Causally Constrained Data Synthesis For Private Data Release
Authors: Varun Chandrasekaran
Darren Edge
Somesh Jha
Lukas Wutschitz
Amit Sharma
Cheng Zhang
Shruti Tople
Venue: Submitted to ICLR 2023 (2023)

Abstract: Data privacy is critical in many decision-making contexts, such as healthcare and finance. A common mechanism is to create differentially private synthetic data using generative models. Such data generation reflects certain statistical properties of the original data, but often has an unacceptable privacy vs. utility trade-off. Since natural data inherently exhibits causal structure, we propose incorporating \emph{causal information} into the training process to favorably navigate the aforementioned trade-off. Under certain assumptions for linear gaussian models and a broader class of models, we theoretically prove that causally informed generative models provide better differential privacy guarantees than their non-causal counterparts. We evaluate our proposal using variational autoencoders, and demonstrate that the trade-off is mitigated through better utility for comparable privacy.

Under review as a conference paper at ICLR 2023
CAUSALLY CONSTRAINED DATA SYNTHESIS FOR PRI- VATE DATA RELEASE
Anonymous authors Paper under double-blind review
ABSTRACT
Data privacy is critical in many recision-making contexts, such as healthcare and finance. A common mechanism to create differentially private synthetic data using generative models. Such data generation reflects certain statistical properties of the original data, but often has an unacceptable privacy vs. utility trade-off. Since natural data inherently exhibits causal structure, propose incorporating causal information into the training process to favorably navigate the aforementioned trade-off. Under certain assumptions for linear gaussian models and a broader class of models, we theoretically prove that causally informed generative models provide better differential privacy guarantees than their non-causal counterparts. We evaluate our proposal using variational autoencoders, and demonstrate that the trade-off is mitigated through better utility for comparable privacy.
INTRODUCTION
Automating Al-based solutions and making evidence- based decisions both require data analyses. However, in many situations, the data is sensitive and cannot be published directly. Synthetic data generation, which captures certain statistical properties of the original data, is useful in resolving these issues. However, naive data synthesis may not work: when improperly constructed, the synthetic data can leak information about its sensitive counterpart (from which it was constructed). Several membership inference (MI) and attribute inference attacks demonstrated for generative models (Mukherjee et al., 2019; Zhang et al., 2020b) eliminate any privacy advantage provided by releasing synthetic data. Therefore, effective pwwaacypreserving synthetic data generation methods are needed.
The de-facto mechanism used for providing privacy synthetic data release that of differential privacy (DP) (Dwork et al., 2006) which is known to degrade utility proportional to the amount of privacy provided. This is further exacerbated tabular data because of the correlations between different records, and among different attributes within a record. In such settings, the amount of noise required to provide meaningful privacy guarantees often destroys utility. Apart from assumptions made on the independence of records and attributes, prior works make numerous assumptions about the nature of usage of synthetic data and downstream tasks to customize DP application (Xiao et al., 2010; Hardt et al., 2010; Cormode al., 2019; Dwork al., 2009).
To this end, we propose a mechanism to create synthetic data that is agnostic of the downstream task. Similar to Jordan et al. (Jordon et al., 2018), our solution involves training a generative model to provide formal DP guarantees. A key distinction arises as we encode knowledge about the causal structure of the data into the generation process to provide better utility. Our approach leverages the fact that naturally occurring data exhibits causal structure. In particular, to induce favorable privacy vs. utility trade-offs, our main contribution involves encoding the causal graph (CG) into the training of the generative model to synthesize data. Considering the case of linear gaussian models, we formally prove that generative models trained with additional knowledge of the causal structure of the specific dataset more private than their non-causal counterparts. We extend this proof for more broader class of generative models as well.
To validate the theoretical results on real-world data, we present a novel practical solution utilizing variational autoencoders (VAEs) (Kingma & Welling, 2013). These models combine the advantage of both deep learning and probabilistic modeling, making them scale to large datasets, flexible to fit complex data a probabilistic manner, and can be used for data generation (Ma et al., 2019; 2020a). Thus, in designing our solution, train causally informed and differentially private VAEs. The

---

Under review as a conference paper at ICLR 2023
CG can be obtained from domain expert, or learnt directly from observed data (Zheng et al., 2018; Morales-Alvares et al., 2021) or by using DP CG discovery algorithm (Wang et al., 2020a). The problem of learning the CG itself is important but orthogonal to the goals of this paper.
We evaluate our approach to understand its efficacy both towards improving the utility of downstream tasks, and robustness an MI attack (Stadler et al., 2020). Further, we aim to understand the effect of true, partial and incorrect CG on the privacy vs. utility trade-off. We experimentally evaluate our solution on synthetic dataset where the true CG is known. We evaluate on real world applications: a medical dataset (Tu et al.. 2019), a student response dataset from a real-world online education platform (Wang al., 2020b), and perform ablation studies using the Lung Cancer dataset (Lauritzen & Spiegelhalter, 1988).
Through our evaluation, we show that models that are causally informed are more stable (Kutin & Niyogi, 2012) than associational (either non-causal, or with the incorrect causal structure) models trained using the same dataset. In the absence of DP noise, causal models enhance the baseline utility' by 2.42 percentage points (PPs) average while non-causal models degrade it by 3.49 PPs. With respect to privacy evaluation, prior works solely rely on the value of the privacy budget e. We take this one step further and empirically evaluate resilience to MI. Our experimental results demonstrate the positive impact of causal information in inhibiting the MI adversary's 's advantage on average. Better still, we demonstrate that DP models that incorporate both complete even partial causal information are more resilient to MI adversaries than those with purely differential privacy with the exact same e-DP guarantees.
In summary, the contributions of our work include:
1. A deeper understanding of the advantages of causality through theoretical result that highlights the privacy amplification induced by being causally informed ($ 3), and insight as to how this can be instantiated ($ 4.)
2. Empirical results demonstrating that causally constrained (and DP) models are more utilitarian in downstream classification tasks ($ 5.1) and are robust (on average) to MI attacks ($ 5.2).
PROBLEM STATEMENT & NOTATION
Formally, we define dataset D to be the set (xi, ..,) of n. records x; E X (the universe of records); each record x (x.,... rk) has k attributes (a.k.a variables X,. .g)).
Problem Statement:
We aim to design a procedure which takes as input private (or sensitive) dataset Dp and outputs synthetic dataset D.. The output should have formal privacy guarantees and maintain statistical properties from the input for downstream tasks. Formally speaking, we wish to design fo Z + X,
where 9 are the parameters of the method, and Z is some underlying latent representation for inputs in X. In our work, we wish for fa to provide the guarantee of differential privacy.
Differential Privacy (Dwork et al., 2006): Let E E R+ be the privacy budget, and H be randomized mechanism that takes dataset as input. H is said to provide g-differential privacy (DP) if, for all datasets Dj and D2 that differ on single record, and all subsets of the outcomes of running H: (D;) E S] S e (D)) S]. where the probability is over the randomness of H.
Sensitivity: Let d E Zt, D be collection of datasets, and define H : D + Rd, The é sensitivity of H, denoted A H, is defined by AH = max (D:) - H (D2)lla, where the maximum is over all pairs of datasets D1 and D2 in D differing in most one record.
We rely on generative models to enable private data release. If they are trained to provide DP, then any further post-processing (i.e., using them to obtain synthetic dataset) is also DP by post- processing (Dwork et al., 2014). In this work, we use variational autoencoders (VAEs) as our generative models.
Variational Autoencoders (VAEs) (Kingma & Welling, 2013): Data generation, ()) is realized by deep neural network (DNN) parameterized by 0, known as the decoder. To approximate the posterior of the latent variable pe p=(=|x), VAES use another DNN (the encoder) with x as input to produce an approximation of the posterior (2(x). VAEs are trained by maximizing an evidence lower bound (ELBO), which is equivalent to minimizing the KL divergence between (2(x)) and
Utility obtained from models trained the original datasct (without the use of any generative model).
2

---

Under review as a conference paper at ICLR 2023
po(2|x; (Jordan et al., 1999; Zhang et al., 2018). Solutions using VAES for data generation would concatenate all variables as X, train the model, and generate data through sampling from the prior p(Z). To train the model, we wish minimize the KL divergence between the true posterior p(z[x) and the approximated posterior qo (=|x), by maximizing the BLBO:
ELBO (=))()))) Po (x) 2)] KL ((=)x)]lp(=)]
Formally, the underlying data generating process (DGP) is character- ized by causal graph that describes the conditional independence relationships between different variables. In this work, we use the term causally consistent models to refer to those models that factor- ize in the causal direction. For example, the graph X1 - X2 implies that the factorization following the causal direction is p(X1, X2) = p(X1) - p(X2 ( Due to the modularity property (Woodward, 2005), the mechanism to generate X2 from X1 is independent from the marginal distribution of X1. This only holds in causal factorization but not in anti-causal factorization.
Causally Consistent Models:
PRIVACY AMPLIFICATION THROUGH CAUSALITY
Here, we present our main result. Stated simply: under infinite training data, causally consistent (or simply causal) models are more private than their non-causal (or associational) counterparts. We also characterize the conditions needed for this claim to be true under finite training data. For case of exposition, we first consider the setting of linear gaussian structural causal models (SCMs) where each node (i.e., variable) is generated as linear function of its parents in the causal graph (CG).
Causal and Associational models. Let M = f.) be a linear gaussian SCM corresponding to a CG G (X, Eg). X the set of variables (.1,-.. } Eg are the edges in the CG connecting them, represents the linear generating function for each variable x; E X. and are the error terms. We assume all variables are standardized to be zero mean and unit variance. We use upper-case variables to capture sets, bold-faced to capture vectors, and subscripts capture appropriate indexing.
In a linear gaussian SCM, each node is generated as a linear function of its parents (assuming no interaction between them).
(I) where Pa; is matrix of parent variables of x; (of size k; where n is the number of data points and h; I lt denotes the number of parents of 22),, and similarly B, is the estimated coefficient vector (of size k; x 1). The error terms G are mutually independent as well as independent of all other variables. We can also write it as X B.,eatt + 6; where X is the n x k matrix with all variables as columns and Bt,ent is an extended vector such that its value is fixed to 0 for all non-parents of ri.
x;, = Pa,B + E;
A causal generative model has additional knowledge of the CG. Since mechanisms of the SCM are stable and independent (Peters et al., 2017), fitting the causal generative model can be broken down into a set of separately fit linear regression models. For any variable x;, parameters Br are learnt (as (3) by minimizing the least squares error, l(E, xx,) Eje(n(( x/)², where &; is given by,
a; Pa.
An associational generative model does not have knowledge of the true CG. In general, it can be a generative model such as VAE. However, for learning linear functional relationships, it makes sense to instead learn set of linear regression equations, which is based on an alternative acyclic structure (e.g., an incorrect graph). For each v,, let H, be the feature matrix used to predict 24. We obtain,
H:7
(3)
where H; is the data for all features that generate the value of x; in the model, analogous to Pa. For each 34, 7: is the learnt parameter vector of the associational model.
We show that sensitivity of 3 = (BI.... .B is lower than or equal to (M1,'.. }- To do so, we first prove a result about comparing sensitivity of linear regression when features are chosen by the true data-generating process (DGP) not. Our result on linear regression can be found in Appendix A (see Lemma 1). Note that since our goal is to compare between models, we follow a different set of assumptions than standard DP on linear regression. Rather than assuming that the inputs are bounded, we assume that the error terms in the DGP are bounded, thus providing a bound on the values of parameters that are optimal for any point.
3

