Differentially Private Mixed-Type Data Generation For Unsupervised Learning
Authors: Uthaipon Tantipongpipat
Chris Waites
Digvijay Boob
Amaresh Siva
Rachel Cummings
Venue:  (2020)
Keywords: Differential privacy
synthetic data
private data generation
mixed-type
unsupervised learning
autoencoder
GAN
private deep learning

Abstract: In this work we introduce the DP-auto-GAN framework for synthetic data generation, which combines the low dimensional representation of autoencoders with the flexibility of GANs.  This framework can be used to take in raw sensitive data, and privately train a model for generating synthetic data that should satisfy the same statistical properties as the original data.  This learned model can be used to generate arbitrary amounts of publicly available synthetic data, which can then be freely shared due to the post-processing guarantees of differential privacy.  Our framework is applicable to unlabled \emph{mixed-type data}, that may include binary, categorical, and real-valued data.  We implement this framework on both unlabeled binary data (MIMIC-III) and unlabeled mixed-type data (ADULT).  We also introduce new metrics for evaluating the quality of synthetic mixed-type data, particularly in unsupervised settings.

Under review as a conference paper at ICLR 2020
DIFFERENTIALLY PRIVATE MIXED-TYPE DATA GENERATION FOR UNSUPERVISED LEARNING
Anonymous authors Paper under double-bling review
ABSTRACT
In this work we introduce the DP-auto-GAN framework for synthetic data gener- ation, which combines the low dimensional representation of autoencoders with the flexibility of Generative Adversarial Networks (GANs). This framework can be used to take in raw sensitive data, and privately train model for generating synthetic data that will satisfy the same statistical properties as the original data. This learned model can be used to generate arbitrary amounts of publicly available synthetic data, which can then be freely shared due to the post-processing guaran- tees of differential privacy. Our framework is applicable to unlabeled mixed-type data, that may include binary, categorical, and real-valued data. We implement this framework on both unlabeled binary data (MIMIC-III) and unlabeled mixed- type data (ADULT). We also introduce metrics for evaluating the quality of synthetic mixed-type data, particularly in unsupervised settings.
INTRODUCTION
As data storage and analysis are becoming more cost effective, and data become more complex and unstructured, there is growing need for sharing large datasets for research and learning purposes. This is in stark contrast to the previous statistical model where a data curator would hold datasets and answer queries from (potentially external) analysts. Sharing entire datasets allows analysts the freedom to perform their analyses in-house with their own devices and toolkits, without having to pre-specify the analyses they wish to perform. However, datasets are often proprictary or sensitive, and cannot be shared directly. This motivates the need for synthetic data generation, where new dataset created that shares the same statistical properties as the original data. These data may not be of single type: all binary, all categorial, or all real-valued; instead they may be of mixed-types, containing data of multiple types in a single dataset. These data may also be unlabeled, requiring techniques for unsupervised learning, which is typically more challenging task than supervised learning on labeled data.
Privacy challenges naturally arise when sharing highly sensitive datasets about individuals. Ad hoc anonymization techniques have repeatedly led to severe privacy violations when sharing "anonymized" datasets. Notable examples include the Netflix Challenge (Narayanan & Shmatikov 2008), the AOL Search Logs (Barbaro & Zeller (006). and Massachusetts State Health data (Ohm, 2010 where linkage attacks publicly available auxiliary datasets were used to reidentify individ- uals in the dataset. Even deep learning model have been shown to inadvertently memoize sensitive personal information such as Social Security Numbers during training (Carlini al. 2019).
Differential privacy (DP) (Dwork et al. 2006) (formally defined in Section 2 has become the de facto gold standard of privacy in the computer science literature. Informally, it bounds the amount the extent to which an algorithm can depend on a single datapoint in its training set. This guarantee ensures that any differentially privately learned models do not overfit to individuals in the database, and therefore cannot reveal sensitive information about individuals. It is an information theoretic notion that does not rely on any assumptions of an adversary's 's computational power or auxiliary knowledge. Furthermore, it has been shown empirically that training machine learning models with differential privacy protects against membership inference and model inversion attacks (Triastcyn & Faltings| 2018, Carlini et al.) 2019). Differentially private algorithms have been deployed at large scale in practice by organizations such as Apple, Google, Microsoft, Uber, and the U.S. Census Bureau.

---

Under review as a conference paper at ICLR 2020
Much of the prior work differentially private synthetic data generation has been either theoretical algorithms for highly structured classes of queries (Blum et al. 2008 Hardt & Rothblum 2010) or based on deep generative models such as Generative Adversarial Networks (GANs) autoencoders. These architectures have been primarily designed for either all-binary or all-real-valued datasets, and have focused the supervised setting, where datapoints labelled.
In this work we introduce the DP-auto-GAN framework, which combines the low dimensional rep- resentation of autoencoders with the flexibility of GANs. This framework can be used to take in raw sensitive data, and privately train a model for generating synthetic data that should satisfy the same statistical properties as the original data. This learned model can be used to generate ar- bitrary amounts of publicly available synthetic data, which can then be freely shared due to the post-proee prosessnnssiing guarantees of differential privacy. We implement this framework on both unlabeled binary data (for comparison with previous work) and unlabeled mixed-type data. We also introduce new metrics for evaluating the quality of synthetic mixed-type data, particularly in unsupervised settings.
1.1 OUR CONTRIBUTIONS
In this work, we provide three main contributions: new algorithmic framework for privately gen- crating synthetic data, new evaluation metrics for measuring the quality of synthetic data in unsu- pervised settings, and empirical evaluations of our algorithmic framework using our new metrics, as well as standard metrics.
Algorithmic Framework. We propose new data generation architecture which combines the ver- satility of an autoencoder (Kingma & Welling 2013) with the recent success of GANs on complex data. Our model extends previous autoencoder- based DP data generation (Abay al. 2018 Chen eet al. 2018) by removing an assumption that the distribution of the latent space follows a mixture of Gaussian distribution. Instead, we incorporate GANs into the autoencoder framework so that the generator must learn the true latent distribution against the discriminator. We describe the composi- tion analysis of differential privacy when the training consists of optimizing both autoencoders and GANs (with different noise parameters). Furthermore, in this analysis we halve the noise injected into autoencoder from all existing works while provably maintaining the same mathematical privacy guarantee.
Unsupervised-L.earee Evaluation Metric of Synthetic Data. We define several new metries that evaluate the performance of synthetic data compared to the original data when the data is of mixed- type. Previous metrics in the literature are applicable only to all-binary or all-real-vaad valued datasets. Our new metries generalize the previously used metrics (Choi et al. 2017 Xie et al.) 2018) from all- binary data to mixed-type by training various learning models to predict each feature from the rest of the data in order assess correlation between features. In additional, particular feature to be specified as a label, and therefore do not assume a supervised-learnin nature of the data, as in much of the previous work does (Papernot et al. 2017 2018 Jordon al. 2018).
metries do not require
Empirical Results. We empirically comepare the performance of our algorithmic framework on the MIMIC-III medical dataset (Johnson al., 2016) and UCI ADULT Census dataset (Dua & Grafi) 2017) using previously studied metrics in literature (Frigerio et al., 2019 Xie et al.) 2018). Our experiments show that our algorithms perform better, and allow significantly improved values with ~ 1, compared to prior work (Xie et al.] 2018) with = 200. We evaluate our synthetic data using new quantitative and qualitative metries, confirming that the performance of our algorithm remains high even for small values of e, corresponding to strong privacy guarantees. Our code is made publicly available for future use and research.
1.2 RELATED WORK ON DIFFERENTIALLY PRIVATE DATA GENERATION
Early work on differentially private synthetic data generation was focused primarily on theoretical algorithms for solving the query release problem of privately and accurately answering large class of pre-specified queries on a given database. It was discovered that generating synthetic data on
which the queries could be evaluated allowed for better privacy composition than simply answering all the queries directly (Blum et al. 2008 Hardt & Rothblum, 2010; Hardt et al.) 2012) Gaboardi et al. 2014). Bayesian inference has also been used for differentially private data generation (Zhang
2

