G-PATE: Scalable Differentially Private Data Generator via Private Aggregation of Teacher Discriminators

1 Introduction . Machine learning has been applied to a wide range of applications such as face recognition [ 30 , 39 , 21 , 22 ] , autonomous driving [ 26 ] , and medical diagnoses [ 8 , 20 ] . However , most learning methods rely on the availability of large-scale training datasets containing sensitive information such as personal photos or medical records . Therefore , such sensitive datasets are often hard to be shared due to privacy concerns [ 40 ] . To handle this challenge , data providers sometimes release synthetic datasets produced by generative models learned on the original data . Though recent studies show that generative models such as generative adversarial networks ( GAN ) [ 14 ] can generate synthetic records that are indistinguishable from the original data distribution , there is no theoretical guarantee on the privacy protection . While privacy definitions such as differential privacy [ 9 ] and Rényi differential privacy [ 27 ] provide rigorous privacy guarantee , applying them to synthetic data generation is nontrivial . Recently , two approaches have been proposed to combine differential privacy with synthetic data generation : DP-GAN [ 35 ] and PATE-GAN [ 37 ] . DP-GAN modifies GAN by training the discriminator using differentially private stochastic gradient descent . Though it achieves privacy guarantee due to ⇤Equal contribution . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) the post processing property [ 10 ] of differential privacy , DP-GAN incurs significant utility loss on the synthetic data , especially when the privacy budget is low . In contrast , PATE-GAN trains differentially private GAN using Private Aggregation of Teacher Ensembles ( PATE ) [ 28 ] . Specifically , it trains a set of teacher discriminators and a student discriminator . To ensure differential privacy , the student discriminator is only trained on records that are produced by the generator and labeled by the teacher discriminators . The key limitation of this approach is that it relies on the assumption that the generator would be able to generate the entire real records space to bootstrap the training process . If most of the synthetic records are labeled as fake by the teacher discriminators , the student discriminator would be trained on a biased dataset and fail to learn the true data distribution . Consequently , this trained generator would not be able to produce high-quality synthetic data . This problem does not exist for traditional GAN , where the discriminator is always able to provide useful information to the generator since they can access the real data records rather than the synthetic data only . The main contribution of this paper is a new approach named G-PATE for training a differentially private data generator by combining the generative model with PATE mechanism . Our approach is based on the key observation that : It is not necessary to ensure differential privacy for the discriminator in order to train a differentially private generator . As long as we ensure differential privacy on the information flow from the discriminator to the generator , it is sufficient to guarantee the privacy property for the generator . To achieve this , we propose a private gradient aggregation mechanism to ensure differential privacy on all the information that flows from the teacher discriminators to the student generator . The aggregation mechanism applies random projection and gradient discretization to reduce privacy budget consumed by each aggregation step and to increase model scalability . Compared to PATE-GAN , our approach has three advantages . First , it improves the use of privacy budget by only applying it to the part of the model that actually needs to be released for data generation . Second , our discriminator can be trained on original data records since it does not need to satisfy differential privacy . Finally , G-PATE preserves better utility on high-dimensional data given its more efficient gradient aggregation mechanism . Theoretically , we show that our algorithm ensures differential privacy for the generator . Empirically , we conduct extensive experiments on the Kaggle credit dataset and image datasets . To the best of our knowledge , this is the first work that is able to scale to high-dimensional face image dataset such as CelebA while still preserving high data utility . The results show that our method significantly outperforms all baselines including DP-GAN and PATE-GAN . 