Differentially Private Synthetic Data: Applied Evaluations and Enhancements
Authors: Lucas Rosenblatt
Xiaoyan Liu
Samira Pouyanfar
Eduardo de Leon
Anuj Desai
Joshua Allen
Venue:  (2021)
Keywords: privacy
differential privacy
generative adversarial networks
gan
security
synthetic data
evaluation
benchmarking
ensemble

Abstract: Machine learning practitioners frequently seek to leverage the most informative available data, without violating the data owner's privacy, when building predictive models. Differentially private data synthesis protects personal details from exposure, and allows for the training of differentially private machine learning models on privately generated datasets. But how can we effectively assess the efficacy of differentially private synthetic data? In this paper, we survey four differentially private generative adversarial networks for data synthesis. We evaluate each of them at scale on five standard tabular datasets, and in two applied industry scenarios. We benchmark with novel metrics from recent literature and other standard machine learning tools. Our results suggest some synthesizers are more applicable for different privacy budgets, and we further demonstrate complicating domain-based tradeoffs in selecting an approach. We offer experimental learning on applied machine learning scenarios with private internal data to researchers and practitioners alike. In addition, we propose QUAIL, a two model hybrid approach to generating synthetic data. We examine QUAIL's tradeoffs, and note circumstances in which it outperforms baseline differentially private supervised learning models under the same budget constraint.

Under review as a conference paper at ICLR 2021
DIFFERENTIALLY PRIVATE SYNTHETIC DATA: APPLIED EVALUATIONS AND ENHANCEMENTS
Anonymous authors
Paper under double-blind review
ABSTRACT
Machine learning practitioners frequently seek leverage the most informative available data, without violating the data owner's privacy, when building predic- tive models. Differentially private data synthesis protects personal details from exposure, and allows for the training of differentially private machine learning models on privately generated datasets. But how can we effectively assess the efficacy of differentially private synthetic data? In this paper, we survey four dif- ferentially private generative adversarial networks for data synthesis. We evaluate each of them at scale on five standard tabular datasets, and in two applied indus- try scenarios. We benchmark with novel metrics from recent literature and other standard machine learning tools. Our results suggest some synthesizers more applicable for different privacy budgets, and we further demonstrate complicating domain- tradeoffs in selecting approach. We offer experimental learning on applied machine learning scenarios with private internal data to researchers and practitioners alike. In addition, propose QUAIL, a two model hybrid approach to generating synthetic data. We examine QUAIL's tradeoffs, and note circum- stances in which it outperforms baseline differentially private supervised learning models under the same budget constraint.
INTRODUCTION
Maintaining an individual's privacy major concern when collecting sensitive information from groups or organizations. A formalization of privacy, known differential privacy, has become the gold standard with which to protect information from malicious agents (Dwork) TAMC 2008). Differential privacy offers some of the most stringent known theoretical privacy guarantees (Dwork) ct al. 2014). Intuitively, for some query on some dataset, a differentially private algorithm produces output, regulated by privacy parameter c, that is statistically indistinguishable from the same query on the same dataset had any one individual's 's information been removed. This powerful tool has been adopted by researchers and industry leaders, and has become particularly interesting to machine learning practitioners, who hope to leverage privatized data in training predictive models (Ji al. 2014 Vietri et al. 2020).
Because diffcrential privacy often depends on adding noise, the results of differentially private al- gorithms can come at the cost of data accuracy and utility. However, differentially private machine learning algorithms have shown promise across number of domains. These algorithms can provide tight privacy guarantees while still producing accurate predictions (Abadi et al. 2016). A drawback to most methods, however, is in the one-off nature of training: once the model is produced, the pri- vacy budget for a real dataset can be entirely consumed. The differentially private model is therefore inflexible to retraining and difficult to share/verify: the output model is a black box.
This can be especially disadvantageous in the presence of high dimensional data that require rigorous training techniques like dimensionality reduction or feature selection (Hay et al.) 2016). With limited budget to spend, data scientists cannot exercise free range over a dataset, thus sacrificing model quality. In effort remedy this, and other challenges faced by traditional differentially private methods for querying, we can use differentially private techniques for synthetic data generation, investigate the privatized data, and train informed supervised learning models.
In order to use the many state-of of the-art methods for differentially private synthetic data effectively in industry domains, we must first address pitfalls in practical analysis, such the lack of realistic

---

Under review as a conference paper at ICLR 2021
benchmarking (Arnold & Neunhoeffer 2020 Benchmarking is non-trivial, as many new state- of-the-art differentially private synthetic data algorithms leverage generative adversarial networks (GANs), making them expensive to evaluate large scale datasets (Zhao al. 2019). Further- more, many of state-of-the-ard approaches lack direct comparisons to one another, and by nature of the privatization mechanisms, interpreting experimental results is non-trivial (Jayaraman & Evans 2019). New metrics presented to analyze differentially private synthetic data methods may them- selves need more work to understand, especially in the domain of tabular data (Ruggles al. 2019 Machanavajjhala et al. 2017).
To that end, our contributions in this paper are 3-fold. (1) We introduce more realisitic benchmark- ing. Practitioners commonly collect state-of-the-arr approaches for comparison in shared envi- ronment (Xu et al.) 2019). We provide our evaluation framework, with extensive comparisons on both standard datasets and our real-world, industry applications. (2) We provide experimentation on novel metrics at scale. We stress the tradeoff between synthetic data utility and statistical similarity, and offer guidelines for untried data. (3) We present straightforward and pragmatic enhancement, QUAIL, that addresses the tradeoff between utility and statistical similarity. QUAIL's ' simple modi- fication to differentially private data synthesis architecture boosts synthetic data utility in machine learning scenarios without harming summary statistics or privacy guarantees.
BACKGROUND
Differential Privacy (DP) is a formal definition of privacy offering strong assurances against various re-identification and re-construction attacks (Dwork et al. [006) 2014). In the last decade, DP has attracted significant attention due to its provable privacy guarantees and ability to quantify privacy loss, as well as unique properties such robustness to auxiliary information, composability enabling modular design, and group privacy (Dwork et al. 2014 Abadi et al. 2016)
Definition 1. (Differential Privacy Dwork et al. 2006)) A randomized function IC provides (e, differential privacy if AS C Range(K), (K), all neighboring datasets D, î) differing single entry,
Pr(I[(D) E 5] S e Pr((((D) 8] + 5,
(1)
This is a standard definition of DP, implying that the outputs of differentially private algorithm for datasets that vary by single individual are indistinguishable, bounded by the privacy parameter Here, e is a non-negative number otherwise known as the privacy budget. Smaller values more rigorously enforce privacy, but often decrease data utility. An important property DP is its resistance to post-processing. Given an (e, ddifferriree private algorithm K. D - O, and f: O + O' an arbitrary randomized mapping. f KC : D - Ó'is also differentially private.
Currently, the widespread accessibility of data has increased data protection and privacy regulations, leading to surge of research into applied scenarios for differential privacy (Allen et al. (2019): Ding ( et al. (2017). There have been several studies into protecting individual pri- vacy during model training Li et al. ZZaag et al. (2015); Feldman et al. (2018). In particular, solve the problem of preserving privacy in deep learning (Phan) several studies have attempted Shokki & Shmatikov (015); Xie et al. (2018) Zhang et al. (2018); et al. 2): Abadi et al. [ Jordon et 2018b): Torkzadchmahan et al. (2019)) Here, two main techniques for training mod- els with differential privacy are discussed:
et (217);; Doudalis
DP-SGD Differentially Private Stochastic Gradient Descent (DP-SGD), proposed by Abadi et al. (016)), is one of the first studies to make the Stochastic Gradient Descent (SGD) computation differ- ential private. Intuitively, DPSGD minimizes its loss function while preserving differential privacy by clipping the gradient in the optimization's 's la norm to reduce the model's 's sensitivity, and adding noise to protect privacy. Further details can be found in the Appendix.
PATE Private Aggregation of Teacher Ensembles (PATE) Papernot et al. (2016) provided PATE, which functions by first deploying multiple teacher models that are trained on disjoint datasets, then deploying the teacher models on unseen data to make predictions. On unseen data, the teacher models "vote" to determine the label; here random noise is introduced to privatize the results of the vote. The random noise is generated following the Laplace Lap(A) distribution. PATE further introduces student models, which try to train a model, but only have access to the privatized labels garnered from the teacher's vote. By training multiple teachers on disjoint datasets and adding noise
2

