Differentially Private Statistical Inference through $\beta$-Divergence One Posterior Sampling
Authors: Jack Jewson
Sahra Ghalebikesabi
Christopher C. Holmes
Venue: NeurIPS 2023 poster (2023)
Keywords: differential privacy
beta-divergence
posterior sampling
generalised Bayesian inference
TL;DR: We propose a method for unbiased differentially private parameter estimation that samples from a generalised Bayesian posterior targeting the minimisation of the $\beta$-divergence between the model and the data generating process.

Abstract: Differential privacy guarantees allow the results of a statistical analysis involving sensitive data to be released without compromising the privacy of any individual taking part. Achieving such guarantees generally requires the injection of noise, either directly into parameter estimates or into the estimation process. 
Instead of artificially introducing perturbations, 
sampling from Bayesian posterior distributions has been shown to be a special case of the exponential mechanism, producing consistent,
and efficient private estimates without altering the data generative process. The application of current approaches has, however, been limited by their strong bounding assumptions which do not hold for basic models, such as simple linear regressors.
To ameliorate this, we propose $\beta$D-Bayes, a posterior sampling  scheme from a generalised posterior targeting the minimisation of the $\beta$-divergence between the model and the data generating process. This provides private estimation that is generally applicable without requiring changes to the underlying model and consistently learns the data generating parameter. 
We show that $\beta$D-Bayes produces more precise inference estimation for the same privacy guarantees, and further facilitates differentially private estimation of complex classifiers, and continuous regression models such as neural networks, which goes beyond what has been currently possible with private posterior sampling.

Differentially Private Statistical Inference through 3- One Posterior Sampling
Jack Jewson"
Sahra Ghalebikesabi Department of Statistics University of Oxford Oxford, UK
Department of Economics and Business Universitat Pompeu Fabra
Barcelona, Spain jack. jewson@upf...mm edu
sahra sahra.ghaleete ghwlebikesabi wewieeesaaaiuiii...eeeea @univ. ox. ac
Chris Holmes
The Alan Turing Institute
Department of Statistics University of Oxford Oxford, UK
chris. hot.esshtlmeesstttt...m ac
Abstract
Differential privacy guarantees allow the results of a statistical analysis involving sensitive data be released without compromising the privacy of any individual taking part. Achieving such guarantees generally requires the injection of noise, either directly into parameter estimates of artificially introducing perturbations, sampling from Bayesian posterior dis- tributions has been shown be a special case of the exponential mechanism, producing consistent, and efficient private estimates without altering the data gen- erative process. The application of current approaches has, however, been limited by their strong bounding assumptions which do not hold for basic models, such as simple linear regressors. ameliorate this, we propose 3D-Bayes, a posterior sampling scheme from generalised posterior targeting the minimisation of the 3-divergence between the model and the data generating process. This provides private estimation that is generally applicable without requiring changes the underlying model and consistently learns the data generating parameter. We show that 3D-Bayes produces more precise inference estimation for the same privacy guarantees, and further facilitates differentially private estimation via posterior sampling for complex classifiers and continuous regression models such neural networks for the first time.
the estimation process. Instead
Introduction
Statistical and machine learning analyses are increasingly being done with sensitive information, such as personal user preferences [49], electronic health care records [72], defence and national security data [27]. It thus becomes more and more important to ensure that data-centric algorithms do not leak information about their training data. Let D (D {ur, ) E denote sensitive data set with dimensional features X, E X Rdd and labels yı C y C R. Here,
considering inference problems where trusted data holder releases model parameters Ø(D) E O, that describe the relationship between X and based on an arbitrary likelihood model f(: 0). Differential privacy
'Joint first authorship. Order decided based on coin flip.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

(DP) provides a popular framework to quantify the extent to which releasing ((D) compromises the privacy of any single observation D; {ye Xi) D.
Definition 1 (Differential Privacy, [26]). Let D and D' be any two neighbouring data sets differing in at most one feature label pair. A randomised parameter estimator O(D) is (e, d) -iifferrentill private for 0 and E [0, 1] for all A S G. P(O(D) E A) S exp(C) A) + 6.
The privacy guarantee is controlled by the privacy budget 8), While bounds the log-likelihood ratio of the estimator (DD for any two neighbouring data sets D and D', 5 is the probability of outputs violating this bound and is thus typically chosen smaller than 1/n to prevent data leakage. DP estimation requires the parameter estimate to be random even after conditioning on the observed data. Thus, noise must be introduced into the learning or release procedure of deterministic empirical risk minimisers to provide DP guarantees.
The sensitivity method [26] is a popular privatisation technique in DP where the functional that depends on the sensitive data (i.e. a sufficient statistic, loss objective or gradient) is perturbed with noise that scales with the functional's ' sensitivity. The sensitivity (h)) of functional h DD IR is the maximum difference between the values of the function on any pair of neighboring data sets D and D', S(h) = maxD, D' I)((D)- h(D))ll- As the bound of statistical functionals given arbitrary data sets is typically unknown, their sensitivity is determined by assuming bounded input features [18] or parameter spaces [81]. In practise, noise is added either directly to the estimate e or the empirical loss function, skewing the interpretation of the released statistical estimates ways that cannot be explained by probabilistic modelling assumptions. In differentially private stochastic gradient descent (DPSGD; 1]. for example, the sensitivity of the mini-batch gradient in each update step is bounded by clipping the gradients of single batch observations before averaging. The averaged mini-batch gradient is then perturbed with noise that scales inversely with the gradients' clipping norm. The repercussions of so doing can be detrimental. The effects of statistical bias within DP estimation have been subject to recent scrutiny, and bias mitigation approaches have been proposed [31].
An alternative to the sensitivity method, is one- peee-potteroo sampling [OPS: 81]. Instead of artificially introducing noise that biases the learning procedure, OPS takes advantage of the inherent uncertainty
provided by sampling from Bayesian posterior distributions [81, 66, 30, 85, 21, 22, 86). Given prior x (0) and likelihood f(D; 0), the random OPS estimate corresponds to single sample from the Bayesian posterior π D) I(D; ()).).) If one accepts the Bayesian inference paradigm, then a probabilistic interpretation of the data generative distribution can be leveraged to sample interpretable DP parameter estimates. Additionally, Bayesian maximum-a cattuuum---sttriorri estimates are generally associated with regularised maximum likelihood estimates, and OPS has been shown to consistently learn the data generating parameter [81]. Therefore, OPS provides compelling method for DP estimation independently of the analyst's 's perspective on the Bayesian paradigm. Current approaches to OPS, however, only provide DP under unrealistic conditions where the log- likelihooood is bounded [81] or unbounded but Lipschitz and convex [66] limiting their implementation beyond logistic regression models see Table 1.
In this paper, we extend the applicability of OPS to more general prediction tasks, making it a useful alternative to the sensitivity method. To do so, we combine the ability of OPS to produce consistent estimates with a robustified general Bayesian posterior aimed at minimising the 3-divergence [9] between the model f(D;; and the data generating process. We henceforth refer to this privacy mechanism as 3D-Bayes. While previous research has studied the benefits of the 3-divergence for learning model parameters that are robust to outliers and model misspecification [32, 34, 45, 48, 46), we leverage its beneficial properties for DP parameter estimation: A feature of the 3BD-Bayes posterior is that it naturally provides pseudo-log likelihood with bounded sensitivity for popular classification and regression models without having to modify the underlying model f(: 0). Further, such a bound is often independent of the predictive model, which allows, for instance, the privatisation of neural networks without an analysis of their sensitivity or perturbation of gradients.
Contributions. Our contributions can thus be summarised as follows:
By combining OPS with the intrinsically bounded f-divergence, we propose (D-Baayes DP mechanism that applies to general class of inference models.
3D- -ayes bounds the sensitivity of learning procedure without changing the model, getting rid of the need to assume bounded feature spaces or clipping statistical functionals. the model is correctly specified, the data generating parameter can be learned consistently.

---

DD-Bayes improves the efficiency of OPS leading to improved precision for DP logistic regression.
The general applicability of BD-Bayes facilitates OPS estimation for complex models such as Bayesian neural network (BNN) classification and regression models.
We provide extensive empirical evidence by reporting the performance of our model and four relevant baselines on ten different data sets, for two different tasks; additionally analysing their sensitivity in the number of samples and the available privacy budget.
2 Background and related work
Here, we focus on the OPS literature that analyses the inherent privacy of perfect sampling from Bayesian posterior [21. 81, 27, 66, 30). Such DP mechanism is theoretically appealing as it does not violate generative modelling assumptions. Current approaches have, however, been limited in their application due to strong likelihood restrictions. We start by outlining the weaknesses of traditional DP methods and the state-of-the- for OPS, before we introduce ,31>-Bayes OPS.
OPS is distinct from other work on DP Bayesian inference that can be categorised as either analysing the DP release of posterior samples using variational inference [40, 44, 71], or Monte Carlo procedures [81, 60, 37, 83, 29, 73, 85]. We show that these methods can be extended to approximately sample from 3D-Bayes in Section 4.
DP via the sensitivity method According to the exponential mechanism [63], sampling @ with probability proportional to exp(-c((D, (opo-cc(D,))((25(() (2)((()))) for loss function e D θ R is (c, O)DP. A particularly widely used instance is the sensitivity method [26] which adds Laplace noise with scale calibrated by the sensitivity of the estimator: For example, consider empirical risk minimisation for a p dimensional parameter 0 E θ C RP:
((D) arg min
Σ ((;,f(;0)) AR(0)
den
n i=1
where E(D;, (() is the loss function, R(()) is regulariser, and À > 0 is the regularisation weight. Chaudhuri et al. [18] show that 0 - O(D) + z, RD 9 =
~ L (0, ) where L(p,8) 8) is a Laplace distribution with density f(=) 2g exp(-1=- /l/s). is O)-DP provided R(-) is differentiable and I-strongly convex, and E(y;, -) is convex and differentiable with gradient (e, < 1. The negative log- lggliike of logistic regression with a L.2 regulariser satisfies these conditions when the features are standardised between and 1- see Section A.4.1 for more details. Relaxing the conditions of convexity, DPSGD [1], which adds calibrated noise to gradient evaluations within stochastic gradient descent, has arisen as general purpose tool for empirical risk minimisation [62, 20]. To achieve bounded sensitivity, DPSGD clips each single gradient within the update step. Instead of bounding the sensitivity artificially by assuming bounded feature spaces or clipping data functions, Dwork and Lei [25] identified the promise of robust methods for uP-estimation. Robust estimation procedures [c.g 41, 35] provide parameter estimates that are less sensitive to any one observation and therefore the scale of the noise that needs be added to privatise such estimate is reduced. While the connection between robust statistical estimators and DP has thus been subject to extensive research [5, 6, 25, 77, 22, 55, 17, 57, 58), sampling to produce a generally applicable method for consistent estimation of model parameters.
iid
the first to consider it within Bayesian
DP via Gibbs one-posterior sampling Sampling from a Bayesian posterior constitutes a particular case of the exponential mechanism [81, 21, 22, 86]. leading to the proposal of OPS through Gibbs posterior sampling. the log-lib likelieeloood log (D::) is such that sup e llo (DD; 0) S B, then one sample from the Gibbs posterior
π w log 1 (0) x T (0) exp w Σ log f ((D:
with w == 1B (c, DD- [81]. Note w recovers the standard posterior and w * provides flexibility to adapt the posterior to the level of privacy required. However, standard models for inference do not usually have bounded ligelikelssoods. Even discrete models with bounded support such as logistic regression do not. To overcome this, Wang et al. [81] assume a bounded parameter space and accordingly 'scale-down' the data. However, parameter spaces are typically unbounded, and data scaling has to be done carefully to avoid information leakage or loss inefficiency. Nevertheless,
3

---

Table 1: Requirements of different DP estimation techniques; sorted in decreasing strength of the
restrictions imposed on the likelihood.
Unbounded
Likelihood
Prior
Unbiased+ Consistent
Features
Restriction
Restriction
Foulds et al. [27]
X
exponential Tamily +
conjugate
0
V
bounded sufficient statistics
Bernstein Shel-
X
exponential family +
conjugate
don [12, 13]
bounded sufficient statistics
Minami et al. [66]
X
convex + Lipschitz
strongly convex
>>
0
log-density bounded log-density
Wang et al. [81]
X
proper
0
Chaudhuri [18]
X
convex log-density
strongly convex
0
Abadi et al. [1]
bounded gradients
none
>
X
1b-Baaes
bounded density
proper
0
their algorithm is shown to outperform the perturbation approach proposed by [18]. Some works [21, 22, 86] overcome the assumption of bounded logllikelihood by relaxing the definition of DP allowing distant observations according to some metric be distinguishable with greater probability. Such relaxation, however, no longer guarantees individual privacy. Geumlek et al. [30] consider versions of the Gibbs posterior for exponential family models and generalised linear models but the context of Rényi-DP (RDP) [68], relaxation of DP that bounds the Rényi divergence with parameter a between the posterior when changing one observation. Minami et al. [66] generalise the result of
Wang et al. [81] to show that one sample from (2) with w = Z y m, /(((/111 + 2 1og(1/6) for convex L-Lipschitz log- likelhhokiso with m, -troongy convex regulariser (c, 8)DD.. For logistic regression, we have L = 2/d if the features are bounded between 0 and 1. This, however, requires a relaxation to > 0.
Sufficient statistics perturbation Foulds et al. [27] identified that OPS mechanisms based on the Gibbs posterior are data inefficient in terms of asymptotic relative efficiency. For exponential family models, Foulds et al. [27] and Zheng [87] propose a Laplace mechanism that perturbs the data's sufficient statistics and considers conjugate posterior updating according the perturbed sufficient statistics. The privatisation of the statistics allows for the whole posterior to be released rather than just one sample, and the perturbation of the statistics is independent of n allowing the amount of noise to become smaller relative to the sufficient statistics as + oo providing consistent inference. They compare directly to [81] showing improved inference for exponential family models. However, these results require bounded sufficient statistics. Extensions include [12, 13, 67, 40, 71, 51]. These methods are further limited to exponential families which do not include popular machine learning models e.g. logistic regression or neural networks. In this paper, we set out to generalise the applicability of OPS and also address its efficiency issues by moving away from the Gibbs posterior, making use of tools used within generalised Bayesian updating.
DD-ayees one-posterior sampling
Generalised Bayesian Updating and the Divergiveeee OPS has struggled as a general purpose tool for DP estimation as bounding the sensitivity of log [x; 0) is difficult. Motivated by model misspecification, Bissiri et al. [15] showed that the posterior update
Σ EaDintton) ..
n (0)D) x (0)) exp
exp
(3)
assigning high posterior density to parameters that achieved small loss on the data, provides coherent means to update prior beliefs about parameter of == arg mingge I E(D, 0)) (D)dz
after observing data D g()). The Gibbs posterior in (2) is recovered using the weighted neg-
ative log- likelihooh E(D, f(: = - log (D: 6), and the standard posterior for w 1. This demonstrates that Bayesian inference learns about glog := arg mingee log (D) arg mingge KLD(gIIS(s 0)) [11, 80].
The framework of [15] provides the flexibility to choose loss function with bounded sensitivity.
An alternative, loss function that continues to depend on 0 through the likelihood f(:00 is the

