Mitigating Statistical Bias within Differentially Private Synthetic Data
Abstract
Increasing interest in privacy-preserving machine learning has led to new and evolved approaches for generating private synthetic data from undisclosed real data.
However, mechanisms of privacy preservation can signiﬁcantly reduce the utility of synthetic data, which in turn impacts downstream tasks such as learning predictive models or inference.
We propose several re-weighting strategies using privatised likelihood ratios that not only mitigate statistical bias of downstream estimators but also have general applicability to differentially private generative models.
Through large-scale empirical evaluation, we show that private importance weighting provides simple and effective privacycompliant augmentation for general applications of synthetic data.
INTRODUCTION
The prevalence of sensitive datasets, such as electronic health records, contributes to a growing concern for violations of an individual’s privacy.
In recent years, the notion of
Differential Privacy (Dwork et al., 2006) has gained popularity as a privacy metric offering statistical guarantees.
This framework bounds how much the likelihood of a randomised algorithm can differ under neighbouring real datasets.
We say two datasets D and D (cid:48) are neighbouring when they differ by at most one observation.
A randomised algorithm g : M → R satisﬁes ( (cid:15), δ ) -differential privacy for (cid:15), δ ≥if and only if for all neighbouring datasets D , D (cid:48) and all subsets S ⊆ R , we have Pr
[Equation] g [Equation] D ) ∈ S ) ≤ δ + e
[Equation]
Pr ( g ( D (cid:48) ) ∈ S ) .
The parameter (cid:15) is referred to as the privacy budget; smaller (cid:15) quantities imply more private algorithms.
Injecting noise into sensitive data according to this paradigm allows for datasets to be published in a private manner.
With the rise of generative modelling approaches, such as Generative Adversarial Networks (GANs) (Goodfellow et al., 2014), there has been a surge of literature proposing generative models for differentially private (DP) synthetic data generation and release (Jordon et al., 2019; Xie et al., 2018;
Zhang et al., 2017).
These generative models often fail to capture the true underlying distribution of the real data, possibly due to ﬂawed parametric assumptions and the injection of noise into their training and release mechanisms.
The constraints imposed by privacy-preservation can lead to signiﬁcant differences between nature’s true data generating process (DGP) and the induced synthetic DGP (SDGP) (Wilde et al., 2020).
This increases the bias of estimators trained on data from the SDGP which reduces their utility.
Recent literature has proposed techniques to decrease this bias by modifying the training processes of private algorithms.
These approaches are speciﬁc to a particular synthetic data generating method (Zhang et al., 2018; Frigerio et al., 2019; Neunhoeffer et al., 2020), or are query-based (Hardt and Rothblum, 2010;
Liu et al., 2021) and are thus not generally applicable.
Hence, we propose several postprocessing approaches that aid mitigating the bias induced by the DP synthetic data.
While there has been extensive research into estimating models directly on protected data without leaking privacy, we argue that releasing DP synthetic data is crucial for rigorous statistical analysis.
This makes providing a framework to debias inference on this an important direction of future research that goes beyond the applicability of any particular DP estimator.
Because of the post-processing theorem (Dwork et al., 2014), any function on the DP synthetic data is itself DP.
This allows deployment of standard statistical analysis tooling that may otherwise be unavailable for DP estimation.
These include 1) exploratory data analysis, 2) model veriﬁcation and analysis of model diagnostics, 3) private release of (newly developed) models for which no
DP analogue has been derived, 4) the computation of con- ﬁdence intervals of downstream estimators through the nonparametric bootstrap, and 5) the public release of a data set to a research community whose individual requests would otherwise overload the data curator.
This endeavour could facilitate the release of data on public platforms like the
UCI Machine Learning Repository (Lichman, 2013) or the creation of data competitions, fuelling research growth for speciﬁc modelling areas.
This motivates our main contributions, namely the formulation of multiple approaches to generating DP importance weights that correct for synthetic data’s issues.
In particular, this includes:
• The bias estimation of an existing DP importance weight estimation method, and the introduction of an unbiased extension with smaller variance (Section 3.3).
• An adjustment to DP Stochastic Gradient Descent’s sampling probability and noise injection to facilitate its use in the training of DP-compliant neural networkbased classiﬁers to estimate importance weights from combinations of real and synthetic data (Section 3.4).
• The use of discriminator outputs of DP GANs as importance weights that do not require any additional privacy budget (Section 3.5).
• An application of importance weighting to correct for the biases incurred in Bayesian posterior belief updating with synthetic data motivated by the results from (Wilde et al., 2020) and to exhibit our methods’ wide applicability in frequentist and Bayesian contexts (Section 3.1).
BACKGROUND
Before we proceed, we provide some brief background on bias mitigation in non-private synthetic data generation.
2.1 DENSITY RATIOS FOR NON-PRIVATE GANS
Since their introduction, GANs have become a popular tool for synthetic data generation in semi-supervised and unsupervised settings.
GANs produce realistic synthetic data by trading off the learning of a generator Ge to produce synthetic observations, with that of a classiﬁer Di learning to correctly classify the training and generated data as real or fake.
The generator Ge takes samples from the prior u ∼ p u as an input and generates samples Ge ( u ) ∈ X .
The discriminator Di takes an observation x ∈ X as input and outputs the probability Di ( x ) of this observation being drawn from the true DGP.
The classiﬁcation network Di distinguishes between samples from the DGP with label y
= 1 and distribution p D , and data from the SDGP with label y
=
and distribution p G .
Following Bayes’ rule we can show that the output of Di ( x ) , namely the probabilities (cid:98) p ( y = 1 | x ) and (cid:98) p ( y =
|
x ) , can be used for importance weight estimation:
[Equation]
This observation has been exploited in a stream of literature focusing on importance weighting (IW) based sampling approaches for GANs.
Grover et al.
(2019) analyse how importance weights of the GAN’s outputs can lead to performance gains; extensions include their proposed usage in rejection sampling on the GAN’s outputs (Azadi et al., 2018), and Metropolis–Hastings sampling from the GAN alongside improvements to the robustness of this sampling via calibration of the discriminator (Turner et al., 2019).
To date, no one has leveraged these discriminator-based IW approaches in DP settings where the weights can mitigate the increased bias induced by privatised data models.
2.2 DIFFERENTIAL PRIVACY IN SYNTHETIC DATA GENERATION
Private synthetic data generation through DP GANs is built upon the post processing theorem: If Di is ( (cid:15), δ ) - DP, then any composition Di ◦
Ge is also ( (cid:15), δ ) -DP
(Dwork et al., 2014) since Ge does not query the protected data.
Hence, to train private GANs, we only need to privatise the training of their discriminators, see e.g. Hyland et al.
Xie et al.
(2018) propose DPGAN, a Wasserstein GAN which is trained by injecting noise to the gradients of the discriminator’s parameters.
In contrast, Jordon et al.
(2019) privatise the GAN discriminator by using the Private Aggregation of
Teacher Ensembles algorithm.
Recently, Torkzadehmahani et al.
(2019) proposed DPCGAN as a conditional variant to
DPGAN that uses an efﬁcient moments accountant.
In contrast, PrivBayes (Zhang et al., 2017) learns a DP Bayesian network and does not rely on a GAN-architecture.
Other generative approaches, for instance, include Chen et al.
Acs et al.
See Abay et al.
; Fan (2020) for an extensive overview of more DP generative approaches.
Differentially private bias mitigation In this paper, we offer an augmentation to the usual release procedure for synthetic data by leveraging true and estimated importance weights.
Most related to our work are the contributions from Elkan (2010) and Ji and Elkan (2013) who train a regularised logistic regression model and assign weights based on the Laplace-noise-contaminated coefﬁcients of the logistic regression.
In follow up work, Ji et al.
(2014) propose to modify the update step of the Newton-Raphson optimisation algorithm used in ﬁtting the logistic regression classiﬁer to achieve DP.
However, neither of these generalise well to more complex and high dimensional settings because of the linearity of the classiﬁer.
Further, the authors assume the existence of a public dataset while we consider the case where we ﬁrst generate DP synthetic data and then weight them a posteriori, providing a generic and universally applicable approach.
The beneﬁt of learning a generative model over using public data include on the one hand that there is no requirement for the existence of a public data set, and on the other hand the possibility to generate new data points.
