Private Post-GAN Boosting
Authors: Marcel Neunhoeffer
Steven Wu
Cynthia Dwork
Venue: ICLR 2021 Poster (2021)

Abstract: Differentially private GANs have proven to be a promising approach for generating realistic synthetic data without compromising the privacy of individuals. Due to the privacy-protective noise introduced in the  training, the convergence of GANs becomes even more elusive, which often leads to poor utility in the output generator at the end of training. We propose Private post-GAN boosting (Private PGB), a differentially private method that combines samples produced by the sequence of generators obtained during GAN training to create a high-quality synthetic dataset. To that end, our method leverages the Private Multiplicative Weights method (Hardt and Rothblum, 2010) to reweight generated samples. We evaluate Private PGB on two dimensional toy data, MNIST images, US Census data and a standard machine learning prediction task. Our experiments show that Private PGB improves upon a standard private GAN approach across a collection of quality measures. We also provide a non-private variant of PGB that improves the data quality of standard GAN training.

Published as a conference paper at ICLR 2021
PRIVATE POST-GAN BOOSTING
Marcel Neunhoeffer
Zhiwei Steven Wu Carnegie Mellon University
University of Mannheim
meeunhoe@mail uni-mannheim.co de
zstevennu@cmu,
Cynthia Dwork
Harvard University
dworkêseas harvard.edu
ABSTRACT
Differentially private GANs have proven to be a promising approach for gener- ating realistic synthetic data without compromising the privacy of individuals. Due to the privacy-protectiv
noise introduced in the training, the convergence of GANs becomes even more elusive, which often leads to poor utility in the output generator at the end of training. We propose Private post-GAN boosting (Private PGB), differentially private method that combines samples produced by the sequence of generators obtained during GAN training to create high-quality synthetic dataset. To that end, our method leverages the Private Multiplicatiie Weights method (Hardt and Rothblum, 2010) to reweight generated samples. We dimensional toy data, MNIST images, US Census
evaluate Private PGB data and standard machine learning prediction task. Our experiments show that Private PGB improves upon standard private GAN approach across collection of quality measures. We also provide a non-private variant of PGB that improves the data quality of standard GAN training.
INTRODUCTION
The vast collection of detailed personal data, including everything from medical history to voting records, to GPS traces, to online behavior, promises to enable researchers from many disciplines to conduct insightful data analyses. However, many of these datasets contain sensitive personal information, and there is a growing tension between data analyses and data privacy. To protect the privacy of individual citizens, many organizations, including Google (Erlingsson et al., 2014),
Microsoft (Ding et al. 2017). Apple (Differential Privacy Team, Apple, 2017). and more recently the 2020 US Census (Abowd 2018), have adopted differential privacy (Dwork et al. (006) mathematically rigorous privacy measure. However, working with noisy statistics released under differential privacy requires training.
natural and promising approach to tackle this challenge to release differentially private synthetic data-a a privatized version of the dataset that consists of fake data records and that approximates the real dataset on important statistical properties of interest. Since they already satisfy differential privacy, synthetic data enable researchers interact with the data freely and to perform the same analyses even without expertise in differential privacy. A recent line of work (Beaulieu-Jones et al., 2019 Xie al. 2018 Yoon al.) 2019) studies how one can generate synthetic data by incorpo- rating differential privacy into generative adversarial nefworks (GANs) (Goodfellow et al. 2014). Although GANs provide powerful framework for synthetic data, they are also notoriously hard to train and privacy constraint imposes even more difficulty. Due to the added noise in the private gradient updates, it is often difficult to reach convergence with private training.
In this paper, we study how to improve the quality of the synthetic data produced by private GANs. Unlike much of the prior work that focuses on fine-tuning of network architectures and training techniques, propose Private GAst-GAN boosting (Private PGB) differentially private method that boosts the quality of the generated samples after the training of a GAN. Our method can be viewed as simple and practical amplification scheme that improves the distribution from any

---

Published as a conference paper at ICLR 2021
isting black-box GAN training method private not. We take inspiration from empirical observation in [Beaulieu-Jonee et al. (2019) that even though the generator distribution at the end of the private training may be a poor approximation to the data distribution (due e.g. mode collapse), there may exist a high-quality mixture distribution that is given by several generators over different training epochs. PGB is principled method for finding such mixture moderate privacy cost and without any modification of the GAN training procedure.
To derive PGB, we first formulate two-player zero-sum game, called post-GAN zero-sum game, between a synthetic data player, who chooses a distribution over generated samples over training epochs to emulate the real dataset, and a distinguishher player, who tries to distinguish generated samples from real samples with the set of discriminators over training epochs. We show that under a "support coverage" assumption the synthetic data player's mixed strategy (given by a distribution over the generated samples) at an equilibrium can successfully "fool" the distinguisher-thar that is, no mixture of discriminators can distinguish the real versus fake examples better than random guessing- While the strict assumption does not always hold in practice, we demonstrate empirically that the synthetic data player's equilibrium mixture consistently improves the GAN distribution.
The Private PGB method then privately computes an approximate equilibrium in the game. The algorithm can be viewed as a computationally efficient variant of MWEM (Hardt & Rothblum 2010 Hardt et al. 2012), which is inefficient query release algorithm with near-optimal sample complexity. Since MWEM maintains a distribution over exponentially many "experts" (the set of all possible records in the data domain), it runs in time exponential in the dimension of the data. In contrast, we rely on private GAN to reduce the support to only contain the set of privately generated samples, which makes PGB tractable even for high-dimensional data.
We also provide an extension of the PGB method by incorporating the technique of discriminator rejection sampling (Azadi et al. 2019; Turner al., 2019). We leverage the fact that the distin- guisher's 's equilibrium strategy, which is mixture of discriminators, can often accurately predict which samples are unlikely and thus can be used as a rejection sampler. This allows us further improve the PGB distribution with rejection sampling without any additional privacy cost since dif- ferential privacy is preserved under post-processing. Our Private PGB method also has a natural non-private variant, which we show improves the GAN training without privacy constraints.
We empirically evaluate both the Private and Non-Private PGB methods on several tasks. To vi- sualize the effects of our methods, we first evaluate our methods on two-dimensional toy dataset with samples drawn from a mixture of 25 Gaussian distributions. We define a relevant quality score function and show that the both Private and Non-Private PGB methods improve the score of the samples generated from GAN. We then show that the Non-Private PGB method can also be used to improve the quality of images generated by GANs using the MNIST dataset. Finally, focus on applications with high relevance for -roacc-protection. First we synthesize US Census datasets and demonstrate that the PGB method can improve the generator distribution on several statistical mea- sures, including 3-way marginal distributions and PMSE. Secondly, we evaluate the PGB methods on dataset with a natural classification task. We train predictive models on samples from Private PGB and samples from a private GAN (without PGB), and show that PGB consistently improves the model accuracy on real out-le-sample test data.
Related work. Our PGB method can be viewed as a modular boosting method that can improve on growing line of work on differentially private GANs (Beaulieu-Jones et al. 2019, Xie et al.] 2018 Frigerio et al. 2019 Torkzadehmmhani et al. 2020). To obtain formal privacy guarantees, these algorithms optimize the discriminators in GAN under differential privacy, by using private SGD, RMSprop, or Adam methods, and track the privacy cost using moments accounting Abadi jet al. (2016); Mironov (0177). Yoon et al. (2019) give private GAN training method by adapting ideas from the PATE framework (Papernot et al. 2018).
Our PGB method is inspired by the Private Multiplicative Weigths method (Hardt & Rothblum 2010) and its more practical variant MWEM (Hardt et al., 2012),, which answer large collection of statistical queries by releasing a synthetic dataset. Our work also draws upon two recent tech- niques (Turner et al. (2019) and Azadi et al. (2019)) that use the discriminator as a rejection sampler to improve the generator distribution. We apply their technique by using the mixture discriminator computed in PGB as the rejection sampler. There has also been work that applies the idea of boosting to (non-private) GANs. For example, Arora et al. (2017) and Hoang et al. (2018) propose methods
2

