Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training

Authors: kristjan  greenewald
yuancheng  yu
hao  wang
kai  xu
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 15:19:18

Abstract: Training generative models with differential privacy (DP)  typically involves injecting noise into gradient updates or adapting the discriminator's training procedure. As a result, such approaches often struggle with hyper-parameter tuning and convergence. 
We consider the \emph{slicing privacy mechanism} that injects noise into random low-dimensional projections of the private data, and provide strong privacy guarantees for it. These noisy projections are used for training generative models.
To enable optimizing generative models using this DP approach, we introduce the \emph{smoothed-sliced $f$-divergence} and show it enjoys statistical consistency.  
Moreover, we present a kernel-based estimator for this divergence, circumventing the need for adversarial training. 
Extensive numerical experiments demonstrate that our approach can generate synthetic data of higher quality compared with baselines. Beyond performance improvement, our method, by sidestepping the need for noisy gradients, offers data scientists the flexibility to adjust generator architecture and hyper-parameters, run the optimization over any number of epochs, and even restart the optimization process---all without incurring additional privacy costs.

Main paper: 
 introduction: 
 Just as oil fueled the industrial revolution, data now propels innovation and progress in today's digital life. However, data sharing faces challenges due to privacy risks and regulatory policies (e.g., GDPR, CCPA, FTC). Synthetic data offers a promising solution as it closely resembles real data, retains its formats and essential properties, and can be seamlessly integrated into existing workflows. Nonetheless, modern generative models are vulnerable to privacy attacks that could expose individuals' sensitive information in the original data [HMDDC17, CYZF20, SOT22] . Today, differential privacy (DP) [DR14] stands as the de facto standard for privacy protection and it plays a crucial role in guiding the design of synthetic data. For example, DP was used in the release of microdata from Israel's National Registry of live births in 2014 to protect the privacy of mothers and newborns [HC24] , as well as in the release of global victim-perpetrator data to ensure the privacy of victims [fM22] . Additionally, a recent publication [NDL + 23] by the National Institute of Standards and Technology (NIST) recommends the use of DP algorithms in generating synthetic data to provide robust privacy protection against rapid developments in privacy attacks.Existing approaches to training generative models often integrate DP by injecting noise into gradient updates or adapting the discriminator's training procedure [XLW + 18, TKP19, CBV + 21, TTCY21, BJWW + 19, JYVDS19, TWB + 19, BKZ23, NPA23, LJW + 20, XGJ + 22, COF20]. They provide several benefits, such as the ability to generate diverse data types (including continuous data, time-series, and images), scalability to high-dimensional data, and accelerated runtime using GPUs. However, fine-tuning hyper-parameters within these frameworks can be challenging [NWD20, PS22, LT19] . Additionally, they encounter a dilemma when determining the number of training epochs: with a fixed privacy budget, increasing the number of epochs requires injecting more noise into gradient update per iteration, while fewer epochs might not be sufficient for the optimizer to converge. In such a setting, if the training does not converge, the only recourse may be to increase the privacy budget. This motivates a fundamental question:How can we train generative models with DP guarantees while ensuring easy fine-tuning, stable convergence, and high utility?In this paper, we introduce a new learning paradigm for training privacy-preserving generative models.Our approach decouples the training process into two steps: (i) computing noisy low-dimensional projections of the private data along random directions, and (ii) updating the generative models to fit these noisy projections. We establish DP guarantees for the first step and leverage the random projection to further tighten our privacy bound. This decoupling strategy offers several advantages. The post-processing property of DP ensures that any deep learning techniques can be applied in the second step. In other words, our approach is model-agnostic, allowing for smooth integration into existing training pipelines of generative models. With our method, data scientists have the flexibility to adjust generator architecture and hyper-parameters, optimize the generative model for any number of epochs, and even restart the optimization-all without worrying about additional privacy costs.Based on this paradigm, we are motivated to introduce a new information-theoretic measure: the smoothed-sliced f -divergence. This divergence (randomly) projects the original and synthetic data distributions onto lower-dimensional spaces, followed by smoothing with isotropic Gaussian noise, and averaging their f -divergence over all projections. We prove that using this divergence as the loss function in generative model training is equivalent to the aforementioned two-step training process. Additionally, we present a kernel-based, differentiable estimator for this divergence. It circumvents the need for adversarial training in generative models, thereby enhancing convergence stability and robustness to different choices of hyper-parameters. Finally, we establish the statistical consistency of training generative models using this divergence.In terms of the slicing mechanism, we build upon the work of [RL21] . They introduced the smoothedsliced Wasserstein distance and applied it to generative models and domain adaptation tasks. However, their approach is limited to 1-dimensional projection spaces (k = 1), exploiting the closed-form expression of Wasserstein distances in 1D. Moreover, their privacy analysis contains a significant flaw in its derivation (see Remark 1 for detailed discussions). In contrast, we propose a generic framework for training privacy-preserving generative models, applicable to any k-dimensional projections. Empirically, we observe that setting the projection dimension to a small number (e.g., k = 2, 3) significantly improves the quality of synthetic data compared with k = 1 under the same privacy budget. Additionally, our kernel-based estimator eliminates the need for adversarial training in generative models, facilitating stable convergence. Finally, we present a completely new proof for establishing the DP guarantees of our framework. This analysis also applies to any smoothsliced divergence objective, for instance, we provide corrected (and improved!) DP bounds for the smoothed-sliced Wasserstein framework of [RL21] .We demonstrate the effectiveness of our method through numerical experiments. We compare generative models trained using our method with those trained by standard privacy mechanisms (DP-SGD, PATE, or smoothed-sliced Wasserstein distance) among various real-world datasets. The results indicate that our approach consistently produces synthetic data of higher quality compared with baseline methods.In summary, our main contributions are:• We introduce a new framework for training privacy-preserving generative models. It offers easy hyper-parameter tuning and allows for optimizing generative models over any number of training epochs without extra privacy costs.• We propose a new information-theoretic divergence and provide a kernel-based estimator. This estimator enables the training of generative models without relying on adversarial training, enhancing convergence stability.• For the slicing mechanism, we extend the work of [RL21] and allow for projecting data onto any k-dimensional space. Using an entirely new proof technique, we provide DP guarantees, which in the k = 1 setting correct (and strengthen!) the privacy analysis in [RL21] .• We validate our method through numerical experiments. The results show that our method produces synthetic data of higher quality compared with baselines.Recent work has proposed alternative approaches for training DP generative models without adversarial networks. For example, [CBV + 21] considered using the Sinkhorn divergence as the loss function, but their method adds noise to gradient updates to ensure DP, which leads to the challenges discussed in the introduction. Another line of work [HAP21, VCH + 22, HJSP23, YAS + 23] used the maximum mean discrepancy (MMD) to train DP generative models. They inject noise into the embedding of the private data distribution to maintain DP. However, minimizing their loss function to zero does not guarantee perfect matching between the synthetic and real data distributions, due to either not using a characteristic kernel or the approximation errors stemming from using finite-dimensional feature mappings to approximate the kernel function. In contrast, Proposition 1 proves that our smoothed-sliced f -divergence equals zero iff the synthetic and real distributions are identical; Corollary 1 establishes the statistical consistency of training generative models using our loss function. Additionally, we amplify our privacy bound by leveraging random projections in Theorem 1. A burgeoning line of work has explored slicing and smoothing to improve sample complexity in estimating divergence and optimal transport measures. These measures often suffer from extreme curses of dimensionality (e.g., n -1/d for Wasserstein distance [Dud69] ). Previous studies have shown that both slicing [RPDB11, VFT + 19, LZC + 21, NDC + 20, GG21] and smoothing [GGNWP20, GG20] facilitate convergence at the parametric rate for both f -divergences and optimal transport distances, while preserving key properties of the original divergence (e.g., being zero iff the two distributions are identical). These modified divergences are also used as objective functions for training generative models. In our context, the use of smoothed-sliced divergence is less motivated by sample complexity (indeed using both smoothing and slicing would be unnecessary for achieving the parametric rate). Instead, it is motivated by the slicing privacy mechanism. Also, while we enjoy the sample complexity benefits of slicing, we do not benefit from the sample complexity improvements of smoothing [GGK20] . This is because achieving DP requires injecting a finite number (typically just one) of noise realizations per data point. Full smoothing results are still useful, however, for our consistency results in the asymptotic regime.While the 1-dimensional sliced Wasserstein distance can be computed via a simple sorting algorithm [DZS18] , there is in general no closed-form sample-based estimator for f -divergence, even in one dimension. While nearest neighbor [WKV09] and kernel-based [MSGHI18] estimators do exist, they often suffer from scalability issues and are not friendly to gradient-based optimization. Hence, it is a common practice to use dual forms of f -divergence in deriving adversarial-based training procedures for generative models [NCT16] . In the present work, we avoid this costly adversarial training using our moment matching estimator.The supplementary material of this paper includes: (i) omitted proofs of all theoretical results and (ii) supporting experimental results. 
preliminaries and problem setup: 
 In this section, we review the concepts of differential privacy (DP), f -divergence, and a moment matching method used for estimating f -divergence.We denote the original dataset as a matrix X ∈ R n×d , where n denotes the number of records and d represents the number of real-valued features per record. Definition 1 (Dataset adjacency). Two datasets X and X ′ are considered adjacent if they differ in a single row, say the i-th row, such that ∥X i,: -X ′ i,: ∥ 2 ≤ 1 where X i,: and X ′ i,: are the i-th row of X and X ′ , respectively.Next, we recall the definition of differential privacy (DP) [DR14] . Definition 2 ((ϵ, δ) differential privacy). A randomized mechanism M : R n×d → O satisfies (ϵ, δ)-differential privacy if for any adjacent datasets X, X ′ and all possible outcomes S ⊆ O, we have:Pr(M(X) ∈ S) ≤ exp(ϵ) Pr(M(X ′ ) ∈ S) + δ.DP has many compelling properties. The post-processing property states that if a mechanism M is (ϵ, δ)-DP, its outcome remains (ϵ, δ)-DP even after applying a (potentially randomized) function; the basic composition rule states that given a sequence of mechanisms M 1 , . . .M k , if M i is (ϵ i , δ i )-DP, then their composition M(D) = (M 1 (D), . . . , M k (D)) will satisfy ( k i=1 ϵ i , k i=1 δ i )-DP.We first recall the definition of f -divergence [Chapter 7 in PW23]. Definition 3. Let f : (0, ∞) → R be a convex function with f (1) = 0 and f (0) ≜ f (0+). Let P X and Q X be two probability distributions on X . If P ≪ Q, then the f -divergence is defined asD f (P ∥Q) ≜ E Q f dP dQwhere dP dQ is a Radon-Nikodym derivative. Additionally, we denote the density ratio by r(x) ≜ dP dQ (x).f -divergences have many nice properties. For example, it is always non-negative; and assuming f is strictly convex at 1, then D f (P ∥Q) = 0 if and only P = Q.There is a burgeoning field of research focusing on f -divergence estimation [see e.g., GGNWP20, WY20, SXGS20]. Here we revisit a framework based on kernel mean matching, a special instance of moment matching methods [Chapter 3 in SSK12]. Given a reproducing kernel K(x, x ′ ), one can solve the following optimization problem to estimate the density-ratio function:min r∈R K(x, •)dP (x) -K(x, •)r(x)dQ(x) 2 R ,where ∥ • ∥ R denotes the norm of a reproducing kernel Hilbert space R. One example of reproducing kernels is the Gaussian kernel K(x, x ′ ) = exp-∥x-x ′ ∥ 2 2 2σ 2 g . Given {x p i } np i=1drawn from P and {x q j } nq j=1 drawn from Q, we can optimize an empirical version of the above optimization to obtain an analytical solution:rq = n q n p K -1 q,q K q,p 1 np ,where rq ∈ R nq is the (empirically) optimal density ratio values at samples drawn from Q, K q,q ∈ R nq×nq and K q,p ∈ R nq×np are the kernel Gram matrices:[r q ] j = r x q j , [K q,q ] j,j ′ = K x q j , x q j ′ , [K q,p ] j,i = K x q j , x p i . We extend the definition of f to a vector by applying it to each element of the vector. Then we haveDf (P ∥Q) = 1 n q 1 T nq f (r q ) = 1 n q 1 T nq f n q n p K -1 q,q K q,p 1 np .(1) 
