SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Combining the two cases completes the proof.
Proof. Without loss of generality, given two neighboring datasets  $D$  and  $D'$ , assume that  $D$  contains one more element than  $D'$ . Executing  $P$  on  $D$  and  $D'$ , we have partitions  $D_1, D_2, \ldots, D_m$  and  $D'_1, D'_2, \ldots, D'_m$ , respectively. There exists  $j$  such that (1)  $D_j$  contains one more element than  $D'_j$ , and (2)  $D_s = D'_s$  for  $s = 1, 2, \ldots, m$  and  $s \neq j$ . Given any finite subsets  $S = (\mathbf{x}_1, \ldots, \mathbf{x}_n) \subset T$ , Using additivity of Rényi divergence in [30] (Thm 28), we have:
$$
\begin{array}{l} \mathbb {D} _ {\alpha} (f _ {D} (S) | | f _ {D ^ {\prime}} (S)) = \sum_ {i = 1} ^ {m} \mathbb {D} _ {\alpha} (f _ {D _ {i}} (S) | | f _ {D _ {i} ^ {\prime}} (S)) \\ = \sum_ {i = 1, \dots , m, i \neq j} \mathbb {D} _ {\alpha} (f _ {D _ {i}} (S) | | f _ {D _ {i} ^ {\prime}} (S)) + \mathbb {D} _ {\alpha} (f _ {D _ {j}} (S) | | f _ {D _ {j} ^ {\prime}} (S)) \\ \leq \epsilon_ {j} \leq \max  _ {i \in \{1, 2, \dots , m \}} \epsilon_ {i}. \\ \end{array}
$$
Theorem 5 (Sequential composition of f-RDP). Let  $\{f_D:D\in \mathcal{D}\}$  and  $\{g_D:D\in \mathcal{D}\}$  be two families of functions indexed by dataset  $D$ , where  $f_{D}\in \mathcal{R}_{1}^{T}$  is  $(\alpha ,\epsilon_{1})$  RDP and  $g_{D}:\mathcal{R}_{1}^{T}\to \mathcal{R}_{2}^{S}$  is  $(\alpha ,\epsilon_{2})$  RDP. Releasing the sequentially composed functional mechanism  $h_D = (f_D,g_D\circ f_D)\in$ $\mathcal{R}_1^T\times \mathcal{R}_2^S = (\mathcal{R}_1\times \mathcal{R}_2)^{T\times S}$  satisfies  $(\alpha ,\epsilon_1 + \epsilon_2)$ -RDP.
Proof. According to Definition 4, our objective is to show for any finite subsets  $X = (\mathbf{x}_1, \ldots, \mathbf{x}_n)$  of  $T$  and  $Y = (\mathbf{y}_1, \ldots, \mathbf{y}_m)$  of  $S$ ,
$$
\begin{array}{l} \mathbb {D} _ {\alpha} \left(h _ {D} (X, Y) | | h _ {D ^ {\prime}} (X, Y)\right) \leq \epsilon_ {1} + \epsilon_ {2} \\ \Longleftrightarrow \mathbb {D} _ {\alpha} \left( \right.\left(\left(f _ {D} (X), g _ {D} \left(f _ {D}, Y\right)\right) \mid \mid \left(f _ {D ^ {\prime}} (X), g _ {D ^ {\prime}} \left(f _ {D ^ {\prime}}, Y\right)\right)\right) \leq \epsilon_ {1} + \epsilon_ {2}. \\ \end{array}
$$
Here we adapt the proof of Proposition 1 in [23]. Let  $F$  be the distribution of  $f_{D}(X)$ ,  $G$  be the distribution of  $g_{D}(f_{D},Y)$ ,  $H = (F,G)$ , and  $F^{\prime},G^{\prime},H^{\prime}$  are similarly defined on adjacent dataset  $D^{\prime}$ .
$$
\begin{array}{l} \exp \left[ (\alpha - 1) \mathbb {D} _ {\alpha} \left(h _ {D} (X, Y) \mid \mid h _ {D ^ {\prime}} (X, Y)\right) \right] = \int_ {\mathcal {R} _ {1} \times \mathcal {R} _ {2}} H (x, y) ^ {\alpha} H ^ {\prime} (x, y) ^ {1 - \alpha} d x d y \\ = \int_ {\mathcal {R} _ {1}} \int_ {\mathcal {R} _ {2}} [ F (x) G (x, y) ] ^ {\alpha} [ F ^ {\prime} (x) G ^ {\prime} (x, y) ] ^ {1 - \alpha} d x d y \\ = \int_ {\mathcal {R} _ {1}} F (x) ^ {\alpha} F ^ {\prime} (x) ^ {1 - \alpha} \left[ \int_ {\mathcal {R} _ {2}} G (x, y) ^ {\alpha} G ^ {\prime} (x, y) ^ {1 - \alpha} d y \right] d x \\ \leq \int_ {\mathcal {R} _ {1}} F (x) ^ {\alpha} F ^ {\prime} (x) ^ {1 - \alpha} \cdot \exp [ (\alpha - 1) \epsilon_ {2} ] \\ \leq \exp [ (\alpha - 1) (\epsilon_ {1} + \epsilon_ {2}) ]. \\ \end{array}
$$
Proof. Consider any finite set  $(\mathbf{x}_1, \ldots, \mathbf{x}_n) \in T^n$ , the vector  $(G(\mathbf{x}_1), \ldots, G(\mathbf{x}_n))$  follows a multivariate Gaussian with mean zero and covariance given by Eq. (2). Thus, evaluating  $\widetilde{f_D}$  at any finite sets would form a vector that satisfies Eq. (5) in Definition 5, which completes the proof.
MNIST [15] & Fashion MNIST [34]: MNIST contains hand-written digits images, whereas Fashion MNIST contains cloth and shoe images. Images in both datasets are single-channel, in the size of  $1 \times 28 \times 28$ , which are resized to  $1 \times 32 \times 32$  and normalized to have 0.5 mean and 0.5 standard deviation. Both datasets have 10 classes. We adopt the official training and test split. MNIST and Fashion MNIST are made available under Creative Commons Attribution-Share Alike 3.0 license and MIT License, respectively.
CelebA [20]: CelebA is a dataset including face images of celebrities. Each image is in the size of  $3 \times 178 \times 218$  and has 40 binary attributes. All images are center-cropped to  $3 \times 178 \times 178$ , then resized to  $3 \times 32 \times 32$ , and normalized to have 0.5 mean and 0.5 standard deviation. We also adopt the official training, validation and test split, but randomly select 60k images from the training split as our training set. The CelebA dataset is available for non-commercial research purposes only, as described on their website.
Generative network: Our unconditional generative network is based on the official code of MMDGAN [16]. For the NN architecture, we use the same Conv2dTranpose layer with similar depth as prior related works. Besides, we use the same architecture for both gray-scale and RGB image sets to
Table 2: Training parameters for retaining DP on MNIST and Fashion MNIST. Both variants on CelebA use parameters in the row of Conditional.  $q$  is the subsampling rate, and  $\sigma$  is the noise multiplier.
target ε	q	σ	epochs (iterations)
Conditional	10.0	0.001	0.60	200 (200k)
1.0	0.001	1.95	200 (200k)
0.2	0.001	8.00	200 (200k)
Parallel	10.0	0.010	1.00	200 (20k)
1.0	0.010	5.75	200 (20k)
0.2	0.010	25.00	200 (20k)
demonstrate its versatility (of course with different NN parameters to account for the difference in input channels). Encoding labels to the latent code leads to the conditional variant. All networks are optimized by RMSprop with a learning rate  $5 \times 10^{-5}$ .
CNN classifier: We follow Cao et al. [4] for the classifier implementation.
The CNN consists of following layers: Conv2d(input_channels, 32, kernel_size=3, stride = 2, padding=1)  $\rightarrow$  Dropout(p=0.5)  $\rightarrow$  ReLU  $\rightarrow$  Conv2d(32, 64, kernel_size=3, stride = 2, padding=1)  $\rightarrow$  Dropout(p=0.5)  $\rightarrow$  ReLU  $\rightarrow$  flatten  $\rightarrow$  linear(flatten_dim, output_dim)  $\rightarrow$  Softmax.
The CNN classifier is optimized by Adam with default parameters. All classifiers are trained on synthetic data, and we report test accuracy on real test data as the evaluation metric.
Privacy: We use Tensorflow privacy for computing the total privacy cost, which only requires inputting a few important parameters, e.g. subsampling rate (or batch size), noise multiplier, training epochs (iterations), target  $\delta$  ( $\delta = 10^{-5}$  in all our experiments). We summarize the parameters in Table 2.
Baselines: We use the official code of DP-MERF to replicate their results under different  $\epsilon$  and use the same evaluation metrics to add quantitative comparison. The numerical evaluations of rest baselines are cited from related works, as specified in the caption of the tables.
Computation resources: All computation is conducted by one NVIDIA T4 GPU. It costs 1.5 hours to train a conditional generator on MNIST (and Fashion MNIST) and around 5 hours on CelebA. Each sub-model in the parallel variant takes only 10 minutes to train on MNIST (and Fashion MNIST) and 30 minutes on CelebA. A better GPU should compute faster. As a reference, DP-Sinkhorn and GS-WGAN can take up to 24 hours to train, and GS-WGAN even requires at least 2 GPUs (as they have 1000 discriminators).
D Additional results
For completeness, we include the qualitative comparison between our method and related works under  $(10, 10^{-5})$ -DP on all three datasets in Figures 4 and 5. Numerical comparison is in Table 3. We note that  $\epsilon = 10$  is usually considered a weak privacy regime. Generally, all baselines can generate decent images when  $\epsilon = 10$ , whereas our method still generates more diverse and more informative images, especially on CelebA.
E Broader impact and limitations
Broader impact: Some prior works reveal that DP training could introduce additional biases to the model, leading to fairness concerns [2, 10, 35]. We did not explore this point in the current experiments as there are no sensitive attributes involved, but we can imagine the potential negative effects on fairness issues if our methods are not used properly.
DP-CGAN
DP-MERF
G-PATE
GS-WGAN
DP-Sinkhorn
Ours (conditional)
Ours (parallel)
Figure 4: Qualitative comparison under  $(10,10^{-5})$ -DP on MNIST and Fashion MNIST
Table 3: Quantitative comparison under  $(10,10^{-5})$ . Acc denotes classification accuracy, which is shown in%. ↑ and ↓ refer to higher is better or lower is better, respectively. Results of DP-CGAN, GS-WGAN, DP-Sinkhorn are cited from Cao et al. [4] and Long et al. [21]. Results of PEARL and DPDM are cited from Dockhorn et al. [6]. Results of G-PATE and DataLens are cited from their papers, respectively.  $(^{*})$ : DPDM did unconditional generation on CelebA.
Method	ε	MNIST	FMNIST	CelebA
FID ↓	Acc ↑	FID ↓	Acc ↑	FID ↓	Acc ↑
DPDM	10	5.0	97.3	18.6	84.9	*21.1	-
DP-CGAN	10	179.2	63.0	243.8	46.0	-	-
DP-MERF	10	121.4	82.0	110.4	73.2	211.1	64.0
PEARL	10	116.0	78.8	102.0	64.9	-	-
G-PATE	10	150.6	80.9	171.9	69.3	305.9	70.7
DataLens	10	173.5	80.7	167.7	70.6	320.8	72.9
GS-WGAN	10	61.3	80.0	131.3	65.0	432.5	63.3
DP-Sinkhorn	10	55.6	79.1	129.4	68.9	-	-
Ours (conditional)	10	29.9	93.1	56.3	79.2	77.2	85.8
Ours (parallel)	10	17.7	96.4	38.1	82.0	78.5	87.4
Besides, we do not expect this work to trigger any differential privacy concern by its design, and we do not expect it to be used for Deepfakes (as the non-private counterparts are better in utility), but there might be some unintended uses that we are not aware of for now.
Limitations: The current conditional approach assumes a uniform distribution over different labels, which happens to hold for all three datasets. A more tailored algorithm is needed if the label distribution is imbalanced. The current parallel approach is not subject to a specific label distribution, but it may hinder its practical deployment if the number of classes is too large.
DataLens
Figure 5: Qualitative comparison under  $(10,10^{-5})$  -DP on CelebA
F A simplified view of RDP for vectors and functions
In this section, we propose to define Rényi differential privacy (RDP) for vectors and functions in a unified way.
Let  $\mathcal{D}$  be a collection of datasets and  $f:\mathcal{D}\to \mathcal{R}$  be a randomized mechanism. We consider  $\mathcal{R} = \mathbb{R}^T$  so we may also identify  $f$  as a bivariate (random) function  $f:T\times \mathcal{D}\rightarrow \mathbb{R}$ . In the following we call two datasets  $D,D^{\prime}\in \mathcal{D}$  adjacent if they differ by one data point. We recall the Renyi  $\alpha$ -divergence [26] between two random variables  $\mathrm{X}_1$  and  $\mathrm{X}_2$  with density  $p$  and  $q$ , respectively:
$$
\mathbb {D} _ {\alpha} (\mathtt {X} _ {1} \| \mathtt {X} _ {2}) := \mathbb {D} _ {\alpha} \big (p (\mathbf {x}) \| q (\mathbf {x}) \big) := \frac {1}{\alpha - 1} \log \mathbb {E} _ {\mathtt {X} \sim q} \left[ \frac {p (\mathtt {X})}{q (\mathtt {X})} \right] ^ {\alpha} \geq 0,
$$
where  $\alpha > 1$  is a hyperparameter and the last inequality follows from Jensen's inequality. Since we can rewrite
$$
\mathbb {D} _ {\alpha} (\mathsf {X} _ {1} \| \mathsf {X} _ {2}) = \frac {1}{\alpha - 1} \log \mathbb {E} _ {\mathsf {X} \sim p} \left[ \frac {p (\mathsf {X})}{q (\mathsf {X})} \right] ^ {\alpha - 1},
$$
it is clear Rényi's  $\alpha$ -divergence  $\mathbb{D}_{\alpha}$  is increasing w.r.t.  $\alpha$ , with the following limits:
$$
\mathsf {K L} (\mathsf {X} _ {1} \| \mathsf {X} _ {2}) = \lim  _ {\alpha \to 1} \mathbb {D} _ {\alpha} (\mathsf {X} _ {1} \| \mathsf {X} _ {2}) \leq \lim  _ {\alpha \to \infty} \mathbb {D} _ {\alpha} (\mathsf {X} _ {1} \| \mathsf {X} _ {2}) = \operatorname * {e s s} _ {\mathbf {x}} \sup  \log \frac {p (\mathbf {x})}{q (\mathbf {x})}.
$$
For joint distributions, we can easily verify the following decomposition rule:
$$
\begin{array}{l} \mathbb {D} _ {\alpha} (p (\mathbf {x}, \mathbf {z}) \| q (\mathbf {x}, \mathbf {z})) = \frac {1}{\alpha - 1} \log \mathbb {E} _ {\mathsf {X} \sim q} \left[ \left[ \frac {p (\mathsf {X})}{q (\mathsf {X})} \right] ^ {\alpha} \exp \Big ((\alpha - 1) \mathbb {D} _ {\alpha} [ p (\mathbf {z} | \mathsf {X}) \| q (\mathbf {z} | \mathsf {X}) ] \Big) \right] \\ \geq \mathbb {D} _ {\alpha} (p (\mathbf {x}) \| q (\mathbf {x})), \tag {12} \\ \end{array}
$$
where the inequality follows from the nonnegativity of the conditional Rényi divergence inside the exponential. In other words, the  $\alpha$ -divergence between joint distributions is always larger than that between marginal distributions.
We are now ready to define Rényi differential privacy [23]:
Definition 6  $((\alpha, \epsilon)$ -RDP). A randomized mechanism  $f: T \times \mathcal{D} \to \mathbb{R}$  is  $(\alpha, \epsilon)$ -RDP if for all adjacent datasets  $D, D' \in \mathcal{D}$ ,
$$
\sup  _ {n \in \mathbb {N}} \sup  _ {\mathbf {t} := \left[ t _ {1}, \dots , t _ {n} \right] \subseteq T} \mathbb {D} _ {\alpha} \left(f (\mathbf {t}; D) \| f (\mathbf {t}; D ^ {\prime})\right) \leq \epsilon , \tag {13}
$$
where  $f(\mathbf{t};D) \coloneqq [f(t_1;D),\dots ,f(t_n;D)]$  is the concatenation of  $n$  random variables.
The acute reader will notice some immediate difference between our definition and the one in the literature, e.g., Mironov [23, Definition 4]. Before explaining our motivation, let us first notice that when  $T = [d] \coloneqq \{1, \dots, d\}$ , i.e., the range of our mechanism  $f$  is  $\mathcal{R} = \mathbb{R}^d$  (which is the setting of [23] and most existing work), the supremum in (13) is attained when  $n = d$  and  $\mathbf{t} = [1, \dots, d]$ , thanks to inequality (12). In other words, the supremum in (13) is superficial when  $T$  is a finite set. The important point is that we can now extend RDP effortlessly to any index set  $T$ , including when  $T$  is even uncountable. For instance, in our later application to generative modeling (Section 4), we will use  $T = \mathbb{R}^m$ . On the other hand, one might be tempted to lump all random variables together into  $f(T; D) = \{f(t; D) : t \in T\}$ , hoping to obviate the supremum in (13). However, this approach will run into two difficulties: Firstly, the rigorous minds will start to worry about measurability issues around  $f(T; D)$  (as a stochastic process) and involve tedious measure-theoretic jargon (such as the cylinder field in [12]). Secondly, we no longer possess a dominating measure (e.g., Lebesgue) to define an easily computable density of the process  $f(T; D)$ . In contrast, our reduction to the finite case through taking the supremum does not suffer from either issue, and, as we will see, renders extensions of existing properties of RDP (to an arbitrary index set  $T$ ) rather natural or even trivial.
The following result was proved by Mironov [23, Proposition 3]:
Theorem 6. If a mechanism  $f$  is  $(\alpha, \epsilon)$ -RDP, then for any (measurable) set  $A$ ,
$$
\operatorname * {P r} [ f (D) \in A ] \leq \left\{\exp (\epsilon) \operatorname * {P r} [ f (D ^ {\prime}) \in A ] \right\} ^ {1 - \frac {1}{\alpha}} \leq (1 - \frac {1}{\alpha}) \exp (\epsilon + \frac {1}{\alpha - 1} \log \frac {1}{\delta}) \operatorname * {P r} [ f (D ^ {\prime}) \in A ] + \frac {\delta}{\alpha}.
$$
In particular,  $f$  is  $\left(\epsilon + \frac{1}{\alpha - 1} \log \frac{1}{\delta}, \frac{\delta}{\alpha}\right)$ -DP.
Proof. For  $\alpha \geq 1$ , consider the (jointly) convex function (as the perspective of  $p \mapsto p^{\alpha}$ ):
$$
g (p, q) := q \left(\frac {p}{q}\right) ^ {\alpha},
$$
as well as the probability measure  $\mathbf{1}_{\mathbf{x}\in A}\cdot \mu (\mathrm{d}\mathbf{x}) / \mu (A)$  (recall that  $\mu (\mathrm{d}\mathbf{x})$  is the underlying dominating measure that the densities  $p$  and  $q$  are defined w.r.t.). Applying Jensen's inequality we obtain
$$
\begin{array}{l} \frac {1}{\mu (A)} \cdot \int_ {A} q (\mathbf {x}) \left(\frac {p (\mathbf {x})}{q (\mathbf {x})}\right) ^ {\alpha} \mu (\mathrm {d} \mathbf {x}) \geq g \left(\frac {1}{\mu (A)} \int_ {A} p (\mathbf {x}) \mu (\mathrm {d} \mathbf {x}), \frac {1}{\mu (A)} \int_ {A} q (\mathbf {x}) \mu (\mathrm {d} \mathbf {x})\right) \\ = \frac {1}{\mu (A)} Q (A) \left(\frac {P (A)}{Q (A)}\right) ^ {\alpha}, \\ \end{array}
$$
where  $P(A)\coloneqq \int_{A}p(\mathbf{x})\mu (\mathrm{d}\mathbf{x}) = \operatorname *{Pr}[f(D)\in A]$  and similarly for  $Q(A)$ . Thus,
$$
\epsilon \geq \mathbb {D} _ {\alpha} (p \| q) \geq \frac {1}{\alpha - 1} \log \int_ {A} q (\mathbf {x}) \left(\frac {p (\mathbf {x})}{q (\mathbf {x})}\right) ^ {\alpha} \mu (\mathrm {d} \mathbf {x}) \geq \frac {1}{\alpha - 1} \log \left[ Q (A) \left(\frac {P (A)}{Q (A)}\right) ^ {\alpha} \right].
$$
Rearranging we obtain the first inequality. The second inequality is simply the arithmetic-geometric mean inequality, after noting that
$$
[ \exp (\epsilon) Q (A) ] ^ {1 - \frac {1}{\alpha}} = \left[ \exp (\epsilon + \frac {1}{\alpha - 1} \log \frac {1}{\delta}) Q (A) \right] ^ {1 - \frac {1}{\alpha}} \cdot \delta^ {\frac {1}{\alpha}}.
$$
Lastly, we relax the factor  $(1 - \frac{1}{\alpha}) \leq 1$  to obtain the claimed DP guarantee.
For two Gaussian distributions  $\mathcal{N}(\mathbf{u},\Sigma)$  and  $\mathcal{N}(\mathbf{v},\Sigma)$ , their Rényi  $\alpha$ -divergence can be readily computed from Liese and Vajda [18, Proposition 2.22]:
$$
\mathbb {D} _ {\alpha} \left(\mathcal {N} (\mathbf {u}, \Sigma) \| \mathcal {N} (\mathbf {v}, \Sigma)\right) = \frac {\alpha}{2} \left\langle \mathbf {u} - \mathbf {v}, \Sigma^ {- 1} (\mathbf {u} - \mathbf {v}) \right\rangle .
$$
Therefore, the Gaussian mechanism
$$
f (D) := F (D) + \sigma \cdot \mathcal {N} (\mathbf {0}, \Sigma)
$$
is  $(\alpha ,\epsilon)$  -RDP, where
$$
\epsilon = \frac {\alpha}{2 \sigma^ {2}} \cdot \sup _ {D \sim D ^ {\prime}} \left\langle F (D) - F (D ^ {\prime}), \Sigma^ {- 1} (F (D) - F (D ^ {\prime})) \right\rangle .
$$