Scalable Differentially Private Data Generation via Private  Aggregation  of  Teacher Ensembles

1 INTRODUCTION . Machine learning has been applied to a wide range of applications such as face recognition ( Parkhi et al. , 2015 ) , autonomous driving ( Menze & Geiger , 2015 ) , and medical diagnoses ( de Bruijne , 2016 ; Kourou et al. , 2015 ) . However , most learning methods rely on the availability of large-scale training datasets containing sensitive information such as personal photos or medical records . Therefore , such sensitive datasets are often hard to be shared due to privacy concerns . To handle this challenge , data providers sometimes release synthetic datasets produced by generative models learned on the original data . Though recent studies show that generative models such as generative adversarial networks ( GAN ) ( Goodfellow et al. , 2014 ) can generate synthetic records that are indistinguishable from the original data distribution , there is no theoretical guarantee on the privacy protection . While privacy definitions such as differential privacy ( Dwork & Feldman , 2018 ) and Rényi differential privacy ( Mironov , 2017 ) provide rigorous privacy guarantee , applying them to synthetic data generation is nontrivial . Recently , two approaches have been proposed to combine differential privacy with synthetic data generation : DP-GAN ( Xie et al. , 2018 ) and PATE-GAN ( Yoon et al. , 2019 ) . DP-GAN modifies GAN by training the discriminator using differentially private stochastic gradient descent . Though it achieves privacy guarantee due to the post processing property ( Dwork et al. , 2014 ) of differential privacy , DP-GAN incurs significant utility loss on the synthetic data , especially when the privacy budget is low . In contrast , PATE-GAN trains differentially private GAN using the PATE mechanism ( Papernot et al. , 2017 ) . Specifically , it first trains a set of teacher discriminators and then train a student discriminator based on the trained ensemble of teacher discriminators . To ensure differential privacy , the student discriminator is only trained on records that are produced by the generator and labeled by the teacher discriminators . The key limitation of this approach is that it relies on the assumption that the generator would be able to generate the entire “ real ” records space to bootstrap the training process . If most of the synthetic records are labeled as fake by the teacher discriminators , the student discriminator would be trained on a biased dataset and fail to learn the true data distribution . Consequently , this trained generator would not be able to produce high-quality synthetic data . This problem does not exist on a traditional GAN , where the discriminator is always able to provide useful information to the generator since they can access the real data records rather than the synthetic data only . In addition , the two stage training process of PATE-GAN makes it less scalable or flexible in terms of varying the number of teacher discriminators . The main contribution of this paper is a new approach named G-PATE for training a differentially private data generator by combining the generative model with PATE mechanism . Our approach is based on the key observation that : It is not necessary to ensure differential privacy for the discriminator in order to train a differentially private generator . As long as we ensure differential privacy on the information flow from the discriminator to the generator , it is sufficient to guarantee the privacy property for the generator . To achieve this , we propose a private gradient aggregation mechanism to ensure differential privacy on all the information that flows from the teacher discriminators to the student generator . Compared to PATE-GAN , our approach has three advantages . First , we improve the use of privacy budget by only applying it to the part of the model that actually needs to be released for data generation . Second , our discriminator can be trained on original data records since it does not need to satisfy differential privacy . Finally , G-PATE is much more scalable given its simple framework architecture . Theoretically , we show that our algorithm ensures differential privacy for the generator . Empirically , we conduct extensive experiments on the standard Kaggle credit card fraud detection dataset , as well as two image datasets MNIST and Fashion-MNIST . The results show that our method significantly outperforms all baselines including DP-GAN and PATE-GAN in terms of data utility . 2 RELATED WORK . Differential privacy ( Dwork , 2008 ) is a notion that ensures an algorithm outputs general information about its input dataset without revealing individual information . Rényi differential privacy ( Mironov , 2017 ) is a relaxation of differential privacy that allows tighter analysis on the composition of privacy budgets . Following the work of differential privacy , researchers have proposed different methods to design differentially private statistical functions and machine learning models ( Bassily et al. , 2014 ; Chaudhuri et al. , 2011 ; Abadi et al. , 2016 ; McSherry & Talwar , 2007 ; Friedman & Schuster , 2010 ) . Recently , various approaches have been proposed for differentially private data generation . Priview ( Qardaji et al. , 2014 ) generates synthetic data based on marginal distributions of the original dataset , and PrivBayes ( Zhang et al. , 2017 ) trains a differentially private Bayesian network . However , these