Post-processing Private Synthetic Data for Improving Utility on Selected Measures
Authors: Hao Wang
Shivchander Sudalairaj
John Henning
Kristjan Greenewald
Akash Srivastava
Venue: NeurIPS 2023 poster (2023)
Keywords: differential privacy
synthetic data

Abstract: Existing private synthetic data generation algorithms are agnostic to downstream tasks. However, end users may have specific requirements that the synthetic data must satisfy. Failure to meet these requirements could significantly reduce the utility of the data for downstream use. We introduce a post-processing technique that improves the utility of the synthetic data with respect to measures selected by the end user, while preserving strong privacy guarantees and dataset quality. Our technique involves resampling from the synthetic data to filter out samples that do not meet the selected utility measures, using an efficient stochastic first-order algorithm to find optimal resampling weights. Through comprehensive numerical experiments, we demonstrate that our approach consistently improves the utility of synthetic data across multiple benchmark datasets and state-of-the-art synthetic data generation algorithms.

Post- Private Synthetic Data for Improving Utility on Selected Measures
Hao Wang, Shivchander Sudalairaj, John Henning, Kristjan Greenewald, Akash Srivastava" MIT-IBM Watson Al Lab
Abstract
Existing private synthetic data generation algorithms are agnostic to downstream tasks. However, end users may have specific requirements that the synthetic data must satisfy. Failure to meet these requirements could significantly reduce the utility of the data for downstream use. We introduce a post-prec poss--ssessiigg technique that improves the utility of the synthetic data with respect to measures selected by the end user, while preserving strong privacy guarantees and dataset quality. Our technique involves resampling from the synthetic data to filter samples that do not meet the selected utility measures, using an efficient stochastic first-order algorithm find optimal resampling weights. Through comprehensive numerical experiments, we demonstrate that our approach consistently improves the utility of synthetic data across multiple benchmark datasets and state-of-the-ar synthetic data generation algorithms.
1 Introduction
The advancement of machine learning (ML) techniques relies on large amounts of training data. However, data collection also poses a significant risk of exposing private information. In recent years, several instances of privacy breaches have surfaced [NS06, Con 18], making urgent to find reliable way to share data. Today, the de facto standard for privacy protection is differential privacy (DP) [DR14]. DP ensures that useful information of a private dataset can be released while simultaneously preventing adversaries from identifying individuals' personal data. DP has been utilized effectively in a wide variety settings, by actors including the US Census [Abo18] and various large corporations Appl7,,Fa20,, RE19, HBMAL19, IBM23].
Generating private synthetic data crucial application of DP. allows data scientists to train their ML models on the synthetic data while preserving a certain level of utility when deploying these models on real test data. The U.S. National Institute of Standards and Technology (NIST) has emphasized its significance by hosting series of competitions [RTMT21, MMS21J. There is also significant work introducing new DP synthetic data generation mechanisms, including GAN-based [XLW+18 18, BJWW 19, JYVDS19, TWB 19], marginal- [ZCP+1] 17, MSM19, MMS21]. and workload- based [VTB+20 20, ABK 21, LVW21, MMSM22, VAA+22) methods. Existing methods for generating private synthetic data are task-agnostic they do not take into account the downstream use cases of the synthetic data in the data generation process. However, end users often have specific requirements for synthetic datasets to be successfully analyzed by their existing data science pipelines, which are often esbblsstall,seed, well-understood, heavily vetted, and difficult or expensive to change. Unfortunately, synthetic data generated by existing methods may not always meet these requirements, resulting in reduced utility for their downstream use cases. This raises a fundamental question:
"email: (hao, shiv.sr, Jhenning
akash.srivastaval @ibm.com
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Is it possible to improve synthetic dataset's utility on a set of selected measures while preserving its differential privacy guarantees?
In this paper, we introduce a post-processing procedure that enhances the quality of the synthetic data on set of utility measures. These measures are usually based on the end user's requirements for the synthetic data. Our method solves an optimization problem to calculate the optimal resampling weights for each data point. We then use these weights to resample the synthetic dataset, eliminating data points that do not accurately reflect the real data based on the selected utility measures. This post- processing procedure has many remarkable properties. Firstly, it model -agnossg,,,,,,, meaning that does not depend on any assumptions about how the synthetic data were generated. The synthetic data could be generated using either GAN- -aaN-dsed, marginal baaee, or workload the post-processed data preserve the DP guarantees while maintaining the performance of downstream models on real data compared to models trained on the original synthetic data. Finally, our algorithm is highly scalable, especially for high-dimensional data. It only requires convex optimization whose number of variables is equal to the number of desired utility measures. We develop a stochastic first-order method that can efficiently solve this optimization problem. As reference, we apply our algorithm to the home- credit dataset [MOK18] 18] which consists of 307,511 data points and 104 features, and it only takes around 4 mins to finish running.
methods. Second,
We conduct comprehensive numerical experiments demonstrate the effectiveness of our post- processing techniques. Our results show that this algorithm consistently improves the utility of the synthetic data on different selected measures, across multiple datasets, and for synthetic data generated using various state-of-the-arr privacy mechanisms. Additionally, the downstream models trained on the post-proce processed data can achieve comparable (or even better) performance on real data compared to the models trained on the original synthetic data. We demonstrate an application of our technique by using it to align the correlation matrix of the synthetic data with that of the real data. The correlation matrix shows the correlation coefficients between pairs of features and is often used as a reference for feature selection. By applying our post-processing technique, we can ensure that the correlation matrix of the synthetic data closely matches that of the real data. This, for instance, can help downstream data scientists more accurately select a appropriatt set of features for fitting their ML models, c.g. by thresholding the correlation with the desired target variable or using Lasso techniques.
Our proof techniques rely on an information-theoreet formulation known as information projection, which dates back to Csiszár's 's seminal work [Csi75]. This formulation has recently been successfully applied in several domains, such as large deviation theory [DZ96], hypothesis testing [Csi84], and fair machine learning [2H]+ Here we use information projection to "project" the empirical distribution of the synthetic data onto set of distributions whose utility measures match those of the real data. We show that the optimal projected distribution can be expressed as an exponential tilting of the original distribution and determine the tilting parameters via convex program in the dual space. To solve this optimization problem, we introduce a compositional proximal gradient algorithm, which is stochastic first-order method and highly scalable for large dataset. Notably, this exponential tilting takes the form of a simple reweighting of the data points in the original synthetic dataset. Hence, our approach has the added benefit that it only reweights synthetic data points without changing their values, ensuring that the quality of the data points is not compromised and the support set of the overall dataset not expanded.
In summary, our main contributions are:
We present post- post-processing technique that enables end users to customize synthetic data according to their specific requirements.
Our technique model- it is applicable regardless of the methods used to generate private synthetic data. It is scalable to high-dimensional data and maintains strong privacy guarantees.
We conduct comprehensive numerical experiments, showing that our technique can consistently improve the utility of synthetic data across multiple benchmark datasets and for synthetic data generated using state-of-the-ar DP mechanisms.
The supplementary material of this paper includes: (i) omitted proofs of all theoretical results, (ii) details on algorithm implementation, and (iii) supporting experimental results.
2

---

1.1 Related Work
DP synthetic data generation mechanisms. Generating synthetic data using DP mechanisms is an active area of research [see e.g., HLM12, BLR13, GAH 14, CXZX15, BSG17, AZK 19, UV20, GMH120, TMH* VAA 22, BSV22]. Along this line of work, the closest ones ours are workload-aware aware methods [VTB+20, ABK MMSM22, LVW21J, which aim to ensure that the synthetic data perform well on collection of queries. Our work differs three key features. First, all existing approaches focus on generating private synthetic data from scratch, while we aim to post-process synthetic data to downweight samples that do not accurately represent the real data under the specified utility measures. As result, our approach is more efficient as it does not need to fit a graphical model [MMSM22] or a neural network [LVW21] to represent the data distribution, and it is more extendable, allowing single synthetic dataset to be quickly post-processed multiple times for different sets of utility measures as needed by downstream users. Second, some existing work may not scale well to large datasets they either require solving an integer program multiple times [VTB* 20] or need to solve a large-scale optimization problem approach is highly scalable, as it only requires solving a convex program whose number of variables is equal to the number of specified utility measures. Third, existing work often evaluates the quality of the synthetic data by how well it preserves key statistics (e.g., 3-way marginals) of the real data. In contrast, in our experiments, we evaluate our approach on the more stringent and realistic test of training various downstream ML models on the synthetic data and measuring their performance on real test data. The experimental results demonstrate that our approach can enhance the utility of synthetic data on selected measures without compromising their downstream quality.
In contrast, our
methods. Our work introduces a post-processing procedure for improving the utility of given synthetic dataset based on selected measures. As special case, our approach can be applied to post-process publicly available datasets. In this regard, this work is related to publio-data-asiisted methods [see e.g., 211, LVW21J, which leverage public data for saving privacy budgets. We extend Algorithm 1 in [LVS*21] by formalizing the preservation of (noisy) utility measures constrained optimization problem, rather than minimizing the corresponding Lagrangian function. We further establish strong duality and propose a stochastic first-order method for solving this constrained optimization efficiently. We extend Algorithm 4 in [LVW21] by allowing any non-negative violation tolerance (i.c., any 7 2 0 in (3b)) compared with y = in [LVW21]. This extension offers increased flexibility, as users can now select various values of y to navigate the trade-off between minimizing the distortion of the synthetic data and enhancing their utility on selected measures. Moreover, our experiments show that setting y to be small positive number (e.g.. 7 = lE 5) consistently outperforms when work is related with [NWD20], which proposes to post-process outputs from differentially private GAN-based models for improving the quality of the generated synthetic data. However, their method tailored to GAN-based privacy mechanisms while our approach is model-agnostic. This versatility is crucial, given that marginal-based and workload -ased mechanisms often yield higher quality synthetic tabular data, as evidenced by benchmark experiments in [TMH + Our experiments indicate that our method consistently improves the utility of synthetic data produced by all kinds of privacy mechanisms, even when the initial synthetic data are of high quality.
Public data assisted ceathods/Pos-ppocessiii
0. Finally, our
2 Preliminaries and Problem Formulation
In this section, we review differential privacy and provide an overview of our problem setup.
2.1 Differential Privacy
We first recall the definition of differential privacy (DP) [DR14].
Definition 1. A randomized mechanism M : X R satisfies (e, -ddiffferettial privacy, if for any adjacent datasets DD and D', which only differ in one individual's record, and all possible outputs from the mechanism O C R, we have
Pr(M(D) E 0) s e Pr(M(D') E +
8
(1)
DP has two important properties: post-processing immunity and composition rule. Specifically, M x + R satisfies (e, DD and g R + R' is any randomized (or deterministic) function, then
3

