Mind the Privacy Budget: How Generative Models Spend their Privacy Budgets
Authors: Georgi Ganev
Kai Xu
Emiliano De Cristofaro
Venue: Submitted to ICLR 2023 (2023)
Keywords: synthetic data
differential privacy
generative models
graphical models
GANs

Abstract: Numerous Differentially Private (DP) generative models have been presented that aim to produce synthetic data while minimizing privacy risks.
As there is no single model that works well in all settings, empirical analysis is needed to establish and optimize trade-offs vis-\`a-vis the intended use of the synthetic data.
In this paper, we identify and address several challenges in the empirical evaluation of such models.
First, we analyze the steps in which different algorithms ``spend'' their privacy budget.
We evaluate the effects on the performance of downstream tasks to identify problem settings they are most likely to be successful at.
Then, we experiment with increasingly wider and taller training sets with various features, decreasing privacy budgets, and different DP mechanisms and generative models.

Our empirical evaluation, performed on both graphical and deep generative models, sheds light on the distinctive features of different models/mechanisms that make them well-suited for different settings and tasks.
Graphical models distribute the privacy budget horizontally and cannot handle relatively wide datasets, while the performance on the task they were optimized for monotonically increases with more data.
Deep generative models spend their budget per iteration, and their behavior is less predictable with varying dataset dimensions, but could perform better if trained on more features.
Also, low levels of privacy ($\epsilon\geq100$) could help some models generalize, achieving better results than without applying DP.

Under review as a conference paper at ICLR 2023
MIND THE PRIVACY BUDGET: How GENERATIVE MODELS SPEND THEIR PRIVACY BUDGETS
Anonymous authors Paper under double-blind review
ABSTRACT
Numerous Differentially Private (DP) generative models have been presented that aim to produce synthetic data while minimizing privacy risks. As there is no single model that works well in all settings, empirical analysis is needed to establish and optimize trade-off's vis-à-vis the intended use of the synthetic data. In this paper, we identify and address several challenges in the empirical evaluation of such models. First, we analyze the steps in which different algorithms "spend" their privacy budget. We evaluate the effects on the performance of downstream tasks to identify problem settings they are most likely to be successful at. Then, we experiment with increasingly wider and taller training sets with various features, decreasing privacy budgets, and different DP mechanisms and generative models. Our empirical evaluation, performed on both graphical and deep generative mod- els, sheds light on the distinctive features of different models/mechanisms that make them well-suited for different settings and tasks, Graphical models distribute the privacy budget horizontally and cannot handle relatively wide datasets, while the performance on the task they were optimized for monotonically increases with more data. Deep generative models spend their budget per iteration, and their be- havior is less predictable with varying dataset dimensions, but could perform bet- ter trained on more features. Also, low levels of privacy (e 2 100) could help some models generalize, achieving better results than without applying DP.
INTRODUCTION
Techniques for creating synthetic data based on generative models have been attracting efforts from the research community (Jordon et al. 2022). government organizations (Benedetto et al.) NHS England| 2021). regulatory bodies (ICO UK| 2022), and industry alike TechCrunch 2022). However, training such models without privacy guarantees can lead to overfitting to the training data or memorization of individual points (Carlini et al. 2019 Webster let al. 2019). This, in turn, enables attacks like membership and property inference (Hayes al. Chen 2019 Hilprecht et al. 2019 Chen et al. 2020). To mitigate these concerns, models should be trained satisfy Differential Privacy (DP) (Dwork et al. (014), whereby noisy/random mechanisms used to provably minimize the contribution of individual data points to the model.
2018 NIST 8a 2020
In this paper, set out to profile DP generative models for tabular data aiming to understand the settings in which they perform best systematically. As shown by (Hay et al., 2016), the more complex DP algorithms become, the harder to analyze their performance analytically. This motivates the need for solid empirical evaluations; thus far, however, evaluations have only been performed on few, relatively small (i.e.. involving a dozen features) datasets and rarely beyond single evaluation metric. Furthermore, it is unclear if/how they scale to larger datasets, even though companies are using scalability delivered in minutes as part of their product offerings (Accelario) 2022 Datagen 2022 Syntho 2022
Gretel 2022).
The conventional wisdom is that computationss/mttoods satisfying DP become more accurate with more training data and less with stricter privacy guarantees. On the other hand, in some cases, more data or training iterations make deep learning classifiers worse when optimized with DP- SGD (Near & Abuah 2021). Also, satisfying small degree of DP improves the performance of CNNs on limited data (Pearee (2022) and GANs for imbalanced data (Ganev) 2022). and even defends against reconstruction attacks vs. highly informed adversaries (Balle al. 2022

---

Under review as a conference paper at ICLR 2023
Problem Statement. We perform the first empirical evaluation of the effects of different DP mech- anisms and the size and dimensionality of training data in the context of generative models and synthetic data. More broadly, we aim to analyze how generative models spend their privacy budget across the number of rows and columns, while also varying the dimensions of the datasets. We also evaluate how the choice of generative model and DP mechanism affects the quality of the syn- thetic data for downstream tasks, c.g., capturing simple distributions, maintaining high similarity, clustering, and binary and multi-class classification.
We compare two synthetic data approaches, namely, graphical and deep generative models; more precisely, PrivBayes (Zhang et al. 2017) and MST (MeKenna et al.] 2021b) for the former and DP-WGAN (Alzantot & Srivastava, 2019) and PATE-GAN (Jordon et al. 2018) for the latter.
Overall, we aim to answer the following research questions:
RQI: How scalable are DP generative models in terms of the dimensions of the dataset?
RQ2: Do DP generative models distribute their privacy budgets in a similar way?
RQ3: What are the effects of different ways to distribute DP and varying dataset dimen- sions on the downstream task of the synthetic data?
Main Findings. Among other things, our experiments reveal that:
1. The graphical models distribute their privacy budget per column, cannot scale many fea- tures (256 for PrivBayes and 128 for MST at most), and increasing the number of rows does not affect the training time. The deep generative models spend their budget per train- ing iteration and can handle much wider datasets but become slower with more data.
2. PrivBayesi performance on downstream tasks degrades when a stricter privacy budget is imposed or the number of features increases, while more data counters these effects. Also, it is the only model properly separating signal from noise in the clustering task.
3. MST is the best performing model at capturing simple statistics and has the best privacy- utility trade-off for this task. Also, when there is lack of data, it benefits from adding small degree of privacy (e 2 100). Increasing the number of rows too much, however, can cause MST overfit and degrade its performance on more complex tasks.
4. The GAN models have they are not as competitive on simple tasks and frequently cannot beat baseline models, PATE-GAN well-suited for more complex tasks and often outperforms both graphical models. PATE-GAN can also improve when presented with more features and is better than DP-NGAN for almost all settings.
variable behaviors with different dataset dimensions. While
Overall, we are confident that our work will assist researchers and practitioners deploying DP syn- thetic data techniques in understanding the trade-offs and navigating through the best candidate models, vis-à-vis the dataset features, desired privacy level, and the downstream task at hand.
2 BACKGROUND AND RELATED WORK
In this section, review related work on Differential Privacy and data dimensionality for queries, classification models, and generative models. In Appendix A we also provide background informa- tion on DP. synthetic data generation, and DP generative models.
Notation. In the rest of the paper, columns of the real dataset. Also, e denotes the privacy budget and the probability of failure in a DP mechanism (see Equation 1 in Appendix A).
n to denote the number of rows and d and the number of
DP Queries and Data Dimensionality. (Hay et al., 2016) benchmark 15 DP algorithms for range queries over and 2-dimensional datasets, showing that increasing values of n reduce error. For small data-dependent algorithms tend to perform better; for large data-independent algorithms dominate. For (more complex) predicate counting queries and higher dimensional data, (McKenna jet al., 2021a) propose method with consistent utility improvements and show that increasing d results in more significant errors. However, they experiment with datasets with at most 15 features, and their model struggles to scale beyond 30-dimensional datasets.
2

