Differentially Private Diffusion Models
Authors: Tim Dockhorn
Tianshi Cao
Arash Vahdat
Karsten Kreis
Venue: Submitted to ICLR 2023 (2023)
Keywords: Diffusion models
Differential Privacy
Generative Modeling

Abstract: While modern machine learning models rely on increasingly large training datasets, data is often limited in privacy-sensitive domains. Generative models trained with differential privacy (DP) on sensitive data can sidestep this challenge, providing access to synthetic data instead. However, training DP generative models is highly challenging due to the noise injected into training to enforce DP. We propose to leverage diffusion models (DMs), an emerging class of deep generative models, and introduce Differentially Private Diffusion Models (DPDMs), which enforce privacy using differentially private stochastic gradient descent (DP-SGD). We motivate why DP-SGD is well suited for training DPDMs, and thoroughly investigate the DM parameterization and the sampling algorithm, which turn out to be crucial ingredients in DPDMs. Furthermore, we propose noise multiplicity, a simple yet powerful modification of the DM training objective tailored to the DP setting to boost performance. We validate our novel DPDMs on widely-used image generation benchmarks and achieve state-of-the-art (SOTA) performance by large margins. For example, on MNIST we improve the SOTA FID from 48.4 to 5.01 and downstream classification accuracy from 83.2% to 98.1% for the privacy setting DP-$(\varepsilon=10, \delta=10^{-5})$. Moreover, on standard benchmarks, classifiers trained on DPDM-generated synthetic data perform on par with task-specific DP-SGD-trained classifiers, which has not been demonstrated before for DP generative models.

Under review as a conference paper at ICLR 2023
DIFFERENTIALLY PRIVATE DIFFUSION MODELS
Anonymous authors Paper under double-blind review
ABSTRACT
While modern machine learning models rely on increasingly large training datasets, data is often limited privacy-sensitive domains. Generative models trained with differential privacy (DP) sensitive data can sidestep this challenge, providing access to synthetic data instead. However, training DP generative models is highly challenging due to the noise injected into training to enforce DP. We propose to leverage diffusion models (DMs), an emerging class of deep generative models, and introduce Differentially Private Diffussion Models (DPDMs), which enforce privacy using differentially private stochastic gradient descent (DP-SGD). We motivate why DP-SGD is well suited for training DPDMs, and thoroughly investigate the DM parameterization and the sampling algorithm, which turn out be crucial ingredients DPDMs. Furthermore, we propose noise multiplicity, a simple yet powerful modification of the DM training objective tailored to the DP setting to boost performance. We validate our novel DPDMs on widely-used image generation benchmarks and achieve state-of-the-an (SOTA) performance by large margins. For example, on MNIST we improve the SOTA FID from 48.4 to 5.01 and downstream classification accuracy from 83.2% to 98.1% % for the privacy setting (P- 5= Moreover, on standard benchmarks, classifiers trained on DPDM DPDM-generated synthetic data perform on par with task-specific DP-SGD SGD-trained classifiers, which has not been demonstrated before for DP generative models.
INTRODUCTION
Modern deep learning usually requires significant amounts of training data. However, sourcing large datasets privacy-sensine domains is often difficult. To circumvent this challenge, generative models trained sensitive data can provide access to large synthetic data instead, which can be used flexibly to train downstream models. Unfortunately, typical overparameterized neural networks have been shown to provide little to privacy to the data they have been trained on. For example, an adversary may be able to recover training images of deep classifiers using gradients of the networks (Yin al., 2021) reproduce training text sequences from large transformers (Carlini et al., 2021). Generative models may even overfit directly, generating data indistinguishable from the data they have been trained on. In fact, overfitting and privacy-leakage of generative models are more relevant than ever, considering recent works that train powerful photo-realistic image generators on large-scale Internet-scraped data (Rombach al., 2021; Ramesh et al., 2022; Saharia et al., 2022).
To protect the privacy of training data, one may train their model using differential privacy (DP), DP a rigorous privacy framework that applies to statistical queries (Dwork al., 2006; 2014). In our case, this query corresponds to the training of neural network using sensitive data. Differentially private stochastic gradient descent (DP-SGD) (Abadi et al., 2016) is the workhorse of DP training of neural networks. It preserves privacy by clipping and noising the parameter gradients during training. This leads to an inevitable trade-off between privacy and utility; for instance, small clipping constants and large noise injection result in very private models that may be of little practical use.
DP-SGD has, for example, been employed to train generative adversarial networks (GANs) (Frigerio et al., 2019; Torkzadchmahani et al., 2019; Xie et al., 2018), which are particularly susceptible to privacy-leakage (Webster et al., 2021). However, while GANs in the non non-private setting can synthesize photo-realistic images (Brock et al., 2019; Karras et al., 2020b;a; 2021), their application in the private setting is challenging. GANs are difficult to optimize (Arjovsky & Bottou, 2017: Mescheder al., 2018) and prone to mode collapse; both phenomena may be amplified during DP-SGD training.
Recently, Diffusion Models (DMs) have emerged as a powerful class of generative models (Song al., 2021e; Ho et al., 2020: Sohl-Diekstein al., 2015), demonstrating outstanding performance

---

Under review as a conference paper at ICLR 2023
Sintttiee Forwurd Parz
Sentlization
Objective: l Do on))
Figure 1: Information flow during training in our Dif- ferentially Private Diffussio Model (DPDM) for single training sample in green (i.e. batchsize B=1, another sample shown in blue). We rely on DP-SGD to guaran- tee privacy and use noise multiplicity; here, K=3. The diffusion visualized for one-dim. toy distribu- tion (marginal probabilities in purple): our main experi- ments use high-dim, images. Note that for brevity in the visualization we dropped the index i, which indicates the minibatch element in Eqs. (6) and (7).
xxl
Sonttiive Backward Pars
Averaging
Averaging over Noise Levels:
Σ
Private Backward Plass
AE[M]
Objective
Objective
Oljective
Gradlent Calculation:
Do ot
Ky
Vel
Gradient Sanitization:
86 = clipe (Ro) + C op
X2
X
X1
01
Diffiation Trajectorses
Forward Diffiation Process Xa x (0,
image synthesis (Ho et al., 2021; Nichol Dhariwal, 2021; Dhariwal Nichol, 2021; Rombach et al., 2021; Ramesh et al., 2022; Saharia et al., 2022). In DMs, diffusion process gradually perturbs the data towards random noise, while a deep neural network learns to denoise. DMs stand out not only by high synthesis quality, but also sample diversity, and simple and robust training objective. This makes them arguably well suited for training under DP perturbations. Moreover, generation in DMs corresponds to iterative denoising process, breaking the difficult generation task into many small denoising steps that are individually simpler than the one-shot synthesis task performed by GANs and other traditional methods. In particular, the denoising neural network that is learnt in DMs and applied repeatedly at each synthesis step is less complex and smoother than the generator networks of one-shot methods, we validate in experiments on toy data. Therefore, training of the denoising neural network is arguably less sensitive to gradient clipping and noise injection required for DP.
Based on these observations, we propose Differentially Private Diffussin Models (DPDMs), DMs trained with rigorous DP guarantees based on DP-SGD. We thoroughly study the DM parameterization and sampling algorithm, and tailor them to the DP setting. We find that the stochasticity in DM sam- pling, which is empirically known to be enror-crrrectnng (Karras et al., 2022), can be particularly help- ful in DP-SGD training to obtain satisfactory perceptual output quality. We also propose noise multi- plicity, where single training data sample is re-used for training at multiple perturbation levels along the diffusion process (see Fig. 1). This simple yet powerful modification of the DM training objective improves learning at additional privacy cost. We validate DPDMs standard DP image generation tasks, and achieve state-of-the-an performance by large margins, both in terms of perceptual quality and performance of downstream classifiers trained synthetically generated data from our models. For example, on MNIST we improve the state-of-the-ae FID from 48.4 to 5.01 and downstream classi- fication accuracy from 83.2% 98.1% 1% for the privacy setting (P-(s-10 10, ò 10-5).. We also find that classifiers trained on aPDM-generater synthetic data perform on par with task task-specific DP-trained classifiers on standard benchmarks. which has not been demonstrated before for DP generative models.
In summary, we make the following contributions: (i) We carefully motivate training DMs with DP-SGD and introduce DPDMs, the first DMs trained under DP guarantees. (ii) We study DPDM parameterization, training setting and sampling in detail, and optimize it for the DP setup. (iii) We propose noise multiplicity to efficiently boost DPDM performance. (iv) Experimentally. we significantly surpass the state-of-the-an in DP synthesis benchmarks. (v) We demonstrate that classifiers trained on DPDM PPDM-geneeated data perform on par with task-specific DP-trained discriminative models. This implies very high utility of the synthetic data generated by DPDMs, delivering on the promise of DP generative models as an effective data sharing medium. Finally, we hope that work has implications for the literature DMs, which are now routinely trained on ultra large-scale datasets diverse origins.
widely-studied image modeling
2 BACKGROUND
2.1 DIFFUSION MODELS
We consider continuous time DMs (Song et al., 2021c) and follow the presentation of Karras et al. (2022). Let Pdata (x) denote the data distribution and p(x; a) ) the distribution obtained by adding i.i.d.
2

---

Under review as a conference paper at ICLR 2023
o-- Gaussian noise to the data distribution. For sufficiently large max: p(x; d is almost indistinguishable from Tmax -variance Gaussian noise. Capitalizing on this observation, DMs sample (high variance) Gaussian noise X .N (0, o max) and sequentially denoise Xy into x; p(x;; 02), i [O,....MM] with Ø; < 0 (0g- max)). If Ø = 0, then Xo is distributed according to the data.
Sampling. In practice, the sequential denoising is often implemented through the simulation of the Probability Flow ordinary differential equation (ODE) (Song et al., 2021c)
dx = - (1)a po; o (1) dl,
where Vx log p(x; 0)) is the score function (Hyvärinen, 2005). The schedule ot)) [0, 1] + R+ is user-specified and (t) denotes the time derivative of (t). Alternatively, we may also sample from stochastic differential equation (SDE) (Song et al., 2021c; Karras et al., 2022):
dx (t)) log p(x; a (()) dt- 3()) (1) V log (1)) dt v 223(t)a dwy,
(2)
Probability Flow ODE; see Fi.. (1)
Langevin diffusion component
where duy, is the standard Wiener process. In principle, given initial samples Xy ~ NV (0, max)) sim- ulating either Probability Flow ODE or SDE produces samples from the same distribution. In practice, though, neither ODE nor SDE can be simulated exactly: Firstly, any numerical solver inevitably intro- duces discretization errors. Secondly, the score function is only accessible through model so(x; a)) that needs to learned; replacing the score function with an imperfect model also introduces an error. Empirically, the ODE formulation has been used frequently to develop fast solvers (Song et al., 2021a; Zhang& & Chen, 2022; Lu et al., 2022; Liu et al., 2022; Dockhorn et al., 2022a), whereas the SDE for- mulation often leads to higher quality samples (while requiring more steps) (Karras et al., 2022). One possible explanation for the latter observation is that the Langevin diffusion component in the SDE at any time during the synthesis process actively drives the process towards the desired marginal distri- bution p( x; o), whereas errors accumulate in the ODE formulation, even when using many synthesis steps. In fact, it has been shown that the score model so improves, the performance boost that be obtained by an SDE solver diminishes (Karras et al., 2022). Finally, note that we are using classifier- free guidance (Ho Salimans, 2021) to perform class-conditional sampling in this work. For details on -lssifier--rre guidance and the numerical solvers for Eq. (1) and Eq. (2), we refer to App. C.3.
Training. DM training reduces learning the score model sg. The model can, for example, be param- eterized as Vx log p(x; o) = denoiser that, given a noisy data point x + n, X ~ Pdata(x)) n ~ N' (0,a²) and conditioned on the noise level o, tries to predict the clean x. The denoiser Dg can be trained by minimizing an L2-loss
(Do(x; σ)- -00-xx)) -x)/o² (Karras et al., 2022), where Dg is learnable
arg min (xxxpassaxx) orrp)) Da(x + n, n, - x112
(3)
0
where M(r): R_ + R4 is a weighting function. Previous works proposed various denoiser models Do. noise distributions p(a), and weightings X(o). We refer to the triplet (Do. p. A) as the DM config. Here, we consider four such configs: variance preserving (VP) (Song et al., 2021c), variance exploding (VE) (Song al., 2021c), v-prediction (Salimans & Ho, 2022), and the config introduced in Karras et al. (2022) (referred to as Elucidate in this work); App. C.1 for details.
2.2 DIFFERENTIAL PRIVACY
DP is a rigorous mathematical definition of privacy applied to statistical queries; in our work the queries correspond to the training of neural network using sensitive training data. Informally, training is said to be DP, if, given the trained weights f of the network, an adversary cannot tell with certainty whether a partieular data point was part of the training data. This degree of certainty is controlled by two positive parameters and 5: training becomes more private as E and 5 decrease. Note, however, that there is an inherent trade-off between utility and privacy: very private models may be of little to no practical use. To guarantee a sufficient amount of privacy, as a rule of thumb, 8 should not be larger than 1/N, where N is number of training points {x)) and e should be small constant. More formally, we refer to (e, DDP defined as follows (Dwork et al., 2006):
Definition 2.1. (Differential Privacy) A randomized mechanism M D + R with domain D and range R satisfies (E, DDP if for any two datasets d, d' D differing by most one entry, and for any subset of outputs S C R it holds that
Pr (M() er (M E ES $1++5. +
(4)
3