---

Under review as a conference paper at ICLR 2021
to the output predicted by those teacher models, the student cannot relearn individual teacher's model or related parameters.
2.1 PRIVACY PRESERVING SYNTHETIC DATA MODELS
Synthetic data generation techniques, such as generative adversarial networks (GANs) (Goodfellow et al.] (2014); (Arovssy et al. (2017); Xu et al. (2019)) have become a practical way to release realistic fake data for various explorations and analyses. Although these techniques are able to generate high-quality fake data, they may also reveal user sensitive information and are vulnerable to re-identification and/or membership attacks (Hayes et al. (2019); Hitaj et al. (2017); Chen et al.) (219 ) Therefore, in the interest of data protection, these techniques must be formally privatized. In recent years, researchers have combined data synthesis methods with DP solutions to allow for the release of data with high utility while preserving an individual's privacy (Xie et al. (2018); Jordon et al. (20 8b); Park et al. (2018); Mukherjee et al. (2019). Below, we briefly discuss three popular differentially private data synthesizers, evaluated this paper.
MWEM Multiplicative Weights Exponential Mechanism (MWEM) proposed by Hardt et al. (2012) simple yet effective technique for releasing differentially private datasets. It combines Multi- plicative Weights (Hardt & Rothblum 2010) with the Exponential Mechanism (McSherry & Tal- war 2007) achieve differential privacy. The Exponential Mechanism a popular mechanism for designing E-differentially private algorithms that select for best set of results R using a scoring function r)) Informally, 8( (B))) can be thought of as the quality of a result r for a dataset B. MWEM starts with a dataset approximation and uses the Multiplicative Weights update rule to improve the accuracy of the approximating distribution by selecting for informative queries using the Exponential Mechanism. This process of updates iteratively improves the approximation.
DPGAN Following Abadi et al. (2016'ss 's work, a number of studies utilized DP-SGD and GANs to generate differential private synthetic data (Xie et al. 2018 Torkzadehmahani et al. 2019 Xu al., 2018). These models inject noise to the GAN's discriminator during training to enforce differential privacy. DP's guarantee of post-processing privacy means that privatizing the GAN's discriminator enforces differential privacy on the parameters of the GAN's generator, as the GAN's mapping func- tion between the two functions does not involve any private data. We use the Differentially Private Generative Adversarial Network (DPGAN) Xie et al. (2018) as one of our benchmark synthesizers. DPGAN leverages the Wasserstein GAN proposed by Arjovsky et al. (017), adds noise on the gra- dients, and clips the model weights only, ensuring the Lipschitz property of the network. DPGAN has been evaluated on image data and Electronic Health Records (EHR) in the past.
PATE-GAN et al. (2018b) modified the Private Aggregation of Teacher Ensembles (PATE) framework to apply to GANs order to preserve the differential privacy of synthetic data. Similarly to DPGAN, PATE-GAN only applies the PATE mechanism to the discriminator. The dataset is first partitioned into k subsets, and & teacher discriminators are initialized. Each teacher discriminator is trained discriminate between a subset of the original data and fake data generated by Generator. The student discriminators are then trained to distinguish real data and fake data using the labels generated by ensemble of teacher discriminators with random noise added. Lastly, the generator is trained to fool the student discriminator, Jordon et al.] (2018b) claim that this method outperforms DPGAN for classification tasks, and present supporting results.
ENHANCING PERFORMANCE
The QUAIL Hybrid Method As we explored generating differentially private synthetic data, we noted disconnect between the distribution of epsilon, or privacy budget, and the algorithm's ap- plication. Generating synthetic data to provide summary statisties necessitates an even distribution of budget across the entire privatization effort; we cannot know user's query in advance. We may want to reallocate the budget, however, for a known supervised learning task.
QUAIL (Quail-ified Architecture Improve Learning) is a simple, two model hybrid approach to enhancing the utility of a differentially private synthetic dataset for machine learning tasks. Intu- itively, QUAIL assembles DP supervised learning model in tandem with DP synthetic data model to produce synthetic data with machine learning potential. Algorithum describes the procedure more formally.
3

---

Under review as a conference paper at ICLR 2021
Algorithm 1: QUAII, pseudocode
Input:
Dataset D, supervised learning target dimension r', budget > O, split factor 0 < p < 1, size n samples to generate, differentially private synthesizer (D, e), and a differentially private supervised learning model C(D, e, t) (f is supervisory signal i.e. target dimension). We let X be the universe of samples, and N denote the set of all non-negative integers. Thus, NIX is all databases in universe X, as described in Section 2.3 of Dwork et al. (2014).
Split;
Split the budget: EM = 6 and &c = * p). Create Das which identical D except r' & DMM-
In parallel;
Train differentially private supervised learning model: C(D, ([D,ec,r' ec,r") to produce
(r)(s) .NIII > R1, which can map any arbitrary E N7X to an output label.
Train differentially private synthesizer: M(DM, CM) N R2 to produce synthesizer MD which produces synthetic data S E N
Sample;
Using MR generate synthetic dataset Spn with n samples.
2. For each sample 8, SD apply (x,(s) = Ta i.e. apply model to each synthetic datapoint to produce a supervised learning target output T4+
3. Transform S + RR. For each row 8; E SDM = [s,, r:] s.t. vss, 8; E dom( i.e. append r; each row 8; so that Sr is now in same domain D, the original dataset.
Output: Return SR. synthetic dataset with samples, where each sample in SR has target dimension ri produced by the supervised learner C,¹
Theorem 3.1 (QUAIL follows the standard composition theorem for (c, d)dfffrrennti privacy). The QUAII. method preserves the differential privacy guarantees of C (/RR&c. (g,,rrr) and M (RM,,MM) by the standard composition rules of differential privacy (Dwork el al. 2014).
Proof. Let the first (e, -diffferrettillyy private mechanism M1 : N + Rí be C(R, EC, r'). Let the second (e, o)dffffrrentillly private mechanism M2 NN R2 be (RMM, Fix 0 <
1, Eas = p= * e and EC (1- p) * e, then by construction, (r[M2())=(1117 (x)= 2 exp(-(EMs + Ec)),,
which satisfies the differential privacy constraints for a privacy budget of EM +cc = Etotal- For more details, see the appendix.
Differentially Private GANs for Tabular Data In this paper, we focus on tabular synthetic data, and explored state-of-the-art methods for generating tabular data with GANs. CTGAN is state-of- the-art GAN for generating tabular data presented by Xu et al. (2019). We made CTGAN differen- tially private using the aforementioned techniques, DP-SGD and PATE. CTGAN addresses specific challenges that a vanilla GAN faces when generating tabular data, such as mode-collapse and con- tinuous data following a non-Gaussian distribution (Xu et al. 2019). To model continuous data with multi-mode distributions, it leverages mode-specift normalization In addition, CTGAN in- troduces a conditional generator, which can generate synthetic rows conditioned by specific discrete columns. CTGAN further trains by sampling, which explores discrete values more evenly.
DP-CTGAN Inspired by Xie et al. (2018)'s 's DPGAN work, we applied DP-SGD to the CTGAN architecture (details can be found in Figure in the Appendix). Similarly to DPGAN, in applying DP-SGD to CTGAN we add random noise to the discriminator and clip the norm to make it dif- ferentially private. Based the post-processing property mroorrty(Doork et al.) (014)) that any randomized mapping of a differentially private output is also differentially private, the generator is guaranteed to be differentially private when the generator is trained to maximize the probability of D(G())). In CTGAN, the authors add the cross-entropy loss between conditional vector and produced set of one- hot discrete vectors into the generator loss. To guarantee differential privacy with the generator,
4

---

Under review as a conference paper at ICLR 2021
removed the enosspentropy loss when calculating generator loss. Thus, the generator is differentially private as well. See Figure I in Appendix for a diagram.
AATE-CTGAN Drawing from work PATE-GAN, applied the PATE framework to CTGAN (Jordon et al. 2018b). Similarly to PATE-GAN, we partitioned our original dataset into & subsets and trained k differentially private teacher discriminators to distinguish real and fake data. In order to apply the PATE framework, we further modified CTGAN's s teacher discriminator training: instead of using one generator generate samples, we initialize conditional generators for each subset of data (shown in Figure 2 in the appendix).
Add none
g gradeets
Genseator
Pake
Teacher
Conditional
Disoiminator Network
Concitinaal Genoeeko 2
Fake oueples
samples
Teacber
Cond
Nele
Tocher
Real somoles tumple vileeis
Figure 2: Teacher Discriminator of PATE- Figure 1: Block diagram of DP-CTGAN model. CTGAN model.
4 EVALUATION: METRICS, INFRASTRUCTURE AND PUBLIC BENCHMARKS
We focus two sets of metrics in our benchmarks: one for comparing the distributional similarity of two datasets and another for comparing the utility of synthetic datasets given a specific predictive task. These two dimensions should be viewed complementary, and in tandem they capture the overall quality of the synthetic data.
Distributional similarity To provide quantitative measure for comparison of synthetically gener- ated datasets, we use relatively new metric for assessing synthetic data quality: propensity score mean-squared error (pMSE) ratio score. Proposed by SSnok & Slavković (2018), pMSE provides statistic to capture the distributional similarity between two datasets. Given two datasets, we com- bine the two together with an indicator label which set a specific observation comes from. A discriminator is then trained to predict these indicator labels. To calculate pMSE, we simply com- pute the mean-squared error of the predicted probabilities for this classification task. If our model is unable to discern between these classes, then the two datasets are said to have high distributional similarity. To help limit the sensitivity of this metric to outliers, [Snoke & Slavković (2018) propose transforming pMSE to a ratio by leveraging an approximation to the null distribution. For the ratio, we simply divide the pMSE by the expectation of the null distribution. ratio score of 0 implies the two datasets are identical.
Machine Learning Utility Given the context of this paper, we aim to provide quantitative measures for approximating the utility of differentially private synthetic data in regards to machine learning tasks. Specifically, we used three metrics: AUCROC and FI-score, two traditional utility measures, and the synthetic ranking agreement (SRA), a more recent measure. SRA can be thought of as the probability that a comparison between any two algorithms on the synthetic data will be similar to comparisons of the same two algorithms the real data (Jordon et al. 2018a). Descriptions of each metric can be found in the Appendix.
Evaluation Infrastructure The design of our pipeline addressed scalability concerns, allowing us to benchmark four computationally expensive GANs on five high dimensional datasets across the privacy budgets c [0.01, 0.1, 0.5, 1.0,3.0, 6.0, 9.0], averaged across 12 runs. We used varying compute, including CPU nodes (24 Cores, 224 GB RAM, 1440 GB Disk) and GPU nodes GPU (4 x NVIDIA Tesla K80). Despite extensive computational resources, we could not adequately address the problem of hyperparameter tuning differentially private algorithms for machine learning tasks, which is an open research problem (Liu & Talwar 2019). In our case, a grid search was computationally intractable: for each of the public datasets all synthesizers, Car averaged 1.27 hours, Mushroom averaged 8.33 hours, Bank averaged 13.30 hours, Adult averaged 14.47 hours and Shopping averaged 27.37 hours. We trained our GANs using the experimentally determined
5

---

Under review as a conference paper at ICLR 2021
hyperparameters, and were informed by prior work around each algorithm. We include description of the parameters used for each synthesizer in the appendix.
Regarding Fl-score and AUC-ROC: We averaged across the maximum performance of five classifi- cation models: an AdaBoost classifier, a Bagging classifier, a Logistic Regression classifier, Multi- layer Perceptron classifier, and a Random Forest classifier. We decided to focus on classification scenario specifically: train-synthetic test-real or TSTR, which was far more representative of applied scenarios than train-synthetic test-synthetic. We compare these values to train-real test-real (TRTR).
LIPT ACHET
Figure 3: Real Car Fl Score: 0.97
Figure 4: Mushroom PMSE
Experimental Results: Public Datasets We ran experiments five public real datasets, which helped inform the applied scenario discussed in Section [ Full details of the experiments can be found in the Appendix, Figures 25-30. We will refer the datasets Adult, Car, Mushroom, Bank and Shopping, and will discuss a handful of the results here in terms of their machine learning utility and their statistical similarity consistently across plots, and their performance is tracked according to dataset (so "dpctgan ccr"" tracks the graphed metric for DPCTGAN on the Car dataset).
the real data. The individual synthesizer's are color coded
In our Car evaluations in Figure 3 we see strong performance from the QUAIL variants on very low é values. However, we note that for 3.0, DPCTGAN and PATECTGAN outperform even the QUAIL enhanced models. We further note that PATECTGAN performs remarkably well on the PMSE metric across values in Figure [88] In our Mushroom evaluations Figure 28a] QUAIL, variants also outperformed other synthesizers. However, PATECTGAN's exhibits the best statistical similarity (pMSE score) with larger e. In our evaluations on the Adult dataset Figure 30a while PATECTGAN performs well, DPCTGAN performs best when 2 3.0.
Our findings suggest that generally, with larger budgets (e 2 3.0). PATECTGAN improves on other synthesizers, both in terms of utility and statistical similarity. With smaller budgets (e 1.0), DPCTGAN may perform better. Synthesizers are not able to achieve reasonable utility under low budgets < 0.1), but DPCTGAN was able to achieve statistical similarity in this setting.
EVALUATION: APPLIED SCENARIO
Supported by learnings from experiments on the public datasets, we evaluated our benchmark DP synthesizers on several private internal datasets, for different scenarios such as classification and regression. We show that DP synthetic data models can perform on real-world data, despite a noisy supervised learning problem and skewed distributions when compared to the more standardized public datasets.
Classification The data used in this set of experiment include ~ 100,0000 samples and 30 features. The data includes only categorical columns each containing between to 24 categories. One of tasks with this dataset to train classification task with three classes. We faced significant challenges when managing the long-tail tail distribution of each feature. Figure 266 which can be found in the appendix, shows example of data distributions for different attributes in this data.

---

Under review as a conference paper at ICLR 2021
13
Classification
(b) Regression
Figure 5: ML evaluation results for internal dataset
We ran our evaluation suite on the applied internal data scenarios to generate the synthetic data from each DP synthesizer and benchmark standard MI. models. We also applied a Logistic Regression classifier with differential privacy from IBM. (Chaudhuri et al. 2011 diffprivlib) to the real data as a baseline. Figure [a shows the ML results from our evaluation suite. As expected, as the pri- vacy budget increases, performance generally improves. DP-CTGAN had the highest performance without the QUAIL enhancement. QUAIL, however, improved the performance of all synthesizers. In particular, QUAIL enhanced DPCTGAN synthesizer had the highest performance across ep- silons in this experiment. In particular, these experiments demonstrated the advantages of QUAIL, combining DP synthesizers with DP classifier for classification model.
Regression In this experiment, we used another internal data for the task of regression. Our dataset included 27466 and 6867 training and testing samples, respectively. The domain comprised eight categorical and 40 continuous features, After generating the DP synthetic data from each model, we used Linear Regression to predict the target variable. Figure[5bshovee the results from the evaluation suite. We used RMSE as the evaluation metric. For QUAIL boosting, we used Linear Regression model with differential privacy from IBM (Sheffet [015] diffprivlibb). We also compared the DP synthesizers with "vanilla" DP Linear Regression (DPLR) using real data.
In this experiment, PATECTGAN outperformed other models and even improved on the RMSE (root-mean-son -quae---uarree--rrro))) when compared to the real data for budget > 1.0. For QUAIL-enhanced models, the RMSE considerably larger than the real and other DP synthetic data. We attribute this to weakness of the embedded regression model (DP Linear Regression) in QUAIL for this data scenario. Based on our observations, small privacy budgets (c < 10.0) for DP Linear Regression significantly affects its performance. However, as shown in Figure 5bb we still see some boost on the QUAIL variant synthesizers when compared to the "vanilla" DP Linear Regression. For distributional similarity comparison, please refer to Figure 27 in the appendix.
QUAIL Evaluations QUAIL'S hyperparameter, the split factor p where < < < 1, deter- mines the distribution of budget between classifier and synthesizer. We generated classifica- tion task datasets with 10000-50000 samples, 7 feature columns and 10 output classes using the maake_classi classificatiion fication package from Scikit-learn (Pedregosa et al. [011]. We experimented with the values = 10.1, 0.3, 0.5, 0.7, 0.9]. and report on results, varying budget e [1.0. 3.0, 10.0). See the appendix for complete results and a list of DP classifiers we experimented on embedding in QUAII..
Our figures represent the delta 8 in F1 score between training the classifier C(R, r') on the original dataset (the "vanilla" scenario) (F1,). and training Random Forest classifier on the dif- ferentially private synthetic dataset produced by applying QUAIL to an hybrid CRR, tc,r") and one of our benchmark synthesizers M (D, eM) (FI,). We plot FI, Fl,, across epsilon splits and datasizes. Positive to highly positive deltas are grey->red, indicating the "vanilla" scenario out- performed the QUAIL scenario. Small negative deltas are blue, indicating the QUAIL scenario matched, or even outperformed, the "vamilla" scenario. Each cell contains for some on datasets 110000 50000]. In our results use DP Gaussian Naive Bayes (DP-GNB) C <c, r') (F),),
7

---

Under review as a conference paper at ICLR 2021
and trained Random Forest Classifier data generated by QUAIL (F1,) (recall QUAIL combines C(R, ec, r') and a DP synthesizer) (Vaidya et al. 2013 diffirivliib). We average across 75 runs.
Note the correlation between epsilon split, datasize and classification performance when embedding PATECTGAN in QUAIL, shown in Figure 6 suggesting that a higher p split value increases the likelihood of outperforming C(R, (c,rr). For embedded MWEM synthesizer, seen in Figure 7 the relationship between split, scale and performance was more ambiguous. In general, a higher split factor p. which assigns more budget to the differentially private classifier C(D, EM; t) could improve the utility of the overall synthetic dataset. However, any perceived improvements were highly depen- dant on the differentially private synthesizer used. Our QUAIL results are agnostic the embedded supervised learning algorithm C(R, cc, r'), as they depict relative performance, though different methods of supervised learning are more suitable to certain domains. Future work might explore alternative classifiers or regression models, and how purposefully overfitting the model C CRR, r') could contribute to improved synthetic data.
Varying QUAIL e-split across datasizes with categorical data: patectgan
Varying QUAIL E-split across datasizes with categorical data: mwem
10000
0.04
12090
0.0047
0.04
Cant quall
20000
0623
0017
0003
X0000
0.00048
0.0019
0.03
Data Sazte
0.02
Data Siees
0.02
30000
0.0011
0.0062
0.0019
0.0044
0.059
10000
0:0041
0.0488
0:0088
00051
4. 1.0033
-001
-000
40000
0.013
0.0089
0.155
0.02
0.016
-000
40000
0.0032
0.072
0.0066
00085
000388
-0.00
-0.01
-0.01
50000
0.00096
0.0012
4.00 0000
4. 3.0067
0.0012
300000
0:0018
0.0015
4 0.0077
4.e-05
4. 0.0025
-0.02
-0.02
0.5
0.9
Spitss
Epsiion Sples
Figure 6: Privacy budget = 3.0
Figure 7: Privacy budget e 3.0
Peeling Back QUAIL: Analysis of via clustering and direct comparison By first assessing the TSNE clustering in Figures 8 and 9, we see that not only is the synthetic data produced by QUAIL very similar to the real data, but the accuracy of the labeling for the embedded model (in this case, DPLR) is also very similar. Further investigation into data scale revealed that the QUAIL method takes advantage of allocating excess epsilon when datasets are large. As datascale increases, the sensitivity of the differentially private model decreases and so less epsilon can be used more effi- ciently. Thus, we see that an exaggerated difference between DPLR embedded in QUAIL (with an epsilon of 2.4) and DPLR with an epsilon of 3.0 for a dataset of 20,000 samples. In this case, the embedded DPLR model accuracy suffers, and so does the learning utility of the produced synthetic data. Conversely, as we increase the data size to 50,000 and 100,000 samples, we see that the in- ternal model (with epsilon 2.4) can match the performance of the vanilla model (with epsilon 3.0). Then, the synthetic dataset serves only to augment the performance by small but significant margin (in Figure 10, we see a bump of three percent to fl score.)
Time Performance Analysis of QUAIL: Making supervised learning more efficient QUAIL benefits the efficiency of training intensive GANs. In Table the time performance of QUAIL is compared with non-Quail methods. Specifically, we select two epsilons = 3.0 and two QUAIL split factors (p- = 0.9 and p = 0.5). From this table, it can be seen that in all GAN-based models, QUAIL can improve time efficiency considerably. This is more noticeable as the epsilon increases where training time for models such as DPCTGAN and DPGAN skyrockets.
6.0) and
6 PUNCHLINES
We summarize our findings in the following punchlines, concise takeaways from our work for searchers and applied practitioners exploring DP synthetic data.
1. Holistic Performance. No single model performed best always (but PATECTGAN performed well often). Model performance was domain dependent, with continuous/aategriical features, dataset scale and distributional complexity all affecting benchmark results. However, in general, we found
8

---

Under review as a conference paper at ICLR 2021
Figure 8: Privacy budget 3.0
Photing Syrtindic Denat//rumnt Lebelhngg Kendirn Parcal 109)
Slaz: aurgtci
nan 2200 vestic A.1
Figure 9: Privacy budget 3.0
that PATECTGAN had better utility and statistical similarity in scenarios with high privacy budget (c > 3.0) when compared to the other synthesizers we benchmarked. Conversely, with low privacy budget (e <= 1.0) we found that DPCTGAN had better utility, PATECTGAN may still be better in terms of statistical similarity.
Computational tradeoff. Our highest performant GANs were slow, and MWEM is fast. PATECT- GAN and DPCTGAN, while being most performant synthesizers, were also the slowest to train. With GANs, more computation often correlates with higher performance (Lucic et al. 2018). On categorical data, MWEM performed competitively, and is significantly faster to train any domain.
3. Using AUC-ROC and Fl Score. One should calculate both, especially to best understand QUAIL's tradeoffs. Our highest performing models by F1 Score often had QUAIL enhancements, which sometimes, but not always, detrimentally affected AUC-ROC. Without both metrics, one risks using QUAIL. enhancement for model with high training accuracy that struggles to generalize.