---

Under review as a conference paper at ICLR 2023
DP Model
Model Type
DP Mechanism
Max
Independent
Marginal Graphical Graphical
Laplace
1,024
Priv Bayes (Zhang 2017
Exponential + Laplace
256
MST (McKenna et al.
2021b)
Exponential + Gaussian
128
DP-WGAN Alizntoot& & Srivastava 2019
Deep Learning
DP-SGD PATE
1,024
PATE-GAN
Jordon et al.
2018)
Deep Learning
1,024
Table 1: DP generative models used in this paper.
DP Classifiers and Data Dimensionality. For standard predictive models, more data and longer training usually lead to better performance, i.e., lower loss/better classification on the training set. This also holds for DP logistic regression learned via empirical risk minimization and objective perturbation (Chaudhuri et al. 20 :) for large n, the cost function tends to the non-private one, and while the scale of the noise independent of d, there linear shift to the objective function that does not affect the optimization it is strongly peaked (Antonova (016). However, this does necessarily hold for other DP models; e.g., methods based on iterative training like DP-SGD trade-off the number of training steps and the noise added per iteration (Near & Abuah (201T)
DP Generative Models and Data Dimensionality. Unlike query answering and classification tasks, the output of generative models lives in a high-dimensional space. Thus, has much higher sen- sitivity, which even trying analyze is an incredibly difficult task. Furthermore, private synthetic data generation is computationally challenging (exponential in d in the worst-case scenario, i.c., all two-way marginals these results are in the worst-case and do not rule out the existence of practical algorithms (such as those introduced in Appendix A);; indeed, if most, rather than all, correlations are preserved, one build computationally efficient algorithms (Boedihardjo et al.) (001))
preserved (Dwork et al.) 2009, Ullman & Vadhan 201I)). Nevertheless,
Since there is no -ine-izzefiits-al" DP synthetic data generation method, (Jordon et al. 2022 high- light the need to empirically assess the privacy and fidelity of the data on a per-case basis. Even though (Hay et al., (2016) describe of standardized evaluation principles for DP query answer- ing algorithms, including diversity of inputs such as varying domain size, scale, and shape, no such studies focus on synthetic data generation. For example, current frameworks for synthetic data evaluation (Amool & Neunhoeffer 2020) do not consider varying n and d as essential factors, and benchmark studies (Tao et al.) 2022 do not consider datasets with more than features.
To our knowledge, -tate-of-the-ate art graphical models have not been evaluated on datasets with more than 100 dimensions. Specifically, for PrivBayes and MST, (Takagi et al., 202T) argue that the former only performs well for datasets having simple dependencies and a small number of features, while the latter cannot reconstruct the essential information from limited information (i.e., and 2-way marginals) required for more complex classification tasks. Finally, (Li et al.) [202aa] observe that the two models are usually tested on tabular datasets with dozens dimensions and claim that they still suffer from the curse of dimensionality.
Overall, our work aims to bridge these gaps through an extensive empirical evaluation, testing both graphical models and deep generative models on diverse dataset sizes and shapes well a variety of downstream tasks with different complexity.
3
PRELIMINARIES
In this section, we introduce the datasets and the DP generative models we use in our evaluation and discuss the specific steps in which they distribute their privacy budgets.
3.1 GENERATIVE MODELS
Table 1 lists the DP generative models used in our analysis. The specific implementations we use are given in footnotes. (Note that we independently implemented Independent and PrivBayes.) For all experiments, the default hyperparameters are used unless stated otherwise. We focus on two types of generative approaches, graphical models (PrivBayes and MST) and GANs (DP-WGAN and PATE-GAN). The former model the joint distribution by breaking it down to explicit lower- dimensional marginals. The latter approximate the distribution implicitly by iteratively optimizing two competing neural networks until reaching an equilibrium: generator, creating synthetic data
3

---

Under review as a conference paper at ICLR 2023
from noise, and discriminator, separating real from synthetic data points. We select these models as they are well-studied and tested, have reliable open source implementations, and have proven to be among the top performing solutions in practice, winning both the Differential Privacy Synthetic Data Challenge (NIST) 2018a) and The Unlinkable Data Challenge (NIST) 2018b) NIST competitions. Also, they rely on different modeling techniques and DP mechanisms.
Independent. As baseline, we use a simple model that, for all columns, independently captures noisy marginal counts through the Laplace mechanism and then samples from them to generate synthetic data. Though very simple, it has proven to perform better than far more sophisticated models in certain settings (Tao et al. 2022).
PrivBayes (Zhang et al. 2017) first constructs optimal Bayesian network by randomly picking up node (column of the dataset) as the root and iteratively adding one node at a time, maximiz- ing the mutual information between the existing "parent" nodes and candidate "child" node. Half of e is spent at this step using the Exponential mechanism, while the network degree argument determines the maximum number of parents a given node can have. Then, PrivBayes estimates the resulting oow-dimensional conditional distributions through computing noisy contingency tables (utilizing the Laplace mechanism) before normalizing and converting them distributions. Since the network is built iteratively and all computed distributions are conditional, they are also consis- tent. We run Priv Bryvs for datasets with columns up to 256, setting the network degree to the default 3 for datasets with fewer than 100 columns and to 2 otherwise
MST McKKnna et al. 2021b follows similar procedure. For selection, it starts with all 1-way marginals and finds attribute pairs (2-way marginals) that form a maximum spanning tree of the underlying correlation graph. This is achieved through first estimating all 2-way marginals using Private-PGM (McKenna et al. 2019) (a post-processing method that infers a data distribution given noisy measurements) and, then, one by one, noisily adding highly weighted edge to the graph. The edge weights are measured by the L1 distance between real and estimated 2-way marginals. All selected marginals are measured privately using the Gaussian mechanism. MST allocates 1/3 of the privacy budget to selection and the remaining 2/3 to measurement. We train MST on datasets with up to 128 columns and set 8 10-5 (to be consistent with DP-WGAN and PATE-GAN).
DP-WGAN (Alzantot & Srivastava 2019 utilizes the Wasserstein GAN (WGAN) architec- ture (Arjovsky et al., 2017), which achieves better learning stability and improves mode collapse di-
issues compared to the original GAN by using Wasserstein distance rather than vergence. The model relies DP-SGD to ensure the privacy of the diseriminator during training. which in turn guarantees the privacy of the generator since is never exposed to the real data.
PATE-GAN (Jordon et al. 2018 adapts the PATE framework and combines it with a GAN ar- chitecture. The architecture consists of a single generator, t tischee-dsssiimnnatoos,, and student- are only presented with disjoint subsets of the training
discriminator. The data and are trained to improve their loss with respect to the generator (i.e., classifying samples as real or fake). In contrast, the student-discriming by the teachers, and its loss gradients are sent to train the generator.
is trained on noisily aggregated labels provided
3.2 PRIVACY ANALYSIS
The two types of models substantially differ from each other from a DP perspective, e.g., what DP mechanisms they use, how they distribute their privacy budgets, what factors cause more consider- able expenditures, etc. The graphical models rely the "select-measure- genuurree""rre""" paradigm, i.e., the first two steps are: I) selecting a collection of low-dimensional marginals and 2) measuring them with noise addition mechanism. Naturally, as increases, the privacy budget needs to be distributed among more marginals, potentially leading to more noisy measurements. By increasing n, however, we could expect to decrease the mer-measurement sensitivity and thus resulting in more accurate estimations.
https://githu..com/rrs htt.:////o/oaaa.////aaeeeeee.e// 12388/prvvaee
https:// bttps//gthhu..co//es//iss diffarential privacy synthetic data challenge http://hiiikkkoooommmmmmmmmnnnnn
4