---

g R' (c, if M = (M1,... 1..... ,Mx) is sequence of randomized mechanisms, where M; is (c; dD) then M is (E, Ci i=1 - There are also advanced composition theorems [see e.g., DRVIO, KOVI5].
The Laplace and Gaussian mechanisms are two fundamental DP mechanisms. For function f: X" + R we define its Lp sensitivity for p E [1, 2] as
_ sup (D - p(D)) DMD'
where DD and D' are adjacent datasets. The Laplace mechanism adds Laplace noise N ~ Lap(O, bT) the output of f:
M(D) - ((D) +
In particular, b= (f)/e, the Laplace mechanism satisfies (e, OD-D. Similarly, the Gaussian mechanism adds Gaussian noise ~ (0, o²I) to the output of f. We recall result from [BW18] that establishes DP guarantee for the Gaussian mechanism and refer the reader to their Algorithm for a way to compute from (e, 6) and (2
Lemma 1 ([BW18)). For any e 2 and E [0, 1). the Gaussian mechanism (e. 6D-P if and only if
A22(f) co 2x
1,07)
A2(f)
e
5.
A2(f)
20
22(f)
where & is the Gaussian CDF; (() A I f 122
V2a
The function f can often be determined by a query 9: X -R f(D)= ; ((x;). In this case, =
we denote (q) å suPa,a'ex' (4(x)) g(x')l; (P) a Rx~p (x()) for a probability distribution P: and ((D) 1 En,eD g(m:) for dataset D.
2.2 Problem Formulation
Consider dataset D comprising private data from individuals, where each individual contributes single record x = (I1. ... za) E X. Suppose that a synthetic dataset Dayn has been generated from the real dataset D, but it may not accurately reflect the real data on set of utility measures (also known as workload). We express the utility measures of interest as a collection of queries, denoted by Q [4 X + K and upper bound their Lp sensitivity by (p(2) A [ExEjK] A(gx) l/2
Our goal is enhance the utility of the synthetic dataset Dayn w.r.t. the utility measures Q while maintaining the DP guarantees. We do not make any assumption about how these synthetic data have been generated e.g., they could be generated by either GAN-based, marginal-based, or workload-based methods. We evaluate the utility measures from the real data via a (Epost Opest DDP mechanism and denote their answers by a (a), .ax) ). Next, we present a systematic approach to post-process the synthetic data, aligning their utility with the (noisy) answers a.
Post-processing Private Synthetic Data
In this section, we present our main result: a post-processing procedure for improving the utility of a synthetic dataset. We formulate this problem an optimization problem that projects the probability distribution of the synthetic data onto a set of distributions that align the utility measures with the (noisy) real data. We prove that the optimal projected distribution can be expressed in closed form, which is an exponentially tilted distribution of the original synthetic data distribution. To compute the tilting parameters, resample from the synthetic data. By doing so, we filter out synthetic data that inaccurately represent the real data the selected set of utility measures.
introduce stochastic first-order method and leverage the tilting parameters to
We use Psyn and Prese to represent the (empirical) probability distribution the synthetic data and the generating distribution of post-processed data, respectively. We obtain the post-processed distribution

---

by "projecting" Paya onto the set of distributions that align with the real data utility measures up to 7 0:
min
DEL (Ppsssl pl Pyy))
(3a)
Ppnt
s.t. 9s (P (Poost) - aul S.y, AA [K].
(3b)
Here the "distance" between two probability distributions is measured using the KL-diivegeece.. Solving this problem directly suffers from the curse of dimensionality, as the number of variables grows exponentially with the number of features. Below, we leverage strong duality and prove that the optimal distribution post can be achieved by tilting Psnn and the tilting parameters can be obtained from a convex program. This approach involves fewer variables, making it more efficient and practical.
Theorem 1. If (3) is feasible, then its optimal solution has a closed-form expression:
Pp (x) xe Payn(2)) exp XE (q)(x) ax)
(4)
where the dual variables X (Xi, Xx) are the optimal solution of the following optimization:
an) -
min
log E ExmP
exp
Ax(
+
(5)
AER
(())
Theorem only requires the feasibility of (3). To ensure feasibility, we denoise the (noisy) answers computed from real data. This denoising step could also increase the accuracy of the released answers while preserving DP guarantees due to the post-processing property [BW18, LWK15]. Specifically, suppose that Dayn has S unique values. We denote the collection of these unique values by supp (Dsyn) {.1..... .ss).
We construct matrix Q R such that 2j.s = (z,)) and solve the following linear quadratic programs (see Appendix B for more details):
argmin PEAj |Qp all1.
if using Laplace mechanism,
p-
argmin pea. !lQpp all
if using Gaussian mechanism.
Here A
(p E 1' 1, > 0} is the interior of the probability simplex in R We obtain
denoised answers as a' = Qp = (ai ... ax)) Finally, if we solve (3) with a* instead, then guaranteed be feasible.
Although (5) is convex program, its form differs from the standard empirical risk minimization as the expected loss is composed with logarithmic function. Thus, one cannot directly apply stochastic gradient descent (SGD) to solve this problem as computing an unbiased (sub)-gradient estimator for (5) is challenging. Instead, we apply a stochastic compositional proximal gradient algorithm to solve (5). Note that the partial derivative of f in (5) has closed-form expression:
Dk 1 (x(gx(X) -x)) (g) - az)
0f 0x,-
Ex~P gm
exp
(A)
Ex-
exp
ΣK (x) ax))
We estimate this partial derivative by using a mini-bater -btch of data to calculate the expectations in numerator and denominator separately, and then computing their ratio. With this estimator, we can apply the stochastic proximal gradient algorithm [PB 14] to solve (5). Although this approach uses biased gradient estimator, it has favorable convergence guarantees [see e.g., WLF16, HZCH20). We provide more details about the updating rule in Algorithm 1.
After obtaining the optimal dual variables from Algorithm 1, we generate the post-processed dataset by resampling from the synthetic data with weights: -k A (q)(()) - ax)) for each point post in (4). As our approach only reweights synthetic data without altering their values, the quality of the data points is preserved and the support set of the overall dataset is not expanded. Moreover, numerical experiments
ar. This ensures that the resampled data follow the optimal distribution P=
5

---

Algorithm Dual variables computation.
Input: D {q:}==1 where 9, (gn (ar?") mini-batch index B, S [n]; step size ot
a1.... ; ;9 (x)
ax): maximal number of iterations T;
for == 1, , T do
Dual variables update:
K Ris
x(++1) ac7l-lll
1111
7(0)
a
Be
Σ
exp
T
for j [K]
iEtt
((411)
Σ
((+1)
exp
Qi.k
|Bt|
iEBi
end for Output: X
(741)
Function: prox.) (a) = sign(x) max [ax] ax, 0}
demonstrate that downstream predictive models trained the post-processed synthetic data can achieve comparable or even better performance on real data than those trained on the original synthetic data.
Finally, we establish a DP guarantee for the post-processing data. Since our algorithm only ac- cesses the real data when computing the utility measures, the composition rule yields the following proposition.
Proposition 1. Suppose the synthetic data are generated from any (c.8)-DP mechanism and the utility measures are evaluated from the real data from any (Epost: Spost DP DP mechanism. Then the post-processed data satisfy (e Epost: 5 + -DP.
So far, we have introduced general framework for post-processing synthetic data to improve their utility on selected measures. Next, we present a concrete use of our framework: aligning the correlation matrix. This can be achieved by choosing a specific set of utility measures in our framework.
Aligning the correlation matrix. The correlation matrix comprises the correlation coefficients between pairs of features and is commonly used by data scientists select features before fitting their predictive models. Aligning the correlation matrix of synthetic data with real data can assist data scientists in identifying the most suitable of features and developing more accurate model. Recall the definition of the correlation coefficient between features X, and X, for i, E [d]:
E X,X,)
E X E [X,)
corr(X, X,)
E [
- EX
X3] |
Since the correlation coefficient only depends on the first and second order moments, we can select the following set of (d + 3)d/2 queries as our utility measures:
2 {q. (x) 2; hee4 (x) x,r,his
Assume that each feature æ; is normalized and takes values within [0, 1]. As a result, the L, and L sensitivity of Q can be upper bounded:
(1) (d + 3)d
and A2(2) vd+
2n
V2n
We can compute these utility measures using the Laplace or Gaussian mechanism, denoise the answers, compute the optimal dual variables, and resample from the synthetic data.
4 Numerical Experiments
We now present numerical experiments to demonstrate the effectiveness of our post-processing algorithm. Our results show that this algorithm consistently improves the utility of the synthetic