---

Published as a conference paper at ICLR 2021
that directly train mixture of generators and discriminators, and Tolstikhin al. (2017) proposes AdaGAN that reweighes the real examples during training similarly to what done in AdaBoost (Freund & Schapire, 1997). Both of these methods may be hard to make differentially private: they either require substantially more privacy budget to train a collection of discriminators or increase the weights on subset of examples, which requires more adding more noise when computing private gradients. In contrast, our PGB method boosts the generated samples post training and does not make modifications the GAN training procedure.
PRELIMINARIES
Let X' denote the data domain of all possible observations in given context. Let pa be distribution over X. We say that two datasets X, X'X' E X" are adjacent, denoted by X ~ X', if they differ by at most one observation. We will write px to denote the empirical distribution over X.
Definition 1 (Differential Privacy (DP) (Dwork et al. 22066), A randomized algorithm A x - R with output domain R (e.g. all generative models) (E. differrentill private (DP) if for all adjacent datasets X,X X' E X" and for all S S R. P(A(X) E 8) S P(A(X') E S) + 6.
very nice property of differential privacy is that it is preserved under post-processing.
Lemma fost-proccsssig). Let M be (eiff-riffrllttillll private algorithu with output range R and f R > R' be any mapping, the composition f M is (e, -)-differentially private.
As result, any subsequent analyses conducted on DP synthetic data also satisfy DP.
The exponential mechanism (McSherry & Talwar 2007 is a private mechanism for selecting among the best of a discrete of alternatives R. where "best" is defined by quality function q: X x R that measures the quality of the result for the dataset X. The sensitivity of the quality score is defined as ((q) max,ER maxx~x r)-((
r)]- Then given quality score q and privacy parameter E, the exponential mechanism MM q, e, X) simply samples random alternative from the range R such that the probability of selecting each r is proportional (x)(
2.1 DIFFERENTIALES PRIVATE GAN
The framework of generative adversarial networks (GANs) (Goodfellow al. 2014) consists of two types of neural networks: generators and discriminators. A generator G a function that maps random vectors 2 Z drawn from prior distribution p- sample G(2) E X. A discriminator D takes an observation x E X' as input and computes probability D(x) that the observation is real. Each observation is either drawn from the underlying distribution pa the induced distribution Pa from a generator. The training of GAN involves solving the following joint optimization over the discriminator and generator:
min max E Ex-px [f(((z)) + Ez [f(1 D(G(2))))
G
D
where f: [0,1]- and in Wasserstein GAN (Arjovsky et al., 2017), f(a) The standard (non-private) algorithm iterates between optimizing the parameters of the discriminator and the generator based on the loss functions:
+ IR is a monotone function. For example, in standard GAN, f(a) = log a,
Ln = -Bappx
[f(D(z))) -==-===)((((()))
Ez-p, [S(1 - D(G())))
Er-, D(G(:)))
The private algorithm for training GAN also performs the same alternating optimization, but optimizes the discriminator under differential privacy while keeping the generator optimization the same. In general, the training proceeds over epochs == 1, .,...,N, and at the end of each epoch the algorithm obtains discriminator D, and generator G, by optimizing the loss functions respectively. In [Beaulieu-Jones et al.] (2019); Xie et al. (2018). the private optimization on the discriminators is done by running the private SGD method Abadi et al. (2016) or its variants. Yoon et al. (2019) performs the private optimization by incorporating the PATE framework Papernot et al. (2018). For all of these private GAN methods, the entire sequence discriminators {Di...., Dx satisfies privacy, and thus the sequence of generators {G1..... GN } is also private since they can be viewed as post- procesrocessing of the discriminators. Our PGB method is agnostic to the exact private GAN training methods.

---

Published as a conference paper at ICLR 2021
3 PRIVATE POST-GAN BOOSTING
The noisy gradient updates impede convergence of the differentially private GAN training algo- rithm, and the generator obtained in the final epoch of the training procedure may not yield good approximation to the data distribution. Nonetheless, empirical evidence has shown that a mixture over the set of generators can be realistic distribution (Beaulieu-Jones et al., 2019). We now provide a principled and practical scheme for computing such mixture subject to a moderate pri- vacy budget. Recall that during private GAN training method produces sequence of generators G = [GI..... G and discriminators D = (DI..... D Our boosting method computes weighted mixture of the Gj and weighted mixture of the Dj 's that improve upon any individual generator and discriminator. We do that by computing an equilibrium of the following Post-GAN (training) zero-sum game.
3.1 POST-GAN ZERO-SUM GAME.
We will first draw r independent samples from each generator Gj. and let B be the collection of the rN examples drawn from the set of generators. Consider the following post-GAN GAN zero-sum game between a synthetic data player, who maintains distribution over the data in B to imitate the true data distribution px, and a distinguisher player, who uses a mixture of discriminators to tell the two distributions @ and pxx apart. This zero-sum game is aligned with the minimax game in the original GAN formulation, but much more tractable since each player has a finite set of strategies. To define the payoff in the game, we will adapt from the Wasserstein GAN objective since it is less sensitive than the standard GAN objective to the change of any single observation (changing any single real example changes the payoff by at most 1/ni). rendering it more compatible with privacy tools. Formally, for any E B and any discriminator Dj, define the payoff as
Ux, D2) = Ev'xxx [D) + (1 (z()))
For any distribution Φ over B. let U(o.)) = Exrol [1 }}. and similarly for any distribution vi over (Di..... DN J. we will write U..,)) (U D)J. Intuitively, the payoff function U measures the predictive accuracy of the distinguisher in classifying whether the examples are drawn from the synthetic data player's distribution é or the private dataset X. Thus, the synthetic data player aims to minimize U while the distinguisher player aims to maximize U.
Definition 2. The pair (D,ō) is an a-approximate equilibrium of the post-GAN game if
max Uό, Dj) S U( D) + a, and min U(ò, 2 U(Ø D) a (EA(B)
DjED
By von Neumann's minimax theorem, there exists value V - the game value such that
V min max (dd, Dÿ) max min Uzx, v)
(CA(B) JE[M
*EA(D) zEB
The game value corresponds to the payoff value at an exact equilibrium of the game (that is a = 0). When the set of discriminators cannot predict the real versus fake examples better than random guessing, the game value V = 1. We now show that under the assumption that the generated samples in B approximately cover the support of the dataset X, the distinguisher player cannot distinguish the real and fake distributions much better than by random guessing.
Theorem 1. Fix private dataset X E (IRd)" Suppose that for every E X, there exists Ia E B such that || zoll2 S 7. Suppose 'D includes discriminator network D1/2 that oulputs 1/2 for all inputs, and ussume that all networks in DD are L-Lipschitz. Then there exists a distribution & A(B) such that (122 is Lay-ppixximate equilibrium, and so 1 < V L
We defer the proof to the appendix. While the support coverage assumption strong, we show empirically the synthetic data player's mixture distribution in an approximate equilibrium improves on the distribution given by the last generator G even when the assumption does not hold. We now provide method for computing approximate equilibrium of the game.
3.2 BOOSTING VIA EQUILIBRIUM COMPUTATION.
Our post-GAN boosting (PGB) method computes an approximate equilibrium of the post-GAN zero-sum game by simulating the so-called no-regret dynamics. Over T rounds the synthetic data
4