---

Under review as a conference paper at ICLR 2020
et al. 2017 Ping et al., 2017) by estimating the correlation between features. See Surendra & Mohan (017 for a survey of techniques used in private synthetic data generation through 2016.
In 2016. Abadi et al. (2016) introduced framework for training deep learning models with dif- ferential privacy. Non-convex optimization, which is required when training deep models, can be made differentially private by adding Gaussian noise to clipped morr-bbuudddd gradient in each training step. [Abadi et al. (2016) also introduced the moment accountant privacy analysis for pri- vate stochastic gradient descent, which provided much tighter Gaussian-bace bassed privacy composition and allowed for significant improvements in accuracy over previously used composition techniques, such as advanced composition Dwork et al. (2010). The moment account was later defined in terms of Renyi Differential Privacy (RDP) (Mironov, (017)) which is a slight variant of differential pri- vacy designed for easy composition, partieularly for differentially private stochastic gradient descent (DP-SGD). Much of the work that followed on private data generation used deep theural-network- based) generative models to generate synthetic data, and can be broadly categorized into two types: autoencoder-bact and GAN-based. Our algorithmic framework is the first to combine both DP GANs and autoencoders into one framework.
Differentially Private Autoencoder-Bane Based Models. A variational autoencoder (VaE) Kingma & Welling, 2013) is generative model that compresses high-dimensional data to smaller space called latent space. The compression is commonly achieved through deep models and can be differentially privately trained (Chen et al.) 2018 Acs et al., 2018). VaE makes the (often unrealistic) assumption that the latent distribution Gaussian. (As et al. (2018) uses Restricted Boltzmann machine (RBM) to learn the latent Gaussian distribution, and Abay et al. (2018) uses expectation maximization to learn a Gaussian mixture. Our work extends this line of work by additionally incorporating the generative model GANs which have also been shown to be successful in learning latent distributions.
Differentially Private GANs. GANs are a generative model proposed by Goodfellow et al. (2014) that have been shown success in generating several different types of data (Mogren. 2016 Saito
al. 2017: Salimans et al. 2016 Jang et al. 2016; Kusner & Hernández-Lobato 2016; Wang et al. 2018). As with other deep models, GANs can be trained privately using the aforementioned private stochastic gradient descent (formally introduced in Section 2.T). Additional related work, including variants of the DP GAN framework, optimization techniques to improve the performance of DP GANS, and Table 4 summarizing these works can be found in Appendix D
Differentially Private Generation of Mixed-Type Data. Next we describe the three most relevant recent works on privately generating synthetic data of mixed type. [Abay et al. (2018) consider the problem of generating mixed-type labeled data with k possible labels. Their algorithm, DP- SYN, partitions the dataset into & sets based on the labels and trains a DP autoencoder on each partition. Then DP expectation maximization (DP-EM) algorithm of Park et al. (2017) is used to learn the distribution in the latent space of encoded data of the given label-class. The main workhorse, DM-EM algorithm, is designed and analyzed for Gaussian mixture models and more general factor analysis models. Chen et al. (2018) works in the same setting, but replaces the DP auto-encoder and DP-EM with a DP variational auto- encoders DDE). Their algorithm assumes that the mapping from real data to the Gaussian distribution can be efficiently learned by the encoder. Finally, |Frigerio et al. (2019) used a Wasserstein GAN (WGAN) to generate differentially private mixed-type synthetic data. This type of GAN uses a Wasserstein-distance- based loss function in training. Their algorithmic framework privatized the WGAN using DP-SGD, similar to the previous approaches for image datasets (Zhang et al., 2018 Xie et al. 2018). The methodology of Frigerio ct al. (019)) for generating mixed-type synthetic data involved two main ingredients: changing discrete (categorical) data to binary data using one-hot encoding, and adding an output softmax layer to the WGAN generator for every discrete variable.
Our framework is distinct from these three approaches. We use differentially private auto-encoder which, unlike DP-VaE of Chen et al.] (2018), does not require mapping data to a Gaussian distribu- tion. This allows to reduce the dimension of the problem handled by the WGAN, hence escaping the issues of nigh-dimensionalityy from the one-hot encoding of Frigerio et al. (001)). We also use DP-GAN, replacing DP-EM in Abay et al. (2018), for learning distributions the latent encoded
space.
Evaluation Metries for Synthetic Data. Various evaluation metries have been considered in the literature to quantify the quality of the synthetic data (see Charest (2011) for a survey). The metrics
3

---

Under review as a conference paper at ICLR 2020
can be broadly categorized into two groups: supervised and unsupervised. Supervised evaluation metrics are used when there are clear distinctions between features and labels of the dataset, c.g., for healthcare applications, person's disease status is natural label. In these settings, predictive model is typically trained on the synthetic data, and its accuracy is measured with respect to the real (test) dataset. Unsupervised evaluation metrics are used when feature of the data can be decisively termed as label. Recently proposed metrics include dimension-wise probability for binary data (Choi et al., 2017), which compares the marginal distribution of real and synthetic data on each individual feature, and dimension-witn wise prediction which measures how closely synthetic data captures relationships between features in the real data. This metric was proposed for binary data, and we extend it here to mixed-type data. Recently, NIST (2019) used a 3-way marginal evaluation metric which used three random features of the real and synthetic datasets to compute the total variation distance as a statistical score. See Appendix (o more details on both categories of metrics, including Table [ which summarizes the metrics' applicability to various data types.
2 PRELIMINARIES ON DIFFERENTIAL PRIVACY
In the setting of differential privacy, a dataset X consists of m individuals' sensitive information, and two datasets are neighbors if one can be obtained from the other by the addition or deletion of one datapoint. Differential privacy requires that an algorithm produce similar outputs on neighboring datasets, thus ensuring that the output does not overfit to its input dataset, and that the algorithm learns from the population but not from the individuals.
Definition 1 (Differential privacy (Dwork et al., 2006).. For e,8 > O, an algorithm M is (e, 8)- differentially private for any pair of neighboring databases X, X' and any subset S C Range(MM),
Pr(M(X) E S S et -Pr[M(X') E 6.
A smaller value of e implies stronger privacy guarantees (as the constraint above binds more tightly), but usually corresponds with decreased accuracy, relative to non-pn non-private algorithms or the same algorithm run with a larger value of e. Differential privacy is typically achieved by adding random noise that scales with the sensitivity of the computation being performed, which is the maximum change in the output value that can be caused by changing a single entry. Differential privacy has strong composition guarantees, meaning that the privacy parameters degrade gracefully additional algorithms are run on the same dataset. It also has post-processing guarantee, meaning that any function of differentially private output will maintain the same privacy guarantees.
2.1 DIFFEENTIALLY PRIVATE STOCUASTIC GRADIENT DESCENT (DP-SGD)
The DP-SGD framework (given formally in Algorithm 5 in Appendix D.1p is generically applicable for private non-convex optimization. In our proposed model, we use this framework to train the autoencoder and GAN.
Training deep learning models reduces to minimizing some (empirical) loss function f(X;)) ==
m - EE= [(xx;;;; () on a dataset X {I; E RT) Typically f is nonconvex function, and common method to minimize f is by iteratively performing stochastic gradient descent (SGD). To make SGD private, [Abadi et al. (2016) proposed to to first clip the gradient of each sample to ensure bounded f2-norm, and then add multivariate Gaussian noise to the gradient. The clipping reduces the scale of noise that must be added preserve differential privacy. The noisy-clipped- gradient is then used in the update step instead of the true gradient. Further details of this procedure are deferred to Appendix D.I
A variant notion of differential privacy, known as Renyi Differential Privacy (RDP) (Mironov) 2017 that is often used to analyze privacy for DP-SGD. randomized mechanism M is (a,, RDP for all neighboring databases X' that differ in at most one entry,
RDP(a) = Da (M(()))))(( Se
where (Pll() ب log E
P(x) is the Renyi divergence or Renyi entropy of order Q(z)
a between two distributions P and Q. Renyi divergence is better tailored to tightly capture the privacy loss from the Gaussian mechanism that used in DG-SGD, and is common analysis tool
4

---

Under review as a conference paper at ICLR 2020
for DP-SGD literature. To compute the final (e, diifferrnnt privacy parameters from iterative runs of DP-SGD, one must first compute the subsampled Renyi Divergence, then compose privacy under RDP, and then convert the RDP guarantee into DP. Further details of this process given in Appendix D.2
3
ALGORITHMIC FRAMEWORK
The overview of our algorithmic framework DP-auto-GAN is shown in Figure and the full details given in Algorithm T The algorithm takes in raw data points, and pre-processes these points into m vectors T1..... Z' E R" to be read by DP-auto-GAN, where usually n very large. For example, categorical data may be pre-processed using one-hot encoding, text may be converted into numerical values. Similarly, the output of DP-auto-GAN can be post-processed from R back the data's original form. We assume that this pre- and post-processing can done based on public knowledge, such as possible categories for qualitative features and reasonable bounds on quantitative features, and therefore does not require privacy.
Within the DP-auto-GAN there are two main components: the autoencoder and the GAN. The autoencoder serves to reduce the dimensionality of the data before it is fed into the GAN. The GAN consists of generator that takes in noise sampled from distribution Z and produces G (=) E IR., and discriminator D.,.) R" - {0, 1). Because of the autoencoder, the generator only needs to synthesize data based on the latent distribution Rdd, which a much easier task than synthesizing in the original high-dimensional space IR. Both components of our architecture, as well as our algorithm's overall privacy guarantee, are described in the remainder of this section.
Autoencoder Loss
De(En(s)).... De(Em(X,))
Training
Xy.
Encoder En())
Decader De(-)
Privste
Latent Rd
Raw Data
ge
Public
Postpracess
Synthetic Data
Generator Training
6,03
De(G,,t)) e a
Discriminator
Discriinator
Biscr iminwttrr Training
Training
Wasserstein Loss
Figure I: The summary our DP-auto-GAN algorithmic framework. Pre- and post-processing (in black) are assumed to be public knowledge. Encoder and generator (in green) are trained without noise injection, whereas decoder and discriminator (in yellow) are trained with noise. The four red arrows indicate how data are forwarded for each training: autoencoder training, generator training, and discriminator training. After training, the generator and decoder (but not encoder) are released to the public generate synthetic data.
3.1 AUTOENCODER TRAINING
The autoencoder consists of the encoder Ens(-) R" + IRd and decoder Dea(-) Rd - R" parametrized by edge weights Φ 8, respectively. The architecture of the autoencoder assumes that nigh-dimensional data I; R called latens space. The encoder Eng is trained to find such fow-dimensional representations. We also need the decoder, Deg, map this point Eng (xxz in the latent space back to 2; A measure of
be represented compactly in low-dimensional space Rd also
5

---

Under review as a conference paper at ICLR 2020
the information preserved in this process is the error between the decoder's image and the original Di. Thus a good autoencoder should minimize the distance dist( Dey Enn(x;)). 24) for each data- point 2; and the appropriate distance function dist. Our autoencoder uses binary cross entropy loss: it dist(ar, y) = - وi=1 B(y) log( Σソ= (C)) log(1 t(t)) (where ziy) is the jth coordinate of x E ).
This also motivates the definition of (true) loss function Ez~zy (dist(Dee(En((t:)) æ;)l when data are drawn independently from an underlying distribution Zx. The corresponding empirical loss function when have access to sample { is
Lauto (0. 0) ==
m i=
dist( Des (Eng (T,n
(I)
The task of finding good autoencoder reduces to optimizing ø and 0 to yield small empirical loss as in Equation !
We minimize Equation I privately using DP-SGD (described in Section 2. Our approach differs
from previous work on private training of autoeneoders (Chen al. 2018 Aes et al. 2018, Abay et al. 2018) by not adding noise to the decoder during DP-SGD, whereas previous work adds noise to both the encoder and decoder. This improves performance by reducing the noise injected into the model by half, while still maintaining the same privacy guarantee (see Proposition 3 The full description of our autoencoder training is given in Algorithm ( in the appendix. In our DP-auto- GAN framework, the autoencoder is trained first until completion, and is then fixed for the second phase of training GAN.
3.2 GAN TRAINING
A GAN consists of the generator G., and discriminator D, R" :R" {00, 1}, parameterized respec- tively by edge weights w and y. The aim of the generator Ga, is to synthesize (fake) data similar to the real dataset, while the aim of discriminator to determine whether an input v, is from the generator's s synthesized data (and assigning label (z,) 0) or is real data (and assigning label (z; = 1). The generator is seeded with a random noise 2 ~ Z that contains no information about real dataset, such multivariate Gaussian vector, and aims generate distribution Gz) that is hard for D, is distinguish from the real data. Hence, the generator wants to minimize the probability that D,, makes a correct guess, [g,zz[1 (1 (G (=))]. At the same time, the discrimi- nator wants to maximize its probability of correct guess when the data is fake Ezzz Dy and when the data is real Ez-2x (Dy (x:)
We generalize the output of D, to a continuous range [o. 1]. with the value indicating the confidence that sample is real. We use the zero-sum objective for the discriminator and generator proposed by Arjovsky et al. (2017) and motivated by the Wasserstein distance of two distributions. Although their proposed Wasserstein objective cannot be computed exactly, can be approximated by optimizing the objective:
( min, max,, Oly, w) = RE-Zx (D, (x)) -
(2)
We optimize Equation privately using the DP-SGD framework described in Section 2. We differ from prior work on DP GANs in that our generator G- outputs data (2) in latent space Rd which needs to be decoded to De(G..(z)) before being fed into the discriminator D (z).). The gradient V. W. is obtained by backpropagation through one more component En(-). Hence, the training of generator remains totally private because the additional component En((-) is fixed and never accesses the private data. The full description of our GAN training is given in Algorithm in the appendix.
At the end of the two-phase training (including autoencoder and GAN), the noise distribution Z. trained generator G.(.), (-), and trained decoder De(-) are released to the public. The public can then generate synthetic data by sampling 2 ~ Z obtain a synthesized datapoint En(G,((2) repeatedly to obtain synthetic dataset of any desired size.
3.3 PRIVACY ACCOUNTING
Our autoencoder and GAN are trained privately by adding noise to the encoder and discrimina- tor. Since the generator only accesses data through the discriminator's (privatized) output, then the

---

Under review as a conference paper at ICLR 2020
trained parameters of generator are also private by post-processing guarantees of differential privacy. Finally, we release the privatized decoder and generator, together with generator's noise distribution Z and post-processing procedure, both of which are assumed to be public knowledge.
The privacy accounting is therefore required for the two parts that access real data X: training the autoencoder and the discriminator. In each training procedure, we apply the RDP accountant (described in Section 2.1 and Appendix (D.2) to analyze privacy of the DP-SGD training algorithm, compute final (e, DDP bound. Our application of the RDP accountant diverges from the previous literature in two main ways.
First, we do not add noise decoder during the autoencoder training, which is contrary to prior work that adds noise to both the encoder and decoder. Our approach of not adding noise to the decoder does not affect the algorithms'' overall privacy guarantees. This claim stated formally in the following corollary, which follows immediately from Propositions and
Corollary 2. Suppose autoencoder in DP-auto-GAN is trained with RDP privacy RDP and the discriminator in DP-auto- GAN is trained with RDP privacy RDPp(.), then -aaat---GA is RDP with values RDP auto (.mooo-)RDPD((
Second, the privacy analysis must account for two phases of training, usually with different privacy parameters (due to different batch sampling rates, noise, and number of iterations). One obvious solution to calculate the desired (c, 5)-DP parameter obtained from each phase and compose them to obtain (c1 + Eg. 81 + 5DD using basic composition of differential privacy (Dwork et al. 2006). However, we can obtain a tighter privacy bound by composing the privacy the Renyi Divergence level before translating Renyi Divergence into (c, 6)-DP. In other words, we first apply Proposition
4 to compute RDP(-) of two-phase training before applying Proposition to translate RDP into DP. In practice, this reduces the privacy parameter by
This is the approach highlighted in Corollary 2
about 30%.
4 EVALUATION METRICS
In this section, we discuss the evaluation metrics that we use in the experiments (described Sec- tion 5) to empirically measure the quality of the synthetic data. Some of these metrics have been used in the literature, while many are novel contributions in this work. The evaluation metrics are summarized in Table our contributions in bold.
For the first two metrics described below, the dataset should be partitioned into a training set R E Rmixn and testing set T E RR where m my m2 is the total number of samples the real data, and n is the number of features in the data. After training the DP-auto-GAN, we use it to create a synthetic dataset S E mm Xn for sufficiently large ma.
Dimension-wise probability. This metric is used when the entire dataset is binary, and it serves as a basic sanity check verify whether DP-auto-GAN has correctly learned the marginal distribution of each feature. Specifically, it compares the proportion of I's (which can be thought of as estimators of Bernoulli success probability) each feature of the training set R and synthetic dataset S.
Dimension-wise prediction. This metric evaluates whether Paautt-GANN has correctly learned the relationships berween features. For the k-th feature of training set and synthetic dataset S, we choose yR. E mR and ys. RR as labels of a classification or regression task based on the type of that feature, and the remaining features R_ and S_, k are used for prediction. We train either a classification regression model and measure their goodness of fit based on the model's I' accuracy using AUROC, F1 or R² scores, which are formally defined in Appendix C
We also propose following novel evaluation metrics. For more details, we refer the reader to Ap- pendix D.5
1-way feature marginal. This metric works as sanity check for real features. We compute his- tograms for the feature interest of both real and synthetic data. The quality of the synthetic data with respect to this metric can be evaluated qualitatively through visual comparison of the histograms real and synthetic data. This can be extended to w--way feature marginals and made into a quantitative measure by adding distance measure between the histograms.
7

---

Under review as a conference paper at ICLR 2020
Table 1: Summary evaluation metries in DP synthetic data generation. We list applicability of each metric to each of the data type. Parts in bold are our new contributions. Evaluation methods with asterisk * are peddictiv-model-spee data that the chosen predictive model is appropriate for. Methods with asterisks ** are equipped with any any distributional distance choice such as Wasserstein distance.
and their applicability therefore depends on types of
TYPES
EVALUATION METHODS
DATA TYPES
Binary
Categorical
Regression
Label prediction" (Chen et al., 2018
Yes
Yes
Yes
Supervised
Abay et al., 2018 Frigerio al. 2019)
Predictive model ranking*
(Jrddn
Yes
Yes
Yes
ct al. 2018)
Unsupervised,
Dimension-wise prediction plot*
Yes (Choi
Yes
Yes
prediction-based
2017).
ours)
Unsupervised, distributional- distance-bart based
Dimension-wise. probability plot (Choi et al. 2017)
Yes
No
No
3-way feature marginal, total varia-
Yes
Yes
Yes
tion distance (NIST 2019)
k-way feature marginal
Yes
Yes
Yes
k-way PCA marginal**
Yes
Yes
Yes
Distributional distance**
Yes
Yes
Yes
Unsupervised, qualitative
1- way feature marginal (histogram)
Yes
Yes
Yes
2-way PCA marginal (data visual- ization)
Yes
Yes
Yes
2-way PCA marginal. This metric generalizes the 3-way marginal score used in NIST (011)). In particular, we compute principle components of the original data and evaluate projection operator for first two principle components. Let us denote P E R as the projection matrix such that R. Then we evaluate projection of
π RP the projection on first two principle components synthetic data S = SP and scatterplot 2-D points in R and 3 for visual evaluation. For quantitative evaluation, we also compute Wasserstein distance between and S. In the simulations described in Section 5 used Wasserstein distance since
optimize for the WGAN objective, but any distributional divergence metric can be used. This approach can also be extended to k-way marginals by making the projection matrix P Rax2 for the first k principle components.
Distributional distance. In this metric, we first compute the Wasserstein distance W2(RRS) be- tween the entire real and synthetic datasets R, S. The Wasserstein score is then defined
W score ()
(R,RS))
maxr.wex 1
where the Wasserstein distance is normalized by the maximum distance possible of two datapoints data universe X. To compute the Wasserstein score on k-way marginal PCA projection P, we normalize the score with additional term /u, where the explained variance of P:
W score (R, SR
WR(RS))
Ve mamxa, ----v
5 EXPERIMENTS
In this section we present details of our datasets and show empirical results of our experiments. Throughout our experiments, we fix 8 1 for training DP-auto-GAN and show results for different values e including < = oc (i.e., non non-private GAN) which serves as a benchmark. We also compare results with existing works in the literature where relevant. Details of hyper-parameters and architecture can be found in the appendix. The code our implementation is available at http:///hhhao.ooo///aaaaaaaaaaaa
8

