SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Hao Wang, Shivchander Sudalairaj, John Henning, Kristjan Greenewald, Akash Srivastava* MIT-IBM Watson AI Lab
Existing private synthetic data generation algorithms are agnostic to downstream tasks. However, end users may have specific requirements that the synthetic data must satisfy. Failure to meet these requirements could significantly reduce the utility of the data for downstream use. We introduce a post-processing technique that improves the utility of the synthetic data with respect to measures selected by the end user, while preserving strong privacy guarantees and dataset quality. Our technique involves resampling from the synthetic data to filter out samples that do not meet the selected utility measures, using an efficient stochastic first-order algorithm to find optimal resampling weights. Through comprehensive numerical experiments, we demonstrate that our approach consistently improves the utility of synthetic data across multiple benchmark datasets and state-of-the-art synthetic data generation algorithms.
The advancement of machine learning (ML) techniques relies on large amounts of training data. However, data collection also poses a significant risk of exposing private information. In recent years, several instances of privacy breaches have surfaced [NS06, Con18], making it urgent to find a reliable way to share data. Today, the de facto standard for privacy protection is differential privacy (DP) [DR14]. DP ensures that useful information of a private dataset can be released while simultaneously preventing adversaries from identifying individuals' personal data. DP has been utilized effectively in a wide variety of settings, by actors including the US Census [Abo18] and various large corporations [App17, Fac20, RE19, HBMAL19, IBM23].
Generating private synthetic data is a crucial application of DP. It allows data scientists to train their ML models on the synthetic data while preserving a certain level of utility when deploying these models on real test data. The U.S. National Institute of Standards and Technology (NIST) has emphasized its significance by hosting a series of competitions [RTMT21, MMS21]. There is also significant work introducing new DP synthetic data generation mechanisms, including GAN-based  $\left[\mathrm{XLW}^{+}18\right.$ ,  $\left.\mathrm{BJWW}^{+}19\right.$ ,  $\left.\mathrm{JYVDS}19\right.$ ,  $\left.\mathrm{TWB}^{+}19\right]$ , marginal-based  $\left[\mathrm{ZCP}^{+}17\right.$ ,  $\left.\mathrm{MSM}19\right.$ ,  $\left.\mathrm{MMS}21\right]$ , and workload-based  $\left[\mathrm{VTB}^{+}20\right.$ ,  $\left.\mathrm{ABK}^{+}21\right.$ ,  $\left.\mathrm{LVW}21\right.$ ,  $\left.\mathrm{MMSM}22\right.$ ,  $\left.\mathrm{VAA}^{+}22\right]$  methods. Existing methods for generating private synthetic data are task-agnostic—they do not take into account the downstream use cases of the synthetic data in the data generation process. However, end users often have specific requirements for synthetic datasets to be successfully analyzed by their existing data science pipelines, which are often well-established, well-understood, heavily vetted, and difficult or expensive to change. Unfortunately, synthetic data generated by existing methods may not always meet these requirements, resulting in reduced utility for their downstream use cases. This raises a fundamental question:
* email: {hao, shiv.sr, john.l.henning, kristjan.h.greenewald, akash.srivastava} @ibm.com
Is it possible to improve a synthetic dataset's utility on a set of selected measures while preserving its differential privacy guarantees?
In this paper, we introduce a post-processing procedure that enhances the quality of the synthetic data on a set of utility measures. These measures are usually based on the end user's requirements for the synthetic data. Our method solves an optimization problem to calculate the optimal resampling weights for each data point. We then use these weights to resample the synthetic dataset, eliminating data points that do not accurately reflect the real data based on the selected utility measures. This post-processing procedure has many remarkable properties. Firstly, it is model-agnostic, meaning that it does not depend on any assumptions about how the synthetic data were generated. The synthetic data could be generated using either GAN-based, marginal-based, or workload-based methods. Second, the post-processed data preserve the DP guarantees while maintaining the performance of downstream models on real data compared to models trained on the original synthetic data. Finally, our algorithm is highly scalable, especially for high-dimensional data. It only requires a convex optimization whose number of variables is equal to the number of desired utility measures. We develop a stochastic first-order method that can efficiently solve this optimization problem. As a reference, we apply our algorithm to the home-credit dataset [MOK18] which consists of 307,511 data points and 104 features, and it only takes around 4 mins to finish running.
