Differentially Private Generative Models Through Optimal Transport
Authors: Tianshi Cao
Alex Bie
Karsten Kreis
Sanja Fidler
Venue:  (2021)
Keywords: Differential Privacy
Generative Learning
GAN
Optimal Transport

Abstract: Although machine learning models trained on massive data have led to breakthroughs in several areas, their deployment in privacy-sensitive domains remains limited due to restricted access to data. Generative models trained with privacy constraints on private data can sidestep this challenge and provide indirect access to the private data instead. We propose DP-Sinkhorn, a novel optimal transport-based generative method for learning data distributions from private data with differential privacy. DP-Sinkhorn relies on minimizing the Sinkhorn divergence---a computationally efficient approximation to the exact optimal transport distance---between the model and the data in a differentially private manner and also uses a novel technique for conditional generation in the Sinkhorn framework. Unlike existing approaches for training differentially private generative models, which are mostly based on generative adversarial networks, we do not rely on adversarial objectives, which are notoriously difficult to optimize, especially in the presence of noise imposed by the privacy constraints. Hence, DP-Sinkhorn is easy to train and deploy. Experimentally, despite our method's simplicity we improve upon the state-of-the-art on multiple image modeling benchmarks. We also show differentially private synthesis of informative RGB images, which has not been demonstrated before by differentially private generative models without the use of auxiliary public data.

Under review as a conference paper at ICLR 2021
DIFFERENTIALLY PRIVATE GENERATIVE MODELS THROUGH OPTIMAL TRANSPORT
Anonymous authors Paper under double-blind review
ABSTRACT
Although machine learning models trained massive data have led to break- throughs in several areas, their deployment in privacy-sensitive domains remains limited due to restricted access to data. Generative models trained with privacy constraints on private data can sidestep this challenge and provide indirect access the private data instead. We propose DP-Sinkhorn, novel optimal transport- based generative method for learning data distributions from private data with dif- ferential privacy. DP-Sinkhorn relies on minimizing the Sinkhorn divergence- computationally efficient approximation to the exact optimal transport distance- between the model and the data in differentially private manner and also uses novel technique for conditional generation in the Sinkhorn framework. Unlike existing approaches for training differentially private generative models, which are mostly based generative adversarial networks, we do not rely adversar- ial objectives, which are notoriously difficult to optimize, especially in the pres- ence of noise imposed by the privacy constraints. Hence, DP-Sinkhorn is easy to train and deploy. Experimentally. despite our method's simplicity we improve upon the state-of-the-ard on multiple image modeling benchmarks. We also show differentially private synthesis of informative RGB images, which has not been demonstrated before by differentially private generative models without the use of auxiliary public data.
INTRODUCTION
As the full value of data comes to fruition through a growing number of data-centric applications (e.g. recommender systems (Gomez- Uribe & Hunt 2016), personalized medicine (Ho et al.) [2020). face recognition (Wang & Deng 2020), speech synthesis (Oord al. 2016). etc.), the importance of privacy protection has become apparent to both the public and academia. At the same time, recent Machine Learning (ML) algorithms and applications are increasingly data hungry and the use of personal data will eventually be necessity.
Differential Privacy (DP) is a rigorous definition of privacy that quantifies the amount of information leaked by user participating in any data release (Dwork al., 2006; Dwork & Roth 2014). DP was originally designed for answering queries to statistical databases. In a typical setting, a data analyst (party wanting to use data, such healthcare marketing company) sends query data curator (party in charge of safekeeping the database, such as a hospital), who makes the query on the database and replies with
mandorrndoom answer that preserves privacy. Differentially Private Stochastic Gradient Descent (DPSGD) T AAaadi et al. 2016) is the most popular method for training general machine learning models with DP guarantees. DPSGD involves large numbers of queries, in the form of gradient computations, to be answered quickly by the curator. This requires technology transfer of model design from analyst curator, and strong computational capacity be present the curator. Furthermore, if the analyst wants to train on multiple tasks, the curator must subdivide the privacy budget to spend on each task. As few institutions have simultaneous access to private data, computational resources, and expertise in machine learning, these requirements significantly limit adoption of DPSGD for learning with privacy guarantees.
To address this challenge, generative models-models with the capacity to synthesize new data- can be applied as a general medium for data-sharing (Xie et al. 2018) Augenstein et al. 2020). The
Including any variants that use gradient perturbation for ensuring privacy.

---

Under review as a conference paper at ICLR 2021
curator first encodes private data into a generative model; then, the model is used by the analysts to synthesize similar yet different data that can train other ML applications. So long as the genera- tive model is learned "privately", the user can protect their privacy by controlling how specific the generative model is to their own data. Differentially private learning of generative models has been
studied mostly under the Generative Adversarial Networks (GAN) framework (Xie al.. 2018 Torkzadehmahaní et al., 2019; Frigerio et al. 2019; Yoon et al. 2019 Chen et al.) 2020). While GANs in the non-private setting have demonstrated the ability synthesize complex data like high definition images (Brock et al. 2019 Karras et al. 2020). their application in the private setting is more challenging. This is in part because GANs suffer from training instability problems (Arjovsky) & BBotoou 2017 Mescheder et al.) 2018), which can be exacerbated when adding noise to the net- work's gradients during training, common technique to implement DP. Because of that, GANs typically require careful hyperparameter tuning and supervision during training to avoid model col- lapse. This goes against the principle of privacy, where repeated interactions with data need to be avoided (Chaudhuri & Vinterbo 2013).
Optimal Transport (OT) is another method to train generative models. In the optimal transport setting, the problem of learning generative model is framed as minimizing the optimal transport distance, a type of Wasserstein distance, between the generator-induced distribution and the real data distribution (Bousquet et al., 2017 Peyré & Cuturi 2019). Unfortunately, exactly computing the OT distance is generally expensive. Nevertheless, Wasserstein distance-based objectives are actually widely used to train GANs (Arjovsky et al. [017 Gulrajani et al. (017b)) However, these approaches typically estimate a Wasserstein distance using an adversarially trained discriminator. Hence, training instabilities remain (Mescheder al. 2018
An alternative to adversarial-based OT estimation is provided by the Sinkhorn divergence (Genevay jet al., 2016) Feydy et al.] 2019 Genevay al., 2018). The Sinkhorn divergence is an entropy- regularized version of the exact OT distance. for which the optimal transport plan can be computed efficiently via the Sinkhorn algorithm (Cuturi] 2013). In this paper, we propose DP-Sinkhorn, a novel method to train differentially private generative models using the Sinkhorn divergence as objective. Since the Sinkhorn approach does not intrinsically rely on adversarial components, avoids any potential training instabilities and removes the need for early stopping. This makes our method easy to train and deploy in practice. As a side, we also develop a simple yet effective way to perform conditional generation in the Sinkhorn framework, by forcing the optimal transport plan to couple same-label data closer together. To the best of our knowledge, DP- Sinkhorn is the first fully OT-based approach for differentially private generative modeling.
Experimentally, despite its simplicity DP-Sinkhorn achieves state-of-the-art results on image-based classification benchmarks that use data generated under differential privacy for training. We can also generate informative RGB images, which, to the best of our knowledge, has not been demonstrated by any generative models trained with differential privacy and without auxiliary public data.
We make the following contributions: (i) We propose DP-Sinkhorn, flexible and robust optimal transport-buuc based framework for training differentially private generative models. (ii) We introduce a simple technique to perform label- -oblllooniiional synthesis in the Sinkhorn framework. (iii) We achieve fate-offtheeart performance on widely used image modeling benchmarks. (iv) We present informa- tive RGB images generated under strict differential privacy without the use of public data.
2 BACKGROUND
2.1 NOTATIONS AND SETTING
Let X denote sample space, P(X') all possible measures on X, and Z C Rd the latent space. We are interested in training a generative model g + X' such that its induced distribution μ = g g with noise source P(Z) is similar to observed through independently sampled finite sized set of observations D = {y} N. In our case, g is a trainable parametric function with parameters Q.
2.2 GENERATIVE LEARNING WITH OPTIMAL TRANSPORT
Optimal Transport- generative learning considers minimizing variants of the Wasserstein dis- tance between real and generated distributions (Bousquet al. 2017 Peyré & Cuturi 2019
2

