Don’t Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence

1 Introduction . Modern machine learning ( ML ) algorithms and their practical applications ( e.g . recommender systems [ 1 ] , personalized medicine [ 2 ] , face recognition [ 3 ] , speech synthesis [ 4 ] , etc . ) have become increasingly data hungry and the use of personal data is often a necessity . Consequently , the importance of privacy protection has become apparent to both the public and academia . Differential privacy ( DP ) is a rigorous definition of privacy that quantifies the amount of information leaked by a user , participating in a data release [ 5 , 6 ] . The degree of privacy protection is represented by the privacy budget . DP was originally designed for answering queries to statistical databases . In a typical setting , a data analyst ( party wanting to use data ; e.g . a healthcare company ) sends a query to a data curator ( party in charge of safekeeping the database ; e.g . a hospital ) , who makes the query on the database and replies with a semi-random answer that preserves privacy . Responding to each new query incurs a privacy cost . If the analyst has multiple queries , the curator must subdivide the privacy budget to spend on each query . Once the budget is depleted , the curator can no longer respond to queries , preventing the analyst from performing new , unanticipated tasks with the database . Generative models can be applied as a general and flexible data-sharing medium [ 7 , 8 ] , sidestepping the above problems . In this scenario , the curator first encodes private data into a generative model ; ∗Work done during internship at NVIDIA . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . ar X iv : s ub m it/ 40 07 49 5 [ cs .L G ] 1 N ov 2 then , the model is shared with the analyst , who can use it to synthesize similar yet different data from the training data . This data can be used in any way desired , such as for data analysis or to train specific ML models . Unanticipated novel tasks can be accommodated without repeatedly interacting with the curator , since the analyst can easily generate additional synthetic data as required . Furthermore , it has been observed that generative models can reveal critical information about their training data [ 9 , 10 ] . For example , Webster et al . [ 9 ] found that modern GANs trained on images of faces produce examples that greatly resemble their training data , thereby leaking private information . Hence , the generative model must be learnt with privacy constraints to protect the privacy of individuals contributing to the database . Differentially private learning of generative models has been studied mostly using generative adversarial networks ( GANs ) [ 7 , 11 , 12 , 13 , 14 ] . While GANs in the non-private setting can synthesize complex data such as high definition images [ 15 , 16 ] , their application in the private setting is challenging . This is in part because GANs suffer from training instabilities [ 17 , 18 ] , which can be exacerbated by adding noise to the GAN ’ s gradients during training , a common technique to implement DP . Hence , GANs typically require careful hyperparameter tuning . This goes against the principle of privacy , where repeated access to data need to be avoided [ 19 ] . In this paper , we propose DP-Sinkhorn , a novel method to train differentially private generative models using a semi-debiased Sinkhorn loss . DP-Sinkhorn is based on the framework of optimal transport ( OT ) , where the problem of learning a generative model is framed as minimizing the optimal transport distance , a type of Wasserstein distance , between the generator-induced distribution and the real data distribution [ 20 , 21 ] . DP-Sinkhorn approximates the exact OT distance in the primal space using the Sinkhorn iteration method [ 22 ] . Furthermore , we propose a novel semi-debiased Sinkhorn loss to optimally control the bias-variance trade-off when estimating gradients of this OT distance in the privacy preserving setting . Since our approach does not rely on adversarial components , it avoids any training instabilities and removes the need for early stopping ( stopping before catastrophic divergence of GANs , as done , for example , in [ 15 ] ) . This makes our method easy to train and deploy in practice . To the best of our knowledge , DP-Sinkhorn is the first fully OT-based approach for differentially private generative modeling . In summary , we make the following contributions : ( i ) We propose DP-Sinkhorn , a flexible and robust optimal transport-based framework for training differentially private generative models . ( ii ) We demonstrate a novel technique to finely control the bias-variance trade-off of gradient estimates when using the Sinkhorn loss . ( iii ) Benefiting from these technical innovations , we achieve stateof-the-art performance on widely used image modeling benchmarks for varying privacy budgets , both in terms of image quality ( as measured by FID ) and downstream image classification accuracy . Finally , we present informative RGB images generated under strict differential privacy without the use of public data , with image quality surpassing that of concurrent works . 2 Related Works . The task of learning generative models on private data has been tackled by many prior works . The general approach is to introduce privacy-calibrated noise into the model parameter gradients during training . A long line of works have explored combinations of GANs and differential privacy . DPGAN [ 7 ] first introduced the idea of combining differential privacy with GANs in a simple scheme where DPSGD [ 23 ] is used when updating the generator . This is followed up a year later by dpGAN [ 11 ] , which adds a decaying clipping threshold that heuristically matches the decreasing gradient magnitude during training . DP-CGAN [ 24 ] adds class conditioning to DPGAN for generation of conditional data . PATE-GAN [ 25 ] adopts the PATE framework for generative learning by using PATE [ 26 ] to train a private student discriminator ; only generated images are scored by this student discriminator to train the generator . This work is improved by G-PATE [ 27 ] , which uses random projections and gradient quantization to directly aggregate discriminator gradients for updating the generator . Importantly , G-PATE makes the point that only the generator is released in the DP generative learning task , thus a large ( ∼1000s ) ensemble of non-private discriminators can be used to train a private generator . GS-WGAN [ 13 ] brings this idea back to DPSGD-based training , in which the gradient aggregate from an ensemble of discriminators is processed by the Gaussian mechanism . Unlike DP-GAN , this is performed on the image gradient , which has fewer dimensions than the parameter gradient . Datalens [ 14 ] further improves upon G-PATE by introducing TopAgg—a three step gradient compression and aggregation algorithm , which provides stable , quantized discriminator gradients at a low privacy cost . It is well documented that GANs are unstable during training [ 17 , 18 ] due to the non-optimality of the discriminator producing large biases in the generator gradient [ 20 ] . This problem is critical in the context of DP , where the imposed gradient noise can increase training instabilities and interaction with private data ( for example during hyperparameter tuning ) should be limited . Our approach circumvents these issues by not relying on adversarial learning schemes . Furthermore , state-of-the-art methods [ 13 , 14 ] rely on training a large number of discriminators to take advantage of the subsampling property of differential privacy . This hinders their practical usefulness as the discriminators require large amounts of GPU/TPU memory . In contrast , only a single generator network is trained in DP-Sinkhorn , making our approach more amenable to various hardware configurations . Other generative models have also been studied in the DP setting . [ 28 ] partitions the private data in clusters and learns separate likelihood-based models for each cluster . [ 29 ] uses Maximum Mean Discrepancy with random Fourier features . While these works do not face the same stability issues as GANs , their restricted modeling capacity results in these methods mostly learning prototypes for each class . DP-Sinkhorn is better at using the modeling capacity of neural networks to produce high utility synthetic data while preserving privacy . Lastly , while [ 30 ] produced strong empirical results , their privacy analysis relies on the use of Wishart noise on sample covariance matrices , which has been proven to leak privacy [ 31 ] . Hence , their privacy protection is invalid in its current form . 3 Background . 3.1 Notations and Setting . Let X denote a sample space , P ( X ) all possible measures on X , and Z ⊆ Rd the latent space . We are interested in training a generative model g : Z 7→ X such that its induced distribution µ = g ◦ ξ with noise source ξ ∈ P ( Z ) is similar to observed ν through an independently sampled finite sized set of observations D = { y } N . In our case , g is a trainable parametric function with parameters θ . 3.2 Generative Learning with Optimal Transport . Optimal Transport-based generative learning considers minimizing variants of the Wasserstein distance between real and generated distributions [ 20 , 21 ] . Two key advantages of the Wasserstein distance over standard GANs , which optimize the Jensen-Shannon divergence [ 32 ] , are its definiteness on distributions with non-overlapping supports , and its weak metrization of probability spaces [ 33 ] . This prevents collapse during training caused by discriminators that are overfit to training data . The OT framework can be formulated in either the primal or dual formulation . In WGAN and variants [ 33 , 34 , 35 ] , the dual potential is approximated by an adversarially trained discriminator . These methods still encounter instabilities during training , since the non-optimality of the discriminator can produce arbitrarily large biases in the generator gradient [ 20 ] . The primal formulation involves solving for the optimal transport plan—a joint distribution over the real and generated sample spaces . The distance between the two distributions is then measured as the expectation of a point-wise cost function between pairs of samples as distributed according to the transport plan . In general , finding the optimal transport plan is a difficult optimization problem . The entropyregularized Wasserstein distance ( ERWD ) imposes a strongly convex regularization term on the Wasserstein distance , making the OT problem between finite samples solvable in linear time [ 36 ] . Given a positive cost function c : X × X 7→ R+ and λ ≥ 0 , the ERWD is defined as : Wc , λ ( µ , ν ) = min π∈Π ∫ c ( x , y ) dπ ( x , y ) + λ ∫ log ( dπ ( x , y ) dµ ( x ) dν ( y ) ) dπ ( x , y ) ( 1 ) where Π = { π ( x , y ) ∈ P ( X × X ) | ∫ π ( x , · ) dx = ν , ∫ π ( · , y ) dy = µ } . The Sinkhorn divergence uses auto-correlation terms to reduce the entropic bias introduced by ERWD with respect to the exact Wasserstein distance , canceling it out completely for µ = ν ( i.e . Sc , λ ( µ , ν ) = 0 for matching µ = ν ) . This results in faithful matching between the generator and real distributions . Here , we use the Sinkhorn divergence as defined in [ 37 ] . Definition 3.1 . ( Sinkhorn Divergence ) The Sinkhorn divergence between measures µ and ν is defined as : Sc , λ ( µ , ν ) = 2Wc , λ ( µ , ν ) −Wc , λ ( µ , µ ) −Wc , λ ( ν , ν ) ( 2 )

Summary: The paper proposes DP-Sinkhorn, an optimal-transport based generative model for privacy-preserving data generation based on differential privacy.  Optimal transport based generative models minimize variants of the Wasserstein distance, in particular an entropy-regularized version. The Sinkhorn divergence adds an autocorrelation term which cancels out the entropic bias completely when the distance is zero. [36] showed that the gradients of the empirical Sinkhorn loss are biased and proposes using independently drawn samples from the generator, the "debiased" Sinkhorn loss.  This paper proposes the "semi-debiased" Sinkhorn loss which, instead of using independently drawn samples, splits the sample along the batch dimension.   Differential privacy is added by perturbing gradients with the privacy level determined using the RDP accountant.   The method of using the semi-biased Sinkhorn loss with DP is termed DP-Sinkhorn and the paper argues that the lack of adversarial training, as opposed to GANs, avoids training instability and the need for early stopping.   Experimental results indicate better performance on MNIST, Fashion-MNIST and Celeb-A compared to other DP generative models.