---

3-divergence loss [9] for 3 >> 1
B / (DD
(D. = 8- - 0) 8-1
[(D;
(4)
so called as arg ming D (D) f(::0)] = arg ming D (gllf(:: 8)) where D (g If) is the 3-divergence defined in Section A. The first term in (4) contains the negative likelihood, therefore parameters that make the data likely achieve low loss. However, it is raised to the power 3 1 >> 1 prescribing relatively smaller loss to observations unlikely under that parameter than the log-
likelihood. A key feature of (4) is that while lim - log f = xo, limy- fo
8-T = 0 for 3 > 1. The second integral term only depends on the parameters and ensures the 3D loss can learn the data generating parameters. Setting 3 1 recovers the negative log-likeli logliikeiihood. We refer to updating using (3) and loss (4) as 3D- ID-Bayes. Note that this update is general, and can be applied for any choice of prior (0), and density/mass function f (y: 9). Using (4) for inference was first proposed by Basu et al. [9] and extended by Ghosh and Basu [32] to the Bayesian paradigm. Because of its favourable robustness properties, the 8-divergence has since been deployed for a variety of examples within modern statistical inference [e.g. 47, 34, 48, 33, 79] and deep learning [e.g. 3, 36, 2, 19, 48).
A particularly convenient feature of inference based on divergences is that they are uniquely minimised to 0 when f = g. Therefore, if there exists 0g such that g = f(= 0o). i.e. the model is correctly specified for 9. then arg mingee D (l.f)) the 3D-BBays posterior will learn about the same parameter as the Gibbs posterior (2). Further, the general Bernstein- von---oo-sssss theorem for generalised posteriors [Theorem 4; 65] can be applied to the 3D-Bayes posterior (see Theorem 3) to show that x (()) D) is asymptotically Gaussian and - oc. This proves useful when establishing consistency and asymptotic efficiency, see Section A.2. When the model is misspecified,
f)) arg mingee (LD
= 8.. and
concentrates around 0g arg mingge 1.S1) (g()))((:;0)
Le. there exists no Ou such that g(-) f(: 0)). then 06%h) * arg mingee KLD(o()) ()) and the 3D-Bayes posterior learns a different parameter to the standard posterior. However, several works have argued that it provides more desirable inference [32, 34, 47, 48] and decision decision-making [45] under model misspecification, and stability [46] to the specification of the model. We now show that we can leverage the favourable robustness properties of 3D-BBayes to obtain general-use DP OPS estimates.
DP cnee-osterior-sampplee
Rather than bounding log ((; we replace it in (3) with the 3D loss from (4) which is naturally bounded when the density is bounded.
Condition (Boundedness of the model density/mass function). The model density or mass function f(; is such that there exists 0 < M < such that f(;;0) S M, V0 E A.
Lemma 1 (Bounded sensitivity of the 3D-Bayes loss). Under Condition 1 the sensitivity of the DD-BByes-loss// for any 3 > (D,
g( (D', < M
B-I-
Bounding f rather than its logarithm is considerably more straightforward: discrete likelihoods are always bounded by I, while continuous likelihoods can be guaranteed to be bounded under mild assumptions. We will see in Example that such a bound can be provided in a Gaussian regression model by truncating the support of the variance parameter 0² from below. Under Condition 1, Theorem proves (c. DDP of 3D-Bayes OPS. Theorem 2 establishes the consistency of 3D-Bayes OPS and Proposition establishes its efficiency, based on the definitions given by [81, 27]. Condition 3, stated fully in Section A.2 requires that the 3D-Bayes loss can be approximated by a quadratic form and requires that as n grows the 3D-Bayes loss uniquely minimied.
Theorem (Differential privacy of the 3D-BBays posterior). Under Condition 1, draw 0 from the BD-Bayes posterior n (00) D)) in (3) is (2
0-1 -)dfffferettially private.
Theorem 2 (Consistency of 31D-Bayes sampling). Under Condition 3, stated in Section A.2,
1. posterior sample â ~ ((8) (0) is consistent estimator of 0g
2. if data Di...., Dr g(-) were generated such that there exists 0g with g(D) f(D;Bo), then 0 ~ n. (18) for all 1 < B < oc is consistent for Og-
5

---

Bule posterict 0.1)
HDD Buyes (2 1.35)
60
mL
Figure 1: Left: Comparison of fly = 1; 0) x posteriors achieving DP with c= with the standard logistic function for binary classification with m(X,8) 8) X0. The f associated with the 3D- BD-Bayes posterior is closer to that of the Bayes posterior for any m(X: 0) than that of the Gibbs posterior for the same privacy level. Right: Comparison of fly; 0) for the Gibbs posterior and the 3D-Bayes posterior for Gaussian regression with the standard log-likelihood. The 3D-Baaes posterior allows for DP estimation while the Gibbs posterior does not as any choice for w > 0 fails bound the loss sensitivity.
f(y=1111
for the Gibbs and BD-Bayes
Proposition 1 (Asymptotic efficiency). Under Condition 3, stated in Section A.2, O ~ x((2) (0|D)
is asymptotically distributed as vn(0 ) weakly No0, (H6 K6 (H) 1 + (H6 )-1)
where K8 and Hg are the gradient cross-product and Hessian matrices for the 3D loss and are defined in (5) and (6).
OPS for classification and regression Note, unlike other methods, this DP guarantee does not require bounding features or response. We consider two explicit examples.
Example 1 (Binary classification). Consider a classifier for y E {0, 1} taking the logistic value of arbitrary function m X x θ + R. ply = 1; X, 0) 1/ (1 + exp (-m X, 0))), depending on predictors X E X and parameters 0 E O. Clearly, S f(y 1; x) S 1 independently of the functional form of m(X,0), f). which guarantees 13-1). 0)-DP of the BDD-Bayes OPS.
Taking m(X,0)= x recovers logistic regression. Both the output perturbation of [18] and the Gibbs posterior (2) taking the Gibbs weight of [66] can also provide DP estimation for logistic regression. We show in Section that 3D-Bayes provides superior inference to these methods for the same privacy budget. Figure 1 (left) compares the standard Bayesian posterior for logistic regression with the Gibbs posterior (w = 0.09) and the 3D>-Bayes posterior (3 = 1.33); both methods achieve DP estimation with e = 6. The y-axis is [ = 1; X,0) ε exp(E(y = 1; X, 0)}, the term that multiplies the prior in the updates (2) and (3). The figure shows that for the same privacy, the 3D-Bayes update more closely resembles the standard Bayesian update allowing 3D-Bayes OPS to produce more precise inference. Unlike [18] and [66], 33D-Bayes also does not require bounding the features to guarantee DP.
Modern machine learning, however, often requires non- lineli models, and 3D-Bayes allows DP estimation for these as well. For example, we can choose m X, 0) = NN(X, 0) where NN is a neural network parameterised by 0. See [70] for more details on Bayesian inference for neural networks. Unlike logistic regression, the log-likelihood of neural network classifier is not convex and therefore the methods of [18] and [66] cannot be applied. This necessitates the application of DPSGD [1] which adds noise to minibatch gradient evaluations in SGD and clips the gradients at some value artificially bound their sensitivity-see [84] for a Bayesian extension. In contrast, 3D-Bayes gets rid of the need to bound the neural network's 's sensitivity. It further allows for DP estimation beyond classification.
Example 2 (Gaussian regression). Consider a Gaussian model f(y; X,0,),0,0))= = (y; my: 0), o2) regressing univariate y E R.. on predictors X X using any mean function X' θ RR and parameter 0 E θ where 0² > 0 is the residual variance. Provided there exists a lower bound 0 $2 < 0², then 0 < fly; X, 8, o²) < 1/ (1/ 2 independent of m(X. 8). 3D-Bayes OPS for such model is O)P with 2/ - ()(v)) 2ms) (3-1)).
Ensuring Condition for a Gaussian likelihood model requires that the support of the variance parameter is bounded away from O. Such bound is not limiting. For example, the standard conjugate

---

ewverse-gamma prior puts vanishing prior density towards O, and in situations where a natural lower bound is not available, adding independent and identically distributed zero-mean Gaussian noise with variance 5² to the observed responses y ensures this bound without changing the mean estimation.
standard linear regression. This is an exponential family model with conjugate prior, and DP estimation can be done using e.g. [13, 12]. They, however, require artificial bounds on the feature and response spaces. Again, the 3D-Bayes estimation also holds for more complex mean functions such as neural networks see [48] for 3D-Bayes neural network regression. Figure 1 (right) illustrates how 3D-Bayes bounds the sensitivity for Gaussian regression models while the Gibbs posterior cannot. The log- oilliiklidood of the Gaussian distribution is unbounded and while multiplying this with w < 1 reduces the slope. this does not change its bound. The DD-Bayes, on the other hand, provides a bounded loss function.
One popular choice for the mean function is m(X, X 0) = =XTO corresponding
Extending the privacy beyond one-posterior sampling
While OPS has been shown to provide DP guarantees for perfect samples, the OPS posterior is typically not available in closed form and as a result, some approximate sampling methods such as Markov Chain Monte Carlo (MCMC) are required. Note that this is not only a limitation of OPS, but sampling from the intractable exponential mechanism [63, 75] in general. Proposition 2 taken from [66] investigates the DP properties of the approximation.
T(0 D) is (c, 8)-DP and for all D there Proposition 2 (Proposition 12 of [66]). If sampling from π exists approximate sampling procedure pf()) with J () (D) s 7 then sampling from (0) is (c, DDD with 8 = 5 + (1 + )-
Proposition 2 establishes that if the MCMC chain has converged to the target distribution i.e. Y z then the DP of the exact posterior is shared by the approximate sampling. Proposition 3 of [81] is the same result for 5 = 0. For the sufficiently well-behaved Gibbs posteriors (i.e. with Lipschitz convex loss function and strongly convex regulariser), Minami et al. [66] provide an analytic stepsize and number of iterations, N, that guarantees an (unadjusted) Langevin Monte-Carle Markov Chain is within y of the target. While the Gibbs posterior for logistic regression satisfies these conditions, the Gibbs posterior for more general tasks and the 3D-Bayes loss will in general not be convex.
Previous contributions [81, 66, 29] have assumed that the MCMC kernel has converged. Seeman et al. [75] observed that if the MCMC algorithm is geometrically ergodic achieving 8' smaller than order 1/n and preventing data leakage requires the chain to be run for at least order N = log(n)) iterations. For our experiments we used the No-U-tumn Sampler [NUTS; 38] version of Hamiltonian Monte Carlo [HMC; 24] implemented in the stan probabilistic programming language [16]. The geometric ergodicity of HMC was established in [59] and stan provides a series of warnings that indicate when the chain does not demonstrate geometric ergodicity [14]. Running stan for sufficiently many iterations to not receive any warnings provides reasonable confidence of a negligible 8'. As an alternative to measuring convergence, we below review approximate DP sampling approaches where 3D-Bayes can be applied to guarantee bounded density. We hope that the emergence 3D-Bayes, as general purpose OPS method to provide consistent DP estimation, motivates further research into private sampling methods for OPS.
DP MCMC methods Alternatively to attempting to release one sample from the exact posterior, much work has focused on extending OPS to release a Markov chain that approximates the Gibbs posterior, incurring per iteration privacy costs. Examples include the privatisation of Stochastic Gradient Langevin Dynamics [SGLD; 82, 81], the penalty algorithm [83], Hamiltonian Monte Carlo [DP-HMC 73]. Baker's 's acceptance test [37, 8, 76], and rejection sampling [7]. Similar to DPSGD, these algorithms all rely on either subsampled estimates of the model's log-likelihood or its gradient to introduce the required noise and run the chain until the privacy budget has been used up. Just like the Gibbs posterior (2), the 3D-Bayes posterior posterior-using (4) and (3)-also contains a sum of loss terms that can be estimated via subsampling, making the 3D-Bayes similarly amenable. What is more, many of these algorithms previously listed [85, 83, 37, 73, 81, 56, 84) require the boundedness of the sensitivity of the log- lieeiiol,,,,d, or its derivatíve. Proposition 3 shows that under Condition I which ensures that 3D-Bayes OPS is DP, or for gradient based samplers Condition 2, many of these DP samplers can be used to sample from the 3D- 3D-Bayes posterior without compromising DP.
7

---

Condition 2 (Boundedness of the model density/mass function gradient). The model density or mass function f(::0) ([:0) is such that there exists 0 < G( < oc such that (Df(D: x f(D:0)8- 8-2 G(O), 40 O.
Proposition 3 (DP-MCMC methods for the 8D-Bayes- SD-Bayes-Posterior, Under Condition 1, the penalty algorithm [Algorithm 1; 83 DP-HMC [Algorithm 1; 73] and DP-Fast MH [Algorithm 2: 85] and under Condition 2 DP-SGID [Algorithm I; 56) can produce (e, 5)DD estimation from the 3D-Bayes posterior with 8 > 0 without requiring clipping.
Perfect sampling An alternative approach is seek to modify MCMC chains to allow for exact samples from the posterior. Seeman et al. [75] privatise the perfect sampling algorithm of [54), which introduces an 'artificial atom' into the support of the target and uses augmented MCMC kemel to move between the atom and the rest of the support. While we believe these approaches to be very promising and in principle trivially applicable to 3D-Bayes OPS, Lee et al. [54] find considerable instability to choices for the underlying MCMC chain, and therefore more investigation is required.
Attacking one-posterior samples In order to quantify the data Icakage from approximate sampling schemes, we run the strongest privacy attacks for DP auditing, namely membership inference attacks (MIA). In MIA, an adversary tries to predict whether an observation was part of the training data set or not. This attack corresponds directly to the DP guarantee presented in Definition 1: Given any two neighbouring data sets, D and D', an attacker should not be able to confidently predict which data set was used in training if they observe the final statistical estimate 0. Indeed, Jagielski et al, [43] have shown that the false positive and false negative rates of MIA attacks can be used to audit the DP of an algorithm directly. In the pursuit of tight auditing of DP algorithms, Nasr et al. [69] have proposed worst-case attacks where [D] + | are chosen maximise attack performance. These attacks are beneficial to uncover whether an algorithm violates its promised DP guarantees as published works have repeatedly been shown suffer from faulty implementations or mistakes in proving DP [69, 78]. We are the first to consider such attacks for OPS.
For number of rounds, we 1) generate two neighbouring data sets, D and D', 2) sample (05) 3) if m 1 return ((D)) or if m 0 return 0( (D), and then 4) predict given Remark 1 which data set 0 was trained on. Without loss of generality, we assume m 1. We follow [74] in defining the objective of the MIA attack M(0. D, D') := p(m = 1;0, D. D'), i.c the probability that f was trained on D' after observing 0, D, and D'.
Remark 1.
Let p(0 D) be the density of the privacy mechanism-i.e i.e the Laplace density for [18] p( D')
or the posterior (i.e. (2) or (3)) for OPS. An attacker estimating M(0 D, D') (p (')
is Bayes optimal. For OPS, M(0 D, D') = exp(E(D); (()0)) - ((D;; [}} exp(e(Di; (:; 0))
E(Di; (() where D, D' s.t. D D' [Di} and D' \ D {Di} (see Appendix A.5).
5 Experimental results
Appendix B contains additional experimental details and results. Our code can be found at https:
// //ggttuu..cc. htt.ib..oomm///ii//// hwan///ggaleebieebbbbbeeeee wateeeaabbbbettbbababaee bayes- ops.
Data sets The evaluations are conducted on simulated and UCI [23] data sets. For the former, we generate d- d-dimensional features from multivariate normal distribution with the identity matrix as covariance matrix, sample the model parameters from a normal distribution with mean 0 and standard deviation 3 (i.e. a d dimensional vector for the logistic regression), and simulate the label according to the assumed likelihood model. For the latter, we have included the two classification data sets that were previously analysed in other applications of OPS (adult and abalone) [66, 81], in addition to other popular UCI data sets. We report the test performance on random test splits that constitute 10% of the original data. We further scale the features in all data sets to lie within 0 and 1. This a requirement for the methods proposed by [81, 66, 18], whereas 3D-Bayes guarantees DP for unbounded data.
Logistic regression Figure 2 compares 3D-Bayes, Chaudhuri et al. [18] and Minami et al. [66] (with 10-5). Note that [18] still presents a widely-used implementation of DP logistic regression [39]. We consider two implementations of [18]: one where X = 1/(9n) in (1) decreases in the
8

---

log RMSE( )
2.0
E-002
2.0
E-0.5
2.0
E=
E-5.0
1.0
0.0
1.0
500
1000
500 adult
1000
500
1000
500 vertebral
1000
abalone
bank
AUC 1 (E-5,0) AUC 1 (E-0.5)
0.8
1.0
0.8
0.8
0.8
0.6
0.6
0.6
0.4
0.4
0.8
0.8
0.8
0.6
0.6
0.4
# observations
BD-Bayes
Chaudburi et [19] 1/9n)
Chaudhuri al. [19] 1/9)
Minami [65]
Figure 2: Parameter log RMSE and test-set ROC-AUC of DP estimation for logistic regression as the
number of observations n increases. We have upper bounded the axis of the log RMSE (0), as [18]
performs poorly when the regularisation term decreases in n.
E-0.2
g=0.5
E=1.0
0.5
E=S.0
1.0
log RMSE
1.0
0.2
0.5
0.0
0.0
0.0
0.0
0
500
1000
0
500
1000
500
1000
0
500
1000
boston
kin8mm
naval
wine
3.0
0.0
1.0
-2.
0.0
-2.0
550
3.0
0.0
0.0
0.5
-20
-1.0
2.0
-2.0
.4.0
-0.5
10
50
200
10
50
200
1000
10
50
200
1000
10
50
200
1000
observations
BDD-Bayes
DPSGD
Figure 3: Test set predictive log RMSE of DP estimation for neural network regression as the number of observations n increases on simulated and UCI data. See Appendix Figure for a comparison of each method with its private counterpart.
number of samples, consistent with the Bayesian paradigm the effect of the regulariser diminishes as n + co and corresponds to Gaussian prior with variance 3, and another where À 1/9 is fixed see A.4.1 for further discussion. The first leads to unbiased but inconsistent DP-inference while the second consistent at the cost of also being biased. We report the RMSE between the estimated parameter ((D) and the true data generating parameter on the simulated data sets, and the ROC-AUC on UCI data. For compairson of each method with its non-private equivalent, please see Figure 6 in the appendix. We also introduce a new metric, termed correct sign accuracy that computes the proportion of coefficients that are 'correctly' estimated. Please refer to Figures 7 and in the appendix.
In simulations, we observe that increases, BD- 3D-Bayes achieves the smallest RMSE, illustrating the increased efficiency we argued
Section 3. The extent to which 3D-Bayes dominates greater for large e. The ROC-AUC curves show that this better estimation of parameters generally corresponds to greater ROC-AUC. For the UCI data we see that for increasing n 33D-Bayes outperforms the other methods and Figure 6 shows it achieves performance that is very close to the unprivatised analogue.

---

Neural network regression Figure 3 compares 6D-Bayes and DPSGD [1] (with à d 10 for training a one-layer neural network with 10 hidden units. The learning rate, number of iterations, and clipping norm for DPSGD were chosen using validation splits to maximise its performance. For small n the DPSGD is preferable in both simulations and the UCI data, but as the number of observations increases, the test set predictive RMSE of (3D-Bayes outperforms that of DPSGD. Note that DPSGD is currently the best- best-performing optimiser for DP neural network training [20]. It privatises each gradient step, guaranteeing privacy for each parameter update, while 3D-Bayes only guarantees DP for a perfect sample from the Bayesian posterior. DPSGD thus provides stronger privacy guarantees, and is more computationally efficient MCMC scales poorly to high-dimensional feature spaces. We hyperparameter tune the number of epochs, learning rate, and batch size of DP-SGD on a validation data set and use the same parameters on SGD for a fair comparison. Thus, the performance of SGD could be improved by a different choice of hyperparameters.
Membership inference attacks We implement the Bayes optimal attacker for the case of logistic regression. As the solution of the logistic regression is not defined when only
BD-Bayes
Chsuchuri al. [19]
observations from single class are present, we choose D
log RMSE
Chauchuri al. [19] 1/9)
Minami et [65]
{(1, 1), (0. 0)} and D' {(),, (0, 0)} to achieve optimal
22
attack results. Figure 4 compares the attack success rate with the log RMSE achieved on simulated data (n 1000, = 2). As increases, the attack success rate of all methods increases and their RMSE decreases, except [18] with A = 1/9 whose RMSE does not decrease because of bias. Fixing the attack success rates, 3D-Bayes generally achieves the lowest RMSE. Importantly, 9D-Bayes is more efficient than [18] for the same attack success rate, where [18] has exact DP guarantees.
0.6 0.8 attack success rate
Figure 4: MIA attack success rates against log RMSE. Points corre- spond to values of
6 Discussion
We showed that BD-Bayes OPS produces consistent parameter estimates that are (c. O)-DP provided that the model's density mass function f(: was bounded from above. BD-BBayes OPS improved the precision of DP inference for logistic regression and extends to more complex models, such as neural network classification and regression. Such extensions facilitate DP estimation for semi- parametric models where consistent inference for a linear predictor is required, but a complex model used capture the remaining variation [50]. Extensions of this work could consider dividing the privacy budget to release more than one sample paving the way for parameter inference as well as estimation. Bayesian inference with different divergences or discrepancies becoming increasingly popular [28, 42, 4, 61]. and their suitability for DP estimation could be investigated following our example and results. Further, the BD-loss applicable beyond Bayesian methods, could also be used in place of clipping gradients in algorithms such as DP-SGD [1].
The main limitation of OPS methods is that they prove DP for sample from the exact posterior which is never tractable. Instead, MCMC samples approximate samples from the exact posterior and convergence of the MCMC sampler must be ensured to avoid leaking further privacy. Future work should investigate whether convergence guarantees are possible for 33D-Bayes, taking advantage of its natural boundedness, and consider which of the DP-MCMC methods introduced in Section 4 makes best use of the privacy budget to sample a chain from @D-Bayes. A further limitation of OPS is the computational burden required to produce posterior samples, particularly in larger neural networks with many parameters. Such a cost and is mitigated by the fact that inference can only be run once to avoid leaking privacy and that only one posterior sample is required. But further research is required to tackle these computational challenges, including scaling MCMC to large neural networks or developing DP variational inference approaches [40, 44, 71] for the -ayess posterior. We hope that the existence of a general general-purposs purpose method for DP estimates through Bayesian sampling with improved performance can stimulate further research in these directions.
Acknowledgements
thank you to Anna Menacher, Dan Moss and the anonymous reviewers for valuable comments on earlier drafts of the paper. JJ was funded by Juan de la Cierva Formación fellowship FJC2020- 046348-I. SG was a PhD student of the EPSRC CDT in Modern Statistics and Statistical Machine Learning (5P/)023151/I), and also received funding from the Oxford Radcliffe Scholarship and
10

---

Novartis. CH was supported by The Alan Turing Institute, Health Data Research UK the Medical Research Council UK, the EPSRC through the Bayes4Health programme Grant EP/R018561/1, and AT for Science and Government UK Research and Innovation (UKRI).
References
[1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the ACM conference on computer and communications security, pages 308-318, 2016.
ACM SIGSAC
[2] Haleh Akrami, Wenhui Cui, Anand A Joshi, and Richard M. Leahy. Learning from imperfect training data using a robust loss function: application to brain image segmentation, 2022.
[3] Haleh Akrami, Anand A Joshi, Jian Li, Sergül Aydöre, and Richard M Leahy. A robust variational autoencoder using beta divergence. Knowledge- Based Systems, 238: 207:107886, 2022.
[4] Matias Altamirano, François-Xavier Briol, and Jeremias Knoblauch. Robust and scalable Bayesian online changepoint detection. arXiv preprint wxXiv:2302.04755 2023.
[5] Marco Avella-Medina. The role of robust statistics in private data analysis. Chance, 33(4): 37-42, 2020.
[6] Marco Avella-Medina. Privacy-preserving parametric inference: a case for robust statistics. Journal of the American Statistical Association, 1166534))999-883,, 2021.
[7] Jordan Awan and Vinayak Rao. Privacy-aware rejection sampling. Journal of Machine Learning Research, 24(74):1-32, 2023.
[8] Anthony Alfred Barker. Monte Carlo calculations of the radial distribution functions for a proton? electron plasma. Australian Journal of Physics, 18(2):119-134, 1965.
[9] Ayanendranath Basu, Ian R Harris, Nils L Hjort, and MC Jones. Robust and efficient estimation by minimising a density power divergence. Biometrika, 85(3):549 -599, 1998.
[10] Ayanendranath Basu, Hiroyuki Shioya, and Chanseok Park. Statistical inference: the minimum distance approach. CRC Press, 2011.
[11] Robert H Berk al. Limiting behavior of posterior distributions when the model is incorrect. The Annals of Mathematical Statistics, 37(1):51-58, 1966.
[12] Garrett Bernstein and Daniel R Sheldon. Differentially private Bayesian inference for exponen- tial families. Advances in Neural Information Processing Systems, 31, 2018.
[13] Garrett Bernstein and Daniel R Sheldon. Differentially private Bayesian linear regression. Advances in Neural Information Processing Systems, 32, 2019.
[14] Michael Betancourt. A conceptual introduction to hamiltonian Monte Carlo. arXiv preprint arXiv:1701.02434 2017.
[15] PG Bissiri, CC Holmes, and Stephen Walker. A general framework for updating belief distributions. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 2016.
[16] Bob Carpenter, Andrew Gelman, Matt Hoffman, Daniel Lee, Ben Goodrich, Michael Betan- court, Michael A Brubaker, Jiqiang Guo, Peter Li, and Allen Riddell. Stan: A probabilistic programming language. Journal of Statistical Software, 20, 2016.
[17] Kamalika Chaudhuri and Daniel Hsu. Convergence rates for differentially private statistical es- timation. In Proceedings of the... International Conference on Machine Learning. International Conference Muchine Learning, volume 2012, page 1327. NIH Public Access, 2012.
[18] Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
[19] Wenhui Cui, Haleh Akrami, Anand A Joshi, and Richard M Leahy. Semi-supervised learning using robust loss. arXiv preprint ar arX1v:2203.01524 2022.

---

[20] Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlock- ing high-accuracy differentialyy private image classification through scale, arXiv preprint arXiv:2204. 13650, 2022.
[21] Christos Dimitrakakis, Blaine Nelson, Aikaterini Mitrokotsa, and Benjamin IP Rubinstein. Robust and private Bayesian inference. In Algorithmic Learning Theory: 25th International Conference, ALT 2014, Bled, Slovenia, October 8-10, 2014, Proceedings 25, pages 291-305. Springer, 2014.
[22] Christos Dimitrakakis, Blaine Nelson, Zuhe Zhang, Aikaterini Mitrokotsa, and Benjamin IP Rubinstein. Differential privacy for Bayesian inference through posterior sampling. The Journal of Machine Learning Research, 18(1):333331,, 2017.
[23] Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. URL http://///rr ics.uci. edu/ml.
[24] Simon Duane, Anthony Kennedy, Brian Pendleton, and Duncan Roweth. Hybrid Monte Carlo. Physics Letters B, 195(2):216-223 1987.
[25] Cynthia Dwork and Jing Lei. Differential privacy and robust statistics. In Proceedings of the forty-first annual ACM symposium on Theory of computing, pages 371-380, 2009.
[26] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pages 265-284. Springer, 2006.
[27] James Foulds, Joseph Geumlek, Max Welling, and Kamalika Chaudhuri. On the theory and practice of privacy-preserve Bayesian data analysis. arXiv preprint arXiv:1603. 0660007994, 2016.
[28] Hironori Fujisawa and Shinto Eguchi. Robust parameter estimation with a small bias against heavy contamination. Journal of Multivariate Analysis, 99(9):2053-208) 2008.
[29] Arun Ganesh and Kunal Talwar. Faster differentially private samplers via rényi divergence analysis of discretized Langevin MCMC. Advances in Neural Information Processing Systems, 33:7222-7233, 2020.
[30] Joseph Geumlek, Shuang Song, and Kamalika Chaudhuri. Renyi differential privacy mecha- nisms for posterior sampling. Advances in Neural Information Processing Systems, 30, 2017.
[31] Sahra Ghalebikesabi, Harry Wilde, Jack Jewson, Arnad Doucet, Sebastian Vollmer, and Chris Holmes. Mitigating statistical bias within differentially private synthetic data, In Uncertainty in Artificial Intelligence, pages 696-705. PMLR, 2022.
[32] Abhik Ghosh and Ayanendranath Basu. Robust Bayes estimation using the density power divergence. Annals of the Institute of Statistical Mathematics, 68(2):413-43) 2016.
[33] Paolo Girardi, Luca Greco, Valentina Mameli, Monica Musio, Walter Racugno, Erlis Ruli, and Laura Ventura. Robust inference for non-linear regression models from the tsallis score: Application to coronavirus disease 2019 contagion in italy. Stat, 9(1):330, 2020.
[34] Federica Giummolè, Valentina Mameli, Erlis Ruli, and Laura Ventura. Objective Bayesian inference with proper scoring rules. Test, 28(3):728-777 755, 2019.
[35] Frank R Hampel, Elvezio M Ronchetti, Peter J Rousseeuw, and Werner A Stahel. Robust statistics: the approach based influence functions, volume 1 14.. John Wiley & Sons, 201
[36] S Harini, K Nivedha, Selva Keerthana BG, R Gokul, BS Jayasree, et al. Data anomaly detection in wireless sensor networks using B- v-rariational autoencoder. In 2023 International Conference on Intelligent Systems for Communication, loT and Security (ICISCoIS), pages 631-636. IEEF, 2023.
[37] Mikko Heikkilä, Joonas Jälkö, Onur Dikmen, and Antti Honkela. Differentially private Markov chain Monte Carlo. Advances in Neural Information Processing Systems, 32, 2019.
[38] Mathew D Hoffman and Andrew Gelman. The No-U-Turn sampler: adaptively setting path lengths Hamiltonian Monte Carlo. Journal of Machine Learning Research, 15(1):1593-15 2014.
12

---

[39] Naoise Holohan. Stefano Braghin, Pó1 Mac Aonghusa, and Killian Levacher. Diffprivlib: the ibm differential privacy library. arXiv preprint arXiv:1907.0244 02444, 2019.
[40] Antti Honkela, Mrinal Das, Arttu Nieminen, Onur Dikmen, and Samuel Kaski. Efficient differentially private learning improves drug sensitivity prediction. Biology direct, 13:1-12, 2018.
[41] Peter J Huber and EM Ronchetti. Robust statisties, series in probability and mathematical statistics, 1981.
[42] Aapo Hyvärinen. Estimation of non-normalized statistical models by score matching. Journal of Machine Learning Research, 6(Apr):695-709, 2005.
[43] Matthew Jagielski, Jonathan Ullman, and Alina Oprea. Auditing differentially private machine learning: How private is private sgd? Advances Neural Information Processing Systems, 33: 22205-22211 2020.
[44] Joonas Jälkö, Onur Dikmen, and Antti Honkela. Differentially private variational inference for non-conjugate models. arXiv preprint arXiv:1610.0874, 2016.
[45] Jack Jewson, Jim Smith, and Chris Holmes. Principles of Bayesian inference using general divergence criteria. Entropy, 20(6):442, 2018.
[46] Jack Jewson, Jim Q Smith, and Chris Holmes. On the stability of general Bayesian inference. arXiv preprint (xXv:22311.3301, 2023.
[47] Jeremias Knoblauch, Jack Jewson, and Theodoros Damoulas. Doubly robust Bayesian inference for non-stationary streaming data using 3-divergences. In Advances in Neural Information Processing Systems (NeurIPS), pages 64-75, 2018.
[48] Jeremias Knoblauch, Jack Jewson, and Theodoros Damoulas. An optimization-centric view on Bayes' rule: Reviewing and generalizing variational inference. Journal of Machine Learning Research, 23(132):1-10% 2022.
[49] Hyeyoung Ko, Suyeon Lee, Yoonseo Park, and Anna Choi. A survey of recommendation systems: recommendation models, techniques, and application fields. Electronics, 11(1):141, 2022.
[50] Michael Kosorok. Introduction to empirical processes and semipurametric inference. Springer, 2008.
[51] Tejas Kulkarni, Joonas Jälkö, Antti Koskela, Samuel Kaski, and Antti Honkela. Differentially private Bayesian inference for generalized linear models. In International Conference on Machine Learning, pages 5838-5849. PMLR, 2021.
[52] Solomon Kullback and Richard A Leibler. On information and sufficiency. The annals of mathematical statistics, 22(1):79-86, 1951.
[53] Sebastian Kurtek and Karthik Bharath. Bayesian sensitivity analysis with the fisher-rai metric. Biometrika, 102(3):601-616, 2015.
[54] Anthony Lee, Arnaud Doucet, and Krzysztof Latuszyúski. Perfect simulation using atomic regeneration with application to sequential Monte Carlo. arXiv preprint arXiv: 1407.5770 2014.
[55] Jing Lei. Differentially private m-estimators. Advances in Neural Information Processing Systems, 24, 2011.
[56] Bai Li, Changyou Chen, Hao Liu, and Lawrence Carin. On connecting stochastic gradient MCMC and differential privacy. In The 22nd International Conference on Artificial Intelligence and Statistics, pages 557-566. PMLR, 2019.
[57] Mengehu Li, Thomas B Berrett, and Yi Yu. On robustness and local differential privacy. arXiv preprint arXiv:2201.0073 2022.
[58] Mengchu Li, Thomas Berrett, and Yi Yu. On robustness and local differential privacy. The Annals of Statistics, 51(2)777 2023.
13

---

[59] Samuel Livingstone, Michael Betancourt, Simon Byrne, and Mark Girolami. On the geometric ergodicity of hamiltonian Monte Carlo. 2019.
[60] Lauri Lode et al. Sub-sampled and differentially private hamiltonian Monte Carlo. 2019.
[61] Takuo Matsubara, Jeremias Knoblauch, François- Xavier Briol, Chris Oates, al. Robust generalised Bayesian inference for intractable likelihoods. arXiv preprint arXiv:2104.07339,
2021.
[62] H Brendan McMahan, Galen Andrew, Ulfar Erlingsson, Steve Chien, Ilya Mironov, Nicolas Papernot, and Peter Kairouz. A general approach to adding differential privacy iterative training procedures. arXiv preprint arXiv: /8/..0/8/00062// 2018 8.
[63] Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS pages 94-103. IEEE, 2007.
[64] Minami Mihoko and Shinto Eguchi. Robust blind source separation by beta divergence. Neural computation, 1859-18888888 2002.
[65] Jeffrey W Miller. Asymptotic normality, concentration, and coverage of generalized posteriors. The Journal of Machine Learning Research, 22(1):7598-7655) 2021.
[66] Kentaro Minami, HItomi Arai, Issei Sato, and Hiroshi Nakagawa. Differential privacy without sensitivity. Advances in Neural Information Processing Systems, 29, 2016.
[67] Darakhshan J Mir. Differential privacy: an exploration the privacy-utiling landscape. Rutgers The State University of New Jersey, School of Graduate Studies, 2013.
[68] lya Mironov, Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263 263-275. IEEE, 2017.
[69] Milad Nasr, Shuang Songi, Abhradeep Thakurta, Nicolas Papernot, and Nicholas Carlin. Ad- versary instantiation: Lower bounds for differentially private machine learning, In 2021 IEEE Symposium on security and privacy (SP), pages 866-882. IEEE, 2021.
[70] Radford M Neal. Bayesian learning for neural networks, volume 118. Springer Science & Business Media, 2012.
[71] Mijung Park, James Foulds, Kamalika Chaudhuri, and Max Welling. VariationalBayes in private settings (vips). Journal of Artificial Intelligence Research, 68:109-157, 2020.
[72] Melanie F Pradier, Niranjani Prasad, Paidamoyo Chapfuwa. Sahra Ghalebikesabi, Max Ilse, Steven Woodhouse, Rebecca Elyanow, Javier Zazo, Javier Gonzalez. Julia Greissl, et al. Airiva: A deep generative model of adaptive immune repertoires. arXiv preprint 2304: 2023.
[73] Ossi Räisä, Antti Koskela, and Antti Honkela. Differentially private hamiltonian Monte Carlo. arXiv preprint arXiv:2106.09377 2021.
[74] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. White-box vs black-box: Bayes optimal strategies for membership inference. In International Conference on Machine Learning, pages 5558-5567. PMLR, 2019.
[75] Jeremy Seeman, Matthew Reimherr, and Aleksandra Slavković. Exact privacy guarantees for Markov chain implementations of the exponential mechanism with artificial atoms. Advances in Neural Information Processing Systems, 34:13 13155-133336, 2021.
[76] Daniel Seita, Xinlei Pan, Haoyu Chen, and John Canny. An efficient minibatch acceptance test for Ceeropolis-Hastingg In Proceedings of the 27th International Joint Conference on Artificial Intelligence, pages 5359-5363, 2018.
[77] Adam Smith. Privacy-preserving statistical estimation with optimal convergence rates. In Proceedings of the forty-third annual ACM symposium Theory of computing, pages 813-822, 2011.
[78] Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data-anonymisation groundhog day. In s/ USENIX Security Symposium (USENIX Security 22), pages 1451-1468, 2022.
14

---

[79] Shonosuke Sugasawa. Robust empirical Bayes small area estimation with density power divergence. Biometrika, 107(2)467-480, 2020.
[80] Stephen G Walker. Bayesian inference with misspecified models. Journal of Statistical Planning and Inference, 143(10):1621-1633 2013.
[81] Yu-Xiang Wang, Stephen Fienberg, and Alex Smola. Privacy for free: Posterior sampling and stochastic gradient Monte Carlo. In International Conference on Machine Learning, pages 2493 2502. PMLR, 2015.
[82] Max Welling and Yee W Teh. Bayesian learning via stochastic gradient Langevin dynamics. In Proceedings of the 28th international conference on machine learning (ICML-11), pages 681-688, 2011.
[83] Sinan Yıldımm and Beyza Ermiş. Exact MCMC with differentially private moves: revisiting the penalty algorithm in a data privacy framework. Statistics and Computing, 29:947-9900 963, 2019.
[84] Qiyiwen Zhang, Zhiqi Bu, Kan Chen, and Qi Long. Differentially private Bayesian neural networks on accuracy, privacy and reliability. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2022, Grenoble, France, September 19-23, 2022, Proceedings, Purt IV, pages 604-619 Springer, 2023.
[85] Wanrong Zhang and Ruqi Zhang. DP-Fast MH: Private, fast, and accurate Messonolis-Haating for lcrge-scale Bayesian inference. arXiv preprint arXiv:2303.06171, 2023.
[86] Zuhe Zhang, Benjamin Rubinstein, and Christos Dimitrakakis. On the differential privacy of Bayesian inference. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 30, 2016.
[87] Shijie Zheng. The differential privacy of Bayesian inference. PhD thesis, Harvard University, 2015.
15

---

Appendix A
Definitions, proofs, and related work
Here, we provide missing definitions of the Kullback-Leible divergence (KLD) and the 3-divergence (8D).
Definition 2 Kaulback-Leiblee divergence [52]). The KLD between probability densities g(-) and f(+) given by
KLD(glIf) / g(z) log
g(z) ((z)
dx.
Definition (3-divergence 19, 64]), The 3D is defined as
(ollf) B(B - 1) ((x)) dx
B 8-1 3 f(z))dx dr
1
1 / ((x))(x))
where B R {0, 13. When 3 L, D (g(=)]lf())) + KLD(g(=))lf()))
The B-divergence has often been referred as the density-power divergence in the statistics literature [9] where it is also parameterised with 3DPD = 3 1.
Intuition for how 3D-Bayes provides DP estimation is provided in Figure 5 which shows the influence of adding an observation y at distance Jy |4| from the posterior mean when updating using Gaussian distribution under KI.D-Bayes and 38D-Bayes. Here, influence is defined by [53] as the Fisher-Rao divergence between the posterior with or without that observation and can be easily estimated using an MCMC sample from the posterior without the observation. The influence of observations under KLD-Bayes is steadily increasing, making the posterior sensitive to extreme observations and therefore leaking their information. Under 3D-Bayes, the influence initially increases before being maximised at point depending on the value of 3, before decreasing to O. Therefore, each observation has bounded influence on the posterior, allowing for DP estimation.
0.8
KLD-
KLD-Bayes Bayes (3 = 1)
BD- Bayes (3 1.05)
0.6
BD- Bayes (0 (0=1.1)
Influence
BD- Bayes (3 = 1.25)
0.4
((, 1)
0.2
0.0
0
2
4
6
8
Figure 5: The influence of adding observation distance ly 14| from the posterior mean μ the posterior conditioned on a sample of 1000 points from a (0, 1) when fitting N NNu,, o²).
A.1 Notation
Before proving the paper's results, we first define all notation used.
For likelihood (;; f). prior x (0) and data D {D.) from data generating process g. the posterior, Gibbs posterior parameters by w > and 3D-Baaes posterior for 3 > are given by
D) & (0) F(D;;))
n log (0)D) x (() exp
f(D;:0)
n (0)) (0 x (()) exp
((0) ((.)
16

---

where
((D:)) - 3 / f(D:0/.D.
( f(:0)) = 8-
The population loss minimising parameters are
/
o
arg min 0
log (DD))) arg min min KID(g)l(((()) 0E0
/
00
arg min
(D:)(())))) arg min D (=)l((:0))
Ac
Iee
and their sample estimates
n
arg min IEO
log (D:;;))
@
arg min
(Di,
ME
the model is well specified for the data generating process then we write g(-) f(;:0)) and 8g = arg mingge KLD(gl) f(; = arg mingee D ())))()))))
Lastly, our asymptotic results require the definitions of the Hessian and gradient cross-product matrices
1
(10)
f(: (1:))
00,00,
n
is
16
p())
ED
(D, (D. 06 }0]
(5)
00,003
is
K6
i
ED
(10) [ol0)
(D:
))}
Ep
(00) (D; f(:300
))] is
(6)
00,
00,
A.2 Bernstein-von Mises theorem for 3D-Bayes
The general Bernstein-von Mises theorem for generalised posteriors [Theorem 4; 65] can be applied to the 3D- 3D-Bayes posterior. We first state the required Condition 3 before stating the result.
Condition 3 (Assumptions of Theorem 4 of [65] for the 3D-Bayes). Fix 0g E R and let prior (0)
continuous at of with T (66 > 0. Let ((8) TRP + with f( (0) = Em (10) (Di,
for E N and assume:
(1) (0) can represented as
f| f(,: = ((3)
10-- 00 T (0 (0-)(())
((0 +
g0((0)
where go E IP and 05
+ 00000 with " + Hb for positive definite H!" and
rh TRP - R has the following property: there exist ca. > such that for all
sufficiently large, for all Beo (0), we have (x(()(x)) S colx/
(x)]
(2) For any 0, lim inf, inf (o (F (110) / (0x00) where (x {1r
RD: f -x- -e--rpl rol r}
Condition 3 (1) requires that the 3D-Bayes loss can be approximated by a quadratic form and (2) requires that grows the 3D--Bayes loss is uniquely minimied at (g(m)
Theorem (Theorem 4 of [65] for the 3D-Bayes). Assume Condition 3. Define n Then
n (()) D
17

---

(i) The BD-Bayes posterior concentrates on 0,
J J
F ( A (0)d0
where Br(x)) = for E RP: : vol <r}
(ii) The BD-Bayes posterior is asymptotically Gaussian
/ t (6)
(d: (0) NN
(F(6")))1
de
0
(8)
n0+00
NNp p. 2) denotes the p-dimensional multivariate Gaussian distribution with mean vector and covariance matri Σ
where =n denotes the density of /n )2 when θ Th
Proof. The result is proved as a direct application of Theorem of [65] with f.(()
E (1) (D,, f(: being the 3D-Bayes loss function.
Theorem 3 shows that the 3D-Bayes posterior concentrates on 8 and converges to Gaussian distribution centred around the 5D minimising parameter 00(0) in total variation distance.
A.3 Proofs
A.3.1 Proof of Lemma
Lemma 1 (Bounded sensitivity of the 3D-Bayes loss). Under Condition 1 the sensitivity of the 3D- ID-Bayes-loss for any $ is (D, ((: (( f(:0))( ():) -0
Proof. By (4), for
1
(D,
3-1 -100::0)---1((-00))00
max D 3 f(D:0)=-1
M
3-1
A.3.2 Proof of Theorem
Theorem (Differential privacy of the 3D-Bayes posterior). Under Condition 1, draw ê from the BD-Bayes posterior N. (00)( in (3) is ( 22
3-1 -0)-differentially private.
Proof. Define D = (DI..... D.), D' = (D, D', and let j be the index such that D, * D' with D; = D for all * j. Firstly, the normalising constant of the B3D-Bayes posterior combining (3) with (4) is
/ (0)) exp
p(0)
(0) Dz)
d0
(9)
Then,
x ((
n
p(0) (D;, f(:0)) log (())
log
((0) (D), Σ
T (1)))
(()
-=1
(())
=
f(:0)) (D';:;(())
f(: 0)) + log p()
18

---

Now, by Condition and Lemma 1,
- M
e
3-1¹
and
(()) - exp Σ (V) =(0)d0
= { exp (D)) f(:
(18) (D),f(::0) Σ e (D. T
sexp 3 18-1)
(
{ 1
/ exp Σ ((0) (D.. f(::)) =(0)d0,
which combined provides that
T(ID) M
log
D') 3 -1
A.3.3 Proof of Theorem 2
Theorem 2 (Consistency of 33D-Bayes sampling). Under Conditions a posterior sample Ô ~ x (18) (OID) a consistent estimator of 06
2. if data Di...., Dn g(-) were generated such that there exists 0g with g(D) f(D;0u), then i ~ π ((0) ()) all 1 < 3 < oo consistent for Po-
Proof. For Part 1), define B, = {sr ERP
|x -xol= < r). Theorem 3 Part (i) proves that = (0)d0
-
(10)
for all and (.)
(3)) (0 D (Di,... Dn)) This is enough show that for 0
π elo) D) + gg in probability.
For Part 2), note that if g(D) = S(D; 0o), then for all 1 <B<00 <0
05 arg min E, ( (D:
lee
arg min D (8) (gllf(:0)) = 0o- dEN
A.3.4 Proof of Proposition!
Proposition (Asymptotic efficiency). Under Conditions 3, Ø ~ x²1²² (( is asymptotically
distributed as vā(ō - (16")) weakly
(0, (H (H1 )-2 + (H16 ) where K((()) and
11 are the gradient cross cross-product and Hessian matrices for the 3D loss and are defined in (5) and (6).
Proof. Let 0 ~ x (00) (0
D). By Theorm 3 Part (ii),
Vū(ō ggh00) + (O,, )
By the asymptotic normality of g) [10]. we have that
n
V
pla NO0, ( (11)
for
i
(D; 0g })}
@ ED (eLo) f(: 06:00) 111
En
00,
30,
The result then comes from the asymptotic independence of θ -g and 05 [see c.g. 81].
19

---

A.3.5 Proof of Proposition 3
Lemma considers the sensitivity of the 3D-Bayes loss to the change in observation. DP-MCMC methods require the sensitivity to the change in the parameter which is provided by Lemma 2.
Lemma 2 (Bounded parameter sensitivity of the 3D-BBayss loss). Under Condition I the param- eter sensitivity of the 3D-Bayes-loss for any 3 > 1 is (D= - (() s
28-1 M8-1
313 11
Proof.
By (4), for >1
(10) (D, f(: 0)) - (D,
3 ((D:0) 3-1 + 3 f(D:0) dD + 3- ((D:0) 1 3 5(D;0))aD)
S max 8,0'
1 + 3-1 (DD:0)
B
I max 8,8'
B
((D.0)
(D; 3-11
3 - M
M
3 M8-1
23
M-1
B(B 1)
Proposition 3 (DP-MCMC methods for the JDD-Bays-PPosterio)) Under Condition 1, the penalty algorithm [Algorithu 1; 83), DP-HMC [Algorithm 1; 73] and DP-Fast MH [Algorithm 2; 85] and under Condition 2 DP-SGLD [Algorithum 1; 56) can produce (c, 8) estimation from the 3D-Bayes posterior with 8 > 0 without requiring clipping.
Proof. Algorithm of [83] (Assumption A1), Algorithm 1 of [73] and Algorithm 2 of [85] (As- sumptions 1 and 2) require posterior whose log-likelihood has bounded parameter sensitivity. For 3D-Baaes posterior, this requires the 33D- -a-eeyss-ssss have bounded parameter sensitivity which is provided by Condition 1 and Lemma 2.
Algorithm of [56] requires posterior whose log-likelihood has bounded gradient. For 3D-Bayes posterior, this requires 3D-Bayes-loss to have bounded gradient. Assuming we can interchange integration and differentiation, this requires
(3) (D;
(D) x S(D:0)3-2 / To](D:0)xI(T..))))))) 0D
Vos(D: x ((D:0) [o[ ((D
S max G M)
as vof(D:0) x ((D:0) 21 G( by Condition 2.
We show that Condition 2 satisfied for logistic regression.
Example (Satisfying Condition 2 for logistic regression). For Logistic regression introduced in Example
fyy:0,80
(1 + exp( 1)x0))
(2y - 1)X
0, (1 (1+exp(-X0))
f(y: () = + (xxp-((2)) 1)x8))2-8
20

---

and therefore,
(2y 1) + exp(-(2y -
1)X8))
VoJ(u:0,X) f(;:0, xya-2 8-21
100
+ exp( (app--(2)) (2g - 1)
(2y 1)X
(1 + exp( - (2y 1).x0))
Satisfying Condition 2 for logistic regression requires bounding of the features, a similar requirement to the methods of [81, 66, 18].
A.4 Related work
Here, would like extend our discussion of two important areas within the related work.
A.4.1 Differentially private logistic regression
Extensions to Li-sensitivity Our presentation of the object perturbation of Chaudhuri et al. [18] in Section differs slightly from its original presentation. Corollary [18] assumes that IVoe(D;,
< which allows the bounding of the T-2-sensttvvtyy of the empirical risk min- imiser (1). Then adding multivariate Laplace noise z' ~ v(2) & exp(-"%) "= provides DP estimation. For logistic regression, |[VoE(D, f(:
requires that the features X are such that
|||||2 1.
In order provide fairer comparison with [66], who require that VV, (D, f(:00) < ,1
.P. which for logistic regression requires [Xyl < 1 for = 1..... P. add univariate Laplace noise to each parameter estimate requiring us to bound the L2 sensitivity of the empirical risk minimiser (1). This is natural extension of the result of Chaudhuri et al. [18], but for completeness, we provide a proof that the approach presented in Section 2 is O)-P..
Theorem (Modification of Nutput-Pertuuration Chaudhuri et al. [18]). Consider empirical risk minimisation for p dimensional parameter 0 E e S IR:
((D) == arg min
Σ lee nI
1 E(D., f(:0)) AR(O)
where E(D f:; ()) is convex and differentiable loss function with (V ((::)()))) < j, ... R(0) is differentiable and I-strongly convex regulariser, and X the regularisation weight. Then releasing
0= QDD 2, E
idd 0,
2 nde
where C(u,s) s) a Laplace distribution with density f(z)
1 expl -12 wl/s]. is (e, D)-PP 2a
Proof. Fix datasets Dj and D2 [D, \ D&} Dr. Then define
0ş 0(D)) arg min ()(())
Gx(0): 1 Σ ((;)
DED
g(0) = ()) Gz(0) 1 ((Dz. f(:0) (Di,
Lemma 7 of Chaudhuri al. [18] then proves that
1
10: 82112 S
max Vog(f)
x #EB
21

---

Now, as (o,((D()((:0) < <1, = ,.....P .P
1 (o - Vol(Di
[[oo((0]]2
2
5
max
[(:00)
n1
D
2
max D
V, 0, f(::()
2/P
π
The original result of Chaudhuri et al. [18] assumed that Vo [1]2 < 1 and they obtained IIV (0)(()) 2. Instead, we require a weaker element wise bound that (o, [(::0] < 1 and note that n.
2/D 101
2
100 02112 S
82111
À
nd
Therefore by Proposition 1 of [26] we have that 0 = (D) + (z1,...,,zp) 2p) with 2j ~ [0, neX is (P.D)-
Note, I-strong convexity of an L2 type regulariser requires that R(Ø) 1 ンリー OJ. This parametrisation is the default implementation in sklearn.
Consistency Chaudhuri et al. [18] propose a regularised DP logistic regression, solving (1). The optimisation problem in (1) adds the regulariser to the average loss and as result, the impact of the regulariser does not diminish as n + oc. Even though the scale of the Laplace noise decreases as n grows, Chaudhuri et al. [18] consistently estimate a parameter that is not the data generating parameter. Alternatively, one could choose a regulariser X' := A/2 whose influence decreases as n grows. This would allow for unbiased inference as n + oo (assuming a Bayesian model with corresponding prior distribution), but the cancels in the scale of the Laplace noise and therefore the perturbation scale does not decrease in n, and the estimator is inconsistent. Choosing instead X' := A with 0 < r 1, would help in constructing unbiased and consistent estimators. In our experiments, we did not find this choice to help.
A.4.2 Differentially private Monte Carlo methods
Wang et al. [81] propose using Stochastic Gradient Langevin Dynamics [SGLD; 82] with modified burn-in period and bounded step-size provide DP sampling when the log-likelihood has bounded gradient. Li et al. [56] improve upon [81]. taking advantage of the moments accountant [1] to allow for a larger step-size and faster mixing for non-convex target posteriors. Foulds al. [27] extend their privatisation of sufficient statistics to a Gibbs sampling setting where the conditional posterior distribution for a Gibbs update is from the exponential family. Yıldırmm and Ermiş [83] use the penalty algorithm which adds noise to the log of the Metropolis- Hectopolis-Hastinnss acceptance probability. Heikkilä et al. [37] use Barker's acceptance test [8. 76) and provide RDP guarantees. Räisä al. [73] derive DP- DM-HMC also using the penalty algorithm. Zhang and Zhang [85] propose a random batch size implementation of Metropolis- Hastiing for general proposal distribution that takes advantage of the inherent randomness of Metropolis-Hastin and is asymptotically exact. Lastly, Awan and Rao [7] consider DP rejection sampling.
A.5 Attack optimality
Remark 1. Let p(O be the density of the privacy mechanism-ia i. the Laplace density for [18] p( D')
or the posterior (i.e. (2) or (3)) for OPS. An attacker estimating M(0 D') pp(( D'))
is Bayes optimal. For OPS, M(O D, D') = EXp( f(: ((Dr; [epp(((x f(: 0)) E(D;; f(: (O) where D, D' s.t. D D'D'= = (Di} and D' \ (D/} (see Appendix A.5).
The privacy attacks outlined in Section 4 require the calculation of
M,, D') = p(m = 1; D. D') = p(01=>)/(v00
-1/o((1D)//(0)))*
22

---

by Bayes Theorem. For [18),
D(0 = (B(D), 2 nxc)
ndc
where (DD was defined in (I).
For the OPS methods, Minami al. [66] and (3D-Bayes, p(0] the posterior
> (0) x n (0) exp { Σ E
a
=
where for [66] f(;;:(;;;)) = -w log (D;; 0), and for 3D-Bayes f(;;((;0) (tt) f(::8) given in (4). Without loss of generality, index observations within D and D' such that D \ D' {Di and D'
(D/). Then,
x (0]D) T(0) Eh ((;:[(:)0) x² D' [xp) (D; (0) expl E ((;]((;)))
π T0) expl > ((D;:((0))
J (())) exp - (D)
=xp(((D):[(()))) (())(:())))(((:((000))))
exp] Σ ((D ((:))d
=exp((((::(:0)) ((D;0))
/ cxp((((D:0)) [(D::f(:0)
x(0) - (D;:f((; d8
ex()) (D;
=exp((():((=0)) (DD:((;)) [00)(((ii(::)))00::::0::000))
exp(((((:[(:0)) - ((Dis((;0) N
exp exp((tDittt)))))00://
where {0, {0,1)=1 ~ (0) The adversary only needs to sample from the posterior based on dataset D to be able to estimate M(0 D, D') for all D' differing from D in only one index (.
Appendix B Additional experimental details and results
Datasets
Please see the following list for the name of the targets in the prediction tasks of the UCI
data:
abalone ring class (threshold 10)
adult income class
bank authenticity
boston housing prices
kin8mm distance of the end-effector from target
naval - GT Turbine decay state coefficient
wine quality
vertebral disease (normal/abnormal)
We used all remaining features in the data sets as predictors.
Bayesian models In the case logistic regression, we assume normal prior with mean 0 and variance 9 on the regression coefficient. In the case of linear regression, we again assume normal prior with mean 0 and variance o² on the regression coefficient. Further, we assume o² follows an inverse gamma distribution a- a-priori with shape and scale of 1, with lower bound of 0.01. In the case of neural network classification, we assume normal priors with mean 0 and variance on weight and bias parameters of one-hidden-laye of neural network regression, the same assumptions hold and we additionally assume a² follows an inverse gamma distribution a-priori with shape and scale of 1, with a lower bound of 0.01.
neural network with 10 hidden nodes. In the case
23

---

MCMC sampling Unless otherwise specified, we choose d = 2 in the simulated experiments. The MCMC methods are run for 1000 warm-up steps, and 100 iterations. The DP sample is sampled uniformly at random from the last 100 iterations.
Neural network training DPSGD is run for 14+ |c] epochs, with clipping norm 1, batch size 100. and learning rate of 10-2. All other implementation details can be found at https: //gi titbgtthu...... com/ sghalebikesabl /eobbi/bbee bbtpebbtaaaaaeaeeeeee baye--ayesoooo ops. We tuned the learning rate and the batch size on validation data sets when training with DPSGD. We use the same parameters for training with SGD to show how much performance is lost through the privatisation of the training procedure. The rule for the number of epochs was found by tuning the number of epochs for 1 within (5, 10, 15, 20} and trying different parameters for the slope of the linear increase in e ((0.5, 1, 2}) following observations from [20]. The batch size was tuned within {50, 100, 200). the learning rate within {10 10 2, 10 1]. and the clipping norm within 10.8,1,1.2) 1.2].
Additional plots for logistic regression Figure 6 compares the DP method for logistic regression individually with their non-private counterparts. For the 3D-BBayes the non-private estimate was the posterior mean (PM) while for [18] it was the regularised empirical risk minimiser 0( (() without the added noise. As the number of observations n increases the DP-estimates from 3D-Bayes and [18] with À = 1/9 approach the unprivatised estimates. This is not the case for [18] with À = 1/9n.
Figure and consider the correct sign accuracy (CSA) of the DP methods for logistic regression. The CSA is the proportion of the time the DP-parameter estimates from the different methods agree with those of non-private baselines. The plot demonstrates that the estimates from 3D-Bayes OPS agree with the sign of the non- non-private method more of the time than the other methods.
Neural network classification Similarly to neural network regression, we can also use 3D-Bayes for DP neural network classification. For simulated data, Figure 9 shows the for e > 0.2 the BD- Bayes generally achieves higher test set ROC-AUC than DPSGD across all sample sizes. In the real data we see that for 0.5 3D-Bayes and DPSGD perform similarly. on abalone the DPSGD generally achieves higher ROC-AUC whereas on bank the 3D-Bayes generally performs slightly better. However, for == 5, we see that while the DPSGD sometimes achieves higher ROC-AUC when n is small, as n increases the 3D--Bayes achieves the highest ROC-AUC for all datasets, once again illustrating the consistency of our method.
Sensitivity in number of features Figure 10 investigates the quality of the DP estimation methods considered in this paper as the number of features grows. The top panel considers parameter RMSE of the data generating parameter 0 (divided by the number of dimensions of ()) in logistic regression. Here even the non-DP methods increase as the dimension of the parameter space increases as more parameters estimated from the same number of observations. While the J3D-Bayes performs the best, it appears to scale similarly with dimension as [18] and [66]. The middle panel considers test set predictive RMSE in neural network regression. More features provide a more complex model which should decrease RMSE. We see that the 3D-Bayes achieves lower RMSE than DPSGD and 3D-Bayes appears to scale better with dimension as the improvement made by 3D-Bayes improves as the dimension of the feature space increases. The bottom panel considered test set ROC-AUC for neural network classification. Again, more features provide a more complex classifier improving test set ROC-AUC. For e > 0.2 3D-Bayes achieves higher ROC-AUC than DPSGD and the improvement increases with the number of features.
Membership inference attacks For E {0.2, 1, 2, 7, 10, 20}. run 10,000 rounds of the attack presented in Section 4. Figure 11 presents an estimated lower bound on c, given the false positive and negative rates of the attacks [43], for each method with its RMSE for the data generating 6. Note that these lower bounds are unrealistic for < 1. We see that, for any RMSE value, BD-Bayes achieves a lower practical bound on than [18], which gives exact privacy guarantees. For fixed lower bound, we see that 3D-Bayes achieves the smallest RMSE.
Compute While the final experimental results can be run within approximately two hours on a single Intel(R) Xeon(R) Gold 5118 CPU @ 2.30GHz core, the complete compute needed for the final results, debugging runs, and sweeps amounts to around 1l days.
Licenses The UCI data sets are licensed under Creative Commons Attribution 4.0 International
license (CC BY 4.0).
24

---

log RMSEIO
0-0.2
1.5
E-0.5
1.0
E-10
1.0
E-5.0
1.2
0.0
0.5
0.0
-1.0
500 Nabservations
1000
500
1000
500
1000
500
1900
BD BD-Ba
BD Bayes (PM)
abalone
adult
bank
vertebral
AUC 1 (E=5.0) AUC (E-005)
0.8
1.0
0.8
0.8
0.6
0.5
0.6
0.6
0.2
0.8
0.8
1.0
0.9
0.8
0.6
0.6
0.8
0.7
0
2000 1 observations
20000
500
1000
200
9D-Bayes
BD-Bayes (PM)
Jog RMSE())
1.5
E-0.2
2.5
E-0.5
2.5
E-1.0
1.0
E-5.0
0.0
0.0
0.0
0.0
1000
obeetvations
Chaudhurii [19] (A 1/9m)
Log (1)
abalone
vertebral
AUC 1 (E-50) (E-1.))
0.8
1.0
0.8
0.6
0.6
0.6
0.6
0.4
0.8
1.0
0.8
0.8
0.6
0.6
2000 obberrvations
20000
Chandburi at. [19] (A = 1/9n)
LogReg (1)
0.2
5-0
1.0
5.0
log RMSE(())
1.5
1.5
1.4
1.4
1.2
1.2
1.2
1000
observarions
Chaudhuri [19] (A 199)
LogReg (1) 1/9)
ahalone
adult
vertehral
AUC (E-5.0) AUC (E-0.5)
0.8
0.6
0.6
0.6
0.5
0.5
0.9
0.8
0.7
0.4
0.8
0.6
0.3
0.7
2000 obbervvations
20000
500
1000
100
200
Chaodhari al. [19] 1.9)
LogReg (1) 1/9)
Figure 6: Parameter log RMSE and test-set ROC-AUC of DP estimation for logistic regression the number of observations n increases on simulated (first row each method) and UCI data (second and third row of each method). PM stands for posterior mean which was estimated over 20 samples. This is a non non-oonnvee private baseline, i.c. the point estimate you would release if privacy were not an issue.
25

---

E-0.2
0-0
E-1.0
E-5.0
1.0
0.8
0.8
0.5
0.5
500
1000
500 adult
1000
500
1000
0
500
1000
abulone
bank
vertebral
CSA 1 (E-5 () CSA (E-0.5)
1.0
1.0
0.7
0.7
0.6
0.6
0.6
0.5
0.5
0.8
0.8
0.8
0.6
0.5
0.5
2000
20000
500
1000
100
200
# observations
BD-Bayes
Chaudhuri (A 1/9n)
Chaudburi al. [19] 1/9)
Minami [65]
Figure 7: Correct sign accuracy (CSA) for simulated experiments (first row) and UCI data sets
(second and third rows). For CSA, estimate the number of coefficients in the logistic regression that have the same sign as the true coefficient on the simulated experiment or the non-DP coefficient estimated the UCI data set with La-regularised logistic regression implemented with default parameters in Isklearnl.
26

---

0.0.
8=0.5
E=1.0
5.5.0
1.0
1.0
0.8
0.8
0.8
0.8
0.5
1000
1000
500
1000
500
1000
observations
BD-Bayes
BD-Bayes (PM)
abalone
adult
bank
veriebral
CSA 1 (E-5.0) CSA 1 (E=0.5)
1.0
1.0
1.0
0.8
0.8
0.8
0.8
0.6
0.5
0.6
0.6
1.0
1.0
0.8
0.8
0.8
0.6
0.6
0.6
0.6
0
2000 observations
0
20000
500
1000
100
200
BD-Baaes
BD-BBayes (PM)
0
E-0.
1.0
1.0
1.0
1.0
0.8
0.8
0.5
500 A observations
1000
0
300
1000
0
500
1000
0
500
1000 LogReg (1)
Chaudhuri et al. [19] (A = 1/9n)
a abalone
adult
bank
vertebml
1.0
1.0
0.8
0.8
CSA (E=5.0) CSA t
0.6
0.6
0.6
1.0
1.0
0.8
0.8
0.8
0.6
0.6
0.6
0.6
2000 observvttins
20000
500
1000
100
200
Chandhuri et.l. (A 1/9n)
LogReg (1)
0-0.2 2
2-0.5
e-1.0 1.
5-5.0
0.9
0.8
0.8
0.5
0.5
0.7
500 It observations
1000
500
1000
500
1000
500
1000
Chaudhuri ot al. [19] (A 1.9)
LogKeg (1) (A = 1/9)
a abalone
adult
bank
vertebral
(c-0.5)
0.7
0.8
0.6
0.5
0.8
0.6
0.5
0.4
0.7
0.81
0.7
0.8
2
0.1
0.6
0.6
0.5
0
2000 observations
20000
500
1000
100
200
Chaudhuri al. [19] (A = 1.9)
LogReg (1) (A = 1/9)
Figure& 8: CSA for simulated experiments (first row of each method) and UCI data sets (second row of each method). PM stands for posterior mean which was estimated over 20 samples. This is non-private baseline, i.e. the point estimate you would release if privacy were not an issue.
27

---

6-0.2
6-0.5
E-1.0
E-5.0
ROC-AUC
0.7
0.8
0.8
0.9
0.6
0.8
0.6
0.5
0.7
50
200
1000
50
200
1000
50
200
1000
50
200
1000
abalone
adult
vertebral
0.8
1.0
0.8
500
0.6
0.6
0.6
0.5
20
50
200
500
1000
10
200
278
0.8
1.0
1
0.6
0.6
200
1000
10
50
200
1000
200
1000
10
.00
200
observations
Ba-B
BD-Bayes (PM)
DPSGD
SGD
Figure 9: Test set predictive ROC-AUC of DP estimation for neural network classification as the number of observations increases simulated and UCI data.
6=0.2
8=0.5
e=1.0
8=5.0
log RMSttt)
2.0
0.0
1.0
0.0
8
Chandhor [19] (A 1/9m)
BD-Rayes
Minumi al, [65]
Chandbur et [19] 1/9)
E-0,2
8-0.5
E-1.0
8-5.0
1.0
ROC-AUC
0.7
0.9
0.9
0.8
0.9
0.8
0.5
4
6
BD-Bayes
DPSGD
e-0.2
E-0.5
E-1.0
E-5.0
log RMSE
0.2
0.2
0.2
0.0
0.0
0.0
features
BD-Bayes
DPSGD
Figure 10: Parameter log RMSE DP logistic regression (first row), test set predictive log RMSE of DP neural network classification (second row), and test set ROC-AUC of DP neural network regression (third row) as the number of features increases on simulated data with n 1000.
Beyes
Chuchar [19]
Jog RMSE(6)
Chasllus etal. [19] 1/9)
Minern etall
3
lower bound on
Figure 11: Lower bound on against log RMSE. Points correspond to values of c.
28


Reviews:
[{"review_id": "fgIk7jyjYQ", "reviewer": "Reviewer_ADTx", "summary": "The paper introduces a privacy mechanism called \\betaD-Bayes, which combines the one-posterior sampling (OPS) technique with the \\beta-divergence to provide differentially private (DP) parameter estimation for a wide range of inference models. The goal is to ensure that sensitive information in the training data is not leaked when releasing model parameters. The authors extend the applicability of OPS to general prediction tasks and propose \\betaD-Bayes as an alternative to the sensitivity method in DP estimation.\n\nThe sensitivity method perturbs the function that depends on the sensitive data with noise scaled according to the sensitivity of the function. However, this approach introduces statistical bias and limits the interpretability of the released statistical estimates. OPS, on the other hand, leverages the uncertainty provided by sampling from Bayesian posterior distributions to generate interpretable DP parameter estimates. OPS has been shown to consistently learn the data-generating parameter and is not restricted to specific models like logistic regression.\n\nThe authors introduce \\betaD-Bayes to make OPS applicable to a broader class of inference models. They combine OPS with a robustified general Bayesian posterior that minimizes the \\beta-divergence between the model and the data-generating process. \\betaD-Bayes naturally provides a pseudo-log likelihood with bounded sensitivity for popular classification and regression models without modifying the underlying model. This eliminates the need to assume bounded feature spaces or clip statistical functions.\n\nExtensive empirical evidence is provided, including performance comparisons with relevant baselines on multiple datasets and analysis of sensitivity based on sample size and privacy budget.\n", "questions": "Can the proposed method be applied to stochastic MCMC methods?\nHow it could be extended to neural networks? Does the complexity allow it to be applied to that type of models?", "limitations": "This method, as a one posterior sampling (OPS) method, is computationally infeasible since they aim to achieve differential privacy for a sample from the exact posterior distribution. OPS methods rely on using MCMC samples to approximate the posterior distribution. However, ensuring the convergence of the MCMC sampler is crucial to avoid compromising privacy further. This part is missing at the moment, but I understand it is not within the scope of this paper. I think that could be follow-up work.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper proposes a generalizable approach that can be potentially high impact. I think it could lead to broadening differential privacy research in the Bayesian inference field. The proposed approach is an efficient alternative to the sensitivity methods, and the empirical evaluation shows that the proposed approach outperforms the baselines.\n\nOverall the paper is well-written, the motivation is clear, technical contribution looks correct and strong. It also has a nice related work section and it is easy to understand the contribution.", "weaknesses": "The empirical study conducted in Section 5 is limited. I would suggest adding more complex models to the empirical study, e.g. neural network classification and discuss the complexity of such applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging the potentially high impact that is brought by our paper’s broadening of differential privacy research within Bayesian inference. We address your questions and concerns specifically below. \n\n### The breadth of our empirical study (incl. neural network classification) \nThank you for these comments. We included a comparison with logistic regression as this is one of the only models that can currently be tackled by the OPS methods of Wang [80] and Minami [65] as well as Chaudhuri [19], and we wanted to show that even in these cases $\\beta$D-Bayes outperformed these approaches. \nHowever, we believe one of our key contributions is providing a setting in which OPS can be extended to a wider class of models. We illustrated this by considering a regression example (where DP methods struggle outside of conjugate families because of unbounded responses) with a neural network mean function. The results of this are in Fig 3.\nAn example of neural network classification was also already included in the original version of our paper, to further demonstrate the flexibility of $\\beta$D-Bayes for DP estimation, but sadly the paper is short on space. This appears in Suppl. Fig 6.\n### Applications of stochastic MCMC methods for neural networks\nThe aim of our paper was to establish $\\beta$D-Bayes as an alternative to the current Gibbs posterior OPS methods. In the paper, we ran an off-the-shelf MCMC for neural networks with one hidden layer and this appeared to work well In principle, our paper proves that a sample from the exact posterior is DP and from this standpoint as long as the stochastic MCMC is run long enough to convergence then it would be applicable to our paper. A great deal of research has gone into scaling MCMC methods for logistic regression and there are tailored MCMC methods for neural networks as well.\n\nWe hope that the considerable improvements in performance make the increased computational costs worthwhile. Our experiments show that $\\beta$D-Bayes OPS outperforms Chaudhuri [19] and DPSGD [1] as well as the Gibbs OPS methods. We hope that the performance of our method encourages further research that can tackle these computational challenges, including scaling MCMC to large neural networks or alternatively DP variational Bayes methods to approximate the $\\beta$D-Bayes posterior [41, 45, 70]. These however require different theoretical tools that are out of the scope of this paper.\n\nFinally, we note that these procedures cannot be repeated, as repeated estimation would leak information, and only require one posterior sample (after reaching stationarity). As a result, it is reasonable to trade-off performance gains for computational costs. \nTo Sec. 6 l. 377 we will add: \n> A further limitation of OPS is the computational burden required to produce posterior samples, particularly in larger neural networks with many parameters. However, we argue that the improved performance justified such a cost and is mitigated by the fact that such inference can only be run once to avoid leaking privacy and that only one posterior sample is required. We hope that our method encourages further research into computational procedures for these models, including scaling MCMC to large neural networks or Developing DP variational inferences approaches [41, 45, 70] to the $\\beta$D-Bayes posterior is another option here.\n\n### Interesting follow up work could look at ensuring the convergence of the MCMC to avoid compromising privacy further\nYou are absolutely right. We proved that exact sampling from the $\\beta$D-Bayes posterior was $(\\epsilon, 0)$-DP where in reality one would normally use MCMC to approximate sampling from this posterior. In Sec. 4 we refer to a Thm. of Minami [65] which says that if the distribution of the MCMC chain is within in total variation distance $\\gamma$ of the $\\beta$D-Bayes posterior then a sample from the MCMC chain is $(\\epsilon, \\delta^{\\prime})$-DP, with $\\delta^{\\prime} = (1+e^{\\epsilon})\\gamma$. The result from Seeman et al. [74] (stated on l. 258) observed that if the MCMC algorithm is geometrically ergodic achieving a delta at most of order $1/n$ and preventing data leakage requires the chain to be run for at least order $N = log(n)$ iterations. Finally, we point out that stan’s implementation of the No-U-Turn sampler has been shown to be geometrically ergodic (i.e. fast mixing) and comes with warnings when the chain exhibits evidence of a lack of geometric ergodicity. \n\nThe conclusion is that running stan for sufficiently many iterations to not receive any warnings provides reasonable confidence of a negligible $\\delta^{\\prime}$.\n\nHowever, as you point out exact guarantees are crucial to avoid compromising privacy further. We agree it is somewhat beyond the scope of our first paper and an excellent idea for follow-up work. \nThere are two avenues here \n1. Deploy $\\beta$D within methods that specifically design MCMC chains to be differentially private (DP-MCMC). Prop. 2 in Sec. 4 outlines the conditions required of the model for $\\beta$D-Bayes to be immediately applicable to some popular methods. Incidentally, these methods often rely on stochastic MCMC methods which you mentioned above.\n2. Try to take advantage of the boundedness of the $\\beta$D-Bayes loss function to provide convergence guarantees for a finite sample chain from a particular algorithm. This for example was done in Prop. 13 of Minami [65] for a small class of well-behaved models. \n\nWe have alluded to these in Sec. 6 ll 370-377.\n\nWe aimed to propose a posterior that is more precise and widely usable than current methods and hope this inspires further research in this direction.\n"}, {"review_id": "cAh9yxuTLL", "reviewer": "Reviewer_fSk8", "summary": "Maintaining differential privacy in a Bayesian setting, can be implemented using Gibbs posterior sampling, which can be viewed as the exponential mechanism with respect to the score function, defined by the the sum of the log prior probability and the log likelihood of the dataset multiplied by a factor governed by the privacy parameter. To ensure differential privacy, this factor must scale with the global sensitivity of the log likelihood, which is unbounded in the general case.\n\nThe authors of this paper propose $\\beta$D-Bayes, a DP mechanism based on an alternative score function, which is defined by the $\\beta$ divergence. This loss function is bounded whenever the underlying distribution is bounded, a much more reasonable assumption. While this method is no longer justified by the theoretical Bayesian framework, it is still consistent under certain assumptions.\n\nWhile this probability function is intractable in the general case, it can be approximated using MCMC techniques, which are proven to guarantee privacy under additional assumptions. They continue to evaluate numerically and empirically the quality of this new technique.", "questions": "As mentioned in the previous section, I had a hard time to parse many of the claims, especially those which were not formally stated. The authors input will be appreciated.\n\nMinor question: In line 52, I failed to understand why the OPS method was presented as an alternative to the sensitivity method, while as the authors explain in later parts, it is actually an implementation of the exponential mechanism with the appropriate sensitivity function?", "limitations": "N/A", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 1, "contribution": 2, "strengths": "The posterior sampling technique is an important tool in providing private parameter estimations in a Bayesian setting. This techniques has two main drawbacks. The first is the infinite global sensitivity of the score function in the general case, and the second is the intractability of the posterior distribution. This paper provides an important method that reliefs the first issue.", "weaknesses": "It might result from my limited knowledge in statistical tools, but I found it hard to parse many of the claims presented in the paper.\n\nPresentation: In many cases, the paper avoids providing full definitions and conditions for the stated claims, and instead refers the reader to other papers or the appendix. The conditions in Theorem 2 and Proposition 2, and the discussion at the first paragraph of section 4, all refer to conditions stated in other papers, and the notation used to state Proposition 1 were defined only in the Appendix, which I found very challenging to follow.\n\nHard to parse informal claims: While the formal claims were clearly stated, some of the results stated in the introduction are not fully proven, but are based on discussions in sections 3 and 4. While these short discussions might be sufficient for experts in the field, I found it hard to follow. In particular, I did not understand the first paragraph in page 6 which discusses implementation to NNs, and the first paragraph in page 7 which discusses the computational guarantees (as far as I can tell, there are none for $\\beta$D-Bayes).\n\nMinor comments:\n\n* In equation 4, the letter $D$ is used twice, once as an argument of the function, and once as the integrated term, which is confusing.\n\n* In Theorem 2, $\\theta_{0}^{(\\beta)}$ was not defined. Is it possible it is a shorthand for $\\theta_{0}^{\\ell^{(\\beta)}}$? \n\n* In Figure 3, the choice of colors makes it hard to distinguish between $\\beta$D-Bayes (PM) and SGD.\n\n=======\n\n**Edit after rebuttal discussion:**\n\nAs my main concerns were presentation related, I hope the authors will update their work in accordance with the additional explanations they added in the rebuttal. In particular, in my opinion, the format of the statements should be edited, so that the paper will become self contained.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging the importance that moving away from log-score updating contributes to DP probabilistic inference. We address your questions and concerns specifically below. \n\n### Clarifying Thm. 2 and Prop. 2, the first paragraph of Sec. 4 and Prop. 1\nSpace in the paper is limited and we decided to spend what we have explaining the concepts. We propose the following changes to improve this section’s clarity:\nWe can discuss the conditions of [64] in relation to the $\\beta$D-Bayes posterior before the proofs of Thm. 2 in the appendix. \nCondition 2 required for Prop. 2 is provided in the appendix before the proof of the proposition. We will directly refer to this in the statement of Prop. 2.\nA formal statement of Prop. 12 of Minami [65] and their conditions will also be added to the appendix and correctly referred to in the paper. \nFrom Prop. 1, $H^{(\\beta)}_0$ is the Hessian matrix and $K^{(\\beta)}_0$ the cross-product matrix of the gradient vector, we keep their formal definitions in the appendix, but add the following sentence to Prop. 1: “where $K^{(\\beta)}_0$ and $H^{(\\beta)}_0$ are the gradient cross-product and Hessian matrices for the $\\beta$D loss and are defined in appendix Eq. …’’\nWe will add a subsection to Appendix A providing formal definitions of all notation. \n\n\n### Clarifying the first paragraph in page 6 discussing the implementation to NNs\nThe first paragraph on page 6 points out that NNs have been shown to outperform logistic regression for modern problems. However, the log-likelihood of a NN classifier is not convex, and therefore the methods of Minami [65] and Chaudhuri [19] cannot be applied. Instead, the state-of-the-art method for DP estimation of NNs is DPSGD which adds noise to minibatch gradient evaluations in SGD and clips the gradients at some value to bound their sensitivity.\nWe agree our previous statement on ll 222 was imprecise and we will replace this statement with: “unlike logistic regression, the log-likelihood of a neural network classifier is not convex and therefore the methods of Minami et al. [65] and Chaudhuri (2011) [19] cannot be applied.” \nFurther, our description of DPSGD on ll 224 was very brief and relies on the reader to remember DPSGD from ll 46. We therefore replace this with: “DPSGD [1] which adds noise to minibatch gradient evaluations in SGD and clips the gradients at some value to artificially bound their sensitivity.”\n\n### Clarifying the first paragraph in page 7 which discusses the computational guarantees\nSec. 4 introduces that while OPS sampling from the $\\beta$D-Bayes posterior is $(\\epsilon, 0)$-DP, if one uses MCMC to approximate the $\\beta$D posterior the MCMC approximation needs to be accounted for in the DP analysis. The cited result from Minami [65] says that if the distribution of the MCMC chain is within in total variation distance $\\gamma$ of the $\\beta$D-Bayes posterior, then a sample from the MCMC chain is $(\\epsilon, \\delta^{\\prime})$-DP, with $\\delta^{\\prime} = (1+e^{\\epsilon})\\gamma$.\n\nWe know that if we run MCMC for $N = \\infty$ iterations we can achieve $\\gamma = 0 \\Rightarrow \\delta^{\\prime} = 0$, but in practice only finitely many iterations are possible. The first paragraph on page 7 evokes the result from Seeman [74] saying that if the chain is geometrically ergodic, then at least order $\\log(n)$ ($\\Omega(\\log(n)$) iterations are required to get a $\\delta^{\\prime} = (1+e^{\\epsilon})\\gamma$ to be at most order $1/n$ ($O(1/n)$), a reasonable value for the size of $\\delta$ as we state in Line 34. The paragraph then discusses the sampler we consider. We used Stan’s implementation of the No-U-Turn sampler which has been shown to be geometrically ergodic (i.e. fast mixing) and comes with warnings when the chain exhibits evidence of a lack of geometric ergodicity. The conclusion is that running stan for sufficiently many iterations to not receive any warnings provides reasonable confidence of a negligible $\\delta^{\\prime}$.\n\nHowever, we agree that our statement on ll 258 can be improved. We will increase the clarity of this passage by\n\n+ Defining $\\delta^{\\prime} = (1+e^{\\epsilon})\\gamma$ on l 250 and referring to it on l 260\n+ Adding to ll 258: ‘’Seeman et al. [74] observed that if the MCMC algorithm is geometrically ergodic achieving a delta smaller than order $1/n$ and preventing data leakage requires the chain to be run for at least order $N = log(n)$ iterations”\n+ Finishing the paragraph with: ‘’running stan for a sufficiently many iterations to not receive any warnings provides reasonable confidence of a negligible $\\delta^{\\prime}$’’\n\nThis paragraph does not provide formal guarantees for using stan. Following the works of Minami et al. [65] and Wang et al. [80], we assume that a sample from a chain after convergence is representative of a sample from the posterior, and the paragraph here explains that this assumption is reasonable for the sampler we have chosen.\n\nClearly formal guarantees are desirable but we believe these are out of the scope of this first paper. We specify on ll 269 how $\\beta$D-Bayes is suitable for applications of DP-MCMC, but we leave investigating this for future work. We hope that the existence of a more precise general-purpose DP posterior encourages and facilitates new advances in DP-MCMC.\n### Why the OPS method is presented as an alternative to the sensitivity method\nThe sensitivity method is a subclass of the exponential mechanism that noise-perturbs an estimate with bounded sensitivity. In contrast, OPS (also an instance of the exponential mechanism) samples from a density proportional to a sensitivity-bounded function. We make the distinction as the noise in Bayesian sampling is not artificially added, but naturally present.\n### Notation in Eq. 4\nThanks, we have changed this to $\\overline{D}$."}, {"review_id": "C00mYzKPil", "reviewer": "Reviewer_9D13", "summary": "In this paper, authors propose a modified version of one posterior sample (OPS) mechanism. The OPS mechanism releases a sample from a posterior distribution in which the likelihood is tempered based on the privacy guarantee. This can be shown to be a simple instance of exponential mechanism which provides the privacy guarantees. Instead of tempering the likelihood (or equivalently scaling the sum of log-probabilities and taking the exp), authors use the $\\beta$-divergence loss as the utility loss for the exponential mechanism. Compared to basic OPS this approach has the benefit that the sensitivities of the log-probabilities don't need to be bounded. Instead using EM with $\\beta$-divergence loss, requires the pdf's of the model to be bounded from above (the lower limit is trivially 0). Such a bound exists naturally for almost every distribution (except for something like Dirac's delta dist.), while the log-pdf's typically don't have such bound. Authors further note, that the $\\beta$-divergence loss can also be used in other DP Bayesian inference methods. The experimental results demonstrate that the proposed method is able to outperform some previous works in DP logistic regression for various data sets, as well as DP-SGD in learning a simple NN for some $\\epsilon$'s and number of observations.", "questions": "- Is the convergence of the STAN run for the $\\beta$D-Bayes somehow included in the privacy parameters? You do discuss this in Section 4, but I don't see any $\\delta$'s reported in the experiments.\n- Also, while the STAN gives you the warnings, aren't the tests for the geometric ergodicity there only statistical estimates? Wouldn't this give a further error probability that should be taken into account for the privacy analysis?\n- Since you use the pdf's instead of the log-pdf's in the $\\beta$D-Bayes, I wonder how will it affect the numerical stability of the inference. Do you need to adjust the precision somehow to compensate this, or will it not be a problem at all? Having some discussion about this would seem appropriate.\n- Section 5: You say \"Note that [19] still presents the state-of-the-art in logistic regression [40].\". Is this really so? I checked the [40] and I cannot see them suggesting this. I would be actually really surprised if the DP-SGD with all the modern accounting machinery would not out-perform the logistic regression method of [19].\n- Fig 2: the linestyles in the legend look odd. In the top most figure, the green line is dashed, which is not the case for the two lower ones. Furthermore, the shade of green looks bit different between the first row and the rest. Also, it is bit had to say which gray line is which (the \\beta D-Bayes or LogReg (1)). I would encourage the authors to make the line styles in this figure consistent and more distinct from each other.\n- Does the PM abbreviation stand for posterior mean in Figs 2 and 3?\n- the SGD in Fig 3, is it just non-DP SGD?\n- If so, I'm really confused why it performs so poorly in the experiments. Why would you obtain so much smaller loss from the $\\beta$D-Bayes approach? I guess both should be optimizing at least similar likelihood function, so the main difference would arise from the prior, which then should have a more limited effect as the number of observations increase. \n\nReferences are as in the paper:\n[19] Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.\n[40] Naoise Holohan, Stefano Braghin, Pól Mac Aonghusa, and Killian Levacher. Diffprivlib: the ibm differential privacy library. arXiv preprint arXiv:1907.02444, 2019.\n\nMinor questions/comments/suggestions:\n- Denoting the data set with the same variable as the variable in the integral in (4) looks bit odd. Of course it's technically fine, but you might want to consider changing it.\n- line 157: should you have a $-\\log f(D; \\theta)$ instead of $\\log f(D; \\theta)$? \n- a minor comment: \"and the data can always be transformed–without changing the mean estimation–to avoid a very small variance.\". Can we really _always_ do this without accessing the data? I would imagine that in order to bound the small variance, you would first need to inspect how small the variance is, and then based on that upscale the data. Now, depending on the size of the data, the variance could be affected by a single neighbouring sample, and hence I would imagine you would need to take this into account in the privacy analysis.\n- typo, line 265: \"Bayescan\"\n- typo, appendix, proof for Lemma 1: additional $)$ in the second line\n", "limitations": "There are some limitations that I raised in the weaknesses which should be further discussed.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The unbounded sensitivity of the log-probabilities is a challenge in all DP probabilistic inference methods. Since the log-probabilities don't typically have a lower bound, the previous approaches typically resort into clipping or otherwise bounding the log-probabilities to obtain bounded sensitivity for the perturbation. The proposed solution overcomes this challenge by using probabilities instead of log-probabilities, thus avoiding any possible clipping bias. Therefore this attempt is an interesting contribution to the DP probabilistic inference.", "weaknesses": "The limitations of the method could be further discusses. For example, there is a reason why probabilistic inference is typically implemented using log-probabilities. Using the pdf's in the Bayesian updates would often lead to numerical issues, where as the log-probabilities are typically more stable. Also, since OPS produces only a single sample of the posterior, it could be far away from the posterior mean. And if you would be interested in Bayesian inference, a single sample would not be too interesting as it contains no information on the actual uncertainty.\n\nThe experimental results have some clarity issues. For example the lines in Fig 2 seem bit inconsistent between the panes. I will include some questions about these into the questions. \n\nAlso, I think comparing the proposed approach to any of the OPS works would be a relevant comparison which is currently missing from the paper.\n\nAfter rebuttal: Authors have sufficiently addressed my concerns in their rebuttal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging our contribution to DP probabilistic inference and the potential of moving away from log-score updating. We address your questions and concerns specifically below. \n### Numerical stability of using pdf's instead of the log-pdf's\nThe $\\beta$D loss *sums* the p.d.f.s to a power rather than multiplying them (Eq. 3 and 4) and is therefore not subject to numerical issues. \n### Utility of single sample from the posterior\nWe agree that when Bayesian inference is the goal, one sample is of little use. In this work, however, we are not advocating Bayesianism as the correct paradigm for inference, but as a convenient way to release DP parameter estimates as an alternative to noising empirical risk minimizers. One sample from the posterior is an unbiased and consistent estimate of the posterior mean and our experiments show that $\\beta$D-Bayes improves estimation performance and extends applicability compared to current methods\n\nIf uncertainty quantification is required, the privacy budget can be split and more than one sample can be released from a posterior with higher $\\beta$. Interesting further work could look at the utility/privacy trade-off here. \n\nIn Sec. 6 ll 369 we will add ‘’Extensions of this work could consider the benefits of dividing the privacy budget to allow for the release of more than one sample paving the way for parameter inference as well as estimation’’.\n### Distance of single sample from the posterior mean\nIdeally, one would release the posterior mean but randomness of the estimate is required in order to provide differential privacy as per its definition. Methods that noise MLEs (e.g. Chaudhuri [19]) also release one sample that could also be far from the original MLE. Our experiments, e.g. Fig 2 and 3 show that a sample from the $\\beta$D-Bayes posterior is closer on average to the data generating parameters than the noised MLE in [19] or a sample from the Gibbs posterior [65] for the same privacy level, so the cost of ensuring privacy is less under $\\beta$D Bayes OPS.\n### Favourable comparison to other OPS works already included\nFig 2 compares our $\\beta$D-Bayes OPS with Minami [65] who do Gibbs posterior OPS and whose method is an improvement of Wang [80] for logistic regression. We show that $\\beta$D-Bayes OPS generally improves the performance of Minami [65]. For neural network classification and regression we are not aware of anyOPS methods that apply and therefore we compare to DPSGD instead. We believe one of our key contributions is providing a setting in which OPS can be extended to a wider class of models.\n### SGD in Fig 3 is non-DP SGD\nSGD is run with the same hyperparameters as DPSGD but without clipping and noising of gradients. We will explicitly mention this.\n### Explaining the performance of non-DP SGD in the experiments \nThe goal of this experiment was the comparison of the private methods. For SGD we chose the same parameters as for DPSGD which includes a small number of epochs. While non-private performance could believably be improved with other hyperparameters, we included SGD as an ablation of DPSGD. We will explain this further in the appendix and Fig 3 no longer compares $\\beta$D-Bayes with SGD in the non-private setting.\n### Utility of stan warnings despite them being statistical estimates\n\nTheorem 1 proves that a sample from the exact posterior is DP, and following Minami et al. [65] and Wang et al. [80], we assume that a sample from a chain after convergence is representative of a sample from the posterior. We use the absence of stan warnings to justify this. While, as you point out, these diagnostics are only estimates, they are widely adopted measures to assess MCMC convergence outside of the privacy setting. It is reasonable to assume that the data holder can choose a large enough number of steps to obtain a posterior sample without the occurrence of such stan warnings\n\nThank you for pointing out that these diagnostics are missing from the paper. We will report the ESS and R-hat scores in the appendix the number of warm-up steps and iterations used.\n\nWe specify on ll 269 how the properties of $\\beta$D-Bayes make it suitable for applications of DP-MCMC, where the whole MCMC chain is made private, but we leave investigating this for future work. We will further elaborate on the limitation of stan warnings in Sec. 6. \n### Current relevance of [19]\nThank you for checking. [40] is an example use case of [19] (DP logistic regression proposed by Chaudhuri et al.) in 2019 suggesting that [19] was not outdated then. Further, [19] is designed specifically for logistic regression allowing for the use of 2nd order optimisation techniques and privatising the final converged logistic regression parameters. DPSGD on the other hand privatises each gradient step and can only be run for a limited number of iterations, thus introducing more noise for the same level of privacy. We re-formulate this sentence to reflect that “[19] still presents a widely-used implementation of DP logistic regression” \n\nWe compare $\\beta$D-Bayes OPS with DPSGD in our neural network classification and regression examples (Fig 3 and 6).\n\n### ‘’[T]he data can always be transformed…to avoid a very small variance.\"\n\nWe agree the original comment was vague, and yes, you do not want to scale by something that depends on the data. A strategy that can always be implemented is to add $0$ mean Gaussian noise with variance $s_0^2$ to the responses $y$. Then you can trivially bound the response variance of the linear regression above $s_0^2$. \n\nTo ll 235 we add: \n> In situations where a natural lower bound is not available, one can guarantee this bound by adding iid 0 mean Gaussian noise with variance $s_0^2$ to the observed responses $y$.\n\nThis is conceptually different from noising parameter estimate. This repeatedly adds 0 mean noise with a very small variance (we used $s_0^2 = 0.01$) to every observation and doesn’t affect the regression parameter estimates."}, {"review_id": "9siPgAoM6J", "reviewer": "Reviewer_D3oa", "summary": "This paper combines OPS  (one posterior sampling) with bounded beta-divergence, resulting in a DP mechanism that applies to a general class of inference models. This approach bounds the sensitivity of the procedure without bounding the feature space or statistical functionals thereby improving on previous approaches. The paper provides empirical evidence for the performance of the approach against relevant baselines and on multiple different data sets. ", "questions": "\nHow can this approach be used for uncertainty quantification over the parameters or posterior predictive? In approaches where the exact posterior is targeted, this is obvious but it is less clear with this approach. If this requires additional privacy budget, this should be noted. \n\n", "limitations": "The authors should address the computational demandingness of this approach compared to alternative approaches. How large of a model/dataset could this realistically be run on? ", "rating": 6, "confidence": 2, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "The paper is well motivated, I agree that overcoming the limitations of sensitivity bounding is an important direction for work on differentially private inference. The theoretical analysis is careful and precise. Table 1 is very helpful for baselining the approach and clarifying its novelty. \n\n", "weaknesses": "The presentation of section 3 is extremely dense and jargon-y,  with very little intuition given for the key formulas (e.g. equation 4). The paper would be significantly easier to follow to those unfamiliar with this class of Bayesian inference algorithms (which are fairly esoteric as far as I gather) if some additional intuition was included. \n\nFigure 2 is very hard to read given the amount of information being conveyed and the size (e.g. the red and orange colors are similar, what is PM?). From looking at the figure, it is also not obvious to me that the proposed method is better. Perhaps extrapolating the line out in n, that would be the case, but then these experiments should be run with larger sample sizes. If the reason for not doing so is the computational infeasibility then this should be noted as a limitation of the method. \n\nThe description of the experiments was lacking clarity in my opinion. What is the prediction goal of training these models? what information is contained in these datasets? how many covariates were used? how/why were hyper-parameters chosen? These details should be included in the main body of the paper. I would be more convinced if the experiment could show that the proposed approach replicated a finding without DP with lower error than alternatives.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging the importance of our contribution to overcoming the limitations of sensitivity bounding. We address your questions and concerns below. \n### Improving the presentation of Sec. 3 and providing more intuition \nThe most important points for readers unfamiliar with Bayesian and general Bayesian inference to understand are:\n+ The Gibbs posterior used by Wang [80] and Minami [65] generalises the standard Bayesian posterior to $\\pi(\\theta|D) \\propto \\pi(\\theta)\\exp(\\sum_{i=1}^n w\\log f(D_i; \\theta))$. The parameter $w > 0$ provides some flexibility in adapting to the sensitivity of the posterior. However, bounding the sensitivity of $\\log f(D_i; \\theta)$ is difficult outside very simple problems.\n+ The generalised Bayesian posterior, Bissiri [15], generalises this further to $\\pi(\\theta|D) \\propto \\pi(\\theta)\\exp(-\\sum_{i=1}^n \\ell(D_i; \\theta))$ (Eq. 3) providing the flexibility to choose a loss with bounded sensitivity.\n+ We chose the beta-divergence loss (Eq. 4), which still depends on the model $f(\\cdot;\\theta)$, and allows data generating parameters to be learned unbiasedly, while also having bounded sensitivity.\nFor improving clarity and intuition, we propose the following changes:\n+ll 123 \"Note $w = 1$ recovers the standard posterior and $w\\neq 1$ provides flexibility to adapt the posterior the level of privacy required.’’\n+ ll 153 \"OPS has struggled as a general purpose tool for DP estimation as bounding the sensitivity of $\\log f(x;\\theta)$ is difficult.’’.\n+ ll 155 “high posterior density is assigns to parameters that achieved small loss on the data.’’\n+ ll 156 \"The Gibbs posterior in (2) is recovered using the weighted negative log-likelihood … and the standard posterior for $w=1$.’’\n+ ll 158 \"The framework of Bissiri et al. [15] provides the flexibility to choose a loss function with bounded sensitivity. An alternative loss function…’’\n+ ll 161 \"the first term in (4) contains the negative likelihood, therefore parameters that make the data likely achieve low loss. However, it is raised to the power $\\beta-1 > 1$ prescribing relatively smaller loss to observations unlikely under that parameter than the log-likelihood. A key feature of (4) is that while $lim_{f\\rightarrow 0} -\\log f = \\infty$, $lim_{f\\rightarrow 0} -\\frac{f^{\\beta-1}}{\\beta-1} = 0$ for $\\beta > 1$. The second integral term only depends on the parameters and ensures the $\\beta$D loss can learn the data generating parameters.’’ \n+ ll 163 \"$\\beta = 1$ recovers the negative log-likelihood.’’\n+ ll 180-183 “Rather than bounding $log f(\\cdot;\\theta)$, we replace it in (3) with the $\\beta$D loss from (4) which is naturally bounded when the density is bounded.’’\nWe will also use more subsections to improve the readability.\n### Improving the description of the experiments\nThank you. Appendix B will be updated to contain the following information for each dataset/experiment\n+ What was the response\n+ What were the predictors\n+ Specifications of priors, regularisers and optimisation parameters\nMost hyperparameters resulted directly from the DP requirement. \n### Extensions to uncertainty quantification\nIn this work, we are not advocating Bayesianism as the correct paradigm for inference, but as a convenient way to release DP parameter estimates as an alternative to adding noise to the empirical risk minimizer. We demonstrate improved performance and flexibility.\n\nIf uncertainty quantification is required, the privacy budget can be split and more than one sample can be released from a posterior with higher $\\beta$. Interesting further work could look at the utility/privacy trade-off here. \n\nTo Sec. 6 ll 369 we will add \"Extensions of this work could consider the benefits of dividing the privacy budget to allow for the release of more than one sample paving the way for parameter inference as well as estimation.’’\n### Addressing the computational demandingness of this approach compared to alternative approaches\nIn Sec. 4 and 6 we identify the limitation that our approach relies on a perfect sample from the posterior. This is shared by the Gibbs OPS approaches of Wang [80] and Minami [65], but not by the approaches of Chaudhuri [19] or DPSGD [1]. These rely on techniques from optimisation that are known to scale better in the number of parameters. \nObtaining posterior samples is left for future work. In Sec. 4 we discuss how the $\\beta$D-Bayes posterior is naturally suitable for application to the DP-MCMC literature. A great deal of research has gone into scaling MCMC methods for logistic regression and there are tailored MCMC methods for neural networks as well. Finally, these procedures cannot be repeated, as repeated estimation would leak information, and only require one posterior sample (after reaching stationarity). \nWe hope that the considerable improvements in performance make the increased computational costs worthwhile. Our experiments show that $\\beta$D-Bayes OPS outperforms Chaudhuri [19] and DPSGD [1] as well as the Gibbs OPS methods. We hope that our method encourages further research into computational procedures for these models, including scaling MCMC to large neural networks or alternatively DP variational Bayes methods to approximate the $\\beta$D-Bayes posterior [41, 45, 70]. \nTo Sec. 6 l. 377 we will add: \n> A further limitation of OPS is the computational burden required to produce posterior samples, particularly in larger neural networks with many parameters. However, we argue that the improved performance justified such a cost and is mitigated by the fact that such inference can only be run once to avoid leaking privacy and that only one posterior sample is required. We hope that the performance of our method encourages further research that can tackle these computational challenges, including scaling MCMC to large neural networks or developing DP variational inference approaches [41, 45, 70] to the $\\beta$D-Bayes posterior."}]

Author rebuttal:
We would like to thank all reviewers for their thoughtful feedback and for appreciating the importance of our contribution. We have changed all minor comments, and addressed their suggestions in individual responses.

Alongside our rebuttal we provide a PDF demonstrating how we will alleviate some of the reviewers’ concerns.

**Reviewers 9D13, fSk8 and D3oa** found the demonstration of our results in Fig 2 and 3 confusing. In particular, the plot was cluttered with too many lines; some that looked similar. The goal of Fig 2 and 3 is to compare the performance of the different private methods for the same level of privacy, and not the performance of their non-private analogs. To address these concerns, Fig S1 (in the attached PDF) provides an updated version of Fig 2 where we have removed the non-private methods (grey/black dotted lines). The plot now compares the four DP methods for the same $\epsilon$ on simulated and real data sets and shows that for large enough \# observations $\beta$D-Bayes OPS incurs the least statistical error. We will also remove the non-DP methods from Fig 3 to improve its readability. 

Following comments from **Reviewer D3oa**, we also extrapolated the figures to display the full data set sizes (to the benefit of our method). Before we presented the results only on a subset of the data for clarity reasons. Now that the dashed lines are removed, the results on the full data set can be displayed without loss in readability. We run the method on repeated subsamples of the data in order to provide an idea of how the methods compare for different sample sizes. We do not consider subsamples for computational reasons. We could run our simulations for more than $n = 1000$, however from the top line of Fig S1 (in the attached PDF), we believe it is already clear that $\beta$D-Bayes performs the best. We hope that from the updated Fig S1, it is clear that for the simulations and real data for all considered values of $\epsilon$ for large enough \# observation $\beta$D-Bayes is the best (lowest for log RMSE top plots, highest for AUC bottom plots).

Fig S2 (in the attached PDF) illustrates a separate comparison of private $\beta$D-Bayes inference with its non-private analog (i.e. the posterior mean) and these plots for all the methods will be added to the appendix. As pointed out by **Reviewers 9D13 and D3oa**, PM stands for posterior mean and this is now explicitly noted in a revised version of the paper.

Fig S3 (in the attached PDF) addresses the comment of **Reviewer D3oa** who asked if $\beta$D-Bayes could ‘’replicate[d] a finding without DP’’. For logistic regression, we understood a finding as estimating a coefficient as being of a particular sign. For our real and simulated data, Fig S3 looks at the CSA (correct sign accuracy), the proportion of the time the DP-parameter estimates from the different methods agree with those of a non-private baselines (i.e. l2-penalised logistic regression implemented in sklearn). The plot demonstrates that the estimates from $\beta$D-Bayes OPS would agree with the sign of the non-private method more of the time than the other methods.

Meta-review: The paper presents a novel method for differentially private Bayesian inference. After author rebuttal and discussion, all reviewers recommend acceptance.

For the final version of the paper, the authors should update the presentation to make the paper better self-contained. Especially the theorem statements should be fully self-contained and not rely on references to other papers.
Decision: Accept (poster)