Privacy-Preserving Energy-Based Generative Models for Marginal Distribution Protection
Authors: Robert E. Tillman
Tucker Balch
Manuela Veloso
Venue: Accepted by TMLR ()

Abstract: We consider learning generative models for sensitive financial and healthcare data. While previous work incorporates Differential Privacy (DP) into GAN training to protect the privacy of individual training instances, we consider a different privacy context where the primary objective is protecting the privacy of sensitive marginal distributions of the true generative process. We propose and motivate a new notion of privacy: \emph{$\alpha$-Level Marginal Distribution Privacy} ($\alpha$-LMDP), which provides a statistical guarantee that the sensitive generative marginal distributions are different from the observed real data. We then propose \emph{Privacy-Preserving Energy Models (PPEMs)}, a novel energy-based generative model formulation where the representations for these attributes are isolated from other attributes. This structured formulation motivates a learning procedure where a penalty based on a statistical goodness of fit test, the \emph{Kernel Stein Discrepancy}, can be applied to only the attributes requiring privacy so that $\alpha$-LMDP may be satisfied without affecting the other attributes. We evaluate this approach using financial and healthcare datasets and demonstrate that the resulting learnt generative models produce high fidelity synthetic data while preserving privacy. We also show that PPEMs can incorporate both $\alpha$-LMDP \emph{and} DP in contexts where both forms of privacy are required.

Published in Transactions on Machine Learning Research (06/2023)
Privacy-Preserving Energy-Based Generative Models for Marginal Distribution Protection
Robert E. Tillman"
Optum AT Labs (UnitedHealth Group)
Tucker Balch
J.P. Morgan Chase AT Research
Manuela Veloso
J.P. Morgan Chose AT Research
Reviewed on OpenReview: https: // openreview. net/ forum? id fd=
Abstract
We consider learning generative models for sensitive financial and healtheare data. While previous work incorporates Differential Privacy (DP) into GAN training to protect the privacy of individual training instances, we consider a different privacy context where the primary objective is protecting the privacy of sensitive marginal distributions of the true generative process. We propose and motivate a new notion of privacy: a-Level Marginal Distribution Privacy (a-LMDP), which provides statistical guarantee that. the sensitive generative marginal distributions are different from the observed real data. We then propose Privacy- Preserving Eneryy Models (PPEMs), novel energy-based generative model formulation where the representations for these attributes are isolated from other attributes. This structured formulation motivates a learning procedure where a penalty based on a statistical goodness of fit test, the Kernel Stein Discrepancy, can be applied to only the attributes requiring privacy so that a-LMDP may be satisfied without affecting the other attributes. We evaluate this approach using financial and healthcare datasets and demonstrate that the resulting learnt generative models produce high fidelity synthetic data while proserving privacy. We also show that PPEMs can incorporate both a-LMDP and DP in contexts where both forms of privacy are required.
1 Introduction
In recent years, the quantity and variety of data collected from individuals and organizations has grown dramatically. Such growth has fueled the development. of large-scale machine learning systems capable of high accuracy predictions, but also led to significant concerns about data privacy and the potential leakage of sensitive information. These concerns are particularly relevant for the financial and healthcare industries as their data are often very sensitive and personally identifiable and these industries are subject to strict regulatory and compliance requirements. As a result, data access at such organizations is typically highly controlled and the usage of data for research purposes often requires lengthy legal reviews with no guarantees of success CChoi et al. 2017). These restrictions often apply not only to external researchers, but to internal research groups working in different parts of the same company (Assefa et al.) (020). Ultimately, these processes can impede opportunities for academic collaborations and potential advances in areas such financial fraud detection, anti-money laundering, disease prediction and patient care (Nass et al. 2009).
Advances in neural generative models such as GANs (Goodfelow et al. 2014 have led many such organizations to consider using synthetic data to enable more timely and collaborative research. Recent work, however,
*This work was completed J.P. Morgan Chase AT Research.

---

Published in Transactions on Machine Learning Research (06/2023)
has shown that GANs may still leak sensitive information: GAN attack models have been proposed for inferring membership in or reconstructing training data (Shokri et al. 2017 Hayes et al. 2019) This led to the development of GANs incorporating Differential Privacy (DP) to mitigate such attacks (Xie et al.) 2018 Yoon et al. 2019 DP Dworr & Roth 2014) is a paradigm for protecting the privacy of training data by ensuring a learning algorithm's output does not vary significantly based on the inclusion of parlicular training instance. While DP is effective for ensuring the privacy of particular individuals or organizations is protected, it does not, however, protect against the potential leakage of aggregate-leve information which may be inferred from the generative distribution. This is particular concern for (e.g.) financial institutions generative models for financial data may leak aggregate-level information about typical client characteristics or markets the institution is most active in. We thus propose a new notion of privacy which may be used either in place of or in conjunction with DP, depending on the privacy requirements, and a robust procedure for learning generative models while satisfying this privacy notion.
1.1 Contributions
We make the following novel contributions:
1. We propose new notion of privacy for protecting sensitive marginal distributions of the generative process: a-Level Marginal Distribution Privacy (a-LMDP), which provides statistical guarantee that sensitive generative marginal distributions differ from the observed real data.
2. We theorctically show that a-LMDP is neither strictly stronger weaker than DP.
3. We propose Preeecy-neeerring Energy Models (PPEMs), a novel energy-based generative model formulation where representations for attributes requiring a-LMDP protection are isolated from other attributes.
We introduce a non-negative normalized variant of the Kernel Stein Discrepancy, a goodness-of-ff fit test that is compatible with energy models, which we use to incorporate a-LMDP protection into PPEMs through a training penalty.
5. We show that when PPEM training converges, the learnt generative models produce samples indistinguishable from the real data and provide conditions under which a-LMDP will be satisfied.
6. We show how DP can also be incorporated into PPEMs when both privacy notions are required.
Using credit card data and electronic healthcare records, we empirically demonstrate that PPEMs produce high fidelity syuthetic data while preserving privacy.
2 Notions of Privacy for Generative Models
Differential Privucy (DP) is paradigm for quantifying how much the output of a mechanism that interacts with data may be affected by changing single data point in dataset.
Definition 2.1 (Dork & Roth 2014]. A randomized mechanism M is ((e, D)- if for any output set S and two datasets D and D' which differ by only single data point, the Sollowing holds for e, d E Bt,, where IP(.) denoles the probabilily laken with respect to M:
Private
P (MM(D) E exple) ()) +
A mechanism that is (c,8)-DP guarantees changing any data instance will affect the probability of an outcome only up to a multiplicative (e) and additive (8) factor, providing protection against membership inference attacks. Gradient Perturbation is an efficient way to augment a learning algorithm to make it DP, such as Differentially Private Stochastic Gradient Descent (DP-SGD) (Abadi et al. 20166, where at cach descent step, the gradient norm clipped and Gaussian noise, which is carefully scaled ensure a particular (e, -eeel,, is added to the gradient. DP-GAN (Xie et al. 2018) is GAN which uses DP-SGD to learn to
2

---

Published in Transactions on Machine Learning Research (06/2023)
generate synthetic data with DP guarantees. While DP is effective for protecting the privacy of individuals and organizations whose information make up specifie instances of training datasets, it does not, however, consider the privacy of aggregate-level information that may be inferred from the distribution of the generated data. For example, consider a dataset consisting of customer information from a financial institution. A DP generalive model would ensure that the privacy of individual customers is not violated, but the distribution of certain attributes in the generated data might reveal information about the institution's 's typical customer profiles that is valuable to a competitor. Similarly, many financial transaction and trade datasets contain no personally identifiable attributes, but their marginal distributions reveal information about which markets and venues the institution is most active in. Unless this risk is managed, institutions will likely not approve of the release and use of synthetic data, limiting potential collaborations with external researchers as well as among internal leams. Similarly in healthcare, there may be ethical concerns that revealing marginal distributions of demographics associated with specific outcomes in electronic healthcare records through synthetic data could lead to discrimination in paticnt care or insurer coverage.
We thus propose new statistical notion of privacy for the context. of protecting sensitive marginal distributions: a- LeLevel Marginal Distribution Privacy (a-LMDP). a-LMDP makes use of a level-a test, or statistical hypothesis test with probability of falscly rejecting the null hypothesis I a. a-LMDP ensures that for a specified subset of attributes whose marginal distribution may be sensitive, level-a test that the training data for these attributes follows the learnt (marginal) generative distribution can be rejected.
Definition 2.2. Let x E X be a d-dimensional vector, {x',²"} a partitioning of the dimensions of a, 9: "d' +x Xd a generative model with output distribution pg, D== {xx): a dataset of vectors x X' and D=' = -1= the corresponding dimensions x', Pg., = Sx Pg the marginal generalive distribution for x' and = a level-a goodness of fit test. G satisfies a-Level Marginal Distribution Privacy (a-LMDP) with respect to E and x' if the null typothessi Ho Da pG_, can be rejected using E.
The specific test utilized by a-LMDP to provide a statistical guarantec that the privacy of the specified marginal distribution is protected is a goodness of fil lesl, which tests whether a sample fits a specified distribution. The sample corresponds to the private attributes (x') in the real data and the specified distribution is the marginal distribution learnt by the generative model. The definition does not constrain the other (non-private) attributes x" as it assumes all sets of attributes whose marginal distributions are sensitive are included in x'. a-LMDP requires a representation for pş and goodness of fit test. capable of evaluating this representation. We propose framework providing these requirements in section 3 We note that the definition assumes G and pg have sufficient representation power and E has sufficient statistical power to reject the null hypothesis; otherwise, a training procedure soundly designed to ensure this privacy notion may still fail in practice. The framework we propose in section 3 makes use of a powerful nonparametric goodness of fit test which permits flexible representations for pç, the Kernel Stein Discrepancy (Liu et al. 2016).
An important distinction between L-LMDP and DP is a-LMDP is a model-based notion of privacy, whereas DP is mechanism-bused. We can still, however, relate o-LMDP to mechanisms defined to return generative models which satisfy a- a-LMDP under certain conditions, we describe in section 3 This is advantageous since mechanisms often require assumptions that are not always realistic. In such cases, the resulting models may be checked after training to ensure they satisfy a-LMDP and accepted or retrained under different conditions depending on whether the test is rojected. When we consider a-LMDP in regards to such mechanisms, we can formally show that it is neither a strictly weaker nor strictly stronger notion of privacy than (c, 6)DD, i.e. (e, d) mechanisms which return generative models never also guarantee any level of a-LMDP and vico-versa. While such results are expected since o-LMDP and DP address completely different privacy concerns, we provide this theoretical analysis since, in practice, DP training procedures often affect the learnt generative distributions. We provide proofs in Appendix B
Theorem 2.1. For a generative mechanism M, < 1, a partitioning x = =x" x'} and e,0 E RR, M is (c, # M returns models satisfying L-LMDP for x'.
Theorem 2.2. For a generative mechanism M and partitioning x = {x=, ,'), M returns models satisfying a-LMDP for x' + M is (e, for fonite e,
Since a-LMDP and DP address different types of privacy concerns, we cannot rely on using one to entail the other. Our proposed model in section is capable of incorporating both a-LMDP and DP if required.
3