This distinction necessitates additional analysis as the privacy budget splits between the budget spent on ﬁtting the SDGP and the budget for estimating the IW approach.
Furthermore, we show that the approach from Ji and Elkan (2013) leads to statistically biased estimation and formulate an unbiased extension with improved properties.
DIFFERENTIAL PRIVACY AND IMPORTANCE WEIGHTING
From a decision theoretic perspective, the goal of statistics is estimating expectations of functions h : X (cid:55)→ R , e.g. loss or utility functions, w.r.t the distribution of future uncertainties x ∼ p D .
Given data from { x (cid:48) 1 , . . .
, x (cid:48) N D } =: x (cid:48) 1: N D i.i.d.
∼ p
D
the data analyst can estimate these expectations consistently via the strong law of large numbers as E x ∼ p D ( h ( x ))
≈ 1 N D (cid:80) N D i =1 h ( x (cid:48) i ) .
However, under DP constraints the data analyst is no longer presented with a sample from the true
DGP x (cid:48) 1: N D i.i.d.
∼ p D but with a synthetic data sample x 1: N G from the SDGP p G .
Applying the naive estimator in this scenario biases the downstream tasks as 1 N G (cid:80) N G i =1 h ( x i ) →
E x ∼ p G ( h ( x )) almost surely.
This bias can be mitigated using a standard Monte Carlo method known as importance weighting (IW).
Suppose we had access to the weights w ( x ) :
= p D ( x ) p G ( x ) .
If p G ( · ) >whenever h ( · ) p D ( · ) > 0 , then IW relies on
E x
[Equation] [Equation]
( x )]
=
E
[Equation]
[ w ( x ) h ( x )] .
[Equation]
So we have almost surely for x 1: N G i.i.d.
∼ p
G the convergence
I N ( h | w ) :
= 1 N G
[Equation]
3.1 IMPORTANCE WEIGHTED EMPIRICAL RISK MINIMISATION
A downstream task of particular interest is the use of x (cid:48) 1: N D ∼ p D to learn a predictive model, f ( · ) ∈ F , for the data generating distribution p D based on empirical risk minimisation.
Given a loss function h : F × X (cid:55)→ R comparing models f ( · ) ∈ F with observations x ∈ X and data x (cid:48) 1: N D ∼ p D , the principle of empirical risk minimisation (Vapnik, 1991) states that the optimal (cid:98) f is given by the minimisation of
[Equation]
over f .
Maximum likelihood estimation (MLE) is a special case of the above with h ( f ( · ) , x i )
= − log f
( x i | θ ) for a class of densities f parameterised by θ .
Given synthetic data x 1: N G ∼ p G , Equation (2) can be used to debias the learning of f .
Remark 1 (Supplement B.5) .
Minimisation of the importance weight adjusted log-likelihood, − w ( x i ) log f
( x i | θ ) , can be viewed as an M -estimator (e.g. Van der Vaart, 2000) with clear relations to the standard MLE.
Bayesian Updating.
Wilde et al.
(2020) showed that naively conducting Bayesian updating using DP synthetic data without any adjustment could have negative consequences for inference.
To show the versatility of our approach and to address the issues they pointed out, we demonstrate how
IW can help mitigate this.
The posterior distribution for parameter θ given ˜ x (cid:48) :
= x (cid:48) 1: N D ∼ p
D is
[Equation]
where π ( θ ) denotes the prior distribution for θ .
This posterior is known to learn about model parameter θ KLD p D :=
arg min θ KLD ( p D || f ( ·| θ ))
(Berk, 1966; Bissiri et al., 2016) where KLD denotes the Kullback-Leibler divergence.
Given only synthetic data ˜ x := x 1: N G from the ‘proposal distribution’ p G , we can use the importance weights deﬁned in Equation (2) to construct the (generalised) posterior distribution
[Equation]
In fact, Equation (3) corresponds to a generalised Bayesian posterior (Bissiri et al., 2016) with (cid:96) IW ( x i
[Equation]
θ )
[Equation]
= − w ( x i ) log f
( x i | θ ) , providing a coherent updating of beliefs about parameter θ KLD p D using only data from the SDGP.
Theorem 1 (Supplement B.6) .
The importance weighted
Bayesian posterior π IW ( θ | x 1: N G ) , deﬁned in Equation (3) for x 1: N G i.i.d.
∼ p G , admits the same limiting Gaussian distribution as the Bayesian posterior π ( θ | x (cid:48) 1: N D ) where x (cid:48) 1: N D i.i.d.
∼ p D , under regularity conditions as in (Chernozhukov and Hong, 2003; Lyddon et al., 2018).
It is necessary here to acknowledge the existence of methods to directly conduct privatised Bayesian updating (e.g.
Dimitrakakis et al., 2014; Foulds et al., 2016; Wang et al., 2015) or M-estimation (Avella-Medina, 2021).
We refer the reader Section 1 for why the attention of this paper focuses on downstream tasks for private synthetic data.
We consider the application of DP IW to Bayesian updating as a natural example of such a task.
3.2 ESTIMATING THE IMPORTANCE WEIGHTS
The previous section shows that IW can be used to recalibrate inference for synthetic data.
Unfortunately, both the DGP p D and SDGP p G densities are typically unknown, e.g. due to the intractability of GAN generation, and thus the ‘perfect’ weight w ( x ) cannot be calculated.
Instead, we must rely on estimates of these weights, (cid:98) w ( x ) .
In this section, we show that the existing approach to DP importance weight estimation is biased, and how the data curator can correct it.
Using the same reasoning as in Section 2.1, we argue that any calibrated classiﬁcation method that learns to distinguish between data from the DGP, labelled thenceforth with y = 1 , and from the SDGP, labelled with y = 0 , can be used to estimate the likelihood ratio (Sugiyama et al., 2012).
Using Equation (1), we compute
[Equation]
where (cid:98) p are the probabilities estimated by such a classiﬁcation algorithm.
To improve numerical stability, we can also express the log weights as
[Equation]
where σ ( x ) :
= (1 + exp( − x )) − 1 is the logistic function and σ − 1 ( (cid:98) p ( y = 1 | x )) are the logits of the classiﬁcation method.
We will now discuss two such classiﬁers: logistic regression and neural networks.
3.3 PRIVATISING LOGISTIC REGRESSION
DP guarantees for a classiﬁcation algorithm g can be achieved by adding noise to the training procedure.
The scale of this noise is determined by how much the algorithm differs when one observation of the dataset changes.
In more formal terms, the sensitivity of g w.r.t a norm | · | is deﬁned by the smallest number S ( g ) such that for any two neighbouring datasets D and D (cid:48) it holds that
[Equation]
g
[Equation]
D
[Equation]
g
[Equation]
D
[Equation]
) | ≤ S ( g ) .
Dwork et al.
(2006) show that to ensure the differential privacy of g , it sufﬁces to add Laplacian noise with standard deviation S ( g ) /(cid:15) to g .
Possibly the simplest classiﬁer g one could use to estimate the importance weights is logistic regression with L 2 regularisation.
It turns out this also has a convenient form for its sensitivity.
If the data is scaled to a range from 0 to 1 such that X ⊂ [0 , 1] d , Chaudhuri et al.
(2011) show that the Lsensitivity of the optimal coefﬁcient vector estimated by (cid:98) β in a regularised logistic regression with model
[Equation]
is S ( (cid:98) β ) = 2 √ d/ ( N D λ ) where λ is the coefﬁcient of the
L 2 regularisation term added to the loss during training.
For completeness, when the logistic regression contains an intercept parameter, we let x i denote the concatenation of the feature vector and the constant 1.
Ji and Elkan (2013) propose to compute DP importance weights by training such an L 2 regularised logistic classiﬁer on the private and the synthetic data, and perturb the coefﬁcient vector (cid:98) β with Laplacian noise.
For a d dimensional noise vector ζ with ζ j i.i.d.
∼ Laplace (0 , ρ ) with ρ = 2 √ d/ ( N D λ(cid:15) ) for j ∈ { 1 , . . .
, d } , the private regression coefﬁcient is then β = (cid:98) β
+ ζ , akin to adding heteroscedastic noise to the private estimates of the log weights
[Equation]
The resulting privatised importance weights can be shown to lead to statistically biased estimation.
Proposition 1 (Supplement B.1) .
