D IFFERENTIALLY P RIVATE M IXED -T YPE D ATA G ENERATION F OR U NSUPERVISED L EARNING Anonymous authors
Paper under double-blind review
A BSTRACT
In this work we introduce the DP-auto-GAN framework for synthetic data generation, which combines the low dimensional representation of autoencoders with the ﬂexibility of Generative Adversarial Networks (GANs).
This framework can be used to take in raw sensitive data, and privately train a model for generating synthetic data that will satisfy the same statistical properties as the original data.
This learned model can be used to generate arbitrary amounts of publicly available synthetic data, which can then be freely shared due to the post-processing guarantees of differential privacy.
Our framework is applicable to unlabeled mixed-type data , that may include binary, categorical, and real-valued data.
We implement this framework on both unlabeled binary data (MIMIC-III) and unlabeled mixedtype data (ADULT).
We also introduce new metrics for evaluating the quality of synthetic mixed-type data, particularly in unsupervised settings.
I NTRODUCTION
As data storage and analysis are becoming more cost effective, and data become more complex and unstructured, there is a growing need for sharing large datasets for research and learning purposes.
This is in stark contrast to the previous statistical model where a data curator would hold datasets and answer queries from (potentially external) analysts.
Sharing entire datasets allows analysts the freedom to perform their analyses in-house with their own devices and toolkits, without having to pre-specify the analyses they wish to perform.
However, datasets are often proprietary or sensitive, and cannot be shared directly.
This motivates the need for synthetic data generation , where a new dataset is created that shares the same statistical properties as the original data.
These data may not be of a single type: all binary, all categorial, or all real-valued; instead they may be of mixed-types , containing data of multiple types in a single dataset.
These data may also be unlabeled, requiring techniques for unsupervised learning , which is typically a more challenging task than supervised learning on labeled data.
Privacy challenges naturally arise when sharing highly sensitive datasets about individuals.
Ad hoc anonymization techniques have repeatedly led to severe privacy violations when sharing “anonymized” datasets.
Notable examples include the Netﬂix Challenge (Narayanan & Shmatikov, 2008), the AOL Search Logs (Barbaro & Zeller, 2006), and Massachusetts State Health data (Ohm, 2010), where linkage attacks to publicly available auxiliary datasets were used to reidentify individuals in the dataset.
Even deep learning model have been shown to inadvertently memoize sensitive personal information such as Social Security Numbers during training (Carlini et al., 2019).
Differential privacy (DP) (Dwork et al., 2006) (formally deﬁned in Section 2) has become the de facto gold standard of privacy in the computer science literature.
Informally, it bounds the amount the extent to which an algorithm can depend on a single datapoint in its training set.
This guarantee ensures that any differentially privately learned models do not overﬁt to individuals in the database, and therefore cannot reveal sensitive information about individuals.
It is an information theoretic notion that does not rely on any assumptions of an adversary’s computational power or auxiliary knowledge.
Furthermore, it has been shown empirically that training machine learning models with differential privacy protects against membership inference and model inversion attacks (Triastcyn &
Faltings, 2018; Carlini et al., 2019).
Differentially private algorithms have been deployed at large scale in practice by organizations such as Apple, Google, Microsoft, Uber, and the U.S. Census
Bureau.
Much of the prior work on differentially private synthetic data generation has been either theoretical algorithms for highly structured classes of queries (Blum et al., 2008; Hardt & Rothblum, 2010) or based on deep generative models such as Generative Adversarial Networks (GANs) or autoencoders.
These architectures have been primarily designed for either all-binary or all-real-valued datasets, and have focused on the supervised setting, where datapoints are labelled.
In this work we introduce the DP-auto-GAN framework , which combines the low dimensional representation of autoencoders with the ﬂexibility of GANs.
This framework can be used to take in raw sensitive data, and privately train a model for generating synthetic data that should satisfy the same statistical properties as the original data.
This learned model can be used to generate arbitrary amounts of publicly available synthetic data, which can then be freely shared due to the post-processing guarantees of differential privacy.
We implement this framework on both unlabeled binary data (for comparison with previous work) and unlabeled mixed-type data.
We also introduce new metrics for evaluating the quality of synthetic mixed-type data, particularly in unsupervised settings.