---

Under review as a conference paper at ICLR 2023
3.1 MAIN THEOREM
Theorem 1. Consider a linear gaussian SCM M = (X, with standardized variables (zero mean, unit variance). Let the true generative equations be expressed as,
Vx, X 3; Pa.f; C;
where (a) Pa; is the data matrix denoting all parents of x; in the CG corresponding to M, (b) Br are the true generative parameters, and (c) E an independent, symmetric error vector that bounded such that the maximum deviation from Gg that minimizes | - 33, for the jth data point 8maz- Let a mechanism take as input data points and output the parameters of the fitted linear generative functions. Then,
1. As + co, the sensitivity of the mechanism based on causal information is lower than that without it.
2. For finite whenever the empirical correlation of variable's 's parents with error is much less than the empirical correlation of the features used by the associational model with error (i.e.. Pa. 6 << H. e,2), the sensitivity of the mechanism based causal information is the lowest.
Proof idea.' Since a SCM consists of independent mechanisms, it is sufficient to prove the result for regression parameters of any one mechanism. Given a fitted linear regression for one of the nodes in the CG, its sensitivity is determined by stability: how much a new training point can alter the learnt parameters; the new point is also constrained be generated by the linear SCM equation, so the optimal learnt parameters for the new point is the the true SCM parameters (within 6mar bound).
In the infinite data regime, for a causal model, the fitted parameters are exactly the true SCM purameters since it uses exactly the parents as features. Whereas the associational model uses different set (with possibly correlated features) and therefore the learnt parameters for each feature are different than the SCM parameters. So a new point generated from the true SCM parameters can introduce a significant change in learnt parameters for associational models (note that new input is not bounded), while for causal models the effect is bounded by 9maz.
For finite data, we additionally need that the associational model deviates substantially from the causal features (i.e., the contribution of non-causal features the model is substantial); otherwise causal model may not have significant improvement on the sensitivity than the associational model.
The above proof also generalizes to case where all variables of SCM are not observed. We need the following assumption.
Assumption 1. For each node x, X for the SCM M, any unobserved parents Pa Papmobs are independent of all other observed parents of xı Pamss
Papiobs 1 Pa unoberj. k where Pap Patmobs Pa;
(5)
Corollary 1. Under Assumption 1, Theorem I is satisfied even if some variables of the SCM are unobserved.
By assuming strong convexity of the loss function, we are able to generalize our result beyond linear gaussian SCMs; the detailed proof is in Appendix B. The key insight again stems from the higher stability of causal models (in both the infinite and finite data regimes) resulting in lower sensitivity.
Why does causality provide any privacy benefit? In the case causal models, we know the proper factorization of the joint probability distribution. These factorized conditional probabilities remain stable even under new data that corresponds to a different joint distribution (Peters et al., 2017). Hence any learnt model using the factorization will be (worst-case) loss on unseen points (or points generated by the true DGP) is lower. In the associational case, the model does not have any such constraint, and thus may learn relationships that are not stable.
stable. Due this higher stability, its
OUR APPROACH AND IMPLEMENTATION
Our theoretical analysis shows the privacy benefit of training causally informed generative model for the linear gaussian case. In practice, the generation of synthetic datasets requires flexibility for
2T is used to denote the transpose of the matrix.
'The detailed proof is in Appendix A.
4

---

an MI attack specific Under review as a conference paper at ICLR 2023
downstream tasks and computational efficiency in large-scale applications. Therefore, propose our approach of building causally informed generative models using VAEs and implement this approach for evaluating Experiments were performed on a server with 8 NVIDIA GeForee RTX GPUs, 48 vCPU cores, and 252 GB of memory. All our code was implemented in python.
real-world datasets; salient features of each dataset is presented in Table 2.
4.1
CAUSAL DEEP GENERATIVE MODELS
Let us consider that the original dataset contains variables X and X2 and the causal relationship follows Figure 9() (in Appendix C.I). For example, X1 can be medical treatment, X2 can be medical test, and Z is the patient health status which is not observed. Instead of using VAE to generate the data, we design a generative model as shown in Figure 9(), where the solid line shows the model p(X1 X2, Z) = p(2) Pe, (Xx]z) pe, (X2)Xi, Z). and the dashed line shows the inference network 20 [ X1, X2). In this way, the model is consistent with the underlying CG.
The modeling principle is similar to that of prior work, CAMA (Zhang al., 2020a). However, CAMA only focuses on prediction and ignores all variables outside the Markov Blanket of the target. In our application, we aim for data generation and need to consider the full causal graph, and generalizes CAMA.
In this work, we assume that the causal relationship is given. In practice, this can be obtained from domain expert or using a careful chosen causal discovery algorithm (Glymour et al., manner (Wang et al., 2020a). Additionally,
Remark 1:
2019); the latter can be learnt in a tuffereeniaally-rrival recent advances enable simultaneously learning the CG and optimizing the parameters of a generative model informed by it Morales-Alvare et al., 2021). We stress that the contribution our work is understanding the influence of causal information the privacy associated with generative models, and not on mechanisms to learn the required causal information.
Remark 2: The theory propose in Appendices A and B show that the privacy amplification induced by causal information is agnostic of the particular choice of generative model. We utilize VAEs as the work of Morales-Alvaree et al. (2021) provides a platform for simultaneously performing (P1) causal discovery and (P2) causal inference. Recent work provides both the aforementioned properties in the context of generative adversarial networks (GANs) (Geffner et al., 2022) and flow-based models (Kyono et al., 2021), and validating their efficacy is subject of future research.
4.2 PRIVACY BUDGET (E)
For training our DP models, we utilize opacus vO. 10.10.0 0 library that supports the DP-SGD training approach proposed by Abadi et al. (2016) of clipping the gradients and adding noise while training. We ensure that the training parameters for training both causal and non-causal models are fixed. These are described in Appendix C. For all our experiments, we perform grid search to obtain the optimal clipping norm and noise multiplier. Once training done, we calculate the privacy budget after training using the Renyi DP accountant provided as part of the opacus package. The value of E for both causal and con-causal models is the same (refer Table 2).
4.3
MEMBERSHIPP INFERENCE (MI) ATTACK
Prior solutions for private generative models often use the value of as the sole measure for privacy (Jordon et al., 2018: Zhang et al., 2020b). In addition to E, to generative models to empirically evaluate if the models we train leak information (Stadler et al., 2020). In this attack, the adversary has access to (a) synthetic data sampled from a generative model trained with a particular record the training data, and (b) synthetic data sampled from a generative model trained without the same record in the training data. The objective of the adversary is to use this synthetic data (from both cases) and learn a classifier to determine if a particular record was used during training.
4.4 UTILITY METRICS
Utility is preserved if the synthetic data performs comparably to the original sensitive data for any given task using any classifier. To measure the utility change, we perform the following experiment: if dataset has k attributes, we utilize A attributes to predict the kth attribute. We randomly choose 20 different attributes to be predicted. Furthermore, we train 5 different classifiers for this task,
hhttps:////t wtt..cccomggttttcc//o/oooo/
5

---

Under review as a conference paper at ICLR 2023
Dataset (Baseline Unitity Kange)
DP
Non Causal
Cansal
kernel
avC
lagist ke
cf
knn
kwznel
2012
lug le
knn
SEDI (86 92%)
X
6.83
1.14
7.81
3.86
682
2.6
5.27
6.54
2.41
5.36
-6.83
-4.04
-2.74
-0.22
-6.13
-3.49
-000
6.09
-1.96
5.8
Pain10CD (88 95%6
<
x
9.56
5.42
6.34
5.5
2,48
1.31
5.66
6.22
40.544
2,03
-1.75
-1.84
4.03
1.56
-1.27
-3.66
2,22
2.11
4.64
-6.2
Pain5000 (92-98%)
<
4,09
6.89
5.68
688
2.27
5.22
-0.64
177
2.11
-0.4
4,58
0.62
0082
Table 1: Downstream Utility Change: We report the utility change induced by synthetic data on downstream classification tasks in comparison to the original data Le., (original data utility synthetic data utility). Negative values indicate the percentage point improvement, while positive values indicate degradation. The performance range of the classifiers we consider reported in parentheses next to each dataset. Observe that (a) DP training induces performance degradation in both causal and non-causal settings, and (b) performance degradation in the causal setting is lower than that of the non-causal setting.
and compare the predictive capabilities of these classifiers when trained on (a) the original sensitive dataset, and (b) the synthetically generated private dataset. The 5 classifiers are: (a) linear SVC (or kernel), (b) svc, (c) logistic regression, (d) rf (or random forest), (e) knn. Additionally, we draw pairplots using the features from the original and the synthetic dataset to compare their similarity visually. These pairplots are obtained by choosing 10 random attributes (out of the k available attributes). Refer Appendix E for more details.
5 EVALUATION
Since the accounting mechanism returns the same value of e, our evaluation is designed to understand:
If (DP) causally informed models negatively influence accuracy?
If causally informed models leak more information than their non-causal counterparts?
From our evaluation, we observe that:
In the absence of DP, causal models enhance the baseline utility computed using the original dataset by 2.42 percentage points (PPs) on average while non-causal models degrade it by 3.49 PPs ($ 5.1). The influence of causality (with DP) on MI resilience is nuanced. The general trend we observe is that, as the accuracy of causal information increases, so does the model's resilience to MI (S 5.2).
5.1 UTILITY EVALUATION
Table 1 shows the change in utility on different downstream tasks using the generated synthetic data when trained with and without causality well as DP. The negative values in the table indicate improvement in utility². We only present the range of absolute utility values when trained using the original data in the table and provide individual utility for each classifier in Appendix
We observe an average performance degradation of 3.49 percentage points (PPs) across all non-causal models trained without DP, and an average increase of 2.42 PPs in their causal counterparts. However, it is well understood that DP training induces a privacy vs. utility trade-off, and consequently the utility suffers (compare rows with DP and without DP). However, when causal information incorporated into the generative model, we observe that the utility degradation is less severe (compare pairs of cells with and without causal information). These results suggest that causal information encoded into the generative process improves the privacy utility trade-off i.e., for the same D-DP guarantees, the utility for causal models is better than their non-causal counterparts.
In Figure 1, we plot the utility (measured by the average accuracy across the 5 downstream prediction tasks) for both causal and associational models, for varied values of e. Observe that for a fixed e, the causal models always have better utility than their associational counterparts. Note that our work is the first to combine DP and causality. When compared with prior work, DP-PGM McKenna et al. (2019) (which uses only DP), observe that our approach (Causal in Figure 1) generates synthetic data that is more utilitarian than DP-PGM.
$ Alll trials were reported 5 times with different random seeds. The numbers reported in the table are an average of these trials.