main results: 
 We introduce a new information-theoretic measure-the smoothed-sliced f -divergence. We show that this divergence can measure the difference between distributions, with only access to noised k-dimensional slices of the distributions. This finding motivates a new DP mechanism: the k-slicing privacy mechanism. Finally, using the non-adversarial estimator (1), we apply the smoothed-sliced f -divergence as a new loss function to train privacy-preserving generative models.We start with giving a formal definition of the smoothed-sliced f -divergence.Definition 4. Denote the Stiefel manifold of d×k matrices with orthonormal columns byS k (R d ). Let Θ ∼ Unif(S k (R d )) and N ∼ N (0, σ 2 I k ). The smoothed-sliced f -divergence between distributions P X and Q X on R d is defined as SD f,k,σ 2 (P X ∥Q X ) ≜ D f (P Θ T X+N|Θ ∥Q Θ T X+N|Θ |P Θ ) = 1 vol(S k (R d )) θ θ θ∈S k (R d ) D f (P θ θ θ T X+N ∥Q θ θ θ T X+N )dθ θ θ.Next, we discuss some basic properties of this new divergence.Proposition 1. The smoothed-sliced f -divergence is non-negative: SD f,k,σ 2 (P X ∥Q X ) ≥ 0 for any k ≥ 1 and σ ≥ 0. If f is strictly convex at 1 and P X , Q X have moment generating functions, then SD f,k,σ 2 (P X ∥Q X ) = 0 if and only if P X = Q X .Given a set of real data {x i } n i=1 (i.e., rows of X) and synthetic data {x syn i } nsyn i=1 , let Df denote any estimator of k-dimensional f -divergence (e.g., (1)). We draw random directions θ θ θ s and additive noise v s,i and vs,i . Then we can estimate the smoothed-sliced f -divergence byEQUATIONAs SD f,k,σ 2 is an empirical average of m estimates of k-dimensional divergences, this estimator will inherit any statistical convergence bounds that apply to the chosen Df .The loss function in (2) accesses the original data solely through their noisy projections along random directions. This observation motivates the following k-slicing privacy mechanism.Definition 5. Let k denote the dimension of the random projections, and m denote the number of them, yielding m ′ = mk. Let X ∈ R n×d represent the original dataset where we assume ∥X i,:∥ 2 ≤ 1 for all i. Let U ∈ R d×m ′ and V ∈ R n×m ′be random slicing and noise matrices with each element independently drawn from U i,j ∼ N (0, d -1 ) and V i,j ∼ N (0, σ 2 ), respectively. The slicing privacy mechanism is defined asM(X) ≜ (U, XU + V).(3)Remark 1. Our mechanism outputs the random slicing matrix U, as it will be used to project the synthetic data onto the same spaces during the training of generative models. In contrast, [RL21] did not include U in their privacy mechanism, leading them to give an incorrect derivation of the privacy guarantee. Similarly, our approach differs from using the Johnson-Lindenstrauss transform to preserve DP [BBDS12, EKKL20], as these methods do not reveal the random matrix.In Definition 5, we draw random projections from a Gaussian distribution instead of uniformly from the Stiefel manifold. This choice simplifies the sampling procedure and streamlines our privacy analysis by making the the mechanism output jointly Gaussian with zero mean, conditioned on the data. Next, we establish the DP guarantees for our noisy slicing mechanism.Theorem 1. Assume γ ≜ σ -2 (α 2 -α) < d. For all δ ∈ (0, 1) and α > 1, the mechanism M(X) = (U, XU + V) in Definition 5 satisfies m ′ α 2σ 2 (d -γ) + ln(1/δ) α -1 , δ -DP.where (ϵ, δ)-DP is as defined in Definition 2 with dataset adjacency specified in Definition 1.Our privacy bound relies on k (the dimension of projection spaces) and m (the number of slices) only through their product m ′ = mk, which reveals a trade-off: with a fixed privacy budget, increasing k aids generative models in capturing higher-order information of the original data, while increasing m improves the accuracy of learning lower-order information. This trade-off resembles marginal-based mechanisms, where adjusting k to enable generative models to learn the k-way marginal queries [Definition 1 in LVW21] involves a similar effect. However, we remark that even one-dimensional slices suffice to fully characterize a distribution since SD f,1,σ2 (P X ∥P X syn ) = 0 implies P X = P X syn by Proposition 1. In contrast, matching all k-way marginal distributions for k < d does not necessarily ensure P X = P X syn .We prove in Appendix Proposition 3 that the slicing privacy mechanism is mα 2σ 2 + ln(1/δ) α-1 , δ -DP if the projection matrix U is deterministic. Comparing it with Theorem 1, we observe that by randomly selecting the projection matrix, we can achieve a tighter privacy bound by reducing a factor of k d-γ (for the first-term), even if U is disclosed by the privacy mechanism. The rationale behind this lies in the fact that a deterministic projection matrix allows the model designer/adversary to target specific individual records through carefully designed projection directions. Remark 2 (Choosing α). The bound in Theorem 1 can be optimized in terms of α for a desired fixed δ and this optimization can be done numerically. Alternatively, there is an ad hoc strategy for 'approximately optimizing' α.Let us assume γ ≤ d/2, i.e. α 2 -α ≤ dσ 2 /2. Then ϵ ≤ m ′ α σ 2 d + ln(1/δ) α -1 .Minimizing the right hand side expression w.r.t. α > 1 yields an optimalα * = 1 + σ 2 d ln(1/δ) m ′ .Substituting it into the (true) expression for ϵ yieldsϵ * = m ′ 2σ 2 (d -γ * ) + 1 + d 2(d -γ) m ′ ln(1/δ) σ 2 d ≤ m ′ σ 2 d + 2 m ′ ln(1/δ) σ 2 d ,where γ * = σ -2 (α 2 -α).We outline our approach for training privacy-preserving generative models using the smoothed-sliced f -divergence (see Algorithm 1 for more details). First, we transform the output of the slicing privacy mechanismM(X) = (U, XU + V) into O = {(θ θ θ s , o i,s )} s∈[m],i∈[n] .Here θ θ θ s = U :,(s-1)k+1:sk ∈ R d×k is the random slicing directions and o i,s = (XU + V) i,(s-1)k+1:sk ∈ R k is the (noisy) projection of the i-th data point onto the s-th slice.Let G ω be a generative model with trainable parameters ω ∈ Ω. At each iteration, we sample a mini-batch from O as{(θ θ θ s , o i,s )} s∈[m],i∈[b], where b is the batch size.To produce synthetic data, we draw random noise z j for j ∈ [b] and feed them into the generative model x syn j = G ω (z j ). Additionally, we draw random noise vj,s ∼ N (0, σ 2 I k ) for j ∈ [b] and s ∈ [m] that will be added to the projected synthetic data. 2 Given these samples, we train the generative model G ω to generate samples close to the real data, using an estimator for the sliced f -divergence to measure the discrepancy between the noisy-sliced real data o i,s and the noisy-sliced synthetic data x syn j θ θ θ s + vj,s . The smoothed slice f -divergence (2) yields the following loss function:EQUATIONThe following corollary is a direct application of Proposition 1.Corollary 1 (Consistency). Consider a dataset X ∈ R n×d of n i.i.d. samples from a d-dimensional distribution P X whose moment generating function exists, and the slicing privacy mechanism M(X) as in Definition 5. Suppose the noise level σ is fixed while m → ∞ and n → ∞. 