# Local Differential Privacy Image Generation Using Flow-Based Deep Generative Models
## 3 Materials and Methods
### Our Framework: DP-GLOW  
We represent a gray-scale CXR image as a vector \(x\in\mathbf{R}^{H\times W}\), where \(H\) and \(W\) are the height and width of the image, respectively. We assume that the abovementioned GLOW has already been trained with many CXR images. Moreover, as a result of the training, we assume that we obtained an invertible map \(\mathbf{G}_{\mathbf{\theta}}^{-1}\) between an elementwise independent normal distribution and a probabilistic distribution of CXR images. Our objective is to generate another image \(\mathbf{\tilde{x}}\) from \(\mathbf{x}\), which satisfies the definition of \(\epsilon\)-LDP:  
\[\log p(\mathbf{\tilde{x}}|\mathbf{x})-\log p(\mathbf{\tilde{x}}|\mathbf{x}^{ \prime}) \leq \epsilon, \tag{5}\]  
where \(\epsilon(\geq 0)\) is the privacy budget, \(\mathbf{x}^{\prime}\) is an arbitrary image taken from a probabilistic distribution of CXR images, \(p(\mathbf{\tilde{x}}|\mathbf{x})\) is the posterior probability to obtain \(\mathbf{\tilde{x}}\) when we already obtained \(\mathbf{x}\), and \(p(\mathbf{\tilde{x}}|\mathbf{x}^{\prime})\) is the posterior probability to obtain \(\mathbf{\tilde{x}}\) when we already obtained \(\mathbf{x}^{\prime}\). Specifically, even if we simply add noise that follows a Laplace distribution to the image itself, the image satisfies local differential privacy. However, especially when the privacy budget is small, the intensity of the noise increases, and the class of the image (in this case, CXR images) is not retained. In such cases, the utility drastically decreases. To avoid this, in this study, we add noise following the Laplace distribution to the image mapped to the latent space and then revert the perturbed latent space vector back to the image space. To this end, we introduce a trained invertible vector function \(\mathbf{G}_{\mathbf{\theta}}^{-1}\), which maps \(\mathbf{x}\) into another vector \(\mathbf{z}\) (a latent space vector), each element of which does not have a correlation with other elements. This vector function is, in general, dependent on the probabilistic distribution of images we adopt (e.g., CXR, head computed tomography, and mammography images). Therefore, we explicitly represent this dependence as parameters \(\mathbf{\theta}\). We further define \(\mathbf{z}^{\prime}\equiv\mathbf{G}_{\mathbf{\theta}}^{-1}(\mathbf{x}^{\prime})\), and \(\mathbf{\tilde{z}}\equiv\mathbf{G}_{\mathbf{\theta}}^{-1}(\mathbf{\tilde{x}})\). As we will prove later, we can add noise that follows the Laplace distribution to the latent space vector:  
\[\tilde{z}_{k} = \mathbf{z}_{k}+\mathcal{N}_{k}, \tag{6}\] \[\mathcal{N}_{k} \sim \text{Lap}\left(\mu_{k}=0,\sigma_{k}=\frac{\Delta z_{k}}{\frac{ \epsilon}{H\cdot W}}\right), \tag{7}\]  
where \(\mu_{k}\) and \(\sigma_{k}\) are, respectively, the expectation (a scalar) and scale (a scalar) of the Laplace distribution, \(\epsilon\) is the user-defined privacy budget, and \(\Delta z_{k}\) is the sensitivity for the element \(k\) defined as:  
\[\Delta z_{k} := \max_{\mathbf{z},\mathbf{z}^{\prime}:\mathbf{z}\
eq\mathbf{z}^{\prime}}|z_{k}-z_{ k}^{\prime}|, \tag{8}\]  
where \(\mathbf{z}\) and \(\mathbf{z}^{\prime}\) run latent vectors of all the training images. Moreover, we set a bound for each element of the latent space vector so that \(\mathbf{x}\) and \(\mathbf{\tilde{x}}\) are in the probabilistic distribution of CXR images:  
\[z_{k} \leftarrow \text{clip}\Big{(}z_{k},c_{k}-\frac{w_{k}}{2},c_{k}+\frac{w_{k} }{2}\Big{)}, \tag{9}\] \[\tilde{z}_{k} \leftarrow \text{clip}\Big{(}\tilde{z}_{k},c_{k}-\frac{w_{k}}{2},c_{k}+\frac {w_{k}}{2}\Big{)},\] (10) \[w_{k} = \alpha\cdot(\max_{z}z_{k}-\min_{z}z_{k}),\] (11) \[c_{k} = \frac{(\max_{z}z_{k}+\min_{z}z_{k})}{2}, \tag{12}\]where min and max operators, respectively, find the minimum and maximum values over all the latent space vectors \(z\) for training images, the scalar function \(\text{clip}(x,a,b)\) bounds the value of \(x\) such that \(a\leq x\leq b\), and the subscript \(k\) means the element number (runs all the elements of the latent space vector).