SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Proposition 1 (Asymptotic efficiency). Under Condition 3, stated in Section A.2,  $\tilde{\theta} \sim \pi^{\ell^{(\beta)}}(\theta|D)$  is asymptotically distributed as  $\sqrt{n} (\tilde{\theta} - \theta_0^{\ell^{(\beta)}}) \stackrel{\text{weakly}}{\longrightarrow} \mathcal{N}(0, (H_0^{\ell^{(\beta)}})^{-1} K_0^{\ell^{(\beta)}}(H_0^{(\beta)})^{-1} + (H_0^{\ell^{(\beta)}})^{-1})$ , where  $K_0^{\ell^{(\beta)}}$  and  $H_0^{\ell^{(\beta)}}$  are the gradient cross-product and Hessian matrices for the  $\beta D$  loss and are defined in (5) and (6).
OPS for classification and regression Note, unlike other methods, this DP guarantee does not require bounding features or response. We consider two explicit examples.
Example 1 (Binary classification). Consider a classifier for  $y \in \{0,1\}$  taking the logistic value of arbitrary function  $m: \mathcal{X} \times \Theta \mapsto \mathbb{R}$ ,  $p(y = 1; X, \theta) = 1 / (1 + \exp(-m(X, \theta)))$ , depending on predictors  $X \in \mathcal{X}$  and parameters  $\theta \in \Theta$ . Clearly,  $0 \leq f(y = 1; X, \theta) \leq 1$  independently of the functional form of  $m(X, \theta)$ , which guarantees  $(\frac{2}{(\beta - 1)}, 0)$ -DP of the  $\beta$ -D-Bayes OPS.
Taking  $m(X, \theta) = X^T\theta$  recovers logistic regression. Both the output perturbation of [18] and the Gibbs posterior (2) taking the Gibbs weight of [66] can also provide DP estimation for logistic regression. We show in Section 5 that  $\beta \mathrm{D}$ -Bayes provides superior inference to these methods for the same privacy budget. Figure 1 (left) compares the standard Bayesian posterior for logistic regression with the Gibbs posterior ( $w = 0.09$ ) and the  $\beta \mathrm{D}$ -Bayes posterior ( $\beta = 1.33$ ); both methods achieve DP estimation with  $\epsilon = 6$ . The  $y$ -axis is  $\tilde{f}(y = 1; X, \theta) \propto \exp\{\ell(y = 1; X, \theta)\}$ , the term that multiplies the prior in the updates (2) and (3). The figure shows that for the same privacy, the  $\beta \mathrm{D}$ -Bayes update more closely resembles the standard Bayesian update allowing  $\beta \mathrm{D}$ -Bayes OPS to produce more precise inference. Unlike [18] and [66],  $\beta \mathrm{D}$ -Bayes also does not require bounding the features to guarantee DP.
Modern machine learning, however, often requires non-linear models, and  $\beta$ D-Bayes allows DP estimation for these as well. For example, we can choose  $m(X,\theta) = \mathrm{NN}(X,\theta)$  where NN is a neural network parameterised by  $\theta$ . See [70] for more details on Bayesian inference for neural networks. Unlike logistic regression, the log-likelihood of a neural network classifier is not convex and therefore the methods of [18] and [66] cannot be applied. This necessitates the application of DPSGD [1] which adds noise to minibatch gradient evaluations in SGD and clips the gradients at some value to artificially bound their sensitivity—see [84] for a Bayesian extension. In contrast,  $\beta$ D-Bayes gets rid of the need to bound the neural network's sensitivity. It further allows for DP estimation beyond classification.
Example 2 (Gaussian regression). Consider a Gaussian model  $f(y; X, \theta, \sigma^2) = \mathcal{N}(y; m(X, \theta), \sigma^2)$  regressing univariate  $y \in \mathbb{R}$  on predictors  $X \in \mathcal{X}$  using any mean function  $m: \mathcal{X} \times \Theta \to \mathbb{R}$  and parameter  $\theta \in \Theta$  where  $\sigma^2 > 0$  is the residual variance. Provided there exists a lower bound  $0 < s^2 < \sigma^2$ , then  $0 \leq f(y; X, \theta, \sigma^2) \leq 1 / (\sqrt{2\pi} s)$  independent of  $m(X, \theta)$ . BD-Bayes OPS for such a model is  $(\epsilon, 0)$ -DP with  $\epsilon = 2 / ((\beta - 1)(\sqrt{2\pi} s)^{(\beta - 1)})$ .