---

Under review as a conference paper at ICLR 2023
Dataset
Max n
Max d Downstream Task Evaluated
Eye Gauss
128k
1,024
Statisties:
Mean (Fig.
and Correlation (Fig.
PCA (Fig. 12
13
Corr Gauss
128k
1,024
Statisties:
Mcan (Fig.
and Correlation (Fig.
7. PCA (Fig.
Mix Gauss Unsup
128k
1,024
PCA (Fig.
16
17
Clustering (Fig. 11
Mix Gauss Sup
128k
1,024
PCA (Fig.
18
T9 Classification (Fig. 20
Census
199k
41
Similarity: Marginal and Mutual Info i 2
8
10
Classification (Fig.
3a
21
MNIST
60k
784
Classification (Fig.
Table 2: Datasets and evaluated downstream tasks.
As for GANs, one of the most widely used approaches is to train them iteratively using mini-batcher based on DP-SGD. For fixed-networks architectures, increasing d should not be a major factor as that only affects the discriminator's input and the generator's 's output layers. Analyzing the effect of increasing n is more complicated: on the one hand, more (clean and diverse) training data is usually better for the model as that helps it generalize. On the other hand, more iterations could make the model worse since one has to use a lower privacy budget per iteration, and so the scale of the noise goes up (Near& & Abuah 2021).
Independent. Unlike the other four models, this is the only one that distributes its DP budget independently of the data. It always selects the same marginals (all columns) and uses the same amount of budget to get every noisy marginal, c/d.
Priv PrivBayes and MST. In total, PrivBayes measures approx. d 4-dimensional (if the network degree is three) noisy distributions, each of which has allocated e/2d. The MST measurement step has a few advantages over PrivBayes: i) devotes more budget to (2/3 vs. 1/2); ii) it models structural zeros in the distribution (areas with negligible probability); iii) it uses the Gaussian mechanism, which has better bounds than Laplace; and iv) even though in total it measures more marginals (approx. 2d or 2-way vs. d 4-way), their dimensionality is lower, which means that the noise could be distributed more efficiently. However, requires more computations, potentially leading to slower running times Private-PGMM is called twice, namely, in the selection and generation steps.
WPANGAN and PATE-GAN. In DP-WGAN, the privacy budget is not directly computed but es- timated using the moments accountant method (Abadi et al. 2016). Unlike graphical models, DP- WGAN spends its privacy budget iteratively, through DP-SGD. PATE-GAN also relies on the mo- ments accountant. An advantage over OP-WGAN that noise is not added directly to the gradients but to the vote of the teacher-discrimintto tribute lower privacy cost to accessing noisy aggregations (from the disrrminissri with stronger consensus as a single teacher/data point would have a lower influence on the final vote.
Furthermore, the accountant in PATE-GAN would at-
3.3 DATASETS
For our experiments, we create four progressively more difficult controllable datasets based on the normal distribution (Eye Gauss, Corr Gauss, Mix Gauss Unsup, Mix Gauss Sup) to test whether generative model can capture different aspects of the distribution. We also include two standard, commonly used datasets, namely, Census and MNIST, aiming to be consistent with other studies (Tao)
et al. 2022 Pearce 2022 Ganev] (022). A summary of the datasets is reported in Table 2 and more detailed descriptions, along with the dimension ranges, can be found in Appendix B
4 EXPERIMENTAL EVALUATION
In this section, we present and analyze our experiments with four DP generative models (plus baseline model) and six datasets over several underlying tasks - scalability, statisties, similarity, and classification. Due to space limitations, the evaluation of Principal Component Analysis (PCA) on all Gauss datasets, as well as of the clustering task, are presented in Appendix CC.4
For all generative models and all privacy budgets, we train the model
5 times and generate s = synthetic dataset, which yields 25 synthetic datasets for each reported point in the plots. Besides varying the dataset dimensions (as discussed in Sec. (.3), we also vary the privacy budget e in the range (0.01, 0.1, 1, 10, 100, 1k, 10k, oo}. In total, we train 15k generative models and generate 75k synthetic datasets. A summary of all our experiments is reported in Table
5

---

Under review as a conference paper at ICLR 2023
DP Modell, d+
8
16
32
64
128
256
512
1,024
Independent
0.00
0.01
0.01
0.03
0.08
0.22
0.89
3.03
PrivBayes
0.01
0.02
0.06
0.26
2.29
34.15
MST
0.75
1.55
3.23
7.71
35,90
DP-WGAN
0,50
0.58
0.76
1.24
3.53
6.47
12.52
23.97
PATE-GAN
0.65
0.68
0.76
0.94
1.40
2.13
4.09
10.38
Table 3: Running time (in minutes) of the model's fitting step for DP generative models, on Corr Gauss, varying and
16k.
180
180
(a) Varying nt and d 32
(b) Varying d and n 16k
Figure 1: Off-diagonal pairwise correlation for different levels, on Corr Gauss, varying n and d.
4.1 SCALABILITY
We show the rumning time of the models' fitting step Corr Gauss with varying d in Table In Appendix C.T. we also report the running times of the fitting and generation (for a fitted model) steps, while varying n and d (see Tables 4 (m4.4xlarge) equipped with a 2.4GHz Intel Xcon E5-2676 v3 (Haswell) processor, 16 vCPUs, and 64GB RAM. We opt to very practical time constraints
5 6). All experiments
AWS instance
stress scalability claims from commercial players (Accelario 2022 Datagen 2022, Syntho 2022 Gretel, 2022); ) specifically, we discard models taking longer than 60 minutes to train. (This also allows us maintain a reasonable amount of models to test i.e., 15k trained model instances.)
The graphical models scale polynomially with and quickly approach the minutes limit it takes PrivBayes 35 minutes to fit on 256-dimensional dataset and MST 36 minutes on 128 dimensions while increasing n is barely a factor. On the other hand, increasing either of d or n slows the GAN models d due to the increase of the first and last layers of, respectively, the discriminator and generator and n, due to the increased number of iterations (we fix the number of epochs instead). PATE-GAN is far more time efficient than DP-WGAN PATE only adds noise to the teacher-discee diseriendisrrimmnator votes, while DP-SGD clips and adds noise to all discriminator layers. For all models apart from Independent, the generation step only takes fraction of the training time.
4.2 STATISTICS
We report the off-diagonal pairwise correlation across all columns of Corr Gauss with varying n and Fig.
We visualize the remaining statistics for Eye Gauss and Corr Gauss in Appendix C.2
(see Fig. 4
6
for mean and Fig. 5 for other pairwise correlation).
Overall, MST captures the distributions best, especially the mean and other pairwise correlation, and it is the least sensitive changing and d. Looking the off-diagonal pairwise correlation in Fig. [ we observe that, for n < 4k, the correlation score improves when privacy applied and always remains above the "no-DP" values for c 10. In other words, DP acts regularization when there is insufficient data for the model to capture the distribution. To the best of our knowledge, this is the first such finding of non-deep learning DP model previous examples, CNNs (Pearce)