approaches are not suitable for image datasets since the statistics they use can not well preserve the correlations between pixels in an image . Both DP-GAN ( Xie et al. , 2018 ) and PATE-GAN ( Yoon et al. , 2019 ) apply differential privacy to the training process of generative adversarial networks . They both ensure differential privacy while training the discriminator , and the privacy property of the generator is guaranteed by the post processing property of differential privacy . Unlike their approaches , our method improves the use of privacy budget by only ensuring differential privacy on the generator , which is the part that actually needs to be released for synthetic data generation . This improvement allows us to incur much lower utility loss on the synthetic data under the same privacy constraint . Private aggregation of teacher ensembles ( PATE ) is a method to train a differentially private classifier using ensemble mechanisms . It first trains an ensemble of teacher models on disjoint subsets of the sensitive training data . Then , a differentially private student model is trained on public data labeled by the teacher models . The privacy guarantee of PATE is more intuitive to understand because no teacher model can dictate the training of the student model . Compared to most differentially private classification method , PATE benefits from a tighter data-dependent privacy bound especially when teacher models are likely to reach consensus . Scalable PATE ( Papernot et al. , 2018 ) improves the utility of PATE with a Confident-GNMax aggregator that only returns a result if it has high confidence in the consensus among teachers . However , both PATE and Scalable PATE relies on the availability of public unlabeled data , and their aggregators are only applicable to categorical data ( i.e. , class labels ) . In contrast , our method does not rely on any public dataset and can generate synthetic samples that are differentailly private with respect to the private training dataset . We also design a differentially private gradient aggregator that works for continuous gradient vectors . 3 BACKGROUND . We recall the definition of differential privacy ( DP ) , Rényi differential privacy ( RDP ) , and some of their properties . 3.1 DIFFERENTIAL PRIVACY . Differential privacy bounds the shift in the output distribution of a randomized algorithm that could be caused by a small input perturbation . The following definition formally describes this privacy guarantee . Definition 1 ( ( ε , δ ) -Differential Privacy ) . A randomized algorithmM with domain N|X | is ( ε , δ ) differentially private if for all S ⊆ Range ( M ) and for any neighboring datasets D and D′ : Pr [ M ( D ) ∈ S ] ≤ exp ( ε ) Pr [ M ( D′ ) ∈ S ] + δ . 3.2 RÉNYI DIFFERENTIAL PRIVACY . Rényi differential privacy is a natural relaxation of differential privacy . Defined below , its privacy guarantee is expressed in terms of Rényi divergence . Definition 2 ( ( λ , ε ) -RDP ) . A randomized mechanismM is said to guarantee ( λ , ε ) -RDP with λ > 1 if for any neighboring datasets D and D′ , Dλ ( M ( D ) ‖M ( D′ ) ) = 1 λ− 1 logEx∼M ( D ) [ ( Pr [ M ( D ) = x ] Pr [ M ( D′ ) = x ] ) λ−1 ] ≤ ε . ( λ , ε ) -RDP implies ( εδ , δ ) -differential privacy for any given probability δ > 0 . Theorem 1 ( From RDP to DP ) . If a mechanismM guarantees ( λ , ε ) -RDP , thenM guarantees ( ε+ log 1/δλ−1 , δ ) -differential privacy for any δ ∈ ( 0 , 1 ) . Compared to DP , RDP supports easier composition of multiple queries and clearer privacy guarantee under Gaussian noise . Specifically , RDP could be easily composed by adding the privacy budget : Theorem 2 ( Composition of RDP ) . If a mechanismM consists of a sequnce ofM1 , . . . , M ) k such that for any i ∈ [ k ] , Mi guarantees ( λ , εi ) -RDP , thenM guarantees ( λ , ∑k i=1 εi ) -RDP . Suppose f is a real-valued function , and the Gaussian mechanism is defined as follows : Gσf ( D ) = f ( D ) +N ( 0 , σ2 ) , where N ( 0 , σ2 ) is normally distributed random variable with standard deviation σ and mean 0 . The Gaussian mechanism provides the following RDP guarantee : Theorem 3 ( RDP Guarantee for Gaussian Mechanism ) . If f has sensitivity 1 , then the Gaussian mechanism Gσf satisfies ( λ , λ/ ( 2σ2 ) ) -RDP . 4 THE G-PATE METHOD . In this section , we present our method named G-PATE . An overview of the method is shown in Figure 1 . Unlike PATE-GAN and DP-GAN , G-PATE ensures differential privacy for the information flow from the discriminator to the generator . This improvement incurs less utility loss on the synthetic samples , so it can generate synthetic samples for higher dimensional and more complex datasets . G-PATE makes two major modifications on the training process of GAN . First , we replace the discriminator in GAN with an ensemble of teacher discriminators trained on disjoint subsets of the sensitive data . The teacher discriminators do not need to be published , thus can be trained using non-private algorithms . In addition , we design a gradient aggregator to collect information from teacher discriminators and combine them in a differentially private fashion . The output of the aggregator is a gradient vector that guides the student generator to improve its synthetic samples . Unlike PATE-GAN , G-PATE does not require any student discriminator . The teacher discriminators are directly connected to the student generator . The gradient aggregator sanitizes the information flow from the teacher discriminators to the student generator to ensure differential privacy . This way , G-PATE uses privacy budget more efficiently and better approximates the real data distribution to ensure high data utility . 4.1 TRAINING THE STUDENT GENERATOR . To achieve better privacy budget efficiency , G-PATE only ensures differential privacy for the generator and allows the discriminators to learn private information . The privacy property is achieved by sanitizing all information propagated from the discriminators to the generator . To ease privacy analysis , we decompose G-PATE into three parts : the teacher discriminators , the student generator , and the gradient aggregator . To prevent the propagation of private information , the student generator does not have direct access to any information in any of the teacher discriminators . Consequently , we can not train the student generator by ascending its gradient based on loss of the discriminators . To solve this problem , we propose the use of adversarial perturbation , which is a small manipulation on the fake record x that causes the discriminator ’ s loss on x to increase . The adversarial perturbation is calculated by ascending x ’ s gradients on the loss of the discriminator . It teaches the student generator how to improve its fake records . In each training iteration , the student generator is updated in three steps : ( 1 ) A teacher discriminator generates adversarial perturbations for each record produced by the student generator . ( 2 ) The gradient aggregator takes the adversarial perturbations from all teacher models and generates a differentially private aggregation of them . ( 3 ) The student generator updates its weights based on the privately aggregated adversarial perturbation . The process is formally presented in Algorithm 1 . Generating Adversarial Perturbations . Let D be a teacher discriminator . Given a fake record x , we use LD ( x ) to represent D ’ s loss on x . In each training iteration , the weights of D are updated by descending their stochastic gradients on LD . For each input fake record x , we generate an adversarial perturbation ∆x that guides the student generator on improving its output . By applying the perturbation on its output , the student generator would get an improved fake record x̂ = x + ∆x on which D has a higher loss . Therefore , ∆x is calculated as x ’ s gradients on LD : ∆x = ∂LD ( a ) ∂a ∣∣∣∣ a=x . ( 1 ) Algorithm 1 - Training the Student Generator . The student generator is jointly trained with an ensemble of teacher discriminators . In each iteration , the student generator updates its weights based on an aggregated adversarial perturbation generated by the teacher ensemble . Require : batch size m , number of teacher models n , number of training iterations N , gradient clipping constant c , number of bins B , projected dimension k , noise parameters σ1 and σ2 , threshold T , disjoint subsets of sensitive data d1 , d2 , . . . , dn 1 : for number of training iterations do 2 : Sample m noise samples { z1 , z2 , . . . , zm } 3 : Generate fake samples { G ( z1 ) , G ( z2 ) , . . . , G ( zm ) } 4 : for i ∈ { 1 , . . . , n } do 5 : Sample m data samples { x1 , x2 , . . . , xm } from di 6 : Update the teacher discriminator Di by descending its stochastic gradient on LDi on both fake samples and real samples 7 : for j ∈ { 1 , . . . , m } do 8 : Calculate the adversarial perturbation ∆x ( i ) j as xj ’ s gradients on LDi ( xj ) 9 : end for 10 : end for 11 : for j ∈ { 1 , . . . , m } do 12 : ∆xj ← DPGradAgg ( ∆x ( 1 ) j , ∆x ( 2 ) j , . . . , ∆x ( n ) j , c , B , k , σ1 , σ2 , T ) 13 : x̂j ← G ( zj ) + ∆xj 14 : end for 15 : Update the student generator G by descending its stochastic gradient on LG on { x̂1 , x̂2 , . . . , x̂m } 16 : end for 17 : return G With the adversarial perturbation ∆x , the student generator can be trained without direct access to the discriminator ’ s loss . Updating the Student Generator . A student generator G learns to map a random input z to a fake record x = G ( z ) so that x is indistinguishable from a real record by D. Given an adversarial perturbation ∆x , the teacher discriminators have higher loss on the perturbed fake record x̂ = x+∆x compared to the original fake record x . Therefore , the student generator learns to improve its fake records by minimizing the mean squared error ( MSE ) between its output G ( z ) and the perturbed fake record x̂ . LG ( z , x̂ ) = 1 k k∑ i=1 ( G ( z ) i − x̂i ) 2 , ( 2 ) where k is the number of synthetic records generated per training iteration . To ensure differential privacy , instead of receiving the adversarial perturbation from a single discriminator , we train the student generator using a differentially private gradient aggregator that combines adversarial perturbations from multiple teacher discriminators . Details are provided in Section 4.2 .

Summary: This paper presents a framework for Differentially private data generation that enables more accurate training of downstream learners without compromising on the privacy guarantees. The key insight is to introduce an ensemble of teacher discriminators in the GAN formulation instead of a single discriminator. The teachers are trained on separate subsets of the private data set. A gradient aggregator is also introduced for transmitting loss signal to the student without losing privacy by using adversarial perturbations and random projections. The authors provide theoretic guarantees of Renyi differential privacy and experiments on Kaggle Credit default dataset and MNIST.