Private GANs, Revisited
Authors: Alex Bie
Gautam Kamath
Guojun Zhang
Venue: Accepted by TMLR ()

Abstract: We show that the canonical approach for training differentially private GANs -- updating the discriminator with differentially private stochastic gradient descent (DPSGD) -- can yield significantly improved results after modifications to training. Specifically, we propose that existing instantiations of this approach neglect to consider how adding noise only to discriminator updates inhibits discriminator training, disrupting the balance between the generator and discriminator necessary for successful GAN training. We show that a simple fix -- taking more discriminator steps between generator steps -- restores parity between the generator and discriminator and improves results. 
Additionally, with the goal of restoring parity, we experiment with other modifications -- namely, large batch sizes and adaptive discriminator update frequency -- to improve discriminator training and see further improvements in generation quality. Our results demonstrate that on standard image synthesis benchmarks, DPSGD outperforms all alternative GAN privatization schemes. Code: https://github.com/alexbie98/dpgan-revisit.

Published in Transactions on Machine Learning Research (10/2023)
Private GANs, Revisited
Alex Biet
yabie
University of Waterloo
Gautam Kamath University of Waterloo
g mit edu
Guojun Zhang
guojuun. Bhwwweei.cccommmmmmmmmmmmmmm com
Huawei Noah's Ark Lab
Reviewed on OpenReview: https: // openreview. net/ forun? id= 9s VCIngrhP
Abstract
We show that the canonical approach for training differentially private GANs updating the discriminator with differentially private stochastic gradient descent (DPSGD) can yield significantly improved results after modifications to training. Specifically, we propose that existing instantiations of this approach neglect to consider how adding noise only to discriminalor updales inhibits discriminator training, disrupting the balance between the generator and discriminator necessary for successful GAN training. We show that simple fix taking more discriminator steps between generator steps restores parity between the generator and discriminator and improves results.
Additionally, with the goal of restoring parity, we experiment with other modifications namely, large batch sizes and adaptive discriminator update frequency to improve dis- criminator training and see further improvements in generation quality. Our results demon- strate that on standard image synthesis benchmarks, DPSGD outperforms all alternative GAN privatization schemes. Code: https: htops////ihhbb com/ hwtpeaeeeexeeeeeeeeeeeeeeee dpgan-revistt
1 Introduction
Differential privacy (DP) (Dwork et al., 2006b) has emerged as compelling approach for training machine learning models sensitive data. However, incorporating DP requires changes to the training process. Notably, it prevents the modeller from working directly with sensitive data, complicating debugging and exploration. Furthermore, upon exhausting their allocated privacy budget, the modeller is restricted from interacting with sensitive data. One approach to alleviate these issues is by producing differentially privale synthetic data, which can be plugged directly into existing machine learning pipelincs, without further concern for privacy.
Towards generating tigh-dimensional, complex data (such as images), a line of work has examined privatizing generative adversarial networks (GANs) (Goodfellow et al., 2014) to produce DP synthetic data. Initial efforts proposed lo use differentially private stochastic gradient descent (DPSGD) (Abadi el. al., 2016) as a drop-in replacement for SGD to update the GAN discriminator an approach referred to as DPGAN (Xie et al., 2018; Beaulieu-Jones et al., 2019; Torkzadehmahani et al., 2019).
However, follow-up work (Jordon et al., 2019; Long el al., 2021; Chen el al., 2020; Wang el al., 2021) departs from this approach: they propose alternative privatization schemes for GANs, and report significant improvements over the DPGAN baseline. Other methods for generating DP syuthetic data diverge from GAN-based architectures, yielding improvements to utility in most cases (Table 2). This raises the question of whether GANs are suitable for DP training, or if bespoke architectures are required for DP data generation.
Authors GK and GZ listed alphabetical order. i Work performed part while interning Huawei.

---

Published in Transactions on Machine Learning Research (10/2023)
250
non-privato (3.4)
nl
200
no m 10
]
no 20
FID score
150
no 10
4
3
X
47
2
4
1 1
2
3
4
7 7
8
?
100
J
3
*
8
9
50
nn = 50
0
1 /
3
4
5
6
7
8
9
0
0
2
3
7
5
6
7
8
9
0
1
3
4
5
6
7
7
9
Privacy budget E
(a) MNIST FID training run
(b) Corresponding images at (10, 10-
Figure 1: DPGAN results on MNIST synthesis at (10, 10 D-DP.. (a) We 3 seeds, plotting mean, min, and FID along the runs. We find that increasing nd, the number discriminator sleps taken between generator steps, significantly improves image synthesis. Increasing no 1 no 50 improves FID from 205.3 + 0.9 + 18.5 0.9. (b) Corresponding synthesized images (each are trained with the same privacy budget). We observe that large ny improves visual quality, and low nyp leads mode collapse.
MNIST
FashionMNIST
CelebA-Gender
Privacy
Method
FID
Acc.(%)
FID
Acc.(%
FID
Acc. (%)
Real Data
1.0
99.2
1.5
92.5
1.1
96.6
GAN
3.4 + 0.1
97.0 + 0.1
16.5 + 1.7
79.5 + 0.8
30.0 + 1.6
92.0 + 0.4
Best Private GAN
61.34
80.92
131.31
70.61
70.72
8 = 10
DPGAN
179.16
80.11
243.80
60.98
54.09
8 == 9.32
Our DPGAN
12.8 0.3 95.1 + 0.1 62.3 + 8.7 74.7 1 0.4
170.8 + 20.3 82.4 d:: 4.4
Table 1: summary of our results compared to results reported in previous work on private GANs. For our results, 3 seeds and report mean + std. Acc. refers to downstream classification accuracy of CNN models trained with generated data. The middle two rows are a composite of the best results reported in the literature for DPGAN and alternative GAN privatization schemes ("Best Private GAN"); see Tables 2 and 3 for correspondences. Here use Gopi et al. (2021) privacy accounting for our results. We find significant improvement over all previous GAN- based methods for DP image syuthesis.
Our contributions. We show that DPGANs give far better utility than previously demonstrated, and compete with or outperform almost all other methods for DP image synthesis."
Hence, we conclude that previously demonstrated deficiencies of DPGANs should not be attributed to inher- ent limitations of the framework, but rather, training issues. Specifically, we propose that the asymmetric noise addition in DPGANs (adding noise to discriminator updates only) inhibits discriminator training while leaving generator training untouched, disrupting the balance necessary for successful GAN training, Indeed, the seminal study of Goodfellow al. (2014) points to the challenge of "synchronizing the discrininator with the generator" in GAN training, suggesting that, "G must not be trained too much without updating D, in order to avoid 'the Helvetica sccnario' [mode collapse]". Prior DPGAN implenentations in the litcrature do not take this into consideration in the process of porting over non-private GAN training recipes.
We propose that taking more discriminator steps between generator updates addresses the imbalance intro- duced by noise. With this change, DPGANs improve significantly (sce Figure and Table 1). Furthermore, we show this peespective on DPGAN training ("restoring parity to discriminator weakened by DP noise") can be applied to improve training. We make other modifications to discriminator training larger batch
A notable exception diffusion models, discussed further Section
2

---

Published in Transactions on Machine Learning Research (10/2023)
sizes and adaptive discriminator update frequency to improve discriminator training and further improve upon the aforementioned results. In summary, we make the following contributions:
We find that taking more discriminator steps between generator steps significantly improves DP- GANs. Contrary to previous results in the literature, DPGANs outperform alternative GAN priva- lization schemes.
We present empirical findings towards understanding why more frequent discriminator steps help. We propose an explanation based on asymmetric noise addition for why vanilla DPGANs do not perform well, and why taking more frequent discriminator steps helps.
We employ our explanation as a principle for designing better private GAN training recipes in- corporating larger batch sizes and adaptive discriminator update frequency and indeed are able improve over the aforementioned results.
2 Related work
The baseline DPGAN that employs a DPSGI-ttrained discriminator was introduced in Xie et al. (2018), and studied follow-up work of Torkzadehmahani al. (2019); Beaulieu-Jones et. al. (2019). Despite significant interest in the approach (s:400 citations at time of writing), we were unable find studies that explore the modifications we perform or uncover similar principles for improving DPGAN training. We note that the number of discriminalor steps taken per generator step, WDD: appears as a hyperparameter in the framework outlined by the seminal study of Goodfellow et al. (2014), and in follow- up work such as WGAN (Arjovsky et al., 2017). Xie et al. (2018) privatizes WGAN, adopting its imbalanced stepping strategy of upp = 5, however makes no mention of the importance of the parameter (along with Torkzadehmahani et al. (2019), which uses np = =). As we show Figure 1a, ensuring that nt lies within a critical range (as determined by DPSGD hyperparameters) is key to adapting a GAN training recipe to DP; selection of nn is the difference between state-of-the-arle Maateo--lheartlcompeliiie performance and something that is entirely not working.?
Private GANs.
As a consequence, subsequent work has departed from DPGANs, examining alternative privatization schemes for GANs (Jordon et al., 2019; Long et al., 2021; Chen et al., 2020; Wang et al., 2021). Broadly speaking, these approaches employ subsample-and-ageen agg-gggeea (Nissim et al., 2007) via the PATE approach (Papernot et al., 2017), dividing the data into 2 1K disjoint partitions and training teacher discriminators separately on each one. Our work shows that these privatization schemes are outperformed by DPSGD.
DP generative models. Other generative modelling frameworks have been applied to generate DP syn- thetic data: VAEs (Chen et al., 2018), maximum mean discrepancy (Harder et al., 2021; Vinaroz et al., 2022; Harder et al., 2022), Sinkhorn divergences (Cao et al., 2021), normalizing flows (Waites & Cummings, 2021), and diffusion models (Dockhorn et al., 2022). In different vein, Chen et al. (2022) avoids learning a generative model, and instead generates a coreset of examples (> 20 per class) for the purpose of training a classifier. These approaches fall into two camps: applications of DPSGD to existing, perforaa generative models; or custom approaches designed specifically for privacy which fall short of GANs when evaluated at their non-private limits (s + o0).
Concurrent work on DP diffusion models. Simultaneous and independent work by Dockhorn et al. (2022) is the first to investigate DP training of diffusion models. They achieve impressive state-of-tho-ee results for DP image synthesis in a variely of settings, in particular, outperforming our results for DPGANs reported in this paper. We consider our results to still be of significant interest to the community, as we challenge the conventional wisdom regarding deficiencies of DPGANs, showing that they give much better utility than previously thought. Indeed, GANs are still one of the most popular and well-studied generative models, and consequently, there are many cases where one would prefer GAN over an alternative approach. By revisiting several of the design choices in DPGANs, we give guidance on how to scamlessly introducc
For further discussion on the role of hyperparameters DP machine learning, see Appendix
3

---

Published in Transactions on Machine Learning Research (10/2023)
differential privacy into such pipelines. Furthermore, both our work and the work of Dockhorn et al. (2022) are aligned in supporting broader message: training conventional machine learning architectures with DPSGD frequently achieves state-of-the-arr results under differential privacy. Indeed, both our results and theirs outperform almost all custom methods designed for DP image synthosis. This reaffirms a similar message recently demonstrated in other private ML settings, including image classification (De al., 2022) and NLP (Li et al., 2022; Yu et al., 2022).
3 Preliminaries
Our goal is to Irain a generative model sensitive data that is safe to release, that is, it does not leak the secrets of individuals in the training dataset. We do this by ensuring the training algorithm A - which takes as input the sensitive dataset D and returns the parameters of a trained (generative) model 0 satisfies differential privacy.
Definition (Differential Privacy, Dwork et al. 2006b). A randomized algorithm A : U O is (e, differentially private if for every pair of neighbouring datasets D, D' E EU, we have
P(A(D) e S} < exp(E) P(A(D') E 5} +
for all (measurable) $ SCO e.
In this work, adopt the add/remove definition of DP, and say two datasets D and D' are neighbouring if they differ in at most one entry, that is, D = D' {x) or D' = [U)r..
One convenient property of DP is closure under post-processing, which says that further outputs computed from the output of a DP algorithm (without accessing private data by any other means) are safe to release, satislying the same DP guarantees as the original outputs. In our case, this means that interacting with a privatized model (e.g., using it to compute gradients on non-sensitive data, generate samples) does not lead to any further privacy violation.
DPSGD. gradient-based learning algorithm can be privatized by employing differentially private stochastic gradient descent (DPSGD) (Song et al., 2013; Bassily et al., 2014; Abadi et al., 2016) as a drop-in replacement for SGD, DPSGD involves clipping per-example gradients and adding Gaussian noise to their sum, which effectively bounds and masks the contribution of any individual point to the final model parame- ters. Privacy analysis of DPSGD follows from several classic lools in the DP toolbox: Gaussian mechanism, privacy amplification by subsampling, and composition (Dwork et al., 2006a; Dwork & Roth, 2014; Abadi et al., 2016; Wang et al., 2019).
In our work, we use two different privacy accounting methods for DPSGD: (a) the classical approach of Mironov al. (2019), implemented in Opacus (Yousefpour al., 2021), and (b) the recent exact privacy accounting of Gopi et al. (2021). By default, we use the former technique for closer direct comparison with note that some prior works use looser accounting techniques). However, the
prior works (though latter technique gives tighter bounds on the true privacy loss, and for all practical purposes, is the preferred method of privacy accounting. We use Gopi et al. (2021) accounting only where indicated in Tables 1, 2, and 3.
DPGANs. Algorithm 1 details the training algorithm for DPGANs, which is effectively an instantiation of DPSGD. Note that only gradients for the discriminator D must be privatized (via clipping and noise), and not those for the generator G. This is a consequence of closure under post-processing the generator only interacts with the sensitive dataset indirectly via discriminator parameters, and therefore does not need further privatization.
4 Frequent discriminator steps improves private GANs
In this section, we discuss our main finding: np, the number of discriminator steps taken between each generator step (see Algorithm 1) plays significant role in the success of DPGAN training.
4

---

Published in Transactions on Machine Learning Research (10/2023)
Algorithm TrainDPGAN(DD Bn. OptD, OptG, B,B,
Input: Labelled dataset D {(z, V=) Discriminator D and generator g initializations do and 8o. Opti- mizers OptD, OptG. Hyperparameters: un (D steps per & step), T' (total number of D steps), B (expected batch size), C' (clipping norm), and a (noise level). Privacy parameter 8.
2: ạ - DJ and i, 4
A Calculate sampling rate q, initialize counters. > Update D with DPSGD. b Sample real batch St by including each (x, v) E D w-p. q. Sample fake batch S..
while t < T' do
4: St ~ PoissonSample(D, (.))
~ ((;0a))
6:
9d. < Lastes,
(=
+ La,nees clip -(
Clip per-example gradients. Add Gaussian noise.
De. 28 (gb, + z1), where ~ N((,C
8:
@c+1 <- -pptD(0r, Io,)
t ++++
10:
if ny divides then
> Perform & update every ny steps.
11:
S ~ G(:;
12:
g0a B (8,8)8
Vo.( (ooioogg(((aaaa
13:
0k+1 (pt
14: k - k+
15: end if
16: end while
17: 8 <- AivoattAcoounaan(((..o (,)
b. Compute privacy budget spent.
18: Output: Final & parameters 0g and (c, 6)DD guarantee.
Fixing a sctting of DPSGD hyperparameters, there is an optimal range of values for ny that maximizes generation quality, in terms of both visual quality and utility for downstream classifier training. This value can be quite large (no 100 in some cases).
4.1 Experimental details
Setup. We focus on labelled generation of MNIST (LeCun et al., 1998) and FashionMNIST (Xiao et al., 2017), both of which are comprised of 60K 28 x 28 grayscale images divided into 10 classes. To build a strong baseline, we begin from an open source PyTorch (Paszke et al., 2019) implementations of DCGAN (Radford et al., 2016) that performs well non-privately, and copy their training recipe. We then adapt their architecture our purposes: removing BatchNorm layers (which are not compatible with DPSGD) and adding label embedding layers to enable labelled generation. Training this configuration non-privately yields labelled generation that achieves FID scores of 3.4 0.1 on MNIST and 16.5 + 1.7 FashionMNIST. D and G have 1.72M and 2.27M trainable parameters respectively. For further details, please see Appendix B.1.
Privacy implementation. To privatize training, we use Opacus (Youscfpour et al., 2021) which imple- ments per-example gradient computation. As discussed before, we use the Rényi differential privacy (RDP) accounting of Mironov et al. (2019) (except in a few noted instances, where we instead use the tighter Gopi et al. (2021) accounting). For our baseline setting, we use the following DPSGD hyperparameters:: we keep the non-private (expected) batch size 128, and use a noise level a and clipping norm C Under these settings, have the budget. for T 450K discriminator steps when targeting (10, 10-5)-D.
Evaluation. We evaluate our generative models by examining the visual quality and utility for downstream lasks of generated images. Following prior work, we measure visual quality by computing the Fréchet Inception Distance (FID) (Heusel et al., 2017) between 60K generated images and entire test set.* To measure downstream task utility, we again follow prior work, and train a CNN classifier on 60K generated image-label pairs and report its accuracy on the real test set.
Courtesy Hyeonwon Kang (httpe://github http://gttuub.cc//mzmlee/ com//nxlum......m.mm....mm...mm. Code available this link. We open source PyTorch implementation to compute FID: https://githas
cem//mmeiitaer/pptorc--ttddd
5

---

Published in Transactions on Machine Learning Research (10/2023)
100
250
90
200
80
Accuracy (%)
Accuratcy (%)
FID score
150
70
60
toleppirate (97.0)
%l
100
(16.5)
60
Ro.
fg =10
Pa 10
40
20
50
=5
50
no
100
200
Jo-s 200
Pp 200
40
10
Privacy budget
Privacy budget
Privacy budget
(a) MNIST accuracy
(b) FashionMNIST FID
(c) FashionMNIST accuracy
Figure 2: DPGAN results over training runs using different discriminator update frequencies np, targeting (10, 10 DP. Each plotted line indicates the mean, min, and max utility of training runs with different seeds, as the privacy budget is expended.
(a) We plot the test set accuracy of CNN trained on generated data only, Accuracy mirrors the FID scores from Figure la. Going from np = 1 to no = 50 improves accuracy from 40.3 + 6.3% + 93.0 + 0.6%. Further up increases hurt accuracy. (b) and (c) We obtain similar results for PashionMNTS, Note that the optimal no is higher (around np z 100). At rp = 100, we obtain an FID 85.9 + 6.4 and accuracy of 71.7 + 1.0%.
Q a
3 4
@ 4
7 7 7 1 6 5
6
0
X
7
4
4
9
8
9
0
2
3
9
3
6
"
2
/
1
5
6 6
7 7
0
J
e
0
3
G
9
9
0
2
2
6
0
5
0 1 v
5 4
0
/
4
5
6
7
3
9
123
G
1
A
4
5
7 7 7 7
0 / 2 4
C
0/27
9
4
7
0
0
2
4
0 Q
9 /
0
1
6
0
Ø
?
0
1
A
5 4
/
6
2
99
0
3
4
4
9
3
9
0
7
6
7
9
0
2
6
t=
50K
t=
100K
t
150K
t=
200K
Figure 3: Evolution of samples drawn during training with no 10, when targeting (10, 90-DDP.. This setting reports its best FID and downstream accuracy at ( = 50K iterations (s R 2.85). As training progresses beyond this point, we observe mode collapse for several classes (e.g., the 6's and 7's, particularly at 150K), co-occuring with the deterioration in evaluation metrics (these samples correspond to the first 4 data points in the nn 10 line in Figures la and 2a).
4.2 Results
More frequent discriminator steps improves generation. We plot in Figures la and 2 the evolution of FID and accuracy during DPGAN training for both MNIST and FashionMNIST, under varying discriminator update frequencios np. The effect of this parameter has outsized impact on the final results. For MNIST, np = 50 yields the best results; on FashionMNIST, np = 100 the best.
We emphasize that increasing the frequency of discriminator steps, relative to generator steps, does not affect the privacy cost of Algorithm 1. For any setting of np, we perform the same number of noisy gradient queries real data- what changes is the total number of generator steps taken over the course of training, which is reduced by factor of npp
a path to mode collapse. For our MNIST results, observe that at low discriminator update frequencies (np 10), the best FID and accuracy scores occur early in training, well before the privacy budget we are targeting is exhausted. Examining Figures la and 2a at 50K discriminator steps (the leftmost points on the charts; = 2.85), the np = 10 runs (in orange) have better FID and accuracy than both: (a) later checkpoints of the np = 10 runs, after training longer and spending more privacy budget; and (b) other settings of np at that stage of training.
Private GANs
8hhis observation has been reported Neunhoeffer et al. (2021), serving motivation for their remody of taking mixture of intermediate models encountered in training. We are aware of any mentions of this aspect of DPGAN training in papers reporting DPGAN baselines for labelled image synthesis.

