Noise-Aware Differentially Private Regression via Meta-Learning
Authors: Ossi Räisä
Stratis Markou
Matthew Ashman
Wessel P Bruinsma
Marlon Tobaben
Antti Honkela
Richard E. Turner
Venue: NeurIPS 2024 poster (2024)
Keywords: differential privacy
meta-learning
neural processes
Gaussian processes
sim-to-real
probabilistic regression
Primary area: privacy
TL;DR: We train a neural network that can output a differentially private probabilistic regression model from a data set in one forward pass.

Abstract: Many high-stakes applications require machine learning models that protect user privacy and provide well-calibrated, accurate predictions. While Differential Privacy (DP) is the gold standard for protecting user privacy, standard DP mechanisms typically significantly impair performance. One approach to mitigating this issue is pre-training models on simulated data before DP learning on the private data. In this work we go a step further, using simulated data to train a meta-learning model that combines the Convolutional Conditional Neural Process (ConvCNP) with an improved functional DP mechanism of Hall et al. (2013), yielding the DPConvCNP. DPConvCNP learns from simulated data how to map private data to a DP predictive model in one forward pass, and then provides accurate, well-calibrated predictions. We compare DPConvCNP with a DP Gaussian Process (GP) baseline with carefully tuned hyperparameters. The DPConvCNP outperforms the GP baseline, especially on non-Gaussian data, yet is much faster at test time and requires less tuning.

Noise-Aware Differentially Private Regression via Meta-Learning
Ossi Räisä University of Helsinki ossi reissrrsschhhlikkk....
Stratis Markou" University of Cambridge em6260cam. ac uk
Matthew Ashman
University of Cambridge
mca390cam. ac
Wessel P. Bruinsma Microsoft Research AI for Science wessel. p. bruinsma@gmail....... com
Marlon Tobaben
University of Helsinki
marlon. tobabem@heleinki...
Antti Honkela
Richard E. Turner
University of Helsinki antti www.hheeeelelllnnkeee..
University of Cambridge ret260cam. ac uk
Abstract
Many high-stakes applications require machine learning models that protect user privacy and provide well-calibrated, accurate predictions. While Differential Pri- vacy (DP) is the gold standard for protecting user privacy, standard DP mechanisms typically significantly impair performance. One approach mitigating this issue is pre-training models on simulated data before DP learning on the private data. In this work we go a step further, using simulated data train a meta-learning model that combines the Convolutional Conditional Neural Process (ConvCNP) with improved functional DP mechanism of Hall et al. 2013) yielding the DPConvCNC DPConvCNP learns from simulated data how to map private data DP predictive model in one forward pass, and then provides accurate, well-calibrated predictions. We compare DPConvCNP with DP Gaussian Process (GP) baseline with carefully tuned hyperparameters. The DPConvCNP outperforms the GP baseline, especially non Non-Gaussian data, yet is much faster at test time and requires less tuning.
Introduction
Deep lcarning has achieved tremendous success across range of domains, especially in settings where large datasets are publicly available. However, in many impactful applications such as healthcare, the data may contain sensitive information about users, whose privacy we want to protect. Differential Privacy [DP: Dwork et al. 2006) is the gold standard framework for protecting user privacy, it provides strong guarantees the privacy loss incurred on participating in a dataset. However, enforcing DP often significantly impairs performance. mitigate this issue is pre-train model non-private data, e.g. from a simulator [Tagg al. 2023
recently proposed method to
and then fine-tune under DP on real private data (Yu et al.) 2021 Li et al. 2022
De et al. 2022
We go step further and train meta-learning model with DP mechanism inside it (Figure D While supervised learning is about learning a mapping from inputs to outputs using a learning algorithm, in meta-learning we learn learning algorithm directly from the data, by meta-training, enabling generalisation new datasets during meta-testing. Our model is meta-trained on simulated datasets,
'Equal contribution.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

TRAIN: SIMULATED OR PROXY DATA
TEST: REAL SENSITIVE DATA
DP ENCODER
DP ENCODER
DECODER
Loss
DECODER
PREDICTIONS
CCT
CE
SET
INPUTS
OUTPUTS
PROTECTED DATA
CLIP NOISE
Figure 1: Mett--triiiin (left) and meta-testing (right) using our method. We train model multiple tasks with non- non-private (simulated or proxy) data to predict on target (t) points using the context (c) points. Crucially, by including DP mechanism, which clips and adds noise to the data during training, the parameter updates (dashed arrow) teach the model to make well-calibrated and accurate predictions in the presence of DP noise. At test time, deploy the model real data using the same mechanism, which protects the context set with DP guarantees.
each of which is split into a context and targel set, learning to make predictions at the target inputs given the context set. At meta-test-time, the model takes context set of real data, which is protected by the DP mechanism, and produces noise-aware predictions and accurate uncertainty estimates.
Neural Processes. Our method is based on neural processes INPs: Garnelo al. 2018a], model which leverages the flexibility of neural networks to produce well-calibrated predictions in the meta- learning setting. The parameters of the NP are meta-trained to generalise to unseen datasets, while
adapting to new contexts much faster than gradient- gradient-bused fine-tuning alternatives [Finn et al. 2017
Convolutional NPs. We focus convolutional conditional NPs [ConvCNP:) Gordon et al. 2020). type of NP that has remarkably strong performance challenging regression problems. That is because the ConvCNP is translation equivariant [TE: Cohen and Welling 2016), so its outputs change predictably whenever the input data are translated. This an extremely useful inductive bias when modelling, for example, stationary data. The ConvCNP architecture also makes it natural to embed an especially effective DP mechanism inside it using the functional mechanism (Hall et al.) 2013) to protect the privacy of the context set (Figure D. We call the resulting model the OPConvCNP.
Training with a DP mechanism. crucial aspect of our approach is training the DPConvCNP on non-sensitive data with the DP mechanism in the training loop. The mechanism involves clipping and adding noise, so applying only during testing would create a mismatch between training and testing. Training with the mechanism climinates this mismatch, ensuring calibrated predictions (Figure 2
Overview of contributions. In summary, our main contributions in this work are follows.
1. We introduce the DPConvCNP, meta- meta-learning model which extends the ConvCNP using the functional DP mechanism (Hall et al. 2013). The model is meta-trained with the mechanism in place, learning to make calibrated predictions from the context data under DP.
2. We improve upon the functional mechanism of Hall et al. [2013) by leveraging Gaussian DP theory [Dong et al. 2022], showing that context set privacy can protected with smaller amounts of noise (at least 25% lower standard deviation in the settings considered in Figure 4). We incorporate these improvements into DPConvCNP, but note that they are also of interest in any case of the functional mechanism.
3. We conduct study on synthetic and sim-to-real tasks. Remarkably, even with relatively few context points (a few hundreds) and modest privacy budgets, the predictions of the DPConvCNP are surprisingly close to those of the non-DP optimal Bayes predictor. Further, we find that single DPConvCNP can be trained to generalise across generative processes with different statistics and privacy budgets. We also evaluate the DPConyCNP by training it on synthetic data, and testing on a real dataset in the small data regime. In all cases, the DPConvCNP produces well calibrated predictions, and is competitive with a carefully tuned DP Gaussian process baseline.
2 Related Work
Training deep learning models on public proxy datasets and then fine-tuning with DP on private data is becoming increasingly common in computer vision and natural language processing applications

---

1.00 8= 0.001 256
1.00 8=0.001 51
e=3.0 8=0.001 N= 256
DPConvCNP
Optimal Bayes predictions (non-private)
Figure 2: Training our proposed model with DP mechanism inside it, enables the model make accurate well-calibrated predictions, even for modest privacy budgets and dataset sizes. Here, the context data (black) are protected with different (e, DP budgets as indicated. The model makes predictions (blue) that are remarkably close to the optimal (non-private) Bayes predictor.
Yu et al. 2021 Li et al. 2022 De et al. 2022 Tobaben et al., 2023 However, these approaches rely on the availability of very large non-sensitive datasets. Because these datasets would likely need to be scraped from the internet, it is unclear whether they are actually non-sensitive [Tramèr et al. 2024). On the other hand, other approaches study meta-learning with DP during meta-training [Li ct al.
2020 Zhou and Bassily 2022]. but do not enforce privacy guarantees at meta-test time.
Our approach fills gap in the literature by enforcing privacy of the meta-test data with DP guarantees (see Figure [ and using non senssiisttiee proxy data during meta-training Unlike other approaches which rely on large fine tuning datasets, our method produces well-calibrated predictions even for relatively small datasets (a few hundred datapoints). In this respect, the work of Smith al. [2018), who study Gaussian process (GP) regression under DP for the small data regime, is perhaps most similar to ours. However, [Smith et al.) (2018) enforce privacy constraints only with respect to the output variables and do not protect the input variables, whereas our approach protects both.
In terms of theory, there is fairly limited prior work on releasing functions with DP guarantees. Our method is based on the functional DP mechanism of Hall et al. (2013) which works by adding noise from GP to a function to be released. This approach works especially well when the function lies in reproducing kernel Hilbert space (RKHS), property which we leverage in the DPConvCNP We improve on the original functional mechanism by leveraging Gaussian DP theory of Dong et al.) [2022]. In related work. Aldà and Rubinstein [2017) develop the Bernstein DP mechanism, which adds noise the coefficients of the Bernstein polynomial of the released function, and Mirshani et al. 2019) generalise the functional mechanism beyond RKHSs. Diang et al.] [2023] derive Rényi differential privacy [RDP; Mironov 2017] bounds for the mechanism of Hall et al. [2013].
Background
We start by laying the necessary background. In Section focusing on the ConvCNP. In Section 3..2 we introduce DP, and the functional mechanism of Hall et al. (013)). We keep the discussion DP lightweight, deferring technical details to Appendix
3.1
outline meta-learning and NPs.
3.1 Meta-learning and Neural Processes
Supervised learning. Let D be the set of datasets consisting of (ar, y)-rairs with x E X c Re and y E y C R. The goal of supervised learning is use a dataset D D to learn appropriate parameters 0 for a conditional distribution p(y|æ, 0), which maximise the predictive log- log-likelihood on unseen, randomly sampled test pairs (x* """,y"), i.c. L(,, (x" ,,"""") )) p(y" [x=' 0). Let us denote the entire algorithm that performs learning, followed by prediction, by म, that is T T(=", _,=,,,, D) = p(- 22= ,0*), where 6* arg max, L(r, D). Supervised learning is concerned with designing e.g. picking an appropriate architecture and optimiser, which is trained on a single dataset D.
x,
Meta-learning. Meta-learning can be regarded as supervised learning of the function и itself. In this setting, 1) is regarded as part of single training example, which means that meta-learning algorithm can handle different D) at test time. Concretely, in meta-learning, we have ox," D) p(-|z*, 0, r (D)), where T is now a function that produces task-specific parameters, adapted for D. The meta-training set now consists of a collection of datasets (Dm) often referred to tasks. Each task is partitioned into a context set D(e) = (x(e), y y(c) and a target set ( (x9)),(()) We refer to x and y(()) as the context inputs and outputs and to x(t) and (-()) as the target inputs and outputs. To meta- train a meta- learning model, we optimise its predictive log- ligllikelhood, averaged over tasks, i.e. EE [C0, o, D)] = Ep [log To.s (x(1), D(e) (y(")). leaaning algorithms are broadly categorised into two groups, based on the choice of r [Bronskill] 2020).
3

---

Gradient based vs amortised meta-learning. On one hand. gradient- based methods, such as MAML [Finn et al. 2017] and its variants (e.g. [Nichol et al. 2018) rely on gradient- based fine-tuning at test time. Concretely, these let ra be function that performs gradient-based optimisation. For such algorithms, we can enforce DP with respect to a meta-test time dataset by fine-tuning with a DP optimisation algorithm, such as DP-SGD [Abadi et al.] 2016]. While generally effective, such approaches can require significant resources for fine-tuning at meta-lest-ting hyper-parameter tuning to work at all. On the other hand, there are amortised methods, such neural processes [Garnelo et al. 2018a], prototypical networks [Snell et al. 2017], and matching networks |Vinyals al.] 201 in which re is a learnable function, such as a neural network. This approach has the advantage that it requires far less compute and memory at meta-test cetta-test-iimie time. In this work, we focus on neural processes (NPs), and show how To can be augmented with DP mechanism to make well calibrated predictions, while protecting the context data at meta test time.
as well as careful DP
Neural Processes. Neural processes (NPs) are type of model which leverage the flexibility of neural networks to produce well calibrated predictions. A range of NP variants have been developed, including conditional NPs ICNPs: Garnneo et al. 2018a), latent-variable NPs ILNPs: Gareelo et al., 2018b), Gaussian NPs [GNPs: Markou et al. 2022]. score-based NPs Dutordoir et al. [2023], J. and autoregressive NPs (Bruinsma al., 2023]. In this work, we focus on CNPs because these are ideally suited for our purposes, but our framework can be extended to other variants. A CNP consists of an encoder encs, and a decoder decg. The encoder is a neural network which ingests a context set D(o) E 'D and outputs a representation r in some representation space R. Two concrete examples of such encoders are DeepSets [Zaheer et al. 2017] and SetConv layers (Gordon et al., 2020]. The decoder is another neural network, with parameters 0, which takes the representation r together with target inputs x*) and produces predictions for the corresponding y(!) In summary
T ((()) = deco(x(), ,)),
(D(o).
(I)
In CNPs, a standard choice, which we also use here, is to let (x(1()()), D(e)) return a mean 1s.. 8 (x((0) D(o) and variance d² (ar(t) D to parameterise a predictive distribution that fac- (
torises across the target points y (x((t) ~ (N D(S),, o² o (z(1) D())). We note that our framework straightforwardly extends to more complicated T (x.) D(o)). To train CNP to make
accurate predictions, we can optimise log oollieelihood objective Gamelo et al. [0188] such as
[(0, +) = En [oggN (y
(y ( (x
where the expectation is taken over the distribution over tasks D. This objective is optimised by present- ing each task D,,. to the CNP, computing the gradient of the loss with back- pack-propagation, and updating the parameters (Ø, 0) of the CNP with any first-order op- timiser (see alg. D. This process trains the CNP to make well-calibrated predictions for D(f) given D(e) At test time, given a new D(e), we can use Tg.0 which can be queried at arbitrary target inputs, to obtain corresponding predictions (alg. 2}.
Algorithm Meta Meta-training neural process.
Input:
Simulated datasets (Dm ) 1. en-
coder enc,, decoder dec,, iterations T,, op- timiser opt
Output: Optimised parameters o,
for i E (1 (1...T) T} do
Choose D from (Dm)
J.M randomly
D(e), D(O)_ + D
x(0 (()) + (())
u,o² t dec (Dco()(
Convolutional CNPs. Whenever we have useful inductive biases or other prior knowledge, we can leverage these by building them directly into the en- coder and the decoder of the CNP. Stationarity is a powerful inductive bias that is often encountered in potentially sensitive applications such as time series or spatio-temporal regression. Whenever the generat- ing process is stationary, the corresponding Bayesian predictive posterior is TE (Foong al.] 2020). Con- vCNPs leverage this inductive bias using TE architec- tures [Cohen and Welling 2016 Huang et al. 2023
C Φ) + log ((y(00)u,
0.0 + opt(o, 6, V Vo.oL)
end for Return o,
Algorithm 2 Meta-testing a neural process.
Input: Real context Díe), enc,, dec, Output: Predictive μt with domain X' p()),(())) +- deco(,, enca(D(e)) Return 14,
ConvCNP encoder. To achieve TE, the ConvCNP encoder produces r that is itself TE function.

---

y.
pa (a) Σ m oaga())
8 (x)= Σ Ev(=
pl)()))
(0))== E clippy C) OM + +0)8000)
Figure 3: Left; Illustration of the ConvCNP encoder encø. Black crosses show an example context set D(o), The density channel r(d) shown in purple and the signal channel ,(r) is shown red. The representation consists of concatenating r!d) and y(*), Right: Illustration of the DPConvCNP encoder. Black crosses show an example context D clipped with a threshold C' (gray dashed). Here, a single point (rightmost) is clipped (gray cross shows value before clipping). The density and signal channels are computed and GP noise is added to obtain the DP representation (red & purple).
Specifically, ence maps the context D(e) ((xhh)
(c) Dn
))
to the function r: : - R
[x)))()) r(æ) = (x)
N
In (c)
(0)
&
y/
A
where di is the Gaussian radial basis function (RBF) and eb {A]. We refer to the two channels of r as the density p(d) and the signal r(5) channels, which can be viewed as a smoothed version of D The density channel carries information about the inputs of the context data, while the signal channel carries information about the outputs. This encoder referred to as the SetConv.
ConvCNP decoder. Once has been computed, it is passed to the decoder which performs three steps. First, it discretises using pre-specified resolution. Then, applies a CNN to the discretised signal, and finally it uses an RBF smoother akin to Equation 33) to make predictions at arbitrary target locations. The aforementioned steps are all so, composing them with the TE encoder produces TE prediction map [Bronstein et al. 2021]. The ConvCNP has universal approximator properties and produces state-of-the-are well-calibrated predictions [Gordon et al. 2020
3.2 Differential Privacy
Differential privacy [Dwork et al. 2006 Dwork and Roth 2014) quantifies the maximal privacy loss to data subjects that occur when the results of analysis are released. The loss is quantified by two numbers, and which bound the change the distribution of the output of an algorithm, when the data of single data subject in the dataset change.
Definition 3.1. An algorithum M is (c, 5)-DP for neighbouring D, D' and all measurable sets S
Pr(M(D) S) e Pr(M(D') 8.
We consider D E xd with users and d dimensions, and use the substitution neighbourhood relation ~s where D ~s D' if D and D' differ by at most one row.
Gaussian DP. In Section 3.3 we discuss the functional mechanism of Hall al. 2013 which we use in the ConyCNP. However, the original privacy guarantees derived by Hall et al. (013 are suboptimal. We improve upon these using the framework of Gaussian DP [GDP: Dong et al. 2022). Dong et al. (202) define GDP from hypothesis testing perspective, which is not necessary for our purposes. Instead, we present GDP through the following conversion formula between GDP and DP.
Definition 3.2. A mechanism M is 4-GDP if and only if is (e, D(e))-DP for all 2 0, where
8(c) Φ (-
e
(5)
11
and & is the CDF of the standard Gaussian distribution.
Properties of DG) Differential privacy has several useful properties. First, post-processing immunity guarantees that post-proe post-procs the result DP algorithm does not cause privacy loss:
Theorem 3.3 (Dwork and Roth 2014). Let M be an (e, DDD (or μ-GDP) algorithm and let be any, possibly randomised, function. Then f o M is (e, DDP (or μ-GDP).
5

---

Composition of DP mechanisms refers to running multiple mechanisms on the same data. When each mechanism can depend on the outputs of the previous mechanisms, the composition called adaptive. GDP is particularly appealing because it has a simple and tight composition formula:
Theorem 3,4 (Dong et al. 2022). The adaptive composition TT mechanisms that P4-GDP (i (i= 1,..,... T), μ-GDP with μ v M
pr.
Gaussian mechanism. One of the central mechanisms guarantee DP, the Gaussian mechanism. This releases the output of a function f with added Gaussian noise
M(D) = J(D) + +N(00, o2),
(6)
where the variance o² depends the 12 sensiiviy of f. defined
sup D
[I[(D) S(D')ll
(7)
Theorem 3.5 (Dong al. 2022). The Gaussian mechanism with variance o² 22//2 is μ-GDP.
3.3
The Functional Mechanism
Now we turn to the functional mechanism of Hall et al. (2013). Given dataset D E RNxd the functional mechanism releases function J'D: - Tk, where C IRd with added noise from Gaussian process. For simplicity, here we only define the functional mechanism for functions in reproducible kernel Hilbert space (RKHS), and defer the more general definition to Appendix [A.2
Definition 3.6. Let be sample path of Gaussian process having mean zero and covariance function k, and let H be RKHS with kernel k. Let \JD D DED) D} H be a family of functions indexed by datasets, satisfying
AuI
def sup lIfo - fD S A. D-D'
(8)
The functional mechanism with multiplier and sensitivity A is defined as
M(D) = fo + cg.
(9)
Theorem 3.7 (Hlll et al.). Iffe e I 1, the mechanism in Def. 3.6 with c A /21m(22/8) is (e,8)-DP.
Differential privacy for the Conv
Now we turn to our main contributions. First, we tighten the functional mechanism privacy analysis in Section 4.1 and then build the functional mechanism into the ConyCNP in Section 4.2
4.1 Improving the Functional Mechanism
The privacy bounds given by Theorem 3.7 are suboptimal, and do not allow to use the tight composition formula from Theorem 3.4 However, the proof of Theorem 3.7 builds on the classical replace with the GDP theory from Section 3.2
Gaussian mechanism privacy bounds, which
As demonstrated in Figure 4 our bound offers significantly smaller e for the same noise standard deviation, compared to the existing bounds of Hall al. (2013) and Diang et al. [203]]
Theorem 4.1. The functional mechanism with sensitivity A and multiplier e = A/u is p-GDP.
Proof. The proof of Theorem 3.7 from Hall et al. 2013 shows that any (e, 8)DD bound for the
Gaussian mechanism carries over to the functional mechanism. Replacing the classical Gaussian mechanism bound with the GDP bound proves the claim. For details, see Appendix A O

---

Algorithm 3 DPSetConv; modifications to the original SetConv layer shown in blue.
10"
(Hall et
-50
RDP (Jiang
-40
(Our vs liing
GDP (Curs)
rodiactio
Grid C RP, D(e), (c, RBF covariance & with scale X, threshold C, DP accounting method moise_scales
Input:
10
20%g
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2,00
Output: DP representation of r(d) p((), ((e)
yn clip(yn) (e) C) for n I,....N
Figure 4: Noise magnitude comparison for the clas- sical functional mechanism of Hail et al. (2013), the
9d. 9s ~ GP(O, k)
gd, 8. - [a
RDP-based mechanism of Jiang et al. [2023 and our improved GDP-based mechanism. The line for Hall et al. cuts off at 1 since their bound has only been proven for e - 1. We set A = 10 and
Od, t noise_scales(c,, C,
r(d) < E v((x /// + adga
p(0) + Em=1 ( ((x - 2/2 + o.ge
= 10-3, which representative values from our experiments. See Appendix A.6 for more details.
Return: Density and signal r(d) (()),
4.2 Differentially Private Convolutional CNP
Differentially Private SetConv. Now we turn to building the functional DP mechanism into the ConvCNP. We want to modify the SetConv encoder (Eq. 3) to make it DP, As a reminder, the SetConv outputs the density p(d) and signal p(s) channels
(r) (x)))))
Σ
(c)
(10)
X
which are the two quantities we want to release under DP. To achieve this, we must first determine the sensitivity of (d) and r((s), as defined in Eg. 8 Recall that we use the substitution neighbourhood relation ~s, defined as D( ~ D2 D and D differ in at most one row, i.c. by a single context point. Since the RBF vp is bounded above by I, it can be shown (see Appendix [..44 that the
squared lz-sensitivity of (()) is bounded above by 2, and this bound is tight. Unfortunately however, since the signal channel (()) depends linearly on each yh (see Eq. 10), its sensitivity is unbounded.
To address this, we clip each (c) by threshold C, which is a standard way to ensure the sensitivity bounded. With this modification we obtain the following tight sensitivities for ((d) and r(e);
23r (4) = 2, 2 = 4C²
(11)
With these in place, we can state our privacy guarantee which forms the basis of the DPConvCNP. Post- processing immunity (Theorem 3.3) ensures that prsc-procs (()) and r(d) with the ConvCNP decoder does not result in further privacy loss.
Theorem 4.2. Let ga and 9, be sample paths of two independent Gaussian processes having zero mean and covariance function k. such that 0 S k S Ck for some Cg 0. Let A 2C and
A3 4C Then releasing pdd) + Jaga and (() Jage H-GDP with μ v 22/o² + A3/03.
Proof. The result follows by starting from the GDP bound of the mechanism in Theorem and using Theorem 3.4 to combine the privacy costs for the releases of ((d) and (())
Corollary 4.3, Algorithm with the DPSerConv encoder from Algorithum is (e.8)-DP with respect to the real context set D(e)
Proof. The noise _ccales method in Algorithm 3 computes the appropriate aa and o, values from Theorem 4.2 and Definition | such that releasing the functional encodings ((d) + aaga and p()) G.99 (c. -P. The 6) guarantee extends HHll al. 2013 Proposition 5] to the point
evaluations (dd and (()) over the grid Algorithm 3 Post-processing immunity (Theorem 3.3
extends (c. DDP to Algorithm 2
4.3 Training the CPC
Training loss and algorithm. We meta-train the DPConvCNP parameters 0, using the CNP log- liceiiil (eq. 2 within Algorithm I and meta-test using alg. 2 Importantly, the encoder
7

---

ence now includes clipping and adding noise (alg. B in its forward pass. Meta- Meta-training training with the functional place is crucial, because teaches the decoder handle the DP noise and clipping.
Privacy hyperparameters. By Definition 3.2 and Theorem 4.2 each (c, (e.uget implies a j budget, placing constraint the sensitivities and noise magnitudes, namely 1²² 22/0² + 43/03- Since v is an RBF, Ai = 2 and A = 402, and we need to specify C, a, and aa, subject to this constraint. We introduce variable 0 < and rewrite the constraint as
4C²
2
and
2
(12)
tp
(1 t)p²
allowing to freely set / and C. One straightforward approach is to fix l and C' to hand-picked values, but this is sub-optimal since the optimal values depend on μ., _N, and the data statistics. Instead, we can make them adaptive, letting t Rt x N- - (0, 1) and C': Et x N R+ be learnable functions, e.g. neural networks t(u, = sig (NN, (j, N)) and C(,, .N = exp(NNc((u N)) where sig is the sigmoid. These networks
veta-trained along with all other parameters of the DPConvCNP.
Experiments & Discussion
We conduct experiments synthetic and sim-to-real task with real data. We provide the exact experimental details in Appendix E We make our implementation of the DPConvCNP public in the repository httpps://itthub.. com/ wwtp:/aggeell///ppppooooooo wtwpo//cggggpppppppmmmmmmm
DP-SGD baseline. Since, we are interested in the small-data regime, i.e. few hundred datapoints per task, we turn to Gaussian processes [GP: [Rasmussen and Williams] [006]. the gold-standard model for well-calibrated predictions in this setting. To enforce DP, we make the GP variational (Titsias 2009), and use DP-SGD [Abadi et al.) 2016) to optimise its variational parameters and hyperparameters. This is a strong baseline because GPs excel in small data, and DP-SGD is a state- of-the-art DP fine-tuning algorithm. We found it critical to carefully tune the DP-SGD parameters and the GP initialisation using BayesOpt, and devoted substantial compute on this to ensure we have maximised GP performance. We refer to this baseline the DP-SVGE For details Appendix D
General setup. In both synthetic and sim-to- real experiments, we first tuned the DP as well as the GP initialisation parameters of the DP- 0.5
1.5
1.0
-H+
Posoo FOr
SVGP synthetic data using BayesOpt. We
0.0
then trained the DPConvCNP on synthetic data
1.5
DP-SVGP
DPConvCNP
from the same generative process. Last, we
NLL
1.0
tested both models on unseen test data. For the
0.5
DP-SVGP, testing involves DP fine-tuning its variational parameters and its hyperparameters on each test set. For the DPConvCNP, testing involves a single forward pass through the net- work. We report results in Figures and 7 and discuss them below.
0.0
0.1
1.0
10.0
Time (s)
Figure 5: Deployment-time comparison on Gaus- sian (top) and non-Gaussian (bottom) data. We ran the DP-SVGP for different numbers of DP-SGD steps to determine a speed versus quality-of-fit tradeoff. Reporting 95% confidence intervals.
5.1 Synthetic tasks
Gaussian data. First, we generated data from a GP with an exponentiated quadratic (EQ) covariance (Figure 6 top), fixing its signal and noise scales, as well as its lengthscale f. For each l we sampled datasets with N ~ [11 512] and privacy budgets with e <~ 24[0.90, 4.00] and 8 = 10 -3, We trained and DPConvCNPs for each é and tested them unseen data from the same generative process -nnottiots Figure 6.. These models can handle different privacy budgets but only work well for the lengthscale they were trained on. In practice not known a priori. To make this task more realistic, we also trained a single DPConvCNP on data with randomly sampled f &~ 20(2, 2.00] (amortised; Figure 6. This model implicitly infers & and simultaneously makes predictions, under DP. We also show the performance of the non-DP Bayes posterior, which is optimal (oracle; ttop). See Appendix E. for more details.
separate
appropriate lengthscale is
DPConv competes with DP-SVGP. Even in the Gaussian setting, where the DP-SVGP is given the covariance of the generative process, the DPConvCNP remains competitive (red and
8