1. O UR C ONTRIBUTIONS
In this work, we provide three main contributions: a new algorithmic framework for privately generating synthetic data, new evaluation metrics for measuring the quality of synthetic data in unsupervised settings, and empirical evaluations of our algorithmic framework using our new metrics, as well as standard metrics.
Algorithmic Framework.
We propose a new data generation architecture which combines the versatility of an autoencoder (Kingma & Welling, 2013) with the recent success of GANs on complex data.
Our model extends previous autoencoder-based DP data generation (Abay et al., 2018;
Chen et al., 2018) by removing an assumption that the distribution of the latent space follows a mixture of Gaussian distribution.
Instead, we incorporate GANs into the autoencoder framework so that the generator must learn the true latent distribution against the discriminator.
We describe the composition analysis of differential privacy when the training consists of optimizing both autoencoders and
GANs (with different noise parameters).
Furthermore, in this analysis we halve the noise injected into autoencoder from all existing works while provably maintaining the same mathematical privacy guarantee.
Unsupervised-Learning Evaluation Metric of Synthetic Data.
We deﬁne several new metrics that evaluate the performance of synthetic data compared to the original data when the data is of mixedtype .
Previous metrics in the literature are applicable only to all-binary or all-real-valued datasets.
Our new metrics generalize the previously used metrics (Choi et al., 2017; Xie et al., 2018) from allbinary data to mixed-type by training various learning models to predict each feature from the rest of the data in order to assess correlation between features.
In additional, our metrics do not require a particular feature to be speciﬁed as a label, and therefore do not assume a supervised-learning nature of the data, as in much of the previous work does (Papernot et al., 2017; 2018; Jordon et al., 2018).
Empirical Results.
We empirically comepare the performance of our algorithmic framework on the
MIMIC-III medical dataset (Johnson et al., 2016) and UCI ADULT Census dataset (Dua & Graff, 2017) using previously studied metrics in literature (Frigerio et al., 2019; Xie et al., 2018).
Our experiments show that our algorithms perform better, and allow signiﬁcantly improved (cid:15) values with (cid:15)
≈ 1 , compared to prior work (Xie et al., 2018) with (cid:15)
≈ 200 .
We evaluate our synthetic data using new quantitative and qualitative metrics, conﬁrming that the performance of our algorithm remains high even for small values of (cid:15) , corresponding to strong privacy guarantees.
Our code is made publicly available for future use and research.
1. R ELATED W ORK ON D IFFERENTIALLY P RIVATE D ATA G ENERATION
Early work on differentially private synthetic data generation was focused primarily on theoretical algorithms for solving the query release problem of privately and accurately answering a large class of pre-speciﬁed queries on a given database.
It was discovered that generating synthetic data on which the queries could be evaluated allowed for better privacy composition than simply answering all the queries directly (Blum et al., 2008; Hardt & Rothblum, 2010; Hardt et al., 2012; Gaboardi et al., 2014).
Bayesian inference has also been used for differentially private data generation (Zhang et al., 2017; Ping et al., 2017) by estimating the correlation between features.
See Surendra & Mohan (2017) for a survey of techniques used in private synthetic data generation through 2016.
In 2016, Abadi et al.
(2016) introduced a framework for training deep learning models with differential privacy.
Non-convex optimization, which is required when training deep models, can be made differentially private by adding a Gaussian noise to a clipped (norm-bounded) gradient in each training step.
Abadi et al.
(2016) also introduced the moment accountant privacy analysis for private stochastic gradient descent, which provided much tighter Gaussian-based privacy composition and allowed for signiﬁcant improvements in accuracy over previously used composition techniques, such as advanced composition Dwork et al.
The moment account was later deﬁned in terms of Renyi Differential Privacy (RDP) (Mironov, 2017), which is a slight variant of differential privacy designed for easy composition, particularly for differentially private stochastic gradient descent (DP-SGD).
Much of the work that followed on private data generation used deep (neural-networkbased) generative models to generate synthetic data, and can be broadly categorized into two types: autoencoder-based and GAN-based.
Our algorithmic framework is the ﬁrst to combine both DP
GANs and autoencoders into one framework.
Differentially Private Autoencoder-Based Models.
