PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees

1 INTRODUCTION . More and more large datasets are becoming available in a wide variety of communities . In the U.S. medical community , for example , the fraction of providers using electronic health records ( EHR ) increased from 9.4 % in 2008 to 83.8 % in 2015 [ 20 ] . The availability of large datasets presents enormous opportunities for collaboration between the data-holders and the machine learning community . However , many of these large datasets , especially EHR , include sensitive information that prevents data-holders from sharing the data . The most common way to mitigate the privacy risk of sharing sensitive records is to de-identify the records - but it is by now well-known that records that have been de-identified can be easily re-identified by linking them to other identifiable datasets [ 30 ; 13 ; 24 ; 22 ; 14 ] . ( This is especially true for medical records of patients who have rare diseases . ) However , if the purpose of sharing the data is to develop and validate machine learning methods for a particular task ( e.g . prognostic risk scoring ) , real data is not necessary ; it would suffice to have synthetic data that is sufficiently like the real data . ∗ : Equal contribution Precisely what this means depends on how the synthetic data will be used . For example , the synthetic data may be used to train models that will be deployed directly on real data . In this setting it is important that these methods ( which we trained entirely on synthetic data ) perform as well as if they had been trained on real data . Another setting to consider is one in which data-holders wish to use the synthetic data to identify the best method ( s ) to be used on the real data [ 11 ] . In this setting , it is not important that training on synthetic data leads to good performance on real data , but rather that comparing two methods on the synthetic data results in conclusions similar to those that would have been drawn from comparing the two methods on the real data . We evaluate our method in both settings . Generative Adversarial Networks ( GAN ) [ 19 ] provide a powerful method for using real data to generate synthetic data but it does not provide any rigorous privacy guarantees . Our method modifies the GAN machinery in a way that does guarantee privacy ; the synthetic data is ( differentially ) private [ 12 ] with respect to the original data . To do this we modify the training procedure of the discriminator to be differentially private by using a modified version of the Private Aggregation of Teacher Ensembles ( PATE ) [ 25 ; 26 ] framework . The Post-Processing Theorem [ 12 ] then guarantees that the GAN generator - which is trained only using the differentially private discriminator - will also be differentially private and thus so will the synthetic data it generates . We call our proposed framework PATE-GAN . Using two Kaggle datasets , two different real-world medical datasets and two UCI datasets , we evaluate the utility of the samples generated by PATE-GAN in various settings with various levels of differential privacy . In line with the settings outlined above , we consider two methods for evaluating the similarity of synthetic datasets with a real dataset . The first method , first proposed in [ 15 ] , compares the predictive performance of models trained on the synthetic datasets and tested on the real dataset . The second method , which we propose for the first time here , compares the performance rankings of predictive models on the synthetic datasets with their performance rankings on the real dataset . We demonstrate that , for both of these methods , PATE-GAN consistently produces synthetic datasets that are ” more like ” the original real dataset than the synthetic datasets produced by the state-of-the-art benchmark ( DPGAN [ 32 ] ) . The contributions of this paper can be summarized as follows : ( 1 ) we modify the PATE framework and apply it to GANs to generate synthetic data , ( 2 ) we demonstrate in the experiments section that using PATE to enforce differential privacy results in higher quality synthetic data than DPGAN using various real-world datasets , ( 3 ) we propose a novel new metric for evaluating the generated synthetic data . 2 RELATED WORKS . The most related previous work to this paper is DPGAN [ 32 ] . Like us , DPGAN proposes a framework for modifying the GAN framework to be differentially private , also relying on the PostProcessing Theorem to change the problem of learning a differentially private generator to learning a differentially private discriminator . Their work uses a technique introduced by [ 1 ] that provides a differentially private mechanism for training deep networks . The key idea is that noise is added to the gradient of the discriminator during training to create differential privacy guarantees . These ideas are also used in [ 2 ] . Our method is similar in spirit ; during training of the discriminator differentially private training data is used , which results in noisy gradients , however , we use the mechanism introduced in [ 25 ] which we believe gives tighter differential privacy guarantees ( via tighter bounds on the effect of a single sample ) than those provided in [ 1 ] . This means that for the same privacy guarantees , our method is capable of producing higher quality synthetic data . For a visual representation of both PATE-GAN and DPGAN , see the Appendix . The proposed model modifies the PATE framework [ 25 ; 26 ] for use in a generative model setting ( specifically for use with GANs ) . The key to the GAN framework is that the discriminator is a differentiable module trained to classify samples as either real or generated . The PATE framework provides a differentially private mechanism for classification by training multiple teacher models on disjoint partitions of the data . To classify a new sample each teacher ’ s output is evaluated on the sample and then all outputs are noisily aggregated . This noisy aggregation , though , results in a classifier that is not differentiable with respect to the parameters of the generator . In order to overcome this problem we follow the idea of the student model , also proposed in [ 25 ] , that involves taking some public unlabelled data , labelling it using the standard PATE mechanism and then training the student using the resulting labelled data . Because access to any public data is often an unreasonable assumption in synthetic data generation , we adapt this training paradigm in a way that does not require public data by training the student using only outputs from the ( differentially private ) generator . Some previous works generate synthetic data using summary statistics of the original data [ 23 ] or based on specific domain-knowledge [ 6 ] ; however , those methods are limited to low-dimensional feature spaces , specific fields and do not provide any differential privacy guarantees . [ 9 ] generates synthetic patient records using a GAN framework . However , [ 9 ] focuses only on generating discrete variables , whereas PATE-GAN is capable of generating mixed-type ( continuous , discrete , and binary ) variables . Furthermore , [ 9 ] also does not provide any differential privacy guarantees and instead uses ad-hoc notions of privacy which are only validated empirically . Finally , it is worth remarking that it is known to be hard in the worst-case to generate private synthetic data [ 31 ] and so techniques such as GANs are necessary to address this challenge . 3 BACKGROUND . Let us denote the feature space by X , the label space by Y and write U = X ×Y . Let the dimension of U be d. Suppose that X and Y are random variables over X and Y . We write U = ( X , Y ) and x , y , u to denote realizations of X , Y and U , respectively . The dataset D consists of N samples of u , assumed i.i.d . according to PU denoted as D = { ui } Ni=1 = { ( xi , yi ) } Ni=1 . 3.1 DIFFERENTIAL PRIVACY . We first provide some preliminaries on differential privacy [ 12 ] before describing PATE-GAN ; we refer interested readers to [ 12 ] for a thorough exposition of differential privacy . We will denote an algorithm byM , which takes as input a dataset D and outputs a value from some output space , O . Definition 1 . ( Neighboring Datasets ) Two datasets D , D′ are said to be neighboring if ∃x ∈ D s.t . D \ { x } = D′ . ( 1 ) Definition 2 . ( Differential Privacy ) A randomized algorithm , M , is ( , δ ) -differentially private if for all S ⊂ O and for all neighboring datasets D , D′ : P ( M ( D ) ∈ S ) ≤ e P ( M ( D′ ) ∈ S ) + δ ( 2 ) where P is taken with respect to the randomness ofM . Differential privacy provides an intuitively understandable notion of privacy - a particular sample ’ s inclusion or exclusion in the dataset does not change the probability of a particular outcome very much : it does so by a multiplicative factor of e and an additive amount , δ . The following theorem , a proof of which can be found in [ 12 ] , allows us to move the burden of differential privacy to the discriminator ; the differential privacy of the generator will follow by the theorem . Theorem . ( Post-processing ) LetM be an ( , δ ) -differentially private algorithm and let f : O → O′ where O′ is any arbitrary space . Then f ◦M is ( , δ ) -differentially private . 3.2 PRIVATE AGGREGATION OF TEACHER ENSEMBLES ( PATE ) . In this section we describe the PATE mechanism first defined in [ 25 ] and later improved upon by [ 26 ] . The PATE mechanism provides a differentially private method for classification , a core component of the GAN framework ; the discriminator is a classifier trained to identify whether samples are real/fake . In order to build a differentially private classifier , the dataset is first divided into k disjoint subsets D1 , ... , Dk . k classifiers , T1 , ... , Tk ( referred to as teachers ) are then trained separately on the k sub-datasets ( i.e . Ti is only trained on Di ) . Given a new input feature vector x to classify , the differentially private output is given by passing x to each of the k teachers , and then performing a noisy aggregation of the resulting outputs . Formally , given the k teachers , m possible classes and an input feature vector , x , set nj ( x ) = | { Ti : Ti ( x ) = j } | for j = 1 , ... , m ( 3 ) so that nj ( x ) is the number of teachers that output class j for x . The output of the PATEλ mechanism for input x is then defined as PATEλ ( x ) = arg max j∈ [ m ] ( nj ( x ) + Yj ) ( 4 ) where Y1 , ... , Ym are i.i.d . Lap ( λ ) random variables . The following result , found in [ 25 ] , follows from [ 12 ] . Theorem . The output of a single query to the PATEλ mechanism is ( 1λ , 0 ) -differentially private . In order to apply this framework in the GAN framework , however , we require that the discriminator be differentiable , which the output of this classification mechanism is not ( note that accessing the internal parameters of the teachers would violate differential privacy , the only thing we have access to in this case is the output ) . Instead , we draw on the PATE extension ( also introduced in [ 25 ] ) in which a student model is trained . This student model ( after being trained ) is free to access , not only its outputs given inputs but also its internal parameters . The model itself is differentially private . Formally , the student , S , is a classifier that is trained by taking some public , unlabelled data , P = { xi } Ki=1 , passing each sample , xi , through the ( standard ) PATE mechanism , to receive a differentially private label , ŷi , and forming a new ( noisy- ) teacher-labelled dataset P̂ = { ( xi , ŷi ) } Ki=1 on which the student is then trained . Importantly , we can make the student differentiable - it can be modelled using any classifier , such as a neural net . Moreover , querying the student is “ free ” - there is no privacy cost associated with passing an input to the student and receiving an output , the only privacy cost is in acquiring the data on which to train the student . We state the following result which follows from the analysis in [ 25 ] . Theorem . The student , S , trained on the dataset P̂ where labels were generated according to the PATEλ mechanism using λ = K2 , is ( , 0 ) -differentially private with respect to the original data D .

Summary: This paper considers using a GAN to generate synthetic data in a differentially private manner [see also https://www.biorxiv.org/content/early/2018/06/05/159756 ]. The key novelty is the integration of the PATE differential privacy framework from recent work. Specifically, rather than a single distinguisher as is usual in a GAN, there is a "student distinguisher" and several "teacher distinguishers". The student distinguisher is used as usual except that it does not have access to the real data, only the teacher distinguishers have access to the real data (as well as the synthetic data). The data is partitioned amongst the teacher distinguishers and their output is aggregated in a differentially private manner (and gradients are not revealed). The role of the teacher distinguishers is solely to correct the student distinguisher when it errs.