---

Under review as a conference paper at ICLR 2023
DP-SGD. We require DP algorithm that trains a neural network using sensitive data. The workhorse for this particular task is diffcrentially private stochastic gradient descent (DP-SGD) (Abadi et al., 2016). DP-SGD is modification of SGD for which saample-gaddenn are clipped and noise is added to the clipped gradients; the DP-SGD parameter updates are defined as follows
0 0-0- 7 B
Eien iEB clipo (Vel.(0)) + Cz). z ~ 000,o TD
(5)
where IB is B-sized subset of (I,...,NY NY drawn uniformly at random, 4 is the loss function for data point X4, 77 is the learning rate, and the clipping function is clipa(g) = min {1. C/ (//|l/|2)) g. DP-SGD can be adapted to other first-order optimizers, such Adam (McMahan al., 2018).
Privacy Accounting, According to the Gaussian mechanism (Dwork et al., 2014), a single DP-SGI update (Eq. (5)) satisfies (c, 6)-DP if oh > 2 1og(1.25, / /e?. Privacy accounting methods can be used to compose the privacy cost of multiple DP-SGD training updates and to determine the variance hh needed to satisfy (e, 6)-DP for a particular number of DP-SGD updates with clipping constant C' and subsampling rate B B/N. Also see App. A.
3 DIFFERENTIALLY PRIVATE DIFFUSION MODELS
We propose DPDMs, DMs trained with rigorous DP guarantees based on DP-SGD. In See. 3.1, we discuss the motivation for using DMs for DP generative modeling. In Sec. 3.2, we then discuss training and methodological details as well as DM design choices, and we prove that DPDMs satisfy DP.
1000
3.1 MOTIVATION
100
(i) Objective function. GANs have so far been the workhorse of DP generative modeling (see Sec. 4), even though they are generally difficult to optimize (Arjovsky & Bottou, 2017; Mescheder et al., 2018) due to their adver- sarial training and propensity to mode collapse. Both phe- nomena may be amplified during DP-SGD training. DMs, in contrast, have been shown to produce outputs as good or even better than GANs' (Dhariwal & Nichol, 2021), while being trained with very simple regression-like L2-loss (Eq. (3)). which makes them robust and scalable in prac- tice. DMs are therefore arguably also well-suited for DP- SGD-based training and offer better stability under gradient clipping and noising than adversarial training frameworks.
0.01
Denoiser ((.
...*
DM
0.01
GAN
0.005
0,02
Noise level
Figure 2: Frobenius norm of the Jacobian (r(o) of the denoiser D(,, and constant Frobenius norms of the Jacobians Jp of the sampling functions defined by the DM and a GAN. App. for experiment details.
(ii) Sequential denoising. In GANs and most other traditional generative modeling approaches, the generator directly learns the sampling function, i.e., the mapping of latents to synthesized samples, end-to-end. contrast, the sampling function in DMs is defined through a sequential denoising pro- cess, breaking the difficult generation task into many small denoising steps which are individually less complex than the one-shot synthesis task performed by. for instance, a GAN generator. The denoiser neural network, the learnable component in DMs that is evaluated once per denoising step, is therefore simpler and smoother than the one-shot generator networks of other methods. We fit both a DM and a GAN to a two-dimensional toy distribution (mixture of Gaussians, see App. D) and empirically verify that the denoiser D is indeed significantly less complex (quantified by the Frobenius norm of the Jaco- bian) than the generator learnt by the GAN and also than the end-to-end multi-step synthesis process (Probability Flow ODE) of the DM (see Fig. 2; we calculate denoiser JF (a) at varying noise levels or). Generally, more complex functions require larger neural networks and are more difficult to learn. Note, however, that the Ln-morm of the noise added in the DP-SGD updates scales linearly with the number of parameters, and therefore smaller networks are generally preferred. Moreover, in DP-SGD training we only have limited number of training iterations available until the privacy budget is depleted. Consequently, the fact that DMs require less complexity out of their neural networks than typical one- shot generation methods, while still being able represent expressive generative models due the iterative synthesis process, makes them likely well-suited for DP generative modeling with DP-SGD.
(iii) Stochastic diffusion model sampling. As discussed in Sec. 2.1, generating samples from DMs with stochastic sampling can perform better than deterministic sampling when the score model is not learned well. Since replace gradient estimates in DP-SGD training with biased large variance
4

---

Under review as a conference paper at ICLR 2023
estimators, we cannot expect a perfectly accurate score model. In Sec. 5.2, we empirically show that stochastic sampling can in fact boost perceptual synthesis quality in DPDMs as measured by FID.
3.2 TRAINING DETAILS, DESIGN CHOICES, PRIVACY
The clipping and noising of the gradient estimates in DP-SGD (Eq. (5)) pose major challenge for efficient optimization. Blindly reducing the added noise or increasing the clipping constant C' could be fatal, as it decreases the number of training iterations allowed within a certain (e, 6)-DP budget. Furthermore, as discussed the Ly Ly-norm of the noise added in DP-SGD scales linearly to the number of parameters. Consequently, settings that work well for non- non-private DMs, such as relatively small batch sizes, large number of training iterations, and heavily overparameterized models, may not work well for DPDMs. Below, we discuss how we propose to adjust DPDMs for successful DP-SGD training.
Noise multiplicity. Recall that the DM objective in Eq. (3) involves three expectations. As usual, the expectation with respect to the data distribution Paata (x) is approximated using mini-batching, For non-private DMs, the expectations over a and are generally approximated using single Monte Carlo sample (o,, n.) ~ P(a) (0, per data point x,, resulting in the loss for training sample
= Mo(x) n; x:112-
The estimator I; is very noisy in practice. Non-private DMs counteract this by training for large number of iterations in combination with an exponential moving average (EMA) of the trainable parameters 0 (Song & Ermon, 2020). When training DMs with DP-SGD, we incur a privacy cost for each iteration, and therefore prefer a small number of iterations. Furthermore, since the per-example gradient clipping as well as the noise injection induce additional variance, like our objective function to be less noisy than in the non-DP case. We achieve this by estimating the expectation over a and n using an average over K noise samples, {(o,, n&s b K for each data point X;, replacing the non-private DM objective I, in Eq. (6) with
would
~ p(o)W (0,
- K k=1
+ DEE, a.) x:112-
Importantly, we show that this modification comes no additional privacy cost (also see App. A). We call this simple yet powerful modification of the DM objective, which is tailored to the DP setup, noise multiplicity. The noise multiplicity mechanism is also highlighted in Fig. I: the figure describes the information flow during training for a single training sample (i.e., batch size B = 1). Intuitively, the key is that we first create a relatively accurate low-variance gradient estimate by averaging over multiple noise samples before performing gradient sanitization in the backward pass via clipping and noising. Ideas similar to our noise multiplicity have recently been also used train classifiers with DP-SGD, where multiple augmentations per image are used (De et al., 2022). We empirically showcase the benefit of noise multiplicity in Sec. 5.2.
0.4
Elucidate
VP
Neural networks sizes. Current DMs are heavily overparam- eterized: For example, the current state-of-the-ar image gen- eration model (in terms of perceptual quality) on CIFAR-10 uses more than 100M parameters, despite the dataset consisting of only 50k training points (Karras et al., 2022). Using such heavily overparameterized models for DP-SGD training may not be effective because the I.2-norm of the noise added in the DP-SGD update scales linearly to the number of parameters. Furthermore, the per-example clipping operation of DP-SGD requires the computation of the loss gradient on each training example Vel, rather than the minibatch gradient. In theory, this increases the memory footprint by least O(B; however, in practice the peak memory require- ment is ((B²) compared to non-private training ( (Yousefpour et al., 2021). On top of that, DP-SGD generally already relies on a significantly increased batch size, when compared to non-private training, to improve the privacy-utilig trade-off. As result, for both methodological as well as practical rea- sons, we train very small neural networks for DPDMs, when compared to their non-DP counterparts: models on SAIIST//ashon-MNISST and CelebA have 1.75M and 1.80M parameters, respectively.
y-prediction
VE
0.3
o)lugg)
0.2
0.1
0.0
Noise level
Figure 3: Noise level sampling for dif-
ferent DM configs; see App. C.I.
Diffusion model config. In addition to network size, we found the choice of DM config, i.c., denoiser parameterization Dg. weighting function X(o), and noise distribution p( to be important. In partic- ular the latter is crucial to obtain strong results with DPDMs. In Fig. 3, we visualize the noise distribu- tions of the four configs under consideration. We follow Karras et al. (2022) and plot the distribution
5

---

Under review as a conference paper at ICLR 2023
p(log σ) over the log-noise level. Especially for high privacy settings (small e), we found it important to use distributions that give sufficiently much weight to larger d, such as the distribution of v- prediction (Salimans & Ho, 2022). is known that at large a the DM learns the global. coarse structure of the data, i.e., the low frequency content in the data (images, in our case). Learning global structure reasonably well is crucial to form visually coherent images that can also be used to train downstream models. This is relatively easy to achieve in the non-DP setting, due to the heavily smoothed diffused distribution these high noise level. At high privacy levels, however, even training such high noise levels can be challenging due to DP-SGD's gradient clipping and noising. We hypothesize that this is why it is beneficial to give relatively more weight to high noise levels when training the DP setting, In Sec. 5.2, we empirically demonstrate the importance of the right choice of the DM config.
DP-SGD settings. Following De et al. (2022)
Algorithm 1 DPDM Training
we use very large batch sizes: 4096 on MNIST/Fashion-MMNSS) and 2048 on CelebA. Similar to previous works (De et al., 2022; Ku- rakin et al., 2022: Li et al., 2022), we found that small clipping constants C' work better than larger clipping norms; in particular, we found C = 1 to work well across our exper- iments. Decreasing C even further had little effect; in contrast, increasing C' significantly worsened performance. Similar to non-private DMs, we use an EMA of the learnable param- eters O. Incidentally, this has recently been reported to also have a positive effect on DP- SGD training of classifiers by De et al. (2022).
Input: Private data d {x, ) subsampling rate B/N, DP noise scale dDP, clipping constant C, sampling function Poisson Sample (Alg. 2). denoiser Do with initial parameters O, noise distribution p(a)),
learning rate 77, total steps T. noise multiplicity K, Adam (Kingma & Ba, 2015) optimizer
Output: Trained parameters for 1 = 1 to do
B ~ Poisson Sample (N, B/N))
for i E B do
( nuk ( ~ p(o)
1, x Σx (osst) (x::0(xxx00)0 (xx+ xxx)
end for
Ghatch B Eies clipo (Vol))
Goatch Geatch + (C/B)a, 2 N(O,
Privacy. We formulate privacy protec- tion under the Rényi Differential Privacy (RDP) (Mironov, 2017) framework (see Def- inition A. which can be converted to (e, dD. For an algorithm for DPDM training with noise multiplicity see Alg. 1. For the sake of completeness we also formally prove the DP of DPDMs (DP of releasing sanitized training gradients Gbatch):
0= 0 17 Adam (Ceath))
end for
Theorem 1. For noise magnitude ODP, releasing Gratch in Alg. I satisfies (a, a (222orr)-RDD
The proof can be found in App. A. Note that the strength of DP protection independent of the noise multiplicity, as discussed above. In practice, we construct mini- baii-bbachhss by Poisson Sampling (See Alg. 2) the training dataset for privacy amplification via sub-sampling (Mironov et al., 2019), and compute the overall privacy cost of training DPDM via RDP composition (Mironov, 2017).
4 RELATED WORK
In the DP generative learning literature, several works (Xie et al., 2018; Frigerio et al., 2019; Torkzadehmahani et al., 2019; Chen al., 2020) have explored applying DP-SGD (Abadi et al., 2016) to GANs. while others (Yoon et al., 2019; Long et al., 2019; Wang et al., 2021) train GANs under the PATE (Papernot et al., 2018) framework, which distills private teacher models (discriminators) into a public student (generator) model. Apart from GANs, Acs et al. (2018) train variational autoencoders on DP-sanitized data clusters, and Cao et al. (2021) use the Sinkhorn divergence and DP-SGD.
MERMERF (Harder et al., 2021) was the first work to perform one-shot privatization on the data, followed by non-private learning. It uses differentially private random Fourier features to construct a Maximum Mean Discrepancy loss, which is then minimized by a generative model. PEARL (Liew et al., 2022) instead minimizes an empirical characteristic function, also based on Fourier features. DP-MEPF (Harder et al., 2022) extends DP-MERF to the mixed public-private setting with pre-trained feature extractors. While these approaches are efficient in the high gisgh--rivcy/mmalll dataset regime, they are limited in expressivity by the data statistics that can be extracted during one-shot privatization. As a result, the performance of these methods does not scale well in the oorprivacy//large dataset regime.
In our experimental comparisons, excluded Takagi et al. (2021) and Chen et al. (2022) due to concerns regarding their privacy guarantees. The privacy analysis of Takagi et al. (2021) relies on the Wishart mechanism, which has been retracted due privacy leakage (Sarwate, 2017). Chen
6

---

Under review as a conference paper at ICLR 2023
3
7
Figure 4: MNIST and Fashion-
2
3
Y
6
7 h
A &
9 9 4
MNIST images generated by
DP-CGAN (Ist row). DP-
0
3
C.
5
G
MERF (2nd row), Datalens
&
r
2
3
5
6
7
S
(3rd row). G-PATE (4th row),
GS-WGAN (5th row), DP-
0
/ 2.
4
5 6 7
8 8 5 )
Sinkhorn (6th row), PEARL
0
1 2
3
4
S 6
(7th row) and our DPDM (8th
row). The DP privacy setting is
0
[ f. 3
4
- 6
s=10. Please see App. E.5 for
more samples.
O / 2 3 4 S 6 8 9
et al. (2022) attempt to train score-based model while guaranteeing differential privacy through a data-dependent randomized response mechanism. In App. B, we prove why their proposed mechanism leaks privacy, and further discuss other sources of privacy leakage.
Our DPDM relies on DP-SGD (Abadi et al., 2016) to enforce DP guarantees. DP-SGD has also been used train DP classifiers (Dörmann et al., 2021; Tramer & Boneh, 2021; Kurakin al., 2022). Re- cently, De et al. (2022) demonstrated how to train very large discriminative models with DP-SGD and proposed augmentation multiplicity, which is related our noise multiplicity, as discussed in Sec. 3.2. Furthrmore, DP-SGD has been utilized to train and fine-tune large language models (Anil et al., 2021; Li et al., 2022; Yu et al., 2022), to protect sensitive training data the medical domain (Ziller et al., 2021a;b; Balelli et al., 2022), and to obscure geo-spatial location information (Zeighami et al., 2022).
Our work builds on DMs and score-based generative models -ock-tiikstein et al., 2015: Song et al., 2021c; Ho et al., 2020). DMs have been used prominently for image synthesis (Ho et al., 2021; Nichol & Dhariwal, 2021; Dhariwal & Nichol, 2021; Rombach et al., 2021; Ramesh al., 2022; Saharia et al., 2022) and other image modeling tasks (Meng et al., 2021; Saharia et al., 2021 Li et al., 2021; Sasaki et al., 2021; Kawar et al., 2022). They have also found applications in other areas, for instance in audio and speech generation (Chen al., 2021; Kong et al., 2021; Jeong et al., 2021) and 3D synthesis (Luo & Hu, 2021; Zhou et al., 2021: Zeng et al., 2022). Methodologically. DMs have been adapted, for example, for fast sampling (IoliceeurMaartinaau Martineau et al., 2021; Song et al., 2021a; Salimans & Ho, 2022: Dockhorn et al., 2022b; Xiao et al., 2022: Watson et al., 2022; Dockhorn et al., 2022a) and maximum likelihood training (Song et al., 2021b Kingma al., 2021; Vahdat al., 2021). To the best of our knowledge, we are the first to train DMs under differential privacy guarantees.
5 EXPERIMENTS
Datasets. We focus on image synthesis and use MNIST (LeCun et al., 2010), Fashion-MNIS" (Xiao et al., 2017) (both 28x28 resolution), and CelebA (Liu et al., 2015) (center-cropped; downsampled to 32x32 resolution). These three datasets are widely used in the DP generative modeling literature as standard benchmarks. They contain 50k, 50k, and 162k training images, respectively.
Architectures. We implement the neural networks of DPDMs using the DDPM++ architecture (Song et al., 2021c). For class-conditioning, we add learned class-embedding. See App. C.2 for details.
Evaluation. We measure sample quality via Fréchet Inception Distance (FID) (Heusel et al., 2017). On MNIST and Fashion- sifiers on synthesized samples and compute class prediction accuracy on real data. As is standard prac- tice, consider logistic regression (Log Reg), MLP, and CNN classifiers; App. E.1 for details.
also assess utility of labeled generated data by training clas-
Sampling. We generate samples from DPDM using (stochastic) DDIM (Song et al., 2021c) and the Churn sampler introduced in (Karras et al., 2022). See App. C.3 for details and pseudocode.
Privacy implementation: We implement DPDMs in PyTorch (Paszke et al., 2019) and use Opa- (Yousefpour et al., 2021). DP-SGD library in PyTorch, for training and privacy accounting. We use 1010-5 for MNIST and Fashion-MNIST, and 8-10-6 for CelebA. These values are standard (Cao et al., 2021) and chosen such that d is smaller than the reciprocal of the number of training images. Similar to existing DP generative modeling work, we do not account for the (small) privacy cost of hyperparameter tuning. However, training and sampling very robust with regards hyper- parameters, which makes DPDMs an ideal candidate for real privacy-critical situations; see App. C.4.
5.1 MAIN RESULTS
Class-conditional gray scale image generation. For MNIST and Fashion-MNIST. we train models
7

