Title: PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees
Authors: James Jordon
Jinsung Yoon
Mihaela van der Schaar
Venue: ICLR 2019
Keywords: Synthetic data generation
Differential privacy
Generative adversarial networks
Private Aggregation of Teacher ensembles

Abstract: Machine learning has the potential to assist many communities in using the large datasets that are becoming more and more available. Unfortunately, much of that potential is not being realized because it would require sharing data in a way that compromises privacy. In this paper, we investigate a method for ensuring (differential) privacy of the generator of the Generative Adversarial Nets (GAN) framework. The resulting model can be used for generating synthetic data on which algorithms can be trained and validated, and on which competitions can be conducted, without compromising the privacy of the original dataset. Our method modifies the Private Aggregation of Teacher Ensembles (PATE) framework and applies it to GANs. Our modified framework (which we call PATE-GAN) allows us to tightly bound the influence of any individual sample on the model, resulting in tight differential privacy guarantees and thus an improved performance over models with the same guarantees. We also look at measuring the quality of synthetic data from a new angle; we assert that for the synthetic data to be useful for machine learning researchers, the relative performance of two algorithms (trained and tested) on the synthetic dataset should be the same as their relative performance (when trained and tested) on the original dataset. Our experiments, on various datasets, demonstrate that PATE-GAN consistently outperforms the state-of-the-art method with respect to this and other notions of synthetic data quality.


Review discussion:
The paper studies the problem of generating synthetic datasets (while ensuring differential privacy) via training a GAN. One natural approach is the teacher-student framework considered in the PATE framework.  In the original PATE framework, while the teachers are ensured to preserve differential privacy, the student model (typically a GAN) requires the presence of publicly data samples. The main contribution of this paper is to get around the requirement of public data via using uniformly random samples in [0,1]^d.
Differentially private synthetic data generation is clearly an important and a long-standing open problem. Recently, there has been some work on exploiting differentially private variants of GANs to generate synthetic data.
However, the scale of these results is far from satisfactory. The current paper claims to bypass this issue by using the PATE-GAN approach.
I am not an expert on deep learning. The idea of bypassing the use of public data by taking uniformly random samples seems interesting. In my view, these random vectors are used in the GAN as some sort of a basis. It is interesting to see if this result extends to high-dimensional settings (i.e., where d  is very large).
Thank you for your insightful comments.
A1: We have performed simulations using higher-dimensional data which we will include in the paper.
Specifically, we used two UCI datasets (UCI ISOLET dataset (dimensions: 617, no of samples: 7797, task: classify consonant vs vowel) and UCI Epileptic Seizure Recognition dataset (dimensions: 179, no of samples: 11500, task: classify seizure activity)) and varied the dimensionality to demonstrate the scalability of our method. The results on the full dataset (all 617 features and 179 features) can be seen in the following tables:
(1) UCI ISOLET Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.817     |        0.769          |       0.739      |
AUPRC                       |     0.556     |        0.473          |       0.383      |
(2) UCI Epileptic Seizure Recognition Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.917     |        0.872          |       0.819      |
AUPRC                       |     0.813      |        0.766          |       0.720      |
As can be seen in the table, PATE-GAN works well in high-dimensional data continuing to outperform DPGAN. Detailed results with various dimensionalities will be added to the revised manuscript.
[Post revision update] The authors' comments addressed my concerns, especially on the experiment side. I changed the score.
This paper applies the PATE framework to GAN, and evaluates the quality of the generated data with some predictive tasks. The experimental results on some real datasets show that the proposed algorithm outperforms DPGAN, and the generated synthetic data is quite useful in comparison with real data.
The presentation is clear and easy to follow.
However, I think the paper needs to be improved in its novelty, and the techniques and experiments need to be more thorough.
More details:
- It might be necessary to consider using Gaussian noise[24] in replace of the Laplace noise, which, according to [24], would improve privacy and accuracy.
- This paper:
“Privacy-preserving generative deep neural networks support clinical data sharing” by Brett K. Beaulieu-Jones, Zhiwei Steven Wu, Chris Williams, Casey S. Greene
seems quite relevant. If so, you may want to add some discussion in the related work section or compare with their result.
- The last paragraph of the related works section mentioned some related work with shortcomings as working only on low-dimensional data and features of specific types, yet the experiments are also mostly done on low-dimensional datasets. I think it would be better to do a thorough evaluation on data of different kinds, such as image data.
- If the two evaluation metrics for private GAN is considered an important contribution of the paper, it might be better to make it a separate section and elaborate more on the motivation and method.
- It might be better to move some details (for example, instead of presenting the results of the 12 predictive models, presenting only the average, as it’s not very important how each of them performs) of the credit card fraud detection dataset to the appendix and bring the results of the other datasets to the main body.
Thank you for your insightful comments.
A1: Our key contribution is in building on PATE, and developing a new framework which can be used in the GAN setting.
While using Gaussian noise may indeed improve our results further, the additional analysis required to use Gaussian noise for PATE is more involved (as noted in [24]), and its inclusion may therefore distract the reader from the main contribution of our paper.
A2: The method proposed in this paper is very similar to (if not the same as) DPGAN. We will modify the related works section to read:
“… The key idea is that noise is added to the gradient of the discriminator during training to create differential privacy guarantees. These ideas are also used in [Privacy-preserving generative deep neural networks support clinical data sharing]. Our method…”
A3: A key difference between our work and these works, which we will highlight in the paper, is that they do not use differential privacy.
In addition, we have performed simulations using higher-dimensional data which we will include in the paper.
Specifically, we used two UCI datasets (UCI ISOLET dataset (dimensions: 617, no of samples: 7797, task: classify consonant vs vowel) and UCI Epileptic Seizure Recognition dataset (dimensions: 179, no of samples: 11500, task: classify seizure activity)) and varied the dimensionality to demonstrate the scalability of our method. The results on the full dataset (all 617 features and 179 features) can be seen in the following tables.
(1) UCI ISOLET Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.817     |        0.769          |       0.739      |
AUPRC                       |     0.556     |        0.473          |       0.383      |
(2) UCI Epileptic Seizure Recognition Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.917     |        0.872          |       0.819      |
AUPRC                       |     0.813      |        0.766          |       0.720      |
As can be seen in the tables, PATE-GAN works well also in high-dimensional data and continues to outperform DPGAN. Detailed results will be added to the revised manuscript.
A4: Thank you for the suggestion, the new metric that we are proposing is the agreed ranking probability of section 5.4. To highlight this we will move its introduction to the end of section 4, highlighting that it is one of our contributions.
A5: Thank you for this suggestion, we will move the average results for the other datasets into the main manuscript. We will keep the 12 predictive models in the main manuscript for the Kaggle credit card fraud dataset, as we feel it gives a more complete picture of our results.
This paper considers using a GAN to generate synthetic data in a differentially private manner [see also https://www.biorxiv.org/content/early/2018/06/05/159756 ]. The key novelty is the integration of the PATE differential privacy framework from recent work.
Specifically, rather than a single distinguisher as is usual in a GAN, there is a "student distinguisher" and several "teacher distinguishers". The student distinguisher is used as usual except that it does not have access to the real data, only the teacher distinguishers have access to the real data (as well as the synthetic data). The data is partitioned amongst the teacher distinguishers and their output is aggregated in a differentially private manner (and gradients are not revealed). The role of the teacher distinguishers is solely to correct the student distinguisher when it errs.
What is strange about this setup is that the generator's only feedback is from the gradients of the student distinguisher, which is never exposed to the real data. The entire training process relies on the generator producing realistic data by chance at which point the teacher distinguishers can provide positive feedback. (The paper remarks about this in the middle of page 5.) It's surprising that this works, but there are experimental results to back it up.
I think it would be appropriate to remark that generating private synthetic data is known to be hard in the worst case [ https://eccc.weizmann.ac.il/report/2010/017/ ] and therefore it is necessary to use techniques like GANs.
Overall, I think the paper is interesting, well written, novel, and therefore appropriate for ICLR.
Thank you for your insightful comments.
A1: We note that the generator need only generate samples that are “somewhat” more realistic than other samples, thus providing the discriminator with some side information about what direction to guide the generator in. We also considered starting the student training using uniformly drawn samples from [0,1]^d and then transitioning to generator-only samples after the generator had a chance to start generating realistic samples but found this to be unnecessary. To further demonstrate this, we have now included results for higher-dimensional data in which it would be harder for the generator to do this “by chance”, and continue to show high performance.
Specifically, we used two UCI datasets (UCI ISOLET dataset (dimensions: 617, no of samples: 7797, task: classify consonant vs vowel) and UCI Epileptic Seizure Recognition dataset (dimensions: 179, no of samples: 11500, task: classify seizure activity)) and varied the dimensionality to demonstrate the scalability of our method. The results on the full dataset (all 617 features and 179 features) can be seen in the following tables.
(1) UCI ISOLET Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.817     |        0.769          |       0.739      |
AUPRC                       |     0.556     |        0.473          |       0.383      |
(2) UCI Epileptic Seizure Recognition Dataset
(epsilon, delta) = (10, 10^-5) |      GAN     |     PATE-GAN     |     DPGAN    |
AUROC                       |     0.917     |        0.872          |       0.819      |
AUPRC                       |     0.813      |        0.766          |       0.720      |
As can be seen in the tables, PATE-GAN works well in high-dimensional data continuing to outperform DPGAN. Detailed results will be added to the revised manuscript.
A2: We will add the following line to the end of the related works section:
“Finally, it is worth remarking that it is known to be hard in the worst-case to generate private synthetic data [the above-mentioned paper] and techniques such as GANs are necessary to address this challenge.

Meta-review:
role: AC
data: metareview: This paper improves upon the PATE-GAN framework for differentially-private synthetic data generation. They eliminate the need for public data samples for training the GAN, by providing a distribution which can be sampled from instead.

The authors were unanimous in their vote to accept.

Decision: Accept (Poster)