We conduct comprehensive numerical experiments to demonstrate the effectiveness of our post-processing techniques. Our results show that this algorithm consistently improves the utility of the synthetic data on different selected measures, across multiple datasets, and for synthetic data generated using various state-of-the-art privacy mechanisms. Additionally, the downstream models trained on the post-processed data can achieve comparable (or even better) performance on real data compared to the models trained on the original synthetic data. We demonstrate an application of our technique by using it to align the correlation matrix of the synthetic data with that of the real data. The correlation matrix shows the correlation coefficients between pairs of features and is often used as a reference for feature selection. By applying our post-processing technique, we can ensure that the correlation matrix of the synthetic data closely matches that of the real data. This, for instance, can help downstream data scientists more accurately select a task-appropriate set of features for fitting their ML models, e.g. by thresholding the correlation with the desired target variable or using Lasso techniques.
Our proof techniques rely on an information-theoretic formulation known as information projection, which dates back to Csiszár's seminal work [Csi75]. This formulation has recently been successfully applied in several domains, such as large deviation theory [DZ96], hypothesis testing [Csi84], and fair machine learning  $\mathrm{[AHJ^{+}22]}$ . Here we use information projection to "project" the empirical distribution of the synthetic data onto a set of distributions whose utility measures match those of the real data. We show that the optimal projected distribution can be expressed as an exponential tilting of the original distribution and determine the tilting parameters via a convex program in the dual space. To solve this optimization problem, we introduce a compositional proximal gradient algorithm, which is a stochastic first-order method and highly scalable for large dataset. Notably, this exponential tilting takes the form of a simple reweighting of the data points in the original synthetic dataset. Hence, our approach has the added benefit that it only reweights synthetic data points without changing their values, ensuring that the quality of the data points is not compromised and the support set of the overall dataset is not expanded.
- We present a post-processing technique that enables end users to customize synthetic data according to their specific requirements.
- Our technique is model-agnostic—it is applicable regardless of the methods used to generate private synthetic data. It is scalable to high-dimensional data and maintains strong privacy guarantees.
- We conduct comprehensive numerical experiments, showing that our technique can consistently improve the utility of synthetic data across multiple benchmark datasets and for synthetic data generated using state-of-the-art DP mechanisms.
The supplementary material of this paper includes: (i) omitted proofs of all theoretical results, (ii) details on algorithm implementation, and (iii) supporting experimental results.
DP synthetic data generation mechanisms. Generating synthetic data using DP mechanisms is an active area of research [see e.g., HLM12, BLR13,  $\mathrm{GAH}^{+}14$ , CXZX15, BSG17,  $\mathrm{AZK}^{+}19$ , UV20, GMHI20,  $\mathrm{TMH}^{+}21$ ,  $\mathrm{VAA}^{+}22$ , BSV22]. Along this line of work, the closest ones to ours are workload-aware methods  $\left[\mathrm{VTB}^{+}20, \mathrm{ABK}^{+}21, \mathrm{MMSM}22, \mathrm{LVW}21\right]$ , which aim to ensure that the synthetic data perform well on a collection of queries. Our work differs in three key features. First, all existing approaches focus on generating private synthetic data from scratch, while we aim to post-process synthetic data to downweight samples that do not accurately represent the real data under the specified utility measures. As a result, our approach is more efficient as it does not need to fit a graphical model [MMSM22] or a neural network [LVW21] to represent the data distribution, and it is more extendable, allowing a single synthetic dataset to be quickly post-processed multiple times for different sets of utility measures as needed by downstream users. Second, some existing work may not scale well to large datasets as they either require solving an integer program multiple times  $\left[\mathrm{VTB}^{+}20\right]$  or need to solve a large-scale optimization problem  $\left[\mathrm{ABK}^{+}21\right]$ . In contrast, our approach is highly scalable, as it only requires solving a convex program whose number of variables is equal to the number of specified utility measures. Third, existing work often evaluates the quality of the synthetic data by how well it preserves key statistics (e.g., 3-way margins) of the real data. In contrast, in our experiments, we evaluate our approach on the more stringent and realistic test of training various downstream ML models on the synthetic data and measuring their performance on real test data. The experimental results demonstrate that our approach can enhance the utility of synthetic data on selected measures without compromising their downstream quality.
