Functional Renyi Differential Privacy for Generative Modeling
Authors: Dihong Jiang
Sun Sun
Yaoliang Yu
Venue: NeurIPS 2023 poster (2023)
Keywords: Renyi differential privacy
RKHS
MMD
Gaussian process
generative model
TL;DR: An extension of RDP to functional output, with application in differentially private generative models

Abstract: Differential privacy (DP) has emerged as a rigorous notion to quantify data privacy.  Subsequently, Renyi differential privacy (RDP) becomes an alternative to the ordinary DP notion in both theoretical and empirical studies, for its convenient compositional rules and flexibility. However, most mechanisms with DP (RDP) guarantees are essentially based on randomizing a fixed, finite-dimensional vector output. In this work, following Hall et al. (2013) we further extend RDP to functional outputs, where the output space can be infinite-dimensional, and develop all necessary tools, *e.g.*, (subsampled) Gaussian mechanism, composition, and post-processing rules, to facilitate its practical adoption. As an illustration, we apply functional RDP (f-RDP) to functions in the reproducing kernel Hilbert space (RKHS) to develop a differentially private generative model (DPGM), where training can be interpreted as iteratively releasing loss functions (in an RKHS) with DP (RDP) guarantees. Empirically, the new training paradigm achieves a  significant improvement in privacy-utility trade-off compared to existing alternatives, especially when $\epsilon=0.2$. Our code is available at https://github.com/dihjiang/DP-kernel.

Functional Rényi Differential Privacy for Generative Modeling
Dihong Jiang!? Sun La and Yaoliang Yu
School of Computer Science, University of Waterloo'
Vector Institute?
National Research Council Canada'
{dihong. jiang, sun, yaoliang Baaannggyyuuwwwataeee yuu@uwaterloo..
Abstract
Differential privacy (DP) has emerged as a rigorous notion to quantify data pri- vacy. Subsequently, Rényi differential privacy (RDP) has become an alternative to the ordinary DP notion both theoretical and empirical studies, because its convenient compositional rules and flexibility. However, most mechanisms with DP (RDP) guarantees are essentially based on randomizing fixed, finite- dimensional vector output. In this work, following Hall et al. [12] further extend RDP to functional outputs, where the output space can be difiite-dimensionall and develop all necessary tools, e.g. (subsampled) Gaussian mechanism, com- position, and post- proseprocsssing rules, to facilitate its practical adoption. As an illustration, apply functional RDP (f-RDP) to functions in the reproduc- ing kernel Hilbert space (RKHS) to develop a differentially private generative be interpreted as iteratively releasing loss
model (DPGM), where training functions (in an RKHS) with DP guarantees. Empirically, the new training paradigm achieves a significant improvement in privacy-utility trade-off com- pared to existing alternatives, especially when = 0.2. Our code is available at /ttps://gitee com/dihj jathiiingDDD Btee/DD-kee LangDDP-kenne..
Introduction
Modern machine learning has achieved impressive success thanks to the availability of big data and computing resources. However, there are increasing privacy concerns when training with personal or sensitive data. Differential privacy (DP, 8] has become the de-facto standard technique for releasing statistics of sensitive databases, which is designed to bound the output change of a randomized mechanism M given incremental input deviation, such that M does not depend too much any individual point in the dataset. Recently, Mironov [23] generalizes DP to Rényi differential privacy (RDP) through a-Rényi divergence [26), which shares many properties with the ordinary DP, yet with tighter and easier composition analysis, thereby attracts more attention in practice.
The popular mechanisms (e.g. Gaussian Laplace) towards DP or RDP essentially randomize mmite-dimensionall vector output with (Gaussian or Laplace) noises. However, if we want to privately release a function, vector-based DP mechanisms not readily amenable, because function over a real-valued domain is characterized by infinitely many points [12), which will lead to co bound the I.2/L 1.2/L1-sensitivtty if we follow the vector output, and will effectively lead to infinitely large Gaussian/Laplacian noise and is impractical. Moreover, it is unclear how to add noise functional DP mechanism include privately releasing the reward function in reinforcement learning [32], the kernel function in kernel density estimation and kernel support vector machine (SVM) [12], and the kernel function in DPGM in this work.
sensitivity analysis in Dwork and Roth [9] for the
dimeniiaiimeliinall output. Examples that require
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Hall et al. [12] made the most fundamental contribution to extending DP from vectors to functions. Essentially, the functional Gaussian mechanism is achieved by adding sample path of Gaussian process to function, in contrast to adding Gaussian noise to vector. Evaluating the released DP function at arbitrarily many points (which will form vector) will retain the same DP guarantee. is worth mentioning that there are composition theorems and subsampled Gaussian mechanisms developed for functional DP in Hall et al. [12], thus restricting its use deep learning.
Due to the theoretical convenience and practical flexibility of RDP, in this work, we aim to extend RDP to functions, with all necessary tools to facilitate its adoption in deep learning. Furthermore, we demonstrate its value via particular application in DPGM where the loss function is in an RKHS. Our contributions can be summarized as:
Theoretically, we develop the functional RDP, which is equipped with many useful tools including (subsampled) Gaussian mechanism, composition, and post-processing theorems. We will show that functional RDP will share many important properties and results with the vector-based variant.
Empirically, with functional RDP, we propose novel DPGM training paradigm by privatizing the loss function in an RKHS, rather than truncating the RKHS to diite-ddmensional space and injecting Gaussian noise therein as in existing works. Our method is evaluated and compared across a wide variety of image datasets and DP guarantees, where our method consistently outperforms other baselines by large margin. Notably, our method indicates better scalability at more stringent DP guarantees (e.g.. é and 0.2), compared to state-of-the-an (SoTA) baselines.
2 Preliminary
Differential privacy quantifies and restricts the output change of a randomized mechanism given an incremental change in the input dataset, such that the privacy of an individual point is protected. The output of a randomized mechanism can be either a vector (Sections 2.1 to 2.3) or a function (Section 2.4). In this section, we recall few important related works in differential privacy.
2.1 Differential privacy for vectors (v-DP)
Definition ((e, 8)-DP for vectors, [8, 9]). A randomized mechanism M D - R with domain DD and range R satisfies (c, didfifffreltial privacy for any two adjacent inputs D, D' E D and for any (measurable) subset of outputs S S holds that
Pr(M(D) E S) S exple) Pr[M(DD) E S] +
where adjacent imputs (a.ka. neighbouring datasets) D, D' only differ in one entry. Particularly, when 8 = 0. we say that M is c-DP.
2.2 Rényi differential privacy for vectors (v-RDP)
Mironov [23] first formalizes Rényi differential privacy (RDP) which extends ordinary DP by using a-Rényi divergence [26]. RDP is shown to provide easier composition properties than the ordinary DP notion, and can be easily converted to (e, 8)-DP.
Definition 2 ((, R)- for vectors, [23]). A randomised mechanism M is (a, RDDP if for all adjacent inputs D, D', Rényi's 's a-divergence (of order a > 1) between the distributions of M(D) and M(D') satisfies:
Da(M(D)IM(D)) = - log Evng
(p(x) a(x)
Sc.
where p and q are the density of M(D) and M(D"), respectively.
Conveniently, RDP is linearly composable:
Theorem 1 (Sequential composition v-RDP, (23]). Let f D + R₁ be (a, RDD. g R1 > D + R2 be (a, 62)-DDP, then running f.g sequentially to obtain h D R₁ R2, h(D) = (D()), D)) satisfies (a, + RD)P.
Similar to the parallel composition theorem for ordinary c-D as MeSherry [22], we complement the parallel composition for v-RDP:

---

Theorem 2 (Parallel composition of v-RDP). If mechanism M, satisfies (a,6)) RDD for 1,2...., m. and let D2, Dz..... Dm be the disjoint partitions by executing a deterministic partition- ing function P on D. Releasing Mi Mm (Dm) satisfies (a, (1, (1.2....)) 6)) RR)P
2.3 Gaussian mechanism for v-DP and v-RDP
Among multiple choices, the Gaussian mechanism is more suitable for the (e, 8)-P notion (where 6 > 0) and provides additional flexibility (e.g., the sum of Gaussians is still a Gaussian). It achieved by adding calibrated spherical Gaussian noise to vector output.
Proposition 1 (Gaussian mechanism for v-DP and v-RDP, [9, 23). Given d-dimensional function f: + Rd. The Gaussian mechanism is given by:
= = fDD + of2f (O,
where 2 DAXD=D' D'DD' - M(D) is said be: (1) (c,
( for (0,1), or (2) (a, 25 RRDP.
2.4 Differential privacy for functions (f-DP)
Prior DP works mainly focused on the setting when the output of a query a vector. However, if the output is a function, such as the kernel density estimation example in Hall et al. [12] and the DPGM example in our work (Section 4.3), a few challenges render the direct application of previous DP results on finctional oulput' intractable: it is unclear (1) how to analyze the sensitivity and (2) how to add Gaussian noise to an infiniteddimensional output. To the best of our knowledge, Hall et al. [12] are the pioneers in addressing those challenges by starting with defining the (e, 5)-D for functions: Definition 3 ((c, 5)DP for functions, [12]). Consider class of functions indexed by database D over T = IR4 ie. {JD: D E D C RR Define cylinder sets Cs,B = {f R (f(x)).... for all finite subsets 5 = (x1,-..,Xx) of T and Borel sets B E R². Then, define C. {Cs,n B E B(R")) and Fo = =Us.ssiaoo C.. We say the mechanism fo satisfies (e, 8DD over the field of cylinder sets, for all D, D' D:
e
Pr[ʃD E A] S exp(c) x Pr[JD' E A] VAE
Hall et al. [12] point out that whenever Eq. (1) holds, for any finite set of points X1...., X,, in T chosen a-priori, after the construction of the function, even adaptively chosen based on the outputs given, releasing the vector (x1())), (D(x)) satisfies (c, DD...
The Gaussian mechanism for f-DP is reached by injecting a sample path a calibrated Gaussian process into the function:
Proposition 2 (Gaussian mechanism for f-DP, [12]). Let G be a sample path of a Gaussian process having mean zero and covariance function k. Let M denote the Gram matrix
((x1,x1)
k(x1, Xn)
M (X1
Xx)
(x(,,, X1)
ke k(x,, xn)
Let (SD: D E D} be family of functions indexed by database D. Releasing Jn In /2ln(1.25/8)) G satisfies (c, (DPP) whenever
(fl(x)) (x1) : (D((x)) (xx))
sup sup D- n-c00 JET
sup
M (xI........
Xa)
AA.
It means the output is a function. 'Intuitively, the cylinder defined here set of functions where any finite evaluation of the function is in a "ball".
"A Borel set is formed via countable union, intersection and complement of open sets in topological space. "Not to confuse with the function DP in Dong et al. [7], where the type-I and type-Il emrrr are controlled by a pre-specified function.
A Gaussian process is generalization of the multivariate Gaussian distribution to the infiiit-ddimnssional
case. Any arbitrarily collected finite random variables from a Gaussian process follow a multivariate Gaussian distribution.
3

---

Particularly, Hall et al. [12] studied how to achieve (c, 6)-DP for functions in an RKHS Hi
Corollary (Corollary 9 in [12]). For {fD
D} S H. releasing fD fD
(11n(112//))/e G is (c, 6)-DP (with respect to the cylinder a o-field) whenever supp. l [D S A and when G a sample path of a Gaussian process with mean zero and covariance function & that is given by the reproducing kernel H.
3 Rényi differential privacy for functions (f-RDP)
In this section, we aim to extend the definition of RDP to functional outputs, along with its associated calculus rules to facilitate practical adoption. In particular, we will show that the main results for v-RDP all extend f-RDP.
3.1 Definition
Consider a class of functions over T = R", i.e {fo: : C.T. We can define functional generalization of the a-Rényi divergence:
Definition ((xx, RDDD for functions). Denote the evaluation of function I on any finite subsets S -x1....... Xn) T by (fD(x)).....
== fD(S). We say fD is (a, c)-RDP, for all adjacent imputs D' E DD Rényi's a-divergence (of order a > 1) between the distributions of (S) and f (S) satisfies:
De (F((S)IFF - log Exny
plar) g(x)
Se.
(4)
where p. 9 are the density of fD(S) and fo (S), respectively. Remark 1. Definition essentially claims that the distribution of any finite number of evaluations of function In and J satisfies Definition (v-RDP).
We have weaker definition of [-RDP (see Lemma 1 for the weaker definition) also based on cylinder sets in Definition 3. We also refer interested readers Appendix for an alternative unified definition of RDP for both vectors and functions.
3.2 Post-processing theorem
As any data-independent post-processing preserves the DP guarantee for v-RDP (Definition 2), it also preserves DP guarantee for f-RDP with Remark 1. Specifically,
Theorem 3 pPost-processing theorem of f-RDP). function Io (),c))RDP,, is g SD. where is a post-processing mechanism that only depends on a finite number of outputs of fD-
3.3 Conversion O)DP
The following conversion is direct extension of its vector version in Mironov [23]:
Proposition 3 (f-RDP conversion f-DP). Sunction In that (a,e)-RDP is (e + log 1/8
a-1 8)-D.
3.4 Composition theorems
Similar to Theorem 2, we first derive the parallel composition theorem of RDP for functions:
Theorem 4 (Parallel composition of f-RDP). Given a deterministic partitioning function P. ler D1, D2..... Dm be the disjoint partitions by executing P on D. function J'D satisfies (o, RR)-RD for 1,2, ...., m, releusing (JD,....,, := JD satisfies (a,, max.e 6, RDD.
Now we move on to the sequential composition theorem of RDP for functions (extension of Theorem 1 functional mechanisms), which is important and required for composing the total privacy cost when we sample different sample paths from the Gaussian process over training iterations.
A Hilbert space of functions with continuous pointwise evaluation f + f(x). We give more explanations in Section 4.

---

First, we note that Theorem I implicitly defines g as functional mechanism, i.c. : means for any ri R1, we have 9r, := g(r. D R2 (a, 62)
Q: - R²² It
Theorem 5 (Sequential composition of f-RDP). Let (fD D E D) and (gD D E D be two
families of functions indexed by dataset D, where fo E R2 is (a, E1) and gD R - R
(a, 2 RDD. Releasing the sequentially composed functional mechanism hD (fD.90 9n fD)
Ri x R = (Ri R2) xxS satisfies (0,61 + -RDP.
3.5
Gaussian mechanism
We also need to develop
Gaussian mechanism retain f-RDP. To make it more convenient, we first rewrite Proposition in a similar form to Proposition in Hall et al. [12] as:
Definition 5 (Gaussian mechanism for v-RDP, with non-isotropic Gaussian), Let M E Raxd be positive definite symmetric matrix, the family of vectors {VD D E DDj E Rd satisfies
supp>D' || (VD- - -DD'll2 I A for all adjacent datasets D' D. The Gaussian mechanism is given by:
VD VD + +D
(5)
VD in Eq. (5) satisfies (a,, /Ø- RD.. Now we define the Gaussian mechanism for f-RDP:
Proposition (Gaussian mechanism for f-RDP). Let be a sample path of a Gaussian process having mean zero and covariance function k. Let M denote the Gram matrix (as defined in Eq. (2)).
Let UDD D D) be a family of functions indexed by database D. Releasing fo = fD + a G satisfies (a, 20²
o -RDP whenever Eq. (3) holds.
Particularly, when the function is in RKHS H. we have the following corollary:
Corollary For (JD: : DJ H. releasing Jn = Jn + ob. G is (ax, ( (with respect
Gis to the cylinder o-field) whenever sup II - J ll < A and when G is sample puth of fuvarioncefunnction
Gaussian process with mean zero and covariance function ls given by the reproducing kernel of H..
3.6 Subsampled Gaussian mechanism (SGM)
Subsampling is crucial component in existing DP deep learning algorithms (e.g., DP-SGD of [1]. which incurs a small privacy cost for every sampled batch by querying D, thereby requiring to compose the total privacy loss (measured by over training iterations. The same thing could happen for functional mechanisms when we subsample a batch S from the whole dataset D to index the function fs.
The current dominant (python-based DP implementation packages, e.g., Tensorflow privacy and Opacus, apply v-RDP and compute the total in three main steps: (1) compute the v-RDP guarantee for an SGM, based on a numerical procedure in Mironov et al. [24]: (2) sequentially compose v-RDP over training iterations; (3) convert v-RDP to v-DP. In previous sections we have already shown that f-RDP shares the same results with v-RDP on steps (2) and (3), now we will show that an SGM for f-RDP can be reduced to v-RDP in Mironov al. [24], thus, the numerical procedure in Mironov et al. [24] (and thereby those DP packages) is amenable to f-RDP in terms of the accumulation.
We apply the same subsampling strategy in Mironov et al. [24]. Let S be a subsampled set from D, where each element S is independently drawn from D with probability q. SGM for f-RDP is given by fs fs + aA- G. where A and G are defined in Proposition 4. The reduction is immediate: for any finite set of points V = {x1,.... xa) (where < 0o), (V) will form a d-dimensional vector. Let gs (V) d-dimensional vector and gs( (V) is the same SGM as in Mironov et al. [24]. Therefore, f-RDP shares the same guarantee of an SGM with v-RDP. Another intuition is that Mironov et al. [24] reduce computing the Ré-én divergence of d-dimensional Gaussians to 1-dimensional Gaussians, which guides all of their subsequent derivations. When - oc, we can reach the same reduction from diinite-dimensionn Gaussian (Gaussian process) to 1-dimensional Gaussian.
1/2 fsV),, we have gs (V) = gs (V) a (N(O, where gs (V) is
5

---

4
An application in DPGM
To demonstrate the practical value of f-RDP, here consider a particular example of training differentially private generative model (DPGM) through Maximum Mean Discrepancy (MMD).
4.1
Background
Assuming a feature map Φ X' + H. where H. is an RKHS of some kernel, MMD [1I] is non-param non-parametric distance measure that compares two distributions p, q by:
LNMMD q) [Ex=p(((x]] Ew (o(w)ll?
where Ex [x(x]] E H. is also known as the (kernel) mean embedding (KME) of
Given kernel k: & x X' R. such that? k(x, w) (Ø(x), <(w)) can play the kernel trick to compute the (squared) MMD in an alternative way:
SMMD= (p, q) xxxx'=p((xx x') 2 w) Ew, ww.wwngktmw w'),
which also implicitly lifts the KME into an unfnite-dimensional space.
Sriperumbudur al. [27] suggest that if k is characteristic kernel (e.g., Gaussian kernel), then MMD = 0 iff p g, which makes MMD a practical tool in many applications, such as two-sample test [11] and generative modeling [e.g.. 16, 17].
4.2 Related works
Balog et [3] first proposed DP database release mechanism via KME, by truncating the infinite- dimensional RKHS to a siiteedimeesional feature space through random Fourier features and adding Gaussian noise to the mean of truncated feature embeddings of all data. This idea is further extended to generative modeling by DP-MERF [13]. Specifically, given the samples drawn from two distributions:
D [x: ~ p (true) and
{w;} q (generated), empirical MMD with a kernel function
LM
k can be estimated by:
N
N
N
2
CMMDD (p, g)
k(x, xp)
k(wj, w.). (6)
N2
NM
M
DP-MERF approximates the kernel by: k(x, w) Fourier feature [25] and d is the feature dimension. Now the loss becomes:
x(x) (ww). where x(x) Rd is the random
EMMDE (p.9)
1 Σ (x,) N
1 M W 1
1
Σ
M
1 M
M
( (w
where My = E obtain Mip with DP guarantees, which can be viewed privatized statisties of the whole real dataset. Thereafter, the training objective is to match the KME of generated data with Up. without querying the real data any longer. A line of recent follow-up works, e.g., PEARL [19] and DP-HP [31], boil down to improving the Lnite-dimensional truncation and show some further improvement in utility.
i- o(x;) ) is the empirical KME of p. Calibrated Gaussian noise is added to 14p to
Compared to other DPGM approaches via DP-SGD [1], DP-MERF is appealing in two aspects: (1) training efficiency, since noise is added to the KME of the whole database once and for all, whereas DP-SGD has to clip and perturb the gradient in each training iteration, which leads to significant training time overhead; (2) more scalable to smaller e, c.g., E = or below.
However, we observe that the generation by DP-MERF (and related followup methods) resembles 3), which can be explained by their training objective, because matching the KME of all data is likely to lead to mode collapse. Moreover, truncating the RKHS into a dimee-ndie space makes it easy add Gaussian noise, but the cost of potentially losing the fine ability to distinguish the data distribution from generation (any finite- dimensional RKHS not characteristic). Therefore, we turn to study the possibility of adding noise in the dimenioadi RKHS directly.
"mean-like" images (e.g. see Figures
"B Moore-Aree Aronszajn theorem, any symmetric, positive definite kernel & on X detines a unique Hilbert space of functions on X where & is a reproducing kernel. We can find feature map é X + H. such that k(xx, w) = (o(x), d(w)) and 2) is the inner product on H.

---

4.3 Methodology
We use Gaussian kernel as our kernel function k. i.e. k(x,, w) expf used in related works [13, 19, 31]. Define
x--W 2h2
1
since it is widely
N
1
fD
((x:)
Σ
k(xir))
N
can rewrite Eq. (6) by plugging in fD:
N
2 M
M
M
LMMD
fb(xp) - M 1=1
Σ
fD(w,) +
k (. Wg)
N
M
Privatizing the terms relating to real data x, E D (i = ........ .N) amounts to privatizing the function fo E H by Corollary which leads to our private training objective:
M Jn(ws) M
M
M
LMMD N Σ (n(xp)
2
1
ΣΣ
k k(w,, Wa).
M
where gz)), i.e., is generated from standard Gaussian noise by generative neural network Go- Given the kernel is Gaussian, we can easily bound the sensitivity ÍD in the RKHS norm. Without loss of generality, assume D, D' only differ in the last element, i.e., XN + x'y. Then,
(fD-SD) Σ
((x,)
Σ
(xx) (d(xN)
N
Now we play the kernel trick k(x, y) (o(x), ((x))))(())))))))))))))) again:
o(y))
1 IID 1 N2 (N(XN,XN) 2k(xN, x k(x xm))
2 N2 A
We follow the batch method in Hall et al. [12] to release function fo in practice, as it naturally fits the batch training manner, which amounts to sampling a path from the Gaussian process specified by any finite collection (batch) of points. Assuming the batch size is m, we concatenate (x, w) = s (of size 2m, $[1mm] 8 (/2mm) to save additional privacy cost incurred by additional sample path in each training iteration. Now we release fo (x,) and fD(wy) via fo(s) as needed in (7) by:
(ns)
[n((s))
k(s1,81)
k(s1, 82m)
~
.o
(8)
(
fD($2m)
k($2m, $1)
k(s2m S2m)
In summary, each training iteration proceeds with (1) subsample batch S from 1 to index the function fs: (2) perturb is by Corollary (3) compute the loss function Eq. (7) by Eq. (8).
Extension to the conditional setting: We follow the approach in DP-MERF to encode labels in the MMD loss. Consider a new kernel ks product of existing kernels: 1:" ((x, y). (x,)) (x,x, Jiy (y, where set kx the same the unconditional setting (i.e., Gaussian kernel) and ky to be polynomial kernel of order-1, i.e., (y, y y. Now the function that want to privately release becomes fo = ENN, ke ((x,, y.). .). The sensitivity of f is the same as fD- Thus, releasing fi by the batch method is achieved by replacing fD, k with fū k* in Eq. (8).
4.4 Experiments
Since our method is based on making the RKHS features of a (Gaussian) kernel differentially private without truncating the kernel, we term our method DP-kernel. In this section, we will evaluate DP-kernel both qualitatively and quantitatively on three image benchmarks, including both grayscale and colorful images. All implementation details are given in Appendix C.
7

---

Datasets: We consider widely used image benchmarks in related works, i.e. MNIST [15], Fashion MNIST [34], and CelebA [20]. For MNIST and Fashion MNIST, we generate images conditioned on 10 respective labels. For CelebA, we condition gender. Descriptions and pre-processing of the datasets are given in Appendix B.
Evaluation metries: For quantitative comparison with baselines, we compute the following two metrics via 60k generated images under the same DP guarantees as baselines:
Generation fidelity. We mainly use Fréchet Inception Distance (FID) [14), as it is widely compared related works. However, recent studies suggest that FID is not always consistent with human evaluations (c.g. [28]), where the authors found that Inception- V3 (the feature extractor used to compute FID, which was proposed 2015) is not competent enough, and switching to a more recent and powerful feature extractor (e.g- DINOv2 ViT-L/144 seems overcome this issue. Therefore, we follow Stein et al. [28] and use their code to compute an additional Fréchet Distance, which is denoted by FDDINOv2, for our presentation only.
Generation utility. We train convolutional neural network (CNN) as the classifier on generated im- ages, then test the classifier on real images, where the performance is measured by the classification accuracy. We take 5 runs and report the average and standard deviation.
Baselines: We compare our method with the following related works: (1) kernel-based methods: DP-MERF [13], DP-HP [31], PEARL [19]; (2) others: DP-CGAN [29], GS- WGAN [5]. DP-Sinkhom [4], G-PATE [21], DataLens [33], DPDM [6]. All baselines developed from v-RDP v-DP.
Privacy regimes: Note that according to Definition 1, the DP guarantee is weak when 2 10, because exp(10) 2.2 x 10*, which meaningless, because the two probabilities are presumed to be comparable for practical deployment (e.g. S 1). However, line of recent SoTA DPGMs only generate acceptable images at 10 [4, 5, 29]. Instead, we consider three values of e, i.c., 10, 1, 0.2, indicating three levels of DP guarantees, where put comparison under (10, 10 50 in Appendix for completeness.
4.4.1 Conditional vs. parallel
The downstream classification task requires access to labels, need to consider conditional generative modeling, as introduced at the end of Section 4.3.
Alternatively, we can partition the dataset by labels, train K (K is the number of total classes) unconditional sub-models parallel with DP guarantees, and release the union in the end, which could retain the same level of DP guarantee as the conditional one by parallel composition theorem for f-RDP (Theorem 4). Specifically, we partition the dataset D into subsets by labels, and set the target (for (D) the same for all fDx. Thus, releasing (JD,.... ......... fDxx ) also satisfies (a, RDP. We will show both conditional and parallel generation results in the following sections.
4.4.2 Grayscale image sets: MNIST and Fashion MNIST
We first tried our method on MNIST and Fashion MNIST. Qualitatively, while all baselines are able to generate reasonable images under (10, 10-5)-DP guarantee (see Appendix D), our method indicates more visual improvements for smaller with more diversity and less artifacts, as shown in Figures and The quantitative comparison is summarized Table Although DPDM the only related work that is par with our method (both variants) when 1, DP-kernel significantly outperforms other baselines when e = 0.2. Specifically, our method improves the SoTA FID from 61.9 to 26.5 MNIST, and from 78.4 to 46.2 FMNIST, while SoTA classification accuracy is generally improved for more than 20% on MNIST and more than 10% on FMNIST.
The FDDINOV2 of our conditional variant on MNIST and FMNIST are 454.8 and 608.9 when = 1, and they are 410.3 and 589.2 when e = 0.2.
$DPDM requires GPUs to train, whereas method only requires I GPU.
8

---

G-PATE
Q
3
6
7
DP-MERF
0
I
2
3
5
6
7
0
[
A
3
8
6
7
2
PEARL
2
3
5
7
0 /
J
F
3 7
DP-HP
3
4
&
4
O
(
2
3
4
5
6
7 3 9
DPDM
4
7
2
5
6
7
GS-WGAN
O
/
12
5
6
7
&
Ours (conditional)
0
012
2
3
5
6
7
9
1
0
0123
3
9
3
L
7
3
9
0123
4
5
6
7
8
9
0
/
2
3
4
5
6
7
8
9
Ours (parallel)
0
1
1. 7
3
4
5
6
7
8
9
0
1
3
4
6
6
1
9
0
/
3
4
5
6
7
8
9
Figure Qualitative comparison under
(1, 10
- on MNIST and Fashion MNIST
1
0
27
7
5
8
DPDM
C
4
4
7
0
6
7
DP-MERF
4A
2:
7
PEARL
0
2
7
O
/
7
4
5
6
7
0
1
2
4
5
6
7
f
Ours (conditional)
0
1
2
3
4
5
6
7
1 4
4 9
0
/
2
3
4
5
6
7
0
2
3
1
5
6
Y 7 7
7
9 ,
Ours (parallel)
0
1
2
4
5
6
1
2
3
4
5
6
9 Σ
0
2
3
4
5
7
Figure 2: Qualitative comparison under (0.2, 10
5DD MNIST and Fashion MNIST
4.4.3 RGB image sets: CelebA
To test the versatility and scalability of our method, we also evaluate our method more complex colorful image dataset, i.e. CelebA. Figure 3 shows that our method generates more diverse face images with identifiable gender attributes compared baselines, which is quantitatively verified by significant improvement both FID and Acc in Table 1. Note that DPDM is unconditional on CelebA. Notably, for 0.2, method improves the SoTA FID from 264.8 to 85.9, and improves SoTA Acc from 52.7 to 86.5.
The FD of our conditional variant on CelebA are 1028.2 when and 998.9 when 0.2.

---

DPDM
DataLens
DP-MERF
Ours
(conditional)
Ours
(parallel)
c
(b)
Figure 3: The qualitative comparison CelebA. å 10 DPDM is unconditional.
Table 1: Quantitative comparison on MNIST, Fashion MNIST (FMNIST) and CelebA. Acc denotes classification accuracy. which is shown in %. f and refer to higher better lower better, respectively. We use boldface for the best performance. Results of DP-CGAN, GS-W AS-WAAN, DP- Sinkhorn are cited from Cao [4] and Long et al. [21]. Results PEARL and DPDM are cited from Dockhorn et al. [6]. Results of G-PATE and Datal.en Lens are cited from their papers, respectively. (+): DPDM did unconditional generation on CelebA.
MNIST
FMNIST
CelebA
Method
FID
Acc
FID +
Acc
FID 4
Acc t
DP-MERF
118.3
80.5
104.2
73.1
219.4
57.6
GS-WGAN
489.8
14.3
587.3
16.6
437.3
62.9
DP-HP
74.0
67.0
PEARL
121.0
78.2
109.0
68.3
G-PATE
153.4
58.8
214.8
58.1
293.2
70.2
Datal
186.1
71.2
195.0
64.8
297.7
70.6
DPDM
23.4
93.4
37.8
73.6
*71.0
Ours (conditional)
29.5
93.4
49.5
78.8+004
81.8
86. 86.2+099
Ours (parallel)
21.8
95.5+00
48.4
80.0+0.5
83.8
87.0=08
DP-MERF
0.2
119.3
75.2
151.3
67.4
264.8
52.7
PEARL
0.2
133.0
77.6
160.0
68.0
G-PATE
0.2
22.0
18.0
DataLens
0.2
23.4
22.3
DPDM
0.2
61.9
71.9
78.4
57.0
Ours (conditional)
0.2
26.5
91.3+00
46.2
78.4+00
85.9
84.3
Ours (parallel)
0.2
37.3
93.7=0.7
65.4
79.2
95.8
86.5#12
5
Conclusion
We generalize RDP for vectors to functional mechanisms and develop all building blocks, e.g. (sub- sampled) Gaussian mechanisms, composition theorems, and post-processing theorems, facilitate its adoption in deep learning frameworks. We show that those main properties or results of v-RDP also hold for f-RDP. Equipped with f-RDP, we propose novel approach for training a DPGM, by making the loss function in the RKHS private without truncating the RKHS feature map. Experimental results across different datasets and privacy costs indicate that our method (equipped with f-RDP and retaining the full discriminative capability of the kernel) consistently outperforms other kernel-based methods (with v-RDP) as well to bridge the gap between RDP and functional mechanisms and enrich the family of DPGM.
wew-keeenelsseeee methods by large margin. We expect our work
10

---

Acknowledgments and Disclosure of Funding
We thank the reviewers and the area chair for thoughtful comments that have improved our final draft. YY gratefully acknowledges NSERC and CIFAR for funding support. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute.
References
[1] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. "Deep Learning with Differential Privacy". In: Proceedings of the 2016 ACM SIGSAC Conference Computer and Communications Security. 2016, pp. 308-318.
[2] E. Bagdasaryan, O. Poursaeed, and V. Shmatikov. "Differential privacy has disparate impact on model accuracy". In: Advances in neural information processing systems. 2019.
[3] M. Balog, I. Tolstikhin, and B. Schölkopf. "Differentially Private Database Release via Ker- nel Mean Embeddings". In: Proceedings of the 36th International Conference on Machine Learning. 2018.
[4] T. Cao, A. Bie, A. Vahdat, S. Fidler, and K. Kreis. "Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence". In: Proceedings of the 34th Advances in Neural Information Processing Systems. 2021.
[5] D. Chen, Orekondy, and M. Fritz. "GS- WGAN: A Gradient-Sanitizee Approach for Learn- ing Differentially Private Generators". In: Proceedings of the 33rd Advances in Neural Infor- mation Processing Systems. 2020. pp. 12673-12684.
[6] T. Dockhorn, Т. Cao. A. Vahdat, and K. Kreis, "Differentially private diffusion models". arXiv:2210.09929. 2022.
[7] J. Dong, A. Roth, and W. J. Su. "Gaussian differential privacy" ar..v: 2019.
[8] C. Dwork. "Differential privacy". In: Automata, Languages and Programming: 33rd Interna- tional Colloquium, ICALP 2006, Venice, Italy, July 10-14, 2006, Proceedings, Part II 33. 2006, pp. 1-12.
[9] C. Dwork and A. Roth. "The algorithmic foundations of diffcrential privacy". Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3-4 (2014), pp. 211-407.
[10] M. S. Esipova, Privacy from Gradient Misalignment", In: The Eleventh International Conference Learning Representations. 2023.
Ghomi, Y. Luo, and C. Cresswell. "Disparate Impact in Differential
[11] A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf. and A. Smola. "A kernel two-sample test". The Journal of Machine Learning Research, vol. 13, no. (2012), pp. 723-773.
[12] R. Hall, A. Rinaldo, and L. Wasserman. "Differential privacy for functions and functional data". The Journal of Machine Learning Research, vol. 14, no. (2013), pp. 703-727.
[13] F. Harder, K. Adamczewski, and M. Park. "DP-MERF: Differentially Private Mean Embed- dings with Random Features for Practical tional Conference on Artificial Intelligence and Statistics. 2021, pp. 1819-1827.
Data Generation", , In: Interna-
[14] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter. "GANs trained by a two time-scale update rule converge to a local Nash equilibrium". In: Proceedings of 30th Advances in Neural Information Processing Systems. Vol. 30. 2017.
[15] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. "Gradient-basee learning applied to document recognition".. Proceedings of the IEFE, vol. 86, no. 11 (1998), pp. 2278-2324.

---

[16] C.-L. W.-C Chang, Y. Cheng, Y. Yang, and B. Póczos. "Mmd gan: Towards deeper understanding of moment matching network". In: Proceedings of the 30th Advances in neural information processing systems. 2017.
[17] Y. Li, K. Swersky, and R. Zemel. "Generative moment matching networks". In: International conference on machine learning. 2015, pp. 7718-17217
[18] F. Liese and L. Vajda. "Convex Statistical Distances". Teubner, Leipzig, 1987.
[19] S. Liew, T. Takahashi, and M. Ueno. "PEARL: Data Synthesis via Private Embeddings and Adversarial Reconstruction Learning". In: International Conference Learning Representa- tions. 2022.
[20] Z. Liu, P. Luo, X. Wang, and X. Tang. "Deep Learning Face Attributes in the Wild". In: Proceedings of International Conference on Computer Vision (ICCV). 2015.
[21] Y. Long, B. Wang, Z. Yang, B. Kailkhura, A. Zhang, C. A. Gunter, and B. Li. "G-PATE: Scal- able Differentially Private Data Generator via Private Aggregation of Teacher Discriminators". In: Proceedings of 34th Advances in Neural Information Processing Systems. 2021.
[22] F. D. McSherry. "Privacy integrated queries: extensible platform for privacy-preservin data analysis". In: Proceedings of the 2009 ACM SIGMOD International Conference on Management of data. 2009, pp. 19-30.
[23] I. Mironov. "Rényi differential privacy". In: 2017 IEEE 30th computer security foundation symposium (CSF). IEEE. 2017, pp. 263-275.
[24] I. Mironov, K. Talwar, and L. Zhang. "Rényi differential privacy of the sampled gaussian mechanism" (2019). arXiv:1908. 100.:1990..0500.
[25] A. Rahimi and B. Recht. "Random features for large-scale kernel machines". In: Proceedings of the 20th International Conference on Neural Information Processing Systems. 2007, pp. 1177 1184.
[26] A. Rényi. "On measures of entropy and information". In: Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability. Vol. 1. 1961, pp. 547-562.
[27] B. K. Sriperumbudur, K. Fukumizu, and G. R. Lanckriet. "Universality, Characteristic Kernels and RKHS Embedding of Mcasures", Journal of Machine Learning Research, vol. 12, no. 7 (2011).
[28) G. Stein et al. "Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models". arXiv:2306.04611 046755 2023.
[29] R. Torkzadehmahani, P. Kairouz, and B. Paten. "DP-CGAN: Differentially Private Synthetic Data and Label Generation".. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). 2019, 98-104.
[30] T. Van Erven and P. Harremos. "Rényi divergence and Kullhack-Leible divergence". IEEE Transactions on Information Theory, vol. 60, no. 7 (2014), pp- 3797-3820.
[31] M. Vinaroz, M.-A. Charusaie, F. Harder, K. Adamczewski, and M. J. Park. "Hermite Poly- nomial Features for Private Data Generation". In: Proceedings of the 39th International Conference on Machine Learning. Vol. 162. 2022, pp. 22300-22324.
[32] Wang and N. Hegde. "Privacy- prreacc-prrseeving lelearning with functional noise in continuous spaces".. In: Proceedings of the 32nd Advances in Neural Information Processing Systems. 2019.
[33] B. Wang, F. Wu, Y. Long. L. Rimanic, C. Zhang, and B. Li. "Datalens: Scalable privacy preserving training via gradient compression and aggregation", In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 2021, pp. 2146-2168.
12

---

[34] H. Xiao, K. Rasul, and R. Vollgraf. "Fashion mnist: maishoon-mmist:: machine learning algorithms", arXiv:1708.07747. 2017.
novel image dataset for benchmarking
[35] D. Xu, W. Du, and X. Wu. "Removing disparate impact on model accuracy in differentially private stochastic gradient descent". In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 2021, pp. 1924-1932.
13

---

A Proofs
Theorem 2 (Parallel composition v-RDP). If mechanism M, satisfies (a, (.), -RDP for .... n,, and let Di, .,...., Dm be the disjoint partitions by executing deterministic partition- ing function P on D. Releasing Mi (D.)....... Mm (Dm) satisfies (a, maxie m)...m 6,) -
Proof. Without loss of generality, given two neighboring datasets D and D', assume that D contains one more element than D'. Executing P on D and D', we have partitions Di, D2...., Dm and D1 D2---.. mm respectively. There exists such that (1) Dj contains and (2) D2 D' for ..,,..., m and + j. Denote Mi(Di), Mm Mm(mm) by M(D). Using additivity of Rényi divergence in [30] (Thm 28);
element than DJ.
Da(M(())lM(D')> = Σ (.(M((D)MMMM)
Σ
$ 5 v max CG.
i=.2.....m
The proof is complete.
Theorem 3 (Post-processing theorem of f-RDP). a function fo is (a., c)-DP, is f'D where g is post-processing mechanism that only depends on a finite number of outputs of J'D
Proof. Given any finite subsets S, we reach the reduction of proof of the post-processing theorem in [23]:
2 Diodf(())lo((f
Lemma 1. Definition 4 implies:
P(Jo A) (exp(c)P(fo E A)) " AA E Fo.
(9)
where we reuse all the notations in Definition 3.
Proof. Proof sketch: we will show that Eq. (9) holds whenever Eq. (4) holds.
By taking logarithm and rearranging from Eq. (9), we have
a - log ( PiSo E A) P(fd A)
) "P( E A)) Sc.
(10)
By the definition of cylinder sets, To implies that (D()) in some sets B for any finite subsets S = (x,..... ..) of T. Thus,
P( E A) =)= P(F(SS) B) = p(x)
where is the density of Fo()). Now we can translate Eq. (10) into
log (1e ) q(x)) du(a)) S
(11)
a-1
Recall that Eq. (4) in Definition 4 can be translated to:
1
log (f(ele)) ((x)
((((x) ((x dp(x)) Se.
1
14

---

Note that q are non non non-negative, so [(p(e) (II), it now suffices to show
(()) du(x)) 2 Is( ((a)) )rh q((x) du(z). Compared to Eq.
[(2)
p(z) (
((())d((())) 2 p(x) du(e)) Is (()) du(x))
/ g(x) dp(x).
Define p² (x) Ig du(() and q" is similarly defined. All want show reduces to
((ES)
p
21 Eggn 11 [2) )y 2 (Beng* gr ( 1,
(x)
where the final step follows from Jensen's 's inequality.
Proposition 3 (f-RDP conversion to f-DP). function fo that is (a,e)-RDP is (e + log
a-1 -D..P.
Proof. We reuse the notations in Definition in this proof. To show that (a, RDP function satisfies (e', 8)-P for functions, where = e + o-l
1/6 the objective becomes to show PifD e
A] S exp(e') Pifdr E A] + 8. With the help of Lemma 1, denote PifD E A] by Q and we perform case analysis:
exp((()) s 8a/(a-1), then
P(D A) (exp(e)Q) = < exp(e')Q +
. If exp(())) > 80/(a-1), then
P(Jn E A) s (exp(e)Q)
explee)((expp) (exp(e))) -
exple)Q 8- a'
exp((e log 1/8 )Q
a
< expl(')) 6
Combining the two cases completes the proof.
Theorem 4 (Parallel composition of f-RDP). Given a deterministic partitioning function P. let D1, D2...., Dm be the disjoint partitions by executing P on D. If function J'D satisfies (a,, RRD- for 1,2,.... m, releasing (fD....., fD.... = fo satisfies (a, max (1.2....m) RDD.
Proof. Without loss of generality, given neighboring datasets D and D', assume that D contains one more element than D'. Executing P on D and D', we have partitions D1, D2...., D,, and D D22 ........ ., D'm, respectively. There exists j such that (1) Dy contains one more element than D and (2) D. = D' for 1,2,..., m and f j. Given any finite subsets S (x1,..., Xn) T. Using additivity of Rényi divergence in [30] (Thm 28), we have:
(a()(())l( = Σ (a(U,(())l
Σ
Da Da(fo + (SLU(())))))(
i= i=1,..,,,i$$
< Ej <
max E
i9 (
15

---

Theorem 5 (Sequential composition of f-RDP). Let {fD: : D and {go D E D be two
families of functions indexed by dataset D, where fo E Rí is () and gn R + R
is (a, (2) -RDP. Releasing the sequentially composed functional mechanism hp (SD. 9n fD) R R = (R1 TxS satisfies (0,61 RDD.
Proof. According to Definition 4, our objective is to show for any finite subsets X = (XI,...,X,, Xa) of T and Y (y1,...., ym) ) of S.
D. (u(ho(( sa
=
=
D. D.
<c C2.
Here adapt the proof of Proposition in [23]. Let F be the distribution of fD(X), G be the distribution of gf(f (.D..Y) Y), H (F, G), and F", G', H' are similarly defined on adjacent dataset D'.
/
expl(a - (b Y)
H(r, (x, do dy
RIXR2
I [F dr
RR
[ (z)) G(z,y)" v) 1 dy) de
JR
R2
$ [ (xx)" (xpp)= 1)
Ri s expl(a 1)(e1 + +2)]
Proposition (Gaussian mechanism for f-RDP). Let be sample path of Gaussian process
having mean zero and covariance function k. Let M denote the Gram matrix (as defined in Eq. (2)).
Let {fo D "D} be a family of functions indexed by database D) Releasing fo fo + a G
satisfies (a, 20z
a -RDP whenever Eq. (3) holds.
Proof. Consider any finite set (x1,..., X..) E T the vector (G(xi),..., G(x,)) follows multi-
variate Gaussian with mean zero and covariance given by Eq. (2). Thus, evaluating fo at any finite sets would form vector that satisfies Eq. (5) in Definition 5, which completes the proof.
B Datasets
MNIST [15] & Fashion MNIST [34]: MNIST contains hand-written digits images, whereas Fashion MNIST contains cloth and shoe images. Images in both datasets are single-channel, in the size of 1 x 28 x 28, which are resized to 1 x 32 x 32 and normalized to have 0.5 mean and 0.5 standard deviation. Both datasets have 10 classes. We adopt the official training and test split. MNIST and Fashion MNIST are made available under Creative Commons Attribution-Sie Shaore Alike 3.0 license and MIT License, respectively.
CelebA [20]: CelebA is a dataset including face images of celebrities. Each image is in the size of 3 x 178 218 and has 40 binary attributes. All images are center-cropped to 3 178 178, then resized to 3 x 32 x 32, and normalized to have 0.5 mean and 0.5 standard deviation. We also adopt the official training, validation and test split, but randomly select 60k images from the training split as our training set. The CelebA dataset is available for non-commercial research purposes only, as described on their website.
C Implementation
Generative network: Our unconditional generative network is based on the official code of MMD- GAN [16]. For the NN architecture, we use the same Cony2dTranpose layer with similar depth as prior related works. Besides, use the same architecture for both gray-scale and RGB image sets to
16

---

Table 2: Training parameters for retaining DP on MNIST and Fashion MNIST. Both variants on CelebA use parameters in the row of Conditional. is the subsampling rate, and a is the noise multiplier.
target
q
epochs (iterations)
10.0
0.001
0.60
200 (200k)
Conditional
1.0
0,001
1.95
200 (200k)
0.2
0.001
8.00
200 (200k)
10.0
0.010
1.00
200 (20k)
Parallel
1.0
0.010
5.75
200 (20k)
0.2
0.010
25.00
200 (20k)
demonstrate its versatility (of course with different NN parameters account for the difference in input channels). Encoding labels to the latent code leads the conditional variant. All networks optimized by RMSprop with a learning rate 5 x 10-5
CNN classifier: We follow Cao et al. [4] for the classifier implementation.
The CNN consists of following layers: Conv2d(input catptut_hhahhsss.__ 32, kernel size=__ie=epp_ee stride 2, padding=1) - Dro5out(p=055) ReLU - Conv2d(32, 64, kernel size=3, + Dropout(p=0.5) + ReLU - flatten - linear(flatten flatten_ding output dotuutddmmmmm__eee + Softmax.
kernelssiz=33, stride padding=1)
The CNN classifier is optimized by Adam with default parameters. All classifiers are trained synthetic data, and we report test accuracy on real test data as the evaluation metric.
Privacy: We use Tensorflow privacy for computing the total privacy cost, which only requires inputting few important parameters, e.g. subsampling rate (or batch size), noise multiplier, training epochs (iterations), target 8 (8 = 10 in all our experiments). We summarize the parameters in Table 2.
Baselines: We use the official code of DP-MERF to replicate their results under different e and use the same evaluation metrics to add quantitative comparison. The numerical evaluations of rest baselines are cited from related works, as specified in the caption the tables.
Computation resources: All computation is conducted by one NVIDIA T4 GPU. It costs 1.5 hours to train conditional generator MNIST (and Fashion MNIST) and around 5 hours CelebA. Each sub-model in the parallel variant takes only 10 minutes to train on MNIST (and Fashion MNIST) and 30 minutes CelebA. A better GPU should compute faster. As reference, OP-Sinnhorm and GS-WGAN can take up to 24 hours to train, and GS- WGAN even requires at least 2 GPUs (as they have 1000 discriminators).
D Additional results
For completeness, we include the qualitative comparison between our method and related works under (10, 10 S0- all three datasets Figures and Numerical comparison is in Table 3. We note that = 10 is usually considered a weak privacy regime. Generally, all baselines can generate decent images when 10, whereas our method still generates more diverse and more informative images, especially on CelebA.
E Broader impact and limitations
Some prior works reveal that DP training could introduce additional biases to the model, leading to fairness concerns [2, 10, 35]. We did not explore this point in the current experiments as there are no sensitive attributes involved, we can imagine the potential negative effects faimess issues if our methods not used properly.
Broader impact:
17

---

3
6
7
9
DP-CGAN
46
4
6
7
9
0
2
3
4
4
7
8
9 9
DP-MERF
4
7
3
7
/
7
0
1
3
3
9
5
6
7
3
PEARL
6
2
3
4
6
8
G-PATE
0
2
4
7
S
GS-WGAN
0
2
3
4
6
7
8
9
0
/
2
4
5
6
7
8
9
0
4
6
7
8
DP-Sinkhorn
0
3
4
L
O
2
4
5
6
7
8
9 9 9 9
0
2
3
4
5
6
7
Ours (conditional)
0
2
3
9
5
4
7 7
8.
0
2.
3
4
5
6
8
0
2
3
4
5
6
7
8
9
Ours (parallel)
0
2
3
4
6
7
8
9
0
2
3
4
5
6
7
4
0
2
3
4
5
6
7
8
9
Figure 4: Qualitative comparison under (10, 10 10- --DP on MNIST and Fashion MNIST
Table 3: Quantitative comparison under (10, 50- Acc denotes classification accuracy, which is shown in %. and + refer to higher better or lower better, respectively, Results of DP-CGAN, GS-WGAN, DP-Sinkhorn are cited from Cao et al. [4] and Long et al. [21]. Results of PEARL and DPDM are cited from Dockhorn et al. [6]. Results of G-PATE and DataLens are cited from their papers, respectively. (*): DPDM did unconditional generation CclebA
MNIST
FMNIST
CclebA
Method
FID J
Acc 1
FID 4
Acc f
FID
Acc
DPDM
10
5.0
97.3
18.6
84.9
$21.1
DP-CGAN
10
179.2
63.0
243.8
46.0
DP-MERF
121.4
82.0
110.4
73.2
211.1
64.0
PEARL
10
116.0
78.8
102.0
64.9
G-PATE
10
150.6
80.9
171.9
69.3
305,9
70.7
DataLens
10
173.5
80.7
167.7
70.6
320.8
72.9
GS- AS-WAAN
10
61.3
80.0
131.3
65.0
432,5
63.3
DP-Sinkhorn
10
55.6
79.1
129.4
68.9
Ours (conditional)
10
29.9
93.1
56.3
79.2
77.2
85.8
Ours (parallel)
10
17.7
96.4
38.1
82.0
78.5
87.4
Besides, do not expect this work trigger any differential privacy concern by its design, and do not expect it to be used for Deepfakes (as the non- non-private counterparts are better in utility), but there might be some unintended uses that are not aware for now.
The current conditional approach assumes a uniform distribution over different labels, which happens to hold for all three datasets. A more tailored algorithm is needed if the label distribution is imbalanced. The current parallel approach is not subject to specific label distribution, but it may hinder its practical deployment if the number of classes is too large.
Limitations:
18

---

DP-MERF
DataLens
DP-Sinkhorn
Ours (conditional)
Ours (parallel)
Figure 5: Qualitative comparison under (10, 10 50-P on CelebA
A simplified view of RDP for vectors and functions
In this section, we propose to define Rényi differential privacy (RDP) for vectors and functions in unified way.
Let 'D be a collection of datasets and f: D + R be randomized mechanism. We consider R = IR' so we may also identify f as a bivariate (random) function f T + the following we call two datasets D, D' E 'D adjacent if they differ by one data point. We recall the Rényi a-divergence (26) between two random variables X, and X2 with density p and q, respectively:
(x() == (p(x))
باب
1Ex
x
0,
o(X)
where a > 1 is hyperparameter and the last inequality follows from Jensen's 's inequality. Since we can rewrite
D. (X: - log Exup
P(X
it is clear Rényi's a-divergence D, is increasing w.r.t. with the following limits:
KL(X1
lim (x < lim (x(X)))))) sup log p(x) a++1
g(x)
For joint distributions, we easily verify the following decomposition rule:
[[(x]] cxp (ia 1)D. 1)D. (xto
Da (p(x. ())(xxx)llg(x,,, 2)) _ log Exng
D. (p(x))(((())))
(12)
19

---

where the inequality follows from the nonnegativity of the conditional Rényi divergence inside the exponential. In other words, the a-divergence between joint distributions is always larger than that between marginal distributions.
We now ready define Rényi differential privacy [23]: Definition 6 ((a, e)RRD)) A randomized mechanism f T TXD is (o,c)-RDP for all adjacent datasets D, D' DD
sup Da (f(t S nENN t:=[4r....aa..
sup
(13)
where f(t: ()= (f(;: ... f(nn: D)) is the concatenation of random variables.
The acute reader will notice some immediate difference between our definition and the one in the literature, e.g.. Mironov [23, Definition 4]. Before explaining our motivation, let first notice that when = d] := {1....,d},
d}. ,. i.e., the range of our mechanism f is R = R (which is the setting of [23] and most existing work), the supremum in (13) is attained when n and [l,...,d, d], thanks to inequality (12). In other words, the supremum in (13) is superficial when T is finite set. The important point is that is even uncountable. For instance, in our later application to generative modeling (Section 4), we will use T RT. On the other hand, one might be tempted lump all random variables together into f(T; D)- = {f(t; D): tE T`}. hoping to obviate the supremum in (13). However, this approach will run into two difficulties: Firstly, the rigorous minds will start to worry about measurability issues around f(T: D) (as stochastic process) and involve tedious measure-theorette jargon (such as the cylinder field in [12). Secondly, we no longer possess dominating measure (e.g.. Lebesgue) to define an easily computable density of the process f(T: D). In contrast, our reduction to the finite case through taking the supremum does not suffer from either issue, and, as we will see, renders extensions of existing properties of RDP (to an arbitrary index set 7) rather natural or even trivial.
now extend RDP effortlessly any index set T, including when T
The following result was proved by Mironov [23, Proposition 3]:
Theorem 6. If mechanism f is (a, -RDP, then for any (measurable) set A,
E AID'-à s (1 - ) exple + + log PT(J(()) E A) +
Pr(S(D) E A] S In particular, f is ( --م log 1,4 -
Proof. For a 2 1, consider the (jointly) convex function (as the perspective of p + pd))
o(p.9) (2)
as well as the probability measure 1XEA u(dx)//(AA)) (recall that μ((x) is the underlying dominating measure that the densities p and g are defined w.r.t.). Applying Jensen's 's inequality we obtain
p(A) J
( u(dx) 2 9 M(a) /. p(x)u(dx)) utt J ((x))u(dx))
(((x)
p(x) ((x)
((A)
P(A)
P(aj
Q[A)
where P(A) = -Ap(x))(dx)== = Pr(f(D) E A] and similarly for Q(A). Thus,
2 (Pll)))) 2 - log / ((x)
p(x) ((x))
p(dx) N ب log [Q(A))
Q(4) {]
P(4)
Rearranging we obtain the first inequality. The second inequality simply the arithmetic-geometric mean inequality, after noting that
(exp(e) ((A))= [[exp(e بيب log 1) 60.
Lastly, we relax the factor (1 1) < 1 to obtain the claimed DP guarantee.
20

---

For two Gaussian distributions (uu, Σ) and (vv, Σ), their Rényi a-divergence can be readily computed from Liese and Vajda [18, Proposition 2.22]:
Dr (N (VI Σ)) = vu v))
Therefore, the Gaussian mechanism
=1)==F()+o-NN0.11
(a, (D)D,) where
c= a sup
- -F F(D)))
20² D
21


Reviews:
[{"review_id": "BybDm8DNDs", "reviewer": "Reviewer_JRvJ", "summary": "Conceptually, this paper combines the idea behind RDP and f-DP and proposes f-RDP. \n\nTheoretically, this paper proved several important properties of f-RDP (e.g., Composition, post-processing, and the privacy level for the widely-used Gaussian mechanism).\n\nExperimentally, this paper showed f-RDP can be applied to improve the performance of real-world applications. ", "questions": "1. May I know what is the high-level idea of why $f$-DP is better than DP? I guess this is because the sensitivity $\\Delta$ for $f$-DP is smaller, but again, why? Can the authors provide some high-level ideas and explanations?\n\n2. I am not an expert on generative models, but may I know why the proposed $f$-DP notions are suitable for generative models? Can it also be used to improve standard classification tasks?\n\n3. Functional and cylinder set need to be explained before use. I don't believe the majority of the researchers in computer science (without expertise in math) can understand these. \n\n4. I suggest the author to add a note about the $f$-DP notion in the following paper (already with 200+ citations), where $f$ plays a similar role as the Renyi divergence in RDP. I know that these two $f$-DP notions are different, but some readers may get confused because RDP is a special case of the $f$-DP in the following paper.\n\nDong, Jinshuo, Aaron Roth, and Weijie J. Su. \"Gaussian differential privacy.\" arXiv preprint arXiv:1905.02383 (2019).", "limitations": "No limitations within my scope.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. The problem studied in this paper is important to the community. Achieving privacy without losing too much utility is always desired by researchers and mechanism designers.\n\n2. The results of this paper look solid to me. The composition theorem for a new privacy notion usually is not an easy task.\n\n3. The overall presentation looks good to me.", "weaknesses": "1. Some high-level explanations are missing and it's hard for the readers out of DP community to understand Section 2.\n\nTo both authors and chairs: I provide a relatively low confidence score because I am not an expert on generative models. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. Some high-level explanations are missing and it's hard for the readers out of DP community to understand Section 2.\n\n**Response:** Thanks for your suggestion. We will add more explanations and summarize a paragraph in the beginning of Section 2. \n\n> Q2. May I know what is the high-level idea of why f-DP is better than DP? I guess this is because the sensitivity $\\Delta$ for f-DP is smaller, but again, why? Can the authors provide some high-level ideas and explanations?\n\n**Response:** Please note that we are not claiming f-DP is always better than v-DP. They are just two DP notions for different cases (e.g., finite- or infinite-dimensional output). However, through a DPGM example, we show that privatizing the infinite-dimensional functional output in RKHS with functional RDP is theoretically more convenient and empirically better than privatizing a truncated finite-dimensional RKHS with v-DP/v-RDP. \n\nBesides, the functional DP mechanism is more flexible than traditional DP. Please see our joint response to CQ1 for details.\n\nSensitivity is part of the reason. Since the functional output in our example is infinite-dimensional, bounding its L2 sensitivity (in the v-RDP case) will easily go to $\\infty$, which will lead to infinitely large Gaussian noise and thereby is not useful. With functional RDP, we can obtain a finite sensitivity in RKHS norm. In terms of utility gain, compared to truncating the kernel, we believe that preserving the Gaussian kernel without truncation will better preserve its discriminative power. Our generation result is indeed more informative and diverse than prior related works.\n\n> Q3. I am not an expert on generative models, but may I know why the proposed f-DP notions are suitable for generative models? Can it also be used to improve standard classification tasks?\n\n**Response:** Because the MMD objective for training a generative model includes kernel functions in RKHS, we can apply f-RDP (v-RDP does not work without truncating the RKHS) therein to make the training objective differentially private. We are not aware of an immediate example in image classification, but if the training objective also includes a functional output, then we can apply f-RDP as well. It is our hope that the functional RDP toolkit detailed in this work will encourage and facilitate more practitioners to exercise functional RDP in real applications.\n\n> Q4. Functional and cylinder set need to be explained before use. I don't believe the majority of the researchers in computer science (without expertise in math) can understand these.\n\n**Response:** Thanks for your suggestion. We will add more explanations on these concepts in our revision.\n\n> Q5. I suggest the author to add a note about the $f$-DP notion in the following paper (already with 200+ citations), where $f$ plays a similar role as the Renyi divergence in RDP. I know that these two $f$-DP notions are different, but some readers may get confused because RDP is a special case of the  $f$-DP in the following paper.\n\n**Response:** Thanks for your suggestion. Indeed, the name $f$-DP may cause confusion with other notions in the field. We will follow your suggestion to change it to the more explicit functional DP. "}, {"review_id": "LknvCBW7kn", "reviewer": "Reviewer_iWpL", "summary": "The authors  extend  the concept of RDP from vectors  to functions. They introduce the notion of functional RDP and present a few properties of the functional RDP under composition / amplification by sampling. Finally, they demonstrate the functional RDP using the application in RKHS.", "questions": "Here I list my concerns on the novelty:\n\n\n1. Their results on RDP for functions (Definition 5)  and subsampled RDP for functions directly generalize from the existing  RDP literature, except that the output space might now have an infinite-dimension. However,  assuming a bounded RDP divergence of the unbounded output space (in this work) essentially renders it equivalent to  classic RDP.\n\n2. The authors provide empirical demonstrations of the applications of functional RDP by applying it to privatize the Maximum Mean Discrepancy (MMD), a crucial component in DP generative model training. In their approach, they choose to privatize the kernel function $k(\\cdot, \\cdot)$ applied to the private dataset, resulting in a finite (and even one-dimensional) output space for the function.\nGiven that the output space is finite, the authors could use the classic Gaussian mechanism directly to publish the loss function. In this context, the connection with functional RDP is not apparent.\n\nSome minor comments: The organization of the paper is not clear. The authors do not clearly state the motivation/applications of the functional  RDP  before proving their main results.", "limitations": "Not applicable.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. They generalize the definition of RDP to the setting when we have an infinite output space. \n2. The application to RKHS is nice and the experiment section is also complete.", "weaknesses": "My main concern is the novelty of the paper: The applications on DP generative models and the proposed functional new RDP definition appear to publish either the fixed finite-dimensional vector output or the infinite output with some strong constraint on its boundness.  These aspects have already been covered in the existing RDP literature.\n\nThough the authors claim the goal of their work is to publish a function, their results essentially involve releasing the output of functions  applied on a private dataset. This algins closely with  prior classic DP work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. My main concern is the novelty of the paper: Their results on RDP for functions (Definition 5) and subsampled RDP for functions directly generalize from the existing RDP literature, except that the output space might now have an infinite-dimension. However, assuming a bounded RDP divergence of the unbounded output space (in this work) essentially renders it equivalent to classic RDP.\n\n**Response:** Thanks for your comment. Our novelty lies in the following two aspects: (1) Theoretically, **we are the first to develop functional RDP**, and we also develop many useful tools to facilitate its practical use; (2) Empirically, we propose a novel DPGM training algorithm with functional RDP, which allows us to perturb the training objective without truncating the RKHS, in contrast to previous works that truncate RKHS to a finite-dimensional space and add standard Gaussian noise (but lose injectivity of the kernel mean embedding). Our experimental results on widely compared image benchmarks consistently outperform previous related works, especially in strict privacy regimes (e.g. $\\epsilon=1,0.2$).\n\n> Q2. The authors provide empirical demonstrations of the applications of functional RDP by applying it to privatize the Maximum Mean Discrepancy (MMD), a crucial component in DP generative model training. In their approach, they choose to privatize the kernel function $k(\\cdot,\\cdot)$ applied to the private dataset, resulting in a finite (and even one-dimensional) output space for the function. Given that the output space is finite, the authors could use the classic Gaussian mechanism directly to publish the loss function. In this context, the connection with functional RDP is not apparent.\n\n**Response:** If we understand correctly, the reviewer is saying that our $\\widetilde{f_D}$ is evaluated at finitely many points (including both real and generated data), then recalling equation (8) in our paper, we are effectively releasing a finite vector $[\\widetilde{f_D}(x_1), \\ldots, \\widetilde{f_D}(x_N), \\widetilde{f_D}(w_1(\\theta)), \\ldots, \\widetilde{f_D}(w_M(\\theta))]$. Therefore, we can apply the classic Gaussian mechanism (we suppose the reviewer refers to the method in DP-MERF) to this vector. However, while the (private) training data is fixed (if we treat $N$ as its size), the generated data $w(\\theta)$ will increase with training iterations (and is not determined _a priori_; it changes with the model parameter $\\theta$), i.e., its size is $tM$ where $t$ denotes the number of iterations and $M$ is the number of generated samples in each iteration, which could effectively lead to a large sensitivity due to a large $t$ and is likely to degrade the model utility. Certainly, we can pre-set an upper bound for $tM$ (the total number of generated samples), but it may restrict the generalizability of the model  and we still would not know the values of generated data beforehand (and hence would have to guard against the worst-case in calculating the sensitivity).\n\nAlternatively, we can consider a more flexible approach via releasing the function $\\widetilde{f_D}$ with DP guarantees since a function can be evaluated at arbitrarily many points. To do so, we need a functional DP mechanism, which is what we propose in this paper, i.e., we apply functional RDP to the function $\\widetilde{f_D}$ by adding a sample path of a Gaussian process, which does not depend on the number of generated samples anymore.\n\n> Q3. Some minor comments: The organization of the paper is not clear. The authors do not clearly state the motivation/applications of the functional RDP before proving their main results.\n\n**Response:** Thanks for your suggestion. We mentioned the motivation/applications at the beginning of Introduction (Line 24-31), and we will follow your suggestion to expand it and make it more clear in our revision."}, {"review_id": "CwIqSZukUy", "reviewer": "Reviewer_i7xA", "summary": "The work generalizes the DP to infinite dimensions. Based on the modeling of Hall et al., the authors propose some characteristics of functional DP aligning with the traditional DP. The most interesting part is adopting their proposed framework to RHKS for an infinite functional space. Some numerical studies is done for verification.", "questions": "1. How can we compute the functional DP given function $f$, if the functional is high dimension, will we suffer from dimension curse\n2. what is the relationship between the proposed DP and the traditional DP. This problem comes from numerical studies. I am not sure whether it is fair to use the same $epsilon$ for different methods with different privacy metrics. Maybe they protect different things.\n3. can functional form be generalized to privacy loss random variable accounting\n", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Pros:\n1. the application in RKHS is interesting and promising for further application to reduce the dimension and formulate some functional structural data input\n2. some proposed tools like composition and subsampling can be adopted for further studies", "weaknesses": "Cons:\n1. The technical contribution should be clearly stated. Some remarks about the different characteristics of the functional DP and traditional Dp in Subsample and others should be stated. We do know whether we directly imply the results for the composition theorem with Hall's and the traditional DP's proof.\n2. Some more error bounds for RKHS need to be considered. It might influence the privacy guarantee.\n3. The work does not clearly show the complexity result to construct such a DP measure. We can do it with kernel trick or reduced paramters, but some guarantee should be provided.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ">  Q1. The technical contribution should be clearly stated. Some remarks about the different characteristics of the functional DP and traditional Dp in Subsample and others should be stated.\n\n**Response:** Thanks for your suggestion. Our primary technical contribution is the functional RDP with its toolkit, e.g., subsampling, composition theorems, and Gaussian mechanisms. Note that there are no subsampling and composition theorems in Hall et al.'s work.\n\nThe proposed functional RDP extends traditional RDP from vectors to functions, where the output space can be infinite-dimensional. We have indicated that the functional RDP shares similar results with traditional RDP in subsampling, composition, conversion to $(\\epsilon,\\delta)$-DP, Gaussian mechanisms.\n\n> Q2. Some more error bounds for RKHS need to be considered. It might influence the privacy guarantee.\n\n**Response:**  \nThanks for your suggestion. This seems to be a delicate issue that is worth significant future study. We will give a preliminary result below (akin to Proposition 3.1 of DP-MERF), based on a finite dimensional argument. Assuming the generated samples $w$ are fixed, so that we may restrict the kernel to a finite domain $X = \\\\{x_1, \\ldots, x_N, w_1, \\ldots, w_M\\\\}$. Then, let \n\n$$ F = \\Big\\lVert \\frac{1}{N} \\sum_{i=1}^N k(\\cdot, x_i) - \\frac{1}{M} \\sum_{j=1}^M k(\\cdot, w_j) \\Big\\rVert_{X}^2 = \\lVert\\mu_P(\\cdot)-\\mu_Q(\\cdot) \\rVert_X^2 $$\n\n$$\\tilde F = \\Big\\lVert \\mathbf{g} + \\tfrac{1}{N} \\sum_{i=1}^N k(\\cdot, x_i) - \\tfrac{1}{M} \\sum_{j=1}^M k(\\cdot, w_j) \\Big\\rVert_X^2 = \\lVert\\mathbf{g} + \\mu_P(\\cdot) -\\mu_Q(\\cdot) \\rVert_X^2,$$\n\nwhere $\\mu_P(\\cdot),\\mu_Q(\\cdot)$ are embeddings of real distribution $P$ and generative distribution $Q$, $\\lVert\\cdot\\rVert_X$ denotes the RKHS norm restricted to the domain $X \\times X$, and $\\mathbf{g}$ is a Gaussian sample path with zero mean and covariance $\\Sigma$. Note that $F$ is the standard empirical objective of maximum mean discrepancy (MMD) while $\\tilde F$ is the privatized version of $F$. We can bound the difference between $F$ and $\\tilde F$: \n\n$$ \\mathbb{E} _\\mathbf{g}|\\tilde F- F| \\leq  \\mathbb{E} _\\mathbf{g}[\\lVert\\mathbf{g}\\rVert_X^2 + 2\\lVert\\mathbf{g}\\rVert_X \\cdot \\lVert\\mu_P(\\cdot)-\\mu_Q(\\cdot)\\rVert_X] \\leq \\mathbb{E} _\\mathbf{g}[\\lVert\\mathbf{g}\\rVert_X^2]  + 2 \\sqrt{\\mathbb{E} _\\mathbf{g} \\lVert\\mathbf{g}\\rVert_X^2} \\cdot \\lVert\\mu_P(\\cdot)-\\mu_Q(\\cdot)\\rVert_X. $$\n\nUsing the RKHS norm equality over a finite domain (see, e.g., Saitoh and Sawano 2016, p. 130), we have\n\n$$\\mathbb{E} _\\mathbf{g}\\big[\\lVert\\mathbf{g}\\rVert_X^2\\big] = \\mathbb{E} _\\mathbf{g}\\big[\\mathbf{g}^\\top K^{-1} \\mathbf{g}\\big]  = trace(\\Sigma K^{-1}) = \\sigma^2 \\Delta^2 (N+M),$$\n\nwhere $K = k(X, X)$ is the kernel matrix and $\\Sigma = \\sigma^2 \\Delta^2 K$. Noting that the kernel $k$ is bounded by (say) 1, we further have \n\n$$ \\Delta^2 \\leq \\frac{2}{N^2}, ~ \\mbox{ and } \\lVert\\mu_P(\\cdot)-\\mu_Q(\\cdot)\\rVert_X \\leq 2. $$ \n\nSetting $M=N$ (for simplicity) and combining all of the above, we obtain \n\n$$\\mathbb{E}_{\\mathbf{g}} | \\tilde F - F | \\leq \\frac{4\\sigma^2}{N} + \\frac{8\\sigma}{\\sqrt{N}}.$$ \n\nThus, as $N=M$ increases, the difference between the privatized and non-privatized objectives decreases at the usual rate of $O(1/\\sqrt{N})$. We note that this result is similar to Lemma B.3 of DP-MERF (effectively equating their dimension $D$ with sample size $m$). However, since we do not truncate the feature map of the kernel, we do not suffer the additional truncation error in their Lemma B.2.\n\n> Q3. The work does not clearly show the complexity result to construct such a DP measure.\n\n**Response:** The time complexity for one iteration is $O\\big((M+N)^2\\big)$ (where $N$ is the size of private training data and $M$ is the size of generated samples).\n\n> Q4. How can we compute the functional DP given function $f$, if the functional is high dimension, will we suffer from dimension curse.\n\n**Response:** We only considered real-valued functions in this work. Our Proposition 4 shows how we can make a general function $f$ DP with Gaussian process, and Corollary 2 is a special case where the function is in an RKHS. Since the parameters $\\sigma$ and $\\Delta$ in Corollary 2 do not depend on the input dimension (explicitly), we will not suffer from the dimension curse. We believe this is inherited from the nice properties of kernel mean embedding.\n\n> Q5. what is the relationship between the proposed DP and the traditional DP. This problem comes from numerical studies. I am not sure whether it is fair to use the same $\\epsilon$ for different methods with different privacy metrics. Maybe they protect different things.\n\n**Response:** The proposed f-RDP generalizes traditional v-RDP from finite-dimensional vectors to infinite-dimensional functions. Our Section 3 shows that the main properties of f-RDP are the same as v-RDP, and we already know how to convert v-RDP to v-DP. Therefore, the numerical procedure for computing the $\\epsilon$ for f-RDP is the same as traditional DP. In all of our experiments, we  compute and convert the DP guarantee to the same $(\\epsilon,\\delta)$-DP. Thus, we believe the comparison is wrt the same privacy metric, which is fair. Besides, both f-RDP and traditional DP protect the same individual privacy, i.e. the functions or vectors will not change much by changing one point in the dataset. \n\n> Q6. can functional form be generalized to privacy loss random variable accounting\n\n**Response:** If we understand correctly, the privacy loss random variable referred by the reviewer is from Abadi et al.'s work (DP-SGD) and is associated with the Moments Accountant (for traditional v-DP) in the same paper.\n    \nYes. We have already shown that the f-RDP accounting is the same as v-RDP, which can be easily converted to v-DP. Thus, we believe the functional form can be generalized to other DP notions / accountants, including the privacy loss random variable accounting (Moments Accountant)."}, {"review_id": "LOr6QCYdWa", "reviewer": "Reviewer_1DXa", "summary": "Standard differential privacy (v-DP) provides mathematical guarantees on the closeness of distributions of real-valued, randomized functions when they act on adjacent inputs. v-RDP is a variant of the standard DP definition which can be connected back to v-DP guarantees, and can provide tighter v-DP bounds through its analysis. Meanwhile, functional DP (f-DP) extends v-DP to the case where randomized functionals act on adjacent input sets of functions. The current paper considers an RDP variant of f-DP (f-RDP). From the proposed definition of f-RDP, the authors present and prove a number of theorems that mirror the standard toolkit used by practitioners for v-DP and v-RDP, namely (serial and parallel) composition, post-processing, the subsampled Gaussian mechanism, and conversion to f-DP. f-RDP is used to analyze the training of private generative models in several experiments.", "questions": "1. Can the authors quantify the improvement in $\\epsilon$ when using the f-RDP analysis as compared to the preexisting f-DP analysis? For comparison, the motivation to use v-RDP is that it produces tighter guarantees v-DP than have been obtained with v-DP directly.\n\n2. Beyond providing a mathematical guarantee, have the authors considered what characteristics DPGMs will have in comparison to non-private GMs? Do they behave differently in terms of training or sample generation?\n\n3. Related to the previous question, can the authors verify (beyond the mathematical guarantees) that their DPGMs preserve privacy of the training data? For example, around the Figure 1,2 experiments, have the authors considered checking nearest neighbours between the private training data, and the generated samples? The same could be done for generated samples from non-private models. I would expect that models trained with DP guarantees should not memorize and reproduce training set data. Such verification would give more intuitive meaning to the levels of privacy considered in the work ($\\epsilon=0.2, 1.0, 10.0$). An alternate test would be to perform membership inference attacks.\n\n4. L286 and L292 mention standard deviations of results, but the method of obtaining these statistics is not mentioned. Can the authors include explanations of where the statistics come from? E.g. are models retrained from scratch with different randomness? How many times? Can error bars be included for the main results tables (Table 1 and Table 3 in the appendix)? Specifically for the Accuracy measure where 5 classifiers were trained, why are error bars withheld?\n\nThe chosen evaluation metrics have significant flaws and limitations. I encourage the authors to put more thought into the metrics they choose:\n\n5. FID - Concerns around FID have been widely raised in the DGM literature, but the authors make no mention of this. The authors state FID is a measure of generation fidelity which is only partly true, as FID also measures diversity and these two factors cannot be disentangled. Can the authors comment on why they believe FID is a sufficient measure, or provide alternative evaluations? Note that using a measure \"because it is the standard\" may not be a good reason if that measure has significant flaws.\n\n6. Accuracy of a classifier trained on generated samples and evaluated on real samples - This is not a typical measure, as it would only seem to measure if generation has picked up on class-conditional information. It seems to have been used in [3], but this is not mentioned in the main text (only the appendix). Additionally, having to train a model (actually five!) on a generated dataset just to get an evaluation seems like an expensive procedure, and one that introduces additional randomness (on top of the randomness in generating a dataset for evaluation). Imagine trying to use this measure for validation during training! At the very least, the authors must explain what this metric is measuring and why they believe this to be a useful measure for their task.\n\nMinor:\n\nL2 and L21 refer to RDP as a \"recent\" development. While recency is always relative, work from 2017 does not seem very recent with the fast pace of development in ML.\n\nThe proof of Theorem 4 follows the proof of Theorem 2. However, Theorem 4's proof lacks the same detail as Theorem 2's. Can the authors either provide additional steps for Theorem 4, or make a reference back to Theorem 2? The reader who only looks at Theorem 4 may feel there is insufficient detail.\n\nA bit more exposition on the experimental details in the main text would be good to contextualize the results, for instance what kind of NN architectures are used, and are these similar across training methods for fair comparisons?\n\nThere are some grammatical errors that do not detract from the clarity of the work (non-exhaustive list):\n\nL2 becomes -> has become\n\nL18 becomes -> has become\n\nL226 pluggin -> plugging\n\nL230 Wlog - this abbreviation is somewhat unprofessional.", "limitations": "The consideration of broader impacts in Appendix E seems like an afterthought. I encourage the authors to put more thought into this section. The paper focuses on the theoretical, and utility aspects of DP, but does not mention that private training can have negative effects other than reducing utility. For instance, it is well-known that DP-SGD usually exacerbates the biases in models making them more unfair [A][B][C]. How does training with the loss functions in Section 4 compared to DP-SGD in terms of fairness? This is an important \"broader impact\" of research into private model training.\n\n[A] Bagdasaryan et al. 'Differential privacy has disparate impact on model accuracy' NeurIPS 2019\n\n[B] Xu et al. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent' ACM SIGKDD 2021\n\n[C] Esipova et al. 'Disparate impact in differential privacy from gradient misalignment' ICLR 2023\n\n----\nSummary of Discussion: I have read all reviews and rebuttals for this submission.\n\nThe authors have responded to each of my concerns. The only outstanding piece was around the evaluation metrics chosen by the authors, which they admitted had flaws. Due to the format of NeurIPS reviews (no updated manuscript) I can't fully review the changes they intend to make.", "rating": 7, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "Thank you to the authors for sharing their interesting research! This work contains both theoretical results, proving several useful theorems following from the definition of f-RDP, and experimental work training generative models with privacy guarantees. The theoretical work appears to be correct, and I have read over (but not verified in a detailed manner) the proofs given in the appendix. The experimental results show improvement in image quality at strong levels of privacy ($\\epsilon=0.2$) on three common datasets.\n\nOriginality: The application of functional DP to generative modelling is relevant and timely.\n\nQuality: The analysis appears to be correct, the usual toolkit of theorems used by DP practitioners is filled out, and at least some of the results are non-trivial to obtain. Experiments and code are provided.\n\nClarity: The format and flow of the paper are generally good. Proofs are reasonably detailed.\n\nSignificance: The possibility of useful generative models trained at privacy levels as strong as $\\epsilon=0.2$ is very promising.", "weaknesses": "Originality: The paper combines two known concepts - RDP, and f-DP. The main theoretical results play out exactly as one would expect - the authors do not go beyond the standard toolkit to explore any new properties of their definition.\n\nQuality: Quantitative results are given as single numbers in Table 1 and 3 - there is no quantification of statistical uncertainty. Please see questions below for more suggestions to improve quality.\n\nClarity: The paper assumes a high level of background mathematical knowledge which may not be accessible to the ML community, and does not include pedagogical expanations. Example topics that are not explained in detail, or for which intuition is not provided: functionals, Borel sets from measure theory, cylinder sets, reproducing kernel Hilbert spaces, Gaussian processes. The lack of explanation and intuition will limit the readership of this work.\n\nSignificance: Only a few examples of the usefulness of differentially private functionals are given (L29-31). The applications of f-RDP seem limited in comparison to v-RDP. Only relatively small and easy datasets are used in the experiments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Due to the length limit, we will simplify the reviewer's question when we quote.\n> Q1. Originality: The paper combines RDP and f-DP, and does not explore any new properties of proposed f-RDP.\n\n**Response:** We believe that we have developed the necessary tools for the practical use of f-RDP, and we demonstrate its value through a GM example (where the current tools are sufficient). We hope that the f-RDP toolkit in this work will encourage and facilitate more practitioners to exercise functional f-RDP in real applications, and we certainly look forward to exploring more properties in future work.\n\n> Q2. Quality: There is no error bar in Table 1 and 3; L286 and L292 mention std of results, can the authors include explanations of the statistics? E.g. are models retrained from scratch? Can error bars be included in the tables ?\n\n**Response:** The model is not repetitively trained. Once the model is trained, we randomly generate samples 5 times and run the classification accordingly, then we can compute the mean and std of Acc. Note that we do not know the comparison to baselines, as they generally do not report the error bars in their tables. Nevertheless, we will include our std in our tables. \n\nWe also tried retraining the model from scratch on MNIST, and run the same classification tasks 5 times, where both mean and variance are very similar to what we reported in Table 1. For example, when $\\epsilon=1,0.2$, our Acc are $93.2\\pm0.6$ and $91.8\\pm0.5$, respectively.\n\n> Q3. Clarity: The paper assumes a high level of background knowledge.\n\n**Response:** We will add more explanations and pointers in our revision to make it more reader-friendly.\n\n> Q4. Significance: Only a few examples of functional DP are given (L29-31). The applications of f-RDP seem limited in comparison to v-RDP. Only relatively small and easy datasets are used in the experiments.\n\n**Response:** There were a few more examples of f-DP, but comparatively, yes, there are more v-DP papers than f-DP, partly because v-RDP/v-DP are sufficient for many purposes and partly because of the technical requirements and the lack of functional DP tools. We believe the f-RDP mechanism provides more flexibility (see our joint response to CQ1) and we hope that our work would help other practitioners to adopt f-RDP in more applications.\n\nAs for the datasets, both MNISTs and CelebA are widely compared image benchmarks in related works, so we feel it is more fair to compare the results using the same datasets. We agree that bigger and more complex datasets are interesting and useful, and we currently leave it for future work.\n\n> Q5. Can the authors quantify the improvement in $\\epsilon$ when using the f-RDP as compared to the preexisting f-DP? For comparison, v-RDP produces tighter v-DP guarantees than obtained with v-DP directly.\n\n**Response:** We have shown that the conversion from f-RDP to f-DP is the same as from v-RDP to v-DP (Proposition 3). Therefore, the improvement in $\\epsilon$ of f-RDP over f-DP is the same as that of v-RDP over v-DP.\n\n> Q6. What characteristics DPGMs will have in comparison to non-private GMs? Do they behave differently?\n\n**Response:** The DPGM is expected to be not too different by changing one point in the training set, so that the individual privacy is preserved. Intuitively, because of the noise perturbation during training, we expect the generation from DPGMs will be less similar to the training set compared to non-private GMs (they are expected to reproduce/memorize fewer training samples than non-private GMs).\n\n> Q7. CQ2.\n\n**Response:** Please see our joint response to CQ2.\n\n> Q8. Concerns around FID have been widely raised in the DGM literature. The authors' statement on FID is only partly true.\n\n**Response:** We do note that FID is a combined measure for fidelity and diversity. We give a concise description due to page limit. We will add more notes on FID in our revision.\n        \nIn spite of its flaw, FID is still one of the most widely used evaluation metrics in image generation tasks, which you can find in both recent non-private and private GM papers. We understand that FID is flawed, but we fear that it will raise more questions if we fail to include FID in our comparison.\n\n> Q10. The authors must explain what Acc is measuring and why they believe this is a useful measure for their task.\n\n**Response:** Classification accuracy is actually used by all DPGM works, as a quantification of model utility. It is measured by training a classifier on 60k generated samples, then we test the classifier on the real test set. It simulates the scenario of how a generative model can be used: generating synthetic samples for downstream ML tasks, which is one of the main motivations for developing DPGMs.\n\n> Q11. Minor comments:\n> + Q11.1. RDP is not 'recent'. \n\n**Response:** We will modify our term.\n\n> + Q11.2. Theorem 4's proof lacks details. \n\n**Response:** We will include more details in it.\n\n> + Q11.3. Need more details on the experiments, e.g., NN architecture. \n\n**Response:** For the NN architecture, we use the same Conv2dTranpose layer with similar depth as prior related works. Besides, we use the same architecture for both gray-scale and RGB image sets to demonstrate its versatility (of course with different NN parameters to account for the difference in input channels). We will add more details about our experiments in our revision.\n\n> + Q11.4. There are some grammatical errors.\n\n**Response:** We will proofread it again carefully.\n\n> Q12. The paper does not mention that private training can have fairness issues [A][B][C]. This is an important \"broader impact\".\n\n**Response:** Thanks for your suggestion. We agree this is a very important and interesting direction. We did not explore this point in the current experiments as there are no sensitive attributes involved, but we can imagine the potential negative effects if our methods are not used properly. We will include this discussion in our broader impact.\n\n"}]

Author rebuttal:
We thank all reviewers for their insightful reviews. There is a doubt on the value of the proposed functional-RDP, especially in the DPGM application, e.g., why we need functional-RDP and why it is better than v-DP in this application. Besides, reviewer 1DXa raised a practical and interesting question: the different behaviors between DPGM and non-private GM in terms of generation. Therefore, we give a global response as follows for all reviewers' benefit:

> CQ1 (by reviewer iWpL). The authors provide empirical demonstrations of the applications of functional RDP by applying it to privatize the Maximum Mean Discrepancy (MMD), a crucial component in DP generative model training. In their approach, they choose to privatize the kernel function $k(\cdot,\cdot)$ applied to the private dataset, resulting in a finite (and even one-dimensional) output space for the function. Given that the output space is finite, the authors could use the classic Gaussian mechanism directly to publish the loss function. In this context, the connection with functional RDP is not apparent.

**Joint response:** If we understand correctly, the reviewer is saying that our $\widetilde{f_D}$ is evaluated at finitely many points (including both real and generated data), then recalling equation (8) in our paper, we are effectively releasing a finite vector $[\widetilde{f_D}(x_1), \ldots, \widetilde{f_D}(x_N), \widetilde{f_D}(w_1(\theta)), \ldots, \widetilde{f_D}(w_M(\theta))]$. Therefore, we can apply the classic Gaussian mechanism (we suppose the reviewer refers to the method in DP-MERF) to this vector. However, while the (private) training data is fixed (if we treat $N$ as its size), the generated data $w(\theta)$ will increase with training iterations (and is not determined _a priori_; it changes with the model parameter $\theta$), i.e., its size is $tM$ where $t$ denotes the number of iterations and $M$ is the number of generated samples in each iteration, which could effectively lead to a large sensitivity due to a large $t$ and is likely to degrade the model utility. Certainly, we can pre-set an upper bound for $tM$ (the total number of generated samples), but it may restrict the generalizability of the model  and we still would not know the values of generated data beforehand (and hence would have to guard against the worst-case in calculating the sensitivity).

Alternatively, we can consider a more flexible approach via releasing the function $\widetilde{f_D}$ with DP guarantees since a function can be evaluated at arbitrarily many points. To do so, we need a functional DP mechanism, which is what we propose in this paper, i.e., we apply functional RDP to the function $\widetilde{f_D}$ by adding a sample path of a Gaussian process, which does not depend on the number of generated samples anymore.

> CQ2 (by reviewer 1DXa). Can the authors verify (beyond the mathematical guarantees) that their DPGMs preserve privacy of the training data? For example, around the Figure 1,2 experiments, have the authors considered checking nearest neighbours between the private training data, and the generated samples? The same could be done for generated samples from non-private models. I would expect that models trained with DP guarantees should not memorize and reproduce training set data. Such verification would give more intuitive meaning to the levels of privacy considered in the work ($\epsilon=0.2,1.0,10$).

**Joint response:** Thanks for your constructive suggestion! We agree that it would be more practical and intuitive to investigate the behavior of GM with or without DP guarantees. To the best of our knowledge, no prior DPGM work has done anything similar. Nevertheless, we tried generating samples under different DP guarantees and checked their nearest neighbors in the training set (measured by L2 distance). We include the visual comparisons in the attached PDF. It is clear that the non-private GM reproduces more training samples than its private counterparts. Under weak DP guarantee ($\epsilon=10$), though the DPGM somehow still reproduces some of the training samples, we can already see more difference, e.g., in digits 3 and 4. Under the strong DP guarantee ($\epsilon=0.2$), it generates more differently compared to the non-private GM, e.g., in digits 2 to 9.



Meta-review: Most reviewers praised the contribution of introducing a functional version of RDP with applications to generative modeling for being interesting and timely. They also liked the solid theory and convincing experiments. One reviewer had some concerns, some of which addressed by the author response leading that reviewer to increase his/her score. In the end, all reviewers support acceptance, and this is also my recommendation.
Decision: Accept (poster)