SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The specification of an adequate privacy level  $\varepsilon$  is challenging since it does not only depend on the domain but also on the dataset itself. This challenge persists when assigning individual privacy levels over a dataset. Especially in sensitive domains, one needs to make sure that the assignment of individual privacy guarantees does not pose an additional risk to the individuals whose data is processed. Therefore, one needs to first make sure that assigning individual privacy guarantees is not abused. This can occur when the entity training the model violates underlying individuals' privacy by nudging them into choosing inadequate privacy levels. Second, one needs to prevent individuals from giving up their privacy due to a lack of understanding or a wrong perception of their risk. To do so, IDP-SGD should not be used as a stand-alone method. Instead, following the example of [6], we suggest incorporating it into a whole process that involves communicating the functioning of DP and the risks associated with a decision to the individuals, analyzing their preferences, and supporting them in an informed decision-making process. There exist a growing body of work on the communication of DP methodology and associated risks to the public [41, 9, 12]. The most recent finding [12] suggests that medical risk communication formats, such as percentages or frequencies, are best applicable to inform about privacy risks. For the identification of privacy preferences, existing frameworks, such as [37] can be applied. Finally, we suggest giving individuals the choice between categorical privacy levels (e.g., high, medium, low) while putting a regulatory entity, such as an ethics committee in charge of specifying concrete numeric values of  $\varepsilon$ . This mitigates the disadvantages of the general limited interpretability of  $\varepsilon$  that exist independently of individualization.
In this work, we consider a setup where individuals indicate their privacy preferences. We acknowledge that not all individuals are aware of their own privacy preferences and might, therefore, provide inaccurate indications. Therefore, our framework should be always deployed in a protected setup as described above. While we provide theoretical privacy guarantees in the framework of differential privacy, we assess the practical impact of these guarantees on the individuals solely through membership inference attacks. Future work should investigate the practical (disparate per privacy-group) impact on other known privacy risks, such as data reconstruction. Due to the lack of sensitive-real world datasets that, in addition to individuals' data, also capture their privacy preferences, we evaluate our methods on standard benchmark datasets. We, therefore, have to simulate a privacy preference distribution on this data according to the distribution known from society [17, 5].
A.2 Confidentiality of the Privacy Budgets
In some setups, an individual's choice of privacy budget could reflect some sensitive information. Imagine a medical context with a dataset that consists of individuals that do and individuals that do not have cancer. The latter ones might be more inclined towards choosing higher privacy protection to hide their condition. If an attacker with access to the trained model was able to deduce the individual's privacy budget, they might, in turn, be able to draw conclusions on the individual's medical state.
Yet, theoretical results from ML, e.g., [14], have shown that one cannot currently perform sample-efficient black-box audits to determine the privacy-budget of a trained model. Frameworks to estimate privacy of a trained model, such as [39] rely on training 1000-100,000 shadow models to get an estimate of the full model's privacy guarantee. In our IDP-SGD setup, the model does not have one single  $\varepsilon$ , but one  $\varepsilon_{p}$  per group, aggravating the impracticability of auditing guarantees and limiting the applicability of existing frameworks. As a result, the adversary cannot currently determine the different per-group privacy budgets of the model.
Our MIA experiments in Section 4.3 show a difference in privacy risks over entire privacy groups. First note that these experiments (Figure 2) were the most costly ones in our paper. We had to train more than 1500 (3 times 512) shadow models to generate the results. Yet, there are two limitations: a) The results only show differences in the groups, but do not reveal the respective  $\varepsilon_{p}$  values, b) they do not allow to perform per-point distinctions. This is because the distributions of privacy risks over the two groups still have a large overlap. Hence, given a single point's risks and the two distributions, one cannot predict without error to what group the point belongs. This error could be reduced when the privacy budgets between the groups differ significantly (0.1 vs. 100). Note however, that we suggest deploying the model in a setup where individuals simply specify their privacy preferences
and the model builder or an ethics committee assign concrete epsilon values to these preferences. We observed that extreme differences between privacy groups' are less beneficial because they degrade overall model performance. Hence, in practice, these large differences are very unlikely. As a result, it will be very challenging for an adversary to determine which privacy group a data point belongs to. Even if they manage to, they are unlikely to be able to learn the privacy budget of the group as described above.