---

2.0
1.00, 0.25
2= e=0,,,06007 0.70
e= 1.00, 2.00
EQ
1.0
0.0
2.0
3.00. 0.25
e= 0.71
3.00, /=
EQ
NLL
1.0
0.0
Sawtooth Sawtooth
1.0
8= 1.00, 4=000
1.00, r= 2.00
2= 1.00 1.00
0.5
0.0
1.0
3.00 4.0.0
C= 3,00, == 2.00
c= 3,00
1.00
NLL
0.5
0.0
100
200
300
400
500
200
300
400
500
100
200
300
400
500
N
EV
NV
Oraole
DP-SVGP (noo-amortised)
DFCoavCNP (oon-amortisel)
DPCorvCNP (amortised)
Figure 6: Negative log-lik log-likelihoods (NLL) of the DPConvCNP and the DP-SVGP baseline on synthetic data from EQ GP (top two rows; EQ lengthscale f) and non-Gaussian data from sawtooth waveforms (bottom two rows; waveform period r). For each point shown we report the mean NLL with its 95% confidence intervals (error bars too small to see). See Appendix C.2 for example fits.
purple in Figure 6 top). While the DP-SVGP outperforms the DPConvCNP for some N and l, the gaps are typically small. In contrast, the DP-SVGP often fails provide sensible predictions (see f = 0.25, N 300), and tends to overestimate the lengthscale, which is known challenge variational GPs [Bauer et al., 2016). We also found that the DP-SVGP tends to underestimate the observation noise, resulting in over-smoothed and over-confident predictions which lead to counter-intuitive reduction performance as N increases. By contrast, the DPConvCNP gracefully handles different N and recovers predictions that are close to the DP Bayesian posterior for modest e and N, with runtimes several orders of magnitude faster than the DP-SVGP (Figure(5)
Amortising over l and privacy budgets. We observe that the DPConvCNP trained on range of lengthscales (green; Figure [ accurately infers the lengthscale of the test data, with only modest performance reduction compared to its -mootised counterpart (red). The ability of the DPConvCNP to implicitly infer while making calibrated predictions remarkable, given the DP constraints under which it operates. Further, we observe that the DPConvCNP works well across range of privacy budgets. amortising privacy budgets small. This is particularly appealing because single DPConvCNP can be trained on a range of budgets and deployed at test time using the privacy level specified by the practitioner, eliminating the need for separate models for different budgets.
preliminary experiments, we found that the performance loss due to
Non-Gaussian synthetic tasks. We generated data from a non Gaussian process with sawtooth signals, which has previously been identified as challenging task Bruinsma et al.) 2023). We sampled the waveform direction and phase using a fixed period 7 and adding Gaussian observation noise with fixed magnitude. We gave the DP-SVGE function, and truncating the Fourier series of the waveform signal to make continuous: otherwise, since the DP-SVGP cannot handle discontinuities in the sawtooth signal, it explains the data mostly as noise, failing catastropically, Again, we trained a separate DP-SVGP and DPConvCNE for each т, well single DPConvCNP model on randomly sampled -- ~ Z((0.00, 1.25), We report results in Figure (bottom), along with a non-DP oracle (blue). The Bayes posterior intractable, so we report the average NLL of the observation noise, which a lower bound to the NLL.
advantage by using periodic covariance
DPConvCNP outperforms the DP-SVGP. We find that, even though we gave the DP-SVGP significant advantages, the DPConvCNP still outperforms it, and produces near-optimal predictions even for modest N and e. Overall, our findings in the -on-Gaussian tasks mirror those of the Gaussian tasks. The DPConvCNP can amortise over different signal periods with very small performance drops (red, green Figure bottom). Given the difficulty of this task, the fact that the DPConvCNP can predict accurately for signals with different periods under DP constraints is especially impressive.

---

2.5
NLL
2.0
age / height
age / weight
Hoighh (cm))
1.0
Onaea Taga
0.5
8
Tape
2.5
NLL
==3.00
2.0
DESSVGP DRGGeNh
Weight (kg)
1.5
0.5
100
200
300
400
100
200 300
400
N
N
Age (years)
Age (years)
Figure 7: Left; Negative log-likelihoods of the DPConvCNP and the DP-SVGP baseline on the sim to real task with the !Kung dataset, predicting individuals' height from their age (left col.) or their weight from their age (right col.). For each point shown here, we partition each dataset into context and target at random, make predictions, and repeat this procedure 512 times. We report mean NLL with its 95% confidence intervals. Error bars are to small to see here. Right; Example predictions for the DPConvCNP and the DP-SVGP, showing the mean and 95% confidence intervals, with N = 300, e = 1.00, = 10-3, The DPConvCNP visibly better-calibrated than the DP-SVGP.
5.2 Sim-to-real tasks
Sim-to-real task. We evaluated the performance of the DPConvCNP in sim-to-real task, where we train the model on simulated data and test it on the the Dobe !Kung dataset [Howell 2009]. also used by /mith al. [ containing age, weight and height measurements of 544 individuals. We generated data from GPs with Matérn-3/ 22 covariance, with a fixed signal scale of a. = 1.00, randomly sampled noise scale on ~ 24(0.00, 0.60) and lengthscale & ~ 4[0.50, 2.00]. We chose Matémn-3/2 since its paths are rougher than those of the EQ, and picked hyperparameter ranges via back-of-the envelope calculation, without tuning them for the task. We trained a single DP-SVGP and DPConvCNP with ~ [10.900 4.00] and 6 10-3, We consider two test tasks: predicting the height or the weight of an individual from their age. For each N, we split the dataset into a context and target at random, repeating the procedure for multiple splits.
Sim-to-real comparison. While the two models perform similarly for large N, the DPConvCNP performs much better for smaller N (Figure 7 left). The DPConvCNP predictions are surprisingly good even for strong privacy guarantees, e.g. c 1.00, 8 = 10-3 and a modest dataset size (Figure 7 right), and significantly better-calibrated than those of the DP-SVGP, which under-fits. fits. Note we have not tried to tune the simulator or add prior knowledge, which could further improve performance.
Limitations & Conclusion
Limitations. The OPConvCNP does not model dependencies between target outputs, which is a major limitation. This could be achieved straightforwardly by extending our approach to LNPs, GNPs, or ARNPs. Another limitation that the efficacy of any sim-to-real scheme is limited by the quality of the simulated data. If the real and the simulated data differ substantially, then sim-to- sim-to-real transfer has little hope of working. This can be mitigated by simulating diverse datasets to ensure the real data are in the training distribution. However, simulator diversity increases, predictions typically become less certain, so there is a sweet spot in simulator diversity. While we observed strong sim-to-real results, exploring the effect of this diversity is valuable direction for future work.
Broader Impacts. This paper presents work whose goal advance the field of DP. Generally, we view the potential for broader impact of this work generally positive. Ensuring individual user privacy is critical across a host of Machine Learning applications. We believe that methods such as ours, aimed at improving the performance of DP algorithms and improve their practicality, have the potential to have a positive impact on individual users of Machine Learning models.
We proposed an approach for DP meta-learning using NPs. We leveraged and improved upon the functional DP mechanism of Hall et al. 2 and showed how can be naturally built into the ConvCNI to protect the privacy of the mesa-test set with DP guarantees. Our improved bounds for the functional DP mechanism are substantial, providing the same privacy guarantees with a 30% lower noise magnitude, and are likely of independent interest. We showed that the DPConvCNP competitive and often outperforms a carefully tuned DP-SVGP baseline on both Gaussian and non-Gaussian synthetic tasks, while simultaneously being orders of magnitude faster at meta-test time. Lastly, we demonstrated how the DPConvCNP can be used as a sim-to-real model in a realistic evaluation scenario in the small data regime, where it outperforms the DP-SVGP baseline.
Conclusion.
10

---

Acknowledgements
This work was supported in part by the Research Council of Finland (Flagship programme: Finnish Center for Artificial Intelligence, FCAI as well Grants 356499 and 359111), 1). the Strategic Research Council at the Research Council of Finland (Grant 358247) as well as the European Union (Project 101070617) Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them. SM is supported by the Vice Chancellor's s and Marie and George Vergottis Scholarship, and the Qualcomm Innovation Fellowship. Richard E. Turner is supported by Google, Amazon, ARM, Improbable, EPSRC grant EP/T005386/1, and the EPSRC Probabilistic AI Hub (ProbAI, EP/Y028783/I).
References
Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2016.
Takuya Akiba, Shotaro Sano, Toshihiko Yanase, Takeru Ohta, and Masanori Koyama. Optuna: A next-generation hyperparameter optimization framework. In The 25th ACM SIGKDD International Conference Knowledge Discovery & Data Mining, pages 2623-2633 2019.
Francesco Aldà and Benjamin Rubinstein. The Bernstein Mechanism: Function Release under Differential Privacy, In Proceedings of the AAAI Conference on Artificial Intelligence, volume 31, 2017.
Matthias Bauer, Mark van der Wilk, and Carl Edward Rasmussen. Understanding probabilistic sparse Gaussian process approximations. In Advances in Neural Information Processing Systems, volume 29, 2016.
John Bronskill. Data and computation efficient meta-learning, PhD thesis, University of Cambridge, 2020.
Michael M. Bronstein, Joan Bruna, Taco Cohen, and Petar Velickovic. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges. arXiv preprint arXiv:2104.13478, 2021.
Wessel Bruinsma, Stratis Markou, James Requeima, Andrew Y. K. Foong, Tom Andersson, Anna Vaughan, Anthony Buonomo, Scott Hosking, and Richard E Turner. Autoregressive conditional neural processes. In The Eleventh International Conference on Learning Representations, 2023.
Taco Cohen and Max Welling. Group equivariant convolutional networks. In Proceedings of The 33rd International Conference Machine Learning, volume 48 of Proceedings of Machine Learning Research, pages 2990 2990-2999. PMLR, 2016.
Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, and Borja Balle. Unlocking High-Accuracy Differentially Private Image Classification through Scale. arXiv preprint arXiv:2204.136500 2022.
Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian Differential Privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3-37, 2022.
Vincent Dutordoir, Alan Saul, Zoubin Ghahramani, and Fergus Simpson. Neural diffusion processes. In International Conference on Machine Learning, pages 8990-9012. PMLR, 2023.
Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4:221 1122211-07,, 2014.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. Calibrating Noise to Sensitivity in Private Data Analysis. Third Theory of Cryptography Conference, volume 3876 of Lecture Notes in Computer Science, pages 265-284. Springer, 2006.

---

Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-Agnoste Meta- Meta-Learning for Fast Adaptation of Deep Networks. In Proceedings of the 34th International Conference on Machine Learning. PMLR, 2017.
Andrew Foong, Wessel Bruinsma, Jonathan Gordon, Yann Dubois, James Requeima, and Richard Turner Meta-learning stationary stochastic process prediction with convolutional neural processes. In Advances in Neural Information Processing Systems, volume 33, pages 8284-8295, 2020.
Marta Garnelo, Dan Rosenbaum, Christopher Maddison, Tiago Ramalho, David Saxton, Murray Shanahan, Yee Whye Teh, Danilo Rezende, and S. M. Ali Eslami. Conditional Neural Processes. In Proceedings of the 35th International Conference on Machine Learning, pages 1704-1713. PMLR, 2018a.
Marta Garnelo, Jonathan Schwarz, Dan Rosenbaum, Fabio Viola, Danilo J. Rezende, S. M. Ali Eslami, and Yee Whye Teh. Neural Processes. arXiv preprint arXiv:1807.01622. 2018b.
Jonathan Gordon, Wessel P. Bruinsma, Andrew Y. K. Foong, James Requeima, Yann Dubois, and Richard E. Turner. Convolutional Conditional Neural Processes. In International Conference on Learning Representations, 2020.
Rob Hall, Alessandro Rinaldo, and Larry A. Wasserman. Differential privacy for functions and functional data. Journal of Machine Learning Research, 14(1):703-727,211
Nancy Howell. Dobe lkung census of all population.. 2009. URL httph: hwt.spaace..bbaarry.. utoronto. (taaa/lee1117/179999 License: All right reserved.
Daolang Huang, Manuel Haussmann, Ulpu Remes, S. T. John, Grégoire Clarté, Kevin Luck, Samuel Kaski, and Luigi Acerbi. Practical Equivariances via Relational Conditional Neural Processes, In Advances in Neural Information Processing Systems, volume 36, 2023.
Dihong Jiang, Sun Sun, and Yaoliang Yu. Functional Rényi Differential Privacy for Generative Modeling. In Thirty-Seventh Conference on Neural Information Processing Systems, 2023.
Jeffrey Li, Mikhail Khodak, Sebastian Caldas, and Ameet Talwalkar. Differentially Private Meta- Learning. In International Conference Learning Representations, 2020.
Xuechen Li, Florian Tramèr, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In The Tenth International Conference Learning Representations, ICLR, 2022.
Stratis Markou, James Requeima, Wessel P. Bruinsma, Anna Vaughan, and Richard E. Turner. Practical conditional neural processes via tractable dependent predictions. In Proceedings of the 10th International Conference on Learning Representations, 2022.
Ilya Mironov. Rényi Differential Privacy. In 30th IEEE Computer Security Foundations Symposium, pages 263-275, 2017.
Ardalan Mirshani, Matthew Reimherr, and Aleksandra Slavković. Formal Privacy for Functional Data with Gaussian Perturbations. In Proceedings of the 36th International Conference on Machine Learning, pages 1-595-4608 PMLR, May 2019.
Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint arXiv: 029999 2018.
Carl Edward Rasmussen and Christopher KI Williams. Gaussian Processes for Machine Learning. MIT Press, 2006.
Michael T. Smith, Mauricio A. Álvarez, Max Zwiessele, and Neil D. Lawrence. Differentially Private Regression with Gaussian Processes. In Proceedings of the Twenty-Firsl International Conference Artificial Intelligence and Statistics, pages 1195-1200 1203. PMLR, 2018.
Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical Networks for Few-shot Learning. In Advances in Neural Information Processing Systems, volume 30, 2017.
12

---

Xinyu Tang, Ashwinee Panda, Vikash Sehwag, and Prateck Mittal. Differentially Private Image Classification by Learning Priors from Random Processes. In Thirty-Seventh Conference on Neural Information Processing Systems, 2023.
Michalis Titsias. Variational learning of inducing variables in sparse Gaussian processes. In Artificial intelligence and statistics, pages 567-574. PMLR, 2009.
Marlon Tobaben, Aliaksandra Shysheya, John Bronskill, Andrew Paverd, Shruti Tople, Santi- ago Zanella Béguelin, Richard E. Turner, and Antti Honkela. On the efficacy of differentially private few-shot image classification. Transactions on Machine Learning Research, 2023.
Florian Tramèr, Gautam Kamath, and Nicholas Carlini. Position:
Considerations for Differentially Private Learning with Large-Scale Public Pretraining. In Proceedings of the 41st International Conference on Machine Learning, pages 48453 48467. PMLR, 2024.
Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al. Matching networks for one shot learning. Advances neural information processing systems, 29, 2016.
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Πla Mironov. Opacus: User-friendly differential privacy library in PyTorch. arXiv preprint arXiv:2109. /2298, 2021.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially Private Fine-tuning of Language Models. In International Conference on Learning Representations, 2021.
Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexander J Smola. Deep sets. In Advances in Neural Information Processing Systems, volume 30, 2017.
Xinyu Zhou and Raef Bassily. Task-level Differentially Private Meta Learning. In Advances in Neural Information Processing Systems, volume 35, 2022.
13

---

A Differential Privacy Details
A.1 Measure-Theoretic Details
Definition 3.1 is the typical definition of (c, 6)-DP that is given in the literature, but it glosses over some measure-theoretic details that are usually not important, but are important for the functional mechanism. In particular, the precise meaning of "measurable" is left open. Here, we make the a-field that "measurable" implicitly refers explicit:
Definition A.1. An algorithm M is (e, 8, A)-DP for a o-field Af. for neighbouring datasets D, D' and all A E A.
Pr(M(D) E A) Pr(M(D') +
(13)
Hall et al. 2013 point out that the choice of AA is important, and insist that A be the finest o-field on which M(D) is defined for all D. When the output of the mechanism is discrete, or an element
of IR" this corresponds with the a-field that typically implicitly used in such settings. When the output is a function, as in the functional mechanism, the choice of A is not as clear [Hall et al. 2013 Note that A is similarly implicitly present in the definition of GDP (Definition 3.2).
Next, we recall the construction of the appropriate o-field for the functional mechanism from Hall et al. [0033] Let 7 be index set. We denote the set of functions from T to R as R For [1.....; Fn E T and Borel set B E B(R)),
Cs.B = (f RD (. ((T)) E B}
(14)
is called a cylinder set of functions. Let Cs = {Cs.n B E B(R")) and
Fo
Cs.
(15)
S:18|<co
Fo is called the field of cylinder sets. (c, 6, Fo) DDP amounts to (c. 8, ) for any evaluation of f at finite vector of points (.i,..., F.. E T of any size n E N (Hall et al. 2013).
The o-field for the functional mechanism is the o-field F generated by Fo Hall et al. 2013). It turns that (e, 6, FDP is sufficient for (e, 6, FP.
A.2 General Definition of the Funetional Mechanism
Definition A.2. Let be a sample path of a Gaussian process having mean zero and covariance function k. Let {fo E D} C g be family of functions indexed by datasets satisfying the inequality
A (
11. S.A
sup sup D ncce (ET
sup
(16)
with
[n((r)) - (x1)
A
(a) D2D'
1/2 1M (11,,
(fo(zn) - SD (xa)
where M (x1...... En)i 2z). The functional mechanism with multiplier and sensitivity A defined as
M(D) = JD + cg.
(17)
If is member of reproducible kernel Hilbert space (RKHS) H with the same kernel k: the noise process the sensitivity bound of Definition AA2 is much simpler:
Lemma A.3 Hall et al. 2013). For a function f in an RKHS H. with kernel k.
Auf
def sup llfe - fD I A. D-D'
(18)
implies T6)
This is small abuse of notation, Fo is o -ield..
14

---

A.3 Proof of Theorem 4.1
To prove Theorem we need a GDP version of a lemma from Hall et al. 2013
Lemma A.4. Suppose that, for positive definite symmetric matrix M Raxd, the function
f: F R2 satisfies
sup
A.
(19)
DeD
Then the mechanism M that outputs (Gaussian mechanism)
M(D) f(D) cZ, Z ~~ ~a(0,0
is jt-DP with c
Proof. We can write
M(D) = M M-1/2 f(D)+)), S Na0,0..
M(D)=
Denote MD) M/1 1/2 S(D) + S. MM' is Gaussian mechanism with variance 1. Because of 19
M/1/3 f(D) has sensitivity
sup D-D'
1/1/2 1/2
S(D)
M M/1
S(D')
A
so M' is μ-GDP by Theorem
3.5 M is obtained by post-processing M', it is also y-GDP.
Theorem 4.1. The functional mechanism with sensitivity A and multiplier = A/u p-GDP.
Proof. Let T be the index set of the Gaussian process G, and let S (I1, (.i...., Zn. E T". Then (G(z1)..... G(xn)) )) has a multivariate Gaussian distribution with mean zero and covariance Cov (G(x)) G(r))) K( (.). Then the vector obtained by evaluating M(D) at (2i,.-., M.) is
μ-GDP by Lemma A.4. as 16 implies the sensitivity bound (9).. Theorem 3.5 gives a curve of for all
from J..
This holds for any S E T and any n E N, so M is Fo) for all e 2 0, which immediately implies (e, FDDD, This curve can be converted back to μ-GDP (with regards to F) using Theorem 3.5
A.4 Functional Mechanism Sensitivities for DPConvCNP
To bound the sensitivity of r(d) and r(() for the functional mechanism, we look at two neighbouring
context sets ((o) ((x()) vn. )) and D. ((x.1) (())))))))))) ( that differ only in the points
(x1, V1) ((e) and (zz, V2) E ( Let y for E {1,2] denote (d) from I0 computed from D(o)
D( and define (s) "(")) similarly.
Denote the RKHS the kernel & by H. The distance in between the functions kz, = k((1, and kr, k(22,-) :) is given by
liker 1sg = (Kiz) king kirs) 7
(20)
= k(x1, 2k(11, x22 + 22)
(21)
< 20k-
(22)
For the RBF kernel, this is tight bound without other assumptions on x, as k(x, = Cs for all and k(21, x2) can be made arbitrarily small by placing Ii and 22 far away from each other.
15

---

The sensitivity of p(4)) for the functional mechanism can be bounded with (22 0 for.
A Axrlld)
sup D ws
(d)
D/
r
(d)
(23)
H
sup
Σ
(k (e)
- (c)
(24)
~g
19
sup
||km
Kag
l
(25)
21.22
$ 2Ckx
(26)
where the second last line follows from the fact that D and D/ only differ in one datapoint. This is tight bound for the RBF kernel, because when = x1. kz, (x) = and (x:) can be made arbitrarily small by moving 22 far away from æ.
For p()) and any function o with (o(v)] s C, we first bound
|1 )km, 6 (i2))in. 11:
(27)
- (00))))((2))(())))))) + (x2,))
(28)
S Ck.
(29)
Again, these are tight bounds for the RBF kernel if we don't constrain r or further.
The H-seniitivity for (*) is then derived in the same way as the sensitivity for p(4) giving
Azr(ts) S CC
(30)
A.5 Gaussian Mechanism for DPConvCNP
naive way of releasing r(z) under DP is to first select discretisation points , in some way, and release r(z1)...., with the Gaussian mechanism. The components of r, (()) and (d)) have the following sensitivities:
(x)
sup 1 ~ D
r
(d) D
(x) (2) D
(xr)
(31)
2
sup D/ ~g D2.
Σ
(k (c) (x) co) (x))
(32)
sup
|kz, (I) kiz (x))
(33)
< C2-
(34)
Line 33
follows from the fact that D and D only differ one datapoint.
For (*) (x), have
(o(y)) (x) ((y2)kn, (x) 40*C2.
(35)
Then we get
(2)(0) (x) S 40
(36)
following the derivation of (2) For the RBF kernel, this is again tight without additional assumptions on y or x.
These sensitivities give the following privacy bound:
Theorem A.5. Let A2 4C2C2 and A = Cz. Releasiin n evaluations of r(x)
(x), (z)) with the Gaussian mechanism with noise variance o² is μ-GDP for
A2 +
#
n1
(37)
16

---

Proof. Releasing n evaluations of r(z) is simply an n-fold composition of Gaussian mechanisms that release (x) for one value. Relcasing rax) for one value is composition of releasing r r(d) (x) and (()) (z), which have the sensitivities A, and Ag. Now Theorems 3.5 and 3.4 prove the claim.
As 14 scales with n, this method must add a large amount of noise for even moderate numbers of discretisation points.
The difference between having factor of C% in the Lz-sensitivities and Cs in the H-sensitivities is explained by the fact that the kernel also directly affects the noise variance for the functional mechanism, but it does directly affect the noise variance with the Gaussian mechanism. This can be illustrated by considering what happens when the kernel is multiplied by a constant u > O. This multiplies C by u. and multiplies the L2 Le-seisitiiities by u², For the Gaussian mechanism, this means multiplying the noise standard deviation by u, but simultancously multiplying all released values by u, which does not change the signal-to-noise ratio. For the functional mechanism, multiplying the kernel values effectively multiplies by vu and the squared sensitivities by which then cancel each other in p.
For the RBF kernel and clipping function ø with threshold = 1, we see that (2r(()) = while A3r(d) = 1, and ( = 4, while 2A3r(e) = 4, so the functional mechanism adds noise with slightly more variance as releasing single value with the Gaussian mechanism, so the functional mechanism adds noise of less variance when 2 or more discretisation points are required. However, the functional mechanism adds correlated noise, which is not as useful for denoising the uncorrelated noise that the Gaussian mechanism adds.
A.6 Details on Figure
In this section, we go the details of the calculations behind Figure 4 The "classical" line of the
figure is computed from Theorem 3.7 The GDP line uses Definition 3.2 to convert the (e, 5,5) -pair
into a GDP y bound by numerically solving for z in E5.( is then found with Theorem 4.1
For the RDP line, we get an RDP guarantee from Corollary 2 of Diang al. [023], which we convert
to (e, 8) with Proposition 3 of Jiang et al. [2023] These give the equation
o,2
Ind
(38)
2g
a-1'
where a: >>> 1 is parameter of RDP that can be freely chosen. The a value that minimises é is
2o lnd
+1.
(39)
A
Plugging a" into Eq. 38 gives the quadratic equation
A In 8
A² =0
-ea² + +21
(40)
that can be solved for a.
To that choosing the a that minimises also leads the smallest o that satisfies given (e, 6)- bound, let
a^
In
e(a, 0)
(41)
2g
and let o² be the solution to Eq. (40). Let Or, a be another pair that satisfies the (c, -bouund Since
a" is chosen to minimise 6, c(a" o)) S <(a, a). We can assume that c(a,a) = (()" -)= c, since otherwise we could reduce a further. Now
E(a" (a"), = =c=
(42)
so c(aa"(")) ((aa a). ()) By manipulating Eq. decreasing, so this implies that o".
40). we can see that e(a"()),) is strictly
17

