Scalable Differentially Private Data Generation via Private  Aggregation  of  Teacher Ensembles
Authors: Yunhui Long
Suxin Lin
Zhuolin Yang
Carl A. Gunter
Han Liu
Bo Li
Venue:  (2020)

Abstract: We present a novel approach named G-PATE for training differentially private data generator. The generator can be used to produce synthetic datasets with strong privacy guarantee while preserving high data utility. Our approach leverages generative adversarial nets  to generate data and exploits the PATE (Private Aggregation of Teacher Ensembles) framework to protect data privacy. Compared to existing methods, our approach significantly improves the use of privacy budget.  This is possible since we only need to  ensure differential privacy for the generator, which is the part of the model that actually needs to be published for private data generation.  To achieve this, we connect a student generator with an ensemble of teacher discriminators and propose a private gradient aggregation mechanism to ensure differential privacy on all the information that flows from the teacher discriminators to the student generator. Theoretically, we prove that our algorithm ensures differential privacy for the generator.   Empirically, we provide thorough experiments to demonstrate the superiority of our method over prior work on both image and non-image datasets.

Under review as a conference paper at ICLR 2020
SCALABLE DIFFERENTIALLY PRIVATE DATA GENER- ATOR VIA PRIVATE AGGREGATION OF TEACHER DIS- CRIMINATORS
Anonymous authors Paper under double-blind review
ABSTRACT
We present a novel approach G-PATE for training a scalable differentially private data generator, which can be used to produce synthetic datasets with strong privacy guarantee while preserving high data utility. Our approach leverages generative adversarial nets to generate data and exploits the PATE (Private Aggregation of Teacher Ensembles) framework to protect data privacy. Compared to existing methods, our approach significantly improves the use of privacy budget. This is possible since we only need to ensure differential privacy for the generator, which is the part of the model that actually needs to be published for private data generation. In particular, we connect student generator with an ensemble of teacher discriminators and propose a private gradient aggregation mechanism to ensure differential privacy on all the information that flows from the teacher discriminators to the student generator. Theoretically, we prove that our algorithm ensures differential privacy for the generator. Empirically, provide thorough experiments to demonstrate the superiority of our method over prior work on both image and non-image datasets.
INTRODUCTION
Machine learning has been applied wide range of applications such as face recognition (Parkhi et al. 20155, autonomous driving (Menze & Geiger] 2015), and medical diagnoses (de Bruijne] [0016] Kourou et al., 2015). However, most learning methods rely on the availability of large-scale training datasets containing sensitive information such as personal photos or medical records. Therefore, such sensitive datasets are often hard to be shared due to privacy concerns. To handle this challenge, data providers sometimes release synthetic datasets produced by generative models learned on the original data. Though recent studies show that generative models such as generative adversarial networks (GAN) (Goodfellow et al. 2014) can generate synthetic records that are indistinguishable from the original data distribution, there is no theoretical guarantee on the privacy protection. While privacy definitions such differential privacy (Dwork & Feldman, 2018) and Rényi differential privacy (Mironov] 2017) provide rigorous privacy guarantee, applying them to synthetic data generation is nontrivial.
Recently, two approaches have been proposed to combine differential privacy with synthetic data generation: DP-GAN (Xie et al. 2018) and PATE-GAN (Yoon al.) 2019). DP-GAN modifies GAN by training the discriminator using differentially private stochastic gradient descent. Though it achieves privacy guarantee due to the post processing property (Dwork et al., 2014) of differ- ential privacy, DP-GAN incurs significant utility loss on the synthetic data, especially when the privacy budget is low, In contrast. PATE-GAN trains differennially private GAN using the PATE mechanism (Papernot et al., 2017). Specifically, it first trains set of teacher discriminators and then train a student discriminator based on the trained ensemble of teacher discriminators. To ensure differential privacy, the student discriminator is only trained on records that are produced by the generator and labeled by the teacher discriminators. The key limitation of this approach is that relies on the assumption that the generator would be able to generate the entire "real" records space to bootstrap the training process. If most of the synthetic records are labeled as fake by the teacher discriminators, the student discriminator would be trained on a biased dataset and fail to learn the true data distribution. Consequently, this trained generator would not be able to produce high-quality synthetic data. This problem does not exist on traditional GAN, where the discriminator is always