A variational autoencoder (VaE) (Kingma &
Welling, 2013) is a generative model that compresses high-dimensional data to a smaller space called latent space .
The compression is commonly achieved through deep models and can be differentially privately trained (Chen et al., 2018;
Acs et al., 2018).
VaE makes the (often unrealistic) assumption that the latent distribution is Gaussian.
Acs et al.
(2018) uses Restricted Boltzmann machine (RBM) to learn the latent Gaussian distribution, and Abay et al.
(2018) uses expectation maximization to learn a Gaussian mixture.
Our work extends this line of work by additionally incorporating the generative model GANs which have also been shown to be successful in learning latent distributions.
Differentially Private GANs.
GANs are a generative model proposed by Goodfellow et al.
(2014) that have been shown success in generating several different types of data (Mogren, 2016;
Saito et al., 2017; Salimans et al., 2016; Jang et al., 2016; Kusner & Hern ´ andez-Lobato, 2016; Wang et al., 2018).
As with other deep models, GANs can be trained privately using the aforementioned private stochastic gradient descent (formally introduced in Section 2.1).
Additional related work, including variants of the DP GAN framework, optimization techniques to improve the performance of DP GANs, and Table 4 summarizing these works can be found in Appendix D.
Differentially Private Generation of Mixed-Type Data.
Next we describe the three most relevant recent works on privately generating synthetic data of mixed type.
Abay et al.
(2018) consider the problem of generating mixed-type labeled data with k possible labels.
Their algorithm, DPSYN, partitions the dataset into k sets based on the labels and trains a DP autoencoder on each partition.
Then a DP expectation maximization (DP-EM) algorithm of Park et al.
(2017) is used to learn the distribution in the latent space of encoded data of the given label-class.
The main workhorse, DM-EM algorithm, is designed and analyzed for Gaussian mixture models and more general factor analysis models.
Chen et al.
(2018) works in the same setting, but replaces the DP auto-encoder and DP-EM with a DP variational auto-encoders (DP-VaE).
Their algorithm assumes that the mapping from real data to the Gaussian distribution can be efﬁciently learned by the encoder.
Finally, Frigerio et al.
(2019) used a Wasserstein GAN (WGAN) to generate differentially private mixed-type synthetic data.
This type of GAN uses a Wasserstein-distance-based loss function in training.
Their algorithmic framework privatized the WGAN using DP-SGD, similar to the previous approaches for image datasets (Zhang et al., 2018; Xie et al., 2018).
The methodology of Frigerio et al.
(2019) for generating mixed-type synthetic data involved two main ingredients: changing discrete (categorical) data to binary data using one-hot encoding, and adding an output softmax layer to the WGAN generator for every discrete variable.
Our framework is distinct from these three approaches.
We use a differentially private auto-encoder which, unlike DP-VaE of Chen et al.
(2018), does not require mapping data to a Gaussian distribution.
This allows us to reduce the dimension of the problem handled by the WGAN, hence escaping the issues of high-dimensionality from the one-hot encoding of Frigerio et al.
We also use
DP-GAN, replacing DP-EM in Abay et al.
(2018), for learning distributions in the latent encoded space.
Evaluation Metrics for Synthetic Data.
Various evaluation metrics have been considered in the literature to quantify the quality of the synthetic data (see Charest (2011) for a survey).
The metrics can be broadly categorized into two groups: supervised and unsupervised .
Supervised evaluation metrics are used when there are clear distinctions between features and labels of the dataset, e.g., for healthcare applications, a person’s disease status is a natural label.
In these settings, a predictive model is typically trained on the synthetic data, and its accuracy is measured with respect to the real (test) dataset.
Unsupervised evaluation metrics are used when no feature of the data can be decisively termed as a label.
Recently proposed metrics include dimension-wise probability for binary data (Choi et al., 2017), which compares the marginal distribution of real and synthetic data on each individual feature, and dimension-wise prediction which measures how closely synthetic data captures relationships between features in the real data.
This metric was proposed for binary data, and we extend it here to mixed-type data.
Recently, NIST (2019) used a 3-way marginal evaluation metric which used three random features of the real and synthetic datasets to compute the total variation distance as a statistical score.
See Appendix D for more details on both categories of metrics, including Table 1 which summarizes the metrics’ applicability to various data types.
