SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Differentially Private Statistical Inference through  $\beta$ -Divergence One Posterior Sampling
Jack Jewson*  
Department of Economics and Business  
Universitat Pompeu Fabra  
Barcelona, Spain  
jack.jewson@upf.edu
Sahra Ghalebikesabi*  
Department of Statistics  
University of Oxford  
Oxford, UK  
sahra.ghalebikesabi@univ.ox.ac.uk
The Alan Turing Institute
chris.holmes@stats.ox.ac.uk
Differential privacy guarantees allow the results of a statistical analysis involving sensitive data to be released without compromising the privacy of any individual taking part. Achieving such guarantees generally requires the injection of noise, either directly into parameter estimates or into the estimation process. Instead of artificially introducing perturbations, sampling from Bayesian posterior distributions has been shown to be a special case of the exponential mechanism, producing consistent, and efficient private estimates without altering the data generative process. The application of current approaches has, however, been limited by their strong bounding assumptions which do not hold for basic models, such as simple linear regressors. To ameliorate this, we propose  $\beta$  D-Bayes, a posterior sampling scheme from a generalised posterior targeting the minimisation of the  $\beta$ -divergence between the model and the data generating process. This provides private estimation that is generally applicable without requiring changes to the underlying model and consistently learns the data generating parameter. We show that  $\beta$  D-Bayes produces more precise inference estimation for the same privacy guarantees, and further facilitates differentially private estimation via posterior sampling for complex classifiers and continuous regression models such as neural networks for the first time.
Statistical and machine learning analyses are increasingly being done with sensitive information, such as personal user preferences [49], electronic health care records [72], or defence and national security data [27]. It thus becomes more and more important to ensure that data-centric algorithms do not leak information about their training data. Let  $D = \{D_i\}_{i=1}^n = \{y_i, X_i\}_{i=1}^n \in \mathcal{D}$  denote a sensitive data set with  $d$  dimensional features  $X_i \in \mathcal{X} \subset \mathbb{R}^d$ , and labels  $y_i \subset \mathcal{Y} \subset \mathbb{R}$ . Here, we are considering inference problems where a trusted data holder releases model parameters  $\tilde{\theta}(D) \in \Theta$ , that describe the relationship between  $X$  and  $y$ , based on an arbitrary likelihood model  $f(\cdot; \theta)$ . Differential privacy
*Joint first authorship. Order decided based on coin flip.
(DP) provides a popular framework to quantify the extent to which releasing  $\tilde{\theta}(D)$  compromises the privacy of any single observation  $D_i = \{y_i, X_i\} \in D$ .
Definition 1 (Differential Privacy, [26]). Let  $D$  and  $D'$  be any two neighbouring data sets differing in at most one feature label pair. A randomised parameter estimator  $\tilde{\theta}(D)$  is  $(\epsilon, \delta)$ -differentially private for  $\epsilon > 0$  and  $\delta \in [0,1]$  if for all  $\mathcal{A} \subseteq \Theta$ ,  $P(\tilde{\theta}(D) \in \mathcal{A}) \leq \exp(\epsilon)P(\tilde{\theta}(D') \in \mathcal{A}) + \delta$ .
The privacy guarantee is controlled by the privacy budget  $(\epsilon, \delta)$ . While  $\epsilon$  bounds the log-likelihood ratio of the estimator  $\tilde{\theta}(D)$  for any two neighbouring data sets  $D$  and  $D'$ ,  $\delta$  is the probability of outputs violating this bound and is thus typically chosen smaller than  $1/n$  to prevent data leakage. DP estimation requires the parameter estimate to be random even after conditioning on the observed data. Thus, noise must be introduced into the learning or release procedure of deterministic empirical risk minimisers to provide DP guarantees.
