PEARL: D ATA S YNTHESIS VIA P RIVATE E MBEDDINGS AND A DVERSARIAL R ECONSTRUCTION L EARNING Anonymous authors
Paper under double-blind review
A BSTRACT
We propose a new framework of synthesizing data using deep generative models in a differentially private manner.
Within our framework, sensitive data are sanitized with rigorous privacy guarantees in a one-shot fashion, such that training deep generative models is possible without re-using the original data.
Hence, no extra privacy costs or model constraints are incurred, in contrast to popular gradient sanitization approaches, which, among other issues, cause degradation in privacy guarantees as the training iteration increases.
We demonstrate a realization of our framework by making use of the characteristic function and an adversarial re-weighting objective, which are of independent interest as well.
Our proposal has theoretical guarantees of performance, and empirical evaluations on multiple datasets show that our approach outperforms other methods at reasonable levels of privacy.
I NTRODUCTION
Synthesizing data under differential privacy (DP) (Dwork (2006; 2011); Dwork & Roth (2014)) enables us to share the synthetic data and generative model with rigorous privacy guarantees.
Particularly, DP approaches of data synthesis involving the use of deep generative models have received attention lately (Takagi et al.
Xie et al.
; Torkzadehmahani et al.
; Frigerio et al.
; Yoon et al.
; Chen et al.
Harder et al.
Typically, the training of such models utilizes gradient sanitization techniques (Abadi et al.
that add noises to the gradient updates to preserve privacy.
While such methods are conducive to deep learning, due to composability, each access to data leads to degradation in privacy guarantees, and as a result, the training iteration is limited by the privacy budget.
Recently, Harder et al.
(2021) has proposed DP-MERF, which ﬁrst represents the sensitive data as random features in a DP manner and then learns a generator by minimizing the discrepancy between the (ﬁxed) representation and generated data points.
DP-MERF can iterate the learning process of the generator without further consuming the privacy budget; however, it is limited in the learning and generalization capabilities due to its ﬁxed representation.
In this work, we seek a strategy of training deep generative models privately that is able to resolve the aforementioned shortcomings, and is practical in terms of privacy (e.g., usable image data at (cid:15) (cid:39) 1 .)
We propose a private learning framework called PEARL (Private Embeddings and Adversarial
Reconstruction Learning).
In this framework, we have i) no limitation in learning iterations , and ii) well-reconstruction capability .
Towards those preferable properties, our framework ﬁrst obtains (1) informative embedding of sensitive data and (2) auxiliary information (e.g., hyperparameters) useful for training, both in a differentially private manner, then (3) the generative model is trained implicitly like GANs via the private embedding and auiliary information, where the learning is based on a stochastic procedure that generates data, and (4) a critic distinguishing between the real and generated data.
The overview of PEARL is illustrated in Fig.
As a concrete realization of PEARL, We ﬁrst identify that the characteristic function (CF) representation of data can be sanitized as the private embedding of PEARL.
Consequently, it is possible to train deep generative models using an appropriately deﬁned metric measuring the discrepancy between the real (but sanitized) and generated data distribution based on the CF without re-using the original data.
As will be explained in detail in later Sections, the generative modelling approach using CFs also
[Figure] [Figure]
[Figure]
involves sampling “frequencies” from an ad hoc distribution, to project the data to the embedding.
It is desirable to optimize the sampling distribution to better represent the data as an embedding, but the naive way of optimizing it would require re-accessing the data via sampling, coming at a cost of privacy budget.
Henceforth, we also propose to incorporate a privacy-preserving critic to optimize the sampling strategy, which, through re-weighting, chooses the best representation from a ﬁxed samples of frequencies without extra privacy costs.
To this end, we propose the following minimax optimization training objective:
[Equation]
See later parts for notations and details.
Theoretically, we show that our proposed objective has properties similar to those that are suited to training GANs, i.e., continuity and differentiability of the generator’s parameters, and continuity in weak topology.
We also prove the consistency of our privacy-preserving sampling strategy at the asymptotic limit of inﬁnite sampling.
Empirical evaluations show that PEARL is able to high-quality synthetic data at reasonable privacy levels.
Related works.
Traditional methods of synthesizing data are mainly concerned with discrete data or data preprocessed to the discrete form (Zhang et al.
(2017); Qardaji et al.
; He et al.
Chen et al.
; Cai et al.
; Zhang et al.
(2021)), whereas we are interested in more general methods involving continuous data.
Deep generative models under the DP setting are suitable for this type of tasks (Takagi et al.
Xie et al.
; Torkzadehmahani et al.
; Frigerio et al.
; Yoon et al.
; Chen et al.
Harder et al.
The private training of deep generative models is usually performed using gradient sanitization methods.
An exception is DP-MERF (Harder et al.
(2021)), which is closest to our work.
There, random features used to approximate the maximum mean discrepancy (MMD) objective are privatized and utilized for training a generator.
PEARL, which, as a realization, uses CFs, may be viewed as a generalization of
DP-MERF.
Additionally, PEARL has several distinctive features which are lacking in DP-MERF.
The ﬁrst lies in the introduction of a privacy-preserving critic, which leads to an improvement of performance.
The second is the private selection of the parameter of the sampling distribution, which is also shown to be vital.
Moreover, DP-MERF uses non-characteristic kernels when treating tabular data, in contrast to ours, which is characteristic and has guarantees in convergence.
We ﬁnally note that generative models using CFs but only non-privately have been explored before (Ansari et al.
Li et al.
Contributions.
Our contribution in this paper is three-fold: (i)
We propose a general framework called PEARL, where, unlike gradient sanitization methods, the generator training process and iteration are unconstrained; reliance on ad-hoc (non-private) hyperparameter tuning is reduced by extracting hyperparameters (auxiliary information) privately.
(ii)
We demonstrate a realization of our framework by making use of
the characteristic function and an adversarial re-weighting objective.
(iii)
Our proposal has theoretical guarantees of performance, and empirical evaluations show that our approach outperforms competitors at reasonable levels of privacy ( (cid:15) (cid:39) 1) .
P RELIMINARIES
This Section gives a brief review of essential preliminaries about differential privacy, characteristic function and the related notations.
2. D IFFERENTIAL P RIVACY
Deﬁnition 1 (( (cid:15) , δ )-Differential Privacy) .
Given privacy parameters (cid:15) ≥ 0 and δ ≥ 0 , a randomized mechanism, M : D → R with domain D and range R satisﬁes ( (cid:15) , δ )-differential privacy (DP) if for any two adjacent inputs d, d (cid:48) ∈ D and for any subset of outputs S ⊆ R , the following holds:
[Equation]
We next consider concrete ways of sanitizing certain outputs with DP.
A typical paradigm of DP is applying the randomized mechanism, M , to a certain deterministic function f : D → R such that the output of f is DP.
The noise magnitude added by M is determined by the sensitivity of f , deﬁned as ∆ f = sup d,d (cid:48) ∈D (cid:107) f
( d ) − f ( d (cid:48) )
(cid:107) , where || · || is a norm function deﬁned on f ’s output domain.
d and d (cid:48) are any adjacent pairs of dataset.
Laplacian and Gaussian mechanisms are the standard randomized mechanisms.
We primarily utilize the Gaussian mechanism in this paper (Dwork & Roth (2014)):
Deﬁnition 2 (Gaussian Mechanism) .
Let f : X → R be an arbitrary function with sensitivity ∆ f .
The Gaussian Mechanism, M σ , parameterized by σ , adds noise to the output of f as follows:
[Equation] [Equation]
One of the most important properties of DP relevant to our work is the post-processing theorem (Dwork & Roth (2014)):
Theorem 1 (Post-processing Theorem) .
Let M : D → R be ( (cid:15), δ )-DP and let f : R → R (cid:48) be an arbitrary randomized function.
Then, f ◦ M : D → R (cid:48) is ( (cid:15), δ )-DP.
It ensures that the DP-sanitized data can be re-used without further consuming privacy budgets.
2. C HARACTERISTIC F UNCTIONS
Characteristic function (CF) is widely utilized in statistics and probability theory, and perhaps is best known to be used to prove the central limit theorem (Williams (1991)).
The deﬁnition is as follows.
Deﬁnition 3 (Characteristic Function) .
Given a random variable X ⊆ R d and P as the probability measure associated with it, and t ∈ R d , the corresponding characteristic function (CF) is given by
[Equation]
Here, i is the imaginary number.
From the signal processing point of view, this mathematical operation is equivalent to the Fourier transformation, and Φ P ( t ) is the Fourier transform at frequency t .
It is noted that we deal with the discrete approximation of CFs in practice.
That is, given a dataset with n i.i.d.
samples, { x j } n j =1 from P , the empirical CF is written as (cid:98) Φ P ( t ) = 1 n (cid:80) n i =
j e i t · x j .
We next introduce characteristic function distance (CFD) (Heathcote (1972);
Chwialkowski et al.
Deﬁnition 4 (Characteristic Function Distance) .
Given two distributions P and Q of random variables residing in R d , and ω a sampling distribution on t ∈ R d , the squared characteristic function distance (CFD) between P and Q is computed as:
[Equation]
Notations.
Let us make a short note on the notations before continuing.
Let k be the number of t drawn from ω and P be the probability measure of a random variable.
We group the CFs associated to P of different frequencies, ( (cid:98) Φ P ( t 1 ) , . . .
, (cid:98) Φ P ( t k ))
(cid:62) more compactly as (cid:98) φ P ( x ) .
To make the dependence of (cid:98) φ P ( x ) on the sampled data explicit, we also use the following notation: (cid:98) φ P ( x ) = 1 n (cid:80) nj =1 (cid:98) φ P ( x j ) .
We notice that (cid:107) (cid:98) φ P ( x ) (cid:107) 2 ≡ (cid:113)(cid:80) km =1 | (cid:98) Φ P ( t m ) | 2 = (cid:113)(cid:80) km =1 | (cid:80) nl =1 e i t m · x l /n | 2 ≤ (cid:113)(cid:80) km =1 | (cid:80) nl
=1 1 /n | 2 = √ k , where the norm is taken over the (complex) frequency space.
With a slight abuse of notation, we abbreviate (cid:98) φ P as (cid:98) φ when there is no ambiguity in the underlying probability measure associated with the CF.
G ENERATIVE M ODEL OF PEARL
Let us describe generative modelling under the PEARL framework.
The realization is summarized by the following Proposition:
Proposition 1.
Let the real data distribution be P r , and the output distribution of an implicit generative model G θ by Q θ .
Let n be the total number of real data instances and consider releasing k
CFs from the dataset.
