SlowGuess/NeurIPS_2023_OCR huggingface dataset:
More importantly, the extent to which party  $i$  can benefit from its contribution depends on the quantity/quality of its data relative to that of the grand coalition  $N$  (and the suitability of the model or informativeness of the prior).
Party  $i$ 's DP guarantee  $\epsilon_{i}$  is varied in Sec. 6 while the DP guarantee  $\epsilon_{k}$  of the other party  $k$  and its number  $c_{k}$  of data points for  $k \in N$  are varied in App. H.5. The privacy order  $\lambda$  is varied in App. H.5. Across all experiments, we observe that the privacy-valuation trade-off holds. Moreover, when (i) a party  $i$  has lower-quality data in the form of fewer data points or smaller  $\epsilon_{i}$ , or (ii) another party  $k$  has higher-quality data such as a larger  $\epsilon_{k}$ , the improvement in the utility of its model reward over that of its individually trained model is larger.
Question 8: Can privacy be guaranteed by using secure multi-party computation and homomorphic encryption in model training/data valuation?
Answer: These techniques are designed to prevent direct information leakage and prevent the computer from learning anything about the data. However, as the output of the computation is correct, any mediator and collaborating party with access to the final model can query the model for predictions and infer private information/membership of a datum (indirect privacy leakage). In our work here, every party can access a model reward. Hence, the setup should prevent each party from inferring information about a particular instance in the data beyond what can be learned from the underlying data distribution through strong DP guarantees.
Question 9: In Sec. 4, we mention that (i) it is possible to have negative marginal contributions (i.e.,  $v_{C \cup i} < v_C$ ) in rare cases and (ii) adding some noise realizations may counter-intuitively create a more valuable model reward (e.g.,  $r_i > v_N$ ). Why and what are the implications?
Answer: For our choice of valuation function via Bayesian surprise, the party monotonicity (V2) and privacy-valuation trade-off (V3) properties involve taking expectations, i.e., on average/in most cases, adding a party will not decrease the valuation (i.e., the marginal contribution is non-negative), and strengthening DP by adding more noise should decrease the reward value. However, in rare cases, (i) and (ii) can occur. We have never observed (i) in our experiments, but a related example of (ii) is given in Fig. 14a: A larger  $\tau_{i}$  surprisingly increased the valuation.
The implication of (i) is that the Shapley value  $\phi_{i}$  may be negative, which results in an unusable negative/undefined  $r_i^*$ . However, this issue can be averted while preserving P3 by upweighting non-negative MCs, such as to the empty set, as mentioned in Footnote 10. The implication of (ii) is that some (large) noise realization can result in a more valuable model reward than the grand coalition's model, i.e.,  $r_i > v_N$ . However, collaborating parties still prefer  $p(\theta | o_N)$  valued at  $v_N$  as the more surprising model reward is not due to observations and information. This motivates us to define more specific desiderata (P1 and P2) for our reward scheme.
Lastly, one may question if we should change the valuation function. Should we use the information gain  $\mathbb{I}(\theta; o_C) = \mathbb{E}_{o_C}[v_C]$  on model parameters  $\theta$  given perturbed SS  $o_C$  instead to eliminate (i) and (ii)? No, the information gain is undesirable as it disregards the observed perturbed SS  $o_C$  and will not capture a party's preference for higher similarity of its model reward to the grand coalition  $N$ 's posterior  $p(\theta | o_N)$ .