---

data across multiple datasets and state-of- af--the-rt art privacy mechanisms. Additionally, it achieves this without degrading the performance of downstream models or statistical metries. We provide additional experimental results and implementation details in Appendix C.
Benchmark. We evaluate our algorithm on four benchmark datasets: Adult, Bank, Mushroom, and Shopping, which are from the UCI machine learning repository [DG17]. All the datasets have a target variable that can be used for downstream prediction task. We use four existing DP mechanisms- [MMSM22], MST [MMS21], DPCTGAN [RLP*20], and PATECTGAN [RLP*20]] 20] to generate private synthetic data. Among these DP mechanisms, AIM is a workload- MST a marginal-baser method; DPCTGAN and PATECTGAN are GAN-based methods. All of their implementations are from the OpenDP library [Sma23]. To demonstrate the scalability of our approach, we conduct an additional experiment on the home-credit dataset [MOK18]. This dataset has 307,511 data points and 104 features. We apply GEM [LVW21] to this high-dimensional dataset for generating synthetic data. We pre-process each dataset to convert categorical columns into numerical features and standardize all features to the range [0. 1].
method;
We clarify that our objective not to compare the quality of synthetic data generated by these DP mechanisms (for a benchmark evaluation, please refer to [TMH 21]). but to demonstrate how our post-pree post-procsssing method can consistently improve the utility of synthetic data generated from these different DP mechanisms.
Setup. We compare synthetic data produced by different privacy mechanisms with e E {2, 4] against the post-processce synthetic data that are generated by applying our post-processing technique with Spost = I to synthetic data generated from privacy mechanisms with e E [1.3}. For UCI datasets, we select features, including the target variable, from the synthetic data that have the highest absolute correlation with the target variable. These features are chosen as they have higher influence on downstream prediction tasks. The set of these features is denoted by S S [d]. Next, we define the utility measures as the first-order and second-order moment queries among the features in S:
Q = (x) = x; jiss U (x))(x) = Jujjs For home-credit dataset, we follow the same setup but choosing 10 features.
We apply the Gaussian mechanism with (Epost = 1, 6post 1//n)) estimate utility measures from the real data, where n denotes the number of real data points. Finally, we apply Algorithm I with ? = 1e- 5, batch size of 256 for UCI datasets and 4096 for home-credit, and 200 epochs to compute the optimal resampling weights, which are then used to resample from the synthetic data with the same sample size. We repeat our experiment times to obtain an error bar for each evaluation measure.
Evaluation measure. We provide evaluation metrics for assessing the quality of synthetic data after post-processing. Our first metric, utility improvement, is defined as:
1 error gorr D post)
where error = ||corr(Preal) corr(D)) for D E (Dposts D
error (D
The range of this metric is (-oo, 1], where value of 1 indicates a perfect alignment between the correlation matrix of the post-processed data and the real data.
To assess the downstream quality of synthetic data, we train predictive models using the synthetic data and then test their performance on real data. Specifically, we split the real data, using 80% for generating synthetic data and setting aside 20% to evaluate the performance of predictive models. We use the synthetic data to train a logistic regression classifier to predict the target variable based on other features. Then we apply this classifier to real data and calculate its Fl score. We use the function BinaryLogisticRegrsssio from SDMetrics library [Dat23] to implement this process.
We compute two statistical measures to quantify the similarity between synthetic and real data distributions. The first measure is the average Lensen-Shannon distance between the marginal distributions of synthetic and real data, which ranges from 0 (identical distribution) to 1 (totally different distributions). The second measure the average inverse KL.-divergence between the marginal distributions of synthetic and real data, which ranges from O (totally different distributions) (identical distribution). These statistical measures are implemented by using synthcity library [QCvdS23].
7

---

F] score
IS distance (marginal)
Inverse KL (marginal)
Daraset
DP Mechanism
Uniiiy Improw.
weo post-proe.
w/ post-pioc.
wio post-pme.
w/ post-pooe
w/o post-prne.
w/ post-proc.
Adolc
AIM
0.13 Looc
0.61
0.61 10.0
0.01
0. 0.100
0.99
10.0
NST
0.22 2002
0.55
0.56 g0.0
0.01
au.0
DECIGAN
0.81 +0.00
0.22
0.33 =0.02
0.07
0.03 #0,02
0.85
0.91 #0.0
PATECTGAN
0.6 #0.04
0.37
0.5 =0.03
0.01
0.01 #0.0
0.72
0.87 #0,0
Xushrooc
AIM
0.12 20.0
0.93
0.93 $0.0
0.01
#0.0
1
20.0
MST
0.58 #0.0
0.83
0.83 =0.02
0.01
=0.0
1
+0,0
DFCTGAM
0.69 20.04
0.47
0.68 =0.01
0.05
0.02 #0.0
0.83
0.92 #0.0
PATECTGAN
038 00:0
0.6
0.86 20.01
0.03
0:02 400
0.87
0.95 30.0
Shopper
ATM
0.1 1aoz
0.48 10.00
0:01
0.84
0.92 10.0
NST
0,5 2302
0.47 20.0
0.01
0.99
a0.0
DECTOAM
#0,06
0.27
0.3 =0.02
0.03
=0.0
0.74
#0.0
PATECTGAN
10.0
0.25
10.00
0.01 ino
10.0
AIM
00.00
0.46 20.01
0.04
0.02 #0.0
0.83
0.9 20.0
NST
#0.02
=0.02
0.02
=0.0
0.98
10.0
DECTOAM
0.2 #0.00
0.22
0.24 =0.07
0.04
#0.01
0.71
#0.0
PATRCTGGN
0.25 10/00
0.23
0.03
40000
0.83
0.9
Table 1: We compare synthetic data generated without and with our post-processing technique, all under the same privacy budget e = 2. We demonstrate utility improvement (higher is better, positive numbers imply improvement) and F1 score for downstream models trained on synthetic data and tested on real data. For reference, when training the same downstream model using real data, the F1 scores are: (Adult, 0.61), (Mushroom, 0.95). (Shopper, 0.54), and (Bank, 0.47). Additionally, we measure the average densen-Shannos (JS) distance between the marginal distributions of synthetic totally different distributions) and the average inverse KL-divergence (0: totally different distributions; I: identical distribution). As shown, our technique consistently improves the utility of the synthetic data across all datasets and all DP mechanisms without degrading the performance of downstream models or statistical metrics.
and real data (0: identical distribution;
DP Mechanism
Uiility
Fl score w/o post-proc.
El score w/ post-proe.
JS distance
IS distance
Inverse KI. w/o post-proc.
Invense KI. w/ post-pree.
Improv.
w/o post-proc.
w/ post-pree.
GBN
0.57 20.03
0.19
0.19 20.02
0.01
0.01 10.0
0.93
0.97 10.01
GEN, 0.68 20.01
0.21
0.21 20.01
0.01
0.01
0.95
0.99 20.01
Table 2: Experimental results on the home-credit dataset. We compare synthetic data produced by GEM with E {2, 4} against the post-processed synthetic data that are generated by applying our post-processing technique with Epost 1 to synthetic data generated from GEM with e E {1,3). For reference, the downstream model trained and tested on real data has an Fl score of 0.24.
Result. We present the experimental results on the UCI datasets in Table 1 (and Table 3 in Ap- pendix with a higher privacy budget). We report utility improvement, Fl score, and staristical measures. As shown, our post-processing technique consistently enhances the utility of synthetic data on selected metrics across all benchmark datasets and all privacy mechanisms. Moreover, the utility improvements are achieved without degrading the performance of downstream models or statistical properties of synthetic data. In other words, our post- post-proesssig procedure ensures that the logistic regression classifier trained on synthetic data can achieve comparable even higher performance on real test data, while simultancously reducing or maintaining the statistical divergences between synthetic and real data.
We present the experimental results on the home-credit dataset in Table and illustrate the misalignment of the correlation matrix with and without applying our post-processing procedure in Figure 1. The results demonstrate that our algorithm consistently reduces the overall correlation misalignment. Additionally, our procedure, which includes computing the utility measures from real data, denoising the noisy answers, and computing optimal resampling weights, only takes around mins on 1x NVIDIA GeForce RTX 3090 GPU.
8

---

Without post-proc
With post-proc
FLAG DOCUMENT 6
0.00
0.00
0.060
DAYS BIRTH
0.00
0.06
0.03
0.00
0.00
0.01
REC_CITY NOT_LIVECITT
0.00
0.02
0.00
0.01
0.00
0.03
WWL_CITLNOOT COTT_NOTTWWRRRCCCCCO CIIY
0.00
0.02
0.00
0.00
0.02
1.00
0.00
0.00
0.00 0.00
EWAG_EMP, EMP, PHONE
0.00
0.01
0.01
0.03
0.01 0.01
0.00
0.01
0.00
0.02
0.00 0.01
0.030
REGION_RATING, SATTINGCCLENTWW.CCM
0.02
0.00
0.00
0.00 0.00
REGION RATING, CLIENT
0.00
0.03
0.01
0.02
0.01
0.01
0.01 0.01
0.00 0.02 0.00 0.00 0.00 0.01
0.00 0.00
0.015
CCTYCCYY NOT, WORK
0.00
0.1 0.00
0.00
0.02
0.00 0.00 0.00 0.00
TANGET
0.02
000 od 0.81 0.02 11.00 0.03 00 0.81
0.00 0.00 o.0 0.00 8.00 n.00 0.00 d.11 10.00 0.03
0.000
TARGET
Rec, LoTry N...
REGION Pett...
REDION PAT...
RLAG. tup P
UvV_eITv city
BEG, CITY g..
DAvS BATH
RLAG, cocuM...
RLAG, DecuM...
TARGET
NEO, ciTy N
MESION Pat
REGION RAT...
RLAG, eup P..
UiVE CiTY... ..
MeG CITY N
DAYS BRTH
RLAG Docume...
RLAG DOCUM...
Figure 1: Correlation matrix misalignment with and without applying our post- post-processing procedure. Left: absolute difference between the real and synthetic data correlation matrices. Right: absolute difference between the real and post-procet post-processed synthetic data correlation matrices. As shown, our procedure effectively aligns the correlation matrix of the synthetic data with that of the real data.
Conclusion and Limitations
The use of private synthetic data allows for data sharing without compromising individuals' private information. In practice, end users typically have specific requirements that the synthetic data must meet, which are often derived from their standard data science pipeline. Failure meet these requirements can diminish the usefulness of the synthetic data. To address this issue, we introduce theoretically-gren groundedr post-processing procedure for improving a synthetic dataset's utility on a selected set of measures. This procedure filters out samples that do not accurately reflect the real data, while still maintaining DP guarantees. We also present scalable algorithm for computing resampling weights and demonstrate its effectiveness through extensive experiments.
We believe there is crucial need for future research to comprehend the capabilities and limitations of private synthetic data from various perspectives [see e.g., JSH 22, GODC22, BDI+23, for further discussions]. It should be noted that synthetic data generation is not intended replace real data, and any model trained on synthetic data must be thoroughly evaluated before deployment on real data. In cases ML model trained on synthetic data exhibits algorithmic bias upon deployment on real data, it becomes imperative to identify the source of bias and repair the model by querying the real data with privacy mechanism.
When generating synthetic data using DP mechanisms, outliers may receive higher noise, which can have greater impact on minority groups Consequently, ML models trained DP-synthetic data by downstream users may demonstrate a disparate impact when deployed on real data [GODC22]. This is true even when using fairness- interventooonnn algorithms [HCZ+ 22] during model training because the synthetic data follows a different probability distribution than real data. One can potentially apply our post-processing techniques resample synthetic data and eliminate samples that do not reflect the underlying distribution of the population groups, while ensuring sample diversity. By doing so, they can achieve higher aacness-accuracy curve when deploying downstream ML. models trained on the pest-processed synthetic data on real data.
Another promising avenue of research is to investigate the data structure in cases where user or a company can provide multiple records to the dataset. Financial data, for instance, is typically collected over time and presented as a time series. While is possible combine all of user's data into a single row, this approach can lead to an unmanageably unbounded feature domain and limit the effectiveness of the synthetic data. Therefore, it is worthwhile to explore other privacy notions [see e.g., ZXLZ14, DWCS19, LSA+21] and develop strategies for optimizing higher privacy-utility trade-offs under special data structures.