Public data assisted methods/Post-processing methods. Our work introduces a post-processing procedure for improving the utility of a given synthetic dataset based on selected measures. As a special case, our approach can be applied to post-process publicly available datasets. In this regard, this work is related to public-data-assisted methods [see e.g.,  $\mathrm{LVS}^{+}21$ , LVW21], which leverage public data for saving privacy budgets. We extend Algorithm 1 in  $[\mathrm{LVS}^{+}21]$  by formalizing the preservation of (noisy) utility measures as a constrained optimization problem, rather than minimizing the corresponding Lagrangian function. We further establish strong duality and propose a stochastic first-order method for solving this constrained optimization efficiently. We extend Algorithm 4 in [LVW21] by allowing any non-negative violation tolerance (i.e., any  $\gamma \geq 0$  in (3b)) compared with  $\gamma = 0$  in [LVW21]. This extension offers increased flexibility, as users can now select various values of  $\gamma$  to navigate the trade-off between minimizing the distortion of the synthetic data and enhancing their utility on selected measures. Moreover, our experiments show that setting  $\gamma$  to be a small positive number (e.g.,  $\gamma = 1e - 5$ ) consistently outperforms when  $\gamma = 0$ . Finally, our work is related with [NWD20], which proposes to post-process outputs from differentially private GAN-based models for improving the quality of the generated synthetic data. However, their method is tailored to GAN-based privacy mechanisms while our approach is model-agnostic. This versatility is crucial, given that marginal-based and workload-based mechanisms often yield higher quality synthetic tabular data, as evidenced by benchmark experiments in  $[\mathrm{TMH}^{+}21]$ . Our experiments indicate that our method consistently improves the utility of synthetic data produced by all kinds of privacy mechanisms, even when the initial synthetic data are of high quality.
In this section, we review differential privacy and provide an overview of our problem setup.
We first recall the definition of differential privacy (DP) [DR14].
Definition 1. A randomized mechanism  $\mathcal{M}:\mathcal{X}^n\to \mathcal{R}$  satisfies  $(\epsilon ,\delta)$ -differential privacy, if for any adjacent datasets  $\mathcal{D}$  and  $\mathcal{D}'$  which only differ in one individual's record, and all possible outputs from the mechanism  $\mathcal{O}\subseteq \mathcal{R}$ , we have
$$
\Pr (\mathcal {M} (\mathcal {D}) \in \mathcal {O}) \leq e ^ {\epsilon} \Pr (\mathcal {M} (\mathcal {D} ^ {\prime}) \in \mathcal {O}) + \delta . \tag {1}
$$
DP has two important properties: post-processing immunity and composition rule. Specifically, if  $\mathcal{M}:\mathcal{X}^n\to \mathcal{R}$  satisfies  $(\epsilon ,\delta)$ -DP and  $g:\mathcal{R}\rightarrow \mathcal{R}'$  is any randomized (or deterministic) function, then
$g\circ \mathcal{M}:\mathcal{X}^n\to \mathcal{R}'$  is  $(\epsilon ,\delta)$  -DP; if  $\mathcal{M} = (\mathcal{M}_1,\dots ,\mathcal{M}_k)$  is a sequence of randomized mechanisms, where  $\mathcal{M}_i$  is  $(\epsilon_i,\delta_i)$  -DP, then  $\mathcal{M}$  is  $(\sum_{i = 1}^{k}\epsilon_{i},\sum_{i = 1}^{k}\delta_{i})$  -DP. There are also advanced composition theorems [see e.g., DRV10, KOV15].
The Laplace and Gaussian mechanisms are two fundamental DP mechanisms. For a function  $f: \mathcal{X}^n \to \mathbb{R}^K$ , we define its  $L_p$  sensitivity for  $p \in \{1, 2\}$  as
$$
\Delta_ {p} (f) \triangleq \sup  _ {\mathcal {D} \sim \mathcal {D} ^ {\prime}} \| f (\mathcal {D}) - f \left(\mathcal {D} ^ {\prime}\right) \| _ {p}, \tag {2}
$$
where  $\mathcal{D}$  and  $\mathcal{D}'$  are adjacent datasets. The Laplace mechanism adds Laplace noise  $\mathrm{N} \sim \mathrm{Lap}(\mathbf{0}, b\mathbf{I})$  to the output of  $f$ :
$$
\mathcal {M} (\mathcal {D}) = f (\mathcal {D}) + \mathrm {N}.
$$
In particular, if  $b = \Delta_1(f) / \epsilon$ , the Laplace mechanism satisfies  $(\epsilon, 0)$ -DP. Similarly, the Gaussian mechanism adds Gaussian noise  $\mathbf{N} \sim N(\mathbf{0}, \sigma^2\mathbf{I})$  to the output of  $f$ . We recall a result from [BW18] that establishes a DP guarantee for the Gaussian mechanism and refer the reader to their Algorithm 1 for a way to compute  $\sigma$  from  $(\epsilon, \delta)$  and  $\Delta_2(f)$ .
Lemma 1 ([BW18]). For any  $\epsilon \geq 0$  and  $\delta \in [0,1]$ , the Gaussian mechanism is  $(\epsilon, \delta)$ -DP if and only if
$$
\Phi \left(\frac {\Delta_ {2} (f)}{2 \sigma} - \frac {\epsilon \sigma}{\Delta_ {2} (f)}\right) - e ^ {\epsilon} \Phi \left(- \frac {\Delta_ {2} (f)}{2 \sigma} - \frac {\epsilon \sigma}{\Delta_ {2} (f)}\right) \leq \delta ,
$$
where  $\Phi$  is the Gaussian CDF:  $\Phi(t) \triangleq \frac{1}{\sqrt{2\pi}} \int_{-\infty}^{t} e^{-y^2/2} dy$ .
The function  $f$  can often be determined by a query  $q: \mathcal{X} \to \mathbb{R}$ :  $f(\mathcal{D}) = \frac{1}{n} \sum_{\boldsymbol{x}_i \in \mathcal{D}} q(\boldsymbol{x}_i)$ . In this case, we denote  $\Delta(q) \triangleq \sup_{x, x' \in \mathcal{X}} |q(x) - q(x')|$ ;  $q(P) \triangleq \mathbb{E}_{\mathrm{X} \sim P}[q(\mathrm{X})]$  for a probability distribution  $P$ ; and  $q(\mathcal{D}) \triangleq \frac{1}{n} \sum_{\boldsymbol{x}_i \in \mathcal{D}} q(\boldsymbol{x}_i)$  for a dataset  $\mathcal{D}$ .
Consider a dataset  $\mathcal{D}$  comprising private data from  $n$  individuals, where each individual contributes a single record  $\pmb{x} = (x_{1},\dots ,x_{d})\in \mathcal{X}$ . Suppose that a synthetic dataset  $\mathcal{D}_{\mathrm{syn}}$  has been generated from the real dataset  $\mathcal{D}$ , but it may not accurately reflect the real data on a set of utility measures (also known as workload). We express the utility measures of interest as a collection of queries, denoted by  $\mathcal{Q}\triangleq \{q_k:\mathcal{X}\to \mathbb{R}\}_{k = 1}^K$ , and upper bound their  $L_{p}$  sensitivity by  $\Delta_p(\mathcal{Q})\triangleq \frac{1}{n} (\sum_{k\in [K]}\Delta (q_k)^p)^{1 / p}$ .
Our goal is to enhance the utility of the synthetic dataset  $\mathcal{D}_{\mathrm{syn}}$  w.r.t. the utility measures  $\mathcal{Q}$  while maintaining the DP guarantees. We do not make any assumption about how these synthetic data have been generated—e.g., they could be generated by either GAN-based, marginal-based, or workload-based methods. We evaluate the utility measures from the real data via a  $(\epsilon_{\mathrm{post}}, \delta_{\mathrm{post}})$ -DP mechanism and denote their answers by  $\pmb{a} = (a_1, \dots, a_K)$ . Next, we present a systematic approach to post-process the synthetic data, aligning their utility with the (noisy) answers  $\pmb{a}$ .