To enhance confidentiality of privacy budgets, Alaggan et al. [2] implement a form of deniability for users' membership in a certain privacy group by uniformly sampling the privacy values over groups in an overlapping way: the unconcerned sample from 1., the pragmatists from 0.5, 0.75, 1., and the fundamentalists from 0, 0.5, 1, such that on average, the values will be 1., 0.75, and 0.5 within the groups (0 denotes the strongest, while 1 is the weakest privacy guarantee). Such an approach can be implemented into our IDP-SGD framework as well. The drawback is that an individual who expresses strong privacy preferences (fundamentalists) might actually be assigned a privacy value 1 by randomness, which causes the same privacy leakage as for an unconcerned individual. Depending on the individuals' preferences and the application, when protecting privacy group membership is more important than protecting the actual data, this approach might still be valid and this approach could be integrated with IDP-SGD, as well.
B Extended Background
B.1 Differential Privacy
Differential Privacy (DP) [10] provides a theoretical upper bound on the influence that a single data point can have on the outcome of an analysis over the whole dataset.
The most commonly applied instantiation of DP is  $(\varepsilon, \delta)$ -DP which is defined as follows:
Definition B.1. Let  $D, D' \subseteq \mathcal{D}$  be two neighboring datasets, i.e., datasets that differ in exactly one data point. Let further  $M: \mathcal{D}^* \to \mathcal{R}$  be a mechanism that processes an arbitrary number of data points.  $M$  satisfies  $(\varepsilon, \delta)$ -DP if for all datasets  $D \sim D'$ , and for all result events  $R \subseteq \mathcal{R}$
$$
\mathbb {P} [ M (D) \in R ] \leq e ^ {\varepsilon} \cdot \mathbb {P} [ M (D ^ {\prime}) \in R ] + \delta . \tag {4}
$$
In the definition, the privacy level is specified by  $\varepsilon \in \mathbb{R}_+$ , while  $\delta \in [0,1]$  offers a relaxation, i.e., a small probability of violating the guarantees.
B.2 Differential Privacy Accounting in Machine Learning
Privacy accounting in DP-SGD is most commonly implemented by the moments accountant which keeps track of a bound on the moments of the privacy loss random variable at outcome  $R$ , defined by
$$
c (R; M, \mathbf {a u x}, D, D ^ {\prime}) = \log \frac {\Pr [ M (\mathbf {a u x} , D) \in R ]}{\Pr [ M (\mathbf {a u x} , D ^ {\prime}) \in R ]}. \tag {5}
$$
for  $D, D', M$  and  $R$  as above, and an auxiliary input aux.
B.3 PATE Algorithm
The Private Aggregation of Teacher Ensembles (PATE) algorithm [33] represents an alternative to DP-SGD for training ML models with privacy guarantees. This ensemble-based algorithm implements privacy guarantees through a knowledge transfer from the ensemble to a separate student model. More concretely, in PATE, the private training data is split into non-overlapping subsets and distributed among several teacher models. Once each teacher is trained on their own data subset, they perform a privacy-preserving knowledge transfer by jointly labeling an additional unlabeled public dataset. To implement DP guarantees, noise is added to the labeling process. On completion, an independent student model is trained on the public dataset using the generated labels, and thereby incorporating knowledge about the original training data without ever requiring access to it.
B.4 Individualized PATE.
The individualized PATE variants by [6] are Upsample and Weight. Upsample duplicates data points and distributes them to different teachers in the PATE ensemble. Utility increase in this method
result from the availability of more training data points for the teachers. Since the sensitivity for a duplicated data point increases (it can change the votes of all the teachers that are trained on its duplicates), privacy consumption of that data point is higher. Since each data point can be duplicated individually, this method allows for a fine-grained individualization. In contrast, the weight method allows for a per-teacher model privacy individualization. Data points with the same privacy budget are assigned to the same teacher model(s) and the impact of that teacher model's weight on the final vote is weighted according to its training data points' privacy preferences. Teachers that are trained on data points with low privacy requirements are weighted higher, increasing the privacy consumption of their training data.