P RELIMINARIES ON D IFFERENTIAL P RIVACY
In the setting of differential privacy, a dataset X consists of m individuals’ sensitive information, and two datasets are neighbors if one can be obtained from the other by the addition or deletion of one datapoint.
Differential privacy requires that an algorithm produce similar outputs on neighboring datasets, thus ensuring that the output does not overﬁt to its input dataset, and that the algorithm learns from the population but not from the individuals.
Deﬁnition 1 (Differential privacy (Dwork et al., 2006)) .
For (cid:15), δ > 0 , an algorithm M is ( (cid:15), δ ) - differentially private if for any pair of neighboring databases X, X (cid:48) and any subset S ⊆
Range ( M ) ,
[Equation]
A smaller value of (cid:15) implies stronger privacy guarantees (as the constraint above binds more tightly), but usually corresponds with decreased accuracy, relative to non-private algorithms or the same algorithm run with a larger value of (cid:15) .
Differential privacy is typically achieved by adding random noise that scales with the sensitivity of the computation being performed, which is the maximum change in the output value that can be caused by changing a single entry.
Differential privacy has strong composition guarantees , meaning that the privacy parameters degrade gracefully as additional algorithms are run on the same dataset.
It also has a post-processing guarantee, meaning that any function of a differentially private output will maintain the same privacy guarantees.
2. D IFFERENTIALLY P RIVATE S TOCHASTIC G RADIENT D ESCENT (DP-SGD)
The DP-SGD framework (given formally in Algorithm 5 in Appendix D.1) is generically applicable for private non-convex optimization.
In our proposed model, we use this framework to train the autoencoder and GAN.
Training deep learning models reduces to minimizing some (empirical) loss function f
( X ; θ ) :
=m (cid:80) mi =1 f ( x i ; θ ) on a dataset X = { x i ∈ R n } mi =1 .
Typically f is a nonconvex function, and a common method to minimize f is by iteratively performing stochastic gradient descent (SGD).
To make SGD private, Abadi et al.
(2016) proposed to is to ﬁrst clip the gradient of each sample to ensure bounded (cid:96) 2 -norm, and then add multivariate Gaussian noise to the gradient.
The clipping reduces the scale of noise that must be added to preserve differential privacy.
The noisy-clippedgradient is then used in the update step instead of the true gradient.
Further details of this procedure are deferred to Appendix D.1.
A variant notion of differential privacy, known as Renyi Differential Privacy (RDP) (Mironov, 2017), that is often used to analyze privacy for DP-SGD.
A randomized mechanism M is ( α, (cid:15) )
-RDP if for all neighboring databases X, X (cid:48) that differ in at most one entry,
[Equation]
where D α ( P || Q ) :
= 1 α − 1 log E x ∼ X (cid:16) P ( x ) Q ( x ) (cid:17) α is the Renyi divergence or Renyi entropy of order α between two distributions P and Q .
Renyi divergence is better tailored to tightly capture the privacy loss from the Gaussian mechanism that is used in DG-SGD, and is a common analysis tool for DP-SGD literature.
To compute the ﬁnal ( (cid:15), δ ) -differential privacy parameters from iterative runs of DP-SGD, one must ﬁrst compute the subsampled Renyi Divergence, then compose privacy under RDP, and then convert the RDP guarantee into DP.
Further details of this process are given in
Appendix D.2.
A LGORITHMIC F RAMEWORK
The overview of our algorithmic framework DP-auto-GAN is shown in Figure 1, and the full details are given in Algorithm 1.
The algorithm takes in m raw data points, and pre-processes these points into m vectors x 1 , . . .
, x m ∈ R n to be read by DP-auto-GAN, where usually n is very large.
For example, categorical data may be pre-processed using one-hot encoding, or text may be converted into numerical values.
Similarly, the output of DP-auto-GAN can be post-processed from R n back to the data’s original form.
We assume that this pre- and post-processing can done based on public knowledge, such as possible categories for qualitative features and reasonable bounds on quantitative features, and therefore does not require privacy.
Within the DP-auto-GAN, there are two main components: the autoencoder and the GAN.
The autoencoder serves to reduce the dimensionality of the data before it is fed into the GAN.
The GAN consists of a generator that takes in noise z sampled from distribution Z and produces G w ( z ) ∈ R d , and a discriminator D y ( · ) : R n → { 0 , 1 } .
Because of the autoencoder, the generator only needs to synthesize data based on the latent distribution R d , which is a much easier task than synthesizing in the original high-dimensional space R n .
Both components of our architecture, as well as our algorithm’s overall privacy guarantee, are described in the remainder of this section.
3. A UTOENCODER T RAINING
The autoencoder consists of the encoder En φ ( · ) : R n → R d and decoder De θ ( · ) :
R d → R n parametrized by edge weights φ, θ , respectively.
The architecture of the autoencoder assumes that high-dimensional data x i ∈ R n can be represented compactly in low-dimensional space R d , also called latent space .
The encoder En φ is trained to ﬁnd such low-dimensional representations.
We also need the decoder, De θ , to map this point En φ ( x i ) in the latent space back to x i .
A measure of the information preserved in this process is the error between the decoder’s image and the original x i .
Thus a good autoencoder should minimize the distance dist ( De θ ( En φ ( x i )) , x i ) for each datapoint x
i and the appropriate distance function dist.
Our autoencoder uses binary cross entropy loss: dist ( x, y )
= − (cid:80) nj =1 y ( j ) log( x ( j ) ) − (cid:80) nj =1 (1 − y
( j ) )
log(1 − x ( j ) )
(where x ( j ) is the j th coordinate of x ∈ R n ).
This also motivates the deﬁnition of a (true) loss function E x ∼ Z X [ dist ( De θ ( En φ ( x i )) , x i )] when data are drawn independently from an underlying distribution Z X .
The corresponding empirical loss function when we have an access to sample { x i } mi =1 is
[Equation]
The task of ﬁnding a good autoencoder reduces to optimizing φ and θ to yield small empirical loss as in Equation 1.
We minimize Equation 1 privately using DP-SGD (described in Section 2.1).
Our approach differs from previous work on private training of autoencoders (Chen et al., 2018;
Acs et al., 2018; Abay et al., 2018) by not adding noise to the decoder during DP-SGD, whereas previous work adds noise to both the encoder and decoder.
This improves performance by reducing the noise injected into the model by half, while still maintaining the same privacy guarantee (see Proposition 3).
The full description of our autoencoder training is given in Algorithm 2 in the appendix.
In our DP-autoGAN framework, the autoencoder is trained ﬁrst until completion, and is then ﬁxed for the second phase of training GAN.
3. GAN T RAINING
A GAN consists of the generator G w and discriminator D y : R n → { 0 , 1 } , parameterized respectively by edge weights w and y .
The aim of the generator G w is to synthesize (fake) data similar to the real dataset, while the aim of discriminator is to determine whether an input x i is from the generator’s synthesized data (and assigning label D y ( x i )
= 0 )
or is real data (and assigning label
D y ( x i ) = 1 ).
The generator is seeded with a random noise z ∼ Z that contains no information about real dataset, such as a multivariate Gaussian vector, and aims to generate a distribution G w ( z ) that is hard for D y is distinguish from the real data.
Hence, the generator wants to minimize the probability that D y makes a correct guess, E z ∼ Z
[1 − D y ( G w ( z ))] .
At the same time, the discriminator wants to maximize its probability of correct guess when the data is fake E z ∼ Z [1 − D y ( G w ( z ))] and when the data is real E x ∼ Z X
[ D y ( x )] .
We generalize the output of D y to a continuous range [0 , 1] , with the value indicating the conﬁdence that a sample is real.
We use the zero-sum objective for the discriminator and generator proposed by
Arjovsky et al.
and motivated by the Wasserstein distance of two distributions.
Although their proposed Wasserstein objective cannot be computed exactly, it can be approximated by optimizing the objective:
[Equation]
We optimize Equation 2 privately using the DP-SGD framework described in Section 2.1.
We differ from prior work on DP GANs in that our generator G w ( · ) outputs data G w ( z ) in latent space R d which needs to be decoded to De ( G w ( z )) before being fed into the discriminator D y ( z ) .
The gradient ∇ w G w is obtained by backpropagation through one more component En ( · ) .
Hence, the training of generator remains totally private because the additional component En ( · ) is ﬁxed and never accesses the private data.
The full description of our GAN training is given in Algorithm 4 in the appendix.
At the end of the two-phase training (including autoencoder and GAN), the noise distribution Z , trained generator G w ( · ) , and trained decoder De ( · ) are released to the public.
The public can then generate synthetic data by sampling z ∼ Z to obtain a synthesized datapoint
En ( G y ( z )) repeatedly to obtain synthetic dataset of any desired size.
3. P RIVACY A CCOUNTING
Our autoencoder and GAN are trained privately by adding noise to the encoder and discriminator.
Since the generator only accesses data through the discriminator’s (privatized) output, then the trained parameters of generator are also private by post-processing guarantees of differential privacy.
Finally, we release the privatized decoder and generator, together with generator’s noise distribution
Z and post-processing procedure, both of which are assumed to be public knowledge.
The privacy accounting is therefore required for the two parts that access real data X : training the autoencoder and the discriminator.
In each training procedure, we apply the RDP accountant (described in Section 2.1 and Appendix D.2) to analyze privacy of the DP-SGD training algorithm, to compute ﬁnal ( (cid:15), δ ) -DP bound.
Our application of the RDP accountant diverges from the previous literature in two main ways.
First, we do not add noise to decoder during the autoencoder training, which is contrary to prior work that adds noise to both the encoder and decoder.
Our approach of not adding noise to the decoder does not affect the algorithms’ overall privacy guarantees.
This claim is stated formally in the following corollary, which follows immediately from Propositions 3 and 4.
Corollary 2.
Suppose autoencoder in DP-auto-GAN is trained with RDP privacy RDP auto ( · ) and the discriminator in DP-auto-GAN is trained with RDP privacy RDP D ( · ) , then DP-auto-GAN is
RDP with values RDP auto ( · )+ RDP D ( · ) .
Second, the privacy analysis must account for two phases of training, usually with different privacy parameters (due to different batch sampling rates, noise, and number of iterations).
One obvious solution is to calculate the desired ( (cid:15), δ )-DP parameter obtained from each phase and compose them to obtain ( (cid:15) 1 + (cid:15) 2 , δ 1 + δ 2 ) -DP
using basic composition of differential privacy (Dwork et al., 2006).
However, we can obtain a tighter privacy bound by composing the privacy at the Renyi Divergence level before translating Renyi Divergence into ( (cid:15), δ ) -DP.
In other words, we ﬁrst apply Proposition 4 to compute RDP ( · ) of two-phase training before applying Proposition 5 to translate RDP into DP.
This is the approach highlighted in Corollary 2.
In practice, this reduces the privacy parameter (cid:15) by about 30%.
E VALUATION M ETRICS
In this section, we discuss the evaluation metrics that we use in the experiments (described in Section 5) to empirically measure the quality of the synthetic data.
Some of these metrics have been used in the literature, while many are novel contributions in this work.
The evaluation metrics are summarized in Table 1; our contributions are in bold.
For the ﬁrst two metrics described below, the dataset should be partitioned into a training set R ∈ R m 1 × n and testing set T ∈ R m 2 × n , where m =
m
+ m 2 is the total number of samples the real data, and n is the number of features in the data.
After training the DP-auto-GAN, we use it to create a synthetic dataset S ∈ R m 3 × n , for sufﬁciently large m 3 .
Dimension-wise probability.
This metric is used when the entire dataset is binary, and it serves as a basic sanity check to verify whether DP-auto-GAN has correctly learned the marginal distribution of each feature.
Speciﬁcally, it compares the proportion of 1 ’s (which can be thought of as estimators of Bernoulli success probability) in each feature of the training set R and synthetic dataset S .
Dimension-wise prediction.
This metric evaluates whether DP-auto-GAN has correctly learned the relationships between features.
For the k -th feature of training set R and synthetic dataset S , we choose y R k ∈
R m 1 and y S k ∈ R m 3 as labels of a classiﬁcation or regression task based on the type of that feature, and the remaining features R − k and S − k are used for prediction.
We train either a classiﬁcation or regression model and measure their goodness of ﬁt based on the model’s accuracy using AUROC, F 1 or R 2 scores, which are formally deﬁned in Appendix C.
We also propose following novel evaluation metrics.
