Title: Functional Renyi Differential Privacy for Generative Modeling
Venue: NeurIPS 2023
Accepted: yes
Keywords: Renyi differential privacy

RKHS

MMD

Gaussian process

generative model
Abstract: Differential privacy (DP) has emerged as a rigorous notion to quantify data privacy.  Subsequently, Renyi differential privacy (RDP) becomes an alternative to the ordinary DP notion in both theoretical and empirical studies, for its convenient compositional rules and flexibility. However, most mechanisms with DP (RDP) guarantees are essentially based on randomizing a fixed, finite-dimensional vector output. In this work, following Hall et al. (2013) we further extend RDP to functional outputs, where the output space can be infinite-dimensional, and develop all necessary tools, *e.g.*, (subsampled) Gaussian mechanism, composition, and post-processing rules, to facilitate its practical adoption. As an illustration, we apply functional RDP (f-RDP) to functions in the reproducing kernel Hilbert space (RKHS) to develop a differentially private generative model (DPGM), where training can be interpreted as iteratively releasing loss functions (in an RKHS) with DP (RDP) guarantees. Empirically, the new training paradigm achieves a  significant improvement in privacy-utility trade-off compared to existing alternatives, especially when $\epsilon=0.2$. Our code is available at https://github.com/dihjiang/DP-kernel.

Functional Rényi Differential Privacy for Generative Modeling

Abstract

Differential privacy (DP) has emerged as a rigorous notion to quantify data privacy. Subsequently, Rényi differential privacy (RDP) has become an alternative to the ordinary DP notion in both theoretical and empirical studies, because of its convenient compositional rules and flexibility. However, most mechanisms with DP (RDP) guarantees are essentially based on randomizing a fixed, finitedimensional vector output. In this work, following Hall et al. [12] we further extend RDP to functional outputs, where the output space can be infinite-dimensional, and develop all necessary tools, e.g. (subsampled) Gaussian mechanism, composition, and post-processing rules, to facilitate its practical adoption. As an illustration, we apply functional RDP (f-RDP) to functions in the reproducing kernel Hilbert space (RKHS) to develop a differentially private generative model (DPGM), where training can be interpreted as iteratively releasing loss functions (in an RKHS) with DP guarantees. Empirically, the new training paradigm achieves a significant improvement in privacy-utility trade-off compared to existing alternatives, especially when ϵ = 0 . 2 . Our code is available at https://github.com/dihjiang/DP-kernel .

1 Introduction

Modern machine learning has achieved impressive success thanks to the availability of big data and computing resources. However, there are increasing privacy concerns when training with personal or sensitive data. Differential privacy [DP, 8] has become the de-facto standard technique for releasing statistics of sensitive databases, which is designed to bound the output change of a randomized mechanism M given an incremental input deviation, such that M does not depend too much on any individual point in the dataset. Recently, Mironov [23] generalizes DP to Rényi differential privacy (RDP) through α -Rényi divergence [26], which shares many properties with the ordinary DP, yet with tighter and easier composition analysis, thereby attracts more attention in practice.

The popular mechanisms (e.g. Gaussian or Laplace) towards DP or RDP essentially randomize a finite-dimensional vector output with (Gaussian or Laplace) noises. However, if we want to privately release a function , vector-based DP mechanisms are not readily amenable, because a function over a real-valued domain is characterized by infinitely many points [12], which will lead to ∞ bound on the L2/L1-sensitivity if we follow the same sensitivity analysis in Dwork and Roth [9] for the vector output, and will effectively lead to infinitely large Gaussian/Laplacian noise and is impractical. Moreover, it is unclear how to add noise to an infinite-dimensional output. Examples that require a functional DP mechanism include privately releasing the reward function in reinforcement learning [32], the kernel function in kernel density estimation and kernel support vector machine (SVM) [12], and the kernel function in DPGM in this work.

Hall et al. [12] made the most fundamental contribution to extending DP from vectors to functions. Essentially, the functional Gaussian mechanism is achieved by adding a sample path of Gaussian process to a function, in contrast to adding Gaussian noise to a vector. Evaluating the released DP function at arbitrarily many points (which will form a vector) will retain the same DP guarantee. It is worth mentioning that there are no composition theorems and subsampled Gaussian mechanisms developed for functional DP in Hall et al. [12], thus restricting its use in deep learning.

Due to the theoretical convenience and practical flexibility of RDP, in this work, we aim to extend RDP to functions, with all necessary tools to facilitate its adoption in deep learning. Furthermore, we demonstrate its value via a particular application in DPGM where the loss function is in an RKHS. Our contributions can be summarized as:

Theoretically, we develop the functional RDP, which is equipped with many useful tools including (subsampled) Gaussian mechanism, composition, and post-processing theorems. We will show that functional RDP will share many important properties and results with the vector-based variant.

Empirically, with functional RDP, we propose a novel DPGM training paradigm by privatizing the loss function in an RKHS, rather than truncating the RKHS to a finite-dimensional space and injecting Gaussian noise therein as in existing works. Our method is evaluated and compared across a wide variety of image datasets and DP guarantees, where our method consistently outperforms other baselines by a large margin. Notably, our method indicates better scalability at more stringent DP guarantees (e.g., ϵ = 1 and 0 . 2 ), compared to state-of-the-art (SoTA) baselines.

2 Preliminary

Differential privacy quantifies and restricts the output change of a randomized mechanism given an incremental change in the input dataset, such that the privacy of an individual point is protected. The output of a randomized mechanism can be either a vector (Sections 2.1 to 2.3) or a function (Section 2.4). In this section, we recall a few important related works in differential privacy.

2.1 Differential privacy for vectors (v-DP)

Definition 1 ( ( ϵ, δ ) -DP for vectors, [8, 9]) . A randomized mechanism M : D → R with domain D and range R satisfies ( ϵ, δ ) -differential privacy if for any two adjacent inputs D,D ′ ∈ D and for any (measurable) subset of outputs S ⊆ R it holds that

where adjacent inputs (a.k.a. neighbouring datasets) D,D ′ only differ in one entry. Particularly, when δ = 0 , we say that M is ϵ -DP.

2.2 Rényi differential privacy for vectors (v-RDP)

Mironov [23] first formalizes Rényi differential privacy (RDP) which extends ordinary DP by using α -Rényi divergence [26]. RDP is shown to provide easier composition properties than the ordinary DP notion, and it can be easily converted to ( ϵ, δ ) -DP.

Definition 2 ( ( α, ϵ ) -RDP for vectors, [23]) . A randomised mechanism M is ( α, ϵ ) -RDP if for all adjacent inputs D,D ′ , Rényi's α -divergence (of order α > 1 ) between the distributions of M ( D ) and M ( D ′ ) satisfies:

where p and q are the density of M ( D ) and M ( D ′ ) , respectively.

Conveniently, RDP is linearly composable:

Theorem 1 (Sequential composition of v-RDP, [23]) . Let f : D → R 1 be ( α, ϵ 1 ) -RDP, g : R 1 ×D → R 2 be ( α, ϵ 2 ) -RDP, then running f, g sequentially to obtain h : D → R 1 ×R 2 , h ( D ) := ( f ( D ) , g ( f ( D ) , D ) ) satisfies ( α, ϵ 1 + ϵ 2 ) -RDP.

Similar to the parallel composition theorem for ordinary ϵ -DP as in McSherry [22], we complement the parallel composition for v-RDP:

Theorem 2 (Parallel composition of v-RDP) . If mechanism M i satisfies ( α, ϵ i ) -RDP for i = 1 , 2 , . . . , m , and let D 1 , D 2 , . . . , D m be the disjoint partitions by executing a deterministic partitioning function P on D . Releasing M 1 ( D 1 ) , . . . , M m ( D m ) satisfies ( α, max i ∈{ 1 , 2 ,...,m } ϵ i ) -RDP.

2.3 Gaussian mechanism for v-DP and v-RDP

Among multiple choices, the Gaussian mechanism is more suitable for the ( ϵ, δ ) -DP notion (where δ > 0 ) and provides additional flexibility (e.g., the sum of Gaussians is still a Gaussian). It is achieved by adding calibrated spherical Gaussian noise to a vector output.