---

Acknowledgement
H. Wang would like to thank Rui Gao (UT Austin) for his valuable imput in the early stage of this project.
References
[ABK+21] Sergul Aydore, William Brown, Michael Kearns, Krishnaram Kenthapadi, Luca Melis, Aaron Roth, and Ankit A Siva. Differentially private query release through adaptive projection. In International Conference Machine Learning, pages 457-467. PMLR, 2021.
[Abo18] John M Abowd. The US census bureau adopts differential privacy. In ACM SIGKDD International Conference Knowledge Discovery & Data Mining, pages 2867-2867, 2018.
[AH] 22] Wael Alghamdi, Hsiang Hsu, Haewon Jeong, Hao Wang, Peter Michalak, Shahab Asoodeh, and Flavio Calmon. Beyond adult and compas: Fair multi-class prediction via information projection. Advances in Neural Information Processing Systems, 35:38747-38760, 2022.
[App17] Apple. Learning with privacy at scale. https://machhnelearniin apple com/ researchhlearming with witth--prvcayc-t----aiiee 2017.
[AZK* + 19] Nazmiye Ceren Abay, Yan Zhou, Murat Kantarcioglu, Bhavani Thuraisingham, and Latanya Sweeney. Privacy preserving synthetic data release using deep learning. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2018, Dublin, Ireland, September 10-14, 2018, Proceedings, Part 18, pages 510-526. Springer, 2019.
[BDI+23] Brian Belgodere, Pierre Dognin, Adam Ivankay, Igor Melnyk, Youssef Mroueh, Alek- sandra Mojsilovic, Jiri Navartil, Apoorva Nitsure, Inkit Padhi, Mattia Rigotti, Jerret Ross, Yair Schiff, Radhika Vedpathak, and Richard Young. Auditing and generating synthetic data with controllable trust trade-offs. arXiv preprint arXhv:2304.108/ 2023.
[BJWW+ 19] Brett K Beaulieu-Jones Zhiwei Steven Wu, Chris Williams, Ran Lee, Sanjeev Bhavnani, James Brian Byrd, and Casey Greene. Privacy-preserving generative deep neural networks support clinical data sharing. Circulation: Cardiovascular Quality and Outcomes, 12(7):0005122. 2019.
[BLR13] Avrim Blum, Katrina Ligett, and Aaron Roth. learning theory approach to noninter- active database privacy. Journal of the ACM (JACM), 60(2): 1-25, 2013.
[BSG17] Vincent Bindschaedler, Reza Shokri, and Carl A Gunter. Plausible deniability for privacy-preserving data synthesis. arXiv preprint arXiv:1708.0797. 2017.
[BSV22] March Boedihardjo, Thomas Strohmer, and Roman Vershynin. Privacy of synthetic data: statistical framework. IEEE Transactions on Information Theory, 69(1):520- 527, 2022.
[BV04] Stephen P Boyd and Lieven Vandenberghe. Convex optimization, Cambridge university press, 2004.
[BW18] Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference Machine Learning, pages 403. PMLR, 2018.
[Con18] Nicholas Confessore. Cambridge Analytica and Facebook: The scandal and the fallout far. The New York Times, 2018
[Csi75] Imre Csiszár, I-divergence geometry of probability distributions and minimization problems. The Annals of Probability, pages 146-158, 1975.
10

---

[Csi84] Imre Csiszár. Sanov property, generalized I-rojecction and conditional limit theorem.
The Annals of Probability, pages 768-793, 1984.
[CXZX15] Rui Chen, Qian Xiao, Yu Zhang, and Jianliang Xu. Differentially private high- dimensional data publication via sampling-bases inference. In ACM SIGKDD in- ternational conference on knowledge discovery and data mining, pages 129-138, 2015.
[Dat23] DataCebo. Synthetic data metries. https:///ooe adv wetpssdvvdddvvv... wwt.d///eeeeeriaa.aaaaa 2023.
[DG17] Dheeru Dua and Casey Graff. UCI machine learning repository, http://archive ics uci. edu/m1, 2017.
[DR14] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends@ Theoretical Computer Science, 9(3-4):21 1-407, 2014.
[DRV10] Cynthia Dwork, Guy N Rothblum, and Salil Vadhan. Boosting and differential privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science, pages 51-60, 2010.
[DWCS19] Mario Diaz, Hao Wang. Flavio P Calmon, and Lalitha Sankar. On the robustness of information-theorett privacy measures and mechanisms. IEEE Transactions on Information Theory, 66(4):1949-197) 2019.
[DZ96] Amir Dembo and Ofer Zeitouni. Refinements of the Gibbs conditioning principle. Probability Theory and Related Fields, 104:1-14, 1996.
[Fac20] Facebook AI. Introducing Opacus: A high-speed library for training Py- Torch models with differential privacy. https://ai facebook. com/blog/ wawpaun---ppuuuua-hha-aaa-- wwddba-wth--ddffferttill-pppi-ie 2020.
[GAH+ 14] Marco Gaboardi, Emilio Jesús Gallego Arias, Justin Hsu, Aaron Roth, and Zhi- wei Steven Wu. Dual query: Practical private query release for high dimensional data. In International Conference on Machine Learning, pages 1170-1178, PMLR, 2014.
[GMH120) Chang Ge, Shubhankar Mohapatra, Xi He, and lhab llyas. Kamino: Constraint-aware differentially private data synthesis. arXiv preprint axXiv:20/2.15713. 2020.
[GODC22] Georgi Ganev, Bristena Oprisanu, and Emiliano De Cristofaro. Robin Hood and Matthew effects: Differential privacy has disparate impact on synthetic data. In International Conference on Machine Learning, pages 6944-699 6959.. PMLR, 2022.
[HBMAL19] Naoise Holohan, Stefano Braghin, Pól Mac Aonghusa, and Killian Levacher. Diff- privlib: the IBM differential privacy library. arXiv preprint arXiv:
arXiv:/907.024444 0eti//977004444 2019.
[HCZ+22] Max Hort, Zhenpeng Chen, Jie M Zhang, Federica Sarro, and Mark Harman. Bias mitigation for machine learning classifiers: A comprehensive survey. arXiv preprint arXiv:2207.0700 2022.
[LMM1] Moritz Hardt, Katrina Ligett, and Frank McSherry, A simple and practical algorithm for differentially private data release. Advances in neural information processing systems, 25, 2012.
[HZCH20) Yifan Hu, Siqi Zhang, Xin Chen, and Niao He. Biased stochastic first-order methods for conditional stochastic optimization and applications meta learning. Advances in Neural Information Processing Systems, 33:2759 2020.
[BM23]] IBM Research. Synderella. https://research: ibm. cwm/ com/projects/ synderella, 2023.
[JSH+22] James Jordon, Lukasz Szpruch, Florimond Houssiau, Mirko Bottarelli, Giovanni Cherubin, Carsten Maple, Samuel Cohen, and Adrian Weller. Synthetic data-what, why and how? arXiv preprint arXiv:2205.33257 2022.

---

[JYVDS19] James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International conference on learning representations, 2019.
[KOV15] Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In International Conference on Machine Learning, pages 1376-1385. PMLR, 2015.
[LSA+21] Daniel Levy, Ziteng Sun, Kareem Amin, Satyen Kale, Alex Kulesza, Mehryar Mohri, and Ananda Theertha Suresh. Learning with user-level privacy. Advances in Neural Information Processing Systems, 34:12466-12479 2021.
[LVS*21] 21] Terrance Liu, Giuseppe Vietri, Thomas Steinke, Jonathan Ullman, and Steven Wu. Leveraging public data for practical private query release. In International Conference on Machine Learning, pages
PMLR, 2021.
[LVW21] Terrance Liu, Giuseppe Vietri, and Steven Z Wu. Iterative methods for private syn- thetic data: Unifying framework and new methods. Advances in Neural Information Processing Systems, 34:690-702, 2021.
[LWK15] Jaewoo Lee, Yue Wang, and Daniel Kifer. Maximum likelihood postprocessing for differential privacy under consistency constraints. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 635-644, 2015.
[MMS21] Ryan McKenna, Gerome Miklau, and Daniel Sheldon. Winning the NIST contest: A scalable and general approach differentially private synthetic data. arXiv preprint arXiv:2108. 04470:2,0 2021.
[MMSM22] Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. Aim: An adaptive and iterative mechanism for differentially private synthetic data. arXiv preprint arXiv: 12677, 2022.
[MOK18] Anna Montoya, Kirill Odintsov, and Martin Kotek. Home credit default risk. https: //kaggle. wotpgggee.ccooeeooooo wwooppeeitii wiioss/oome-eeeeeeeeeeeeoooeeeee http://ommeerrrdtt-eeeeeeeeeeeee dewtttt-fefuuttt-reeeeeee 2018.
[MSM19] Ryan McKenna, Daniel Sheldon, and Gerome Miklau. Graphical-model based estima- tion and inference for differential privacy. In International Conference on Machine Learning, pages 4435 4444. PMLR, 2019.
[NS06] Arvind Narayanan and Vitaly Shmatikov. How to break anonymity of the Netflix prize dataset. arXiv preprint cs/0610105, 2006.
[NWD20] Mareel Neunhoeffer, Zhiwei Steven Wu, and Cynthia Dwork. Private post-gan boosting. arXiv preprint arXiv:2007. /934, 2020.
[PB14] Neal Parikh and Stephen Boyd. Proximal algorithms. Foundations and trends0 in Optimization, 1(3):177-239, 2014.
[QCvdS23] Zhaozhi Qian, Bogdan-Constanie Cebere, and Mihaela van der Schaar. Synthcity: facilitating innovative use cases of synthetic data in different data modalities. https: // //arxiv. httrg/aab/3331.10 07730...777.... 2023.
[RE19] Carey Radebaugh and Ulfar Erlingsson. Introducing TensorFlow privacy: Learning with differential privacy for training data. https://blog tensorfle foasrrrloww..oooo org/2019// 03/ fe/introduciing-i wewpttiiiinnntssrfoloooooo www.oorwwwwwricccc-oooooo
html, 2019.
[RLP 20] Lucas Rosenblatt, Xiaoyan Liu, Samira Pouyanfar, Eduardo de Leon, Anuj Desai, and Joshua Allen. Differentially private synthetic data: Applied evaluations and enhancements. arXiv preprint 10Xi:20011005533 2020.
[RTMT21] Diane Ridgeway, Mary F Theofanos. Terese W Manley, and Christine Task. Chal- lenge design and lessons learned from the 2018 differential privacy challenges. NIST Technical Note 2151, 2021.
12

---

[Sma23] SmartNoise. Smartnoise sdk: Tools for differential privacy on tabular data. https: wwtp:lt/doooo////o//oaacc hwt.//pppnnaarrreeeeeeee swwammmiisteeeeeeeeeeeeeeeeeeeee 2023.
//github. com/
[TMH* Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. arXiv preprint arXiv:2112.092.38, 2021.
[TWB* + 19] Uthaipon Tantipongpipat, Chris Waites, Digvijay Boob, Amaresh Ankit Siva, and Rachel Cummings. Differentially private mixed-type data generation for unsupervised learning. arXiv preprint arXiv:1912.03255,
1:13, 2019.
[UV20] Jonathan Ullman and Salil Vadhan. PCPs and the hardness of generating synthetic data. Journal of Cryptology, 3374)2207--2112, 2020.
N2A+22] Giuseppe Vietri, Cedric Archambeau, Sergul Aydore, William Brown, Michael Kearns, Aaron Roth, Ankit Siva, Shuai Tang. and Steven Z. Wu. Private synthetic data for multitask learning and marginal queries. Advances Neural Information Processing Systems, 15:18282-18295 2022.
[VTB +20 Giuseppe Vietri, Grace Tian, Mark Bun. Thomas Steinke, and Steven Wu. New oracle- efficient algorithms for private synthetic data release. In International Conference on Machine Learning, pages 9765 9774. PMLR, 2020.
[WLF16] Mengdi Wang, Ji Liu, and Ethan Fang. Accelerating stochastic composition optimiza- tion. Advances in Neural Information Processing Systems, 29, 2016.
[XLW 18] Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint 1rXivv1802..6111 06009, 2018
[ZCP+ 17] Jun Zhang, Graham Cormode, Cecilia Procopiue, Divesh Srivastava, and Xiaokui Xiao. PrivBayes: Private data release via Bayesian networks. ACM Transactions Database Systems (TODS), 42(4): 1-41, 2017.
[ZXLZ14] Tianqing Zhu, Ping Xiong, Gang Li, and Wanlei Zhou. Correlated differential privacy: Hiding information in non-IID data IEEE Transactions Information Forensics and Security, 10(2):229-22) 242, 2014.
13

---

A Omitted Proofs
A.1 Proof of Theorem
Recall that Slater's condition a sufficient condition for ensuring strong duality in the context of convex program [see Section 5.2.3 in BV04J: it states that strong duality holds for convex program there exists a strictly feasible solution (i.c., a solution that satisfies all constraints and ensures that nonlinear constraints are satisfied with strict inequalities).
Proof. Since (3) only has linear constraints and is feasible, Slater's condition holds. Recall that Psyn represents the empirical distribution of the synthetic data, supported on X. Without loss of generality, we assume X' a finite set and denote p & (z)) and pd - (Psy(())) where pæ & (x)) syn _ Payn(x). For each query, we denote (9x(x)) Now we introduce the dual variables A+ (AT.... x and - (AT Ax) Then the Lagrangian function of (3) can be written as
Lpp post X PP)
post
K
post
log syn P
- + μ (17 100p01111
Σ
X
p
pappitt ak -7) + (- post + okk 7)
MEX
The Lagrangian function is strictly convex w.r.t. p so it has unique solution if exists. We compute the partial derivative w.r.t. prose and set be zero:
aL(p A A
Op
post
log
P
Pz
post
syn
1
K
(At
X )4k. O.
(6)
k=1
We denote A Xt x
Then (6) yields closed-form expression of the optimal solution:
K
post,
exp
A
11"
1=1
Substitute this optimal solution into the Lagrangian function and rewrite it as
L POSt A+
A,,,A ())
K
K
Σ post,
AnTre x - - -M +
Σ
post,
A a post, +
xEX
k=1
k=
mE
Σ postt
+
#EX
K Aa
Σ sEX
Pe exp
11 / +...
where we omit the terms that do not depend on Therefore, the that maximizes L(ppa, A ,,,'", (4) satisfies:
Σr
2 exp
Auyke 11¹ - 0.
ΦEAt
We simplify the above expression and obtain
exp (1 + n²)
Σ
syn
exp
Ak
æEN
Now substitute μ² into the Lagrangian function and get
K
K
Lppood, A+ x- x²p²) = 10--lp log Σ
exp
Au
-E axdx -
(1 >
x7).
m
mEN
k=l
k=
14

---

Note that the (A* 2 otherwise, we can replace them with
that maximizes L(p , ' v²) must satisfy X x since,
(A min ( AB J.A. A min (A }1
and the Lagrangian function increases. Hence, we have |All1 Ex= (AF simplify the Lagrangian function:
1.")). Now
K Ablle
K
Lpp xt A ,
= log
Σ
P
exp
Σ
ak - >11AA111
xE
k=1
Ao- (X) 11)
loo
E
exp
axdx
7111111
k=1
k=
K
As (qx - axk) )])
log
E
Exp
Σ
- >/1
Finally, rewrite the optimal primal solution
ppesi. (xx) x (xx exp
(2)
x p.d (x) exp
Xg -xx)
B More Details on Algorithm Implementation
Denoising output from Laplace mechanism. For given matrix Q E KxS and vector a E R.K we can denoise the outputs from Laplace mechanism by solving linear program (LP):
p' argmin
1p a/l1
A
argmin 1't
pER
Qp S
Qp - 2 -t
1"p=1
p> 0.
Denoising output from Gaussian mechanism. For given matrix k and vector E RK, we can solve the following quadratic program to denoise the outputs from Gaussian mechanism:
p = argmin
- 1pp 2
all
PEaj
Implementing Algorithm in log-domain. Recall that we introduced stochastic first-order method for computing the dual variables in Algorithm 1. To avoid underflow and overflow problems, we use log-domain computations to implement this algorithm. The details are included in Algorithm
C Additional Experimental Results
In Table 3, we reproduce our experiment in Table 1 with higher privacy budget. Our observation is consistent with prior experimental results: our post-processing technique consistently enhances the utility of synthetic data on selected metries across all benchmark datasets and all privacy mechanisms.
15

---

Algorithm 2 Dual variables computation in log scale.
Input: = { k== where 7. = (gi (x.) - 01, : (x,) - ox); maximal number of iterations T;
mini-batch index 8 C [n]; step step size oz
for t= 1,... T do
Dual variables update (in log-scale):
u((+1) exp proxocsil-lh
log
(1/²)=
at
K
u
( a..e) 9.. ))
for j E [K]
-(1)
[Bal
KEB, Am
(++1)
II
B
iEB
1m1
end for Output: (T++1 log(11(7+1))
Function: prox,|-1, (x) = sign(x) max [2]|
0}
F1 score
18 diszance (marginal)
Inverse Kl. (marginal)
Daraset
DP Mechanism
Unilty Impcov.
wlo post-prac.
w/ post-proc.
wio post proc.
w/ post-proc.
w/o post-prnc.
w/ prot-pracc
Adolt
AIM
0.29 20.04
0.61
0.61 20.0
0.01
0 0.000
0.99
$0.00
MST
0.1 +0.00
0.55
0.55 =0.0
0.01
#0.0
=0,0
DECTGAN
0,52 #0.00
0.56
0.58 20.03
0,07
0.02 =0.0
0.81
0.87 #0.0
PATECTGAN
0.7 20:01
0.16
0.49 20.01
B00
0.01 2000
0.88
0.93 30.0
Mushreea
AIM
0,28 =0.0
0.93
0.95 =0.0
0.01
#0.01
0.96
=0,0
NS7
0.55 =0.0
0.83
0.84 20.0
0.11
#0.0
10.0
DPCTCAN
0.74 10:1
0.61
0.73 10.00
0.07
0.02 100
0.72
0.85 ....
PATECTGAN
0.8 1000
0.29
0.78 10.0
0.02
0.01 1.0
0.94
0.99 10.0
Shopper
AIN
0.17 20.00
0.5
0.5 =0.0
0.01
0.01 #0.
0.89
0.97 $0.0
MST
0.47 =0.01
0.47
0.52 =0.0
0.01
40.0
0.98
=0.0
DPCIGAM
0.1 43.00
0.19
0.25 #0.01
0.06
0.02 #0.01
0.89 =0.0
PATECTGAAN
10.00
0.26 20.05
400
0.83
0.96 16.002
Dank
AIM
0.21 +0.06
0.47
0.17 =0.0
0.02
0.02 =0.0
0.93
0.98 #0.0
MS7
0.21 +0,00
0.41
0.44 20.0
001
0.00
0.98
20.0
DPCTGAM
10r0
10.00
100
16.0
10.00
Table We compare synthetic data generated without and with our post-processing technique, all under the same privacy budget = 4.
16


Reviews:
[{"review_id": "lP74YQ1mVU", "reviewer": "Reviewer_SorM", "summary": "The paper under review introduces a technique aimed at enhancing the quality of differentially private synthetic data. Specifically, this approach is applicable when a private synthetic data set, generated by any available privacy-preserving mechanism, does not align with the original data set on certain key measures or queries. The proposed solution involves adjusting the weights of synthetic data samples to ensure their alignment with the original data based on the specified objective. The paper specifically applies this technique to post-process synthetic data such that the resultant synthetic data aligns with the true data's correlation matrix.\n\nThe proposed algorithm commences by estimating the empirical correlation matrix using the Gaussian mechanism with privacy parameters epsilon=1 and epsilon=3. This involves the addition of independent Gaussian noise to each entry of the correlation matrix. Subsequently, the algorithm resolves a convex optimization problem using a first-order method to determine the optimal sample weights that best conform to the noisy correlation matrix.\nThe research findings demonstrate that the post-processed synthetic data offers a more accurate approximation of the correlation matrix compared to the original synthetic data (prior to the reweighting operation), thereby underscoring the effectiveness of the proposed method.\n", "questions": "Why was the algorithm GEM only used for the home-credit dataset ?\nWhat is the effect of the post-processes dataset on the measures that the original data was optimized for? That is, does the utility degrade?\nHow does the quality of the original synthetic data affect the absolute performance of the post-process synthetic data ? ", "limitations": "Yes", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 1, "strengths": "The idea of post-processing synthetic data presented in this paper is a compelling approach that boasts potential applicability to a multitude of problems. While the primary objective here is the alignment of pair-wise correlations within the data, theoretically, the objective could be a more intricate query that existing synthetic data methods are not designed to tackle.\n", "weaknesses": "In terms of originality, the proposed solution bears similarity to the Private Entropy Projection (PEP) mechanism referenced in [LVW21]. The PEP mechanism functions over the entirety of the data domain, assumed to be sufficiently small for its computational limitations. Nevertheless, it could, in theory, operate over any support, including samples from synthetic datasets, as suggested in this paper. Thus, it would be advantageous to explain the distinctions between these methods. Further, if they indeed differ, the paper should clarify why the PEP method is ill-suited for addressing the problem at hand.\n\nRegarding the experimental setup, it appears to have some potential flaws. The paper compares the utility of a synthetic dataset D_syn, presumably generated using an original privacy budget (termed epsilon_original), with the utility of a post-processed dataset D_post, created with an additional privacy budget of epsilon=1. Consequently, the post-processed dataset D_post possesses less privacy than the pre-processed D_syn. Hence, it remains ambiguous whether the superiority of D_post over D_syn can be attributed to the proposed resampling method or merely to the fact that a larger privacy budget was utilized to generate D_post. A more transparent comparison would involve assessing the utility of D_post against a synthetic dataset generated using a budget of (epsilon_original + 1).\n\nLastly, while the post-processing operation enhances the synthetic data in relation to the correlation matrix, it remains uncertain whether this operation compromises other essential data properties. For instance, if the original synthetic data was trained on 3-way marginals, the post-processing step could cause a deviation from these queries, thus leading to a poorer approximation. This possibility could account for the machine learning results in Figure 1, where the post-processed dataset exhibits a lower F1 score under certain conditions.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thoughtful review and for appreciating the merits of the work!\n\n---------\n**Q1. Comparison with PEP in [LVW21].**\n\nA1. Thank you for highlighting this comparison. In contrast to PEP in [LVW21], our proposed solution offers several enhancements.\n\nFirst, it is important to note that their Algorithm 4, an implementation of PEP outlined in the appendix, only applies when $\\gamma=0$. The extension of this algorithm to accommodate a general non-negative violation tolerance, i.e., $\\gamma \\geq 0$, is not straightforward. In contrast, we introduced a stochastic compositional proximal gradient algorithm (Algorithm 1 in our paper) that is applicable to any general non-negative violation tolerance. From our numerical experiments, we have observed that setting gamma to be a small positive number (for example, $\\gamma = 1e-5$ in all our setups) consistently outperforms when $\\gamma = 0$.\n\nSecond, note that PEP is designed to find an optimal solution to a regularized constraint optimization problem (Eq. 8 in their appendix). However, due to the Laplace/Gaussian noise introduced to the measurements, this problem may prove to be infeasible. Despite the authors' claim in Appendix C.2 that their algorithm can still be executed even if Equation 8 is infeasible, solving the dual optimization under this circumstance may not yield a satisfactory primal solution. In contrast, our approach is to first denoise the noisy measurements prior to running our algorithm. By doing this, we can consistently guarantee the feasibility of the constraint optimization problem (Eq. 3 in our paper). Furthermore, this denoising step could augment the accuracy of our proposed solution since it can be perceived as identifying the maximum likelihood estimation of the utility measures of interest.\n\nFinally, we wish to highlight the originality of both the challenges we tackled in this study—incorporating end-user requirements into the data generation pipeline—and our proposed solution—a post-processing pipeline to enhance the utility of synthetic data. These subjects have not been explored in any previous research.\n\n\n\n---------\n**Q2. Experimental setup appears to have some potential flaws.**\n\nA2. In response to your comments, we have conducted an additional experiment under the setup you suggested: comparing the utility of synthetic data produced by privacy mechanisms with a privacy budget of $\\epsilon_{original} + 1$, against the post-processed synthetic data that was generated by applying our post-processing technique (with a privacy budget of $1$) to synthetic data generated from privacy mechanisms with a privacy budget of $\\epsilon_{original}$.  Please refer to the PDF we submitted in the global response for more details. \n\n\nIn short, our observations are in line with prior experiments, confirming that our algorithm consistently enhances the utility of synthetic data on selected measures.\n\nThe reasoning behind our initial experimental setup stems from the observation that increasing the privacy budget in synthetic data generation mechanisms *does not* necessarily enhance the quality of the synthetic data, even when averaged over multiple trials. The metrics we considered in this quality assessment include utility measures of interest, downstream performance, and statistical measures. We conjecture this incongruity arises from the random noise injected into the data generation process to ensure DP guarantees. Therefore, even without employing our post-processing algorithm, synthetic data generated from a lower privacy budget may surpass data produced with a higher privacy budget in terms of their overall quality. Our initial experimental setup enabled us to eliminate this potential issue. As a result, we concluded that our post-processing algorithm can consistently enhance the utility of the synthetic data on selected measures, despite requiring a small privacy budget (see lines 45–46 and 53–55).\n\n\n\n\n---------\n**Q3. Whether post-processing compromises other essential data properties.**\n\nA3. Indeed, this is a great point. In response to your concerns, we have incorporated two statistical metrics (average inverse of KL-divergence and Jensen-Shannon distance) along with the F-1 score to evaluate the quality of synthetic data. These metrics are implemented by using synthcity, which is a python package for generating and evaluating synthetic tabular data. As shown, our post-processing algorithm consistently enhances the selected utility measures without compromising either statistical parameters or downstream performance measures.\n\n---------\n**Q4. GEM model and other experimental results**\n\nA4. Due to GEM not being included in the opendp package, we omitted it from Table 1 out of concern that comparing GEM with other mechanisms, processed under different data pre-processing pipelines, may lead to misleading conclusions.\n\nIn response to your other comments, note that the workloads of AIM include all one-way and two-way marginals. The utility measures presented in Table 1 are based on first-order and second-order moments, which are functions of the workloads in AIM, and our post-processing algorithm continues to yield utility improvements across all datasets.\n\nWe observed that the poorer the quality of the synthetic data, the greater the enhancement of quality through our post-processing algorithms. More specifically, we've seen that marginal-based mechanisms typically outperform DP-SGD-based mechanisms (please refer to the raw F1 scores reported in Table 1 and 2 in our global response). As shown in these two tables, our post-processing algorithms tend to yield more substantial utility enhancements for DP-SGD-based mechanisms."}, {"review_id": "FL3UbR2Llt", "reviewer": "Reviewer_zgZz", "summary": "The paper introduces a post-processing technique that enhances the utility of synthetic DP data with respect to selected measures. \nThe proposed technique involves resampling from the synthetic data to filter out samples that do not meet the selected utility measures, using a stochastic first-order algorithm to find optimal resampling weights. ", "questions": "- Could you elaborate on the computational complexity of the proposed post-processing technique? How does it compare to the complexity of existing synthetic data generation algorithms?\n\n- How does the proposed technique handle high-dimensional data? Are there any limitations or challenges in this regard?\n\n- Could you provide additional examples to illustrate the practical applications and benefits of the proposed technique?", "limitations": "See my questions above. \n", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "Strengths:\n\n- The post-processing technique discussed appears to be novel and significant.\n\n- The method is model-agnostic. This makes the technique highly versatile.\n\n- The authors provide a good set of numerical experiments to validate their approach. These results are strong and show improvements across multiple benchmark datasets and synthetic data generation algorithms.\n\n- The paper is well-structured and the methodology is clearly explained.\n", "weaknesses": "Weaknesses:\n\n- The paper could benefit from a more detailed discussion on the trade-offs involved in using the proposed post-processing technique. For instance, it would be helpful to understand the impact of the technique on the computational complexity of the data synthesis process.\n\n- The authors could provide more examples or case studies to illustrate the practical applications and benefits of their proposed technique, beside the correlation example illustrated.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the kind comments and the encouragement!\n\n---------\n**Q1. More detailed discussion on the trade-offs involved in using the proposed post-processing technique and the impact of the technique on the computational complexity of the data synthesis process.**\n\nA1. That’s a great suggestion! Indeed, scalability is a key feature of our proposed technique. To be precise, our Algorithm 1 requires a computational cost of $O(bKT)$ where $b$ denotes the mini-batch size, $K$ denotes the number of utility measures of interest, and $T$ denotes the number of iterations. Note that this computational cost is independent with the number of features or the number of synthetic data. In contrast, some existing approaches do not scale to high-dimensional data. For example, they need to solve an integer program multiple times [Vietri etal., 2020] or need to solve a large-scale optimization problem whose complexity depends on the number of synthetic data to generate  [Aydore etal., 2021]. Please also refer to our response to your Q4 for further details on how our algorithm scales on a large-scale real-world dataset.\n\n—Vietri, G., Tian, G., Bun, M., Steinke, T. and Wu, S., 2020. New oracle-efficient algorithms for private synthetic data release.\n\n—Aydore, S., Brown, W., Kearns, M., Kenthapadi, K., Melis, L., Roth, A. and Siva, A.A., 2021. Differentially private query release through adaptive projection. \n\n\n---------\n**Q2. Practical applications and benefits of their proposed technique, beside the correlation example illustrated.**\n\nA2. Thank you for your valuable suggestion. Yes, our proposed method can be expanded for use in many other applications, not limited to correlation alignment. For instance, it can be applied to mitigate data biases while ensuring the DP guarantees of resampled synthetic data.\nDuring the generation of private synthetic data, outliers may end up receiving a higher level of noise. This could disproportionately affect minority groups. As a result, ML models, when trained on this DP-synthetic data by downstream users, may exhibit disparate impact when implemented on real data.\n\nSpecifically, consider a situation where each data record, represented by $x$, includes a sensitive attribute, such as gender or ethnicity, indicated by $s \\in \\mathcal{S}$. This record also includes an outcome variable, denoted as $y \\in \\mathcal{Y}$. To adjust the probability distribution $P_{S,Y}$ of the synthetic data to match that of the real data, our post-processing technique can be applied by selecting the following utility measures: $\\set{q_{i,j}(x) = \\mathbb{I}[s = i, y = j]}_{i\\in \\mathcal{S}, j \\in \\mathcal{Y}}$ where $\\mathbb{I}$ is the indicator function.\n\nThis method provides an extension to the current data pre-processing techniques found in fair ML literature [e.g., Kamiran and Calders, 2012] by implementing DP guarantees within the pre-processing pipeline. Broadly, our technique can be applied to enhance any utility measures that can be represented as bounded queries.\n\n—-Kamiran, F. and Calders, T., 2012. Data preprocessing techniques for classification without discrimination. \n\n\n---------\n**Q3. The computational complexity of the proposed post-processing technique.**\n\nA3. Please refer to our response to your Q1.\n\n---------\n**Q4. How does the proposed technique handle high-dimensional data? Are there any limitations or challenges in this regard?**\n\nA4. Indeed, a key characteristic of our proposed technique is its scalability, particularly with high-dimensional data. This scalability has been achieved by transforming the original optimization problem (Eq. 3), where the number of variables exponentially increases with the number of features, into a dual problem. Moreover, we have introduced a stochastic compositional proximal gradient algorithm (Algorithm 1) for solving the dual problem, enhancing computational efficiency significantly through the use of mini-batches for parameter updates. In addition, we have provided a PyTorch implementation of our algorithm which is optimized for GPU-based computations (please refer to the submitted code).\n\nAs a practical demonstration, we have applied our proposed technique to the home-credit dataset [MOK18]. This dataset has 307,511 rows and 104 features. The execution of our method, which includes computing the utility measures from real data, denoising the noisy answers, and computing optimal resampling weights, on this large-scale dataset took approximately 3 mins on a single NVIDIA GeForce RTX 3090 GPU.\n\n---------\n**Q5. Additional examples to illustrate the practical applications and benefits of the proposed technique.**\n\nA5. Please refer to our response to your Q2."}, {"review_id": "RUXNu3fLYp", "reviewer": "Reviewer_5bmq", "summary": "The paper proposes a DP post-processing method for synthetic data that weights the synthetic data to match user-selected utility measures on the real dataset. The utility measures on real data are measured with noise to make this post-processing DP. To find the synthetic data weights, the paper derives a closed-form expression, and develops an optimisation algorithm to find optimal dual variables required to evaluate the closed-form optimum. To evaluate the method, the paper conducts experiments on 5 real datasets, testing how much the method is able to improve the synthetic data produced by 5 existing methods of generating DP synthetic data.\n", "questions": "Important experimental details:\n- Is the plain synthetic data baseline $\\epsilon$ or $(\\epsilon + \\epsilon')$-DP? It seems to be the former, which is not a fair comparison, as the generation + post-processing is $(\\epsilon + \\epsilon')$-DP.\n- Are the categorical columns also converted to numerical features for AIM and MST? They should not be, as both methods handle categorical values natively.\n- What is the workload given to AIM? Does it contain the marginal queries with the variables the utility measures are looking at?\n\nMinor questions:\n- How is the real data split into training and test data?\n- Why were MST and AIM not run on the home-credit dataset? The original paper on Private-PGM (McKenna et al. 2019) that both methods are based on experiments on a dataset with a similar number of features.\n- Is there a difference between $\\lambda^*$ in (4) and $\\lambda$ in (5)?\n\nReferences:\n- Neunhoeffer et al. \"Private Post-GAN Boosting\" ICLR 2021\n- McKenna et al. \"Graphical-model based estimation and inference for differential privacy\" ICML 2019\n", "limitations": "The paper mentions that they assume the real data is normalised so each feature lies in $[0, 1]$. This is a fairly large limitation, as normalising data under DP while retaining the possibility of undoing the normalisation is not trivial, and should be discussed further..\n", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The paper is written well, and the main points are easy to understand. The idea behind the proposed method is interesting, and it should, at least in principle, be applicable to any kind of synthetic data and utility measure.\n", "weaknesses": "Some important experimental details are missing. See my questions.\n\nThe Private PGB method of Neunhoeffer et al. (2021) is fairly similar to the proposed method, and their differences should be discussed. Currently the paper is not even cited.\n\nMinor comments:\n- Slater's condition should be introduced before the proof of Theorem 1.\n- Seeing the raw utility and F1 scores from the experiment in Table 1 would be useful, as it would show whether the large improvement from post-processing on the GANs is just caused by the GANs generating poor synthetic data\n- References [App17], [Dat23], [DG17], [MOK18], [Sma23] should have URLs\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the thoughtful comments and for appreciating the value of the work! \n\n---\n**Q1. Some important experimental details are missing.**\n\nA1. We appreciate your constructive feedback regarding our experimental results! Please find the detailed responses to your questions below, where we hope to adequately address all your concerns.\n\n---\n**Q2. Private PGB method of Neunhoeffer et al. (2021).**\n\nA2. We thank the reviewer for pointing out the missing reference. We will ensure it is included in the revised paper. The key difference between our work and [Neunhoeffer etal., 2021] is that their method is tailored to GAN-based privacy mechanisms while our approach is model-agnostic. In other words, it can be applied to improve the utility of synthetic data generated by *any* privacy mechanisms. This versatility is crucial, given that marginal-based and workload-based mechanisms often yield higher quality synthetic data, as evidenced by benchmark experiments in [Tao etal., 2021], the NIST competition rankings [McKenna etal., 2021], and Table 1, 2 in the PDF submitted in our global response. Our experiments indicate that our method consistently improves the utility of synthetic data produced by all kinds of privacy mechanisms, even when the initial synthetic data is of high quality.\n\n—Tao, Y., McKenna, R., Hay, M., Machanavajjhala, A. and Miklau, G., 2021. Benchmarking differentially private synthetic data generation algorithms. \n\n—McKenna, R., Miklau, G. and Sheldon, D., 2021. Winning the NIST Contest: A scalable and general approach to differentially private synthetic data. \n\n---\n**Q3. Slater's condition should be introduced before the proof of Theorem 1.**\n\nA3. We thank the reviewer for their suggestion and will include Slater's condition before the proof of Theorem 1. \n\n---\n**Q4. Seeing the raw utility and F1 scores from the experiment in Table 1 would be useful, as it would show whether the large improvement from post-processing on the GANs is just caused by the GANs generating poor synthetic data**\n\nA4. Absolutely, that's an excellent suggestion! Please refer to the PDF we included in our global response for the raw F1 scores of both the original synthetic data and the post-processed data. \n\n---\n**Q5. Some references should have URLs**\n\nA5. We appreciate the reviewer's suggestion and will incorporate the URLs into the revised paper.\n\n---\n**Q6. Is the plain synthetic data baseline $\\epsilon$ or $\\epsilon + \\epsilon’$-DP? It seems to be the former, which is not a fair comparison.**\n\nA6. In response to your concerns, we have conducted *an additional experiment* under the setup you suggested. Please refer to the PDF we submitted in the global response for details. In short, our observations are in line with prior experiments, confirming that our algorithm consistently enhances the utility of synthetic data on selected measures.\n\nThe reasoning behind our original setup stems from the observation that increasing the privacy budget in synthetic data generation mechanisms *does not* necessarily enhance the quality of the synthetic data, even when averaged over multiple trials. We conjecture this incongruity arises from the random noise injected into the data generation process to ensure DP guarantees. Therefore, even without employing our post-processing algorithm, synthetic data generated from a lower privacy budget may surpass data produced with a higher privacy budget in terms of their overall quality. Our initial experimental setup enabled us to eliminate this potential issue. As a result, we concluded that our post-processing algorithm can consistently enhance the utility of the synthetic data on selected measures, despite requiring a small privacy budget (see lines 45–46 and 53–55).\n\n---\n**Q7. Are the categorical columns also converted to numerical features for AIM and MST?**\n\nA7. To clarify, we used ordinal encoding to pre-process the categorical columns, which were then fed into the AIM and MST mechanisms.\n\n---\n**Q8. Workload given to AIM**\n\nA8. The workload given to AIM consists of all one-way and two-way marginals. The utility measures chosen for our study are first-order and second-order moments, which are functions of the workload.\n\n---\n**Q9. How is the real data split into training and test data?**\n\nA9. We split the real data, using 80% for generating synthetic data and setting aside 20% to evaluate the performance of predictive models trained on the synthetic data.\n\n---\n**Q10. Why were MST and AIM not run on the home-credit dataset?**\n\nA10.  The primary reason was the lack of a functional GPU-accelerated implementation for these algorithms at the time of our experimentation. Our attempts to generate synthetic copies of the home-credit dataset, which comprises 100+ columns, using CPU-based computations proved to be exceedingly time-consuming and resource-intensive. Despite our best efforts, these attempts repeatedly led to kernel crashes and hindered our ability to carry out comprehensive experiments.\n\n---\n**Q11. Difference between $\\lambda^{*}$ in (4) and $\\lambda$ in (5)?**\n\nA11. $\\lambda$ represents the variables involved in the optimization problem in Eq. (5), while $\\lambda^*$ denotes the optimal solution. We will clarify this notation in the updated version of our paper.\n\n---\n**Q12. Data normalization.**\n\nA12. To clarify, our proposed method can be expanded to a broader context where we do not necessarily assume that each feature is in $[0,1]$. Instead, we only require utility measures that are represented by bounded queries. In the case of aligning the correlation matrix as an application, the only requirement is for all features to have a bounded domain, ensuring that the first and second-order moment queries are also bounded. Users can either define the lower and upper bounds of each feature, or they can be estimated from real data using a DP mechanism (see e.g., an OpenDP API: snsynth.transform.minmax)."}, {"review_id": "r9jmDqihq5", "reviewer": "Reviewer_rPbc", "summary": "The paper considers how to obtain improved utility from synthetic data under differential privacy.  Prior work has tried to achieve utility by incorporating utility directly into the generation of the synthetic data e.g., by making use of workload data.  Here, the proposal is to perform post-hoc reweighting of the synthetic data, based on measuring a difference in values between the final data under a set of queries with known answers.  This measurement/reweighting step is also done under privacy.  The paper shows that the optimization can be done using standard solvers, and so can be performed effectively via linear or quadratic programming (for pure or approximate DP). A specific use case based on aligning the correlation matrix is used to demonstrate that the sensitivity calculations can be quite simple.  Numerical experiments demonstrate that the approach can be quite effective in terms of absolute error ratio, and F1 score.   ", "questions": "Apart from correlation matrix, can you generate more examples of query families to apply that have bounded sensitivity?", "limitations": "No need to address societal impact.  \n\nTechnical limitations are outlined in Section 5 in broad strokes, but it would be interesting to hear more specific suggestions about how this approach could be extended to handle more diverse data. ", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "Synthetic data is widely promoted as a practical way to gain from private data, without running into issues around exhaustion of privacy budget.  Ensuring that synthetic data is usable for the target queries is therefore an important challenge, particularly if the workload may not be known at data generation time.  This approach shows a promising way to overcome these issues, provided we still have access to the data to perform the private optimization step. \n\nThe approach is very clean, and shows good promise in terms of utility and performance. ", "weaknesses": "Evaluation is on four benchmark data sets that may be considered \"easy\".  It would be interesting to test this out on additional data, such as that used in recent synthetic data challenges by NIST. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their careful read of our paper and constructive comments!\n\n---------\n**Q1. Evaluation is on four benchmark data sets that may be considered \"easy\". It would be interesting to test this out on additional data, such as that used in recent synthetic data challenges by NIST.**\n\nA1. To clarify, we have also applied our algorithm to the home-credit dataset [MOK18], in addition to the four benchmark datasets. The home-credit dataset is a large-scale dataset, which has 307,511 rows and 104 features. The execution of our method, which includes computing the utility measures from real data, denoising the noisy answers, and computing optimal resampling weights, on this large-scale dataset took approximately 3 mins on a single NVIDIA GeForce RTX 3090 GPU and the results are shown in Table 2 and Figure 1 in the paper.\n\n\n---------\n**Q2. Apart from correlation matrix, can you generate more examples of query families to apply that have bounded sensitivity?**\n\nA2. Indeed, our proposed method can be expanded for use in many other applications, not limited to correlation alignment. For instance, it can be applied to mitigate data biases while ensuring the DP guarantees of resampled synthetic data. During the generation of private synthetic data, outliers may end up receiving a higher level of noise. This could disproportionately affect minority groups. As a result, ML models, when trained on this DP-synthetic data by downstream users, may exhibit disparate impact when implemented on real data.\n\nSpecifically, consider a situation where each data record, represented by $x$, includes a sensitive attribute, such as gender or ethnicity, indicated by $s \\in \\mathcal{S}$. This record also includes an outcome variable, denoted as $y \\in \\mathcal{Y}$. To adjust the probability distribution $P_{S,Y}$ of the synthetic data to match that of the real data, our post-processing technique can be applied by selecting the following utility measures: $\\set{q_{i,j}(x) = \\mathbb{I}[s = i, y = j]}_{i\\in \\mathcal{S}, j \\in \\mathcal{Y}}$ where $\\mathbb{I}$ is the indicator function.\n\nThis method provides an extension to the current data pre-processing techniques found in fair ML literature [e.g., Kamiran and Calders, 2012] by implementing DP guarantees within the pre-processing pipeline. Broadly, our technique can be applied to enhance any utility measures that can be represented as bounded queries.\n\n\n—-Kamiran, F. and Calders, T., 2012. Data preprocessing techniques for classification without discrimination. \n\n\n---------\n**Q3. Technical limitations are outlined in Section 5 in broad strokes, but it would be interesting to hear more specific suggestions about how this approach could be extended to handle more diverse data.**\n\nA3. Thank you for raising this important point! There are two additional applications where our approach can be effectively applied. First, in cases where the data exhibit a temporal structure, our approach can be used for post-processing synthetic data. This allows for the alignment of the transition matrix between adjacent time-steps with that of real data. The second application involves aligning the distribution of synthetic data in its tail with real data, as DP mechanisms tend to add higher noise to these regions. This aspect of preserving the tail distribution is particularly crucial in financial data, such as in fraud detection."}]