---

Under review as a conference paper at ICLR 2020
5.1 BINARY DATA
First, we consider the MIMIC-III dataset et al. (2016) which a publicly available dataset consisting of medical records of 46K intensive unit (ICU) patients is binary dataset with 1071 features. We use this dataset because it has been used in similar non- private Choi et al. (2017) and private Xie et al. (2018) GAN frameworks. We use the same evaluation metrics used in these papers. First we plot dimension-wiss probability for DP-auto-GAN run on this dataset.
11 years old. This
(a)
(b) 3.11865
(c) 1.27655
(d) 0.94145
Figure 2: Dimension-wise probability scatterplots for different values For each point in the plot represents one of the 1071 features in MIMIC-III dataset. The and coordinates of each point are the proportion of in real and synthetic datasets of feature, respectively.
As shown in Figure the proportion of I's in the marginal distribution for is similar on the real and synthetic datasets for e = oo and = 3.11865, because nearly all points fall close to the line y The performance of DP-auto-GAN is affected marginally for 1.27655 which can be noticed by increased variance of points along line v. The performance drop with e = 0.94145 45 expected since smaller values of correspond to stronger privacy guarantees. Figure shows the plots of dimension-wise prediction using DP-auto-GAN for different values of e. Many points concentrated along the lower side of line y x, which indicates that the AUROC score of the real dataset is close to that of the synthetic dataset. Fewer points are seen on the plots with smaller values because many features in the synthetic data have high proportion of O's, the logistic regression classifier trained on these features uniformly outputs O. In such cases, the AUROC score is 1 1/2 by default and does not have any meaning, so we drop those features from the plot. We note that our results are significantly stronger than the ones obtained in Xie et al. (2018 8) with E [96.5, 231] because we obtain dramatically better performance with e values that are two orders magnitude smaller. For visual performance comparison, see Figures 4 and 5 of Xfe et al. (2018).
(a)
3. 1865
(c) 1.27655
(d) 0.94145
Figure 3: Dimension-wind wise prediction scatterplots for different values of e. Each point represents
one 1071 features in MIMIC-III dataset. For each point, the and y coordinates represent the AUROC score of logistic regression classifier trained on real and synthetic datasets, respectively. The line y = x corresponds to the ideal performance.
5.2
MIXED DATA
Second, we consider the ADULT dataset Dua & Graff 2017) which an extract of the U.S. Census and contains information about working adults. This dataset has 14 features out of which 10 features are categorical and four are real-valued. Figure 4 shows the dimension- -isse prediction plot of DP- auto-GAN this dataset. For categorical features (represented by blue points and single green point), we use random forest classifier order to compare our result with Prigerio et al. (2019). For real-valued features (represented by red points), we used lasso regression model. The green point

---

Under review as a conference paper at ICLR 2020
(a) c 00
(b) = 1.5
(c)==1
(d) c 0.8
Figure 4: Dimension-wise prediction scatterplot for different values of E. Each point represents one of 14 features in the ADULT dataset. Blue points and single green points correspond to categorical features, and are plotted according Fi score. Red points correspond to real-valued features, and we plot R score. For each point, x and y coordinate represents relevant score evaluated on real and synthetic datasets, respectively.
Table 2: Accuracy scores of prediction on salary feature evaluated on different values.
value
Real dataset
00
3
1,5
0.8
Accuracy (ours)
86.63%
79.18%
77.86%
76.92%
77.7%
Accuracy (Frigerio et al. (2019))
77.2%
76.7%
76.0%
75.3%
corresponds to the salary feature of the data, which is real-valued but treated as binary, based on the condition $50k, which similarly used as a binary label in Frigerio al. (2019). We use score our classification accuracy measure for categorical features in in Figure 4 and we use R score our regression accuracy for real-valued features. The Fi score is preferred over AUROC score for the ADULT dataset because it has many non-binary features where AUROC cannot be used. Each point in Figure 4 corresponds to one feature, and the x and y coordinates respectively show the accuracy score on the real data and the synthetic data.
Similar to the MIMIC-III dataset, we see that large values of points are scattered close yo = line, and gets smaller, points gradually shift downward implying, that accuracy of synthetic data deceases with stronger privacy guarantees. For the salary feature, we also compute accuracy scores for comparison with Frigerio et al. (2019). In Table 2 report the accuracy of cach synthetic dataset as well as benchmark accuracy. We see that our accuracy guarantees are higher than those of Frigerio al. (2099) with smaller values.
Note that in the ADULT dataset, we have four real-valued features but we only plot one red point in Figure corresponding the age feature. The other realevalued features (capital gain, capital loss, and hours worked per week) were not included because even on the real data, we were not able to find regression model with good fit (as measured by R² score) for these features in terms of the other features. To check whether we learned the distribution correctly for these features, we plot 1-way feature marginal histogram each of them. See Figure 7 Appendix C It can be seen that DP-auto-Gai GAN identifies the distribution in those features.
In order to understand combined performance of all features, we use two metrics. First, we show the qualitative results from 2-way PCA marginal score in Figure 5 A close qualitative inspection
(a) Real data
(c) 1.5
(d) e
(c) 0.8
Figure 5: Scatterplot of projection of dataset first two principle component of the real dataset
of plots clearly shows the similarities of trends between the plots for real dataset and for different values of e, as low as e = 1. Finally we also evaluate Wasserstein distributional distance between synthetic and real data, shown in Table
10

---

Under review as a conference paper at ICLR 2020
Table Wasserstein distance scores on 2-way PCA marginal and whole dataset, for different e's.
Method
2-way PCA score
Whole-data score
DP-auto-GAN 1.5
44.36%
60.84%
DP-auto-GAN
1
60.53% 41.17%
DP-auto-GAN
0.8
19.25%
60.51%
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference Computer and Communications Security pp. 308-318. ACM, 2016.
Nazmiye Ceren Abay, Yan Zhou, Murat Kantarcioglu, Bhavani Thuraisingham, and Latanya Sweeney. Privacy preserving synthetic data release using deep learning. In Joint European Con- ference Machine Learning and Knowledge Discovery in Databases, pp. 510-526. Springer, 2018.
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially private mixture of generative neural networks. IEEE Transactions on Knowledge and Data Engineering, 31(6):1109-112:) 2018.
Moustafa Alzantot and Mani Srivastava. Differential Privacy Synthetic Data Generation using praiiiiiapppppplcccee
WGANs, 2019. /tLhttts:://ittuuu com
syytheeric_data_challae
Martin Arjovsky, Soumith Chintala, and Léon Bottou. arXiv:1701.07855 2017.
Wasserstein
gan. arXiv preprint
Michael Barbaro and Tom Zeller. A face is exposed for AOL searcher 4417749, August
2006. URL/tttps: / www. nyt imes cctmm/20666000/////eccolll/ll/// .html [Online, Retrieved 9/25/2019].
Brett K Beaulieu-Jones, Zhiwei Steven Wu, Chris Williams, Ran Lee, Sanjeev P Bhavnani, James Brian Byrd, and Casey S Greene. Privacy-preserving generative deep neural networks sup- port clinical data sharing. Circulation: Cardiovascular Quality and Outcomes, 12(7))e005122 2019.
Avrim Blum, Katrina Ligett, and Aaron Roth. A learning theory approach to non-interactive database privacy. In Proceedings of the 40th annual ACM Symposium Theory of Computing, STOC '08, pp. 609-618, 2008
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th (USENIX) Security Symposium (UUSNNIX) Security 19), pp. 267-284, 2019.
Anne-Sophie Charest. How can we analyze differentialll-privaal synthetic datasets? Journal of Privacy and Confidentiality, 2(2), 2011.
Kamalika Chaudhuri and Staal A Vinterbo. A stability-based validation procedure for differentially
private machine learning. In Advances in Neural Information Processing Systems, pp. 2652-26600, 2013.
Qingrong Chen, Chong Xiang, Minhui Xue, Bo Li, Nikita Borisov, Dali Kaarfar, and Haojin Zhu. Differentially private data generative models. arXiv preprint arXiv:1812.02274, 2018.
Edward Choi, Siddharth Biswal, Bradley Malin, Jon Duke, Walter F Stewart, and Jimeng Sun. Generating multi-label discrete patient records using generative adversarial networks. In Machine Learning for Healthcare Conference, pp. 286-305, 2017.
Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. URL http: /ttt:://rrcive.
ics. uc. www..edummm m
11

---

Under review as a conference paper at ICLR 2020
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(34):211400) 2014.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In 3rd Conference Theory of Cryptography, 2006.
Cynthia Dwork, Guy N. Rothblum, and Salil Vadhan. Boosting and differential privacy. In Proceed- ings of the IEEE 51st Annual Symposium on Foundations of Computer Science, FOCS '10, pp- 51-60, 2010.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differen- tially private generative adversarial networks for time series, continuous. and discrete open data. In IFIP International Conference on ICT Systems Security and Privacy Protection, pp. 151-164. Springer, 2019.
Marco Gaboardi, Emilio Jesús Gallego Arias, Justin Hsu, Aaron Roth, and Zhiwei Steven Wu. Dual query: Practical private query release for high dimensional data. In Proceedings of the 31st International Conference on International Conference on Machine Learning Volume 32, ICML'14, 14, pp. 1170-1178, 2014.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Infor- mation Processing Systems 27, pp. 2672-2680, 2014.
Google. Tensorflow privacy, 2018. URL https:tsp//////t
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Im- proved training of wasserstein gans. In Advances in Neural Information Processing Systems 30, pp. 0767-777 2017.
Anupam Gupta, Katrina Ligett, Frank McSherry, Aaron Roth, and Kunal Talwar. Differentially private combinatorial optimization. In Proceedings of the twenty- annual ACM-SIAM sym- posium on Discrete Algorithms, pp. 1106-1125. Society for Industrial and Applied Mathematics, 2010.
Moritz Hardt and Guy N. Rothblum. A multiplicatiie weights mechanism for data analysis. In Proceedings of the 51 annual IEEE Symposium on Foundations of Computer Science, FOCS 100 pp. 61-70, 2010.
Moritz Hardt, Katrina Ligett, and Frank McSherry. A simple and practical algorithm for differen- tially private data release. In Advances in Neural Information Processing Systems 25, NIPS '12 pp. 2339-2347. 2012.
Eric Jang, Shixiang Gu, and Ben Poole. retegorical reparameteriization with Gumbel-softmax, arXiv preprint 1611.01144, 2016.
Alistair EW Johnson, Tom J Pollard, Lu Shen, H Lehman Li-wei, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G Mark. Mimic-iii, a freely accessible critical care database. Scientific data, 3:160035, 2016.
2010.
James Jordon, Jinsung Yoon, and Mihaela van der Schaar. Pate-gan: generating synthetic data with differential privacy guarantees. International Conference Learning Representations, 2018.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint
arXiv: 1312.61 14, 2013.
Matt J Kusner and José Miguel Hernández-Lobato. GANs for sequences of discrete elements with the Gumbel-softmax distribution. arXiv preprint 161 1.04051, 2016.
Jingeheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 5 Annual ACM SIGACT Symposium on Theory of Computing, pp. 298-309. ACM, 2019.
H Brendan McMahan and Galen Andrew. A general approach to adding differential privacy to iterative training procedures. PPMLI8: Privacy Preserving Machine Learning NeurlPS 2018 Workshop, 2018
12