---

Under review as a conference paper at ICLR 2023
Table 1:
Class-
MNIST
conditional DP
Mothod
DP-
FID
Ace (5)
FID
Ace (56)
image
genera-
Long Reg
ML.
CNN
Log Rog
MLP
CNN
tion performance
DPIM (sues)
DPDM (FLD) (ours)
0.2
61.9
81.0
65.3
81.7
65.8
N6.3
71.9
78.4
1.28
53.6
70.4
71.3
55.3
72.3
57.0
(MNIST & Fashion-
PEARL (Laew 2022)
77.6
160
MNIST).
For
DPDM (FID) (ours)
93.4
37.8
71.5
71.7
73.6
PEARL (Liew
DPDM (Acc) (nurs)
35.5
86.7
91.6
95.3
$1.4
76.3
76.9
79.4
PEARL (Laew al., 2022)
121
76.0
79.5
78.2
109
74.4
74.0
68.3
et al.. 2022), we
DPDM (FTD) (nurs)
10
5.01
90.5
94.6
97.5
18.6
80.4
81.1
84.9
train models and
DPDM (Acc) (ours)
10
6,65
90.8
94.8
98.1
19.1
$1.1
83.0
86.2
compute
met- ourselves (App. E. All
PEARL (Laew 2022)
116
76.5
78.3
78.8
L02
72.6
73.2
64.9
Sinktoorn (Cao
2011)
82.77
K3.2
128.3
75.1
74.6
rics
(LPATTF
20199)
150.62
171.90
CGAN (Tockaadehmmaami et 2019)
243.88
Datal Lms (Wang et 2021)
173.5
80,66
167.7
other results taken 70.61
De MEEE (Harder et 2021)
10
116.3
79.4
78.3
K2.1
132.6
75.5
74.5
75,4
from the literature.
GS WGIAN (Chen atal. 2030)
10
61.3
79
70
80
131.3
68
65
65
DP-MEPF (f) uses
MEPP (os] (flarder et 2022)
71.7
DP-MEPF (6s: (Hudar at at., 2023) (t)
75.8
79.9
72.5
70.4
additional public
DP MEPE (0s) (lander et al., 2022) (1)
79.0
87.3
76.2
75.0
data for training (only included for
DP-MEPP (6s. (b) (Harder at ol., 2022) (f)
82.5
89.3
75.4
74.7
DP MEPF (0x) (Tlander el al., 2022) (?)
10
80.8
85.8
75.5
75,5
completeness).
DP-MEPS ($2, d2) (Harder at ol., 2022) (t)
10
83.4
89.8
75.7
76.0
Table 2: Class prediction accuracy on real test data. DP-SGD: Classifiers trained directly with DP-SGD and real training data. DPDM: Classifiers trained non- non-privately on synthesized data from DP-SGD-rrained DPDMs.
MNIST
Fashion-MNIST
DP
Log Reg
MLP
CNN
Log Reg
MLP
CNN
DP-SGD
DPDM
DP.SGD
DPDM
DP-SGD
DPDM
DP-SGD
DPDM
DP-SGD
DPDM
DP-SGD
DPDM
0.2
83.8
81.0
82.0
81.7
69.9
86.3
74.8
70.4
73.9
71.3
59.5
72.3
89.1
86.7
89.6
91.6
88.2
95.3
79.6
76.3
79.6
76.9
70.5
79.4
91.6
90.8
92.9
94,8
96.4
98.1
83.3
81.1
83.9
83.0
77.1
86.2
for three privacy settings: =- 1, 10} (Tab. 1). Informally, the three settings provide high, moder- ate, and low amounts of privacy, respectively. The DPDMs use the v-prediction DM config (Salimans & Ho, 2022) for c=0.2 and the Elucidate DM config (Karras et al.. 2022) for ==(1, 103; see Sec. 5.2. We use the Churn sampler (Karras et al., 2022): the two settings (FID) and (Acc) are based on the same DM, differing only in sampler setting; see Tab. 14 and Tab. 15 for all sampler settings.
DPDMs outperform all other existing models for all privacy settings and all metrics by large margins (see Tab. 1). Interestingly, DPDM also outperforms DP-MEPF (Harder al., 2022), a method which is trained on additional public data, in 22 out of 24 setups. Generated samples for ==10 are shown in Fig. 4. Visually, DPDM's samples appear to be of significantly higher quality than the baselines'.
Comparison to specific private classifier with DP-SGD directly, or can a non-private classifier well downstream
classifiers. Is it better to train task-
Table 3: Noise multiplicity ablation MNIST for e=1. See Tab. 11 for extended results.
trained on DPDM's synthethized data perform tasks? To answer this question, we train private classifiers with DP-SGD on real (training) data and compare them our classifiers learnt using DPDM-syythesized data (details in App. E.3). For a fair comparison, we are using the same architectures that we have already been using in our main experiments to quantify downstream classification accuracy (results in Tab. 2: we test on real (test) data). While direct DP-SGD training on real data outperforms the DPDM downstream classifier for logistic regression in all six setups (in line with empirical findings that it is casier to train classifiers with few parameters than large ones with DP-SGD (Tramer & Boneh, 2021)), CNN classifiers trained on DPDM's s synthetic data generally outperform -r-SGDDtraiined classifiers. These results imply very high utility of the synthetic data generated by DPDMs, demonstrating that DPDMs can potentially be used as an effective, beneficial over training task-specific models with DP-SGD, because user can generate as much data from DPDMs as they desire for various downstream applications without further privacy implications. To the best of our knowledge, it has not been demonstrated before in the DP generative modeling literature that (image) data generated by DP generative models can be used to train discriminative models on-par with directly DP-SGD-trained task-specific models.
K FID
CNN-Ace (86)
76.9
91.7
57.1
92.8
8 44.8
04.1
16
36.9
94.2
34.8
94.4
data sharing medium in practice. In fact, this approach is
Unconditional color image generation. On CelebA, we train models for (= 10) (Tab. 4 & Fig. 5). The two DPDMs use the Elucidate config (Karras et al., 2022) as well as the Churn sampler; see Tab. 14. For =-10, DPDM again outperforms existing methods by a significant margin. DPDM's synthesized images appear much more diverse and vivid than the baselines' samples.
8

---

Under review as a conference paper at ICLR 2023
Table 4: (bottom) Unconditional CelebA generative performance. G-PATE and Dnt (f) use = 10- (less privacy) and model images at 64x64 resolution.
Figure 5: CelebA
images generated by DataLens (Ist row), DP-MEPF (2nd now), DP- Sinkhorn (3nd
Method
DP-c
FID
DPDM (owrs)
71.8
row), and our
DPDM (4th row)
DPDM (ours)
10
21.1
DP-Sinkhom (Cao 2021)
10
189.5
for DP-s=10.
DP-MERF (Harder ot al., 2021)
10
274.0
More samples in App. E.5.
G-PATE: (Loogg et al. 2019) (f)
10
105.92
DataLens (Wang et al., 2021) (f)
10
320.8
5.2 ABLATION STUDIES
Noise multiplicity. Tab. 3 shows results for DPDMs trained with different noise multiplicity K. As expected, increasing K leads to a general trend of improving performance; however, the metrics start to plateau at around K'=22
Table 5: DM config ablation on MNIST for 0-0.2. See Tab. 12 for extended results.
Diffusion model config. We train DPDMs with different DM configs (see App. C.1). VP- and VE-based models (Song et al., 2021c) perform poorly for all settings, while for 0-0. v-prediction significantly outperforms the Elucidate DM config on MNIST (Tab. 5). On
DM comfig
FID
CNN-Acc (8)
(Song et al., 2021c)
197
24.2
VE (Song al. 2021e)
171
13.9
v-prediction (Salimans Ho. 2022)
97.8
84,4
Elucidase (Karras et 2022)
119
49.2
the advantage is less significant (extended Tab. 12). For == 10), the Elucidate DM conlig performs better than v-prediction. Note that the denoiser parameterization for these configs is almost identical and their main difference is the noise distribution p(o) (Fig. 3). As discussed in Sec. 3.2, oversampling large noise levels a is expected to be especially important for the large privacy setting (small E), which is validated by our ablation.
Sampling. Tab. 6 shows results for different samplers: deterministic and stochastic DDIM (Song et al., 2021a) as well the Churn sampler (tuned for high FID scores and downstream accuracy). Stochastic sampling is crucial to obtain good perceptual quality, as measured by FID (see poor performance of deterministic DDIM), while it less important for downstream accuracy. We hypothesize that FID better captures image details that require a sufficiently accurate synthesis process. As discussed in Secs. 2.1 and 3.1, stochastic sampling can help with that and therefore is particularly important in DP-SGD-traing DMs. We also observe that the advantage of the Churn sampler compared to stochastic DDIM becomes less significant as e increases. Moreover, in particular for s=0.2 the FID-adjusted Churn sampler performs poorly on downstream accuracy. This is arguably because its settings sacrifice sample diversity, which downstream accuracy usually benefits from, in favor of synthesis quality (also see samples in App. E.5).
Table 6: Diffusson sampler comparison on MNIST (see Tab. 13 for results on Fashion-MNISTI We compare the Chum sampler (Karras et al., 2022) stochastic and deterministic DDIM (Song et al., 2021a).
6 CONCLUSIONS
We proposed Differentially Private Diffussio Models (DPDMs), which use DP-SGD to enforce DP guaran- tees during DM training. DMs are strong candidates for DP generative learning due to their robust training ob- jective and intrinsically less complex denoising neural networks. We perform an in-depth analysis of the ideal DPDM parametrization and sampling strategy and intro- duce noise multiplicity to boost synthesis quality. DPDMs achieve of-te-of-the-rtt performance in common DP image generation benchmarks. Furthermore, downstream classi- fiers trained with -PDM-generated synthetic data perform on-par with task-specific discriminative models trained with DP-SGD directly. Based on our promising results, we conclude that DMs are an ideal generative modeling framework for DP generative learning. We hope that DPDMs can grow into practical tool for effective data sharing in the form of a generative model that can produce synthetic but useful data, while preserving the privacy of the generative model's 's original training data. Moreover, we believe that advancing DM- based DP generative modeling is a pressing topic, considering the extremely fast progress of DM-based large-scale photo-realistie image generation systems (Rombach al., 2021; Sa- haria et al., 2022; Ramesh et al., 2022). As future directions we envision applying our DPDM approach during training of such large image generation DMs, as well applying DPDMs to other types of data.
Sampler
FID
(9)
Reg
ML.P
CNK
Chura (FID)
61.9
65.3
65.8
71.9
Chura (Ace)
101
81.0
81.7
86.3
Stcchetic DDIM
0.2
97.8
80.2
B1.3
84-4
Deseminissic DDIM
81.3
Chura (FID)
23.4
83.8
87.0
93.4
Charn (Ace)
35.5
86.7
91.6
95.3
Stnchastic DDIM
34.2
85.2
Desemminiac DDIM
50.4
85.7
91.8
Chura (FID)
10
5.01
90.5
94.6
97.3
Chura (Ace)
10
0.65
90.8
Stnchaetic DDIM
10
6.13
90.4
94.6
97.5
Deteminnsiic DDIM
10
10.9
90.5
95.2
97.7
9