2 Related Work . Differential privacy [ 9 ] is a notion that ensures an algorithm outputs general information about its input dataset without revealing individual information . So far , researchers have proposed different methods to design differentially private statistical functions and machine learning models [ 2 , 5 , 1 , 25 , 12 ] . Private aggregation of teacher ensembles ( PATE ) is proposed to train a differentially private classifier using ensemble mechanisms . Scalable PATE [ 29 ] improves the utility of PATE with a ConfidentGNMax aggregator that only returns a result if it has high confidence in the consensus among teachers . However , PATE and Scalable PATE are only applicable to categorical data ( i.e. , class labels ) as shown in prior work . Differentially private data generative models have also been proposed . Priview [ 31 ] generates synthetic data based on marginal distributions of the original dataset , PrivBayes [ 38 ] trains a differentially private Bayesian network , and MWEM [ 16 ] uses the multiplicative weights framework to maintain and improve a distribution approximating a given data set with respect to a set of counting queries . However , these approaches are not suitable for image datasets since the statistics they use can not well preserve the correlations between pixels in an image . Some recent work applies differential privacy to the training of GAN . DP-GAN [ 35 ] and DPCGAN [ 33 ] add Gaussian noise to the gradients of the discriminators during the training process . GSWGAN [ 6 ] reduces gradient sensitivity using the Wassertein distance and uses gradient sanitization to ensure differential privacy for the generator . PATE-GAN [ 37 ] trains a student discriminator using an ensemble of teacher discriminators . DP-MERF [ 15 ] and PEARL [ 23 ] use differentially private embedding to train generative models on the embedding space . Concretely , DP-MERF uses random feature representations of kernel mean embeddings , and PEARL improves upon DP-MERF by incorporating characteristic function that improves the generator ’ s learning capability . Both DP-MERF and PEARL focus on generating a private embedding space on which the distance metric between synthetic and real data is computed ( though there are no results reported for high-dimensional images ) . On the contrary , G-PATE focuses on generating DP high-dimensional data by improving the model structure and the private gradient aggregation step , which is orthogonal to the embedding space optimization approaches as DP-MERF and PEARL . 3 Preliminaries . Differential Privacy . Differential privacy bounds the shift in the output distribution of a randomized algorithm that could be caused by a small input perturbation . The following definition formally describes this privacy guarantee . Definition 1 ( ( `` , ) -Differential Privacy ) . A randomized algorithm M with domain N|X | is ( `` , ) - differentially private if for all S ✓ Range ( M ) and for any neighboring datasets D and D0 , we have Pr [ M ( D ) 2 S ] exp ( `` ) Pr [ M ( D0 ) 2 S ] + . Rényi Differential Privacy . Rényi differential privacy is a natural relaxation of differential privacy . Defined below , its privacy guarantee is expressed in terms of Rényi divergence . Definition 2 ( ( , `` ) -RDP ) . A randomized mechanism M is said to guarantee ( , `` ) -RDP with > 1 if for any neighboring datasets D and D0 , D ( M ( D ) kM ( D0 ) ) = 1 1 logEx⇠M ( D ) `` ✓ Pr [ M ( D ) = x ] Pr [ M ( D0 ) = x ] ◆ 1 # `` . ( , `` ) -RDP implies ( `` , ) -differential privacy for any given probability > 0 . Theorem 1 ( From RDP to DP ) . If a mechanism M guarantees ( , `` ) -RDP , then M guarantees ( `` + log 1/ 1 , ) -differential privacy for any 2 ( 0 , 1 ) . Compared to DP , RDP supports easier composition of multiple queries and clearer privacy guarantee under Gaussian noise . Specifically , RDP could be easily composed by adding the privacy budget : Theorem 2 ( Composition of RDP ) . If a mechanism M consists of a sequence of M1 , . . . , Mk such that for any i 2 [ k ] , Mi guarantees ( , `` i ) -RDP , then M guarantees ( , Pk i=1 `` i ) -RDP . Suppose f is a real-valued function , and the Gaussian mechanism is defined as G f ( D ) = f ( D ) + N 0 , 2 , where N 0 , 2 is normally distributed random variable with standard deviation and mean 0 . The Gaussian mechanism provides the following RDP guarantee : Theorem 3 ( RDP Guarantee for Gaussian Mechanism ) . If f has sensitivity 1 , then the Gaussian mechanism G f satisfies , / 2 2 -RDP . 4 G-PATE : A Scalable Data Generative Method . In this section , we present our method named G-PATE . An overview of the method is shown in Figure 1 . Unlike PATE-GAN and DP-GAN , G-PATE ensures differential privacy for the information flow from the discriminator to the generator . This improvement incurs less utility loss on the synthetic samples , so it can generate synthetic samples for higher dimensional and more complex datasets . G-PATE makes two major modifications on the training process of GAN . First , we replace the discriminator in GAN with an ensemble of teacher discriminators trained on disjoint subsets of the sensitive data . The teacher discriminators do not need to be published , thus can be trained using non-private algorithms . In addition , we design a gradient aggregator to collect information from teacher discriminators and combine them in a differentially private fashion . The output of the aggregator is a gradient vector that guides the student generator to improve its synthetic samples . Unlike PATE-GAN , G-PATE does not require any student discriminator . The teacher discriminators are directly connected to the student generator . The gradient aggregator adds noise in the information flow from the teacher discriminators to the student generator to ensure differential privacy . This way , G-PATE uses privacy budget more efficiently and better approximates the real data distribution to ensure high data utility . 4.1 Training the Student Generator Algorithm 1 - Training the Student Generator .. 1 : Input : batch size m , number of teacher models n , num- ber of training iterations N , gradient clipping constant c , number of bins B , projected dimension k , noise parameters 1 and 2 , threshold T , disjoint subsets of sensitive data S1 , S2 , . . . , Sn 2 : for number of training iterations do 3 : //Phase I : Pre-Processing 4 : Sample m noise samples z1 , z2 , . . . , zm 5 : Generate fake samples G ( z1 ) , G ( z2 ) , . . . , G ( zm ) 6 : for each synthetic image G ( zj ) do 7 : //Phase II : Private computation and aggregation 8 : for each teacher model i do 9 : Sample m data samples from Si 10 : Update the teacher discriminator Di 11 : Calculate the gradients x ( i ) j 12 : end for 13 : Xj ⇣ x ( 1 ) j ; x ( 2 ) j ; . . . ; x ( n ) j ⌘ 14 : xprivj DPGradAgg ( Xj , c , B , k , 1 , 2 , T ) 15 : //Phase III : Post-Processing 16 : x̂j G ( zj ) + xprivj 17 : end for 18 : Update the student generator G by descending its stochastic gradient on LG on ( x̂1 , x̂2 , . . . , x̂m ) 19 : end for To achieve better privacy budget efficiency , G-PATE only ensures differential privacy for the generator and allows the discriminators to learn private information . To ease privacy analysis , we decompose G-PATE into three parts : the teacher discriminators , the student generator , and the gradient aggregator . To prevent the propagation of private information , the student generator does not have direct access to any information in any of the teacher discriminators . Consequently , we can not train the student generator by ascending its gradient based on loss of the discriminators . To solve this problem , we calculate the backpropagated gradients on the fake record x by ascending x ’ s gradients on the loss of the discriminator . This gradient vector can be viewed as an adversarial perturbation on x that would cause the discriminator ’ s loss on x to increase . Therefore , adding the gradients to the generated fake record would teach the student generator how to improve the fake record . In each training iteration , the student generator is updated in three steps : ( 1 ) A teacher discriminator generates the backpropagated gradients for each record produced by the student generator . ( 2 ) The gradient aggregator takes the gradients from all teacher models and generates a differentially private aggregation of them . ( 3 ) The student generator updates its weights based on the privately aggregated gradients . The process is formally presented in Algorithm 1 . Backpropagating Gradients in the Discriminator . Let D be a teacher discriminator . Given a fake record x , we use LD ( x ) to represent D ’ s loss on x . In each training iteration , the weights of D are updated by descending their stochastic gradients on LD . For each input fake record x , we generate a gradient vector x that guides the student generator on improving its output . By applying the perturbation on its output , the student generator would get an improved fake record x̂ = x+ x on which D has a higher loss . Therefore , x is calculated as x ’ s gradients on LD : x = @ LD ( a ) @ a a=x . ( 1 ) With the gradient vector x , the student generator can be trained without direct access to the discriminator ’ s loss . Updating the Student Generator . A student generator G learns to map a random input z to a fake record x = G ( z ) so that x is indistinguishable from a real record by D. Given the gradient vector x , the teacher discriminators have higher loss on the perturbed fake record x̂ = x+ x compared to the original fake record x . Therefore , the student generator learns to improve its fake records by minimizing the mean squared error ( MSE ) between its output G ( z ) and the perturbed fake record x̂ . LG ( z , x̂ ) = 1 k kX i=1 ( G ( zi ) x̂i ) 2 , ( 2 ) where k is the number of synthetic records generated per training iteration . To ensure differential privacy , instead of receiving the gradient vector from a single discriminator , we train the student generator using a differentially private gradient aggregator that combines gradient vectors from multiple teacher discriminators . Details are provided in Section 4.2 .

Summary: The paper proposes a new method called G-PATE for generating differentially private datasets. G-PATE is motivated from the PATE framework, by training teacher discriminators on real datasets, and then privately aggregating the gradients from those discriminators to train the generator. To aggregate the gradients, the paper proposes to project the gradients to a lower dimension, discretize the gradients, and then use the voting mechanism from PATE to aggregate the gradients. The paper demonstrates that G-PATE achieves better fidelity-privacy trade-offs than the two prior techniques: DP-GAN and PATE-GAN.