---

Under review as a conference paper at ICLR 2020
H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. International Conference on Learning Representations, 2017.
Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Sym- posium (CSF), pp. 263-275. IEEE, 2017.
Mchdi Mirza and Simon Osindero. arXiv: 2014.
Conditional generative adversarial nets. arXiv preprint
Olof Mogren, C-rnn-gan: Continuous recurrent neural networks with adversarial training. Con- structive Machine Learning Workshop (CML.) NeurlPS 2016, 2016.
Arvind Narayanan and Vitaly Shmatikov. Robust de-anonymization of large sparse datasets. In Proceedings of the 2008 IEEE Symposium Security and Privacy, SP '08, pp. 111-125, 2008.
NIST. Contest: Nist differential privacy #3. TopCoder, 2019. URL & topcoder www.oooggoonteeeeoooooooooooooee httpc///wwooooooooooooooeootttee oanere/eeeeeeeeeoeooeeeeeeeeeoaa
pm=15315 National Institute of Standards and Technology, Public Safety Communications
Research.
Paul Ohm. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review, 57:1701, 2010.
Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from private training data. International Confer- ence on Learning Representations, 2017.
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Er- lingsson. Scalable private learning with PATE. International Conference on Learning Represen- tations, 2018
Mijung Park, James Foulds, Kamalika Choudhary, and Max Welling. DP-EM: Differentially Private Expectation Maximization. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, pp. 896-904, 2017.
Haoyue Ping, Julia Stoyanovich, and Bill Howe. Datasynthesizer: Privacy-preserve synthetic datasets. In Proceedings of the 29th International Conference on Scientific and Statistical Database Management, pp. 42. ACM, 2017.
Masaki Saito, Eiichi Matsumoto, and Shunta Saito. Temporal generative adversarial nets with sin- gular value clipping. In Proceedings of the IEEE International Conference on Computer Vision, pp. 2830-2839, 2017.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Proceedings of the 30th International Conference Neural Information Processing Systems, 2016.
Surendra and HS Mohan. review of synthetic data generation methods for privacy preserving data publishing. International Journal of Scientific and Technology, 6, 2017.
Om Thakkar, Galen Andrew, and H Brendan McMahan. Differentially private learning with adaptive clipping. arXiv preprint 1905vv1100.03888 2019.
Reihanch Torkzadehmahani, Peter Kairouz, and Benedict Paten. Dp-cgan: Differentially private synthetic data and label generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 0-0, 2019.
Aleksei Triastcyn and Boi Faltings. Generating artificial data for private deep learning. Privacy- Enhancing Artificial Intelligence and Language Technologies, AAAI Spring Symposium Series, 2019, 2018
Koen Lennart van der Veen, Ruben Seggers, Peter Bloem, and Giorgio Patrini. Three tools for practical differential privacy. PPMLI8: Privacy Preserving Machine Learning NeurIPS 2018 Workshop, 2018
13

---

Under review as a conference paper at ICLR 2020
Tim Van Erven and Peter Harremos. Rényi divergence and kullback-leibler divergence. 1EEE Transactions on Information Theory, 60(7):3797-388)) 2014.
Hongwei Wang, Jia Wang, Jialin Wang, Miao Zhao, Weinan Zhang. Fuzheng Zhang, Xing Xie, and Minyi Guo. Graphgan: Graph representation learning with generative adversarial nets. In Thirty-Second AAAI Conference on Artificial Intelligence, 2018.
Yu-Xiang Wang, Borja Balle, and Shiva Kasiviswanathan. Subsampled r\ 'enyi differential privacy and analytical moments accountant. Proceedings of the 22th International Conference on Artifi- cial Intelligence and Statistics, 2019.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXiv: /802 06739, 2018.
Lei Yu, Ling Liu, Calton Pu, Mehmet Emre Gursoy, and Stacey Truex. Differentially private model publishing for deep learning. Proceedings of the 40th IEEE Symposium on Security and Privacy (Oakland), 2019.
Jun Zhang, Graham Cormode, Cecilia M Procopiue, Divesh Srivastava, and Xiaokui Xiao. Privbayes: Private data release via bayesian networks. ACM Transactions Database Systems (TODS), 42(4):25, 2017.
Xinyang Zhang, Shouling Ji, and Ting Wang. Differentially private releasing via deep generative model (technical report). arXiv preprint arXiv:1801.0159) 2018.
A ALGORITHM DESCRIPTION AND PSEUDOCODE OF DP-AUTO-GAN
We provided the pseudocode of our proposed DP-auto-Gar -e-a-uG--NNN Algorithm [ The Algorithm is spec- ified by the architecture and training parameters of encoder, decoder, generator, and discriminator. After pre-processing, OPTRAINAMT trains autoencoder fully specified in Algorithm 2 As noted earlier, the decoder trained privately by clipping gradient norm and injecting Gaussian noise in order to obtain the gradient of decoder ge. while the gradient of encoder can be used directly as encoder can be trained non-privately.
The second phase is to train GAN. As suggested by Goodfellow et al. 2014), discriminator trained for several iterations per one iteration of generator training. When discriminator is trained, generator is fixed, and vice-versa. Discriminator and generator training is described in Algorithms and As the discriminator receives real data sample their training, the training made private by clipping the norm and adding Gaussian noise to the gradient g. The training of generator does not use any private data X and hence can be train without any need to clip gradient norm or to inject noise to the gradient.
Finally, the privacy analysis via RDP accountant for each training, and composing at the RDP level (as function of a)) as described in Corollary 2 After the sum of RDP (as function of a) is obtained, for any given fixed 8, we optimize a to get the best by Proposition Because the value of <(a) obtained from Proposition 5 as function of is convex (014)) and noted by Wang et al. (2019)), we implement ternary search to efficiently optimize for a.
(Van Erven & Harremos
Proposition 3. DP-auto-GAN trained with differentially private algorithms Mi on the decoder and M2 on the discriminator (and possibly non- non-private algorithm on the encoder) achieves differential privacy guarantee equivalent to that of the composition of M2
Proof. DP-auto-GAN needs release only generator and decoder as an output. Releasing the de- coder incurs cost of privacy equal to that of M1. The generator accesses the data only through a discriminator, which is differentially private by mechanism M2, so releasing the generator has the same privacy loss as M2 from post-put post-processing. Therefore, releasing both decoder and generator incurs privacy loss of composition of Mi and M2.
Proposition 3 is stated more formally using the RDP notion of privacy (where the privacy parameters are a function of a:) in Corollary in the main body. That corollary follows immediately from Propositions andd
14

---

Under review as a conference paper at ICLR 2020
Algorithm DPAUTOGAN (full procedure)
I: architecture input: Private dataset D x where X is the set of (raw) data universe, pre- processed data dimension n, latent space dimension d, preprocessing function Pre X R", post-processing function Post R X, encoder architecture En IR" R. parameterized d, decoder architecture Des I IR parameterized by generator's 's noise distribution on sample space (2),, generator architecture G 22(Z) - R parameterized by w, dis- criminator architecture D, _ 1).
2: autoencoder training parameters: Learning rate 7/,, number of iteration rounds (or optimiza- tion steps) Ti, loss function Lutoo optimization method optim batch sampling rate y (for the batch expectation size bj = m1m clipping norm C1. noise multiplier 1/1, microbatch size generator training parameters: Learning rate 7/2, batch size b2, loss function LG, optimization method optimg, number of generator iteration rounds (or optimization steps) T2
4: discriminator training parameters: Learning rate 7/s number of discriminator iterations per generator step tp. loss function LD. optimization method optim batch sampling rate d (for the batch expectation size by = qam,, clipping norm C3, noise multiplier 4/3, microbatch size T3
5: privacy parameter 5 >>0
6: procedure DPAUTOGAN
7: X + Pre(D)
8: Initialize Φ) 0, w. y for Eng: Dea, Gw, Dy
Phase 1: autoencoder training
9:
for I... do
10:
APTRAIN (X, En, De, autoencoder training parameters) Phase 2: GAN training for = 1 T2 do
11:
12:
(privately) train Dy for iterations for j DISCRIIATEO ( (X, Z, G, De, D, discriminator training parameters)
to do
13:
DPTRAIN
14:
TRAINGENER (Z, De, D, generator training parameters)
Privacy accounting
15:
RDP auto (-) + RDP-ACCOUNT(/I, 11,
RDP RDP-ACCOUNT(T: (D, 43, 4/, ra) (-) : + RDP (.))
17:
e C+GG
return model (Gw, Deg). privacy (c.8)
Algorithm DPTRAINAUTO (X, Eng, Deg, training parameters)
1: training parameter input: Learning rate v/, number of iteration rounds (or optimization steps)
Ti, loss function T optimization method optim batch sampling d (for the batch expectation size b m)) clipping norm C1, noise multiplier 1h,, microbatch size
2: goal: train one step of autoencoder (En,, Des)
3: procedure DPTRAINAUT
4: B SAMPLEBATCH(X,, 91)
5: Partition B into B,,..., B& each of size r (ignoring the dividend)
6: k
estimate of
7:
for = - do
Both gag de can be computed in one backpropagation
8:
2o. (
(Deo (Deo (Fn B;)), (B))), By)), (T Desl (By)), By)
9:
90 - (E CLIP(E,, G.) +1(0,
10:
11:
(b, 0) + opt (Ø, 0, go. go, 71)
15