---

Under review as a conference paper at ICLR 2023
7 ETHICS AND REPRODUCIBILITY
Our work improves the state-of-te ofate-of-the-ary in differentially private generative modeling and we validate our proposed DPDMs on image synthesis benchmarks. Generative modeling of images has promising applications. for example for digital content creation and artistic expression (Bailey, 2020), but it can in principle also be used for malicious purposes (Vaccari Chadwick, 2020; Mirsky & Lee, 2021; Nguyen al., 2021). However, differentially private image generation methods, including our DPDM, are currently not able to produce photo-realistic content, which makes such abuse unlikely.
As discussed in Sec. 1, severe issue in modern generative models is that they can easily overfit to the data distribution, thereby closely reproducing training samples and leaking privacy of the training data. Our DPDMs aim to rigorously address such problems via the well-established DP framework and fundamentally protect the privacy of the training data and prevent overfitting to individual data samples. This is especially important when training generative models diverse and privacy-sensitive data. Therefore, DPDMs can potentially act as an effective medium for data sharing without needing to worry about data privacy, which we hope will benefit the broader machine learning community. Note, however, that although DPDM provides privacy protection in generative learning, information about individuals cannot be eliminated entirely, as no useful model can be learned under (P-(s=0,65) 8-0). This should be communicated clearly to dataset participants.
To aid reproducibility of the results and methods presented in our paper, we will make source code to reproduce all quantitative and qualitative results of the paper publicly available, including detailed instructions. Moreover, all training details and hyperparameters are already described in detail the Appendix, in particular in App. C.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318, 2016.
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially Private Mixture of Generative Neural Networks. IEEE Transactions Knowledge and Data Engineering, (016):109-112111 2018
Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-Scale Differen- tially Private BERT. arXiv:2108. 01644, 2021.
Martin Arjovsky and Leon Bottou. Towards Principled Methods for Training Generative Adversarial Networks. In International Conference Learning Representations, 2017.
Bailey. The tools of generative art, from flash to neural networks. Art in America, 2020.
Irene Balelli, Santiago Silva, and Marco Lorenzi. A Differentially Private Probabilistic Framework for Modeling the Variability Across Federated Datasets of Heterogeneous Multi-View Observations. Journal of Machine Learning for Biomedical Imaging, 2022.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large Scale GAN Training for High Fidelity Natural Image Synthesis. In International Conference on Learning Representations, 2019.
Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don't Generate Me: Train- ing Differentially Private Generative Models with Sinkhorn Divergence. Advances in Neural Information Processing Systems, 34: 12480-122222 2021.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting Training Data from Large Language Models, In 30th USENIX Security Symposium (USENIX Security 21), pp- 2633-2650, 2021.
Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. GS-WGAN: A Gradient-Saninn Sanitized Approach for Learning Differentially Private Generators. Advances in Neural Information Processing Systems, 33:12673-1288 12684, 2020.
10

---

Under review as a conference paper at ICLR 2023
Jia- Wei Chen, Chia-Mu Yu, Ching- Bhing-ChiaBe Kao, Izai-Wei Pang, and Chun-Shien Lu. DPGEN: Differen- tially Private Generative Energy- Seide- Network for Natural Image Synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8387-8396, June 2022.
Nanxin Chen, Yu Zhang, Heiga Zen, Ron Weiss, Mohammad Norouzi, and William Chan. WaveG- rad: Estimating Gradients for Waveform Generation. In International Conference on Learning Representations, 2021.
Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlocking High- Accuracy Differentially Private Image Classification through Scale. arXiv:2204. 122204413600 13650, 2022.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255, leee, 2009.
Prafulla Dhariwal and Alex Nichol. Diffusion Models Beat GANs on Image Synthesis. In Neural Information Processing Systems, 2021.
Tim Dockhorn, Arash Vahdat, and Karsten Kreis. GENIE: Higher- Order Denoising Diffusion Solvers. In Advances in Neural Information Processing Systems, 2022a.
Tim Dockhorn, Arash Vahdat, and Karsten Kreis. Score-Based Generative Modeling with Critically- Damped Langevin Diffusion. In International Conference on Leurning Representations, 2022b.
Friedrich Dörmann, Osvald Frisk, Lars Nørvang Andersen, and Christian Fischer Pedersen, Not All Noise is Accounted Equally: How Differentially Private Learning Benefits from Large Sampling Rates. In 2021 IEEE st International Workshop on Machine Learning for Signal Processing (MLSP), pp. 1-6. IEBE, 2021.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating Noise to Sensitivity in Private Data Analysis. In Theory of Cryptography Conference, pp. 265-284. Springer, 2006.
Cynthia Dwork, Aaron Roth, et al. The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4):211-477, 2014.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differentially Private Generative Adversarial Networks for Time Series, Continuous, and Discrete Open Data. In IFIP International Conference on ICT Systems Security and Privacy Protection, pp. 151-164. Springer, 2019.
Frederik Harder, Kamil Adamczewski. and Mijung Park. DP-MERF: Differentially Private Mean Em- Data Generation. In International
beddings with RandomFeature for Practical Conference on Artificial Intelligence and Statistics, pp. 18 1819-1827. PMLR, 2021.
Fredrik Harder, Milad Jalali Asadabadi, Danica J Sutherland, and Mijung Park. Differentially Private Data Generation Needs Better Features. arXiv:2205. /2900, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs Trained by a Two SSale Update Rule Converge to a Local Nash Equilibrium. In Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Gamnet (eds.), Advances in Neural Information Processing Systems. Curran Associates, Inc., 2017.
Jonathan Ho and Tim Salimans. Classifier-Free Diffusion Guidance. In NewrIPS 2021 Workshop on Deep Generative Models and Downstream Applications, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising Diffusion Probabilistic Models, In Advances in Neural Information Processing Systems, 2020.
Jonathan Ho, Chitwan Saharia, William Chan, David J Fleet, Mohammad Norouzi, and Tim Salimans.
Cascaded Diffusion Models for High Fidelity Image Generation. arXiv:2106.1522 15282, 2021.
Aapo Hyvärinen. Estimation of Non-Normalizer Statistical Models by Score Matching. Journal of Machine Learning Research, 6:695-709, 2005. ISSN 1532-4435.
11

---

Under review as a conference paper at ICLR 2023
Myeonghun Jeong, Hyeongju Kim, Sung Jun Cheon, Byoung Jin Choi, and Nam Soo Kim. Diff-TTS: A Denoising Diffusion Model for texeech arXiv preprint arxiv:2104.01409, 2021.
Alexia Salicoeur-Martneanr Ke Li, Rémi Piché- Taillefer, Tal Kachman, and loannis Mitliagkas. Gotta Go Fast When Generating Data with Score- Based Models. arXiv:2105.. 14080, 2021.
Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training Generative Adversarial Networks with Limited Data. Advances in Neural Information Processing Systems,
2020a.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and Improving the Image Quality of StyleGAN. In Proceedings of the IEEE/CVF Conference on Computer Bision and Pattern Recognition, pp. 8110-8119, 2020b.
Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-Free Generative Adversarial Networks. Advances in Neural Information Processing Systems, 34:852-863, 2021.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the Design Space of Diffusion- Based Generative Models. arXiv:2206.00332 2022.
Bahjat Kawar, Michael Elad, Stefano Ermon, and Jiaming Song. Denoising Diffusion Restoration Models. arXiv:2201. 11793, 2022.
Diederik Kingma and Jimmy Ba. Adam: Method for Stochastic Optimization. In International Conference on Learning Representations, 2015.
Diederik P Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational Diffusion Models. In Advances in Neural Information Processing Systems, 2021.
Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. DiffWave: Versatile Diffusion Model for Audio Synthesis. In International Conference Learning Representations, 2021.
Alex Krizhevsky. Learning Multiple Layers of Features from Tiny Images. Technical report, University of Toronto, 2009.
Alexey Kurakin, Steve Chien, Shuang Song, Roxana Geambasu, Andreas Terzis, and Abhradeep Thakurta. Toward Training at ImageNet Scale with Differential Privacy. arXiv:2201. 12328, 2022.
Yann LeCun, Corinna Cortes, and Chris Burges. MNIST handwritten digit database, 2010.
Haoying Li, Yifan Yang, Meng Chang, Huajun Feng, Zhihai Xu, Qi Li, and Yueting Chen. SRDiff: Single Image Super-Resolution with Diffusion Probabilistic Models. urXiv:2104.1495/ 2021.
Xuechen Li, Florian Tramer, Percy Liang. and Tatsunori Hashimoto. Large Language Models Can Be Strong Differentially Private Learners. In International Conference on Learning Representations, 2022.
Seng Pei Liew, Tsubasa Takahashi, and Michihiko Ueno. PEARL: Data Synthesis via Private Embeddings and Adversarial Reconstruction Learning. In International Conference on Learning Representations, 2022.
Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo Numerical Methods for Diffusion Models on Manifolds. In International Conference on Learning Representations, 2022.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep Learning Face Attributes in the Wild. In Proceedings of the IEEE International Conference on Computer Vision, pp. 3730-3738, 2015.
Yunhui Long, Suxin Lin, Zhuolin Yang, Carl A Gunter, Han Liu, and Bo Li. Scalable differentially private data generation via private aggregation of teacher ensembles. 2019.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li. and Jun Zhu. DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Steps. 220.:2200000027,, 2022.
12

---

Under review as a conference paper at ICLR 2023
Shitong Luo and Wei Hu. Diffusion Probabilistic Models for 3D Point Cloud Generation. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR), 2021.
H Brendan McMahan, Galen Andrew, Ulfar Erlingsson, Steve Chien, Ilya Mironov, Nicolas Papernot, and Peter Kairouz. A General Approach to Adding Differential Privacy to Iterative Training Procedures. arXiv: 18/2.0621, 2018.
Chenlin Meng, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. SDEdit: Image Synthesis and Editing with Stochastic Differential Equations. arXiv:2108.01073, 2021.
Lars Mescheder, Andreas Geiger, and Sebastian Nowozin. Which Training Methods for GANs do actually Converge? In Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, 2018.
Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263-275, IEEE, 2017.
Ilya Mironov, Kunal Talwar, and Li Zhang. Rényi Differential Privacy of the Sampled Gaussian Mechanism, arXiv: 1908. 10530, 2019.
Yisroel Mirsky and Wenke Lee. The Creation and Detection of Deepfakes: A Survey, ACM Comput. Surv. 54(1), 2021.
Thanh Thi Nguyen, Quoc Viet Hung Nguyen, Cuong M. Nguyen, Dung Nguyen, Duc Thanh Nguyen, and Saeid Nahavandi. Deep Learning for Deepfakes Creation and Detection: A Survey. arXiv: 2021.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved Denoising Diffusion Probabilistic Models. In International Conference on Machine Learning, 2021.
Art B. Owen. Monte Carlo theory, methods and examples. 2013.
Nicolas Papernot and Thomas Steinke. Hyperparameter Tuning with Renyi Differential Privacy. In International Conference on Learning Representations, 2022.
Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Ülfar Erlingsson. Scalable Private Learning with PATE. In International Conference on Learning Representations, 2018
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. PyTorch: An Imperative Style, High- Perhorrrffrm Deep Learning Library. Advances in Neural Information Processing Systems, 32, 2019.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical Text- Conditional Image Generation with CLIP Latents. arXiv:2204.06125, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- Resolution Image Synthesis with Latent Diffusion Models. 12Xiv:2112.10752, 2021.
Chitwan Saharia, William Chan, Huiwen Chang, Chris A. Lee, Jonathan Ho, Tim Salimans, David J. Fleet, and Mohammad Norouzi. Palette: Image-to-Image Diffusion Models. arXiv:2111.05826, 2021a.
Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David Fleet, and Mohammad Norouzi. Image Super-Resolution via Iterative Refinement. arXiv:2104.0766 2021b.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kam- yar Seyed Ghasemipour, Bureu Karagol Ayan, S Sara Mahdavi, Rapha Gontijo Lopes, et al. Photo- realistic Text-to- Image Diffusion Models with Deep Language Understanding. ar55v: 1487, 2022.
13

---

Under review as a conference paper at ICLR 2023
Tim Salimans and Jonathan Ho. Progressive Distillation for Fast Sampling of Diffusion Models. In International Conference on Learning Representations, 2022.
Anand Sarwate. Retraction for Symmetric Matrix Perturbation for Differentially-Privat Principal Component Analysis, 2017.
Hiroshi Sasaki, Chris G. Willcocks, and Toby P. Breckon. UNIT-DDPM: UNpaired Image Translation with Denoising Diffusion Probabilistic Models. arXiv:2104.05358, 2021.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep Unsupervised Learning using Nonequilibrium Thermodynamics. In International Conference on Machine Learning, 2015.
Jaaming Song, Chenlin Meng, and Stefano Ermon. Denoising Diffusion Implicit Models. In International Conference on Learning Representations, 2021a.
Yang Song and Stefano Ermon. Improved Techniques for Training Score-Based Generative Models. Advances in Neural Information Processing Systems, 33: 1448--12448, 2020.
Yang Song, Conor Durkan, lain Murray, and Stefano Ermon. Maximum Likelihood Training of Score-Based Diffusion Models. In Neural Information Processing Systems (NeurIPS), 2021b.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-Based Generative Modeling through Stochastic Differential Equations. In International Conference on Learning Representations, 2021c
Shun Takagi, Tsubasa Takahashi, Yang Cao, and Masatoshi Yoshikawa. P3GM: Private High- Dimensional Data Release via Privacy Preserving Phased Generative Model. In 202/ JEEE 37th International Conference on Data Engineering (ICDE), pp. 169-180. IEEE, 2021.
Reihanch Torkzadehmahani, Peter Kairouz, and Benedict Paten. DP-CGAN: Differentially Private Synthetic Data and Label Generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pp. 0-0, 2019.
Florian Tramer and Dan Boneh. Differentially Private Learning Needs Better Features (or Much More Data). In International Conference on Learning Representations, 2021.
Cristian Vaccari and Andrew Chadwick. Deepfakes and Disinformation: Exploring the Impact of Synthetic Political Video on Deception, Uncertainty, and Trust in News. Social Media + Society, (1):2056305122) 19956305120903400 120033408, 2020.
Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based Generative Modeling in Latent Space. In Neural Information Processing Systems (NeurIPS), 2021.
Boxin Wang, Fan Wu, Yunhui Long, Luka Rimanic, Ce Zhang, and Bo Li. Datal Lens: Scalable Privacy Preserving Training via Gradient Compression and Aggregation. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 2146-2168, 2021.
Daniel Watson, William Chan, Jonathan Ho, and Mohammad Norouzi. Learning Fast Samplers for Diffusion Models by Differentiating Through Sample Quality. In International Conference Learning Representations, 2022.
Ryan Webster, Julien Rabin, Loic Simon, and Frederic Jurie. This Person (Probably) Exists. Identity Membership Attacks Against GAN Generated Faces. arXiv:2107.06018, 2021.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNISTT: a Novel Image Dataset for Bench- 2017.
marking Machine Learning Algorithms.
Zhisheng Xiao, Karsten Kreis, and Arash Vahdat. Tackling the Generative Learning Trilemma with Denoising Diffusion GANs. In International Conference on Learning Representations, 2022.
Liyang Xie, Kaixiang Lin, Shu Wang. Fei Wang, and Jiayu Zhou. Differentially Private Generative Adversarial Network. arXiv: /00.0068000069 2018.
14