3 Post-processing Private Synthetic Data
In this section, we present our main result: a post-processing procedure for improving the utility of a synthetic dataset. We formulate this problem as an optimization problem that projects the probability distribution of the synthetic data onto a set of distributions that align the utility measures with the (noisy) real data. We prove that the optimal projected distribution can be expressed in a closed form, which is an exponentially tilted distribution of the original synthetic data distribution. To compute the tilting parameters, we introduce a stochastic first-order method and leverage the tilting parameters to resample from the synthetic data. By doing so, we filter out synthetic data that inaccurately represent the real data on the selected set of utility measures.
We use  $P_{\mathrm{syn}}$  and  $P_{\mathrm{post}}$  to represent the (empirical) probability distribution of the synthetic data and the generating distribution of post-processed data, respectively. We obtain the post-processed distribution
by "projecting"  $P_{\mathrm{syn}}$  onto the set of distributions that align with the real data utility measures up to  $\gamma \geq 0$ :
$$
\min  _ {P _ {\text {p o s t}}} \mathrm {D} _ {\mathrm {K L}} \left(P _ {\text {p o s t}} \| P _ {\text {s y n}}\right), \tag {3a}
$$
$$
\text {s . t .} \left| q _ {k} \left(P _ {\text {p o s t}}\right) - a _ {k} \right| \leq \gamma , \quad \forall k \in [ K ]. \tag {3b}
$$
Here the "distance" between two probability distributions is measured using the KL-divergence. Solving this problem directly suffers from the curse of dimensionality, as the number of variables grows exponentially with the number of features. Below, we leverage strong duality and prove that the optimal distribution  $P_{\mathrm{post}}^*$  can be achieved by tilting  $P_{\mathrm{syn}}$  and the tilting parameters can be obtained from a convex program. This approach involves fewer variables, making it more efficient and practical.
Theorem 1. If (3) is feasible, then its optimal solution has a closed-form expression:
$$
P _ {\text {p o s t}} ^ {*} (\boldsymbol {x}) \propto P _ {\text {s y n}} (\boldsymbol {x}) \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} ^ {*} \left(q _ {k} (\boldsymbol {x}) - a _ {k}\right)\right), \tag {4}
$$
where the dual variables  $\lambda^{*} \triangleq (\lambda_{1}^{*}, \dots, \lambda_{K}^{*})$  are the optimal solution of the following optimization:
$$
\min  _ {\boldsymbol {\lambda} \in \mathbb {R} ^ {K}} \underbrace {\log \mathbb {E} _ {\mathrm {X} \sim P _ {\text {s y n}}} \left[ \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} \left(q _ {k} (\mathrm {X}) - a _ {k}\right)\right) \right]} _ {\triangleq f (\boldsymbol {\lambda})} + \gamma \| \boldsymbol {\lambda} \| _ {1}. \tag {5}
$$
Theorem 1 only requires the feasibility of (3). To ensure feasibility, we denoise the (noisy) answers  $\mathbf{a}$  computed from real data. This denoising step could also increase the accuracy of the released answers while preserving DP guarantees due to the post-processing property [BW18, LWK15]. Specifically, suppose that  $\mathcal{D}_{\mathrm{syn}}$  has  $S$  unique values. We denote the collection of these unique values by  $\operatorname{supp}(\mathcal{D}_{\mathrm{syn}}) = \{\pmb{x}_1, \dots, \pmb{x}_S\}$ . We construct a matrix  $\pmb{Q} \in \mathbb{R}^{K \times S}$  such that  $Q_{j,s} = q_j(\pmb{x}_s)$  and solve the following linear or quadratic programs (see Appendix B for more details):
$$
\boldsymbol {p} ^ {*} = \left\{ \begin{array}{l l} \operatorname * {a r g m i n} _ {\boldsymbol {p} \in \Delta_ {S} ^ {+}} \| \boldsymbol {Q} \boldsymbol {p} - \boldsymbol {a} \| _ {1}, & \text {i f u s i n g L a p l a c e m e c h a n i s m ,} \\ \operatorname * {a r g m i n} _ {\boldsymbol {p} \in \Delta_ {S} ^ {+}} \frac {1}{2} \| \boldsymbol {Q} \boldsymbol {p} - \boldsymbol {a} \| _ {2} ^ {2}, & \text {i f u s i n g G a u s s i a n m e c h a n i s m .} \end{array} \right.