Ensuring Condition 1 for a Gaussian likelihood model requires that the support of the variance parameter is bounded away from 0. Such a bound is not limiting. For example, the standard conjugate
inverse-gamma prior puts vanishing prior density towards 0, and in situations where a natural lower bound is not available, adding independent and identically distributed zero-mean Gaussian noise with variance  $s^2$  to the observed responses  $y$  ensures this bound without changing the mean estimation.
One popular choice for the mean function is  $m(X, \theta) = X^T\theta$  corresponding to standard linear regression. This is an exponential family model with conjugate prior, and DP estimation can be done using e.g. [13, 12]. They, however, require artificial bounds on the feature and response spaces. Again, the  $\beta \mathrm{D}$ -Bayes estimation also holds for more complex mean functions such as neural networks - see [48] for  $\beta \mathrm{D}$ -Bayes neural network regression. Figure 1 (right) illustrates how  $\beta \mathrm{D}$ -Bayes bounds the sensitivity for Gaussian regression models while the Gibbs posterior cannot. The log-likelihood of the Gaussian distribution is unbounded and while multiplying this with  $w < 1$  reduces the slope, this does not change its bound. The  $\beta \mathrm{D}$ -Bayes, on the other hand, provides a bounded loss function.
4 Extending the privacy beyond one-posterior sampling
While OPS has been shown to provide DP guarantees for perfect samples, the OPS posterior is typically not available in closed form and as a result, some approximate sampling methods such as Markov Chain Monte Carlo (MCMC) are required. Note that this is not only a limitation of OPS, but sampling from the intractable exponential mechanism [63, 75] in general. Proposition 2 taken from [66] investigates the DP properties of the approximation.
Proposition 2 (Proposition 12 of [66]). If sampling from  $\pi (\theta |D)$  is  $(\epsilon ,\delta)$ -DP and for all  $D$  there exists approximate sampling procedure  $p_D(\theta)$  with  $\int |\pi (\theta |D) - p_D(\theta)|d\theta \leq \gamma$ , then sampling from  $p_D(\theta)$  is  $(\epsilon ,\delta^{\prime})$ -DP with  $\delta^{\prime} = \delta +(1 + e^{\epsilon})\gamma$ .
Proposition 2 establishes that if the MCMC chain has converged to the target distribution i.e.  $\gamma \approx 0$ , then the DP of the exact posterior is shared by the approximate sampling. Proposition 3 of [81] is the same result for  $\delta = 0$ . For the sufficiently well-behaved Gibbs posteriors (i.e. with Lipschitz convex loss function and strongly convex regulariser), Minami et al. [66] provide an analytic stepsize and number of iterations,  $N$ , that guarantees an (unadjusted) Langevin Monte-Carlo Markov Chain is within  $\gamma$  of the target. While the Gibbs posterior for logistic regression satisfies these conditions, the Gibbs posterior for more general tasks and the  $\beta$ D-Bayes loss will in general not be convex.
Previous contributions [81, 66, 29] have assumed that the MCMC kernel has converged. Seeman et al. [75] observed that if the MCMC algorithm is geometrically ergodic achieving a  $\delta^\prime$  smaller than order  $1 / n$  and preventing data leakage requires the chain to be run for at least order  $N = \log (n)$  iterations. For our experiments we used the No-U-turn Sampler [NUTS; 38] version of Hamiltonian Monte Carlo [HMC; 24] implemented in the stan probabilistic programming language [16]. The geometric ergodicity of HMC was established in [59] and stan provides a series of warnings that indicate when the chain does not demonstrate geometric ergodicity [14]. Running stan for sufficiently many iterations to not receive any warnings provides reasonable confidence of a negligible  $\delta^{\prime}$ . As an alternative to measuring convergence, we below review approximate DP sampling approaches where  $\beta \mathrm{D}$ -Bayes can be applied to guarantee bounded density. We hope that the emergence of  $\beta \mathrm{D}$ -Bayes, as a general purpose OPS method to provide consistent DP estimation, motivates further research into private sampling methods for OPS.
