Iterative Methods for Private Synthetic Data: Unifying Framework and New Methods

1 Introduction . As the collection and analyses of sensitive data become more prevalent , there is an increasing need to protect individuals ’ private information . Differential privacy [ 15 ] is a rigorous and meaningful criterion for privacy preservation that enables quantifiable trade-offs between privacy and accuracy . In recent years , there has been a wave of practical deployments of differential privacy across organizations such as Google , Apple , and most notably , the U.S. Census Bureau [ 3 ] . In this paper , we study the problem of differentially private query release : given a large collection of statistical queries , the goal is to release approximate answers subject to the constraint of differential privacy . Query release has been one of the most fundamental and practically relevant problems in differential privacy . For example , the release of summary data from the 2020 U.S. Decennial Census can be framed as a query release problem . We focus on the approach of synthetic data generation—that is , generate a privacy-preserving `` fake '' dataset , or more generally a representation of a probability distribution , that approximates all statistical queries of interest . Compared to simple Gaussian or Laplace mechanisms that perturb the answers directly , synthetic data methods can provably answer an exponentially larger collection of queries with non-trivial accuracy . However , their statistical advantage also comes with a computational cost . Prior work has shown that achieving better accuracy than simple Gaussian perturbation is intractable in the worst case even for the simple query class of 2-way marginals that release the marginal distributions for all pairs of attributes [ 38 ] . ∗First two authors contributed equally . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Despite its worst-case intractability , there has been a recent surge of work on practical algorithms for generating private synthetic data . Even though they differ substantially in details , these algorithms share the same iterative form that maintains and improves a probability distribution over the data domain : identifying a small collection of high-error queries each round and updating the distribution to reduce these errors . Inspired by this observation , we present a unifying algorithmic framework that captures these methods . Furthermore , we develop two new algorithms , GEM and PEP , and extend the former to the setting in which public data is available . We summarize our contributions below : Unifying algorithmic framework . We provide a framework that captures existing iterative algorithms and their variations . At a high level , algorithms under this framework maintain a probability distribution over the data domain and improve it over rounds by optimizing a given loss function . We therefore argue that under this framework , the optimization procedures of each method can be reduced to what loss function is minimized and how its distributional family is parameterized . For example , we can recover existing methods by specifying choices of loss functions—we rederive MWEM [ 21 ] using an entropy-regularized linear loss , FEM [ 40 ] using a linear loss with a linear perturbation , and DualQuery [ 19 ] with a simple linear loss . Lastly , our framework lends itself naturally to a softmax variant of RAP [ 5 ] , which we show outperforms RAP itself.2 Generative networks with the exponential mechanism ( GEM ) . GEM is inspired by MWEM , which attains worst-case theoretical guarantees that are nearly information-theoretically optimal [ 11 ] . However , MWEM maintains a joint distribution over the data domain , resulting in a runtime that is exponential in the dimension of the data . GEM avoids this fundamental issue by optimizing the absolute loss over a set of generative models parameterized by neural networks . We empirically demonstrate that in the high-dimensional regime , GEM outperforms all competing methods . Private Entropy Projection ( PEP ) . The second algorithm we propose is PEP , which can be viewed as a more advanced version of MWEM with an adaptive and optimized learning rate . We show that PEP minimizes a regularized exponential loss function that can be efficiently optimized using an iterative procedure . Moreover , we show that PEP monotonically decreases the error over rounds and empirically find that it achieves higher accuracy and faster convergence than MWEM . Incorporating public data . Finally , we consider extensions of our methods that incorporate prior information in publicly available datasets ( e.g. , previous data releases from the American Community Survey ( ACS ) prior to their differential privacy deployment ) . While Liu et al . [ 26 ] has established PMWPub as a state-of-the-art method for incorporating public data into private query release , we discuss how limitations of their algorithm prevent PMWPub from effectively using certain public datasets . We then demonstrate empirically that GEM circumvents such issues via simple pretraining , achieving max errors on 2018 ACS data for Pennsylvania ( at ε = 1 ) 9.23x lower than PMWPub when using 2018 ACS data for California as the public dataset . 1.1 Related work . Beginning with the seminal work of Blum et al . [ 9 ] , a long line of theoretical work has studied private synthetic data for query release [ 33 , 21 , 22 , 20 ] . While this body of work establishes optimal statistical rates for this problem , their proposed algorithms , including MWEM [ 22 ] , typically have running time exponential in the dimension of the data . While the worst-case exponential running time is necessary ( given known lower bounds [ 16 , 36 , 39 ] ) , a recent line of work on practical algorithms leverage optimization heuristics to tackle such computational bottlenecks [ 19 , 40 , 5 ] . In particular , DualQuery [ 19 ] and FEM [ 40 ] leverage integer program solvers to solve their NP-hard subroutines , and RAP [ 5 ] uses gradient-based methods to solve its projection step . In Section 3 , we demonstrate how these algorithms can be viewed as special cases of our algorithmic framework . Our work also relates to a growing line of work that use public data for private data analyses [ 6 , 4 , 7 ] . For query release , our algorithm , GEM , improves upon the state-of-the-art method , PMWPub [ 26 ] , which is more limited in the range of public datasets it can utilize . Finally , our method GEM is related to a line 2We note that Aydore et al . [ 5 ] have since updated the original version ( https : //arxiv.org/pdf/2103 . 06641v1.pdf ) of their work to include a modified version of RAP that leverages SparseMax [ 27 ] , similar to way in which the softmax function is applied in our proposed baseline , RAPsoftmax . of work on differentially private GANs [ 8 , 44 , 30 , 42 ] . However , these methods focus on generating synthetic data for simple downstream machine learning tasks rather than for query release . Beyond synthetic data , a line of work on query release studies `` data-independent '' mechanisms ( a term formulated in Edmonds et al . [ 17 ] ) that perturb the query answers with noise drawn from a data-independent distribution ( that may depend on the query class ) . This class of algorithms includes the matrix mechanism [ 25 ] , the high-dimensional matrix mechanism ( HDMM ) [ 28 ] , the projection mechanism [ 31 ] , and more generally the class of factorization mechanisms [ 17 ] . In addition , McKenna et al . [ 29 ] provide an algorithm that can further reduce query error by learning a probabilistic graphical model based on the noisy query answers released by privacy mechanisms . 2 Preliminaries . Let X denote a finite d-dimensional data domain ( e.g. , X = { 0 , 1 } d ) . Lete U be the uniform distribution over the domain X . Throughout this work , we assume a private dataset P that contains the data of n individuals . For any x ∈ X , we represent P ( x ) as the normalized frequency of x in dataset P such that ∑ x∈X P ( x ) = 1 . One can think of a dataset P either as a multi-set of items from X or as a distribution over X . We consider the problem of accurately answering an extensive collection of linear statistical queries ( also known as counting queries ) about a dataset . Given a finite set of queries Q , our goal is to find a synthetic dataset D such that the maximum error over all queries in Q , defined as maxq∈Q |q ( P ) − q ( D ) | , is as small as possible . For example , one may query a dataset by asking the following : how many people in a dataset have brown eyes ? More formally , a statistical linear query qφ is defined by a predicate function φ : X → { 0 , 1 } , as qφ ( D ) = ∑ x∈X φ ( x ) D ( x ) for any normalized dataset D. Below , we define an important , and general class of linear statistical queries called k-way marginals . Definition 1 ( k-way marginal ) . Let the data universe with d categorical attributes be X = ( X1 × . . .×Xd ) , where each Xi is the discrete domain of the ith attribute Ai . A k-way marginal query is defined by a subset S ⊆ [ d ] of k features ( i.e. , |S| = k ) plus a target value y ∈ ∏ i∈S Xi for each feature in S. Then the marginal query φS , y ( x ) is given by : φS , y ( x ) = ∏ i∈S 1 ( xi = yi ) where xi ∈ Xi means the i-th attribute of record x ∈ X . Each marginal has a total of ∏k i=1 |Xi| queries , and we define a workload as a set of marginal queries . We consider algorithms that input a dataset P and produce randomized outputs that depend on the data . The output of a randomized mechanismM : X ∗ → R is a privacy preserving computation if it satisfies differential privacy ( DP ) [ 15 ] . We say that two datasets are neighboring if they differ in at most the data of one individual . Definition 2 ( Differential privacy [ 15 ] ) . A randomized mechanism M : Xn → R is ( ε , δ ) differentially privacy , if for all neighboring datasets P , P ′ ( i.e. , differing on a single person ) , and all measurable subsets S ⊆ R we have : Pr [ M ( P ) ∈ S ] ≤ eεPr [ M ( P ′ ) ∈ S ] + δ Finally , a related notion of privacy is called concentrated differential privacy ( zCDP ) [ 14 , 10 ] , which enables cleaner composition analyses for privacy . Definition 3 ( Concentrated DP , Dwork and Rothblum [ 14 ] , Bun and Steinke [ 10 ] ) . A randomized mechanismM : Xn → R is 12 ε̃ 2-CDP , if for all neighboring datasets P , P ′ ( i.e. , differing on a single person ) , and for all α ∈ ( 1 , ∞ ) , Rα ( M ( P ) ‖ M ( P ′ ) ) ≤ 1 2 ε̃2α where Rα ( M ( P ) ‖ M ( P ′ ) ) is the Rényi divergence between the distributionsM ( P ) andM ( P ′ ) .

Summary: # Summary of contributions  The paper studies the problem of synthesizing differentially private (DP) data for query release. Here we are given a sensitive dataset $P$ together with a set $\mathcal{Q}$ of queries of interest. The goal is to generate a DP synthetic dataset $D$ so that answering the queries using $D$ gives similar answers to those of $P$; more formally, we want to minimize the maximum error across the queries, i.e. $\max_{q \in \mathcal{Q}} |q(P) - q(D)|$. Several works have proposed algorithms for this problem, including MWEM [Hardt et al., NeurIPS'12] and FEM [Vietri et al., ICML'20].  The first contribution of the paper is in observing that essentially the previously proposed algorithms all fit into a single framework which they call "Adaptive Measurements". Specifically, the algorithm proceeds in iterations and, in each iteration, it uses the exponential mechanism to select one or more queries, asks for noisy values of those queries and it then updates the current synthetic dataset $D$ by minimizing some objective (which involves the answers to the queries so far and the current guess dataset).  With the above in mind, the authors then decide a new algorithm which fits into this framework called Private Entropy Projection (PEP) algorithm. At each step, PEP tries to find the distribution $D$ with maximum entropy among those whose max error w.r.t. the noisy measurements is at most $\gamma$ for some parameter $\gamma$. The authors note that PEP also gives exponentially weighted distributions, similar to MWEM, but the weights are more elaborated. Empirically, the authors show that PEP performs better than MWEM when $\epsilon$ is sufficiently large (and performs similarly for small $\epsilon$) on reduced versions of ADULT and ACS datasets for 3-way marginal queries.  The reason a reduced version of those datasets are used is because the original datasets have high-dimension, which is infeasible for MWEM or PEP since they have to keep the entire distribution explicitly. To overcome this, the authors propose a different algorithm called GEM which instead assume that the distribution is generated to some network $G_\theta$ with parameter $\theta$ (assuming that the inputs to the network is i.i.d. Gaussian). This can help reduce the computational cost dramatically since now only the network parameters $\theta$ is needed to be maintained. Here, GEM still works in the "Adaptive Measurements" framework and the authors use gradient descent to minimize the $\ell_1$ loss w.r.t. the noisy measurements so far. Note that this might not be easily differentiable for generic queries; fortunately, for k-way marginal queries, the authors point out that they are just product of the network's outputs and as a result the gradient can be easily found.  Finally, the authors consider the setting where there is some public data which one hopes to use to improve the quality of the synthetic dataset. Previous state-of-the-art called PMW$^{Pub}$ [Liu et al., 2021] simply uses limits the distribution to only those on the _support_ of the public data and runs MWEM. This has several limitations, such as when the support of the public data is not sufficient to express the sensitive data, or when some features are missing in the public dataset. The authors show that a modified version of GEM (called GEM$^{Pub}$) is more amenable for these cases: just use the public data to find an initial generator network, and then proceed with the GEM algorithm as usual. They demonstrate that this approach indeed works well in practice: although the performances of GEM$^{Pub}$ and PMW$^{Pub}$ are similar for large & similarly-distributed public data, GEM$^{Pub}$ significantly outperforms PMW$^{Pub}$ when public data is incomplete or its support not closely resembling the sensitive data.