Then, G θ trained to optimize the empirical CFD, min θ ∈ Θ (cid:98) C 2 ( P r , Q θ ) with the CF sanitized according to the Gaussian mechanism (Defn. 3) with sensitivity 2 √ k/n satisﬁes ( (cid:15), δ ) -DP, where σ ≥ (cid:112) 2 log(1 .
25 /δ ) /(cid:15) .
Proof.
In the following we give a detailed explanation of the above Proposition.
The ﬁrst step of
PEARL is projecting the data to the CF as in Eq.
4, where the number of embeddings is the number of frequency drawn from ω ( t ) .
We note that CF has several attractive properties.
CF is uniformly continuous and bounded, as can be seen from its expression in Eq.
Unlike the density function, the CF of a random variable always exists, and the uniqueness theorem implies that two distributions are identical if and only if the CFs of the random variables are equal Lukacs (1972).
The CF is sanitized with DP by applying the Gaussian mechanism (Defn. 3) to (cid:98) φ ( x ) :
[Equation]
(6) where we write the sanitized CF as (cid:101) φ ( x ) ; ∆ (cid:98) φ ( x ) denotes the sensitivity of the CF, σ denotes the noise scale which is determined by the privacy budget, ( (cid:15), δ ).
The calculation of sensitivity is tractable (no ad-hoc clipping commonly required by gradient sanitization methods) Without loss of generality, consider two neighboring datasets of size n where only the last instance differs ( x n (cid:54) =
x (cid:48) n ).
The sensitivity of (cid:98) φ ( x ) may then be calculated as
[Equation]
where we have used triangle inequality and (cid:107) (cid:98) φ ( · ) (cid:107) 2 ≤ √ k .
It can be seen that the sensitivity is proportional to the square root of the number of embeddings (releasing more embeddings requires more DP noises to be added to (cid:98) φ ) but inversely proportional to the dataset size, which is important for controlling the magnitude of noise injection at practical privacy levels, as will be discussed in later Sections.
We would like to train a generative model where the CFs constructed from the generated data distribution, Y ⊆ R d , matches those (sanitized) from the real data distribution, X ⊆ R d .
A natural way of achieving this is via implicit generative modelling (MacKay (1995); Goodfellow et al.
We introduce a generative model parametrized by θ , G θ : Z → R d , which takes a low-dimensional latent vector z ∈ Z sampled from a pre-determined distribution (e.g., Gaussian distribution) as the input.
In order to quantify the discrepancy between the real and generated data distribution, we use the CFD deﬁned in Eq. 5.
Empirically, when a ﬁnite number of frequencies, k , are sampled from ω , C 2 ( P , Q ) is approximated by
[Equation]
where (cid:98) Φ P ( t ) and (cid:98) Φ Q ( t ) are the empirical CFs evaluated from i.i.d.
samples of distributions P and Q respectively.
The training objective of the generator is to ﬁnd the optimal θ ∈ Θ that minimizes the empirical CFD:
min θ ∈ Θ (cid:98) C 2 ( P r , Q θ ) .
It can be shown via uniqueness theorem that as long as ω resides in
R d , C
( P , Q ) =
⇐⇒ P = Q (Sriperumbudur et al.
This makes CFD an ideal distance metric for training the generator.
Optimization procedure.
The generator parameter, θ , is updated as follows.
(cid:98) φ P r ( x ) is ﬁrst sanitized to obtain (cid:101)
φ P r ( x ) , as in Eq.
This is performed only for once (one-shot).
Then, at each iteration, m samples of z are drawn to calculate (cid:98) φ Q θ ( x ) .
Gradient updates on θ are performed by minimizing the
CFD, (cid:13)(cid:13)(cid:13) (cid:101)
φ P r ( x ) − (cid:98) φ Q θ ( x ) (cid:13)(cid:13)(cid:13) 2 .
We note that only the ﬁrst term, (cid:101)
φ P r ( x ) , has access to the real data distribution, X , of which privacy is of concern.
Then, by Thm. 1, G θ trained with respect to (cid:101) φ P r ( x ) is DP.
Furthermore, unlike gradient sanitization methods, the training of G θ is not affected by network structure or training iterations.
Once the sanitized CF is released, there is no additional constraints due to privacy on the training procedure.
DP release of auxiliary information.
Auxiliary information, e.g., hyperparameters regarding to the dataset useful for generating data with better quality may be obtained under DP.
In our case, one may extract auxiliary information privately from the dataset to select good parameters for the sampling distribution ω ( t ) .
This will be discussed in more detail in the next Sections.
Another example is the modelling of tabular data.
Continuous columns of tabular data consisting of multiple modes may be modelled using Gaussian mixture models (GMMs) (Xu et al.
GMMs are trainable under DP using a DP version of the expectation-maximization algorithm (Park et al.
The total privacy budget due to multiple releases of information is accounted for using the
Rényi DP composition.
See App.
A for the deﬁnition of Rényi DP.
A DVERSARIAL R ECONSTRUCTION L EARNING
This Section is devoted to proposing a privacy-preserving critic for optimizing ω ( t ) , while giving provable guarantees of performance.
Back to Eq.
5 and Eq.
7, we note that choosing a “good” ω ( t ) or a “good” set of sampled frequencies is vital at helping to discriminate between P and Q .
For example, if the difference between P and Q lies in the high-frequency region, one should choose to use t with large values to, in the language of two-sample testing, improve the test power.
Adversarial objective.
If the resulting empirical CFD remains small due to under-optimized ω ( t ) , while the two distributions still differ signiﬁcantly, the generator cannot be optimally trained to generate high-quality samples resembling the real data.
Hence, we consider training the generator by, in addition to minimizing the empirical CFD, maximizing the empirical CFD using an adversarial objective which acts as a critic , where the empirical CFD is maximized by ﬁnding the best sampling distribution.
We consider a training objective of the form
[Equation]
where Ω is some set of probability distribution space of which the sampling distribution ω lives in.
Privacy-preserving optimization.
It is intractable to directly optimize ω in the integral form as in
Eq.
In this work, we opt for a privacy-preserving one-shot sampling strategy where once the private data is released (by sampling from ω ), optimization is performed without further spending the privacy budget.
We believe that such a new formulation of distribution learning is of independent interest as well.
Effectiveness of the critic.
To further motivate why it is preferable to introduce an adversarial objective as in Eq.
8, we present a simple demonstration through the lens of two-sample testing (Chwialkowski et al.
; Jitkrittum et al.
using synthetic data generated from Gaussian distributions.
We generate two unit-variance multivariate Gaussian distributions P , Q , where all dimensions but one have zero mean.
We conduct a two-sample test using the CF to distinguish between the two distributions, which gets more difﬁcult as the dimensionality increases.
We test if the null hypothesis where the samples are drawn from the same distribution is rejected.
Higher rejection rate indicates better test power.
Note that the ﬁrst dimension (where the distribution differs) of the frequency used to construct CFs is the most discriminative dimension for distinguishing the distributions.
We consider three sets of frequencies: “unoptimized”, “normal”, and “optimized”, where the set of “unoptimized” frequencies is optimized with re-weighting.
More details can be found in App.
C.
[Figure]
Fig.
2 shows the hypothesis rejection rate versus the number of dimensions for the three cases considered above.
As can be observed, the “optimized” case gives overall the best test power.
While this experiment is somewhat contrived, it can be understood that although both “unoptimized” and “optimized” sets of frequencies contain the discriminative t 0 , the re-weighting procedure of selecting the most discriminative
CF improves the test power signiﬁcantly.
Even without re-sampling from a “better” ω ( t ) , reweighting the existing frequencies can improve the test power.
The fact that re-weighting can improve the test power is crucial privacy-wise because the altenative method, re-sampling, causes degradation in privacy.
Proposal.
Recall that the empirical CFD, (cid:98) C 2 ( P r , Q θ )
=
1 k (cid:80) ki =1 (cid:12)(cid:12)(cid:101) Φ P r ( t i ) − (cid:98) Φ Q θ
[Equation]
t i ) (cid:12)(cid:12) 2 , is obtained by drawing k frequencies from a base distribution ω 0 .
Our idea is to ﬁnd a (weighted) set of frequencies that gives the best test power from the drawn set.
We propose Eq.
1 as the optimization objective, restated below:
[Equation]
[Table]
Note that the generator trained with this objective still satisﬁes DP as given in Prop. 1 due to Thm. 1.
The following Lemma ensures that the discrete approximation of the inner maximization of Eq.approaches the population optimum as the number of sampling frequency increases ( k → ∞ ):
Lemma 1.
Let ω 0 be any probability distribution deﬁned on R d , and let f : R d → R (cid:48) be any function.
Also let t ∈ R d and ω ∗ be the maximal distribution of ω with respect to E ω
[ f ( t )] ≡ (cid:82) f
( t ) ω ( t ) d t .
Assume that the empirical approximation (cid:98) E ω [ f ( t )]
→ E ω [ f ( t )] at the asymptotic limit for any ω .
Then, (cid:98) E ω
[ f ( t ) ω ∗ ( t ) ω
( t ) ]
→ E ω ∗ [ f ( t )] at the asymptotic limit as well.
The proof is in App.
B, and is based on importance sampling.
Empirically, we ﬁnd that treating ω ( t i ) as a free parameter and optimizing it directly does not lead to improvement in performance.
This may be due to the optimization procedure focusing too much on uninformative frequencies that contain merely noises due to DP or sampling.
We perform parametric optimization instead, that is, e.g., we perform optimization with respect to { µ , σ } if ω is of the Gaussian form, N ( µ , σ 2 ) .
Performance guarantees.
Let us discuss the theoretical properties of Eq. 8.
The objective deﬁned in Eq.
8 shares beneﬁcial properties similar to those required to train good GANs, ﬁrst formulated in (Arjovsky et al.
First, the generator learns from a distance continuous and differentiable almost everywhere within the generator’s parameters.
Second, the distance is continuous in weak topology, and thus provides informative feedback to the generator (different from, e.g., the JensenShannon divergence, which does not satisfy this property).
We make assumptions similar to those given in (Arjovsky et al.
and state the ﬁrst theorem as follows.
Theorem 2.
Assume that G θ ( z ) is locally Lipschitz with respect to ( θ, z ) ; there exists L (( θ, z ) satisfying E z
[ L ( θ, z )] < ∞ ; and sup ω ∈ Ω E ω [ | t | ] < ∞ for all t .
Then, the function sup ω ∈ Ω C 2 ω ( P r , Q θ ) is continuous in θ ∈ Θ everywhere, and differentiable in θ ∈ Θ almost everywhere.
Note that the local Lipschitz assumptions are satisﬁed by commonly used neural network components, such as fully connected layers and ReLU activations.
The continuity and differentiability conditions with respect to θ stated above allow G θ to be trained via gradient descent.