Let w denote the importance weights computed by noise perturbing regression coefﬁcients as in Equation (4) (Ji and Elkan, 2013, Algorithm 1).
The IS estimator I N ( h | w ) is biased.
Introducing bias on downstream estimators of sensitive information is undesirable as it can lead to an increased expected loss.
To address this issue, we propose a way for the data curator to debias the weights after computation.
Proposition 2 (Supplement B.2) .
Let w denote the importance weights computed by noise perturbing the regression coefﬁcients as in Equation (4) (Ji and Elkan, 2013, Algorithm 1) where ζ can be sampled from any noise distribution that ensures ( (cid:15), δ ) -differential privacy of β .
Deﬁne
[Equation]
and adjusted importance weight
[Equation]
The importance sampling estimator I N ( h | w ∗ ) is unbiased and ( (cid:15), δ ) -DP for E p ζ
[exp (cid:0) ζ T x i (cid:1) ] > 0 .
In Supplement B.2.4, we further show that our approach does not only decrease the bias, but also the variance of the importance weighted estimators.
For the case of component-wise independent Laplace perturbations ζ j i.i.d.
∼
Laplace (0 , ρ ) , we show that the bias correction term can be computed as
[Equation]
In practice, e.g. as we observe empirically in Section 4, the optimal choice of the regularisation term λ is sufﬁciently large such that ρ < 1 .
Since the data is scaled to a range of 0 to 1 (Chaudhuri et al., 2011), this bias correction method is not limited by the restriction | x ij | < 1 /ρ, ∀ j .
If the data curator still encounters a case where this condition is not fulﬁlled, they can choose to perturb the weights with Gaussian noise instead, in which case the bias correction term always exists (see Supplement B.2.2).
Laplacian perturbations are however preferred as the required noise scale can be expressed analytically without additional optimisation (Balle and Wang, 2018), and as they give stricter privacy guarantees with δ = 0 .
Alternatively, unbiased importance weighted estimates can be computed directly by noising the weights instead of the coefﬁcients of the logistic regression.
While this procedure removes the bias of the estimates and can also be shown to be consistent, it increases the variance to a greater extent than noising the coefﬁcients does, and is thus only sustainable when small amounts of data are released.
Please refer to Supplement A.1 for more details.
3.4 PRIVATISING NEURAL NETWORKS
If logistic regression fails to give accurate density ratio estimates, for example because of biases introduced by the classiﬁer’s linearity assumptions, a more complex discriminator in the form of a neural network can be trained.
We can train DP classiﬁcation neural networks for the aim of likelihood ratio estimation with stochastic gradient decent (SGD) by clipping the gradients and adding calibrated Gaussian noise at each step of the SGD, see e.g. Abadi et al.
The noised gradients are then added up in a lot before the descent step where lots resemble mini-batches.
These optimisation algorithms are commonly formulated for the case when the complete dataset is private.
However, in our setting, N D observations are private and N G observations are non-private.
Thus, we can deﬁne a relaxed version of DP SGD.
Algorithm 1 provides an overview of our proposed method.
We highlight the modiﬁcations to
Algorithm 1 from Abadi et al.
(2016) in blue.
Proposition 3.
Each step in the SGD outlined in Algorithm 1 is ( (cid:15), δ ) -differentially
private w.r.t the lot and ( O ( q(cid:15) ) , δ ) differentially private w.r.t the full dataset where q =
L N D + N G and σ = (cid:113) 2 log ( 1 . 25 δ ) /(cid:15) .
The differential privacy w.r.t a lot follows directly from the observation that the gradients of the synthetic data are already private.
Further, the labels of the synthetic data are public knowledge.
Lastly, the differential privacy w.r.t the dataset follows from the ampliﬁcation theorem (Kasiviswanathan et al., 2011), the fact that sampling one particular private observation within a lot of size L is q =
L N D + N G , and the reasoning behind the moment accountant of Abadi et al.
We still clip the gradients of the public dataset
Algorithm
Input: Examples x 1: N D , y 1: N D from the DGP and x N D +1: N D + N G , y N D
+1: N D + N G from the SDGP, loss function
L ( θ ) =
1 N G + N D
(cid:80) i
L ( θ, x i , y i ) .
Parameters: learning rate η t , noise scale σ , expected lot size
L , gradient norm bound C .
1 Initialise θ 0 randomly 2 for t ∈ [ T ] do
Construct a random subset
L t ⊂ { 1 , . .
. , N D + N G } by including each index independently at random with probability
L N D + N G
Compute gradient
For each i ∈
L t , compute g t ( x i , y i ) ← ∆ θ t L ( θ t , x i , y i )
Clip gradient g t ( x i , y i ) ← g t ( x i , y i ) / max(1 , || g
[Equation]
[Table]
Add noise
[Table]
[Equation]
where 1 ( y i =1) is
if y i
=
and
otherwise
[Table]
[Equation]
Output: θ T and the overall privacy cost ( (cid:15), δ ) using the moment’s accountant of Abadi et al. (2016) with sampling probability q =
L N D + N G .
as their inﬂuence will otherwise be overproportional under strong maximum norm assumptions.
3.5 GAN DISCRIMINATOR WEIGHTS
The downside of the aforementioned likelihood ratio estimators (Equation (4), Equation (5), Algorithm 1) is that their training requires an additional privacy budget which has to be added to the privacy budget used to learn the SDGP.
If we however use a GAN such as DPGAN or PATE-GAN for private synthetic data generation, we can use the GAN’s discriminator for the computation of the importance weights.
According to the post processing theorem, these importance weights can be released without requiring an additional privacy budget.
In contrast to the weights computed from DP classiﬁcation networks, this approach is more robust and requires less hyperparameter tuning (confer to Section 4).
EXPERIMENTS
We demonstrate the beneﬁts of using debiased IW for DP data release with a large-scale experimental study comparing three different SDGPs (DPGAN, DPCGAN, PrivBayes) on six real-world data sets (Iris, TGFB, Boston,
Breast, Banknote, MNIST) for two different privacy budgets, (cid:15) ∈ { 1 , 6 } .
We stress that debiasing comes with
[Figure] [Figure]
little overhead to the actual computations.
As we see in Supplement C.2, the computations of the logistic regression and neural network importance weight estimates take less than one and a half minutes to train, even on MNIST.
These weight estimators can be applied to any kind of synthetic data generation model, while the importance weights of the GAN discriminator can be computed in a single line of Python code and do not require any additional concerns regarding the privacy budget.
Please see https://github.com/sghalebikesabi/ importance-weighted-differential-privacy for the implementation.
Computation of importance weights After ﬁtting the
SDGP on the scaled true data, we weight each synthetic observation with importance weights.
Based on the train and the synthetic data, we apply one of the following IW approaches: weights computed from a non-private logistic regression (LogReg), its DP alternative introduced by Ji and
Elkan (2013) (BetaNoised), or our debiased proposal (BetaDebiased), and likelihood ratios estimated by a non-private multi-layer perceptron (MLP), or a DP-MLP trained using
Algorithm 1.
We also compare to the naive estimator using uniform weights without IW (called ’None’).
Please refer to Supplement C.1 for more details on the implementation and the hyperparameters used in our experiments.
In Supplement C.8, we provide a comparison to the experimental results reported by related papers.
Because of the large scale of our experimental study, we present only the most important results in this section, and give a complete overview in Supplement C.
The code and data for all experiments can be found in the Supplements, and will be made available online.
4.1 TOY EXAMPLE
We start our analysis with a simple example to illustrate the beneﬁts of the different weighting schemes.
We assume that the synthetic data is sampled from a two-dimensional uniform distribution from 0 to 1 whereas the true data follows a uniform distribution on the lower triangle given by x 1 + x 2 < 1 for x 1 , x 2 ∈ [0 , 1] .
This illustrative toy example was chosen for a fairer comparison of the logistic regression and the neural network based approaches.
As we see in Figure 1, the weighted kernel density estimate (KDE) of BetaDebiased is closer to the LogReg weighted KDE, and also the true KDE compared to the BetaNoised KDE.
4.2 UCI DATA SETS
Datasets and preprocessing We performed additional experiments on four UCI datasets of different characteristics [Table] as decribed in Supplement C.1:
Iris, Banknote, Boston [Table] and
Breast.
Similarly to Chaudhuri et al.
