Pre-trained Perceptual Features Improve Differentially Private Image Generation
Authors: Frederik Harder
Milad Jalali
Danica J. Sutherland
Mijung Park
Venue: Accepted by TMLR ()

Abstract: Training even moderately-sized generative models with differentially-private stochastic gradient descent (DP-SGD) is difficult:
the required level of noise for reasonable levels of privacy is simply too large.
We advocate instead building off a good, relevant representation on an informative public dataset, then learning to model the private data with that representation.
In particular, we minimize the maximum mean discrepancy (MMD) between private target data and a generator's distribution,
using a kernel based on perceptual features learned from a public dataset.
With the MMD, we can simply privatize the data-dependent term once and for all,
rather than introducing noise at each step of optimization as in DP-SGD.
Our algorithm allows us to generate CIFAR10-level images with $\epsilon \approx 2$ which capture distinctive features in the distribution,
far surpassing the current state of the art, which mostly focuses on datasets such as MNIST and FashionMNIST at a large $\epsilon \approx 10$.
Our work introduces simple yet powerful foundations for reducing the gap between private and non-private deep generative models.
Our code is available at https://github.com/ParkLabML/DP-MEPF.

Published in Transactions on Machine Learning Research (04/2023)
Pre-trained Perceptual Features Improve Differentially Private Image Generation
Frederik Harder
fharder @ tue. tue.
Max Planck Institute for Intelligent Systems & University of Titbingen
Milad Jalali Asadabadi
miladj7 mnladj7@cs.ubber es.ubc.ea
University of British Columbia
Danica J. Sutherland
dsuth@cs.uber
University of British Columbia & Alberta Machine Intelligence Institute
Mijung Park
mijungp cubbc.c
University of British Columbia & Alberta Machine Intelligence Institute
Reviewed on OpenReview:
Abstract
Training even moderately-sizee generative models with differentially-privee stochastic gradient descent (DP-SGD) is difficult: the required level of noise for reasonable levels of privacy is simply too large. We advocate instead building off a good, relevant representation on an informative public dataset, then learning to model the private data with that representation. particular, we minimize maximum mean discrepancy (MMD) between private target data and generator's distribution, using a kernel based on perceptual features learned from a public dataset. With the MMD, we can simply privatize the data-dependent term once and for all, rather than introducing noise each step of optimization as in DP-SGD. Our algorithm allows to generate CIFAR10-B e 2 2 which capture distinctive features in the distribution, far surpassing the current state of the art, which mostly focuses on datasets such as MNIST and FashionMNIST at large e z 10. Our work introduces simple yet powerful foundations for reducing the gap between private and non-private deep generative models. Our code is available at ht tps:: //gttubb. com/ Somm/Prrkee ParkLabML MEPF.
images with
1 INTRODUCTION
The gold standard privacy notion, differential privacy (DP), is now ubiquitous a diverse range of academic research, industry products (Apple, 2017), and even government databases (National Conference of State Legislatures, 2021). DP provides a mathematically provable privacy guarantee, which is its main strength and reason for its popularity. DP even offers means of tracking the effect of multiple accesses the same data on it's overall privacy level, but with each access, the privacy of the data gradually degrades. To guarantee high level of privacy, one thus needs to limit access to data, challenge in applying DP with the usual iterative optimization algorithms used in machine learning.
Differentially private data generation solves this problem by creating a synthetic dataset that is similar to the private dataset, in terms of some chosen similarity metric. While producing such a synthetic dataset incurs a privacy loss, the resulting dataset can used repeatedly without further loss of privacy. Classical approaches, however, typically assume certain class of pre-specified purposes how the synthetic data can be used (Mohammed et al., 2011; Xiao et al., 2010; Hardt et al., 2012: Zhu al., 2017). data analysts use the data for other tasks outside these pre-specified purposes, the theoretical guarantees on its utility are lost.
This revision the first published version which contained erroncous FID Please refer this paper's Open page clarification of and the older version.

---

Published in Transactions on Machine Learning Research (04/2023)
To produce synthetic data usable for potentially any purpose, many papers DP data generation have utilized the recent advances in deep generative modelling. The majority of these approaches are based on the generative adversarial network (GAN; Goodfellow et al., 2014) framework, where a discriminator and a generator play an adversarial game to optimize given distance metric between the true and synthetic data distributions. Most approaches under this framework have used DP-SGD (Abadi et al., 2016), where the gradients of the discriminator (which compares generated samples to private data) are privatized in each training step, resulting in a high overall privacy loss (Park et al., 2017; Torkzadehmahani et al., 2019; Yoon et al., 2019; Xie al., 2018; Frigerio et al.. 2019). Another challenge is that, as the gradients must have bounded norm to derive the DP guarantee, the amount of noise for privatization in DP-SGD increases proportionally to the dimension of the discriminator. Hence, these methods are typically bound to relatively small discriminators, limiting the ability to learn data distributions beyond, say, MNIST (LeCun & Cortes, 2010) or FashionMNIST (Xiao et al., 2017).
Given these challenges, the heavy machinery such as GANs and large-scale auto-encoder- based methods - capable of generating complex datasets in a non-private setting - fails to model datasets such as CIFAR-10 10 (Krizhevsky, 2009) or CelebA (Liu et al., 2015) with meaningful privacy guarantee (e.g., e 2). Typical deep generative modeling papers have moved well beyond these datasets, but to the best of our knowledge, currently there is no DP data generation method that can produce reliable samples at a reasonable privacy level.
How can we reduce this huge gap between the performance of non-private deep generative models and that of private counterparts? We argue that we can narrow this gap by using the abundant resource of public data, in line with the core message of Tramèr& & Boneh (2021): We simply need better features for differentially private learning. While Tramèr & Boneh demonstrated this in the context of DP classification, we aim to show the applicability of this reasoning for the more challenging problem of DP data generation, with focus high-dimensional image generation.
We propose to exploit public data to learn perceptual features (PFs) from public data, which we will use to compare synthetic and real data distributions. Following dos Santos et al. (2019), we use "perceptual features"' to mean the vector of all activations of a pretrained deep network for a given data point, e.g. the hundreds of thousands of hidden activations from applying a trained deep classifier to an image. Building on dos Santos et al. (2019), who use PFs for transfer learning in natural image generation, our goal is to improve the quality of natural images generated with differential privacy constraints.
We construct a kernel on images using these powerful PFs, then train generator by minimizing the Maximum Mean Discrepancy (MMD) (Gretton et al., 2012) between distributions (as in Harder et al., 2021; Li et al., 2015; Dziugaite et al., 2015; dos Santos et al., 2019). This scheme is non-adversarial, leading to simpler and more stable optimization; moreover, it allows us to privatize the mean embedding of the private dataset once, using it at each step of generator training without incurring cumulative privacy losses.
We observe in our experiments that as long as the public data contains more complex patterns than private data, e.g., transferring the knowledge learned from ImageNet as public data to generate CIFAR-10 10 images as private data, the learned features from public data are useful enough to generate good synthetic data. We successfully generate reasonable samples for CIFAR- 10, CelebA, MNIST, and FashionMNIST in high-privacy regimes. We also theoretically analyze the effect of privatizing our loss function, helping understand the privacy-accuracy trade-offs in our method.
The main point of our paper is that features from public data are a key tool for improved DP data generation, a point we think our experiments make resoundingly; this may be "obvious", but has not been explored for image generation. Our proposed method, in particular, is a simple (which, we think, is good thing) initial technique exploiting this idea, which outperforms simple pretraining of DP-GAN and DP-Sinkhorn (see Section 6). We hope this work will inspire future work on other ways to use public features for improving image generation with differential privacy.
2 BACKGROUND
We provide background information on maximum mean discrepancy and differential privacy.
Maximum Mean Diserepancy The MMD is a distance between distributions based on a kernel ko(2, v) (o(z), ((v)),, u. where e maps data in X to Hilbert space H (Gretton et al., 2012). One definition is
MMD (P. Q) = || [p(x)) Ey-olew)]l
2

---

Published in Transactions on Machine Learning Research (04/2023)
where (P) Ez=plo(x)] H is known the (kernel) mean embedding of P, and is guaranteed to exist if EExPy k(x x) 30 (Smola et al., 2007). If Kg is characteristic (Sriperumbudur et al., 2011), then P Mo(P)) is injective, so MM (P. Q) 0 if and only if P = Q.
pm, the empirical mean embedding pa (D) = E (xx)) is the "plug-in" estimator of (P) using the empirical distribution of D. Given D (x: ~ Q", we can estimate MMDR, (P.Q) as the distance between empirical mean embeddings,
For sample set D (xi =
MMDA, (D,
(x:) - m
1
m
1 Y1
(
(1)
We would like to minimize the distance between a target data distribution P (based on samples D) and the output distribution Qa of generator network ge. If the feature map finitediimensional and norm-bounded, following Harder al. (2021); Vinaroz et al. (2022), we can privatize the mean embedding of the data distribution pe (D) with known DP mechanism such as the Gaussian or Laplace mechanisms, be discussed shortly. As the summary of the real data does not change over the course of generator training, only need to privatize (D) once.
Differential privacy A mechanism M is (c, 5)-DP for a given e 2 and 8 2 0 if and only if
e Pr(M(D) 8) $ e" Pr(MMDD') S] +
for all possible sets of the mechanism's outputs S and all neighbouring datasets DD D' that differ by a single entry. One of the most well-known and widely used DP mechanisms is the Gaussian mechanism. The Gaussian mechanism adds a calibrated level of noise to a function μ : D + IR to ensure that the output the mechanism is (e, 8D:D: (DD = (DD + n, where n [ o² A Here, a is often called a privacy parameter, which is function' of and 5. A is often called the global sensitivity (Dwork et al., 2006), which is the maximum difference in I--norm given two neighbouring 2> and D', [|x(D) 122) In this paper, we will use the Gaussian mechanism to ensure the mean embedding of the data distribution is DP.
3 METHOD
In this paper, transfer knowledge from public to private data distributions, we construct a particular kernel kg to use in Equation based on perceptual features (PFs).
3.1 MMD with perceptual features as feature map
We call our proposed method Differentially Private Mean Embeddings with Perceptual Features (DP-MEPF), analogous to the related method DP-MERS (Harder et al., 2021). We use high-dimensional, over-complete perceptual features from feature extractor network pre-trained on public dataset, as illustrated in Step 1 of Figure 1. Given vector input x, the pre-trained feature extractor network outputs the perceptual features from each layer, where the jth layer's 's PF is denoted by (x). Each of the J layers' perceptual features is of a different length, ex(x) E IRds; the total dimension of the perceptual feature vector is D -
As illustrated in Step in Figure 1, we use those PFs to form our feature map (xx) = (x),, (x)))), where the first part comes from a concatenation of PFs from all the layers: (x) = =x), (....)................. (x)], while the second part comes from their squared values: d2 (x) = (x), ... (x)). where eç (x) means each entry of ex(x is squared. Using this feature map, we then construct the mean embedding of data distribution given the data samples D {x,)
1 (D) u (D)
+E (xx:)
(P(D)=
m
(2)
1 Em (xx))
Lastly (Step 3 in Figure 1), we will train a generator go that maps latent vectors 2; ~ N 7) to a synthetic data sample x; = go (z:); we need to find good parameters 0 for the generator. In non-private settings, we estimate the generator's
2The relationship can numerically computed by packages like aut o-p (Wang et al., 2019), among other methods.
3