---

Published in Transactions on Machine Learning Research (10/2023)
1.0
non-privato (no 50
Discriminaton Accuracy
0.9
10
0.8
0.7
0.6
0.5
0.40
2000
4000
6000
8000
10000
12000
14000
Generator step k
Figure 4: Exponential moving average (3 0.95) of GAN discriminator accuracy mini-batches, immediately before each generator step. While non-privately the discriminator maintains a 60% accuracy, the private discriminator with up is elfectively random guess. Increasing the number of discriminator steps recovers the discriminator's advantage early on, leading to generator improvement. As the generator improves, the discriminator's 's task is made more difficult, driving down accuracy.
We attributc generator deterioration with more training to mode collapse: known failure mode of GANs where the generator resorts to producing a small set of examples rather than representing the full variation present in the underlying data distribution. In Figure 3, we plot the evolution of generated images for up = 10 rum over the course of training and observe qualitative evidence of mode collapse: at 50K steps, all generated images are varied, whereas at 150K steps, many of the columns (in particular the 6's and 7's) are slight variations of the same image. In contrast, successfully trained GANs do not. exhibit this behaviour (see the uo = 50 images in Figure 1b). Mode collapse co-occurs with the deterioration FID and accuracy observed the first 4 data points of the np = 10 runs (in orange) in Figures la and 2a.
An optimal discriminator update frequency. These results suggest that faring other DPSGD hyperpa- rameters, there is an optimal setting for the discriminator step frequency no that strikes balance between: (a) being too low, causing the generation quality to peak early in training and then undergo mode collapse; resulting in all subsequent training to consume additional privacy budget without improving the model; and (b) being too high, preventing the generator from taking enough steps to converge before the privacy budget is exhausted (an example of this is the np 200 run in Figure 2a). Striking this balance results in the most effective utilization of privacy budget towards improving the generator.
5 Why does taking more steps help?
In this section, we present empirical findings towards understanding why more frequent discriminator steps improves DPGAN training. We propose an explanation that is conistent with our findings.
How does DP affect GAN training? Figure compares the accuracy of the GAN discriminator on held-out real and fake examples immediately before each generator step, between private and non-private training with different settings of np. We observe that non-privately stabilizes at around 60%. Naively introducing DP (nD 1) leads to qualitative difference: DP causes discriminator accuracy to drop to 50% (i.e., comparable accuracy to randomly guessing) immediately at the start of training, to never recover. 6
ny = 1, discriminator accuracy
For other seltings of no, we make following observations: (1) larger np corresponds to higher discriminator accuracy in carly training; (2) in a training run, discriminator accuracy decrcases throughout as the generator improves; (3) after discriminator accuracy falls below a certain threshold, the generator degrades or sees
6Qur plot only shows the first. 15K generator steps, but we remark that this persists until the end of training (450K steps).
7

---

Published in Transactions on Machine Learning Research (10/2023)
Discriminator Accuracy
0.8
0.6
eriyiaa (no
0.4
50
10
no 30-1
1000
1500
2000
2500
3000
3500
4000
Generator step
(a) Exponential moving average (8 0.95) of discriminator accuracy on mini-batches, after checkpoint restarts
1.0
moroprioll -1)
7p
Rp
10
0.8
150
Accuracy
comprivai (na
50
100
0.2 1000
1000
1500
2000
2500
3000
3500
4000
1500
2000
2500
3000
3500 4000
Generator step
Generator step k
(b) FID after checkpoint restarts
(c) Accuracy after checkpoint restarts
Figure 5: We restart training under various privacy and no settings at 3 checkpoints taken at 1K, 2K, and 3K generator steps into nou-private training. plot the progression of discriminator accuracy, FID, and downstream classification accuracy. The black dots correspond to the initial values of checkpoint. We observe that low no settings not achieve comparable discriminator accuracy to non-private training (a), and results in degradation of utility ((b) and (c)). Discriminator accuracy for up 50 tracks non-private training, and we observe utility improvement throughout training, as in the non-private setting.
limited improvement." Based on these observations, we propose the following explanation for why more frequent discriminator steps help:
Generator improvement occurs when the discriminator is effective at distinguishing between real and fake data.
The asymmetric noise addition introduced by DP to the discriminator makes such task difficult, resulting in limited generator improvement.
Allowing the discriminator train longer on a fixed generator improves its accuracy, recovering the non-private case where the generator and discriminator are balanced.
Checkpoint restarting experiment. We perform checkpoint restarting experiment to examine this explanation in more controlled setting. We train non-private GAN for 3K generator steps, and save checkpoints of 'D and (and their respective optimizers) at 1K, 2K, and 3K generator steps. We restart training from each of these checkpoints for 1K generator steps under diffeerett np and privacy settings. We plot the progression of discriminator accuracy, FID, and downstream classification accuracy. Results are pictured in Figure 5. Broadly, our results corroborate the observations that discriminator accuracy improves with larger ny and decreases with better generators, and that generator improvement occurs when the discriminator has sufficienlly high accuracy.
For up accuracy falls bclow 50% after 5K 9 steps (= 50K D steps), which corresponds the first point the up 10 line in Figures and For np 50, accuracy falls below 50% after @ steps (= 250K steps), which corresponds to the 5th point in the uo line in Figures and
8

---

Published in Transactions on Machine Learning Research (10/2023)
300
0b =1 a 0:45 (127:1)
0g (18.5)
Accuracy (%)
200
50
100
25
(57.5)
(93.0)
0.4
0.6
0.8
1.0
0.4
0.6
0.8
1.0
Noise scale 0
Noise scale a
(a) Varying a only vs. FID at Rp =
(b) Varying only vs. accuracy at Rp =
Figure 6: On MNIST, we fix no = 1 and report results for various settings of the DPSGD noise level Ø, where the number of iterations chosen for each a target (10, --DP. gap between dashed lines represent the advancement of the utility frontier by incorporating the choice of up inlo our design space.
Does reducing noise accomplish the same thing? In light of the above explanation, we ask if reducing the noise level a offer the same improvement taking more steps, as reducing should also improve discriminator accuracy before generator step. To test this: starting from our setting in Section 4, fixing Rpp 1, and targeting MNIST at = 10, we scarch over grid of noise levels (the lowest of which, a = 0.4, admits a budget of only T = 360 discriminator steps). Results are pictured in Figure 6. We obtaín a best FID of 127.1 and best accuracy of 57.5% at noise level o = 0.45, Hence we can conclude that in this experimental sctting, incorporating discriminator update frequency in our design space allows for more effective of privacy budget for improving generation quality.
Does taking more discriminator steps always help? As we discuss in more detail in Section 6.1, when we are able to find other means to improve the discriminator beyond taking more steps, tuning discriminator update frequency may not yicld improvements. To illustrate with an extreme case, consider eliminating the privacy constraint.
non-private GAN training, laking more steps known to be unnecessary. We corroborate this result: we run our non-private baseline from Section with the same number of generator steps, but opt to take 10 discriminator steps between cach generator step instead of 1. FID worsens from 3.4 + 0.1 8.3, and accuracy worsens from 97.0 + 0.1% + 91.3%.
6 Better generators via better discriminators
Our proposed explanation in Section provides a concrete suggestion for improving GAN training: effec- tively use privacy budget to maximize the number of generator steps taken when the discriminator has sufficiently high accuracy. We experiment with modifications to the private GAN training recipe towards these ends, which translate to improved generation.
6.1 Larger batch sizes
Several recent works have demonstrated that for classification tasks, DPSGD achieves higher accuracy with larger batch sizes, after tuning the noise level accordingly (Tramèr & Bonch, 2021; Anil et al., 2022; De et al., 2022). On simpler, less diverse datasets (such as MNIST, CIFAR-10, and FFHQ), GAN training is typically conducted with small batch sizes (for example, DCGAN uses B = 128 (Radford et al., 2016), which we adopt: StyleGAN(2(3)) uses B 32/64 (Karras et al., 2019; 2020; 2021)). Therefore is interesting see large batch sizes help in our setting. We corroborate that on MNIST, larger batch sizes do not significantly improve non-private baseline from Section 4: when we go up to B 2048 from B 128. FID goes from 3.4 + 0.1 + 3.2 and accuracy goes from 97.0 0.1% + 97.5%.
8 However conclusion from BigGAN (Brock al., 2019). Recent work scaling up StyleGAN to diverse datasets StyloGAN-XL (Sauer et al., 2022) and GigaGAN (Kang al., 2023) corroborate this result, seeing improvements from scaling up batch sizes 2048 and 1024 respectively.
complex, diverse datasets (such ImageNet), has been found that larger batch sizes help: this the