B.5 The LiRA Membership Inference Attack
The LiRA membership inference attack [8] proceeds in three steps to determine which data points from a dataset  $\mathcal{D} = \{x_1, \ldots, x_N\}$  were used to train a target model  $f$ : (1) First, multiple shadow models, similar to  $f$ , are trained on different subsets of  $\mathcal{D}$ . (2) Then, the mean and variance of two loss distributions  $\mathcal{N}(\mu_{\mathrm{in}}, \sigma_{\mathrm{in}})$  and  $\mathcal{N}(\mu_{\mathrm{out}}, \sigma_{\mathrm{out}})$  are estimated per data point  $x_i$ . Both distributions are calculated from the logits of  $x_i$  at the target class  $y_i$ —the former one over the shadow models that  $x_i$  is a member of, the latter one on shadow models that  $x_i$  is not a member of. (3) Finally, the likelihood of a new data point  $x$  of class  $y$  being a member of the target model  $f$  is calculated as  $\Lambda = \frac{p(f(x)_y \mid \mathcal{N}(\mu_{\mathrm{in}}, \sigma_{\mathrm{in}}^2))}{p(f(x)_y \mid \mathcal{N}(\mu_{\mathrm{out}}, \sigma_{\mathrm{out}}^2))}$ .
C Details on the Methods
C.1 Sample
Leveraging Higher Sampling Rates for Increased Utility. With higher sampling rates for certain data points, utility could, in principle be increased in several ways. (1) Larger sampling rates can be used to obtain higher mini-batch sizes  $B$  (while keeping the number of training iterations  $I$  constant). Line 3 in Algorithm 1 shows that noise is added to the aggregate of all gradients. Hence, with larger mini-batches, the signal-to-noise ratio is higher, which can improve training. (2) Alternatively, the mini-batch size  $B$  can be kept constant while increasing the number of training iterations  $I$ . Longer training can increase model performance. However, these two approaches result in a change of core training hyperparameters (mini-batch size and number of iterations). As we discuss in Section 3, changing training hyperparameters would require a separate fine-tuning, for example, to adapt the learning rate for larger mini-batches, as in (1) or longer training as in (2). Since the training parameters would change according to the privacy budgets encountered in the private training dataset, and the ratios of these budgets over the training data points, the hyperparameter-tuning would have to be repeated whenever the dataset is updated, individuals change their privacy preferences, or decide to withdraw their consent for leveraging their data for the ML model altogether, yielding significant overheads. We, therefore, implement our Sample according to the third option (3), described in Section 3.3 which leverages higher sampling rates for improved utility by reducing the noise multiplier of the added noise  $\sigma$ . This allows us to perform an apple to apple comparison between both our methods and to the standard DP-SGD.
C.2 Scale
Deriving Noise Multiplier  $\sigma_{\mathrm{scale}}$ . Given the desired clip norm  $c$  found through hyperparameter tuning of the standard DP-SGD, we set the individual clip norms such that their weighted average yields  $c$  as  $c = \frac{1}{N}\sum_{p=1}^{P}|G_p| \cdot c_p$ . So, we derive the  $\sigma_{\mathrm{scale}}$  in the following way:
$$
c = \frac {1}{N} \sum_ {p = 1} ^ {P} \left| G _ {p} \right| \cdot c _ {p} \tag {6}
$$
$$
c = \frac {1}{N} \sum_ {p = 1} ^ {P} \left| G _ {p} \right| \cdot \left(c \frac {\sigma_ {\text {s c a l e}}}{\sigma_ {p}}\right) \tag {7}
$$
$$
c = c \sigma_ {\text {s c a l e}} \frac {1}{N} \sum_ {p = 1} ^ {P} \frac {\left| G _ {p} \right|}{\sigma_ {p}} \tag {8}
$$
$$
\sigma_ {\text {s c a l e}} = \left(\frac {1}{N} \sum_ {p = 1} ^ {P} \frac {\left| G _ {p} \right|}{\sigma_ {p}}\right) ^ {- 1} \tag {9}
$$
From (6) to (7), we use the equality between the scale of added noise  $\sigma_{\mathrm{scale}}c = \sigma_p c_p$ . In (8), we extract terms that are independent of the privacy groups ( $c$  and  $\sigma_{\mathrm{scale}}$ ) before the summation.
C.3 Algorithmic Details
We specify our used sub-routines used for determining a sample rate or noise multiplier based on given privacy parameters in Algorithm 4 and Algorithm 5, respectively.
Algorithm 4: Subroutine getSampleRate. Is the equivalent to Opacus' function get_noisemultiplier [32] for deriving an adequate sample rate for given paramteters.
Require: Target  $\varepsilon$ , target  $\delta$ , iterations  $I$ , noise multiplier  $\sigma$ , precision  $\gamma = 0.01$
1: init  $\varepsilon_{\mathrm{high}}$  :  $\varepsilon_{\mathrm{high}}\gets \infty$
2: init  $q_{\mathrm{low}}$ ,  $q_{\mathrm{high}}$ :  $q_{\mathrm{low}} \gets 1\mathrm{e} - 9$ ,  $q_{\mathrm{high}} \gets 0.1$
3: while  $\varepsilon_{\mathrm{high}} > \varepsilon$  do
4:  $q_{\mathrm{high}} \gets 2q_{\mathrm{high}}$
5:  $\varepsilon_{\mathrm{high}}\gets I\cdot 2q_{\mathrm{high}}^2\frac{1}{\sigma^2}$  {approximate  $\varepsilon$  according to Equation (2), we suppress  $\alpha$  for simplicity}
6: end while
7: while  $\varepsilon -\varepsilon_{\mathrm{high}} > \gamma$  do
8:  $q \gets (q_{\mathrm{low}} + q_{\mathrm{high}}) / 2$
9:  $\varepsilon_{\mathrm{temp}} \gets I \cdot 2q^2 \frac{1}{\sigma^2}$  {approximate  $\varepsilon$  according to Equation (2), we suppress  $\alpha$  for simplicity}
10: if  $\varepsilon_{\mathrm{temp}} <   \varepsilon$  then
11:  $q_{\mathrm{high}}\gets q$
12:  $\varepsilon_{\mathrm{high}}\gets \varepsilon_{\mathrm{temp}}$
13: else
14:  $q_{\mathrm{low}}\gets q$
15: end if
16: end while
17: Output  $q_{\text{high}}$
D Additional Empirical Evaluation
We report the hyperparameters found for our individualized methods in Table 6. The training and standard DP-SGD hyperparameters are specified in Table 5. The performance of our individualized methods when using the hyperparameters of standard DP-SGD is presented in Table 8. Already when using these (non-individually tuned) hyperparameters, our methods yield a significant performance increase in comparison to standard DP-SGD. For MNIST, individual hyperparameter for our methods and individual setups did not yield significant improvements, therefore the results presented in Table 8 and Table 2 are identical for MNIST.
Computing Resources. The implementation of our methods does not increase computation time over the standard implementation of DP-SGD apart from the derivation of the privacy parameters that is performed once at the beginning of training. Hence, to run all experiments around our methods and
Algorithm 5: Subroutine getNoise. Implements Opacus' function get_noisemultiplier [32].
Require: Target  $\varepsilon$  target  $\delta$  , iterations  $I$  sample rate  $q$  precision  $\gamma = 0.01$    
1: init  $\varepsilon_{\mathrm{high}}$  ..  $\varepsilon_{\mathrm{high}}\gets \infty$    
2: init  $\sigma_{\mathrm{low}},\sigma_{\mathrm{high}}$  ..  $\sigma_{\mathrm{low}}\gets 0,\sigma_{\mathrm{high}}\gets 10$    
3: while  $\varepsilon_{\mathrm{high}} > \varepsilon$  do   
4:  $\sigma_{\mathrm{high}}\gets 2\sigma_{\mathrm{high}}$    
5:  $\varepsilon_{\mathrm{high}}\gets I\cdot 2q^2\frac{1}{\sigma_{\mathrm{high}}^2}$  {approximate  $\varepsilon$  according to Equation (2), we suppress  $\alpha$  for simplicity}   
6: end while   
7: while  $\varepsilon -\varepsilon_{\mathrm{high}} > \gamma$  do   
8:  $\sigma \gets (\sigma_{\mathrm{low}} + \sigma_{\mathrm{high}}) / 2$    
9:  $\varepsilon_{\mathrm{temp}}\gets I\cdot 2q^2\frac{1}{\sigma^2}$  {approximate  $\varepsilon$  according to Equation (2), we suppress  $\alpha$  for simplicity}   
10: if  $\varepsilon_{\mathrm{temp}} <   \varepsilon$  then   
11:  $\sigma_{\mathrm{high}}\gets \sigma$    
12:  $\varepsilon_{\mathrm{high}}\gets \varepsilon_{\mathrm{temp}}$    
13: else   
14:  $\sigma_{\mathrm{low}}\gets \sigma$    
15: end if   
16: end while   
17: Output  $\sigma_{\mathrm{high}}$
their evaluation, we required, in total less than 16h of GPU time on a standard GeForce RTX 2080 Ti. We ran the experiment on combining individualized privacy assignment and accounting on the same machines RTX 2080Ti and the total compute time is also around 2h. To train all the shadow models for our membership inference attack and run inference on them, we ran on an A100 GPU and required a total runtime of roughly 32 hours.
Table 5: DP-SGD Hyperparameters. LR: learning rate, B: expected mini-batch size, I: number of iterations, C: clip norm,  $\sigma$ : noise multiplier in DP-SGD derived from the desired privacy budget  $\varepsilon = 1$ . Default target  $\delta = 0.00001$ .
DATASET	LR	B	I	C	σ
MNIST	0.6	512	9375~80 EPOCHS	0.2	3.42529
SVHN	0.2	1024	2146~30 EPOCHS	0.9	2.74658
CIFAR10	0.7	1024	1465~30 EPOCHS	0.4	3.29346
Table 6: DP-SGD Hyperparameters (Individually Tuned). LR: learning rate, B: expected minibatch size, I: number of iterations, C: clip norm,  $\sigma$ . Default target  $\delta = 0.00001$ . Setup A is for privacy budgets  $\varepsilon = \{1.0, 2.0, 3.0\}$  and their respective distribution of  $34\% - 43\% - 23\%$ . Setup B is for the same privacy budgets but with their distributions  $54\% - 37\% - 9\%$ .
DATASET	METHOD	SETUP	LR	B	I	C	σ
MNIST	SAMPLE	A	0.6	512	9375~80 EPOCHS	0.2	3.42529
SVHN	SAMPLE	A	0.2	1024	5723~80 EPOCHS	0.6	2.53261
CIFAR10	SAMPLE	A	0.2	1024	2929~60 EPOCHS	1.0	2.65712
MNIST	SAMPLE	B	0.6	512	9375~80 EPOCHS	0.2	3.42529
SVHN	SAMPLE	B	0.1	1024	3577~50 EPOCHS	0.6	2.41421
CIFAR10	SAMPLE	B	0.1	1024	2929~60 EPOCHS	1.8	3.14049
MNIST	SCALE	A	0.6	512	9375~80 EPOCHS	0.2	3.42529
SVHN	SCALE	A	0.1	1024	3577~50 EPOCHS	2.0	2.09719
CIFAR10	SCALE	A	0.2	1024	3418~70 EPOCHS	1.1	2.88335
MNIST	SCALE	B	0.6	512	9375~80 EPOCHS	0.2	3.42529
SVHN	SCALE	B	0.1	1024	3577~50 EPOCHS	1.6	2.45703
CIFAR10	SCALE	B	0.1	1024	2929~60 EPOCHS	1.8	3.17792
We present the individualized privacy parameters identified for our methods in Table 7.
Table 7: Individualization Parameters Computed by our Methods for Table 8. We report the individualized privacy parameters identified for our Scale and Sample by Algorithm 3 and Algorithm 2, respectively. The parameters are obtained on the MNIST, SVHN, and CIFAR10 datasets when using the privacy budget distributions of Table 8 with  $\varepsilon = \{1.0, 2.0, 3.0\}$
DATASET	DP-SGD	SCALE	SAMPLE
SETUP	σ	c	q	σscale	{σ1, ..., σP}	{c1, ..., cP}	σSAMPLE	{q1, ..., qP}
MNIST	34%-43%-23%	3.425	0.2	0.008	2.063	{2.189, 1.310, 1.032}	{0.129, 0.216, 0.274}	2.024	{0.005, 0.009, 0.013}
54%-37%-9%	3.425	0.2	0.008	2.418	{2.189, 1.310, 1.032}	{0.148, 0.248, 0.315}	2.376	{0.006, 0.011, 0.016}
SVHN	34%-43%-23%	2.747	0.9	0.014	1.896	{2.747, 1.589, 1.214}	{0.561, 0.970, 1.270}	1.667	{0.008, 0.015, 0.021}
54%-37%-9%	2.747	0.9	0.014	2.180	{2.747, 1.589, 1.214}	{0.651, 1.125, 1.472}	1.937	{0.009, 0.018, 0.025}
CIFAR10	34%-43%-23%	3.293	0.4	0.020	2.244	{3.294, 1.868, 1.399}	{0.244, 0.430, 0.574}	1.965	{0.012, 0.022, 0.031}
54%-37%-9%	3.293	0.4	0.020	2.594	{3.294, 1.868, 1.399}	{0.285, 0.502, 0.671}	2.300	{0.014, 0.026, 0.037}
Table 8: Model Test Accuracy after training with Standard DP-SGD vs our Individualized DP-SGD using Sample or Scale. D is the distribution of privacy groups (percentages) and  $\varepsilon$  the privacy budget for a given group. The percentages of the three privacy groups are chosen according to Alaggan et al. [2] (first setup) and [30] (second setup). We used the hyperparameters found for standard DP-SGD, see Table 5 and report the standard deviation over 10 trials.
DATASET	SETUP	DP-SGD	SAMPLE	SCALE
MNIST	D	34%-43%-23%	96.75	97.81	97.78
ε	1.0-2.0-3.0	±0.15	±0.09	±0.08
D	54%-37%-9%	96.75	97.6	97.54
ε	1.0-2.0-3.0	±0.15	±0.11	0.09
SVHN	D	34%-43%-23%	83.26	84.56	84.48
ε	1.0-2.0-3.0	±0.31	±0.25	±0.25
D	54%-37%-9%	83.26	84.32	84.31
ε	1.0-2.0-3.0	±0.31	±0.31	±0.26
CIFAR10	D	34%-43%-23%	52.77	54.89	54.92
ε	1.0-2.0-3.0	±0.65	±0.55	±0.63
D	54%-37%-9%	52.77	54.88	55.00
ε	1.0-2.0-3.0	±0.65	±0.45	±0.65
D.1 Privacy Consumption of our Methods
We track privacy consumption of our methods over the course of training in Figure 4. The figure highlights the good calibration of our methods which causes all privacy groups to exhaust their budget after the pre-specified number of training iterations.
(a) Sample
(b) Scale
Figure 4: Individual Privacy Costs on MNIST for  $\varepsilon \in \{1,2,3\}$  with Distribution  $(54\%, 37\%, 9\%)$ .
D.2 General Applicability of our Methods
We showcase the practical impact of individual privacy assignments on individual utility and demonstrate how our methods extend to many privacy groups and privacy budget distributions.
Table 9: 100 privacy groups on MNIST. We randomly assign MNIST training data points to one of the 100 privacy groups with respective  $\varepsilon_{p}$  sampled uniformly at random from [1, 6]. We compare against the DP-SGD baseline with  $\varepsilon = 1$  and observe that our methods converge well and outperform the baseline.
DP-SGD	Sample	Scale
Test Acc. (%)	96.75±0.15	98.17±0.18	98.21±0.1
Practical Impact. We run experiments on the CIFAR10 dataset where we assign higher or lower privacy budgets to one of the 10 classes. We select all data points from the class 0 (which we can think of, for example, as an underprivileged group) as one privacy group and assign to it either higher  $(\varepsilon = 3)$ , the same  $(\varepsilon = 2)$ , or lower  $(\varepsilon = 1)$  privacy budgets in comparison to all other data points from the other classes  $(\varepsilon = 2)$ . Table 10 shows that the choice of privacy budget for a single group also impacts the other groups. We observe that by only changing the privacy budget for the selected group (in this case for class 0), we can flip its performance (its accuracy from being higher to being lower) in comparison to the accuracy of the other group (consisting of remaining classes). In the example of class 0, the accuracy is  $67.76\%$  when assigned high privacy budget  $(\varepsilon = 3)$ , which is a higher accuracy than for all other classes that have an average accuracy of around  $53.41\%$  and assigned the privacy budget  $\varepsilon = 2$ . Then, by modifying only the privacy budget of class 0 and by assigning to it the low privacy budget  $(\varepsilon = 1)$ , its accuracy drops to a mere  $25.76\%$  and is below the accuracy of  $56.58\%$  for the remaining classes. We visualize the impact of the chosen privacy budget on utility over all classes (instead of only the class 0) in Figure 5 and Figure 6 for CIFAR10 and MNIST, respectively.