Proposition 1 (Gaussian mechanism for v-DP and v-RDP, [9, 23]) . Given a d -dimensional function f : D → R d . The Gaussian mechanism is given by:

where ∆ 2 f = max D ∼ D ′ ,D,D ′ ∈D ∥ f ( D ) -f ( D ′ ) ∥ 2 . M ( D ) is said to be: (1) ( ϵ, δ ) -DP if σ ≥ √ 2 ln(1 . 25 /δ ) /ϵ for ϵ ∈ (0 , 1) , or (2) ( α, α 2 σ 2 ) -RDP.

2.4 Differential privacy for functions (f-DP)

Prior DP works mainly focused on the setting when the output of a query is a vector. However, if the output is a function , such as the kernel density estimation example in Hall et al. [12] and the DPGM example in our work (Section 4.3), a few challenges render the direct application of previous DP results on a functional output 1 intractable: it is unclear (1) how to analyze the sensitivity and (2) how to add Gaussian noise to an infinite-dimensional output. To the best of our knowledge, Hall et al. [12] are the pioneers in addressing those challenges by starting with defining the ( ϵ, δ ) -DP for functions:

Definition 3 ( ( ϵ, δ ) -DP for functions, [12]) . Consider a class of functions indexed by database D over T = R d , i.e. { f D : D ∈ D} ⊆ R T . Define cylinder sets 2 C S,B = { f ∈ R T : ( f ( x 1 ) , . . . , f ( x n )) ∈ B } , for all finite subsets S = ( x 1 , . . . , x n ) of T and Borel sets 3 B ∈ R n . Then, define C s = { C S,B : B ∈ B ( R n ) } and F 0 = ⋃ S : | S | < ∞ C s . We say the mechanism ˜ f D satisfies ( ϵ, δ ) -DP over the field of cylinder sets, if for all D,D ′ ∈ D :

Hall et al. [12] point out that whenever Eq. (1) holds, for any finite set of points x 1 , . . . , x n in T chosen a-priori, or after the construction of the function, or even adaptively chosen based on the outputs given, releasing the vector [ ˜ f D ( x 1 ) , . . . , ˜ f D ( x n )] satisfies ( ϵ, δ ) -DP.

The Gaussian mechanism for f-DP 4 is reached by injecting a sample path of a calibrated Gaussian process 5 into the function:

Proposition 2 (Gaussian mechanism for f-DP, [12]) . Let G be a sample path of a Gaussian process having mean zero and covariance function k . Let M denote the Gram matrix

Let { f D : D ∈ D} be a family of functions indexed by database D . Releasing ˜ f D = f D + √ 2 ln(1 . 25 /δ )∆ /ϵ · G satisfies ( ϵ, δ ) -DP whenever

Particularly, Hall et al. [12] studied how to achieve ( ϵ, δ ) -DP for functions in an RKHS 6 H :

Corollary 1 (Corollary 9 in [12]) . For { f D : D ∈ D} ⊆ H , releasing ˜ f D = f D + √ 2 ln(1 . 25 /δ )∆ /ϵ · G is ( ϵ, δ ) -DP (with respect to the cylinder σ -field) whenever sup D,D ′ ∥ f D -f D ′ ∥ H ≤ ∆ and when G is a sample path of a Gaussian process with mean zero and covariance function k that is given by the reproducing kernel of H .

3 Rényi differential privacy for functions (f-RDP)

In this section, we aim to extend the definition of RDP to functional outputs, along with its associated calculus rules to facilitate practical adoption. In particular, we will show that the main results for v-RDP all extend to f-RDP.

3.1 Definition

Consider a class of functions over T = R d , i.e. { f D : D ∈ D} ⊆ R T . We can define a functional generalization of the α -Rényi divergence:

Definition 4 ( ( α, ϵ ) -RDP for functions) . Denote the evaluation of function ˜ f D on any finite subsets S = ( x 1 , . . . , x n ) of T by { ˜ f D ( x 1 ) , . . . , ˜ f D ( x n ) } := ˜ f D ( S ) . We say ˜ f D is ( α, ϵ ) -RDP, if for all adjacent inputs D,D ′ ∈ D , Rényi's α -divergence (of order α > 1 ) between the distributions of ˜ f D ( S ) and ˜ f D ′ ( S ) satisfies:

where p, q are the density of ˜ f D ( S ) and ˜ f D ′ ( S ) , respectively.

Remark 1. Definition 4 essentially claims that the distribution of any finite number of evaluations of function ˜ f D and ˜ f D ′ satisfies Definition 2 (v-RDP).

We have a weaker definition of f-RDP (see Lemma 1 for the weaker definition) also based on cylinder sets as in Definition 3. We also refer interested readers to Appendix F for an alternative unified definition of RDP for both vectors and functions.

3.2 Post-processing theorem

As any data-independent post-processing preserves the DP guarantee for v-RDP (Definition 2), it also preserves DP guarantee for f-RDP with Remark 1. Specifically,

Theorem 3 (Post-processing theorem of f-RDP) . If a function f D is ( α, ϵ ) -RDP, so is g ◦ f D , where g is a post-processing mechanism that only depends on a finite number of outputs of f D .

3.3 Conversion to ( ϵ, δ ) -DP

The following conversion is a direct extension of its vector version in Mironov [23]:

Proposition 3 (f-RDP conversion to f-DP) . A function ˜ f D that is ( α, ϵ ) -RDP is ( ϵ + log 1 /δ α -1 , δ ) -DP.

3.4 Composition theorems

Similar to Theorem 2, we first derive the parallel composition theorem of RDP for functions:

Theorem 4 (Parallel composition of f-RDP) . Given a deterministic partitioning function P , let D 1 , D 2 , . . . , D m be the disjoint partitions by executing P on D . If function f D i satisfies ( α, ϵ i ) -RDP for i = 1 , 2 , . . . , m , releasing ( f D 1 , . . . , f D m ) := f D satisfies ( α, max i ∈{ 1 , 2 ,...,m } ϵ i ) -RDP.

Nowwemoveon to the sequential composition theorem of RDP for functions (extension of Theorem 1 to functional mechanisms), which is important and required for composing the total privacy cost when we sample different sample paths from the Gaussian process over training iterations.

First, we note that Theorem 1 implicitly defines g as a functional mechanism, i.e. g : D → R R 1 2 . It means for any r 1 ∈ R 1 , we have g r 1 := g ( r 1 , · ) : D → R 2 is ( α, ϵ 2 ) -RDP.

Theorem 5 (Sequential composition of f-RDP) . Let { f D : D ∈ D} and { g D : D ∈ D} be two families of functions indexed by dataset D , where f D ∈ R T 1 is ( α, ϵ 1 ) -RDP and g D : R T 1 → R S 2 is ( α, ϵ 2 ) -RDP. Releasing the sequentially composed functional mechanism h D = ( f D , g D ◦ f D ) ∈ R T 1 ×R S 2 = ( R 1 ×R 2 ) T × S satisfies ( α, ϵ 1 + ϵ 2 ) -RDP.

3.5 Gaussian mechanism

We also need to develop a Gaussian mechanism to retain f-RDP. To make it more convenient, we first rewrite Proposition 1 in a similar form to Proposition 3 in Hall et al. [12] as:

Definition 5 (Gaussian mechanism for v-RDP, with non-isotropic Gaussian) . Let M ∈ R d × d be a positive definite symmetric matrix, the family of vectors { v D : D ∈ D} ∈ R d satisfies sup D ∼ D ′ ∥ M -1 2 ( v D -v D ′ ) ∥ 2 ≤ ∆ for all adjacent datasets D,D ′ ∈ D . The Gaussian mechanism is given by:

˜ v D in Eq. (5) satisfies ( α, α 2 σ 2 ) -RDP. Now we define the Gaussian mechanism for f-RDP:

Proposition 4 (Gaussian mechanism for f-RDP) . Let G be a sample path of a Gaussian process having mean zero and covariance function k . Let M denote the Gram matrix (as defined in Eq. (2) ). Let { f D : D ∈ D} be a family of functions indexed by database D . Releasing ˜ f D = f D + σ ∆ · G satisfies ( α, α 2 σ 2 ) -RDP whenever Eq. (3) holds.