The sensitivity method [26] is a popular privatisation technique in DP where the functional that depends on the sensitive data (i.e. a sufficient statistic, loss objective or gradient) is perturbed with noise that scales with the functional's sensitivity. The sensitivity  $S(h)$  of a functional  $h: \mathcal{D} \to \mathbb{R}$  is the maximum difference between the values of the function on any pair of neighboring data sets  $D$  and  $D'$ ,  $S(h) = \max_{D, D'} \| h(D) - h(D') \|$ . As the bound of statistical functionals given arbitrary data sets is typically unknown, their sensitivity is determined by assuming bounded input features [18] or parameter spaces [81]. In practise, noise is added either directly to the estimate  $\hat{\theta}$  or the empirical loss function, skewing the interpretation of the released statistical estimates in ways that cannot be explained by probabilistic modelling assumptions. In differentially private stochastic gradient descent [DPSGD; 1], for example, the sensitivity of the mini-batch gradient in each update step is bounded by clipping the gradients of single batch observations before averaging. The averaged mini-batch gradient is then perturbed with noise that scales inversely with the gradients' clipping norm. The repercussions of so doing can be detrimental. The effects of statistical bias within DP estimation have been subject to recent scrutiny, and bias mitigation approaches have been proposed [31].
An alternative to the sensitivity method, is one-posterior sampling [OPS; 81]. Instead of artificially introducing noise that biases the learning procedure, OPS takes advantage of the inherent uncertainty provided by sampling from Bayesian posterior distributions [81, 66, 30, 85, 21, 22, 86]. Given prior  $\pi(\theta)$  and likelihood  $f(D; \theta)$ , the random OPS estimate corresponds to a single sample from the Bayesian posterior  $\pi(\theta | D) \propto f(D; \theta) \pi(\theta)$ . If one accepts the Bayesian inference paradigm, then a probabilistic interpretation of the data generative distribution can be leveraged to sample interpretable DP parameter estimates. Additionally, Bayesian maximum-a-posteriori estimates are generally associated with regularised maximum likelihood estimates, and OPS has been shown to consistently learn the data generating parameter [81]. Therefore, OPS provides a compelling method for DP estimation independently of the analyst's perspective on the Bayesian paradigm. Current approaches to OPS, however, only provide DP under unrealistic conditions where the log-likelihood is bounded [81] or unbounded but Lipschitz and convex [66] limiting their implementation beyond logistic regression models – see Table 1.
In this paper, we extend the applicability of OPS to more general prediction tasks, making it a useful alternative to the sensitivity method. To do so, we combine the ability of OPS to produce consistent estimates with a robustified general Bayesian posterior aimed at minimising the  $\beta$ -divergence [9] between the model  $f(D_{i};\theta)$  and the data generating process. We henceforth refer to this privacy mechanism as  $\beta$ D-Bayes. While previous research has studied the benefits of the  $\beta$ -divergence for learning model parameters that are robust to outliers and model misspecification [32, 34, 45, 48, 46], we leverage its beneficial properties for DP parameter estimation: A feature of the  $\beta$ D-Bayes posterior is that it naturally provides a pseudo-log likelihood with bounded sensitivity for popular classification and regression models without having to modify the underlying model  $f(\cdot;\theta)$ . Further, such a bound is often independent of the predictive model, which allows, for instance, the privatisation of neural networks without an analysis of their sensitivity or perturbation of gradients.
Contributions. Our contributions can thus be summarised as follows:
- By combining OPS with the intrinsically bounded  $\beta$ -divergence, we propose  $\beta$ D-Bayes, a DP mechanism that applies to a general class of inference models.
-  $\beta$ D-Bayes bounds the sensitivity of a learning procedure without changing the model, getting rid of the need to assume bounded feature spaces or clipping statistical functionals. If the model is correctly specified, the data generating parameter can be learned consistently.
-  $\beta$  D-Bayes improves the efficiency of OPS leading to improved precision for DP logistic regression.
- The general applicability of  $\beta$ D-Bayes facilitates OPS estimation for complex models such as Bayesian neural network (BNN) classification and regression models.
- We provide extensive empirical evidence by reporting the performance of our model and four relevant baselines on ten different data sets, for two different tasks; additionally analysing their sensitivity in the number of samples and the available privacy budget.
Here, we focus on the OPS literature that analyses the inherent privacy of perfect sampling from a Bayesian posterior [21, 81, 27, 66, 30]. Such a DP mechanism is theoretically appealing as it does not violate generative modelling assumptions. Current approaches have, however, been limited in their application due to strong likelihood restrictions. We start by outlining the weaknesses of traditional DP methods and the state-of-the-art for OPS, before we introduce  $\beta$ D-Bayes OPS.