---

Algorithm 4 Efficient sampling of GP noise on a D-dimensional grid.
Input Dimension-wise grid location ud R, spacing na E R. and number of points Na N, Product kernel RDD x TR - R with factors kid : R x -.
Output: Sample fni...n from GP with kernel k on grid inputs zn defined by uds Tos Na.
Sample fni...nD (O 1) for each 1 S na S Na. 1,..., D {Sample Gaussian noise) for d = 1 to D do
K ddnm t- ka(ua + nyd, Ud + mm/a for 0 S n. m S Na |Compute covariance)
Ld f CHOLESKY(KA) (Compute Cholesky factor)
f MATMULALONGDIM(44; f.d) (Matmul by L, along dimension d}
end for
B Efficient sampling of Gaussian process noise
In order to ensure differential privacy within the DPConvCNP, we need to add GP noise (from a GP with an EQ kernel) to the functional representation outpuited by the SetConv. In practice, this is implemented by adding GP noise on the discretised representation, i.c. the data and density channels.
While sampling GP noise is typically tractable if the grid is one-dimensional, the computational and memory costs of sampling can easily become intractable for two- or dine--dimesiional grids. This is because the number of grid points increases exponentially with the number of input dimensions and, in addition to this, the cost of sampling increases cubically with the number of grid points. Fortunately, we can exploit the regularity of the grid and the fact that the EQ kernel is product kernel, to make sampling tractable. Proposition B.. illlsttrte how this can be achieved.
Proposition B.1. Let I E IN x.N.NN be a grid of points in RD given by
Emi... DD = (w) + (m] - 1)....... un + (nD 1)YD),
(43)
where un E R. Ra E R. and S na E S for each d -,.... D. Also let k: RR. be a product kernel, iee. kernel that satisfies
x R.
TR.
k(2,2)
II ka(2a, d=1
(44)
for some univariate kernels ka : R - R. for every 2, E R, let
Kanm = ka(us + (n- 1)ya, ud - (m - 1)7a)
(45)
and let La be a Cholesky factor of the matrix K Then if emi... un R N(0, 1) is a grid of corresponding i.i.d. standard Gaussian noise, the scalars fni..nn R. defined as
N1
ND
fn AD
Lingks
Loapko Ek.... kp:
(46)
kp=1
are Gaussian-distributtd, with zero mean and covariance
Clfar.. no, fmi.... mp] = k(Ens... no: Fmi... mp).
(47)
Before giving the proof of Proposition B.I we provide pseudocode for this approach in Algorithm and discuss the computation and memory costs of this implementation compared to naive approach. Naive sampling on a grid of N1 covariance matrix of the entire grid and then multiplying standard Gaussian noisy by this factor. We discuss the costs of these operations, comparing them to the efficient approach.
x ND points requires computing a Cholesky factor for the
Computing Cholesky factors. The cost of computing Cholesky factor for covariance matrix of the entire N, x ... x ND grid incurs a computation cost of O(N x ... x Ng and a memory cost of ON? x ... x N. By contrast, Algorithm 4 only ever computes Cholesky factors for NA Na covariance matrices, so it incurs a computational cost of O Ede N²) and memory cost of O E 1=1 N2), which are both much lower than those of naive implementation. For clarity, if
18

---

Ni - ND = N. naive factorisation has O(N3D) computational and ( memory cost, whereas the efficient implementation has (DDN2) computational and ODDN2) memory cost.
Matrix multiplications. addition, naively multiplying the Gaussian noise by the Cholesky factor of the entire covariance matrix incurs (N? x x ND) computation cost. On the other hand, in Algorithm 4 we perform D batched matrix-vector multiplications, where the dhh multiplication consists of -g Na matrix- vector multiplications, where a vector with Na entries is multiplied by an Na Na matrix. The total computation cost for this step only O O N3 Il Nar For example, if N1 =.... ... = ND = N, naive matrix-vector multiplication has a computation cost of O(N2D), whereas the efficient implementation has computation cost of O(N++1).
In Algorithm CHOLESKY denotes a function that computes the Cholesky factor of a square positive- f, d) denotes the batched matrix-vector multiplication of
definite matrix. MATVECALONGDIMM an array f by a matrix La along dimension d, batching over the dimensions d' * d. Specifically, given D-dimensional array b with dimension sizes N ND and an Na Na matrix A, the matrix-vector multiplication of b by A along dimension outputs the D-dimensional array
No. Σ j=1
MATVECALONGDDIM A,b, d)
Angg J Pay1-..0pp
(48)
From the above equation, we can see that initialising f with standard Gaussian noise, and batch- multiplying f by La along dimension d for each d 1,..., D, amounts to computing the nested sum in Equation (46). Note that the order with which these batch multiplications are performed does not matter: it does not change neither the numerical result nor the computation or memory cost the algorithm.
Proof of Proposition B.I From the definition above, we see that fni... is a linear transformation of Gaussian random variables with zero mean, and therefore also has zero mean. For the covariance, again from the definition above, we have
C [f ap. Smi... mp)
(49)
N2
No
ND Σ Ip=1
C
Lingk
LDmpkD fk.... kp
I Limph
Lomplp 61... lp
(50)
=1=
kn=1
4=1
N1
ND
C
Σ
Linki
LDnpko 6k... kp:
Σ
Limp4 ... Limplo fg... lp
(51)
=1
kp=1
Ip=1
Ni
Np
N
Np
E
Σ
Linght ... LDapko ck kD
Σ
Limbh
LDmplo Cl... lp
kp=1
p=
(52)
where we have used the fact that the expectation of f is zero. Now, expanding the product of sums above, taking the expectation and using the fact that em.... are i.i.d., we see that all terms vanish, except those where has la for all d = L....,,. D. Specifically, we have
C [m nos Smy... mn)
(53)
N
Np
Ni
Np Lingk
E
LDapko Limah LDmoto Ck... kp 4... dp
(54)
kp=1
1=1
b==
Ni
No
N;
Np
Linki LDmpko Limih LDmplo [Ck kp Ch kol
(55)
kp=1
4=1
pp=
No
Ni
No
Link ... LDapko Limils ... LDmplo 1 bi... kD=
(56)
Ap=llys
pp
Np
Linkk ... Lunkk Limiks ... L DDmko
(57)
19

---

=02.
0=7.11
2
1.00
NLL
13000
NLL
1,0
0.0
0
100
200
300
400
500
1.00
200
300
400
500
100
200
300
400
500
N
NN
N
cli,, density
Clip, density noise
Clip, density
Lower
Figure S1: DPConvCNP performance the GP modelling task, where the data generated using an EQ GP with lengthscale É. We train three models per e, combination, keeping 10-3 fixed as well as the clipping threshold C 2.00 and noise weight 0.50 fixed. Specifically, we train one model where only noise to the signal channel (red; no clip, no density), one model where noise and clipping are applied the signal channel (orange; clip, no density noise) and another model where noise and clipping to the signal channel as well as noise to the density channel are applied (green; clip, density noise). We also show the NLL of the oracle, non-DP, Bayesian posterior, which is the best average NLL that can be obtained on this task (blue). Lastly, we show a bound to the functional mechanism (black), which
lower bound on the NLL that can be obtained with the functional mechanism with C 2.00, / 0.50 on this task. We used 512 evaluation tasks for each N, l, e combination, and report mean NLLs together with their 95% confidence intervals. Note that the error bars are plotted but are too small to see in the plot.
No
Linkk Limik
Lpankn DDmpkn
(58)
K Kanama
(59)
d=1
K(Znn... RDt Tmi... mp).
(60)
which is the required result.
C Additional results
C.1 How effectively does the ConyCNP learn to undo the DP noise?
Quantifying performance gaps. In this section provide some additional results the per- formance the DPConvCNP and the functional mechanism. Specifically, we investigate the performance gap between the DPConvCNP and the oracle (non-DP) Bayes predictor. Assuming the data generating prior is known, which in our synthetic experiments it is, the corresponding Bayes posterior predictive attains the best possible average log-likelihood achievable. We determine and quantify the sources this gap in controlled setting.
Sources of the performance gaps. Specifically, the performance gap can be broken down into two main parts: one part due to the DP mechanism (specifically the signal channel clipping and noise, and the density channel noise) and another part due to the fact that to map the DP representation to an estimate of the Bayes posterior. To assess the performance gap introduced by each of these sources, perform controlled experiment with synthetic data from Gaussian process prior (see Figure
training neural network
Gap quantification experiment. We fix the clipping threshold value at C' = 2.00, which is sensible setting since the marginal confidence intervals of the data generating process 1196. We also fix the noise weighting t 0.50, which is again is sensible setting since it places roughly equal
20

---

importance to the noise added to the density and the signal channels. We consider three different settings for the prior lenghtscale (E 0.25, 0.71, 2.00) and two settings for the DP parameters (e = 1.00, 3.00 and fixed ė = 10-9). For each of the six combinations of settings, we train three different DPConvCNPs, one with just signal noise (red; no clip, no density noise), one with signal noise and clipping (orange; clip, no density noise) and one with signal noise and clipping and also density noise (green; clip, density noise). Note, only the last model has DP guarantees. We compare performance with the non-DP Bayesian posterior oracle (blue).
Lower bound model. When we only add signal noise to the ConvCNP representation (and do not apply clipping or add density noise), and the true generative process is a GP such as in this case, the predictive posterior (given the noisy signal representation and the noiseless density representation) a GP. That is because the data come from known GP, and the signal channel is a linear combination of the data (since we have turned off clipping) plus GP noise, so it is also a GP. Therefore, we can write down closed form predictive posterior in this case. We refer to this as the lower bound model (black) in Figure [ST] because for a given C and f, the performance of this model is lower bound to the NLL of any model that uses this representation as input. Note however that different lower bounds can be obtained for different C' and t.
We observe that the DPC with no clipping and no density noise (red) matches the performance of the lower bound model. This is encouraging as it suggests that the model is able to undo the effect of the signal noise perfectly. We also observe that applying clipping (orange) does not reduce performance substantially, which is also encouraging as it suggests that the model is able to cope with the effect of clipping on the signal channel, when it is trained to do so. Lastly, we observe that there is an additional gap in performance introduced due to noise in the density channel (green). This is expected since the density noise is substantial and confounds the context inputs. This gap reduces as the number of context points increases, which is again expected. From the above, we conclude that in practice, the model is able to make predictions under DP constraints that are near optimal, i.e. there is likely not a significant gap due to approximating the mapping from the DP representation to the optimal predictive map, with a neural network.
Conclusions.
C.2 Supplementary model fits for the synthetic tasks
We also provide supplementary model fits for the synthetic, Gaussian and non-Gaussian tasks. For each task, we provide fits for three parameter settings (& and r), two privacy budgets, four context sizes and two dataset random seeds. See Figures S2 to S5 at the end of this document, for model fits.
D Differentially-Privaal Sparse Gaussian Process Baseline
Here, we provide details of the differentially-prinn sparse variational Gaussian process (DP-SVGP) baseline.
Let D = (x, y) denote a dataset consisting of imputs N inputs x E X and N corresponding outputs
y y.v. We assume the observations are generated according to the probabilistic model:
f ~ GP(O, ke, x'))
N
(61)
ylf.x x II po. Po, (vnl 1==1
where ko denotes the GP kernel from which the latent function f is sampled from, with hyperparame- ters 0, and O2 denotes the parameters of the likelihood function. Computing the posterior distribution po pe(flx, y) is only feasible when the likelihood is Gaussian. Even when this is true, the computational complexity associated with this computation is O(N").
Sparse variational GPs Titsias 2009] offer a solution to this by approximating the true posterior with the GP
(f) pe(fzulu)gs(t
(62)
with u = fz), where z E M denote a set of M inducing locations, and (u) = NN(u m. S).
The computational complexity associated with this posterior approximation O(NM2), which is significantly lower if M < N. We can optimise the variational parameters = -(m, 2) by
21

---

optimisation of the evidence lower bound, LELBO:
(O, Φ) = (f) po - KL (L(s((u)llpo(
(63)
Importantly, LELBO also serves as lower bound to the marginal likelihood p and can optimise this objective with respect to both 0 and ø. Since the likelihood factorises, we can obtain an unbiased estimate the CELBO by sampling batches of datapoints. This lends itself to stochastic optimisation using gradient based methods, such as SGD. By replacing SGD with differentially--riiaal gradient-based optimisation routine (DP-SGD), we obtain our DP-SVGP baseline.
A difficulty in performing DP-SGD optimise model and variational parameters of the DP-SVGP baseline is that the test-time performance is a complex function of the hyperparameters of DP-SGD (i.e. maximum gradient norm, batch size, epochs, learning rate), the initial hyperparameters of the model (i.e. kemne hyperparameters. and likelihood parameters), and the initial variational parameters (i.e. number of inducing locations M). Fortunately, we considering the meta-learning setting, in which we have available to us a number of datasets that we can use to tune these hyperparameters. We do so using Bayesian optimisation (BO) maximise the sum of the LELBO'S 's for a number of datasets. To limit the number of parameters we optimise using BO, we set the initial variational mean and variational covariance to the prior mean and covariance, m 0 and S k(z, z)..
In Table ST we provide the range for each hyperparameter that we optimise over. In all cases, we fix the number of datasets that compute the LELBO for to 64 and the number of BO iterations to 200. We use Optuna [Akiha et al. 2019] to perform the BO, and Opacus (Yousefpour et al. 2021 to perform DP-SGD using the PRV privacy accountant.
Hyperparameter
Min
Max
Max gradient norm
1
20
Epochs
200
1000
Batch size
10
128
Learning rate
0.001
0.02
Lengthscale
0.1
2.5
Period
0.25
4.0
Scale
0.5
2.0
Observation noise
0.05
0.25
Table S1: The ranges SPD hyperparameter settings (upper half) and initial model hyperparam-
eters (lower half) over which Bayesian optimisation is performed for the DP-SVGP baseline.
E Experiment details
In this section we give full details for our experiments. Specifically, we describe the generative processes we used for the Gaussian, non-Gaussian and sim-to-real tasks.
E.1 Synthetic tasks
First, we specify the general setup that is shared between the Gaussian and non-Gaussian tasks. Second, we specify the Gaussian and non-Gaussian generative processes used to generate the outputs. Lastly we give details on the parameter settings for the amortised and the non-amortised models.
General setup. During training, we generate data by sampling the context set size N U[1, 512), then sample N context inputs uniformly in [-2.00, 2.00] and 512 target inputs in the range [-6.00, 6.00]. We then sample the corresponding outputs using either the EQ Gaussian process or the sawtooth process, which we define below. For the DPConv CNP we use 6,553,600 such tasks with a batch size of 16 at training time, which is equivalent to 409,600 gradient update steps. We do note however that this large number of tasks, which was used to ensure convergence across all variants of the models we trained, is likely unnecessary and significantly fewer tasks (fewer than half of what used) suffices. Throughout optimisation, maintain fixed set of 2,048 tasks generated
22