---

Published as a conference paper at ICLR 2021
player maintains sequence of distributions ,',...,""' over the set B. and the distinguisher plays sequence of discriminators D'..... ,....,,". At each round t, the distinguisher first selects a discrimina- tor D using the exponential mechanism M with the payoff U -) the score function. This will find an accurate discriminator D' against the current synthetic distribution Φ', so that the synthetic data player improve the distribution. Then the synthetic data player updates its distribution of based on an online no-regret learning algorithm-the multiplicative weights (MW) method Kivinen Warmuth| (1997). We can view the set of generated examples in B as set of "experts", and the algorithm maintains a distribution over these experts and, over time, places more weight on the examples that can better "fool" the distinguisher player. To do so, MW updates the weight for each E B with
x (x) x Ø² exp (-nU (z, D*)) & exp (x))
where is the learning rate. At the end, the algorithm outputs the average plays (D, for both players. We will show these form an approximate equilibrium of the post-GAN zero-sum game (Freund & Schapire 1997).
Algorithm Differentially Private Post-GAN Boosting
Require:
private dataset X X", synthetic dataset B generated by the of generators G, collection discriminators {Di,..., Dx}, number of iterations T, per-round privacy budget co-
learning rate parameter 1/.
Initialize @² to be the uniform distribution over B for t ,,..., do
Distinguisher player: Run exponential mechanism ME to select a discriminator D using quality score qx,, D,) U Synthetic data player: Multiplicative weights update on the distribution over B: for each example E B:
((o",D) Dj) and privacy parameter Ep.
(b) d'(b) exp(n)D((i)
Let D be the discriminator defined by the uniform average over the (D.,... D and be the distribution defined by the average over the set {Ø .....o"}
Note that the synthetic data player's MW update rule does not involve the private dataset, and hence is just post-processing step of the selected discriminator D Thus, the privacy guarantee follows from applying the advacned composition of runs of the exponential mechanism |
Theorem (Privacy Guarantee). For any (0, 1), the privale MW poxt-amplification algorithm satisfies (c, 5-D with = (2 + Teo(exp(<o) - -1).
Note that if the private GAN training algorithm satisfies (c,, - and the Private PGB method satisfies (E2, DDP, then the entire procedure (Ei E2, ô1 62)-DP.
We now show that the pair of average plays form an approximate equilibrium of the game.
Theorem 3 (Approximate Equilibrium), With probability 8, the pair (D), Φ) an a-approximate
equilibrium of the post- Mast zero-sum game with a = 4n + TT"
log B 2log(N//3r
IfT 2 n² and
1 = (l))T then
Log(nN|Bl/8)
a=
TED
We provide proof sketch here and defer the full proof to the appendix. By the result of Fre- und & Schapire (1977). if the two players have low regret in the dynamics, then their average plays form an approximate equilibrium, where the regret of the two players is defined Rayn It U - ΣT= U(b, D') and Rais = maxp, ET, U(6', D2)- U( D'). Then the approximate equilibrium guarantee directly follows from bounding Raya with the regret bound of MW and Rais with the approximate optimality of the exponential mechanism.
Note that since the quality scores from the GAN Discriminators are assumed to he probabilities and the function takes average over probabilities (one for each private example), the sensitivity A(q) 1
5

---

Published as a conference paper at ICLR 2021
Non-Private PGB.
The Private PGB method has natural non-private variant: in each round, in- stead of drawing from the exponential mechanism, the distinguisher player will simply compute the exact best response: D' = arg maxD, U D2). Then if we set learning rate vj = Vloo( / and run for T = log log(IB))/cc) rounds, the pair (D, () returned is a-approximate equilibrium.
Extension with Discriminator Rejection Sampling. The mixture discriminator D the equi- librium provides an accurate predictor on which samples are unlikely. As a result, we can use D to further improve the data distribution o by the discriminator rejection sampling (DRS) tech- nique of Azadi al. (2019). The DRS scheme in our setting generates single example as fol- lows: first draw example from Φ (the proposal distribution), and then accept z with probabil- ity proportional to (x2) (1 D(x)). Note that the optimal discriminator D that distinguishes the distribution σ from true data distribution Pa will accept I with probability proportional to pa(x)/pp(z)) (1==)/(1-1)) D= Our scheme aims approximate this ideal rejection sampling by approxinating D with the equilibrium strategy D, whereas prior work uses the last discriminator Dy an approximation.
4 EMPIRICAL EVALUATION
We empirically evaluate how both the Private and Non-Private PGB methods affect the utility of the generated synthetic data from GANs. We show two appealing advantages of our approach: 1) non-private PGB outperforms the last Generator of GANs, and 2) our approach can significantly improve the synthetic examples generated by a GAN under differential privacy.
Datasets. We assess our method with toy dataset drawn from a mixture of 25 Gaussians, which is commonly used to evaluate the quality of GAN (Srivastava et al. 2017 Azadi et al. 2019: Turner al. 2019) and synthesize MNIST images. We then turn to real datasets from the American Census, and standard machine learning dataset (Titanic).
Privacy budget. For the tasks with privacy, we set the privacy budget be the same across all algorithms. Since Private PGB requires additional privacy budget this means that the differentially private GAN training has be stopped earlier as compared to running only a GAN achieve the same privacy guarantee. Our principle is to allocate the majority of the privacy budget to the GAN training, and a much smaller budget for our Private PGB method. Throughout we used 80% to 90% of the final privacy budget on DP GAN training ?
Utility measures. Utility of synthetic data can be assessed along two dimensions; general utility and specific utility (Snoke et al. 2018 Arnold & Neunhoeffer 2020). General utility describes the overall distributional similarity between the real data and synthetic datasets, but does not capture specific cases of synthetic data. To assess general utility,
the propensity score mean squared error (pMSE) measure (Snoke et al.] 2018) (detailed in the Appendix). Specific utility of a synthetic dataset depends on the specific use an analyst has in mind. In general, specific utility can be defined as the similarity of results for analyses using synthetic data instead of real data. For each of the experiments we define specific utility measures that are sensible for the respective example. For the toy dataset of 25 gaussians we look at the number of high quality samples. For the American Census data we compare marginal distributions the synthetic data to marginal distributions of the true data and look at the similarity of regression results.
4.1 EVALUATION OF
PGB
Mixture of 25 Gaussians. We first examine the performance of our approach on a two dimensional dataset with a mixture of 25 multivariate Gaussian distributions, each with a covariance matrix of 0.00251. The left column in Figure| displays the training data. Each of the 25 clusters consists
"Our observation is that the DP GAN training is doing the "heavy lifting". Providing good "basis" for PGB requires a substantial privacy expenditure in training DP GAN. The privacy budget allocation is a hy- perparameter for PGB that could be tuned. In general, the problem of differentially private hyperparameter selection is extremely important and the literature is thin (Liu & Talwar 2019 Chaudhuri & Vinterbo 2013).

---

Published as a conference paper at ICLR 2021
of 1, 100 observations. The architecture of the GAN is the same across all results To compare the utility of the synthetic datasets with the real data, we inspect the visual quality of the resultsand calculate the proportion of high quality synthetic examples similar to Azadi et al. 2019 Turerr et al. (2019) and Srivastava et al. [
Visual inspection of the results without privacy (in the top row of Figure T shows that our proposed method outperforms the synthetic examples generated by the last Generator of the GAN, as well as the last Generator enhanced with DRS. PGB over the last 100 stored Generators and Discriminators trained for T 1, 000 update steps, and the combination of PGB and DRS, visibly improves the results. The visual impression is confirmed by the proportion of high quality samples. The data from the last GAN generator have a proportion of 0.904 high quality samples. The synthetic data after PGB achieves a higher score of 0.918. The DRS samples have proportion of 0.826 high quality samples, and the combination of PGB and DRS a higher proportion of 0.874 high quality samples
MNIST Data. We further evaluate the performance of our method on an image generation task with the MNIST dataset. Our results are based the DCGAN GAN architecture (Radford et al. 2013) with the KL-WGAN loss (Song & Ermon 2020). To evaluate the quality of the generated images we use a metric that is based instead of the Inception Net we use a MNIST Classifier that achieves 99.65% test accuracy. The theoretical best score of the MNIST IS is 10, and the real test images achieve a score of 9.93. Without privacy the last GAN Generator achieves a score of 8.41, using DRS on the last Generator slightly decreases the score 8.21, samples with PGB achieve score of 8.76, samples with the combination of PGB and DRS achieve similar score of 8.77 (all inception scores are calculated on 5,000 samples). Uncurated samples for all methods are included in the Appendix.
the Inception score (IS) (Salimans al.] 2016), where
4.2 EVALUATION OF PRIVATE PGB
Mixture of 25 Gaussians. To show how the differentially private version of PGB improves the samples generated from GANs that were trained under differential privacy, we first re-run the ex- periment with the two-dimensional toy data O Our final value of is and 8 is 1. For the results with PGB, the GAN training contributes é 0.9 to the overall e and the Private PGB algorithm 62 0.1. Again first visual inspection of the results in Figure [ (in the bottom row) shows that post-processing the results of the last GAN Generator with Private PGB is worthwhile. Private PGB over the last 100 stored Generators and Discriminators trained for T 1, 000 update steps, again, visibly improves the results. Again, our visual impression is confirmed by the proportion of high quality samples. The last Generator of the differentially private GAN achieves a proportion of 0.031 high quality samples. With DRS on top of the last Generator, the samples achieve a quality score of 0.035. The GAN enhanced with Private PGB achieves a proportion of 0.044 high quality samples, the combination of Private PGB and DRS achieves quality score of 0.053.
MNIST Data. On the MNIST data, with differential privacy (e = 10, 8 2N the last DP GAN Generator achieves inception score of 8.07, using DRS on the last Generator the IS improves to 8.18. With Private PGB the samples achieve an IS of 8.58, samples with the combination of Private PGB and DRS achieve the highest IS of 8.66 Uncurated samples for all methods are included in the Appendix.
Private Synthetic 1940 American Census Samples. While the results on the toy dataset are en- couraging, the ultimate goal of private synthetic data is to protect the privacy of actual persons in
"A description of the architecture is in the Appendix. The code for the GANs and the PGB algorithm will be made available GitHub.
'Note that the scores in Azadi et al. (201)) and Turner et al. (201)) do not account for the synthetic data distribution across the 25 modes. We detail our evaluation of high quality examples in the Appendix. quality metric. Without the capping penalty the scores are 0.906 for the last Generator, 0.951 for PGB 0.946 for DRS and 0.972 for the combination of PGB and DRS.
'The lower scores for the DRS samples are due to capping penalty
'To achieve DP. we trained the Discriminator with a DP optimizer as implemented in tensor 11 ow_pri vacy or the opacus library. We keep track of the values of and 8 by using the moments accountant (Abadi et al. 2016 MMronovy (017))
All inception scores are calculated on 5, (100 samples.

---

Published as a conference paper at ICLR 2021
Redl Doa
Figure 1: Real samples from multivariate normal distributions, synthetic examples without pri- vacy from GAN, DRS, Non-Private PGB and the combination of PGB and DRS (top row). Syn- thetic examples from GAN with differential privacy, DP DRS, Private PGB and the combination of Private PGB and DRS (bottom row).
data collections. and provide useful data interested analysts. In this section report the results of synthesizing data from the 1940 American Census. We rely on the public use micro data samples (PUMS) as provided in Ruggles al. (2019) For 1940 we synthesize an excerpt of the 1 1% sample of all Californians that were at least 18 years old 9 Our training sample consists of 39,660 observa- tions and attributes (sex, age, educational attainment, income, race, Hispanic origin, marital status and county). The test set contains another 9,915 observations. Our final value of is 1 and is 2N As 6.3 x 10-6 (after DP GAN training with é = 0.8 and PGB with e = 0.2, d1 = 2N 62 0). The general utility scores measured by the pMSE ratio score 2.357 (DP GAN), 2.313 (DP DRS), 2.253 (DP PGB). and 2.445 (DP PGB+DRS). This indicates that PGB achieves the best general utility. To assess the specific utility of our synthetic census samples compare one-way marginal distributions to the same marginal distributions in the original data. In panel (A) of Figure 2 we show the distribution of race membership. Comparing the synthetic data distributions the true distribution (in gray), we conclude that PGB, improves upon the last Generator. To underpin the visual impression we calculate the total variation distance between each of the synthetic distri- butions and the real distribution, the data from the last GAN Generator has total variation distance of 0.58, DP DRS of 0.44, DP PGB of 0.22 and DP PGB+DRS of 0.13. Furthermore, we evaluate whether more complex analysis models, such as regression models, trained synthetic samples could be used to make sensible out-of-sample predictions. Panel (B) of Figure shows a parallel coordinate plot to compare the out-of- sample root mean squared error of regression models trained on real data and trained on synthetic data. The lines show the RMSE for predicted income for all linear regression models trained with three independent variables from the set of on the synthetic data generated with Private PGB as compared to the last GAN generator and other post processing methods like DRS.
Further experiments using data from the 2010 American Census can be found the appendix. A 1% sample means that the micro data contains 1% of the total American (here Californian) population.
8