---

Under review as a conference paper at ICLR 2021
Two key advantages of the Wasserstein distance over standard GANs, which optimize the Jensen- Shannon divergence (Goodfellow et al.] 2014). are its definiteness on distributions with non- overlapping supports, and its weak metrization of probability spaces (Arjovsky et al., 2017). This prevents collapse during training caused by discriminators that are overfit to the training examples.
Methods implementing the OT framework tive learning, the dual formulation has been more popular. Under the dual formulation, the distance between the generator-induced and the data distribution is computed as the expectation of potential functions over the sample space. In WGAN and variants (Arjovsky et al. 2017; Gulrajani et al.) 2017a Miyato al., 2018). the dual potential is approximated by an adversarially trained discrimi- nator network. While theoretically sound, these methods still encounter instabilities during training since the non-optimality of the discriminator can produce arbitrarily large biases in the generator gradient (Bousquet et al., 2017). The primal formulation involves solving for the optimal trans- port plan-a joint distribution over the real and generated sample spaces. The distance between the two distributions is then measured as the expectation of point-wise cost function between pairs of samples as distributed according to the transport plan. Thus, the properties of the point-wise cost function are of great importance. In practice, sufficiently convex cost functions allow for effi- cient optimization of the generator. It is also possible to learn cost functions adversarially (Szabō) & Sriperumbudur 2017). However, discussed earlier, adversarial training often comes with addi- tional challenges, which can be especially problematic in the differentially private setting.
either the primal the dual formulation. For genera-
In general, finding the optimal transport plan is difficult optimization problem due to the constraints of equality between its marginals and the real and generated distributions. Entropy Regularized Wasserstein Distance (ERWD) imposes a strongly convex regularization term on the Wasserstein distance, making the OT problem between finite samples solvable in linear time (Peyré et al.) 2019). Given a positive cost function c: X' X R and 2 O, the EERWD defined as:
<(x,y) dr dr(x, y) We,,(1 v) =min / (xx,)) v) + f log dp(z)dv(v) REll|
where II =1 ( v) E P(X x X') (I. -dzz = u, [ wyyy = 11). Sinkhorn divergence uses cross correlation terms to cancel out the entropic bias introduced by ERWD. This results in faithful matching between the generator and real distributions. In this paper, we use the Sinkhorn divergence as defined Feydy et al. (2019).
Definition 2.1 (Sinkhorn Divergence) The Sinkhorn divergence between measures P and is de- fined as:
Sc,( v) = 2W,,e(,,V) - (o, u) - Wo.e(v.v) v)
Works on the efficient computation of the Sinkhorn divergence have yielded algorithms that converge to the optimal transport plan within tens of iterations (Cuturi 2013; Feydy et al.) 2019). Gradient computation follows by taking the Jacobian vector product between the cost matrix Jacobian and the transport weights, which is implemented in many nuto-differentiation frameworks.
When compared to WGAN, learning with the Sinkhorn divergence has distinct differences. First, the Sinkhorn divergence is computed under the primal formulation of OT, whereas WGAN's loss is computed under the dual formulation. While both are approximations to the exact Wasserstein distance, the source of the approximation error differs. The Sinkhorn divergence uses entropic regu- larization to ensure linear convergence when finding the optimal transport plan æ (Cuturi) 2013). Its two sources of error are the suboptimality of the transport plan and bias introduced by entropic reg- ularization. With the guarantee of linear convergence, π can converge to optimality by using enough iterations, thereby allowing control of the first error. The second source of error can be controlled by using small values of e, which we found to work well in practice. In contrast, WGAN's source of error lies in the sub-optimality of the dual potential function. Since this potential function is parame- terized by an adversarially trained deep neural network, it enjoys neither convergence guarantees nor feasibility guarantees. Furthermore, the adversarial training scheme can produce oscillatory behav- ior, where the discriminator and generator change abruptly every iteration to counter the strategy of the other player from the previous iteration (Mescheder et al., (017). These shortcomings contribute to WGAN's 's problems of non- converrreege,e,, which in turn lead to mode dropping. In contrast, training with the Sinkhorn divergence does not involve any adversarial training at all, converges more stably, and reaps the benefits of OT metrics covering modes.
3

---

Under review as a conference paper at ICLR 2021
Non-sensitive
Sinkhom Iteration
Sinkhom Loss
Sensitive, forward
Z
JO.E0
f
Sc,e
Clip and
Noise
Sensitive,
Latent
Ganerated Data Batch
backward pass
Generative Model
Training Data Set
Private backward
Privacy Barrier
Real Data Batch
Sampling
Figure 1: Flow diagram of DP-Sinkhorn for a single training iteration: Sensitive training data is combined with non-sensitive generated data in the cost matrix. Then, the loss is calculated using the Sinkhorn algorithm. In the backward pass, we impose privacy barrier behind the generator by clipping and adding noise to the gradients the generated image level, similar to Chen al. (2020)
2.3 DIFFERENTIAL PRIVACY
The current gold standard for measuring the privacy risk of data releasing programs is the notion of differential privacy (DP) (Dwork et al. (006)) Informally, DP measures to what degree program's 's output can deviate between adjacent input datasets-set which differ by one entry. For a user contributing their data, this translates to guarantee on how much adversary could learn about them from observing the program's 's output. In this paper, we are interested the domain of image- label datasets where each image and its semantic label constitute an entry.
Gradient perturbation with the Gaussian mechanism the most popular method for DP learning of parametric models. During stochastic gradient descent (SGD) and variants, the parameter gradients are clipped 2-norm by a constant, and then Gaussian noise is added. By adding a sufficient satisfy DP requirements. Then, the post-processing property
amount of noise, the gradients of differential privacy (Dwork & Roth (2014) guarantees that the parameters are also private. As SGD involves computing the gradients on randomly drawn batches of data for multiple iterations, two other properties of DP, composition and subsampling are required to analyze the privacy of the algorithm. Rényi Differential Privacy (RDP) is well-studied formulation of privacy that allows tight composition of multiple queries, and can be easily converted to standard definitions of DP.
Definition 2.2 (Rényi Differential Privacy) A randomized mechanism M D R with domain D and range R satisfies (ar, (..c))RDPPP for any adjacent d, d' E 'D it holds that
Da(M(d))Mdd)) Se,
(3)
where Da the Rényi divergence of order a. Also, any M that satisfies (a,c)-RDP also satisfies (c log 1/6 6)-DP Mironov 2017).
a-1
For clipping threshold A and standard deviation of Gaussian noise a, the Gaussian mechanism sat- isfies (a, AA? / RRDP (Mironov 2017). Subsampling the dataset into batches also improves privacy. The effect subsampling on the Gaussian mechanism under RDP has been studied in (Wang et al. 2019 Balle et al. 2018 Zhu & Wang 2019). Privacy analysis of gradient- based learning algorithm entails accounting for the privacy cost of single queries (possibly with subsam- pling), summing up the privacy cost across all queries (i.e. training iterations in our case), and then
choosing the best a. A more thorough discussion of DP can be found in Appendix B
DIFFERENTIALLY PRIVATE SINKHORN WITH CLASS CONDITIONING
We propose DP-Sinkhorn (Algorithm]) 1). an OT-based method to learn differentially private genera- tive models, avoiding the training instability problems characteristic for GAN- techniques. We use the empirical Sinkhorn loss between batches of real and generated data as objective and define the cost function timal transport plan to couple images of the same class together. Privacy protection is enforced by clipping and adding noise to the gradients of the generated images during backpropagation.
simple pixel-wise L2-loss. Class conditioning is achieved by biasing the op-
4

