SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \mathcal {M} (\tilde {\theta}, D, D ^ {\prime}) := p (m = 1; \tilde {\theta}, D, D ^ {\prime}) = p (\tilde {\theta} | D ^ {\prime}) / (p (\tilde {\theta} | D)) + p (\tilde {\theta} | D ^ {\prime})) \\ = 1 / \left(p (\tilde {\theta} | D) / p (\tilde {\theta} | D ^ {\prime}) + 1\right) \\ \end{array}
$$
by Bayes Theorem. For [18],
$$
p (\tilde {\theta} | D) = \mathcal {L} \left(\hat {\theta} (D), \frac {2}{n \lambda \epsilon}\right),
$$
where  $\hat{\theta} (D)$  was defined in (1).
For the OPS methods, Minami et al. [66] and  $\beta$  D-Bayes,  $p(\hat{\theta} |D)$  is the posterior
$$
p (\tilde {\theta} | D) = \pi^ {\ell} (\tilde {\theta} | D) \propto \pi (\theta) \exp \left\{- \sum_ {i = 1} ^ {n} \ell (D _ {i}; \theta) \right\}
$$
where for [66]  $\ell(D_i; f(\cdot; \theta)) = -w \log f(D_i; \theta)$ , and for  $\beta$ D-Bayes  $\ell(D_i; f(\cdot; \theta)) = \ell^{(\beta)}(D_i; f(\cdot; \theta))$  given in (4). Without loss of generality, index observations within  $D$  and  $D'$  such that  $D \setminus D' = \{D_l\}$  and  $D' \setminus D = \{D'_l\}$ . Then,
$$
\begin{array}{l} \frac {\pi^ {\ell} (\tilde {\theta} \mid D)}{\pi^ {\ell} (\tilde {\theta} \mid D ^ {\prime})} = \frac {\pi (\tilde {\theta}) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ; f (\cdot ; \tilde {\theta})) \}}{\int \pi (\theta) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ; f (\cdot ; \theta)) \} d \theta} \Bigg / \frac {\pi (\tilde {\theta}) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ^ {\prime} ; f (\cdot ; \tilde {\theta})) \}}{\int \pi (\theta) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ^ {\prime} ; f (\cdot ; \theta)) \} d \theta} \\ = \exp \{\ell (D _ {l} ^ {\prime}; f (\cdot ; \tilde {\theta})) - \ell (D _ {l}; f (\cdot ; \tilde {\theta})) \} \int \frac {\pi (\theta) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ^ {\prime} ; f (\cdot ; \theta)) \}}{\int \pi (\theta) \exp \{- \sum_ {i = 1} ^ {n} \ell (D _ {i} ; f (\cdot ; \theta)) \} d \theta} d \theta \\ = \exp \left\{\ell \left(D _ {l} ^ {\prime}; f (\cdot ; \tilde {\theta})\right) - \ell \left(D _ {l}; \tilde {\theta}\right) \right\} \\ \int \exp \left\{\ell \left(D _ {l}; \theta\right) - \ell \left(D _ {l} ^ {\prime}; f (\cdot ; \theta)\right) \right\} \frac {\pi (\theta) \exp \left\{- \sum_ {i = 1} ^ {n} \ell \left(D _ {i} ; f (\cdot ; \theta)\right) \right\}}{\int \pi (\theta) \exp \left\{- \sum_ {i = 1} ^ {n} \ell \left(D _ {i} ; f (\cdot ; \theta)\right) \right\} d \theta} d \theta \\ = \exp \left\{\ell \left(D _ {l} ^ {\prime}; f (\cdot ; \tilde {\theta})\right) - \ell \left(D _ {l}; f (\cdot ; \tilde {\theta})\right) \right\} \int \exp \left\{\ell \left(D _ {l}; f (\cdot ; \theta)\right) - \ell \left(D _ {l} ^ {\prime}; f (\cdot ; \theta)\right) \right\} \pi (\theta | D) d \theta \\ \approx \exp \{\ell (D _ {l} ^ {\prime}; f (\cdot ; \tilde {\theta})) - \ell (D _ {l}; f (\cdot ; \tilde {\theta})) \} \frac {1}{N} \sum_ {j} ^ {N} \exp \{\ell (D _ {l}; f (\cdot ; \theta_ {j})) - \ell (D _ {l} ^ {\prime}; f (\cdot ; \theta_ {j})) \}, \\ \end{array}
$$
where  $\{\theta_j\}_{j=1}^N \sim \pi(\theta|D)$ . The adversary only needs to sample from the posterior based on dataset  $D$  to be able to estimate  $\mathcal{M}(\tilde{\theta}, D, D')$  for all  $D'$  differing from  $D$  in only one index  $l$ .
Appendix B Additional experimental details and results
Datasets Please see the following list for the name of the targets in the prediction tasks of the UCI data:
- abalone - ring class (threshold 10)
adult - income class
bank - authenticity
- boston - housing prices
- kin8mm - distance of the end-effector from a target
- naval - GT Turbine decay state coefficient
- wine - quality
- vertebral - disease (normal/abnormal)
We used all remaining features in the data sets as predictors.
Bayesian models In the case of logistic regression, we assume a normal prior with mean 0 and variance 9 on the regression coefficient. In the case of linear regression, we again assume a normal prior with mean 0 and variance  $9\cdot \sigma^2$  on the regression coefficient. Further, we assume  $\sigma^2$  follows an inverse gamma distribution a-priori with shape and scale of 1, with a lower bound of 0.01. In the case of neural network classification, we assume normal priors with mean 0 and variance 1 on the weight and bias parameters of a one-hidden-layer neural network with 10 hidden nodes. In the case of neural network regression, the same assumptions hold and we additionally assume  $\sigma^2$  follows an inverse gamma distribution a-priori with shape and scale of 1, with a lower bound of 0.01.
MCMC sampling Unless otherwise specified, we choose  $d = 2$  in the simulated experiments. The MCMC methods are run for 1000 warm-up steps, and 100 iterations. The DP sample is sampled uniformly at random from the last 100 iterations.
Neural network training DPSGD is run for  $14 + \lfloor \epsilon \rfloor$  epochs, with clipping norm 1, batch size 100, and learning rate of  $10^{-2}$ . All other implementation details can be found at https://github.com/sghalebikesabi/beta-bayes-ops. We tuned the learning rate and the batch size on validation data sets when training with DPSGD. We use the same parameters for training with SGD to show how much performance is lost through the privatisation of the training procedure. The rule for the number of epochs was found by tuning the number of epochs for  $\epsilon = 1$  within  $\{5, 10, 15, 20\}$  and trying different parameters for the slope of the linear increase in  $\epsilon$  ( $\{0.5, 1, 2\}$ ) following observations from [20]. The batch size was tuned within  $\{50, 100, 200\}$ , the learning rate within  $\{10^{-3}, 10^{-2}, 10^{-1}, 1\}$ , and the clipping norm within  $\{0.8, 1, 1.2\}$ .
Additional plots for logistic regression Figure 6 compares the DP method for logistic regression individually with their non-private counterparts. For the  $\beta$ D-Bayes the non-private estimate was the posterior mean (PM) while for [18] it was the regularised empirical risk minimiser  $\hat{\theta}(D)$  without the added noise. As the number of observations  $n$  increases the DP-estimates from  $\beta$ D-Bayes and [18] with  $\lambda = 1/9$  approach the unprivatised estimates. This is not the case for [18] with  $\lambda = 1/9n$ .
Figure 7 and 8 consider the correct sign accuracy (CSA) of the DP methods for logistic regression. The CSA is the proportion of the time the DP-parameter estimates from the different methods agree with those of a non-private baselines. The plot demonstrates that the estimates from  $\beta$ D-Bayes OPS agree with the sign of the non-private method more of the time than the other methods.
Neural network classification Similarly to neural network regression, we can also use  $\beta$ D-Bayes for DP neural network classification. For simulated data, Figure 9 shows the for  $\epsilon >0.2$  the  $\beta$ DBayes generally achieves higher test set ROC-AUC than DPSGD across all sample sizes. In the real data we see that for  $\epsilon = 0.5$ $\beta$ D-Bayes and DPSGD perform similarly, on abalone the DPSGD generally achieves higher ROC-AUC whereas on bank the  $\beta$ D-Bayes generally performs slightly better. However, for  $\epsilon = 5$ , we see that while the DPSGD sometimes achieves higher ROC-AUC when  $n$  is small, as  $n$  increases the  $\beta$ D-Bayes achieves the highest ROC-AUC for all datasets, once again illustrating the consistency of our method.
Sensitivity in number of features Figure 10 investigates the quality of the DP estimation methods considered in this paper as the number of features grows. The top panel considers parameter RMSE of the data generating parameter  $\theta$  (divided by the number of dimensions of  $\theta$ ) in logistic regression. Here even the non-DP methods increase as the dimension of the parameter space increases as more parameters are estimated from the same number of observations. While the  $\beta$ D-Bayes performs the best, it appears to scale similarly with dimension as [18] and [66]. The middle panel considers test set predictive RMSE in neural network regression. More features provide a more complex model which should decrease RMSE. We see that the  $\beta$ D-Bayes achieves lower RMSE than DPSGD and  $\beta$ D-Bayes appears to scale better with dimension as the improvement made by  $\beta$ D-Bayes improves as the dimension of the feature space increases. The bottom panel considered test set ROC-AUC for neural network classification. Again, more features provide a more complex classifier improving test set ROC-AUC. For  $\epsilon > 0.2$ $\beta$ D-Bayes achieves a higher ROC-AUC than DPSGD and the improvement increases with the number of features.
Membership inference attacks For  $\epsilon \in \{0.2, 1, 2, 7, 10, 20\}$ , we run 10,000 rounds of the attack presented in Section 4. Figure 11 presents an estimated lower bound on  $\epsilon$ , given the false positive and negative rates of the attacks [43], for each method with its RMSE for the data generating  $\theta$ . Note that these lower bounds are unrealistic for  $\epsilon < 1$ . We see that, for any RMSE value,  $\beta$ D-Bayes achieves a lower practical bound on  $\epsilon$  than [18], which gives exact privacy guarantees. For fixed lower bound, we see that  $\beta$ D-Bayes achieves the smallest RMSE.
Compute While the final experimental results can be run within approximately two hours on a single Intel(R) Xeon(R) Gold 5118 CPU @ 2.30GHz core, the complete compute needed for the final results, debugging runs, and sweeps amounts to around 11 days.
Licenses The UCI data sets are licensed under Creative Commons Attribution 4.0 International license (CC BY 4.0).
$\beta \mathrm{D}$  -Bayes  $\beta \mathrm{D}$  -Bayes (PM)
[19]  $(\lambda = 1 / 9n)$  LogReg (1)
Chaudhuri et al. [19]  $(\lambda = 1 / 9n)$  LogReg (1)
Chaudhuri et al. [19]  $(\lambda = 1 / 9)$  LogReg (1)  $(\lambda = 1 / 9)$
Figure 6: Parameter log RMSE and test-set ROC-AUC of DP estimation for logistic regression as the number of observations  $n$  increases on simulated (first row of each method) and UCI data (second and third row of each method). PM stands for posterior mean which was estimated over 20 samples. This is a non-private baseline, i.e. the point estimate you would release if privacy were not an issue.
Figure 7: Correct sign accuracy (CSA) for simulated experiments (first row) and UCI data sets (second and third rows). For CSA, we estimate the number of coefficients in the logistic regression that have the same sign as the true coefficient on the simulated experiment or the non-DP coefficient estimated on the UCI data set with  $L_{2}$ -regularised logistic regression as implemented with default parameters in lsklearn.
Figure 8: CSA for simulated experiments (first row of each method) and UCI data sets (second row of each method). PM stands for posterior mean which was estimated over 20 samples. This is a non-private baseline, i.e. the point estimate you would release if privacy were not an issue.
Figure 9: Test set predictive ROC-AUC of DP estimation for neural network classification as the number of observations  $n$  increases on simulated and UCI data.
βD-Bayes DPSGD
Figure 10: Parameter log RMSE of DP logistic regression (first row), test set predictive log RMSE of DP neural network classification (second row), and test set ROC-AUC of DP neural network regression (third row) as the number of features  $d$  increases on simulated data with  $n = 1000$ .
Figure 11: Lower bound on  $\epsilon$  against log RMSE. Points correspond to values of  $\epsilon$ .