---

Published in Transactions on Machine Learning Research (04/2023)
Step
Step
Step
Train feature extractor using public data
2a. Compute mean embedding of data distribution
Train generator By minimizing MMD
e1 it)
1
((1))
min 1ip MQq 1|
(2)
(eyto) (9))))
(g)(==)) n 2m1
Perceptual Features (PFS)
2b. Privatization:
PP
Figure I: Three steps in differentially private mean embedding with perceptual features (DP-MEPF). Step 1: We train feature extractor neural network, Jäy..' using public data. This is function of public data, with no privacy cost to train. trained Sa maps an input x to perceptual features (in green), the outputs of each layer. Step 2: We compute the mean embedding of the data distributions using feature map consisting of the first and second moments (in green) of the perceptual features, and privatize based on the Gaussian mechanism (see text). Step 3: We train a generator which produces synthetic data from latent codes 2 ~ (N( 1). by minimizing the privatized MMD.
parameters by minimizing an estimate of MMD (2015); Li et al. (2015); dos Santos et al. (2019). In private settings, we privatize D's mean embedding to ji)(D) with the Gaussian mechanism (details below), and minimize
Kg. (P, Qg.)) using D = {8a} in Equation I, similar to Dziugaite et al.
MMD Jsp. (D, - -l(b(())-
(3)
A natural question that arises is whether the MMD using the PFs is a metric: if MMD (P.Q) 0 only P = Q. As PFs have a finite-dimensional embedding, we fact know this cannot be the case (Sriperumbudur et al., 2011). Thus, there exists some pair of distributions which our MMD cannot distinguish. However, given that linear functions in perceptual feature spaces can obtain excellent performance nearly any natural image task (as observed in transfer learning), it seems that PFs are "nearly" universal for natural distributions of images (dos Santos et al., 2019). Thus we expect the MMD with this kernel to do good job of distinguishing "natural" distributions from one another, though the possibility of "adversarial attacks" perhaps remains.
A more important question in our context is whether this MMD serves as a good loss for training generator, and whether the resulting synthetic data samples are reasonably faithful the original data samples. Our experiments in Section as well earlier work by dos Santos et al. (2019) in non-private settings, imply that is.
Privatization of mean embedding We privatize the mean embedding of the data distribution only once, and reuse it repeatedly during the training of the generator ge. We use the Gaussian mechanism to separately privatize the first and second parts of the feature map. We normalize each type of perceptual features such that || (x:) = =1 and [| (xx)))ll2 = for each sample x,. After this change, the sensitivity of each part of the mean embedding is
D,D' st. D |n. (D) Mo. (D)) 122 I
2 m
(4)
where Ns. (D) denotes the two parts of the mean embedding for 1, 2. Using these sensitivities, we add Gaussian noise to each part of the mean embedding, obtaining
(D)
Σ == क (x;) + n
(D) = 1os (D)
(5)
m Em x2(x;) + n2
where n, ~ (O, 4n² T) for / = 1,2.
Since we are using the Gaussian mechanism twice, we simply compose the privacy losses from each mechanism. More precisely, given a desired privacy level e, 6, we use the package of Wang et al. (2019) to find the corresponding a for the two Gaussian mechanisms.
4

---

Published in Transactions on Machine Learning Research (04/2023)
Labeled data generation Extending our framework to generate both labels and input images is straightforward. As done by Harder et al. (2021), we construct a separate mean embedding for each class-conditional input distribution and then concatenate them into a single embedding
Pe. (D) (D) = [+ Eiec, (x:) D1,1 J. Eiec 0i(xi) + D,,]]
(6)
where K is the number of classes and Ck {i E Im]ly: k} is the set of indices belonging class k. As a result, the size of the final mean embedding is D x K (number of perceptual features by the number of classes) if we use only the first moment, or 2 X D X K if we use the first two moments. This is exactly the conditional mean embedding with discrete kernel on the class label (Song et al., 2013). In the case of imbalanced data, an estimate of the label distribution can be obtained at low privacy cost with DP release of the class counts, as done in Harder et al. (2021). Since all datasets considered in this paper are balanced, this step is not necessary in our experiments.
3.2 Differentially private early stopping
On some datasets (CelebA and Cifar10) we observe that the generated sample quality deteriorates the model trained for too many iterations high-privacy settings. This is indicated by a steady increase in FID score (Heusel et al., 2017), and likely due overfitting to the static noisy embedding. Since the FID score is based on the training data, simply choosing the iteration with the best FID score after training has completed would violate privacy.
Privatizing the FII) score requires privatizing the covariance of the output of the final pooling layer in the Inception network, which is quite sensitive. Instead, we privatize the first and second moment of data embeddings as in Equation 2, but using only the output of the final pooling layer in the Inception network. We then use this quantity as private proxy for FID, and select the iteration with the lowest score. To minimize the privacy cost, we choose a larger noise parameter than for the main objective: stopping 10o, where a is the noise scale for privatizing each part of the data mean embeddings, works well. Again, we compose these as with the analysis of Wang et al. (2019).
4 THEORETICAL ANALYSIS
We now bound the effect of adding noise our loss function, showing that asymptotically our noise does not hurt the rate at which our model converges to the optimal model.
Appendix A proves full finite-sample versions of all of the following bounds, which are stated here using Op notation for simplicity. The statment = (A,,) essentially means that X is O(A,) with probability at least p for any constant choice of failure probability p > O.
The full version in the supplementary material is also ambivalent to the choice of covariance for the noise variable n, or two moments of PFs. (The full version gives
allowing in particular analysis of DP-MEPF based either slightly more refined treatment of the two-moment case, but the difference is typically not asymptotically relevant.)
To begin, we use standard results on Gaussians to establish that the privatized MMD is close to the non-private MMD:
Proposition 4.1. Given datasets D and D, the absolute difference between the privatized and non-private squared MMDs, a random function of only n, satisfies
MMD (D,D) - MMD2 (D.D) = =Op (g" D+ (MMD,,(D.)) (D.D))
MMDR,
One key quantity in the bound is o/m, the ratio of the noise scale a (inversely proportional to E) to the number of observed (private) data points m. Note that a depends only on the given privacy level, not m, so the error becomes zero as long as m + xc. In the second term, o/m is multiplied by the (non-private, non-squared) MMD, which is bounded for our features, but for good generators (where our optimization hopefully spends most of its time) this term will also be nearly zero. The other term accounts for adding independent noise to each of the feature dimensions: although D typically large, is m² Having m 50k private samples, e.g. for CIFAR-10, allows for strong error bound as long as 2 < 625M.
5

---

Published in Transactions on Machine Learning Research (04/2023)
The above result is for fixed pair of datasets. Because we only add noise n once, across all possible comparisons, we can use this to obtain a bound uniform over all possible generator distributions, in particular implying that the minimizer of the privatized MMD approximately minimizes the original, non-private MMD:
Proposition 4.2. Fix a target dataset D. For each 0 in some set b, fix a corresponding De: in particular, θ F could be the set of all generator parameters, and Da either the outcome of running a generator ge on fixed set of "seeds," " DD- = (g)())))i=> or the full output distribution of the generator Que Let E arg mingee MMD kg (D, Da) be the private minimizer, and 0 arg mingee MMD (D, Do) the non-private minimizer. Then MMD (D, DD) MMD (D, = Op
022 m
D.D
The second term of this bound will generally dominate; arises from uniformly bounding the m MMD (D, :D) term of Proposition 4.1 over all possible Dg. This approach, although the default way to prove this type of bound, misses that MM (D, De) is hopefully small for i and O We can in fact take advantage of this to provide an "optimistic" rate (Srebro et al., 2010: Zhou et al., 2021) that achieves faster convergence if the generator is capable of matching the target features (an "interpolating" regimm)))
Proposition 4.3. In the setting of Proposition 4.2,
O2D m²
oVD m
MMD3, Kap -MM)3, to (D, =0p
MMD kg (D, (D)
Note that this bound implies the previous one, since MMD () is bounded. But in the case where the generator is capable of exactly matching the features of the target distribution, the second term becomes zero, and the rate with respect to m is greatly improved.
In either regime, our approximate minimization of the empirical MMD is far faster than the rate at which minimizing the empirical MMD(D, Que) converges to minimizing the true, distribution-level MMD(P, Qaa): the known results there (c.g. Dziugaite et al., 2015, Theorem 1) give a 1/ V m rate, compared to our 1/m or even 1/m².
We show that minimizing DP-MEPF's loss actually pays no asymptotic penalty for privacy (especially when a perfect generator exists), with the privacy loss dwarfed by the statistical error for large datasets; this essentially agrees with experiments (see Section 6). This is not the case for all DP methods, and other DP generation papers didn't 't prove any such guarantees: DP-Siinhom only proved privacy, and DP-MERF showed only much weaker guarantee (its gradient is asymptotically unbiased).
5 RELATED WORK
Initial work on differentially private data generation assumed strong constraints on the type of data and the intended use of the released data (Snoke& & Slavković, 2018; Mohammed al., 2011; Xiao et al., 2010; Hardt et al., 2012; Zhu et al., 2017). While these studies provide theoretical guarantees on the utility of the synthetic data, they typically do not scale to our goal of large-scale image data generation.
Recently, several papers focused on discrete data generation with limited domain size (Zhang et al., 2017; Qardaji et al., 2014; Chen et al., 2015; Zhang et al., 2021). These methods learn the correlation structure of small subsets of features and privatize them in order to produce differentially private synthetic data samples. These methods often require discretization of the data and have limited scalability, so are also unsuitable for high-dimensional image data generation.
More recently, however, a new line of work has emerged that adopt the core ideas from the recent advances in deep generative models for broad applicability of synthetic data with differential privacy constraints. The majority of this work (Xie et al., 2018; Torkzadehmahani et al., 2019; Frigerio et al., 2019; Yoon et al., 2019; Chen et al., 2020) uses generative adversarial networks (GANs; Goodfellow et al., 2014) along with some form of DP-SGD (Abadi et al., 2016). Other works in this line include PATE-GAN based on the private aggregation of teacher ensembles (Papernot et al., 2017) and variational autocncoders (Acs et al., 2018).
The closest prior work to the proposed method MR-MERF (Harder et al., 2021), where the kernel mean embeddings are constructed using random Fourier features (Rahimi & Recht, 2008). A recent variant of DP-MERF uses Hermite