---

Published in Transactions on Machine Learning Research (10/2023)
MNIST
Pashion
Privacy 8
Method
Reported in
FID
Acc.(%)
FID
Acc.(%)
Real data
1.0
99.2
1.5
92.5
8 20
GAN
This work
3.4 0.1
97.0 + 0.1
16.5 + 1.7
79.5
DP-MERF
Cao et al. (2021)
116.3
82.1
132.6
75.5
DP-Sinkhorn
Cao et al. (2021)
48.4
83.2
128.3
75.1
PSG
Chen et al. (2022)
95.6
77.7
DPDM
Dockhorn et al. (2022)
5.01
97.3
18.6
84.9
==
DPGAN
Chen et al. (2020)
179.16
63
243.80
50
Long et al. (2021)
304.86
80.11
433.38
60.98
GS-WGAN
Chen et al. (2020)
61.34
80
131.34
65
PATR-GAN
Long et al. (2021)
253.55
66.67
229.25
62.18
G-PATE
Long et (2021)
150.62
80.92
171.90
69.34
DataLens
Wang et al. (2021)
173.50
80.66
167.68
70.61
Our DPGAN
18.5 + 0.9
93.0 + 0.6
85.9 6.4
71.7 1.0
8 = 9.32*
+ large batches
This work
13.2 = 1.1
94.0 = 0.6
70.9 = 6.3
73.0
adaptive up
12.8 0.3
95.1 1 0.1
62.3 1 8.7
74.7 + 0.4
DP-MERF"
Vinaroz al. (2022)
80.7
73.9
DP-HP
Vinaroz et al. (2022)
81.5
72.3
PSG
Chen et al. (2022)
80.9
70.2
DPDM
Dockhorn et al. (2022)
23.4
95.3
37.8
79.4
DPGAN
Long et al. (2021)
470.20
40.36
472.03
10.53
GS-WGAN
Long et (2021)
489.75
14.32
587.31
16.61
PATE-GAN
Long et al. (2021)
231.54
41.68
253.19
42.22
G-PATE
Long et al. (2021)
153.38
58.80
214.78
58.12
DataLens
Wang al. (2021)
186.06
71.23
194.98
64.78
Our DPGAN
111.1 17.9
76.9 + 0.6
155.3 + 7.1
64.9 + 0.8
0.912*
+ large batches
This work
106.2 1 64.0
67.5 1 7.8
158.9 1 6.0
67.2 1 1.0
+ adaptive un
52.6 3.2
81.3
126.4 4.1
69.1
Table 2: We gather previously reported results in the literature the performance of various methods for labelled generation of MNIST and FashionMNIST,, compared with our results. For our results, we run 3 seeds and report mean + std. Note that Reported In refers to the source of the numerical result, the originator of the approach. For downstream accuracy, we report the best accuracy among classifiers they use, and compare against our CNN classifier accuracy. (*) For our results, we larget e 10/e with Opacus accounting and additionally report using the improved privacy accounting of Gopi et al. (2021).
Results. We scale up batch sizes, considering B E {128, 512, 2048), and search for the optimal noise level a and up (details in Appendix B.2). We target both E = and 10. We report the best results from our hyperparameter search in Table 2. We find that larger batch sizes leads to improvements: for & = and 10, the best results are achieved at B 512 and B 2048 respectively. We also note that for large batch sizes, the optimal number of generator steps can be quite small. For B 2048, 4.0, targeting MNIST = 10, up is the optimal discriminator update frequency, and improves our best B 128 setting employing n 50. For full results, see Appendix D.3.
6.2 Adaptive discriminator step frequency
Our observations from Section 4 and 5 motivate to consider adaptive discriminator step frequencies. As pictured in Figures 4 and 5a, discriminator accuracy drops during training the generator improves. In
Since PSG produces coresct of only 200 examples (20 per class), the covariance of its IncepiionNet-xxrracted features is singular, and therefore not possible compute FID scorc.
10 group per-class unconditional GANs together with conditional GANs under the DPGAN umbrella. Results from Vinaroz al. (2022) presented graphically the paper. Exact mumbers can found their code.
10

---

Published in Transactions on Machine Learning Research (10/2023)
Privacy
Method
Reported
FID
Acc.(%)
Real data
1.1
96.6
8 00
GAN
This work
30.0
1.6
92.0 + 0.4
DP-MERF
Cao al. (2021)
274.0
65
DP-Sinkhorn
Cao et al. (2021)
189.5
76.3
DPDM
Dockhorn et al. (2022)
21.1
6 = 10
DPGAN
Long et al. (2021)
54.09
GS GS-WGAN
Long et al. (2021)
63.26
PATE-GAN
Long el al. (2021)
58. 70
G-PATE
Long el al. (2021)
70.72
9.39*
Our DPGAN
This work
170.8 + 20.3
82.4 +: 4.4
DPGAN
Long et (2021)
485.41
52.11
GS- GS-WGAN
Long et al. (2021)
432.58
61.36
8 == 10
PATE-GAN
Long et al. (2021)
424.60
65.35
G-PATE
Long et al. (2021)
305.92
68.97
DataLens
Wang et al. (2021)
320.84
72.87
Table 3: Top section of the table: Comparison to state-of-the-arl results on 32 32 CelebA-Gender, largeting (c, 1.1009jp 10DDP (except for the results reported in Long et al. (2021) which target a weaker (s. 10-D)-P)). We run 3 seeds and report the mean std. (*) For our results, we target = 10 with Opacus accounting and additionally report using the improved privacy accounting of Gopi et al. (2021). DPDM reports much better FID score than our DPGAN (which itself, is an improvement over previous results). Our DPGAN achieves the best reported accuracy score. Bottom section of the table: Results for based approaches reported in Long et al. (2021) and Wang et al. (2021), which are not directly comparable because they target (10, 10 DDDDP and use 64 x 64 CelebA-Gender.
this scenario, we want to take more steps to improve the discriminator, in order to further improve the generator. However, using large discriminator update frequency right from the beginning of training is wasteful evidenced by the fact that low no achieves the best FID and accuracy early in training. Hence propose to start at low discriminator update frequency (np 1), and ramp up when our discriminator is performing poorly. Accuracy on real data must be released with DP. While this is feasible, it introduces the additional problem of having to find the right split of privacy budget for the best performance. We observe that discriminator accuracy is related to discriminator accuracy on fake samples only (which are free evaluate on, by post-processing). Hence we use as a proxy assess discriminator performance.
We propose an adapláve slep frequency, parameterized by 8 and d. 3 is the decay parameter used to compute the exponential moving average (EMA) of discriminator accuracy fake batches before each generator update. d is the accuracy floor that upon reaching, np E 21, 10, 20, 50, 100, 200, 500, 10.0....) Additionally, we promise grace period of 2/ generator steps before moving on to the next update frequency motivated by the fact that, 3-FMA 's value is primarily determined by its last 2/(1- B) observations.
move to the next update frequency
We use 8 0.99 in all settings, and try d 0.6 and 0.7. The additional benefit of the adaptive step frequency is that it means do not have to search for the optimal update frequency. Although the adaptive step frequency introduces the extra hyperparameter of the threshold d, we found that these two setlings (d = 0.6 and d = 0.7) were sufficient lo improve over results of much more extensive perpaarraeeeer search over un (whose optimal value varied significantly based on the noise level and expected batch size B).
6.3
Comparison with previous results in the literature
6.3.1 MNIST and FashionMNIST
Table summarizes our best experimental settings for MNIST and FashionMNIST, and situates them the context of previously reported results for the task. We also present a visual comparison in Figure 7. We provide some examples of generated images in Figures and 10 for 10, and Figures 11 and 12 for 1.
11

---

Published in Transactions on Machine Learning Research (10/2023)
0
3
3
9
5
6
7
3
9
DP-Sinkhorn
0
2
3
4
5
6
7
8
9 9 9 R
0
2
3
4
5
6
7
8 8
DPDM
0
2
3
4
6
6
7 7 7 7
( f
Q
3
7
6
1 f 8 8 8 9 4 9
DP-CGAN
4/ 1
4
3
4
1
4
0
1
2
3
4
5 5
6
9 9
GS-N
0
/
2
3
4
6
0
1
3
4
5
6
7
0
5
2
4
7 8 8
Our DPGAN
0
012345
6
0 2
4 6
8
9
Figure 7: MNIST and FashionMNIST results (10, 10 DJ-DP for different methods. Images of other methods are
from Cao et al. (2021) and Dockhorn et al. (2022).
Figure 8: 32 x 32 CelebA-Gender at (10, 10 G-DP. From top to bottom: DPDM (unconditional generation).
DP-Sinkhorn, and our DPGAN. Images of other methods are from Cao et al. (2021) and Dockhorn et al. (2022).
Plain DPSGD beats all alternative GAN privatization schemes. Our baseline DPGAN from Sec- tion 4, with the appropriate choice of up (and without the modifications described in this section yet), outperforms all other GAN-based approaches proposed in the literature (GS-WGAN, PATE-GAN, G-PATE, and DataLens) uniformly across both metries, both datascts, and both privacy levels.
Large batch sizes and adaptive discriminator step frequency improve GAN training. Broadly speaking, across both privacy levels and both datasets, we see an improvement from taking larger batch sizes, and then another with the adaptive step frequency.
Comparison with state-of-the-art. With the exception of DPDM, our best DPGANs are competitive with state-of-the-e approaches for DP syuthetic data, especially in terms of FID scores.
6.3.2 CelebA-Gender
We also report results on generating 32 32 CelebA, conditioned on gender at (10, 10 DD-D.. For these experiments, we employed large batches (B 2048) and adaptive discriminator step frequency with threshold d 0.6. Full implementation details can be found Appendix C. Results are summarized in Table 3 and visualized in Figure 8. For more example generations, Figure 13.
12

---

Published in Transactions on Machine Learning Research (10/2023)
7 Conclusion
We revisit differentially private GANs and show that, with appropriate tuning of the training procedure, they can perform dramatically better than previously thought. Some crucial modifications include increasing discriminator step frequency, increasing the batch size, and introducing adaptíve discriminator step frequency. We explore the hypothesis that the previous deficiencies of DPGANs were due to poor classification accuracy of the discriminator. More broadly, our work supports the recurring finding that carefully-tune DPSGD on conventional architectures can yield strong results for differentially private machine learning-
Acknowledgements
AB supported by an NSERC Discovery Grant, David R. Cheriton Graduate Scholarship, and an Ontario Graduate Scholarship. GK is supported by an NSERC Discovery Grant, unrostricted gift from Google, and a University of Waterloo startup grant. We would like to thank the TMLR anonymous reviewers and action editor for providing constructive feedback.
13

---

Published in Transactions on Machine Learning Research (10/2023)
References
Martin Abadi, Andy Chu, lan Goodfellow, H. Brendan McMahan, 1lya Mironov, Kunal Talwar, and Li Zhang, Deep learning with differential privacy. In CGS'16: 2016 ACM SIGSAC Conference on Compuler and Communications Security, 2016.
Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differentially private BERT. In Findings of the Association for Computational Linguisties: FMNLP'22, 2022.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In Proceedings of the 34th International Conference Machine Learning (ICML'17)) 2017.
Racf Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algo- rithms and tight error bounds. 55th Annual IEEE Symposium on Foundations of Computer Science (40CS'14), 2014.
Brett K. Beaulieu-Jones, Zhiwei Steven Wu, Chris Williams, Ran Lee, Sanjeev P. Bhavmani, James Brian Byrd, and Casey S. Greene. Privacy-preserving generative deep neural networks support clinical data sharing. Circulation: Cardiovascular Quality and Outcomes, 12(7), 2019.
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In 7th International Conference on Learning Representations (ICLR'19) 2019.
Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don't generate me: Training differentially private generative models with Sinkhorn divergence. In Advances in Neural Information Processing Systems 34 (NewrIPS211), 2021.
Tatjana Chavdarova, Matteo Pagliardini, Sebastian U. Stich, François Fleuret, and Martin Jaggi. Taming GANs with lookahead-minman In 9th International Conference on Learning Representations (ICLR 21), 2021.
Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. GS-WGAN: A gradient-sanitized approach for learning differentially private generators. In Advances in Neural Information Processing Systems 33 (NeurIPS'20) 20), 2020.
Dingfan Chen, Raouf Kerkouche, and Mario Fritz. Private set generation with discriminative information. In Advances in Neural Information Processing Systems 35 (NeurIPS 2022.
Qingrong Chen, Chong Xiang, Minhui Xue, Bo Li, Nikita Borisov, Dali Kaafar, and Haojin Zhu. Differentially private data generative models. CoRR, abs/ abs/1812.080 1812.02274, 2018.
Soumith Chintala, Emily Denton, Martin Arjovsky, and Michael Mathien. How to train a GAN? Tips and tricks to make GANs work. https://github. cwt../ccoooooooooooooeooeeoeoooe hotom//smmttthaaiiiina ganhacks, 2016.
Soham De, Leonard Berrada, Jamie Hayes, Samuel T. Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale. CoRR, abs/2204.13650, 2022.
Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. CoRR, abs/2210.00992) 2022.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Compututer Science, 9(3-4):211444) 10777, 2014.
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Tlya Mironov, and Moni Naor. Our data, our- selves: Privacy via distributed noise generation. In 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPTO6)) 2006a.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Proceedings of the 3rd Conference Theory of Cryptography (TCC'06), 2006b.
14

---

Published in Transactions on Machine Learning Research (10/2023)
Tanner Fiez and Lillian J. Ratliff. Local convergence analysis of gradient descent ascent with finite timescale separation. In 9th International Conference on Learning Representations (TCLR 21), 2021.
lan Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua. Bengio. Generative adversarial nets. In Advances in Neural Information Processing Systems 27 (NIPS'14, 2014.
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. In Advances in Neural Information Processing Systems 34 (NearIPS'21), 2021.
Frederik Harder, Kamil Adamczewski, and Mijung Park. DP-MERF: Differentially private mean embeddings with random features for practical privacy-preservve data generation. In 24th International Conference on Artificial Intelligence and Statistics (AISTATS'21), 2021.
Frederik Harder, Milad Jalali Asadabadi, Danica J. Sutherland, and Mijung Park. Differentially private data generation needs better features. CoRR, (tss/2205.12900 2022.
Moritz Hardt, Katrina Ligett, and Frank Mesherry. A simple and practical algorithm for differentially private data release. In Aduances in Neural Information Processing Systems 25 (NTPS'12) 12), 2012.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by a two time-scale update rule converge to a local nash equilibrium. In Advances in Neural Information Processing Systems 30 (NIPS'17), 2017.
James Jordon, Jinsung Yoon, and Mihaela van der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In 7th International Conference on Learning Representations (ICLR'19) 2019.
Minguk Kang, Jun- Yan Zhu, Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park. Scaling up GANs for text-to-image synthesis. In Proccedings of the 2023 IEEE/CVF Conference Computer Vision and Pallern Recognition (CVPR'23) 2023.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Poltern Recognation (CVPR'19)) 19), 2019.
Tero Karras, Samuli Laine, Milk Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of StyleGAN. In Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 20), 2020.
Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Alias-free generative adversarial networks. In Advances in Neural Information Processing Systems 34 (NewrIPS'21) 2021.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference on Leurning Representations (ICLR'15), 2015.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to docu- ment recognition. Proc. IEEF, 96(11):2278-2333 1998.
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In 10th International Conference on Learning Representations (ICLR'22) '22), 2022.
Jingeheng Liu and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Compuling (STOC'19), 2019.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the 2015 IEFE International Conference on Computer Vision (ICCV'15), 2015.
15

---

Published in Transactions on Machine Learning Research (10/2023)
Yunhui Long, Boxin Wang, Zhuolin Yang, Bhavya Kailkhura, Aston Zhang, Carl Gunter, and Bo Li. G- PATE: Scalable differentially private data generator via private ingregation of teacher discriminators. Tn Advances in Newral Information Processing Systems 34 (NeurlPS'21), 2021.
Ryan McKenna, Daniel Sheldon, and Gerome Miklau. Graphical-model based estimation and inference for differential privacy. In Proceedings of the 36th International Conference on Machine Learning (ICML 119) 2019.
llya Mironov, Kunal Talwar, and Li Zhang, Rényi differential privacy of the sampled Gaussian mechanism. CoRR, abs/1908. 10530, 2019.
Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for gen- erative adversarial networks. In 6th International Conference on Learning Representations (ICLR (18), 2018.
Shubhankar Mohapatra, Sajin Sasy, Xi He, Gautam Kamath, and Om Thakkar. The role of adaptive opti- mizers for honest private hyperparameter selection. In Proceedings of the Thirty- Sirth AAAI Conference on Artificial Intelligence (AAAI-22), 2022.
Marcel Neunhoeffer, Steven Wu, and Cynthia Dwork. Private post-GAN boosting. In 9th International Conference Learning Representations ([CLR'19), 2021.
Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. Smooth sensitivity and sampling in private data analysis. In Proceedings of the 39th Annual ACM Symposium on the Theory of Compuling (STOC'07). 2007.
Nicolas Papernot, Martin Abadi, Ülfar Erlingsson, Ian J. Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In 5th International Conference on Learning Representations (ICLR17), 2017.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Z. Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: An imperative style, high-performance deep learning library. In Advances in Newral Information Processing Systems 32 (NeurIPS119), 2019.
Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H. Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradcep Guha Thakurta. How to dp-fy ML: A practical guide to machine learning with differential privacy. J. Artif. Intell. Res., 77:1113 1201, 2023.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convo- lutional generative adversarial networks. In 4th International Conference on Learning Representations (ICLR' 16), 2016.
Axel Sauer, Katja Schwarz, and Andreas Geiger. StyleGAN-XL: Scaling StyleGAN to large diverse datasets. In Special Interest Group on Computer Graphics and Interactive Techniques Conference (SIGGRAPH 2022.
Shuang Song, Kamalika Chaudhuri, and Anand D. Sarwate. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing, 2013.
Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavaijhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. CoRR, abs/2112.099238, 2021.
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. DP-CGAN: Differentially private synthetic data and label generation. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Paltern Recognition Workshops, (CVPR Workshops's 19), 2019.
Florian Tramèr and Dan Bonch. Differentially private learning needs better features (or much more data). Tn 9th International Conference on Learning Representations (ICT.R 21), 2021.
16

---

Published in Transactions on Machine Learning Research (10/2023)
Margarita Vinaroz, Mohammad-Amin Charusaie, Frederik Harder, Kamil Adamczewski, and Mi Jung Park. Hermite polynomial features for private data generation. In Proceedings of the 39th International Confer- ence on Machine Learning (ICML 22), 2022.
Chris Waites and Rachel Cummings. Differentiall private normalizing flows for privacy-preserving density ostimation. CoRR, abs/2108.14068, 2021.
Boxin Wang, Fan Wu, Yunhui Long, Luka Rimanic, Ce Zhang, and Bo Li. DataLens: Scalable privacy preserving training via gradient compression and aggregation. In CCS'21: 2021 ACM SIGSAC Conference on Compuler and Communicalions Securily, 2021.
Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanathan. Subsampled Rényi different privacy and analytical moments accountant. 22nd International Conference on Artificial Intelligence and Statistics (AISTATS'19) 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms. Colli, abs/1708.07747, 2017.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Diffcrentially private generative adversarial 2018.
network. CoRR,
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Gosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in PyTorch. CoRR, abs/2109.122 2021.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang, Differen- tially private fine-tur fne-tuning of language models. In 10th International Conference on Learning Representations (ICLR 22), 2022.
Jun Zhang, Graham Cormode, Cecilia M. Procopiuc, Divesh Srivastava, and Xiaokui Xiao. PrivBayes: Private data release via bayesian networks. ACM Trans. Database Syst., 42(4), 2017.
17

---

Published in Transactions on Machine Learning Research (10/2023)
A
Generated samples
We provide few non-cherrypcked samples for MNIST and FashionMNIST at 10 and & 1, as well as
32 x 32 CelebA-Gender at 10.
7
7
4
&
à?
6
9
4
S
(
2
2
g
9
7
9
4
94
9
9
4
9
5
5
7
9
9
5
6
9
7
8
3
2
/
Figure Some non-cherrypicked MNIST samples from our method, 6 10.
3
5
Figure 10: Some non-cherrypicked FashionMNIST samples from our method, E = 10.
18

---

Published in Transactions on Machine Learning Research (10/2023)
6
5
4
S
2
7
9
Aan
O
1
S
T
7
3
7/4
4
8
}
2
1
7
R
5
7
3
5
7 4
3
3
4
7
5
Figure
Some non-cherrypicked MNIST samples from our method,
Figure 12:
Some non non-cherrypiced FashionMNIST samples from our method, = 1.
19

---

Published in Transactions on Machine Learning Research (10/2023)
M
M
M
M
M
M
M
M
M
M
Figure 13: Some non-cherrypicked CelebA samples from our method, 10.
B MNIST and FashionMNIST implementation details
B.1 Training recipe
begin from open source Py'Torc implementation of DCGAN (Radford et al., 2016) (available at this link) that performs well non-privately, and copy their training recipe. This includes: batch size B = 128, the Adam optimizer (Kingma & Ba, 2015) with parameters (a = 0.0002, 81 = 0.5, B2 = 0.999) for both G and D, the non-saturating GAN loss (Goodfellow et al., 2014), and a 5-layer fully convolutional architecture with width parameter d = 128.
For MNIST and FNSH,
To adapt it to our purposes, we make three architectural modifications: in both G and D we (1) remove all BatchNorm layers (which not compatible with DPSGD); (2) add label embedding layers to enable labelled generation; and (3) adjust
petplutiiinn//taaasppoooo convolutional stride lengths and kernel sizes well as remove the last layer, in order to process 1 x 28 x 28 images without having to resize. Finally, we remove their custom weight initialization, opting for Py defaults.
Our baseline non-private GANs are trained for 45K steps. We train our non-private GANs with poisson sampling as well: for each step of discriminator training, we sample real examples by including each element of our dataset independently with probability B/n, where is the size of our dataset. We then add B fake examples sampled from G to form our fake/real combined batch.
Clipping fake sample gradients. When training the discriminator privately with DPSGD, draw B fake examples and compute clipped per-example gradients the entire combined batch of real and fake examples (sce Algorithm 1). This is the approach taken in the prior work of Torkzadchmahani et al. (2019). We remark that this is purely design choice it is not necessary to clip the gradients of the fake samples, nor to process them together the same batch. So long as we preserve the sensitivity of gradient queries with respect to the real data, the same amount of noise will suffice for privacy.
B.2 Large batch size hyperparameter search
We scale up batch sizes, considering B E {64, 128, 512, 2048), and search for the optimal noise level and ni. For B 128 targeting 10, we search three noise levels Σ {0.6, 1.0, 1.4). We choose candidate noise levels for other batch sizes as follows: when considering a batch size B 128n, search
over
10 1128n
--in-ooia 0 E 2128
10
20

---

Published in Transactions on Machine Learning Research (10/2023)
We also target the high privacy (E regime. For 1, we multiply all noise levels by
Σ = (50 E ).
For each setting of (B,o), o), we search over a grid of up E {1, 5, 10, 20, 50, 100, 200, 5003. Due to compute limitations, we omit some values that we are confident will fail (e.g., trying np = when mode collapse occurs for up = 5).
C CelebA implementation details
The CelebA dataset (Liu et al., 2015) consists of 202,599 178x218 RGB images of celebrity faces, each labelled with 40 binary attributes. The version the dataset we work with, 32x32 CelebA-Gender (a benchmark reported in Cao et al. (2021)), is obtained by resizing to 32x32 and labelling with the gender attribute. The 202,599 images are partitioned into a training set of size 182,637 and a test set of size 19,962.
We use essentially the same model architectures we used for MNIST and MNIST for CelebA: 4- layer fully convolutional networks with label embedding layers for both D and G. We adjust convolu- tional/trane /tranpooee convolutional stride lengths and kernels sizes to process 3 x 32 x 32 images without having to resize. D and G for CelebA are slightly larger, having 2.64M and 3. 1.66 trainable parameters respectively.
Drawing from the results of our MNIST and FashionMNIST experiments, we used a large batch size (B = 2048) and adaptive discriminator updates, with threshold d 0.6. We experimented with few settings for noise level E {2, 3, 3) Our best results were with the largest noise o which gave us 385K discriminator steps when targeting 10.
D Ablations
D.1 Varying discriminator size
We train DPGANs on MNIST under the setting of Section 4: using noise level a = 1, batch size B = 128, and targeting = 10 which yields 450K discriminator steps. By adjusting dp (the # filter banks in the first convolutional layer of the discriminator, which controls width throughout), we can obtain discriminators with roughly 0.25x, 0.5x, and 2x the parameter count (Table 4). For these experiments, we vary discriminator size while keeping the generator size (2.27M parameters) fixed.
dp
parameter count
Ratio
0.44M
0.26x
96
0.97M
0.57x
1.72M
1x
196
3.86M
2.24x
Table 4: Number of trainable parameters in discriminator size variants.
Results. In Figure we plot the progression of FID and downstream classifier accuracy of generated MNIST samples during non-private training with discriminators of varying size. We observe that, non- privately, larger discriminators do better in terms of FID early on, and converge to slightly worse accuracies.
In Figures 15 and 16, we plot the progression of FID and accuracy (respectively) for DPGANs trained on MNIST (largeling = 10) al different discriminalor update frequencies rip. In each plot, we compare the dp = 128 runs (in green), which correspond to results from Figures 1a and 2a, to the results of training with discriminators with 0.26-2.24x as many trainable parameters. These additional scttings mostly track the dp 128 runs. Larger discriminators appear perform slightly better, especially in terms of accuracy early in training. Larger discriminators also use significantly more compute.
21

---

Published in Transactions on Machine Learning Research (10/2023)
15.0
100
dg 64
dg
64
12.5
d6
m18
10.0
192
Accuracy (%)
score
7.5
5.0
2.5
10000
20000
30000
40000
10000
20000
30000
40000
Steps
Steps
(a) Nou-private FID
(b) Non- Non-private accuracy
Figure 14: MNIST FID and downstream classifier accuracy for non-private GAN training with various discriminator sizes. The green (dp 128) line corresponds to the 1.72M parameter discriminator used in previous experiments.
250
250
da
200
200
dg 128
dg 192
FID score
150
FID score
150
100
100
da 61
do 96
50
dg
du
8
10
6
10
Privacy budget E
Privacy budget
(a) FID at np = 1
(b) FID at ap = 10
125
125
do 64
dg 64
do 96
do 96
100
de
FID score
75
FID score
75
50
50
25
25
0
10
Privacy budget
Privacy budget
(c) FID at 50
(d) FID at 100
Figure 15: MNIST FID for DPGAN training (targeting = 10) at various discriminator update frequencies In
each plot, we present results from training with various discriminator sizes. The green (dp = 128) lines correspond to the results pictured in Figure la. Discriminators with 0.26 2.24x many trainable parameters track the results of the original dp = 128 setting.
D.2 Varying learning rate
We train DPGANs on MNIST under the setting of Section 4: using noise level o = 1, batch size = 128, and targeting ε 10 which yields 450K discriminator steps. Here, we keep discriminator size dp 128 fixed, and vary the learning rates of G and D, while keeping the other Adam parameters 3n and Bg for both G and D fixed. Table lists the learning rate settings consider.
22

---

Published in Transactions on Machine Learning Research (10/2023)
90
do = 64
do 64
80
do 96
do 96
de
Accuracy (%)
70
Accuracy (%)
70
60
60
50
50
40
40
30
30
20
20
8
10
Privacy budget
Privacy budget
Accuracy
=1
(b) Accuracy at
10
100
100
90
90
do 96
do - 128
80
Accuracy (%)
do 192
Accuracy
70
70
60
do = 64
60
dg 96
do 128
50
40
40
4
8
10
6 Privacy budget
10
Privacy budget E
(c) Accuracy np 50
(d) Accuracy ny 100
Figure 16: MNIST downstream classifier accuracy for DPGAN training (targeting & 10) at various discriminator update frequencies In each plot, present results from training with various discriminator sizes. The green (dp = 128) lines correspond the results pictured Figure 2a. Discriminators with 0.26 2.24x as many trainable parameters track the results of the original dp 128 setting.
Setting
G LR
2 LR
Base
0.0002
0.0002
5x LR
0.001
0.001
0.2x LR
0.00004
0. 0.00004
5x LR
0.0002
0.001
0.2x D LR
0.0002
0.00004
Table 5: Learning rate settings.
Results. In Figure 17 we plot the progression of FID and downstream classifer accuracy of generated MNIST samples during non-private training under various learning rate settings. We observe FID and accuracy degradation near the end of training for the (D) LR settings. The 0.2x LRR setting converges much slower. This is remodied when we adjust only the D LR by 0.2x and leave G LR unchanged (comparing the green line the purple line in Figure 17).
Figures 18 and 19 examine the where adjust both G and D learning rates by 5x and 0.2x respectively, Broadly, we see the same behaviour in Section 4: FID and downstream classification accuracy improve significantly as we lake rp >> 1, up until the point where RDp is too high, limiting the generalor from laking enough steps to converge. However, we note some differences: (1) the performance of the best settings for up are reduced across the board (most prominently in the case of accuracy
the 0.2x LR setting; see
Figure 19b); and (2) the np which results in the best performance is different while ap 50 leads to the best. results for MNIST at 10 in Section 4, up 200 performs the best for 5x LR and ne 100 is
23

---

Published in Transactions on Machine Learning Research (10/2023)
the best for 0.2x LR. Note that these two differences are not observed in the experiments where vary discriminator size dp in Appendix D.1: all runs with different dp track the dp = 128 run closely.
In Figures 20 and 21, we examine the case where we only adjust D LR, by 5x and 0.2x respectively, and keep 9 LR fixed at 0.0002. Again, we observe large improvements utility as we take up >> 1, up to the point where Wp too high. We note that when keeping LR fixed, the 0.2x setting gets much closer the level of improvement from varying up observed the base LR setting.
In summary: changing learning rates while keeping other hyperparameters fixed still exhibits the benefit of increasing RD, but compared to the base setting, does not recover: (1) the scale of the improvement, and (2) the precise behaviour of the phenomenon; i.e. the same optimal Rtp. We leave open the question of understanding more precisely how the phenomenon changes under different learning rates: it may be fruitful to investigate how Adam's momentum parameters (31, 52) and DPSGD noise level a impact the results, and also perhaps the degradation of the non-private GAN results for large D L.R
40
100
Base
30
0.2x LR
95
5x LR
Accuracy (%)
FID soore
20
90
Base
5x LR
10
85
5K D D
0,2X D LR
10000
20000
30000
40000
10000
20000
30000
40000
Steps
Steps
(a) Non-private FID
(b) Non-private accuracy
Figure 17: MNIST FID and rewmstream classifier accuracy non-private GAN training with various learning rate settings. The blue (do 128) line corresponds to the base learning rate setting used in previous experiments.
300
100
non non-privato (8.3)
250
46-
80
FID spore
200
no 50
Acouracy (%)
60
200
150
non-private (94
40
100
10
50
20
fg =50
100
=00
0
10
6
10
Privacy budget
Privacy budget
(a) FID at LR
(b) Accuracy at LR
Figure 18: MNIST FID and downstream classifier accuracy for DPGAN training runs targeting ε 10 and using 5x the base learning rate for both & and D, under various settings of np-
24

---

Published in Transactions on Machine Learning Research (10/2023)
100
non-private (5.9)
non-private (97.2)
no
400
=10
80
10
no =50
Accuracy (%)
no 50
FID soore
300
60
-10
200
200
200
40
100
20
0
6
10
Privacy budget
Privacy budget
(a) FID at 0.2x
(b) Accuracy at 0.2x
Figure 19: MNIST FID and downstream classifier accuracy for DPGAN training runs targeting e and using 0.2x the base learning rate for both G and D, under various settings of npp
100
non-private (6.5)
250
no
10
80
200
ng 30
Acouracy (%)
FID score
Go
60
150
200
non-pmytte (93.
100
40
0g_74
10
20
0g -050
200
0
8
10
6 Privacy budget
10
Privacy budget
(a) FID LR
(b) Accuracy D LR
Figure 20: MNIST FID and downstream classifier accuracy for DPGAN training runs targeting e and using 5x the base learning rate for D only (G LR unchanged), under various settings of np.
100
non-private (98.1)
nl
150
80
=0
non-phkate (4.5)
Acouracy (%)
no
FID score
no
60
100
=10
200
100
no =50
40
200
50
20
0
8
10
6 Privacy budget
10
Privacy budget
(a) FID 0.2x D LR
(b) Accuracy 0.2x D LR
Figure 21: MNIST FID and downstream classifier accuracy for DPGAN training runs targeting ε 10 and using 0.2x the base learning rate for D ouly (G LR unchanged), under various settings of npp
D.3 Varying batch size and noise level
Fixing batch size B and a noise level yields a total discriminator step budget T allowed under our privacy budget E. For example, the results from Section 4 and Appendices D.1 and D.2 use B 128 and 1, which allows for T 450K when targeting 10 MNTST. Again targeting MNIST at 10, take
25

---

Published in Transactions on Machine Learning Research (10/2023)
various combinations of (B,o), and plot the final FID and accuracy of DPGANs trained at such setting, over spectrum of upp Results are pictured in Figures 22, 23, and 24.
100
o= 0.6
a=0 0.6
200
1.4
d=1.4
Accuracy (%)
80
150
100
60
50
40
0
64
256
16 64
256
Discriminator step frequency
Discriminator step frequency no
(a) FID B 128
(b) Accuracy B 128
Figure 22:
MNIST FTD and downstream classifier accuracy for B 128 runs targeting E 10, with {0.6, 1,144. We report final utility over range of un for the 3 noise levels. The x-axis is log-scaled.
200
100
0=
d=2
2.8
d-2.8
Accuracy (%)
80
100
50
0
1
4
16
64
16 Discriminator step frequency Ap
64
Discriminator step frequency np
(a) FID at B = 512
(b) Accuracy at B = 512
Figure 23: MNIST FID and downstream classifier accuracy for B = 512 runs targeting 10, with E (1.2,2,288) We report final utility over range no the 3 noise levels. The x-axis is log-scaled.
100
100
o= 2.4
2.4
5.6
5:5
Accuracy (%)
40
70
20
60
0
50
8
16
32
Discriminator step frequency Rl
Discriminator step frequency no
(a) FID at = 2048
(b) Accuracy at B = 2048
Figure 24: MNIST FID and downstream classifier accuracy for B = 2048 runs targeting s = 10, with a E (2.4,4,5.6). We report final utility
range of for the 3 noise levels. The x-axis is log-scaled.
Results. At all batch sizes and noise levels, we observe the same U-shaped utility curve described in Section 4, which predicts the existence of an optimal no for any fixed setting of (a, B). For fixed B, the
26

---

Published in Transactions on Machine Learning Research (10/2023)
optimal Top is lower for smaller ø. We also see that for settings with low and large B, optimal np
be quite low. For all batch sizes, choosing noise levels that achieve their optimal wp at fairly large values (>>
1) tends to outperform smaller noise levels which achieve their optimal up early.
E
Additional results
E.1 Wall clock times
We report wall clock times for training runs under various hyperparameter settings, which are executed on 1x NVIDIA A40 card setups rumning PyTorch 1.11.0+CUDA 11.3.1 and Opacus 1.1.3. Table 6 presents results MNIST, in particular comparing the effect of training time. The total number of discriminator steps, T, is determined by the privacy budget and DPSGD hyperparamcters. Hence, increasing results in fewer total G steps and faster training time. Table 7 presents training times under adaptive discriminator step frequency for various datasets.
All private scttings are much slower than non-private training. Indeed, the best DP results tend to come from training long with large noise levels, trading off computation for utility (De et al., 2022). For example, the best DP diffusion models (Dockhorn et al., 2022) use 8 V100's for 1 day to train their best MNIST models. Although not directly comparable, we note that our best & = 10 results train in 7.5 hours on A40.
Privacy
T
FID
Wall clock time
0C
128
45K
1
3.4 0.1
44m
1
205.3 + 0.9
11h 03m
103.4 108.455.5 5.8
33m
128
1
450K
50
18.5 + 0.9
5h 56m
8 =
10
21.0 1.6
57m
200
26.6 2.2
5h 54m
2048
5.6
98K
20
13.2 1.0
16h 54m
128
325K
200
111.1 + 17.9
4h 40m
6=1
512
14
165K
50
106.2
64.0
31m
Table 6: Wall clock times MNIST for various settings. determines the total number D steps taken during training, T. Given T, the discriminator update frequency nyp determines the number of & steps taken during training.
The privacy level E, batch size B, and noise level
Privacy
Dataset
T
FID
Wall clock time
MNIST
3.4 + 0.1
44m
00
PaShionMNIST
45K
16.5 + 1.7
42m
CelebA
30.0 + 1.6
47m
MNIST
12.8 1 0.3
7h 35m
512
2
174K
8 10
MNSST
62.3 + 8.7
7h 35m
CelebA
2048
4
385K
170.8
20.3
3d 17h 49m
MNIST
52.6 + 3.2
7h 43m
8
MNSSI
512
14
165K
126.4 + 4.1
7h 26m
Table 7: Wall clock times MNIST, FashionMNIST and 32x32 CelebA for runs using adaptive discriminator step frequency (with the exception of the è oo results, which use wy = 1).
E.2 Increasing discriminator learning rate instead of step frequency
From the experimental setting in Section 4 targeting MNIST 10, we consider the no setting, and increase the discriminator learning rate instead of WD. G LR is kept fixed at 0.0002. Results are in Table
27

---

Published in Transactions on Machine Learning Research (10/2023)
8. We do not observe the same level of improvement obtained by increasing no and keeping D LR/g LR
x.
LR/g LR
FID
Acc. (%)
1x
205.9
33.7
5x
251.8
45.0
10x
228.1
37.5
50x
237.2
54.5
Table 8: Results on MNIST at -10 for increasing D LR while keeping = 1. For reference, using 50 while
keeping LR// at 1x yields an FID score 18.5 0.9 and accuracy of 93.0 = 0.6%.
F Additional discussion
DP tabular data synthesis. Our investigation focuses on image datasets, while many important appli- cations of private data generation involve tabular data. these scttings, marginal- basod approaches (Hardt et al., 2012; Zhang et al., 2017; McKenna et al., 2019) perform the best. While Tao et al. (2021) find that private GAN-based approaches fail to preserve even basic statistics in these settings, speculate that techniques may yield improvements.
Taking multiple discriminator steps. The original GAN formulation of Goodfellow et al. (2014) has nD, the number of discriminator steps taken between generator steps, as a tunable hyperparameter. In the WGAN framework (Arjovsky et al., 2017), it suggested to train discriminators as much as possible between gemerator steps, i.e. to optimality, for best performance. In practice, WGAN implementations use WD = 5 to save computation. Several studies empirically explore the effect of taking multiple discriminator steps (Miyato et al., 2018; Brock et al., 2019), finding that searching for optimal nD improve results. Similar imbalanced setups, such as lookahead and imbalanced learning rates, have been analyzed theoretically (Chavdarova et al., 2021; Fiez & Ratliff, 2021).
In the private setting, applying such strategies to improve DPGAN training has been relatively unexplored. DPGAN training recipes are largely ports of non-private approaches inheriting many parameter choices designed for performant non-private training which are sub-optimal under DP.
Guidance in the non-private setting (tip 14 of Chintala et al. (2016)) prescribes to train the discriminator for more steps in the presence of noise (a regularization approach used in non-private GANs). This is the case for DP, and is our core strategy that yields the most significant gains in utility. We were not aware of this tip when we discovered this phenomenon, but serves as validation of our finding. While Chintala et al. (2016) provides little elaboration, looking al further explorations of this principle (and other strategies) the non-private setting may offer guidance for improving DPGANs. For instance, Chavdarova et al. (2021) propose lookahead update rule that enables fast convergence in the presence of noise, without using large batches such techniques may help in the private setting as well.
Hyperparameter tuning in DP machine learning. Hyperparameter tuning is crucial to getting deep learning to work. The same is true under privacy, with two additional concerns: (1) tuning is not free - naive composition says privacy loss scales with the number of runs; and (2) DPSGD alters the hyperparameter landscape- - introducing extra ones, and also changing the relative importance of eristing hyperporameters. (1) is addressed by Liu & Talwar (2019) (although composition competitive in settings where adaptive selection is important (Mohapatra et al., 2022)). On (2), Ponomareva et al. (2023) offers comprehensive guide on DP hyperparameter tuning: for GAN training, our work identifies an important parameter with outsized impact in the DP setting.
To compare with prior work, we report our best hyperparameter settings. Indeed, introducing a highly dataset-dependent parameter can result in worse performance overall when accounting for the cost of scarch in a real deployment setting. Our adaptive discriminator update frequency motivated by this concern, and use of MNIST hyperparameters directly for MNSSI is brittleness sanity-check.
28

---

Published in Transactions on Machine Learning Research (10/2023)
The aspect of our work that identifies the importance of discriminator update frequency in private GAN training is unaffected by concerns regarding private hyperparameter search.
Evaluation approaches that take into account the cost of search when comparing algorithms is an important direction, which we do not address in this work. For benchmark datasets, the problem is complicated by implicit knowledge encoded in various algorithms' design choices and "default" hyperparameter ranges.
29