---

Under review as a conference paper at ICLR 2021
Empirical Sinkhorn Divergence Definition 2.1 requires integration over the sample space. In practice, we use an empirical Sinkhorn divergence computed on batches of random samples.
Definition 3.1 (Empirical Sinkhorn loss) The empirical Sinkhorn loss computed over batch of N generated examples and M real examples is defined as:
Se,e( (X. Y) 2Cxy 3 Prx,x- Cxx o Pxx,x
Cyy O P
(4)
where X and Y are uniformly sampled batches from the generator and real distribution respectively. For two samples A E X and B E XA, CAB is the cost matrix between A and B, and P Pr,A, is an approximate optimal transport plan that minimizes Eqn. computed over and B.
Algorithm 1 describes how Equation 4 is computed, while additionally modifying the gradient by adding noise and clipping to implement the chosen mechanism for differential privacy (see below). Please also Appendix A for more details.
Class Conditioning To conditionally generate images given a target class, we inject class infor- mation to both the generator and the Sinkhorn loss during training. For the generator, we supply the class label either by concatenating an embedding of it with the sampled latent code (on sim- ple DCGAN-style generators), or by using class conditioned batch-norm layers (on BigGAN-style generators). For the loss function, we concatenate scaled one-hot class embedding to both the gen- erated images and real images. Intuitively, this works by increasing the cost between image pairs of different classes, hence shifting the weight of the transport plan (P" in Eq. 4 towards mats--d pairs. The scaling constant ae determines the importance of class similarity relative to image simi- larity. Uniformly sampled labels are used for the generated images and the real labels are used for real images. Let lg and l denote the labels of x and y, and [a. b) denote concatenation of a and b. The class-conditional pixel-wise and label loss is:
Coond (1x, 42 [y, ()) = ||xx aa * =L2) - [y, Or * onehot (1,))
(5)
When Goond is used for computing Sc... the resulting optimal transport distance is the cost of trans- porting the joint distribution of generated images and labels to the real distribution. Compared to generating without class conditioning, this means choosing X' to denote the joint space of images and labels instead of the image space. All other formulation remains unchanged. Furthermore, since Ilaa, blll = ||a|| + ||b|[ we can also interpret Geond as separately calculating the cost of transport- ing images and labels, and then performing weighted sum. Despite computing the cost separately, our method does not assume that images and labels are independent. Instead, in our formulation the joint distribution piimage label) is defined through decomposition as p( (image (image/labell))) (label) (label) and novel image-label pairs are synthesized by ancestral sampling. It is worth mentioning that a squared L2 norm label cost may seem unintuitive. However, we found this to work very well and did not observe any instances of class- coass-onniiiinnng failure. Hence, we chose to stick to the simplest choice, in particular because are using the L.2 norm already for the image cost itself. Future work may consider tailored cost functions for more complex label spaces.
Note that, the best of our knowledge, it has not been shown before how perform class- conditional generation in the Sinkhorn divergence generative framework. Our simple yet efficient trick can similarly be used in non-private learning settings.
Privacy Protection Rather than adding noise to the gradients of the generator parameters 0, we add noise to the gradients of the generated images Sx which is then backpropagated to 0. This is private because the input to generators (the latent code) is randomly drawn and independent from data, leaving the only connection to data at the output. Compared to Voš. the dimension of Vx is independent from the network architecture. This allows to train larger networks without requiring more aggressive clipping,
V Vo5112 scales d0) This method has been independently proposed CChhn et al. 2220). In each iteration, gradient descent updates the generator parameters by backpropagating the "image gradient" Vx We clip this term such that ||VxŠ1|a < C. The sensitivity is thus maxy, Y | Y) V ŠX,, Y')ll < 2C' By adding Gaussian noise with scale 2Ca, the mechanism satisfies (a, 2nz -RDP (Mironov 2017). We use the RDP accountant with Poisson subsampling proposed in Zhu & Wang (2019) for privacy composition. Note that the batch size of X is kept fixed, while batch size of Y follows a binomial distribution due to Poisson subsampling.
ac
5

---

Under review as a conference paper at ICLR 2021
4 EXPERIMENTS
We conduct experiments on conditional image synthesis tasks since our focus on the gen- eration of high-dimensional data with privacy protection. We evaluate our method with re- spect to both visual quality and data utility for downstream learning tasks. To compare with previous work, all models are trained under privacy budget 10.
Algorithm DP-Sinkhorn
L is number of categories, X' is sample space. M is size of private data set. backprop is a reverse mode auto-differentiatiin function that takes 'out', 'in' and 'grad weights' as input and computes the Jacobian vector product Jin (out)- grad weights. Poisson Sample and W are defined in Appendix
4.1 EXPERIMENTAL SETUP
Input: private data set d = { E X x sampling ratio 4, noise scale a. clipping coefficient A, generator ge, learning rate a, entropy regularization total steps T'.
{O...., L))....))) L)) AM
Datasets We consider 3 image datasets: MNIST (LeCun al.) [1998, Fashion-MNIST (Xiao et al. 2017). and CelebA (Liu et al. 2013) downsampled to 32x32 resolution. For MNIST and Fashion-MNIST, generation is conditioned on the regular class labels while on CelebA we condition on gender.
Output: 0
q M
= do
Sample Y + Poisson Sample(d, z).
Z (4) s.ddd Unif(O,,) 1)
Lg < [1:}== Lid Unif(O,..... L)
Metries In all experiments, we compute met- rics against synthetic dataset of 60k image- label pairs sampled from the model. For quantitative measure of visual quality, we re- port FID (Heusel et al. 2017). We compute FID scores between our synthetic datasets of size 60k and the full test data (either 10k or 19962 images). To measure the utility of gen- erated data, we assess the class prediction accuracy of classifiers trained with synthetic data on the real test sets. We consider logistic regression, MLP, and CNN classifiers. Previous work also reports classification accuracies
X t { = g0(2,,4)
gradx Vx 2W. Y) W. Wx xi]
gradx clip(grad x: A) - 2A.N(
grad, backprop( XX grad
t- 0 a Adamn(grdd,) end for
large suite of classifiers from scikit-learn. We omit them, since focus on images which are best processed via neural network- based classifiers.
Architectures & Hyperparameters For MNIST and Fashion-MNIST experiments, we adopt the generator architecture from DCGAN (Radford et al.; 2015). For CelebA experiments, we adopt the CIFAR-10 generator configuration from BigGAN Brock et al. 2019). Our preliminary exper- iments found that using the deeper BigGAN architecture did not provide significant improvements on MNIST and Fashion-MNIST datasets, hence we only report results with the DCGAN-based gen- erator for these two datasets. Additional details can be found in Appendix D.3
Privacy Implementation All our models are implemented in PyTorch. We implement the gradient sanitization mechanism by registering backward hook to generator output, and we do not see significant impact on runtime. MNIST and Fashion-Mai -NIIS experiments target (10, 10 DD while CelebA experiments target (10, 10 ODDP. Details are in Appendix D.3
4.2 EXPERIMENTAL RESULTS ON STANDARD BENCHMARKS
In Table I we compare the performance of DP-Sinkhomt with other methods on MNIST and Fashion-MNIST.. Given the same privacy budget, DP Sinkhorn generates more informative exam- ples than previous methods, as demonstrated by the higher accuracy achieved by the downstream classifier. In particular, on the more visually complex Fashion-MNIST, DP-Sinkhorn's 's lead is espe- cially pronounced, beating previous state-of-the- art results by significant margin.
The FID of images generated by Sinkhonhorn is lower than all baselines, except GS-WGAN (Chen) et al. 2020 likely because of the slight blur in images generated by DP- op-Siinhomm, as shown in Figure 2 We hypothesize that this is due to the simple L2 cost and that improved cost functions based other kernels may perform better. However, in this work focus is to keep the model simple and focus on downstream applications, for which our model works best. It is also worth not- ing that GS-WGAN uses more complex adversarial setup and requires auxiliary discriminator

---

Under review as a conference paper at ICLR 2021
network, while rely the robust Sinkhorn framework. Furthermore, FID scores are based on an ImageNet-trained Inception network and are not well suited for analyzing small grayscale images.
Ablations We study the effect of image gradient noise (perturbing V S) versus parameter gradi- ent noise (perturbing VgS). Performance of the parameter gradient noise variant of DP-Sinkhom is shown in Table in the row OP--iinhorrn (V,S). We tuned the clipping bound A separately for this variant, while other hyper-parameters were kept fixed. We see that DP-Sinkhom (VeS) still outper- forms GS WGAN in downstream classification accuracy, and is only slightly behind DP-Sinkhorn in most measures, except for FID score on MNIST. Further inspection (in Appendix El shows that images generated by DP-Sinkhorn (V S) well formed but have noisy edges. Since real MNIST images have sharper lines than Fashion-MNIST FID is impacted more severely by this noise. The observation that DP-Sinkhorn outperforms GS-WGAN and the other baselines in the classification task, despite resulting in slightly noisy images compared to GS-WGAN, suggests that our samples are more diverse, which leads to better generalization when training the downstream classifier. We hypothesize that the baselines suffer from some amount of mode dropping compared to our method. We attribute this to our robust optimal transport-based training approach.
Robustness In Tables and in Appendix we report additional results training DP- Sinnkihorm with a variety of different hyperparameters (optimizer, learning rate, batch size). The majority of these experiments train in stable manner, reaching competitive state-of-the-art performance. This suggests that our method is indeed robust against the choice of hyperparameters.
4.3 EXPERIMENTAL RESULTS ON CELEBA
We also evaluate Di-Sinkhorn on downsampled CelebA. To the extent of our knowledge, no DP generative learning method has been applied on such RGB image data without accessing public data. We evaluate whether DP-Sinkhorn is able to synthesize RGB images that are informative for downstream classification. Furthermore, we study whether an adversarial learning scheme is helpful for learning this dataset. We test this by using an adversarially trained feature extractor in the cost function. Given feature extractor é, we modify the cost function as:
Og Mad(y) T (ao(x) T ly, (n)hot(ly); [1x(x)ll2
Cadv Cado[[x, (x, [z)) = [xx [x, * (1e)
[ 2
(6)
The output of the feature extractor is normalized and then concatenated the image and class label. Training proceeds through alternating updates. To make this learning scheme private, we randomly split the training dataset into k partitions and train one discriminator per partition. This way, the gradient (with respect to generated image) computed on each partition is only dependent on that partition, hence still benefiting from privacy amplification by subsampling. Privacy accounting for this setting is performed through Wang et al. (2019), which analyzes fixed-size batch subsampling.
We find that while using the adversarial feature extractor beneficial in the non-private case, did not provide significant improvements in the private case, shown in Table 2 In theory, using learned feature extractors can provide a sharper loss landscape which should be beneficial to learning (Li al. 2017). We hypothesize that clipping and gradient noise counteracts the effect of gradi- ent shaping provided by the adversarial feature extractor, resulting in similar learning performance in the non-adversarial approach. Despite its simplicity when using only an L2 cost function, DP-Sinkhorn generates informative images for gender classification, (uninformative images would correspond to as 50% classification ratio). Qualitatively, Figure 3 shows that DP-Sinkhom can learn rough representations of each semantic class (male and female) and produces some in-class variations. Visual fidelity of the generated images may be improved in the future through fine-tuning of the adversarial scheme, use of tailored kernels as cost function, or tighter privacy accounting.
5 RELATED WORKS
The task of learning generative models on private data has been tackled by many prior works. The general approach is introduce privacy-calibrated noise into the model parameter gradients during training. While various GaN-based approaches have been introduced (Xie et al.] 2018
Torkzzdeehmaani al. 2019 Frigerio et al. 2019) Yoon et al. 2019 Chen et al. 2020), it is well
7

---

Under review as a conference paper at ICLR 2021
Table 1: Comparison of DP image generation results on MNIST and Fashion-MNIST at (e,
(10, 10-0)00-000 --DP. Results for other methods (G-PATE (Long et al. 2019), DP-MERF & DP-MERF AE (Harder al. 2020). DP-CGAN (Tokzzadchmahaní et al. 2019), GS- WGAN (Chen et al. 2020
from Chen et al. 2020). Results averaged over 5 runs of synthetic dataset generation.
MNIST
Dishion-MNIST
Method
DP-e
Acc (%)
Acc (%)
FID
Log Reg
MLP
CNN
Log Reg
MLP
CNN
Real
97.5
99.3
2.5
84.5
88.2
90.8
Non-priv Sinkhorn
00
84.1
88.6
88.2
87.9
105.2
77.6
78.7
72.8
G-PATE
10
177.2
26
25
51/80.9
205.8
42
30
50/69.3'
DP-CGAN
10
179.2
60
60
63
243.8
51
50
46
DP-MERF
247.5
63
267.8
59
64
DP-MERF AE
10
161.1
54
55
68
213.6
50
56
62
GS-WGAN
10
61.3
79
131.3
68
65
65
Sinkhor (VoS)
218.6
79.7
79.9
80.7
213.9
70.5
71.2
68.6
DP-Sinkhorn
10
124.3
82.0
80.8
79.9
193.8
73.4
72.2
67.5
G-PATE
4
7
4
8
15
7
0
3
7
DP-CGAN
(>
/
G
3
4
3
7
1
4
3
4
0
C
7
8
DP-MERF
C
3
5
G
0
2
9
9
8
9
DP-MERF AE
0
2
3
4
7
9
9
0
0
3
4
7
6
7
8
9
0
3
4
6
7
8
9
GS-WGAN
0
2
4
5
7
8
9
0
/
2
3
4
5
6
7
8
9
0
2
3
4
6
7
8
9
0
1
2
3
4
5
6
7
8
9
T
Ours
0
/
2
3
4
5
6
7
8
9
0
2.
3
4
5
6
8
9
0
2
3
4
6
7
8 9
Figure 2: Comparisons on MNIST and Fashion-MNIS' between methods for private image gener-
ation at (10, 10 --PP The first rows showing other methods are taken from Chen (2020).
documented that GANs are unstable during training (Arjovsky Bottou 2017 Mescheder et al., 2018). As discussed, this is critical in the context of DP, where the imposed gradient noise increase training instabilitics and where interaction with private data should be limited. It is worth noting that Chen et al. (2020) proposed the same privacy barrier mechanism like by applying gradient noise on the generated images rather than the generator parameters.
Other generative models have also been studied in under DP setting. AAs et al. (2018) partitions the private data in clusters and learns separate likelihood-based models for each cluster. Harder al. (2020) MMD with random Fourier features. While these works do not face the same stability issues as GANs, their restricted modelling capacity results in these methods mostly learning
'The G-PATE authors report much more accurate classification results than reported Chen al. 2020
The visual quality of samples in both papers is roughly the same. DP-MERRF is designed for the low-s regime and does make of the extra privacy budget from 10.
8

---

Under review as a conference paper at ICLR 2021
Table 2: Differentially private image generation results on downsampled CelebA
Acc (5)
Method
(c, --DDP
FID
MLP
CNN
Real data
0C
1.1
91.9
95.0
Adversarial Sinkhorn (non-priv)
0C
72.8
78.1
78.2
Pixel Sinkhorn (non-priv)
0C
140.7
78.9
77.9
Adversarial DP-Sinkhorn
10
187.0
74.7
74.5
Pixel DP-Sinkhorn
10
168.4
76.2
75.8
Figure 3: Images Generated on CelebA dataset. From top to botton: Adversarial Sinkhorn, Pixel Sinkhorn, Adversarial DP-Sinkhorn, Pixel DP-Sinkhorn.
prototypes for each class. Lastly, while Takagi al. (2020) produced strong empirical results, their privacy analysis relies on the use of Wishart noise on sample covariance matrices, which has been proven to leak privacy (Sarwate 2017). Hence, their privacy protection is invalid in its current form.
There are various works on incorporating non-sensitive public data while learning differentially private models, mostly for discriminative tasks (Papernot et al., 2017 2018 Zhu et al. 2020), but also for generative modeling. IZhang et al. (2018) uses public data to pretrain discriminators for private GAN learning. Xu et al. (2019) uses public data to calibrate per parameter clipping bounds.
Recently, Triascynn & Faltings (2000 b) introduced Bayesian differential privacy for ML, data- centric notion of differential privacy. It takes into account that dataset's "typical" data easier to protect than outliers. However, this approach has not been widely adopted by the community yet and the focus of our work to introduce DP-Sinkhorn the regular differential privacy setting.
6 CONCLUSIONS
We propose DP-Sinkhorn, novel optimal rransport-based differentially private generative modeling method. Our approach minimizes the empirical Sinkhorn loss in a differentially private manner and does in general not require any adversarial techniques that are challenging to optimize. Therefore, DP-Sinkhorn is easy to train and deploy, which we hope will help its adoption in practice. We also use novel trick force the optimal transport plan couple same-label data together, thereby allowing for conditional data generation in the Sinkhorn divergence generative modeling framework. We experimentally validate our proposed method and demonstrate superior performance compared to the previous state-of-the-arr on standard image classification benchmarks using data generated under DP. We also show differentially private synthesis of informative RGB images without using additional public data. Note that main experiments only used simple pixel-wise L2-loss as cost function. This suggests that in the DP setting, complexity in model and objective are not necessarily beneficial. We conclude that simple and robust models such as ours promising direction for differentially private generative modeling.
Future work includes improving OP-Sinkhom''s ''s performance RGB images and scaling it up to higher resolutions, extending it to other data types, using tailored kernel-based cost functions and incorporating auxiliary public data during training.

---

Under review as a conference paper at ICLR 2021
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. New York, NY, USA, 2016. Association for Computing Machinery. ISBN 978145034139
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially private mixture of generative neural networks. IEEE Transactions Knowledge and Data Engineering, 31(6):1109-1122 109-1121, 2018.
Martin Arjovsky and Leon Bottou. Towards Principled Methods for Training Generative Adversarial Networks. In International Conference Learning Representations, 2017.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. 17X1v0/701.07875 2017.
Wasserstein gan. arXiv preprint
Sean Augenstein, H. Brendan McMahan, Daniel Ramage, Swaroop Ramaswamy, Peter Kairouz, Mingqing Chen, Rajiv Mathews, and Blaise Aguera y Arcas. Generative Models for Effective ML on Private, Decentralized Datasets. In International Conference on Learning Representations, 2020.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. In Advances in Neural Information Processing Systems, pp. 6277-6287, 2018.
Olivier Bousquet, Sylvain Gelly, Ilya Tolstikhin, Carl-Johann Simon-Gabriel, and Bernhard Schoelkopf. From optimal transport to generative modeling: the vegan cookbook. arXiv preprint arXiv:1705.07642, 2017.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. International Conference on Learning Representations, 2019.
Kamalika Chaudhuri and Staal A Vinterbo. A stability-basse validation procedure for differentially private machine learning. In C. J. C. Burges, I.. Bottou, M. Welling, 7. Ghahramani, and K. Q- Weinberger (eds.), Advances Neural Information Processing Systems 26, pp. 2652-2660. Cur- ran Associates, Inc., 2013.
Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. Gs-wgan: A gradient-sanitized approach for learning differentially private generators. arXiv preprint wrXiv:2006.08265 2020.
Marco Cuturi. Sinkhorn distances: Lightspeed computation of optimal transport. In Advances in neural information processing systems, pp. 2292-23302 2013.
Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy. 9(3-4), 2014. ISSN 1551-305X.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265-284. Springer, 2006.
Jean Feydy. PhD thesis, ENS, Mar 2020. URL httph:tt////...... httpss/www.mt..esss........... ens frr fey-ddyyyrrry/ry/////ooo reometrisn data aasta__nalysis traft.pdf
Jean Feydy. Thibault Séjourné, François-Xaviis Xavier Vialard, Shun-ichi Amari, Alain Trouvé, and Gabriel Peyré. Interpolating between optimal transport and mmd using sinkhorn divergences. In The 22nd International Conference Artificial Intelligence and Statistics, pp. 2681-2690, 2019.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differen- tially private generative adversarial networks for time series, continuous, and discrete open data. In IFIP International Conference on ICT Systems Security and Privacy Protection, pp. 151-164. Springer, 2019.
Aude Genevay, Marco Cuturi, Gabriel Peyré, and Francis Bach. Stochastic optimization for large- scale optimal transport. In Advances in neural information processing systems, pp. 3440-3448, 2016.
10

---

Under review as a conference paper at ICLR 2021
Aude Genevay, Gabriel Peyré, and Marco Cuturi. Learning generative models with sinkhorn di- vergences. In International Conference on Artificial Intelligence and Statistics, pp. 1608-1617, 2018.
Carlos A. Gomez-Uribe and Neil Hunt. The netflix recommender system: Algorithms, business value, and innovation. 6(4), 2016. ISSN 2158-656X.
Ian Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger (eds.), Advances in Neural Information Pro- cessing Systems 27, pp. 2672-2680. Curran Associates, Inc., 2014.
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Im- proved training of wasserstein gans. Advances in neural information processing systems, pp- 5767-5777, 2017a.
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Im- proved Training of Wasserstein GANs. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems 30, pp. 5767-5777. Curran Associates, Inc., 2017b.
Frederik Harder, Kamil Adamczewski, and Mijung Park. Differentially private mean embeddings with random features (dp-merf) for simple & practical synthetic data generation. arXiv preprint arXiv:2002.11603. 2020.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge local nash equilibrium. In Advances in neural information processing systems, pp. 6626-6637, 2017.
Dean Ho, Stephen R. Quake, Edward R. B. McCabe, Wee Joo Chng, Edward K. Chow, Xianting Ding, Bruce D. Gelb, Geoffrey S. Ginsburg, Jason Hassenstab, Chih-Ming Ho, William C. Mob- ley, Garry P. Nolan, Steven T. Rosen, Patrick Tan, Yun Yen, and Ali Zarrinpar. Enabling Tech- nologies for Personalized and Precision Medicine. Trends Biotechnol., 38(5):497-518, 2020. doi: 10. 1..10166j..ibe w/t.t//ttttc......... (ttbbecch.211..1.. 20.9.1..021.
Tero Karras, Samuli Laine, Mika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyz- ing and improving the image quality stylegan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8110-8115 19, 2020.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. |RLhttp:
6980
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-232) 1998.
Chun-Liang Li, Wei-Cheng Chang, Yu Cheng, Yiming Yang, and Barnabás Póczos. Mmd gan: Towards deeper understanding of moment matching network. In Advances in Neural Information Processing Systems, pp. 2203-2212 2213, 2017.
Ziwei Liu, Ping Luo. Xiaogang Wang. and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
Yunhui Long, Suxin Lin, Zhuolin Yang. Carl A Gunter, Han Liu, and Bo Li. Scalable differentially private data generation via private aggregation of teacher ensembles. 2019. URL https://
Lars Mescheder, Sebastian Nowozin, and Andreas Geiger. The numerics of gans. In Advances in Neural Information Processing Systems, pp. 1825-1835, 2017.
Lars Mescheder, Andreas Geiger, and Sebastian Nowozin. Which training methods for GANs do actually converge? volume 80 Proceedings of Machine Learning Research, pp. 3481-3490, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR.
11

---

Under review as a conference paper at ICLR 2021
1. Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Sympo- sium (CSF), pp. 363-275,200 2017.
Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. In International Conference on Learning Representations, 2018.
Aaron den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. Wavenet: A generative model for raw audio. arXiv preprini 1iXi 2016.
Nicolas Papernot, Martín Abadi, Úlfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised Knowledge Transfer for Deep Learning from Private Training Data. In International Conference on Learning Representations, 2017.
Nicolas Papernot, Shuang Song. Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Er- lingsson. Scalable Private Learning with PATE. In International Conference Learning Repre- sentations, 2018.
Gabriel Peyré and Marco Cuturi. Computational Optimal Transport. Foundations and Trends in Machine Learning, 1 115--6):3556677, 2019.
Gabriel Peyré, Marco Cuturi, et al. Computational optimal transport: With applications to data science. Foundations and Trends(K) in Machine Learning, 11(5-6):355-607, 2019.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06433 2015.
Anand Sarwate.
Retraction for symmetric matrix
perturbation for differentially-
private principal component analysis, 2017. URL https:://rrodiccizzz net/ 2017 2017/04/07/retraaa
2016/ 6/
Zoltán Szabó and Bharath K Sriperumbudur. Characteristic and universal tensor product kernels. The Journal of Machine Learning Research, 18(1):8724-8752, 2017.
Shun Takagi, Tsubasa Takahashi, Yang Cao, and Masatoshi Yoshikawa. P3gm: Private high- dimensional data release via privacy preserving phased generative model. arXiv preprint arXiv:2006. 12101, 2020.
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. Dp-cgan: Differentially private synthetic data and label generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 0-0, 2019.
Aleksei Triasteyn and Boi Faltings. Bayesian differential privacy for machine learning. In ICML, 2020a.
Aleksei Triastcyn and Boi Faltings. Generating Higher-Fidelity Synthetic Datasets with Privacy Guarantees. arXiv preprint WxXiv:2003.00997 2020b.
Mei Wang and Weihong Deng. Deep Face Recognition: A Survey. arXiv preprint /8x::mmtaXXx:::88066665. 2020.
Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled rényi differential privacy and analytical moments accountant. In The 22nd International Conference Artificial Intelligence and Statistics, pp. 1226-1235. PMLR, 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmise mnist: a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint arXiv: 1708.077777 2017.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXiv: urXiv:1802.06739) 2018.
12

---

Under review as a conference paper at ICLR 2021
Chugui Xu, Ju Ren, Deyu Zhang, Yaoxue Zhang, Zhan Qin, and Kui Ren. Ganobfuscator: Miti- gating information leakage under gan via differential privacy. IEEE Transactions on Information Forensics and Security, 14(9):2358 2071, 2019.
Jinsung Yoon, James Jordon, and Mihaela der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2019.
Xinyang Zhang, Shouling Ji, and Ting Wang. Differentially private releasing via deep generative model (technical report), arXiv preprint arXiv: 2018.
Yuqing Zhu and Yu-Xiang Wang. Poission subsampled rényi differential privacy. In International Conference on Machine Learning, pp- 7634-7642, 2019.
Yuqing Zhu, Xiang Yu, Manmohan Chandraker, and Yu-Xiang Wang. Private-knn: Practical dif- ferential privacy for computer vision. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
13

---

Under review as a conference paper at ICLR 2021
A OPTIMAL TRANSPORT VIA THE SINKHORN DIVERGENCE
In addition to the notations defined in Sec. 2.1 we denote the Dirac delta distribution at x E A' as 8r, and the standard n-simplex S
Recall from Sec. 2.2 that, given positive cost function c: x X + R+ and c 2 0, the Entropy Regularized Wasserstein Distance is defined as:
/ c(2, B)T +e log π(2, y) du(x)dv(v)) dr (a, v)
Wo, v) min KEll
where = {)(,,)) E P(X x X)) T(x )d = U, m(: vddy m
We use the Sinkhorn divergence, defined in Feydy al. (2019).
Definition A.1 (Sinkhorn Loss) The Sinkhorn loss between measures and v is defined as: (e, 2W..c(u,u) We,e(p, 11) We,(vv,)) v)
For modeling data-defined distributions, as in our situation, an empirical version can be defined, too. Note that use slightly different notation from the main text because it is more convenient to deal with empirical distributions rather than samples when relating to the dual formulation later on.
Definition A.2 (Empirical Sinkhorn loss) The empirical Sinkhorn loss computed over a batch of N generated examples and M real examples is defined as:
Se,c(is, 0) 20xx @ Pexx, - Cxx xxx Cry & P.Y.
where f = E S2. and = 1 M E 6y,- For two samples E XN and E X CAB the cost matrix between A and B, and PEA.B is an approximate optimal transport plan that minimizes Equ. computed over A and B.
P. is arrived at by iterating the dual potentials.
Cuturi 2013) and Feydy al. (2019) have shown the following dual formulation for the discritized version of Wer:
max (A, f) + (0, - c(p @ (xp (fg (10-0000000000000mmmmo0000000000 fIRES XSM
We, (P,
(10)
where denotes the product measure and @ denotes the "outer sum" such that the output is matrix of the sums of pairs of elements from each vector. Then, the optimal transport plan P relates to the dual potentials by Pa exp( [ @ (ang-C)a (á D). Thus, once find the optimal and g. can obtain Ps through this primal-dual relationship. We also know the first-order optimal conditions for and g through the Karush Kuhn Tucker theorem:
f: lclog Σ exp(log(e,)+ 1 C(x. 9 -c -cloog (xp(log((4)+ C(x,, V;))
(11)
To optimize f and it suffices to apply the Sinkhorn algorithm (Cuturi 2013 see Algorithm 3 in the main text. Readers can refer to Feydy (2020) for further details.
B DIFFERENTIAL PRIVACY
As discussed in Sec. 2.3 differential privacy is the current gold standard for measuring the privacy risk data releasing programs. It is defined as follows (Dwork et al. (006):
Definition B.1 (Differential Privacy) A randomized mechanism M D + R with domain 'D and range R satisfies (E, 8)DDP DP if for any adjacent inputs d, d' D differing by most one entry, and for any subset of oulputs S C R holds that
Pr[M(d) S) e Pr (M(d') E E +
(12)
14

---

Under review as a conference paper at ICLR 2021
Gradient perturbation: For parametric function fo(x)) parameterized by and loss fune- tion [(fo(z)))) y), usual mini-batched first-order optimizers update using gradients ge = N Di=1 VoL(fo(m;), Vi). Under gradient perturbation, the gradient is first clipped in L2 norm by constant A, and then noise sampled from from.N(O, (N(0,, o²I) is added. Since differential privacy is closed under poxt-prucessing-
1
perocessing-rlllsiinn releasing any transformation of the output of an (e, 6)-DP mechanism still (s, 5DP (Dwork & Roth 2014) the parameters & are also differentially private. The relation between (e, 6) and the perturbation parameters A and a is provided by the following theorem:
Theorem B.1 For e2 > 2 1og(11225 1.25/6), Gaussian mechanism with o 2 c / satisfies (s, differ- ential privacy. (Dwork & Roth 2014)
stochastic gradient descent (SGD) and related methods, randomly drawn batches of data are used in each training step instead of the full dataset. This subsampling of the dataset can provide amplification of privacy protection since the privacy of any record that is not in the batch automatically protected. Privacy bounds for various subsampling methods have been extensively studied and applied (Dwork et al. 2006 Wang et al., 2019: Balle et al. 2018 Zhu & Wang 2019).
Subsampling:
SGD requires the computation of the gradient to be repeated every iteration. The repeated application of privacy mechanisms on the same dataset is analyzed through composition. Composition of the Gaussian mechanism has been first analyzed by Abadi al. (2016) through the moments accountant method.
Composition:
We utilize the often used Rényi Differential Privacy (Mironov) 2017) (RDP), which is defined through the Rényi divergence between mechanism outputs on adjacent datasets:
Definition B.2 (Rényi Differential Privacy) A randomized mechanism M D R. with domain 'D and range R satisfies (ox, -RDDPP for any adjacent d, d' E C' it holds that
Da (a(M( S,,
(13)
where Do is the Rényi divergence of order a. Also, any M that satisfies (D, also satisfies (E + log 1/6 B)-D.
As discussed in the main text, RDP is a well-studied formulation of privacy that allows tight compo- iterations in
sition of multiple queries- definitions of DP with detinition B.2 Recall that for clipping threshold A and standard deviation of Gaussian noise a, the Gaussian mechanism satisfies (a,, a 2 )(2o=)))-RD (Mironov 2017). Pri- vacy analysis of a gradient-basee based learning algorithm entails accounting for the privacy cost of single queries, which corresponds to training iterations in our case, possibly with subsampling due mini- batched training. The total privacy cost is obtained by summing up the privacy cost across all queries or training steps, and then choosing the best a.
and can be easily converted standard
For completeness, the Rényi divergence is defined Da 1 log EREQ
P(x) Q(x)
a
C ALGOITHTS
Algorithm 3 Sinkhorn Algorithm W.(X Y)
Input: X = {x) ; Y = (y)m".e
Algorithm 2 Poosson Sample
Output: W.
V(i.j), ((.,))Cu.]+ c XX, Y₁)
Input: d d= d)((y,1) sampling ratio q
1) E X x {0. M,
f.g <-0
Output: = (6),, E xx (0. (o. L)) m 2 0
i. 1/ Unif(n), Unif(m) while not converged do
= for )
M i.i.d. Berouuli(g)
vi, f. +
-e log Em. exp()og(Px) +
g C(.
Y
{dz |2; = 1
Vj.g (
- log Σi_ (xp()og((t)) +
1f. ((RRs)
end while
W. = (n, f) + (0,g)
15

---

Under review as a conference paper at ICLR 2021
D EXPERIMENT DETAILS
D.1 DATASETS
MNIST and Fashion-MNIST both consist of 28x28 grayscale images, partitioned into 60k train- ing images and 10k test images. The 10 labels of the original classification task correspond to digit/object class. For calculating FID scores, we repeat the channel dimension times. CelebA composed of ~200 colour images of celebrity faces tagged with 40 binary attributes. We down- sample all images to 32x32, and use all 162770 train images for training and all 19962 test images for evaluation. Generation is conditioned on the gender attribute.
D.2 CLASSIFIERS
For logistic regression, we use scikit-learn's implementation, using the L-BFGS solver and capping the maximum number of iterations 5000. The MLP and CNN are implemented in Py PyTorhh. The MI.P has one hidden layer with 100 units and ReLU activation. The CNN has two hidden layers with and filters, and uses ReLU activations. We train the CNN with dropout (p = 0.5) between all intermediate layers. Both the MLP and CNN are trained with Adam under default parameters, and use 10% of training data as holdout for early stopping. Training stops after no improvement is seen in holdout aceuracy for 10 consecutive epochs.
D.3 ARCHITECTURE, HYPERPARAMETER AND IMPLEMENTATION
Our DCGAN-basee architecture uses 4 transposed convolutional layers with ReLU activations at the hidden layers and tanh activation at the output layer. A latent dimension 12 and class embedding dimension of is used for MNIST and Fashion- MNIST experiments. CelebA experiments use latent dimension of 32 and embedding dimension of 4. The latent and class embeddings are con- catenated and then fed to the convolutional stack. The first transposed convolutional layer projects the input to 256 X 7 x 7, with no padding. Layers 2.3 and have output depth [128, 64, 1]. kernel size [4, 4, 3), stride [2, 2, 1). and padding [1, 1].
Our BigGAN-based architecture uses residual blocks of depth 256, and a latent dimension of 32. Each residual block consists of three convolutional layers with ReLU activations and spectral nor- malization between each layer. Please refer to Brock et al. (2019) for more implementation details. Our implementation is based on htthtts:://// httpggtthhbbhc.oo com./ jjJorock/BBggGa-PyTTrre
In our experiments with the adversarially trained feature extractor, we used a simple feature ex- tractor with 3 convolutional layers with hidden depth of 64 and output depth of 32. Between each convolutional layer are batchnorm and ReLU layers, followed a 2 x 2 maxpool layer. The first two layers have kernel size 3 and padding 1, while the last layers have kernel size I with padding. For the generator Go and feature extractor ow, the adversarial loss objective can be formally expressed as:
min max Se(w), min max
(co(Go(s), P. Go(z))) (co(y,)), Py,,,))
((1tmm)) Where co(a, a) [llaing: Otaata Ol TTlassn 12 I"
[bings atpbaabel Oa [oomm
(bimm)
1'1
Codu ([aamg Btabet], [bamg- blabet])
Hyperparameters of the Sinkhorn loss used were: aa 15, and entropy regularization e = 0.05 in MNIST and Mashion-MNIST experiments. = 5 is used for CelebA experiments. We use the im- io qe
plementation publically available at hhttps:: :ettps://wwet //w//w.w... www.eel-ppeeattioooe api/install and all other hyperparameters are kept at their default values. For all experiments, we use the Adam (Kingma Ba 2015) optimizer with learning rate 10 - B = (0.9, 0.999), weight decay 2 x 10-5
16

---

Under review as a conference paper at ICLR 2021
Figure 4: Additional DP-Sinkhorn generated images under (10, 10 10=")diffrrential privacy. Top two rows use DCGAN based generator, while bottom two rows use BigGAN based generator.
D.4 IMPLEMENTATION OF DIFFERENTIAL. PRIVACY
For privacy accounting, Privacy All experiments employing the pixel-wise L2 cost use Poisson sampling, and are amenable to the analysis implemented in compute. e_rdp. For the experiments with the batch-wise feature extractor, examples are batched into records at the start of training, and a single record is drawn at random in each iteration. The privacy amplification for this fixed-size sampling scheme is studied in Wang et al. (2019), and we use the author's 's implementation of Theorem 9 for bounding the RDP cost of our queries.
the implementation of the RDP Accountant available in Tensorflow
For MNIST and Fashion-MNIST results reported in the main body, we use a noise scale of a = 1.1 and batch size of 50 resulting in q 1/1200, which gives us 3.4 million training iterations to reach & = 10 for 8 = 10-5. For the non-private runs, we use a batch size of 500, which improves image quality and diversity. When training with DP, increasing batch size significantly increases the privacy cost per iteration, resulting in poor image quality for fixed e 10. Image gradient perturbation used clipping norm bound of 0.5, while the parameter gradient perturbation variant used clipping norm bound of 1.
For CclebA results reported in the main body, we use a noise scale of a 0.8 and a batch size of 200 resulting in q 0.00123. At 8 10 6, we train for 1.1 million steps to reach 10.
E ADDITIONAL RESULTS
We evaluate the impact of architecture choice the performance in the CelebA task by comparing Sinnhoon--BiGAN with DP-Sinkhoo=DDCGNN under pixel loss. Results are summarized in
Table 3 and visualized in Figure 4 Qualitatively, despite reaching lower FID score, the DCGAN- based generator's s images have visible artifacts that are not present in models trained with BigGAN- generators.
Table 3: Differetially private image generation results downsampled CelebA.
Acc (%)
Method
DP-e
FID
MLP
CNN
Real data
80
1.1
91.9
95.0
DCGAN=DP-Sinkee
10
156.7
74.96
74.62
BigGAN+DP-Sinee -innhhr
10
168.4
76.18
75.79
17

---

Under review as a conference paper at ICLR 2021
0
1
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
O
1
1
3
4
5
6
7
8
9
0
2
3
9
5
6
7
8
9
O
1
4
5
6
7
8
9
01
2
3
4
5
6
7
8
9
O
|
2
4
5
6
6
7
8
9
0 1
2
3
4
5
6
7
8
9
O
1
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
0
2
3
4
5
6
7
8
9
0 I
2
3
4
5
6
8
9
0
2
3
4
5
6
7
8
9
0 1
2
3
4
6
7
8
9
0 2
3
4
5
6
7
8 9
0 1 2
3
4
5
6
7
8 9
0
2
3
4
5
6
7
8
9
Figure 5: Additional images generated by DP-Sinkhorn, trained MNIST. Left: Images gener-
ated using parameter gradient perturbation; these correspond the "DP-Sinkhorn (VoS)" row in the main table. Right: Images generated using gradient perturbation on generated images; these correspond to the "DP-Sinkhorn" in the main results table.
Figure 6: Additional images generated by DP-Sinkhorn, trained on Fashion-MNIST. Left: Images generated using parameter gradient perturbation; these correspond to the "DP-Sinkhorn (V,Sy" row in the main table. Right: Images generated using gradient perturbation on generated images; these correspond to the "DP-Sinkhorn" row in the main results table.
18