---

Published in Transactions on Machine Learning Research (04/2023)
polynomial-basee mean embeddings (Vinaroz al., 2022). Unlike these methods, use the perceptual features from pre-trained network to construct kernel mean embeddings. Neither previous method applies to the perceptual kernels used here, so their empirical results are far worse (as we'll see shortly). Our theoretical analysis is also much more extensive: they only proved a bound on the expected error between the private and non-private empirical MMD for a fixed pair of datasets.
More recently, similar work to DP-MERF utilizes the Sinkhorn divergence for private data generation (Cao al., 2021), which performs similarly DP-MERF when the cost function is the L2 distance with large regularizer. Another related work proposes to the characteristic function and adversarial re- weighiit objective (Liew et al., 2022) in order to improve the generalization capability of DP-MERF.
A majority of these related methods were evaluated only on relatively simple datasets such as MNIST and FashionMNIST. Even so, the DP-GAN-basee methods mostly require a large privacy budget of e Re 10 to generate synthetic data samples that are reasonably close to the real data samples. Our method goes far beyond this quality with much more stringent privacy constraints, as we will now see.
6 EXPERIMENTS
We will now compare our method to state-of-the-ar methods for DP data generation.
Table 1: Downstream accuracies by Logistic regression and MLP, evaluated the generated data samples using MNIST and FaSHionMNIST as private data and SVHN and CIFAR-10 as public data, respectively. In all cases, we set 10, 5 = 10-5. In our method, we used both features Φ1, $2.
DP-MEPF
DP-Sinkhomn (Cao et 201))
GS-WGA AG-N
DP-MERF (Harder et al., 2021)
DP-HP
(Chen et al., 2020)
(Vinaroz et al., 2022)
LogReg
83
83
79
81
MNIST
ML.P
90
83
78
82
LogReg
76
75
68
76
73
F-MNIST
MLP
76
75
65
75
71
Datasets. We considered four image datasets² of varying complexity. We started with the commonly used datasets MNIST (LeCun & Cortes, 2010) and FashionMNIST (Xiao et al., 2017), where each consist of 60,000 28 x 28 pixel grayscale images depicting hand-written digits and items of clothing, respectively, sorted into 10 classes. We also looked at the more complex CelebA (Liu et al., 2015) dataset, containing 202,599 color images of faces which we scale to sizes of 32 x 32 64 x 64 pixels and treat as unlabeled. We also study CIFAR- 10 (Krizhevsky, 2009), 50,000-samplee dataset containing 32 x 32 color images of 10 classes of objects, including vehicles like ships and trucks, and animals such as horses and birds.
Implementation. We implemented our code for all the experiments in PyTorch (Paszke et al., 2019), using the auto-dp package* (Wang et al., 2019) for the privacy analysis. Following Harder et al. (2021), we used the generator that consists of two fully connected layers followed by two convolutional layers with bilinear upsampling, for generating both MNIST and FashionMNIST datasets. For MNIST, used the SVHN dataset as public data to pre-train ResNet18 (He al., 2016), from which we took the perceptual features. For FashionMNIST, we used perceptual features from ResNet18 18 trained on CIFAR- 10. For CelebA and CIFAR- 10, we followed dos Santos et al. (2019) in using perceptual features from a pre-trained VGG (Simonyan & Zisserman, 2014) on ImageNet, and ResNet 1 8-hased generator. Further implementation details are given in the supplementary material, which also studies how different public datasets and feature extractors impact the performance.
Evaluation metric. Evaluating the quality of generated data is challenging problem of its own. We use two conventional measures. The first is the Frechet Inception Distance (FID) score (Heusel et al., 2017), which directly measures the quality of the generated samples. The FID score correlates with human evaluations of visual similarity to the real
DDtuset licenses: MNIST: CC BY-SA 3.0; FashionMNISTTMMIT CelebA: kttps: /mmlab....//////.../////..mmm/b. ie, cuhk. edu. hcc.hh//pprojetts/calee... html; Cifar10: MIT
<nttps:/ http://ggttbb.ut////// thub.hhccce.. cac.b...oo////// com/yuxi an angw/ /
7

---

Published in Transactions on Machine Learning Research (04/2023)
Table Downstream accuracies of our method for MNIST and FashionMNIST at varying values of E.
MNIST
FaSHionMNIST
<=
r= 2
0.2
DP-MEPF (01, (2)
90
89
75
75
70
MI.P
DP-MEPF ((h))
88
88
75
76
75
69
DP OP-MEPF (O1 (2)
83
83
82
76
75
76
75
73
LogReg
MP-MEPP ((b))
81
80
79
72
75
76
76
72
Real Data
DP-MERF 10)
pre-trained DP-GAN (<= = 10)
Ours (e 10)
DP-Siukhoru 10)
pre-trained DP-GAN (e 1)
Ours (e 1)
DP-Diffusion (r
pre-trained DP-GAN (e 0.2)
Ours (c 0.2)
Figure 2: Synthetic 32 x 32 CelebA samples generated at different levels of privacy. Samples for DP-MERF and DP-Sinkhorn are taken from Cao al. (2021) and DP-Diffusion samples are taken from Dockhorn al. (2022). The pre-trained GAN is our baseline utilizing public data. Even 0.2, DP-MEPF (ø1, (2) yields samples of higher visual quality than the comparison methods.
data, and is commonly used in deep generative modelling, We computed FID scores with the pytorch_ fid package (Seitzer, 2020), based on 000 generated samples, matching dos Santos et al. (2019). As discussed in Section 3.2, we use a private proxy for FID for early stopping, while the FID scores we report in this section are non-DP measures of our final model for fair comparison to other existing methods. The second metric we use is the accuracy of downstream classifiers, trained on generated datasets and then test on the real data test Torkzadehmabaní et al., 2019; Yoon al., 2019; Chen et al., 2020; Harder et al., 2021; Cao et al., 2021). This test accuracy indicates how well the downstream classifiers generalize from the synthetic to the real data distribution and thus, the utility of using synthetic data samples instead of the real ones. We computed the downstream accuracy on MNIST and FashionMNIST using the logistic regression and MLP classifiers from scikit-learn (Pedregosa et al., 2011). For CIFAR-1O, we used ResNet9 taken from FFCV (Leclere et al., 2022).
(used by Chen al., 2020;
In all experiments, tested non-private training and settings with various levels of privacy, ranging from 10 (no meaningful guarantee)
0.2 (strong privacy guarantee). We set ō 10-5 for MNIST, FashionMNIST, and Cifar10 and 8 10 for CelebA. In DP-MEPF, also tested cases based embeddings with only the first moment, written (Φ1), and using the first two moments, written (Φ1. Φ2). Each value in all tables is an average of 3 or more runs; standard deviations are in the supplementary material.
Since we are unaware of any prior work on DP data generation for image data using auxiliary datasets, we instead mostly compare to recent methods which do not access auxiliary data. As expected, due to the advantage of non-price non-private data approach outperforms these methods by significant margin on the more complex datasets. As simple baseline based public data, also pretrain GAN downscaled version of ImageNet, 32 32, and fine-tune this model with DP-SGD on CelebA and C0 We use architectures based on ResNet9 with group normalization (Wu & He, 2018) for both generator and discriminator. As suggested by Bie et al. (2023), we update the generator at a lower frequency than the discriminator and use increased minibatch sizes. Further details can be found in the supplementary material.
MNIST and FaShionMNIST..
We compare DP-MEPF to existing methods on the most common settings used in the literature, MNIST and FashionMNIST at 10, in Table For an MLP on MNIST, DP-MEPF's samples far
5tttps: /ttee:///ttttttt com/1 wwwfee/ffff/tttbtbeeebb ab/ma http/////////e/pp/e/////////////
8

---

Published in Transactions on Machine Learning Research (04/2023)
DP-MEPF
DP-GAN
0.2
Figure 3: Synthetic 64 x 64 CelebA samples generated at different levels of privacy with DP-MEPF (#1,
Table 3: CelebA FID scores (lower is better) for images of resolution 32 32 and 64 64. Results for DP Diffusion (DPDM) and DP Sinkhorn taken from Dockhorn al. (2022) and Cao al. (2021).
10
5
0.5
0.2
DP-MEPF (c)1 (22)
17.4
17.5
18.1
19.0
21.4
25.8
DP-MEPF (d1)
16.3
16.9
16.5
17.2
21.8
25.5
32
DP-GAN (pre-trained)
58.1
66.9
67.1
81.3
109.1
192.0
DPDM (no public data)
71.8
DP Sinkhorn (no public data)
189.5
DP-MEPF (cb1, (h2)
18.5
19.1
18.4
19.0
21.4
26.8
64 DP-MEPF (cb))
17.4
16.5
16.9
18.4
20.4
27.7
DP-GAN (pre-trained)
57.1
62.3
65.2
72.5
91.9
133.3
outperform other methods for logistic regression and both classifiers on FashionMNIST, scores match or slightly exceed those of existing models. This might be because the domain shift between public dataset (CIFAR-10, color images of scenes) and private dataset (FaShionMNIST, grayscale images of fashion items) is too large, or because the task is simple enough that random features as found in DP-MERF or DP-HP are already good enough. This will change as we proceed to more complex datasets. Table shows that downstream test accuracy only starts to drop in high privacy regimes, é < 1, due to the low sensitivity of pss Samples for visual comparison between methods are included in the supplementary material.
CelebA Figure 2 shows that previous attempts to generate CelebA samples without auxiliary data using DP-MERF DP-Sinkhom have only managed to capture very basic features of the data. Each sample depicts face, but offers details or variety. DP-MEPF produces
accurate samples the same 32 x 32 resolution, which is also reflected in improved FID scores of around 17, while DP-Sinkhorn, as reported in Cao et al. (2021), achieves an FID of 189.5. Table 3 gives FID scores for both resolutions at varying c. DP-MEPF consistently outperforms our pre-trained DP-GAN baseline and the scores reported for DP diffusion Dockhorn al. (2022), As the dataset has over 200 000 samples, the feature embeddings have low sensitivity, and offer similar quality between and 1, although quality begins to decline at < 1. Samples for 64 x 64 images shown in Figure 3, with similar quality, and a quicker loss of quality in high privacy settings due to its larger embedding. In all cases, the Φ embedding yields better results than Φ1, Ø22 suggesting that the second moment does not contribute useful information, perhaps because on the limited variance of the dataset.
Figure 4: Samples from non-DP Sinkhorn. Top: ImageNet32. Bot- tom: CelebA after pretraining.
10
Because DP-Sinkhorn the best-performing method without public data, we perform experiments on DP-Sinkhom, pretraining non-DP on ImageNet32 and fine-tuning with DP on CelebA 10). After seeing no improvement, we improvements beyond what is shown in Figure 4; we tried both BigGan- and
tested non-DP fine-tuning and still ResNet18- basbd generators with hyperparameter grid searches. DP-Sinkhon only compares features at image-level, without domain-specife priors, and it appears that even non-DP the method is not powerful enough to model image data beyond MNIST. (A DP-MEPF analogue that extracts features learned from public data might help, but this would be novel method beyond scope for comparison.) DP-MERF is similarly limited by its random features, not DP noise, as shown by non-DP versions matching = 10 performance.
Differentially private early stopping. For CelebA and Cifar10, 10, we use DP early stopping as explained Section 3.2 with privacy parameter ten times larger than the used for the training objective. Keeping (c, fixed, this additional