DP MCMC methods Alternatively to attempting to release one sample from the exact posterior, much work has focused on extending OPS to release a Markov chain that approximates the Gibbs posterior, incurring per iteration privacy costs. Examples include the privatisation of Stochastic Gradient Langevin Dynamics [SGLD; 82, 81], the penalty algorithm [83], Hamiltonian Monte Carlo [DP-HMC 73], Baker's acceptance test [37, 8, 76], and rejection sampling [7]. Similar to DPSGD, these algorithms all rely on either subsampled estimates of the model's log-likelihood or its gradient to introduce the required noise and run the chain until the privacy budget has been used up. Just like the Gibbs posterior (2), the  $\beta$  D-Bayes posterior--using (4) and (3)-also contains a sum of loss terms that can be estimated via subsampling, making the  $\beta$  D-Bayes similarly amenable. What is more, many of these algorithms previously listed [85, 83, 37, 73, 81, 56, 84] require the boundedness of the sensitivity of the log-likelihood, or its derivative. Proposition 3 shows that under Condition 1 which ensures that  $\beta$  D-Bayes OPS is DP, or for gradient based samplers Condition 2, many of these DP samplers can be used to sample from the  $\beta$  D-Bayes posterior without compromising DP.
Condition 2 (Boundedness of the model density/mass function gradient). The model density or mass function  $f(\cdot; \theta)$  is such that there exists  $0 < G^{(\beta)} < \infty$  such that  $\left|\left|\nabla_{\theta}f(D;\theta)\times f(D;\theta)^{\beta -2}\right|\right|_{\infty} \leq G^{(\beta)}, \forall \theta \in \Theta$ .
Proposition 3 (DP-MCMC methods for the  $\beta$ D-Bayes-Posterior). Under Condition 1, the penalty algorithm [Algorithm 1; 83], DP-HMC [Algorithm 1; 73] and DP-Fast MH [Algorithm 2; 85] and under Condition 2 DP-SGLD [Algorithm 1; 56] can produce  $(\epsilon, \delta)$ -DP estimation from the  $\beta$ D-Bayes posterior with  $\delta > 0$  without requiring clipping.
Perfect sampling An alternative approach is to seek to modify MCMC chains to allow for exact samples from the posterior. Seeman et al. [75] privatise the perfect sampling algorithm of [54], which introduces an 'artificial atom'  $a$  into the support of the target and uses an augmented MCMC kernel to move between the atom and the rest of the support. While we believe these approaches to be very promising and in principle trivially applicable to  $\beta \mathrm{D}$ -Bayes OPS, Lee et al. [54] find considerable instability to choices for the underlying MCMC chain, and therefore more investigation is required.
Attacking one-posterior samples In order to quantify the data leakage from approximate sampling schemes, we run the strongest privacy attacks for DP auditing, namely membership inference attacks (MIA). In MIA, an adversary tries to predict whether an observation was part of the training data set or not. This attack corresponds directly to the DP guarantee presented in Definition 1: Given any two neighbouring data sets,  $D$  and  $D'$ , an attacker should not be able to confidently predict which data set was used in training if they observe the final statistical estimate  $\tilde{\theta}$ . Indeed, Jagielski et al. [43] have shown that the false positive and false negative rates of MIA attacks can be used to audit the DP of an algorithm directly. In the pursuit of tight auditing of DP algorithms, Nasr et al. [69] have proposed worst-case attacks where  $|D| + |D'| = 1$  are chosen to maximise attack performance. These attacks are beneficial to uncover whether an algorithm violates its promised DP guarantees as published works have repeatedly been shown to suffer from faulty implementations or mistakes in proving DP [69, 78]. We are the first to consider such attacks for OPS.
For a number of rounds, we 1) generate two neighbouring data sets,  $D$  and  $D'$ , 2) sample  $m \sim \text{Bernoulli}(0.5)$ , 3) if  $m = 1$  return  $\tilde{\theta}(D')$  or if  $m = 0$  return  $\tilde{\theta}(D)$ , and then 4) predict given Remark 1 which data set  $\tilde{\theta}$  was trained on. Without loss of generality, we assume  $m = 1$ . We follow [74] in defining the objective of the MIA attack as  $\mathcal{M}(\tilde{\theta}, D, D') := p(m = 1; \tilde{\theta}, D, D')$ , i.e. the probability that  $\tilde{\theta}$  was trained on  $D'$  after observing  $\tilde{\theta}, D$ , and  $D'$ .
Remark 1. Let  $p(\tilde{\theta} |D)$  be the density of the privacy mechanism—i.e. the Laplace density for [18] or the posterior (i.e. (2) or (3)) for OPS. An attacker estimating  $\mathcal{M}(\tilde{\theta},D,D^{\prime}) = \frac{p(\tilde{\theta}|D^{\prime})}{(p(\tilde{\theta} |D) + p(\tilde{\theta} |D^{\prime}))}$  is Bayes optimal. For OPS,  $\mathcal{M}(\tilde{\theta},D,D^{\prime}) = \exp \{\ell (D_{l}^{\prime};f(\cdot ;\tilde{\theta})) - \ell (D_{l};\tilde{\theta})\} \int \exp \{\ell (D_{l};f(\cdot ;\theta)) - \ell (D_{l}^{\prime};f(\cdot ;\theta))\} \pi (\theta |D)d\theta$  where  $D,D^{\prime}$  s.t.  $D\setminus D^{\prime} = \{D_{l}\}$  and  $D^{\prime}\setminus D = \{D_{l}^{\prime}\}$  (see Appendix A.5).
Appendix B contains additional experimental details and results. Our code can be found at https://github.com/sghalebikesabi/beta-bayes-ops.
Data sets The evaluations are conducted on simulated and UCI [23] data sets. For the former, we generate  $d$ -dimensional features from a multivariate normal distribution with the identity matrix as covariance matrix, sample the model parameters from a normal distribution with mean 0 and standard deviation 3 (i.e. a  $d$  dimensional vector for the logistic regression), and simulate the label according to the assumed likelihood model. For the latter, we have included the two classification data sets that were previously analysed in other applications of OPS (adult and abalone) [66, 81], in addition to other popular UCI data sets. We report the test performance on random test splits that constitute  $10\%$  of the original data. We further scale the features in all data sets to lie within 0 and 1. This is a requirement for the methods proposed by [81, 66, 18], whereas  $\beta$ D-Bayes guarantees DP for unbounded data.
Logistic regression Figure 2 compares  $\beta$ D-Bayes, Chaudhuri et al. [18] and Minami et al. [66] (with  $\delta = 10^{-5}$ ). Note that [18] still presents a widely-used implementation of DP logistic regression [39]. We consider two implementations of [18]: one where  $\lambda = 1/(9n)$  in (1) decreases in the
Figure 2: Parameter log RMSE and test-set ROC-AUC of DP estimation for logistic regression as the number of observations  $n$  increases. We have upper bounded the axis of the log RMSE  $(\hat{\theta})$ , as [18] performs poorly when the regularisation term decreases in  $n$ .
Figure 3: Test set predictive log RMSE of DP estimation for neural network regression as the number of observations  $n$  increases on simulated and UCI data. See Appendix Figure 6 for a comparison of each method with its private counterpart.
number of samples, consistent with the Bayesian paradigm the effect of the regulariser diminishes as  $n \to \infty$  and corresponds to a Gaussian prior with variance of 3, and another where  $\lambda = 1 / 9$  is fixed - see A.4.1 for further discussion. The first leads to unbiased but inconsistent DP-inference while the second is consistent at the cost of also being biased. We report the RMSE between the estimated parameter  $\tilde{\theta}(D)$  and the true data generating parameter on the simulated data sets, and the ROC-AUC on UCI data. For a comparison of each method with its non-private equivalent, please see Figure 6 in the appendix. We also introduce a new metric, termed correct sign accuracy that computes the proportion of coefficients that are 'correctly' estimated. Please refer to Figures 7 and 8 in the appendix.