Reviews:
[{"review_id": "UUpGfZmeUP", "reviewer": "Reviewer_UGFA", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Strengths\n\nThis paper improves the performances of previous implementations of DP GANs, by using multiple discriminator updates per one generator update. It also studies if larger batch sizes and adaptive discriminator steps improve the performances for such training with multiple discriminator updates. \n\n\n\n# Weaknesses\n\n**Novely/Relevance/Contribution.**\nThis fact that multiple updates for the discriminator help is a well-known observation in the GAN community, both as a theoretical and empirical observation, see for example [1-4]. It is related to using larger step sizes for the discriminator (instead of updating it multiple times). Thus, I am surprised that the first differentially private GAN did not use this because all standard GAN setups do that.\nThat said, this paper tries to interpret that using an argument based on \"asymmetric noise addition\", which is only argued, but does not provide theoretical insights.  \nGiven that this fact is well-known (from an optimization perspective), this perspective of asymmetric noise addition should be more thoroughly carried out for it to offer a different/deeper understanding in the DP context. \n\n**Misleading discussion on batch sizes.**\nIt is known that noisy gradient estimates can \"harm\" the optimization of GANs [5], and this is true for any min-max optimization, thus also for DP training. \nNow, for simple datasets such as MNIST, there is no/little gain in increasing the batch size, but for more complex datasets such as ImageNet, this is necessary in order to ensure that the optimization method does not diverge away rapidly [6].\nNow, this paper notes that for non-private GAN on MNIST, increasing the batch size does not help, but for private GAN, where noise is added, it does help.\nThis is very much expected/well-known because the added noise increased the complexity of the dataset, and from an optimization perspective, controlling for the variance of the noisy gradient estimates helps the convergence. \nThus, the discussion that this is something specific to DP GANs is in my opinion very misleading  (and the conclusion that for non-private GANs increased batch size does not help is incorrect).\n\n\n**Writing.**\nThe writing is often informal, which makes the reading ambiguous. For example, it is often used \"striking a balance\", or \"careful balance\" without being clear about what that means; see further examples below.\n\n\n**Experiments.**\nThe experiments do not report standard deviation. Moreover, they do not take into account the added computational expense since now, at each generator step, there are $n_D$ more gradient queries, and this number can be large.  \nFurthermore, it is unconvincing to me that FID is a good measure since the primary goal is to have a differentially private generative model, and FID reports how similar the generative samples are to the dataset samples.\n\n\n### Refs\n- [1] Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. In ICLR, 2018.\n- [2] Gauthier Gidel, Hugo Berard, Gaetan Vignoud, Pascal Vincent, Simon Lacoste-Julien, A Variational Inequality Perspective on Generative Adversarial Networks, In ICLR, 2019.\n- [3] Tatjana Chavdarova, Matteo Pagliardini, Sebastian U Stich, François Fleuret, and Martin Jaggi. Taming GANs with Lookahead-Minmax. In ICLR, 2021.\n- [4]  Tanner Fiez, Lillian J Ratliff. Local Convergence Analysis of Gradient Descent Ascent with Finite Timescale Separation. In ICLR, 2021.\n- [5] T. Chavdarova, G. Gidel, F. Fleuret, and Simon Lacoste-Julien. Reducing noise in GAN training with variance reduced extragradient. In NeurIPS, 2019.\n- [6] A. Brock, J. Donahue, and K. Simonyan. Large-scale GAN training for high-fidelity natural image\nsynthesis. In ICLR, 2019.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper focuses on improving existing differentially private (DP) GAN models.\nIt documents that using a different update ratio---that is, updating the discriminator multiple times versus the generator---significantly improves the quality of the generated samples. \n\n\nMy main concern is the limited novelty of this paper: in particular, the change relative to prior work in the DP context, is that the discriminator is trained multiple times, that is, only line 10 in Alg. 1. \nMoreover, it is well-known in the GAN community that multiple discriminator updates help significantly the optimization, and almost all publicly available GAN implementations use this; see references below. \nMoreover, given that the paper has empirical contributions, these are not thoroughly carried out (with seeds and standard deviation, reporting performances over wall clock time or gradient queries, an additional metric that the generated data is differentially private, etc.; see below), and the question on how to select the update ratio in this DP context remains open.  ", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "\n**Experiments.**\n- Please report the standard deviation over at least 3 seeds. \n- Please depict a plot where the x-axis is wall clock time or gradient queries.\n\n**Motivation.**\nPlease explain better what is the overall motivation: it is surprising to me that the overall goal is not to use \n\n\n## Questions:\n1. Increasing $n_D$ also increases the computation a lot. Have you tried increasing the step size for the discriminator?\n2. What would be a recommended way to select $n_D$ after this study? \n\n\n\n## Minor / Typos\n- Abstract: it would be helpful to make the contributions more precise. For example:\n   - \"after modifications to training\" -- it would be clearer to list these\n   - \"a careful balance between the generator and discriminator\" -- it is unclear what this means, balance in what?\n   - \"restores parity\" -- it is unclear what this means\n   - \"we experiment with other modifications\" -- these should be listed\n   - \"improvements in generation quality\" -- give a precise relative improvement in FID.\n- Sec 1: \"weakens the discriminator relative to the generator\"--while I understand the authors' point, this is very informal phrasing; moreover, since this part is the main motivation for the manuscript, it may be helpful to define things or alternatively to explain something like \"X happens, thus herein we refer to it as Y\".\n- Sec 1: \"Disrupting the careful balance necessary for successful GAN training\" -- this is unclear. What is meant by careful balance?\n- Sec 1: similarly, \"addresses the imbalance introduced by noise\"\n- Sec 1, first contribution: do you mean \"outperform\" instead of \"compete\"? \n- Sec 1, third contribution: it is unclear how the third contribution differs from the previous two contributions\n  \n", "broader_impact_concerns": "/", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "fPcWO5C4EV", "reviewer": "Reviewer_sgjK", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\nThe authors revisit differentially private training of GANs and perform a more detail-oriented empirical analysis of this framework. By carefully understanding how different design choices of training affect performance, the authors show that better performance can be obtained. \n\n**Weaknesses**\n\n- The authors claim to have proposed the scheme of taking more discriminator steps per generator step. However, this imbalanced stepping scheme was first presented in the original GAN paper and prominent follow-up papers such as WGAN [1]. To be clear, the cite references (Xie et al. 2018) already employed the imbalanced strategy (5 D steps per G step). Authors should clarify the present work's relationship with prior works. The present work (at least for the content related to imbalanced stepping) feels more like an empirical analysis of an existing technique than proposing a new technique. \n- Authors claim that increasing the D steps per G step can lead to improved performance and justify this claim by showing experiments with other hyperparameters fixed. However, authors only present results for one set of fixed (other) hyperparameters. For a more compelling argument, authors ideally should repeat the same set of experiments (e.g., those in Figure 2), varying other hyperparameters such as the learning rate of the two optimizers to show that the phenomenon is robust to changes in the overall setup. \n- Authors claim that the technique is general but only perform experiments for image generation. To make a more compelling argument, authors should either clarify that the scope is image generation or present additional results for other modalities of data (e.g. tabular data generation).\n\n[1] Arjovsky, Martin, Soumith Chintala, and Léon Bottou. \"Wasserstein generative adversarial networks.\" International conference on machine learning. PMLR, 2017.\n\n**Side notes**\n- Have authors explored other loss functions (e.g., those in WGAN paper)? ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper studies differentially private training of generative adversarial networks (GAN). The authors show that for a given hyperparameter configuration, taking more discriminator steps per generator step may improve performance (though there's a point at which further increasing leads to performance degradation). Authors also study additional modifications such as large batch training and adaptive discriminator step frequency and show further improvements in results. ", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Those listed in the \"Weaknesses\" section.", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "FR7RY8f4cU", "reviewer": "Reviewer_ZVUN", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Authors keep a clean writing style and the paper is easy to follow. I appreciate a comprehensive experimental study of allowing multiple discriminator steps for the discriminator. In addition to support the superior performance of the proposed algorithm, there are plenty of discussions regarding the tradeoff on the number of multiple discriminator steps, mode collapse, and adaptive discriminator steps.\n\nAs mentioned by authors, the performance of DPGAN does not match that of diffusion models. This could undermine the value of the paper. However, GAN often leads to fast generation due to the easy generator structure, while diffusion models are slow in generation because of the iterative backward simulation. In order to strengthen the result, it might be helpful to argue that DPGANs generate much faster with competitive performance to diffusion models. (Minor) The generated images in Figure 8 also Figure 13 seem not very appealing compared to diffusion models.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a training algorithm for private GANs, which significantly improves existing methods on private GANs. In private GANs, the discriminator is updated using langevin-type stochastic gradients (clipped stochastic gradient with additive Gaussian noise), resulting in a potential weak discriminator. Such an observation motivates the algorithm in the paper, which targets at \"balancing\" the effective training of generator and discriminator. In particular, the discriminator is trained for multiple iterations until the generator is updated once. This method is intuitive and relatively simple, yet this should not be perceived as a weakness. In fact, the performance improvement of the proposed algorithm is statistically significant compared to methods in the same class (except diffusion models). Therefore, the empirical evaluation justifies the contribution of the paper.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Definition 1 and Proposition 2 are slightly distracting. I understand the intention of a rigorous exposure, however, these results are not needed to appreciate the strength of the paper.\n\nMode collapse in Figure 3 needs a better explanation. Looking at the figures, I suspect 7 and 9 are mixed and similar.\n\nIt appears that the discriminative power of discriminator is highly relevant to the performance of DPGANs. Does varying the size of discriminator influences the performance?", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Reviewers initially found that the significance of the work is low,  as it is just about one hyperparameter whose effects were previously well-known.  The authors did a good job discussing the non-private GAN work, and clearly discussed their contribution in a revision.  Other reviewers had detailed pointers on improving the experiments and presentation. After (essentially) a major revision, the quality of the paper seems to have improved a lot.  Reviewers are now leaning towards accepting the paper.

I agree with the reviewers.  I recommended "accept as is" but since Reviewer UGFA did not have time to respond, the authors should do their best to go over the comments of UGFA again and make sure that every point in the review is satisfactorily addressed in the rebuttal.

Other comments

-  Tuning one more hyperparameter clearly helps, but I feel that it is time for the empirical DP community to start doing honest hyperparameter tuning with DP.   It is fine to argue that existing work does not report such results, but the problem and the rationale behind the choice to continue this practice should be explained in the paper.

- Please align the color choices for different n_D parameters in Figure 2, e.g., Blue is n_D = 1 in (a) but 10 in (b) and (c), which may cause confusion.
Decision: Accept (poster)