---

Under review as a conference paper at ICLR 2020
Algorithm 3 IDPTRAINDISCRMAArrn (X, Z, Gw. Dea, Dy, training parameters)
training parameter input: Learning rate Tas number of discriminator iterations per generator step tD. loss function LD. optimization method optimp. batch sampling rate (for the batch expectation size by 9am), clipping norm C3. noise multiplier V/3, microbatch size r3
2: goal: train one step of discriminator Dy
3: procedure OPTRAINDISCHMISS
4: B SAMPLEBATCH((X
5: Partition into B BB each size r (ignoring the dividend)
6: < 2
b. an estimate
7:
for j 1 do
8:
[ 1=1 ~ Z" B' - (2)))
9:
10:
g6 + (LLLD(B, B", Dy)) In the case of WGAN,
LD B', Dy) = Σ Dy(b)
Σ -
Dy(
bEB,
VEB'
(C CLIP(O Ca)) + +NV(0, C3031)
11:
+
12:
Algorithm 4 TRAINGENERATOR (Z, G Deg, Dy, generator training parameters)
1: training parameter input:
Learning rate 7/2, batch size b2. loss function Lo, optimization method optima, number of generator iteration rounds (or optimization steps) T2
2: goal: train one step of generator G
3: procedure TRAING GENERATOR
4:
{ by
im1
2z
5:
B' - (e (
6: g - V (B', D,))
In the case of WGAN,
LG(B', Lc(B',D,)
Σ Dy(b')
b2 WER
7:
w + optim (w. 9, 92)
16

---

Under review as a conference paper at ICLR 2020
B MORE DETAILS ON METRIC EVALUATION
We recall the notations from the main body. We explain the scoring used more specifically.
Dimension-wise prediction. We describe the model's accuracy using the following well known metries:
1. Area under the ROC curve (AUROC) score and Fi score for classification: The Fi score of classifier is defined as F1 = 2x precision Xrecall where precision is ratio of true positives to true and
precision recall
false positives, and recall is ratio of true positives to total positives. AUROC score is graphical measure capturing area under ROC (receiver operating characteristic) curve. Both metrics take values in interval [0, with larger values implying good fit.
2 D:) E(y 7)
R2 score for regression: If2 score defined as
where y/ is the true label, D)
is the predicted label and y is the mean of the true labels. This is a popular metric used to measure goodness of fit well as future prediction accuracy for regression.
C EXPERIMENTAL DETAILS
C.I MODEL AND TRAINING SPECIFICATION EXPERIMENT ON MIMIC-III DATA
The autoencoder trained with Adam with Beta == 0.9, Beta = 0.999. The learning rate was set to 0.001. It was trained on minibatches of size 100 and microbatches of size 1. L.2 clipping norm 0,8157 and L2 penalty 0.001. The noise multiplier was changed to achieve different privacy guarantees. The layers of the autoencoder used for training were:
(encoder): Sequential(
(0): Limear(n-feattre--o out-feature=15, bias=True)
(1):
(decoder): Sequential(
(0): 15aateinn- out-feature=60, bias=True)
(1): Sigmoid()
The GAN was trained with optimizer RMSProp, whose Alpha value equalled 0.99, The learning rate was 0.001, training
minibatches of size 1,000 and microbatches of size 1. L.2 clipping norm was set to 0.35, and the L2 penalty to 0.001. The L2 clipping norm was selected to be the median L2 norm observed in non-private training loop. The noise multiplier was tuned achieve desired privacy guarantees.
The GAN architecture is follows:
Generator( (block-O): Sequential(
(0): Lineardin-faatur=644, out-feature=12.. bias=False)
(1): SeLUUnnggative-slop==..
(block-1): Sequential(
(0): Linearii--featre=122, out-feature=64, bias=False)
(1): ReLU/nggative--lop==0.)
Discriminator( (model): Sequential(
(0): (nneartin-faatree27 out-feature=256, bias=True)
(1): Rel.UUeegaaiveestope=.....
17

---

Under review as a conference paper at ICLR 2020
(2): Innearinn-eeatue=2556 out-feature=1, bias=TTrue)
C.2 ADDITIONAL MIMIC-III EMPIRICAL RESULTS
SauureBs dimension-wise prediction plot for different values of As one can see, for e = oc, many points concentrated along the lower side of line y x which is the ideal performance. This shows that AUROC score of the real dataset is marginally higher than that of synthetic dataset. For 3.11865 and 1.27655, there is a gradual shift downwards compared to line y with larger variance in the plotted points. This means that AUROC scores of real and synthetic data shows more difference for smaller values of For 0.94145, which shows the same trend, one can also see that number of datapoints plotted have reduced significantly. This is since many features in synthetic data have very high proportion of O, so logistic regression classifier trained on these features uniformly outputs 0 on the hold-out test dataset T. In such cases, AUROC score outputs 1/2 by default and as such, does not have any meaning. Hence we drop those features from the plot.
Below we show the full plots of dimension-wisg prediction for MIMIC-III dataset.
(a)
(b) = 3.11865
(c) 1.27655
(d) 0.94145
Figure Full plots of dimension-wise prediction for mimic dataset
Below we provide 1-way histogram for ADULT dataset. one can see, DP-auto-GAN identifies the marginal distribution of capital gain and capital loss quite well and it does reasonably well on hours-per- wous-pperweek feature.
C.3 MODEL AND TRAINING SPECIFICATION OF EXPERIMENT ON ADULT DATA
The autoencoder was trained via Adam with Beta 1 = 0.9, Beta 2 = 0.999, and learning rate of 0.005 for 20,000 minibatches of size 64 and microbatch size of 1. The L2 clipping norm was selected to be the median L2 norm observed in a non-private training loop, equal to 0.012. The noise multiplier was then calibrated achieve the desired privacy guarantee.
The GAN was composed of two neural networks, the generator and the discriminator. The generator used ResNet architecture, adding the output of each block the output of the following block. was trained via RMSProp with alpha = 0.99 with learning rate of 0.005. The discriminator was simple feed-forward neural network with LeakyReLU hidden activation functions, also trained via RMSProp with alpha 0.99. The L2 clipping norm of the discriminator was set to 0.022. The pair was trained on 15,000 minibatches of size 128 and mierobatch size of 1, with 15 updates to the discriminator per update to the generator. Again, the noise multiplier was then calibrated to achieve the desired privacy guarantee.
A serialization of the model architectures used in the experiment can be found below.
Autoencoder(
(encoder): Sequential(
Linear(in-faature= 106, out-feature=60, bias=True)
(1):
(2): iemear(i-feeatreeee 15ttfeature=15, bias=True)
(3): LeakyReeUnneaaaivvelleee.e
(decoder): Sequential(
18

---

Under review as a conference paper at ICLR 2020
2000
(a) Capital gain,
(b) 0.8
(c) 1.5
(d)
(c) Capital loss, c = 00
0.8
(g) = 1.5
(b) c-
200
68
(i) Hours per week,
0.8
1.5
11 0=1
Figure 7: 1-way histogram for different values of 6. Three rows correspond to capital gain, capital loss and weekly work-hours
(0): Linear(in-fcatur=-55, out-feature=60, bias=True)
(1): SaalyRee.Lmngaaivv--loeeee
(2): Linear(i-feaatue-d6) out-feature=106. bias=True)
(3): Sigmoid()
Generator(
(block-O): Sequential(
(0): Linear(i-feature-664, out-feature=64, bias=False)
(1): BatchNormldg
(2): LeukyYee.UUnnggavi---pp----
(block-1): Sequential(
(0): Sneear(i--eatture-de featuret,,,:44, bias=False)
(1): BatchNormldO)
(2): Lealyyeel..nnggaiieesspp---
(block-2): Sequential(
(0): Linearin-feattrr=644, 0ut-feature=15, bias=False)
(1): BatchNormld))
(2): LeukyyReLUhnngavvv--pp---
Discriminatort
(model): Sequential(
(0): Linearfin-feature10066 out-feature=70, bias=True)
(1):
(2): out-feature=35, bias=True)
(3):
(4): Linear(in- featturr,f, out-feature=1, bias=True)
19