3 Additionally, suppose that the chosen f -divergence estimator Df is consistent and f is strictly convex at 1. Then lim n,m,b→∞ L(ω * ) = 0 for some ω * ∈ Ω if and only if G ω * (Z) ∼ P X .Inserting our kernel-based estimator (1) yields for kernel KEQUATIONwhere we compute the kernel Gram matrices K s , K s,ω ∈ R b×b along each slice:EQUATIONTo ensure the stability of computing matrix inversion, we include a τ I b where τ > 0 is a small constant. Given that the domain of f is [0, ∞), we clip the density ratio estimator to make it non-negative. Remark 3. Note that to compute the kernel Gram matrices K s and K s,ω , we need to apply the Gaussian kernel, which requires a constant σ g . A heuristic of choosing this σ g is to make it the median distance between all samples-note that this will lead to different kernels along different slices. In practice, we use an ensemble of σ g and average their density ratio estimators. Compute the kernel Gram matrices (6) under Gaussian kernels in each slice.Compute the loss function L(ω) in (5). Run stochastic-gradient optimization ω ← ω -η∇ωL(ω). end for Output: generative model Gω. 
numerical experiments: 
 We validate our approach and compare it with baselines through numerical experiments. Additional experimental results and details of our setup are reported in Appendix C.Baselines. We compare our Algorithm 1 with four DP mechanisms: DP-SGD For SliceWass, we combine our slicing privacy mechanism with their main algorithm, which fixes the flaw in their privacy analysis and improves their privacy guarantees (and therefore quality results). Additionally, since their public Github repo does not include their synthetic data code, we implement their algorithm ourselves.Data. We validate both our method and baselines using the US Census data derived from the American Community Survey (ACS) Public Use Microdata Sample (PUMS). Using the API of the Folktables package [DHMS21] , we access the 2018 California data. Additionally, Folktables package provides five prediction tasks (Income , Coverage, Mobility, Employment, TravelTime) based on a target column and a set of mixed-type features. Details about these data, including the number of records and columns, are provided in Table 2 in the appendix.Evaluation metrics. We follow the evaluation principles in [TMH + 21] for assessing the quality of synthetic data and leverage the APIs from an open-source library in our implementation [Dat23] .• KSComplement (numerical columns) and TVComplement (categorical columns). They measure the (average) similarity of one-way marginals (i.e., histograms of individual columns) between real and synthetic data. • ContingencySimilarity. It measures the (average) similarity of pairs of categorical columns between real and synthetic data. • CorrelationSimilarity. It measures the (average) correlations among numerical column pairs and computes the similarity between real and synthetic data. • BinaryLogisticRegression. It measures the downstream classifier's F-1 score when trained on synthetic and test on real data.Note that the benchmark datasets contain a limited number of numerical columns, with the majority being categorical (see Table 2 ). Hence, the applicability of CorrelationSimilarity and KSComplement is constrained as they are tailored for numerical columns.Main results and observations. We present the experimental results for ϵ = 5.1 in Table 1 and show results for ϵ = 8.1 in Appendix C. As shown, the two methods using the slicing privacy mechanism (Algorithm 1 and SliceWass) consistently outperform the other baselines. MERF has better numbers for three instances of KSComp and one of LogitRegression, but is signficantly worse in other instances and for the remaining metrics. For both Algorithm 1 and SliceWass, we used the same hyper-parameter initialization and neural network architecture across all datasets. We believe that with more extensive hyperparameter tuning, which incurs no extra privacy cost as previously discussed, their performance could be even further improved.Algorithm 1 exhibits a more favorable performance compared with SliceWass in most settings. The rationale behind this observation lies in the fact that SliceWass is limited to 1-dimensional slices (k = 1), relying on the closed-form expression of Wasserstein distances in 1D. In contrast, our Algorithm 1 is applicable to higher-dimensional slices. This capability enables the generative models to capture higher-order statistical information, leading to better performance in the pairwise ContingencySimilarity statistic and higher robustness in the BinaryLogisticRegression downstream task. We conduct an experiment to generate DP synthetic image data using the MNIST dataset [LBBH98] . We train separate generative models for each of the 10 classes in MNIST, with 10% of the data randomly sampled for each class. We evaluate the quality of the synthetic images by measuring the downstream accuracy of a classifier trained on the synthetic data and deployed on the real MNIST test set. We compare Algorithm 1 and SliceWass (combined with our slicing privacy mechanism), with MERF, which is a state-of-the-art MMD-based method for generating synthetic images [HAP21] . We observe that MERF outperforms the two slicing-mechanism-based algorithms at lower privacy budgets but underperforms at higher budgets. We hypothesize that MERF achieves superior performance in the low-budget regime since it privatizes only the mean embedding of the data for each class; its generative model is designed to recover this mean rather than the full data distribution. As using only the mean involves very little privacy budget, they are able to add less noise and outperform in the low-budget regime. Our approach, which models the full data distribution, does not benefit from these savings. However, as the privacy budget increases, our method better captures the true data distribution, leading to improved results over MERF. Following the experiments in [RL21] , for completeness we also apply our smoothed-sliced f -divergence in domain adaptation tasks. We benchmark our approach with SliceWass [RL21] using the implementation available on their Github repo, modified to use our DP bound. This experiment aims to privately train a classifier using labeled data from a source domain and unlabelled data from a target domain. We consider the target and source domains being MNIST and USPS, as well as the reverse. Results for varying ϵ are depicted in Figure 2 . As shown, our Algorithm 1 using 100 slices improves on SliceWass. 
final remarks and limitations: 
 In this paper, we consider the slicing mechanism for training privacy-preserving generative models and derive strong privacy guarantees for it. This mechanism motivates us to combine it with fdivergence to yield a smoothed-sliced f -divergence that can be estimated with a kernel-based density ratio estimator. Our approach circumvents the need for injecting noise into gradient updates and avoids adversarial training for optimizing generative models. It provides flexibility in selecting neural architectures and tuning hyper-parameters without incurring additional privacy costs. Through experiments on synthetic data generation, we validate our approach and compare it with existing baselines. Our findings suggest that the slicing privacy mechanism is a powerful tool for training generative models to create private synthetic data, and the smoothed-sliced f -divergence provides a promising avenue for advancing the field of privacy-preserving data synthesis in sensitive, highdimensional datasets. Additionally, we hope our effort can be of particular interest to the information theory community and open up a new application frontier for classical information-theoretic tools.There are several promising avenues worth exploring. The f -divergence has many nice properties, including (strong) data processing inequalities, inequalities among different f -divergences, and variational representation. It would be interesting to investigate whether similar properties extend to the smoothed-sliced f -divergence SD f,k,σ 2 . Additionally, deriving sample-complexity bounds for estimating SD f,k,σ 2 from finite samples would offer valuable insights. Finally, the use of synthetic data presents both opportunities and challenges. On the one hand, synthetic data is well-suited for various tasks like early model development, educational demonstrations, simulation, and testing. On the other, synthetic data can never fully replicate all aspects of the original data, and adding DP guarantees introduces an additional layer of complexity requiring a careful balance between privacy and utility. Therefore, any machine learning models trained on synthetic data or any insights drawn from synthetic data should undergo thorough evaluation before deployment in real-world scenarios. If biases are detected, it is crucial to diagnose their source-whether stemming from the synthetic data generation algorithm, the noise added to the real data, or other factors-to ensure that the models perform robustly and reliably in practice.Before diving into the proof of Theorem 1, we will first revisit the definition of Rényi differential privacy (RDP) [Mir17, DR16, BS16] and its connection with differential privacy (DP). Additionally, we will recall a useful property of DP known as privacy amplification by subsampling. Definition 6. A randomized mechanism M : R n×d → O satisfies (α, ϵ)-RDP if for any adjacent datasets X, X ′ ∈ R n×d , we havesup X∼X ′ D α (M(X)||M(X ′ )) ≤ ϵ,where D α is the Rényi-α divergence.Proposition 2 (Prop. 3 in [Mir17] ). If M is an (α, ϵ)-RDP mechanism, it also satisfies (ϵ+ ln(1/δ) α-1 , δ)-DP for all δ ∈ (0, 1).We remind readers that two datasets X and X ′ are considered adjacent if they differ in a single row, say the i-th row, such that ∥X i,: -X ′ i,: ∥ 2 ≤ 1 where X i,: and X ′ i,: are the i-th row of X and X ′ , respectively. This condition applies, for example, to unbounded DP (add/remove one record) when the L 2 norm of each record is upper bounded by 1.We revisit privacy amplification by subsampling, a useful technique for handling large-scale datasets that can save computational resources and memory. It proposes that the privacy guarantees of a DP mechanism can be improved by randomly subsampling the private dataset before applying the DP mechanism[KLN + 11, LQS12, BBG18]. Lemma 1. Given a dataset X = [x T 1 , • • • , x T n ] T , PoissonSample τ independently draws Bernoulli random variables σ i ∼ Bern(τ ) for i ∈ [n] and outputs a subset [x T i ] T σi=1,i∈[n] . If a mechanism M is (ϵ, δ)-DP, then M • PoissonSample τ satisfies (ϵ ′ , δ ′ )-DP where ϵ ′ = log(1 + τ (e ϵ -1)) and δ ′ = τ δ.We introduce some notations and a result from [GAL13] that will be used in proving the following lemma. For a matrix A ∈ R m×n , its determinant is denoted by |A|. The vectorization of A is defined asvec(A) ≜ [a 1,1 , • • • , a m,1 , • • • , a 1,n , • • • , a m,n ] T .For two matrices A ∈ R m×n and B ∈ R p×q , their Kronecker product A ⊗ B is the pm × qn block matrix:A ⊗ B ≜    a 1,1 B • • • a 1,n B . . . . . . . . . a m,1 B • • • a m,n B    .We recall a result from [GAL13, Table 2 ]:EQUATIONwhenever αΣ Σ Σ -1 + (1 -α)Σ Σ Σ ′ -1 > 0.Next, we establish the RDP guarantees for our mechanism.Lemma 2. Assume α > 1 and γ ≜ σ -2 (α 2 -α) < d. Let U ∈ R d×m ′ and V ∈ R n×m ′ be two random matrices whose elements are drawn independently from N (0, d -1 ) and N (0, σ 2 ), respectively. Then the mechanism M(X) = (U, XU + V) satisfies (α, ϵ)-RDP whereϵ = m ′ α 2σ 2 (d -γ) .Proof of Lemma 2. Since X is not random, the mechanism M(X) maps X to a (dm ′ + nm ′ )-variate Gaussian distribution with mean zero and covarianceEQUATIONwhere we defineB ≜ I d X T X XX T + dσ 2 I n . Combining (7) with (8) yields D α (M(X)∥M(X ′ )) = - m ′ 2(α -1) ln |(1 -α)B + αB ′ | |B| 1-α |B ′ | α = m ′ 2(α -1) (1 -α) ln |B| + α ln |B ′ | -ln |(1 -α)B + αB ′ | .Next, we compute the determinants in the above Rényi divergence. Using the formula for determinants of block matrices, we know|B| = |B ′ | = |dσ 2 I n |.For the linear combination, we have|(1 -α)B + αB ′ | = I d (1 -α)X T + αX ′ T (1 -α)X + αX ′ (1 -α)XX T + αX ′ X ′ T + dσ 2 I n = dσ 2 I n + (1 -α)XX T + αX ′ X ′ T -((1 -α)X + αX ′ ) ((1 -α)X + αX ′ ) T .We denote∆ ∆ ∆ ≜ (1 -α)XX T + αX ′ X ′ T -((1 -α)X + αX ′ ) ((1 -α)X + αX ′ ) T = -α(XX T -X ′ X ′ T ) -α 2 (X -X ′ )(X -X ′ ) T + αX(X -X ′ ) T + α(X -X ′ )X T = -α(-(X -X ′ )(X -X ′ ) T + X(X -X ′ ) T + (X -X ′ )X T ) -α 2 (X -X ′ )(X -X ′ ) T + αX(X -X ′ ) T + α(X -X ′ )X T = (α -α 2 )(X -X ′ )(X -X ′ ) T .Since X and X ′ only differ in the i-th row, only one entry of this matrix can be nonzero, specifically,α -α 2 ≤ ∆ ii ≤ 0. Then D α (M(X)||M(X ′ )) = m ′ 2(α -1) (1 -α) ln |B| + α ln |B ′ | -ln |(1 -α)B + αB ′ | = m ′ 2(α -1) ln |dσ 2 I n | -ln |dσ 2 I n + ∆ ∆ ∆| = m ′ 2(α -1) ln(dσ 2 ) -ln(dσ 2 + ∆ ii ) .Recall the assumption that |∆ ii | ≤ α 2 -α ≤ γσ 2 for γ ∈ (0, d). Then using the fact that log(a) is concave in a and has derivative 1/a for a > 0,D α (M(X)||M(X ′ )) ≤ - m ′ 2(α -1) 1 dσ 2 + ∆ ii ∆ ii ≤ m ′ 2(α -1) 1 dσ 2 + (α -α 2 ) (α 2 -α) ≤ m ′ 2(α -1) 1 (d -γ)σ 2 (α 2 -α) ≤ m ′ 2(d -γ)σ 2 (α -1) (α 2 -α) ≤ m ′ α 2σ 2 (d -γ) .Proof of Theorem 1. Theorem 1 follows directly from combining Lemma 2 with Proposition 2.Next, we establish a privacy bound assuming the projection matrix U is deterministic. Comparing this with Theorem 1, we observe that by randomly selecting the projection matrix, we can achieve a tighter privacy bound, even if it is disclosed by the privacy mechanism.Proposition 3. Let X ∈ R n×d represents the original dataset. Let V ∈ R n×m ′ be a random noise matrix with each element independently drawn from V i,j ∼ N (0, σ 2 ). Let U ∈ R d×m ′ be a deterministic matrix such that for any j ∈ [m]U :,(j-1)k+1 , • • • , U :,jk are orthonormalThe privacy mechanism M det (X) ≜ XU + V satisfiesmα 2σ 2 + ln(1/δ) α -1 , δ -DP.Proof of Proposition 3. The privacy mechanism M det maps X to a nm ′ -variate Gaussian distribution with mean and covariance being:mean(XU + V) = vec(XU), Cov(XU + V) = σ 2 I nm ′ . Using (7) yields D α (M(X)∥M(X ′ )) = α 2 vec(XU -X ′ U) T (σ 2 I nm ′ ) -1 vec(XU -X ′ U) = α 2σ 2 vec((X -X ′ )U) T vec((X -X ′ )U) = α 2σ 2 ∥(X i,: -X ′ i,: )U∥ 2 2 .Without loss of generality, we assumeX i,: -X ′ i,: = [x, 0, • • • , 0] with |x| ≤ 1.Additionally, recall the assumption that for any j ∈ [m], U :,(j-1)k+1 , • • • , U :,jk are orthonormal. Hence, U 2 1,(j-1)k+1+ • • • + U 2 1,jk+1 ≤ 1, leading to D α (M(X)∥M(X ′ )) ≤ α 2σ 2 m ′ j=1 U 2 1,j ≤ αm 2σ 2 .As a result, our privacy mechanism is (α, αm 2σ 2 )-RDP. Combining it with Proposition 2 yields the desired DP guarantee.Proof of Proposition 1. The property SD f,k,σ 2 (P X ∥Q X ) ≥ 0 follows by the non-negativity of the f -divergence in the integrand.If P X = Q X , then clearly SD f,k,σ 2 (P X ∥Q X ) = 1 vol(S k (R d )) θ θ θ∈S k (R d ) D f (P θ θ θ T X+N ∥Q θ θ θ T X+N )dθ θ θ = 0since the f -divergences D f (P θ θ θ T X+N ∥Q θ θ θ T X+N ) are all zero by definition.Conversely, by the nonnegativity of the f -divergence, SD f,k,σ 2 (P X ∥Q X ) = 0 implies D f (P θ θ θ T X+N ∥Q θ θ θ T X+N ) = 0for almost every θ θ θ ∈ S k (R d ). Additionally, since f is strictly convex at 1, we haveP θ θ θ T X+N = Q θ θ θ T X+N .As a result, by the invertibility of Gaussian convolution,P θ θ θ T X = Q θ θ θ T Xfor almost every θ θ θ ∈ S k (R d ) since f -divergence nullifies iff the arguments are equal. Since the distributions are equal, the moment generating functions of these projections are equal, i.e. for allt ∈ R k E Z∼P θ θ θ T X [e t T Z ] = E Z∼Q θ θ θ T X [e t T Z ] i.e. E X∼PX [e t T θ θ θ T X ] = E X∼QX [e t T θ θ θ T X ]. Since θ θ θt is dense in R d when θ θ θ ∈ S k (R d ) and t ∈ R k , we have that for any s ∈ R d , E X∼PX [e s T X ] = E X∼QX [e s T X ].But these are just the moment generating functions of P X and Q X . Since the moment generating functions exist and are equal for all s, the densities P X , Q X must be equal.Proof of Corollary 1. By the assumption that Df is a consistent estimator of the f -divergence, b → ∞ with σ constant implies that for any fixed ω,EQUATIONwhere N ∼ N (0, σ 2 I k ).In the first case, we assume G ω * (Z) ∼ P X . Substituting ω = ω * into (9) yieldslim n,b→∞ L(ω * ) = 1 m m s=1 D f P θ θ θ T s X+N ∥P θ θ θ T s X+N = 0,where equality with zero follows because the f -divergence nullifies if its arguments are the same distribution.For the second case, we assume that for some ω * ∈ Ω lim m,n,b→∞L(ω * ) = lim m→∞ 1 m m s=1 D f P θ θ θ T s G ω * (Z)+N ∥P θ θ θ T s X+N = 0.Since the D f P θ θ θ T s G ω * (Z)+N ∥P θ θ θ T s X+N terms are all ≥ 0, the fact that this limit exists implies that lim m,n,b→∞L(ω * ) = 1 vol(S k (R d )) θ θ θ∈S k (R d ) D f (P θ θ θ T G ω * (Z)+N ∥P θ θ θ T G ω * (Z)+N )dθ θ θ = SD f,k,σ 2 (P G ω * (Z) ∥P X ).By Proposition 1, this can equal zero only if P G ω * (Z) = P X . Datasets We demonstrate our method and baselines using the US Census data derived from the American Community Survey (ACS) Public Use Microdata Sample (PUMS). Using the API of the Folktables package [DHMS21] , we access the 2018 California data. Additionally, Folktables package provides five prediction tasks (Income , Coverage, Mobility, Employment, TravelTime) based on a target column and a set of mixed-type features. We provide more details about these datasets in Table 2 .Data pre-processing. We pre-process each dataset using the open-source Python library [Sma23] . It normalizes numerical columns and one-hot encodes categorical columns, all within a privacypreserving way using an ϵ = 0.5. Note that the pre-processing budget is not included in the stated ϵ in our results. To satisfy the bounded norm assumption in our privacy analysis, we normalize the resulting dataset so that the largest row 2-norm is upper bounded by 1. This can be achieved by e.g., normalizing each row by 1/ √ d, where d is the number of columns. We subsample each dataset at a rate of 0.25 using the Poisson mechanism, which amplifies the DP guarantees according to Lemma 1. For all our experiments, we report the amplified ϵ.More details. For our method and SliceWass, all experiments used batch size of 128 and learning rate 2 • 10 -5 , and ran for 200 epochs. For our method and baselines, each model was trained using a V100 GPU, with runtimes typically less than 2 hours for our method (200 epochs).Additional results. We repeat our experiments with a different privacy budget ϵ = 8.1 and report the results in Table 3 . Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: Please refer to Section 5.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA]Justification: [NA] Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: We provide references to the code, data, and models used in this paper (see Section 4 and Appendix C). Their licenses can be located within the references.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.There are a few exceptions [e.g., LTVW23, VAA +22] but they only generate a pre-determined number of synthetic samples, rather than providing a generative model, as ours does.This noise can be resampled every epoch as it does not touch the real data.Privacy guarantees will be vacuous in this limit but this can be mitigated by privacy amplification (see Lemma 1 in appendix). Specifically, we can subsample n data from a larger dataset of size n ′ and let n ′ /n → ∞. 
 
 Appendix:  


Decision: The paper is on the borderline. The discussion turned out in the authors' favor and I am happy to recommend "accept".

The two main criticisms from the reviewers are:
1. (from JoQ4) Weak experimental evaluation. Why generative model for tabular data only?
2. (from NMCZ) Unclear sensitivity analysis of the differentially private mechanism.

The authors' rebuttal were mostly satisfactory in my opinion. Generative models for tabular data are still actively being researched on when we want to generate synthetic data differentially privately.  Of course, it is not wrong that the title is a bit click-baiting and the content may disappoint readers hoping to read about large language models.  It's not the authors' fault, but a disclaimer early on could be useful.

As for the second criticism, it was resolved during AC-Reviewer discussion.  The proposed mechanism and its RDP analysis appear to be correct. It is not a purely noise-adding mechanism, thus does not have the notion of a "query" nor does it require a sensitivity analysis. 

Finally, I think the main result of the work is interesting (though it is somewhat hidden in the bells and whistles of "multiple-slices" and "generative models"). I think it is worth emphasizing the following result more crisply (which I summarize in English)

> Random projection matrix results in (sometimes) tighter privacy guarantees than the alternative simple analysis that conditions on the projection matrix.  

> The key observation is that a random projection matrix symmetrizes the distribution so that for both X and X' the mean is 0.

I do have a related question:

- If you orthogonalize the iid gaussian matrix, the above main result should still work? Because at the limit of d --> inf,  Gaussian random matrix with your scaling converges to an orthonormal matrix. It makes the analysis harder, but if it works out, then the result is a lot stronger because for large \alpha, the RDP is still finite.

Reviews: review: paper_summary: paper_summary: This paper proposes a DP generative modeling technique via f-divergence and random projection. Specifically, both real data and synthetic data are randomly projected into a lower-dimensional space, where the noise is added to the aggregation of the projected data such that the effect of individual data point is bounded. Minimizing the smoothed-slicing f-divergence between the noisy embeddings will guarantee the match of two distributions, thereby can be used to train a generative model. Compared to adding noise to gradients (e.g. DP-SGD), this method is more convenient and scalable. Experiments show that it generally outperforms prior related methods in synthesizing tabular data.
strength_weakness: strength_weakness: 1. The proposed method is similar to the MMD-based methods (references on line 96) in the following way:
    + MMD-based methods apply MMD as the divergence measure, since MMD(P, Q)=0 iff P=Q, similar to $D_f$(P, Q)=0 iff P=Q, thus both divergence measure can be used to train a generative model.
    + MMD-based methods minimize the distance between kernel mean embeddings (KME) of real data and generated data, while noise is added to the KME to retain DP guarantee. In this work, both real and generated data are projected to an embedding space, and noise is injected into the embeddings to retain DP guarantee, so the idea of the overall paradigm is quite similar.
    + KME in theory is an infinite-dimensional embedding, which is not convenient to add Gaussian noise, so those works propose to approximate KME by projecting it into a finite-dimensional space. In this work, in theory you have infinitely many directions to slice where only a finite number ($m$) of directions are randomly chosen. So both of you apply the finite-projection idea and therefore both of you will have approximation errors.

In light of the above similarity, the current discussion on the difference and association with MMD-based methods are not adequate. Also, it is more ideal to include some of those methods in the empirical comparison (Table 1), because they ran experiments on tabular dataset as well.

2. For a work in DP, I did not even find sensitivity analysis, which is crucial for proving DP guarantees. Even if it is trivial it should be included for completeness.

3. It looks to me that adding noise to synthetic data (eq. 2) is unnecessary, and will hurt the model utility. Can you please explain why?
questions: questions: 1. Existing methods move to adversarial dual form due to "...they often suffer from scalability issues and are not friendly to gradient-based optimization..." Now you circumvent the adversarial training, then does the proposed method suffer from scalability issues or not friendly to gradient-based optimization?
2. Maybe I am out of the field, but what does "slicing and smoothing" (line 116) exactly mean? What are the differences? And you term the proposed divergence "smoothed-sliced f-divergence", what does "smoothed-sliced" mean?
3. In remark 1 the authors claim that [RL21] did something wrong in their derivation because the slicing matrix U is not included in the privacy mechanism. I am not familiar with [RL21], but is U independent of the dataset X? Why will U affect the privacy analysis?
4. Line 221, "...we can achieve a tighter privacy bound by reducing a factor of..." How this factor is derived?
4. The proposed method seems quite universal, i.e. should be scalable to other domains like image datasets as well, is it true?
limitations: limitations: NA
paper_summary: paper_summary: The paper proposes to add noise to randomly projected private data along with optimizing a newly proposed metric smoothed-sliced f-divergence to train generative models. Such paradigm can circumvent adding noise to gradient and enable more architecture choices. Experiment show the proposed method perform competitively with existing methods.
strength_weakness: strength_weakness: 1.I feel thee baseline algorithms are kind of weak for the setting considered in the paper (synthetic tabular data generation). I am not an expert in this specific area but SliceWass is proposed 3 years ago, DP-SGD and PATE are classical DP algorithms which have many variants improving upon them in recent years,  e.g., Adam also has DP versions. 

2. The algorithm is proposed for generative model training, at least it is what claimed in the title and abstract, but it is only tested on tabular data.
questions: questions: 1. Have the authors tested the algorithm on other type of data, such as image or text?
2. Do the authors have explanations why the proposed approach could be better than the baseline algorithms?
limitations: limitations: I did not find any limitation discussion specifically for the proposed approach. Adding it would be beneficial.
paper_summary: paper_summary: The manuscript introduces a slicing privacy mechanism for training generative models without noisy gradients. This mechanism injects noise into random low-dimensional projections of private data, providing strong differential privacy guarantees. The study introduces the smoothed-sliced 
$f$-divergence and a kernel-based estimator for it, allowing the training of generative models without adversarial training. Empirical results show improved synthetic data quality compared to existing methods.
strength_weakness: strength_weakness: - This is a very solid piece of work. The proposed method is simple yet effective, and I have no particular concerns or issues with it.
questions: questions: None
limitations: limitations: Yes

Comments: title: Thanks!
Response and clarification on bounded norm
Responses to the rebuttal
Part 2
comment: Thanks for increasing your score! We note, however, that if we have indeed addressed all your concerns, a score of 5 is is still tending towards rejection in reality, and - according to the review guidelines - should be used sparingly. If there are any further concerns you have that we could address, please let us know! Otherwise, we respectfully ask that your score reflect your positive evaluation.

Thanks!
the authors
Thanks for the explanation. I have increased my score
Thank you for your prompt response! We are glad to hear that you are generally satisfied with our responses. We will ensure that the discussion on Q1 and the experimental results are included in our revised paper. 

Regarding Q2, you are absolutely right that UX would be unbounded without additional assumptions and privacy guarantees would not hold, we apologize for misunderstanding the precise point of your previous statement of Q2. To clarify---our theorem explicitly requires each record in X to have a norm <= 1 (please refer to Line 145 in our paper, and Lines 659–664 for a discussion on how we satisfy this assumption in our experiments). Given this, UX will be bounded (with high probability) since U is a Gaussian matrix with a specified covariance matrix. Hence the sensitivity is immediately controlled allowing us to compute the correct variance of the additive Gaussian noise applied after slicing to achieve the desired privacy guarantees. While our proof strategy goes through Renyi divergence (crucially using the norm bound assumed for X) rather than through a more explicit sensitivity analysis for the linear U mechanism, the principle is fundamentally the same.

Similarly, as you pointed out, the privacy analyses in [BBDS12, EKKL20] rely on the same bounded norm assumption. In the revision, we will add a comment pointing out that this norm bound is key and analogous to sensitivity discussions in other works.
Thanks for the reply. Discussion on Q1 needs to be included in the revision. I am generally satisfied with the responses except Q2.

I disagree with the answer to Q2. I don't get why eq(3) is not an additive mechanism. For the papers you mentioned, both [BBDS12] and [EKKL20] made assumptions on the sensitivity of the output, i.e. <= 1, whereas I don't find similar assumptions in this paper. In fact, the random slicing UX is unbounded. It looks to me that you need to clip the output and then add V that is scaled with the sensitivity.
We thank all Reviewers for their time and thoughtful feedback! We are glad to see our paper was positively received, and the Reviewers found that: the paper is novel, rigorous, and well-written (all Reviewers); it is well-motivated and of wide interest in the related field (Reviewer NMCZ); the proposed approach is shown to have consistency and perform competitively with baseline (Reviewer JoQ4); the paper provides strong theoretical foundations (Reviewer jo82). We also recognize that the Reviewers are busy handling multiple papers, so their thoughtful feedback is even more appreciated.

In response to the Reviewers’ questions, we did our best to provide comprehensive answers and included additional experimental results (please refer to the 1-page pdf in the global response). Please do follow up with us if you have additional suggestions and feedback that can further strengthen the paper. Thanks!
---
**Q6.  In remark 1 the authors claim that [RL21] did something wrong in their derivation because the slicing matrix U is not included in the privacy mechanism. Is U independent of the dataset X? Why will U affect the privacy analysis?**

A.6. Yes, U is generated independently of the dataset X, but the sliced output UX is clearly dependent on U, hence conditioned on (UX), U and X are now dependent! Since the generative model training requires both the projected data and the projection directions (i.e., the U matrix must be known to the model during training), not accounting for the fact U is known can result in privacy leakage. 
As an analogy, let’s consider the simple additive noise setting, where the output from a Laplace mechanism is used. In such a case, any downstream operation must not access the Laplace noise added by the privacy mechanism. If it did, the noise could be used to denoise the answer, even if the noise is independent of the real data. This is a crucial oversight, which we remedy by explicitly including all needed factors in the privacy analysis.

---
**Q7. Line 221, "...we can achieve a tighter privacy bound by reducing a factor of..." How this factor is derived?**

A7. The intuition is that a deterministic U corresponds to a scenario where the adversary can engage with the design of the privacy mechanism and choose how to project the data. This grants the adversary more freedom to influence the design of the privacy mechanism, resulting in a less effective privacy protection.

Technically, we derive this factor by comparing the Renyi divergence between two privacy mechanisms, where one has random U and the other has deterministic U (see Proposition 3 in the appendix).

---
**Q8.  Is the proposed approach scalable to other domains like image datasets as well?**

A.8. Thank you for bringing up this concern. Indeed, our proposed approach is applicable and scalable to other domains, including image data. For instance, please refer to our domain adaptation experiment (Section 4.2), where we apply our method to MNIST and USPS datasets. 

In Figure 1 of the attached PDF, we also have considered private image generative modeling for MNIST, showing that our approach outperforms the state-of-the-art baseline MERF method for larger privacy budgets. In this experiment, note that MERF, as implemented by the authors thereof, only uses the mean embedding of the real data in each class. This allows them to use much lower noise and achieve better results for low epsilon levels, but damages performance for higher privacy budgets since their approach cannot learn the diversity of each class’s distribution (due to taking the mean only). This explains the trends we see and emphasizes the advantages of our approach that requires no such limiting preprocessing step and can retain the full diversity of the data distribution.

In Table 1 of the PDF, we add MERF to the experiment in the main text, showing that our proposed method (often significantly) outperforms MERF in 20 out of the 24 metrics across five datasets, including all 10 categorical metrics, 4 out of 5 classifier F1 scores, and 6 ouf of 9 numerical metrics. We used the implementation at https://github.com/ParkLabML/DP-MERF for this experiment.

We hope the above answers clarify the reviewer’s view of our work, and if any questions remain, please let us know!