---

Published in Transactions on Machine Learning Research (06/2023)
Latent Distribution
Marginal
Marginal Energy
Licesr
Liveed
Po(x)
Rivellaoe
X (20
Latent Distribution
Conditional Generator
Conditional Energy
Nor- Private
Morginal Energyy
Marginal Gonerttor
Consitionll Enengy
Gonditional Generator
Data
Figure 1: Diagram of PPEMs (left) and network architectures of the individual components (right)
3 Privacy-Preserving Energy Models (PPEMs)
We first provide background on GANs as well energy models and then we propose Privacy-Pree Preserving Energy Models (PPEMs).
3.1 Background
A Generative Adversarial Networks (GAN) consists generator Gs parameterized by which maps samples from a latent distribution Ps to the real distribution Pz and & discriminator Dg parameterized by 0 which attempts to distinguish real from generated samples. In Goodfellow et al. (2014), Gø and DD trained adversarially using the following minimax loss, which minimizes the real and synthetic distributions:
divergence between the
min max (Ep log Do(x) + Ep, log [1 - Do (9)(2)))
(1)
9
As training with the above loss is notoriously unstable, alternative formulations have been proposed. The Wasserstein GAN (WGAN) (Arjovsky et al. 2017) replaces the discriminator with critic that scores, rather than classifies, the realness of a sample. minimize the Wasscrstein-1 distance by enforcing a Lipschitz constraint on the critic and generally leads to more stable training. The original formulation was implemented using parameter clipping (Arjovsky al. (017). Gulrajani et al. (2017) proposes an alternative formulation which appends the below soft penalty, where Unif(0, 1) and a ux u)Ga(z), to the critic loss and generally leads to improved performance.
A DD (8)ll2 - 1)²
(2)
An energy-based model (EBM) (aremii et al. 2018 Ep Xd + + parameterized by maps d-dimensional samples x d from an unknown distribution Pa scalar energy values, resulting the following density po with normalization Ze, referred to the partilion function:
(=(x)= = exp (-Ea(z)) Zo = exp((EE((x))
Zo
Eg(-) thus represents unnormalized log-density: lower energies correspond to higher probability events. EBMs offer considerable flexibility in the designing the energy function, often neural network. Their primary challenge is estimating the (generally intractable) partition function.
EneryyGAN (Zhao et al., 2017) uses adversarial training to learn an energy model: the GAN framework is adopted, but the discriminator replaced with an energy model and trained to promote assigning lower energies to real samples and higher energies to samples from the generator. We adopt the same framework in the model we propose, which results in not requiring evaluation of the partition function.
4

---

Published in Transactions on Machine Learning Research (06/2023)
3.2 Proposed Model
We propose Privacy-Preservvnn Energy Models (PPEMs) which consist of two EBMs and two generators: one EBM and generator pair models the marginal distribution of the attributes x' for which a-LMDP must be satisfied while the other pair models the distribution of the other attributes x² conditioned on x'. The purpose of this structured formulation is to allow for a training procedure that ensures the resulting generators satisfy a-LMDP with respect to without impacting the the generated non-sensitive attributes x and their relation to z'. This permits the generation of paired values for the attributes {z', x²} that are individually realistic given the real data, but in the aggregale do not reveal the true marginal distribution of x'. Figure (left) provides a schema depicting how the individual PPEM components, defined below, each interact with the data.
Let I x be d-dimensional vector and fœ', x=} a partitioning of the dimensions of x such that x' corresponds to the attributes with sensitive marginal distributions that require a-LMDP protection. Let and be the corresponding dimensions of x' and x². We define the marginal energy & to be a standard EBM as in 33 parameterized by & mapping x² + Rt. We then define the conditional energy Ey to be an EBM representation of conditional distribution xe" given x'. Ey, maps x x X - +R+, which permits the following conditional density model:
p=(x"(x') = expl (xp(-En(x*12'))
(4)
Z [
z
Since Ey represents the energy for conditional density with respect to x', apply the normalization over x² rather than æ. We further define a marginal generalor Gu. mapping z' x and a conditional generalor Go mapping z" xdd xdd Samples for are generated using learnt PPEMs by first sampling and z' from the latent distributions of the marginal and conditional generators and then gencrating x' Gç(2) followed by x² (='lar).
The motivating goals of the dual energy and generator framework of PPEMs are (i) it isolates the representation for x' from x" (and its relation to z²), allowing a privacy penalty to be applied when learning the reprosentation for x' that does not affect the attributes which do not require a-LMDP protection; (ii) it provides an explicit representation for p which required for constructing the goodness of fit test for a-LMMD.. This permits an adversarial training procedure that results in generative models which satisfy a-LMDP for z' without affecting x and its relation to x'.
We next discuss this training procedure in general, non-private setting and show Nash equilibrium exists where the generators produce samples indistinguishable from the real data. We then show how a-LMDP and DP protection can be incorporated into the procedure. We note PPEMs do not require estimating partition functions or expensive MCMC-based procedures to generate samples, as samples come directly from learnt generators. Pscudocode for training and sampling provided Appendix and proofs are provided in Appendix B Code is also provided in the attached supplement.
3.3 Training PPEMs
Our goal in training the two EBMs which comprise a PPEM is to learn &g and E, which together represent. the joint distribution of z according to the following likelihood model:
log (x log (p+ (x (z.) (')))) P2 (x'))
(5)
EE (x" (z) log Zi Eg (x') log Ze
Notice that the gradients V. log Pg and Ve log Pe do not include terms from the marginal and conditional EBMs, respectively, so we can learn an EBM for the joint density pe by considering &g and E, separately. We thus train & and E, adversarially with Gu and G., respectively.
5

---

Published in Transactions on Machine Learning Research (06/2023)
Our trained Eg should assign low energies to real samples and high energies to the samples generated by Gw. As in Zhao et al. (2177). use the following margin loss, where m is positive margin and [-] max and use separate generator loss (Goodfellow et al. 2014h:
Lg (x' = Eg (z') + [m Ee (G)()))
(6)
[=](2) = & (9w
We train & and Gw using the above losses by iteratively laking minibatchs of training data {< and samples from the generator's latent distribution and optimizing the EBM in an inner loop and generator in an outer loop. In practice, it computationally prohibitive to optimize the EBM to convergence at cach outer step so inner steps are performed for each outer step. Adversarial training of the conditional model is carried out identically, independent of & and Gw, but while conditioning real samples from pat We use the following losses for Ey and Go:
L, (10",2'2') = (x*1x)) (x'laa)) + im- - & (G. (2'1= L Lo x') = E,, (G. (z' ('|x')(xx))
(7)
When training E, and Go, we sample a minibatch {at afJi=1 and provide { to both Ey and Go to condition on. Otherwise, the procedure is the same as for the marginal model, substituting x for x and z/ for Zz- We emphasize that when training &, and Gus we condition values x' from the real dala for both. This ensures that Ey learns to provide strong coverage conditioning on x' Px and similarly Gu produces realistic samples. It is important that Go be trained by conditioning on the real marginals x' ~ Pz rather than marginals generated by Gw : x' ~ Pws since E, might otherwise learn to assign high energies to samples generated by Gu because of differences between Pa and Pw rather than the quality samples produced by G.. This is important because PPEMs are trained to ensure M-L for x' then, by definition, such differences between the real and generative distributions for z' will exist.
conditional density model for x² when
3.4 Optimality of the solution
We can show that when the systems defined in 6 and indistinguishable from the real data. Define the following:
7
converge, the generators produce samples
Vm (E.w) S Lg (e(2 (o') (z)
(8)
J2
Um (E,w)=
L (z) (2)
(9)
[ Ly (x" 10,,, 2 x') Pm pa()) (x')
(7, =
(10)
22,2
[( Lu Lo (2/22 "l
Uc (v,
per (2') po (x')
(11)
A Nash equilibrium for the first system is pair (e*,")) such that VE, Vn (E ww" S Vm(E, and Yu, Um((", ,w") I Um w)). A Nash equilibrium for the second system is pair (r" (y",v") v*) such that by, Velr",e" x Va(x=") and Vo, Uel"",")) s u)). The results below follow directly from Theorem and Theorem in Zhao et al. (2017) when accounting for the partitioning of x.
Theorem 3.1. If
and ("*, are Nash equilibria for the systems ,w))= Valr", "=)+,"))=) m.
6 and then pwr Po = Pa
almost everywhere and (f*
Theorem 3.2. Nash equilibria for 6 and everywhere and (b) there exists constant Vm E [0, m] such that Eg-(x') vm almost everywhere and for d' dd constant De [0, m)) such that E (x (x') Me almost everywhere.
crist and are characterized by (a) Pu- Ps almost