---

Published as a conference paper at ICLR 2021
(A)
(B)
1.0
Real
1200
Proporton In Sample
GAN
DRS
DRS
PGB
PGB
1100
PGB-DRS
DP PGB-DRS
0.4
1000
0.2
RMSE
0.0
BlackAFican American
Amar Idiaa of Alaska Natire
While
Chinase
Other Asian Pacifcc islander
Japaness
800
Trained on real data
Trained synthetic data
Figure 2: Specific Utility of Synthetic 1940 American Census Data. Panel (A): Distribution of Race Membership in Synthetic Samples. Panel (B): Regression RMSE with Synthetic Samples.
Machine Learning Prediction with Synthetic Data. In final set of experiments evaluate the performance of machine learning models trained on synthetic data (with and without privacy) and tested real out-of-saan samsee data. We synthesize the Kaggle Titanic 10 training set (891 observations of Titanic passengers on 8 attributes) and train three machine learning models (Logistic Regression, Random Forests (RF) (Breiman 200T) and XGBoost (Chen & Guestrin 2016)) on the synthetic datasets to predict whether someone survived the Titanic catastrophe. We then evaluate the perfor- mance the test set with 418 observations. To address missing values in both the training set and the test set we independently impute values using the MissForest (Stekhoven & Bühlmann, (0012) algorithm. For the private synthetic data our final value of is and is 2N (for PGB this implies DP GAN training with = 1.6 and PGB ated with our approaches (PGB and PGB+DRS) consistently perform better than models trained on synthetic data from the last generator DRS with or without privacy I
0.4). The models trained on synthetic data gener-
ACKNOWLEDGMENTS
This work began when the authors were at the Simons Institute participating in the "Data Privacy: Foundations and Applications" program. We thank Thomas Steinke, Adam Smith, Salil Vadhan, and the participants of the DP Tools meeting at Harvard for helpful comments. Marcel Neunhoeffer supported by the University of Mannheim's 's Graduate School of Economic and Social Sciences funded by the German Research Foundation. Zhiwei Steven Wu is supported in part by an NSF S&CC grant 1952085, a Google Faculty Research Award, and a Mozilla research grant. Cynthia Dwork is supported by the Alfred P. Sloan Foundation, "Towards Practicing Privacy" and NSF CCF-1763665.
Whttps: :/wp::///wwww... http://wwwwwwwl....///// wwt.:ooo//////// c/t t Table in the appendix summarizes the results in more detail. We present the accuracy, ROC AUC and PR AUC evaluate the performance.

---

Published as a conference paper at ICLR 2021
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '1, pp. 308-318, New York, NY, USA, 2016. ACM. ISBN 978-1-4503-4139-4,
doi: 10.1145/2976744.297888 7/doi. acm. /tgg/100000 145/ 1ttp//0..1115/27777...18 2977777
URL http:
John M. Abowd. The U.S. census bureau adopts differential privacy, In Proceedings of the ACM
SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2018, London, UK, August 19-23, 20/8, pp. 2867, 2018. 3226070
doi: 10. 10.1145/3219819932267777 URL https://
doi. org 10. 1
Martín Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein GAN. CoRR, abs/1701.07875, 2017.
http:///awwi...orra////////// 07875
Christian Arnold and Marcel Neunhoeffer. Really useful synthetic data-a framework to evaluate the quality of differentially private synthetic data. arXiv preprint 2tt::200000074400 2020.
Sanjeev Arora, Elad Hazan, and Satyen Kale. The multiplicative weights update method: meta-
algorithm and applications. Theory of Computing, 8(6):111-144 2012. doi: 2012
v008a006. httphtt://wwe
www.. wttp::///o....ppooooooooo//////e
Sanjeev Arora, Rong Ge, Yingyu Liang. Tengyu Ma, and Yi Zhang. Generalization and equilibrium in generative adversarial nets (GANs). In Doina Precup and Yee Whye Teh (eds.), Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pp. 224-232, International Convention Centre, Sydney, Australia, 06-11 Aug 2017. PMLR. htth: htLLhttpp/ppeee /ttp:::///cocedingg mir...r....... htt.e//dwwwn.......eeeeeeo///o//
Samanch Azadi, Catherine Olsson, Trevor Darrell, Ian J. Goodfellow, and Augustus Odena. Dis- criminator rejection sampling. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019, 2019. URL /tttps://openrevee/
net
Brett K. Beaulieu-Jones, Zhiwei Steven Wu, Chris Williams, Ran Lee, Sanjeev P. Bhavnani, James Brian Byrd, and Casey S. Greene. port clinical data sharing. Circulation: Cardiovascular Quality and Outcomes, 12(7))e00512) 2019. doi: 10. CTL.://CCICOUTCOMES.......
generative deep neural networks sup-
Lco Breiman. Random forests. Machine learning, 45(1):5-32, 2001.
Kamalika Chaudhuri and Staal A Vinterbo. A stability- based validation procedure for differentially private machine learning. In Advances in Neural Information Processing Systems, pp. 2652-2666 2013.
Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference knowledge discovery and data mining, pp. 785-794, 2016.
Differential Privacy Team, Apple. Learning with privacy at scale. https://
machinelearning.ee wtt.c/ooooooooo hhtp//ocs////// http///eearnnnggieee www.wwhh-a-aaaaaasssae... December 2017.
Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In Advances in Neural Information Processing Systems 30, NIPS '17, pp. 3571-3580. Curran Asso- ciates, Inc., 2017.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Proceedings of the 3rd Theory of Cryptography Conference, volume 3876, pp. 265-284, 2006.
Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. RAPPOR: Randomized aggregatable ordinal response. In Proceedings of the 2014 ACM Conference on Computer and Communications Security, CCS '14 pp. 1054-1067, New York, NY, USA, 2014. ACM.
10

---

Published as a conference paper at ICLR 2021
Yoav Freund and Robert E Schapire. A decision-theorete generalization of on-line learning and an application to boosting. Journal of Computer and System Sciences, 55(1):119 139, 1997. ISSN 0022-0000. doi: https://bb.orr///.000///ssss.ss
199. URL http::/ http://www
sci sciencedi1n rect www.scs....oooo cttmm///eeaeeeeaaaraa.a////////0
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differen- tially private generative adversarial networks for time series, continuous, and discrete open data. In ICT Systems Security and Privacy Protection 34th IFIP TC 11 International Conference, SEC 2019, Lishon, Portugal, June 25-27, 2019, Proceedings, pp. 151 151-164, 2019. doi: 10. 1007/ 30--000-2211-00.111 URL https: www.i.oogg/.... 0. 1007 97 3-00888--00-22233
11
Ian J. Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Proceedings of the 27th International Conference Neural Information Processing Systems- Volume 2, NIPS' 14, http://ddl.ace
pp. 2672 2680, Cambridge, MA, USA, 2014. MIT Press. URL http:/ /ll. acm.am.cc...c.mmmmmmmmmmm.mm.... alm.g.orrg/
Citat on wtw.cccmmmm.mcmmmooo.o 2969125
Moritz Hardt and Guy N. Rothblum. A multiplicative weights mechanism for privacy-preserving data analysis. In 51th Armual IEEE Symposium Foundations of Computer Science, FOCS 2010, October 23-26, 2010, Las Vegas. Nevada, USA, pp. 61-70, 2010. doi: S009//OCS.2000.30
URL Pattps://det http:::/doooooooo... org 10. 1109/F0CS. 01000510.5
Moritz Hardt, Katrina Ligett, and Frank McSherry. A simple and practical algorithm for differ- entially private data release. In Advances in Neural Information Processing Systems 25: 26th Anmual Conference on Neural Information Processing Systems 2012. Proceedings of a meeting held December 3-6, 2012, Lake Tahoe, Nevada, United States., pp. 2348-24482000 22456, 2012.
Quan Hoang, Tu Dinh Nguyen, Trung Le, and Dinh Phung. MGAN: Training generative adversarial nets with multiple generators. In International Conference on Learning Representations, 2018. URL htttps:
fant/foormn ? 1d=rkuu5b0a
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterizzatio with gumbel-softmax. arXiv preprint 1rXiv:161..0144 01440,11111111 2016.
Jyrki Kivinen and Manfred K. Warmuth. Exponentiated gradient versus gradient descent for linear predictors. Information and Computation, 132(1):1 63, 1997. ISSN 0890-5401. doi: https:
//doi.org/10, 1ttp:///...00///oooo.oooo 1996. 2612. URL holthtt::/// htttp://www. sci www.::www.w..................... encedirrcttt
axticle/pii//stt
axticle/ppi/$0890555 02944449999922222
Jingcheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 5 Annual ACM SIGACT Symposium on Theory of Computing, pp. 298-309, 2019.
Chris Maddison, Andriy Mnih, and Yee Whye Teh. The concrete distribution: A continuous 1.001100,21.1 2016.
relaxation of discrete random variables. arXiv preprint
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In Proceedings of the 48th Anmual IEEE Symposium on Foundations of Computer Science, FOCS '07, pp. 94-103, Washington, DC, USA, 2007. IEEE Computer Society. ISBN 0-7695-3010-9. doi: 10.1109/ 41. URL. http::tt///..
doi woog/10..0. 1109/FoCs. 2007.41
Ilya Mironov. Rényi differential privacy. In 30th IEEE Computer Security Foundations Symposium, CSF 2017, Santa Barbara, CA, USA, August 21-25, 2017, pp. 263 663-275, 2017. doi: 10. 109/CSF.
2017.11. URLpttps: p org 1100/ CSE .0017.11
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Er- lingsson. Scalable private learning with PATE. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver. BC, Canada, April 30 May 3, 2018, Conference Track Proceedings, 2018 URL
net forrmm http://eeee/tetteeeeeeeee do..aammma.... rk2B1XbRZ
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv: /5/ 1aee::/111..3330 2015.
11

---

Published as a conference paper at ICLR 2021
Steven Ruggles, Sarah Flood, Ronald Goeken, Josiah Grover, Erin Meyer, Jose Pacas, and Matthew Sobek. lpums usa: Version 9.0 [dataset]. Minneapolis, MN: IPUMS, 10:D010, 2019. doi: 10.18128/D010.VV V9.0.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Advances in neural information processing systems, pp.
2016.
Joshua Snoke, Gillian M. Raab, Beata Nowok, Chris Dibben, and Aleksandra Slavkovie. General and specific utility measures for synthetic data. Journal of the Royal Statistical Society: Series A (Statistics Society), 181())663-688, 2018. doi: 10.111 12358. URL https://rss.
Colinelibrary wiley. com/bol abs
rssa. 12358
Jiaming Song and Stefano Ermon. Bridging the gap between f-gans and wasserstein gans, 2020.
Akash Srivastava, Lazar Valkov, Chris Russell, Michael U Gutmann, and Charles Sutton. Veegan: Reducing mode collapse in gans using implicit variational learning. In Advances in Neural Infor- mation Processing Systems, pp. 3308-3318. 2017.
Daniel Stekhoven and Peter Bühlmann. Missforest M non-parameerii missing value imputation for mixed-type data. Bioinformatics, 28(1): 2012.
Ilya Tolstikhin, Sylvain Gelly, Olivier Bousquet, Carl-Johann
and Bernhard Schölkopf. Adagan: Boosting generative models. In Proceedings of the 31 International Con- ference Neural Information Processing Systems, NIPS' 17, pp. 5430-5439, USA, 2017. Curran Associates Inc. ISBN 978-1-5108-6096--1
acw. http:://a....ccoooooootttaaaaaaa
cfm?
id 32952222 32952994
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. DP-CGAN: differentially private synthetic data and label generation. CoRR, abs/2001.09700 2020. URL https://arxiv.
hkg/abs/2000 09700
Ryan Turner, Jane Hung, Eric Frank, Yunus Saatchi, and Jason Yosinski. Metropolis-Hastinn gener- ative adversarial networks. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 6345 0345-6353, Long Beach, California, USA, 09-15 Jun 2019. PMLR. URL http:: http://proceedings mir wttppp//e///tteeeee111 httmmmm1m...mmll1
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. CoRR, abs/1 802.66739, 2018.
06739
Jinsung Yoon, James Jordon, and Mihaela der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2019.
net. www.:mrrrmmmiieee (-
12

---

Published as a conference paper at ICLR 2021
A PROOFS
A.1 PROOF OF THEOREM 1I
Proof of Theorem 7 Note that if the synthetic data player plays the distribution over X, then Upx, D) Exxx [D(x') + Egso _1 D(x)] for any discriminator D E D. Now let B and obtain a new dataset XB. and let pxn denote the empirical distribution over Xg. By the Lipschitz conditions,
us replace each element
with its aaaproxximation
then have UU(xx D) (pxe. D)I I Ly. This means Upxxg D) E -1- Ly, + L^] for all D. Also, for all Φ E (B), we have (Ø, D1/2) = Thus, (Px,, D1/2) satisfies equation] with a = Lry L
A.2 PROOF OF THE APPROXIMATE EQUILIBRIUM
Proof. We will use the seminal result Freund & Schapire (1997). which shows that the two players have low regret in the dynamics, then their average plays form approximate equilibrium. First, we will bound the regret from the data player. The regret guarantee of the multiplicative weights algorithm (see e.g. Theorem 2.3 of Arora al. (2012) gives
T Σ
(b) < 4nT log [B]
Σ U D³)
-min BEB
(3)
Next, we bound the regret the distinguisher using the accuracy guarantee of the exponential mechanism (McSherry & Talwar 2007p. For each we know with probability (1 - B/T),
max U( D,,,D,))> UΦ D') 2log(NT/B) Dj
n60
Taking union bound, we have this accuracy guarantee holds for all and
T Σ
T
2T (NTT33NT33
max D2
Σ
(4)
nED
t=1
Then following the result of Freund & Schapire 1997). their average plays (D, is approximate equilibrium with
log [
2 llgg(N//3)
== 4n +
T/
760
Plugging in the choices of T and v gives the stated bound.
B ADDITIONAL DETAILS ON THE QUALITY EVALUATION
B. ON THE CALCULATION OF THE PMSE.
To calculate the pMSE one trains discriminator to distinguish between real and synthetic examples. The predicted probability of being classified real synthetic is the propensity score. Taking all propensity scores into account the mean squared error between the propensity scores and the proportion of real data examples is calculated. A synthetic dataset has high general utility, if the model can at best predict probabilities 0.5 for both real and synthetic examples, then the pMSE would be 0.
B.2 SPECIFIC UTILITY MEASURE FOR THE 25 GAUSSIANS.
In the real data, given the data generating process outlined in section 4.1, each of the 25 modes 99% of the observations lie within circle with radius v0.0025 9.21034 around the mode centroids, where 9.21034 is the critical value at = 0.99 of a x² distribution with 2 degrees of freedom, and 0.0025 is the variance of the spherical gaussian.
13