---

Under review as a conference paper at ICLR 2023
Yasin YazIeı, Chuan-Sheng Foo, Stefan Winkler, Kim-Hui Yap, Georgios Piliouras, and Vijay Chandrasekhar. The Unusual Effectiveness of Averaging GAN Training. In International Conference Learning Representations, 2019.
Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See Through Gradients: Image Batch Recovery via GradInversion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16337-16346, 2021.
Jinsung Yoon, James Jordon, and Mihaela van der Schaar. PATE-GAN: Generating Synthetie Data with Differential Privacy Guarantees. In International Conference on Learning Representations, 2019.
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-Friendly Differential Privacy Library in PyTorch. In NeurlPS 2021 Workshop Privacy in Machine Learning. 2021.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially Private Fine-tuning of Language Models. In International Conference on Learning Representations, 2022.
Sepanta Zeighami, Ritesh Ahuja, Gabriel Ghinita, and Cyrus Shahabi. A neural database for differentially private spatial range queries. Proceedings of the VLDB Endowment, 15(5):1066 1078, 2022.
Xiaohui Zeng, Arash Vahdat, Francis Williams, Zan Gojeic, Or Litany, Sanja Fidler, and Karsten Kreis. LION: Latent Point Diffusion Models for 3D Shape Generation. In Advances in Neural Information Processing Systems, 2022.
Qinsheng Zhang and Yongxin Chen. Fast Sampling of Diffusion Models with Exponential Integrator. vrXiv:2204.13900 2022.
Linqi Zhou, Yilun Du, and Jiajun Wu. 3D Shape Generation and Completion through Point-V Voxel Diffusion. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
Alexander Ziller, Dmitrii Usynin, Rickmer Braren, Mareus Makowski, Daniel Rueckert, and Georgios Kaissis. Medical imaging deep learning with differential privacy. Scientific Reports, 11(1):1-8 2021a.
Alexander Ziller, Dmitrii Usynin, Nicolas Remerscheid, Moritz Knolle, Marcus Makowski, Rickmer Braren, Daniel Rueckert, and Georgios Kaissis. Differentially private federated deep learning for multi-site medical image segmentation. arXiv:2107.025888 2021b.
15

---

Under review as a conference paper at ICLR 2023
CONTENTS
Introduction
2
Background
2.1 Diffusion Models
2.2
Differential Privacy
3
Differentially Private Diffusion Models
3.1
Motivation
3.2 Training Details, Design Choices, Privacy
4
Related Work
5
Experiments
5.1 Main Results
5.2 Ablation Studies
Conclusions
7 Ethics and Reproducibility
10
Differential Privacy and Proof of Theorem
17
DPGEN Analysis
18
Model and Implementation Details
21
C.1
Diffusion Model Configs
C.I.1 Noise Level Visualization
22
C.2 Model Architecture
22
C.3 Sampling from Diffusion Models.
22
C.3.1 Guidance
23
C.4
Hyperparameters of Differentially Private Diffusion Models
................................
24
Toy Experiments
24
D.1
Training Details
26
Image Experiments
26
E.1 Evaluation Metrics, Baselines, and Datasets
26
E.2
Computational Resources
27
E.3
Training DP-SGD Classifiers
27
E.4
Extended Quantitative Results
27
E.4.1 Noise Multiplicity
27
16

---

Under review as a conference paper at ICLR 2023
E.4.2
Diffusion Model Config
27
E.4.3
Diffusion Sampler Grid Search and Ablation
27
E.5
Extended Qualitative Results
28
F
Rebuttal Discussions
35
F.1
Additional Experiments on Diverse Datasets
35
F2
Additional Experiments at Higher Resolution
35
F3
Concerns Regarding the CelebA Benchmark
F.4 Variance Reduction via Noise Multiplicity
36
A DIFFERENTIAL PRIVACY AND PROOF OF THEOREM 1
In this section, we provide short proof that the gradients released by the Gaussian mechanism in DPDM are DP. By DP, we are specifically refering to the (e, 6)-DP as defined in definition 2.1, which approximates (E)-DP. For completeness, we state the definition of Rényi Differential Privacy (RDP) (Mironov, 2017):
Definition A.1. (Rényi Differential Privacy) A randomized mechanism M D - R with domain D and range satisfies (a, c)-RDP if for any adjacent d, d' e D:
(a(M( Sc,
where Dr the Rényi divergence order a.
Gaussian mechanism can provide RDP according to the following theorem:
Theorem (RDP Gaussian mechanism (Mironov, 2017)) For query function with Sensitivity S maxa,d [If fd') the mechanism that releases f(d) + N op)) satisfies (a, a.2 /(202)((2))))))))))))))))))))/)
RDP.
Note that any . that satisfies (a, RDDD also satisfies (e+ log 1/8
a-1 8)-DP.
We slightly deviate from the notation used in the main text make the dependency of variables input data explicit. Recall from the main text that the per-data point loss computed as an average over K noise samples:
K Σ A(oa)) Do(x + Dike oa) x,113, where (Gii 1 (0,0)) K
i--
(9)
In each iteration of Alg. 1, we are given (random) set of indices B of expected size B with no repeated indices, from which we construct mini-batch {x In our implementation (which is based on Yousefpour et al. (2021)) of the Gaussian mechanism for gradient sanitization, we compute the gradient of I and apply clipping with norm C, and then divide the clipped gradients by the expected batch size B to obtain the batched gradient Ghatchi
Gbaton Gbatoh((x; (fx;lveB) = = Ec D clipe (Vol(x;))-
1
(10)
iEB
Finally, Gaussian noise z ~ N(0,00p) is added to Gbatch and released as the response Gbatch:
C. B² z ~~0,00,3
Gratch (x:)ie)) Ghatch (antet(((sr) ((x:)ie)) +
(11)
Now, restate Theorem as follows with modified notation:
Theorem 3. For noise magnitude ODP, dataset d = [x, and set of (non-repeating) indices IB,
releasing Goatch (e))) satisfies a -RDD. RRDP.
17

---

Under review as a conference paper at ICLR 2023
Proof.
Without loss of generality, consider two neighboring datasets d = (x+ ) and d' = d U'', & d. and mini- batches (x, heB and x' U (x, heB. where the counter-factual set/batch has one additional entry x'. We can bound the difference of their gradients in L2 -oom as:
| ((x: (xi)iEn) - Ghatch (x' (xi)ien))l
Σ clipe (Vol(x.))
B clipo (Vol(x)))
Σ clipe (Vol(x))) iE3
clipo (Vol(x'))
B
C
= lclipe (Vol(x'))l -
B
We thus have sensitivity S(Cootoh) - Furthermore, since z N(O, oB)) (C/B)z ~ N(O, (C/B))opp)
Following standard arguments, releasing Gbatch ((x: hieB) Gbatch (Hx; (te)) + (C/B)z satisfies (a.a/ a 22 ) RDDP (Mironov, 2017).
In practice, we construct mini batches by sampling the training dataset for privacy amplification via Poisson Sampling (Mironov et al., 2019), and compute the overall privacy cost of training DPDM via RDP composition (Mironov, 2017). use these processes as implemented in Opacus (Yousefpour al., 2021).
For completeness, we also include the Poisson Sampling algorithm Alg. 2.
Algorithm 2 Poisson Sampling
Input:
Index range N. subsampling rate q
Output: Random batch of indices B (of expected size B)
B jije (I..,, 1)
B DPGEN ANALYSIS
In this section, we provide a detailed analysis the privacy guarantees provided in DPGEN (Chen et al., 2022).
As brief overview, Chen al. (2022) proposes to learn an energy function (x) by optimizing the following objective (Chen et al. (2022), Eq. 7):
1 - E Ex
x -
((0:a)
V log go
0²
In practice, the first expectation is replaced by averaging
examples in private training set o is replaced by di = (ū; - xt/ - for each in [1 (not
m.. J, and ž-ي to be confused with which denotes the dataset the DP context), where xf is the query response produced by a data-dependent randomized response mechanism.
d = {x; 2t E Y, E 1, 1,...,
We believe that there are three errors in DPGEN that renders the privacy gurantee in DPGEN false. We formally prove the first error in the following section, and state the other two errors which are factual but not mathematical. The three errors are:
The randomized response mechanism employed in DPGEN has a output space that is only supported (has non-zero probability) on combinations of its input private dataset. e-differential privacy cannot be achieved outcomes with non-zero probability' can have zero probability when the input dataset is changed by one element. Furthermore, adversaries observing the output can immediately deduce elements of the private dataset.
prohhaiility over randomness the privacy mechanism
18

---

Under review as a conference paper at ICLR 2023
The k-nearest neighbor filtering used by DPGEN to reduce the number of candidates for the randomized response mechanism is a function of the private data. The likelihood of the k-selected set varies with the noisy image è (line 20 of algorithm in DPGEN), and is not correctly accounted for in DPGEN.
The objective function used train the denoising network in DPGEN depends on both the ground-truth denoising direction and noisy image provided to the denoising network. The noisy image is dependent on the training data, and hence leaks privacy. The privacy cost. incurred by using this noisy image is not accounted for in DPGEN.
To prove the first error, we begin with re-iterating the formal definition differential privacy (DP); Definition B.1. (e-Differential Privacy) A randomized mechanism M D - I with domain D and image Z satisfies (e)-DP if for any two adjacent inputs d, d' E 'D differing by at most one entry, and for any subset of outputs 5 C I it holds that
Pr [r[M(d) E S S Pr(M(d)) E].
(12)
The randomized response (RR) mechanism is a fundamental privacy mechanism in differential privacy. key assumption required in the RR mechanism is that the choices of random response are not dependent on private information, such that when a respondent draws their response randomly from the possible choices, private information given. More formally, we give the following definition for randomized response over multiple choices?:
Definition B.2. Given fixed response set of size Let d {ax : xy E Y I,..., m) be an input dataset. Define "randomized response" mechanism RR as:
RR(d) (G(zz)
(13)
where,
Iú with probability 5++-- of E Y \ 24, with probability 2++
G(æz)
(14)
classical result is that the mechanism RR satisfies e-DP (Dwork al., 2014).
DPGEN considers datasets of the form d = {.; : I; E R", E 1,..., m). It claims to guarantee differential privacy by applying a stochastic function to each element of the dataset defined as follows (Eq. 8 of Chen et al. (2022)):
Pr(H((:) =w]
tk
c + W = o E
where X = {xx mar(ā; k,)/o; S 3, E d} (max is over the dimensions of ã; xz). [X] = k 2 2, and ã. x, + 2,, 24 o2) We first note that H is not only a function of I; but also X L xg. since its image is determined by X H,, That is, changes in X will alter the possible outputs of H, independently from the value of ã;. We make this dependency explicit in our formulation here-forth. This distinction is important as it determines the set of possible outcomes that we need to consider for in the privacy analysis. The authors also noted that 2; is added for training with the denoising objective, not for privacy, so this added Gaussian noise is not essential to the privacy analysis. Furthermore, since & (or equivalently B3) is hyperparameter that can be tuned, consider the simpler case where k = m, i.c. X = d, as done in the appendix (Eq. 9) by the authors. Thereby we define the privacy mechanism utilized in DPGEN as follows:
Definition B.3. Let d = {I; : x E R", i E 1,...,m. be an input dataset. Define "data dependent randomized response" M as:
M(d) = (H hep.
(15)
where,
Ir, with probability
H d)
6-4m-
(16)
x/ E d Iy, with probability e
"This mechanism is analogous to coin flipping mechanism, where the participant first flip a biased coin to determine whether they'll Il answer truthfully or lie with probability of lying -प.- and if they were to lie, they then roll fair dice determine the response.
19

---

Under review as a conference paper at ICLR 2023
Since the image of H d) is d, M(d) is only supported d't In other words, the image of M is data dependent, and any outcome O (which are sets of I"" tensors, of cardinality m) that include elements which are not in d would have probability of zero to be the outcome of M(d), i.. if there exists = E O and 2 E d, then (r( = 0) = 0.
To construct data = {z: 2; E R", i l...., m) and a counter-facture dataset d' = = z E IR", 24 : I E R", , E 2, ....... m, differing in their first element (x1 A x1). Importantly, since differential privacy
counter-example,
start with considering two neighboring datasets: the training
requires that the likelihoods of outputs to be similar for all valid pairs of neighboring datasets, we are free assume that elements of d are unique, i.e. no two rows of d are identical.
Another requirement of differential privacy is that the likelihood of any subsets of outputs must be similar, hence we are free to choose any valid response for the counter-example. Thus, letting O denote the outcome of M(d), we choose O= = d = {-1, .......::. ..m. J. Clearly, by Definition 0.3, this is a plausible outcome of M(d) as it is in the support d However, O is not in the support of Mdd)) since the first element 21 is not in the image of H-,, ,d';; that is Pr H (z, d') = xi] = 0 for all a E d'. Privacy protection is violated since any adversary observing O can immediately deduce the participation of xı in the data release opposed to any counterfactual data 2'1.
More formally, consider response set T {0} C d and dm is the image of M(d), we have
Pr(M(d) E T = Pr[MM(d) 0]
(17)
m
Pr([l( = xi] II (x:) x;]
(independent dice rolls)
(18)
Pr[H(x;:= = mx:
(apply definition B.3)
(19)
et m
Pr(H(<;) =
(00)
E=
m
Pr|HH(a)) = x II (x) x;] 2=2
(21)
Pr[M((d) = 0J = Pr(M(dd) TT.
(22)
TT]= We can observe that Pr(M(dd) E ET] = 0, as shown in line 9, Clearly, this result violates c-DP for all e, which requires Pr[M(d) E T) S Pr[M(d') E T].
In essence, by using private data to form the response set, make the image of the privacy mechanism data-dependent. This in turn leaks privacy, since an adversary can immediately rulc-out all founter-factual datasets that do not include every element of the response O, as these counter- factuals now have likelihood O. To fix this privacy leak, one could determine a response set a-priori, and use the RR mechanism in Definition B.2 to privately release data. This modification may not be feasible in practice, since constructing a response set of finite size (k) suitable for images is non-trivial, Hence, we believe that it would require fundamental modifications to DPGEN to achieve differential privacy.
Regarding error we point out that in the paragraph following Eq. 8 in DPGEN, X is defined as the set of k points in d that are closest to ã; when weighted by J,. This means that the membership of X is dependent on the value of ã. Thus, any counter-facture input a and & with a different set of k nearest neighbors could have many possible outcomes with 0 likelihood under the true input. In essence, this is a more extreme form of data-dependent randomized response where the response set is dependent on both d and zi.
Regarding error 3. the loss objective in DPGEN (Eq.
of DPGEN, Ep(aa) (N,,N((, [| V. log go (2)] includes the term V, (a)). and ã is also
=
a function of the private data that is yet to be accounted for at all in the privacy analysis of DPGEN.
Hence, one would need to further modify the learning algorithm in DPGEN, such that the inputs to
We mean dataset-oxponentiation in the sense of repeated cartesian products between sets, i.c. d² d d d
20