In simulations, we observe that as  $n$  increases,  $\beta \mathrm{D}$ -Bayes achieves the smallest RMSE, illustrating the increased efficiency we argued for in Section 3. The extent to which  $\beta \mathrm{D}$ -Bayes dominates is greater for large  $\epsilon$ . The ROC-AUC curves show that this better estimation of parameters generally corresponds to greater ROC-AUC. For the UCI data we see that for increasing  $n$ $\beta \mathrm{D}$ -Bayes outperforms the other methods and Figure 6 shows it achieves performance that is very close to the unprivatised analogue.
Neural network regression Figure 3 compares  $\beta$ D-Bayes and DPSGD [1] (with  $\delta = 10^{-5}$ ) for training a one-layer neural network with 10 hidden units. The learning rate, number of iterations, and clipping norm for DPSGD were chosen using validation splits to maximise its performance. For small  $n$  the DPSGD is preferable in both simulations and the UCI data, but as the number of observations increases, the test set predictive RMSE of  $\beta$ D-Bayes outperforms that of DPSGD. Note that DPSGD is currently the best-performing optimiser for DP neural network training [20]. It privatises each gradient step, guaranteeing privacy for each parameter update, while  $\beta$ D-Bayes only guarantees DP for a perfect sample from the Bayesian posterior. DPSGD thus provides stronger privacy guarantees, and is more computationally efficient as MCMC scales poorly to high-dimensional feature spaces. We hyperparameter-tune the number of epochs, learning rate, and batch size of DP-SGD on a validation data set and use the same parameters on SGD for a fair comparison. Thus, the performance of SGD could be improved by a different choice of hyperparameters.
Membership inference attacks We implement the Bayes optimal attacker for the case of logistic regression. As the solution of the logistic regression is not defined when only observations from a single class are present, we choose  $D = \{(1,1),(0,0)\}$  and  $D' = \{(-1,1),(0,0)\}$  to achieve optimal attack results. Figure 4 compares the attack success rate with the log RMSE achieved on simulated data ( $n = 1000$ ,  $d = 2$ ). As  $\epsilon$  increases, the attack success rate of all methods increases and their RMSE decreases, except [18] with  $\lambda = 1/9$  whose RMSE does not decrease because of bias. Fixing the attack success rates,  $\beta$ -D-Bayes generally achieves the lowest RMSE. Importantly,  $\beta$ -D-Bayes is more efficient than [18] for the same attack success rate, where [18] has exact DP guarantees.
Figure 4: MIA attack success rates against log RMSE. Points correspond to values of  $\epsilon$ .
We showed that  $\beta$ D-Bayes OPS produces consistent parameter estimates that are  $(\epsilon, 0)$ -DP provided that the model's density or mass function  $f(\cdot; \theta)$  was bounded from above.  $\beta$ D-Bayes OPS improved the precision of DP inference for logistic regression and extends to more complex models, such as neural network classification and regression. Such extensions facilitate DP estimation for semiparametric models where consistent inference for a linear predictor is required, but a complex model is used to capture the remaining variation [50]. Extensions of this work could consider dividing the privacy budget to release more than one sample paving the way for parameter inference as well as estimation. Bayesian inference with different divergences or discrepancies is becoming increasingly popular [28, 42, 4, 61], and their suitability for DP estimation could be investigated following our example and results. Further, the  $\beta$ D-loss is applicable beyond Bayesian methods, it could also be used in place of clipping gradients in algorithms such as DP-SGD [1].