The theorem related to continuity in weak topology is the following:
Theorem 3.
Let P be a distribution on X and ( P n ) n ∈ N be a sequence of distributions on X .
Under the assumption sup ω ∈ Ω E ω ( t ) [ (cid:107) t (cid:107) ] < ∞ , the function sup ω ∈ Ω C 2 ω ( P n , P ) is continuous in the weak topology, i.e., if P n D −→ P , then sup ω ∈ Ω C 2 ω ( P n , P ) D −→ 0 , where D −→ denotes convergence in distribution.
Weakness is desirable as the easier (weaker) it is for the distributions to converge, the easier it will be for the model to learn to ﬁt the data distribution.
The core ideas used to prove both of these theorems are the fact that the difference of the CFs (which is of the form e ia ) can be bounded as follows: | e ia − e ib | ≤ | a − b | , and showing that the function is locally Lipschitz, which ensures the desired properties of continuity and differentiability.
See App.
B for the full proofs.
E XPERIMENTS 5. E XPERIMENTAL S ETUP
To test the efﬁcacy of PEARL, we perform empirical evaluations on three datasets, namely MNIST (LeCun et al.
, Fashion-MNIST (Xiao et al.
and Adult (Dua & Graff (2017)).
Neural networks constructed from convolutional and fully connected layers are utilized as the generator for image and tabular datasets respectively.
Detailed setups are available in App. H.
Training Procedure.
As our training involves minimax optimization (Eq. 1), we perform gradient descent updates based on the minimization and maximization objectives alternately.
We use a zeromean diagonal standard-deviation Gaussian distribution, N ( 0 , diag( σ 2 ) as the sampling distribution, ω .
Maximization is performed with respect to σ .
Let us give a high-level description of the full training procedure: draw k frequencies from ω , calculate the CFs with them and perform
DP sanitization, train a generator with the sanitized CFs using the minimax optimization method.
The pseudo-code of the full algorithm is presented in App.
E. We further give the computational complexity analysis of our algorithm in App.
F.
DP release of auxiliary information.
We also note that applying maximization (re-weighting) on a randomly selected set of frequencies would not work well.
We initially ﬁx the inverse standard deviation of the base distribution, ω 0 , to be the DP estimate of the mean of the pairwise distance of the data, to obtain (privately) a spectrum of frequencies that overlaps with the "good" frequencies.
This is motivated by the median heuristic (Garreau et al.
Mean is estimated instead of median as its sensitivity is more tractable when considering neighboring datasets.
We obtain ∆ = 2 √ d/n as its sensitivity, where d and n are the data dimension and the number data instances respectively.
See App.
D for the derivation.
1 Using this DP estimate, we also investigate as a ablation study the generator performance with minimization objective only (w/o critic).
The full PEARL framework includes the use of the critic to ﬁnd the "best" frequencies among the selected spectrum to distinguish the distributions (and overall perform a minimax optimization).
Evaluation Metrics.
In the main text and App.
I, we show qualitative results, i.e., synthetic images (image dataset) and histograms (tabular dataset) generated with PEARL.
Furthermore, for image datasets, the Fréchet Inception Distance (FID) (Heusel et al.
and
Kernel Inception Distance (KID) (Bi´nkowski et al.
(2018)) are used to evaluate the quantitative performance.
For tabular data, we use the synthetic data as the training data of 10 scikit-learn classiﬁers (Pedregosa et al.
and evaluate the classiﬁers’ performances on real test data.
The performance indicates how well synthetic data generalize to the real data distribution and how useful synthetic data are in machine learning tasks.
ROC (area under the receiver operating characteristics curve) and PRC (area under the precision recall curve) are the evaluation metrics.
We provide the deﬁnitions and details of FID and KID in App.
G.
5. E VALUATION D ETAILS
MNIST and Fashion-MNIST.
Privacy budget is allocated equally between the sanitization of CFs and the release of auxiliary information.
On a single GPU (Tesla V100-PCIE-32GB), training
MNIST (with 100 epochs) requires less than 10 minutes.
DP-MERF also uses a sampling distribution.
Since privacy budget is not allocated for calculating the parameters of the sampling distribution there, we ﬁx its sampling distribution to be N ( 0 , diag( 1 )) .
We expect that CF sanitization requires more privacy allocation as it is involved in doing the heavy lifting of training the model.
We ﬁnd that allocating around 80-90% of the budget to CF sanitization can increase the performance by around 15%.
Nevertheless, we utilize an equal share of privacy budget for fairness reasons, as tuning the budget allocation would require re-using the private data and this can lead to privacy leakage.
[Figure] [Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
Some of the generated images of ours and baseline models are shown in Fig.
3, and more (including baselines’) can be found in App.
I.
At the non-private limit, the image quality is worse than other popular non-private approaches such as GANs due to two reasons.
First, projecting data to a lower dimension causes information loss.
Second, our architecture does not have a discriminator-like network as in the vanilla GAN framework.
However, we notice that the quality of the images does not drop much as the privacy level increases (except at (cid:15)
= 0 .
2 , where the quality starts to degrade visibly) because the noise added to the CFs is small as it scales inversely proportional to the total sample size.
It also indicates that our approach works particularly well at practical levels of privacy.
We now provide quantitative results by performing evaluation at ( (cid:15), δ ) =
(1 , 10 − 5 ) .
Note that we focus on this high privacy region despite the fact that many previous studies experimented with (cid:15) (cid:39) 10 , because recent analyses showed that realistic attacks can lead to privacy violations at low privacy (Jagielski et al.
; Nasr et al.
Particularly, the claim “values of (cid:15) that offer no meaningful theoretical guarantees” ( (cid:15) (cid:29) 1 ) can be chosen in practice has been “refuted” in general (Nasr et al.
This motivates us to perform evaluation at (cid:15) with meaningful theoretical guarantees ( (cid:15) (cid:39) 1 ).
At this privacy region, we compare PEARL with models using gradient sanitization and DP-MERF (Harder et al.
as other methods do not produce usable images at single-digit (cid:15) .
We run the experiment ﬁve times (with different random seeds each time), and for each time, 60k samples are generated to evaluate the FID and KID.
In Table 1, the FID and KID (average and error) of
DP-MERF, DPGAN, PEARL without critic, and PEARL are shown.
It can be seen that PEARL outperforms DP-MERF signiﬁcantly, and the critic leads to improvement in the scores.
Adult.
The Adult dataset consists of continuous and categorical features.
As data pre-processing, continuous features are scaled to [0 , 1] .
We also compare our results with DP-MERF, as DP-MERF performs best among other existing methods (e.g., DPCGAN achieves ROC and PRC around 0.5; see Table 4.)
Again, auxiliary information and CFs share equal budget of privacy, and we perform evaluation at ( (cid:15), δ ) =
(1 , 10 − 5 ) .
11k synthetic samples are generated for evaluation.
Histogram plots of the attributes comparing the real and synthetic data is shown in Fig.
As can be observed in the Figure, PEARL is able to model the real data better than DP-MERF, e.g., covering more modes in the categorical variable “marital-status” with less discrepancy in the frequency of each mode.
PEARL is also able to better model the descending trend of the continuous variable
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
is performed at ( (cid:15), δ ) =
(1 , 10 − 5 ) .
“age”.
The average ROC and PRC scores (average and error) are shown in Table 2.
ROC and PRC scores based on PEARL’s training data are shown to be closer to those based on real training data compared to DP-MERF.
More histogram plots in higher resolution are available in App.
I.
Also, in
App.
I, we present experimental results of another tabular dataset (Credit), as well as evaluations with other metrics/tasks using the synthetic data.
PEARL still performs favorably under these different conditions.
Overall, we have demonstrated that PEARL is able to produce high-quality synthetic data at practical privacy levels.
C ONCLUSION
We have developed a DP framework to synthesize data with deep generative models.
Our approach provides synthetic samples at practical privacy levels, and sidesteps difﬁculties encountered in gradient sanitization methods.
We comment on several potential future directions.
While we have limited ourselves to characteristic functions, it is interesting to adopt and adapt other paradigms to the PEARL framework.
As a future direction, we note that, throughout the current work, we have taken the extreme limit where the sensitive data is transformed, sanitized, and released in a one-shot fashion.
Allowing more accesses to the data could be more beneﬁcial in terms of the privacy-utility trade-off.
We intend to study this in the future.
A A DDITIONAL D EFINITIONS AND P REVIOUS R ESULTS
Deﬁnition 5 (Rényi differential privacy) .
A randomized mechanism M is said to satisfy ε -Rényi differential privacy of order λ , when
[Equation]
M
[Equation]
is satisﬁed for any adjacent datasets d and d (cid:48) .
Here, D λ ( P (cid:107) Q )
= 1 λ − 1 log E x ∼ Q
[( P ( x ) /Q
( x )) λ ] is the Rényi divergence.
Furthermore, a ε -RDP mechanism of order λ is also ( ε + log1 /δ
λ − 1 , δ ) -DP.
Next, we note that the Gaussian mechanism is ( λ, λ ∆ 2 f 2 2 σ 2 )
-RDP Mironov (2017).
The particular advantage of using RDP is that it gives a convenient way of tracking the privacy costs when a sequence of mechanisms is applied.
More precisely, the following theorem holds Mironov (2017):
Theorem 4 (RDP Composition) .
For a sequence of mechanisms M 1 , ..., M k s.t.
M i is ( λ, ε i )
-RDP ∀
i , the composition M 1 ◦ ... ◦
M k is ( λ, (cid:80) i ε i ) -RDP.
We use the autodp package to keep track of the privacy budget (Wang et al.
B P ROOFS B. P ROOF OF T HM .
Proof.
Let P r denote the real data distribution, Q θ denote the data distribution generated by G θ using a latent vector, z sampled from a pre-determined distribution, and ω a sampling distribution.
| · | denotes the modulus of · .
Then, the CFD between the distributions is
[Equation]
where Φ P ( t ) =
E x ∼ P (cid:2) e i t · x (cid:3) is the CF of P .
For notational brevity, we write Φ P r ( t ) as Φ r ( t ) , and Φ Q θ ( t ) as Φ θ ( t ) in the following.
We consider the optimized CFD, sup ω ∈ Ω C 2 ω ( P r , Q θ ) , and would like to show that it is locally Lipschitz, 4 which subsequently means that it is continuous.
Since the Radamacher’s theorem Federer (2014) implies that any locally Lipschitz function is differentiable almost everywhere, the claim of differentiability is also justiﬁed once the Lipschitz locality is proven.
We ﬁrst note that the difference of two maximal functions’ values is smaller or equal to the maximal difference of the two functions.
Then, for any θ and θ (cid:48) ,
[Equation]
We note that the absolute difference of any two complex values represented in terms of its real-number amplitude ( A, B ) and phase ( α, β ) satisﬁes | Ae iα − Be iβ | ≤ | A | + | B | .
Writing the maximal ω as ω ∗
[Equation]
the RHS of Eq.
9 can be written as
[Equation]
where we have used ( a ) | Φ P | ≤ 1 , ( b ) triangle inequality.
By interpreting a complex number as a vector on a 2D plane
[Equation]
and using trigonometric arguments
[Equation]
one can deduce that | e ia − e ib | = 2 sin ( | a − b | / 2) ≤ | a − b | .
Then,
[Equation]
In ( c ) , we have also used the Jensen inequality.
In ( d ) , the Cauchy-Schwarz inequality has been applied.
As we are assuming that G θ is a L ( θ, z ) -Lipschitz function, we have
[Equation]
Since we are also assuming that E t ∼ ω ∗ ( t ) [ | t | ] , E z [ L ( θ, z )] ≤ ∞ , we have shown that sup ω ∈ Ω C ω is locally Lipschitz, as required.
It is therefore continuous and differentiable almost everywhere, as discussed above.
B. P ROOF OF T HM .
Proof.
We denote x n ∼ P n and x ∼ P , and ω ∗ the maximal function of ω .
Notice that
[Equation]
Here, ( a ) uses | Ae iα − Be iβ | ≤ | A | + | B | as argued above Eq. 10; ( b ) uses Jensen inequality; ( c ) uses the argument | e ia − e ib | = 2 sin ( | a − b | / 2) ≤ | a − b | , given above Eq. 11.
Then, by weak convergence equivalence (Klenke (2013)), the RHS of Eq.
13 approaches zero as P n D −→ P , hence proving the theorem.
B. P ROOF OF L EMMA .
Proof.
Recall that for any two distributions, ω ( t ) , ω 0 ( t ) and any function f ( t ) ,
[Equation]
Hence, E ω ( t ) [ f ( t )] =
E ω
[ f ( t ) ω ( t ) ω
( t ) ] .
Let ω ∗ be the maximal probability distribution.
It is then clear that (cid:98) E ω
[ f ( t )]
→ E ω [ f ( t )] implies (cid:98) E ω
[ f ( t ) ω ∗ ( t ) ω
( t ) ]
→ E ω ∗ [ f ( t )] , as desired.
C E XPERIMENTAL S ETUP OF T WO - SAMPLE T ESTING ON S YNTHETIC D
ATA
Let us describe in more detail the experiment presented in Sec. 4.
Data are generated from two unit-variance multivariate Gaussian distributions P , Q , where all dimensions but one have zero mean ( P ∼ N ( 0 d , I d ) , Q ∼ N ((1 , 0 , . . . , 0) (cid:62) , I d ) ).
We wish to conduct a two-sample test using the CF to distinguish between the two distributions, which gets more difﬁcult as the dimensionality increases.
We test if the null hypothesis where the samples are drawn from the same distribution is rejected.
Three sets of frequencies are considered.
The number of frequncies in each set is set to 20.
The ﬁrst set is an “unoptimized” set of frequencies.
The ﬁrst dimension of all but one frequency has the value of zero.
Other dimensions have values generated randomly from a zero-mean unitvariance multivariate Gaussian distribution.
We denote the frequency with non-zero value in the ﬁrst dimension by t 0 without loss of generality.
A “normal” set of frequencies is also considered for comparison, where the frequencies of all dimensions are sampled randomly from a multivariate
Gaussian distributions.
Finally, we consider an “optimized” set of frequencies, where from the
“unoptimized” set of frequencies, only t 0 is selected to be used for two-sample testing.
In other words, we re-weight the set of frequencies such that all but t 0 has zero weight.
1,000 samples are generated from each of P and Q .
We repeat the problem for 100 trials to obtain the rejection rate (and repeat the whole experiment 5 times to get the error bar).
D DP E STIMATE OF THE M EAN OF P AIRWISE D ISTANCE
Median heuristic is applied widely in kernel methods applications to determine the bandwidth of the radial basis function (RBF) kernels (Garreau et al.
The bandwidth is taken to be the median of all pairwise distances of data samples.
Here we give a DP estimation of the mean instead as the calculation of mean is more tractable.
Let x be samples of a certain data distribution of dimension d and assume that the values lie in [0 , 1] d .
Given n samples, there is a total of n ( n − 1) / 2 pairwise distance pairs.
Then, the mean of the pairwise distance of samples is
[Equation]
where (cid:107) · (cid:107) 2 indicates the Euclidean norm.
Consider a pair of neighboring datasets, D , D (cid:48) .
Without loss of generality, let x n (cid:54) =
x (cid:48) n and x i = x (cid:48)
i for i (cid:54) = n .
Then, the sensitivity of D n ( x ) is
[Equation]
[Table]
[Equation]
[Table]
[Equation]
In (a), we cancel out all terms unrelated to x n or x (cid:48) n .
In (b), we use the fact that (cid:107) x i − x n (cid:107)and (cid:107) x
i − x (cid:48) n (cid:107) 2 lie in [0 , √ d ] .
After obtaining the sensitivity, one can then applies the Gaussian mechanism as in Eq.
6 to obtain the DP estimate of the mean of the pairwise distance of samples.
E T RAINING A LGORITHM
The pseudo-code of the proposed training algorithm is given in Algorithm 1.
F C OMPUTATIONAL C OMPLEXITY A NALYSIS
PEARL is trained based on deep learning methods, which is efﬁcient computation-wise using a
GPU.
Nevertheless, let us give a computational complexity analysis in a traditional sense by ignoring (partially) the parallel computing capability.
Time complexity.
We sample k frequencies and calculate its inner product with data points (of dimension d ), make a summation with respect to n data points to build k CFs.
Since inner product takes d steps, summation n steps, and we do it for k times, the time complexity of generating CFs is nkd .
We additionally train the generative model, requiring t tr .
Note that unlike graphical models like PrivBayes, which gradually add nodes to the Bayesian network, our method can be parallelized efﬁciently with GPU.
As we sample n records from the generative model during data generation, the time complexity of dataset generation is n times the inference time, t inf .
The total training and inference time is O ( nkd + nt inf + t tr ) .
Space complexity.
We need to store the k CF values during training.
We also need to store the generative model with m parameters.
The space complexity is O ( k + m ) .
G E VALUATION M ETRICS
We utilize evaluation metrics commonly used to evaluate GAN’s performance, namely Fréchet
Inception Distance (FID)
Heusel et al.
(2017) and Kernel Inception Distance (KID) Bi´nkowski et al.
FID corresponds to computing the Fréchet distance between the Gaussian ﬁts of the Inception features obtained from real and fake distributions.
KID is the calculation of the MMD of the Inception features between real and fake distributions using a polynomial kernel of degree 3.
The precision deﬁnitions are as follows.
Let { x ri } ni
=1 be samples from the real data distribution P r and { x θi } mi =1 be samples from the generated data distribution Q θ .
The corresponding feature vectors extracted from a pre-trained network (LeNet in our case) are { z r i } n i =1 and { z θ i } m i =1 respectively.
The FID and KID are deﬁned as
[Equation]
where ( µ r , Σ r ) and ( µ θ , Σ θ ) are the sample mean & covariance matrix of the inception features of the real and generated data distributions, and κ is a polynomial kernel of degree 3:
[Equation]
where d is the dimensionality of the feature vectors.
We compute FID with 10 bootstrap resamplings and KID by sampling 100 elements without replacement from the whole generated dataset.
H I MPLEMENTATION D ETAILS
Datasets.
For MNIST and Fashion-MNIST, we use the default train subset of the torchvisionlibrary for training the generator, and the default subset for evaluation.
For Adult, we follow the preprocessing procedure in Harder et al.
(2021) to make the dataset more balanced by downsampling the class with the most number of samples.
Neural networks.
The generator for image datasets has the following network architecture:
• fc → bn → fc → bn → upsamp → relu → upconv →
sigmoid, where fc, bn, upsamp, relu, upconv, sigmoid refers to fully connected, batch normalization, 2D bilinear upsampling, ReLU, up-convolution, and Sigmoid layers respectively.
For tabular dataset, we use the following architecture:
• fc → bn → relu → fc → bn → relu → fc → tanh/softmax,
where tanh and softmax are the Tanh and softmax layers respectively.
Network output corresponding to the continuous attribute is passed through the Tanh layer, whereas network output corresponding to the categorical attribute is passed through the softmax layer, where the category with the highest value from the softmax output is set to be the generated value of the categorical attribute.
We train both networks conditioned on the class labels.
For DP-MERF, we use the same architectures for fair comparisons.
Hyperparameters.
We use Adam optimizer with learning rates of 0.01 for both the minimization and maximization objectives.
Batch size is 100 (1,100) for the image datasets (tabular dataset).
The number of frequencies is set to 1,000 (3,000) for MNIST and tabular datasets (Fashion-MNIST).
The training iterations are 6,000, 3,000, and 8,000 for MNIST, Fashion-MNIST, and tabular datasets respectively.
I A DDITIONAL R ESULTS I. A DDITIONAL TASKS AND DATASET FOR TABULAR DATA
We here present more results relevant to PEARL’s generative modeling of tabular data.
We ﬁrst compare PEARL with DPCGAN in Table 4 using the same classiﬁers as in the main text.
[Table] [Table]
Three additional metrics/tasks are utilized: Range query .
1000 range queries containing three attributes are sampled randomly.
The average l 1 error between the original and synthetic datasets is evaluated.
Marginal release .
All 2-way marginals are calculated and the average l 1 error is evaluated.
MMD .
The max mean discrepancy (MMD) between the original and synthetic dataset is evaluated.
We use the MMD because it is a powerful measure that could in principle detect any discrepancy between two distributions.
A Gaussian kernel is used in the evaluation.
Additionally, we perform evaluation on another tabular dataset: Credit (Pozzolo et al.
Our results comparing with DP-MERF as shown in Table 3 demonstrate that PEARL is competitive with various tasks and datasets.
I. MNIST AND F ASHION -MNIST IMAGES
Fig.
5 and Fig.
6 show more enlarged images of MNIST and Fashion-MNIST at various level of (cid:15) generated with PEARL.
We also show images generated by PEARL but without critic, and DPGAN.
Note that we are unable to generate meaningful images from DP-MERF after taking privacy into account appropriately (see Sec. 5).
I. A DULT HISTOGRAMS
We show more histogram plots for continuous and categorical attributes comparing our method with
DP-MERF in Fig.
9 and Fig.
[Figure] [Figure]
[Figure] [Figure]
[Figure] [Figure]