---

Under review as a conference paper at ICLR 2023
Table 7: Four popular DM configs from the literature.
VP (Song al,, 2021e)
VE (Song et al, 3021e)
y-prodictioo (Salimans Ho, 2023)
Elucidate (Karras al. 2023
Network and preconditionngg
Skip scaling Say(o) 1
11
alaud (o? + toi))
Output scaling Gau(o)
o/vi+o
Vou
Inpet scaling (,(0)
1T
1/
1/v02 %an f (n((r)
Noise cond. (o)
(M t)e
In()er
Training
Noise distribution
1)),).11)
In(e)) In In(aaa))
In(s) ~ (F Pia) (o" ( for aaul
Loss weightnng M()
1/6²
1/ar²
(o" 1) /o"
Parumeters
19.9 Aus
1.2, 1.2 vB
111 M.M 1000
Vise
-(0]= Vetueunn-1
o(d)
cos [[T//2]
the score model are either processed through an additional privacy mechanism, or sampled randomly without dependence on private data.
Regarding justifying the premise that DPGEN implements the data-dependent randomized response mechanism, we have verified that the privacy mechanism implemented the repository of DPGEN (https:/ /tgttgggttttutttttt thub. com/ chiamuyu/DPGEN) is indeed data-dependent:
In line 30 of lossessssdde /iaiees/dss.pp.
sample_ix random. choices (range (k) wei.ghts=weight) [0]
randomly selects index in the range of [0, k - 1]. which is then used in line 46
sample appeed (samples [sample_iss ix)) )
to index the private training data and assigned to the output of
sample_ buffff.
Values of this variable are then accessed line 85 calculate the 2-4 (as x²) term in the objective function (Chen et al. (2022), Eq. 7).
C MODEL AND IMPLEMENTATION DETAILS
C.1 DIFFUSION MODEL CONFIGS
As discussed in Sec. 2, previous works proposed various denoiser models Dø, noise distributions p(a), and weighting functions X(r). We refer the triplet (Da, p. A) DM config. In this work, we consider four such configs: variance preserving (VP) (Song et al., 2021c), variance exploding (VE) (Song et al., 2021c), v-prediction (Salimans & Ho, 2022), and the config introduced in Karras et al. (2022) (referred to as Elucidate in this work). The triplet for each of these configs can be found in Tab. 7. Note, that we use the parameterization of the denoiser model De from (Karras al., 2022)
Dx(x;a) Ca) + Cout Fo (c.n (a)x; Cnniso(r)),
(23)
where Fg is the raw neural network. To accommodate for particular sampler setting (we require to learn the denoiser model for a E [0.002, 80]; see App. C.3) we slightly modified the parameters of VE and v-prediction. For VE, changed Jmin and Fmax from 0.02 to 0.002 and from 100 to 80, respectively. For v-prediction, we changed Emin and émax from 2 arccos Vitc 20
to 2 arccos - and arccos Vi+e2u to 2 arccos -جا respectively. Furthermore, we cannot base our Elucidate models on the true (training) data standard deviation ddata as releasing this information would result in a privacy cost. Instead, we set daata to the standard deviation of uniform distribution between - and 1, assuming no prior information on the modeled image data.
IIn particular, we refer the code at commit: 16644aaass8sttt00000aaaa00000000
21

---

Under review as a conference paper at ICLR 2023
Table 8: Model hyperparameters and training details.
Hyperparameter
MNIST & Sashion-MNIST
CelebA
Model
Data dimensiioality (in pixels)
Residual blocks per resolution
2
2
Attention resolution(s)
8,16
Base channels
32
Channel multipliers
1,2,2
1,2,2
EMA rate
0.999
0.999
of parameters
1.75M
1.80M
Base architecture
DDPM+ (Song al., 2021c)
DDPM+ (Song al., 2021c)
Training
of epochs Optimizer
300
300
Adam (Kingma & Ba, 2015)
Adam (Kingma & Ba, 2015)
Learning rate
3 10 44
3 10
Batch size
4096
2048
Dropout
Clipping constant
DP-8
10 10-5
10"
C.I.1 NOISE LEVEL VISUALIZATION
In the following, we provide details on how exactly the noise distributions of the four configs are visualized in Fig. 3. The reason we want to plot these noise distributions is to understand how the different configs assign weight different noise levels a during training through sampling some a's more and others less. However, to be able to make meaningful conclusion, we also need to take into account the loss weighting ((r).
Therefore, we consider the effective "importance-weighted"" distributions p(o) the loss weighting from the Elucidate config reference weighting.
((Bucidonoo))) where we
A(o)
The A(a)
XElucidaca [a] weightings for VP, VE, v-prediction, and Elucidate then, olataa(o" -0 a. d (a² + dataa) (o² +
+ da and 1, respectively. Fig. 3 then visualizes the "importance "epporraceeweeighted" distributions in log-o space, following Karras et al. (2022) (that way, the final visualized log-o distribution of Elucidate remains normal distribution ( p2a)
1)/(o²
C.2 MODEL ARCHITECTURE
We focus image synthesis and implement the neural network backbone of DPDMs using the DDPM+ architecture (Song et al., 2021c). For class-conditional generation, we add a learned class-embedding the a-embedding is common practice (Dhariwal & Nichol, 2021). All model hyperparameters and training details can be found in Tab. 8.
C.3 SAMPLING FROM DIFFUSION MODELS
Let us recall the differential equations we can use to generate samples from DMs:
ODE: dx ((t)
(24)
SDE: dx =
V
(23(t)o(t) dut.
(25)
Before choosing numerical sampler, we first need define a sampling schedule. In this work, follow Karras et al. (2022) and use the schedule
(ollee
o
P E (0...... .O..... M 1},
(26)
M
22

---

Under review as a conference paper at ICLR 2023
with p=7.0, mmax and min =0.002. We consider two solvers: the (stochastic/dletemminsttt DDIM solver (Song et al., 2021a) as well as the stochastic Churn solver introduced in (Karras et al., 2022), for pseudocode
Alg. 3 and Alg. 4, respectively. Both implementations can readily be combined with classifier-free guidance, which is described in App. C.3.1, in which case the denoiser Do(x; o) may be replaced by D (x; o, .)., where the guidance scale is hyperparameter. Note that the Churn sampler has four additional hyperparameters which should be tuned empirically (Karras al., 2022). If not stated otherwise, set M =100 for the Churn sampler and the stochastic DDIM sampler, and =5 for the deterministic DDIM sampler.
Algorithm 3 DDIM sampler (Song et al., 2021a)
Input: Denoiser Do(x; a), Schedule (oi).cto.....
Output: Sample XM Sample x ~ / (0, 06 r) for to
Evaluate denoiser d.. = Da(x;, 0:) if Solving SDE then
Xx+-1 Xa + 2 -2" (Xa - dn.) + 2( - ont1)onbn. 2n ~N~100
else if Solving ODE then
Xn+1 Xn an
Pett-da
(xn dn)
end if end for Return XM D(XN-1,OM-)
Algorithm 4 Churn sampler (Karras al., 2022)
Input: Denoiser (x o), Schedule {o:) co.....a-113 13. Snoise, Schurn Sming Smax Output: Sample X.M Set dM =
Sample Xo ~ / (0, o2
for ( to M do
if [Smin; Smax then
7: min( Sahurn
22
else
7:
end if
Increase noise level on = + 7m
Sample 2. (0, S Shoiso and Nn xn
Vol of
Evaluate denoiser d., Do("n, and set fn
on
Xo+1 &M (an+1 G..]f,
o1o+11 * 0 then
Evaluate denoiser d', = Do(x.t1, (x4x411,041) and set Py X.t1
Apply second order correction: X,+1 R 11(0+11 (f. f.)
end if
Return XM
C.3.1 GUIDANCE
Classifier guidance (Song et al., 2021c; Dhariwal & Nichol, 2021) is technique to guide the diffusion of
sampling process towards partieular conditioning signal y using gradients, with respect pre-trained, noise-conditional classifier p(y x, r). Classifier-free guidance (Ho & Salimans, 2021), contrast, avoids training additional classifiers by mixing denoising predictions of unconditional and a conditional model, according to a guidance scale w, by replacing Do (xx o) in the score parameterization so (Do(x;o) -x)/o* with
(x;o,) (1 w) Do(x;o) w wDo(x;o,))
(27)
23

---

Under review as a conference paper at ICLR 2023
Table 9: DP noise DP used for all our experiments.
MNIST
Fashion-MNIST
CelebA
0.2
82.5
82.5
N/A
18.28125
18.28125 2.48779
8.82812 1.30371
10
2.48779
(a) Data Pasta
(b) Samples from DM.
(c) Samples from GAN.
Figure 6: Mixture of Gaussians: data distribution and (IM) samples from DM well GAN.
Our visualization based on the log-hise higthisto,rmm, which shows single data points as black dots.
Dø(x; o)) and Dx(x; y)) can be trained jointly; to train (x o the conditioning signal y is discarded at random and replaced by a null token (Ho & Salimans, 2021). Increased guidance scales tend to drive samples deeper into the model's 's modes defined by y at the cost of sample diversity.
C.4 HYPERPARAMETERS OF DIFFERENTIALLY PRIVATE DIFFUSION MODELS
Tuning hyperparameters for DP models generally induces a privacy cost which should be accounted for (Papernot & Steinke, 2022). Similar to existing works (De et al., 2022), we neglect the (small) privacy cost associated with hyperparameter tuning. Nonetheless, in this section we want to point out that our byperparameters show consistent trends across different settings. As a result, we believe our models need little to hyperparameter tuning in similar settings to the ones considered in this work.
Model. We use the DDPM+ (Song et al., 2021c) architecture for all models in this work. Across all three datasets (MNIST, Fashion-MNIST, and CelebA) found the Elucidate (Karras al., 2022) DM config to perform best for (= 10). On MNIST and MNISS, we use the v-prediction config for 0.2 (not applicable CelebA).
DP-SGD training. In all settings, we use 300 epochs and clipping constant C=1, We use batch size B-4096 for MNIST and Fashion-MNIST and decrease the batch size of CelebA B-2048 for the sole purpose of fitting the entire batch into GPU memory. The DP noise aDp values for each setup can be found in Tab.
DM Sampling. We experiment with different DM solvers in this work. We found the DDIM sampler (Song et al., 2021a) (in particular the stochastic version), which does have any hyperpa- rameters (without guidance), to perform well across all settings. Using the Churn sampler (Karras al., 2022), we could improve perceptual quality (measured in FID), however, out of the five (four without guidance) hyperparameters, we only found two (one without guidance) to improve results significantly. We show results for all samplers App. E.5.
D TOY EXPERIMENTS
In this section, we describe the details of the toy experiment from paragraph (ii) Sequential denoising in Sec. 3.1. For this experiment, we consider a two-dimensional simple Gaussian mixture model of the form
Pdata (x)
Σ 9 (x)
(28)
1=
24

---

Under review as a conference paper at ICLR 2023
Table 10: h-standard deviation vicinity metric as defined in the paragraph Fitting of App. D.
h
Data
DM
GAN
1
39.4
37.2
56.8
2
86.5
83.3
95.3
3
98.9
97.7
98.9
4
100
99.8
99.3
5
100
100
99.6
6
100
100
99.9
where (x) = (xx; pa; o and
aa/2
0
p1 =
142
a/2
,
a
a/2
0
2
P11
a/22
14
0
P6
0 2
0/2
p47 =
148 =
aa/2)
where d. 1/25 and a = 1/v2. The data distribution is visualized in Fig. 6a.
Fitting. Initially, we fitted DM as well as GAN to the mixture of Gaussians. The neural networks of the DM and the GAN generator use similar ResNet architectures with 267k and 264k (1.1% % smaller) parameters, respectively (see App. D.1 for training details). The fitted distributions are visualized in Fig. 6. In this experiment, we use deterministic DDIM (Alg. 3) (Song et al., 2021a), numerical solver for the Probability Flow ODE (Eq. (1)) (Song et al., 2021c), with 100 neural function evaluations (DDIM-100) as the end-to-end multi-step synthesis process for the DM. Even though our visualization shows that the DM clearly fits the distribution better (Fig. 6), the GAN does not do bad either. Note that our visualization is based on the log-histogran of the sampling distributions, and therefore puts significant emphasis on single data point outliers.
We provide a second method to assess the fitting: In particular, we measure the percentage of points (out of IM samples) that within h-standard deviation vicinity of any of the nine modes. A point x is said to be within h-standard deviation vicinity of the mode μ4 if ||x p < hao- We present results for this metric in Tab. 10 for h- 3, 4, 5, 6). Note that any mode deviations separated to the next mode, and therefore no point can be in the h-standard deviation vicinity of more than two modes for h S 6.
least 12.5 standard
The results in Tab. 10 indicate that the GAN is slightly too sharp, that is, it puts too many points within the 1- and 2-standard deviation vicinity of modes. Moreover, for larger h, the result in Tab. 10 suggests that the samples in Fig. 6c that appear to "connect" the GAN's modes are heavily overemphasized- these samples actually represent less than 1% of the total samples; 99.3% of samples are within 4-standard deviation vicinity of mode while modes are at least 12.5 standard deviations separated.
Complexity. Now that we have ensured that both the GAN as well as the DM the target distribution reasonably well, we can measure the complexity of the DM denoiser D, the generator defined by the GAN, as well as the end-to-end multi-step synthesis process (DDIM-100 100) of the DM. particular, measure the complexity of these functions using the Frobenius norm of the Jacobian (Dockhorn et al., 2022b). In particular, we define
IF(o) = Exxp(x, Vx 1)
(29)
Note that the convolution of mixture of Gaussian with i.i.d. Gaussian noise is simply the sum of the convolution of the mixture components, i.e.,
p(x; 0) (pdata * N (O, (x)
(30)
N(x: Ms; o/ o²).
(31)
25