The main limitation of OPS methods is that they prove DP for a sample from the exact posterior which is never tractable. Instead, MCMC samples approximate samples from the exact posterior and convergence of the MCMC sampler must be ensured to avoid leaking further privacy. Future work should investigate whether convergence guarantees are possible for  $\beta$ D-Bayes, taking advantage of its natural boundedness, and consider which of the DP-MCMC methods introduced in Section 4 makes best use of the privacy budget to sample a chain from  $\beta$ D-Bayes. A further limitation of OPS is the computational burden required to produce posterior samples, particularly in larger neural networks with many parameters. Such a cost and is mitigated by the fact that inference can only be run once to avoid leaking privacy and that only one posterior sample is required. But further research is required to tackle these computational challenges, including scaling MCMC to large neural networks or developing DP variational inference approaches [40, 44, 71] for the  $\beta$ D-Bayes posterior. We hope that the existence of a general-purpose method for DP estimates through Bayesian sampling with improved performance can stimulate further research in these directions.
A thank you to Anna Menacher, Dan Moss and the anonymous reviewers for valuable comments on earlier drafts of the paper. JJ was funded by Juan de la Cierva Formación fellowship FJC2020-046348-I. SG was a PhD student of the EPSRC CDT in Modern Statistics and Statistical Machine Learning (EP/S023151/1), and also received funding from the Oxford Radcliffe Scholarship and
Novartis. CH was supported by The Alan Turing Institute, Health Data Research UK, the Medical Research Council UK, the EPSRC through the Bayes4Health programme Grant EP/R018561/1, and AI for Science and Government UK Research and Innovation (UKRI).
[79] Shonosuke Sugasawa. Robust empirical Bayes small area estimation with density power divergence. Biometrika, 107(2):467-480, 2020.
[80] Stephen G Walker. Bayesian inference with misspecified models. Journal of Statistical Planning and Inference, 143(10):1621-1633, 2013.
[81] Yu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and stochastic gradient Monte Carlo. In International Conference on Machine Learning, pages 2493-2502. PMLR, 2015.
[82] Max Welling and Yee W Teh. Bayesian learning via stochastic gradient Langevin dynamics. In Proceedings of the 28th international conference on machine learning (ICML-11), pages 681–688, 2011.
[83] Sinan Yildirim and Beyza Ermis. Exact MCMC with differentially private moves: revisiting the penalty algorithm in a data privacy framework. Statistics and Computing, 29:947-963, 2019.
[84] Qiyiwen Zhang, Zhiqi Bu, Kan Chen, and Qi Long. Differentially private Bayesian neural networks on accuracy, privacy and reliability. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2022, Grenoble, France, September 19–23, 2022, Proceedings, Part IV, pages 604–619. Springer, 2023.
[85] Wanrong Zhang and Ruqi Zhang. DP-Fast MH: Private, fast, and accurate Metropolis-Hastings for large-scale Bayesian inference. arXiv preprint arXiv:2303.06171, 2023.
[86] Zuhe Zhang, Benjamin Rubinstein, and Christos Dimitrakakis. On the differential privacy of Bayesian inference. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 30, 2016.
[87] Shijie Zheng. The differential privacy of Bayesian inference. PhD thesis, Harvard University, 2015.
Appendix A Definitions, proofs, and related work
Here, we provide missing definitions of the Kullback-Leibler divergence (KLD) and the  $\beta$ -divergence ( $\beta$ D).
Definition 2 (Kullback-Leibler divergence [52]). The KLD between probability densities  $g(\cdot)$  and  $f(\cdot)$  is given by
$$
\operatorname {K L D} (g | | f) = \int g (x) \log \frac {g (x)}{f (x)} d x.
$$
Definition 3 ( $\beta$ -divergence [9, 64]). The  $\beta D$  is defined as
$$
D _ {B} ^ {(\beta)} (g | | f) = \frac {1}{\beta (\beta - 1)} \int g (x) ^ {\beta} d x + \frac {1}{\beta} \int f (x) ^ {\beta} d x - \frac {1}{\beta - 1} \int g (x) f (x) ^ {\beta - 1} d x,
$$
where  $\beta \in \mathbb{R}\setminus \{0,1\}$ . When  $\beta \to 1$ ,  $D_B^{(\beta)}(g(x)||f(x))\to \mathrm{KLD}(g(x)||f(x))$ .
The  $\beta$ -divergence has often been referred to as the density-power divergence in the statistics literature [9] where it is also parameterised with  $\beta_{DPD} = \beta - 1$ .