---

Published in Transactions on Machine Learning Research (04/2023)
Table 4: Two examples of beneficial early stopping: For CelebA at 64 x 64 resolution and labeled Cifar10, DP-MEPF (Φ1) sample quality (measured in FID) degrades with long training in high privacy settings (here e S 1). This makes the final model at the end of training poor choice. Our DP selection the best iteration via proxy stays close to the optimal choice.
<=
<=
0.5
0.2
Best FID (not DP)
17.7
20.1
27.0
CelehA 64 64
DP proxy for FID
18.4
20.4
27.7
the end of training
18.4
22.1
45.2
Best FID
DP)
54.8
268.3
Cifarl0 (labeled)
DP proxy FID
92.0
268.3
At the end of training
198.6
267.7
357.1
= 10
5 c
6=1 6 0.5 = 0.2
6 00 6 10
Real Data
DP-MEPF (ours)
DP-MERF
Figure 5: Labeled samples from DP-MEPF (Φ1, Φ2) and DP-MERF (Harder et al., 2021).
release results only in small increase in a, and gives us simple way for choosing the best iteration. In Table 4, we compare the true best FID, the FID picked by our private proxy, and the FID at the end of training to illustrate the advantage in high DP settings. FID scores were computed every 000 iterations, while the model trained for 200 000 iterations in total.
CIFAR-10 Finally, investigate dataset which has not been covered in DP data generation. While CelebA depicts centered face in every image, CIFAR- 10 includes 10 visually distinct object classes, which raises the required minimum quality of samples to somewhat resemble the dataset. At only 5 000 samples per class, the dataset is also significantly smaller, which poses challenge in the private setting.
Figure 5 shows that DP-MEPF capable of producing labelled private data (generating both labels and input images together) resembling the real data, but the quality does suffer in high privacy settings. This is also reflected in the FID scores (Table 5): at c < 1 labeled DP-MEPF scores deteriorate a much quicker rate than the unlabeled counterpart, As the unlabeled embedding dimension is smaller by factor of 10 (the number of classes), it is easier release privately and retains semblance of the data in the highest privacy settings, shown in Figure 6. The FID scores of our pre-trained DP-GAN baseline consistently exceed our results, usually by over 10 points. These scores are better than the DP-GAN results for CelebA. likely because 32 x 32 ImageNet is very similar to Cifar10. Nonetheless, the high privacy cost of DP-SGD makes DP-GAN a poor fit for a dataset of this complexity and limited size.
Table FID scores for synthetic CIFAR-10 data; labeled generates both labels and images.
= 10
<= 5
<
<=
= 0.5
< 0.2
DP-MEPF (gh. 6b))
38.8
37.0
38.7
43.0
49.4
67.3
unlabeled
MEPF ((h)
DP-GAN
54.6
54.7
62.4
74.9
62.7
73.4
DP-MEPF (ch, db))
29.1
30.0
39.5
54.0
76.4
226.0
labeled
DP-MEPF (6.)
30.3
35.6
42.0
56.5
92.0
268.3
10

---

Published in Transactions on Machine Learning Research (04/2023)
10 c
6 c 6 0.5 0.2
6 c
DP-MEPF (ours)
DP-GAN
Figure 6: Unlabeled CIFAR-10 samples from DP-MEPF (#1, Φ2) and DP-GAN.
In Table 6 we show the test accuracy of models trained synthetic datasets applied to real data. While there is still large gap between the 88.3% accuracy the real data and our results, DP-MEPF achieves nontrivial results around 50% for = 10, which degrade as privacy is increased. While the drop in sample quality due to high privacy is quite substantial, it is less of a problem in the unlabelled case, since our embedding dimension is smaller by factor of 10 (the number of classes) and thus easier to release privately.
Table 6: Test accuracies (higher better) of ResNet9 trained on CIFAR-10 10 synthetic data with varying privacy guarantees. When trained on real data, test accuracy is 88.3%
10
0.5
0.2
DP-MEPF (th, +2)
53.0
43.9
40.0
28.5
18.0
16.2
DP-MEPF ((h)
40.7
32.3
42.6
33.2
18.8
15.3
DP-MERF
13.2
13.4
13.5
13.8
13.1
10.4
7 DISCUSSION
We have demonstrated the advantage of using auxiliary public data in DP data generation. Our method DP-MEPF takes advantage of features from pre-trained classifiers that are readily available, and allows us to tackle datasets like CelebA and CIF which have been unreachable for private data generation up to this point.
There several avenues to extend our method in future work, in particular finding better options for the encoder features: the choice of VGG19 by dos Santos al. (2019) works well in private settings, but dower-dimensional embedding that still works well for training generative models perhaps based on some kind of pruning scheme might help reduce the sensitivity of μg and improve quality.
Training other generative models such as GANs or VAEs with pretrained components is also exploring further than our initial attempt here. may also be possible take "middle ground" and introduce some adaptation for features in DP-MEPF, to allow for more powerful, GAN-like models, without suffering too much privacy loss. the non-private generative modelling community, this has proved important, but the challenge will be to do while limiting the number of DP releases allow modelling with, e.g., 2.
8 ACKNOWLEDGEMENTS
We thank the anonymous reviewers for their valuable time helping us improve our manuscript.
F. Harder supported by the Max Planck Society and the Gibs Schüle Foundation and the Institutional Strategy of the University of Tübingen (ZUK63) and the German Federal Ministry of Education and Research (BMBF): Tübingen Al
11

---

Published in Transactions on Machine Learning Research (04/2023)
Center, FKZ: 011S18039B. F. Harder is also grateful for the support of the International Max Planck Research School for Intelligent Systems (IMPRS-IS).
M. Jalali Asadabadi, M. Park, and D. J. Sutherland are supported in part by the Natural Sciences and Engineering Research Council of Canada (NSERC) and the Canada CIFAR AI Chairs program.
9 BROADER IMPACT STATEMENT
Our work is motivated by the need for strong and scalable data privacy, which we expect will have mainly beneficial societal impact. However, our work touches on two topics, which are known to contain a risk of harmful impact on individuals and thus need to be treated with caution.
9.1 Differential privacy and fairness
Firstly, recent research has shown that DP is at odds with notions of fairness when if comes to under-represented groups in the data. For instance Chang & Shokri (2021) show that minorities are more susceptible to membership inference attacks in fair non-DP models (i.e. fairness reduces privacy) and Bagdasaryan al. (2019) show the reverse effect: when training an unfair model with strong DP guarantees, the fairness is reduced further. The dilemma is intuitive: Fairness requires amplifying the impact of samples from minorities in the data, so they will not be ignored, while DP needs to limit the impact each individual sample can have in order to keep sensitivity low. Since its discovery, this trade-off has received attention both in works seeking more detailed understanding (Cummings et al., 2019; Mangold et al., 2022; Esipova et al., 2022: Zhong et al., 2022; Sanyal et al., 2022) and works proposing custom approaches to DP fair machine learning (Ding et al., 2020; Xu et al., 2019; Jagielski et al., 2019; Tran et al., 202 l0;b;;;; Esipova et al., 2022). Given that the impact DP on fairness is an active area research and independent of our particular approach, we do not see the need to perform our own experiments on this matter.
We will, however, provide intuition on how the problem manifests in DP-MEPF by looking at labelled data generation with significant class imbalance. Assuming an imbalanced dataset with two classes and [C|] 100 and |C2l 10, we obtain the following mean embedding:
1 Eiec, Φ((x;) + nn.1 m 1. Erec, (x(x)) n
(D)
With (x:(2 = 1, we know that the norm of the unperturbed mean embedding for class 1, given by I Eiec, (2x))222 I 100/110, may be ten times as large as the maximum possible norm for the class em- bedding || 1/ Eiec, (x l12 I 10/110. Nonetheless, in order to preserve DP, both embeddings are perturbed with noise of the same magnitude, leading to a significantly worse signal-to- ratio for the class 2 embedding. As a result, the generative model trained on this embedding will produce more accurate samples for class than for class 2.
9.2 Differential privacy with public data
The second issue regards the use of public data in DP. In recent position paper, Tramèr et al. (2022) raise several concerns about the increasing trend of using auxiliary datasets in DP research. Their critique has two main arguments, the first being that publicly available data may still be sensitive and using such data may cause unintended privacy violations. Given that many large datasets are scraped from the internet with limited human oversight, this data may contain personal data that was released involuntarily or shared exclusively for a specific context. The authors suggest that responsible use of public data requires improved curation practices, including e.g. collection of explicit consent for data use, auditing for and removal of sensitive content, and providing channels for reporting privacy concerns.
The other main criticism raised by Tramèr et al. (2022) is that the datasets used to demonstrate the benefits of public data in DP, such as Cifar 10 or ImageNet, are poorly chosen, because they are often from nearly the same distribution as the private data. In contrast, they argue, using public data in realistic application scenarios such as medical imaging would likely require considerable domain shift, since no public data close to the target domain is available. This disparity leads overly optimistic claims, as the experiments don't 't actually demonstrate good performance under significant domain shift. They further point out that the quality of DP method becomes difficult measure if it builds e.g.
12

---

Published in Transactions on Machine Learning Research (04/2023)
non-privately pre-trained model, overall improvement' may stem both from either the private and the non-private part of the method. The authors propose dedicated henchmarks for DP machine learning should be developed, in order to obtain results which are comparable and predictive of model performance in real-world applications. They also acknowledge that such benchmarks don't currently exist and their design requires careful consideration.
We agree with the authors in their analysis of the challenges facing DP machine learning research and value their proposals for future directions and experiment design. In the light of all these problems introduced by public data, one might ask whether this is at all research direction worth pursuing. Here, we emphasize fact that is acknowledged in the final paragraph of Tramèr et al. (2022): "many recent works employing public data have played important role in showing that differential privacy can be preserved for certain complex machine learning problems, without suffering devastating impacts on utility. DP currently sees little to no practical application in machine learning, in large part because the loss of utility causes is often unacceptable. Auxiliary public data is the best candidate for achieving sufficient utility for practical use and so, our eyes, the potential of these approaches outweighs the complications they introduce. It thus vital that research DP ML with public data is pursued further.
References
Martin Abadi, Andy Chu, Ian J. Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS '16, pp. 308-318, New York, NY, USA, 2016. Association for Computing Machinery. ISBN 978 9781450341394, doi: N0.1145/976749.2977555
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially private mixture of generative neural networks. IEEE Transactions on Knowledge and Data Engineering, (1()): 100--111,, 2018.
Differential Privacy Team, Apple. Learning with privacy at scale, 2017. URL httt::::mmmahhnneeearmnnngg apple. .
Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy, Advances in neural information processing systems, 32, 2019.
Alex Bie, Gautam Kamath, and Guojun Zhang. Private GANs, revisited. arXiv preprint arXiv:2302.02936, 2023.
S. Boucheron, G. Lugosi, and P. Massart. Concentration inequalities: A nonasymptotic theory of independence. Oxford University Press, 2013.
Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don't generate me: Training differentially private generative models with sinkhorn divergence. In Neural Information Processing Systems (NeurIPS), 2021.
Hongyan Chang and Reza Shokri. On the privacy risks of algorithmic fairness. 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 292-303. IEEE, 2021.
Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. Gs-wgan: A gradient-sanitized approach for learning differentially private generators. In Advances in Neural Information Processing Systems 33, 2020.
Rui Chen, Qian Xiao, Yu Zhang, and Jianliang Xu. Differentially private high-dimensional data publication via sampling-base inference. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 129-138, 2015.
Rachel Cummings, Varun Gupta, Dhamma Kimpara, and Jamie Morgenstem. On the compatibility of privacy and fairness. In Adjunct Publication of the 27th Conference on User Modeling, Adaptation and Personalization, pp. 309-315, 2019.
Jiahao Ding, Xinyue Zhang, Xiaohuan Li, Junyi Wang, Rong Yu, and Miao Pan. Differentially private and fair classification via calibrated functional mechanism. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 622-629, 2020.
Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models, arXiv preprint arXiv:2210.09922 2022.
13