---

Under review as a conference paper at ICLR 2023
We then compare (o) with the complexity of the GAN generator (S1) and the end-to-end synthesis process of the DM (S2). In particular, we define
JF = Ex-AA((on) ( (x)(( E {1,2}.
(32)
We want to clarify that for S2 we do not have to backpropagate through an ODE but rather through its discretization, i.e., deterministic DDIM with 100 function evaluations (Alg. 3), since that is how we define the end-to-end multi-step synthesis process of the DM in this experiment. Furthermore, we chose the latent space of the GAN be two-dimensional such that (x) E R2x2 for both the GAN and the DM; this ensures a fair comparison. The final complexities are visualized in Fig. 2.
D.1 TRAINING DETAILS
DM training. Training the diffusion model is very simple. We use the Elucidate config and train for 50k iterations (with batch size B B-256) using Adam with learning rate 3 10-1, We use EMA rate of 0.999.
GAN training. Training GANs on two-dimensional mixture of Gaussians is notoriously difficult (see, for example, Sec. 5.1 in (Yazıcı et al., 2019)). We experimented with several setups and found the following perform well: We train for 50k iterations (with batch size B=256) using Adam with learning rate 3 10 and (31 =8.00.0, 82 = 0.9) for both the generator and the discriminator. Following YAZICI et al. (2019),
use EMA (rate of 0.999 in the DM). We found it crucial to make the discriminator bigger than the generator; in particular, we use twice as many hidden layers in the discriminator's ResNet. Furthermore, we ReLU and LeakyReLU for the generator and the discriminator, respectively.
E IMAGE EXPERIMENTS
E.1 EVALUATION METRICS, BASELINES, AND DATASETS
Metrics. We measure sample quality via Fréchet Inception Distance (FID) (Heusel al., 2017). We follow the DP generation literature and use 60k generated samples. The particular Inception-v3 model used for FID computation is taken from Karras et al. (2021)². S. On MNIST and Fashion-MNIST, we follow the standard procedure of repeating the channel dimension three times before feeding images into the Inception-v3 model.
On MNIST and MaShi we additionally assess the utility of generated data by training classifiers on synthesized samples and compute class prediction accuracy on real data. Similar to previous works, we consider three classifiers: logistic regression (Log Reg), MLP, and CNN classifiers. The model architectures are taken from the Si-Sinnhorn repository (Cao et al., 2021).
For downstream classifier training. we follow the DP generation literature and use 60k synthesized samples. We follow Cao et al. (2021) and split the 60k samples into a training set (90%) and validation set (remaining 10%). We train all models for 50 epochs, using Adam with learning rate 3 10-4, We regularly save checkpoints during training and use the checkpoint that achieves the best accuracy on the validation split for final evaluation. Final evaluation is performed on real, non-synthetic data. We train all models for 50 epochs, using Adam with learning rate 10-4
Baselines. We run baseline experiments for PEARL (Liew et al., 2022). In particular, we train We confirmed that our models match
models for <=, 1, 10) on MNIST and Fashion-MNISS the performance reported in their paper. In fact, our models perform slightly better (in terms of the LeNet-FID metric Liew et al. (2022) uses). We then follow the same evaluation setup (see Metrics above) for our DPDMs. Most importantly, we use the standard Inception setwork-based FID calculation, similarly as most works in the (DP) image generative modeling literature.
Datasets. We use three datasets in this work: MNIST (LeCun et al., 2010), MaSHIOn-MNIST (Xiao et al., 2017) and CelebA (Liu et al., 2015).
26

---

Under review as a conference paper at ICLR 2023
Table 11: Noise multiplicity ablation on MNIST and Fashion-MNIST..
MNIST
Fashion-MNIST
K
Acc (%)
Acc (%)
FID
FID
Log Reg
MLP
CNN
Log Reg
ML.P
CNN
1
76.9
84.2
87.5
91.7
72.5
76.0
76.3
75.9
2
60.1
84.8
88.3
93.1
61.4
76.7
77.0
77.4
4
57.1
85.2
88.0
92.8
61.1
76.7
77.2
77.0
8
44.8
86.2
89.2
94.1
58.2
75.2
76.3
77.4
16
36.9
86.0
89.8
94.2
58.5
77.0
77.4
78,8
32
34.8
86.8
90.1
94.4
57.7
76.4
77.0
77.1
E.2 COMPUTATIONAL RESOURCES
For experiments, we use an in-house GPU cluster of V100 NVIDIA GPUs. eight GPUs, models MNIST and Fashion-MNIST trained for roughly one day and models CelebA for roughly four days. We tried to maximize performance by using a large number of epochs, which results in good privacy-utility trade-off, well high noise multiplicity; this results in relatively high training time (when compared to existing DP generative models).
Models with very little drop in downstream accuracy be trained in much less time by decreasing the noise multiplicity: for example, on MNIST for æ=1, the CNN-classifier accuracy only drops by 2.7% (from 94.4% to 91.7%) when decreasing K 32 K (32-fold speed-up); Tab. 11. On the other hand, the FID metric suffers considerably when decreasing the noise multiplicity.
E.3 TRAINING DP-SGD CLASSIFIERS
We train classifiers on MNIST and Fashion-MNIST" using DP-SGD directly. We follow the setup used for training DPDMs. in particular, batchsize B 4096, 300 epochs and clipping constant C' 1. Recently, De et al. (2022) found EMA to be helpful training image classifiers: we follow this suggestion and use an EMA rate of 0.999 (same rate used for training DPDMs).
E.4 EXTENDED QUANTITATIVE RESULTS
In this section, we show additional quantitative results not presented in the main paper. In particular, we present extended results for all ablation experiments.
E.4.1 NOISE MULTIPLICITY
In the main paper, we present noise multiplicity ablation results on MNIST with c=1 (Tab. 3). All results for MNIST and MasSIon-MNIST on all three privacy settings 1, can be found Tab. 1I.
E.4.2 DIFFUSION MODEL CONFIG
In the main paper, we present DM config ablation results on MNIST with 6=0.2 (Tab. 3). All results for MNIST and FaSHion-MNIST on all three privacy settings (==(0.2, 1, 10}) can be found in Tab. 12.
E.4.3 DIFFUSION SAMPLER GRID SEARCH AND ABLATION
Churn sampler grid search. We run a small grid search for the hyperparameters of the Churn sampler (together with the guidance weight for classifier-free guidance). For MNIST and MaSIIOn-MNIST on E-0.2 we run a two-stage grid search. Using Smin=0.05, Smax=50, and =1 which we found to be sensible starting values,
initial grid search [0 0.125, 0.25, 0.5, 1.0, 2.0} and = 5, 10, 25, 50, 100, 150, 200). which we found to be the most critical hyperparameters of the Churn sampler. Afterwards,
second
27

---

Under review as a conference paper at ICLR 2023
Table 12: DM config ablation.
MNIST
Fashion-MNIST
Method
DP-c
Acc (96
Acc (9)
FID
Log Reg
MLP
CNN
Log Reg
MLP
CNN
VP (Song al., 2021c)
0.2
197
23.1
25.5
24.2
146
49.7
51.6
51.7
VE (Song al., 2021c)
0.2
171
17.9
15.4
13.9
178
22.2
27.9
49.4
V- V-prediction (Salimans Ho, 2022)
0.2
97.8
80.2
81.3
84.4
115
71.3
70,9
71.8
Elucidate (Karras al., 2022)
0.2
119
62.4
67.3
49.2
93.5
64.7
65.9
66.6
VP (Song 2021c)
82.2
59.4
69.3
72.6
73.4
68.3
70.4
72.7
VE (Song al., 2021c)
165
17.9
20.5
26.0
156
30.7
36.0
49.8
V-prediction (Salimans Ho, 2022)
34.8
86.8
90.1
94.4
57.7
76.4
77.0
77.1
Elucidate (Karras al. 2022)
34.2
86.2
90.1
94.9
47.1
77.4
78.0
79.4
VP (Song al., 2021c)
10
12.3
88.8
94.1
97.0
22.3
81.2
81.6
84.5
VE (Song al., 2021c)
10
88.6
48.0
56.9
63.8
83,2
69.0
70.4
75.4
V-prediction (Salimans & Ho. 2022)
10
7.65
90.4
94.4
97.7
23.1
82,0
83.7
85.5
Elucidate (Karras al., 2022)
10
6.13
90.4
94.6
97.5
17.4
82.6
84.1
86.2
Table 13: Diffusion sampler comparison. We compare the Churn sampler (Karras et al., 2022) to stochastic and determistic DDIM (Song al., 2021a).
MNIST
Fashion-MNIST
Sampler
DP-s
Acc (%)
Acc (%)
FID
FID
Log Reg
MLP
CNN
Log Reg
MLP
CNN
Churn (FID)
0.2
61.9
65.3
65.8
71.9
78.4
53.6
55.3
57.0
Churn (Acc)
0.2
104
81.0
81.7
86.3
128
70.4
71.3
72.3
Stochastic DDIM
0.2
97.8
80.2
81.3
84.4
115
71.3
70.9
71.8
Deterministic DDIM
0.2
120
81.3
82.1
84.8
132
71.5
71.6
71.8
Churn (FID)
23.4
83.8
87.0
93.4
37.8
71.5
71.7
73.6
Churn (Aec)
35.5
86.7
91.6
95.3
51.4
76.3
76.9
79.4
Stochastic DDIM
34.2
86.2
90.1
94.9
47.1
77.4
78.0
79.4
Deterministic DDIM
50.4
85.7
91.8
94.9
60.6
77.5
78.2
78.9
Churn (FID)
10
5.01
90.5
94.6
97.3
18.6
80.4
81.1
84.9
Churn (Acc)
10
6.65
90.8
94.8
98.1
19.1
81.1
83.0
86.2
Stochastic DDIM
6.13
90.4
94.6
97.5
17.4
82.6
84.1
86.2
Deterministic DDIM
10
10.9
90.5
95.2
97.7
19.7
81.9
83.9
86.2
grid search over Snoise 1.005]000 Smin=(0.01. 0.02, 0.05, 0.1, 0.2). and =max= 50, 80} us- ing the best (w, Sehurn) setting for each of the two models. For MNIST and Fashion-MNIST on (1 10}, we ran a single full grid search over w= 0.25, 0.5, 1.0, 2.0), Schurn (10, 25, 50, 100). and Smin (0.025, 0.05, 0,1, 0.2) while setting Snoise 11 For CelebA, both e=1 and ==10, we also ran single full grid search over Schum (550, 100, 150, 200), and Smin =min= 0.05) while setting =1 The best settings for FID metric and downstream CNN accuracy can be found in Tab. 14 and Tab. 15, respectively.
Throughout all experiments we found two consistent trends that are listed in the following:
If optimizing for FID, set Schurn relatively high and Smin relatively small. Increase Seburn and decrease Smin as is decreased.
If optimizing for downstream accuracy, set Schrrn relatively small and Smin relatively high.
Sampling ablation. In the main paper, we present sampler ablation for MNIST (Tab. 6). Results for Fashion-MNIST (as well as) MNIST can be found in Tab. 13.
E.5 EXTENDED QUALITATIVE RESULTS
In this section, we show additional generated samples by our DPDMs. On MNIST, see Fig. 7, Fig. and Fig. for c=10, 10, 1=1, and c=0.2, respectively. On Fashion-MNIST, see Fig. 10, Fig. 11, and
28

---

Under review as a conference paper at ICLR 2023
Table 14: Best Churn sampler settings for FID metric.
MNIST
Fashion-MNIST
CelebA
Parameter
0.2
s=1
E=10
E=0.2
E=1
E=10
E=10
0
0.25
2
0.25
N/A
N/A
Sehurn
200
100
50
150
50
25
200
50
Smin
0.01
0.05
0.05
0.02
0.025
0.2
0.005
0.005
Smax
50
50
50
10
50
50
50
50
Snoise
1
1
Table 15: Best Churn sampler settings for downstream CNN accuracy.
MNIST
Fashion-MNIST
Parameter
0-0.2
c=1
c=10
8-0.2
c=1
E= 10
0.125
0
0
0.125
0
churn
5
10
10
min
0.2
0.1
0.025
0.02
0.025
0.1
max
50
50
80
50
50
Sooise
1.005
1
1.005
Fig. 12 for g=10, and c-0.2, respectively. On CelebA, see Fig. 13 and Fig. 14 for e=10 and 8=1, respectively.
29

---

Under review as a conference paper at ICLR 2023
0
/
2
3
4
5
6
7
8
9
0
1
3
4
5
8
9
0
2
3
4
5
6
7
8
O
1
2
3
6
7
8
9
0
2
4
7
8
9 9
O
1
2
4
5
7
8
9
0 1 2
5
6
7 8 8
Q
1
22332
4
5
7
8
0
2
5
6
O
/
3
8
9 9
0
2
4
6
7
8 8
9 9
O
23
6
8
0 1
2
3
4
6
7
O
1
2
3
/
5
6
7 7
8
0
1
2
3
4
6
7
8
9
0
1
2
4
5
6
9
0
1
2
3
4
6
7 7
8
O
1 /
2
3
5
6
3 8
0
3
4
5
6
9
O
1
5
?
O
/
Q
3
4
5
6
7 7 7
8
9
O
1 1
2
3
4
5
7 5
K
2 8 8
9 9 9 9 7 9 9 9 9
0
0
3
4
8
6
8 8 8
0
3
3
4
5
0
1
2
4
6
O
2
4
6
7
0
1
2
3
4
5
7
7 9
0
1
2
4
5
7
8
0
/
a
3
4
5
6
8
0
1
3
4
5
6
7
8
O
1
3
4
6
1
3 8
9
C
2
3
4
5
6
8 8
O
4
6
7
0
1
2
4
5
7
0
0
3
4
5
7
9
0
2
3
4
5
6
7
8
0
1
2
3
4
5
6
7
5
9
17
1
2
3
4
5
6
8
0
/
2
4
5
6
7
8
2
5
8 9
Figure 7: Additional images generated by DPDM MNIST for ==10 using Churn (FID) (top left),
Churn (Ace) (top right), stochastic DDIM (bottom left), and deterministic DDIM (bottom right).
0
1
3
4
5
6
7
8
D
1
0
5
4
7
2
9
0
1
2
3
9
6
6
8
D
3
5
9
0
2
4
6
7
8
O
2
4
5
4
7
g
9
0
1
2
3
4
6
6
7
8
7
O
1
123
4
7
9 7
2
0
1
2
3
4
5
6
8 8 9
O
/
3
5
6
9 9
O
/
2
4
6
7
O
1
&
4
7 9 7
O
1
4
5
6
7
8 8
9
O
1
2
3
4
5
6
7 7
O
1
3
4
5
6
7
9
O
1
2
3
41
6
9
0
1
2
3
4
5
6
7
8
O
2
3
4
5
3 8
9
0
3
4
5
6
7
4
7
3-1
4
5
O
/
Q
3
4
7 7 7
8 9
0
1
2
3
4
5
& f
7
9 9
0
J
3
4
5
6
8 g 8 7 7
3
0
4
2.
3
0
5
8
0
2
4
4
5 7
O
2
4
5
6
8
O 1
2
3
4
5
7
6
1
2
9
1
5
7
4
9 7
0
/
3
3
4
5
6
7
9
6
I 1
2
4
5
6
0
8
0 1
6
4
4
7
G
2
4
3
6
4
4 4
Q 1
3
4
b
7
2 0
O
1
2
5
7
$
0
3
4
5
6
7
9
0
1
7
4
5
6
7
3 8
9 9
0
1
2
4
(
5
9
7
|
2
7
4
5
0
/
2
3
8
/
7
4
5
&
9
Figure 8: Additional images generated by DPDM on MNIST for 8=1 using Chur (FID) (top left).
Churn (Ace) (top right), stochastic DDIM (bottom left), and deterministic DDIM (bottom right).
30