; Ji and Elkan (2013), we scale all data to a feature range from 0 to 1.
We use a train-test split of 80%.
In all experiments we ﬁx δ to
N − 1 D − 10 − 6 , and choose (cid:15) ∈ { 1 , 6 } .
We refer to Supplement C.7 for a complete overview of the results.
Synthetic data generators We used DPCGAN (Torkzadehmahani et al., 2019), DPGAN (Xie et al., 2018), and their corresponding non-DP analogues (CGAN and CGAN) to generate DP synthetic data of the same size as the training data set.
Additionally we also consider PrivBayes (Zhang et al., 2017), a DP Bayesian Network, as a potential SDGP.
Hyperparameter tuning Note that hyperparameter tuning is essentially non-private, and has to be accounted for in the privacy budget.
Since hyperparemeter tuning in a DP setting is an unresolved problem (Liu and Talwar, 2019;
Rosenblatt et al., 2020; Papernot and Steinke, 2021), we follow Jordon et al.
and tune the hyperparameters of the underlying baselines on private validation data sets.
However, we propose default parameters for our methods.
This leads to an over-optimistic presentation of the baseline performance, and a conservative presentation of our extensions.
Evaluation metrics
In order to show that IW decreases statistical bias, we train a linear prediction model on the synthetic data and approximate its bias.
Since the true DGP is not known, we train the same linear predictor on the test data and report the mean squared error (MSE) between the test parameters and the parameters estimated on the
SDGP, as β MSE.
We further analyse the divergence of the weighted SDGP and the DGP in a similar way by computing the Wassertstein (WST) distance w.r.t the test data.
As one exemplary supervised downstream task, we consider the training of a linear downstream classiﬁer or regressor on the synthetic data. This downstream predictor is then assessed by the error measured in the parameter vector compared to the parameters learnt using the test set ( beta MSE). As another downstream task, we train a one-hidden-layer MLP on the training data, and report the test prediction error as MLP ROC-AUC for classiﬁcation tasks, and MLP MSE for regression tasks.
Choice of budget split We only present results for (cid:15)
=in this section, and refer the reader to Supplement C.7 for further results with (cid:15) = 6 .
If the weight computation procedure requires a separate privacy budget (e.g. if the weights are computed by a separate MLP or logistic regression), we spend 10% of the (cid:15) -budget on ﬁtting the SDGP and 30% of the δ -budget on the weight computation; the complete budget can be spent on ﬁtting the SDGP if no weights, or the weights of the discriminator are used.
In Supplement
C.3, we evaluate a range of different privacy splits on the
Breast and Boston data.
Results In Tables 1 and 2, we see that the performance of the models mostly improved when weighted with any type of estimated weights.
Although the best inference for [Table] [Table] each data set is nearly always achieved after importance weighting, we notice that there are some rare cases where no importance weighting performs (insigniﬁcantly) better.
For instance, we observe that the SDGP obtained with PrivBayes seems to be close to the true DGP of the Boston Housing data
[Table]
and that importance weighting is no longer helpful.
In settings where the SDGP and the DGP are really close, it is possible that the effects of additional variance induced by estimating and privatising the importance weights (where appropriate) cancels out the reduction in bias.
This effect might be mitigated with hyperparameter tuning.
Further, we note that debiasing the logistic regression weights mainly results in better performance.
Even though we experience a slight drop in performance from BetaNoised to BetaDebiased in some rare cases, this can be explained by randomness in the data set as we show in Supplement Table 6 that the weights estimated by BetaDebiased are signiﬁcantly closer to the true LogReg weights than the importance weights given by BetaNoised.
If a GAN is used as SDGP, and the data curator is hesitant to release additional importance weights, the discriminator weights nearly always lead to an improvement in results without requiring additional computations.
To further illustrate the practical meaning of debiasing, we have included an exemplary case study in Supplement C.6.
4.3 BAYESIAN UPDATING WITH IW
We investigate the effectiveness of IW in a Bayesian learning setting as per Equation 3.
We evaluated and compared the performance of these weighted posteriors alongside the standard non-weighted posterior by applying them to learning the parameters of models for various regression tasks.
Figure 2 shows the ROC-AUC scores associated with the
Bayesian predictive distribution arising from integration over the posterior of a Bayesian logistic regression model ﬁt on synthesised versions of the Banknote dataset.
We observe that the ROC-AUC under PrivBayes’ synthetic data is signiﬁcantly improved upon across all IW methods, with similar gains made to the median performance under CGAN’s synthetic data.
Additionally, most of the methods help in decreasing variability in the results, especially DP-MLP and MLP.
See Supplement C.5 for a full speciﬁcation of the experimental details and for further results from ﬁtting
Bayesian linear regression and multinomial logistic regression models on the TGFB and Iris datasets respectively.
4.4 MNIST
Additionally, we assessed how IW performs in a highdimensional setting such as a classiﬁcation task on the
MNIST dataset.
Since PrivBayes does not scale to large data sets, we only evaluate DPCGAN as possible SDGP.
For this we follow the setup by Torkzadehmahani et al.
(2019) for (cid:15)
= 9 .
64 and δ = 6000 − 1 − 10 − 6 .
We observe in Table 3 that all IW methods improve upon the state of the art.
DISCUSSION
In this paper, we investigated importance weighting methods to correct for biases in downstream estimation tasks when using differentially private synthetic data.
While classiﬁcation algorithms can be used to estimate the required importance weights, noise must be added in order to maintain privacy.
We presented methods to debias inference based on privatised weights estimated by logistic regression, developed private estimation procedures allowing the complexity of neural networks to be leveraged for weight estimation, and proposed using inbuilt discriminator weights from GAN synthetic data generation to avoid increases to the privacy budget.
Following these developments, we advocate that future releases of DP synthetic data are augmented with privatised importance weights to allow researchers to conduct unbiased downstream model estimation.
Future work will focus on improved hyperparameter tuning practises to choose the optimal IW approach for the task and dataset at hand.
Acknowledgements
SG is a student of the EPSRC CDT in Modern Statistics and Statistical Machine Learning (EP/S023151/1) and receives funding from the Oxford Radcliffe Scholarship and Novartis. HW is supported by the Feuer International Scholarship in Artiﬁcial Intelligence.
JJ was funded by the Ayudas Fundación BBVA a Equipos de Investigación Cientiﬁca 2017 and Government of Spain’s Plan Nacional PGC2018101643-B-I00 grants whilst working on this project.
SJV is supported by the University of Warwick, University of
Warwick and German Resarch Centre for Aritiﬁcal Intelligence.
CH is supported by The Alan Turing Institute, Health
Data Research UK, the Medical Research Council UK, the EPSRC through the Bayes4Health programme Grant
EP/R018561/1, and AI for Science and Government UK
Research and Innovation (UKRI).
A.1 UNBIASED IMPORTANCE WEIGHTING BY OUTPUT PERTURBATION
A simple approach to ensure DP of an algorithm is to add noise (Dwork et al., 2006) to its output, that is the estimated importance weights of the synthetic data.
We establish general results under which such a noise perturbation of an unbiased non-private weights algorithm (cid:98) w ( x ) preserves the unbiasedness of IS estimation.
Theorem 2.
Let σ 2 ( h ) /N
denote the variance of the IS estimate I N ( h | w ) deﬁned in Equation (2) .
Then the IS estimator
I N ( h | w ∗ ) using noise perturbed importance weights w ∗ ( x i ) =
(cid:98) w ( x i )
+
ζ i , where ζ i are i.i.d.
and E [exp( ζ i )]
= 1 , is unbiased and has variance σ ∗ 2 ( h ) /N
where
[Equation]
We refer the reader to Supplement B.3 for the proof.
In the following we will analyse how the noise ζ has to be chosen to ensure DP.
Corollary 1.
The IS estimator with importance weights deﬁned by
[Equation]
ζ [Equation] ∼ Laplace
[Equation]
is ( N S (cid:15), 0) -differentially private.
It is further unbiased and for ρ < 12 has variance as deﬁned in equation 6:
[Equation]
Note that privacy budget is additive.
If we want to release N S DP weights, we thus have to scale the noise proportional to
N S .
Although this approach increases the variance of the estimator, it remains unbiased.
A limitation of this approach is that ρ < 1 / 2 .
Alternatively, Blum et al.
(2005) show that adding Gaussian noise ζ (cid:48) ∼
N (0 , 2 (cid:15) 2 S ( f ) 2 log 2 δ ) to an algorithm f ensures ( (cid:15), δ ) -DP for δ > 0 .
From our analysis it follows that we could adjust
Corollary 1 as follows.
Corollary 2.
The IS estimator with importance weights deﬁned by
[Equation]
δ is ( N S (cid:15), δ ) -differentially private with δ > 0 and (cid:15) < 1 .
It is further unbiased and has variance as deﬁned in equation 6 with
Var [exp( ζ (cid:48) )]
= γ 2 .
This result trivially extends to the case of (cid:15) ≥ 1 with accordingly adjusted noise scales following results from Balle and
Wang (2018).
Sources of Bias and Variance.
This analysis gives us insights on two sources of bias and variance.
The ﬁrst one is the bias and/or variance introduced by privatising the weights.
The estimator of Ji and Elkan (2013) is biased but as a result adds noise with a smaller variance, whereas to be unbiased by noising the weights we have to pay a price of increasing the variance, e.g., by adding more noise or by releasing fewer samples.
The second source is the bias and variance introduced by estimating the weights through the classiﬁer.
The importance weighting procedure is only unbiased when we know exactly how to estimate the true weights.
Using a logistic regression to estimate these cannot reasonably be considered as unbiased for any complicated data.
However, using an arbitrarily complex classiﬁer such as a classiﬁcation neural network could arguably be considered as less biased at estimating the density ratio if it converges, but possibly increases the variance of the estimators due to the increased number of parameters to learn.
A.2 POST-PROCESSING OF LIKELIHOOD RATIOS
The performance of importance weighting can suffer from a heavy right tailed distribution of the likelihood ratio estimates which increases the variance of downstream estimators.
A simple remedy is tempering: for a τ ∈ [0 , 1] the weights { (cid:98) w ( x i ) τ } i ∈{ 1 ,...,N G } are less extreme.
Alternatively, Vehtari et al. (2015) propose Pareto smoothed IS (PSIS).
This procedure requires to ﬁt a generalised Pareto distribution to the upper tail of the distribution of the simulated importance ratios.
Their algorithm does not only post-hoc stabilise IS, but also reports a warning when the estimated shape parameter of the Pareto distribution exceeds a certain threshold.
Similarly, Koopman et al.
(2009) propose a test to detect whether importance weights have ﬁnite variance.
In both warnings, there are certain characteristics of the DGP which are not captured by the SDGP and the resulting IS estimates are likely to be unstable.
This warning can thus be understood as a general indicator for unsuitable proposal distributions.
For large shape parameters the data owner should not release the SDGP.
It is also computationally more efﬁcient than comparable distribution divergences such as maximum mean discrepancy or Wasserstein distance.
We must also consider that unlike traditional IS where the importance weights are known (at least up to normalisation), here they are being estimated from data, providing further motivation for regularisation.
Aside from unstable likelihood ratios, the computed importance weights can suffer from the inability of the classiﬁcation method to correctly capture the density ratios.
To mitigate this problematic, Turner et al.
(2019) propose post-calibration of the likelihood ratios in a non-private setting.
If we can assume that the data analyst has access to a small dataset of the DGP, as e.g. in Wilde et al.
, we can make use of post-calibration methods, such as beta calibration (Kull et al., 2017).
B PROOFS B.1 PROPOSITION 1: BIAS AND VARIANCE OF ALGORITHM 1 OF JI & ELKAN (2013)
Consider Ji and Elkan (2013) Algorithm 1, where under the assumption that p ( y =1) p ( y =0) ≈ N D N S
= 1 , the unprivatised importance weights are estimated using logistic regression
[Equation]
and then the privacy preserving process adds noise to the (cid:98) β coefﬁcients of this logistic regression β ∗ = (cid:98) β
+ ζ with ζ ∼ Laplace (2 √ d/ ( N D λ(cid:15) )) , a vector of length d , to generate privatised estimates of the importance weights
[Equation]
The following proposition proves that w ( x i ) is a biased estimate of (cid:98) w ( x i ) , the consequences being that if the ‘true’ importance weight really is given by a logistic regression then the procedure of Ji and Elkan (2013) will be biased.
Proposition 1.
Let w denote the importance weights computed by noise perturbing the regression coefﬁcients as in Equation (8) (Ji and Elkan, 2013, Algorithm 1).
The importance sampling estimator I N ( h | w ) is biased.
Proof.
Firstly, we show that w ( x i ) is not an unbiased estimate of (cid:98) w ( x i )
[Equation]
As a consequence, we show that even if the true density ratio can be captured by a logistic regression, i.e. there exists βsuch that p D ( [Equation] p
[Equation] β T 0 x (cid:1) , then the importance sampling estimator
[Equation]
with w ( · ) calculated using ‘privatised’ β ∗ =
β 0 + ζ , ζ distributed as above, is a biased estimate of E p D
[ h ( x )] .
Indeed, we have
[Equation]
The proof of Proposition 1 provides several insights on what is required for an unbiased estimator.
The fact that the bias depends explicitly on the observation suggests either 1) asking the data curator to debias the noise given the synthetic data they are about to release or 2) adding noise to the weights themselves rather to the process of how they are calculated.
Ji and Elkan (2013) compute the variance of the estimator β ∗ = (cid:98) β
+ ζ where ζ ∼ Laplace ( 4( d +1)
d ( N D λ(cid:15) ) 2 ) as
[Equation]
They show that the asymptotic variance of importance sampling with the unperturbed weights obtained from the logistic regression w logreg can be upper bounded by
[Equation]
with
[Equation]
where β 0 optimises the loss function of a logistic regression on ﬁxed G and the true distribution of D .
The asymptotic variance of the importance sampling estimator with the weights w ∗ logreg from the logistic regression with parameter β ∗ is then
[Equation]
B.2 PROPOSITION 2: DEBIASING OF JI & ELKAN (2013)
As prescribed by Ji and Elkan (2013) Algorithm 1, consider importance weights
[Equation]
(9) for privacy preserved (cid:98) β coefﬁcients of this logistic regression β ∗ = (cid:98) β
+ ζ with ζ ∼ Laplace (2 √ d/ ( N D λ(cid:15) )) , a vector of length d .
Proposition 1 proved that using w ( · ) resulted in biased expectation estimation.
However, Proposition 2 demonstrates that we can debias this in closed form.
Proposition 2.
Let w denote the importance weights computed by noise perturbing the regression coefﬁcients as in Equation (9) (Ji and Elkan, 2013, Algorithm 1) with ζ ∼ p ζ .
Deﬁne
[Equation]
and adjusted importance weight
[Equation]
[Table]
The importance sampling estimator I N ( h | w ∗ ) is unbiased and ( (cid:15), 0) -differentially private.
The variance of estimator
I N ( h | w ∗ ) has the following decomposition
[Equation]
with
[Equation]
Proof.
Consider ( x 1 , . . .
, x N , ζ ) i.i.d ∼ p ∗ G , i.e. x i i.i.d ∼ p G , i = 1 , . . .
, N and ζ ∼ p ζ and
[Equation]
then
[Equation]
and as a result I N ( h | w ∗ ) is an unbiased estimator of E x ∼ p D ( x ) [ h ( x )] .
The variance of estimator
I N ( h | w ∗ ) is given by
[Equation]
where the weights are dependent under p ∗ G because ζ is not sampled independently for each x
i , it is only sampled once.
The terms making up (11) are
[Equation]
w
[Equation]
x )
[Equation]
Var
[Equation] [Equation]
Var
[Equation]
, with E ζ ∼ p ζ [ b ( x ) exp( ζx )] = 1 by construction and σ 2 ( h ) deﬁned in (10), and
[Equation]
By E ζ (cid:2) exp (cid:0) ζ T x (cid:1) b ( x ) (cid:3) = 1 , and x, x (cid:48)
iid ∼ p G the second term simpliﬁes to
E
[Equation]
[Table]
[Equation]
The ﬁrst term can be simpliﬁed as
[Equation]
As a result
[Equation]
B.2.1 Special Case 1: Laplace Noise
Recall that x i and ζ are d -dimensional vectors with d ≥ 1 .
For i.i.d.
ζ j , j = 1 , . . .
, d
E (cid:2) exp (cid:0) ζ T x i (cid:1)(cid:3) =
E   exp   d (cid:88)
j = ζ j x ij   
 =
E  
d (cid:89) j = exp ( ζ j x ij ) 
 =
d (cid:89) j
=
E [exp ( ζ j x ij )] , (independence) which is the moment generating function for random variable ζ j evaluated at t = x ij .
Now for ζ j iid ∼ L ( µ, ρ ) d (cid:89) j
=
E [exp ( ζ j x ij )]
=
d (cid:89) j = exp ( µx ij ) 1 − ρ 2 x 2 ij , for | x ij | < 1 /ρ ∀ j = exp (cid:16) µ (cid:80)
d j =1 x
[Equation]
as a result
[Equation]
The variance Of interest to the performance of such an approach are the terms
[Equation]
with | x ij | < 1 / 2 ρ ∀ j
[Equation]
and
[Equation]
b
[Equation]
b
[Equation]
x
[Equation]
− 1 , with | x j | , | x (cid:48)
j | and | x j + x (cid:48)
j | < 1 /ρ ∀ j
[Equation]
−
[Equation]
B.2.2 Special Case 2: Gaussian Noise
Recall that x i and ζ are d -dimensional vectors with d ≥ 1 .
The reciprocal of the bias correction
[Equation]
is the moment generating function of random variable ζ T x
i evaluated at t = 1 .
Now if ζ j iid ∼ N ( µ, σ 2 ) , j = 1 , . . .
, d , then
[Equation]
and therefore
[Equation]
The variance Of interest to the performance of such an approach are the terms
Var
[Equation]
and
[Equation]
−
[Equation]
B.2.3 Differential Privacy
The differential privacy of the approach follows from the post-processing theorem: since the synthetic data x 1 , . . .
, x N G is already privatised, the corresponding weights ¯ w ( x 1 ) , ..., ¯ w ( x N G ) are ( (cid:15), δ ) differentially private, and the adversary can be assumed to know which differential privacy mechanism is used (Balle and Wang, 2018), the data curator can debias the weights without any additional privacy budget.
B.2.4 Variance Comparison of Debiasing Ji & Elkan (2013)
Ji and Elkan (2013) provide bounds for the asymptotic variance of their privatised estimator.
Here, we investigate the ﬁnite sample variance of their (biased) method and compare it with the ﬁnite variance of our unbiased estimator form Proposition 2.
Note that we do not consider self-normalised IW while this is an implicit assumption made by Ji and Elkan (2013).
The variance of estimator I N ( h | w ) , where w is deﬁned in Equation (9), is given by
[Equation]
where, x, x (cid:48) ∼ p ∗ G .
The term σ 2 ( h ) is
[Equation] [Equation]
Further, c ( h ) is
[Equation]
where ﬁrstly,
[Equation]
w
[Equation] [Equation]
ζ
[Equation]
x )
[Equation]
x
[Equation]
and
[Equation]
[Equation] [Equation]
−
[Equation] [Equation]
[Equation] [Equation]
[Equation] [Equation]
[Equation] [Equation]
b
[Equation]
(cid:21)
[Equation]
as a result
[Equation] [Equation]
(cid:19)(cid:21) .
Comparisons after debiasing: We can compare the variance of I N ( h | w ) with the previously evaluated variance of
I N ( h | w ∗ ) as follows
[Equation]
with
[Equation] [Equation]
Var
[Equation]
∼
[Equation]
x )
[Equation]
x
[Equation]
w
[Equation]
x )]
[Equation]
Var
[Equation]
∼ p
[Equation]
x ) (cid:20) h ( x ) (cid:98) w ( x ) b ( x ) (cid:21) and c
[Equation]
( h
[Equation]
=
E x
[Equation]
p G (cid:20)
[Equation] [Equation]
( x
[Equation] [Equation]
(cid:48)
[Equation]
(cid:98) w ( x (cid:48) )
(cid:18) b ( x ) b ( x (cid:48) )
b ( x
[Equation]
(cid:48) )
[Equation]
(cid:19)(cid:21) c ( h )
[Equation]
E
[Equation]
(cid:48)
[Equation]
p G (cid:20) h ( x ) (cid:98) w ( x ) b ( x ) h ( x (cid:48) ) (cid:98) w ( x (cid:48) )
b ( x (cid:48) )
(cid:18) b ( x ) b ( x (cid:48) )
b ( x + x (cid:48) ) −(cid:19)(cid:21) .
Comparison for the introduction of Laplace noise: From Equation (12), under ζ j ∼ L (0 , ρ ) we have that
[Equation]
− ρ
[Equation]
x 2 ij (cid:1) , with | x ij | <
1 /ρ ∀ j.
The condition that | x ij | < 1 /ρ ensures that
[Equation]
As a result,
[Equation]
which provides that
[Equation]
Not only does debiasing remove bias, it also makes the estimator’s variance smaller.
B.3 THEOREM 2: NOISY IMPORTANCE SAMPLING
For privacy purposes, we want to be able to noise the importance weights as in
[Equation]
but we would like to still preserve the consistency properties of importance sampling estimates.
To achieve this, we expand the original target in importance sampling as follows
[Equation]
where ζ ∈ R will correspond to some additive noise on the log weights, and g ( ζ ) is a probability density on R such that by assumption
[Equation]
So, in particular, this implies that
[Equation]
Now, we can use a proposal density p ∗ G ( x, ζ ) =
p G ( x ) g ( ζ ) targeting p ∗ D ( x, ζ ) and the resulting importance weight is indeed
[Equation]
i.e. the importance weight in this extended space is a noisy version of the original weight (cid:98) w ( x ) .
We thus have
[Equation]
It follows that for i.i.d.
( x i , ζ i ) ∼ p ∗ G , i.e. x i ∼ p G and ζ i ∼ g , then
[Equation]
is an unbiased and consistent estimator of E p D [ h ( x )] .
Its variance is
Var [ I
[Equation]
By the variance decomposition formula, we have
[Equation]
as E g [exp( ζ )] = 1 by assumption and Var [ I N ( h | w )]
= 1 N Var p G [ h ( x ) (cid:98) w ( x )] .
The variance of our estimator is inﬂated as expected by the introduction of noise.
B.4 COROLLARY 1 AND 2: DIFFERENTIAL PRIVACY OF LOG-LAPLACE NOISED IMPORTANCE WEIGHTS
Following Kozubowski and Podgórski (2003), the (symmetric) log-Laplace distribution is the distribution of random variable x such that y = log( x ) has a Laplace density with location parameter µ and scale λ .
The density of a log-Laplace ( µ, λ ) random variable is
[Equation]
Note this is recovered from the asymmetric log-Laplace in Kozubowski and Podgórski (2003) with α = β = 1 λ .
Kozubowski and Podgórski (2003) further provide forms for the expectation and variance of the log-Laplace distribution as
[Equation]
Next we wish to investigate the differential privacy provided by using the Laplace mechanism (Dwork et al., 2006) to noise importance weights.
Adding Laplace noise to the log-weights, as in Equation (14), is equivalent to multiplying the importance weights by log-Laplace noise.
In order for the importance sampling to remain unbiased, the log-Laplace noise must have expectation 1.
From Equation (15) this will be the case for all λ < 1 if we set µ = log (cid:0) 1 − λ 2 (cid:1) .
A binary logistic-regression classiﬁer speciﬁes class probabilities
[Equation]
We denote by z 1: N G the private data sampled from the DGP, and by x 1: N D the synthetic data sampled from the SDGP.
Let z
[Equation] [Equation]
N G be the neighboring data set of z 1: N G .
The importance weights estimated by such a classiﬁer become
[Equation] [Equation]
if are minmax
B.
REMARK
1: THE IMPORTANCE-WEIGHTED LIKELIHOOD AND M -ESTIMATION
Remark 1.
Minimisation of the importance weight adjusted log-likelihood, − w ( x i ) log f
( x i | θ ) , can be viewed as an M -estimator with clear relations to the standard MLE.
Remark 1 of the paper points out the the connection between the Minimisation of the importance weight adjusted log-likelihood, (cid:96) IW ( x, θ ) :
= − w ( x i ) log f
( x i | θ ) and the standard maximum likelihood estimator which can be seen through the lens of M-estimation.
We exemplify this below.
Following Van der Vaart (2000), the M -estimate of parameter
[Equation]
] is given by
[Equation]
The estimator ˆ β ( n ) h is consistent and is asymptotically normal, i.e.
[Equation]
where
[Equation]
M-estimators generalises the case of MLE under model misspeciﬁcation and the variance calculation collapses to the standard inverse
Fisher’s information if the likelihood is correctly speciﬁed for the DGP.
The minimiser of the importance weight adjusted log-likelihood can be considered an M-estimate with the following form
[Equation]
As a result, given x 1: n ∼ P G the covariance of the asymptotic Gaussian distribution for ˆ θ ( n ) IW simpliﬁes to, ˜
[Equation]
where Var p G [ −∇ θ (cid:96) IW ( x, θ ∗ IW )]
=
E p G (cid:104) ( −∇ θ (cid:96) IW ( x, θ ∗ IW ))
( −∇ θ (cid:96) IW ( x, θ ∗ IW ))
T (cid:105)
because at the maximiser θ ∗ IW
E
[Equation]
G [ −∇ θ (cid:96) IW ( x,
[Table]
Further we can write the variance of the minimiser of the importance weight adjusted log-likelihood in terms of the variance of the standard MLE given the same number of observations x 1: n ∼ P D as follows:
[Equation]
We can then use such notions to produce an idea of the effective sample size of synthetic data.
B.5.1 The Effective Sample Size of Synthetic Data
When constructing traditional Importance Sampling estimates it is typical to talk about the ‘effective sample’ size of the sample from the proposal density.
The effective sample size is the number of independent samples from the true target that gives an unbiased estimator with the same variance as the importance sampling estimator using N G samples from the proposal density.
When using importance weights to adjust the likelihood for Bayesian updating we are not directly seeking to estimate an expectation, but minimize an (expected) loss to produce a parameter estimate.
Analogously, in this scenario we deﬁne the effective sample size of the synthetic data as the number of samples, N ( e ) G , from true DGP
P D that would provide an unbiased maximum likelihood estimate (MLE) with the same variance as the Importance-Weighted MLE (IW-MLE), i.e.
[Equation]
, where the function V corresponds to the asymptotic variance of that estimator
[Equation]
and |·| is a norm summary of the matrix values covariance of the estimator.
Given the asymptotic analysis presented above for the importance-weighted likelihood we have that
[Equation]
where
[Equation]
We note that for multidimensional parameter vectors the V ’s are covariance matrices and therefore we need to take a scalar summary using the norm | · | of these matrices in order to provide an integer effective sample size N ( e ) G .
Faced with a similar problem Lyddon et al.
(2018) consider the matrix trace for example.
Lastly, given a sample x 1: N G ∼ P G the effective sample size can be estimated by using empirical expectations
[Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
B.6 THEOREM 1: ASYMPTOTIC POSTERIOR DISTRIBUTION OF IMPORTANCE WEIGHTED BAYESIAN UPDATING
Section 3.1 of the paper considers the importance weighted Bayesian updating as a special case of general Bayesian updating where the loss function is speciﬁcally chosen to account for the fact that inference is being done with samples from p G while trying to approximate p D .
We henceforth write
[Equation]
for (cid:96) IW ( x i ; θ ) := − (cid:98) w ( x i ) log f
( x i | θ ) and (cid:98) w ( x i ) =
p D ( x i ) /p
G ( x i ) .
The next theorem shows that such a posterior given observations from p G has the same asymptotic distribution as the standard Bayes posterior given samples from p D would have, and therefore we consider this posterior to be asymptotically calibrated.
We give here the formal statement of Theorem 1.
Below D −→ denotes convergence in distribution.
Theorem 1.
Let the regular conditions in (Chernozhukov and Hong, 2003; Lyddon et al., 2018) hold.
Consider ˆ θ ( N ) IW :=
arg min θ ∈ Θ (cid:80) Ni
=1 (cid:96) IW ( x i ; θ ) , x i i.i.d.
∼ p G and ˆ θ ( N ):= arg min θ ∈ Θ (cid:80) Ni =1 (cid:96)
( x i ; θ ) , x i i.i.d.
∼ p D where (cid:96)
( x ; θ ) :
= − log f ( x ; θ ) .
Then both ˆ θ ( N )and ˆ θ ( N ) IW are consistent estimates of θ ∗ 0 :=
arg min θ ∈ Θ (cid:82) (cid:96)
( x ; θ ) dP D ( x ) .
Moreover there exists a non-singular matrix
J − 1 such that we have under the importance weighted Bayesian posterior π IW ( θ | x 1: N )
[Equation]
, almost surely w.r.t.
x 1: ∞ 1 while under the standard Bayesian posterior π ( θ | x 1: N )
[Equation]
N
[Equation]
(cid:1) , almost surely w.r.t.
x 1: ∞ .
Proof.
Firstly, deﬁne
[Equation]
Then Chernozhukov and Hong (2003); Lyddon et al.
(2018) show that under regularity conditions the following asymptotic result holds
[Equation]
as N → ∞ when θ is distributed according to the general Bayesian posterior almost surely w.r.t.
x 1: ∞ .
Similarly, if we deﬁne
[Equation]
then we have that under the standard Bayesian posterior (Chernozhukov and Hong, 2003; Kleijn et al., 2012; Lyddon et al., 2018)
[Equation]
almost surely w.r.t.
x 1: ∞ .
Now it follows from the importance sampling identity that
[Equation]
Moreover ˆ θ ( N )and ˆ θ ( N ) IW are also consistent estimates of θ ∗ 0 under the same regularity conditions.
This establishes the result.
B.6.1 Finite Sample Importance-Weighted Bayesian posterior
To complement the asymptotic results connecting the importance weighted general Bayesian posterior given data from p G and the standard
Bayesian p D we can consider the difference between these two for ﬁnite n = m .
This is formulated in the following proposition.
Proposition 4.
The expected KLD beween standard Bayesian posterior π ( θ | x 1: n ) and its importance weighted approximation π IW ( θ | z 1: m ) in expectation over the generating distributions for x 1: n ∼ P D and z 1: m ∼ P G , for n = m is
[Equation]
[Equation]
Proof.
We have
[Equation]
Now by Fubini we can reorder these integrals assuming that they all exist
[Equation]
Now assuming n = m
[Equation]
we have
[Equation]
C EXPERIMENTS C.1 EXPERIMENTAL DETAILS
Please refer to Table 4 for an overview of the data sets used.
We considered a random 80 / 20 train test split for all data sets except for
MNIST for which the default split was used.
[Table]
We obtained the code for PrivBayes from https://github.com/DataResponsibly/DataSynthesizer , and the code for
DPCGAN from https://github.com/ricardocarvalhods/dpcgan .
This code was used and changed to write the code for
DPGAN.
For the logistic regression alternatives we use an adaption of the sklearn implementation.
DPGAN was trained on labelled data by concatenating the features with the one hot encoding of the labels.
Our implementation will be made available online.
We train different downstream tasks on the synthetic data and test them on test data to ensure their utility for the setting of supervised learning.
The downstream algorithms were trained using sklearn with default parameters.
Hyperparameter tuning is a non-private operation as it queries private data to evaluate the model at validation time.
To ensure that we do not undermine the performance of the baselines we tuned them for (cid:15)
= 1 . , and chose default parameters for our method.
PrivBayes is trained in correlated attribute mode, and with optimal bandwidth computation.
For the GAN alternatives, we tuned the norm clip (1.0, 0.5), the batch size (32, 64), and number of epochs (50, 100) with grid search on a validation set (10% split of training).
The noise multiplier was chosen such that the desired privacy budget was reached.
The models were then retrained on the full training data set. Note that these hyperparameters are chosen smaller than in a non-private setting as the noise to be added would otherwise explode. The optimal hyperparameters can be found in the GitHub repository. Further we chose learning rate of the discriminator and generator as 0.15, and the number of hidden dimensions as d following Jordon et al.
For the MNIST experiment, we chose to use the hyperparameters found by Torkzadehmahani et al.
The regularisation parameter of the logistic regression for weight estimation was chosen from 0 .
The MLP for likelihood ratio estimation was computed based on the tensorflow and tensorflow_privacy package.
To ensure the privacy of the MLP, we started with a conﬁguration of one epoch, a batch size of 1, an L2 norm clip of 1, a noise multiplier of 5.2,microbatches and a learning rate of 0.1.
We computed the (cid:15) using built-in functions and increased/decreased the noise multiplier and the number of epochs until the desired privacy level was reached.
We chose N S = N D unless otherwise mentioned.
To compute the output-noised weights we computed the largest N S such that the scale restriction was satisﬁed and conducted the downstream analysis on this smaller dataset.
C.2 COMPUTATIONAL TIME OF IMPORTANCE WEIGHT ESTIMATION
Please refer to Table 5 for an overview of the additional time needed to compute the importance weights.
All experimental results were computed by training on a single Tesla V100 GPU.
We observe that the estimation of the importance weights comes with negligible computational overhead.
weighting
Iris
Banknote
Housing
Breast
MNIST
BetaNoised
[Table]
BetaDebiased
[Table]
-MLP
[Table]
Discriminator 0 .
[Table]
[Table] [Table]
C.3 CHOICE OF PRIVACY SPLIT
In Figure 3, we plot the change in evaluation metrics for different values of privacy budget splits.
We notice that the impact of the split parameter decreases the larger (cid:15) is.
Similarly, the variability in the metrics for different δ splits decreases, the larger (cid:15) IW is, where (cid:15)
IW denotes the privacy budget dedicated to the importance weight estimation.
While a larger δ split of 30-50% seems beneﬁcial for DP-MLP, the fraction of (cid:15) dedicated to the importance weighting model should be chosen relatively small, i.e. 10%.
Note that we chose these default values based on their performance on the Adult, Credit and Spam data set.
Tuning them to the underlying data and task characteristics will be able to improve their results.
As hyperparameter tuning is an unsolved problem in DP, we leave the procedure for choosing the optimal privacy split per data set for future work.
We note that an additional intricacy appears in DP because of the noise injection which increases the variability of the model’s performances.
C.4 MSE OF IMPORTANCE WEIGHT ESTIMATION
For each of our experiments, we compute the mean squared error between the privatised parameters of the logistic regression for importance weight estimation and the parameters of an unperturbed logistic regression trained on the private data.
Please refer to Tablefor the results.
We observe that debiasing almost always decreases the MSE in the low-privacy regimes.
For large privacy budgets, the scale of the perturbations can be negligible for low-dimensional data sets which is why both approaches perform similarly on Iris and
Banknote, but debiasing still helps with larger data sets such as Breast.
C.5 BAYESIAN UPDATING EXPERIMENTAL DETAILS
In addition to the logistic regression ROC-AUC score distributions presented in the main body of the paper, we applied importance weighted posteriors to updating and learning the parameters of linear regression and multinomial logistic regression models applied to the
TGFB and Iris datasets respectively, see Figures 4a and 4b.
It can be seen that in the case of linear regression, the DP-MLP and MLP IW methods are again very effective, with the performance improving across all SDGPs.
Other methods again tend to reduce variance in the results whilst not damaging performance and so can be seen to be effective in at least ensuring greater robustness and consistency when learning under synthetic data.
In the case of the Iris data, we calculated 1 vs all ROC-AUC scores for each class separately, then averaged these per-class ROC-AUCs to get a single multi-class average ROC-AUC.
Again, MLP and DP-MLP are stand-out in their
[Figure]
L P -
[Figure]
C
[Figure]
[Figure] [Figure]
[Figure] [Figure]
[Table]
performance, signiﬁcantly improving the performance measured by this metric, especially under synthetic data from the CGAN, DPCGAN and PrivBayes generators.
Similar gains can be seen across the majority of the methods for the DPCGAN, especially at the higher (cid:15) = 6 .
All of these models were implemented in the Turing.jl PPL Ge et al.
We then ran an experiment for each model and dataset on a deﬁned grid across all seeds, synthetic generators and (cid:15) values.
For each combination, we generated 10,000 samples across 4 chains (not counting 1,000 discarded warm-up samples per chain) for each of the importance weighting methods, as well as once for a model ﬁt on the synthetic data with its standard non-weighted posterior, and once for the real data.
We used Turing’s implementation of the NUTS sampling algorithm with a target acceptance ratio of 0 .
65 for sampling the linear regression models’ parameters, and for the logistic and multinomial logistic regression models we used HMC with a leapfrog step size of 0 .
05 and 10 leapfrog steps per iteration.
The logistic and multinomial logistic regression models’ coefﬁcients (including intercepts) were given centred Normal priors with σ = 1 .
The linear regression models’ coefﬁcient priors were given the same centred Normal priors with σ = 1 ; its variance was given a non-informative prior via a truncated Normal distribution ensuring positivity with σ = 10 .
We then took all 10,000 samples and calculated our evaluation metrics on the test set for each sample, storing all of these.
We then present the distributions of metric scores that arise in the included box-plot ﬁgures.
C.6 ILLUSTRATIVE EXAMPLE OF THE IMPLICATIONS OF BIAS MITIGATION
[Figure]
on PrivBayes synthesised Banknote data.
In Figure 5, we visualise the beneﬁt of debiasing: We ﬁtted a logistic regression as a downstream classiﬁer on the private data to get the true β coefﬁcients .
The predicted β coefﬁcients are estimated by training the logistic classiﬁer on the importance weighted synthetic data.
Each dot in the ﬁgure plots one dimension of the predicted β coefﬁcients against its true counterpart for one training run (out of ten).
An optimal classiﬁer would reconstruct the true coefﬁcients.
In this case all lines would be on the diagonal.
An unbiased estimator would on average reconstruct the true coefﬁcients: For each true β coefﬁcient, the predicted coefﬁcients would be centred around the true value.
We observe that coefﬁcients learned without importance weighting exhibit the largest distance to the diagonal line, while the importance weighting alternatives push the dots closer to the diagonal line.
Our method, DP-MLP, is particularly successful in decreasing the bias in the β coefﬁcients.
C.7 COMPLETE UCI RESULTS
The complete experimental results on the UCI data sets can be found in Tables 7 to 10.
Each table displays the performance of the different weight estimators for private and non-private synthetic data generative models for (cid:15) ∈ { 1 , 6 } , (cid:15) IW = 0 .
1 (cid:15) and δ IW = 0 .
3 δ .
We observe that importance weighting brings signiﬁcant gains especially in low privacy regimes.
For high privacy regimes this effect is reduced as the
SDGP gets closer to the DGP.
ϵ = ϵ =
None
LogReg
MLP
BetaNoised
BetaDebiased
DP-MLP
Discriminator 2 -2 2222 -2
IW Method
T e s t P r ed
i c
t
i on s
M SE
Synth Model
DPGAN
GAN
PRIVBAYES ϵ
=
ϵ =
None
LogReg
MLP
BetaNoised
BetaDebiased
DP-MLP
Discriminator 0.
IW Method
M u l t
[Table] [Table]
l a ss
[Table]
r aged
[Table]
[Table]
Synth
[Table]
DPGAN
PRIVBAYES
[Table]
(cid:15) =
M L P - R O
CAU
C ↑
None 0 .
[Table] [Table]
(cid:15) =
M L P - R O
CAU
C ↑
[Table] [Table]
[Table]
(cid:15) =
[Table]
BetaNoised
[Table] [Table]
BetaDebiased
[Table]
MLP
[Table]
Discriminator
[Table]
LogReg
[Table]
BetaNoised
[Table]
BetaDebiased
[Table]
MLP
[Table]
Discriminator
[Table]
C.8 COMPARISON TO EXPERIMENTAL RESULTS REPORTED BY RELATED WORK
We compare our results to PATE-GAN and DPGAN as DP synthetic data generators (Jordon et al., 2019; Xie et al., 2018).
The PATEGAN implementation is taken from https://github.com/vanderschaarlab/mlforhealthlabpub .
For DPGAN we chose the code from the DataSynthesizer package.
In the implementation of the PATE-GAN method, Jordon et al.
(2019) generate 50 independent synthetic data sets for each function call, returning the best synthetic data set as deﬁned by a comparison with non-private validation data.
The relative level of privacy violation in these situations is unknown, making interpretation of results and comparison between methods in tables and ﬁgures challenging.
On re-implementing the methods to generate DP synthetic data, we ﬁnd a substantial and signiﬁcant drop in performance, which nonetheless is improved through bias mitigation.
Please see the GitHub repository for further results and an illustration why PATE GAN underperforms.