---

in the same way, as validation set. Every 32,768 gradient updates (i.e. 200 times throughout the training process) we evaluate the model on these held out tasks, maintaining a checkpoint of the best model encountered thus far. After training, this best model is the one we use for evaluation. At evaluation time, we fix N to each of the numbers specified in Figure 6 and sample N context inputs uniformly in [-2.00, 2.00] and 512 target inputs in the range 12000 2.00]. We repeat this procedure for 512 separate tasks, and report the mean NLL together with its 95% confidence intervals in Figure 6 For all tasks, we set the privacy budget with å 10 and ~ (00900, 4.00).
Gaussian generative process. For the Gaussian task, we generate the context and target outputs from a GP with the exponentiated quadratic (EQ) covariance, which is defined as
(I (---²)² o
x(xxx') o. exp
2
Sawtooth generative process. For the non-Gaussian task, we generate the context and target outputs from a the truncation of the Fourier series of the sawtooth waveform
2 An(2mT(dz/2 + 6) 2
f(x)
π m=1
m
where d ~ 1[] is direction sampled uniformly from [-1.1], T is a period and Φ E [0. 2x] is a phase shift. In preliminary experiments, we found that the DPConvCNP worked well with the raw sawtooth signal (i.e. the full Fourier series) but the DP-SVGP struggled due to the discontinuities of the original signal, so we truncated the series, giving an advantage to the DP-SVGP.
Non-amortised and amortised tasks. For the non-amortised tasks, we train and evaluate a single model for single setting of the generative parameter or т. Specifically, for the Gaussian tasks, we fix & = 0.50, 0.71 or 2.00 and train a separate model for each one, that is then tested on data with the same value of E. Similarly, for the non- Gausiann tasks, we fix T 0.25, 0.50 or 1.00 and train separate model for each one, that is again then tested on data with the same value of 7. For the amortised tasks, we sample the generative parameter é or T at random. Specifically, for the Gaussian tasks, we sample e ~ 2/(0.20, 2.50] for each task that we generate, and train a single model on these data. We then evaluate this model for each of the settings = 0.50, 0.71 or 2.00. Similarly, for the non-Gaussian tasks, we sample -- ~ 2/00200, 1.25] for each task that we generate, and train single model on these data, We then evaluate this model for each of the settings T 0.25, 0.50 or 1.00. The results of these procedures are summarised in Figure 6
E.2 Sim-to-real tasks
For the sim-to-real tasks we follow a training procedure that is similar to that of the synthetic experiments. During training, we generate data by sampling the context set size N ~ [112 then sample N' context inputs uniformly in [-1.00, 1.00] and 512 target inputs in the range [-1.00, 1.00). We then generate data by sampling them from a GP with covariance
k(x,2')= x(x,, 0%
(64)
where k3/2, is a Matern-3/2 covariance with lengthscale é [0.50, 2.00] and noise standard deviation on ~ [0,000 0.80]. For all tasks, we set the privacy budget at 5 = 10-3 and ~ (000900 4.00]. The Dobe !Kung dataset is publicly available in TensorFlow 2 [Abadi et al., 2016 specifically the Tensorflow Datasets package. Note that we rescale the ages to be between - -1.0 and 1.0 and normalise the heights and weights of users to have zero mean and unit standard deviation. We assume that the required statistics for these normalisations are public, but they could be released with additional privacy budget. Inaccurate normalisations would only increase the sim-to-real gap and reduce utility. but not affect the privacy analysis. At evaluation time, we fix N to each of the numbers specified in Figure We then sample N points random from the normalised !Kung dataset and use the remaining points as the target set. We repeat this procedure for 512 separate tasks, and report the mean NLL together with its 95% confidence intervals in Figure 7
E.3 Optimisation
For all our experiments with the DPConyCNP we use Adam with learning rate of x 10-1, setting all other options to the default TensorFlow 2 settings.
23

---

E.4
Compute details
We train the DPConvCNP on a single NVIDIA GeForce RTX 2080 Ti GPU, on a machine with 20 CPU workers. Meta-traine veta-training requires approximately 5 hours, with synthetic data generated on the fly. Meta-testing performed on the same infrastructure, and timings are reported in Figure
F DPConv CNP architecture
Here we give the details of the DPConvCNP architecture used in our experiments. The DPConvCNP consists of a DPSetConv encoder, and a CNN decoder followed by a SetConv decoder. We specify the details for the parameters of these layers below.
DPSetConv encoder and SetConv decoder. For all our experiments, we initialise the DPSetConv and SetConv lengthscales (which are also used to sample the DP noise) to X 0.20, and allow this parameter to be optimised during training. For the learnable DP parameter mappings t(p, N) sig(NN, (μ, N)) and C(p, N) exp(NNc N)) we use simple fully connected feedforward networks with two layers 32 hidden units each. For the discretisation step in the encoder, we use resolution of 32 points per unit for all our experiments. We also use fixed discretisation window of [- 7] for the synthetic tasks and [-2, 2] for the sim-to-real tasks. We did this for simplicity, although our implementation supports dynamically adaptive discretisation windows.
Decoder convolutional neural network. Most of the computation involved in the DPConvCNP happens in the CNN of the decoder. For this CNN we used a bare-bones implementation of a UNet with skip connections. This UNet consists of an initial convolution layer processes the signal and density channels, along with two constant channels fixed to the magnitudes d., dd of the DP noise used in these two channels, into another set of Cin channels. The result of the initial layer is then passed through the UNet backbone, which consists of N convolutional layers with stride of 2 and with output channels C (CI,..., Cw), followed by N transpose convolutions again with a stride of 2 and output channels C = (CN C1). Before applying each of these convolution layers, we create a skip connection from the input of the convolution layer and concatenate this to the output of the corresponding transpose convolution layer. Finally, we pass the output of the UNet through final transpose convolution with Cour = output channels, which are then smoothed by the SetConv decoder to obtain the interpolated mean and (log) standard deviation of the predictions at the target points. For all our experiments, we used Cin = 32, N = and C, 256. We used kernel size of for all convolutions and transpose convolutions.
24

---

5=
0.25
N=50
0=7.7
N=50
2=2.0
-2
= 100
é 0.25
N= 100
007.1
N= 100
2=2.00
N= 250
<= 0.25
N5
/ 6= 0.71
25
C -= 2.00
-2
N= 500
<= 0.25
N=500
i = 0.71
N= 500
2
-2
-2
2
N=
0.25
N=50
0=0.71
N=50
2
-2
N= 100
<= 0.25
N= 100
00771
N= 100
2.00
N 250
0=25
N= 250
f == 0.71
N= 250
f= 2.00
N 500
0.25
5=500
/=0.71
N=
2
-2
2
Figure S2: Example model fits for the DPConvCNP the EQ GP task. For all the above fits, a single amortised DPConvCNP is used, that is DPConyCNP that has been trained on EQ GP data with randomly chosen lengthscales ~ (0.200 2.50) and random privacy budgets, specifically e (000900, 4.00) and ě = 10 3 The first four rows correspond to e = 1.00 and the last four to = 3.00. We have fixed 5 10 3, Note that column- wise the datasets fixed, and are varying the context set size N.
25

---

5=
0.25
N=50
0=7.7
N=50
2=2.0
-2
N= 100
f' 0.25
N= 100
é 0.71
N= 100
t= 2.00
N= 250
<= 0.25
N=
<= 0.71
25
/= 2.00
W
-2
N= 500
0.25
500
/= 0.7.1
N= 500
2.00
WW
-2
2
N=
0.25
N=50
0.71
N=50
2.00
-2
N 100
( 0.25
N= 100
0.71
N= 100
l Z= 2.00
N 250
N= 250
0.711
N= 250
e = 2.00
-2
N 500
5=500
0=0.7
N= 500
2.00
-2
2
4
Figure S3: Same Figure S2 but with different dataset seed. Example model fits for the DPConvCNP on the EQ GP task. For all the above fits, a single amortised DPConvCNP is used, that DPConvCNP that has been trained
EQ GP data with randomly chosen lengthscales ~ (0,20, 2.50) and random privacy budgets, specifically ~ (00990, 4.00] and 10-3 The first four rows correspond to e 1.00 and the last four that column-win wise the datasets are fixed, and we are varying the context set size N.
3.00. We have fixed 10 Note
26

---

5=50
1.00
N=50
2.00
N=50
4.0.0
-2
N= 100
1.00
N= 100
2.00
N= 100
r.0.0
N= 250
1.00
250
== 2.00
N5
t= 4.000
-2
N= 500
1.00
5=500
== 2.00
N= 500
2= 4.00
-2
-2
2
N=
1.00
N=
2.00
N=50
4.00
-2
N= 100
1.00
N= 100
2.00
N= 100
4.00
N 250
1.00
250
2.00
N 250
4.00
-2
N 500
1.00
5=
== 2.00
50000
[ 4.00
-2
2
Figure S4: Example model fits for the DPConvCNP the sawtooth task. For all the above fits, a single amortised DPConyCNP is used, that is DPConvCNP that has been trained on sawtooth data with randomly chosen periods -- 2/ (((0.00 1.25) and random privacy budgets, specifically e (000900 4.00) and 5 10-3 The first four rows correspond to e 1.00 and the last four to = 3.00. We have fixed 5 10 -3, Note that column-wine the datasets fixed, and are varying the context set size N.
27

---

5=50
1.00
N=50
2.00
N=50
4.00
-2
N= 100
1.00
N= 100
2.00
N= 100
4.00
N= 250
== 1.00
250
== 2.00
25
t= 4.00
-2
N= 500
== 1.00
5=500
== 2.00
= 500
== 4.00
-2
-2
2
5=
1.00
5=50
2.00
N=50
4.00
-2
N= 100
1.00
N= 100
2.00
N= 100
4.00
N 250
1.00
250
== 2.00
N= 250
4.00
-2
N= 500
==
1.00
5=
== 2.00
N= 500
t 4.00
-2
2
Figure S5: Same Figure S4 but with different dataset seed. Example model fits for the DPConvCNP on the sawtooth task. For all the above fits, a single amortised DPConvCNP is used, that is DPConvCNP that has been trained on sawtooth data with randomly chosen periods -- ~ L (0,20, 1.25) and random privacy budgets, specifically ~ U (0.90, 4.00] and ő = 10 The first four rows correspond to e 1.00 and the last four 3.00. We have fixed 10 Note that column-wisg wise the datasets are fixed, and we are varying the context set size N.
28

---

1.5
=0.11,
Sawtooth
==2.00 c= 0.33, 2= -0
2.00 0.330
EQ
0.5
0.0
0.0
1.5
0=7.7
1.00, 8=
007.1
1.00, 0=
Sawtooth
1.0
200.
1.00,
==2.00.
1.00, 10-
EQ
NLI
1.0
NLL
0.5
0.5
0.0
0.0
100
200
300
400
500
100
200
300
400
500
100
200
300
400
500
100
200
300
400
500
N
N
N
Oracle
DPConvCNP (non-amortised)
DPConvCNP (amortised)
Figure S6: Additional results using the DPC on the EQ and sawtooth synthetic tasks with stricter DP parameters, namely all combinations of {1/s, } and å {10-3 10-0 10-3). The overall setup this figure identical to that in Figure except the amortised DPConvCNP trained on randomly chosen 24/²/s, 1] and fixed 10 10 and the nn-ammottied DPConvCNP models are trained on and 8 values as indicated on the plots. Then, both amortised and non-amonnnno con-mmortised models evaluated with the parameters shown on the plots. The DP-SVGP baseline not run due to time constraints in the rebuttal period: optimise than the DPConvCNP. We note that the amortisation gap, due to training model to handle a continuous range values, is negligible. We also note that as the number of context points N increases, the performance of the DPConvCNP approaches that of the oracle predictors.
significantly slower and more challenging to
000.0=000....0...... 3=10-3
N= 1=300,/00.1.. 1.000, 10
2. N= r=2.00 ==333, 8=10
N= == ==1.00 8=10
-2
-4
N= 1000 00771, c=0.33 1=
N=100, 00..1, c= 10.0 10-
N= 100, r=2.00 20, e=0.33, 8=10
N= 100, == 1.00, 8=10
252 0.7,1, 00333, 10
252 0=7.1 1.000, 1=00
-5250 r=2.00, c= 101
252 r= 2.00, 1.00, 8=10-3
N= /0771, 00..3, 10
5=0 /=
1.00, 8= 10
2.
N r=2.00 x= 1010
500. ==2.00 1000 6=10-3
-2
2
4
2
4
2
4
Figure S7: Illustrations of model fits the synthetic EQ and sawtooth tasks, using stricter DP paramters, for different context sizes N. Left: model fits of amortised DPConvCNPs trained on EQ data using M(1 //, and fixed 10 (first column) or å 10 (second column) and evaluated on the DP parameters shown in the plots. Right: same as the left plot, except the data generating process is the sawtooth waveform rather than an EQ Gaussian process. We observe that the DPConvCNP produces sensible predictions even under strict privacy settings.

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims of the paper, summarised at the end of the introduction accurately reflect the contributions of the paper made Sections and
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
Limitations are discussed in Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]

---

All novel theorems include either the full proof, or a proof idea with the reference to the full proof in the Appendix.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Yes, we give all necessary details in the main text and appendix D and provide our implementations in the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code

---

The authors should provide scripts to reproduce all experimental results for the new reproducible, they Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The code is included the supplementary material, and the Dobe !Kung
dataset [Howell] 2009 is freely available, e.g. through TF datasets Abadi et al. [2016].
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
public/guides/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ https/cccppllliggudeeeeeeeeeeeee Cooee///ddeeebmimiia ssi onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Yes, give all necessary details in the main text and appendix E
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Error bars are reported when appropriate, and documented in the figure captions.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes, these details are provided Appendix E.4
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
The paper conforms to the Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Broader impacts are discussed Section 6
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: The paper does not pose such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: License for the Dobe !Knn dataset (Howell 2009 is mentioned in the bibliography.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.paaeesstt paperswi thcode. cow/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Documentation is included in the code.
Guidelines:
The answer NA means that the paper does not release new assets. Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not include crowdsoureing experiments research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not include crowdsourcing experiments or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.


Reviews:
[{"review_id": "2cOhQM97bU", "reviewer": "Reviewer_Eg3Y", "summary": "Authors propose DPConvCNP, a meta-learning model with a functional DP mechanism. This model is a modification to the SetConv procedure, applying clipping and work from [Hall et al. 2013] with a tighter Gaussian mech. analysis from [Dong et. al 2022] to conduct a sensitivity analysis and privatize the algorithm. The authors then demonstrate empirically that DPConvCNP provides both performance and efficiency boosts relative to the baseline of applying DP-SGD to a neural GP process on both some synthetic tasks and the !Kung dataset.", "questions": "Q1 : My main question/concern with the work is *how* important is leveraging a powerful hyperparameter tuning library (like BayesOpt from Optuna) to adjust hyperparameters for the empirical performance of the proposed method DPConvSet? \n\nHaving worked with DP-SGD variants (like Opacus’s private engine for optimizers), it’s clear to me that minor fluctuations in hyperparameters affect performance drastically. Recent work [Papernot et. al https://arxiv.org/pdf/2110.03620], [Mohapatra et. al, https://arxiv.org/pdf/2111.04906], and [Koskela et. al, https://arxiv.org/pdf/2301.11989] touches on the importance of private tuning. Can the authors discuss the delta between untuned and tuned versions of their algorithms, to be more “honest” about the effects of hyperparameter tuning on both their baseline and their method? An experiment (even anecdotal) would be nice, although isn’t necessarily required.\n\nQ1.5 : Related in Q1, in section 4.3, you include privacy parameters in the meta training of DPConvCNP (as far as I can tell) by re-parameterizing. Can you explain how this maintains the ($\\epsilon,\\delta$)-DP guarantee if the iterative meta-learning procedure is conditioned on prior trainings?\n\nQ2 : It seems like a missed opportunity to discuss the shortcomings of standard supervised learners on small datasets, even a simple standard private regression (many open source implementations available, for example https://diffprivlib.readthedocs.io/en/latest/modules/models.html#linear-regression). Perhaps comparisons between standard learners and meta learners is not worth it in the data scenarios you explore? It’d be helpful for me if you could discuss this (a light experiment if appropriate).\n\nQ3 : Can the authors justify their choice of privacy hyperparameters in the text? I acknowledge that $\\epsilon$ of 1.0+ is definitely reported on in the literature and used practically, but it’s good to contrast this with  $\\epsilon < 1.0$, as this is the more theoretically comfortable private regime, in a strict sense. Adding results for this wider range of privacy parameters would strengthen the contribution.", "limitations": "The authors do a very nice job of highlighting the limitations of their work, alongside broader impacts. This is greatly appreciated!", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "Overall: The paper follows a standard format for a contribution in differential privacy for machine learning: adapt an existing ML approach (SetConv) in a DP setting through sensitivity analysis and the application of a DP mechanism (in this case, an adapted version of the functional mechanism given by Hall et. al). Then, they show that this approach outperforms a Naive application of DP to some other standard method (in this case, applying DP-SGD to a standard neural implementation of a GP, which would be an obvious first attempt at the problem).\n\nIn the Appendix, I reviewed the proofs and lemmas for Theorems 4.1 and 4.2, they checked out and the analysis is well presented. I did not spend time checking Proposition B.1; it seems like the main trick there is noticing that you can apply linearity of expectation over the grid. It would be good if another reviewer has reviewed this.\n\nS1. I find the quality of this submission’s presentation, from the intro to the supplementary appendix/proofs, to be exemplary. I commend the authors for the clarity of writing, notation, proofs and figures - it is refreshing, and worth highlighting. This is minus my minor nitpicks below, which will be easy to address.\n\nS2. I find the approach intuitive, and the analysis sound. The experimental results are compelling, and this method is clearly extensible, as the authors hint at in their limitations section.\n\nS3. The authors application of the [Dong et al.] result to the [Hall et al.] functional mechanism is indeed a nice contribution, and should be useful for future work.", "weaknesses": "I am deferring more substantial weaknesses to the questions section - broadly, I would like to raise my score, given adequate answers to my questions.\n\nNit: translation equivariant abbreviation TE should be introduced in the section where it is used heavily e.g. Section 3.2, not in the intro, along with a citation, which is confusing and gets lost for the reader.\n\nNit: in Section 5, line 259, “we make the GP variational…” is maybe missing a word or two.\n\nNit: In paragraph “Gradient based vs amortized…” in Section 3, the “on one hand…on the other hand” construction is difficult to follow, please restructure.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1 : My main question/concern with the work is how important is leveraging a powerful hyperparameter tuning library (like BayesOpt from Optuna) to adjust hyperparameters for the empirical performance of the proposed method DPConvSet?\n\nWe only use Optuna and BayesOpt on the DP-SVGP baseline. We did not perform any BayesOpt tuning on any hyperparameters of the DPConvCNP.\n\nInstead, rather than performing BayesOpt, the DPConvCNP “tunes” the parameters (but no hyperparameters such as model size) of the backbone network as well as the NNs for parameterising the DP clipping threshold $C$ and noise weight $t$ (Section 4.3) by performing gradient descent on synthetic data. We found our procedure to work well out-of-the-box and did not make any further efforts to optimize the DPConvCNP.\n\n> Q1.5 : Related in Q1, in section 4.3, you include privacy parameters in the meta training of DPConvCNP (as far as I can tell) by re-parameterizing. Can you explain how this maintains the (epsilon, delta)-DP guarantee if the iterative meta-learning procedure is conditioned on prior trainings?\n\nDuring meta-training, DPConvCNP only uses simulated data, so meta-training does not have any impact on the privacy of the real data. We include the noise addition, clipping and other privacy-related computations during meta-training in order to make the model learn the same task it will do during meta-testing, either for single privacy parameters or over a range of privacy parameters. In turn, at meta-testing, the DPSetConv ensures that the data representation of the private data is $(\\\\epsilon, \\\\delta)$-DP.\n\n> Recent work [...] touches on the importance of private tuning. Can the authors discuss the delta between untuned and tuned versions of their algorithms, to be more “honest” about the effects of hyperparameter tuning on both their baseline and their method?\n\nBoth the DPConvCNP and the DP-SVGP are trained on simulated data without any privacy cost, so the work on private hyperparameter tuning is not relevant to our setting.\n\n> Q2: It seems like a missed opportunity to discuss the shortcomings of standard supervised learners on small datasets, even a simple standard private regression [...]. Perhaps comparisons between standard learners and meta learners is not worth it in the data scenarios you explore?\n\nStandard DP supervised learning algorithms would likely not work very well in our settings. For example, linear regression, which seems to be the only regression algorithm in the library you linked, would clearly need some nonlinear features to have any chance of working in our settings. Designing appropriate nonlinear features that work well with DP would be a non-trivial effort, to the point that we would effectively be designing a new baseline. In non-private settings, GPs are the state-of-the-art in the low-data regime, so we think the DP-SVGP is the most reasonable baseline we could use. We will further explain our choice of baseline in the revised version.\n\n> Q3: Can the authors justify their choice of privacy hyperparameters in the text? [...] Adding results for this wider range [$\\\\epsilon < 1$] of privacy parameters would strengthen the contribution.\n\nAs you acknowledge in your question, our privacy parameter settings are standard in the literature. Relatively few papers go below $\\\\epsilon = 1.$ However, following your advice we have run some further experiments for $\\\\epsilon < 1,$ as well as smaller $\\\\delta.$ We have attached these results in the additional rebuttal pdf of the \"global response.\" There, we observe that the DPConvCNP performs well even in such stricter privacy settings, given enough data.\n\nThank you for your valuable feedback. If our comments and amendments have satisfied your concerns, we would like to invite you to consider increasing your score.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YhkpQbEY7y", "reviewer": "Reviewer_AqSn", "summary": "This paper equips meta learning framework with DP guarantees. Specifically, datasets are split into context and target subsets respectively, where an encoder learns good representations from abundant context data, and is able to generalize to a limited amount of target data that may be sensitive. Since the output embedding (function) of the encoder is a sum of kernel functions indexed by the context dataset, so functional DP mechanisms are considered to protect the individual privacy in the dataset. Particularly, the authors extend the classical functional DP mechanism to Gaussian DP (GDP), which has theoretical benefits compared to alternatives. Experiments in both synthetic data and real data show its effectiveness.", "questions": "1. I am not familiar with the neural process either. By reading the paragraphs starting at line 118, I don't see how it is different from a normal neural network. Particularly, how it is able to produce well-calibrated prediction, and how this is evaluated in the experimental results?\n2. For the conditional NP, I don't see where is the conditional input, or what does the conditional mean here?\n3. In Figure 4, I wonder how these lines are drawn. Do you use any analytical forms to calculate, or some libraries/packages to compute? Also, are they converted into the same $(\\epsilon, \\delta)$-DP notion? Because the $\\epsilon$ in different DP notions are not the same (although they share the same notation).", "limitations": "NA", "rating": 7, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. Theoretically, the authors extend Gaussian DP to functional outputs, which may pave the way for follow-up works in related fields.\n2. Empirically, the experiments are complete and extensive, i.e. on both synthetic and real tasks with comparison to existing works.\n3. The paper is well-organized and easy to follow. Figure illustrations are clear and informative.", "weaknesses": "I am not familiar with the meta-learning framework (and related works), so it's likely I misunderstood some parts and had confusion about the meta-testing part. \n\nNormally, a DP classifier, regressor, or generative model only introduces noise perturbation in the training (e.g. DP-SGD). Once the training is complete, the trained DP model can be applied to test data without worrying about breaching DP guarantees, as ensured by the post-processing theorem. In this work, however, the noise is injected in both training and test stages, where the authors explained that it accounts for mismatch between training and test. This paradigm does not look optimal to me. So here I have a few questions:\n1. Can you explain why adding noise to the test stage is necessary? For example, compared to pretraining on the synthetic data then DP fine-tuning on private data, what is the benefit of the current method?\n2. It looks to me that if we need to add noise in the test stage, we need to accumulate the total privacy budget $\\epsilon$ as more test data are coming in. Is it true? If so, how do you determine the $\\epsilon$ in the experiment (e.g. eps=1 or 3 in Fig 5)?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> I am not familiar with the meta-learning framework (and related works), so it's likely I misunderstood some parts and had confusion about the meta-testing part.\n\nMeta-learning has two phases, meta-training and meta-testing. You should view meta-testing as analogous to supervised learning: the input is a dataset, and the output is a function (model) $f$ that can make predictions at arbitrary inputs. Meta-training is the process of learning an algorithm which, when given a new dataset, produces a function (model) that can be queried at arbitrary inputs to make predictions. In the neural process literature, this is achieved using the encoder-decoder architecture of Eq. (1). With this understanding let us address your points below. We will also clarify these points in the revised paper.\n\n> Can you explain why adding noise to the test stage is necessary?\n\nYes, here is why adding noise and clipping are necessary in the test stage. During the test stage, the DPConvCNP takes a previously unseen private dataset as its context set $D^{(c)}.$ (This would be the training data set in regular supervised learning.) Then, the DPConvCNP converts $D^{(c)}$ into a representation $r$ which is “published.” Once the representation is published, it can be passed through the rest of the architecture (the decoder) together with arbitrary test (target) inputs $x^{(t)}$ to make predictions for the corresponding test (target) outputs $y^{(t)}.$ If we do not apply noise and clipping in the test stage, then publishing $r$ would have no guarantees at all, and that could completely breach user privacy. By clipping and adding noise, we ensure that $r$ can be published with DP guarantees, and that arbitrarily many predictions (at arbitrary inputs) can be made using the decoder, without incurring any further privacy cost.\n\nWe will add a corollary to Theorem 4.2 which states that Algorithm 2 with the DPSetConv encoder is DP with respect to meta-testing context set, in order to clarify precisely which part of the algorithm is DP, to better address this point.\n\n> [...] noise is injected in both training and test stages, where the authors explained that it accounts for mismatch between training and test. This paradigm does not look optimal to me.\n\nFrom our reply above, we hope it is clear why adding noise is necessary at test-time in order to preserve privacy. Let us now address meta-training time. \n\nAt meta-training, we do not strictly need to apply noise or clipping, because the meta-training data are synthetic, so training the model on them does not incur a privacy cost. For example, we can train a standard ConvCNP model on synthetic data, and then replace its SetConv encoder with a DPSetConv encoder. The $r$ published from this model would still be $(\\\\epsilon, \\\\delta)$-DP at test time. However, applying noise and clipping changes the statistics of the representation $r$ in a way that this model is not trained for, so its predictions are catastrophically poor. Our observation is that we can address this issue by simply training the model with noise and clipping in place (i.e. with the DPSetConv) at meta-train time, teaching the model to account for these operations, and eliminating the mismatch. We will clarify which data is simulated and which is real in Algorithms 1 and 2.\n\n> It looks to me that if we need to add noise in the test stage, we need to accumulate the total privacy budget epsilon as more test data are coming in. Is it true?\n\nIn our case, we assume that the meta-test context dataset is available all at once and does not change over time. This assumption is analogous to a supervised learning setting, where the training dataset (on which the supervised algorithm is applied) is fixed at the start. Just as in supervised learning, we can still make an arbitrary number of predictions at arbitrary locations, without any further privacy cost.\n\nIt would be interesting to consider the scenario where more test data come in one by one or in batches, but this is beyond the scope of our current work.\n\n\n> For the conditional NP, I don't see where is the conditional input, or what does the conditional mean here?\n\nThe term “conditional” neural process was introduced by Garnelo et al. (2018) to capture the fact that this meta-learning model models the conditional predictive distribution $p(y^{(t)} | x^{(t)}, D^{(c)}).$ We emphasize that we did not introduce this term, but rather the original authors of the CNP.\n\n> In Figure 4, I wonder how these lines are drawn. Do you use any analytical forms to calculate, or some libraries/packages to compute? Also, are they converted into the same (epsilon, delta)-DP notion? Because the epsilon in different DP notions are not the same (although they share the same notation).\n\nYes, all of the noise levels in Figure 4 are calculated via closed form expressions and, if necessary, lightweight numerical solution routines. All of them use $(\\epsilon, \\delta)$-DP from Definiton 3.1\n\nIn more detail, the classical line uses Theorem 3.7. The GDP line uses Definition 3.2 to convert the $(\\epsilon, \\delta)$-bound into a GDP $\\mu$-bound by numerically solving $\\mu$ from Eq. (5), and finds $\\sigma$ with Theorem 4.1. For the RDP line, we get an RDP guarantee from Corollary 2 of Jiang et al. (2023), which we convert to $(\\epsilon, \\delta)$ with Proposition 3 of Jiang et al. (2023). RDP has the $\\alpha$ parameter that can be freely chosen, so we optimise $\\alpha$ to minimise $\\epsilon$ for a given $\\sigma$, and finally solve for $\\sigma$, which gives the plotted values. Both the optimisation and finding $\\sigma$ can be done analytically in this case.\n\n> I am not familiar with the neural process either. [...]\n\nDue to the limited character count of the rebuttal, we have answered this in a separate comment below.\n\nThank you for your valuable feedback. If our comments and amendments have satisfied your concerns, we would like to invite you to consider increasing your score.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tsrDs7NjT0", "reviewer": "Reviewer_aFHD", "summary": "The paper proposes a meta learning gaussian dp algorithm. It uses the same framework as ConvCNP but replaces the encoder during train and meta test with a noisy encoder obtained by adding gaussian noise. The paper is not particularly well written and I have trouble following the notation in the main paper and appendix. I have significant doubts about the correctness of the method due to conflation between continuous results (the integral of a gaussian kernel) with discrete results (the sum of the kernel at discrete points).\n\nNote: after feedback, the authors addressed my concerns about correctness.", "questions": "I would like to see a detailed privacy proof (with carefully explained notation) that explicitly uses the discretized point set (explaining exactly how the discretized points are chosen) and an explicitly defined covariance matrix. \n\nFor more challenging problems, such as text and images, how would one create simulated data so that DPConvCNP would be competitive?", "limitations": "The authors addressed limitations.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The paper considers the use of meta learning to avoid an unfortunate trend in the dp literature which assumes the existence of large scale non private data with a similar distribution to a private dataset. Meta learning is a convenient possible alternative if one can create a good enough synthetic dataset.\n\nAssuming everything is correct, the technique outperforms some prior work on simple synthetic and real datasets.", "weaknesses": "The experiments consider alternatives that use similar methods (GP or DP-SGD) but not alternatives that use different methods for similar problems (regression/kernel density estimates, clustering, etc.). I believe the technique would outperform the alternatives anyway, but their omission is noteworthy.\n\nThe experimental datasets are very simple and not comparable to the ones where public datasets are often assumed (images and NLP). Since the technical contribution lies in replacing r with a noisy r, there should be more challenging experiments and discussions on how to create simulated data for them.\n\nA few typos:\n- line 94, r should be theta\n- line 130, missing word after predictive\n- line 224 references eq 6 instead of 7\n\nThe delta value of 10^-3 is large compared to the literature. Setting it at 1/N puts it into the well-known privacy violating regime where one can return a random record with no noise, violating the privacy of someone with probability 1.\n\nThe paper seems to be taking too much credit for minor things, like using Gaussian DP as a drop-in replacement in the work of Hall et al. (literally taking a theorem that was meant as a drop-in replacement of prior formulas and using it as a drop-in replacement for those formulas). That is not a contribution.\n\nThe most important issue for last. I am not convinced that the algorithm is differentially private at the claimed parameter levels. The paper is missing a detailed pseudocode that puts everything together, but my understanding is that nothing changes except that wherever r is needed, a noisy version is used instead. The privacy properties should be provable from first principles (without relying on abstract kernel properties or an RKHS). Plug in the form of the kernel you are using and directly compute the sensitivity accounting for all of the discretized points being used. The reason I am asking for this is because the sensitivity calculation detailed in the appendix appears to be incorrect (it is not very well written and the notation is not explained well, so I am not 100% sure). The key to the proof seems to be that the gaussian kernel integrates to 1, but this is used to replace a discrete summation (i.e., \\int_{-\\infty}^\\infty exp(-(x-y)^2))~dy  is very different from \\sum_{i=1}^n exp(-(x-y_i)^2)). The summation can diverge depending on what y_i are chosen.\nI would like to see a detailed privacy proof (with carefully explained notation) that explicitly uses the discretized point set (explaining exactly how the discretized points are chosen) and an explicitly defined covariance matrix.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> The delta value of 10^-3 is large compared to the literature. Setting it at 1/N puts it into the well-known privacy violating regime where one can return a random record with no noise, violating the privacy of someone with probability 1.\n\nThis would be true if we considered any $(\\epsilon, \\delta)$-DP mechanism. However, for our specific mechanism, we can always adjust $\\delta$, and obtain a different $\\epsilon$, which will be finite, so we will not be in the privacy violating regime you describe. Making this adjustment would only change the $\\epsilon$ values in our plots for DPConvCNP. We would also need to make the same adjustment for DP-SVGP, which will not be identical, since DP-SVGP is based on DP-SGD. However, we expect these differences to be small, so the adjustment would not change the conclusions from our results.\nTo illustrate this, if we had used $\\delta = 10^{-5}$ instead, which is the recommended value by NIST, we would adjust the DPConvCNP $\\epsilon$ values we use according to the following table:\n\n| Inititial $\\\\epsilon$ | Adjusted $\\\\epsilon$ |\n| -------- | ------- |\n| 1.0 | 1.51 |\n| 3.0 | 4.20 |\n\nHowever, please also note that we have conducted additional experiments, attached to the pdf in the global response, which should help put your concerns about the value of $\\\\delta$ to rest.\n\n> The paper seems to be taking too much credit for minor things, like using Gaussian DP as a drop-in replacement in the work of Hall et al. (literally taking a theorem that was meant as a drop-in replacement of prior formulas and using it as a drop-in replacement for those formulas). That is not a contribution.\n\nWe believe our formulation in the Introduction and the rest of the paper gives appropriate credit to prior work, but are happy to hear if you can suggest a better formulation. We also point out that both reviewers Eg3Y and AqSn found this contribution to be meaningful and listed it as a strength of our work.\n\n> The most important issue for last. I am not convinced that the algorithm is differentially private at the claimed parameter levels.\n\nWe break down this paragraph and answer each of the points below.\n\n> my understanding is that nothing changes except that wherever r is needed, a noisy version is used instead. \n\nThis is correct, but we also add clipping to the signal channel to bound sensitivity.\n\n> The sensitivity calculation detailed in the appendix appears to be incorrect…\n\nThe only properties of the kernel we use in the sensitivity calculation are that $0 \\leq k(x, y) \\leq 1$ and $k(x, y) = k(y, x)$, which are looking at point evaluations, not integrals or sums. The sums in Eq. (19) and (27) disappear because the two datasets in the supremum only differ in one datapoint, so all but one term of the sums are zero.\n\nThe transition from the functional form that the functional mechanism releases to the evaluations on the discretised point set follows from Proposition 5 of Hall et al. (2013). We will add a corollary to Theorem 4.2 that clarifies this.\n\nWe would be happy to improve the notation if you could point out any specific part that is unclear.\n\n> The privacy properties should be provable from first principles… I would like to see a detailed privacy proof [...] that explicitly uses the discretized point set…\n\nHere is a proof that uses the Gaussian mechanism on the discretised points directly. Let $k(x_1, x_2) = \\exp(-\\frac{(x_1 - x_2)^2}{\\lambda})$, and let the discretised points be arbitrarily chosen $x_1, \\dotsc, x_m$. Let’s look at the density channel $r_d$ first. DPConvCNP computes the vector $[r_d(x_1), \\dotsc, r_d(x_m)]$, and adds Gaussian noise with covariance $\\sigma_d^2 M$, where $M$ is an $m\\times m$ matrix with $M_{ij} = k(x_i, x_j)$. By Lemma A.4, it suffices to find the upper bound $\\Delta$ in Eq. (14) for the matrix $M$ and the vector $r_d$ taking the role of the function $f$ of the lemma. By Proposition 8 of Hall et al. (2013), the sensitivity in Eq. (14) is bounded by the RKHS sensitivity we look at in Appendix A.4, which gives the privacy guarantee we claim. The privacy of the signal channel is proven in the same way, and releasing both of them is a composition.\n\n> For more challenging problems, such as text and images, how would one create simulated data so that DPConvCNP would be competitive?\n\nThese domains are likely too high-dimensional for the ConvCNP model to be applied. More concretely, while ConvCNPs have been applied to image-based data before (see e.g. Gordon et al. (2020)) these applications have been confined to image in-painting rather than, for example, image classification. In image in-painting with meta-learning, the context set is a single partially observed image consisting of context pixels. The ConvCNP can be applied to this setting, but preserving data-point (i.e. pixel) privacy is meaningless. In image classification with meta-learning, the context set consists of several images, to which the ConvCNP cannot be readily applied. On the other hand, some amortized adaptation models (see Requeima et al. (2019)) have been developed, however these involve entirely different architectures and representations to the ConvCNP, so the functional mechanism does not apply. Overall, while very interesting and important, tackling higher dimensional data is well beyond the scope of this paper.\n\nReference:\n\nJames Requeima, Jonathan Gordon, John Bronskill, Sebastian Nowozin, Richard E. Turner, Fast and flexible multi-task classification using conditional neural adaptive processes, NeurIPS 2019.\n\nThank you for your feedback. We hope we have settled your concerns regarding the validity of our theory. Provided our comments and amendments have satisfied your concerns, we would like to invite you to consider increasing your score.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Some reviewers had questions regarding how meta-learning differs from standard supervised learning, and the consequences of these differences from the point of view of privacy. To summarise, meta-learning has two phases, meta-training and meta-testing. Meta-testing is analogous to training in supervised learning: the input is a dataset, and the output is a function (model) that can make predictions at arbitrary inputs. Meta-training is the process of learning an algorithm which, when given a new dataset, produces a function (model) that can be queried at arbitrary inputs to make predictions.

We assume that the data used during meta-training comes from a simulator, so using it has no implications on privacy. On the other hand, we consider the meta-test data to be private, and design DPConvCNP to guarantee its privacy. Since the model from meta-testing is made private, we can use the model to make an arbitrary number of predictions.

We will make changes in the revision to further clarify these points, especially the distinction between private and simulated data. In particular, we will update the descriptions of Algorithms 1 and 2 in the following way to make it clear whether their input data is simulated or private (added words in italics):

**Algorithm 1**

**Input:** *Simulated* datasets $(D\_m)\_{m=1}^{M}$, encoder $\mathrm{enc}\_\phi$, decoder $\mathrm{dec}\_\theta$, iterations $T$, optimiser $\mathrm{opt}$.

**Algorithm 2**

**Input:** *Real* context $D^{(c)}$, $\mathrm{enc}\_\phi$, $\mathrm{dec}\_\theta$

We will also add the following corollary to Theorem 4.2 to make it clear which parts of DPConvCNP are private:

**Corollary.** Algorithm 2 with the DPSetConv encoder from Algorithm 3 is $(\epsilon, \delta)$-DP with respect to the real context set $D^{(c)}$.

Lastly, we would like to raise to the reviewers’ attention, particularly reviewers Eg3Y and aFHD, that we ran additional experiments with stricter DP $(\\epsilon, \\delta),$ following their advice that this would strengthen our manuscript. Our results show that the DPConvCNP produces sensible predictions even in strict privacy settings, given enough data.

Meta-review: This paper proposes a meta learning algorithm that uses Gaussian DP and the ConvCNP framework. This approach is compared against the naive application of DP and shown to outperform it. Overall the reviewers agree that the analysis is sound, that the empirical results show an important improvement, and that the techniques/contributions may have broader use. This looks like a solid poster contribution. Despite this, I encourage the authors to look at presentation changes that can make understanding and analyzing the theoretical contributions easier.
Decision: Accept (poster)