---

Under review as a conference paper at ICLR 2023
0 |
2 3 4 f. 6
6
1
2
4
5'
2-
9
0 3 1
8
7
F
2
4
7
8
0 17.34
7734667E3
i
P
3 3
4 //
3
6
2
7
R
1 0
O O
I
2
<
0
9 7 3
D 01220067F5
/
3
4
4
7
8 8 7 1 5 L
01234
4
5
4
O 1 122
O J
7
9
4
5
7
D 0173466721
O
I
3
4
9
9
0 012815678)
O
1
0
4
8
7
0 3
333336666 & 6
/
5
J
0 1 Q
3
4
r.
7 7 7
< 7 2 4 7 8 7 7
D
1
2
3
7 5
%.
t i
g 9 ?
0 J
3 3
4
P
1
J.
3
C [
4 Y
4
O
4
2 7
5
5
r 2 3
Q I 7
3
<
f.
7 7
2
J
7
5
4
4 A
O f 2 ]
1
5
6
3
O
I
Y
3
X
4
O 1 $ 3
4
('
7
G
7
7
4
5
C 1
3)
/
L
1
7
Q
1
A
3
5
?
7
8
17 1 2
3
4
E
G
3
4
4
1
7
J
Y
5
4
7
4
0
1
7
2
7
L
7
5
9
Y
/
7
7
1
6
7
2 7
54
3
1
1
]
8
1
/
5
2
8 4
Figure 9: Additional images generated by DPDM on MNIST for ==0.2 using Churn (FID) (top left),
Churn (Acc) (top right), stochastic DDIM (bottom left), and deterministic DDIM (boltom right).
Figure 10: Additional images generated by DPDM on Fashion-MNIST for ==10 using Chur (FID)
(top left), Churn (Acc) (top right), stochastic DDIM (bottom left), and deterministic DDIM (bottom right).
31

---

Under review as a conference paper at ICLR 2023
Figure 11: Additional images generated by DPDM on FaSHion-MNIST for s=1 using Churn (FID)
(top left), Churn (Acc) (top right), stochastic DDIM (bottom left), and deterministic DDIM (bottom right).
Figure 12: Additional images generated by DPDM Fashion-MNIST for s-0.2 using Churn (FID)
(top left), Churn (Acc) (top right), stochastic DDIM (bottom left), and deterministic DDIM (bottom right).
32

---

Under review as a conference paper at ICLR 2023
Figure 13: Additional images generated by DPDM on CelebA for ==10 using Churn (top), stochastic DDIM (middle), and deterministic DDIM (bottom).
33

---

Under review as a conference paper at ICLR 2023
Figure 14: Additional images generated by DPDM on CclebA for ==1 1 using Churn (top), stochastic DDIM (middle), and deterministic DDIM (bottom).
34

---

Under review as a conference paper at ICLR 2023
(a) DPDM (ours) (ImageNet)
(b) DPDM (ours) (CIFAR-I0)
(c)
Figure 15: Additional experiments on challenging diverse datasets. Samples from our DPDM on
ImageNet and CIFAR-IO, well as CIFAR-I0 samples from DP-MERF (Harder et al., 2021) in (c).
F REBUTTAL DISCUSSIONS
In this section, we provide additional content related to questions and concerns raised by the reviewers. the paper will be accepted, we will re-organize the content and integrate some of the discussions here into the main text.
F.1 ADDITIONAL. EXPERIMENTS ON DIVERSE DATASETS
We provide results for additional experiments challenging diverse datasets, namely, CIFAR- 10 (Krizhevsky, 2009) and ImageNet (Deng et al., 2009) (resolution 32x32), both in the class- conditional setting similar our other experiments on MNIST and Fashion-MNIST. To the best of our knowledge, we are the first to attempt pure DP image generation on ImagenNet.
For both experiments, main paper, see model hyperparameters in Tab. 8. On CIFAR-10, we train for 500 epochs using noise multiplicity K 32 under the privacy setting (E 10, 10 10-5). In ImageNet, we train for 100 epochs using noise multiplicity K = 8 under the privacy setting (E 10, 5 = 7 10 ?) given the limited time, training for longer (or using larger K) was not possible on ImageNet due to its sheer size. We achieve FIDs of 97.7 and 61.3 for CIFAR-10 and ImageNet, respectively. No previous works reported FID scores on these datasets and for these privacy settings, but we hope that our scores serve reference points for future work. In Fig. 15, show samples for both datasets from our DPDMs and visually compare to an existing DP generative modeling work on CIFAR-10, MERE (Harder al., 2021). Our DPDMs cannot learn clear objects; however, overall image/pixel statistics seem to be captured correctly. In contrast, the DP-MERF baseline collapses entirely. We are not aware of any other works tackling these tasks. Hence, believe that DPDMs represent a major step forward.
the same neural network architecture for CelebA (32x32) in the
F.2 ADDITIONAL EXPERIMENTS HIGHER RESOLUTION
We provide results for additional experiments on CelebA at higher resolution (64x64). To accom- modate the higher resolution, we added an additional opsamplig/downsampiing layer to the U-Net, which results in roughly 11 11% increase in the number of parameters, from 1.80M to 2.00M parame- ters. The only row that changed in the CelebA model hyperparameter table (Tab. 8) is the one about the channel multipliers. It is adapted from (1,2,2) to (1,2.2.2). We train for 300 epochs using K = 8 under the privacy setting (5 = 10, 5 = 10 10-6). We achieve an FID of 78.3 (again, for reference; no previous works reported quantitative results this task). In Fig. 16, show samples and visually compare to existing DP generative modeling work on CelebA at 64x64 resolution. Although the faces generated by DPDM somewhat distorted, the model overall is able to clearly generate
35

---

Under review as a conference paper at ICLR 2023
(a) DPDM (ours)
(b) DataLens (Wang al., 2021)
Figure 16: Additional experiments on CelebA at higher resolution (64x64). Samples from our method and DataLens (Wang al., 2021).
face-like structures. In contrast, Datal Lens generates incoherent very low quality outputs. No other existing works tried generating 64x64 CelobA images with rigorous DP guarantees, to the best of our knowledge. Also this experiments implies that DPDMs can be considered major step forward for DP generative modeling.
F.3 CONCERNS REGARDING THE CELEBA BENCHMARK
As correctly pointed out by one of the reviewers, CelebA contains multiple images per person, whereas our method considers the per-image privacy guarantee. For individual with i images in the dataset, a model with (e, 5) per-image DP affords (ke, ke ()) to the individual according the Group Privacy theorem (Dwork et al., 2014). We leave more rigorous study of DPDMs with Group Privacy to future research and note that CelebA serves as standard benchmark in our work.
F.4 VARIANCE REDUCTION VIA NOISE MULTIPLICITY
As discussed in Sec. 3.2, we introduce noise multiplicity to reduce gradient variance. In Fig. 17, plot the (estimated) variance of the Monte Carlo estimator that is obtained after applying the parameter gradient operation on Eq. (7) for all model parameter gradients in histogram. Specifically, for each K we plot one histogram and each histogram corresponds the variances for all the different model parameter gradients. We use our trained model on MNIST and set x to a randomly sampled MNIST image. We can clearly see that increasing K leads variance reduction. We estimate the variance of the gradient estimators (that use K samples) using 1000 Monte Carlo estimates.
Note that variance reduction effect also expected by theory: When calculating gradients of our training objective, we are effectively replacing expectations with Monte Carlo estimates, as is common practice ensure numerical tractability. For a generic function over distribution p(k), we have (p [r(k) ~= 1 Σm r(k;). where (k, 1m p(k) (Monte Carlo estimator for expectation of function with respect to distribution p). The Monte Carlo estimate
noisy unbiased estimator of the expectation { (k)) with variance <Var,(r). where Varp[r) is the variance of r itself. This a well-known fact; see for example Chapter 2 of the excellent book by Owen (2013). our noise multiplicity, K acts like m here and correspondingly reduces the variance the estimator (in our noise multiplicity case, the parameter gradient estimator).
36

---

Under review as a conference paper at ICLR 2023
K
K=8
30000
K=32
25000
20000
Count
15000
10000
10-11
10
10-9
10-7 Gradient variance
10
10-3
10
Figure 17: Histogram of gradient variance over all parameters of the model. Increasing K in noise multiplicity clearly leads to variance reduction. Note the logarithmic x-axis (the variance reduction significant).
37


Reviews:
[{"review_id": "tchRaKcPL5", "reviewer": "Reviewer_F4hz", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studied the differential privacy preservation for the generative model and proposed incorporating the DP-SGD strategy into Diffusion Model training. ", "summary_of_the_review": "The main concern of the reviewer is the novelty of DPDM. It seems that the DPDM is a combination of DP-SGD and DDIM models.", "strength_and_weaknesses": "Strength:\n1. This paper is well-organized and easy to follow.\n2. The experimental results on MNIST, Fashion-MNIST, and CelebA datasets validate the effectiveness of the proposed method, and DPDM achieves state-of-the-art performance.\n\nWeaknesses:\n1. This paper seems simply adopt the well-established DP-SGD into Diffusion Model training. The novelty seems limited.\n2. The motivation of the DPDM is somewhat weak, there exist various generative models, such as GAN, VAE, Diffusion, and so on. Training a GAN is harder than VAE and Diffusion model. However, previous works [G-PATE, PATE-GAN, DPGAN, GS-WGAN] demonstrate the effectiveness of training a DP-GAN-like model. \n3. The datasets adopted have small resolutions. For example, the authors use $28 \\times 28$ resolution for MNIST and Fashion-MNIST, $32 \\times 32$ resolution for CelebA dataset. Training a high-resolution model might be realistic in the application, as the Diffusion Model is well-known for its outstanding performance in high-resolution image synthesis. It might be hard for DP-SGD to train with high resolution while perverse the utility of the outputs.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "gsAg4A8EgG2", "reviewer": "Reviewer_vz3p", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper trains tailored diffusion models with differential privacy. Two intuitive motivations for using diffusion models for DP data generation are 1) the loss function is a simple and scalable $L_2$ regression loss; 2) the denoiser network in diffusion models is simpler and smoother because it is not designed to generate data in a one-shot fashion. Several novel modifications on the design choices of diffusion models are proposed to boost the performance. One worth mentioning modification to the objective function of non-private diffusion models is *noise multiplicity*. At each step, the authors sample $K$ noises and take the average of the gradients of $K$ denoising losses. Experiments show the proposed method achieves SOTA performance.", "summary_of_the_review": "I recommend acceptance because this paper gives a high-quality implementation of DP diffusion models and demonstrates promising results. I hope the authors could reply to my first concern.", "strength_and_weaknesses": "**Strength**\n\n1. This is the first work to use diffusion models for DP data generation. The authors achieve state-of-the-art performance on several image benchmarks. \n\n2. The authors propose several novel modifications to the non-private implementation of diffusion models, which are necessary to achieve good performance.\n\n3. The paper is well written. I enjoy reading it.\n\n**Weaknesses**\n\nI have one concern about the benchmarks used in this paper. They have a common pattern: every image has very visually similar neighbors. For MNIST, all digits from the same class look very similar. For CelebA, there are dozens of images for most of the identities. I understand these two datasets are standard in the literature, but I think they are not representative enough. My suggestion is to include some other datasets that do not have clear clusters in the raw input space, e.g., CIFAR-10 which is also used in some previous works. I don't expect the results to be as good as those in the current version, but it is good for the community to know the results. \n\nAnother small concern about CelebA is that the privacy guarantee is example-wise. Each identity has dozens of examples so the identity-wise privacy guarantee will be loose. Again, I understand this is the benchmark from previous works, but still want to express my concern here.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "USSo0D_Mqp", "reviewer": "Reviewer_d3JQ", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces differential private diffusion models (SPDMs) and studies DP-SGD for DPDMs training. This paper proposes a modification of the diffusion model training objective called noise multiplicity to boost performance. The DPDMs experiments show improvement in image generation tasks. ", "summary_of_the_review": "I feel the approach proposed in this paper is not well motivated. The significance needs to be improved. Overall, I think this submission is not ready for ICLR. Thus, I recommend rejection.", "strength_and_weaknesses": "Strengths:\n\n1. Studying differential privacy for the diffusion model is a good initiation. \n2.The noise multiplicity idea for a less noisy objective function is new and interesting. \n3.This paper also provides positive experiment results using DPDMs. \n\nWeakness\n\n1. The motivation for connecting differential privacy with diffusion models is not well explained.  The arguments in section 3.1 do not fully explain the advantage of diffusion models for differential privacy. The privacy guarantee of DPDMs comes from DP-SGD training which is not new. It would be interesting to show the diffusion model itself benefits privacy.\n2. The advantage of DP-SGD for differential private diffusion models is not well supported. The paper claims that the DP generative model is challenging due to injected noise in training. But DPDMs proposed in this paper also uses DP-SGD for training which also injects noise into training. It will be more convincing if the paper can add theoretical or experimental support that DP-SGD injects less noise for DPDMs than for other generative models \n3. It will be helpful to have a theoretical or empirical explanation that noise multiplicity reduced the noise injected in the training. It also will be interesting if the paper empirically compares the noise variance in the gradient with different levels of K. Also, the paper can clarify if noise multiplicity is unique to diffusion models or if this idea can be generalized to other generative models.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject