown that VAE’s objective function is too sensitive to the noise of DP-SGD, how the authors tackle this problem? And how it affects the final results?
-         The baseline methods are limited to "direct noise features" only. It would be better if the authors use other techniques such as some recent work on LDP on high dimensional data or other general DP classifiers, DP-SGD, PATE, etc. as the baselines for this experiment.
-         It would be better if the authors also showed the performance of the proposed method on higher dimensional data (e.g., Lending club has only 23 features)


Minor comments:
-         In the introduction, please list the contribution of this work.
-         Please define all variables in Eq 5-6.
-         Please add more up-to-date references.
review_title: A well-written paper on an important subject. Good results, needs some improvements.

Meta-review: The paper considers the problem of private data sharing under local differential privacy. 

(1) it assumes having access to a public unlabeled dataset for learning a VAE, so it reduces the dimensionality in a more meaningful way than simply running PCA. (2) the LDP guarantee is coming from the standard Laplace mechanism and Randomized Responses. (3) then the authors propose how to learn a model based on the privately released (encoded) data which exploits the knowledge of the noise distribution.

None of these components are new as far as I know, nor were they new in the context of differential privacy. For example, the use of a publicly available data for DP was considered in: 

- Amos Beimel, Kobbi Nissim, and Uri Stemmer. Private learning and sanitization: Pure
vs. approximate differential privacy. In Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques, pages 363–378. Springer, 2013.

(they called it Semi-Private Learning...)

- Papernot, N., Abadi, M., Erlingsson, U., Goodfellow, I., & Talwar, K. (2017). Semi-supervised knowledge transfer for deep learning from private training data. In ICLR-17.

The idea of integrating out the noise by leveraging the known noise structure were considered in:

- Williams, O., & McSherry, F. (2010). Probabilistic inference and differential privacy. Advances in Neural Information Processing Systems, 23, 2451-2459.

- Balle, B., & Wang, Y. X. (2018). Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising. In International Conference on Machine Learning (pp. 394-403).

And many subsequent work.

The contribution of this work is in combining these known pieces (without citing some of the earlier work) to achieve a reasonably strong set of experimental results (for LDP standard).  I believe this is the first experimental study that uses VAE for the dimension reduction, however, this alone is not sufficient to carry the paper in my opinion; especially since the setting is now much easier, with access to a public dataset.

The reviewers question the experiments are baselines are usually not using a public dataset as well as the practicality of the proposed method.   Also, connections to some of the existing work on private data release (a.k.a., private synthetic data generation) were note clarified. For these reasons, there were not sufficient support among the reviewers to push the paper through. 

The authors are encouraged to revise the paper according to the suggestions and resubmit in the next appropriate venue.
Decision: Reject