---

Under review as a conference paper at ICLR 2020
D ADDITIONAL BACKGROUND AND RELATED WORK
D.1 DETAILS OF DP-SGD
The DP-SGD framework (given formally in Algorithm 5 is generically applicable private non- convex optimization.
Algorithm 5 DP-SGD (one iteration step)
1: parameter imput: Data
) deep learning model parameter learning rate 1,, loss function f. optimization method OPTIM, batch sampling rate (for the batch expectation size == qm), clipping norm C, noise multiplier t, microbatch size
2: goal: differentially privately train one step of the model parametrized by 0 with optim
3: procedure DP-SGD
4: procedure SAMPLEBATCH(X,
5:
B + 0
6: for i 1 ... do
7:
Add T; to B with probability 4
return
8:
Partition B into BI,..., Bs each of size r (ignoring the dividend)
9:
k
q12
an estimate of
1 E
10:
+
(P..M(0.9.T)
Performance improvements. In general, the descent step can be performed using other optimiza- tion methods-such as Adam or RMSProp-in private manner, by replacing the gradient value with g in each step. Also, does not need to clip the individual gradients. but instead clip the gradient group of datapoints, called microbatch (McMahan Andrew 2018). Mathe- matically, the batch B is partitioned into microbatches Bi...., B3 each of size r, and the gradient clipping is performed on the average of each microbatch:
E i=1 (),
Standard DP-SGD corresponds to setting r 1, but setting higher values of r (while holding [B] fixed) significantly decreases the runtime and reduces the accuracy, and does not impact privacy significantly for large dataset. Other clipping strategies have also been suggested. We refer readers to McMahan & Andrew 2018) for more details of clipping and other optimization strategies.
The improved privacy analysis by Abadi et al. (2016) (which has been implemented in Google (2018) and is widely used in practice) obtains tighter privacy bound when data are subsampled, as in SGD. This analysis requires independently sampling each datapoint with a fixed probability q in each step.
D.2 CONVERTING RENYT DP TO DP
To compute the final (c, -ddifferrent privacy parameters from iterative runs of DP-SGD, there are three key steps.
Step 1: Subsampled Renyi Divergence. Given sampling rate q and noise multiplier v. one can obtain RDP(.) values as function of a for one run of DP-SGD (Mironov 2017). We denote this function by RDP/=1(-) (-), which will depend on and q!.
Step Composition of RDP. When DP-SGD run iteratively, we can compose the Renyi privacy parameter across all runs using the following proposition.
Proposition 4 Mirooo 2017). If MM, respectively satisfy (a, 61), (a, 62) RDP for a 2 1, then the composition of two mechanisms M2[Mi satisfies (a, 61 + e2) -DP.
Hence, we can compute RDP(.) values for T iterations DP-SGD as RDP- ACCOUNT q. := T. R.Pr=1(.).
20

---

Under review as a conference paper at ICLR 2020
Step 3: Conversion to (c, JD-P. After obtaining the final RDP(-) function, any (a, c)-RDP guar- antec can be converted into (c, 6C.
Proposition 5 ((Mironov 2017)). If' M satisfiex (a,, c)-RDP for a > 1, then for all 8 > 0, M satisfies (c log -D-
Since the e privacy parameter of RDP is also a function of a, this last step involves optimizing for the that achieves smallest privacy parameter in Proposition
D.3 DIFFERENTIALLY PRIVATE GAN ARCHITECTURES
Training deep learning models reduces to minimizing some (empirical) loss function f(X;0) ==
1 - (zz; () on a dataset X {z, E Ji- Typically is nonconvex function, and m
common method to minimize f is by iteratively performing stochastic gradient descent (SGD):
B BATCHSAMPLE(X)
8 8- TB Σien Vof(z,,
(4)
The size of typically fixed as moderate number to ensure quick computation of gradient, while maintaining that [E]] CiEB fz(,,, 8) is good estimate of true gradient Vef(X;;) 0).
In the setting of differential privacy, X is a dataset of individual's sensitive information, and two datasets are neighbors if one can be obtained from another by the addition or deletion of one datapoint. To make SGD private, a standard method proposed by Abadi al. (2016) is first clip the gradient of each sample to ensure the lg f--norm is at most C::
CLIP(E; C) == x min (1, C/[[==|/2)
Then a multivariate Gaussian noise parametrized by noise multiplier vb is added before taking an average across the batch, leading to noisy-llippd--avereeed gradient estimate g:
1 [B] (Eien CLIP(Vof(Z,, 8), +N (
g -
The quantity g is now private and can be used for the descent step 0 + 0 0- in place of equation 4
Variants of DP GANs have been used for synthetic data generation, including the Wasserstein GAN (WGAN) (Arjovsky et al.) 2017 Gulrajani et al. 2017) and DP-WGAN (Alzantot & Srivastava, loss function in training
2019 Triasteyn & Faltings 2018) that use
(Arjovsky et al. 2017] Gulrajani et al. 2017 Alzantot & Srivastava 2019: Triastcyn & Faltings
2018: the conditional GAN (CGAN) (Mirza & Osindero 2014) and DP-CGAN (Torkzadehmabhani
et al. 2019) that operate in supervised (labeled) setting and use labels as auxiliary information in training; and Private Aggregation of Teacher Ensembles (PATE) (Papernot et al. 2017; 2018) for the semi-supervised setting of multi-label classification when some unlabelled public data available (or PATEGAN (Jordon et al.) (018)) when no public data are available). Our work focuses on unsupervised setting where data unlabeled, and (relevant) labeled public data available.
Existing works in differentially private synthetic data generation can be summarized in Table
D.4 DIFFERENTIALLY PRIVATE TRAINING OF DEEP MODELS
There are numerous works on optimizing the performance of differentially private GANs, including data partitioning (either by class of labels in supervised setting or a private algorithm) (Yu et al.)
2019 Papernot al. 2017 2018 Jordon et al. 2018, Abay et al. 2018 Acs et al. 2018) 8, Chen et al.
2018); reducing the number of parameters in deep models (McMahan et al. 201 2017); changing the norm clipping for the gradient in DP-SGD during training (McMahan et al. [017 yan der Veen
et alll,,201 2018 Thakkar al. 2019); changing parameters of the Gaussian noise used during training
Yu et al.]|2019 2019); and using publicly available data to pre-train the private model with a warm start Zhang et al., 2018 McMahan al. 2017). Clipping gradients per-layer of models (McMahan & Andrew [2018) | McMahan et al. 2017 and per-dynamic parameter grouping (Zhang et al. (018)) are also proposed. Additional details for some of these optimization approaches given below.
21

---

Under review as a conference paper at ICLR 2020
Table 4: Algorithmic frameworks for differentially private synthetic data generation. Our new algorithmic framework (in bold) is the first to combine both DPGAN and autoencoder into one framework by using GAN to learn generative model latent space.
Algorithmic framework
Types
Main architecture
Variants
PATEGAN (Jordon et al. (0118)
DPGAN
DP Wasserstein GAN Alzantot & Srivastava
(Abadi et al. 2016)
2019)
Deep generative models
DP Conditional GAN (Torkzadehmahani et al.
2019)
Gumbel-softmax for categorical data (Frigerio
al. 2019)
Da- (Chen et 2018 Acs et al. 2018
Autoencoder
RBM generative models in latent space (Acs et al.
2018)
Mixture Gaussian model latent space Abbay
ct 2018)
Autoencoder and DPGAN (ours)
Other
SmalIDB (?), PMW (Hardt & Rothblum 2010). MWEM Hardt
models
(2012). DualQuery Gaboardi et al. (2014). DataSynthesizer (Ping et al.
2017). PriBayes (Zhang et 2l.12017
Batch Sampling Three ways are known to sample a batch from data in each optimization step. The three methods are described in McMahan & Andrew (2018). We also summarize here for the completeness of DP-SGD background.
The first is to sample each individual's data with fixed probability independently. This sampling procedure is one used analysis of subsampled moment account in Abadi et al.) (2016): McMahan & Andrew (2018) and subsampled RDP composition in Mironov (2017). This RDP composition publicly available Tensorflow Privacy (Google 2018). We implement this sampling procedure and use Tensorflow Privacy to account Renyi Divergence during the training.
Another sampling policy is to sample uniformly at random a subset of fixed size of all datapoints. This achieves a different RDP guarantee from the first one, but the analysis of this sampling has been done in Wang et al. 2019).
Finally, common subsampling procedure is to shuffle the data at random, and take fixed-size batch in the order of the shuffling without replacement. The process is repeated after pass over all datapoints (an epoch). Though this batch sampling most common in practice, subsampled privacy composition known in this case.
Hyperparameter Tuning Training deep learning models involves hyperparameter tuning to find good architecture and optimization parameters. This process is private and privacy budget must be accounted for. [Abadi et al.) (2016) accounts for hyperparameter search using the work of Gupta al. (210)). Beaulieu-Jones et al. (2019) uses Report Noisy Max Dwork Roth (2014) private select model with top performance when model evaluation metric is known. Some works are done to account for selecting high-perit gegh-perforance models without losing much privacy (Chaudhuri & Vinterbo 2013 Liu & Talwar 2019). In experimental work, we omit the privacy accounting of hypeeparameeerr search as this is not the focus fof our contribution (new algorithmic framework using RDP subsampled composition for privacy analysis), following most literatures in differentially private synthetic data generation.
D.5 EVALUATION METRICS FOR SYNTHETIC DATA
Now review the evaluation schemes for measuring quality of synthetic data. Various evaluation metrics have been considered the literature to quantify the quality of the synthetic data (Charest, 2011). Broadly, evaluation metrics be divided into two major categories: supervised and un-
22

---

Under review as a conference paper at ICLR 2020
supervised. Unsupervised metries can then be divided into three broad types: prediction-based, distributional-dist dissalldddttttnebbaa based, and qualitative- (or visualization-) based. Metrics in previous work and our proposed metrics are summarized in Table [
Supervised evaluation metries. These metries are used when clear distinctions exist between feature and labels of the dataset, e.g., for healthcare applications, whether a person has a disease or not could be a label. The main aim of generating synthetic data is to best understand the relationship between features and labels. A popular metric for such cases is to train machine learning model on the synthetic data and report its accuracy on the real test data (Xie et al.) 2018). Zhang et al. 2018) used inception scores the image data with classification tasks. Inception scores were proposed in Salimans et al. (2016) for images which measure quality as well as diversity of the generated samples. Another metrie used in Jordon et al. (018)) reports whether the accuracy ranking of different machine learning models trained on the real data is preserved when the same machine learning model is trained the synthetic data. All the evaluation metries focus understanding relationship between labels and features of the data and hence we call them supervised evaluation metries. Also, in the literature, these metries are used for classification setting but can be generalized to regression setting easily.
The disadvantage of supervised metric is that in some application, is not clear if any feature can appropriately be a label. For example, the data analyst who wants to learn a pattern from synthetic data may not know what specific prediction tasks perform, but rather wants to explore the data by several ways including by unsupervised algorithm such as Principle Component Analysis (PCA). As result, we now turn our focus to unsupervised evaluation metric- metric when no feature of the data can be decisively termed as a label. We list all three types of evaluation metrics below.
Unsupervised evaluation metric, prediction-based. One metric of this type is proposed by Choi eet al. (2017) for binary data. Instead of measuring accuracy score of one particular feature in supervised-setting, one can predict every single feature by using the rest of features. The predic- tion score is therefore created for each single feature, creating a list of dimension- (or feature-) wise prediction scores. A good synthetic data should resemble dimension-win wise prediction score of that of real data. Intuitively, similar dimension wise prediction shows that synthetic data correctly captures inter-feature relationships in the real data.
Though this was proposed for binary data, we extend this to mixed type data by allowing varieties of predictive models appropriate for each data type present in the dataset. For each feature, we try predictive models on the real dataset in order of increasing complexity until good accuracy score is achieved. For example, to predict real-valued feature, we use linear classifier and then neural network predictor. This ensures that a choice of predictive model is first appropriate to the feature. Synthetic data is then evaluated by measuring the accuracy of the same trained predictive model, but on the synthetic data. A high accuracy score of the model synthetic data close to original accuracy score on real data indicates that synthetic data resembles real data well.
Zhang al. (018)) also provides Shannon divergence between output of a discriminating neural network on the real and synthetic dataset, and Bernoulli random variable with 0.5 probability. This metric differs from dimension- wise prediction in that the predictive model (discriminator) is trained over the whole dataset at once, rather than dimension-wise, obtain a score.
Sensen-Shannon score metrie which measures the Jensen-
Instead of computing dimension-wise prediction score, one can also compute the dimension-wise probability distribution, also proposed in Choi et al. (2017) for binary data. This metric compares the marginal distribution of real and synthetic data on each individual feature.
Unsupervised evaluation metric,
3 3-way marginal: Recently, NIST (219)) challenge used a 3-way marginal evaluation metric in which random three feature of the real and synthetic data R, S are used to compute the total variation distance as a statistical score. This process is repeated a few times and finally, average score is returned. In particular, values of each of the three features are partitioned in 100 disjoint bins as follows:
(R² Bi.min) 100
and B3 = (S) RA. Rk
(mi) 100
BR =
Rk, Rk
23

---

Under review as a conference paper at ICLR 2020
where Rig. St is the value of i-th datapoint's l--th feature in datasets R and S. Rg.min Rie,ax respectively the minimum and maximum value of the k-th feature in R. For example, if 1, 2.3 the selected features then i-th data points of R and S are put into bins identified by 3-tuple, (B/,1, B1,,, B133)) and (B' B' B, respectively.
Let BR. Bs be the set of all 3-tuple bins in datasets R and S, and let [B] denote number of datapoints in 3-tuple bin B, normalized by total number of data points. Then, the 3-way marginal metric reports the E -n-or of the bin-wise difference of BR and By as follows:
E Σ BLEBA B2EBs
1B. ( (B.=B.)) || B1 ||
(B-MBBBBa))BB11 Σ Bi BLEBR
Σ( (1-L4BBBBB |Bal-
BoEBs
Both aforementioned metrics involve two steps. First, a projection (or a selection of features) of data is specified, and second some statistical distance or visualization of synthetic and real data in the projected space computed. Dimension probability for binary data corresponds to projecting data into each single dimension, and visualize synthetic and real distributions in projected space by histograms (for binary data, histogram can be specified by one single number, i.e. probability of feature being 1). 3-way marginal first selects three- prrreddimensional space specified by three features as a space to project data to, discretize the synthetic and real distributions on that space, then compute total variation distance between discretized distributions. Our proposed metric generalizes both steps of designing the metric as follow(s).
One generalize selection of 3 features (3-way marginal) to any h: features (k-way marginal). However, one can also select k: principle components instead of features. We distinguish this as k-way feature marginal (projection onto space spanned by feature dimensions) and k-way PCA marginal (projection onto space spanned by principle components of original datasets). Intuitively, k-way PCA marginal best compress information of real data in small k k-dimension space, and hence is better candidate for comparing projected distributions.
Generalization of Data Projection:
Generalization of Distributional Distance: encode any information on distance of support of two distributions. In general, one can define any metric of choice (optionally with discretization) on two projected distributions, such as Wasserstein distance which also depends on distance of supports of two distributions.
Total variation distance can be misleading as it does not
Finally, we define Distributional Distance metric without any data projection. Computing statistical score on full-dimensional and big data is likely computationally hard. However, we can subsam- ple uniformly at random points from two distributions to compute the score more efficiently, then average this distance over many iterations.
Unsupervised evaluation metric, qualitative. As mentioned earlier, dimension-wiss probability a specific application of comparing histogram under binary data. One can hence plot histogram of each feature (1-way feature marginal) for inspection. In practice, histogram visualization is particu- larly helpful when feature strongly skewed, sparse (majority is zero), and/or hard to be predicted well by predictive models. An example of this is when predictive models do not have meaningful predictive accuracy on certain features of ADULT dataset, making prediction- based metric inap- propriate, but an inspection of histograms of those features on synthetic and real data indicate that synthetic data replicates those features well.
In addition, 2-way PCA marginal is visual representation of data that explains as much variance as possible in a plane, a good trade-off between ease of visualization and information on two datasets. As mentioned earlier, distributional distance of choice can be defined on two distributions these two spaces to get a quantitative metric.
24


Reviews:
[{"review_id": "S1gIouZsYr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper considers synthetic data generation using deep GANs and autoencoders that can be shared for model training.\nThe authors can generate mixed-type data and consider some additional metrics that allow the evaluation of the quality of synthetic data.\n\nWhile the problem raised in the paper is interesting, and there some insights on what kind of metrics one should use, the article now lacks conclusions and discussion of obtained results. \nIn particular, there is a significant number of misprints and inconsistencies here and there (see more on this below).\nMoreover, the experiments are irreproducible e.g. I could not found information about the value of reduced dimension q in the description of the experiments.\nAlso, there is no comparison with previous approaches (e.g. [1, 2]), only results about the proposed one are presented. \n\nThe paper will also benefit from additional rounds of proofreading:\n\n1. The algorithm $\\mathcal{M}$ is not defined. The range $Range(\\mathcal{M})$ is not defined.\n1. a mixture of Gaussian distribution -> a\nmixture of Gaussian distributions\n2. comepare -> compare, matrics -> metrics, deceases -> decreases\n4. should to minimize -> should minimize\n5. In the formula \"(true) loss function\" subscript \"i\" should be dropped, as we talk about $x \\sim Z$, not $x_i$ here\n6. Articles in many places can be improved (finding good autoencoder -> finding a good autoencoder)\n7. It is possible, that in the paragraph after the formula (2) \"encoder\" should be replaced by \"decoder\".\n8.  the total number of samples the real\ndata - > the total number of available real data samples \n9. The axis labels are too small for Figure 2\n10. No reference to Figure 3 in the text of the paper. For Figure 3 the most left plot has for some reason a smaller number of points. Why?\n11. The selection of classifiers is not discussed. I.e. why in some cases authors use random forests (5.2), but in other logistic regression (5.1)? Also in my opinion mixing of R2 and F1 scores in one plot can be confusing.\n12. No conclusion in the end\n\n\n[1.] Xu et al. Modeling tabular data using conditional GAN. NeurIPS 2019\n[2.] S.K.Lim et al. DOPING: Generative Data Augmentation for Unsupervised Anomaly Detection with GAN. IEEE ICDM 2019.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "B1l4NEaecS", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposed a new algorithm for synthetic data generation under differential privacy. The algorithmic architecture combines autoencoder and GAN in a way that it only needs to add the DP-SGD noise to the decoder of the autoencoder and the discriminator of the GAN. This seems to be a good idea to be explored further.\n\nThe authors claimed that the proposed new evaluation metrics are novel contributions of the paper but there is no discussion on why they are good metrics for evaluating the quality of synthetic datasets nor which metric should be used in what scenarios. \n\nIt is unclear how the experimental results (Figure 2, 3, 4 and Table 2, 3) are interpreted. The authors mentioned comparison with DP-GAN but it is not marked in the figures the performance of DP-GAN and how its results compared with DP-auto-GAN. Please clearly state what each figure means and why the results are significant.\n\nI wonder if it is possible to have a version of GAN that also predicts the labels of data so you can use classification task as evaluation metrics, which might be easier and more interpretable. \n\nIn Section 3.1, “not adding noise to the decoder” should be encoder.\nIn Section 3.3, “do not add noise to decoder” should be encoder.\n\nThe presentation of the paper needs to be improved. There are too many typos and grammar mistakes. The labels of figures in the experiment section are too small. The paper does not have a conclusion section.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This provides a new method, called DPAutoGAN, for the problem of differentially private synthetic generation. The method uses private auto-encoder to reduce the dimension of the data, and apply private GAN on the latent space. The reviewers think that there is not sufficient justification for why this is a good approach for synthetic generation. They also think that the presentation is not ready for publication.
Decision: Reject