Particularly, when the function is in an RKHS H , we have the following corollary:

Corollary 2. For { f D : D ∈ D} ⊆ H , releasing ˜ f D = f D + σ ∆ · G is ( α, α 2 σ 2 ) -RDP (with respect to the cylinder σ -field) whenever sup D,D ′ ∥ f D -f D ′ ∥ H ≤ ∆ and when G is a sample path of a Gaussian process with mean zero and covariance function k given by the reproducing kernel of H .

3.6 Subsampled Gaussian mechanism (SGM)

Subsampling is a crucial component in existing DP deep learning algorithms (e.g., DP-SGD of [1]), which incurs a small privacy cost for every sampled batch by querying D , thereby requiring to compose the total privacy loss (measured by ϵ ) over training iterations. The same thing could happen for functional mechanisms when we subsample a batch S from the whole dataset D to index the function f S .

The current dominant (python-based) DP implementation packages, e.g., Tensorflow privacy and Opacus, apply v-RDP and compute the total ϵ in three main steps: (1) compute the v-RDP guarantee for an SGM, based on a numerical procedure in Mironov et al. [24]; (2) sequentially compose v-RDP over training iterations; (3) convert v-RDP to v-DP. In previous sections we have already shown that f-RDP shares the same results with v-RDP on steps (2) and (3), now we will show that an SGM for f-RDP can be reduced to v-RDP in Mironov et al. [24], thus, the numerical procedure in Mironov et al. [24] (and thereby those DP packages) is amenable to f-RDP in terms of the ϵ accumulation.

We apply the same subsampling strategy as in Mironov et al. [24]. Let S be a subsampled set from D , where each element of S is independently drawn from D with probability q . SGM for f-RDP is given by ˜ f S = f S + σ ∆ · G , where ∆ and G are defined in Proposition 4. The reduction is immediate: for any finite set of points V = { x 1 , . . . , x d } (where d < ∞ ), f S ( V ) will form a d -dimensional vector. Let g S ( V ) = M -1 / 2 f S ( V ) , we have ˜ g S ( V ) = g S ( V ) + σ ∆ · N (0 , I d ) , where g S ( V ) is a d -dimensional vector and ˜ g S ( V ) is the same SGM as in Mironov et al. [24]. Therefore, f-RDP shares the same guarantee of an SGM with v-RDP. Another intuition is that Mironov et al. [24] reduce computing the α -Rényi divergence of d -dimensional Gaussians to 1-dimensional Gaussians, which guides all of their subsequent derivations. When d → ∞ , we can reach the same reduction from infinite-dimensional Gaussian (Gaussian process) to 1-dimensional Gaussian.

4 An application in DPGM

To demonstrate the practical value of f-RDP, here we consider a particular example of training a differentially private generative model (DPGM) through Maximum Mean Discrepancy (MMD).

4.1 Background

Assuming a feature map ϕ : X → H , where H is an RKHS of some kernel, MMD [11] is a non-parametric distance measure that compares two distributions p, q by:

where E x ∼ p [ ϕ ( x )] ∈ H is also known as the (kernel) mean embedding (KME) of p .

Given a kernel k : X × X → R , such that 7 k ( x , w ) = ⟨ ϕ ( x ) , ϕ ( w ) ⟩ H , we can play the kernel trick to compute the (squared) MMD in an alternative way:

which also implicitly lifts the KME into an infinite-dimensional space.

Sriperumbudur et al. [27] suggest that if k is a characteristic kernel (e.g., Gaussian kernel), then MMD = 0 iff p = q , which makes MMD a practical tool in many applications, such as two-sample test [11] and generative modeling [e.g., 16, 17].

4.2 Related works

Balog et al. [3] first proposed a DP database release mechanism via KME, by truncating the infinitedimensional RKHS to a finite-dimensional feature space through random Fourier features and adding Gaussian noise to the mean of truncated feature embeddings of all data. This idea is further extended to generative modeling by DP-MERF [13]. Specifically, given the samples drawn from two distributions: D = { x i } N i =1 ∼ p (true) and W = { w j } j M =1 ∼ q (generated), empirical MMD with a kernel function k can be estimated by:

DP-MERF approximates the kernel by: k ( x , w ) = ̂ ϕ ( x ) ⊤ ̂ ϕ ( w ) , where ̂ ϕ ( x ) ∈ R d is the random Fourier feature [25] and d is the feature dimension. Now the loss becomes:

where ̂ µ p = 1 N ∑ N i =1 ̂ ϕ ( x i ) is the empirical KME of p . Calibrated Gaussian noise is added to ̂ µ p to obtain ˜ µ p with DP guarantees, which can be viewed as privatized statistics of the whole real dataset. Thereafter, the training objective is to match the KME of generated data with ˜ µ p , without querying the real data any longer. A line of recent follow-up works, e.g., PEARL [19] and DP-HP [31], boil down to improving the finite-dimensional truncation and show some further improvement in utility.

Compared to other DPGM approaches via DP-SGD [1], DP-MERF is appealing in two aspects: (1) training efficiency, since noise is added to the KME of the whole database once and for all, whereas DP-SGD has to clip and perturb the gradient in each training iteration, which leads to significant training time overhead; (2) more scalable to smaller ϵ , e.g., ϵ = 1 or below.

However, we observe that the generation by DP-MERF (and related followup methods) resembles 'mean-like' images (e.g. see Figures 1 to 3), which can be explained by their training objective, because matching the KME of all data is likely to lead to mode collapse . Moreover, truncating the RKHS into a finite-dimensional space makes it easy to add Gaussian noise, but at the cost of potentially losing the fine ability to distinguish the data distribution from generation (any finitedimensional RKHS is not characteristic). Therefore, we turn to study the possibility of adding noise in the infinite-dimensional RKHS directly.

4.3 Methodology

We use Gaussian kernel as our kernel function k , i.e., k ( x , w ) = exp {-∥ x -w ∥ 2 2 2 h 2 } , since it is widely used in related works [13, 19, 31]. Define

so we can rewrite Eq. (6) by plugging in f D :

Privatizing the terms relating to real data x i ∈ D ( i = 1 , 2 , . . . , N ) amounts to privatizing the function f D ∈ H by Corollary 2, which leads to our private training objective:

̸

where w = g θ ( z ) , i.e., w is generated from standard Gaussian noise z by a generative neural network g θ . Given the kernel is Gaussian, we can easily bound the sensitivity of f D in the RKHS norm. Without loss of generality, assume D,D ′ only differ in the last element, i.e., x N = x ′ N . Then,

Now we play the kernel trick k ( x , y ) = ⟨ ϕ ( x ) , ϕ ( y ) ⟩ H again:

We follow the batch method in Hall et al. [12] to release function ˜ f D in practice, as it naturally fits the batch training manner, which amounts to sampling a path from the Gaussian process specified by any finite collection (batch) of points. Assuming the batch size is m , we concatenate ( x , w ) = s (of size 2 m , x = s [1: m ] , w = s [ m +1:2 m ] ), to save an additional privacy cost incurred by an additional sample path in each training iteration. Now we release ˜ f D ( x i ) and ˜ f D ( w j ) via ˜ f D ( s ) as needed in Eq.(7) by:

In summary, each training iteration proceeds with (1) subsample a batch S from D to index the function f S ; (2) perturb f S by Corollary 2; (3) compute the loss function Eq. (7) by Eq. (8).