---

Under review as a conference paper at ICLR 2021
20AT SPOTNA
OPUA QURILI Coeriiaaa frained QUALL Speiidd
Aomeur (2-5 aevt 2.0
tpoike:: $1)
s00dken 2.0
AOHEIOONLL E.20
Figure 10: Privacy budget = 3.0
classification
regression
method
3
6
c: 3
c: 6
dpgan
1130
3950
1300
4335
quail_dpgan.pp.
20
58
202
203
quail_dpgan_pll)
305
444
1323
dpetgan
15689
24808
3989
14029
quail dpctgan p0.9
199
759
198
318
quail_dpcttan.pple
4478
1171
3964
pategan
77
206
224
389
quail-pategan.pO.
18
15
152
156
quail_ Saaailpaaegan_p....
31
69
1655
210
patectgan
160
449
263
474
quail_ patectgan p0.9
16
19
152
155
quail_pateecgan.pp0.
56
131
185
270
Table 1: Time Performance Analysis of QUAIL compared to other synthesizers (time is shown in seconds)
Using PMSE. pMSE can be used alongside ML utility metrics balanced experiments. pMSE concisely captures statistical similarity, and allows practitioners to easily balance utility against the distributional quality their synthetic data.
5. Enhancing with QUAIL. QUAIL's effectiveness depends far more on the quality of the embedded differentially private classifier than the synthesizer. QUAIL showed promising results almost all the scenarios we evaluated. Given confidence in the embedded "vanilla" differentially private classifier, QUAII. can be used regularly improve the utility DP synthetic data.
6. Reservations for use in applied scenarios. Applied DP for ML is hard, thanks to scale and di- mensionality, Applied scenarios we presented assessed large datasets, leading to high computational costs that makes tuning performance difficult. Dimensionality is tricky deal with in large, sparse, imbalanced private applied scenarios (like we faced with internal datasets). Practitioners may want to investigate differentially private feature selection dimensionality reductions before training. We are aware of work being done to embed autoencoders into differentially private synthesizers, and view this promising approach (Nguyen al. 2020
10

---

Under review as a conference paper at ICLR 2021
7 CONCLUSION
With this paper, we set out to assess the efficacy of differentially private synthetic data for use on machine learning tasks. We surveyed an histogram based approach (MWEM) and four differentially private GANs for data synthesis (DPGAN, PATE-GAN, DPCTGAN and PATECTGAN), We evalu- ated each approach using an extensive benchmarking pipeline. We proposed and evaluated QUAIL, straightforward method to enhance synthetic data utility in ML tasks. We reported results from two applied internal machine learning scenarios. Our experiments favored PATECTGAN when the privacy budget 3.0, and DPCTGAN when the privacy budget 1.0. We discussed nuances of domain-basee tradcoff's and offered takeaways across current methods of model selection, training and benchmarking. As of writing, experiments represent one of the largest efforts bench- marking differentially private synthetic data, and demonstrates the promise of this approach when tackling private real-world machine learning problems.
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318, 2016.
Joshua Allen, Bolin Ding, Janardhan Kulkarni, Harsha Nori, Olga Ohrimenko, and Sergey Yekhanin. An algorithmic framework for differentially private data analysis on trusted processors. In Ad- vances in Neural Information Processing Systems, pp. 1 13657-13668, 2019.
Martin Arjovsky, Soumith Chintala, and Léon Bottou.
Wasserstein
gan. arXiv preprint
arXiv: 07785, 2017.
Christian Arnold and Marcel Neunhoeffer. Really useful synthetic data a framework to evaluate the quality of differentially private synthetic data. arXiv preprint wwxiv:2004.0774400 2020.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against gans. arXiv preprint arXiv: 2019.
diffprivlib.
attps:///ithee com/ IBM/ di differentio aal--riivacy Seraacy-libbrry library Accessed: 2020-07-30.
IBM differential privacy library.
Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In Advances in Neural Information Processing Systems, pp. 0001-3571118 2017.
Stelios Doudalis, Ios Kotsogiannis, Samuel Haney, Ashwin Machanavajjhala, and Sharad Mchrotra. One-sided differential privacy. arXiv preprint arXhv:1712.05888. 2017.
Dheeru Dua and Casey Graff. UCI machine learning repository. 2017. URL Uttlttt:://archie ics uci ml
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference, pp. 265-284 Springer, 2006.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations differential privacy. Foundations and Trends in Theoretical Computer Science, 9(344:211 2014.
Du D. Duan Z. L. A. (eds) Dwork. Cynthia In: Agrawal M. Differential privacy: A survey of results. In Theory and Applications of Models of Computation, pp. Lecture Notes in Computer Science, vol 4978. Springer, TAMC 2008
Vitaly Feldman, Ilya Mironov, Kunal Talwar, and Abhradeep Thakurta. Privacy amplification by iteration. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS), pp. 521-532, IEFE, 2018
11

---

Under review as a conference paper at ICLR 2021
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farkey Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural infor- mation processing systems, pp. 2672-2688 2014.
Moritz Hardt and Guy N Rothblum. A multiplicative weights mechanism for data analysis. In 2010 IEEE 5 Annual Symposium on Foundations of Computer Science, pp- 61-70. IEFE, 2010.
Moritz Hardt, Katrina Ligett, and Frank McSherry. A simple and practical algorithm for differen- tially private data release. In Advances in Neural Information Processing Systems, pp. 2339-2347, 2012.
Michael Hay. Ashwin Machanavajjhala, Gerome Miklau, Yan Chen, and Dan Zhang. Principled evaluation of differentially private algorithms using dpbench. In Proceedings of the 2016 Inter- national Conference on Management of Data, pp. 139 139,154, 2016.
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership infer- ence attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019 11):133-152, 2019.
Briland Hitaj. Giuseppe Ateniese, and Fernando Perez-Cruz. Deep models under the gan: infor- mation leakage from collaborative deep learning. In Proceedings of the 2017 ACM SIGSAC Conference Computer and Communications Security, pp. 603-618, 2017.
Bargav Jayaraman and David Evans. Evaluating differentially private machine learning in practice. In 28th {USENIX) Security Symposium (( (UUENIIX) Security 19), pp. 1895-1912, 2019.
Zhanglong Ji, Zachary C Lipton, and Charles Elkan. Differential privacy and machine learning: a survey and review, arXiv preprint arXiv: 1412.7584, 2014.
James Jordon, Jinsung Yoon, and Mihaela van der Schaar. Measuring the quality of synthetic data for use in competitions. arXiv preprint arXiv: 1/45, 2018a.
James Jordon, Jinsung Yoon, and Mihaela van der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International Conference Learning Representations, 2018b.
Haoran Li, Li Xiong, Lucila Ohno-Machado, and Xiaoqian Jiang. Privacy preserving rbf kernel support vector machine. BioMed research international, 2014, 2014.
Jingcheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, pp. 298-309, 2019.
Mario Lucic, Karol Kurach, Marcin Michalski, Sylvain Gelly, and Olivier Bousquet. Are gans created equal? a large-scale study. Advances in neural information processing systems, pp- 700-709, 2018.
Ashwin Machanavajjhala, Xi He, and Michael Hay. Differential privacy in the wild: A tutorial on current practices & open challenges. In Proceedings of the 2017 ACM International Conference on Management of Data, pp. 1727-1730, 2017.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS'O1) 07), pp. 94-103. IEEE, 2007.
Sumit Mukherjee, Yixi Xu, Anusua Trivedi, and Juan Lavista Ferres. Protecting gans against privacy attacks by preventing overfitting. arXiv preprint arXiv:2001.00071, 2019.
Hung Nguyen, Di Zhuang, Yuan Wu, and Morris Chang. Autogan-basse based dimension reduction for privacy preservation. Neurocomputing, 384:94-103, 2020.
Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi- supervised knowledge transfer for deep learning from private training data. arXiv preprint arXiv:1610.05755 2016.
12

---

Under review as a conference paper at ICLR 2021
Noseong Park, Mahmoud Mohammadi, Kshitij Gorde, Sushil Jajodia, Hongkyu Park, and Youngmin Kim. Data synthesis based on generative adversarial networks. arXiv preprint arXiv: 1806.08000..300 180.0388 2018.
Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. Seikit-learn: Machine learning in python. Journal of machine learning research, 12(0cr):225--2830, 2011.
NhatHai Phan, Xintao Wu, and Dejing Dou. Preserving differential privacy in convolutional deep belief networks. Machine learning, 106(9-10):1881-1704 2017.
Steven Ruggles, Catherine Fitch, Diana Magnuson, and Jonathan Schroeder. Differential privacy and census data: Implications for social and economic research. In AEA papers and proceedings, volume 109, pp. 403-08, 2019.
Or Sheffet. Private approximations of the 2nd-moment matrix using existing techniques in linear regression. arXiv preprint arXiv:/507.00030 2015.
Reza Shokri and Vitaly Shmatikov. Privacy-preeerving deep learning. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp. 2015. 2015.
Joshua Snoke and Aleksandra Slavković. pmse mechanism: Differentially private synthetic data with maximal distributional similarity. In International Conference on Privacy in Statistical Databases, pp. 138-159. Springer, 2018.
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. Dp-cgan: Differentially private synthetic data and label generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 0-0, 2019.
Jaideep Vaidya, Basit Shafiq, Anirban Basu, and Yuan Hong. Differentially private naive bayes classification. In 2013 IEEE/WIC/ACM International Joint Conferences on Web Intelligence (WI) and Intelligent Agent Technologies (IAT), volume 1, pp. 571-576. IEEE, 2013.
Giuseppe Vietri, Grace Tian, Mark Bun, Thomas Steinke, and Zhiwei Steven Wu. New oracle- efficient algorithms for private synthetic data release. arXiv preprint arXiv:2007.05453 2020.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou Differentially private generative adversarial network. arXiv preprint arXiv:8802.06739, 2018.
Jingjing Xu, Xuancheng Ren, Junyang Lin, and Xu Sun. Dp-gan: erative adversarial network for generating informative and diversified text. arXiv preprint 1802.0800..1.333 2018
gen-
Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante and Kalyan Veeramachaneni, Modeling tabular data using conditional GAN. CoRR, abs/1907.00503, 2019.
abs/
1907. 00503
Matei Zaharia, Andrew Chen, Aaron Davidson, Ali Ghodsi, Sue Ann Hong, Andy Konwinski, Sid- dharth Murching, Tomas Nykodym, Paul Ogilvie. Mani Parkhe, et al. Accelerating the machine learning lifecycle with miflow. IEEE Data Eng. Bull., 41(4):39-45, 2018.
Xinyang Zhang, Shouling Ji, and Ting Wang. Differentially private releasing via deep generative model (technical report). arXiv preprint arXiv: /rXX:v:800..15940 2018.
Zuhe Zhang, Benjamin Rubinstein, and Christos Dimitrakakis. bayesian inference. arXiv preprint arXiv:1512.06692,, 2015.
On the differential privacy of
Jingwen Zhao, Yunfang Chen, and Wei Zhang. Differential privacy preservation in deep learning: Challenges, opportunities and solutions. IEEE Access, 7:48901-4891 1, 2019.
13

---

Under review as a conference paper at ICLR 2021
A
APPENDIX
B METHODS
B.1 DP-SGD DETAILED STEPS
The detailed training steps are follows:
1. A batch of random samples is taken and the gradient for each sample is computed
2. For each computed gradient g. is clipped to g/ s/max(11 ligl where C' is a clipping bound hyperparameter.
3. A Gaussian noise (N,0 o²(²2)) (where o is the noise scale) is added to the clipped gra- dients and the model parameters are updated.
4. Finally, the overall privacy cost (c, is computed using a privacy accountant method.
B.2 DESCRIPTIONS OF METRICS: FI-SCORE, AUC-ROC AND SRA
Fl-score measures the accuracy of classifier, essentially calculating the mean between precision and recall and favoring the lower of the two. It varies between 0 and 1, where perfect perfor- mance.
Area Under the Receiver Operating Characteristic (AUC-ROC) represents the Receiver Operating Characteristic curve in single number between 0 and 1. This provides insight into the true positive vs. false positive rate the classifier.
AUC-ROC:
SRA: SRA can be thought of as the probability that comparison between any two algorithms on the synthetic data will be similar to comparisons the same two algorithms on the real data. SRA compares train-synthetic test-real (i.e. TSTR, which uses differentially private synthetic data to train the classifier, and real data to test) with train-real test-real (TRTR, which uses differentially private synthetic data to train and test the classifier)
Further Motivation Machine learning practitioners often need deep understanding of data order to train predictive models. That can be incredibly difficult when data is private. Training off, blackbox "vanilla" DP classifiers cannot be retrained, as this risks individual privacy, making parameter tuning and feature selection incredibly difficult with these models. Differentially private synthetic data allows practitioners to treat data normally, without further privacy considerations, giving them an opportunity fine tune their models.
C QUAIL
C. QUAIL FURTHER DETAILS
We evaluated with few vanilla differentially private classifiers ((R,ec,r):
1. Logistic Regression classifier with differential privacy. (Chaudhuri al. 201 diffprivlib)
2. Gaussian Naive Bayes with differential privacy. (Vaidya et al.
2013 diffprivlib)
3. Multi-layer Perceptron (Neural Network) with differential privacy. Abadi et al, 2016
2014) Let M1 : Ni + R₁ be Theorem C.1. Standard Composition Theorem Dwork et al. an diiffferrntiilly private algorithm, and let M, N R₁ be cx-differentially private al- gorithm. Then their combination, defined to be M1 - R, X R2 by the mapping: M1,((x)
(Mi (x)) M2(x)) is e1. ez-differentially private.
14

---

Under review as a conference paper at ICLR 2021
Proof. Let y E NIx be such that ||a
U111 < 1. Fix any (11, R2 Then:
Pr (() = (2))
Pr[M (x) = Pr) (2]rr(M((2)) (2 = r2]
(2)
Pr (r(M) = (r1.
Pr[M (V) - Pr (2()) = =r2
Pr[Mi (2) - )
Pr Pr[Ma(x)= = r2)
(3)
Pr(Mi()) =
Pr(M2(1) = T2)
S (erp(e))exp(es)
(4)
= exple1 +22
(5)
By symmetry, PrIM (1)
a) 2 exp(-(e1 + 62))
Proof. QUAIL: full proof of differential privacy Let the first (c, diffferrrett private mechanism
Mj N|X| + Rí be ((,'), Let the second (e, -ddffffrrent private mechanism M2 : N + R2 be (Ras,, EM). Fix 0 < p 1, then by construction, with original budget B = 6,
B x+c+ (1 p) *
EM = *
(7)
EC (1 p) =
(8)
By the Standard Composition Theorem
(9)
Pr|Mo, (x) = (2))
exp(- (CEM + tc))
(10)
Pr|Mo, (V) = [2)
Pr|Mo, (x) = (r1,
2 exp( (B))
(11)
Pr[Mo.M (V) (r1,
C.2 QUAIL FULL RESULTS
Varying QUAIL c-split across datasizes cetegorical Cara: mweem
Varying QUAIL c-spiit across datasizes cesegonical data: mweem
Varying QUAIL c-split across datar zes
cetecorical cata: mwem
AUR
UID DM
920ra 2814
21.00
0000
030
2.05
wo0n an0
2800
02012
0.805
00811
0,612
4014
-081
ArM1
2/301
-002
02
07
Figure 11: Budget = 1.0
Figure 12: Budget 3.0
Figure 13: Budget = 10.0
Varying QUAIL across datas cetegonical data: patectgen
Varying QUALL e:splt across detasizes calegorical data: patestgan
Varying QUAIL split across datas caregorical data: patectgan
LAND.
2003
1000 ane
10038 4p12
10000 5p10
Figure 14: Budget = 1.0
Figure 15: Budget = 3.0
Figure 16: Budget e = 10.0
D EVALUATIONS
D. DESCRIPTION OF INFRASTRUCTURE
Our experimental pipeline provides an extensible interface for loading datasets from remote hosts, specifically from the UCI MI. Dataset repository (Dua & Graff 2017). For each evaluation dataset,
15

---

Under review as a conference paper at ICLR 2021
Varying QUAIL s-split acroes datasizes with categorical pateçan
Varying QUAIL e-split datasizes with categorical data: pategan
Varying c-split with categor data: pateeann
380
U1 CNE
w000 400
300
12000
Figure 17: Budget = 1.0
Figure 18: Budget = 3.0
Figure 19; Budget e = 10.0
Varying e-split datasizes with rategorical darigan
Verying e-split darasizes with catagorical dprigan
Varying s-spiir datav categoriral dprigan
1004
CMA
1903 MOX
1O12 2000
6.0
241
2011
2013
2013
5.13
Figure 20: Budget = 1.0
Figure 21: Budget = 3.0
Figure 22: Budget e = 10.0
Varying QUAIL e-split across datasizes with categorical data: dpçan
Varying QUALL e-split across datasizes with categorical date: dpçan
Varying QUAIL e-split across datas zes with categorical data: dpçan
032
1300
033
0211
2012
1331
0211
D4L1
23112
9311
5221
032%
5771
1002 L080
2313
3877
6813
2019
E017
5315
1311
5315
141
0000
0,00
0,01
0001
281L
2011
6012
0008
61122
9210
0440
0217
25
27
07
21
Figure 23: Budget = 1.0
Figure 24: Budget 3.0
Figure 25: Budget 10.0
launch process that synthesizes datasets for each privacy budget (Es) specified on each syn- thesizer specified. Once the synthesis is complete, the pipeline launches a secondary process that analyzes the synthetic data, training classifiers and running the previously mentioned novel metrics. The run is launched, and the results are logged, using MLFlow runs (Zaharia et al.] 2018) with an Azure Machine Learning compute-cluster backend. Our compute used CPU nodes STANDAA D. DADD _NC24r (24 Cores, 224 GB RAM, 1440 GB Disk) and GPU nodes GPU (4 NVIDIA Tesla K80). We highly encourage future work into hyperparameter tuning for differen- tially private machine learning tasks, and believe our evaluation pipeline could be of some use in that effort.
D.2 DETAILS ON DATA
Results presented on the Public Datasets are averaged across 12 runs SRA results were moved to the appendix after difficulty interpreting their significance, although there potential trends that warrant further exploration.
Below is list of parameters used in training:
DPCTGAN
bepooddin-diim-1222 gen.dim=(256. 256),
dis.dim=(256) 256),
12scale=le-6. batch size=500, epochs=300,
16

---

Under review as a conference paper at ICLR 2021
3000
3000
Figure 26: Data distribution of the internal dataset for various attributes. Included to highlight the imbalanced nature, difficulty of supervised learning problem.
Dataset Name
Samples
Continuous Features
Categorical Features
Total Features
Class Distributions
UCI Link
Adult
48842
6
8
14
24.78% (binary anced)
positive imbal-
UCI
Bank Market-
45211
12
20
N/A (binary)
UCI
ing
Car Evaluation
1728
0
6
6
70,023 %,
UCI
22.222 %, 2
3.993 %. 3 3.762
% (multiclass im- balanced)
Mushroom
8124
22
22
51.8% positive (bi-
UCI
nary balanced)
Online Shop- pers Purchas- ing Intention
12330
10
8
18
84.5% negative (bi-
UCI
nary imbalanced)
(Shopping)
Table 2: Details on Public Datasets used for benchmarking.
sald
(a) PMSE Results: Internal Classification
(b) pMSE Results: Internal Regression
Figure pMSE evaluation results for internal dataset. PATECTGAN performed best both cases.
17

---

Under review as a conference paper at ICLR 2021
53T
(a) Real Mushroom F1 Score: 0.98
(b) Car pMSE
Figure 28: PATECTGAN demonstrated better performance at higher epsitons. QUAII. synthesittrs performed best at low epsilon privacy values.
LONDUN
(a) Real Car AUC-ROC: 0.99
(b) Real Mushroom AUC-ROC: 0.02
Figure 29: Mushrooms AUC-ROC curve demonstrated that the QUAIL synthesizers might not eralize particularly well.
Brigen
J012201, 2007
880
(a) Real Adult Fl Score: 0.89
(b) Adult PMSE
Figure 30: DPCTGAN outperformed other synthesizers by significant margins with Adult, both in terms of ML utility and statistical similarity.
18

---

Under review as a conference paper at ICLR 2021
Tard form
C10
699
019
1100EALAA LANG
(a) Real Adult AUC-ROC: 0.31
(b) Real Bank F1 Score: 0.94
Figure 31: As the most complex benchmark dataset, Bank presented a particular challenge. The results difficult interpret, and would require further experimentation to draw conclusions.
1M0 piCc 4C7014
bark ALC
330
330
(a) pMSE Bank
(b) Real Bank AUC-ROC: 0.08
Figure 32: Despite the noisy plots, at higher epsilon values, based F1-Scores and this pMSE plot, does appear as though DPCTGAN and PATECTGAN improved on the other synthesizers.
Sharping p90
140
14-
(a) Real Data Score: 0.93
(b) pMSE Shopping
Figure 33: We similar results here to Bank dataset. Bank and Shopping appear have been too complex for the synthesizers at the relatively low epsilon budgets provided.
19

---

Under review as a conference paper at ICLR 2021
ww.cong ESCHAO A07064
(a) Real Data AUC-ROC: 0.09
(a) SRA results for MWEM
(b) SRA results for PATEGAN
bank car shopping mushroom adult
bank car shopping mushroom adult
epsilons
epsilons
0,01
0.4 0.1
0.3
0.9
0.3
0.01
0.8 0.5
0.8
0,6
0.4
0.10
0.4 0.3
0.6
0.9
0.5
0.10
0.7 0.4
0.7
0.3
0.8
0.50
0.7 0.2
0.6
0.7
0.6
0.50
0.5 0.7
0.4
0.9
0.5
1.00
0.7 0.1
0.6
0.8
0.8
1.00
0.6 0.4
0.8
0.9
0.8
3,00
0.3 0.3
0.5
0.9
0.2
3.00
0.8 0.7
0.7
1.0
0.7
6.00
0.5 0.3
0.6
0.9
0.2
6.00
0.6 0.9
0.6
0.3
0.8
9.00
0.6 0.3
0.6
0.7
0.4
9.00
0.5 0.6
0.5
0.7
0.6
pack=1, log frequency=True, disabled dp=False. target.delta=NNne, sigma 5,
max-per-sampi wtt.saamlle.ggd..nnne -orm--rddddd......mm verbose=True. loss "wasserstein"
PATECIGAN
embedding
2 d1mm=12..
gen_dim=(256, 256), (is_dim=(255) 256), 12scale=1e-6, cpochs=300, pack=1,
(a) SRA results for DPGAN
(b) SRA results for PATECTGAN
bank car shopping mushroom adult
bank car shopping mushroom adult
epsilons
epsilons
0.01
0.6 0.2
0.7
0.7
0.4
0.01
0.4 0.4
0.7
1.0
0.5
0.10
0.4 0.1
0.7
0.7
0.7
0.10
0.7 0.3
0.5
0.9
0.5
0.50
0.4 0.4
0.9
0.6
0.3
0.50
0.5 0.8
0.7
0.9
0.4
1.00
0.8 0.2
0.7
1.0
0.5
1.00
0.5 0.3
0.8
0.6
0.5
3.00
0.9 0.4
0.2
1.0
0.9
3.00
0.7 0.4
0.5
0.8
0.3
6.00
0.9 0.6
0.5
0.6
0.8
6.00
0.5 0.4
0.5
1.0
0.4
9.00
0.4 0.2
0.9
0.9
0.7
9.00
0.4 0.3
0.5
0.8
0.5
20

---

Under review as a conference paper at ICLR 2021
(a) SRA results for DPCTGAN
(b) SRA results for QUAIL (MWEM)
bank car shopping mushroom adult
bank car shopping mushroom adult
epsilons
epsilons
0.01
0.5 0.1
0.8
0.9
0.0
0.01
0.6 0.7
1.0
1.0
0.6
0.10
0.3 0.1
0.6
0.9
0.2
0.10
0.8 0.5
1.0
0.4
0.4
0.50
0.9 0.2
0.3
0.50
0.2 0.6
0.9
0.4
0.2
1.00
0,4 0.2
0.5
0.9
0.0
1.00
0.5 0.5
0.6
0.5
0.6
3.00
0.1 0.1
0.8
3.00
0.5 0.5
0.3
0.4
0.6
6.00
0.1 0.5
0.1
0.8
0.8
6.00
0.7 0.5
0.8
0.3
0.7
9.00
0.0 0.5
0.2
1.0
0.7
9.00
0.7 0.4
0.2
0.4
0.4
(a) SRA results for QUAIL (PATEGAN)
(b) SRA results for QUAIL (DPGAN)
bank shopping mushroom adult
bank car shopping mushroom adult
epsilons
epsilons
0.01
0.6 0.3
0.7
0.3
0.8
0.01
0.5 0.7
0.9
1.0
0.2
0.10
0.4 0.5
0.6
0.10
0.6 0.6
0.5
0.9
0.6
0.50
0.2 0.5
0.7
0.3
0.6
0.50
0.2 0.5
0.5
0.5
0.3
1.00
0.7 0.5
0.8
0.3
0.2
1.00
0.5 0.6
0.9
0.3
0.6
3.00
0,4 0.4
0.2
0.3
0.5
3.00
0.6 0.5
0.2
0.5
0.5
6.00
0.2 0.5
0.3
0.4
0.0
6.00
0.6 0.5
0.3
0.5
0.8
9.00
0.6 0.5
0.6
0.4
0.4
9.00
0.6 0.5
0.0
0.5
0.2
log- fog.ffrquuecy=True disabled.dp=falbe target.delta=None sigma
max per sample grad norm=1.0, verbose=True,
loss = "croos binary=False.
batch 500,
teacher.iters = 5,
student_iters 5, delta = le-5
DPGAN
binary=False. latent_dim =64, batch size =64 epochs=1000, delta=le-5
(a) SRA results for QUAIL (PATECTGAN)
(b) SRA results for QUAIL (DPCTGAN)
bank car shopping mushroom adult
bank car shopping mushroom adult
epsilons
epsilons
0.01
0.9 0.3
0.6
0.3
0.5
0.01
0.8 0.2
0.9
0.5
0.2
0.10
0.4 0.6
0.9
0.3
0.9
0.10
0.6 0.5
0.8
0.3
0.3
0.50
0.7 0.5
0.5
0.3
0.6
0.50
0.1 0.4
0.7
0.3
0.4
1.00
0.0 0.5
0.9
0.3
0.9
1.00
0.7 0.5
0.5
0.3
0.4
3.00
0.6 0.4
0.1
0.3
0.7
3.00
0.1 0.4
0.8
0.4
0.5
6.00
0.7 0.4
0.8
0.4
0.9
6.00
0.0 0.4
0.7
0.3
0.1
9.00
0.7 0.4
0.9
0.3
0.8
9.00
0.3 0.4
0.1
0.5
0.1
21

---

Under review as a conference paper at ICLR 2021
PATEGAN
binary=False, latent dim 664 batch s6z teacher_iters=5,, student.iters=5, delta=le-5
22


Reviews:
[{"review_id": "umUTphXx83H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors proposed QUAIL, an algorithm that uses a supervised model and a synthetic data model to generate synthetic data that is good for downstream tasks. It also shows some empirical evaluations of the algorithm.\n\nThe technical part, especially the experiments, might need some improvement. The main issue is that we cannot draw a clear conclusion from the experimental results. I would suggest taking one or two epsilon values, and look at the results in more detail to see if we can find any trend. Also, generating synthetic data under differential privacy is not an easy task, so I think it's ok to skip the regime where epsilon < 1, or try even larger epsilon to get a reasonable utility first.\nHowever, I would like to say that I very much appreciate the authors' effort in conducting experiments on quite a few datasets, and their integrity in presenting all the results no matter positive or negative.\n\nThe paper can be better organized, for example,\n- The notations in the algorithm should be clearly explained/defined before the algorithm (for example, N and X), and some intuition can be added after the algorithm description. In the algorithm description itself, I think maybe it's clearer to defined the target dimension and the rest of the dimension separately, i.e. defining one sample as (feature, target) and later on we will have (synthetic feature, synthetic target). In the \"split\" part, I guess eps_C should be (1-p)*eps.\n- The part below Theorem 3.1 might better be put into the experiment section than the algorithm section.\n- In quite a few figures, we see interesting trends like some algorithm can have worse utility as epsilon grows. So it might be important to report the standard deviation of the algorithm for readers to better understand what was going on. Also, the texts in the figures can be made larger.\n- The paper called the algorithm \"ensemble method\". I feel like ensemble means something specific in ML, and simply using two different models together doesn't quite seem like ensemble. Maybe I'm understanding something here but it should be better explained.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "VyFJM9sTpk", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes QUAIL, an ensemble of a generative model and a classifier, where both are trained with differential privacy, in order to generate a differentially private dataset (from the generative model) and a label vector (from the classifier). The paper further compared QUAIL with \"other\" differentially private generative models based on conditional GAN.\n\nMy main concern with the paper is that there is no clear contribution. It is hard to judge whether the main claim is that the paper presents a survey of the current differentially private generative models, in which case, the survey part is very short and not in-depth. Or is that the the paper proposes QUAIL, which in many cases performs worse than other generative models. My some other concerns are detailed below:\n\n- There is no mention of \\delta used for (\\epsilon,\\delta) - differential privacy\n- Please use something else than \\delta for difference between performance measures as it can get confusing\n- As the version of GAN used in the paper is conditional, shouldn't the generator be differentially private as well? i.e. how are we protecting the privacy of the labels?\n- There is a mention of PATECTGAN performing better even compared to the non-noisy model trained on real data, how is this possible, please add some explanation.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "VJP8uDw3Ako", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The proposed method works as follows. Given samples are partitioned into two parts; one is for classifier training and the other is for data synthesizer training. Both are trained in a differentially private manner. After training, the DP synthesizer generates samples and the DP classifier labels them so that the resulting samples can be used as training samples. By the post-processing theorems, the resulting are differentially private, which are published as synthesized samples.\n\nThe idea is interesting, simple, and unique. Also, experimental results demonstrate that the  models trained with the proposed method give s better F1 score compared to the existing methods. One limitation of this manuscript is that the reason why the proposed scheme can give better classification accuracy is not discussed. Also, the reason why the RMSE of the regression model trained with this scheme is worse than other methods is not examined, either. One quick thought is that the proposed scheme preserves the cluster structure of the samples well and therefore the classification model trained with the resulting sample has good accuracy. In contrast, the metric structure behind the samples is not preserved well and therefore the regression model does not have good RMSE. I am not sure this is correct or not, but anyway, I think further consideration on these issues will be interesting and needed for this type of experimental study to find a clue to improve data synthesization with DP guarantee.\n  \nMinor:\nFIg 6 is in the Appendix, not in the main body. Also, many important claims (mainly in experimental results) are given with results in the Appendix. The main claim should be constructed with the contents in the main body. \n\n \n\n\n\n\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper surveys existing differentially private data synthesis
methods, and introduces an algorithm that learns both a generator and
a classifier in a differentially private mode.

The problem is highly timely and important. Results are promising.

Main remaining concerns after discussion between the reviewers and the
authors are:

- reason why the proposed scheme can give better classification
accuracy, should be clarified more

- unclarity on conclusions that can be drawn from the experiments. The
revised version has improved on this somewhat.

One explanation for the problems was suggested to be that the paper
tries, at the same time, to both present a new method and be a
survey. Is hard to do in a short paper, and as a result, the paper
lacks focus. At the very least, more work is needed.

The authors are encouraged to continue their work on this
important problem, and the review comments hopefully help in that.

Decision: Reject