$$
Here  $\Delta_S^+ = \{\pmb{p} \in \mathbb{R}^S \mid \mathbf{1}^T\pmb{p} = 1, \pmb{p} > 0\}$  is the interior of the probability simplex in  $\mathbb{R}^S$ . We obtain the denoised answers as  $\pmb{a}^{*} = Q\pmb{p}^{*} = (a_{1}^{*}, \dots, a_{K}^{*})$ . Finally, if we solve (3) with  $\pmb{a}^{*}$  instead, then it is guaranteed to be feasible.
Although (5) is a convex program, its form differs from the standard empirical risk minimization as the expected loss is composed with a logarithmic function. Thus, one cannot directly apply stochastic gradient descent (SGD) to solve this problem as computing an unbiased (sub)-gradient estimator for (5) is challenging. Instead, we apply a stochastic compositional proximal gradient algorithm to solve (5). Note that the partial derivative of  $f$  in (5) has a closed-form expression:
$$
\frac {\partial f}{\partial \lambda_ {j}} (\boldsymbol {\lambda}) = - \frac {\mathbb {E} _ {\mathbf {X} \sim P _ {\mathrm {s y n}}} \left[ \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} (q _ {k} (\mathbf {X}) - a _ {k})\right) \cdot (q _ {j} (\mathbf {X}) - a _ {j}) \right]}{\mathbb {E} _ {\mathbf {X} \sim P _ {\mathrm {s y n}}} \left[ \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} (q _ {k} (\mathbf {X}) - a _ {k})\right) \right]}.
$$
We estimate this partial derivative by using a mini-batch of data to calculate the expectations in numerator and denominator separately, and then computing their ratio. With this estimator, we can apply the stochastic proximal gradient algorithm [PB14] to solve (5). Although this approach uses a biased gradient estimator, it has favorable convergence guarantees [see e.g., WLF16, HZCH20]. We provide more details about the updating rule in Algorithm 1.
After obtaining the optimal dual variables from Algorithm 1, we generate the post-processed dataset by resampling from the synthetic data with weights:  $\exp \left(-\sum_{k=1}^{K} \lambda_k^* (q_k(x) - a_k)\right)$  for each point  $x$ . This ensures that the resampled data follows the optimal distribution  $P_{\mathrm{post}}^*$  in (4). As our approach only reweights synthetic data without altering their values, the quality of the data points is preserved and the support set of the overall dataset is not expanded. Moreover, our numerical experiments
Algorithm 1 Dual variables computation.
Input:  $\mathcal{D} = \{\bar{\pmb{q}}_i\}_{i=1}^n$  where  $\bar{\pmb{q}}_i = (q_1(\pmb{x}_i^{\mathrm{syn}}) - a_1, \dots, q_K(\pmb{x}_i^{\mathrm{syn}}) - a_K)$ ; maximal number of iterations  $T$ ; mini-batch index  $\mathcal{B}_t \subseteq [n]$ ; step size  $\alpha_t$
Dual variables update:
$$
\lambda_ {j} ^ {(t + 1)} = \operatorname {p r o x} _ {\alpha_ {t} \gamma \| \cdot \| _ {1}} \left(\lambda_ {j} ^ {(t)} + \frac {\alpha_ {t}}{\tau^ {(t)}} \frac {1}{| \mathcal {B} _ {t} |} \sum_ {i \in \mathcal {B} _ {t}} \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} ^ {(t)} \bar {q} _ {i, k}\right) \bar {q} _ {i, j}\right) \quad \text {f o r} j \in [ K ]
$$
$$
\tau^ {(t + 1)} = \frac {1}{| \mathcal {B} _ {t} |} \sum_ {i \in \mathcal {B} _ {t}} \exp \left(- \sum_ {k = 1} ^ {K} \lambda_ {k} ^ {(t + 1)} \bar {q} _ {i, k}\right)
$$
Output:  $\lambda^{(T + 1)}$