---

Under review as a conference paper at ICLR 2023
130-
200
Rie Graia
10
(a) EEDI (Condensed)
(b) EEDI (Morales-Alvarez al. (2021))
(a) 10000000
(b) Pain50Dd
Causal models always outperform their associational counterparts, for the
Figure 1: Utility vs. Privacy:
Figure 2:
More Causal Information: EEDI
Morales- Alvarez et al. (2021) is resilient to MI attacks modeell
with te using a generative model trained using the approach proposed by Morales-Alvarez al. Morales-AN Alvarez et al. (2021), and the results are not significantly different from those presented in Table (which we omit for brevity).
S.
Note that we evaluated the quality of synthetic data
5.2 EVALUATING MI RESILIENCE
Understanding the influence of causal information on MI requires nuanced discussion. Thus far, our discussion has focused on how perfect causal information can be used to theoretically minimize However, causal information is often incomplete/partial, or incorrect. Our evaluation answers:
1. What is the effect of complete, partial and incorrect causal information on MI attack accuracy? 2. What is the effect on MI attack accuracy when a causally informed VAE is trained both with and without DP?
We summarize our key results below:
Knowledge of complete CG and training with DP consistently reduces the adversary's advantage across different feature extractors and classifiers i.e., provides better privacy (Figure 3). We observe that incorrect causal information has disparate impacts on resilience MI. While introducing spurious correlations improves MI efficacy, removing causal information reduces MI efficacy but also degrades utility ($ 5.2.2).
3. Even partial causal information reduces the advantage of the adversary when the model is trained without DP and in most cases, with DP as well. As the accuracy of causal information increases, so does the model's resilience to MI attacks ($ 5.2.3).
Evaluation Methodology. We train generative models: one that encodes information from a CG and one that does not. We train each of them with and without DP, and thus have 4 models in total. For all our datasets, we evaluate these models against the MI adversary ($ 4.3), and compute the attack accuracy when method (DP/causal consistency) Note that as part of the MI attack, we are unable to utilize the Corre lat ion and Ensemble feature extractors for the EEDI dataset due to computational constraints in our server.
used in comparison to when it is used.
5.2. WITH COMPLETE CG
We conduct toy experiment with synthetic data where the complete (true) CG is known apriori. The data is generated based on the CG defined in Appendix D. The results are presented in Figure 3. Here, advantage degradation the change MI success between scenario when DP not used, and when DP is used for training (positive values are better). Observe that in both the causal and non-causal model, training with DP provides an advantage against the MI adversary, though to varying degrees. However, the important observation is that causal models provide greater resilience average in comparison to the non-causal model.
5.2.2 ABLATION STUDY: INCORRECT CG
Many real-world datasets do not come with their associated CGs. CGs obtained from domain experts, or those learnt through algorithmic means are potentially erroneous. We wish to understand how these errors assist MI adversaries. To this end, we utilize the causally informed generative modelling framework of Morales-Alvarte et al. (2021) to synthesize data for 3 different models for the Lung Cancer r dataset: (a) armed with the true CG (baseline),
(b) with an edge added, and (c) with an edge introduced to induce enror in the CG. The results of
removed. Observe that the last 2 scenarios average MI success (obtained by averaging the efficacy of the MI attack (Stadler et al., 2020) using classifiers) is presented in Figure 4 (lower is better). By adding edges, introduce more spurious
7

---

Under review as a conference paper at ICLR 2023
tnn
random forsst
SVC
avc. keme
orggndation
Hays
Cer
(b) Causal
(c) Non Causal
Convecttion Ensemble HEROO
Nabe
Figure 3: True CG: Both causal and non-cane non-causal mod- els trained with DP reduce the adversary's 's advantage. Causal models provide more advantage degradation on average.
Figure 4: Incorrect CGs: For the Lung Cancer dataset, adding edges (introducing spurious relation- ships) enables the MI adversary, but removing edges (disahling causal relationships) hurts it.
NJ
+Mag/s Eaniiin Eword
Saae:
EEDI
(b) P Pain5000
REDI
(b) Pa Pain5000
Figure 6: Partial Causal Information DP: We plot MI success when the adversary uses non- causal model and switches to its causal counterpart, Observe that in the presence of DP & causal infor- mation, the adversary is less effective.
DP: plot the (average) MI success the adversary uses a non- causal model and switches to its causal counterpart, Ob- serve that even in the absence of DP, causal information by itself provides resilience against our MI adversary.
Figure 5: Partial Causal Information
correlations which the MI adversary exploits, but by removing (causal) edges, we remove signal that the MI adversary can use. While removing edges may seem tempting from a privacy perspective, the average (across trials) downstream utility of the data generated from the corresponding model suffers. The utility of the data generated from the true CG is 82.94% which reduces to 81.8% when edge is added and futher to 79.67% when an edge is removed. Our results show that while knowing a true CG always useful both for privacy and utility, having access an approximate CG may also provide privacy benefits at the cost of utility.
ways model may use incorrect causal structure: missing true parent of a node, or adding an incorrect parent. Corollary already covers the first: with missing parents in the causal model, the result of lower sensitivity for causal models holds long as Assumption is true. So overall, missing parents is a weaker violation and we may still obtain the same benefits. But if model adds an incorrect parent, then its sensitivity will definitely increase.
Disclaimer:
There
5.2.3
WITH PARTIAL CG
For the real world EEDI and Pain datasets, we follow two approaches: (a) we utilize information from domain experts to partially construct condensed CG (where several variables are clubbed into a single node of the condensed CG), and (b) we learn a CG from data and simultaneously train a VAE that is informed by it (Morales-Alvarez et al., (021)-resulting in larger, yet partial CG. Note that due to space constraints, we only report results for out the 3 datasets we evaluate. The trends from Painl 11100 000 are similar that of Pa Pain500 55000 and are in Appendix F.
Effect of only Causality. Figure 5 shows the MI adversary's 's advantage when the model incorporates causal information in the absence of DP. Observe that across both datasets, causal models result in more resilient models i.e., lower attack accuracy. While this effect is moderate in the EEDI d (Figure 5a) (where the i st. stogrart am features enable more effective attack in the causal model), this effect is more pronounced the Pa i n5000 dataset (Figure 5b). This suggests that standalone
Unlike the other datasets we consider, the EEDI dataset sparse. The Hist ogrra attack relies on counting the number of entries for particular feature to aid in disambiguation, while the Naive attack relies condensing the entire dataset to summary statistics (such as mean, median, mode); we conjecture that sparsity helps the adversary in this case.
8

---

Under review as a conference paper at ICLR 2023
causal information provides some privacy guarantees. We conjecture that the MI adversary uses the spurious correlation among the attributes to perform the attack. Even partial causal information is able to eliminate spurious correlation present in the dataset. Hence, a causally informed VAE is also able to reduce the MI adversary's 's advantage.
Effeet of Causality with DP. Figure 6 shows the results for models trained using partial causal information with DP. Similar to the earlier results (of causal information and no DP), models trained with DP and causal information are more resilient to MI attacks. These results validate that causality amplifies privacy provided by DP training. We iterate that from results in Figure 1 we show that for the same E-DP guarantees, models learnt using causal information provide higher utility, thereby providing promising direction to balance the privacy vs. utility trade-off.
The results thus far rely on domain experts to partially construct a condensed CG. To see if additional causal information provides more resilience, we repeat the experiments with the REDI I dataset using the generative model proposed by Morales-Alvarez et al. (2021) that learns a CG from data. We utilize the same training configuration as in the earlier case, resulting in model learnt with Rs 13., which learns a CG with 57 nodes (compared to the 3 node CG used thus far). From Figure 2, observe that we provide more accurate causal information to the causal model, its effects privacy exacerbated by the presence of DP noise specifically for the attack using Naive features. The attack using H stogram features in unaffected even with DP providing empirical evidence recent work that questions the sufficiency of DP training against MI attacks (Humphries et al., 2020).
5.3 DISCUSSION
1. Better understanding of MI. Yeom et al. (2018) exploit the relationship between MI and overfit- ting, and propose DP training as a defense through a loose bound. However, recent work suggests that DP training by itself is insufficient (Humphries et al., 2020), and often implemented incorrectly leading to faulty conclusions (Tschantz et al., 2017). Our results also partially corroborate this observation but further exploration is needed to understand the cause of MI in different settings. 2. Loose privacy budget. The values of e used in our experiment are large. This a result of the batch size and training duration of the VAES we use as DP training is expensive. If computation resource is not a constraint then we should be able to get smaller epsilon values. There is extensive discussion by Bhowmick et al. (2018) and Nasr et al. (2021) which discusses different threat models where larger values of are tolerable.
3. Non-convex loss functions. VAEs are deep learning models trained to minimize ELBO which is highly non-convex. Research shows that deep learning framework demonstrate for example locally convex properties (Lucas al., 2021; Littwin& & Wolf, 2020) which explains our results.
4. Overheads: The work of Morales-Alvaree Alvarez et al. (2021) discusses an approach to simultaneously learn the CG and train the generative model with said structure. In practice, we observed that causal discovery using this method adds limited overhead (~ 100 epochs of additional training).
6 RELATED WORK
The primary issue associated with private synthetic data generation involves dealing with data scale and dimensionality. Solutions involve using Bayesian networks to add calibrated noise the latent representations (Zhang al., 2017: Jälkö et al., 2019), smarter mechanisms to determine correlations (Zhang et al., 2020b). Utilizing synthetic data generated by GANs has been extensively studied, but only few solutions provide formal guarantees of privacy (Jor- don et al., 2018; Wu et al., 2019; Harder et al., 2020; Torkzadehmahani et al., 2019; Ma et al., 2020b; Tantipongpipat et al., 2019; Xin al., 2020; Long et al., 2019; Liu et al., 2019). Across the spectrum, very limited techniques are evaluated against MI adversaries (Mukherjee et al., 2019).
Private Data Generation:
Membership Inference: Most MI work focuses on the discriminative setting (Shokri et al., 2017). More recently, several works propose MI attacks against generative models (Chen et al., 2020; Hilprecht et al., 2019) but offer a limited explanation as to why they are possible. Tople et al. (2020) show the benefits of causal learning to alleviate membership privacy attacks but only limited to classification models and not for generative models.
7 CONCLUSIONS
Our work proposes a mechanism for private data release using VAFs trained with differential privacy. Theoretically, we highlight how causal information encoded into the training procedure can potentially amplify the privacy guarantee provided by differential privacy, without degrading utility. Empirically, we show how causal information enables advantageous privacy vs. utility trade-offs.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Abhishek Bhowmick, John Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan Rogers. Protec- tion against reconstruction and its applications in private federated learning. arXiv preprint arXiv: 18/2.00984 2018.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 343-362, 2020.
Graham Cormode, Tejas Kulkarni, and Divesh Srivastava. Answering range queries under local differential privacy. Proceedings of the VLDB Endowment, 12(10): 126-1138, 2019.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pp. 265-284. Springer, 2006.
Cynthia Dwork, Moni Naor, Omer Reingold, Guy Rothblum, and Salil Vadhan. On the complexity of differentially private data release: efficient algorithms and hardness results. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pp. 381-390, 2009.
Cynthia Dwork, Aaron Roth, al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4) 2014.
Tomas Geffner, Javier Antoran, Adam Foster, Wenbo Gong, Chao Ma, Emre Kiciman, Amit Sharma, Angus Lamb, Martin Kukla, Nick Pawlowski, et al. Deep end-to-end causal inference. arXiv preprint arXiv:2202.021 095. 195, 2022.
Clark Glymour, Kun Zhang, and Peter Spirtes. Review of causal discovery methods based on graphical models. Frontiers in genetics, 10:524, 2019.
Frederik Harder, Kamil Adamczewski, and Mijung Park. Differentially private mean embeddings with random features (dp-merf) for simple & practical synthetic data generation. arXiv preprint arXiv:2002.1 1603, 2020.
Moritz Hardt, Katrina Ligett, and Frank McSherry. simple and practical algorithm for differentially private data release. arXiv preprint arXiv: 1012.4773 2010.
Benjamin Hilprecht, Martin Härterich, and Daniel Bemnu. Monte carlo and reconstruction member- ship inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019(4):222-249, 2019.
Thomas Humphries, Matthew Rafuse, Lindsey Tulloch, Simon Oya, Ian Goldberg, Urs Hengartner, and Florian Kerschbaum. Differentially private learning does not bound membership inference. arXiv preprint arXhv:2010.12112 2020.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
Joonas Jalkö, Eemil Lagerspetz, Jari Haukka, Sasu Tarkoma, Samuel Kaski, and Antti Honkela. Srivacy-preservee data sharing via probabilistic modelling. arXiv preprint 1rXiv:1912.04439, 2019.
Michael I Jordan, Zoubin Ghahramani, Tommi S Jaakkola, and Lawrence K Saul. An introduction to variational methods for graphical models. Machine learning, 37(2):183-25 1999.
James Jordon, Jinsung Yoon, and Mihaela van der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2018.
10

---

Under review as a conference paper at ICLR 2023
Diederik P Kingma and Max Welling. arXiv:1312.61 14, 2013.
Auto-encoding variational bayes.
arXiv preprint
Samuel Kutin and Partha Niyogi. Almost-everywhere algorithmic stability and generalization error. arXiv preprini 130iv: 0.00,, 2012.
Trent Kyono, Yao Zhang, Alexis Bellot, and Mihaela van der Schaar. Miracle: Causally-aware imputation via learning missing data mechanisms. Advances in Neural Information Processing Systems, 34, 2021.
Steffen Lauritzen and David Spiegelhalter. Local computations with probabilities on graphical structures and their application expert systems. Journal of the Royal Statistical Society: Series (Methodological), 1572)44 1988.
Etai I Littwin and Lior Wolf. On the convex hehavior of deep neural networks in relation to the layers' width. arXiv preprint arXiv:2001.04878 2020.
Yi Liu, Jialiang Peng, JQ James, and Yi Wu. Ppgan: Privacy-preserving generative adversarial network. In 2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS), pp. 985-989. IEEE, 2019.
Yunhui Long, Suxin Lin, Zhuolin Yang. Carl Gunter, and Bo Li. Scalable differentially private generative student model via pate. arXiv preprint
2019.
James R Lucas, Juhan Bae, Michael R Zhang. Stanislav Fort, Richard Zemel, and Roger B Grosse. On monotonic linear interpolation of neural network parameters. In International Conference on Machine Learning, pp. 7168-7177 PMLR, 2021.
Chao Ma, Sehastian Tschiatschek, Konstantina Palla, Jose Miguel Hernandez-Lobato Sebastian Nowozin, and Cheng Zhang. Eddi: Efficient dynamic discovery of high-value information with partial vae. In International Conference Machine Learning, pp. 4234-4243, 2019.
Chao Ma, Sehastian Tschiatschek, José Miguel Hernández-Looato, Richard Turner, and Cheng Zhang. Vaem: a deep generative model for heterogeneous mixed type data. arXiv preprint arXiv:2006.J 11941, 2020a.
Chuan Ma. Jun Li, Ming Ding, Bo Liu, Kang Wei, Jian Weng, and H Vincent Poor. Rdp-gan: Ar) 'enyi- differential privacy based generative adversarial network. arXiv preprint arXiv:2007.02056 2020b.
Ryan McKenna, Daniel Sheldon, and Gerome Miklau. Graphical-model based estimation and inference for differential privacy. In International Conference on Machine Learning, pp. 4435- 4444. PMLR, 2019.
Pablo Morales-Alvaree Angus Lamb, Simon Woodhead, Simon Peyton Jones, Miltos Allamanis, and Cheng Zhang. Vicause: Simultaneous missing value imputation and causal discovery. Tech- nical Report ASR-TR--021--1 ICMI. 2021 workshop on the Neglected Assumptions Causal Inference, July 2021.
Sumit Mukherjee, Yixi Xu, Anusua Trivedi, and Juan Lavista Ferres. privgan: Protecting gans from membership inference attacks at low cost. In PETS, 2019.
Milad Nasr, Shuang Song, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlini. Adver- sary instantiation: Lower bounds for differentially private machine learning. arXiv preprint arXiv:2101 04535, 2021.
Jonas Peters, Dominik Janzing, and Bernhard Schölkopf. Elements of causal foundations and learning algorithms. The MIT Press, 2017.
Shai Shalev-Shwartz and Shai Ben-David. Understanding machine learning: From theory to algorithmss Cambridge university press, 2014.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 3-18. IEFE, 2017.
11

---

Under review as a conference paper at ICLR 2023
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data privacy mirage, 2020.
Uthaipon Tantipongpipat, Chris Waites, Digvijay Boob, Amaresh Ankit Siva, and Rachel Cum- mings. Differentially private mixed-type data generation for unsupervised learning. arXiv preprint 1r11v:111..03250, 2019.
Shruti Tople, Amit Sharma, and Aditya Nori. Alleviating privacy attacks via causal learning. In International Conference on Machine Learning, pp. 9537-9547. PMLR, 2020.
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. Dp-egan: Differentially private synthetic data and label generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 2019.
Michael Carl Tschantz, Shayak Sen, and Anupam Datta. Differential privacy causal property. arXiv preprint arXiv: 1 1710.05899. 2017.
Ruibo Tu, Kun Zhang, Bo Christer Bertilson, Hedvig Kjellström, and Cheng Zhang. Neuropathic pain diagnosis simulator for causal discovery algorithm evaluation. arXiv preprint 1906:099007733 2019.
Lun Wang, Qi Pang, and Dawn Song. Towards practical differentially private causal graph discovery. arXiv preprint arXiv:2006.00 2005:20006088988, 2020a.
Zichao Wang. Angus Lamb, Evgeny Saveliev, Pashmina Cameron, Yordan Zaykov, José Miguel Hernández-Lobaro, Richard E Turner, Richard G Baraniuk, Craig Barton, Simon Peyton Jones, et al. Diagnostic questions: The neurips 2020 education challenge. arXiv preprint arXiv:2007. 12061, 2020b.
James Woodward. Making things happen: A theory of causal explanation. Oxford university press, 2005.
Bingzhe Wu, Shiwan Zhao, Chaochao Chen, Haoyang Xu, Li Wang, Xiaolu Zhang. Guangyu Sun, and Jun Zhou, Generalization in generative adversarial networks: A novel perspective from privacy protection. In Advances in Neural Information Processing Systems, pp. 307-317, 2019.
Yonghui Xiao, Li Xiong, and Chun Yuan. Differentially private data release through multidimensional partitioning. In Workshop on Secure Data Management, pp. 150-168. Springer, 2010.
Bangzhou Xin, Wei Yang, Yangyang Geng, Sheng Chen, Shaowei Wang, and Liusheng Huang. Private fl-gan: Differential privacy synthetic data generation based on federated learning. In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2927-2931. IEEE, 2020.
Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pp. 268-282 IEEE, 2018
Cheng Zhang, Judith Bütepage, Hedvig Kjellström, and Stephan Mandt. Advances in variational inference. IEEE transactions pattern analysis and machine intelligence, 41(8):2008 20062000002226 2018.
Cheng Zhang, Kun Zhang, and Yingzhen Li. A causal view on robustness of neural networks. arXiv preprint XxXv:20055.0095, 2020a.
Jun Zhang, Graham Cormode, Cecilia M Procopiuc, Divesh Srivastava. and Xiaokui Xiao. PrivBAYES: Private data release via bayesian networks. ACM Transactions on Database Systems (TODS), 42(4):25, 2017. https: / acm. wttg//oo//paoooooooooooooooo http://///p//11111///11111
Zhikun Zhang, Tianhao Wang, Ninghui Li, Jean Honorio, Michael Backes, Shibo He, Jiming Chen, and Yang Zhang. Privsyn: Differentially private data synthesis. arXiv preprint 2:X1v22012.15128, 2020b.
Xun Zheng, Bryon Aragam, Pradeep Ravikumar, and Eric P Xing. Dags with no tears: Continuous optimization for structure learning. arXiv preprint 1rXiv:1803.01422 2018
12

---

Under review as a conference paper at ICLR 2023
A DETAILED PROOF: BENEFITS OF CAUSAL LEARNING IN LINEAR GAUSSIAN SCM
A.1 BACKGROUND
= be linear gaussian structural causal model corresponding to causal graph G (X, where (a) X is the set of variables, G is the causal graph connecting them through edges Eg. (b) f represents the of linear generating functions for each variable æ; E X, and (c) are the error terms. We assume that all variables are standardized to be zero mean and unit variance.
In a linear gaussian SCM, each node is generated as linear function of its parents (we assume without any interaction terms). The error terms are mutually independent and independent of all variables.
+
Σ B Paf + E;i a, = Pa,3; tG
(6)
where Pad is a vector referring to the values of jth parent of node Tú Pa; refers to a matrix of data values with parents of z2 as columns (total k; columns, where k, is the number of parents of x.;) and rows as data-points, and B3 refers to the true coefficient vector (or structural causal parameter). Alternatvelly, we can write it as X (eatt + E; where X the matrix with all variables as columns and Bret is an extended vector such that its value is fixed to O for all non- non-parents of 24.
causal generative model has additional knowledge of the graph structure. Since mechanisms of SCM are stable and independent (Peters et al., 2017), fitting the causal generative model can be broken down into a set of separately linear regression models. For any variable æ;, parameters 3 = . are learnt (as (3)) by minimizing the least squares error, ((x,, 28,) EjEm (a) x²)²
3 S3..... S:c
where d is given by
à; SdpPa a; = Pa.
An associational generative model does not know the true causal graph, so it may learn an alternative generative acyclic structure, which is also reducible to set of independently fitted linear regressions. For each æ4, let H, be the matrix denoting the features used to predict æ; (columns are features, rows are nata-points). We obtain
è; = Entmi a; H,7
(8)
where Hi and H; is the individual 7th parent data vector and all parents' data matrix respectively, analogous Pat and Pa;- Y/ is the learnt parameter vector of the associational model, for each
A.2 GOAL
Our goal is to show that sensitivity of 3 [.61.... ,, is lower than equal to (71..... Yo }.
To do so, we first prove result about sensitivity of linear regression, which is used to estimate the parameters of the generative model. Note that since our goal is to compare between models, follow a different set of assumptions than standard differential privacy on linear regression. Rather than assuming that the inputs are bounded, we assume that the error terms in the DGP are bounded, thus providing a bound on the parameter values that are optimal for any point.
Our proof utilizes the following strategy. First, we define 2 worlds: world where where a model is leart with causal information, and world 2 where model is learnt without this causal information. Next, we measure the sensitivity of the parameters learnt in both worlds and demonstrate that the sensitivity is lower in world than world 2. This suggests that if DP is used in both worlds, the privacy budget world will be lower than that of world 2.
A.3 PRIMER
Lemma 1. Consider dataset (X), "5,,8', 13) where the labels are generated by the following equation: y 5xx + c where X. C X refers to variables having non-zero coefficient in the true data-
"This equation holds for the data generating distribution; dataset is sampled from this distribution. More generally, this is the data-generating equation of the SCM that defines the distribution.
13

---

Under review as a conference paper at ICLR 2023
generating process (DGP) of y. X. corresponds to the data matrix associated with variables in X and e is independent error that is bounded and symmetric. e is bounded such that the maximum deviation from [3 that minimizes lyy -3 for any jth data-point is mmax- Consider two linear regression models fit to this dataset, one that has knowledge of the true DGP and includes X. as features, and one that does and includes different subset X C X as features. Assume all variables are standardized (zero mean, unit variance).
1. As + 0G, the sensitivity of linear regression model fitted over Xe is lower than or equal the sensitivity of the linear regression model fitted over Xa-
For finite n, whenever the empirical correlation of X with error is much less than other features Xa with error, Xee << Xac, the sensitivity of the mechanism based on causal information is lower than that of the mechanism without it.
Proof. WARM-UP: TWO VARIABLE REGRESSION
As warm-up exercise, consider a 2-variable regression where X = (x1, x2).. 37 a part of the true DGP for y (i.e., causes y), while is not part of the DGP for y but is related to y (it may be part of Markov Blanket of y, or simply be correlated with y). As stated in the Lemma, the corresponding data-generating equation is
y = 3x1 +
(9)
(Causal) X Model. The model will use the following for predicting
ú = 3,æ1
(10)
leading to the following learnt parameter,
31 Σ any
Σ x1 (3r1 +c) = 33+
Eni ΣN
(11)
To calculate sensitivity, assume the existence of adversary that wishes add more point to the training process such that the estimated parameters are farthest from what is currently achieved (capturing the definition of sensitivity).
Sensitivity. Let us consider a new data-point added to the training set by an adversary, to maximize
difference between 81 and 31 (the estimated parameter obtained after adding the adversarial data- point). Any new input chosen by the adversary will be generated based on Eqn 9.
Note that the definition of DP is for any 2 databases from universe of databases; Eqn 9 captures this universe. Since the adversary operates in the same world, any point they sample has to also obey the same equation. Their overall distribution can be different, e.g., Pr(y) 21, 222) can be different, but Pr(y)z)) has to remain the same.
Since the error is bounded, the adversary tries to generate point such that new estimated 31 is farthest from above. That is, the adversary may choose a point such that the parameter obtained after minimizing the squared loss using that point is 3 + 6maz minimizes the squared loss on the point. Further, the adversary can choose a point with large enough o such that estimate on the entire dataset matches 3 òmaz. This can be done by choosing a point (z1, v') such that E=+
òmaz.
+
+ Thus, for the parameter corresponding to variable æ the sensitivity is J6maz! + parameter corresponding to the variable the sensitivity zero (since there no parameter).
Σ Encs For the Σ
(Associational) X, Model. In contrast, the full regression model will use the following parameters. Since Z2 is not independent of y after conditioning on æ1, the model may include 22 since it may result in predictive accuracy gain for
" = 71.11 + 7202
(12)
leading to the following leantt parameters,
Σ x3 Σ a1y Σ x1 Σ x2y
Σ x Σ 23
[ x122)²
(13)
Σdf Σ B2y Σ 21 Σ 21
1/2
Σ x Σ 23 C x
14

---

Under review as a conference paper at ICLR 2023
Sensitivity. Compared to the X model, the second parameter (f2) will have non-zero sensitivity (while that for causal model is zero). So we focus on showing that the first parameter in will also have a higher sensitivity. Observe that the first parameter can be rewritten as
21
B21 c)
E 212 (3x + = Σe E rie 1112
Σ
Σ
Σ 3
2112)
E 2 (14)
Now the adversary can select a (a 2 y") such that z = 0. Here 2y iy's coefficient becomes irrelevant and the parameter that minimizes error on any new adversarial point is 3 + òmaz. Thus, the sensitivity of the first parameter is
Σ IIE E1 Σ 226 Σ
hi B + Smarl
[8mar
22 ( x1
Note that this sensitivity can be achieved by choosing x", y" (and therefore e") for a new adversarial point such that its value is much higher than other points and thus the estimated coefficient tends to 3 + 6maz.
We now prove the main claims.
1. Infinite Data. As n + 00, ΣzΙe= 0 because and e are independent, by property of the generative process. But Σ 726 o because it is correlated with y. Thus, for infinite data, sensitivity of X model ((0mar)) is lower than another Xa model.
Finite Data. For finite data, if Σ Øze >> 2i, then sensitivity of X. model is lower than or equal to the Xa model.
PROVING THE GENERAL CASE
Using the closed form solution for linear regression, we can write,
β = [ Z)
(15)
where is matrix denoting the model's features' values and y is column vector denoting the values in a dataset for the variable y. For the causal model, Z X the true variables from the DGP. Expanding y based on the DGP equation,
ه (X
y - X.)3 (X) -x)--((x
(16)
A = B+ [ xx) (xx
In contrast, for the associational model, we obtain
6 = H
(17)
-
where H represents X..
The set of features H used by the X, model may not be equal to the true DGP variables, X.. Thus, the above can be rewritten in terms of the true parameter, B, as follows,
3 (H" H) H" (X.0) (H" H) (H''))
= (H' H HH" (HBr.eztedddd + S + H (H'
(18)
" Brextended + (H - SB' + (H H) (
where Bi,extended and B are simply re- paramettrrizaions of the true G; they are zero for all variables X.. (ieextenedd is extension of B for variables in H. and B is an additional vector which is used only if does not include all true DGP variables X,. S is the matrix denoting data for all X, that not in H
15

---

Under review as a conference paper at ICLR 2023
PROOF OF MAIN CLAIM
Infinite data case. Error is independent of the DGP variables, i.e., X 0 as the number of samples n 20. Thus, / 33 and any new training point provided by the adversary will also be generated using the same true , (within an bound of =mmaz). Thus, f = f sma will also be optimal for this new point and the estimated value will change within ōmaz.
For the X model, however, note that 5 * 33 unless H X- We provide construction for adversary's s input such that estimated Ý will change more than or equal to ómaz after adding that input. For all variables 24 E X, that are correlated (not Xc), an adversary chooses value of iV = and generates y using 33 such that the correlation between y and 2ς, is broken. Further, for the X. features and y, the adversary is constrained to choose an input such that 7x. = 3 = Ômaz is optimal on the input, irrespective of the value of other y dimensions (since Fy 0). That is, after addition of new point, the least squares optimization will ignore 2yk and move fxx closer to B for the X features. The total sensitivity is [3x. 31 + |maal for the parameters corresponding to X.. For all other parameters, the X₂ model outputs value of zero (and hence sensitivity of zero), which trivially lower than or equal to the X₂ 's model's parameter sensitivity for those parameters.
Finite data case. In the finite data case, given fitted 3 the sensitivity that a new adversarial point can lead to is [3 + maa - A (x" Xx) E)] |omaæl (from Eqn 16). For large-enough x should be close to zero due to independence. Sensitivity of coefficients for all non-parents is zero. For the Xa model, the coefficients can be written as,
4 eattenddd + (H" (H'
HT SB'
-HH
(19)
As we can see, for the variables & Xe. ` depends on the data and therefore will have a non-zero sensitivity to new data-point, greater than the X model.
We next consider sensitivity of parameters corresponding variables in Xe. As with the infinite data case, to generate new input, the adversary can set the value of variables such that the non-X, features in E H become O. Then optimal 7x, for the new point will be 8 + 8maz (which is equivalent to Bextended + mmax), and sensitivity will be the last two terms from Equ 19 plus 8maz (which can be achieved by sufficiently high values of X, variables for the adversarial point). Thus, sensitivity is |,3 + 8maz - - and S correspond to the true G and X. respectively. the sensitivity of X. model will be higher than X. model's sensitivity for the same parameter whenever <>>>>>>> X
I(H H) H S3' + (H² H) ] + [6maz]- Since f
We now use this lemma to prove our main theorem.
A.4
MAIN THEOREM
Theorem 1. Consider a linear gaussian SCM M = f5)) with standardized variables (zero mean, unit variance). Let the true generative equations be expressed as,
Vx; E X I; = Pa. +
(4)
where (a) Pay is the data matrix denoting all parents of x, in the CG corresponding to M. (b) Br are the true generative parameters, and (c) is an independent, symmetric error vector that is bounded such that the maximum deviation from Br that minimizes |xt -3,Pa for the jth data point is 8maz. Let a mechanism take as input n data points and output the parameters of the fitted linear generative functions. Then.
As n + 0o, the sensitivity of the mechanism based on causal information is lower than that without it. For finite n, whenever the empirical correlation of a variable's 's parents with error is much less than the empirical correlation of the features used by the associational model with error (i.e., Pa 6; << HiL e,²) the sensitivity of the mechanism based on causal information is the lowest.
Proof. WARM-UP: Three node SCM. As a warm-up, consider 3-node SCM where X σ1 causes T3, while 22 does not have causal relationship with I3 but is related
(21, N3).
ST is used denote the transpose of the matrix.
16

---

Under review as a conference paper at ICLR 2023
to Iy (it may be part of Markov Blanket of ø3, or simply be correlated with 23. The corresponding getteaenngg equations are,
31 = 61
12(11, 13, 33 - 8341 + 63
(20)
where f2 can be any linear function (72 optionally caused by 21). If 22 depends on I3, will be a child of I3; if 22 depends on 21, it will be correlated with Zz; if z2 depends on both 21 and 33, will be both a child and correlated with z3- Let us consider the estimation equation for any
r; The proof logic follows the same way for other estimating equations, since they correspond to independent mechanisms.
Causal Model. The causal model will use the following model for predicting Tg.
3 = 33.1
(21)
Associational Model. In contrast, the associational generative model will use the following parame- ters. Since 72 is not independent of za after conditioning on Ti, the model may include 22 since it may result in predictive accuracy gain for T3.
21 75
(22)
Using Lemma 1, we see that causal model corresponds to the true DGP, whereas associational model does not. Thus, sensitivity of causal model is lower than or equal to associational model, under the same conditions (where Xe is replaced by causal parents Pa {x1} and Xa by H {o1, 22)).
We can analogously use Lemma for the general case with all variables.
The above proof also generalizes to case where all variables of SCM are not observed. We need the following assumption.
Assumption 1. For each node I; X for the SCM M, any unobserved parents Paynobe are independent of all other observed parents of x4, Pacbs
Pajiobs L Pa
w.nbbba le where Pat Pa pambb Pa;
(S)
If all parents of a node x; observed, the above assumption is true trivially. If all parents not observed (e.g., x, shares an unobserved common cause with another variable), then this assumption ensures that the estimated error from linear regression is independent of the true parents.
Corollary 2. Under Assumption 1, Theorem I is satisfied even if some variables of the SCM are unobserved.
Proof. Under Assumption 1, the empirical error is still independent of the causal parents. Under the simple case, if It has unobserved parent, it may share unobserved parent with 22 and thus the 63 term can be expanded as, c3 = Buunobe Tunobs + c where cg is the true SCM error with an unobserved variable. However, due Assumption 1, Tanoba 1 3 hence æ E3. Hence the logic of above proof holds and the rest of the proof follows identically to Theorem 1.
REMARK: Counter- Examples Where Causal Information May Not Help Sensitivity. Note that the above proof would not work if the additional features used by the associational model are independent or weakly correlated with the variable to be generated (and thus we cannot claim that H e, >> Pa, c,). In the 3-node SCM, for example, 2n weakly correlated with 23; Σ Z263 will also be close to zero, as would be Σ Z163, for large n. So the sensitivity of 1/1 may be comparable to $3 (though parameter 13 may still have non-zero sensitivity compared to the causal model's zero sensitivity). Specifically, if relationship between Z2 and Z3 is weak enough such that Σ 22C3 is comparable Σ 1 C3, then it is not guaranteed that causal information will help.
To provide a contrived example where a model with causal information will have worse sensitivity than without, consider the following counter-example. Suppose finite dataset such that Σ 23 Σ 2153
17

---

Under review as a conference paper at ICLR 2023
Ex1rz Σ x2233 = 0. Then f3 = 83 and will have minimal (Ōmaz) sensitivity. while 33 * So and thus its sensitivity is > 8mar- In addition, we can construct relationship of 222 and Ty such that sensitivity of 1/ is also zero. Specifically, 222 may be the child of 23 and be fully determined by Is; 22 = f223 = 233 = 22 leading to 33 32 Then 9/ will also be optimal for any new adversarial
2 point. Thus, comparing the causal versus associational model, the sensitivity of both " and Ss is zero, but the sensitivity of 7/3 is lower than that of By
Our proof does not simply depend the number of features. As counterexample, consider graph where a node 23 has two parents: I1 and 22 and is correlated with F4. A causal model will use both x2 and 22 while the associational model may use 24. The logic in the proof (independence of error w.r. features) will show that causal model with more features is less sensitive.
Correctness of the Proof:
We would like to clarify that the proof involving linear mixture of gaussians is meant serve intuition to understand what the benefit of causal side-information has towards the stability of the learnt parameters. Prior work (Chaudhuri et al., 2011) also studies the learning of linear models using DP and performs similar style of analysis. However, we remark that (a) their work does not focus on using any causal information, and (b) measuring sensitivity through parameter stability is a fairly general technique used (and does not imply that output perturbation is the only mechanism to be used to achieve DP in such setting). We would also like to stress that (a) we use different proof technique that motivated by the causal graph structure, and (b) their work is for discriminative models while ours is for generative models.
Clarification (& Comparison to Prior Work):
B
PRIVACY BENEFIT OF CAUSAL MODELS IN NON-LINEAR SETTINGS
Note: The notation in this section is slightly different from that used earlier.
B.1 NOTATION
A mechanism H takes in input dataset D and outputs a parameterized model fe, where @ are the parameters of the model. The model (and its parameters) belongs to a hypothesis space H. The dataset comprises of samples, where each sample x = (xr,,... .xk) comprise of features. To learn the model, we utilize the empirical risk mechanism (ERM), and loss function L. The subscript of the loss function denotes what the loss is calculated over. For example Cx denotes the loss being calculated over sample x. Similarly, L.D denotes the average loss calculated over all samples in the dataset i.e., LD [D] ExED fxx. Additionally, (x()) E(fo (x), I (x)) where f the oracle (responsible for generating ground truth), and .(...) can be any loss function (such as the cross entropy loss or reconstruction loss for generative model).
1. Data Generating Process (DGP):
The DGP (n)" is obtained using the following procedure: f = lim,-+x arg min (fo).. Essentially f can be thought of as the infinite data limit of the ERM learner and can be viewed as the ground truth. In a causal setting, the DGP for all ...... mutually, independently chosen noise values and Pa(x;) are the parents of 2; in the SCM.
variables/features x is defined as f" (x) = (fa((()))
(Pa(x))) + m/)) where 7/ are fit +h, ,
For each feature I,, we call Pa(x;) as the causal features, and X {z,, Pa(z:)} as the associational features for predicting z,. Corre- spondingly, the model using only Pa(x;) ) for each feature x, is known as the causal model, and the model using all features X (including associational features) is known as the associational model. We denote the causal model learnt by ERM with loss L as fo., and the associational model learnt by ERM using the same loss L as fe.. Note that the hypothesis class for the models is different: fo. E Ho and fe. E HA. where Hc C HA
Distinction between Causal and Associational Worlds:
Like Jo., the true DGP function uses only the causal features. Assuming that the true function l" belongs in the hypothesis class He. we write, f = lim Di arg min Lf()).
3. Adversary. Given dataset D and model fe, the role of adversary is to create neighboring dataset D' by adding a new point x'. We assume that the adversary does so by choosing point x' where the loss of fo is maximized. Thus, the difference of the empirical loss on D' compared D will be high, which we expect to lead to high susceptibility to membership inference attacks.
18

---

Under review as a conference paper at ICLR 2023
4. Loss-maximizing (LM) Adversary: Given model fe. dataset D, and loss function L, an LM adversary chooses point x' (to be added D to obtain D') as arg maxy Lx(fe). Note that fx (fo) = (x()
Main Result. Given dataset D of size n, and strongly convex and Lipschitz continuous loss function L. assume we train two models in a differentially private manner: a causal (generative) model fa.. and an associational (generative) model fa.. such that they minimize L on D. Assume that the class of hypotheses H is expressive enough such that the true causal function lies in H.
1. Infinite sample case. As + oo, the privacy budget of the causal model is lower than that of the associational model i.e., & Ea.
2. Finite sample case. For finite n, assuming certain conditions on the associational models learnt and n, the privacy budget of the causal model is lower than that of the associational model ie., Se S Ea.
B.2 PROOF OUTLINE
The main steps of our proof are as follows:
1. We instantiate two worlds: one with causal model, and one without one (i.e., with an associational model).
2. We show that the maximum loss of causal model is lower than equal maximum loss of the corresponding associational model.
3. Using strong convexity and Lipschitz continuity of the loss function, show how the difference in loss corresponds to the sensitivity of the learning function.
4. Finally, the privacy budget e is monotonic function of the sensitivity.
We prove step 2 separately for n + oo (Appendix B. and finite n (Appendix B.2) below. Then we prove step 3 in Appendix B.3. Step follows from differential privacy literature (Dwork et al., 2014).
B.3 PROOF WHEN + oo (FOR STEP 2 FROM OUTLINE)
As |D + sc, the proof arises from knowledge that the causal model becomes the same as the true DGP f*
Preliminary 1. Given any variable zr, the causal model learns function based only on its parents, Pa(zz). The adversary for causal model chooses points from the DGP (f", .')) s.t.,
x arg max (x(fe, (x)) s.t. Vi x; fr (Pa(x:)) + 13s
(23)
where fo = arg minyeHe (f)... Assuming that He is expressive enough such that I* E Hc. as |D] + co, we can write
lim fo. D
lim arg max LD(f) f
DD
JEHC
Therefore, the causal model is equivalent to the true DGP's function. For any target x; to be predicted, maximum error on any point 7)s for the & loss, and function 17s for other losses. Intuitively, the adversary is constrained to choose points at maximum distance away from the causal model.
But for associational models, we have,
x" = arg max (x), s.t. Vi o. J: +
(24)
As n = [D] + 0c. fo. # Thus, the adversary is less constrained and can generate points for target u; that are generated from different function than the associational model. For any point, the difference in the associational model's prediction and the true value is [fe, (x)) - f (Pa(z.)) + 77- which is equivalent to the loss under εT. For general loss function, the loss is function of [fe_ (x) - f (Pa(x:)) + Th- Therefore, we obtain,
Vi < [f__ (x) f (Pa(z:)) + + max Lx (x)) S max m Cx (x))
(25)
for all losses that are increasing functions of the difference between the predicted and actual value.
One should think of the DGP (f"
(f"..) m7) as the oracle that generates labels.
19

---

Under review as a conference paper at ICLR 2023
B.4 PROOF WHEN FINITE (FOR STEP 2 FROM OUTLINE)
When n is finite, the proof argument remains the same but we need an additional assumption on the associational model fe, learnt from D. From learning theory (Shalev-Shwartz & Ben-David, 2014), we know that the loss of fo. will converge to that f* while loss of fo. will converge to loss of f0. f Thus, with high probability, fe, will have lower loss w.r.t. f than fo, and similar argument follows as for the infinite-data case. However, since this convergence is probabilistic and depends on the size of n, it possible obtain a fa_ that has higher loss w.r.t. f* compared to sea.
Therefore, rather than assuming convergence of Jug to ʃ", we instead rely on the property that the true DGP function f does not depend on the associational features Ji.- As result, even if the loss of the associational model is lower than the causal model on particular point x = Ie U x 10, we can change the value of Tg to obtain higher loss for the associational model (without changing the loss of the causal model). This requires that the associational model have non-trivial contribution from the associational (non-causal) features, sufficient to change the loss. We state the following assumption.
Sa. is the causal model and fa, the associational model, then we assume that the associational model has non-trivial contribution from the associational features. Specifically, denote He as the causal features and Ta as the associational features, such that x Ie U J.- We define any two new points: x' z U za and x" x U Ux" Let first assume fixed value of T.. The LHS (below) denotes the max difference in loss between fa. and fe. (i.e., change in loss between causal and associational models over the same causal features). The RHS (below) denotes difference in loss of for between Ta and another value T keeping Ie constant (i.e. effect due to the associational features). Formally speaking
Assumption 2:
Ar fxx
(Fo (fo Ux))) Lx (fo, (fo (x)
(26)
S min max Lx" (fo. U vx"))) -uzyue (fo. (x" U Ux))
The inequality above can be interpreted as follows: if adversary I aims to find the x'e such that difference in loss between associational and causal features is highest for a given Tas then there can always be another adversary 2 who can obtain a bigger difference in loss by changing the associational features (from the same Fa to x"").
Intuition:
Imagine that fo. is trained initially, and then associational features are introduced to train fo.- fo, can obtain lower loss than fo, by using the associational features Ta In doing so, it might even change the model parameters related to Assumption 1 says that change in x. 's parameters is small compared to the importance the x, 's parameters in fe.- For example, consider a f*, fo., fe. to predict the value of o, such that x. {x1} and Ia {.2). and consider & loss.
f F1; f0. 2x,; fe. 1.9x + (xx22
where v, fx( + and 17 (.5. Note that without ((x2), the loss of the associational model is lower than the loss of causal model on any point. However, if x. D22 E IR, then we can always set [22]] to an extreme value such that d(x2) overturns the reduction in loss for the associational
model, without invoking Assumption 1. When 2. is bounded (e.g., D2 E {0, 1}). then Assumption I states that the change in loss possible due to changing Φ(x2) is higher than the loss difference (which is 0.1 for & loss). If 7 was the class of linear functions and assume & loss with all features in the same range (e.g.. [0, 1)), then Assumption implies that the coefficient of the associational features in So, is higher than the change in coefficient for the causal features from fo. to fo.-
Note that va and v. each represent of features, and single feature.
20

---

max Under review as a conference paper at ICLR 2023
Lemma 2. Assume an LM adversary and a strongly convex loss function L. Given causal fea and an associational model fe, trained on dataset D using ERM. The LM adversary selects two points: x' and x". Then under Assumption the worst-case loss obtained on the causal ERM model Lx (fo.) ) is lower than the worst-case loss obtained on the associational ERM model Ex" (fo.) i.e.,
(xx S fx" (Soc)
which can be re-written as
Cx(fo) S max Cx(fe)
(27)
x
Proof: Before we discuss the proof, let us establish another preliminary.
Preliminary 2. Let write Jo, (x) Sa, (It U J.)) as combination of terms due to and Ta. where Te and za are the causal features (parents) and non-causal features respectively i.e., LeLiza = x, and ze O a Φ. Let = x'. Uxa be the point chosen by the causal adversary.
We will show that the associational adversary can always choose point x" = x' Ux" such that loss of the adversary is higher. We write, for any value x.a'. "1
L(fe, (z' C(fo, U x²)) L(fe. (x' Uxx)) L(fo (lf
=CC(fe, (e's Uz"))) - [(fe. (xlu) (C( Uxa)
(28)
C(Jo, (3'd U (xa))) + L(Jo, (1% Una))
Rearranging terms, and since L(fe, (a's U Ux'))) [(fo. (x'd (xa)) for any value of za (causal model does not depend on associational features),
C(Jo (1.Ux))))))) L(oo U'')) = (C(So. (o' (. - C(So. (2' Uxa)))
Term 1
(29)
- -[[(oo, U Uxa)) L(So, (x'o U Uta)))
Now the first term is 2 since the adversary can select x" such that loss increases (or stays constant) for fe.- Since the true function f" does not depend on Ta changing Ta does not change the true function's 's value but will change the value of the associational model (and adversary can choose point is higher). The second term can either be positive negative. If it is
such that loss on the negative, then we are done. Then the LHS > 0.
If the second term is positive, then need show that the first term is higher in magnitude than the second term. From assumption 1, let it be satisfied for some x We know that L(So, (2' U Jr))) L(So (2r Ux.)) since the causal model ignores the associational features.
C(fo (4' x)) L(fe, (x', U Ux))) I max( - C(fe. (Ic xz)))
Ze
min main (fe,, U - L(fo. (Io U x))) < max Coax. (2's Uz - L(fe. (2' U xz:))
(30)
Now suppose adversary chooses a point such that xl = xma where xm is the arg max the RHS
above. Then Equation can be rewritten as
C(fe. (2' U x))==)) [(fe, (x), U Uz()))
(C(fe, (2', U Uzllar)) - L(fe, (z()))I))
(C(fe, (2'd Uza)) L(fo, (1.
(31)
>0
where the last inequality is due to equation
Thus, adversary can always select different value of x x' U Jmma such that loss is higher than the max loss a causal model.
L(fe (x's U a())) = max (x(.).) S L(fe, (2% Un(aar S max Lx (fo.)
x
We omit the subscript for L for brevity. It can he implied from context.
21

---

Under review as a conference paper at ICLR 2023
B.5 PROOF OF STEP 3 FROM OUTLINE
Theorem 2. Assume the existence of a dataset D of samples. Further, assume neighboring dataset is defined by adding data point to D. Let fe, and fe. be the causal and associational models learnt using D, and for and fo, be the causal and associational models learnt using neighboring datasets D' and D" respectively. All models are obtained by ERM on Lipschitz continuous (with parameter p), strongly convex (with parameter X) loss function L. Then, the sensitivity of a causal learning function Hc will be lower than that of its associational counterpart HA- Mathematically, assuming large enough n. such that > 22 1,
max
10. 0'2ll S max 110, D,D D
-Oal
(32)
The proof uses strongly convex and Lipschitz properties of the loss function. Before we discuss the proof, let us introduce requisite preliminary.
Proof:
Preliminary 3. Assume the existence of a dataset D of size n. There are two generative models learnt, fe, and fe. using this dataset. Similarly, assume there is neighboring dataset D' which is obtained by adding one point x'. Then the corresponding ERM models learnt using D' are for and for-
We now detail the steps of the proof.
Step 1. Assume L is strongly convex. Then by the optimality of ERM predictor on D and the definition of strong convexity,
Cn(Jo) S Ln(aso (1 (1- X -0(1 (o]11-))10-- 0'11
(33)
SaLn(Jo) + (1-a))n((o)
Step 2. Rearranging terms, and as 1
(1-a)Co(fa) $ (1 ao) aa(1 - a)lle 1 8
(34)
2
= |10 - 01112 (CD(for) - (D(
Step 3. Further, we can write (Ln(sor) - (n(s))) in terms of loss on x'.
1
(f)
n + (s(
+
Lx (fo) (since D' DUX)
n +
1
n + (f(
+
(fo) (from Equation 34)
n
<
n +1
Lr (fw)
1 n n+1n Cx (for + n + 1 fxx (fo) (since D= D'
n
n + n
= (o n + (fx((f) (for
(35)
Step Combining the above two equations, we obtain,
2 2 - (CD([)) Ln(so)) < X(n + 1) (fx Exx
|10 11-0011 0'11
(36)
Step 5. From Claim 1 above, we know that
max Lx (x( S max Lx (x..)
(37)
+ Lx (fo.) S (xx
22

---

For n 1> 30 x Under review as a conference paper at ICLR 2023
where x' = arg maxx Lx(f6_ and x" is chosen such that x' and x" differ only in the associational features. Thus, (fo = Lx" (fo: ). Also because He S Ha. the training loss of the ERM model for any D" defined using D and x" is higher for causal model ie.,
(x((Fe) = Lx" (foz) 2 Exx:(oo))
(38)
Therefore, obtain,
Ex/ fx (Jo:) max (x( Lx (Jo)) S (So) Lxx' (Jo)
(39)
So have now shown that the max loss difference on a point x' for causal ERM models trained on neighboring datasets is lower than the corresponding loss difference over x" for the associational models.
Step 6. Now we use the Lipschitz property, to claim,
Lx"( (xr((o;)) S pll0a - -Oall
(40)
Step Combining Equations 36 (substituting fo.) and 40, and taking max on the RHS, we get,
2
max |10 D.D
-6.112 v
max Lx (fo.) - (for
A(n + 1)
D,D'
2
max Cx (fe.) Lx (fo:)
(41)
A(n + 1)
2p
max 110 0'all
X(n + 1) D2D
2p
3 max D.D
|10g - 0'/12 <
max 10 - 0-
(42)
A(n + 1) D.D
max D.D
00
-0111 <
max D.D
10 Pall
(43)
Now if maxp, |10- 0'1 2 1, then the result follows by taking the square root over LHS. If not, need sufficiently large such that
maxx p - then obtain,
2p
max
110 0'1l S max 1|0, D.D
0a11
(44)
D,D
Remark on Theorem 2. Theorem 2 depends on two key assumptions:
1. Assumption 1 that constrains associational model to have non-trivial contribution from associa- tional (non-causal) features.
sufficiently large n as shown above.
When any of these assumptions is violated (e.g., small-n training dataset or an associational model that is negligibly dependent the associational features), then it is possible that the causal ERM model has higher E than the associational model.
Connections between Theory & Practice: The proof provided in Appendix A is meant to provide intuition as to the benefit of causal information in a simpler setting using linear gaussian mixtures, similar to what done in other work (Ilyas al., 2019). We provide more general proof (across all classes of generative models), for a general privacy adversary in Appendix B, but under some constraining assumptions regarding the convexity of the loss function.
23

---

Under review as a conference paper at ICLR 2023
C TRAINING DETAILS
C.I OVERALL SCHEME
We outline the work-flow overview (refer Figure 7): 1. The user provides a dataset for which they want create synthetic copy; 2. We utilize techniques (e.g.. Morales-Alvame et al. (2021)) to learn the structured causal model (SCM) associated with this dataset (or can assume the SCM is given); 3. We encode this structure into generative model (e.g., Morales-Alvarez al. (2021); Geffner et al. (2022); Kyono et al. (2021)) and train it with DP-SGD; 4. The generative model is sampled to obtain a synthetic data which is DP (by post-processing) and can be used for arbitrary downstream tasks. We will also clarify that unlike some works which require some information about the nature of usage of downstream data, ours does not.
SERVER
DI SCD
Caunal Disovery
Geneettive Modil
CUENT
Downstrem
Figure 7: Overview of procedure.
VAR
(h) Causal Graph
Causal DGM
Figure 9: Exemplar case comparing solution VAE.
C.2 MODELS
Pain
Xi
X₂
Encoder: = ao. (z/2), gos (x)1(12)
Decoder: (1, Po, (22/ (x2222 pas (21
EEDI
24

---

Under review as a conference paper at ICLR 2023
X1
Z
X₂
Encoder: (0(2,21122) (22) 9ái (z|x2)
Decoder: pa(22, (1, z) = p(z) p(x1) (22/2) (22)(r)
All encoders and decoders used part of experiments comprised of simple feed-forward architectures. In particular, these architectures have 3 layers. All embeddings generated are of size 10. We set the learning rate be 0.001.
Note:
C.3 DATASETS
Dataset
Records
k
EEDI Wang et al. (2020b)
2950
948
12.42
Pain5000 Tu et al. (2019)
5000
222
5.62
Pain Tu et al. (2019)
1000
222
2.36
Synthetic
1000
22
3.9
Lung Cancer Lauritzen Spiegelhalter (1988)
80,000
Table 2: Salient features of our experimental setup. More information about the datasets and parameters used be found in the Appendix C.4.
We evaluate on datasets from three real-world applications. The first one is the EEDI dataset Wang et al. (2020b) which is one of the largest real-world education data collected from an online education platform. It contains answers by students (of various educational backgrounds) for certain diagnostic questions. The second one is the neuropathic pain (Pain) diagnosis dataset obtained from causally grounded simulator Tu et al. (2019). For this dataset, we consider two variants: one with 1000 data records (or Pain1 C00), and another with 5000 data records (or Pain500C).. The third dataset (Lung Cancer) contains information about lung diseases and visits to Asia Lauritzen Spiegelhalter (1988).
We choose these datasets as they encompass diversity in their size (n), dimensionality (k), and have some prior information on causal structures (refer Appendix D). We utilize this causal information in building a causally informed generative models. The (partial) SCM is given utilizing domain knowledge of the EEDI and Pain contexts.
More salient features of each dataset is presented in Table 2.
A larger SCM for the RED dataset was learnt using the VICause methodology proposed by Morales-Alvarez al. (2021).
25

---

Under review as a conference paper at ICLR 2023
C.4 TRAINING PARAMETERS
Causality
Dataset
Batch Size
Epochs
EEDI
1000
EEDI
200
1000
X
Pain1000
100
100
Pain1000
100
100
X
Pain5000
100
100
V
Pain5000
100
100
X Synthetic
100
50
Synthetic
100
50
Lung Cancer
100
100
Table 3: Training parameters for our experimental evaluation.
For the experiments related the model proposed by Morales-Alvarez al. (2021), utilized the same parameters as for EEDI (in Table 3) to obtain the same privacy expenditure (E).
D CAUSAL GRAPHS
SCM-1: SCM for the Pain dataset. X, denotes the causes of a medical condition, and X₂ denotes various conditions.
X2
X1
Z
SCM-2: SCM used by the EEDI. X2 denotes the answers questions and X, is the student meta data such as the year group and school.
X2
X1
Z
VICause: We refer the reader to the work of Morales-Alvart Morales-Alvarez al. (2021), which contains information about the causal graph used to obtain Figure 2.
Lung Cancer:
The causal graph related to the Lung Cancer dataset can be found in https: html. The edge between tub
/ / //ww,. www..bnleee .aleearn com homm/bnreposiii tory cetor/ddiiee /wt.//iiteeeeaaaaaaaee and ether was removed to simulate missing edges, and the edge between as asia and smoke was added to simulate new edges.
26

---

Under review as a conference paper at ICLR 2023
E UTILITY EVALUATION
E.1 ACCURACY ON ORIGINAL DATA
The results are detailed Table
Dataset
Non Causal
Causal
kernel
SVC
logistic
rf
knn
kernel
svc
legistic
rf
knn
EEDI
86.93
91.24
88.53
93.8
88.22
87.38
91.46
88.95
93.44
87.92
Pain1000
92.75
94.42
91.56
94.19
88.78
92.69
94.03
91.81
94.28
89.5
Pain5000
95.37
96.53
97.47
93.03
92.14
95,48
96.5
97.39
92.74
92.19
Table Baseline Accuracy calculated on original (and not synthetic) data. Results presented in Table are based on these values.
E.2 PAIRPLOTS
Observe that the pair-plots obtained from the models trained with causality and DP are comparable to those obtained from models trained with causality and no DP; the utility of both these models should be comparable.
(a) Original
(b) Causal + DP
(c) Causal
Figure 10: Paí 55000 Dataset
F RESULTS ON PAIN1000 DATASET
As in the figures the main body of the paper, we plot the average success of the MI attack Stadler et al. (2020). From Figures 11 and 12. observe that the trends the same what observed earlier: causality in conjunction with DP reduces the advantage of the adversary. DP and causality in isolation also reduce the MI adversary's advantage.
27

---

Under review as a conference paper at ICLR 2023
03
Ml Success (56)
60
MI Succebs (76)
60
20
Naive
Histogram
Correlated
Ensemble
Naive
Histogram
Correlated
Ensemble
(i) DP
(b) No DP
Figure 11: Impact of DP MI resilience: Causality by itself is able to provide resilience to MI adversaries. When combined with DP, the advantage exacerbated.
80-
No
10
MI Success (%)
MI Success (%)
20
.0-
10
Naive
Histogram
Correlated
Ensemble
Naive
Histogram
Correlated
Ensemble
Causal
Non-Causal
Figure Impact of Causality on MI resilience: Observe that the combination of DP and causality produces more resilience to MI attacks.
28

---

Under review as a conference paper at ICLR 2023
G MI RESULTS
PA denotes the ability of the classifier to correctly classify train samples. NA denotes the ability of the classifier to correctly classify test samples. The Accuracy is weighted combination of PA and NA.
EEDI.
Observe that when there is causal information, the difference between the DP and No DP
column is larger.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No
DP
DP
DP
kernel
47.33
47.33
100
100
0
47.33
47.33
100
100
0
0
Naive
random forest
62.18
99.21
58.51
99.49
65.48
98.96
knn
54.79
96.48
55.19
98.85
54.43
94.36
kernel
100
100
100
100
100
100
Histogram
SVC
100
100
100
100
100
100
random forest
100
100
100
100
100
100
knn
100
100
100
100
100
100
Table 5: Model trained using EEDI and partial causal information.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No
DP
DP
No DP
kernel
49.85
81.23
100
100
0
62.58
Naive
SVC
75.38
81.23
62.96
100
87.73
62.58
random forest
98.15
96.92
98.77
97.53
97.55
96.32
knn
98.15
94.46
99.38
95.06
96.93
93.87
kemel
100
100
100
100
100
100
Histogram
svC
100
100
100
100
100
100
random forest
100
100
100
100
100
100
knn
100
100
100
100
100
100
Table 6: Model trained using EEDI and causal information obtained from VICause Morales-Alvaree et al. (2021).
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No DP
DP
No DP
kerell
47.33
47.33
100
100
0
0
Naive
svc
53.21
60.85
60.44
57.62
46.72
63.75
random forest
99.76
100
99.74
100
99.77
100
knn
99.76
99.82
99.87
99.62
99.65
100
kernel
52.67
100
0
100
100
100
Histogram
sve
47.33
95.7
100
95.39
0
95.97
random forest
59.39
100
100
100
22.9
100
knn 59.39
100
100
100
22.9
100
Table 7: Model trained using EEDI and no causal information.
29

---

Under review as a conference paper at ICLR 2023
Pain 1000. Observe that when there is causal information, the difference between the DP and No DP column is larger.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No DP
DP
No DP
kernel
47.33
47.33
100
100
0
0
47.33
47.33
100
100
0
0
Naive
random forest
57.7
99.58
60.44
99.74
55.24
99.42
knn
55.94
96.76
60.44
96.16
51.9
95.4
kernel
48.3
57.82
78.36
100
21.29
19.91
47.33
47.33
100
100
0
0
Histogram random forest
57.82
57.82
100
100
19.91
19.91
knn
59.7
59.7
81.82
81.82
39.82
39.82
kernel
99.7
98.24
100
99.62
99.42
97.01
51.09
62.12
83.99
50.58
21.52
72.5
Correlated
random forest
97.39
100
95.52
100
99.08
100
knn
41.52
60.61
42.64
60.95
40.51
60.3
kernel
61.76
61.7
20.49
72.23
98.85
51.78
Ensemble
SVC
47.33
47.33
100
100
0
0
random forest
97.94
100
96.93
100
98.85
100
knn 81.09
82.12
86.3
83.99
76.41
80.44
Table 8: Model trained using Pain1000 and partial causal information.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No DP
DP
No
DP
kernel
47.33
47.33
100
100
0
0
Naive
SVC
47.33
47.33
100
100
0
0
random forest
79.82
99.7
82.33
100
77.56
99.42
knn
80.85
85.76
82.71
88.6
79.17
83.2
kernel
96.36
96.79
96.41
90.14
96.32
83.77
Histogram
sve
47.33
47.33
100
100
0
random forest
100
100
100
100
100
100
knn
100
94.91
100
94.88
100
94.94
kernel
100
100
100
100
100
100
Correlated
sve
94.12
100
92.83
100
95.28
100
random forest
78
100
79
100
77.1
100
knn
53.82
73.88
74.9
72.73
34.87
74.91
kernel
98.55
98.3
98.46
99.49
96.82
97.24
47.33
47.33
100
100
0
0
Ensemble
random forest
94.85
100
93.98
100
95.63
100
knn
100
88.79
100
90.27
100
87.46
Table Model trained using Pain100 000 causal information.
30

---

Under review as a conference paper at ICLR 2023
Pain 5000. Observe that when there is causal information, the difference between the DP and No DP column is larger.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No DP
DP
No DP
kernel
47.33
47.33
100
100
0
0
47.33
47.33
100
100
0
0
Naive
random forest
76.85
98.85
78.36
97.7
75.49
99.88
knn
76.79
96.12
78.36
93.98
75.37
98.04
kernel
47.33
60.24
100
38.16
0
80.09
47.33
47.33
100
100
0
0
Histogram
random forest
57.82
57.82
100
100
19.91
19.91
knn
58.7
59.7
81.82
81.82
39.82
38.82
kernel
92.61
100
94.88
100
90.56
100
Correlated
svc
47.33
97.64
100
100
0
95.51
random forest
100
100
100
100
100
100
knn
36.48
100
45.07
100
28.77
100
kernel
47.33
62.18
100
46.73
0
76.06
Ensemble
SVC
47.33
47.33
100
100
0
0
random forest
100
100
100
100
100
100
knn 74.85
100
81.56
100
68.81
100
Table 10: Model trained using Pa Pain5000 and partial causal information.
Extractor
Attack Model
Accuracy
NA
PA
DP
No DP
DP
No DP
DP
No
DP
kernel
47.33
47.33
100
100
0
0
Naive
SVC
64.61
47.33
60.18
100
68.58
0
random forest
99.94
100
99.87
100
100
100
knn
100
99.82
100
99.62
100
100
kernel
100
100
100
100
100
100
Histogram
sve
65.03
47.33
91.55
100
41.2
random forest
100
100
100
100
100
100
knn
100
100
100
100
100
100
kernel
100
100
100
100
100
100
Correlated
sve
100
100
100
100
100
100
random forest
99.76
100
99.62
100
99.88
100
knn
53.09
100
80.41
100
28.54
100
kernel
100
100
100
100
100
100
48.85
47.33
100
100
0
0
Ensemble
random forest
100
100
100
100
100
100
knn
100
100
100
100
100
100
Table 11: Model trained using Pain5000 and causal information.
31


Reviews:
[{"review_id": "tqO_4UpWZG", "reviewer": "Reviewer_3noA", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tries to measure whether adding causal information to a differentiably private generative model allows for a more favorable utility-privacy tradeoff curve.", "summary_of_the_review": "This paper seems to still be a bit of a work-in-progress. It shows promising directions, particularly w.r.t. evaluating privacy extrinsically without just reporting the privacy budget. However, the experiments and presented results are a bit scattered in terms of the picture that is trying to be painted. The two largest areas of improvement I would suggest are: 1) either reworking the notion of utility or at least further justifying why it is appropriate; and 2) re-organizing some of the sections of writing so that the experiments flow more meaningfully and coherently.", "strength_and_weaknesses": "STRENGTHS\n- Rather than just relying on the privacy budget (epsilon) to quantify privacy, this work uses  susceptibility to a membership inference attack. It is very valuable to explore quantifiable notions of privacy based on risk (eg in order to compare privacy risks between DP-based methods and non-DP methods).\n\nWEAKNESSES\n- I am not persuaded that this was a good measure of \"utility.\" Page 5 describes that the metric involves randomly selecting 20 attributes to be predicted, rather than picking actually useful targets. This is especially surprising given this work's emphasis on the importance of causal and meaningful relationships in data generation. I find the approach concerning because it is essentially performing an *attribute* inference attack (ie if I know someone's age, gender, etc, can I predict their HIV status using the synthetic data?). Without more details & careful thought, this metric could arguably be another measurement of risk/privacy instead of utility. \n- On multiple occasions, the work explicitly stresses that its contribution is meant to be severable from the construction of a given causal graph. However, I'm not sure such a separation can be so clean. The field of causal inference suffers in reputation (and ultimately empirical performance) because although \"the causal graph can be constructed using domain expertise\" in theory... in practice, trying to construct a meaningful graph often leads to over-promise/under-deliver. The work could benefit from showing the CG for the 3-node experiment.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "hlzcf2QmWGo", "reviewer": "Reviewer_PkKv", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper studies the synthesis of privacy-preserving datasets from an interesting angle: It claims knowledge about the causal relationship of the data attributes can simultaneously amplify privacy and improve accuracy. \nTo shed light on this surprising result, the paper analyzes in which condition a generative model equipped with a causal graph decrease the sensitivity of the data release task, thus increasing accuracy. Surprisingly this also reflects in better model performance against membership inference attacks. \nThe paper then proposes a VAE-based mechanism to generate causally consistent datasets and provide results over several benchmarks.", "summary_of_the_review": "The paper studies a very important problem: the release of privacy-preserving data through synthetic generators. \nThe claims that privacy and accuracy can be both amplified by using additional side information are counter-intuitive to me and require further explanation. ", "strength_and_weaknesses": "**Presentation**\nThe paper is generally well-written; There are a few typos and errors but are not affecting the overall readability. \nIn terms of claims, I would refrain, in the Introduction, to say with such certainty that Membership inference attacks are breaking synthetic data generation models. This is not only an overstretch but is also dangerous as readers may mistrust synthetic data generators, which, in my opinion, provide one of the best alternatives for privately releasing datasets. \n\n**Related work**\nThe similarity of the proposed method with PrivBayes [1] should be discussed. E.g., where and why, in the proposed approach, the causal representation is different from what done by PrivBayes? \n\n**Technical Questions**\n- Can you clarify when the sensitivity of (1) will be smaller than (3) w.r.t. the properties of the causal relationships? Does this hold only when there exists at least one variable with no dependency on y? (see proof of Lemma 1).\n- On page 4, under paragraph \"why does causality provide any privacy benefit?\" the paper claims that \"the model will be more stable\". Can the authors elaborate further? What assumptions are taken in terms of causal graph dependencies? See also the question I ask above.\n- Why are the values of the MI attacks so high? \n- The results also do not seem to show that MI attacks can be better overcome (thus better privacy protection) in the causal setting considered. Can you elaborate on your claims? \n\n[1] PrivBayes: Private Data Release via Bayesian Networks. ACM Transactions on Database Systems 42(4):1-41, 2017", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Utb4SHyE3Q", "reviewer": "Reviewer_2NXW", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper considers the effect of adding causality to differentially private generative models. A theorem is proved showing that the sensitivity of a causally informed mechanism is lower than a non-causal mechanism. Experiments show that using causal information with the same privacy budget results in models which perform better on downstream tasks than generative models which do not use causal information.", "summary_of_the_review": "The paper addresses an interesting problem and includes a nice mix of theoretical and empirical results, but there appear to be some gaps between the theory and claims and the robustness of the empirical results are unclear. ", "strength_and_weaknesses": "Strengths\n- The paper address a topic of relevance to multiple research communities \n- The paper includes a nice mix of theory and empirical results\n- The paper is generally well written\n\nWeaknesses\n- There appear to be gaps between the claims made in the paper and the results which makes the significance unclear (see below)\n- Some results are not well explained\n- Some assumptions may not align to realistic settings\n- It is not clear how robust some of the empirical results are", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject