SlowGuess/NeurIPS_2023_OCR huggingface dataset:
[1] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In Proc. ACM CCS, pages 308-318, 2016.
[2] B. Balle and Y.-X. Wang. Improving the Gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In Proc. ICML, pages 394-403, 2018.
[3] G. Bernstein and D. Sheldon. Differentially private Bayesian inference for exponential families. In Proc. NeurIPS, pages 2924-2934, 2018.
[4] G. Bernstein and D. Sheldon. Differentially private Bayesian linear regression. In Proc. NeurIPS, pages 525-535, 2019.
[5] C. M. Bishop. Pattern Recognition and Machine Learning. Springer, 2006.
[6] Center for Open Data Enterprise. Sharing and utilizing health data for AI applications. Roundtable report, 2019.
[7] Y. Chen, Y. Shen, and S. Zheng. Truthful data acquisition via peer prediction. In Proc. NeurIPS, 2020.
[8] K. Choi, M. Liao, and S. Ermon. Featurized density ratio estimation. In Proc. UAI, pages 172-182, 2021.
[9] J. Conway. Artificial Intelligence and Machine Learning: Current Applications in Real Estate. PhD thesis, Massachusetts Institute of Technology, 2018.
[10] T. Cover and J. Thomas. Elements of Information Theory. John Wiley & Sons, Inc., 1991.
[11] C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Proc. TCC, pages 265-284, 2006.
[12] C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3-4):211-407, 2014.
[13] A. Fallah, A. Makhdoumi, A. Malekian, and A. Ozdaglar. Optimal and differentially private data acquisition: Central and local mechanisms. arXiv:2201.03968, 2022.
[14] T. Farrand, F. Mireshghallah, S. Singh, and A. Trask. Neither private nor fair: Impact of data imbalance on utility and fairness in differential privacy. In Proc. ACM CCS Workshop on Privacy-Preserving Machine Learning in Practice, pages 15-19, 2020.
[15] J. Foulds, J. Geumlek, M. Welling, and K. Chaudhuri. On the theory and practice of privacy-preserving Bayesian data analysis. In Proc. UAI, pages 192–201, 2016.
[16] J. Geumlek, S. Song, and K. Chaudhuri. Rényi differential privacy mechanisms for posterior sampling. In Proc. NIPS, pages 5289-5298, 2017.
[17] A. Ghorbani, M. P. Kim, and J. Zou. A distributional framework for data valuation. In Proc. ICML, pages 3535-3544, 2020.
[18] A. Ghorbani and J. Zou. Data Shapley: Equitable valuation of data for machine learning. In Proc. ICML, pages 2242-2251, 2019.
[19] M. D. Hoffman and A. Gelman. The No-U-Turn sampler: Adaptively setting path lengths in Hamiltonian Monte Carlo. JMLR, 15(1):1593-1623, 2014.
[20] R. Hu and Y. Gong. Trading data for learning: Incentive mechanism for on-device federated learning. In Proc. GLOBECOM, pages 1-6, 2020.
[21] J. Huggins, R. P. Adams, and T. Broderick. PASS-GLM: polynomial approximate sufficient statistics for scalable Bayesian GLM inference. In Proc. NIPS, pages 611--3621, 2017.
[22] N. Hynes, D. Dao, D. Yan, R. Cheng, and D. Song. A demonstration of Sterling: A privacy-preserving data marketplace. Proc. VLDB Endowment, 11(12):2086-2089, 2018.
[64] L. Zhang, T. Zhu, P. Xiong, W. Zhou, and P. S. Yu. More than privacy: Adopting differential privacy in game-theoretic mechanism design. ACM Comput. Surv., 54(7), 2022.
[65] B. Z. H. Zhao, M. A. Kaafar, and N. Kourtellis. Not one but many tradeoffs: Privacy vs. utility in differentially private machine learning. In Proc. ACM SIGSAC Conference on Cloud Computing Security Workshop, pages 15-26, 2020.
[66] P. Zhao and L. Lai. Minimax optimal estimation of KL divergence for continuous distributions. IEEE Transactions on Information Theory, 66(12):7787-7811, 2020.
A Fundamental Concepts
In this section, we will elaborate on concepts from Sec. 2 in more detail.
A.1 Sufficient Statistics
Bayesian learning involves updating our belief of the likely values of the model parameters  $\theta$ , captured in the prior  $p(\theta)$ , to a posterior belief  $p(\theta | \mathcal{D}_i) \propto p(\theta) \times p(\mathcal{D}_i | \theta)$ . The posterior belief gets more concentrated (around the maximum likelihood estimate) after observing a larger dataset  $\mathcal{D}_i$ .
The statistic  $s_i$  is a SS for  $\mathcal{D}_i$  if  $\theta$  and  $\mathcal{D}_i$  are conditionally independent given  $s_i$ , i.e.,  $p(\theta | \mathcal{D}_i) = p(\theta | s_i, \mathcal{D}_i) = p(\theta | s_i)$  [48, 52]. Knowing the dataset  $\mathcal{D}_i$  does not provide any extra information about  $\theta$  beyond the SS  $s_i$ . SS exists for exponential family models [5] and Bayesian linear regression [39]. Approximate SS has been proposed by [21] for generalized linear models. For more complex data such as images, we can use pre-trained neural networks like VGG-16 as feature extractors and generate SS from the last hidden layer's outputs.
Bayesian Linear Regression. In linear regression, each datum consists of the input  $\mathbf{x} \in \mathbb{R}^w$  and the output variable  $y \in \mathbb{R}$ . Let  $\mathcal{D}$  denote the dataset with  $c$  data points, and  $\mathbf{y}$  and  $\mathbf{X}$  be the corresponding concatenated output vector and design matrix in  $\mathbb{R}^{c \times w}$ . Bayesian linear regression models the relationship as  $\mathbf{y} = \mathbf{X}\mathbf{w} + \mathcal{N}(0,\sigma^2\mathbf{I})$  where the model parameters  $\theta$  consists of the weight parameters  $\mathbf{w} \in \mathbb{R}^w$  and the noise variance  $\sigma^2$ . The likelihood
$$
\begin{array}{l} p (\boldsymbol {y} | \boldsymbol {X}, \boldsymbol {w}, \sigma^ {2}) = (2 \pi \sigma^ {2}) ^ {- \frac {c}{2}} \exp \left(- \frac {(\boldsymbol {y} - \boldsymbol {X} \boldsymbol {w}) ^ {\top} (\boldsymbol {y} - \boldsymbol {X} \boldsymbol {w})}{2 \sigma^ {2}}\right) \\ = (2 \pi \sigma^ {2}) ^ {- \frac {c}{2}} \exp \left[ \frac {- 1}{2 \sigma^ {2}} \boldsymbol {y} ^ {\top} \boldsymbol {y} + \frac {1}{\sigma^ {2}} \boldsymbol {w} ^ {\top} \boldsymbol {X} ^ {\top} \boldsymbol {y} - \frac {1}{2 \sigma^ {2}} \boldsymbol {w} ^ {\top} \boldsymbol {X} ^ {\top} \boldsymbol {X} \boldsymbol {w} \right]. \\ \end{array}
$$
only depends on data via the sufficient statistics  $\boldsymbol{s} = (\boldsymbol{y}^{\top}\boldsymbol{y},\boldsymbol{X}^{\top}\boldsymbol{y},\boldsymbol{X}^{\top}\boldsymbol{X})$ . Concretely, when the prior  $p(\theta)$  of the weights and variance follow a normal inverse-gamma distribution,  $\mathrm{NIG}(\mathbf{0},\mathbf{V}_0,a_0,b_0)$ , the posterior  $p(\theta|\mathcal{D}_i)$  is the normal inverse-gamma distribution  $\mathrm{NIG}(\mathbf{w}_i,\mathbf{V}_i,a_0 + c_i / 2,b_i)$  where  $c_i$  is the number of data points and
$$
\boldsymbol {w} _ {i} = \boldsymbol {V} _ {i} \boldsymbol {X} _ {i} ^ {\top} \boldsymbol {y} _ {i} \quad \boldsymbol {V} _ {i} = \left(\boldsymbol {V} _ {0} ^ {- 1} + \boldsymbol {X} _ {i} ^ {\top} \boldsymbol {X} _ {i}\right) ^ {- 1} \quad b _ {i} = b _ {0} + (1 / 2) \left[ \boldsymbol {y} _ {i} ^ {\top} \boldsymbol {y} _ {i} - \boldsymbol {w} _ {i} ^ {\top} \boldsymbol {V} _ {i} ^ {- 1} \boldsymbol {w} _ {i} \right]
$$
can be computed directly from  $s_i$ . The posterior belief  $p(\theta | \mathcal{D}_i, \mathcal{D}_j)$  given parties  $i$  and  $j$ 's dataset can be similarly computed using the SS of their pooled dataset,  $s_{ij}$ . As the SS  $s_{ij}$  works out to  $s_i + s_j$ , we only need  $s_i$  and  $s_j$  from party  $i$  and  $j$  instead of their private datasets.
Generalized Linear Model (GLM). A generalized linear model (GLM) generalizes a linear model by introducing an inverse link function  $\Upsilon$ . The probability of observing the output  $y$  given input  $\boldsymbol{x} = (x_{(1)}, \ldots, x_{(w)})$  and model weights  $\theta$  depends on their dot product
$$
p (y | \boldsymbol {x}, \theta) = p (y | \Upsilon (\boldsymbol {x} ^ {\top} \theta)).
$$
Next, we define the GLM mapping function  $v$  to the log-likelihood of observing  $y$  given the GLM model. Formally,
$$
v (y, \boldsymbol {x} ^ {\top} \theta) \triangleq \log p (y | \Upsilon (\boldsymbol {x} ^ {\top} \theta)).
$$
As an example, logistic regression is a GLM with  $\Upsilon$  defined as the sigmoid function and  $p(y = \pm 1|\mathrm{sigmoid}(\boldsymbol{x}^\top \theta))$  follows a Bernoulli distribution. As the non-linearity of  $\Upsilon$  disrupts the exponential family structure, logistic regression and other GLMs do not have sufficient statistics. Logistic regression's GLM mapping function  $v_{\log}(y,\boldsymbol{x}^\top \theta) = -\log (1 + \exp (-y\boldsymbol{x}^\top \theta))$ .
[21] propose to approximate the GLM mapping function  $\upsilon$  with an  $M$ -degree polynomial approximation  $\upsilon_{M}$ .  $\upsilon_{M}$  is an exponential family model with sufficient statistics  $g(d) = \left\{\prod_{i=1}^{w}(yx_{(i)})^{m_i} \mid \sum_{i} m_i \leq M, \forall i, m_i \in \mathbb{Z}_0^+\right\}$ . These SS are the polynomial approximate sufficient statistics for GLMs. For example, when  $M = 2$  and  $x = (x_{(1)}, x_{(2)})$ ,  $g(d) = \left[1, x_{(1)}y, x_{(2)}y, x_{(1)}^2y^2, x_{(2)}^2y^2, x_{(1)}x_{(2)}y^2\right]$ .
A.2 Differential Privacy
Remark 1. Our work aims to ensure example-level  $DP$  for each collaborating party: A party updating/adding/deleting a single datum will only change the perturbed SS visible to the mediator and the corresponding belief of the model parameters in a provably minimal way. We are not ensuring user-level  $DP$ : The belief of model parameters only changes minimally after removing a collaborating party's (or a user/data owner's) dataset, possibly with multiple data points [35].
Intuitively, a DP algorithm  $\mathcal{R}:\mathcal{D}\to \mathbf{o}$  guarantees that each output  $\pmb{o}$  is almost equally likely regardless of the inclusion or exclusion of a data point  $d$  in  $\mathcal{D}$ . This will allay privacy concerns and incentivize a data owner to contribute its data point  $d$  since even a knowledgeable attacker cannot infer the presence or absence of  $d$ .
The works on noise-aware inference [4, 27] assume that the input  $x$  and output  $y$  of any data point have known bounded ranges. We will start by introducing our domain-dependent definitions:
Definition A.1 (Neighboring datasets). Two datasets  $\mathcal{D}$  and  $\mathcal{D}'$  are neighboring if  $\mathcal{D}'$  can be obtained from  $\mathcal{D}$  by replacing a single data point. The total number of data points and all other data points are the same.
Definition A.2 (Sensitivity [11]). The sensitivity of a function  $g$  that takes in dataset  $\mathcal{D}_k$  quantifies the maximum impact a data point can have on the function output. The  $\ell_1$ -sensitivity  $\Delta_1(g)$  and  $\ell_2$ -sensitivity  $\Delta_2(g)$  measure the impact using the  $\ell_1$  and  $\ell_2$  norm, respectively. Given that  $\mathcal{D}_i'$  must be a neighboring dataset of  $\mathcal{D}_i$ ,
$$
\Delta_ {1} (g) \triangleq \max  _ {\mathcal {D} _ {i}, \mathcal {D} _ {i} ^ {\prime}} \| g (\mathcal {D} _ {i}) - g (\mathcal {D} _ {i} ^ {\prime}) \| _ {1}  ,
$$
$$
\Delta_{2}(g)\triangleq \max_{\mathcal{D}_{i};\mathcal{D}_{i}^{\prime}}\| g(\mathcal{D}_{i}) - g(\mathcal{D}_{i}^{\prime})\|_{2}  .
$$
In our problem,  $g$  computes the exact SS  $s_i$  for  $\mathcal{D}_i$ . The sensitivity can be known/computed if the dataset is normalized and the feature ranges are bounded.
We start with the definition of  $\epsilon$ -differential privacy. The parameter  $\epsilon$  bounds how much privacy is lost by releasing the algorithm's output.
Definition A.3 (Pure  $\epsilon$ -DP [11]). A randomized algorithm  $\mathcal{R}: \mathcal{D} \to \mathbf{o}$  with range  $\mathcal{O}$  is  $\epsilon$ -DP if for all neighboring datasets  $\mathcal{D}$  and  $\mathcal{D}'$  and possible output subset  $\mathcal{O} \subset \text{Range}(\mathcal{R})$ ,
The Laplace mechanism [11] is an  $\epsilon$ -DP algorithm. Instead of releasing the exact SS  $s_i$ , the mechanism will output a sample of the perturbed SS  $o_i \sim \mathrm{Laplace}(s_i, (\Delta_1(g) / \epsilon)I)$ .
A common relaxation of  $\epsilon$ -differential privacy is  $(\epsilon, \delta)$ -differential privacy. It can be interpreted as  $\epsilon$ -DP but with a failure of probability at most  $\delta$ .
Definition A.4  $((\epsilon, \delta)$ -DP). A randomized algorithm  $\mathcal{R}: \mathcal{D} \to \mathbf{o}$  with range  $\mathcal{O}$  is  $(\epsilon, \delta)$ -differentially private if for all neighboring datasets  $\mathcal{D}$  and  $\mathcal{D}'$  and possible output subset  $\mathcal{O} \subset \text{Range}(\mathcal{R})$ ,
$$
P (\mathcal {R} (\mathcal {D}) \in \mathcal {O}) \leq e ^ {\epsilon} P (\mathcal {R} (\mathcal {D} ^ {\prime}) \in \mathcal {O}) + \delta .
$$
The Gaussian mechanism is an  $(\epsilon, \delta)$ -DP algorithm. The variance of the Gaussian noise to be added can be computed by the analytic Gaussian mechanism algorithm [2].
In the main paper, we have also discussed another relaxation of  $\epsilon$ -differential privacy that is reproduced below:
Definition A.5 (Rényi DP [38]). A randomized algorithm  $\mathcal{R}:\mathcal{D}\to \pmb{o}$  is  $(\lambda ,\epsilon)$ -Rényi differentially private if for all neighboring datasets  $\mathcal{D}$  and  $\mathcal{D}'$ , the Rényi divergence of order  $\lambda >1$  is  $D_{\lambda}(\mathcal{R}(\mathcal{D})||\mathcal{R}(\mathcal{D}')|\leq \epsilon$  where
$$
D _ {\lambda} (\mathcal {R} (\mathcal {D}) \mid | \mathcal {R} (\mathcal {D} ^ {\prime})) \triangleq \frac {\log \mathbb {E} _ {\boldsymbol {o} \sim \mathcal {R} (\mathcal {D} ^ {\prime})} \left[ \frac {P (\mathcal {R} (\mathcal {D}) = \boldsymbol {o})}{P (\mathcal {R} (\mathcal {D} ^ {\prime}) = \boldsymbol {o})} \right] ^ {\lambda}}{\lambda - 1}.
$$
When  $\lambda = \infty$ , Rényi DP becomes pure  $\epsilon$ -DP. Decreasing  $\lambda$  emphasizes less on unlikely large values and emphasizes more on the average value of the privacy loss random variable  $\log [P(\mathcal{R}(\mathcal{D}) = o) / P(\mathcal{R}(\mathcal{D}') = o)]$  with  $o \sim \mathcal{R}(\mathcal{D}')$ .
The Gaussian mechanism is a  $(\lambda, \epsilon)$ -Rényi DP algorithm. Instead of releasing the exact SS  $s_i$ , the mechanism will output a sample of the perturbed SS  $o_i \sim \mathcal{N}(s_i, 0.5(\lambda/\epsilon) \Delta_2^2(g) I)$ .
Post-processing. A common and important property of all DP algorithms/mechanisms is their robustness to post-processing: Processing the output of a DP algorithm  $\mathcal{R}$  without access to the underlying dataset will retain the same privacy loss and guarantees [12].
Choosing Rényi-DP over  $(\epsilon, \delta)$ -DP. In our work, we consistently use the Gaussian mechanism in all the experiments, like in that of [27]. We choose Rényi DP over  $(\epsilon, \delta)$ -DP due to the advantages stated below:
- Rényi-DP is a stronger DP notion according to [38]: While  $(\epsilon, \delta)$ -DP allows for a complete failure of privacy guarantee with probability of at most  $\delta$ , Rényi-DP does not and the privacy bound is only loosened more for less likely outcomes. Additionally, [38] claims that it is harder to analyze and optimize  $(\epsilon, \delta)$ -DP due to the trade-off between  $\epsilon$  and  $\delta$ . More details can be found in [38].
- Rényi-DP supports easier composition: In a collaborative ML framework, each party  $i$  may need to release multiple outputs on the same dataset  $\mathcal{D}_i$  such as the SS and other information for preprocessing steps (e.g., principal component analysis). Composition rules bound the total privacy cost  $\hat{\epsilon}$  of releasing multiple outputs of differentially private mechanisms. It is harder to keep track of the total privacy cost when using  $(\epsilon, \delta)$ -DP due to advanced composition rules and the need to choose from a wide selection of possible  $(\epsilon(\delta), \delta)$  [38]. In contrast, the composition rule (i.e., Proposition 1 in [38]) is straightforward: When  $\lambda$  is a constant, the  $\epsilon$  of different mechanisms can simply be summed.
Note that the contribution of our work will still hold for  $(\epsilon, \delta)$ -DP (using the Gaussian mechanism) and  $\epsilon$ -DP (using the Laplace mechanism) with some modifications of the inference process and proofs.
Remark 2. Our work is in the same spirit as local DP (and we also think that no mediator can be trusted to directly access any party's private dataset) but does not strictly satisfy the definition of local DP (see Def. A.6). In the definition, the local DP algorithm takes in a single input/datum and ensures the privacy of its output — the perturbation mechanism is applied to every input independently. In contrast, in our case, a party may have multiple inputs and the perturbation mechanism is only applied to their aggregate statistics. Thus, a datum owner (e.g., a patient of a collaborating hospital) enjoys weaker privacy in our setting than the local DP setting.
Definition A.6 ( $\epsilon$ -Local DP [61]). A randomized algorithm  $\mathcal{R}$  is  $\epsilon$ -local DP if for any pair of data points  $d, d' \in \mathcal{D}$  and for any possible output  $\mathcal{O} \subset \text{Range}(\mathcal{R})$ ,
$$
P (\mathcal {R} (d) \in \mathcal {O}) \leq e ^ {\epsilon} P (\mathcal {R} (d ^ {\prime}) \in \mathcal {O}).
$$
A.3 DP Noise-Aware Inference
DP mechanisms introduce randomness and noise to protect the output of a function. Noise-naive techniques ignore the added noise in downstream analysis. In contrast, noise-aware techniques account for the noise added by the DP mechanism.
Consider a probabilistic model where the model parameters  $\theta$  generate the dataset  $\mathcal{D}_i$  which then generates the exact and perturbed sufficient statistics of each party  $i$ , which are modeled as random variables  $S_i$  and  $O_i$ , respectively. The exact SS  $s_i$  and perturbed SS  $o_i$  computed by party  $i$  are realizations of  $S_i$  and  $O_i$ , respectively. As the mediator cannot observe  $i$ 's exact SS,  $S_i$  is a latent random variable. Instead, the mediator observes  $i$ 's perturbed SS  $O_i$  which also contains noise  $Z_i$  added by the DP mechanism, i.e.,  $O_i \triangleq S_i + Z_i$ . The Gaussian mechanism to ensure  $(\lambda, \epsilon)$ -Renyi DP sets  $Z_i \sim \mathcal{N}\left(0, 0.5(\lambda/\epsilon) \Delta_2^2(g)I\right)$ . We depict the graphical model of our multi-party setting in Fig. 4.
Differences between exact, noise-naive and noise-aware inference. When the mediator observes the exact SS  $s_i$  from party  $i$ , the exact posterior belief  $p(\theta | S_i = s_i)$  can be computed in closed form based on App. A.1. However, when the mediator only observes the perturbed SS  $o_i$ , the mediator can
Figure 4: In the graphical model above, all parties share the same prior belief  $p(\theta)$  of model parameters  $\theta$  and prior belief  $p(\omega)$  of data parameters  $\omega$ . The mediator models its beliefs of the SS of each party separately and only observes the perturbed SS  $o_i$  of every party  $i \in N$  (thus, only  $O_i$  is shaded). The sufficient statistic  $S_i$  is generated from the model inputs  $X_i$  and the model output  $y_i$  (which depends on the model parameters  $\theta$ ). We illustrate the relationship between  $\omega$ ,  $X_i$ , and  $S_i$  as dashed lines as they may be modeled differently in the various DP noise-aware inference methods. See [4, 27] for their respective graphical models and details.
only compute the noise-naive and noise-aware posterior beliefs instead. The noise-naive posterior belief  $p(\theta | S_i = o_i)$  will neither reflect the unobservability of the exact SS random variable  $S_i$  accurately nor quantify the impact of the DP noise  $Z_i$ . In contrast, for any party, the DP noise-aware posterior belief  $p(\theta | O_i = o_i)$ , conveniently abbreviated as  $p(\theta | o_i)$ , will quantify the impact of the noise added by the DP mechanism. (For a coalition  $C$  of parties, the DP noise-aware posterior belief is  $p(\theta | o_C) \triangleq p(\theta | \{O_i = o_i\}_{i \in C})$ ), as described in Footnote 6.) The works of [3, 4, 27] have shown that DP noise-aware inference leads to a posterior belief that is better calibrated (i.e., lower bias and better quantification of uncertainty without overconfidence) and of higher utility (i.e., closer to the non-private posterior belief), thus a better predictive performance.
The main challenge of noise-aware inference lies in tractably approximating the integral  $p(O_i = \pmb{o}_i|\theta) = \int p(\pmb{s}_i|\theta)p(\pmb{o}_i|\pmb{s}_i)\mathrm{d}\pmb{s}_i$  and  $p(\pmb{s}_i|\theta) = \int_{\{\mathcal{D} = (\pmb{X},\pmb{y}):g(\mathcal{D}) = \pmb{s}_i\}}p(\pmb{X},\pmb{y}|\theta)\mathrm{d}\pmb{X}d\pmb{y}$  over all datasets. [3, 4, 27] exploit the observation that as the SS sum  $c$  individuals, the central limit theorem guarantees that the distribution  $p(\pmb{s}_i|\theta)$  can be well-approximated by the Gaussian distribution  $\mathcal{N}(c\mu_g,c\Sigma_g)$  for large  $c$  [4]. Here,  $\mu_g$  and  $\Sigma_g$  are the mean and covariance of an individual's SS. [3, 4, 27, 26] prescribe how to compute  $\mu_g$  and  $\Sigma_g$  in closed form from the sampled  $\theta$  parameters and moments of  $x$  and set the noise of the DP mechanism based on a sensitivity analysis. To approximate the posterior  $p(\theta |o)$ , Markov Chain Monte Carlo (MCMC) sampling steps are needed. [4] propose to use Gibbs sampling, an algorithm that updates a group of parameters at a time and exploits conditional independence, for Bayesian linear regression models. [27] use the No-U-Turn [19] sampler and utilizes Hamiltonian dynamics to explore the parameter space more efficiently for generalized linear models. We describe the BLR Gibbs sampler adapted for our multi-party setting in Algo 1.
Algorithm 1 BLR Gibbs sampler [4] from noise-aware posterior  $p(\theta |O_N = \pmb {o}_N) \propto \int \prod_{i\in N} [p(\pmb {o}_i|\pmb {s}_i)p(\pmb {s}_i|\theta)]p(\theta)\mathrm{d}\pmb {s}_1\dots \mathrm{d}\pmb {s}_n$ . The algorithm (repeatedly) sample the latent variables  $S_{i}$ ,  $\omega$  and  $\theta$  sequentially.
Require: Shared prior  $p(\theta)$  of model parameters, prior  $p(\omega)$  of data parameters, data quantity  $c_{i}$ , shared perturbed SS realization  $o_{i}$ , the Gaussian noise distribution of  $Z_{i}$  for every party  $i \in N$ , number  $b$  of burn-in samples, number  $m$  of samples, Boolean parameter (shared) controlling if  $p(x)$  is the same across parties.
1: Sample the initial model parameters  $\theta^{(0)}$  from the prior  $p(\theta)$ .
2: Sample the data prior parameters  $\omega^{(0)}$  from the prior  $p(\omega)$ .
3: Compute the moments of  $X_{i}$  based on  $\omega$ .
4: for  $t = 1, \dots, b + m$  do
5: for  $i = 1,\dots ,n$  do
6: Compute the normal approximation of  $p(S_i|\theta)$ , denoted as  $p_{\mathcal{N}}(S_i|\theta)$ , using the moments of  $X_i$ .
7: Sample  $\boldsymbol{s}_i^{(t)}$  from the product of two multivariate Gaussians  $p_{\mathcal{N}}(S_i|\theta)$ $p(\boldsymbol{o}_i|S_i)$ , which is also multivariate Gaussian.
8: if not shared then
9: Use information from  $\pmb{s}_i^{(t)}$  and  $c_{i}$  to perform conjugate update on  $p(\omega_i)$  to obtain  $p(\omega_i | (\pmb{s}_i^{(t)}, c_i))$ . Sample  $\omega_i^{(t)}$  and compute the moments of  $X_{i}$ .
0: end if
1: end for
2: if shared then
3: Use information from  $(\pmb{s}_i^{(t)},c_i)_{i\in N}$  to perform conjugate update on  $p(\omega)$  to obtain  $p(\omega |(\pmb{s}_i^{(t)},c_i)_{i\in N})$ . Sample  $\omega^{(t)}$  and compute the moments of  $X_{i}$ .
4: end if
5: Use  $(s_i^{(t)},c_i)_{i\in N}$  to perform conjugate update on  $p(\theta)$  to obtain  $p(\theta |(s_i^{(t)},c_i)_{i\in N})$
6: Sample  $\theta^{(t)}$  from  $p(\theta |(\pmb{s}_i^{(t)},c_i)_{i\in N})$
7: if  $t > b$  then
8: Append  $\theta^{(t)}$  to  $\Theta$ .
9: end if
10: end for
21: return  $\Theta$
B Key Differences with Existing Data Valuation, Collaborative ML, and DP/FL Works
Incentives for Data Sharing Higher reward for contributing more valuable data (fairness across parties, individual rationality, etc.)