---

Published as a conference paper at ICLR 2021
To calculate the quality score count the number of observations within each of these 25 circles. If one of the modes contains more points than we would expect given the true distribution the count is capped accordingly. Our quality score for the toy dataset of 25 gaussians
be expressed as Q = 25 (min(preal' Neyns //V Vyyn) where indexes the clusters, Preat the true distribution of points per cluster, Nayn the number of observations at a cluster within radius r, and N Nyn the total number of synthetic examples.
C GAN ARCHITECTURES
C.I DETAILS ON THE EXPERIMENTS WITH THE 25 GAUSSIANS.
The generator and discriminator are neural nets with two fully connected hidden layers (Discrimi- nator: 128, 256: Generator: 512, 256) with Leaky ReLu activations. The latent noise vector Z is of dimension 2 and independently sampled from a gaussian distribution with mean 0 and standard de- viation of 1. For GAN training we use the KL-WWGAN loss (Song & Ermon] 2020). Before passing the Discriminator scores to PGB we transform them probabilities using sigmoid activation.
C.2 GAN ARCHITECTURE FOR THE 1940 AMERICAN CENSUS DATA.
The GAN networks consist of two fully connected hidden layers (256, 128) with Leaky ReLu activa- tion functions. To sample from categorical attributes we apply the Gumbel-Sofftan trick (Maddison jet al.) 2016 Dang et al. 2016) to the output layer of the Generator. We run our PGB algorithm over the last 150 stored Generators and Discriminators and train it for T = 400 update steps.
D PRIVATE SYNTHETIC 2010 AMERICAN DECENNIAL CENSUS SAMPLES.
We conducted further experiments more recent Census files. The 2010 data is similar to the data that the American Census is collecting for the 2020 decennial Census. For this experiment, synthesize 10% sample for California with 3,723,669 observations of 5 attributes (gender, age, Hispanic origin, race and puma district membership). Our final value of e is 0.795 and 2N 1.34 X 10-7 (for PGB the GAN training contributes e 0.786 and PGB = 0.09). The pMSE ratio scores are 1.934 (DP GAN), 1.889 (DP DRS), 1.609 (DP PGB) and 1.485 (DP PGB+DRS), here PGB achieves the best general utility. For specific utility, we compare the accuracy of three-way way marginals on the synthetic data to the proportions in the true data 2 We tabulate race (11 answer categories
the 2010 Census) by Hispanic origin (25 answer categories the 2010 Census) by gender (2 answer categories in the 2010 Census) giving us a total of 550 cells. To assess the specific utility for these three-way marginals we calculate the average accuracy across all 550 cells. Compared to the true data DP GAN achieves 99.82%, DP DRS 99.89%. DP PGB 99.89%
and the combination of DP PGB and DRS 99.93%. Besides the average accuracy across all 550 cells another interesting metric of specific utility is the number of cells in which each synthesizer achieves the highest accuracy compared to the other methods, this is the case 43 times for DP GAN, 30 times for DP DRS, 90 times for DP PGB and 387 times for DP PGB+DRS. Again, this shows that our proposed approach can improve the utility of private synthetic data.
E DETAILED RESULTS OF MACHINE LEARNING PREDICTION WITH SYNTHETIC DATA
Table I summarizes the results for the machine learning prediction experiment with the Titanic data. We present the accuracy, ROC AUC and PR AUC to evaluate the performance. It can be seen that the models trained on synthetic data generated with our approach consistently perform better than models trained on synthetic data from the last generator or DRS with or without privacy. To put these values into perspective, the models trained on the real training data and tested on the same out-of-sample data achieve the scores in table
A task that is similar the tables relcased by the Census.
14

---

Published as a conference paper at ICLR 2021
Table 1: Predicting Titanic Survivors with Machine Learning Models trained synthetic data and tested on real out-of-sample data. Median scores of 20 repetitions with independently generated
synthetic data. With differential privacy c and 8 is 2N R 5.6 10-4
GAN
DRS
PGB
PGB
DRS
Logit Accuracy
0.626
0.746
0.701
0.765
Logit ROC AUC
0.591
0.760
0.726
0.792
Logit PR AUC
0.483
0.686
0.655
0.748
RF Accuracy
0.594
0.724
0.719
0.742
RF ROC AUC
0.531
0.744
0.741
0.771
RF PR AUC
0.425
0.701
0.706
0.743
XGBoost Accuracy
0,547
0.724
0.683
0.740
XGBoost ROC AUC
0.503
0.732
0.681
0.772
XGBoost PR AUC
0.400
0.689
0.611
0.732
DP
DP DRS
DP PGB
DP PGB
GAN
+DRS
Logit Accuracy
0,566
0.577
0.640
0.649
Logit ROC AUC
0.477
0.568
0.621
0.624
Logit PR AUC
0.407
0.482
0.532
0,547
RF Accuracy
0.487
0.459
0.481
0.628
RF ROC AUC ROC AUC
0.512
0.553
0.558
0.652
RF PR AUC PR AUC
0.407
0.442
0.425
0.535
XGBoost Accuracy
0.577
0.589
0.609
0.641
XGBoost ROC AUC
0,530
0.586
0.619
0.596
XGBoost PR AUC
0.398
0.479
0.488
0.526
Table Predicting Titanic Survivors with Machine Learning Models trained on real data and tested on real out-of-sampp data.
Model
Score
Logit Accuracy
0.764
Logit ROC AUC
0.813
Logit PR AUC
0.785
RF Accuracy
0.768
RF ROC AUC
0,809
RF PR AUC
0.767
XGBoost Accuracy
0.768
XGBoost ROC AUC
0.773
XGBoost PR AUC
0.718
F SYNTHETIC MNIST SAMPLES
Figure shows uncurated samples from the last Generator after 30 epochs of training without dif- ferential privacy in Panel 3al and with differential privacy (c 5 =) in Panel 3b Figure shows uncurated samples with DRS on the last Generator. Figure 5 shows uncurated samples after PGB and Figure shows uncurated samples after the combination of PGB and DRS, In Figure we show the 100 samples with the highest PGB probabilities.
15