---

Under review as a conference paper at ICLR 2020
able to provide useful information to the generator since they can access the real data records rather than the synthetic data only. In addition, the two stage training process of PATE-GAN makes it less scalable or flexible in terms of varying the number of teacher discriminators.
The main contribution of this paper is new approach named G-PATE for training a differentially private data generator by combining the generative model with PATE mechanism. Our approach is based on the key observation that: It is not necessary to ensure differential privacy for the discrimina- tor in order train differentially private generator. As long as we ensure differential privacy on the information flow from the discriminator to the generator, it is sufficient to guarantee the privacy property for the generator. To achieve this, we propose a private gradient aggregation mechanism to ensure differential privacy on all the information that flows from the teacher discriminators to the student generator. Compared to PATE-GAN, our approach has three advantages. First, we improve the use of privacy budget by only applying it to the part of the model that actually needs to be released for data generation. Second, our discriminator can be trained on original data records since it does not need to satisfy differential privacy. Finally, G-PATE is much more scalable given its simple framework architecture.
Theoretically, we show that our algorithm ensures differential privacy for the generator. Empirically, we conduct extensive experiments on the standard Kaggle credit card fraud detection dataset, as well as two image datasets MNIST and Rashion-MNIST The results show that our method significantly outperforms all baselines including DP-GAN and PATE-GAN in terms of data utility.
2 RELATED WORK
Differential privacy (Dwork 2008) is notion that ensures algorithm outputs general information about its input dataset without revealing individual information. Rényi differential privacy (Mironov) 2017) is relaxation of differential privacy that allows tighter analysis on the composition of privacy budgets. Following the work of differential privacy, researchers have proposed different methods to design differentially private statistical functions and machine learning models (Bassily al.
2014 Chaudhuri et al., 2011 Abadi et al., 2016; McSherry & Talwar 2007| |Friedmnn & Schuster 2010 Recently, various approaches have been proposed for differentially private data generation.
Priview (Qardaji et al., 2014) generates synthetic data based on marginal distributions of the original dataset, and PrivBayes (Zhang et al.] 2017) trains a differentially private Bayesian network. However, these approaches are not suitable for image datasets since the statistics they use cannot well preserve the correlations between pixels in an image.
Both DP-GAN (Xie et al. 2018) and PATE-GAN (Yoon et al. 2019) apply differential privacy to the training process of generative adversarial networks. They both ensure differential privacy while training the discriminator, and the privacy property of the generator is guaranteed by the post processing property of differential privacy. Unlike their approaches, our method improves the use of privacy budget by only ensuring differential privacy the generator, which is the part that actually needs to be released for synthetic data generation. This improvement allows us to incur much lower utility loss on the synthetic data under the same privacy constraint.
Private aggregation of teacher ensembles (PATE) is a method to train a differentially private classifier using ensemble mechanisms. It first trains an ensemble of teacher models on disjoint subsets of the sensitive training data. Then, a differentially private student model is trained on public data labeled by the teacher models. The privacy guarantee of PATE is more intuitive understand because no teacher model can dictate the training of the student model. Compared to most differentially private classification method, PATE benefits from a tighter data-dependent privacy bound especially when teacher models are likely to reach consensus. Scalable PATE (Papernot et al.) 2018) improves the utility of PATE with a Confident-GNMax aggregator that only returns a result if it has high confidence in the consensus among teachers. However, both PATE and Scalable PATE relies on the availability of public unlabeled data, and their aggregators are only applicable to categorical data (i.e., class labels). In contrast, our method does not rely on any public dataset and can generate synthetic samples that are differentailly private with respect to the private training dataset. We also design a differentially private gradient aggregator that works for continuous gradient vectors.
2

---

Under review as a conference paper at ICLR 2020
3 BACKGROUND
We recall the definition of differential privacy (DP), Rényi differential privacy (RDP), and some of their properties.
3.1 DIFFERENTALL PRIVACY
Differential privacy bounds the shift in the output distribution of randomized algorithm that could be caused by a small input perturbation. The following definition formally describes this privacy guarantee.
Definition ((E, D)ffirrrrent Privacy), A randomized algorithm .M with domain N is (c, 6)- differentially private if for all S S Range(M) and for any neighboring datasets D and D':
Pr(M(D) E S] S exp(s) E S] -
3.2 RÉNYI DIFFERENTIAL PRIVACY
Rényi differential privacy is natural relaxation of differential privacy. Defined below, its privacy guarantee is expressed terms of Rényi divergence.
Definition ((A,E)-RDP) A randomized mechanism M said guarantee (A,e)-RDP with À if for any neighboring datasets D and D',
Pr(M(D) = z] [M
Dy (DD) - log E.gE
S
(X,E)-RDP implies (Es, 8)ddifferential privacy for any given probability 5> 0. Theorem (From RDP to DP). mechanism M guarantees (A,e)-RDP, then M guarantees (e + X-I diffffeerlt privacy for any (0, 1).
log 1/5
Compared to DP, RDP supports easier composition of multiple queries and clearer privacy guarantee under Gaussian noise. Specifically, RDP could be easily composed by adding the privacy budget:
Theorem 2 (Composition of RDP). If mechanism M consists of sequnce of M,,..., such that for any i [k], M, guarantees (A, RDDD,,,,, then M guarantees Ex Eh, RDD-
Suppose f is real-valued function, and the Gaussian mechanism is defined follows:
G.f( f + N (0.a²),
where N o2) ( normally distributed random variable with standard deviation o and mean 0. The Gaussian mechanism provides the following RDP guarantee:
Theorem (RDP Guarantee for Gaussian Mechanism). I has sensitiviry 1, then the Gaussian mechanism fof satisfies (A. (2o²)) -RDP.
THE G-PATE METHOD
In this section, we present our method named G-PATE. An overview of the method is shown in Figure I Unlike PATE-GAN and DP-GAN, G-PATE ensures differential privacy for the information flow from the discriminator to the generator. This improvement incurs less utility loss on the synthetic samples, so it can generate synthetic samples for higher dimensional and more complex datasets.
G-PATE makes two major modifications on the training process of GAN. First, we replace the discriminator in GAN with ensemble of teacher discriminators trained disjoint subsets of the sensitive data. The teacher discriminators do not need to be published, thus can be trained using non-private algorithms. In addition, design gradient aggregator to collect information from teacher discriminators and combine them in a differentially private fashion. The output of the aggregator is gradient vector that guides the student generator to improve its synthetic samples.
3

---

Under review as a conference paper at ICLR 2020
Synthetic Samples
Teacher Discriminators
Teacher
Data
Adversarial Perturbations
Differentially Private Gradient
Student Data Generator
Aggregator
Teacher 2
Data
Teacher 3
Sensitive Data
Accesible by Adversary
Not Accesible by Adversary
Teacher n
Data
Data Flow
Training
Gradient
Figure I: Model Overview of G-PATE. The model contains three parts: student data generator,
differentially private gradient aggregator, and an ensemble of teacher discriminators.
Unlike PATE-GAN, G-PATE does not require any student discriminator, The teacher discriminators are directly connected the student generator. The gradient aggregator sanitizes the information flow from the teacher discriminators to the student generator to ensure differential privacy. This way. G-PATE uses privacy budget more efficiently and better approximates the real data distribution to ensure high data utility.
4.1 TRAINING THE STUDENT GENERATOR
To achieve better privacy budget efficiency, G-PATE only ensures differential privacy for the generator and allows the discriminators to learn private information. The privacy property achieved by sanitizing all information propagated from the discriminators to the generator. To ease privacy analysis, decompose G-PATE into three parts: the teacher discriminators, the student generator, and the gradient aggregator. To prevent the propagation of private information, the student generator does not have direct access any information any of the teacher discriminators. Consequently, we cannot train the student generator by ascending its gradient based on loss of the discriminators. To solve this problem, we propose the use of adversarial perturbation, which is small manipulation on the fake record x that causes the discriminator's loss on increase. The adversarial perturbation is calculated by ascending æ's gradients on the loss of the discriminator. teaches the student generator how to improve its fake records. In each training iteration, the student generator is updated in three steps: (1) A teacher discriminator generates adversarial perturbations for each record produced by the student generator. (2) The gradient aggregator takes the adversarial perturbations from all teacher models and generates differentially private aggregation of them. (3) The student generator updates its weights based the privately aggregated adversarial perturbation. The process is formally presented in Algorithm[]
Generating Adversarial Perturbations. Let D be teacher discriminator. Given fake record æ, we use p (z) to represent D's loss on z. In each training iteration, the weights of D are updated by descending their stochastic gradients on Lp.
For each input fake record we generate an adversarial perturbation Ar that guides the student generator on improving its output. By applying the perturbation on its output, the student generator would get an improved fake record å = x + Ar on which D has a higher loss. Therefore, Ar is calculated z's gradients on Lp:
(Lp(a)
T
(I)
da
4

---

Under review as a conference paper at ICLR 2020
Algorithm 1 Training the Student Generator. The student generator is jointly trained with an ensemble teacher discriminators. In each iteration, the student generator updates its weights based aggregated adversarial perturbation generated by the teacher ensemble.
Require: batch size number of teacher models number of training iterations N, gradient clipping constant c, number of bins B. projected dimension k, noise parameters 01 and d2. threshold T, disjoint subsets of sensitive data d1, dn
1: for number of training iterations do
2: Sample m noise samples {21, 22..... 2m
3: Generate fake samples {G(z1), G(zz), G(zm))
4: for E (I,...,7I) n do
5: Sample m data samples {01 ................................ Fm from dN
6:
Update the teacher discriminator D, by descending its stochastic gradient on CD, on both fake samples and real samples
7:
for j E (1...., m) do
8:
Calculate the adversarial perturbation Azy) 2ÿ gradients on L (2,) end for end for
9:
11:
for j E (1....,m)] m) do
Azy DD Arf").... ..... A.,") ca,.A,,,,,,B........ (.B.k,o,
Bj c GG(()) Anz 14: end for
15: Update the student generator G by descending stochastic gradient on La on f2,, 4m)
16:
end for
17:
return G
With the adversarial perturbation Az, the student generator can be trained without direct access to the discriminator's loss.
Updating the Student Generator. student generator G learns to map a random input = to a fake record x: G(2) that z: is indistinguishable from real record by D. Given adversarial perturbation Ar, the teacher discriminators have higher loss on the perturbed fake record 4 = x + Ar compared the original fake record æ. Therefore, the student generator learns improve its fake records by minimizing the mean squared error (MSE) between its output G(2) and the perturbed fake record ft
1 Σ (G(=), -.,)
Co(2, 5)
where & is the number of synthetic records generated per training iteration. To ensure differential privacy, instead of receiving the adversarial perturbation from single discriminator, we train the student generator using a differentially private gradient aggregator that combines adversarial perturbations from multiple teacher discriminators. Details are provided in Section 4.2
4.2 DIFFERENTIALLY PRIVATE GRADIENT AGGREGATION FOR G-PATE
G-PATE consists of a student generator and an ensemble of teacher discriminators trained on disjoint subsets the sensitive data. In each training iteration, each teacher discriminator generates an adversarial perturbation Ar that guides the student generator improving its output records. Different from traditional GAN, G-PATE, the student generator does not have access the loss of any teacher discriminators, and the adversarial perturbation is the only information propagated from the teacher discriminators to the student generator. Therefore, to achieve differential privacy, suffices to add noise during the aggregation of the adversarial perturbations.
However, the aggregators used in PATE and GATN are not suitable for aggregating gradient vectors because they are only applicable to categorical data. Therefore, propose a differentially private gradient aggregator (DPGr adAgg) based on PATE. With gradient discretization, we convert gradient aggregation into voting problem and get the noisy aggregation of teachers' votes using
5

---

Under review as a conference paper at ICLR 2020
PATE. Additionally, we random projection to reduce the dimension of vectors which the aggregation is performed. The combination of these two approaches allows G-PATE to generate synthetic samples with higher data utility, even for large scale image datasets, which is hard to be achieved by PATE-GAN, The procedure is formally presented in Algorithm
Algorithm 2 - Differentially Private Gradient Aggregator (DPGradAgg). This algorithm takes a list of gradient vectors and returns a differentially private aggregation of them.
Require: gradient vectors { (Aa(1, Ar 1.... .....
Ar(m)) J. gradient clipping constant c, number of bins B. projected dimension k, noise parameters and Ø2, threshold T
1: kn < the dimension of Az(1)
2: R + a ko by / random projection matrix with each component randomly drawn from N(0, +
3: (Au(1), Au(2)..... A < (Ax(1) R, (x R...., Ar(()) R}
4: Au +- empty list
5: for j E 1,.....,k do
6: t vector containing the jth element of all gradients in (Au(), Au(?) ...., Au(n))
7:
Clip v to t-
8:
h the histogram of with B bins of width 26
9:
j + f-Coffident -NMaax σi, 02. T)
10: Append the midpoint of the j-th bin Au
11: end for
Az f- AURT
13: return Ar
Gradient Discretization. Since PATE is originally designed for aggregating the teacher models' votes on the correct class label of example, the aggregation mechanism PATE only applies to categorical data. Therefore, we design three-step algorithm to apply PATE on continuous gradient vectors. First, we discretize the gradient vector by creating histogram and mapping each element to the midpoint of the bin it belongs to. Then, instead of voting for the class labels as in PATE, teacher discriminator votes for & bins associated with it elements in its gradient vector. Finally, for each dimension, we calculate the bin with most votes using the Con f dent -aMMx aggregator (Papernot et al.) 2018) (Algorithm ij Appendix A.4). The aggregated gradient vector consisted of the midpoints of the selected bins.
With gradient discretization, the teacher discriminators can directly communicate with the student generator using the PATE mechanism. Since these teacher discriminators are trained real data, they can provide much better guidance to the generator compared to the student discriminator in PATE- GAN, which is only trained on synthetic samples. Moreover, the Conf fent -GNMax aggregator ensures that the student generator would only improve its output in the direction agreed by most of the teacher discriminators.
Random Projection. Aggregation of high dimensional vectors is expensive in terms of privacy budget because private voting needs be performed on each dimension of the vectors. To save privacy budget, we use random projection (Bingham & Mannila, 2001) to reduce the dimensionality of gradient vectors. Before the aggregation, we generate random projection matrix with each component randomly drawn from a Gaussian distribution. We then project the gradient vector into a lower dimensional space using the random projection matrix. After the aggregation, the aggregated gradient vector is projected back to its original dimensions. Since the generation of random projection matrix inteeinndeeendtt. does not consume any privacy budgets.
Random projection is shown to be especially effective on image datasets. Since different pixels of an image are often highly correlated, the intrinsic dimension of an image is usually much lower than the number of pixels (Gong et al., 2018). Therefore, random projection maximizes the amount of information a student generator can get from a single query to the Confident -CNMax aggregator, and makes it possible for G-PATE to retain reasonable utility even high dimensional data. Moreover, random projection preserves similar squared Euclidean distance between high-dimensiioal vectors, therefore is beneficial privacy protection both theoretically and empirically (Xu et al. 2017).

---

Under review as a conference paper at ICLR 2020
5 THEORETICAL GUARANTEES
In this section, we provide theoretical guarantees the privacy properties for G-PATE. To start with, we propose the following definition for a differentially private data generative model.
Definition 3 (Differentially Private Generative Model), Let G be a generative model that maps set of points Z in the noise space Z set of records X in the data space dataset of G and A : DD + G' be the training algorithm. We say that G is a (s, -)-differentially private data generative model if the training algorithm A is (e, diffeernentl private.
X. Let D be the training
Definition 3 relaxes the definition of DP-GAN by focusing the protection only on the generative model in GAN. This relaxation saves privacy budget during training and improves the utility of the model. Moreover, the relaxation does not compromise the privacy guarantee for the synthetic data.
Theorem 4 shows that differentially private generative model is able to support infinite number of queries to data generator and can be used to generate multiple synthetic datasets.
Theorem 4. Let G be an (e, difffereent private data generative model trained on a private dataset D. For any Z E Z, the synthetic dalaset X ( difffrrential private.
is
Theorem consequence of the post-processing property of differential privacy. First, the random points Z are independent of the private dataset D. Second, one does not need to query the diseriminator during the data generation process. Therefore, the synthetic dataset generated by post-processing G and is guaranteed to be (c, diifferereel private.
The next theorem justifies the Rényi differential privacy the G-PATE method.
Theorem (Rényi Differential Privacy of G-PATE). Lel A be the training algorithum for the student with N training iterations and k projected dimensions. The data date-dependent generator (Algorithm Z
Rényi disferential privacy for A with orler X > is & = Eigien (Eisis (i.) where Bi,5 is the data-depnndet Rényi differential privacy for the Confident GNMax aggregator in the i-th iteration on the j-th projected dimension.
Theorem 5 holds because of the composition theorem of Rényi differential privacy (Theorem 2 in Appendix A.4). During the training process, the student generator accesses information about sensitive dataset through the Con f diden-GnNMM. aggregator. It submits A queries per training iteration. Therefore, the Rényi differrnniial privacy budget the training algorithm a composition of the data-dependent Rényi differential privacy budget of the Conf Confidents GNMax aggregator over dimensions and iterations. The data-dependent privacy budget for each Con fident -addentt-Maaxx aggregation is dependent d1, 02, and threshold T. We include the analysis in Appendix [A.4 The remaining parameters (e.g. gradient clipping constant c, number of bins B) do not influence the privacy guarantee.
The next theorem provides a theoretical guarantee on the differential privacy of the G-PATE method.
Theorem 6 (Differential Privacy of G-PATE). Given sensitive dataset D and parameters 0 < < 1, let G be the student generator trained by Algorithm / There exists ε > 0 and X > so that G is log 1/8 d)dfiffernttially private data generative model.
(E +
X-1
Theorem is the consequence of converting the Rényi differential privacy guarantee in Theorem 5 to differential privacy (Theorem in Appendix A.4).
EXPERIMENTAL EVALUATION
We evaluate G-PATE against two state-of-the-at benchmarks: DP-GAN and PATE-GAN. To compare the performance of different data generators, train classifier on the synthetic data and test it on the original data to benchmark the quality of the synthetic data.
We first perform comparative analysis with PATE-GAN and DP-GAN the datasets used in the corresponding works (i.e., Kaggle credit dataset and MNIST dataset). addition, we evaluate G-PATE on the MNSiT dataset consisting of real-world images of clothes.
7

---

Under review as a conference paper at ICLR 2020
Table 1: Performance Comparison on Kaggle Credit Dataset. The table presents AUROC of classifier trained on synthetic data and tested on real data. The evaluation results for PATE-GAN and DP-GAN are recorded in Yoon et al. (2019). We evaluate G-PATE under the same experimental setup. PATE CATE,GAN, DP-GAN, and PA-ATEE all satisfy (1, 10 10,00-))diifein -difffereeti privacy. The best results out of different models are bolded.
GAN
PATE-GAN
DP-GAN
G-PATE
Logistic Regression
0.9430
0.8728
0.8720
0.9251
AdaBoost (Freund et al.. 1996)
0.9416
0.8959
0.8809
0.8981
Bagging (Breiman 1996)
0.9379
0,8877
0.8657
0.8964
Multi-layer Perceptron
0.9444
0.8925
0.8787
0.9093
Average
0.9417
0.8872
0.8743
0.9072
6.1 EXPERIMENTAL SETUP
To compare with PATE-GAN, we use the same Kagele credit card fraud detection dataset (Dal Pozzolo
et al. 2015) (Kaggle Credit) as in Yoon et al. (211)) | The dataset contains 284,807 samples representing transactions made by European cardholders credit cards in September 2013, and 492 (0.2%) of these samples are fraudulent transactions. Each sample consists of 29 continuous features which are the results of a PCA transformation from the original features.
To demonstrate the superiority of G-PATE to PATE-GAN on high dimensional image datasets, we train G-PATE on the MNIST and Reshion-MNISY datasets (Xiao et al., (017). Each of them consists of 60,000 training examples and 10,000 testing examples. Each example is 28 x 28 grayscale image, associated with a label from 10 classes. The examples in the MNIST dataset are images of handwritten digits between 0 and 9, and the examples in the Bashion-MNIS, dataset are real-wor world images of clothes taken from the Zalando articles. Fashion- -NNIST is proposed as a replacement for the MNIST dataset because it better represents modern computer vision tasks.
For the Kaggle Credit dataset, both the generator and discriminator networks of G-PATE are fully con- nected neural network with the same architecture as PATE-GAN (Yoon et al. 2019). We use random projection with 5 projected dimensions during gradient aggregation. We use the DCGAN (Radford al., (0155) structure on both MNIST and MaNSI We use random projection with 10 projected dimensions during gradient aggregation. More details are provided in Appendix A.5
6.2 COMPARISON WITH DP-GAN AND PATE-GAN
Kaggle Credit. The Kaggle Credit dataset is highly unbalanced. In PATE-GAN, the ratio between positive and negative classes in the sensitive training set assumed to be public information. In con- trast, the G-PATE method does not rely any public information about the sensitive training dataset. calculates the ratio between positive and negative classes using Laplacian mechanism (Dwork et al., 2014) with 0.01. We then train (0.99, 10 10--))-differooooo -diifferentialyy private data generator and sample the synthetic records according to the noisy class ratios. By the composition theorem of differential privacy (Dwork et al. 2014), the data generation mechanism is (1, 10-5)
i -differentially private.
To compare with PATE-GAN, we select 4 commonly used classifiers evaluated in Yoon et al. (2019). The performance of a generator is measured by the AUROC of the classifiers trained the corresponding synthetic data. We evaluate G-PATE under the same experimental setups as PATE- GAN for 1 The results for PATE- BATE-GAN and DP-GAN are from Yoon al. (2019). and we get higher baseline performance from GAN compared to the bascline performance reported in Yoon et al.
(2019).
Table 6 presents the comparative analysis between G-PATE and PATE-GAN on Kaggle Credit dataset. G-PATE outperforms both PATE-GAN and DP-GAN and is close to the original GAN which has no privacy protection. The good performance of G-PATE is partly due to the relatively low dimensionality of the Kaggle Credit dataset and the abundance of training examples. More experimental results on Kaggle Credit dataset are presented in Appendix A.
"PATE-GAN docs not open source, so we directly compare with the results they reported. We reproduce the experimental setups of PATE-GAN the hest of our knowledge according the paper.
8

---

Under review as a conference paper at ICLR 2020
Table 2: Performance Comparison on Image Datasets. We compare G-PATE with DP-GAN and GAN on MNIST and Eashion-MNIST datasets. The table presents the 10-class classification accuracy of a model trained on synthetic data and tested on real data. DP-GAN and G-PATE are both evaluated under two private settings: 1,6 10-5 and 10,8 10-5.
Dataset
GAN
DP-GAN
G-PATE
0.4036 (8 1)
0.5631 (e =
MNIST
0.9653 (s oo)
0.8011 (E 10)
0.8092 (E 10)
0.1053 (E
0.5174
FaSHion-MNIST
0.8032 (s oo)
0.6098 10)
0.6934 (E 10)
MNIST and Fashion-MNIST. To understand G-PATE's performance on image datasets, we per- form comparative analysis between G-PATE and DP-GAN on the MNIST and Fashion-MNIST dataset: We evaluate the generator by the 10-class classification accuracy of models trained synthetic data and tested on real data (Table 2} The analysis performed under two performance settings: 1, 10-5 and e 10, 5 10 G-PATE outperforms DP-GAN under both settings, and there is a more significant improvement for the setting with stronger privacy guarantee (i.c., E 1). Specifically, we observe that DP-GAN fails to converge on the Fashion-MNIST dataset with E = 1. The synthetic records generated by DP-GAN under this setting are close to random noise while the model trained on G-PATE generated data retains an accuracy of 51.74%.
2
Lee
Figure Visualization of generated instances by G-PATE. Row (real image), row (s 10, = 10 10-5) and row 3 (s = 1, = 10 10-5) each presents one image from each class (the left columns are MNIST images, and the right 5 columns are FaSSion-MNIST images). When & = 1, G-PATE does not generate high-quality images. However, it preserves partial features in the training images, so the synthetic images are useful to preserve data utility which can be seen from our quantitative results.
Analysis the Number of Teachers and the Projection Dimensions. We perform comprehen- sive ablation studies on the number of teachers and the the projection dimensions to gain better understanding about G-PATE. As shown in Table 3, G-PATE benefits from having more teacher discriminators. Under the same privacy guarantee, the number of noisy votes (a1 and σ2) remains the same, the output of the noisy voting algorithm is more likely to be correct, and the model would get better performance. However, this benefit diminishes as the training set for each teacher model gets smaller with the increasing number of teachers, and 4000 teachers have already achieved satisfiable results. Table 3 also demonstrates the effectiveness of the random projection method, which improves the classification accuracy by around 0.45.
We are unable perform comparative study with PATE-GAN image datasets because PATE-GAN does not report any results images.

---

Under review as a conference paper at ICLR 2020
Table 3: Analysis on the Number of Teachers and the Projection Dimensions. We performed comprehensive studies on the number of teachers and the the projection dimensions on MNIST with ε 1 and 6 10-6, The model has the best performance with 4000 teacher models and projection dimension equals to 10.
Projection Dimensions
# of Teachers
5
10
20
No Projection
2000
3000
4000
MNIST
0.4638
0.5631
0.5604
0.1141
0.4240
0.5218
0.5631
Fashion
0.5129
0.5174
0.5172
0.1268
0.3997
0.4874
0.5174
7 CONCLUSION
This paper proposes G-PATE, a novel approach for training a differentially private data generator by ensuring privacy property the information flow from the discriminator generator in GAN. G-PATE is enabled by differentially private gradient aggregation mechanism combined with random projection. It significantly outperforms prior work both image and non-image datasets. Moreover, G-PATE retains reasonable utility on complex image dataset for which DP-GAN can hardly converge.
10

---

Under review as a conference paper at ICLR 2020
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318 ACM, 2016.
Racf Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In Foundations of Computer Science (FOCS), 2014 IEEE 55th
Annual Symposium on, pp. 464 473. IEEE, 2014.
Ella Bingham and Heikki Mannila. Random projection dimensionality reduction: applications to image and text data. In Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining. pp. 245-250, ACM, 2001.
Leo Breiman. Bagging predictors. Machine learning, 24(2):123-140, 1996.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Leurning Research, 12(Mar):1099-1109 2011.
Andrea Dal Pozzolo, Olivier Caelen, Reid A Johnson, and Gianluca Bontempi. Calibrating prob- ability with undersampling for unbalanced classification. In 2015 IEEE Symposium Series on Computational Intelligence, pp. 159-166. IEEE, 2015.
Marleen de Bruijne. Machine learning approaches in medical image analysis: From detection to diagnosis, 2016.
Cynthia Dwork. Differential privacy: A survey of results. In International Conference on Theory and Applications of Models of Computation, pp. 1-19. Springer, 2008
Cynthia Dwork and Vitaly Feldman. Privacy-preserving prediction. arXiv preprint arXiv: 10266. 2018.
Cynthia Dwork, Aaron Roth, al. The algorithmic foundations of differential privacy. Foundations and Rrends in Theoretical Computer Science, 9(3-4):211-407, 2014.
Yoav Freund, Robert E Schapire, et al. Experiments with new boosting algorithm. In icml, volume 96, pp. 148-156. Citeseer, 1996.
Arik Friedman and Assaf Schuster. Data mining with differential privacy. In Proceedings of the 16th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 402-502. ACM, 2010.
Sixue Gong, Vishnu Naresh Boddeti, and Anil K. Jain. On the intrinsic dimensionalityy of face repre- sentation. CoRR, abs/1803.09672. 2018. URL DBRL://p.///axxx..cc////////...3
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural informa- tion processing systems, pp.
2014.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.69880 2014.
Konstantina Kourou, Themis P Exarchos, Konstantinos P Exarchos, Michalis V Karamouzis, and Dim- itrios Fotiadis. Machine learning applications in cancer prognosis and prediction. Computational and structural biotechnology journal, 13:8-17, 2015.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In Foundations of Computer Science, 2007. FOCS 07. 48th Anmual IEEE Symposium on, pp. 94-103. IEEE, 2007.
Moritz Menze and Andreas Geiger. Object scene flow for autonomous vehicles. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 3061-3070, 2015.
Ilya Mironov. Renyi differential privacy. In Computer Security Foundations Symposium (CSF), 2017 IEEE 30th, pp. 263-275. IEFF, 2017.
11

---

Under review as a conference paper at ICLR 2020
Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from private training data. International Conference Learning Representations, 2017. URL
forum?
id=HkwoSDPqg
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Ulfar Erlingsson. Scalable private learning with PATE. International Conference on Learning Representations, 2018. UtL/attps://peeeeviiie
net Sate//oorum2ddr2225X.0.
Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, et al. Deep face recognition. In bmvc, volume 1, pp. 6, 2015.
Wahbeh Qardaji, Weining Yang, and Ninghui Li. Priview: practical differentially private release of marginal contingency tables. In Proceedings of the 2014 ACM SIGMOD international conference on Management of data, pp. 1435-1446. ACM, 2014.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1571.064: 2015.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXiv: / /802.06739 2018.
Chugui Xu, Ju Ren, Yaoxue Zhang, Zhan Qin, and Kui Ren. Dppro: Differentially private high- dimensional data release via random projection. IEEE Transactions on Information Forensies and Security, 12(12):3081-3044
2017.
Jinsung Yoon, James Jordon, and Mihaela van der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. International Conference on Learning Representations, 2019. URL URL/sttpa::/openeeviiee http://ewweeeeeeeeeeeeeeeeereeee http:///ww....ttt.oo.oooooassaaa
Jun Zhang, Graham Cormode, Cecilia M Procopiue, Divesh Srivastava, and Xiaokui Xiao. Privbayes: Private data release via bayesian networks. ACM Transactions on Database Systems (TODS), 42 (4):25, 2017.
12

---

Under review as a conference paper at ICLR 2020
A APPENDIX
A.1 ADDITIONAL EVALUATION RESULTS ON KAGGLE CREDIT DATASET
In addition AUROC, also evaluate the AUPRC of the classification models trained on the synthetic data produced by different generative models. Table 4 the results. G-PATE has the best performance among all the differentially private generative models.
GAN
PATE-GAN
DP-GAN
G-PATE
Logistic Regression (LR)
0,4069
0.3907
0.3923
0.4476
AdaBoost
0,4530
0.4366
0.4234
0.4481
Bagging
0.3303
0.3221
0.3073
0.3503
Multi-Layer Perceptron (MLP)
0.4790
0.4693
0.4600
0.5109
Average
0.4173
0.4046
0.3958
0.4392
Table 4: AUPRC on Kaggle Credit Dataset. The table presents AUPRC of classification models trained on synthetic data and tested on real data. PATE-GAN, DP-GAN, and G-PATE all satisfy (1, 10 -ifferrentia privacy. The best results among different DP generative models are bolded.
To understand the upper-bound the classification models' performance. We train the same classification models real data and test on real data. The results are presented in Table
LR
AdaBoost
Bagging
MLP
AUROC
0.9330
0.9802
0.9699
0.9754
AUPRC
0.6184
0.7103
0.6707
0.8223
Table 5: Performance of Classification Models Trained Real Data. The table presents, AUROC and AUPRC of classification models trained and tested on real data. These results are the upper- bounds for evaluation results on Kaggle Credit dataset.
A.2 SYNTHETIC IMAGES GENERATED BY G-PATE
Figure presents the synthetic images generated by G-PATE on MNIST and MNShi..-MNIST. Images in the same column share the same class label. Row contain real images in the training dataset; row 2 contain images generated by G-PATE when 10, 10 55 and row contain images generated
by G-PATE when = 1, = 10
A.3 PERFORMANCE ANALYSTS ON NONPRIVATE GPATE
To understand how the GPATE training framework influence the performance GAN, we train nonprivate GPATE with 10 teacher models. As shown in Table 6 the GPATE structure has comparable performance to the vanilla GAN.
Table Performance Comparison between GAN and nonprivate GPATE on Kaggle Credit Dataset.
GAN
Nonprivate GPATE
Logistic Regression AdaBoost (Freund et al. 1996
0.9430
0.9455
0,9416
0.9165
Bagging (Breiman] 1996
0,9379
0,9456
Multi-layer Perceptron
0.9444
0.9219
Average
0.9417
0.9324
13

---

Under review as a conference paper at ICLR 2020
2
4
X
4
5
(a) MNIST
uec
(b) Fashion-MNIST
Figure Visualization of generated instances by G-PATE. Row (real image), row (s 10, 8 = 10 10-5) and row 3 (E = 1, 8 10- each presents one image from each class.
A.4 PRIVACY BUDGET OF SONFIDENT-GNMAR
The Confident GNMax aggregator was proposed by Papernot et al. (2018) to support differentially private aggregation of the votes from multiple teacher models. For the completeness of this paper, in this section, we include the algorithm for the Confi sidentette GNMaa aggregator and its data-dependent RDP guarantee.
A.4.1 THE CONFIDENT-GNMAX AGGREGATOR
Algorithm Confident-GNMax Aggregator. The private aggregator used in the scalable PATE framework Papernot et al. (2018).
Require: input v, threshold T noise parameters 01 and 02
1: if (n, // of) > T then
2: return arg max (1( + (0)
3: else
4: return T
5: end if
presents the Confiderm GNMr aggregator proposed by Papernot et al. (2018). The algorithm contains two steps. First, computes the noisy maximum vote
Algorithm
Mi = max max (x)) + (0,
Then, the noisy maximum vote is greater than a given threshold, it uses the GNMax mechanism to select the output with most votes:
M2 arg max (0,
Since each teacher model may cause the maximum number of vote to change at most by 1, M, is equivalent to a Gaussian mechanism with sensitivity 1. Therefore, following Theorem M, with Gaussian noise of variance of guarantees (A, //2oo)))DD -RDP for all 1.
14

---

Under review as a conference paper at ICLR 2020
M2 could be decomposed into post-processing noisy histogram with Gaussian noise added each dimension. Since each teacher model may increase the count in one bin and decrease the count in another, the mechanism has sensitivity of 2. Therefore, M2 with Gaussian noise of variance o2 guarantees (A, A (Papernot et al. 2018).
The data-dependent privacy guarantee for the GNMax mechanism M2 has been analyzed by Papernot et al. (0118):
Theorem 7. Let M be a randomized algorithm with (11, and (uz 82) 2 guarantees and suppose that there exists likely outcome i" given dataset D and bound such that
q Z Pr (D)) & i*). Additionally, suppose that X S P1 and q S elu2-1)62/ / A1 p2-1
Then, for any neighboring dataset D' of D. we have:
Dx (M(D))) S A log ((1 ((1-q) ( 2-2 + -(
1
where (g. U2: 82) _ (1 /)/ (1 (1- (ge
and (q. (1, E /q/
The parameters μn and μl2 are optimized get data-dependent RDP guarantee for any order X. By applying Theorem 7 on M2, we obtain the data-dependent RDP budget for M2.
For any À > suppose E is the RDP budget for M1 and Eq the data-dependent RDP budget for M2. Then, the RDP budget for the Confident- Beant-GNNeA -GNMax algorithm could be calculated as follows:
E1 E1 +
if output is 1, otherwise.
A.5 MODEL STRUCTURES AND HYPERPARMETERS
G-PATE. For MNIST and Fashion-MNIST the student generator consists of fully connected layer with 1024 units and deconvolutional layer with 64 kernels of size 5 5 (strides 2 x 2). Each teacher discriminator has a convolutional layer with 32 kernels of size x 5 (strides 2 x 2) and a fully connected layer with 256 units. All layers are concated with the one-hot encoded class label. We apply batch normalization and Leaky ReLU on all layers. When E = 10, we train 2000 teacher discriminators with batch size of 30 and set 01 600, 02 100. When E = 1. we train 4000 teacher discriminators with batch size of 15 and set 01 = 3000, 02 = 1000. For Kaggle Credit dataset, we 600. For all three
train 2100 teacher diseriminators with batch size of 32 and set o 1500, d2 3 to train the models datasets, we use Adam optimizer Kingma & Ba (2014) with learning rate of 10
and clip the adversarial perturbations between =10- The consensus threshold T is set 0.5.
GAN. The structure of GAN is the same the structure of G-PATE with single teacher discrimi- nator. The hyper-parameters are also the same as G-PATE.
We use DP-GAN method mentioned in Xie et al. 2018) both MNIST and FashionM- NIST tasks. For the generator, we use FC Net structure with [128, 256, 512, 784] neurons in each layer, and the discriminator contains [784, 64, 64, neurons in each layer. In each training epoch, the discriminator trains 5 steps and the generator trains 1 step. For both networks, 0.5 x ReLU(-) activation layers are used. Our batch size 64 for each sampling, and sampling rate q equals 6x 10
DP-GAN.
We bound the discriminator's parameter weights to [-0.1, 0.1] and kept feature's value between [-0.5, 0.5] during the forward process. In order to generate specific digit data, we concat one-hot vector, which represents digits categories, into each layer in both the disciminator and the generator.
Classification Models for MNIST and Fashion-MNISTT. For each synthetic dataset, we trian CNN for the classification task. The model has two convolutional layers with 32 and 64 kernels respectively. We use ReLU as the activation function and applies dropout on all layers.
Classification Models for Kaggle Credit. We implement 4 predictive models in Yoon et al. (2019) using sklearn: Logistic Regression (LogisticRegression)) Adaptive Boosting (AdaBoostClassife fieer. Bootstrap Aggregating (Saggi assi fier) and Multi-layer
15

---

Under review as a conference paper at ICLR 2020
Perceptron (MLPClassifier) We use L/ penalty, Liblinear solver and (350:1) class weight Logistic Regression, We use logistic regression as classifier in Adaptive Boosting and Bootstrap Aggregating, setting L2 penalty, number of models 200 and 100. For Multi-layer Perceptron, use tanh as the activation of 3 layers with 18 nodes and Adam as the optimizer.
16


Reviews:
[{"review_id": "r1exqds19H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies the problem of differentially private data generator. Inspired by the general GAN framework and the PATE mechanism, the authors propose a new differentially private training algorithm for data generator. The problem of training data generator with privacy guarantee considered in this paper is very interesting, and the proposed algorithm looks novel. However, there are lots of unclear statements in the current paper, and I cannot tell whether the proposed algorithm is indeed better than previous methods. Following are my major concerns:\n1.It is unclear what are the loss functions used in equation (1) and (2). Please define k when introducing equation (2).\n2.The training framework introduced in section 3.1 is different from the traditional GAN framework, and thus my concern is that whether this framework will give us good generated samples. Because the performance of GAN has been proved in both theory and practice. The authors should at least empirically show the performance of the proposed framework in the nonprivate setting.\n3.There is no introduction of the $(\\epsilon,\\delta)$-differential privacy before introducing the Definition 1.\n4.There is no definition of Renyi differential privacy, so the statement of Theorem 2 is unclear. In addition, what is data-dependent Renyi differential privacy?\n5.The privacy guarantee of Algorithm 2 is not very clear. Because there are lots of parameters in Algorithm 1 and 2 which may affect the privacy guarantee, and Theorem 3 does not state such requirements. For example, how to choose $\\sigma_1,\\sigma_2$? In Theorem 7, there are some constraints on different parameters, will them be satisfied by your algorithm?\n6.How will the number of teacher models affect the privacy guarantee?\n7.Why you choose random projection matrix with variance $1/k$, and what is the projection dimension for different algorithms?\n8.In Table 1, the results of non private GAN are different from the results of non private GAN reported in PATE-GAN paper. Since the baseline results are much better in the current than the results reported in the PATE-GAN paper, it seems to me that the improvements of the proposed method comes from the stronger baseline.\n\nOther comments:\n1.$\\lambda>1$ in Theorem 3.\n2.Algorithm 2 should be moved to main context.\n3.The last sentence in section 3.2 is not convincing.\n4.Typo “differnet” in the caption of Table 1.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HyxAyKi7cH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents a framework for Differentially private data generation that enables more accurate training of downstream learners without compromising on the privacy guarantees. The key insight is to introduce an ensemble of teacher discriminators in the GAN formulation instead of a single discriminator. The teachers are trained on separate subsets of the private data set. A gradient aggregator is also introduced for transmitting loss signal to the student without losing privacy by using adversarial perturbations and random projections. The authors provide theoretic guarantees of Renyi differential privacy and experiments on Kaggle Credit default dataset and MNIST. \n\nI have very little knowledge of this field, but the main idea idea seemed quite novel and insightful.  I have not verified the theoretical results closely, I only skimmed the derivations, but what I can understand, it seems reasonable. The experimental results seemed quite good, with improvements across the board. I would have liked to see some metric that  was not just performance of the downstream classifier, is there an intrinsic measure of the generator's performance that makes sense to report?\n\nThe presentation was quite reasonable and polished, with very few typos.  My only gripe is that they seemed to spend a little too much space in different sections re-iterating their key contributions, but not enough defining or citing sources for key definitions such as Renyi differential privacy, which would be helpful to a non-expert reader.\n \n", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I did not assess the derivations or theory."}, "extra_text": {}}, {"review_id": "ByxX-UTWcH", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this submission, the authors propose a method to generate synthetic datasets with privacy guarantee while preserving high data utility. However, the following concerns are important to clarify for the authors:\n\n1) Compared to existing work, the proposed method can preserve high data utility due to the fact that the proposed method doesn't ensure differential privacy for the discriminator. Could the authors provide more details about this key observation and motivation? How about discriminator is not trustable? Can we simply assume that it is safe for discriminator to access sensitive data? How about the discriminator is attacked? I agree for some applications, we can have this assumption about discriminator, but it is very important to better understand the limitation and risk of this assumption. The real-world applications are not simply defined by us.\n\n2) The authors claim that the proposed method is scalable? Could the author confirm this either theoretically or experimentally?\n\n3) The experiments are conducted on a single dataset, simple MNIST dataset. It would be convincing to report experiments on more datasets such as CIFAR-10 and others.\n\n4) For experiment comparison and analysis, the authors adopt quite large epsilon, i.e., \\epsilon = 1 and \\epsilon = 10. Several existing work adopt \\epsilon = 0.2. Can the authors report experiment comparison with such meaningful epsilon?", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper addresses the problem of differential private data generator. The paper presents a novel approach called G_PATE which builds on the existing PATE framework. The main contribution is in using a student generator with an ensemble of teacher discriminators and in proposing a new private gradient aggregation mechanism which ensures differential privacy in the information flow from discriminator to generator.

Although the idea is interesting, there are significant concerns raised by the reviewers about the experiments and analysis done in the paper which seem to be valid and have not been addressed yet in the final revision. I believe upon making significant changes to the paper, this could be a good contribution. Thus, as of now, I am recommending a Rejection.
Decision: Reject