Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper presents a DP model based on Sinkhorn GAN. Different from DP GAN models that are based on adversarial loss, they use an optimal transport (OT) distance similar to Wasserstein distance called Sinkhorn divergence. The idea is simple and incremental, it is an extension of Sinkhorn GAN. Experimental results looks promising but some important results are missing.  

main_review: - In Section 2, the authors briefly mentioned some of the existing DP-GAN methods based on DP-SGD or PATE. Many these techniques or new developed version of them are already applied noised on the gradient of the Wasserstein distance and handled instability of traditional GANs. It is not clear how the proposed method is different from the state-of-the-art techniques. Maybe a good comparison between DP-Sinkhorn and DP-WGAN can better address this issue.

- Please explain how DP-Sinkhorn can be applied on non-image data (e.g., tabular data) where both continues and categorical features exist. For GANs, there are several techniques that handle tabular data (e.g., CTGAN).

- Please provide more information about cross group and debiasing group and why noise is only added to the cross group?

- One of the disadvantage of GAN models are the long training time. It would be great if the authors show the training time comparison between the proposed model and DP-GAN models.

- In experimental results, why CelebA data is missing in table 1 (comparison results)? Why for this dataset, the image size is reduced to 32*32? How the model can handle large scale datasets (images with high resolution)? Why Figure 3 does not include other benchmarks? 

- Please explain how the proposed model performs on imbalanced datasets and if it suffers from mode collapse similar to some traditional GAN models?
limitations_and_societal_impact: It is better if the authors mention few limitations and future directions for this model
review_title: null

final_score: rating: 4: Ok but not good enough - rejection
review_content: summary: The paper proposes DP-Sinkhorn, an optimal-transport based generative model for privacy-preserving data generation based on differential privacy.

Optimal transport based generative models minimize variants of the Wasserstein distance, in particular an entropy-regularized version. The Sinkhorn divergence adds an autocorrelation term which cancels out the entropic bias completely when the distance is zero. [36] showed that the gradients of the empirical Sinkhorn loss are biased and proposes using independently drawn samples from the generator, the "debiased" Sinkhorn loss.

This paper proposes the "semi-debiased" Sinkhorn loss which, instead of using independently drawn samples, splits the sample along the batch dimension. 

Differential privacy is added by perturbing gradients with the privacy level determined using the RDP accountant. 

The method of using the semi-biased Sinkhorn loss with DP is termed DP-Sinkhorn and the paper argues that the lack of adversarial training, as opposed to GANs, avoids training instability and the need for early stopping. 

Experimental results indicate better performance on MNIST, Fashion-MNIST and Celeb-A compared to other DP generative models. 
main_review: In general, I found the paper to be confusing in terms of what it is arguing its main contributions are. 

The paper casts itself as a contribution in privacy-preserving generative models, but there is not really any novelty in the DP domain as existing privacy mechanisms are used to achieve DP in the same way they are used for existing DP GANs and related models.

Rather, the primary novelty is that the authors have proposed the "semi-debiased" Sinkhorn loss, compared to the debiased Sinkhorn loss, but it's not clear what this has to do with privacy - and if this does represent a significant improvement, the paper does not dedicate much theory or experiments in attempting to understand its improvement (why the semi-debiased version is better in a general, non-private context).

This same confusion extends to the experimental results. While the results appear strong, the only included baselines are other DP generative models so it's unclear why the performance is better (is the underlying model just better in a non-private context so it remains better even after DP is added?). This confusion makes it difficult to judge the novelty and significance. 

It seems there are 3 possibilities: 1) the paper is arguing OT-based generative models are better in general than GANs so they remain better when coupled with standard DP mechanisms; 2) the paper is arguing that the "semi-debiased" Sinkhorn loss significantly improves over the debiased Sinkhorn loss and that's what's responsible for the gains (making privacy a secondary thought); 3) the paper is arguing there is something specific about the semd-debiased Sinkhorn related to privacy that causes it to perform better (compared to other Sinkhorn losses) when coupled with DP mechanisms. I'm not sure which the paper is intending to argue and what the primary support would be for the claim. 

I also found the claim that DP-Sinkhorn "avoids the need for early stopping" strange since this does not appear to be something specific to adversarial learning.

Finally, the writing in section 4.2 should be more clear and explicit since it's describing the main contribution, e.g. X' is never defined. It still remains unclear to me why the performance should be that different by simply splitting the batch rather than sample from the generator twice.
limitations_and_societal_impact: There is not much discussion of limitations
review_title: null

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper proposes a new technique for generating differentially-private synthetic data. The approach avoids adversarial training altogether, which has historically given poor model accuracy due to its instability and sensitivity to noise. Instead, the authors minimize Sinkhorn divergence, which is a computationally-tractable approximation to the optimal transport distance between the true distribution and the generated one. The authors demonstrate empirical gains over existing techniques for DP generative models. 
main_review: Overall, I think this is a potentially interesting idea, and I believe there is a lot of value to pursuing non-adversarial techniques for DP generative models. The idea of using sinkhorn divergence to (non-adversarially) train a generative model appears to be new, to the best of my knowledge. 

My main concern is that the proposed generative model simply doesn’t work very well in the non-private setting, as evidenced by its poor FID scores. This seems to suggest that there is no hope of making this approach ever have “good enough” fidelity to compete with non-DP data. That being said, Sinkhorn-DP does seem to have slightly better FID and prediction accuracy than the many competing baselines, so that is an interesting observation. Though the difference is not large compared to, say, GS-WGAN. So when we’re talking about FID scores that in the hundreds, I would have ideally liked to see a more substantial improvement over the state-of-the-art scores. 