---

Published as a conference paper at ICLR 2021
4
5
5
9
7
7
g
4
8
8
6
9
7
4
0
6
6
7
0
9
6
4
7
O 7
7
8
6
4
7
4
O
8
E 4 6 3
7 2
Q
1004
2
6
2
4
7 5 O 4
007
3
6
O
0
7
3
7
0
7
/
1 7 8
O
77
7
/
7
6
5
7
0 8
7
6
3
/
2
8
7
6
3
8
3
5
8
7
3
3
6
7
1
7
6
3
7
O
8
9
5
7
A
7
4
3
5
-
8
6
8
9
7 5 O
8 4 7 1
3 9
7
7
6
8
6
4
6 8
O
4
9
9
4
3
9
1
9
8
/
4
5
8 8
9
7
5
3
4 6
5
7
3
7
8
S
6
7
6
2
7
(a) Without Differential Privacy.
(b) With Differential Privacy (c
10, 8
2N
Figure 3: Uncurated MNIST samples from last GAN Generator after 30 epochs.
/
2
9
O
4
4
3
7
2
9
7
7
7
8
8
3 6
2
3
5
0
7
/
3
5
5
/
5
9
9
7
9
8
5
8 3
O
8
1 6 5 7
7
7
3
6
8
6
2
O
2
4
9
0
9
/
O
2 6 0 0
0
8
5
5
3
4
4
3
8
0
3
3
4-
7 3
3
4
7
5
8
7
0
6
Q
O
3
6
O
8
6
2
8
4
~
O
4
5
0
8
3
5
7
3 S
7
O
G
7
8
2
8
S
7
6
8
7
7
/
1 6
à
4
3
S
6 9
3
0
5
9
O
7
8
4
r
&
6
8
6
4
8
3
3
3
1
7
6
6
2
3
2
G
0
7
8
6
3
/
6
(a) Without Differential Privacy.
(b) With Differential Privacy (c
10,
2N
Figure 4: Uncurated MNIST samples with DRS last Generator after 30 epochs.
3
4
9
2
8
9
6
9
/
2
4
9
9
8
4
R
8
9
8
6
3
7
3
7 7 4
O
9
8
4
6
9
9
7
/
6
8 6 8 9
0
4
8
0
6
7
4
7 0 2 1 /
9
1_2
3
of
3
9
3
4
3
177
7
0
9
/
3
$200
6
6
/
7
8
7 7
337
5
/
7
9
7
5 7 8 A 2 7
5
8
5
9
5
6
4
5
1
4
/
3
6
6
1
7
2
8
9
8
3
7
S
/
6
3
0
2.
9
2
1
4
7
3 8 K
8
3
4
/
K
7
L
8.
3
3
1
7
<
7
9
X
&
0
>
8
T
5
3
5
8
3
9
O
8
3
6
6 L
0
9
5
2
8
6
3
7
/
6
2
6
8
9
(a) Without Differential Privacy.
(b) With Differential Privacy (e
10, 8
2N
Figure 5: Uncurated MNIST samples with PGB after 30 epochs (without DP) and 25 epochs (with
DP).
16

---

Published as a conference paper at ICLR 2021
0
/
7
7
7
3
7
3
0
7
6
7
5
7
6
7
7
6
3
3
0
3
7
4
4
0
0
7
8
5
7
9
8
6
7
4
/
6
5
3
5
8
3
8 O 4
8
2
7
7
8
6
5
/
7 9 0
2
9
5
6
6
/
7
0 1 6
7
7
0
6
6
0
7
6
9
/
2
3
6
5
2
4
9
Q
7
0
9
7
9
7
0
6 6 6 5 0
3
3
6
7
4
O
3
6
8
6
5
8
6
1
8
0
o
6
0
9
/
9
7 0
6
7
0
2
2
3
2
8 7
f
7
9
1
4
7
7
3 5 8
6
4
8
9
5
/
9
6
T
5
1
O
7
3
5
6
0
8
8
O
8
/
5
T
2
2
6
8
7
6
(a) Without Differential Privacy.
(b) With Differential Privacy (c
10,
2N
Figure 6:
Uncurated MNIST samples with PGB and DRS after 30 epochs (without DP) and 25
epochs (with DP).
7
7
5
9
3
3
3
3
3 6
4
8
6
3
0
6
4
8
8
8
9
6
5
9
5
2
4
8
2
2
2
2
7
2
2
5
2
7
0
0
9
7
R
2
2
4
35
6
9
2
2
2
0
2 9 6
9
2
4
9
0
2
4
0
5
2
6
9
0
2
4
7
5 6
5
2
5
2
6
2
0
8
6
4
8
2
2
5
2
9
4
6
3
4
3
3
5
8
2
3
0
5
2
6
5
4
8
9
8
2
4 7 6 6 4
8
3
0
8
4
2
4
R
4
6
5
7
8
8
5
5
8
3
7 4
8
7
9
7
S
5
4
0
3 9 2
2
2
3
2
8
3
2
0
5 3
4
0
0
8
3
5 0
6
3
2
6
2
6
8
8
5
4
0
3
5
7
5 2
0
6
2
5
9
(a) Without Differential Privacy.
(b) With Differential Privacy (e 10,
2N
Figure 7: Top 100 MNIST samples after PGB after 30 epochs (without DP) and 25 epochs (with DP).
17


Reviews:
[{"review_id": "eKWxtq5UJF", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: This paper studies the differential private synthetic dataset generation. Unlike previous DP based GAN models, this paper aims to boost the sample quality of after the training stage. In particular, the final synthetic dataset is sampled from the sequence of generators obtained during GAN training. The distribution is obtained by a private two-player game between the privately selected discriminator and a sampler from the mixture of generators. The results are demonstrated on gaussian data and tabular data.\n\n\nPros: 1. The sample quality of private generative models is known to be not as good as non-private models. This paper provides a practical private post gan boosting algorithm to improve the sample quality. \n\nCons:1. My main concern is on experiments. It is known that private generative models have bad sample quality on image data. Prior works on private synthetic generation papers usually show results on MNIST. It would be better if the authors could compare private PGB on MNIST dataset. \n\n2. It would be better to have an ablation study of the proposed PGB and discriminator rejection sampling. For example, in Figure~1, the baselines for both non-private gan and private gan are too bad. I am wondering whether the gain is from rejection sampling or the proposed PGB algorithm.\n\n\nQuestions:\n\n1. I am curious about how to split epsilon for gan training and the post gan boosting. Are there any principled reasons for the split?\n\n2. How do you calculate the sensitivity for the exponential mechanism?", "extra_scores": {}, "extra_text": {}}, {"review_id": "KHkHQzqktEd", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a method of improving the generated samples of differential-private synthetic dataset using GANs by boosting them post training. They support their proposed method using theory, and then empirically show that it works on 3 types of machine learning tasks.\n\nThis paper presents a novel way of utilizing the sequence of generators and discriminators during training as they are already part of the privacy budget. So it significantly improves the quality of GAN-generated samples for different experiments under the same privacy budget.\n\nThe experiments provide evidence of the utility of the proposed method in all three tasks. The community can definitely benefit from this paper.", "extra_scores": {}, "extra_text": {}}, {"review_id": "2uSEIDwfm9Y", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes an algorithm to process the sequence of generators and discriminators produced by any differentially private GAN training, in order to produce synthetic data of better quality. The paper also presents some empirical evaluations. \nThere have been a few works on differentially private GAN, yet the noised required by differential privacy usually causes significant degradation in utility. So an algorithm for improving the results can be quite valuable. The evaluation was mainly on simple datasets, which is understandable as differentially private GAN can be quite hard. However, I think it might be helpful to do more experiments on more difficult datasets (like those usually used to evaluate non-private GAN) with various epsilons (even with very large epsilon), so that readers and future researchers can understand the limitations of the current sota.\n\nThe presentation is clear. The privacy aspect of the algorithm, e.g. which part needs privacy protection and what is the sensitivity of the score function, can be elaborated more.\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper provides a privacy-preserving method to boost the sample quality after training a GAN. The reviewers were unanimous that this paper should be presented at ICLR, with an important contribution to privacy-preserving GANs.
Decision: Accept (Poster)