---

Published in Transactions on Machine Learning Research (04/2023)
Cicero Nogueira dos Santos, Youssef Mroueh, Inkit Padhi, and Pierre L. Dognin. Learning implicit generative models by matching perceptual features. In 20/9 IEEF/CVF International Conference on Computer Vision (ICCV), pp- 4460-4469. IEEE, 2019. doi: 10.1 10.110//CCC222110000456
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Advances in Cryptology EUROCRYPT 2006, 25th Annual International Conference the Theory and Applications of Cryptographic Techniquex, volume 4004 of Lecture Notes in Computer Science, pp. 486-503. Springer, 2006. doi:
Gintare Karolina Dziugaite, Daniel M. Roy, and Zoubin Ghahramani. Training generative neural networks via Maximum Mean Discrepancy optimization. In UAI, 2015.
Maria S Esipova, Atiyeh Ashari Ghomi, Yaqiao Luo, and Jesse Cresswell. Disparate impact in differential privacy from gradient misalignment. arXiv preprint arXiv:2206.07737, 2022.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differentially private generative adversarial networks for time series, continuous, and discrete open data. In ICT Systems Security and Privacy Protection 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings, pp. 151-164, 2019. doi: 10.1007/978-3-0000 --0077------00-222--000 22-12-2312221-
J. Goodfellow, J. Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial networks. In Advances in Neural Information Processing Systems, 2014.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. Journal of Machine Learning Research, 13(Mar):723-773 2012.
Frederik Harder, Kamil Adamczewski, and Mijung Park. DP-MERF: Differentially private mean embeddings with random features for practical privacy- data generation. In AISTATS, volume 130 of Proceedings of Machine Learning Research, pp. 1819-1827. PMLR, 2021.
Moritz Hardt, Katrina Ligett, and Frank Mcsherry. simple and practical algorithm for differentially private data release. In Advances in Neural Information Processing Systems 25, pp. 2339 23397 Curran Associates, Inc., 2012.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local Nash equilibrium. Advances in Neural Information Processing Systems, 30, 2017.
Matthew Jagielski, Michael Kearns, Jieming Mao, Alina Oprea, Aaron Roth, Saeed Sharif--Malvaeerdi, and Jonathan Ullman. Differentially private fair learning. In International Conference on Machine Learning, pp. 3000 PMLR, 2019.
Alex Krizhevsky. Learning multiple layers of features from tiny images. 2009.
Beatrice Laurent and Pascal Massart. Adaptive estimation of a quadratic functional by model selection. Annals of Statistics, pp. 1302-1338, 2000.
Guillaume Leclere, Andrew Ilyas, Logan Engstrom, Sung Min Park, Hadi Salman, and Aleksander Madry. ffev. /tttp::/gittane com htmm///bffc//fff/////// 2022.
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010. URL http::////yan..ta
Yujia Li, Kevin Swersky, and Richard Zemel. Generative moment matching networks. In JCML, 2015.
Seng Pei Liew, Tsubasa Takahashi, and Michihiko Ueno. PEARL: Data synthesis via private embeddings and adversarial reconstruction learning. In International Conference on Learning Representations, 2022.
14

---

Published in Transactions on Machine Learning Research (04/2023)
Ziwei Liu, Ping Luo, Xiaogang Wang. and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
Paul Mangold, Michaël Perrot, Aurélien Bellet, and Mare Tommasi. Differential privacy has bounded impact on fairness in classification. 2022.
Noman Mohammed, Rui Chen, Benjamin C.M. Fung, and Philip S. Yu. Differentially private data release for data mining. In Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Diseovery and Data Mining, KDD "11, pp. 493-501, New York, NY, USA, 2011, ACM. ISBN 978-1 1-------0--881---- doi: 10.1 145/2000040822224455)
National Conference of State Legislatures. Differential privacy for census data, 2021. http:t::
aspx.
Nicolas Papernot, Martín Abadi, Úlfar Erlingsson, lan J. Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In Proceedings of the International Conference on Learning Representations (ICLR), 2017.
Mijung Park, James Foulds, Kamalika Choudhary, and Max Welling. DP-EM: Differentially Private Expectation Maximization. In AISTATS, volume 54 of Proceedings of Machine Learning Research, pp. 896-904, Fort Lauderdale, FL, USA, April 2017. PMLR.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32, pp. 8024-8035. Curran Associates, Inc., 2019.
F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2830, 2011.
Wahbeh Qardaji, Weining Yang, and Ninghui Li. Priview: practical differentially private release of marginal contingency tables. Proceedings of the 2014 ACM SIGMOD international conference on Management of data, pp. 1435-1446, 2014.
Ali Rahimi and Benjamin Recht. Random features for large-scale kernel machines. In Advances in Neural Information Processing Systems, pp. 1177-1184, 2008
Amartya Sanyal, Yaxi Hu, and Fanny Yang. How unfair is private learning? In Uncertainty in Artificial Intelligence, pp. 1738-1748. PMLR, 2022.
Maximilian Seitzer. pytorch- fid: FID Score for httppp///ggttaa..ccc///aaeeeeeep August 2020. Version 0.2.1.
fid,
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. 2014.
A. Smola, A. Gretton, L. Song, and B. Schölkopf. A Hilbert space embedding for distributions. In ALT, pp. 13-31, 2007.
Joshua Snoke and Aleksandra Slavković. pmse mechanism: differentially private synthetic data with maximal distributional similarity. In International Conference on Privacy in Statistical Databases, pp. 138-159. Springer, 2018.
Song, Kenji Fukumizu, and Arthur Gretton. Kernel embeddings conditional distributions: unified kernel framework for nonparametric inference in graphical models. IEEE Signal Processing Magazine, 30(4))98-111) 30(4))99880
2013.
Nathan Srebro, Karthik Sridharan, and Ambuj Tewari. Optimistic rates for learning with smooth loss, 2010.
15

---

Published in Transactions on Machine Learning Research (04/2023)
Bharath K Sriperumbudur, Kenji Fukumizu, and Gert RG Lanckriet. Universality, characteristic kernels and rkhs embedding of measures. Journal of Machine Learning Research, 12(7), 2011.
Reihaneh Torkzadehmahani. Peter Kairouz, and Benedict Paten. Dp-cgan: Differentially private synthetic data and label generation. In The IEEE Conference Computer Vision and Pattern Recognition (CVPR) Workshops, June 2019.
Florian Tramèr and Dan Boneh. Differentially private learning needs better features (or much more data). In International Conference on Learning Representatiinss 2021.
Florian Tramèr, Gautam Kamath, and Nicholas Carlini. Considerations for differentially private learning with large-scale public pretraining, arXiv preprint arXiv:2212.064700 2022.
Cuong Tran, My Dinh, and Ferdinando Fioretto. Differentially private empirical risk minimization under the fairness lens. Advances in Neural Information Processing Systems, 34:27555-275655 2021a.
Cuong Tran, Ferdinando Fioretto, and Pascal Van Hentenryck. Differentially private and fair deep learning: A lagrangian dual approach. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 9932-9939, 2021b.
Margarita Vinaroz, Mobammad-Ami Charusaie, Frederik Harder, Kamil Adamczewski, and Mi Jung Park. Hermite polynomial features for private data generation. In ICML,, volume 162 of Proceedings of Machine Learning Research, pp. 22300-22324. PMLR, 2022.
Yu-Xiang Wang. Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled rényi differential privacy and analytical moments accountant. In AISTATS, 2019.
Yuxin Wu and Kaiming He. Group normalization. In Proceedings of the European conference on computer vision (ECCV), pp. 3-19, 2018.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. 2017.
Yonghui Xiao, Li Xiong, and Chun Yuan. Differentially private data release through multidimensional partitioning. In Secure Data Management, pp. 150-168, Berlin, Heidelberg, 2010. Springer Berlin Heidelberg. ISBN 978-3-642- 15546-8.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. 2018.
Depeng Xu, Shuhan Yuan, and Xintao Wu. Achieving differential privacy and fairness in logistic regression. Companion proceedings of The 2019 world wide web conference, pp. 594-599, 2019.
Jinsung Yoon, James Jordon, and Mihaela van der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International Conference on Leurning Representations, 2019.
Jun Zhang, Graham Cormode, Cecilia M Procopiuc, Divesh Srivastava, and Xiaokui Xiao. Privbayes: Private data release via bayesian networks. ACM Transactions on Database Systems (TODS). 42(4):1-41, 2017.
Zhikun Zhang, Tianhao Wang, Ninghui Li, Jean Honorio, Michael Backes, Shibo He, Jiming Chen, and Yang Zhang. Privsyn: Differentially private data synthesis. In 30th USENIX Security Symposium (USENIX Security 21), 2021.
Da Zhong, Haipei Sun, Jun Xu, Neil Gong, and Wendy Hui Wang. Understanding disparate effects of membership inference attacks and their countermeasures. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pp. 959-974, 2022.
Lijia Zhou, Frederic Koehler, Danica J. Sutherland, and Nathan Srebro. Optimistic rates: A unifying theory for interpolation learning and regularization in linear regression, 2021.
T. Zhu, Li, W. Zhou, and P. S. Yu. Differentially private data publishing and analysis: A survey, IEEE Transactions on Knowledge and Data Engineering, 1619)1661 August 2017. ISSN 1041-4347. doi: 1011 2697856.
16

---

Published in Transactions on Machine Learning Research (04/2023)
Supplementary Material
A Proofs
We will conduct our analysis in terms of general noise covariance 2 for the added noise, ~ (0, 2). The results will depend on various norms of Σ, as well as |E|/aa||, where a = (D (D( is the difference between empirical mean embeddings (2( = [D] EXED (x). (Recall that MMD(2, D) ||al|.)
When we use only normalized first-moment features, the quantities appearing in the bounds
402
ID
m
2
2
2
|0|| op
|r
VD
Tr(E)
m² D
(8)
m²
m
|| = Va
Ea
MMD (D.
When we use first- and second-moment features with respective scales C₁ and C2 (both 1 in our experiments here), we have
0² m
In
4
C
0
20
TD.
m
0
CHID
2
4g
2
[Σ op
max
( C2)
|
(C² + C3)
VD
TT(E)
(C² C2) D
(9)
m
m
m
20
// a
Va
La
Cf MMD ks (D, D) C3 MMD k. (D, D)2.
m
Note that if C1 = C2 = C, then
CK
MMD kΦ, (D, C2 MMD K2_ (D, C. MMD (D,
A.1 Mean absolute error of loss function
Proposition A.1. Given datasets D [x m and D {x }リ and a kernel Ke with D-dimensional embedding o,
let (D) (D) Define MMD kg. (D,D) = |la + n 2 for a noise vector n ~ No0 E). Introducing the noise n affects the expected absolute error as
2 |1///aal MMD Ry (D,D) MMD? (D.ii] < <T(E) + +2
Em
(10)
Proof. We have that
MMD ho (D.D) - MMDD2 (D, D)]]
En
= En
la + n 1|| ||al"]]
= E,
nn n + 2n Talal
$ En
Tn n
+
E
n a
(11)
The first term is standard:
En-n=ETr(n n) E'Tr(nn") Tr(Enn)) Tr(2).
For the second, note that
a n No a Σa),
and so its absolute value is Va Ea times a x(1) random variable. Since the mean of a x(1) distribution is
vēT(U)
T(172)
we obtain the desired bound.
17

---

Published in Transactions on Machine Learning Research (04/2023)
A.2 High-probability bound on the error
Proposition A.2. Given datasets D {x+]= and D {x,1z=1 let Ha(D) -La(D), and define
MMD (D, D) |a + nll² for noise vector (0, )), Then for any P (0. 1), it holds with probabil- ity at least 1 over the choice of n that
MMD Re. (D. MMD (D, (D.
s TT(E V /1 +2 (|Elle v2|lEball2) / /log(?) + 21|EEllop log( ()) (12)
This implies that
MMD hi
D) - MMD (D. DI -0, (Tr(E) + ||2/2a|12
Proof. Introduce No0, 1) such that n Σスッ into Equation
MMD (D, MMD (D, F)1 S n Sonn+ 2 Ta
+ -Z
Ez
2/a //1/2//
(13)
For the first term, denoting the eigendecomposition of E as QAQ we can write
Σ> (Q x) AQQT2),
in which Q z ~ ~O,, I) and A is diagonal. Thus, applying Lemma of Laurent & Massart (2000), we obtain that with probability at least 2.
Ez S Tr(E) + +
log(?) () + 2/12 log(
(14)
In the second term, aa EZzl can be viewed function of standard normal variable with Lipschitz constant at most b|l Thus, applying the standard Gaussian Lipschitz concentration inequality (Boucheron et al., 2013, Theorem 5.6), we obtain that with probability least 1 e 2'
Tytal <BZ
T + | log(3) ||لta|| (V + / /2
The first statement in the theorem follows by union bound. The Op form follows by Lemma A.1 and the fact that Tr(A) 2 || 2 | for positive semi-definite matrices A.
The following lemma shows how to convert high-probability bounds with both sub-exponential and sub- sub-Gaussian tails into a O statement.
Lemma A.I. If a sequence of random variables Xn, satisfies
X, < An + Br Bug log bn + Cn log Co
with probability at least p.
then the sequence of variables X, is
Op (max (Ams Br max log bn, 1), On max(log en; 1)))
Proof. The definition sequence of random variables X,, being (p(Qn) where Qn sequence of scalars, means that the sequence -. is stochastically bounded: for each p. there some constant R, such that Pr(X../., R,) I p.
18

---

Published in Transactions on Machine Learning Research (04/2023)
Here, have for all with probability at least p that
A. + Bry log d C, log e
X max (An; Bn max( Vlogbbbbe bn, 1), Cn max(log Cn. 1))
max (An, B, max /log b,, 1), Cn max Cu. 1))
An + Bn log in + log 1 + Cn log on + log p
max (Ans Bn max Vlog b,. 1), Cn max Cu. 1))
An Bn lo + Bn log Cn log on + Cn log 1
max (An: Bn max( (v log bn 1), Cn max(log Cn. 1))
$ +1+1+ V log p
+ 1 log
p
Thus the desired bound holds with R2 3 -
/ log + log
A.3 Quality of the private minimizer: worst-case analysis
We first show uniform convergence of the privatized MMD to the non-private MMD.
Proposition A.3. Suppose that Φ X + RRP is such that sup, [ < B, and let MMD (D, = =1)aa(D) - (D) + u|I for n ~ -N(0, 2). Then, with probability at least - p over the choice of n,
sup MMD (D, D) MMD (D. D,D
S TT>> + TT(E) + (1E1| + 2
+111)11) (log(?) + 21p log(?) =0 (T+(E)) + BVT((E))
(T(EE)BBTT+()))
where the supremum is taken over all distributions, including the empirical distribution of datasets D, D of any size.
Proof. Introducing z AO0 ID) such that E1/22, have that
MMDD (D,D) -MMD? (D,D) S supz Ti Ez + 2/ 1/22
sup D,D
D.D
<z < Ez +2
la 1
sup
a:I|a||S2B
$ z TZ +2
|||||||
sup
a:I|a|||2B
z Ez + 4B S1/22
To apply Gaussian Lipschitz concentration, we also need to know that
1/ S / v TT();;
the exact expectation of x variable with more than one degree of freedom is inconvenient, but the gap is generally not asymptotically significant. Then we get that, with probability at least 1
2.
|2 S Tr(E) + |/ 2 22gg 2
1/2
Again combining with the bound of Equation 14, we get the stated bound.
This bound is looser than in Proposition A.2, since the term depending on a is now "looking at" z in many directions rather than just one: we end up with a x(dim (2)) random variable instead of x(1.
We can use this uniform convergence bound show that the minimizer of the private loss approximately minimizes the non-private loss:
19

---

Published in Transactions on Machine Learning Research (04/2023)
Proposition A.4. Fix a target dataset D. For each I in some set θ fix corresponding De: in particular, θ = R could be the set of all generator parameters, and Do either the outcome of running a generator go on fixed set of "seeds," De =
or the full output distribution of the generator Que- Suppose that d X 7 TR. is such that sup,. (x))] Σ B, and let MMDs, (D,D) = =1) ue (D) + al for n ~ NN E). Let 0 E arg mingee MMD ko. (D, Do) be the private minimizer, and 0 arg mingge MMD (D,4g) the non-private minimizer. For any (0, 1), with probability at least p over the choice of n,
MMD ) MMD Rg (D.Dg)
v (log()) $ 2Tx(Z) + 8B Tr( + 4 (|E| 2BI
OO + 41| op log(?)) = (Tr(E) + By Tr(E))
Proof. Let represent the uniform error bound of Proposition A.2. Applying Proposition A.2, the definition of 0, then Proposition A.2 again:
2 MMD Kip (D, MMD Re (D. +as MMD Ky (D, + MMD Ra (D, 2a.
A.4 Quality of the private minimizer: "optimistic" analysis
The preceding analysis is quite "worst-case," since upper-bounded the MMD by the maximum possible value everywhere. Noticing that the approximation in Proposition A.2 is tighter when ||>//a|| is smaller, we can instead show an "optimistic" rate which takes advantage of this fact to show tighter approximation for the minimizer of the noised loss. In the "interpolating" case where the generator can achieve zero empirical MMD, the convergence rate substantially improves (generally improving the squared MMD from (,(1/m) to (,(1/m²))
Proposition A.5. In the setup of Proposition A.4, we have with probability at least 1 - over n that
MMDE, (D, MMD (D, Dg)
< (I)(E) + +4 4 Tr(2) R., (D, gg)
+2 [||E||| + 2 11 MMD (D, (D) log /
+ 18| El log 2 p
|
= =Op (Ir(2)+ + Tr(E) MMD (D, (D.))).
Proof. Let's use MM)(O) to denote MMD ky (D, Do), and MMD(O) for MMD ky (D,Do).
For all 0, we have that
2 MMD (0) MMD (0) < z Ez -z + 21 (D) - μ T
S z
T Ez (MM(())
Thus, applying this inequality in both the first and third lines,
MMD' (0) < MMD
(0) + T Ez MMD(0)1154222)
MMD
+
Ez
MMD (M)
MMD
(0) + 2z
Σz + 2
MMD 0) + MMD(O) ||
in the second line we used that OM < MMD
Rearranging, we get that
MMD
(0)
()) - 7 $ 0,
(15)
20

---

Published in Transactions on Machine Learning Research (04/2023)
where
8 3=2
7 = MMD (0) + 2z Σz + MMD (0) 2
The left-hand side of Equation 15 is quadratic in MM with positive curvature; it has two roots, at
3 ( (2)² + V
2
Thus the inequality Equation 15 can only hold in between the roots; the root with a minus sign is negative, and so does not concern since know that MM)(0) 2 0. Thus, for Equation 15 to hold, we must have
V
MMD
8 2
2 +7
MMD (0) < 1 +7 + BV (2) +y
4 8 + BB..
Also note that
MMD (0) + 2z Lz + 2 MMD || - (MM + v21122/2211
Thus, substituting in for 3 and then simplifying, we have that
MMD (0) < MMD (0) + (6 2v2)z Ez + /1|1 | MMD(
Using the same bounds on z Σz and
| || as in Proposition A.3, and 6v < 9, gives the claimed bound.
B Extended Implementation details
Repositury. Our code is available at httpp://github.c http://hhh....caaaaaaaaaaa////// the readme files contain further instructions on how to run the code.
B.1
Hyperparameter settings
For each dataset, we tune the generator learning rate (L. and moving average learning rate (LRmavy) from choices 10-* and 10-k with {3, 4, 5) once for the non-private setting and once at e = 2. The latter is used all private experiments for that dataset, as shown in After some initial unstructured experimentation, hyperparameters are chosen with identical values across dataset shown in 8
For the Cifar 10 DP-MERF baseline we tested random tuned random features dimension d E {10000, 50000), random features sampling distribution {100, 300, 1000), learning rate decay by 10% every E (1000, 10000) iterations and learning rate 10 with & E {2, 3, 4, 5, 6}. Results presented use d = 500000, 1000, = 10000, k = 3.
The DP-GAN baseline for Cifar10 and CelebA uses the same generator as DP-MEPF with 3 residual blocks and a total of 8 convolutional layers and is paired with ResNet9 discriminator which uses Groupnorm instead of Batchnorm to allow for per-sample gradient computation. We pre-train the model non-privately convergence on downsampled imagenet in order to maintain the same resolution of 32 x 32 and then fine-tune the model for smaller number of epochs. In case of the CclebA 64 x 64 data we add another residual block discriminator and generator to account for the doubling in resolution. The base multiplier for number of feature maps is reduced from 64 to 50 to lessen the increase in number of weights. Results are the best scores of a grid-search over the following parameters at = 2, which is then used in all settings: number of epochs {1, 10, 30, 50} generator and discriminator learning rate separately for 10- and 3 10-k with k E {3, 4, 4,5), clip-norm (10-3. 3 10-4 10-5 10 10-0), batch size (128, 256, 512) and, as advised in Bie et al. (2023), number of discriminator updates per generator (1, 10, 30, 50). The chosen values are given in table 9.
21

---

Published in Transactions on Machine Learning Research (04/2023)
Table 7: Learning rate hyperparameters across datasets
Dataset
(Φ1, +2)
(Ø1)
LRgen
La
LRgen
gen
LR Lany
MNIST
= 00
10-5
10-3
10
10-3
<
10-5
10
10-5
10-4
FaShionMNIST
E = 00
10-5
10-3
10-5
10-3
10-1
10-3
10-4
10-3
10,50
3.10
10
3.
10 4
CelebA32
(2,1)
3.
3-10
3.10
3.10
(0.5.0.2)
10
3.10
.10
3.10
50,)
3 10
10-4
3 1-10-
3 3-10-
CelebA64
{2,1}
3 10-4
10-3
3 1-10-
3 10-
(0.5,0.2)
10-3
10-3
10
10
(0,)
10-3
3 10
10
10
Cifarl0 labeled
{2,1}
10 30-3
10 10-2
10-3
10-2
(..5,0.2)
10
10
10
10
10,5
10-3
10-3
10-3
10-3
Cifarl0 unlabeled
[2,1)
10-3
10-3
10-3
10-3
{0.5,
10-3
10-3
10-3
10-3
Table 8: Hyperparameters fixed across datasets
Parameter
Value
(bou-d
( (b2)-bound
1
iterations (MNIST & FashionMNIST)
100,000
batch size (MNIST and FashionMNIST)
100
iterations (Cifarl0 CelebA)
200,000
batch size (Cifarl0 and CelebA)
128
seeds
1,2,3,4.5
C
Detailed Tables
Below present the results from the main paper with added + b notation, where is the mean and b is the standard deviation of the score distribution across three independent runs for MNIST and FashionMNIST and independent runs for Cifar10 and CelebA.
Table 10: Downstream accuracies of our method for MNIST at varying values of с
= 00
= 10
6=
6=2
6
0.2
DP-MEPP MEPF (d), 62)
91.4
89.8 1 0.5
89.9 99.9-022
89.3 1 0.3
89.3 = 0.6
79.9 + 1.3
MLP
DE-M (Φ1)
88.2 0.6
88.8 0.1
0.
88.0 0.2
87.5 0.6
77.1 - 0.4
DE-MEPF ( d2)
84.6
83.4
83.3 0.7
829 0.7
82.5
75.8
LogReg
DP-MEPF (
81.4 0.4
80.8 = 0.9
80.8 0.8
80.5 = 0.6
79.0 = 0.6
72.1 + 1.4
Table 9: Hyperparameters of DP-GAN for Cifarl0 and CelebA
Cifar10
CelebA 32 x 32
CelebA 64 x 64
(0.2,0.5)
<=1
<=
(5, 10)
LRgen LRais batch size
10-4
3. 10-4
3. 10-4
3 10-1
3 10-1
3 10-1
10-3
3 10-1
10-3
3 10-4
10-3
10-3
512
512
512
512
512
512
epochs
10
10
10
10
10
10
discriminator frequency
10
30
10
10
clip norm
10-5
10-4
10-5
10-5
10-4
10-3
22

---

Published in Transactions on Machine Learning Research (04/2023)
Table 11: Downstream accuracies of our method for FashionMNIIST at varying values of
c 00
<=
<= 5
(=2
c 1
c= 0.2
DP-MEPF (Φ1, (2)
74.4 0.3
7
75.8
0.6
75.1 = 0.3
74.7 1.1
70.4 + 1.9
MLP
DP-MEPF (Φ1)
73.8
75.5
75.1 0.8
75.8 0.7
75.0 = 1.8
69.0 + 1.5
OP-MEPF (6), 62)
0.1
1.0
75.2 0.4
75.8
75.4
72.5
LogReg
DP-MEPF (Φ1)
7288
7.1
75.5
0.8
76.4 0.8
76.2 = 0.8
71.7 + 0.4
Table 12: CelebA FID scores
x (lower is better)
10
0.5
0.2
DP-MEPF (Ø1, (2)
18.5
17.4
17.5 i 0.6
18.1 1 0.8
19.0 1 0.5
21.4 1 1.3
25.8 = 2.1
DP-MEPF (Φ1)
16.6 1 0.7
16.3 + 0.9
16,9 i 0.5
16.5 1 0.8
17.2 + 0.9
21.8 + 1.0
25.5 = 1.1
Table 13: CelebA FID scores 64 x 64 (lower is better)
6= 10
6=
6=2
0.5
0.2
DP-MEPF (01, (2)
18.6 1.0
18.5 +
19.1 +
18.4 +
19.0
21.4 =
26.8 =
DP-MEPF (0))
16.3 + 0.4
17.4 + 1.4
16.5 + 0.8
16,9 + 1.1
18.4 + 0.9
20.4 - 0.8
27.7 = 2.1
Table 14: FID scores for synthetic labelled CIFAR-10 data (generating both labels and input images)
10
c
c=]
0.5
0.2
DP-MEPF (61, (22)
27.7 3.1
29.1
30.0 + 0.8
39.5
1.9
54.0 1.3
76.4 + 3.9
226.0 + 5.4
DP-MEPF (()) 28.4
2.8
30.3 + 2.1
35.6 + 5.8
42.0 + 3.0
56.5 + 3.4
92.0 + 3.5
268.3 + 8.5
Test accuracies (higher better) of ResNet9 trained on CIFAR-10 synthetic data with varying privacy guarantees. When trained real data, test accuracy is 88.3%
Table 15:
10
<=
(=
0.5
0.2
DP-MEPF (01, (22)
57.5 + 3.3
$3.0 + 2.8
43.9 + 1.2
40.0 1,9
28.5 4.5
18.0 + 1.0
16.2 + 1.8
DP-MEPF (Φ1) 43.8 3.5
40.7 4.2
32.3 + 6.2
42.6 1.6
33.2 2.6
18.8 + 4.0
15.3 2.5
D Encoder architecture comparison
We are testing large collection of classifiers of different sizes from the torchvision library including VGG, ResNet, ConvNext and EfficientNet. For each we look at unlabelled Cifar10 generation quality in the non-DP setting and at = 0.2. In each architecture, we use all activations from convolutional layers with a kernel size greater than 1xl. We list the number of extracted features along with the achieved FID score in table 17, where each result is the best result obtained by tuning learning rates. As already observed dos Santos et al. (2019), we find that VGG architectures appear learn particularly useful features for feature matching. We hypothesized that in the private setting other architectures with fewer features might outperform the VGG model, but have found this to not be the case.
E Public dataset comparison
We pretrained ResNet18 using ImageNet, CIFARIO, and SVHN as our public data, respectively. We then used the perceptual features to train a generator using CelebA dataset as our private data at a privacy budget of e 0.2 and obtained the scores shown in 18. These numbers reflect intuition that long as the public data is sufficiently similar and contains more complex patterns than private data, e.g., transferring the knowledge learned from ImageNet as public data to generate CelebA images as private data, the learned features from public data are useful enough to generate good synthetic data. In addition, as the public data become more simplistic (from CIFARIO to SVHN), the usefulness of such features reduces in producing good CelebA synthetic samples.
23

---

Published in Transactions on Machine Learning Research (04/2023)
Table 16: FID scores for synthetic unlabelled CIFAR-10 10 data
6 5
6
6= 0.5
0.2
DP-MEPF (Ø), (22)
38.5 + 1.5
38.8 + 2.0
37.0 +
38.7 + 2.2
43.0 + 1.1
49.4
67.3
DP-MEPF ((11
38.5 + 0.6
38.5 + 0.4
38.6 + 1.3
40.1 + 1.1
45.1 + 2.4
49.8 2.5
72.3 4.0
Table 17: Unlabeled Cifar10 FID scores achieved with different feature extractors. VGG models yield the best results in both non-DP and high DP settings.
Encoder model
#features
0.2
(Ø1, (2)
(Φ1)
(Φ1, (2)
(Φ)
VGG19
303104
35.0
37.0
56.2
85.8
VGG16
276480
37.4
39.8
71.4
72.2
VGGI3
249856
38.2
36.7
78.1
71.2
VGG11
151552
40.5
41.6
65.4
68.6
ResNet152
429568
71.8
70.1
88.6
87.9
ResNet101
300544
77.5
73.7
76.0
82.4
ResNet50
196096
71.5
76.3
90.0
105.1
ResNet34
72704
74.8
103.3
89.1
93.1
ResNer18
47104
84.9
85.0
104.5
95.2
ConvNext large
161280
141.9
232.0
138.2
221.6
ConvNext base
107520
142.4
248.0
157.0
200.1
ConvNext small
80640
171.7
212.3
169.9
202.9
ConvNext tiny
52992
145.6
218.2
138.8
205.8
EfficientNet
119168
200.9
229.0
243.7
226.6
EfficientNet M
68704
185.7
177.1
218.7
227.1
EfficientNet
47488
157.5
160.6
171.5
186.7
Table 18: FID scores achieved for CelebA 32 32 using a ResNet encoder with different public training sets
ImageNet
Cifar10
SVHN
47.6
51.2
24

---

Published in Transactions on Machine Learning Research (04/2023)
F Training DP-MEPF without auxiliary data
While DP-MEPF is explicitly designed to take advantage of available public data, might wonder how the method performs if no such data is available. The following experiment on CIFARIO 10 explores this scenario. We assume that privacy budget of = 10 is given. We use some part of the budget for feature extractor (i.e. the classifier) training and the rest of the budget for the generator training.
For a feature extractor, we have trained ResNet-20 classifiers with DP-SGD at three different levels e E {2, 5, 8) for classifying the CIFARIO dataset. We the clipping norm 0.01 and trained the classifiers for 7, 49 and 98 epochs, respectively. Their test accuracies 38.4%, 49.5% and 54.0% respectively. We also include scores for DP-MEPF applied to the untrained Classifier, denoted as 0.
Then, we train the generator using these four sets of features to generate CIFARIO images, where each generator training uses the rest the budget, i.e., c E {8, 5, 2] and 10 for the untrained classifier. We tune the learning rate in each of the four settings and keep other hyperparameters at default values.
Table 19: DP-MEPF results in CIFAR10 when using DP feature extractor (c 0 is untrained extractor)
for feature extractor training for generator training
FID
0
10
111.1
2
8
127.0
5
5
90.8
8
2
119.0
As expected, in Table 19 we see a considerable increase the FID score, compared to DP-MEPF with public data. A balanced allocation privacy budget with e = each for classifier and generator training yields the best result at an FID score of 90.8 and performs significantly better than just using randomly initialized feature extractor, which only achieves a score of 111.1. For comparison: with public data DP-MEPF achieves FID score of 37.0 5, highlighting the importance of such data to method.
G Additional Plots
Below we show samples from our generated MNIST and FasSionMNIST data in Figure and Figure respectively.
0
0.0
0
0
0 0
0
0
0 0
0
1
1 1
/
/
1
2 2
2 2
5 2
5 2
2
2
2
2.
3 3
3 3
y 3
> =
3
4 /
4
a 4
4
4
4 W
4
4
5 5
5 5
5 5
5 5
5
6.
6 6
6 6
6
6
6
77 8
7 7
7 7
7 7
7 7
7
7 8
77 2
8
8
7
9
9
9
9
9
9
Real Data
00
10
0.2
Figure 7: MNIST samples produced with DP-MEPF (Φ) Φ2) various levels of privacy
25

---

Published in Transactions on Machine Learning Research (04/2023)
Real Data
00
10 =
c 2
0.2
Figure 8: Fashion-MNIST samples produced with DP-MEPF (ø1, Φ2) at various levels of privacy
26


Reviews:
[{"review_id": "L6bkvIS3BE", "reviewer": "Reviewer_2VzY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Stenghts:\n\n- The idea seems interesting and novel and widely applicable, the feature extractor can be any network as well as the generator. \n\n- Strong experimental results. The lack of existing baselines for DP generative models that would exploit synthetic data underlines the novelty of this work.\n\n- Theoretical guarantees that illustrate the utility preservation of the MMD estimator (obtained from squared norm of the difference of the estimator with synthetic data and the private estimator). The results are qualitative but seem to illustrate well how things scale w.r.t. noise level and number of private data points etc. Suggestion: perhaps as a next step here could be e.g. sigmas and dataset sizes replaced by deltas and epsilons.\n\nWeaknesses: \n\n- Mainly small things, mentioned below in \"Requested Changes\". I hope you can answer my question regarding the early stopping.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes an interesting method to using public data for training a synthetic data generator with differential privacy guarantees. The method consists of a feature extractor (e.g. Resnet) trained on public data, and an estimator which computes empirical means and variances of the latent representations of the network. This estimator is evaluated on private data, and it is normalised and Gaussian noise is added and thus it is made DP. As a last step, a generator network is trained to generate synthetic data that is aimed to fit the internal representations of the aforementioned DP estimate that was evaluated on private data. By post-processing the resulting generator is DP with the same guarantees as the estimator (compositions -> DP accounting). ", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "\nBigger questions I hope you can answer:\n\n- You use early stopping based on the DP FID score estimator. Is early stopping rigorously DP? If you think not, could you mention that this part is heuristic, or if it is, could you shortly explain why it is? Using e.g. that Wang et al. (2019) analysis (RDP - analysis), I think early stopping is DP for sure for the epsilons and deltas corresponding to the max number of iterations, but if you compute the epsilons using the number of iterations up to the early stopping, then I am unsure.\n\n- Could you clarify: how are the functions $\\phi_1$ and $\\phi_2$ normalized? Do you clip or just normalise them to 1, by enforcing or by implementing this in the network activations such that it happens automatically?\n\n- Why is the sensitivity of the concatenated vector $[ \\phi_1, \\phi_2]$  2?  Isn't it $\\sqrt{2}$ if you use 2-norm? It seems that in most experiments the alternative that uses $[ \\phi_1, \\phi_2]$ is worse than the one that uses only $\\phi_1$, perhaps this might be due to the utility loss you incur here?\n\n- Or if there is another reason, for the \" $[ \\phi_1, \\phi_2]$ - alternative \" being worse in the experiments, could you clarify?\n\n\n\nSmall things:\n\n\n- p.3: The notation $\\Phi$ for the concatenated features (values and their squares) does not seem to be used later (you could remove it I guess).\n\n- Perhaps change the following sentence somehow, it felt a bit out of place in the beginning: \" However, one of the properties of DP is composability, meaning data can be accessed more than once – but the level of privacy guarantee degrades each time. \"\n\n- p. 9: \" achieves and FID\"-> \"an FID\"\n\n- p. 10: something strange with a linebreak", "broader_impact_concerns": "no concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Wi27FDPOnR", "reviewer": "Reviewer_JBBh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n\n1. At least to my knowledge and based on the claim in the paper, this is the first work in private data synthesis  for images that that uses auxiliary data and  provides meaningful synthesized samples of the CelebA dataset.\n\n2. There are ample experiments to ablate different aspects of the proposed method, such as the early stopping. There is also Downstream task evaluation. \n\n\nWeakness (further elaborated in the requested changes section):\n\n1. There is no study of the disparate impact that the proposed DP method has on the different subgroups. This could be a good discussion for the broader impacts statement, which is also missing from the paper.\n\n2. I think section three could be expanded a bit, to better explain the proposed method, specifically the discussion surrounding the generation of both labels and images together, I think that part needs to be clarified more, maybe even added to figure 1. \n\n3. The results, although there is plenty of them, are not well elaborated, specially Table 3. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes a new method for differentially private synthesis of data in the vision domain. The proposed method relies on existence of huge public training data, and differs from prior work by proposing a differentially private method that relies on MMD loss (minimizing the maximum mean discrepancy). The proposed method has three main steps, in the first step a feature extracted is trained on the public corpus, in the second step the mean embedding of the data distribution is computed and privatized (using the gaussian mechanism, and both first and second moment are used as features). Then, a generator which transforms noise to images is trained using the private features, with the MMD loss. There is also a private early stopping scheme that they suggest, which looks at a proxy FID score to determine when to stop training. \n\nThe authors then evaluate the proposed method on MNIST, FashionMNIST, CIFAR and CelebA datasets, using FID score and classification accuracy of downstream tasks. ", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "To  address the mentioned weaknesses, I propose the following changes to help improve the manuscript:  \n\n1. I think at least a discussion of broader impacts is needed, with focus on the fairness of the method. I have elaborated more in the section regarding broader impacts, but to summarize, there needs to be a study where either the FID/downstream classification accuracy for each subgroup in the data, potentially based on race for the CelebA dataset, is measured for both private and non-private data synthesis, to see how badly the underrepresented races suffer from loss in utility, and how it is exacerbated using the proposed DP method, and how it compares with one of the baselines (either DP-SGD trained GAN or  DP-sinkhorn).\n\n2. The results could be elaborated further/better, right now the progression is a bit confusing, since its based on dataset and not methods. Also, one very confusing thing is how the CelebA results are explained. Although I would assume Table 3 is a big part of the results, it is very briefly elaborated. Also, DP-sinkhorn is mentioned in the text for this dataset but there are no results in any tables for it, it is unclear where the FID 190 comes from or what the setup is there. I also have some doubts about the results in Table 3: why is there no 64*64 version of the DP-GAN? Also, the gap between DP-GAN and proposed method is a bit too high (FID 40 vs 11 for epsilon 10), how much tuning was done for the DP-GAN? \n\n3. As mentioned above section 3 could be better explained. And one final minor issue, there is something odd about the formatting in page 10, beneath figure 7, the lines break at a strange place. ", "broader_impact_concerns": "The paper does not have a broader impacts statement which is concerning, given the sensitivity of the issues covered. \nMy main concern in terms of broader impact is the fairness/disparity in drop of utility and representation of different subgroups in the synthesized samples. As shown by numerous prior work, differential privacy has disparate impact on different subgroups, especially a negative impact on underrepresented groups. This is particularly important in the case of this paper where the main goal is synthesis of data which is as similar as possible to the private data distribution, and one of the case studies is CelebA data, which is faces. In such a case, it is important to make sure different people from different subgroups are presented. I think a discussion/study of how the proposed method differs from normal DP-SGD+GAN training in terms of representation of different subgroups is needed. ", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "k3KhxyPJR5", "reviewer": "Reviewer_nrzH", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The proposed method abstracts away the need to inject noise directly during the generation process (for instance with a GAN or a Diffusion model) by using a privatized mean embedding of the data distribution to model. \n- The authors experiment on 4 datasets and present convincing generation results for decently small values of the privacy budget epsilon. \n- The proposed method (DP-MEPF) generates synthetic images that consistently degrade less the accuracy on downstream tasks than previous state-of-the-art methods.\n- The authors propose a private early stopping method (Section 3.2) using a private proxy of the FID score. We thank the authors for paying attention to potential privacy leaks occurring through training hyperparameters, even though the authors could add that the bandwidth of such hyperparameters is generally too small to incur a meaningful privacy loss [1]\n\nWeaknesses:\n- The proposed method critically relies on (a tuple of) privatized mean embeddings that represent the true data distribution to model. Could the authors elaborate on the soundness of this method for modelling extremely large image datasets? Indeed, the largest considered dataset is CelebA (200k samples), whereas recent generative models leverage LAION (400 million images). In that case, would the mean embedding be enough to capture the diversity of a large-scale dataset?\n- The authors could add some discussion on the assumption of a publicly available dataset. Following [2], we can question whether public datasets generally scrapped from the web could be (1) considered as privacy-preserving and (2) available for certain tasks. Moreover, acquiring information only through the DP channel is indeed more difficult but could alleviate these concerns (the reviewer does not ask for additional experiments but rather to give more substance to this discussion in the paper).\n- The authors could mention recent/concurrent work on Differentially Private Stable Diffusion [3]\n- The authors motivate the need for synthetic image generation mainly through the angle of downstream tasks, for instance by generating private images that still maintain the classification accuracy of a given model. However, another angle is to be able to generate images from the original distribution that are private and consider these images as the end product. In that sense, a potential follow-up would be to perform empirical attacks on the generated images to see how close to the original training set these are.\n\n[1] \"Private selection from private candidates\", Liu and Talwar, 2019.\n\n[2] \"Considerations for Differentially Private Learning with Large-Scale Public Pretraining\", Tramer et al, 2022\n\n[3] \"Differentially Private Diffusion Models\", Dockhorn et al, 2022\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes to generate images in a differentially private manner using a three-stage pipeline. First, the authors pre-train a feature extractor network on a public dataset. Then, using this public network, they extract the mean embedding of the private dataset (from which to generate) and privatize it using the Gaussian mechanism. Finally, using post-processing, the authors leverage this private mean embedding to train (without DP) a network that generates images with a mean embedding that is close to the privatized one (minimizing the Maximum Mean Discrepancy or MMD). \n\nThe authors claim that the proposed method allows them to generate \"reasonable\" CIFAR-10, CelebA, MNIST and FashionMNIST-like images with high privacy regimes ($\\varepsilon = 2$ for CIFAR-10), as illustrated in Figures 2-7. They also provide a theoretical analysis showing that the noise added once to privatize the mean embedding of the private dataset does not hurt the generative model's convergence.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "In summary, the paper does match claims with evidence. We also thank the authors for providing code (which the reviewer read in part but did not execute). Note that the reviewer did not read the proofs nor check the correctness of the theoretical analysis in Section 4 but rather focused on the method, the experimental results and setup. \n\nFor a detailed list of requested changes, see the \"Strengths and Weaknesses\" section.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors made convincing answers to the reviewers' questions and revised their manuscript accordingly. After the discussion phase, there is a consensus on accepting the paper.
Decision: Accept (poster)