---

Under review as a conference paper at ICLR 2021
Table Comparison of training DP-Sinkhom with various optimizers and learning rates MNIST. Batch size is 50 and DP é = 10. The first row corresponds to the configuration used in results reported in Table
Runs which did not converge are highlighted in red.
Ace (%)
Optimizer
Learning rate
Log Reg
MLP
CNN
Adam
le-5
124.3
82.0
80.8
79.9
SGD
le-5
135.0
77.1
77.6
78.8
RMSProp
le-5
135.4
78.8
79.6
77.6
Adam
le-6
137.7
78.4
79.5
78.6
Adam
le-4
158.5
78.1
79.4
76.5
Adam
le-3
158.2
76.8
77.3
76.1
Adam
le-2
491
08.4
13.2
10
SGD
1e-6
137.7
78.4
79.5
78.6
SGD
le-4
175.6
75.9
76.1
74.6
SGD
le:3
360
10.2
5.6
8.7
Table 5: Comparison of training DP-Sinkhorn with various batch sizes and noise scales (a) MNIST. We use an Adam optimizer with learning rate le-5, and DP e = 10 used as target to determine the number of epochs. The first corresponds the configuration used in results reported in Table
Acc (%)
Batch size
Noise scale
FID
Log Reg
MI.P
CNN
50
1.1
124.3
82.0
80.8
79,9
50
0.9
135.6
80.3
78.5
77.0
50
1.3
140.6
82.1
80.5
79.6
100
0.9
78.8
78.8
79.2
100
1.1
131.4
79.4
79.8
77.6
100
1.3
122.1
78.9
78.6
76.7
200
2
113.8
73.1
73.4
72.8
19


Reviews:
[{"review_id": "pf6MMEK8z2h", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents a differentially private method for training a generative model. The proposed method takes advantage of the Sinkhorn divergence to achieve robustness against the hyperparameters' choices. The authors also introduce a cost function enabling the generative model to generate images associated with a specific class label. The experimental results show that the proposed method outperforms the existing methods for learning a generative model in a differentially private manner. Furthermore, such a high accuracy can be achieved without the use of publicity available data.\n\nThe strong points of this paper are as follows:\n-  The authors bring the Sinkhorn divergence-based learning of a generative model into the differentially private generative model learning problem.\n\nThe weak points of this paper are as follows:\n- The proposed method is not clearly explained and thus is suspicious in the guarantee of differential privacy.\n- The presented method is a direct application of Wang et al.'s moment account technique with Zhu et al.'s Poisson sampling. The originality is considerably low.\n- This paper has no theoretical and experimental analysis about robustness against a hyperparameter choice, while the authors claim it as a contribution.\n- The proposed approach is not well motivated. We can use some differentially private classification algorithm if the objective is high accuracy in downstream classification.\n\nI recommend rejection of this paper because the proposed algorithm has low originality and is not well motivated. Also, the unclarity of the privacy guarantee is problematic.\n\nThe authors do not give a clear explanation of the proposed method. In particular, it is unclear if the proposed algorithm guarantees differential privacy. I guess the authors employ either the composition theorem or moment account technique to prove the algorithm's differential privacy; however, there is no privacy proof of the proposed algorithm. I could not confirm that the proposed method ensures differential privacy.\n\nThe proposed method is a straightforward application of the techniques from Wang et al. and Zhu et al. Also, defining the cost function as in Eq. 4 is a straightforward way to combine the multidimensional real-valued data and discrete label. I cannot find any original idea, except introducing the Sinkhorn divergence, in the proposed method.\n\nThe authors claim that the proposed method is robust against the choice of its hyperparameters. However, there is no evidence to support the claim. A theoretical or experimental analysis of robustness is necessary to claim it.\n\nWhy don't we employ the differentially private classification algorithm, such as M. Adabi et al. Deep Learning with Differential Privacy. In CCS'16. When the objective is high accuracy in the downstream classification, we can utilize such an algorithm directly. What is the benefit of employing the generative model-based privacy preservation? The differentially private classification algorithm can achieve high classification accuracy; for example, in Adabi et al.'s paper, the classification accuracy for MNIST with eps=10 is 97%; this value is significantly higher than that of the proposed method.\n\n\n### Minor comments\n\n- What is the definition of $\\hat{S}$? ", "extra_scores": {}, "extra_text": {}}, {"review_id": "jXANwv7tWKN", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a method for training OT GANs using differentially private sinkhorn algorithm. The idea is very simple - train GANs with sinkhorn divergences and add Gaussian noise to the gradient of output wrt generated samples. So, the novelty by itself is minimal as sinkhorn GANs have previously been proposed. The method merely adds Gaussian noise to gradients. The DP analysis is also not very different.\n\nI am generally ok with incremental improvements in method if experimental results are strong. This doesn't seem to be the case in this paper. Two datasets are considered - MNIST and CelebA. In MNIST, we observe that the algorithm performs poorly compared to GS-WGAN both in inception score and FID. The method gets better accuracy though. This suggests that the method does not produce diverse samples. For example, consider a case of a mode collapse where a GAN generates only one sample per class. In this case, FID scores will be poor. However, if the generated sample correcly corresponds to the class, classification score will be high. My guess is similar thing is happening here. This is evident even in Fig 2 where the method has much poor sample diversity compared to GS-WGAN. Hence, the model itself is not that great.\n\nIn CelebA, despite using BigGAN style architecture, there is significant blur. The real challenge in differential private GANs is to generate samples with good quality while still satisfying privacy constraints.  This doesnt seem to be happening here. Also, comparison with GS-WGAN or other differentially private GANs are missing in CelebA experiment.\n\nFor conditional generation, is concatenation of data and labels in cost function a good strategy? It looks like both data and label space is very different, and I am wondering if such type of concatenation might be weak. Can you comment on this.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "BZ5B7hvYf2z", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a novel architecture and training process for learning differentially private synthetic data generators. \n\nRather than taking an explicit adversarial GAN approach, the paper looks at minimizing a regularized Wasserstein distance (called the Sinkhorn loss) between the empirical distribution of the data and the synthetic distribution. \n\nTheir approach brings two benefits: first, the Sinkhorn loss is more straightforward to optimize than traditional GANs. The authors don’t really discuss why this is, but my understanding is that the “adversary” is contained in the dual formulation of Wasserstein distance (as the minimum over Lipschitz functions of the difference in expectation between two distributions). Considering such a Lipschitz adversary simplifies optimization. \n\nSecond, the paper uses an idea first published by Chen et al (NeurIPS 2020) but described as independent work here: Instead of measuring the gradient of the full parametric distribution of the generator, the authors measure the gradient “at the generated image level”. This gives a lower-dimensional gradient (requiring less noise). \n\nOverall, the paper achieves a moderate improvement over the work of Chen et al with respect to a few simple measures of accuracy (namely, how well two DNN models do at classifying real data when they are trained on synthetic data). It does considerably worse than Chen et al’s method with respect to the FID score, a measure of visual similarity. \n\nI generally like the idea of exploring alternate training strategies. Nevertheless, I have several reservations about the paper: \n\n1. The relationship to Chen et al. It seems like much of the gain relative to previous work comes from the way gradients are compressed. But this idea appears already in the NeurIPS paper of Chen et al. It is unclear to me how to handle the relative priority of the papers. \n2. Overly simplistic accuracy measures: Wasserstein (or Sinkhorn) distance is a natural loss function, but it is only likely to be a really good measure of accuracy when it is very small. The DP literature, since the pioneering work of Blum, Ligett, and Roth, has focused on using as a loss function the minimum over a (potentially enormous but) task-specific set of queries as the ultimate loss. We understand as a field that general-purpose synthetic data isn’t really possible (it preserves “too many statistics, too accurately” to avoid attacks). How can the framework here be adapted to such accuracy measures? How well does DP Sinkhorn do when measured against such task-specific accuracy? Can DP Sinkhorn be applied to anything except images (and if so, how well does it do)?\n\nOverall, I find the paper interesting but perhaps borderline. \n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes a DP method for generative modelling based on optimal transport. The reviewers agree that the novelty is limited in relation to prior work, while the results are not especially compelling either. So, even though this is a valid approach, correctness is not sufficient for acceptance at ICLR. 

Decision: Reject