OPS is distinct from other work on DP Bayesian inference that can be categorised as either analysing the DP release of posterior samples using variational inference [40, 44, 71], or Monte Carlo procedures [81, 60, 37, 83, 29, 73, 85]. We show that these methods can be extended to approximately sample from  $\beta$ D-Bayes in Section 4.
DP via the sensitivity method According to the exponential mechanism [63], sampling  $\tilde{\theta}$  with probability proportional to  $\exp (-\epsilon \ell (D,\tilde{\theta}) / (2S(h))$  for a loss function  $\ell :\mathcal{D}\times \Theta \to \mathbb{R}$  is  $(\epsilon ,0)$  -DP. A particularly widely used instance is the sensitivity method [26] which adds Laplace noise with scale calibrated by the sensitivity of the estimator. For example, consider empirical risk minimisation for a  $p$  dimensional parameter  $\theta \in \Theta \subseteq \mathbb{R}^p$  ..
$$
\hat {\theta} (D) := \underset {\theta \in \Theta} {\arg \min } \frac {1}{n} \sum_ {i = 1} ^ {n} \ell \left(D _ {i}, f (\cdot ; \theta)\right) + \lambda R (\theta) \tag {1}
$$
where  $\ell(D_i, f(\cdot; \theta))$  is the loss function,  $R(\theta)$  is a regulariser, and  $\lambda > 0$  is the regularisation weight. Chaudhuri et al. [18] show that  $\tilde{\theta} = \hat{\theta}(D) + z$ ,  $\mathbb{R}^p \ni z = (z_1, \ldots, z_p) \stackrel{\mathrm{id}}{\sim} \mathcal{L}\left(0, \frac{2}{n\lambda\epsilon}\right)$ , where  $\mathcal{L}(\mu, s)$  is a Laplace distribution with density  $f(z) = \frac{1}{2s} \exp\{-|z - \mu|/s\}$ , is  $(\epsilon, 0)$ -DP provided  $R(\cdot)$  is differentiable and 1-strongly convex, and  $\ell(y_i, \cdot)$  is convex and differentiable with gradient  $|\ell'(D_i, \cdot)| < 1$ . The negative log-likelihood of logistic regression with a  $L_2$  regulariser satisfies these conditions when the features are standardised between 0 and 1 – see Section A.4.1 for more details. Relaxing the conditions of convexity, DPSGD [1], which adds calibrated noise to gradient evaluations within stochastic gradient descent, has arisen as a general purpose tool for empirical risk minimisation [62, 20]. To achieve bounded sensitivity, DPSGD clips each single gradient within the update step. Instead of bounding the sensitivity artificially by assuming bounded feature spaces or clipping data functions, Dwork and Lei [25] identified the promise of robust methods for DP-estimation. Robust estimation procedures [e.g. 41, 35] provide parameter estimates that are less sensitive to any one observation and therefore the scale of the noise that needs to be added to privatise such an estimate is reduced. While the connection between robust statistical estimators and DP has thus been subject to extensive research [5, 6, 25, 77, 22, 55, 17, 57, 58], we are the first to consider it within Bayesian sampling to produce a generally applicable method for consistent estimation of model parameters.
DP via Gibbs one-posterior sampling Sampling from a Bayesian posterior constitutes a particular case of the exponential mechanism [81, 21, 22, 86], leading to the proposal of OPS through Gibbs posterior sampling. If the log-likelihood  $\log f(D;\theta)$  is such that  $\sup_{D,\theta}|\log f(D;\theta)|\leq B$  , then one sample from the Gibbs posterior
$$
\pi^ {w \log f} (\theta | D) \propto \pi (\theta) \exp \left\{w \sum_ {i = 1} ^ {n} \log f \left(D _ {i}; \theta\right) \right\} \tag {2}
$$
with  $w = \frac{\epsilon}{4B}$  is  $(\epsilon, 0)$ -DP [81]. Note  $w = 1$  recovers the standard posterior and  $w \neq 1$  provides flexibility to adapt the posterior to the level of privacy required. However, standard models for inference do not usually have bounded log-likelihoods. Even discrete models with bounded support such as logistic regression do not. To overcome this, Wang et al. [81] assume a bounded parameter space and accordingly 'scale-down' the data. However, parameter spaces are typically unbounded, and data scaling has to be done carefully to avoid information leakage or loss inefficiency. Nevertheless,
Table 1: Requirements of different DP estimation techniques; sorted in decreasing strength of the restrictions imposed on the likelihood.
Unbounded Features	Likelihood Restriction	Prior Restriction	δ	Unbiased+ Consistent
Foulds et al. [27]	X	exponential family + bounded sufficient statistics	conjugate	0	✓
Bernstein and Shel- don [12, 13]	X	exponential family + bounded sufficient statistics	conjugate	0	✓
Minami et al. [66]	X	convex + Lipschitz log-density	strongly convex	>0	✓
Wang et al. [81]	X	bounded log-density	proper	0	✓
Chaudhuri et al. [18]	X	convex log-density	strongly convex	0	✓
Abadi et al. [1]	✓	bounded gradients	none	>0	X
βD-Bayes	✓	bounded density	proper	0	✓
their algorithm is shown to outperform the perturbation approach proposed by [18]. Some works [21, 22, 86] overcome the assumption of a bounded log-likelihood by relaxing the definition of DP allowing distant observations according to some metric to be distinguishable with greater probability. Such a relaxation, however, no longer guarantees individual privacy. Geumlek et al. [30] consider versions of the Gibbs posterior for exponential family models and generalised linear models but in the context of Rényi-DP (RDP) [68], a relaxation of DP that bounds the Rényi divergence with parameter  $\alpha$  between the posterior when changing one observation. Minami et al. [66] generalise the result of Wang et al. [81] to show that one sample from (2) with  $w = \frac{\epsilon}{2L}\sqrt{m_{\pi} / (1 + 2\log(1 / \delta))}$  for convex  $L$ -Lipschitz log-likelihoods with  $m_{\pi}$ -strongly convex regulariser is  $(\epsilon, \delta)$ -DP. For logistic regression, we have  $L = 2\sqrt{d}$  if the features are bounded between 0 and 1. This, however, requires a relaxation to  $\delta > 0$ .
Sufficient statistics perturbation Foulds et al. [27] identified that OPS mechanisms based on the Gibbs posterior are data inefficient in terms of asymptotic relative efficiency. For exponential family models, Foulds et al. [27] and Zheng [87] propose a Laplace mechanism that perturbs the data's sufficient statistics and considers conjugate posterior updating according to the perturbed sufficient statistics. The privatisation of the statistics allows for the whole posterior to be released rather than just one sample, and the perturbation of the statistics is independent of  $n$  allowing the amount of noise to become smaller relative to the sufficient statistics as  $n \to \infty$  providing consistent inference. They compare directly to [81] showing improved inference for exponential family models. However, these results require bounded sufficient statistics. Extensions include [12, 13, 67, 40, 71, 51]. These methods are further limited to exponential families which do not include popular machine learning models e.g. logistic regression or neural networks. In this paper, we set out to generalise the applicability of OPS and also address its efficiency issues by moving away from the Gibbs posterior, making use of tools used within generalised Bayesian updating.
3  $\beta$ D-Bayes one-posterior sampling
Generalised Bayesian Updating and the beta-Divergence OPS has struggled as a general purpose tool for DP estimation as bounding the sensitivity of  $\log f(x;\theta)$  is difficult. Motivated by model misspecification, Bissiri et al. [15] showed that the posterior update
$$
\pi^ {\ell} (\theta | D) \propto \pi (\theta) \exp \left\{- \sum_ {i = 1} ^ {n} \ell \left(D _ {i}, f (\cdot ; \theta)\right) \right\}, \tag {3}
$$
assigning high posterior density to parameters that achieved small loss on the data, provides a coherent means to update prior beliefs about parameter  $\theta_0^\ell \coloneqq \arg \min_{\theta \in \Theta} \int \ell(D, f(\cdot; \theta)) g(D) dz$  after observing data  $D \sim g(\cdot)$ . The Gibbs posterior in (2) is recovered using the weighted negative log-likelihood  $\ell(D, f(\cdot; \theta)) = -w \log f(D; \theta)$ , and the standard posterior for  $w = 1$ . This demonstrates that Bayesian inference learns about  $\theta_0^{\log f} \coloneqq \arg \min_{\theta \in \Theta} \int \log f(D; \theta) g(D) dD = \arg \min_{\theta \in \Theta} \mathrm{KLD}(g||f(\cdot; \theta))$  [11, 80].
The framework of [15] provides the flexibility to choose a loss function with bounded sensitivity. An alternative, loss function that continues to depend on  $\theta$  through the likelihood  $f(\cdot ;\theta)$  is the
$\beta$  -divergence loss [9] for  $\beta >1$
$$
\ell^ {(\beta)} (D, f (\cdot ; \theta)) = - \frac {1}{\beta - 1} f (D; \theta) ^ {\beta - 1} + \frac {1}{\beta} \int f (\bar {D}; \theta) ^ {\beta} d \bar {D}, \tag {4}
$$
so called as  $\arg \min_{\theta} \mathbb{E}_{D \sim g}\left[\ell^{(\beta)}(D, f(\cdot; \theta))\right] = \arg \min_{\theta} D_B^{(\beta)}(g \| f(\cdot; \theta))$  where  $D_B^{(\beta)}(g \| f)$  is the  $\beta$ -divergence defined in Section A. The first term in (4) contains the negative likelihood, therefore parameters that make the data likely achieve low loss. However, it is raised to the power  $\beta - 1 > 1$  prescribing relatively smaller loss to observations unlikely under that parameter than the log-likelihood. A key feature of (4) is that while  $\lim_{f \to 0} -\log f = \infty$ ,  $\lim_{f \to 0} -\frac{f^{\beta - 1}}{\beta - 1} = 0$  for  $\beta > 1$ . The second integral term only depends on the parameters and ensures the  $\beta$ D loss can learn the data generating parameters. Setting  $\beta = 1$  recovers the negative log-likelihood. We refer to updating using (3) and loss (4) as  $\beta$ D-Bayes. Note that this update is general, and can be applied for any choice of prior  $\pi(\theta)$ , and density/mass function  $f(y; \theta)$ . Using (4) for inference was first proposed by Basu et al. [9] and extended by Ghosh and Basu [32] to the Bayesian paradigm. Because of its favourable robustness properties, the  $\beta$ -divergence has since been deployed for a variety of examples within modern statistical inference [e.g. 47, 34, 48, 33, 79] and deep learning [e.g. 3, 36, 2, 19, 48].
A particularly convenient feature of inference based on divergences is that they are uniquely minimised to 0 when  $f = g$ . Therefore, if there exists  $\theta_0$  such that  $g(\cdot) = f(\cdot; \theta_0)$ , i.e. the model is correctly specified for  $g$ , then  $\arg \min_{\theta \in \Theta} D_B^{(\beta)}(g(\cdot) || f(\cdot; \theta)) = \arg \min_{\theta \in \Theta} \mathrm{KLD}(g(\cdot) || f(\cdot; \theta)) = \theta_0$ , and the  $\beta$ -D-Bayes posterior will learn about the same parameter as the Gibbs posterior (2). Further, the general Bernstein-von-Mises theorem for generalised posteriors [Theorem 4; 65] can be applied to the  $\beta$ -D-Bayes posterior (see Theorem 3) to show that  $\pi^{(\beta)}(\theta | D)$  is asymptotically Gaussian and concentrates around  $\theta_0^{\ell^{(\beta)}} := \arg \min_{\theta \in \Theta} D_B^{(\beta)}(g(\cdot) || f(\cdot; \theta))$  as  $n \to \infty$ . This proves useful when establishing consistency and asymptotic efficiency, see Section A.2. When the model is misspecified, i.e. there exists no  $\theta_0$  such that  $g(\cdot) = f(\cdot; \theta_0)$ , then  $\theta_0^{\ell^{(\beta)}} \neq \arg \min_{\theta \in \Theta} \mathrm{KLD}(g(\cdot) || f(\cdot; \theta))$  and the  $\beta$ -D-Bayes posterior learns a different parameter to the standard posterior. However, several works have argued that it provides more desirable inference [32, 34, 47, 48] and decision-making [45] under model misspecification, and stability [46] to the specification of the model. We now show that we can leverage the favourable robustness properties of  $\beta$ -D-Bayes to obtain general-use DP OPS estimates.
DP one-posterior-sampling Rather than bounding  $\log f(\cdot ;\theta)$ , we replace it in (3) with the  $\beta$ D loss from (4) which is naturally bounded when the density is bounded.
Condition 1 (Boundedness of the model density/mass function). The model density or mass function  $f(\cdot ;\theta)$  is such that there exists  $0 < M < \infty$  such that  $f(\cdot ;\theta)\leq M,\forall \theta \in \Theta$
Lemma 1 (Bounded sensitivity of the  $\beta$ D-Bayes loss). Under Condition 1 the sensitivity of the  $\beta$ D-Bayes-loss for any  $\beta > 1$  is  $|\ell^{(\beta)}(D, f(:, \theta)) - \ell^{(\beta)}(D', f(:, \theta))| \leq \frac{M^{\beta - 1}}{\beta - 1}$ .
Bounding  $f$  rather than its logarithm is considerably more straightforward: discrete likelihoods are always bounded by 1, while continuous likelihoods can be guaranteed to be bounded under mild assumptions. We will see in Example 2 that such a bound can be provided in a Gaussian regression model by truncating the support of the variance parameter  $\sigma^2$  from below. Under Condition 1, Theorem 1 proves  $(\epsilon, 0)$ -DP of  $\beta \mathrm{D}$ -Bayes OPS. Theorem 2 establishes the consistency of  $\beta \mathrm{D}$ -Bayes OPS and Proposition 1 establishes its efficiency, based on the definitions given by [81, 27]. Condition 3, stated fully in Section A.2 requires that the  $\beta \mathrm{D}$ -Bayes loss can be approximated by a quadratic form and requires that as  $n$  grows the  $\beta \mathrm{D}$ -Bayes loss is uniquely minimized.
Theorem 1 (Differential privacy of the  $\beta$ D-Bayes posterior). Under Condition 1, a draw  $\tilde{\theta}$  from the  $\beta$ D-Bayes posterior  $\pi^{\ell^{(\beta)}}(\theta | D)$  in (3) is  $(\frac{2M^{\beta - 1}}{\beta - 1}, 0)$ -differentially private.
Theorem 2 (Consistency of  $\beta$ D-Bayes sampling). Under Condition 3, stated in Section A.2,
1. a posteriori sample  $\tilde{\theta} \sim \pi^{\ell^{(\beta)}}(\theta|D)$  is a consistent estimator of  $\theta_0^{\ell^{(\beta)}}$ .
2. if data  $D_{1},\ldots ,D_{n}\sim g(\cdot)$  were generated such that there exists  $\theta_0$  with  $g(D) = f(D;\theta_0)$ , then  $\tilde{\theta}\sim \pi^{\ell^{(\beta)}}(\theta |D)$  for all  $1 < \beta < \infty$  is consistent for  $\theta_0$ .
Figure 1: Left: Comparison of  $\tilde{f}(y = 1; X, \theta) \propto \exp\{\ell(y = 1; X, \theta)\}$  for the Gibbs and  $\beta$ D-Bayes posteriors achieving DP with  $\epsilon = 6$  with the standard logistic function for binary classification with  $m(X, \theta) = X\theta$ . The  $\tilde{f}$  associated with the  $\beta$ D-Bayes posterior is closer to that of the Bayes posterior for any  $m(X, \theta)$  than that of the Gibbs posterior for the same privacy level. Right: Comparison of  $\ell(y; X, \theta)$  for the Gibbs posterior and the  $\beta$ D-Bayes posterior for Gaussian regression with the standard log-likelihood. The  $\beta$ D-Bayes posterior allows for DP estimation while the Gibbs posterior does not as any choice for  $w > 0$  fails to bound the loss sensitivity.