---

Published in Transactions on Machine Learning Research (06/2023)
3.5 Incorporating a-LMDP Protection into PPEM Training
When x' corresponds to attribules requiring a-LMDP protection, only need to modify the training procedure for the marginal model to ensure the learnt generative distribution is different from Pe', since Go only generates attributes x" for a given sctting of x'. Our goal is to augment training in such a way that the resulting generative distribution is sufficienlly different from Px¹ but individual samples remain realistic.
For example, consider the simple univariate case where Px is (V, 1). A generator that produces samples roughly uniform between and would likely satisfy a-LMDP while still producing values for x' that are individually realistic given training dataset.
To achieve this goal, we retain the loss functions defined in ( but append a soft penalty based on the goodness of fit test statistic we use to satisfy a-LMDP. This ensures training promotes the dual objective that samples are individually realistic but in the aggregate satisfy a-LMDP. Penalizing 9u directly, however, may result in & initially learning to trivially distinguish real from generated samples and 9.. never receiving sufficient signal to learn generate realistic samples. Instead, we penalize &g and rely on the fact that since Go interacts with the data only indirectly through &g, its representation power is limited by &g.
To implement this penalization for a-LMDP protection, we require a goodness of fit test that is sufficiently flexible to make use of our EBM-based representation for the marginal distribution Pę- In addition, we desire a test that does not require evaluating the partition function Zę and can be calculated efficiently for each minibatch {-/)==1
The Kernel Stein Discrepancy (KSD) (Liu al., 2016) powerful nonparametric goodness of fit test which has these properties. The KSD only interacts with density p through its score function sp(x:) V, log p(r). When p has an EBM-based representation, Sp does not depend on the partition function:
sp(x) = V log Tzz exp (-((()) = =o((()
Thus, computing the KSD for Pg does not require evaluating Zg-
The KSD is based on Stein's identily, which states that for distributions and q with support on R and smooth functions f, the following equivalence holds if and only if (Stein et al. 2004]:
(s,( + v.J(x))= =0
(12)
A Stein discrepancy S(p. q) between p and q thus be defined by taking maximum over f for sufficiently rich space of functions F:: S(p, q) = max E, (z, + (V,
(13)
When F is reproducing kernel Hilbert space (RKHS) associated with smooth positive definite kernel k(s-), e.g. the RBF function exp(-o 1 I')12), S(p. q) is the Kernel Stein Discrepancy (KSD).
Liu et al.
2016) provides the following empirical estimator for the KSD:
$(p.9) = n(n 1) Σ Ug (x(
(14)
(x, = s, (x) k(x,, x d))s,,)()))) (x') (x,) + (T) (K),,())T((K))))) + V , x') s (z') + tr 2 k(2,
(15)
The computational cost of evaluating $(p.g) at each gradient update is (nn²) for minibatch of size Thus Liu et al. (0016) also proposes the following more efficient estimator:
|x/2| Σ
1
(p.
[n/2] (1
(16)
(p q) has O(n) computational complexity at a cost of less statistical power (Liu et al. 2016). There are two issues, however, with including (p(p.)) in soft penalty that can lead to training instability: (i) its
7

---

Published in Transactions on Machine Learning Research (06/2023)
magnitude vary significantly across minibatches; (ii) oscillations between positive and negative values occur. To address these issues, we propose the following non-negative, normalized variant of the KSD, which we show has a x2 null distribution:
(p. (1n/2] -1 [n/2] uy (222-1,
(17)
[n/2] |n/2] Ei=1 Ugg (222-1 122)
Lemma 3.1. (p. q) has asymptotic xi distribution under the null hypothesis q-
(p. 9) is more well behaved than (p(p.) q) when used a soft penalty, but has the same computational efficiency and performance as a test statistic (in terms of type I and Il errors), as we confirm empirically in section 5 We propose the following soft penalty based on (1, q) which grows magnitude relative to the confidence with which the hypothesis Ho {<i ~ Pe may be rejected:
_ (x' = Le(x', + da F (1 a) -S,n(PerPe))
(18)
F is the x quantile function and Xa is hyperparameter used to scale the relative magnitudes of the two quantitics. Since Le and (Por Pt) have conflicting goals, the influence of (P. modulated by the critical value of the level-a test: it is inactive whenever Ho can be rejected with confidence level 1 a and otherwise decreases relative to the confidence which Ho may be rejected. We can now state the following result which relates training using the penalized loss (18) to satisfying a-LMDP:
Theorem 3.3. For sufficiently large Aa and Gw and &g with sufficient representation power, when &g is trained to convergence using (18) and reaches a global optimum, the resulting g (9w;9u) will satisfy a-LMDP with respect to x' and the KSD test using the estimator St (Pw..E)..
The above result assumes & trained to convergence, which may be computationally prohibitive, but this is not practical limitation since after training can confirm the model satisfies a-LMDP using the KSD and adjust the hyperparameters and retrain if needed.
3.6 Incorporating Differential Privacy into PPEM Training
DP can also be incorporated into PPEMs by perturbing gradients when training the marginal and conditional EBMs, as in DP-GAN. Following Abadi et al. (2016), we clip gradients to ensure their norms are bounded by a constant C and then add Gaussian noise, scaled according of privacy. We use the moments accountant method of Abadi et al. (2016) find setting of which will result. in the desired level of privacy given the sample size, minibatch size and number of iterations. The post-procsssing property of DP (Dwork & Roth 2014) guarantees the generators are ODP with respect to their generated attributes since each observe these only through their corresponding EBM.
and a factor determining the (c, level
3.7 Stabilizing Training
While existing work demonstrates that EBM-based generative models for images can be successfully learned using adversarial training, pairing an EBM with a generator (Zhao al.] 2017 Wang & Liu 2017). our experiments using tabular datasets found that gradients become very unstable and regularization is needed for such data. While image data is superficially more complex than tabular data, it is highly structured due to spacial similarities and distributions of pixel values, whereas tabular data may be non-Gaussian, multimodal and highly imbalanced. Other generative modeling approaches for tabular data note similar difficulties [Xu et. al.) 2019). Prior work interprets imposing Lipschitz constraints on EBMs as a form of smoothing regularization (Che et al.) (0200). Given the success of using the soft penalty defined in Guirajani et al. (2017) to enforce Lipschitz constraints on Wasscrstein GAN critics and similaritics between the critic and EBM-based loss functions, we incorporate the same Lipschitz soft penalty into (6) and when optimizing the marginal and conditional EBMs.
8

---

Published in Transactions on Machine Learning Research (06/2023)
3.8 Network architectures
We use multi-layer perceptron (MLP) architectures with 3-layers and LeakyReLU activations for EBMs and generators. Despite findings that autoencoder- based EBM architectures perform well with image data (Wang & Liu 2017 Zhao et al. 2017 our experiments indicated MLP architectures perform best with tabular datasets. We add residual connections and use batch normalization the generators. For the conditional EBM and generator, we include initial sets of neurons connected only to the conditional and unconditional attributes. These architectures depicted in figure | (right).
4 Related Work
4.1 Privacy of data distributions
Zhang et al. (022)) proposes two notions of altribule privacy for a dataset distribution: the first notion, which is the closest a-LMDP, considers protecting specific statistical properties of dataset, whereas the second notion considers protecting parameters of a distribution with dependencies that can be formalized in terms of Bayesian network. The most important differences between the first definition and a- a-LMDP are (i) the first definition requires choosing specific functions of columns of a dataset to be protected whereas a-LMDP considers general differences between marginal distributions that can be detected using a two-sample test, (ii) the first definition requires a multivariate Gaussian assumption (or close to multivariate Gaussian) for the data and the functions of the columns of the dataset must be linear, whereas a-LMDP is fully nonparametric and (iii) the first definition is mechanism-bassed, whereas o-LMDP is model-based. We discuss considerations for using each definition in section 6.2 Suri & Evans (2022) proposes a general definition for distribution inference attacks and considers class of attacks for distinguishing between different possible training distributions of a classifier. [alle et al. (2020) considers hypothesis testing interpretation of differential privacy; this interpretation considers testing whether a specific individual contributed their data rather than global properties of a dataset.
4.2 Generative models for healthcare and finance
Procedures leveraging domain knowledge have been proposed in healthcare (Buzzak et al. 2010 Park et al. 2013) and finance (Galbiati Soramäki 2011: Weber et al. 2019), but there are few domain-agnostic approaches, medGAN (Choi et al. 2017) is one such procedure for binary and count variables. medGAN uses autocncoder that is pretrained autoencoder latent dimension while the discriminator compares the real and fake outputs of the autoencoder's decoder. GAN architectures for financial time series have also been proposed (Wiese et al. 2020). CT-GAN is another GAN architecture for tabular data with mixed discrete and continuous variables [Xu et al. 2019
the real data; the GANN generator learns to generate from the
4.3 Generative models with privacy-preservingg properties
DP-GAN (ie et al. 2018 and PATE-GAN Yoon et al. 2019 are GANs which both incorporate DP.
DP-GAN uses DP-SGD whereas PATE-GAN is based on the PATE framework (Papernot et al. 2018 PATE-GAN is evaluated using both financial and healthcare data.
4.4 EBM-based generative models
MnergyGAN Zhao el al. 2017) and SteinGAN (aag & Liu 2017 are related approaches which combine EBMs with generators and use adversarial training to generate synthetic images. EnergyGAN's training is identical to our marginal model training when no privacy penalty or gradient stabilization used. SteinGAN uses an alternative procedure, Stein variational gradient descent, to train the energy model. Both use AE architectures for the energy model whereas ML.Ps

---

Published in Transactions on Machine Learning Research (06/2023)
0.06
0.30
0.35
p q
0.05
p q
Erro Rate
0.8
Si Type Error
Type Error
0.25
0.20
# q
0.04
0.03
p = q
0.6
Su Type Error
0.15
Type
0.10
0.05
0.01
0.2
0.00
0.00
0
(p q)
10
15
20
25
30
10
-20
() q)
20
40
60
0.0
100
Sample Size
200
300
400
500
Figure 2: Distributions of St, (left) and St (center) empirical type I and II error rates (right)
A
Figure KDE plots for real (blue) and synthetic data (orange) for attributes not requiring a-LMDP protection
5 Experiments
In experiments, we set a = .05 for a-LMDP and c 1, 5= for DP. We use RBF kernels and choose bandwidths using the median distance heuristic described in (Garreau et al., 2018) when evaluating the KSD, Further details regarding datascts, hyperparameters and additional results are provided in Appendices and
D
5.1
Evaluation of KSD variant using synthetic data
We first confirm our proposed KSD variant $t, has the desired properties from section 3 and the same test performance as Š, using simulated data from 1-D Gaussian mixture model (GMM) with 5 equally weighted components, Since the underlying distribution is known, we can calculate the score function exactly when ovaluating the KSD. We evaluate $t, and & across 10,000 sets of 128 samples, the minibatch size used to train PPEMs, using data sampled from the true GMM (p = q) and an alternative 5-component GMM with different parameters (p * q).
Figure 2 shows the empirical distributions of each estimator under the null and alternative conditions. We observe St,, is non-negative and falls within the expected range of a x² variable under the null condition, whereas S, is negative for some samples and has significant variance, confirming $t, has the properties from well behaved soft penalty. To compare test performance, we report empirical type and II errors when simulating from GMMs with randomly chosen parameters 10,000 times in figure 2 We observe type errors are well controlled for both $ and $, and the two estimators exhibit comparable statistical power, confirming $ has the same test performance 6,.
section X which result in
10

---

Published in Transactions on Machine Learning Research (06/2023)
27
04
M
WWGAN
medGAN
BneayGAN
StenGAA
PPEM/501
PREMI000)
FREMISS)+DP
PPEM2200
DP-GAN
PATE-GAN
Figure 4: MIMIC-III Bernoulli success probability for the real (x-axis) vs. generated (y-axis) data
Table 1: KSD and MMD test results and classification and regression performance
Kaggle Credit Card Fraud
MIMIC-III EHR
PKSD
PMMD
AUROC
MSE
R²
PKSD
AUROC
REAL DATA
0.975
0.124
0.881
0.970
WGAN (NO PRIVACY)
0.15
0.966
0.126
0.879
0.811
MEDGAN (NO PRIVACY)
0.625
ENERGYGAN (NO PRIVACY)
0.00
0.871
7.13
-5.86
0.594
STEINGAN (NO PRIVACY)
0.00
0.822
1.81
-0.740
0.508
PPEM (2/50) PPEM (5/200)
0.00
0.02
0.922
0.184
0.822
0.00
0.828
0.00
0.00
0.948
0.196
0.812
0.00
0.769
PPEM (2/50) DP
0.00
0.00
0.872
0.656
0.368
0.00
0.504
PPEM (5/200) + DP
0.00
0.00
0.889
0.485
0.533
0.00
0.511
DP-GAN
0.00
0.857
1.881
-0.811
0.491
PATE-GAN
0.00
0.879
1.569
-0.510
0.490
5.2 Evaluation of PPEMs using real data
We next apply PPEMs to real financial and healthcare datasets that have previously been used benchmark privacy-preservigg generative models: the Kaggle credit card fraud dataset (Pozzolo et al.) 2015), ; used the primary evaluation dataset for PATE-GAN consists of 28 factors used to predict whether transaction is fraudulent and the transaction amount; the MIMIC-III critical care electronic healthcare record (EHR) dataset (Johnson et al. 2016) consists of binary indicators for diagnoses patients received. For MIMIC-III, we use the same procedure as Choi et al.] (2017) and Xie et al.] (2018) to construct 1070 longitudinal indicators for each patient and then add extremely- magnitude Gaussian noise so the binary indicators appear continuous, which we found lod to improved performance over using the modGAN autoencoder architecture.
For each dataset we train PPEMs with a-LMDP for two cases: when x' consists of (i) 2 50 and (ii) 5 200 attributes for the Kaggle and MIMIC-III datasets, respectively, since MIMIC-111 is much higher dimensional datasct. For each case, we train PPEMs with (a) a-LMDP only and (b) a-LMDP and DP (for both the marginal and conditional models). We evaluate the results to confirm a-LMDP is satisfied and compare the fidelity of the generated samples to non-private (Wasserstein GAN, EnergyGAN, SteinGAN) and DP (DP-GAN, PATE-GAN) baselines. We also include medGAN for MIMIC-III.
5.2.1 Privacy evaluation
To confirm the trained PPEMs satisfy .05-LMDP, we evaluate the KSD with the learnt marginal EBMs and training data for the protected attributes (a') and calculate p-value, corresponding
the minimum level-a test with which we reject the null hypothesis that the training data for x' follow the learnt energy-based distribution. We also evaluate the MMD two sample test (Gretton et al.] 2012 for whether the real and generated data for the protected attributes (x') follow the same distribution and calculate a z-value in the case of the real-valued credit card transaction data, We report these in table [ We observe that the p-values for PPEMs under all conditions (for the KSD and MMD and each dataset) are S .05, confirming .05-LMDP is satisfied. We note that achieving a p-value < 0.05 is non-trivial as the p-value for WGAN is 0.15: the small p-values for EnergyGAN and SteinGAN due to poor fidelity, which is discussed in the following section.
11

---

Published in Transactions on Machine Learning Research (06/2023)
5.2.2 Fidelity evaluation of credit card transaction data
We next consider the fidelity of the credit card transaction data, following previous benchmarking approaches. In figure 8 we plot kernel density estimates for the attributes which do not require a-LMDP protection (x*) in the real (blue) vs. generated (orange) data for each PPEM training scenario mentioned above and baseline. We also train logistic regression models to predict whether a transaction is fraudulent and linear regression models to predict the transaction amount using the generated data for training and evaluate these models' performance on the real data in terms of area under the ROC curve (AUROC) and mean-squared error (MSE) and coofficient of determination (R²), respectively. We report these in table [ and include an additional baseline where the prediction models are trained using the real data ("Real Data").
We first observe that the non- privativate Wasserstein GAN produces synthetic data with marginal distributions which best match the real data, whereas EnergyGAN and SteinGAN result in more peaked distributions which fail to capture the true marginal distributions. The poor performance of EnergyGAN and SteinGAN is due to unstable gradients when using tabular data and consistent with our expectations discussed in section B Stabilizzng Training, which motivates the gradient stabilization strategy used for PPEMs. We note that the performance of EnergyGAN and SteinGAN in some cases is worse than methods which include privacy due to poor fidelity resulting from gradient stability issues. We include the EnergyGAN and SteinGAN results for completeness, relying the Wasserstein GAN results as the primary non-private benchmark.
We next observe that the plots for PPEMs trained without DP are the next closest to the real data (after the Wasserstein GAN), indicating the privacy vs. accuracy tradeoff when learning models which satisfy o-LMDP is (at least) no worse than the tradcoff for (1, n, -DDDP. The plots for the PPEMs with a-LMDP and DP are comparable to the plots for PATE-GAN (DP-GAN is slightly worse), indicating that when .05-LMDP is combined with (1, DDDD,, it does not significantly affect the privacy vs. accuracy tradeoff. We observe the same pattern when we consider the prodiction models trained on the synthetic data and evaluated on the real data: the performance for the PPEMs without DP is greater than all DP approaches and the performance for the PPEMs with a-LMDP and DP is comparable to PATE-GAN.
5.2.3 Fidelity evaluation of electronic healthcare records
Finally, consider the fidelity of the EHR data, again following previous benchmarking approaches. We report average AUROC when the generated data is used to train classifiers for each attribute, using the other attributes as predictors, and evaluation is carried out using the real data in table We also plot Bernoulli success probabilities for each attribute in the real vs. generated data in figure as in Choi et al. 2017 ideally, it should form a diagonal line.
Again, we observe the Wasserstein GAN is the best non-private baseline (SteinGAN closely matches the data in terms of Bernoulli success probabilities, but fails to capture relationships between variables as evidenced by low average AUROC, again due to unstable gradients), the PPEMs trained with a-LMDP but without DP most closely resemble the real data and WGAN baseline compared to other privacy-preserving approaches, and the PPEMs trained with o-LMDP and DP perform comparably to PATE-GAN.
5.3 Summary of results
In summaary from these results we draw the following conclusions: (i) PPEMs succeed in ensuring 4-LMDP is satisfied; (ii) the fidelity of data generated using PPEMs compared to that of DP generative models reveals the privacy vs. accuracy tradeoff for a-LMDP, when implemented using PPEMs, is (at least) no worse than the tradeoff for DP; (iii) when PPEMs are trained to ensure both a-LMDP and DP, the results are comparable to using only DP; (iv) the non-negative normalized variant. of the KSD we propose Si, results in a more stable soft penalty, but retains the same test performance of 6; (v) the gradient stabilization strategy of PPEMs successfully prevents the instabilities which result when applying EnergyGAN and SteinGAN to tabular data.
12

---

Published in Transactions on Machine Learning Research (06/2023)
6 Discussion
We proposed a-LMDP, new privacy notion, and PPEMs, novel energy-based generative models which support training with a-LMDP as well as DP, if required. Our results confirm that PPEMs succeed in ensuring a-LMDP is satisfied while maintaining favorable privacy vs. fidelity tradeoff. Below, we discuss limitations of a-LMDP and PPEMs as well as potential broader impacts.
6.1 Limitations and Future Work
While a-LMDP provides a flexible framework for cases where data owner wishes to create general differences between an observed marginal distribution and the resulting generative distribution and achiove plausible deniability among these variables, does nol, however, guarantee that any specific individual function of these variables is different in the generative distribution, e.g. the mean of a specific variable. This is an important distinction between a-LMDP and the first proposed notion of attribute privacy in [Zhang et al. 2022): ; our approach provides flexible protection for a general distribution without parametric assumptions and requiring that specific functions are choosen to protect, whereas the first privacy notion in [Zhang el al. (2022) provides stronger protection for specific functions that are chosen, but with limitations on the types of functions that may be used and parametric assumptions for the distribution. A potential area of future research might, consider combining these approaches a generative model to offer flexible general protection for marginal distributions with stronger protection for specific sensitive properties.
There are several limitations of the PPEM architecture and training paradigm. In terms of the protection offered, PPEMs are limited in that they only offer protection for single marginal distribution, whereas in many cases there may be multiple disjoint sets of variables for which marginal distribution protection is required. The proposed setup requires these sets of variables to be combined into a single marginal distribution, which may be suboptimal in terms of generative fidelity, and there is no straightforward way to extend the PPEM model to enable protection for multiple disjoint variable sets without making additional assumptions. PPEMs also assume GAN style adversarial training procodure with energy models, whereas diffussion models (Sohl-Dickstein et. al., 2015) have gained prominence more recently, oflen outperforming GANs on tasks like image generation (Dhrrwaal& & Nichol 2021). It is not straightforward, however, how the KSD might be integrated into the diffusion model training procedure efficiently; the difficulties associated without incorporating the KSD into a generative model training procedure motivated our choice of energy models with adversarial training. Future work might address these limitations.
A more practical concern for the PPEM model is that when generating data, one might encounter generated a' which does not map to realistic outputs for x in the conditional model, since the conditional model is trained using only real data for x'. While did not encounter issues resulting from this in our experiments, the addition of sampling layer to the conditional architecture, as in variational autoencoders (Kingma & Welling 2014). might improve robustness.
Finally, future work might also consider other goodness of fit tests, such as the Finite Set Stein Discrepancy (FSSD) (Jitkrittum et al. 2017). which is more powerful test than the linear KSD, but difficult to incorporate into a soft. penalty that scales with the rejection level due to its null distribution.
6.2 Broader Impacts
As we emphasize throughout the paper, while a-LMDP protects sensitive aggregate level information about a data set., it does not protect the privacy of individual data points, which may be collected from individuals, DP does. The misapplication of a-LMDP with the expectation of the protection offered by DP could result in significant violations of the privacy of individuals. It is incumbent upon data owners and model builders to ensure the correct notion of privacy is used to achieve their desired privacy objectives.
While the first notion of attribute privacy introduced in Zhang et al. 2022 is closer to a-LMDP than DP, these two notions should also not be used interchangeably. As we note in section 6.1 a-LMDP provides flexible general protection for sensitive marginal distributions without specifying explicit functions to protect and making parametric assumptions, but does not guarantee any explicit function of the marginal distribution
13

---

Published in Transactions on Machine Learning Research (06/2023)
will be different from the data distribution in the generative model. This makes a-LMDP an optimal choice for cases where a data owner wishes to create plausible deniability across range of properties of the marginal distribution without assuming an explicit parametric model for the data distribution, but does require explicit differences across any specific functions, c.g. a mean. The use of a-LMDP in cases where a specific function must be different in the generative distribution may result in violations of the privacy of this function. Similarly, the use of the first notion of attribute privacy introduced in Zhang et al. (2022) in cases where protection is required for additional properties of the marginal distribution beyond linear functions or in cases where a multivariate Gaussian assumption is not appropriate may result in violations of aggregate dataset privacy expectations. Data owners must consider the competitive risks associated with leakage of different. types of aggregate level information and choose the appropriate privacy definition (or choose not to proceeed if neither suffice). While the potential impacts on data owners from misapplying these two notions of privacy have a distinctly different risk profile than failing to use DP when appropriate, it remains a significant risk when competitive information is disccrnible from aggregate properties of a datasct.
While training generative models with a-LMDP has similarities fair generative modeling (Choi al. 2020 which seeks to learn generative models with fairness properties, it is important to recognize that PPEMs (and other hypothetical models trained with a-LMDP) do not guarantee fairness propertics, regardless of whether protected variables like race or gender are included in the specified marginal distribution. The goal of fair generative modelling is often to ensure the resulting generative distribution is as close as possible to a target (unbiased) distribution; a-LMDP, however, seeks only to ensure the generative distribution is different from the observed data distribution, regardless of whether the resulting distribution is fair or unbiased with respect to any target distribution. Hence, including protected attributes in the marginal distribution for a-LMDP not only docs not guarantee fairness unbiasedness for these attributes, it could actually result in more biased generative distribution. It is thus incumbent upon model builders to be especially careful whenever protected attributes are included in marginal distributions when a-LMDP is applied and consider the implications of any biases that may be replicated or introduced by PPEMs both in general and in potential downstream applications. Fairness must always be always be evaluated separately from marginal distribution privacy.
References
Martin Abadi, Andy Chu, Andy Chu, Ian Goodfellow, Hugh Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein Generative Adversarial Networks. In Proceedings of the 34th International Conference Machine Learning, 2017.
Samuel A. Assefa, Danial Dervovic, Mahmoud Mahfouz, Robert E. Tillman, Prashant Reddy, Tucker Balch, and Manuela Veloso. Generating synthetic data in finance: opportunities, challenges and pitfalls. In Proceedings of the 1st ACM International Conference on Al in Finance, 2020.
Borja. Balle, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Tetsuya Salo. Hypothesis Testing Interpretations and Reayi Differential Privacy. In Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, 2020.
Anna Buczak, Steven Babin, and Linda Moniz. Data-driven approach for creating synthetic electronic medical records. BMC Medical Informatics and Decision Making, 10(1), 2010.
Tong Che, Ruixiang Zhang, Jascha Sohl-Dickstein, Hugo Larochelle, Liam Paull, Yuan Cao, and Yoshua Bengio. Your GAN is Secretly an Energy-based Model and You Should Use Discriminator Driven Latent Sampling. In Advances in Neural Information Processing Systems, volume 33, 2020.
Edward Choi, Siddharth Biswal, Bradley Malin, Jon Duke, Walter F. Stewart, and Jimeng Sun. Generating Multi-label Discrete Patient Records using Generative Adversarial Networks. In Proceedings of the 2nd Machine Learning for Healthcare Conference, 2017.
Kristy Choi, Aditya Grover, Trisha Singh, Rui Shu, and Stefano Ermon. Fair Generative Modeling via Weak Supervision. In Proceedings of the 37th International Conference on Machine Learning, 2020.
14

---

Published in Transactions on Machine Learning Research (06/2023)
Prafulla Dhariwal and Alex Nichol. Diffusion Models Beat GANs on Image Synthesis. In Advances in Neural Information Processing Systems, volume 35, 2021.
Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy. Now Publishers Inc, 2014.
Marco Galbiati and Kimmo Soramäki. An agent-based model of payment systems. Journal of Economic Dynamics and Coutrol, 35(6), 2011.
Damien Garreau, Wittawat Jitkrittum, and Motonobu Kanagawa. Large sample analysis of the median heuristic. CoRR, abs/1707.07269, 2018.
Ian Goodfellow, Jean Pouget-Abadic, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative Adversarial Nets. In Advances in Neural Informalion Processing Systems, volume 27, 2014.
Arthur Gretton, Karsten M. Borgwardt, Malte J. Rasch, Bernhard Schölkopf, and Alexander Smola. A Kernel Two-Sample Test. Journal of Machine Learning Research, 13:723-773, -73,, 2012.
Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Improved Training of Wasserstein GANs. In Advances in Neural Information Processing Systems, volume 30, 2017.
Jamie Hayes, Luca Melis, George Danezi, and Emiliano De Cristofaro. LOGAN: Membership Inference Attacks Against Generative Models. In Proceedings Privacy Enhancing Technologies, volume 1, 2019.
Wittawat Jitkrittum, Wenkai Xu, Zoltan Szabo, Kenji Fukumizu, and Arthur Gretton. A Linear-Time Kernel Gfodness-of-Fit Test. In Advances in Neural Information Processing Systems, volume 30, 2017.
Alistair E.W. Johnson, Tom J. Pollard, Lu Shen, Li wei H. Lehman, Mengling Feng, Mohammad Ghassemi, Benjamin Moody, Peter Szolovits, Leo Anthony Celi, and Roger G. Mark. MIMIC-III, a freely accessible critical care database. Scientific Data, 3(160035), 2016.
Diederik P Kingma and Max Welling, Auto-Eng Variational Bayes. In Proceedings of the 2nd International Conference on Learning Representations, 2014.
Qiang Täu, Jason Lee, and Michael Jordan. A Kernelized Stein Discrepancy for Goodness-of-fit Tests. In Proceedings of the 33th International Conference Machine Learning, 2016.
Sharyl Nass, Laura Levit, and Lawrence Gostin (eds.). Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. National Academies Press, 2009.
Nicolas Papernot, Shuang Song, Tya Mironov, Ananth Raghunathan, Kunal Talwar, and Ulfrr Erlingsson. Scalable Private Learning with PATE. In Proceedings of the 2018 International Conference on Learning Representations, 2018.
Yubin Park, Joydeep Ghosh, and Mallikarjun Shankar. Perturbed gibbs samplers for generating large-scale privacy-safe synthetic health data. In Proceedings of the 2013 IEFF International Conference on Healtheare Informatics (ICHI), 2013.
Andrea Dal Pozzolo, Olivier Caclen, Reid A Johnson, and Gianluca Bontempi. Calibrating probability with undersampling for unbalanced classification. In 2015 IEEE Symposium on Computational Intelligence, 2015.
Saeed Saremi, Arash Mehrjou, Bernhard Schölkopf, and Aapo Hyvärinen. Deep Energy Estimator Networks. CoRR, abs/1805.088 083066 2018.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. In IEFE Symposium on Security and Privacy, 2017.
15

---

Published in Transactions on Machine Learning Research (06/2023)
Jascha Sohl-Dickstein, Eric A. Weiss, Niru Mahoswaranathan, and Surya. Ganguli. Deep Unsupervised Learning using Nonequilibrium Thermodynamics. In Proceedings of the 32th International Conference Machine Learning, 2015.
Charles Stein, Persi Diaconis, Susan Holmes, and Gesine Reinert. Use of exchangeable pairs in the analysis of simulations. In Stein's Method: Erpository Lectures and Applications. Institute of Mathematical Statistics, 2004.
Anshuman Suri and David Evans. Formalizing and Estimating Distribution Inference Risks. In Proceedings Privacy Enhancing Technologies, volume 22, 2022.
Dilin Wang and Qiang Liu. Learning to Draw Samples: With Application to Amortized-MLE for Generalive Adversarial Learning. Proceedings of the 2017 International Conference on Learning Representations, 2017.
Mark Weber, Jie Chen, Toyotaro Suzumura, Aldo Pareja, Tengfei Ma, Hiroki Kanezashi, Tim Kaler, Charles E. Leiserson, and Tao B. Schardl. Scalable Graph Learning for Anti-Money Laundering: A First Look In NeurIPS 2018 Workshop on Challenges and Opportunities for Al in Financial Services: the Impact of Fairness, Explainability, Accuracy, and Privacy, 2019.
Magnus Wiese, Robert Knobloch, Ralf Korn, and Peter Kretschmer. Quant GANs: deep generation of financial time series. Quantitative Finance, 20(9):1419 1440, Apr 2020.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially Private Generative Adversarial Network. CoRR, abs/ hbs/1802.06633, 2018.
Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Modeling Tabular data using Conditional GAN. In Advances in Neural Information Processing Systems, volume 32, 2019.
Jinsung Yoon, James Jordon, and Mihaela van der Schaar. PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees. In Proceedings of the 2019 International Conference on Learning Representations, 2019.
Wanrong Zhang, Olga Ohrimenko, and Rachel Cummings. Attribute Privacy: Framework and Mechanisms. In Proceedings of ACM Conference on Fairness, Accountability, and Transparency, 2022.
Junbo Zhao, Michael Mathieu, and Yann LeCun. Fnergy-based Generative Adversarial Networks. Tn Proceedings of the 2017 International Conference on Learning Representations, 2017.
16

---

Published in Transactions on Machine Learning Research (06/2023)
A Pseudocode for Training and Sampling
A Algorithm 1: Training
Energy Models
for iterations to Tg do for iterations to Tи do
Sample minibatch of real data {af 22
Sample {==}==1 ~ -N (0),
Ii) and {=t ~ (0v, (N Iv)
Sample {ui) ~ Unif 1)
{Lg (1/ 20)i=1 - { (x() + +Im-&
& (ci(2))))* 1
(K) {ur} + (1 u.) (=))
j= A1. Vo7 (it) ||2 -1) ()]
{PE (xl, 2i)
i=1
Pe + da
F
(1 - a) - Sn (par,Pe) PP)
xi
lolt + {Ve [e (1/1 21) + Ps (I 21) 1 }" Jiml
(Thy (1,,, + Ey (x (2 + (m - Ey (9. (2/104) 1o0)+
(a + {uaat + (1 u: g
d V Ey (B:) 1 - i=1
n
{Pr (2t (z =
(0 - {V> (Ln (xj, 24, xf{) + P4 (1 2/4 x()) 1
if differentially private then Sample w ~ N (0 C² (4))
(0w {0r / max (1, lollla
Sample v ~ N (0/z), C202 (12))
tot - 96 max (1,
1
C
+ ADAM
1 1
i= g2.EE) i 95,7 7)
Y + ADAM
ADAM(2
Σ E (Gw (2x)) ..) Di=1 VeE, (Go (z/1=1) (x4) 6)
ADAM(
Algorithm 2: Sampling from Privacy-Preserving Energy Models
Sample { N (O,, La) and {x N (0æ, Ix)
{a/ + [9w (+:)),
[ā t (Go (2(1x)))= (aakee
{al, K
B Proofs of Theorems
B.1 Proof of Theorem 2.1
Proof.
Let X' = BB) be a bounded interval on R, X a random variable on x with CDF Fx(x) = i.c. the dimensions are independent Uniform(B, B') variables and D2 {n,)6_ a datasct sampled according Fx.
2-B
1= B B
17

---

Published in Transactions on Machine Learning Research (06/2023)
Let M be mechanism which always returns generative model 9 which is collection of d independent random number generators over X' which generate values for each dimension of X.
Now define D = {y)== to another dataset sampled according to Fx such that D3 and Dy differ by only one datapoint and define S _ Range(M).
Since M always returns collection of random number generator X' for each dimension of z, the following equivalence holds trivially for any such D, and Dy:
P(g(D,) E S] = e s]
It follows that for c, 5 e R++ the following inequality holds:
P P(G(D2) exp(e)P(((D,) 8
8
Thus M is a (e, dddifferrrel private for any e Rt.
However, since 9 generates values uniformly between and B' for cach dimension of x, Jimi ~ Pg, for any partitioning x x²) Thus, for a 1, level-a goodness of fit test will fail reject Ho { po so MM is not guaranteed to return generative models which satisfy a-LMDP for any 1.
B.2 Proof of Theorem 2.2
Proof.
Let Dr = {2 and D, 10 be two datasets which differ by only single datapoint and let 1 be the index of the datapoint for which these two datasets differ.
Let M be a mechanism which always returns a generative model G that a biased identity function, iee. G reproduces elements from the imput dataset {= non-uniformly, with the specific bias that returns x1 with probability and all other elements with probability
Thus, for any partitioning of the dimensions of x, x = {a', xx), pg., is single point mass distribution so any level-a goodness of fit. test with sufficient, power will reject Ho : {x/)== ~ Pg, unless the underlying distribution from which {a is sampled is a single point mass. Thus, M is guaranteed to return a generative model which satisfies a-LMDP whenever the underlying distribution is not a single point mass.
Let S C Rango(M) consist of single element which is the generator that returns æı with probability 1. Since 1 is the index of the element for which D, and D, dilfer, we have the following:
[(M(D2) E $]=1 =1 IP (MM(),, E ES]=0 =
The definition of differential privacy is equivalent to the following inequality holding with probability 1 8 for every S Range(MM) (Dwork & Roth 2014h:
P [M ES SE
log
P MM E 8*)
Since when S' = S, this inequality only holds for 0o, M not (DP for finite e, e,
7
18

---

Published in Transactions on Machine Learning Research (06/2023)
B.3 Proof of Theorem 3.1
We first consider the marginal model system (5) in section 3 of the main text. We note that Vm (5, w) and (E w) are equivalent to V(G, D) and UGG, D) in (Zhao et al. 2017) for x'. Thus by Theorem 1 in (Zhao let al. 2017), it follows that if ((",w")) is a Nash equilibrium for (5), then Pw= = Px almost everywhere and Vi (5",
",ww") = m.
Now we consider the conditional model system (6) in section 3 of the main text. Using the same proof technique as for Theorem in (Zhao al.) 2017) with modification to account for our partitioning of into fa", ,"",,, we can show that 9u produces samples that are indistinguishable from the conditional distribution
of x² given x' in the real data.
First, we observe the following:
Ve(r,u*) = S. [ + fo (2 Im - E, (Gu- (2'1=")|=')) de'da'
(19)
= =1 (o (x')
(x" (1')
+ Po (x 1a )p (2') im - E,, (x (x")x"))*) dx
(20)
From Lemma 1 in the appendix of Zhao el al. 2017), the analysis of the function (l() = ay + blm v) shows:
(a) (x-(x=)=)) S m almost everywhere. To verify, assume there cxists a set of measure non-zero such that (x'(x"))) m and let Eg(x* (x') min(E,- (x*|="), [a'),,) m). Then Va(7, < Va(r", w*) so (7", u*) is not a Nash equilibrium.
(b) 1o reaches its minimum in m if a b and in 0 otherwise Vo(7, u*) reaches its minimum when we replace E.¹ by these values. We thus observe the following:
VelT", m J( Pa- (o"l"""))))))))))) (t)) (o (e Pe (x" /os D (a' ydr
+ m / Pa (e P (x" la' yo (xe dd
(21)
m
Pa (o))
pp (x
+
1p at w (2)))))) (1r1)))) pu- (x /2' pe (x' )dx
(22)
Por (x lxx y (xd)) (dz
+ m
Por (e (oo) (ar (o") Pu- (2x") Pe (2d (a')da
(23)
m /
11 Parpurte (p)) (e))
Pu (x" (x=))a)))) Per (xd )dr
(24)
Since the second term in 24 above non-positive Vel." w²) S m. Now, putting the ideal conditional generator into the right side of Uc(T", "e(r","²) v²) & Uc(T", (u), we get:
[ po )pr (2') (4" do S f Par (o')x') pe (x') En. (x (x"))'") ( dr (p'
(25)
Thus by 20 above, we get the following:
[ (po (x-) (x* p (x (er im Ex- (o*lx'))+) do S ve(r",u"))
(26)
Since Ey. (x*(x') S m, we get m S Ve(1",20 v²). Thus since Velr", (+)) bounded above and below by m, we have V.(7*, v²) m.
19

---

Published in Transactions on Machine Learning Research (06/2023)
Now by 24 above that Ve(y", v²) m can only happen when Sz 1 pp of tor (=r""="") (=)) (27)2))) = 0 equivalently Jrr pp (er1a))) (ar)) = 0. Since Pa (x" |a pa (x') and pv- (x* (x*|2" Pe (a") are probability densities for æ, by Lemma 2 in the appendix of (Zhao et al. 2017) this is true if and only if Pe (="(>²)) [x')))))))))) )p=)((²)) Pu- (a*(=") (2') almost everywhere or equivalently Par lar (x="(((=]))))) (x"|2") = Po (x" almost.
everywhere. Thus, we have Pw Po = ProPa = Pa almost everywhere.
B.4 Proof of Theorem 3.2
We first consider the marginal model system (5) in section 3 of the main text. We note that Vm (5, w) and Um (5. w) are equivalent to V(G, D) and UGG in (Zhao et al. 2017) for x'. Thus by Theorem 2 in (Zhao et al. 2017], it follows that Nash equilibrium for (5) exists and is characterized by Pw = Pz almost. everywhere and there exists a constant Vn E [0, m] such that (x- = Um almost everywhere.
Now consider the conditional model system (6) in section 3 of the main text. Using the same proof technique for theorem 2 in the appendix of (Zhao et al. 2017), it follows that Nash equilibrium for (6) exists and is characterized by P.- [a almost everywhere and there exists constant Ve E [0, m] such that Ey. 55.(x11z) = Ve almost everywhere.
As in theorem comes thcorem 3.1. The necessary condition (="("==)) S comes from the proof of theorem 3.1. Now we assume Exp- (x* (x') is not constant and arrive at contradiction.
(Zhao et al. 2017), the sufficient conditions are obvious. The necessary condition on Go-
If (xy-(x0 (x (x*(x') is not constant, then there is constant C and set S of non-zero measure such that Va e S, En. Ex-(xxpp (x)) & C' and Vr & S, Eye (x"(x") > C. We can choose S such that there exists S' C S of non-zero measure such that Pe (x') > on S. We can build a generator Go such that po (x (x*(x²²) S Px a (2*1x²)
on S and po (x'"">)' < Pa (x (x') on S' We get the following:
Ud(Y", Uc(T".0)
(por)) p=(x" p (x))) (x=l=)/a
(Porje) - -oe---el0aaa (2)) (x (E (x="x=)) O)
(P=-)= - -pocdll))ppppopppppp Par (x') (E (x - C) dr
+ { Jons (per)a ( p (x (E,- (0 - C) dr
> 0
Then "e(y",u") > Uc(r", 0) so (7), ) is not Nash equilibrium.
B.5 Proof of Lemma 3.1
Proof.
We can write St, as follows:
[[n/2] - 1) E!'/2
[n/2] ue 2 x221
(p.
[n/2] E|m/21 My (12)-11 x2i )
2
(|n/2] 1)
I|m/2 nn/2
( x22))
1n/21 Mn (2 (222 12
Ln/2]
=((z)
20

---

Published in Transactions on Machine Learning Research (06/2023)
where
Σ nn/2 i= Ug
(221
n/22
g(z)
x²
n//2]
Σ Ug (2(222-11) I25) )
[n/2]
From (Liu et al. 2016), the above quantity |n/2] - Σ
Ug (221-1, has an asymptotic N (0. Liml
[n/2]
distribution under the null hypothesis q. Thus, since
1n/2|
My (m 0 and x² is symmetric and
[w/2]
monotonically decreasing for x S 0 and monotonically increasing for x 2 0, using the change of variables formula, St,, has the following density function:
J8 (v) 25 (g (v)) dg (y)
dy
where
/ ||m//] 1 My (I2: x22))
|n/2]
dg (y)
Σ In/2]
Ei=1
ug (2(222 x22)
g (v)
[n/2] -1
dy
V
(Ln/2 / 1)y
Thus, we can write the density function for Se,n follows:
(B) 2.z (9 (w)) dg (w)
dy
(v))
dg dg)((y)
= exp
V 2TOP
20
dy
[n/22
My (1P21 2212)
==1 Ug M1(2221-1 12x)
In/2]
[n/2] -1
exp
2TT 2
20
(1n/2) - 1)y
Now plugging the sample variance estimator for oug we get the following
LL//2) My (120-1
In/21 Wg([22i 226)
18.. (1)= = 2
2TO2 uq
exp
n// -1
20
1=1
(nn/2] 1)y
exp
2mry
2
(-)
I (1/2) 21/2
exp
which is the xi density function
B.6 Proof of Theorem 3.3
Proof.
By Lomma 3.1, Stn has an asymptotic x? distribution under the mull hypothesis p = 9. Thus, the quantity F a) > Sen(per.P if and only if (1 ,Pe) falls outside of the rejection region of a level-a test for the null hypothesis {a Pe for a minibatch {x
Now consider the possible parameter settings for & and partition them into Treject and Mfatl where Trejeet consists of all settings of & such that Ho {2/) ~ pş is rejected using the above test and Afait consists of all
21

---

Published in Transactions on Machine Learning Research (06/2023)
other settings. Define the following quantities (where Lg (2%, 21) and P (2%, 24) defined as in Algorithm
I):
Σ (2), 21) + P (1), da F (1 a.) S1.n Sp.,
Sroject arg min SEtragect
fal arg min ÇEnfau
Σ
[Te (1l 2.) P (1d, + Xa F (1 a) Sn, (p (p=r
From the above observation from Lemma 3.1, we have the following:
Aa
F (1 - a:) S1,m (Par' Prresaoe
Xi
Aa
F=1 (1 - a) (por PSjunl
>
Define Lę as follows:
Lg Σ
Le (1 24)+ + p (x(),21)
Now assume that for some iteration of the outer loop of algorithm 1, converges to global optimum 8* in the inner loop. If g- = Ejau then we have the following:
Teejon + da
F- (1 a1) -S,,
Tigiefoot Na F (1 a.) (t,n(P=',Pt ]
Xi
Lejau + da
F Xi
(1 a) - -p Pra))
Le
Legeeect
Na
F (1 a) St, PP
Leveesst LEj
Thus, there cxists Aa > Aa, such that if we replace Aa with da' the above incquality would be reversed and we would have 5* = Freject Thus, for sufficiently large Aa, when Algorithm is trained lo convergence in the inner loop and reaches global optimum, we can reject Ho ) ~ Pe using the above test.
Now, let Pu be representation for the generative distribution of G. When the inner loop of Algorithm 1 is trained to convergence and reaches a global optimum with sufficiently large Xa Go observes x' indirectly through & "gj From the data processing inequality, we have
DEL(Per (PLlffeee Il Per 2 (Pe (olP
Thus, rejection of the level-a test for fo' 1 ~ Pş entails rejection of the level-a test for {a' (r)) ~ Pw-
C Dataset Descriptions
C.1 1-D Gaussian Mixture Models to Compare the Distributions of St,, and S
Below are the randomly chosen parameters for the 1-D Gaussian Mixture Model used evaluate the distributions of $ and S when p q and p # 9-
Mixture Weight
0.2
6.9734
0.2622
0.2
7.1579
0.9046
0.2
2.4358
0.4533
0.2
9.2579
0.0773
0.2
3.0420
0.7823
22

---

Published in Transactions on Machine Learning Research (06/2023)
C.2 Kaggle Credit Card Fraud
This dataset consists of 284,807 credit card transactions made by European cardholders which occurred during two days in September 2013 (Pozzolo et al., 2015). Each transaction record includes 28 continuous variables which result from a PCA transformation (the original variables as well as descriptions are unavailable due to confidentially) as well as the time and amount of the transaction and a binary indicator of whether the transaction was fraudulent. The dataset highly imbalanced; fraudulent transactions make up 0.172% of all transactions. We exclude the time variable in our experiments, treating each transaction as occurring independent of all previous transactions and standardize the variables before training. The license for this dataset is available al https:://peenaaaccomme
org//iceesss//bell/11
C.3 MIMIC-I11 Critical Care
MIMIC-III (Medical Information Mart for Intensive Care) is publicly available (subject to approval) electronic health care record (EHR) dataset that is widely used as benchmark (Johnson al. 2016). It includes data associated with 53,423 distinct hospital admissions to critical care units between 2001 and 2012, e.g, vital signs, medications, laboratory measurements, observations and notes charted by care providers, fluid balance, procedure codes, diagnostic codes, imaging reports, hospital length of stay and survival data. The license for this dataset is available at httpp:://hyssionet. wwwp://www...ooooooooeeooeeeeeee
Please see hattps:/mmmiis mit. mit. edu/iii/about/ and (Johnson et al., 2016) for details regarding personally identifiable information and obtaining consent as well as requirements for researchers use MIMIC-111.
For dalaset construction, we follow the same procedure as in (Choi el al. 2017 and (Xie et al. 2018 focusing on only the ICD-9 codes for each patient. TCD-9 codes (International Statistical Classification of Diseases and Related Health Problems) identity a particular disease or health problem that a patient has been diagnosed with during a hospital stay. We group ICD-9 codes according to their first 3 digits, which results in 1071 possible diagnoses for each hospital stay. We then construct longitudinal health records for each patient {0, 111071 such that each ICD-9 code group coded as 0 if the patient received or never received the diagnosis during any recorded hospital stay, respectively. This results in 46,520 individual longitudinal patient health records which each contain 1071 binary attributes.
D Experimental Settings and Additional Results
D.1 Hyperparameters
Below the hyperparameters used in all experiments with PPEM models:
m 10
A₂ = 10
AD = 1
Training epochs 100
Minibatch size 128
Number of energy model iterations per generator iteration
MLP layer dimensions (all networks) 256
Latent dimensions (both generators) 128
Generators learning rate = 5e
Encrgy models learning rate = le
a-level 0.05
(e, (1, n 1)
For DP-GAN and PATE-GAN, we use the public implementation drivate-data-geeerate with the default settings.
https://githibb.co///reee..
D.2 Environment
All experiments were run using single NVIDIA T4 GPU.
23

---

Published in Transactions on Machine Learning Research (06/2023)
D.3 KSD and MMD Test Statistic Values
Below are the KSD test statistic values and p-values resulting from the bootstrap test to evaluate fitness of the real attributes which require a-LMDP protection to the learnt marginal energy distribution.
Kaggle Credit Card Fraud
KSD
p-value
PPEM (2)
220.2
0.00
PPEM 5
60.86
0.00
PPEM
2 + DP
131.9
0.00
PPEM
55)
+ DP
213.6
0.00
MIMIC-III EHRs
KSD
p-value
PPEM (50)
77.16
0.00
PPEM (200)
162.9
0.00
PPEM (50) + DP
18.48
0.00
PPEM (200) + DP
241.7
0.00
Below are the MMD test statistic values and p-values to evaluate whether the samples generated from each model for the attributes requiring a-LMDP protection are from the same distribution as the real private attributes.
Kaggle Credit Card Fraud
MMD
p-value
WGAN (No Privacy)
0.0417
0.15
Enl (No Privacy)
0.5891
0.00
SteinGAN (No Privacy)
0.1445
0.00
PPEM (2)
0.0530
0.02
PPEM (5)
0.0667
0.00
PPEM (2) DP
0.0571
0.01
PPEM (5) + DP
0.1570
0.00
DP-GAN
0.0968
0.00
PATE-GAN
0.1075
0.00
D.4 Comparison of PPEMs with a-LMDP to DP applied only to x!
We include an additional experiment where compare PPEMs with a-LMDP to only applying Differential Privacy to the attributes x' to directly compare the impact to fidclity for these two different privacy penalties. To train with DP applied to only x', we using the same model and training procedure as for PPEMs, but we do not include the KSD-based penalty and perturb gradients in the marginal model, but not in the conditional model. We apply this procodure the Kaggle Credit Card Fraud dataset and compare the results to PPEMs with L-D. Below, we show the KSD test results on the private attributes and the classification and regression results in the experiments in the main paper when s' includes 2 and 5 attributes.
24

---

Published in Transactions on Machine Learning Research (06/2023)
KSD
p-value
AU-ROC
MSF
R²
0.05-LMDP
220.2
0.00
0.922
0.184
0.822
(1,n-))-DP
7.181
0.00
0.903
0.602
0.421
0.05-LMDP
60.86
0.00
0.948
0.196
0.812
(5) (LD
1.212
0.00
0.891
0.720
0.307
We observe that training with both penalties results in models which satisfy a-LMDP, but the regression and classification performance is stronger for the PPEMs trained to ensure a-LMDP, indicating the KSD-based penalty has a weaker impact on the fidelity the resulting models than DP. These results argue that PPEMs trained ensure o-LMDP have a favorable fidelity vs. privacy tradeoff.
25


Reviews:
[{"review_id": "lMLpTliclC", "reviewer": "Reviewer_nErC", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- interesting problem, different from differential privacy\n- the approach is interesting\n- overall the paper is well-written\n- experiments are comprehensive\n\nWeaker ponts:\n- privacy definition is not close to the strength of commonly accepted privacy definitions\n- though the method is interesting, it protects against a very specific adversary (doing hypothesis testing)\n- the definition and method are dataset dependant (not mechanism) which is not considered strong for data protection in DP", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper considers privacy of marginal generative distribution behind some attributes of the data. This differs from differential privacy (DP) that considers privacy of an individual and is close to the recent work on confidentiality and privacy of dataset properties and distributions.\nThe authors propose a definition to capture the new notion of privacy based on goodness of fit test and relies on hypothesis testing. The authors show that their definition is orthogonal to DP (as one would expect).\nThe paper proposes a method for generating synthetic data that reproduces data close to the data based on non-protected attributes (using energy and GAN-like method).\nThe authors also provide experiments based on two datasets and evaluate privacy of their method using the goodness of fit test.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper is overall sound wrt the claims it makes and it considers an interesting problem. If it was not in the area of privacy I believe its definition and techniques would be fine as in average case the method would work. Unfortunately privacy is a complex topic and making assumptions about what an adversary can do has been shown error prone (e.g., k-anonymity). In particular, the paper defends against an adversary that when trying to detect if data is distributed according to some distribution or not, will only do a goodness of fit test. This is a strong assumption as adversary could test for other properties and infer something about attribute distribution, thereby, leaking the information that needs to be protected. Similarly the method is based on training a neural network which is not optimal, hence, even the method itself may not satisfy the original definition (even if the definition was a strong privacy definition). The authors could consider their definition in view of other definitions to capturing dataset privacy or how one can considers DP protection in the hypothesis testing context:\n\"Hypothesis Testing Interpretations and Renyi Differential Privacy\" by Balle et al AISTATS 2020\n\"Attribute Privacy: Framework and Mechanisms\" by Zhang et al. FACCT 2022\n\"Formalizing and Estimating Distribution Inference Risks\" by Suri and Evans PETS 2022", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "XpbBINHVlL", "reviewer": "Reviewer_KKXi", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths:**\n- The paper is well written and easy to follow.\n- The motivation is clear and the proposed $\\alpha$-LMDP criterion is novel to my knowledge (although I am not an expert on the privacy-preserving literature).\n- The theoretical additions to the paper are also good (showing that DP and $\\alpha$-LMDP are, in a sense, orthogonal, and extending the EnergyGAN optimality proof).\n\n**Weaknesses:**\n1) I think the relation between GANs and energy models is not very clear from the paper. In particular, (6) and (7) are the training criterion of EnergyGAN, which interpretes the discriminator of the GAN as an energy function. This is also stated in Section 4.3 in the paper. I think it would be easier for reading to move this to *3.1 Background* and simplify the description in *3.2 Proposed Model*. \n2) I am not sure I fully understand the experimental evaluation. In particular, in Table 1 almost every method has a p-value for MMD < 0.05. Does this mean that the original problem was not very significant to begin with? There is literature [1] on generating data with realistic marginal distribution (which is the opposite problem as to here) which also points to this as potential conclusion.\n3) I am also curious about why the proposed PPEM can improve the AUROC compared to the EnergyGAN while being almost identical in training. \n4) Finally, why is the MMD test not replicated also for the MIMIC dataset?\n5) The sentence \"PPEMs are the first energy-based models with privacy-preserving properties\" is quite strong. Again, I am not an expert but a very quick search found [1] and [2] on Scholar (diffusion models being strongly linked with energy-based models).\n\n[1] https://arxiv.org/abs/2105.06907\n[2] https://openaccess.thecvf.com/content/CVPR2022/papers/Chen_DPGEN_Differentially_Private_Generative_Energy-Guided_Network_for_Natural_Image_Synthesis_CVPR_2022_paper.pdf\n[3] https://arxiv.org/abs/2210.09929", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper considers a new formulation of privacy in generative models, in which we are interested in protecting the marginal distribution of some protected attributes of the generated data. They term this **$\\alpha$-Level Marginal Distribution Privacy** ($\\alpha$-LMDP), and they argue it can be important for, e.g., financial institutions interested in sharing fake generated data while also hiding aggregate statistics on their consumers.\n\nThe way they approach the problem is to decompose the original distribution $p(x)$ into a distribution on protected attributes $p(x')$ and a conditional distribution $p(x^* | x')$ on the remaining attributes. These are implemented as two separate generators, which are trained with an energy-based criterion that interprets the discriminator of the GAN as an energy function (EnergyGAN). They show that under this interpretation, adding the $\\alpha$-LMDP term as regularization can be done efficiently by using the score function of the energy function and the Kernel Stein Discrepancy criterion.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "* (Optional) Reformulate the discussion as per point 1) above.\n* I am curious about the section \"3.4 Optimality of the solution\". Upon first reading, it appears to be very similar to the optimality proof from the EnergyGAN paper, by considering a factorization of $p(x)$ in two parts. While I am not suggesting to remove this proof, it would be interesting to discuss if there are technical difficulties in extending the EnergyGAN proof here, or if this is, in some sense, a simple extension.\n* Clarify the experimental evaluation as per points (2), (3), and (4) above.\n* Amend the claims of the paper in accordance to point (5) above.\n* I would also suggest to discuss the relation of this paper with fair generative modeling, where the aim is to generate data whose distribution w.r.t. (possibly unobserved) latents is as uniform as possible.", "broader_impact_concerns": "As the paper is discussing ways to mitigate the impact of releasing generative models in certain contexts, I believe there are no specific concerns to discuss.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "0lJUxxTPWC", "reviewer": "Reviewer_mZ5y", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Disclaimers:\n- while familiar with the GAN and differential privacy literature, this reviewer is not an expert at either.\n- in particular, examining the proofs in appendix B, section 5+ is beyond my level of mathematical understanding of the problem.\n\nStrengths:\n- Relevant problem, which adds a new conceptual tool to the portfolio of differential privacy with strong potential for practical utility.\n- Well written paper, clear and detailed.\n- Elegant, general approach to solving for this new DP definition.\n\nWeaknesses:\n- I would have appreciated some commentary on how this may apply to generative models that are not GAN. In many applications, Diffusion Models or even Transformer models trained on a generative objective are completely replacing GANs due to their improves simplicity and ease of training.\n- There is no limitation section. I would have appreciated to read about things that were attempted and didn't work, or any identified limitation of this work beyond the superficial treatment given to it in the Conclusion.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "\nThis paper proposes a new class of differential privacy which protects against the discovery of certain marginal distributions in the data generated by a generative model. These marginal distributions can represent protected demographic or business attributes that the model designer does not want leaked through examining the model output.\n\nThe paper proposes a method for training a certain class (GAN-based) of generative models in a manner that preserves this new differential privacy definition, and demonstrates its effectiveness on a number of tabular benchmarks.\n", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Nits:\n- The title of the paper does it a disservice by not mentioning at all the 'Marginal Distribution Privacy' concept, which is much more central to the contribution than the solution happening to be 'energy-based'. I wouldn't request to change it per se, but encourage the authors to reconsider it.\n- In the first equation in Section 2, the symbol P() is not defined. People may reasonably be expected to understand it's a probability distribution, but unless they are very versed in differential privacy, they may not immediately know a distribution over what. Should be clarified.\n- '\\alpha-Level' is not defined until Definition 2.2: 'a level-\\alpha goodness of fit test' - even that definition is not entirely illuminating until much later in the paper where is is made more clear that \\alpha is meant as what's usually called the '\\epsilon' confidence level of the test. Qualifying what this \\alpha is should be unambiguous and happen much sooner.\n", "broader_impact_concerns": "It would have been interesting to reflect on the fact that this setting basically enforces that the data generated doesn't match the distribution of a protected category. While it may be desirable in the context of preserving privacy, the notion that data that will be used by a downstream application to be inherently non-reflective of the real distribution of a protected attribute is potentially concerning. For example: if the attribute is ethnicity, may it induce the model to generate data that is more or less diverse than reality? How would the end-user be able to tell that they're not exploiting that biased protected category distribution? This is generally not an issue differential privacy has to reason about, because it concerns itself with individuals, but in this setting, it may matter quite a bit.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Reviewers KKXi and mZ5y found the paper strong and were happy with the authors' responses to their reviews.
Reviewer nErC was still worried that the privacy guarantee is weaker in nature than DP and attribute privacy, but this is openly discussed in Sec. 6.1 and the reviewer agreed that the paper meets TMLR acceptance criteria.
Decision: Accept (poster)