Technically, I found the ideas in this paper to be a bit limited. The approach is heuristic, and there is no fundamental reason this approach should work better, other than getting rid of adversarial training. The Sinkhorn-DP approach seems to be very sensitive to hyperparameters as shown in the evaluation, and it is only evaluated on small-scale datasets. The theoretical claims are limited to proving DP of the scheme, which follows trivially from the construction. So in terms of contribution, I am not sure this paper deepens our understanding of how to improve DP generative models. That being said, it does appear to give (modest) gains over SOTA.  

I was not able to understand a few details of the approach from the paper: 

Def. 4.1 – how is the cost matrix C_AB defined, and what is its intuitive meaning? (I did see you partially discuss in this in Sec. 4, but it should come earlier, and I still wanted more details on how to interpret C_AB). What is the Sinkhorn Algorithm used to compute P_AB, and why isn’t W_λ(X, X)=0? 

Algorithm 1: Why do you clip grad(X[n:n+n’]) if you are not adding DP noise? What is the meaning of the categories 0,…, L? Are you assuming labelled data and conditional generation? If so, this isn’t described in the problem setup… (Again, I later saw in the evaluation that you are considering conditional generation, but this wasn’t clear upfront)

Minor comments:
In contrast, only a single generator network is trained in DP-Sinkhorn, making our approach more amenable to various hardware configurations -> do you mean a single discriminator? The previous lines are about multiple discriminators.

limitations_and_societal_impact: The authors seem to be aware of several of the limitations of their approach. It may be helpful to discuss the fact that the non-private model has very poor fidelity, but the DP version still outperforms existing baselines. Is this fundamental? I think this is an interesting question to explore.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: The paper considers the problem of generating private synthetic data using generative adversarial networks trained with differential privacy. While this has been considered, the authors propose an improvement by optimizing Sinkhorn divergence, which has been shown to be a successful strategy for nonprivate GANs. Due to challenges which do not arise in nonprivate GAN training (a difficult bias variance tradeoff), they use a weakening of the unbiased Sinkhorn divergence. They evaluate their strategy on multiple datasets, measuring both FID and a classifier's performance on synthetic data.
main_review: Pros:
The experimental results are strong (improving over existing DP strategies for synthetic data), although evaluated on small datasets. I'm a bit surprised that the classifier performance on MNIST is so bad, when even at somewhat small epsilon values, just because of how easy MNIST is.

Being able to avoid noising G' is nice.

The authors put a solid amount of effort into ablation to justify their strategy.

Cons:
Epsilon is really large - the typical way of justifying this is showing that privacy attacks are not effective - could you do this here? I have seen, for example, membership inference being run on discriminators to test the privacy of generative models.

The l_1 and l_2 losses are pretty simple for image data; I have seen perceptual distance used in place of these for image generation.

I'd be interested in seeing results on non-ML images, e.g. medical image datasets or medical records. This seems to be fairly standard in the DP synthetic data literature.

Overall, I am happy with the paper. I'm not super familiar with the generative model literature, but it seems to take a known nonprivate technique and apply it, overcoming challenges that pop up.
limitations_and_societal_impact: Limitations and societal impact are fine.
review_title: null

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper studies the problem of training generative models under differential privacy constraint. To this end, they propose a new optimal transport based objective, the semi-debiased Sinkhorn loss, analyze its privacy properties, and evaluate its performance on a number of image datasets.

main_review: Originality: The choice of optimizing the semi-debiased Sinkhorn loss is, to the best of my knowledge, novel. The task itself (differentially private generative models) and techniques (gradient clipping +  adding Gaussian noise) are well-known in the literature. While the authors do an adequate job of surveying related work, their exposition as to other methods could be significantly improved in the experiments section (Table 1). It’s not clear exactly how the objectives and training procedures differ between these methods and those proposed by the authors.  A quick summary of how these other algorithms work would be beneficial so as to better understand the contributions of their paper.

Quality: The submission is technically sound. The proofs appear to be correct, although I was not able to verify them in precise detail. The methods used in evaluation seem appropriate, although it would be helpful to the reader if the author’s provided confidence intervals for the results in table 1 to get a better sense of the variance in these methods. 

Clarity: The paper is for the most part well written. 

While their methods do appear to provide some improvement on MNIST and CelebA, these datasets are relatively low dimensional and it would be valuable to understand how the procedures introduced in this paper perform in more complicated settings. Given that the theoretical contributions are based on standard applications of DP tools, the overall impact of the work seems to me like it hinges on the quality of the empirical results. To this end, I would have liked to see experiments in a wider variety of domains to be better convinced of the impact that these ideas will have in practice.




limitations_and_societal_impact: Yes
review_title: null

Meta-review: This paper proposes an DP algorithm for generative modeling, based on Sinkhorn divergence. This approach is non-adversarial, leading to a simpler and more stable optimization problem that is better suited for making differentially private. On the other hand, empirically, even non-private version of non-adversarial generative models lead to worse models and this limits the possible impact of this work.

Papers at the intersection of two active areas of research are usually hard to evaluate and this paper is no exception. The reviewers were divided on this work. The improvement over previous work is small in FID score, though FID is not a particularly good measure. The generated images are reasonably good.

I find the approach promising and the authors might want to evaluate if this approach leads to more "stable" optimization compare to GAN-based approaches; e.g. is this algorithm less sensitive to the choice of hyperparameters. The authors are also encouraged to evaluate this approach on medical datasets, such as those used in https://doi.org/10.1101/159756

On balance, this paper may lead to a broader range of ideas being explored in this space, and therefore I would recommend acceptance.
Decision: Accept (Poster)