Extension to the conditional setting: We follow the approach in DP-MERF to encode labels in the MMD loss. Consider a new kernel k ∗ as a product of two existing kernels: k ∗ ( ( x , y ) , (˜ x , ˜ y ) ) = k x ( x , ˜ x ) k y ( y , ˜ y ) , where we set k x the same as the unconditional setting (i.e., Gaussian kernel) and k y to be polynomial kernel of order-1, i.e., k y ( y , ˜ y ) = y ⊤ ˜ y . Now the function that we want to privately release becomes f ∗ D = 1 N ∑ N i =1 k ∗ (( x i , y i ) , ( · , · )) . The sensitivity of f ∗ D is the same as f D . Thus, releasing f ∗ D by the batch method is achieved by replacing f D , k with f ∗ D , k ∗ in Eq. (8).

4.4 Experiments

Since our method is based on making the RKHS features of a (Gaussian) kernel differentially private without truncating the kernel, we term our method DP-kernel . In this section, we will evaluate DP-kernel both qualitatively and quantitatively on three image benchmarks, including both grayscale and colorful images. All implementation details are given in Appendix C.

Datasets: We consider widely used image benchmarks in related works, i.e. MNIST [15], Fashion MNIST [34], and CelebA [20]. For MNIST and Fashion MNIST, we generate images conditioned on 10 respective labels. For CelebA, we condition on gender. Descriptions and pre-processing of the datasets are given in Appendix B.

Evaluation metrics: For quantitative comparison with baselines, we compute the following two metrics via 60k generated images under the same DP guarantees as baselines:

Generation fidelity. We mainly use Fréchet Inception Distance (FID) [14], as it is widely compared in related works. However, recent studies suggest that FID is not always consistent with human evaluations (e.g. [28]), where the authors found that Inception-V3 (the feature extractor used to compute FID, which was proposed in 2015) is not competent enough, and switching to a more recent and powerful feature extractor (e.g. DINOv2 ViT-L/14) seems to overcome this issue. Therefore, we follow Stein et al. [28] and use their code to compute an additional Fréchet Distance, which is denoted by FDDINOv2, for our presentation only.

Generation utility. We train a convolutional neural network (CNN) as the classifier on generated images, then test the classifier on real images, where the performance is measured by the classification accuracy. We take 5 runs and report the average and standard deviation.

Baselines: We compare our method with the following related works: (1) kernel-based methods: DP-MERF [13], DP-HP [31], PEARL [19]; (2) others: DP-CGAN [29], GS-WGAN [5], DP-Sinkhorn [4], G-PATE [21], DataLens [33], DPDM [6]. All baselines are developed from v-RDP or v-DP.

Privacy regimes: Note that according to Definition 1, the DP guarantee is weak when ϵ ≥ 10 , because exp(10) ≈ 2 . 2 × 10 4 , which is meaningless, because the two probabilities are presumed to be comparable for practical deployment (e.g. ϵ ≤ 1 ). However, a line of recent SoTA DPGMs only generate acceptable images at ϵ = 10 [4, 5, 29]. Instead, we consider three values of ϵ , i.e., 10 , 1 , 0 . 2 , indicating three levels of DP guarantees, where we put comparison under (10 , 10 -5 ) -DP in Appendix D for completeness.

4.4.1 Conditional vs. parallel

The downstream classification task requires access to labels, so we need to consider conditional generative modeling, as introduced at the end of Section 4.3.

Alternatively, we can partition the dataset by labels, train K ( K is the number of total classes) unconditional sub-models in parallel with DP guarantees, and release the union in the end, which could retain the same level of DP guarantee as the conditional one by parallel composition theorem for f-RDP (Theorem 4). Specifically, we partition the dataset D into K subsets by labels, and set the target ϵ (for f D ) the same for all f D K . Thus, releasing ( f D 1 , . . . , f D K ) also satisfies ( α, ϵ ) -RDP. We will show both conditional and parallel generation results in the following sections.

4.4.2 Grayscale image sets: MNIST and Fashion MNIST

We first tried our method on MNIST and Fashion MNIST. Qualitatively, while all baselines are able to generate reasonable images under (10 , 10 -5 ) -DP guarantee (see Appendix D), our method indicates more visual improvements for smaller ϵ with more diversity and less artifacts, as shown in Figures 1 and 2. The quantitative comparison is summarized in Table 1. Although DPDM 8 is the only related work that is on a par with our method (both variants) when ϵ = 1 , DP-kernel significantly outperforms other baselines when ϵ = 0 . 2 . Specifically, our method improves the SoTA FID from 61 . 9 to 26 . 5 on MNIST, and from 78 . 4 to 46 . 2 on FMNIST, while SoTA classification accuracy is generally improved for more than 20% on MNIST and more than 10% on FMNIST.

The FDDINOv2 of our conditional variant on MNIST and FMNIST are 454 . 8 and 608 . 9 when ϵ = 1 , and they are 410 . 3 and 589 . 2 when ϵ = 0 . 2 .

G-PATE

DP-MERF

0123s

014348L

PEARL

012345

DP-HP

017545673

DPDM

,8L99

GS-WGAN

/ M34567&

Ours (conditional)

2

W

6

3

4

3

4

Ours (parallel)

3

O

3

1024E

DPDM

名己学

DP-MERF

PEARL

3

Ours (conditional)

0

2

Ours (parallel)

4.4.3 RGB image sets: CelebA

To test the versatility and scalability of our method, we also evaluate our method on a more complex colorful image dataset, i.e. CelebA. Figure 3 shows that our method generates more diverse face images with identifiable gender attributes compared to baselines, which is quantitatively verified by significant improvement in both FID and Acc in Table 1. Note that DPDM is unconditional on CelebA. Notably, for ϵ = 0 . 2 , our method improves the SoTA FID from 264 . 8 to 85 . 9 , and improves SoTA Acc from 52 . 7 to 86 . 5 .

The FDDINOv2 of our conditional variant on CelebA are 1028 . 2 when ϵ = 1 and 998 . 9 when ϵ = 0 . 2 .

(a)

ϵ

= 1

(b)

ϵ

= 0

.

2

DPDM

DataLens

DP-MERF

Ours

(conditional)

Ours

(parallel)

Table 1: Quantitative comparison on MNIST, Fashion MNIST (FMNIST) and CelebA. Acc denotes classification accuracy, which is shown in %. ↑ and ↓ refer to higher is better or lower is better, respectively. We use boldface for the best performance. Results of DP-CGAN, GS-WGAN, DPSinkhorn are cited from Cao et al. [4] and Long et al. [21]. Results of PEARL and DPDM are cited from Dockhorn et al. [6]. Results of G-PATE and DataLens are cited from their papers, respectively. (*): DPDM did unconditional generation on CelebA.

5 Conclusion

We generalize RDP for vectors to functional mechanisms and develop all building blocks, e.g. (subsampled) Gaussian mechanisms, composition theorems, and post-processing theorems, to facilitate its adoption in deep learning frameworks. We show that those main properties or results of v-RDP also hold for f-RDP. Equipped with f-RDP, we propose a novel approach for training a DPGM, by making the loss function in the RKHS private without truncating the RKHS feature map. Experimental results across different datasets and privacy costs indicate that our method (equipped with f-RDP and retaining the full discriminative capability of the kernel) consistently outperforms other kernel-based methods (with v-RDP) as well as non-kernel-based methods by a large margin. We expect our work to bridge the gap between RDP and functional mechanisms and enrich the family of DPGM.

Acknowledgments and Disclosure of Funding

We thank the reviewers and the area chair for thoughtful comments that have improved our final draft. YY gratefully acknowledges NSERC and CIFAR for funding support. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute.

References

M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. 'Deep Learning with Differential Privacy'. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . 2016, pp. 308-318.

E. Bagdasaryan, O. Poursaeed, and V. Shmatikov. 'Differential privacy has disparate impact on model accuracy'. In: Advances in neural information processing systems . 2019.

M. Balog, I. Tolstikhin, and B. Schölkopf. 'Differentially Private Database Release via Kernel Mean Embeddings'. In: Proceedings of the 36th International Conference on Machine Learning . 2018.

T. Cao, A. Bie, A. Vahdat, S. Fidler, and K. Kreis. 'Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergence'. In: Proceedings of the 34th Advances in Neural Information Processing Systems . 2021.

D. Chen, T. Orekondy, and M. Fritz. 'GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators'. In: Proceedings of the 33rd Advances in Neural Information Processing Systems . 2020, pp. 12673-12684.

T. Dockhorn, T. Cao, A. Vahdat, and K. Kreis. 'Differentially private diffusion models'. arXiv:2210.09929. 2022.

J. Dong, A. Roth, and W. J. Su. 'Gaussian differential privacy'. arXiv:1905.02383. 2019.

C. Dwork. 'Differential privacy'. In: Automata, Languages and Programming: 33rd International Colloquium, ICALP 2006, Venice, Italy, July 10-14, 2006, Proceedings, Part II 33 . 2006, pp. 1-12.

C. Dwork and A. Roth. 'The algorithmic foundations of differential privacy'. Foundations and Trends in Theoretical Computer Science , vol. 9, no. 3-4 (2014), pp. 211-407.

M. S. Esipova, A. A. Ghomi, Y. Luo, and J. C. Cresswell. 'Disparate Impact in Differential Privacy from Gradient Misalignment'. In: The Eleventh International Conference on Learning Representations . 2023.

A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf, and A. Smola. 'A kernel two-sample test'. The Journal of Machine Learning Research , vol. 13, no. 1 (2012), pp. 723-773.

R. Hall, A. Rinaldo, and L. Wasserman. 'Differential privacy for functions and functional data'. The Journal of Machine Learning Research , vol. 14, no. 1 (2013), pp. 703-727.

F. Harder, K. Adamczewski, and M. Park. 'DP-MERF: Differentially Private Mean Embeddings with Random Features for Practical Privacy-preserving Data Generation'. In: International Conference on Artificial Intelligence and Statistics . 2021, pp. 1819-1827.

M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter. 'GANs trained by a two time-scale update rule converge to a local Nash equilibrium'. In: Proceedings of 30th Advances in Neural Information Processing Systems . Vol. 30. 2017.

Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. 'Gradient-based learning applied to document recognition'. Proceedings of the IEEE , vol. 86, no. 11 (1998), pp. 2278-2324.

C.-L. Li, W.-C. Chang, Y. Cheng, Y. Yang, and B. Póczos. 'Mmd gan: Towards deeper understanding of moment matching network'. In: Proceedings of the 30th Advances in neural information processing systems . 2017.

Y. Li, K. Swersky, and R. Zemel. 'Generative moment matching networks'. In: International conference on machine learning . 2015, pp. 1718-1727.

F. Liese and I. Vajda. 'Convex Statistical Distances'. Teubner, Leipzig, 1987.

S. P. Liew, T. Takahashi, and M. Ueno. 'PEARL: Data Synthesis via Private Embeddings and Adversarial Reconstruction Learning'. In: International Conference on Learning Representations . 2022.

Z. Liu, P. Luo, X. Wang, and X. Tang. 'Deep Learning Face Attributes in the Wild'. In: Proceedings of International Conference on Computer Vision (ICCV) . 2015.

Y. Long, B. Wang, Z. Yang, B. Kailkhura, A. Zhang, C. A. Gunter, and B. Li. 'G-PATE: Scalable Differentially Private Data Generator via Private Aggregation of Teacher Discriminators'. In: Proceedings of 34th Advances in Neural Information Processing Systems . 2021.

F. D. McSherry. 'Privacy integrated queries: an extensible platform for privacy-preserving data analysis'. In: Proceedings of the 2009 ACM SIGMOD International Conference on Management of data . 2009, pp. 19-30.

I. Mironov. 'Rényi differential privacy'. In: 2017 IEEE 30th computer security foundations symposium (CSF) . IEEE. 2017, pp. 263-275.

I. Mironov, K. Talwar, and L. Zhang. 'Rényi differential privacy of the sampled gaussian mechanism' (2019). arXiv:1908.10530.

A. Rahimi and B. Recht. 'Random features for large-scale kernel machines'. In: Proceedings of the 20th International Conference on Neural Information Processing Systems . 2007, pp. 11771184.

A. Rényi. 'On measures of entropy and information'. In: Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability . Vol. 1. 1961, pp. 547-562.

B. K. Sriperumbudur, K. Fukumizu, and G. R. Lanckriet. 'Universality, Characteristic Kernels and RKHS Embedding of Measures'. Journal of Machine Learning Research , vol. 12, no. 7 (2011).

G. Stein et al. 'Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models'. arXiv:2306.04675. 2023.

R. Torkzadehmahani, P. Kairouz, and B. Paten. 'DP-CGAN: Differentially Private Synthetic Data and Label Generation'. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . 2019, pp. 98-104.

T. Van Erven and P. Harremos. 'Rényi divergence and Kullback-Leibler divergence'. IEEE Transactions on Information Theory , vol. 60, no. 7 (2014), pp. 3797-3820.

M. Vinaroz, M.-A. Charusaie, F. Harder, K. Adamczewski, and M. J. Park. 'Hermite Polynomial Features for Private Data Generation'. In: Proceedings of the 39th International Conference on Machine Learning . Vol. 162. 2022, pp. 22300-22324.

B. Wang and N. Hegde. 'Privacy-preserving q-learning with functional noise in continuous spaces'. In: Proceedings of the 32nd Advances in Neural Information Processing Systems . 2019.

B. Wang, F. Wu, Y. Long, L. Rimanic, C. Zhang, and B. Li. 'Datalens: Scalable privacy preserving training via gradient compression and aggregation'. In: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security . 2021, pp. 2146-2168.

H. Xiao, K. Rasul, and R. Vollgraf. 'Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms'. arXiv:1708.07747. 2017.

D. Xu, W. Du, and X. Wu. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent'. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining . 2021, pp. 1924-1932.

A Proofs

Theorem 2 (Parallel composition of v-RDP) . If mechanism M i satisfies ( α, ϵ i ) -RDP for i = 1 , 2 , . . . , m , and let D 1 , D 2 , . . . , D m be the disjoint partitions by executing a deterministic partitioning function P on D . Releasing M 1 ( D 1 ) , . . . , M m ( D m ) satisfies ( α, max i ∈{ 1 , 2 ,...,m } ϵ i ) -RDP.

̸

Proof. Without loss of generality, given two neighboring datasets D and D ′ , assume that D contains one more element than D ′ . Executing P on D and D ′ , we have partitions D 1 , D 2 , . . . , D m and D ′ 1 , D ′ 2 , . . . , D ′ m , respectively. There exists j such that (1) D j contains one more element than D ′ j , and (2) D s = D ′ s for s = 1 , 2 , . . . , m and s = j . Denote M 1 ( D 1 ) , . . . , M m ( D m ) by M ( D ) . Using additivity of Rényi divergence in [30] (Thm 28):

̸

The proof is complete.

Theorem 3 (Post-processing theorem of f-RDP) . If a function f D is ( α, ϵ ) -RDP, so is g ◦ f D , where g is a post-processing mechanism that only depends on a finite number of outputs of f D .

Proof. Given any finite subsets S , we reach the reduction of proof of the post-processing theorem in [23]:

Lemma 1. Definition 4 implies:

where we reuse all the notations in Definition 3.

Proof. Proof sketch: we will show that Eq. (9) holds whenever Eq. (4) holds.

By taking logarithm and rearranging from Eq. (9), we have

By the definition of cylinder sets, ˜ f D ∈ A implies that ˜ f D ( S ) is in some sets B for any finite subsets S = ( x 1 , . . . , x n ) of T . Thus,

where p is the density of ˜ f D ( S ) . Now we can translate Eq. (10) into

Recall that Eq. (4) in Definition 4 can be translated to:

Note that p, q are non-negative, so ∫ ( p ( x ) q ( x ) ) α q ( x ) d µ ( x ) ≥ ∫ S ( p ( x ) q ( x ) ) α q ( x ) d µ ( x ) . Compared to Eq. (11), it now suffices to show

Define p ∗ ( x ) = p ( x ) 1 ( x ∈ S ) ∫ S p ( x ) d µ ( x ) , and q ∗ is similarly defined. All we want to show reduces to

where the final step follows from Jensen's inequality.

Proposition 3 (f-RDP conversion to f-DP) . A function ˜ f D that is ( α, ϵ ) -RDP is ( ϵ + log 1 /δ α -1 , δ ) -DP.

Proof. We reuse the notations in Definition 3 in this proof. To show that an ( α, ϵ ) -RDP function satisfies ( ϵ ′ , δ ) -DP for functions, where ϵ ′ = ϵ + log 1 /δ α -1 , the objective becomes to show P [ ˜ f D ∈ A ] ≤ exp( ϵ ′ ) × P [ ˜ f D ′ ∈ A ] + δ . With the help of Lemma 1, denote P [ ˜ f D ′ ∈ A ] by Q and we perform a case analysis:

If exp( ϵ ) Q ≤ δ α/ ( α -1) , then

If exp( ϵ ) Q > δ α/ ( α -1) , then

Combining the two cases completes the proof.

Theorem 4 (Parallel composition of f-RDP) . Given a deterministic partitioning function P , let D 1 , D 2 , . . . , D m be the disjoint partitions by executing P on D . If function f D i satisfies ( α, ϵ i ) -RDP for i = 1 , 2 , . . . , m , releasing ( f D 1 , . . . , f D m ) := f D satisfies ( α, max i ∈{ 1 , 2 ,...,m } ϵ i ) -RDP.

̸

Proof. Without loss of generality, given two neighboring datasets D and D ′ , assume that D contains one more element than D ′ . Executing P on D and D ′ , we have partitions D 1 , D 2 , . . . , D m and D ′ 1 , D ′ 2 , . . . , D ′ m , respectively. There exists j such that (1) D j contains one more element than D ′ j , and (2) D s = D ′ s for s = 1 , 2 , . . . , m and s = j . Given any finite subsets S = ( x 1 , . . . , x n ) ⊂ T , Using additivity of Rényi divergence in [30] (Thm 28), we have:

̸

Theorem 5 (Sequential composition of f-RDP) . Let { f D : D ∈ D} and { g D : D ∈ D} be two families of functions indexed by dataset D , where f D ∈ R T 1 is ( α, ϵ 1 ) -RDP and g D : R T 1 → R S 2 is ( α, ϵ 2 ) -RDP. Releasing the sequentially composed functional mechanism h D = ( f D , g D ◦ f D ) ∈ R T 1 ×R S 2 = ( R 1 ×R 2 ) T × S satisfies ( α, ϵ 1 + ϵ 2 ) -RDP.

Proof. According to Definition 4, our objective is to show for any finite subsets X = ( x 1 , . . . , x n ) of T and Y = ( y 1 , . . . , y m ) of S ,

Here we adapt the proof of Proposition 1 in [23]. Let F be the distribution of f D ( X ) , G be the distribution of g D ( f D , Y ) , H = ( F, G ) , and F ′ , G ′ , H ′ are similarly defined on adjacent dataset D ′ .

Proposition 4 (Gaussian mechanism for f-RDP) . Let G be a sample path of a Gaussian process having mean zero and covariance function k . Let M denote the Gram matrix (as defined in Eq. (2) ). Let { f D : D ∈ D} be a family of functions indexed by database D . Releasing ˜ f D = f D + σ ∆ · G satisfies ( α, α 2 σ 2 ) -RDP whenever Eq. (3) holds.

Proof. Consider any finite set ( x 1 , . . . , x n ) ∈ T n , the vector ( G ( x 1 ) , . . . , G ( x n )) follows a multivariate Gaussian with mean zero and covariance given by Eq. (2). Thus, evaluating ˜ f D at any finite sets would form a vector that satisfies Eq. (5) in Definition 5, which completes the proof.

B Datasets

MNIST [15] & Fashion MNIST [34]: MNIST contains hand-written digits images, whereas Fashion MNIST contains cloth and shoe images. Images in both datasets are single-channel, in the size of 1 × 28 × 28 , which are resized to 1 × 32 × 32 and normalized to have 0 . 5 mean and 0 . 5 standard deviation. Both datasets have 10 classes. We adopt the official training and test split. MNIST and Fashion MNIST are made available under Creative Commons Attribution-Share Alike 3.0 license and MIT License, respectively.

CelebA [20]: CelebA is a dataset including face images of celebrities. Each image is in the size of 3 × 178 × 218 and has 40 binary attributes. All images are center-cropped to 3 × 178 × 178 , then resized to 3 × 32 × 32 , and normalized to have 0 . 5 mean and 0 . 5 standard deviation. We also adopt the official training, validation and test split, but randomly select 60k images from the training split as our training set. The CelebA dataset is available for non-commercial research purposes only, as described on their website.

C Implementation

Generative network: Our unconditional generative network is based on the official code of MMDGAN [16]. For the NN architecture, we use the same Conv2dTranpose layer with similar depth as prior related works. Besides, we use the same architecture for both gray-scale and RGB image sets to

demonstrate its versatility (of course with different NN parameters to account for the difference in input channels). Encoding labels to the latent code leads to the conditional variant. All networks are optimized by RMSprop with a learning rate 5 × 10 -5 .

CNN classifier: We follow Cao et al. [4] for the classifier implementation.

The CNN consists of following layers: Conv2d( input _ channels , 32, kernel_size=3, stride = 2, padding=1) → Dropout(p=0.5) → ReLU → Conv2d(32, 64, kernel_size=3, stride = 2, padding=1) → Dropout(p=0.5) → ReLU → flatten → linear( flatten _ dim, output _ dim ) → Softmax.

The CNN classifier is optimized by Adam with default parameters. All classifiers are trained on synthetic data, and we report test accuracy on real test data as the evaluation metric.

Privacy: We use Tensorflow privacy for computing the total privacy cost, which only requires inputting a few important parameters, e.g. subsampling rate (or batch size), noise multiplier, training epochs (iterations), target δ ( δ = 10 -5 in all our experiments). We summarize the parameters in Table 2.

Baselines: We use the official code of DP-MERF to replicate their results under different ϵ and use the same evaluation metrics to add quantitative comparison. The numerical evaluations of rest baselines are cited from related works, as specified in the caption of the tables.

Computation resources: All computation is conducted by one NVIDIA T4 GPU. It costs 1.5 hours to train a conditional generator on MNIST (and Fashion MNIST) and around 5 hours on CelebA. Each sub-model in the parallel variant takes only 10 minutes to train on MNIST (and Fashion MNIST) and 30 minutes on CelebA. A better GPU should compute faster. As a reference, DP-Sinkhorn and GS-WGAN can take up to 24 hours to train, and GS-WGAN even requires at least 2 GPUs (as they have 1000 discriminators).

D Additional results

For completeness, we include the qualitative comparison between our method and related works under (10 , 10 -5 ) -DP on all three datasets in Figures 4 and 5. Numerical comparison is in Table 3. We note that ϵ = 10 is usually considered a weak privacy regime. Generally, all baselines can generate decent images when ϵ = 10 , whereas our method still generates more diverse and more informative images, especially on CelebA.

E Broader impact and limitations

Broader impact: Some prior works reveal that DP training could introduce additional biases to the model, leading to fairness concerns [2, 10, 35]. We did not explore this point in the current experiments as there are no sensitive attributes involved, but we can imagine the potential negative effects on fairness issues if our methods are not used properly.

DP-CGAN

DP-MERF

PEARL

G-PATE

GS-WGAN

DP-Sinkhorn

2

3

4

5

7

Ours (conditional)

3

1

2

3

3

Ours (parallel)

D

2

Besides, we do not expect this work to trigger any differential privacy concern by its design, and we do not expect it to be used for Deepfakes (as the non-private counterparts are better in utility), but there might be some unintended uses that we are not aware of for now.

Limitations: The current conditional approach assumes a uniform distribution over different labels, which happens to hold for all three datasets. A more tailored algorithm is needed if the label distribution is imbalanced. The current parallel approach is not subject to a specific label distribution, but it may hinder its practical deployment if the number of classes is too large.

DP-MERF

DataLens

DP-Sinkhorn

Ours (conditional)

Ours (parallel)

F A simplified view of RDP for vectors and functions

In this section, we propose to define Rényi differential privacy (RDP) for vectors and functions in a unified way.

Let D be a collection of datasets and f : D → R be a randomized mechanism. We consider R = R T so we may also identify f as a bivariate (random) function f : T ×D → R . In the following we call two datasets D,D ′ ∈ D adjacent if they differ by one data point. We recall the Rényi α -divergence [26] between two random variables X 1 and X 2 with density p and q , respectively:

where α > 1 is a hyperparameter and the last inequality follows from Jensen's inequality. Since we can rewrite

it is clear Rényi's α -divergence D α is increasing w.r.t. α , with the following limits:

For joint distributions, we can easily verify the following decomposition rule:

where the inequality follows from the nonnegativity of the conditional Rényi divergence inside the exponential. In other words, the α -divergence between joint distributions is always larger than that between marginal distributions.

We are now ready to define Rényi differential privacy [23]:

Definition 6 ( ( α, ϵ ) -RDP) . A randomized mechanism f : T × D → R is ( α, ϵ ) -RDP if for all adjacent datasets D,D ′ ∈ D ,

where f ( t ; D ) := [ f ( t 1 ; D ) , . . . , f ( t n ; D )] is the concatenation of n random variables.

The acute reader will notice some immediate difference between our definition and the one in the literature, e.g., Mironov [23, Definition 4]. Before explaining our motivation, let us first notice that when T = [ d ] := { 1 , . . . , d } , i.e., the range of our mechanism f is R = R d (which is the setting of [23] and most existing work), the supremum in (13) is attained when n = d and t = [1 , . . . , d ] , thanks to inequality (12). In other words, the supremum in (13) is superficial when T is a finite set. The important point is that we can now extend RDP effortlessly to any index set T , including when T is even uncountable. For instance, in our later application to generative modeling (Section 4), we will use T = R m . On the other hand, one might be tempted to lump all random variables together into f ( T ; D ) = { f ( t ; D ) : t ∈ T } , hoping to obviate the supremum in (13). However, this approach will run into two difficulties: Firstly, the rigorous minds will start to worry about measurability issues around f ( T ; D ) (as a stochastic process) and involve tedious measure-theoretic jargon (such as the cylinder field in [12]). Secondly, we no longer possess a dominating measure (e.g., Lebesgue) to define an easily computable density of the process f ( T ; D ) . In contrast, our reduction to the finite case through taking the supremum does not suffer from either issue, and, as we will see, renders extensions of existing properties of RDP (to an arbitrary index set T ) rather natural or even trivial.

The following result was proved by Mironov [23, Proposition 3]:

Theorem 6. If a mechanism f is ( α, ϵ ) -RDP, then for any (measurable) set A ,

In particular, f is ( ϵ + 1 α -1 log 1 δ , δ α ) -DP.

Proof. For α ≥ 1 , consider the (jointly) convex function (as the perspective of p ↦→ p α ):

as well as the probability measure 1 x ∈ A · µ (d x ) /µ ( A ) (recall that µ (d x ) is the underlying dominating measure that the densities p and q are defined w.r.t.). Applying Jensen's inequality we obtain

where P ( A ) := ∫ A p ( x ) µ (d x ) = Pr[ f ( D ) ∈ A ] and similarly for Q ( A ) . Thus,

Rearranging we obtain the first inequality. The second inequality is simply the arithmetic-geometric mean inequality, after noting that

Lastly, we relax the factor (1 -1 α ) ≤ 1 to obtain the claimed DP guarantee.

For two Gaussian distributions N ( u , Σ) and N ( v , Σ) , their Rényi α -divergence can be readily computed from Liese and Vajda [18, Proposition 2.22]:

Therefore, the Gaussian mechanism

is ( α, ϵ ) -RDP, where

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nStandard differential privacy (v-DP) provides mathematical guarantees on the closeness of distributions of real-valued, randomized functions when they act on adjacent inputs. v-RDP is a variant of the standard DP definition which can be connected back to v-DP guarantees, and can provide tighter v-DP bounds through its analysis. Meanwhile, functional DP (f-DP) extends v-DP to the case where randomized functionals act on adjacent input sets of functions. The current paper considers an RDP variant of f-DP (f-RDP). From the proposed definition of f-RDP, the authors present and prove a number of theorems that mirror the standard toolkit used by practitioners for v-DP and v-RDP, namely (serial and parallel) composition, post-processing, the subsampled Gaussian mechanism, and conversion to f-DP. f-RDP is used to analyze the training of private generative models in several experiments.\n\nSTRENGTHS:\nThank you to the authors for sharing their interesting research! This work contains both theoretical results, proving several useful theorems following from the definition of f-RDP, and experimental work training generative models with privacy guarantees. The theoretical work appears to be correct, and I have read over (but not verified in a detailed manner) the proofs given in the appendix. The experimental results show improvement in image quality at strong levels of privacy ($\\epsilon=0.2$) on three common datasets.\n\nOriginality: The application of functional DP to generative modelling is relevant and timely.\n\nQuality: The analysis appears to be correct, the usual toolkit of theorems used by DP practitioners is filled out, and at least some of the results are non-trivial to obtain. Experiments and code are provided.\n\nClarity: The format and flow of the paper are generally good. Proofs are reasonably detailed.\n\nSignificance: The possibility of useful generative models trained at privacy levels as strong as $\\epsilon=0.2$ is very promising.\n\nWEAKNESSES:\nOriginality: The paper combines two known concepts - RDP, and f-DP. The main theoretical results play out exactly as one would expect - the authors do not go beyond the standard toolkit to explore any new properties of their definition.\n\nQuality: Quantitative results are given as single numbers in Table 1 and 3 - there is no quantification of statistical uncertainty. Please see questions below for more suggestions to improve quality.\n\nClarity: The paper assumes a high level of background mathematical knowledge which may not be accessible to the ML community, and does not include pedagogical expanations. Example topics that are not explained in detail, or for which intuition is not provided: functionals, Borel sets from measure theory, cylinder sets, reproducing kernel Hilbert spaces, Gaussian processes. The lack of explanation and intuition will limit the readership of this work.\n\nSignificance: Only a few examples of the usefulness of differentially private functionals are given (L29-31). The applications of f-RDP seem limited in comparison to v-RDP. Only relatively small and easy datasets are used in the experiments.\n\nQUESTIONS:\n1. Can the authors quantify the improvement in $\\epsilon$ when using the f-RDP analysis as compared to the preexisting f-DP analysis? For comparison, the motivation to use v-RDP is that it produces tighter guarantees v-DP than have been obtained with v-DP directly.\n\n2. Beyond providing a mathematical guarantee, have the authors considered what characteristics DPGMs will have in comparison to non-private GMs? Do they behave differently in terms of training or sample generation?\n\n3. Related to the previous question, can the authors verify (beyond the mathematical guarantees) that their DPGMs preserve privacy of the training data? For example, around the Figure 1,2 experiments, have the authors considered checking nearest neighbours between the private training data, and the generated samples? The same could be done for generated samples from non-private models. I would expect that models trained with DP guarantees should not memorize and reproduce training set data. Such verification would give more intuitive meaning to the levels of privacy considered in the work ($\\epsilon=0.2, 1.0, 10.0$). An alternate test would be to perform membership inference attacks.\n\n4. L286 and L292 mention standard deviations of results, but the method of obtaining these statistics is not mentioned. Can the authors include explanations of where the statistics come from? E.g. are models retrained from scratch with different randomness? How many times? Can error bars be included for the main results tables (Table 1 and Table 3 in the appendix)? Specifically for the Accuracy measure where 5 classifiers were trained, why are error bars withheld?\n\nThe chosen evaluation metrics have significant flaws and limitations. I encourage the authors to put more thought into the metrics they choose:\n\n5. FID - Concerns around FID have been widely raised in the DGM literature, but the authors make no mention of this. The authors state FID is a measure of generation fidelity which is only partly true, as FID also measures diversity and these two factors cannot be disentangled. Can the authors comment on why they believe FID is a sufficient measure, or provide alternative evaluations? Note that using a measure \"because it is the standard\" may not be a good reason if that measure has significant flaws.\n\n6. Accuracy of a classifier trained on generated samples and evaluated on real samples - This is not a typical measure, as it would only seem to measure if generation has picked up on class-conditional information. It seems to have been used in [3], but this is not mentioned in the main text (only the appendix). Additionally, having to train a model (actually five!) on a generated dataset just to get an evaluation seems like an expensive procedure, and one that introduces additional randomness (on top of the randomness in generating a dataset for evaluation). Imagine trying to use this measure for validation during training! At the very least, the authors must explain what this metric is measuring and why they believe this to be a useful measure for their task.\n\nMinor:\n\nL2 and L21 refer to RDP as a \"recent\" development. While recency is always relative, work from 2017 does not seem very recent with the fast pace of development in ML.\n\nThe proof of Theorem 4 follows the proof of Theorem 2. However, Theorem 4's proof lacks the same detail as Theorem 2's. Can the authors either provide additional steps for Theorem 4, or make a reference back to Theorem 2? The reader who only looks at Theorem 4 may feel there is insufficient detail.\n\nA bit more exposition on the experimental details in the main text would be good to contextualize the results, for instance what kind of NN architectures are used, and are these similar across training methods for fair comparisons?\n\nThere are some grammatical errors that do not detract from the clarity of the work (non-exhaustive list):\n\nL2 becomes -> has become\n\nL18 becomes -> has become\n\nL226 pluggin -> plugging\n\nL230 Wlog - this abbreviation is somewhat unprofessional.\n\nLIMITATIONS:\nThe consideration of broader impacts in Appendix E seems like an afterthought. I encourage the authors to put more thought into this section. The paper focuses on the theoretical, and utility aspects of DP, but does not mention that private training can have negative effects other than reducing utility. For instance, it is well-known that DP-SGD usually exacerbates the biases in models making them more unfair [A][B][C]. How does training with the loss functions in Section 4 compared to DP-SGD in terms of fairness? This is an important \"broader impact\" of research into private model training.\n\n[A] Bagdasaryan et al. 'Differential privacy has disparate impact on model accuracy' NeurIPS 2019\n\n[B] Xu et al. 'Removing disparate impact on model accuracy in differentially private stochastic gradient descent' ACM SIGKDD 2021\n\n[C] Esipova et al. 'Disparate impact in differential privacy from gradient misalignment' ICLR 2023\n\n----\nSummary of Discussion: I have read all reviews and rebuttals for this submission.\n\nThe authors have responded to each of my concerns. The only outstanding piece was around the evaluation metrics chosen by the authors, which they admitted had flaws. Due to the format of NeurIPS reviews (no updated manuscript) I can't fully review the changes they intend to make.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-04"}

comments: SUMMARY:
The work generalizes the DP to infinite dimensions. Based on the modeling of Hall et al., the authors propose some characteristics of functional DP aligning with the traditional DP. The most interesting part is adopting their proposed framework to RHKS for an infinite functional space. Some numerical studies is done for verification.

STRENGTHS:
Pros:
1. the application in RKHS is interesting and promising for further application to reduce the dimension and formulate some functional structural data input
2. some proposed tools like composition and subsampling can be adopted for further studies

WEAKNESSES:
Cons:
1. The technical contribution should be clearly stated. Some remarks about the different characteristics of the functional DP and traditional Dp in Subsample and others should be stated. We do know whether we directly imply the results for the composition theorem with Hall's and the traditional DP's proof.
2. Some more error bounds for RKHS need to be considered. It might influence the privacy guarantee.
3. The work does not clearly show the complexity result to construct such a DP measure. We can do it with kernel trick or reduced paramters, but some guarantee should be provided.

QUESTIONS:
1. How can we compute the functional DP given function $f$, if the functional is high dimension, will we suffer from dimension curse
2. what is the relationship between the proposed DP and the traditional DP. This problem comes from numerical studies. I am not sure whether it is fair to use the same $epsilon$ for different methods with different privacy metrics. Maybe they protect different things.
3. can functional form be generalized to privacy loss random variable accounting

LIMITATIONS:
Yes.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2023-07-05

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors  extend  the concept of RDP from vectors  to functions. They introduce the notion of functional RDP and present a few properties of the functional RDP under composition / amplification by sampling. Finally, they demonstrate the functional RDP using the application in RKHS.\n\nSTRENGTHS:\n1. They generalize the definition of RDP to the setting when we have an infinite output space. \n2. The application to RKHS is nice and the experiment section is also complete.\n\nWEAKNESSES:\nMy main concern is the novelty of the paper: The applications on DP generative models and the proposed functional new RDP definition appear to publish either the fixed finite-dimensional vector output or the infinite output with some strong constraint on its boundness.  These aspects have already been covered in the existing RDP literature.\n\nThough the authors claim the goal of their work is to publish a function, their results essentially involve releasing the output of functions  applied on a private dataset. This algins closely with  prior classic DP work.\n\nQUESTIONS:\nHere I list my concerns on the novelty:\n\n\n1. Their results on RDP for functions (Definition 5)  and subsampled RDP for functions directly generalize from the existing  RDP literature, except that the output space might now have an infinite-dimension. However,  assuming a bounded RDP divergence of the unbounded output space (in this work) essentially renders it equivalent to  classic RDP.\n\n2. The authors provide empirical demonstrations of the applications of functional RDP by applying it to privatize the Maximum Mean Discrepancy (MMD), a crucial component in DP generative model training. In their approach, they choose to privatize the kernel function $k(\\cdot, \\cdot)$ applied to the private dataset, resulting in a finite (and even one-dimensional) output space for the function.\nGiven that the output space is finite, the authors could use the classic Gaussian mechanism directly to publish the loss function. In this context, the connection with functional RDP is not apparent.\n\nSome minor comments: The organization of the paper is not clear. The authors do not clearly state the motivation/applications of the functional  RDP  before proving their main results.\n\nLIMITATIONS:\nNot applicable.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nConceptually, this paper combines the idea behind RDP and f-DP and proposes f-RDP. \n\nTheoretically, this paper proved several important properties of f-RDP (e.g., Composition, post-processing, and the privacy level for the widely-used Gaussian mechanism).\n\nExperimentally, this paper showed f-RDP can be applied to improve the performance of real-world applications.\n\nSTRENGTHS:\n1. The problem studied in this paper is important to the community. Achieving privacy without losing too much utility is always desired by researchers and mechanism designers.\n\n2. The results of this paper look solid to me. The composition theorem for a new privacy notion usually is not an easy task.\n\n3. The overall presentation looks good to me.\n\nWEAKNESSES:\n1. Some high-level explanations are missing and it's hard for the readers out of DP community to understand Section 2.\n\nTo both authors and chairs: I provide a relatively low confidence score because I am not an expert on generative models.\n\nQUESTIONS:\n1. May I know what is the high-level idea of why $f$-DP is better than DP? I guess this is because the sensitivity $\\Delta$ for $f$-DP is smaller, but again, why? Can the authors provide some high-level ideas and explanations?\n\n2. I am not an expert on generative models, but may I know why the proposed $f$-DP notions are suitable for generative models? Can it also be used to improve standard classification tasks?\n\n3. Functional and cylinder set need to be explained before use. I don't believe the majority of the researchers in computer science (without expertise in math) can understand these. \n\n4. I suggest the author to add a note about the $f$-DP notion in the following paper (already with 200+ citations), where $f$ plays a similar role as the Renyi divergence in RDP. I know that these two $f$-DP notions are different, but some readers may get confused because RDP is a special case of the $f$-DP in the following paper.\n\nDong, Jinshuo, Aaron Roth, and Weijie J. Su. \"Gaussian differential privacy.\" arXiv preprint arXiv:1905.02383 (2019).\n\nLIMITATIONS:\nNo limitations within my scope.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-09"}