---

Under review as a conference paper at ICLR 2023
Indepandent
+ Pridayss
-4- RST
- DPANGA
PATE-GA GAN
100
100
Marginal
(b) Mutual information
Figure 2: Marginal and pairwise mutual info similarity for different e levels, on Census, varying n.
2022 and GANs Ganev 2022). are neural networks relying on, respectively, DP-SGD and PATE. However, MST cannot scale beyond 128 features.
PrivBayes can handle wider datasets, up to 256 columns. It performs closest to what one would expect, as mean and other pairwise correlation stay close 0 for all n and d, for both datasets. However, for off-diagonal pairwise correlation (see Fig. [ there is monotonic improvement with increasing n and deterioration with increasing d, reaching the baseline levels of Independent for different levels of
The GAN models behave less predictably, and their performance not monotonic when the dimen- sions are varied. In all cases, PATE-GAN outperforms DP-WGAN, almost par with MST for e > 0.1 for Eye Gauss. For Corr Gauss, however, it cannot capture the off-diagonal pairwise corre- lation sufficiently well, creating data with correlation closer to 0.3 as opposed 0.5 for the real one. Interestingly, varying the dataset dimensions affects DP- WGAN differently - for both datasets, in- creasing n yields more correlated distributions with mean around O, while, for Corr Gauss, increas- ing (beyond 128) makes the model generate data with relatively uncorrelated columns (S 0.2) but with mean further away from 0 (> 0.5). In fact, for Corr Gauss, the model cannot distinguish between the off-diagonal and other correlations for d 32 and creates data with equal correlation.
4.3 SIMILARITY
Next, in Fig. we plot marginal and pairwise mutual information similarities between the real and synthetic datasets for Census with varying n. In Appendix C.3 we also report a zoomed-in plot for MST and PATE-GAN (see Fig. 8 visualize fitted PrivBayes and MST networks (Fig. 9). and break
down the pairwise mutual information for connected vs. non-connected nodes in (Fig. 10
Looking the marginal similarity, Independent, PrivBayes, MST, and DP-WGAN behave as ex- pected, as higher n results in monotonically better scores. The fact that Independent outperforms PrivBayes and the GANs for S 10 should not surprise as it only captures the marginal distribu- tions and does not "waste" any privacy budget for other purposes. With increasing there is also an improvement for PATE-GAR GAN, but the sensitivity is much lower. Fig. 8a shows that, when there is only little data available (n < 4k), adding some privacy (10k < S 10), once again, helps MST.
As for the mutual information similarity (see Fig. 2b adding more data points to the training data yields worse scores for Independent and MST. For the latter, this could be due to the overfitting of the model to its objective function (i.c., all I-way and 41 2-way marginals as seen in Fig. (b). thus failing to capture all 2-way marginals. This is also visible in Fig. 10 where MST suffers more significant drop in scores of connected vs. non-connected nodes compared to PrivBayes (which in turn models much larger number of connections. 120, as seen in Fig, 9ap. For > 8k, AATE-GAN outperforms MST (Fig. (b): this could be explained by its training procedure, which prioritizes creating plausible synthetic data points (i.e., implicitly maintaining correlations between columns).

---

Under review as a conference paper at ICLR 2023
(b) Accuracy on MNIST, varying d
16.0
(c) Accuracy on MNIST, images upscaled to 28x28 Figure 3: Fl and accuracy for different levels, on Census, varying and MNIST, varying d.
(a) on Census, varying
Finally, with Priv Brivs and DP-WGAN, we observe that increasing n helps the score for higher levels of privacy, but only up to 1. Beyond this, one would be better off training the models on less training data.
4.4 CLASSIFICATION
Finally, we report the Fi-score on Census with varying and accuracy on MNIST with different resolutions (features) Fig. and 3b) Appendix C.5)) we present additional classification results, i.e., accuracy on Mix Gauss Sup with varying and d (see Fig. 20p, and accuracy (along with F1) on Census (Fig. 21).
Looking at Mix Gauss Sup, PrivBayes, once again, behaves expected for different and d. There a common trend for MST and DP-WGAN, as both models need at least 16k data points achieve better than random accuracy. Similarly, if there too many features, 128 for MST and 2256 for DP-NGAN, the accuracy approaches the random bascline. Varying n does not seem to be a significant factor for PATE-GAN accuracy tends to be close to the real one for > 0.1. Increasing d, however, has a negative effect, which is contrast with previous experiments. As for Census, consider both accuracy and F1 the dataset is imbalanced (93.8% of the people make less than 50k/year). Somewhat unexpectedly, DP-WGAN comes closest to the real FI baseline but only for the "no-DP" case. Overall, PATE-GAN is the only model with a F] score consistently close to 0.35, provided that it was trained on at least 8k points. For MST, increasing n helps accuracy (see Fig. 21 but at the expense of FI, meaning that the classifiers trained on the synthetic data overfit to the majority class.
These trends are very close to the one observed in the similarity experiments from Sec. the rela- tive overperformance of the GAN models compared to MST is in direct contradiction with previous studies (Tao et al. 2022). Although we cannot say for sure, we believe that this might, part, due to not using the original GAN implementations but relying third-party ones. Unfortunately, (Tao) jet al. 2022) dismiss them as good candidate models while arguably overstating the capabilities of other approaches.
As for the accuracy on MNIST (Fig. (Fig.Bb), we see that more features (i.c., images with higher resolu- tion/better quality) deteriorate the performance of PrivBayes and DP- DP-WGAN but help PATE-GAN. In principle, we could expect higher-resolution images to improve both GAN models, but this the case only for PATE-GAN. However, none of the models approach the real baseline (0.9 accuracy). While this is expected for graphical models, it is somewhat surprising for the GANs. We believe this because both GANs rely only on feed-forward layers and not CNNs. MST trained 10x10 im- ages performs very well, achieving 0.8 accuracy, on par with PATE-GAN (d > 10x10) for > 0.1. Again, this might be surprising, as MST does not explicitly model higher-level dependencies. which is important in the image domain.
4.5 TAKE-AWAS AWAYS
Overall, experiments allow to answer our three research questions introduced in Sec.
8

---

Under review as a conference paper at ICLR 2023
How scalable are the DP generative models in terms of the dimensions of the dataset? Graph- ical models suffer from the curse of dimensionality, and PrivBayes and MST scale up to 256 and 128 columns, respectively (under practical computation restrictions). The GAN models scale to much wider datasets but become slower when presented with taller datasets (since we fix the number of training epochs).
RQI:
RQ2:
Do DP generative models distribute their privacy budgets in a similar way? No. The graphical models distribute their privacy budget horizontally and the GANs vertically (i.e., they spend their budget per iteration).
RQ3: What are the effects of different ways to distribute DP and varying real dataset dimensions on the downstream task of the synthetic data? The effects are mixed. Overall, more training data helps the graphical models but sometimes causes MST to overfit and degrade its performance on tasks that require capturing complex relationships (e.g., classification). Also, in some instances, a small degree of privacy helps MST when presented with a limited amount of data. Varying the dataset dimensions is more unpredictable (more variable and usually not monotonic) for the GAN models. While they underperform at simple tasks on controllable datasets, PATE-GAN could be very competitive at more challenging tasks and could improve if the dataset is higher dimensional.
DISCUSSION AND CONCLUSION
In this paper, we studied and compared how different DP generative models distribute their privacy budget, how they scale in terms of increasing dimensions of the dataset, and how these factors affect the quality of the resulting synthetic data for a variety of tasks. We did so to shed light on which models are best suited for different settings and tasks. We showed that graphical models work best with simpler tasks and lower-dimensional datasets, while deep generative models on more complex problems and wider datasets.
In the rest of this section, we discuss potential first-cut solutions and future research directions.
Increasing Number of Rows. From our experiments, we observed that more data does not always translate improved quality for all models and evaluations (e.g.. the GAN models and MST, apart from marginal similarity). On the other hand, for some models (MST and DP- BG-N), a minimum data threshold is needed to perform better than random. Therefore, more research is needed to find a good balance. One avenue could be to investigate optimal times for early stopping or dataset sampling techniques. Also, one could build relevant public datasets for the tabular domain and develop pre-trained models; researchers and practitioners could then fine-tune the models on their specific (private) dataset (Harder al. 2022). This approach has proved to very promising in other areas, including NLP (Li et al. 2022b Yu et al. 2022) and vision (Tramer & Boneh 2021
Golatkar et al. 2022 De et al. 2022)
Increasing Number of Features. Our evaluation also showed that increasing the data features re- sults in synthetic data with progressively worse performance the downstream task (except for PATE-GAN with MNIST). Furthermore, the graphical models (which perform better at lower di- mensional datasets) cannot scale beyond 128/256 dimensions. A logical follow-up would be try and reduce the dimensionality of the dataset, train/generate synthetic data in the lower space (this would also help with the DP budget) using the better-suited models, and, if necessary upscale the original space. (Tantipongpipat et al. 2021 propose a similar approach, combining VAE and GAN.
As proof of concept, in Fig. 3c we downscale MNIST images using standard tools to 10x10/16x16 16, train MST (on 10x10) and PrivBayes (on 10x10 and 16x16), generate synthetic images, and then upscale them back to 28x28. Comparing classifiers trained on both real and synthetic images, we observe that: 1) classifiers trained on MST generated data perform very well (on par with PATE- GAN trained on the original images), and 2) neither of MST/PrivBayes lose utility compared to when they were tested on downscaled real images (Fig. 3b). Another way improve on partic- ular task would be to investigate the most relevan/imppottat features and spend the privacy budget strategically (Rosenblatt et al. 2022). Alternatively, we could choose the simplest "good enough" model at hand, e.g., Independent preserved marginal similarity even in high dimensions.
Overall, our work takes important step in profiling sfate-of-the-ar approaches for DP synthetic data generation, and their use for downstream tasks, and paves the way for further research and improvements.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In ACM CCS, 2016.
Nazmiye Ceren Abay, Yan Zhou, Murat Kantarcioglu, Bhavani Thuraisingham, and Latanya Sweeney, Privacy preserving synthetic data release using deep learning. In ECML PKDD, 2018.
Accelario. Realistic test data in minutes. http:///wccceiiiiooooo/oooo/o/aa 2022.
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially private mixture of generative neural networks. IEEE TKDE, 2018.
Moustafa Alzantot and Mani Srivastava. Differential Privacy Synthetic Data Generation using WGANs, htips:
geithub..co//esl//nii differential privacy synthetic data challenge 2019.
Danicla S. Antonova. Practical differential privacy in high dimensions. https://cra.dd...uuuu//d/d/////2 2016.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In JCML, 2017.
Christian Arnold and Marcel Neunhoeffer. Really Useful Synthetic Data-A Framework to Evaluate the Quality of Differentially Private Synthetic Data. arXivv2004.077400 2020.
Hassan Jameel Asghar, Ming Ding, Thierry Rakotoarivelo, Sirine Mrabet, and Dali Kaafar. Differentially Private Release Datasets using Gaussian Copula. Journal of Privacy and Confidentiality, 2021.
Sergul Aydore, William Brown, Michael Kearns, Krishnaram Kenthapadi, Luca Melis, Aaron Roth, and Ankit A Siva. Differentially private query release through adaptive projection. ICML, 2021.
Borja Balle, Giovanni Cherubin, and Jamie Hayes. Reconstructing Training Data with Informed Adversaries. In IEFE Symposium on Security and Privacy, 2022.
Mohamed Ishmael Belghazi, Aristide Baratin, Sai Rajeshwar, Sherjil Ozair, Yoshua Bengio, Aaron Courville, and Devon Hjelm. Mutual information neural estimation. In ICML, 2018.
Gary Benedetto, Jordan C Stanlcy, Evan Totty, et al. The creation and use of the SIPP synthetic Beta v7. 0. US Census Bureau, 2018
March Boedihardjo, Thomas Strohmer. and Roman Vershynin. Covariance's Loss is Privacy's 's Gain: Compu- tationally Efficient, Private and Accurate Synthetic Data. arXiv:2107.05824 2021.
Kuntai Cai, Xiaoyu Lei, Jianxin Wei, and Xiaokui Xiao. random fields. PVLDB, 2021.
Data synthesis differentially private markov
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jemej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization neural networks. In USENIX Security, 2019.
Thee Chanyaswad, Changchang Liu, and Prateek Mittal. private data release. PoPETs, 2019.
Ron-gauss: Enhancing utility in non-interactive
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimiza- tion. JMLR, 2011.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In ACM CCS, 2020.
Datagen. Guide: Synthetic Data. https:/dhhagn.cccchhcicccchchhha
2022.
Soham De, Leonard Berrada, Jamie Hayes, Samuel Smith, and Borja Balle. Unlocking high-accuracy differ- entially private image classification through scale. arXiv:2204.1366 2022.
Dheeru Dua and Cascy Graff. UCI Machine Learning Repository. machine- leareinn-nninggn databasss//ensuss income- mid, 2017.
https://archive.cc..cc...d////
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. EuroCrypi. 2006a.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. 7CC, 2006b.
10

---

Under review as a conference paper at ICLR 2023
Cynthia Dwork. Moni Naor, Omer Reingold, Guy N Rothblum, and Salil Vadhan. On the complexity of differentially private data release: efficient algorithms and hardness results. In ACM STOC, 2009.
Cynthia Dwork, Aaron Roth, al. The algorithmic foundations of differential privacy. Foundations and Trends Theoretical Computer Science, 2014.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differentially private generative adversarial networks for time series, continuous, and discrete open data. In IFIP SEC, 2019.
Sébastien Gambs, Frédéric Ladouceur, Antoine Laurent, and Alexandre Roy-Gaumond. Growing synthetic data through differentially-privaal vine copulas. PoPETs, 2021.
Georgi Ganev. DP-SGD vs PATE: Which Has Less Disparate Impact on GANs? AAAI Workshop on Privacy- Preserving Artificial Intelligence (PPAI). 2022.
Chang Ge, Shubhankar Mohapatra, Xi He, and Ihab F, Ilyas. Kamino: Constraint-Aware Differentially Private
Data Synthesis. PVLDB, 2021.
Aditya Golatkar, Alessandro Achille, Yu-X Yu-Xiang Wang, Aaron Roth, Michael Kearns, and Stefano Soatto. Mixed Differential Privacy in Computer Vision. In CVPR, 2022.
Gretel. Gretel Synthetics. https://greeel.aisyntieee 2022.
Fredrik Harder, Milad Jalali Asadabadi, Danica Sutherland, and Mijung Park. Differentially Private Data Generation Needs Better Features. arXiv:2205.22000 2022.
Michael Hay, Ashwin Machanavajhalla Gerome Miklau, Yan Chen, and Dan Zhang. Principled evaluation of differentially private algorithms using dpbench. In SIGMOD, 2016.
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Membership inference attacks against generative models. In PoPETs, 2019.
Benjamin Hilprecht, Martin Härterich, and Daniel Bernau, Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models. In PoPETs, 2019.
ICO UK. Chapter Privacy-enhancing technologies (PETs). Aiasuutttions/4021444///aappp a-oommmiittnoononnnnnoooomaomoa pettioooo--eetpppu pdt 2022.
http:://caooruuukkkmmmiaaaaabbub the-iio
James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. PATE-GAN: Generating synthetic data with differ-
ential privacy guarantees. In ICLR, 2018.
James Jordon, Lukasz Szpruch, Florimond Houssiau, Mirko Bottarelli, Giovanni Cherubia, Carsten Maple, Samuel N Cohen, and Adrian Weller. Synthetic Data-what, why and how? arXiv:2205.03255 2022.
Yann LeCun, Corinna Cortes, CJ Burges. MNIST handwritten digit database. ATT Labs, 2010.
Donghao Li, Yang Cao, and Yuan Yao. Optimizing Random Mixup with Gaussian Differential Privacy. arXiv:2002.06467 2022a.
Haoran Li, Li Xiong, and Xiaoqian Jiang. Differentially private synthesization of multi-dimensional data using copula functions. In EDBT, 2014.
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. ICLR, 2022b.
Terrance Liu, Giuseppe Vietri, and Steven Z Wu. Iterative methods for private synthetic data: Unifying frame- work and methods. NewrIPS, 2021.
Yunhui Long, Boxin Wang, Zhuolin Yang. Bhavya Kailkhura, Aston Zhang, Carl A. Gunter, and Bo Li. G- PATE: Scalable differentially private data generator via private aggregation of teacher discriminators. In NeurIPS, 2021.
Sofiane Mahiou, Kai Xu, and Georgi Ganev. dpart: Differentially Private Autoregressive Tabular, General Framework Synthetic Data Generation. Theory and Practice of Differential Privacy (TPDP), 2022.
Ryan McKenna, Daniel Sheldon, and Gerome Miklau. Graphical-model based estimation and inference for differential privacy. JCML, 2019.
Ryan McKenna, Gerome Miklau, Michael Hay, and Ashwin Machanavajhala. HDMM: Optimizing error of high-dimensional statistical queries under differential privacy. arXiv:2106.12 18, 2021a.
18,

---

Under review as a conference paper at ICLR 2023
Ryan McKenna, Gerome Miklau, and Daniel Sheldon. Winning the NIST Contest: A scalable and general approach to differentially private synthetic data. Journal of Privacy and Confidentiality, 2021b.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In FOCS, 2007.
Joseph P. Near and Chiké Abuah. Programming Differential Privacy. 2021. URL httpss://///m
programming-di
NHS England. A&E Synthetic Data. https://data..egland... .hs. wtt.s////aatttteeeeeesttttteeeee 2021. 2021.
NIST. 2018 Differential Privacy Synthetic Data Challenge.
https:/wwww.ist.oovoeeeo 801
NIST. 2018 The Unlinkable Data Challenge.
1has:ppiize-callleees//11---- http://:wwwww....ttt//o/oo/////. 2018b.
NIST. 2020 Differential Privacy Temporal Map Challenge.
https///www..is..go//lll/sss//// 2020.
Nicolas Papernot, Martin Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-supervised knowl- edge transfer for deep learning from private training data. ICLR, 2017.
Nicolas Papernot, Shuang Song, Ilya Mironow, Ananth Raghunathan, Kunal Talwar, and Ulfar Erlingsson.
Scalable private learning with pate. In /CLR, 2018.
Adam Pearce. Can a Model Be Diffcrentially Private and Fair? hhnps///iiiwwiihooogoo.c///oooes frivate-and-fair 2022.
Ben Poole, Sherjil Ozair, Aaron Van Den Oord, Alex Alemi, and George Tucker. On variational bounds of mutual information. In ICML, 2019.
Benjamin Rhodes, Kai Xu, and Michael U Gutmann. Telescoping density-ratio estimation. NeurlPS, 2020.
Lucas Rosenblatt, Joshua Allen, and Julia Stoyanovich. Spending Privacy Budget Fairly and Wisely. 12X1v 2022.
Syntho. Al-generated Synthetic Data, easy and fast access to high quality data?
https//www.syntho.a/
ai- pegemerracd--yytteeeeddddaa----e aad-ass-----------eee--e------ tigg--/-s----acee-------------u highhiigggualt-ddaatt 2022.
Shun Takagi, Tsubasa Takahashi, Yang Cao, and Masatoshi Yoshikawa. P3gm: Private high-dimensional data release via privacy preserving phased generative model. In IEEE ICDE, 2021.
Uthaipon Tantipongpipat, Chris Waites, Digvijay Boob, Amaresh Siva, and Rachel Cummings. Differentially private mixed-type data generation for unsupervised learning. 2021.
Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. AAAI Workshop on Privacy- Privacy-Preserving Artificial Intelligence (PPAI). 2022.
TechCrunch. The market for synthetic data bigger than you think. https://echerrucccccoo/2///////0 hawaaadeeetteesayaeeetttllll---e
-ou-tnikk/ 2022.
Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much more data). ICLR, 2021.
Jonathan Ullman and Salil Vadhan, PCPs and the hardness of generating private synthetic data. In TCC, 2011.
Giuseppe Vietri, Grace Tian, Mark Bun, Thomas Steinke, and Steven Wu. New oracle-efficient algorithms for private synthetic data release. In ICML, 2020.
Ryan Webster, Julien Rabin, Loic Simon, and Frédéric Jurie. Detecting overfitting of deep generative networks via latent recovery. In IEEE CVPR, 2019.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv: 1802.0679. 2018.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkami, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. ICIA R, 2022.
12

---

Under review as a conference paper at ICLR 2023
Jun Zhang, Graham Cormode, Cecilia M Procopiuc, Divesh Srivastava, and Xiaokui Xiao. Privbayes: Private data release via bayesian networks. ACM TODS, 2017.
Wei Zhang, Jingwen Zhao, Fenggiong Wei, and Yunfang Chen. Differentially private high-dimensional data publication via Markov network. FAI Endorsed Transactions on Security and Safety, 2019.
Xinyang Zhang, Shouling and Ting Wang. Differentially private releasing via deep generative model (tech- nical report). 1801, 01594, 2018.
Zhikun Zhang. Tianhao Wang. Jean Honorio, Ninghui Li, Michael Backes, Shiho He, Jiming Chen, and Yang Zhang. PrivSyn: Differentially Private Data Synthesis. In USENIX Security, 2021.
A ADDITIONAL BACKGROUND AND RELATED WORK
Differential Privacy (DP). A randomized algorithm A satisfies (c, 6)-DD if, for all of its possible outputs S. and all neighboring datasets D and D' (D and D' are identical except for single data row), the following holds (Dwork et al. 20066 2014):
P[A(D) E S] S exp P[A(D") E S]
Here is a positive, real number (also referred to as the privacy budget) that quantifies the infor- mation leakage, while ò, usually a very small real number, allows for a probability of failure. In other words, looking at the output of the computation (e.g.. the trained model), it is impossible to distinguish whether or notany individual's 's data was included in the input dataset.
In this paper, we study generative models relying on variety of well-known DP techniques: the Laplace (Dwork et al. 2006b), Exponential (Dwork et al. 2006a), and Gaussian mechanisms (Mc- Sherry & Talwar 2007). Differentially Private Stochastic Gradient Descend(DP-SGD) (Abadi et al. 2016), and Private Aggregation of Teacher Ensembles (PATE) (Papernot al. 2017 2018).
Due to its composition and robustness to post-processing properties, DP allows different DP mech- anisms to be combined while the overall privacy budget is tracked and DP-trained models to be re-used without further privacy leakage.
Synthetic Data. In this paper, we focus on techniques to create synthetic data through generative machine learning models. A sample dataset D", consisting of n iid drawn records with features from the population D DID), is fed input to the generative model training algorithm (D") during the fitting step. In turn, GM (D") updates its internal parameters é to learn Dr)) (a lower-dimensional) representation of the probability of the sample dataset P(D"), and outputs the trained model GD") Then, GDD) could be sampled to generate synthetic data of size n', S (D")). Since both the fitting and generation steps are stochastic, one can train the generative model m times and sample s synthetic datasets for each trained model to get confidence intervals.
DP Generative Models. There is a vast literature of DP techniques for tabular synthetic data gen- eration, namely, copulas (Li et al.] [2044] Asghar et al., [021] Gambs et al., 2021), graphical mod-
els (Zhang et al.
2017 2019| McKenna et al. 2021b] Cai al.] [021]] | Mahiou et al., 2022), work-
load/query based (Vietri et al. 2020) Aydore et al. [202]] ; Liu et al. (022)), Variational Autoencoders
2018 Abay et al. (GANs) Xie et al.
(VAEs) (Acs et al.
2018
Takagi et al. 2021) 1). Generative Adversarial Networks
2018 Zhang al.
2018
Jordon al.
2018 Alzantot & Srivastava (011 Frige-
rio et al.
2019 Tantipongpipat et al.] 2021
1
Long et al. 202 l) and other approaches (Chanyaswad
et al. 2019 Z0ang et al. 2021 Ge al.]
2021).
B
DATASETS
Gaussians. We create four progressively more complex datasets based on the gaussian distribution:
Eye Gauss consists of columns that are independently distributed standard normals.
* Corr Gauss (inspired by (Belghazi et al. 2018 Poole et al. 2019 Rhodes et al. 2020 is a multivariate normal with mean and covariance matrix with Is on the diagonal (unit variance). 0.5s the off-diagonal (all neighboring columns have correlation 0.5), and Os everywhere else (not neighboring columns are uncorrelated). The idea is to see if the model would be able to capture the correlation correctly.
13

---

Under review as a conference paper at ICLR 2023
DP Model,, + 250
500
1k
4k
16k
32k
64k
128k
Independent
0.01
0.01
0.01
0.01
0.01
0.02
0.03
0.05
PrivBayes
0.02
0.03
0.03
0.05
0.06
0.07
0.10
0.13
MST
3.23
3.27
3.27
3.28
3.23
3.23
3.32
3.30
DP-WGAN
0.11
0.11
0.13
0.24
0.76
1.42
2.73
5.37
PATE-GAN
0.02
0.03
0.05
0.18
0.76
1.75
4.55
13.40
Table 4: Running time (in minutes) of the model's fitting step for DP generative models, on Corr Gauss, varying n and d 32.
DP Model], n
250
500
1k
4k
16k
32k
64k
128k
Independent
0.00
0.00
0.00
0,00
0.01
0.01
0.03
0.06
PrivBayes
0.00
0.00
0.00
0.00
0.01
0.01
0.03
0.05
MST
0.01
0.01
0.01
0.01
0.02
0.02
0.04
0.07
DP- WGAN
0.00
0.00
0.00
0.00
0.01
0.01
0.02
0.04
PATE-GAN
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.01
Table 5: Running time (in minutes) of the model's generation step for fitted DP generative models, on Corr Gauss, varying and d = 32.
The first two columns of Mix Gausy Unsup (inspired by (Frigerio et al. 2019 are a mixture of six gaussians distributed in a ring with center 0, while the remaining columns represent noise in the form of uncorrelated gaussians with mean O. The model should be able to separate signal from noise and reproduce the six clusters.
The Mix Gauss Sup dataset is the same the previous but with added target column, labeling the six gaussians in a non-linearly separable way. Classifiers trained on the real and on the synthetic data should have similar performance.
For all datasets, we vary the number of columns in the range (8, 16, 32, 64, 128, 256, 512, 1,024) while keeping the rows to 16k. We also vary the number of rows the range {250, 500, 1k, 2k, 4k, 8k, 16k, 32k, 64k, 128k) while fixing the columns to 32. When applicable, create test datasets with size equal to 20% of the training.
MNIST. The MNIST dataset (LeCun al. 2010 is collection of greyscale handwritten digits. There are 60K training and 10K testing samples. The task is to classify the digit. We experiment with varying number of features. On top of the original 28x28 pixels, also rescale the images to 10x10 10, 16x16, and 22x22.
Census. The Census dataset (Dua & Grafi 2017) is extracted from the 1994 and 1995 Current Population Surveys conducted by the US Census Bureau. contains 41 (six numerical and 35 categorical) demographic and employ variables. The target column indicates whether the individual's income exceeds $50k/year. The dataset consists 199,523 training and 99,762 testing instances. We vary the training points in the range {1k, 2k, 4k, 8k, 16k, 32k, 64k, 128k, 199,523} (the latter being the original size).
C ADDITIONAL RESULTS AND PLOTS
C.1 SCALABILITY
We report summaries of the running time of the fitting step for Corr Gauss with varying n in Table and generation step with varying n and d in Table 5 The results are discussed Sec. (see the paragraph with heading Scalability..
C.2 STATISTICS
We visualize the average statistics for Eye Gauss and Corr Gauss with varying dimensions; more precisely, mean and correlation for the former in Fig 5 and mean and correlation for the latter in Fig. 6
The results are discussed in detail in Sec.
14

---

Under review as a conference paper at ICLR 2023
DP Model d'+
8
16
32
64
128
256
512
1,024
Independent
0.00
0.00
0.01
0.02
0.07
0.24
0.99
3.69
PrivBayes
0.00
0.00
0.01
0.02
0.03
0.07
MST
0.00
0.01
0.02
0.05
0.13
DP-WGAN
0.00
0.00
0.01
0.01
0.02
0.06
0.39
1.63
PATE-GAN
0.00
0.00
0.00
0.00
0.01
0.05
0.3
1.57
Table 6: Running time (in minutes) of the model's generation step for fitted DP generative models, on Corr Gauss, varying and 16k.
inlopandert
Frasayes
AEE-WA
xd +
211
DB
4
(a) Varying and d 32 Figure Marginal mean for different levels, on Eye Gauss, varying and d.
(b) Varying d and n 16h
Indappndett.
12
(a) Varying Ti and d 32
(b) Varying and n = 16k
Figure 5: Other (apart from diagonal) pairwise correlation for different e levels, on Eye Gauss, varying and d.
C.3 SIMILARITY
We plot zoomed-in average marginal and pairwise mutual information similarly for MST and PATE- GAN Census with varying in Fig. We also visualize fitted networks for MST and PrivBayes in Fig. 9 and break down the mutual information similarly between connected and non-connected nodes in Fig. TO These experiments are discussed in Sec. 4.3
C.4 PCA AND CLUSTERING
We focus Principal Component Analysis (PCA) and clustering tasks.
15

---

Under review as a conference paper at ICLR 2023
Pistoss 2
DP-NAA NEE-SN
4 4
(a) Varying and 32
Varying and 16k
Figure 6: Marginal mean for different levels, on Corr Gauss, varying and d.
indepandee
Frassyes
DENGGR
1800
(a) Varying and d 32
(b) Varying d and n 16h
Figure 7: Other (apart from diagonal and off-diagonal) pairwise correlation for different levels, on Corr Gauss, varying n and d.
1766
0384
(a) Marginal
(b) Mutual information
Figure 8: Marginal and pairwise mutual information similarity zoomed in for MST and PATE-GAN for different levels, on Census, varying n.
The Kernel Density Estimation (KDE) on the first PCA components of all four Gauss datasets with varying dimensions plotted in Fig. I2 13 44
18 and 19 while the silhouette scores of clusters predicted by Mixture Gaussians models fitted to the first PCA components on Corr Gauss shown in Fig.
15
66
17
Analyzing the PCA plots, no models manages to replicate all datasets sufficiently well. FrivBayes probably comes closest for 2 10, and for the Mix Gauss datasets, it is the only model that prop- erly separates the first two columns creating the six clusters from the rest containing noise. When tighter privacy budget is applied, the dataset dimensions increased, the variance of the syn-
16

---

Under review as a conference paper at ICLR 2023
(a) PrivBayes
(b) MST
Figure 9: Example fitted networks for PrivBayes and MST with 1. on Census.
(a) Connected nodes
(b) Non-connected nodes
Figure 10: Pairwise mutual information (comected/non-coomcceee) nodes extracted from the fitted networks for PrivBayes and MST) similarity for different levels, on Census, varying n.
Intepende
(a) Varying n and 32
(b) Varying and n 16k
Figure Silhouette score for different e levels, on Mix Gauss Unsup, varying a and d.
thetic data increases too for all datasets. While MST performs very well for eye and Corr Gauss, it ultimately fails for the other two as generates some difficult-t--defin structure, probably due to mode collapse. Unsurprisingly, Independent cannot capture Mix Gausy distributions either. Unfortu- nately, the GAN models do not perform well on these datasets either. At the very least, they capture the range of the data well. However, and d do not to be important factors. For d 2 32 and > 0.1, PATE-GAN generates data that loosely resembles the real, but it is shaped more as a box rather than ring.
17

---

Under review as a conference paper at ICLR 2023
-2
(a) Real (b) Independent
(c) PrivBayes
MST
(e) DP-WGAN
(f) PATE-GAN
Figure 12: KDE on the first 2 PCA principles for different levels, on Eye Gauss, varying n.
mad & is (c) PrivBayes
(a) Real (b) Independent
(d) MST
(e) DP-N
(Q) PATE-GAN
Figure 13: KDE on the first PCA principles for different levels, on Eye Gauss, varying d.
(a) Real (b) Independent
(c) PrivBayes
MST
(e) DP-WGAN
(O PATE-GAN
Figure 14: KDE on the first PCA principles for different levels, on Corr Gauss, varying n.
The silhouette scores in Fig. [] look very variably and noisy, most likely because the clustering was done on the first 2 PCA components opposed to the complete datasets due to computational time restrictions. Broadly speaking. they confirm what we observed in the PCA plots. PrivBayes performs very well for 1k. Varying has strong effect on MST and makes the scores very noisy and unpredictable. PATE-GAN achieves good silhouette scores, greater or equal to 0.45 for all n.
18

---

Under review as a conference paper at ICLR 2023
Real
(b) Independent
(c) PrivBayes
MST
DP-WGAN
PATE-GAN
Figure 15: KDE on the first PCA principles for different levels, on Corr Gauss, varying d.
(a) (b) Independent
(c) PrivBayes
MST
(c) DP-WGAN
(1 PATE-GAN
Figure 16: KDE on the first 2 PCA principles for different levels, on Mix Gauss Unsup, varying
(a) Real (b) Independent
(c) PrivBayes
(d) MST
(e) DP-WGAN
PATE-GAN
Figure 17: KDE on the first 2 PCA principles for different levels, on Mix Gauss Unsup, varying
C.5 CLASSIFICATION
The average accuracy for Mix Gauss Sup with varying dimensions is plotted in Fig. 20 while the average accuracy and F1 for Census with increasing n is displayed in Fig. 21 We look at these plots in detail in Sec. 4.4
19

---

Under review as a conference paper at ICLR 2023
(a) Real
(b) Independent
(c) PrivBayes
(d) MST
(c) DP-WGAN
(1) PATE-GAN
Figure 18: KDE on the first PCA principles for different levels, on Mix Gauss Sup, varying n..
(a) Real (b) Independent
(c) PrivBayes
(d) MST
(c) DP-WGAN
(0 PATE-GAN
Figure 19: KDE on the first PCA principles for different levels, Mix Gauss Sup, varying d.
4
(a) Varying Tt and 32
Varying and n 16k
Figure 20: Accuracy for different levels, on Mix Gauss Sup, varying n and d.
20

---

Under review as a conference paper at ICLR 2023
TRACH
38
2000
38
2008
FI Figure 21: Accuracy and Fl for different levels, on Census, varying n.
(a) Accuracy
21


Reviews:
[{"review_id": "n5oAn2q5tA", "reviewer": "Reviewer_uTaB", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "the paper benchmarks how various existing approaches for the problem of *DP synthetic tabular data generation* perform as the number of features and instances of the dataset change. in particular, the paper answers some previous under-studied research questions such as 1) how do methods scale with the number of columns. ", "summary_of_the_review": "the paper designed careful experiments to benchmark performance, but lacks more detailed ablation studies to uncover reasons why certain methods behave in certain ways. ", "strength_and_weaknesses": "strength: the paper is empirical in natural and aims to answer concrete practical questions. in this regard, the paper scores nicely as the experiments on evaluating performance is somewhat comprehensive in my opinion. \n\nweakness: i see two major drawbacks of this work, despite of its wide-covering experiments. \n\n1) many discoveries in this paper are rather intuitive and follows naturally from inspecting the algorithms. e.g., \"PrivBayes' performance on downstream tasks degrades when a stricter privacy budget is imposed...\" is the expected and much empirical verification is given in the original PrivBayes paper [1]. in this regard, there are only few truly novel empirical observations uncovered in the current work. \n\n2) the work uncovers two (somewhat) unexpected results in my opinion, but falls short in helping us understand how these empirical phenomena arise. e.g., on page 9, the paper suggests that \"we observed that more data does not always translate to improved quality for all models and evaluation.\" this is quite unexpected for DP machine learning, as workflows as such tend to be bottlenecked by fitting the training data (as opposed to combating overfitting). it'd therefore be useful to design and run experiments to understand why such observations are the case. for instance, are the results due to experimental noise? are the non-monotone results w/ GANs due to bad optimization? understanding why certain counter-intuitive behavior emerges would help future research in developing better methods.\n\n\n[1] Zhang, Jun, et al. \"Privbayes: Private data release via bayesian networks.\" ACM Transactions on Database Systems (TODS) 42.4 (2017): 1-41.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Y4SCyGxhPx", "reviewer": "Reviewer_vrg9", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "Synthetic data generation is a key application of differentially-private generative models---it allows you to build a synthetic dataset that can be used repeatedly without privacy risks for downstream ML or data science use cases. This paper presents an empirical evaluation of different DP generative models on mainly tabular datasets, e.g., studying how well they recreate the underlying data distribution and the various training costs.", "summary_of_the_review": "I think some of the findings can be useful to a broader community, but overall I find the evaluation and takeaways to be too limited to warrant a publication.", "strength_and_weaknesses": "Strengths:\n* This is very much a \"in-the-weeds\" paper that compares various methods on different metrics and datasets. I think some of the resulting findings will be useful for practicioners, e.g., runtime of various methods as you vary the number of features and number of rows. I also think for researchers developing new DP generative models, it'd be useful for them to evaluate their models on metrics like the ones proposed here.\n* I find it interesting that there are cases when using more training data can sometimes hurt. It adds to the growing literature that tuning hyperparameters when training with DP can be quite difficult, non-intuitive, and not in line with what works best for non-private ML.\n* I like seeing downstream comparison of methods from different model classes, e.g., deep generative models trained with DP-SGD versus graphical modeling approaches.\n\nWeaknesses:\n* One concern I have is that some of the \"main findings\" of the paper are actually just statements about the properties of the methods themselves (see introduction and RQ1/RQ2 in Section 4.5). For example, the claim that \"deep generative models spend their budget per training iteration and can handle much wider datasets but become slower with more data\" can be made without an empirical evaluation---the method has those strengths/weaknesses because of the very nature of how DP-SGD and neural nets work.\n* While I think tabular datasets are important to study for a wide variety of real-world settings, 4/6 of the tasks in this paper are variants of sampling from a gaussian distribution.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "HL3B9UxpNaO", "reviewer": "Reviewer_Rx8R", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors rigorously study the effects of varying N (number of samples) and d (dimensionality of the dataset) for 4 separate private generative modeling approaches (belonging to two different classes of algorithms). This is done at different privacy levels (epsilon) and the evaluation is based on both generative modeling metrics (correlation/mutual information between variables) as well as classification performance. As a result of this exercise, the authors are able to report some unique behaviors of different private generative modeling approaches. ", "summary_of_the_review": "While I like the rigor of the evaluations done by the authors, I believe there aren't very many novel generalizable insights that come from the current version of the paper. As such, it reads more like a workshop paper at the moment. However, if the authors were to expand the paper to models for more complex data modalities, I believe it might make for an interesting conference paper. ", "strength_and_weaknesses": "Strengths: \n1) The experimental setup used by the authors is very rigorous \n2) The question of how different generative models differ as a function of N, d and epsilon are somewhat interesting questions.\n\nWeakness: \n1) Beyond highlighting some of the differences between the 4 generative modeling approaches, I am struggling to find the novel contribution of the paper. \n2) The title of the paper and the claim that it examines how the privacy budget is being utilized is quite misleading in my opinion. \n3) The authors only consider models for tabular data generation here but the paper could be significantly improved by considering models that generate more complex data modalities e.g. images. In the case of images for instance, one might be interested in wondering how the difference in learned convolutional filters as a function of N, d and epsilon. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject