PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees

1 INTRODUCTION . More and more large datasets are becoming available in a wide variety of communities . In the U.S. medical community , for example , the fraction of providers using electronic health records ( EHR ) increased from 9.4 % in 2008 to 83.8 % in 2015 [ 20 ] . The availability of large datasets presents enormous opportunities for collaboration between the data-holders and the machine learning community . However , many of these large datasets , especially EHR , include sensitive information that prevents data-holders from sharing the data . The most common way to mitigate the privacy risk of sharing sensitive records is to de-identify the records - but it is by now well-known that records that have been de-identified can be easily re-identified by linking them to other identifiable datasets [ 30 ; 13 ; 24 ; 22 ; 14 ] . ( This is especially true for medical records of patients who have rare diseases . ) However , if the purpose of sharing the data is to develop and validate machine learning methods for a particular task ( e.g . prognostic risk scoring ) , real data is not necessary ; it would suffice to have synthetic data that is sufficiently like the real data . ∗ : Equal contribution Precisely what this means depends on how the synthetic data will be used . For example , the synthetic data may be used to train models that will be deployed directly on real data . In this setting it is important that these methods ( which we trained entirely on synthetic data ) perform as well as if they had been trained on real data . Another setting to consider is one in which data-holders wish to use the synthetic data to identify the best method ( s ) to be used on the real data [ 11 ] . In this setting , it is not important that training on synthetic data leads to good performance on real data , but rather that comparing two methods on the synthetic data results in conclusions similar to those that would have been drawn from comparing the two methods on the real data . We evaluate our method in both settings . Generative Adversarial Networks ( GAN ) [ 19 ] provide a powerful method for using real data to generate synthetic data but it does not provide any rigorous privacy guarantees . Our method modifies the GAN machinery in a way that does guarantee privacy ; the synthetic data is ( differentially ) private [ 12 ] with respect to the original data . To do this we modify the training procedure of the discriminator to be differentially private by using a modified version of the Private Aggregation of Teacher Ensembles ( PATE ) [ 25 ; 26 ] framework . The Post-Processing Theorem [ 12 ] then guarantees that the GAN generator - which is trained only using the differentially private discriminator - will also be differentially private and thus so will the synthetic data it generates . We call our proposed framework PATE-GAN . Using two Kaggle datasets , two different real-world medical datasets and two UCI datasets , we evaluate the utility of the samples generated by PATE-GAN in various settings with various levels of differential privacy . In line with the settings outlined above , we consider two methods for evaluating the similarity of synthetic datasets with a real dataset . The first method , first proposed in [ 15 ] , compares the predictive performance of models trained on the synthetic datasets and tested on the real dataset . The second method , which we propose for the first time here , compares the performance rankings of predictive models on the synthetic datasets with their performance rankings on the real dataset . We demonstrate that , for both of these methods , PATE-GAN consistently produces synthetic datasets that are ” more like ” the original real dataset than the synthetic datasets produced by the state-of-the-art benchmark ( DPGAN [ 32 ] ) . The contributions of this paper can be summarized as follows : ( 1 ) we modify the PATE framework and apply it to GANs to generate synthetic data , ( 2 ) we demonstrate in the experiments section that using PATE to enforce differential privacy results in higher quality synthetic data than DPGAN using various real-world datasets , ( 3 ) we propose a novel new metric for evaluating the generated synthetic data . 2 RELATED WORKS . The most related previous work to this paper is DPGAN [ 32 ] . Like us , DPGAN proposes a framework for modifying the GAN framework to be differentially private , also relying on the PostProcessing Theorem to change the problem of learning a differentially private generator to learning a differentially private discriminator . Their work uses a technique introduced by [ 1 ] that provides a differentially private mechanism for training deep networks . The key idea is that noise is added to the gradient of the discriminator during training to create differential privacy guarantees . These ideas are also used in [ 2 ] . Our method is similar in spirit ; during training of the discriminator differentially private training data is used , which results in noisy gradients , however , we use the mechanism introduced in [ 25 ] which we believe gives tighter differential privacy guarantees ( via tighter bounds on the effect of a single sample ) than those provided in [ 1 ] . This means that for the same privacy guarantees , our method is capable of producing higher quality synthetic data . For a visual representation of both PATE-GAN and DPGAN , see the Appendix . The proposed model modifies the PATE framework [ 25 ; 26 ] for use in a generative model setting ( specifically for use with GANs ) . The key to the GAN framework is that the discriminator is a differentiable module trained to classify samples as either real or generated . The PATE framework provides a differentially private mechanism for classification by training multiple teacher models on disjoint partitions of the data . To classify a new sample each teacher ’ s output is evaluated on the sample and then all outputs are noisily aggregated . This noisy aggregation , though , results in a classifier that is not differentiable with respect to the parameters of the generator . In order to overcome this problem we follow the idea of the student model , also proposed in [ 25 ] , that involves taking some public unlabelled data , labelling it using the standard PATE mechanism and then training the student using the resulting labelled data . Because access to any public data is often an unreasonable assumption in synthetic data generation , we adapt this training paradigm in a way that does not require public data by training the student using only outputs from the ( differentially private ) generator . Some previous works generate synthetic data using summary statistics of the original data [ 23 ] or based on specific domain-knowledge [ 6 ] ; however , those methods are limited to low-dimensional feature spaces , specific fields and do not provide any differential privacy guarantees . [ 9 ] generates synthetic patient records using a GAN framework . However , [ 9 ] focuses only on generating discrete variables , whereas PATE-GAN is capable of generating mixed-type ( continuous , discrete , and binary ) variables . Furthermore , [ 9 ] also does not provide any differential privacy guarantees and instead uses ad-hoc notions of privacy which are only validated empirically . Finally , it is worth remarking that it is known to be hard in the worst-case to generate private synthetic data [ 31 ] and so techniques such as GANs are necessary to address this challenge . 3 BACKGROUND . Let us denote the feature space by X , the label space by Y and write U = X ×Y . Let the dimension of U be d. Suppose that X and Y are random variables over X and Y . We write U = ( X , Y ) and x , y , u to denote realizations of X , Y and U , respectively . The dataset D consists of N samples of u , assumed i.i.d . according to PU denoted as D = { ui } Ni=1 = { ( xi , yi ) } Ni=1 . 3.1 DIFFERENTIAL PRIVACY . We first provide some preliminaries on differential privacy [ 12 ] before describing PATE-GAN ; we refer interested readers to [ 12 ] for a thorough exposition of differential privacy . We will denote an algorithm byM , which takes as input a dataset D and outputs a value from some output space , O . Definition 1 . ( Neighboring Datasets ) Two datasets D , D′ are said to be neighboring if ∃x ∈ D s.t . D \ { x } = D′ . ( 1 ) Definition 2 . ( Differential Privacy ) A randomized algorithm , M , is ( , δ ) -differentially private if for all S ⊂ O and for all neighboring datasets D , D′ : P ( M ( D ) ∈ S ) ≤ e P ( M ( D′ ) ∈ S ) + δ ( 2 ) where P is taken with respect to the randomness ofM . Differential privacy provides an intuitively understandable notion of privacy - a particular sample ’ s inclusion or exclusion in the dataset does not change the probability of a particular outcome very much : it does so by a multiplicative factor of e and an additive amount , δ . The following theorem , a proof of which can be found in [ 12 ] , allows us to move the burden of differential privacy to the discriminator ; the differential privacy of the generator will follow by the theorem . Theorem . ( Post-processing ) LetM be an ( , δ ) -differentially private algorithm and let f : O → O′ where O′ is any arbitrary space . Then f ◦M is ( , δ ) -differentially private . 3.2 PRIVATE AGGREGATION OF TEACHER ENSEMBLES ( PATE ) . In this section we describe the PATE mechanism first defined in [ 25 ] and later improved upon by [ 26 ] . The PATE mechanism provides a differentially private method for classification , a core component of the GAN framework ; the discriminator is a classifier trained to identify whether samples are real/fake . In order to build a differentially private classifier , the dataset is first divided into k disjoint subsets D1 , ... , Dk . k classifiers , T1 , ... , Tk ( referred to as teachers ) are then trained separately on the k sub-datasets ( i.e . Ti is only trained on Di ) . Given a new input feature vector x to classify , the differentially private output is given by passing x to each of the k teachers , and then performing a noisy aggregation of the resulting outputs . Formally , given the k teachers , m possible classes and an input feature vector , x , set nj ( x ) = | { Ti : Ti ( x ) = j } | for j = 1 , ... , m ( 3 ) so that nj ( x ) is the number of teachers that output class j for x . The output of the PATEλ mechanism for input x is then defined as PATEλ ( x ) = arg max j∈ [ m ] ( nj ( x ) + Yj ) ( 4 ) where Y1 , ... , Ym are i.i.d . Lap ( λ ) random variables . The following result , found in [ 25 ] , follows from [ 12 ] . Theorem . The output of a single query to the PATEλ mechanism is ( 1λ , 0 ) -differentially private . In order to apply this framework in the GAN framework , however , we require that the discriminator be differentiable , which the output of this classification mechanism is not ( note that accessing the internal parameters of the teachers would violate differential privacy , the only thing we have access to in this case is the output ) . Instead , we draw on the PATE extension ( also introduced in [ 25 ] ) in which a student model is trained . This student model ( after being trained ) is free to access , not only its outputs given inputs but also its internal parameters . The model itself is differentially private . Formally , the student , S , is a classifier that is trained by taking some public , unlabelled data , P = { xi } Ki=1 , passing each sample , xi , through the ( standard ) PATE mechanism , to receive a differentially private label , ŷi , and forming a new ( noisy- ) teacher-labelled dataset P̂ = { ( xi , ŷi ) } Ki=1 on which the student is then trained . Importantly , we can make the student differentiable - it can be modelled using any classifier , such as a neural net . Moreover , querying the student is “ free ” - there is no privacy cost associated with passing an input to the student and receiving an output , the only privacy cost is in acquiring the data on which to train the student . We state the following result which follows from the analysis in [ 25 ] . Theorem . The student , S , trained on the dataset P̂ where labels were generated according to the PATEλ mechanism using λ = K2 , is ( , 0 ) -differentially private with respect to the original data D .

Summary: The paper studies the problem of generating synthetic datasets (while ensuring differential privacy) via training a GAN. One natural approach is the teacher-student framework considered in the PATE framework.  In the original PATE framework, while the teachers are ensured to preserve differential privacy, the student model (typically a GAN) requires the presence of publicly data samples. The main contribution of this paper is to get around the requirement of public data via using uniformly random samples in [0,1]^d.