Author rebuttal:
We would like to thank all the reviewers for taking the time and effort to review our paper! We are delighted to learn that our paper was positively received, and the reviewers found that the idea of post-processing synthetic data presented in this paper is a compelling approach that boasts potential applicability to a multitude of problems (Reviewer SorM); the method is model-agnostic, which makes the technique highly versatile (Reviewer zgZz); the idea behind the proposed method is interesting, and it should, at least in principle, be applicable to any kind of synthetic data and utility measure(Reviewer 5bmq); and the approach is very clean, and shows good promise in terms of utility and performance (Reviewer rPbc). We also recognize that the reviewers are busy handling multiple papers, so their thoughtful feedback is even more appreciated. 

---
We have included a PDF in this global response that contains additional experiments as suggested by the reviewers. The main differences compared with Table 1 in our submission are:

[New setup]. We compare the utility of synthetic data produced by privacy mechanisms with a privacy budget of $\epsilon + 1$, against the post-processed synthetic data that are generated by applying our post-processing technique (with a privacy budget of $1$) to synthetic data generated from privacy mechanisms with a privacy budget of $\epsilon$. 

[Report raw F1 scores]. We report the F1 scores, both with and without our post-processing, instead of just the F1 score improvement. For your reference, the F1 scores of training on 80% real data and testing on 20% real data are: 0.61 on adult; 0.95 on mushroom; 0.54 on shopping; and 0.47 on bank.

[Include two statistical measures]. We include two statistical measures (Jensen-Shannon distance and average inverse of the KL-divergence) for evaluating statistical properties of synthetic data.

In short, our observations are in line with prior experiments, confirming that our algorithm consistently improves the utility of the synthetic data across all datasets and all DP mechanisms without degrading the performance of downstream models or statistical metrics.

---

Below, we address the concerns and questions raised by each reviewer and detail our plans for updating the paper. We will add the changes in the final version (both in the main text and appendix).

We welcome any additional feedback or suggestions that can further strengthen our paper and would be glad to hear from the reviewers.

Thanks!

Meta-review: # Meta Review

The reviewers agree that the post-processing technique proposed in this paper is widely applicable and compelling, and most agree that the paper is well written. On the other hand, there are three main recurring weaknesses in the reviews:

First, reviewers SorM and 5bmq pointed out that the total privacy budget of the post-processed data uses a larger privacy budget, since the post-processing incurs additional privacy loss. During the discussion period the authors conducted additional experiments showing that this is not the source of improved performance, and the reviewers were convinced by these experiments. I think the new experiments resolve this concern and should be included in the paper.

Second, reviewers SorM and zgZz have concerns about trade-offs / compromises when using the proposed approach. For example, it is possible that post-processing the data to improve the correlation matrix may decrease the quality of the data in other ways. To some extent it seems like such trade-offs must be present, but I don't think that undermines the results much. The authors also conducted additional experiments showing that some specific statistical measures did not degrade after applying the post-processing technique.

Finally, during the reviewer discussion, reviewer SorM pointed out some additional baselines that could be good to compare against. I have included their comments below so that the authors may take them into account.

Overall, I think the reviewers are in agreement that the strengths outweigh the weaknesses and that the paper is above the bar for NeurIPS.

# Related work comments from reviewer SorM:

More importantly, It has become more apparent to me that there exists prior work capable of addressing the problem outlined in the paper. However, these approaches were not taken into consideration. Specifically, the previous work from [1] proposes a mechanism, referred to as PMW^{Pub}, that can tackle a problem very similar to the one in this paper. The only difference lies in the fact that the technique described in [1] conducts a post-processing procedure on publicly available data (as opposed to rows generated by an alternative synthetic data mechanism). Technically, PMW^{Pub} creates a support using a set of public records and subsequently employs the MWEM algorithm to reweigh the importance of each row in the support. In contrast, the support on this paper comes from rows of synthetic data. Regrettably, I initially overlooked this paper in my initial review. It does seem, though, that PMW^{Pub} could serve as a direct point of comparison within this paper.

Finally, I realized that the set of statistics (or workload) they optimize in this paper is very straightforward (The workload Q is defined under line 225). This means that recent generative mechanism such as GEM ([2]) or RAP ([3]) are equipped to handle these types of workloads. Notably, [2] shows how you can initialized GEM with public data. Therefore, a sensible baseline for the setting of the paper would be GEM initialized with synthetic data from other methods.

[1] Liu, Terrance, et al. "Leveraging public data for practical private query release." International Conference on Machine Learning. PMLR, 2021.

[2] Liu, Terrance, Giuseppe Vietri, and Steven Z. Wu. "Iterative methods for private synthetic data: Unifying framework and new methods." Advances in Neural Information Processing Systems 34 (2021): 690-702.

[3] Aydore, Sergul, et al. "Differentially private query release through adaptive projection." International Conference on Machine Learning. PMLR, 2021.
Decision: Accept (poster)