For more details, we refer the reader to Appendix D.5.
-way feature marginal.
This metric works as a sanity check for real features.
We compute histograms for the feature interest of both real and synthetic data.
The quality of the synthetic data with respect to this metric can be evaluated qualitatively through visual comparison of the histograms on real and synthetic data.
This can be extended to k -way feature marginals and made into a quantitative measure by adding a distance measure between the histograms. TYPES EVALUATION METHODS [Table] [Table]
[Table]
et al.
[Table] al., [Table] [Table]
prediction plot
[Table]
et al.
[Table]
ours
[Table]
(Choi et al.,
[Table]
[Table] total varia [Table] [Table]
qualitative [Table] ization
[Table]
2-way PCA marginal. This metric generalizes the 3-way marginal score used in NIST (2019). In particular, we compute principle components of the original data and evaluate a projection operator for ﬁrst two principle components.
Let us denote P ∈ R n × 2 as the projection matrix such that
R = RP is the projection on ﬁrst two principle components of R .
Then we evaluate projection of synthetic data S = SP and scatterplot 2-D points in R and S for visual evaluation.
For quantitative evaluation, we also compute Wasserstein distance between R and S .
In the simulations described in Section 5, we used Wasserstein distance since we optimize for the WGAN objective, but any distributional divergence metric can be used.
This approach can also be extended to k -way marginals by making the projection matrix P ∈ R n × 2 for the ﬁrst k principle components.
Distributional distance.
In this metric, we ﬁrst compute the Wasserstein distance W 2 ( R, S ) between the entire real and synthetic datasets R, S .
The Wasserstein score is then deﬁned as
[Equation]
where the Wasserstein distance is normalized by the maximum distance possible of two datapoints in data universe X .
To compute the Wasserstein score on k -way marginal PCA projection P , we normalize the score with additional term √ v , where v is the explained variance of P :
[Equation]
E XPERIMENTS
In this section we present details of our datasets and show empirical results of our experiments.
Throughout our experiments, we ﬁx δ = 10 − 5 for training DP-auto-GAN and show results for different values of (cid:15) including (cid:15)
= ∞ (i.e., non-private GAN) which serves as a benchmark.
We also compare our results with existing works in the literature where relevant.
Details of hyper-parameters and architecture can be found in the appendix.
The code of our implementation is available at https://github.com/DPautoGAN/DPautoGAN .
5. B INARY D ATA
First, we consider the MIMIC-III dataset Johnson et al.
(2016) which is a publicly available dataset consisting of medical records of 46K intensive care unit (ICU) patients over 11 years old.
This is a binary dataset with 1071 features.
We use this dataset because it has been used in similar nonprivate Choi et al.
(2017) and private Xie et al.
GAN frameworks.
We use the same evaluation metrics used in these papers.
First we plot dimension-wise probability for DP-auto-GAN run on this dataset.
[Figure]
As shown in Figure 2, the proportion of 1’s in the marginal distribution for is similar on the real and synthetic datasets for (cid:15)
= ∞ and (cid:15)
= 3 . 11865 , because nearly all points fall close to the line y
= x .
The performance of DP-auto-GAN is affected marginally for (cid:15) = 1 . 27655 which can be noticed by increased variance of points along line y
= x .
The performance drop with (cid:15) = 0 .is expected since smaller values of (cid:15) correspond to stronger privacy guarantees.
Figure 3 shows the plots of dimension-wise prediction using DP-auto-GAN for different values of (cid:15) .
Many points are concentrated along the lower side of line y = x , which indicates that the AUROC score of the real dataset is close to that of the synthetic dataset.
Fewer points are seen on the plots with smaller (cid:15) values because many features in the synthetic data have a high proportion of 0 ’s, so the logistic regression classiﬁer trained on these features uniformly outputs 0 .
In such cases, the AUROC score is 1 / 2 by default and does not have any meaning, so we drop those features from the plot.
We note that our results are signiﬁcantly stronger than the ones obtained in Xie et al.
(2018) with (cid:15) ∈ [96 . 5 , 231] because we obtain dramatically better performance with (cid:15) values that are two orders of magnitude smaller.
For visual performance comparison, see Figures 4 and 5 of Xie et al.
[Figure]
5. M IXED D ATA
Second, we consider the ADULT dataset Dua & Graff (2017) which is an extract of the U.S. Census and contains information about working adults.
This dataset has 14 features out of which 10 features are categorical and four are real-valued.
Figure 4 shows the dimension-wise prediction plot of DPauto-GAN on this dataset.
For categorical features (represented by blue points and a single green point), we use random forest classiﬁer in order to compare our result with Frigerio et al.
For real-valued features (represented by red points), we used a lasso regression model.
The green point [Figure] [Table] corresponds to the salary feature of the data, which is real-valued but treated as binary, based on the condition > $50 k , which is similarly used as a binary label in Frigerio et al.
We use Fscore as our classiﬁcation accuracy measure for categorical features in in Figure 4, and we use Rscore as our regression accuracy for real-valued features.
The F 1 score is preferred over AUROC score for the ADULT dataset because it has many non-binary features where AUROC cannot be used.
Each point in Figure 4 corresponds to one feature, and the x and y coordinates respectively show the accuracy score on the real data and the synthetic data.
Similar to the MIMIC-III dataset, we see that for large values of (cid:15) , points are scattered close to y = x line, and as (cid:15) gets smaller, points gradually shift downward implying, that accuracy of synthetic data deceases with stronger privacy guarantees.
For the salary feature, we also compute accuracy scores for comparison with Frigerio et al.
In Table 2, we report the accuracy of each synthetic dataset as well as benchmark accuracy.
We see that our accuracy guarantees are higher than those of Frigerio et al.
(2019) with smaller (cid:15) values.
Note that in the ADULT dataset, we have four real-valued features but we only plot one red point in
Figure 4, corresponding to the age feature .
The other real-valued features (capital gain, capital loss, and hours worked per week) were not included because even on the real data, we were not able to ﬁnd a regression model with good ﬁt (as measured by R 2 score) for these features in terms of the other features.
To check whether we learned the distribution correctly for these features, we plot 1-way feature marginal histogram on each of them.
See Figure 7 in Appendix C.
It can be seen that
DP-auto-GAN identiﬁes the distribution in those features.
In order to understand combined performance of all features, we use two metrics.
First, we show the qualitative results from 2-way PCA marginal score in Figure 5 A close qualitative inspection [Figure] of plots clearly shows the similarities of trends between the plots for real dataset and for different values of (cid:15) , as low as (cid:15)
= 1 .
Finally we also evaluate Wasserstein distributional distance between synthetic and real data, shown in Table 3.
[Table]
A A LGORITHM D ESCRIPTION AND P SEUDOCODE OF DP-A UTO -GAN
We provided the pseudocode of our proposed DP-auto-GAN in Algorithm 1.
The Algorithm is speciﬁed by the architecture and training parameters of encoder, decoder, generator and discriminator.
After pre-processing, DPT RAIN AUTO trains autoencoder fully speciﬁed in Algorithm 2.
As noted earlier, the decoder is trained privately by clipping gradient norm and injecting Gaussian noise in order to obtain the gradient of decoder g θ , while the gradient of encoder g φ can be used directly as encoder can be trained non-privately.
The second phase is to train GAN.
As suggested by Goodfellow et al.
(2014), discriminator trained for several iterations per one iteration of generator training.
When discriminator is trained, generator is ﬁxed, and vice-versa.
Discriminator and generator training is described in Algorithms 3 and 4.
As the discriminator receives real data sample in their training, the training is made private by clipping the norm and adding Gaussian noise to the gradient g .
The training of generator does not use any private data X and hence can be train without any need to clip gradient norm or to inject noise to the gradient.
Finally, the privacy analysis is via RDP accountant for each training, and composing at the RDP level (as a function of α ) as described in Corollary 2.
After the sum of RDP (as a function of α ) is obtained, for any given ﬁxed δ , we optimize α to get the best (cid:15) by Proposition 5.
Because the value of (cid:15) ( α ) obtained from Proposition 5 as a function of α is convex over α (Van Erven & Harremos (2014) and noted by Wang et al.
, we implement ternary search to efﬁciently optimize for α .
Proposition 3.
DP-auto-GAN trained with differentially private algorithms M 1 on the decoder and
M 2 on the discriminator (and possibly a non-private algorithm on the encoder) achieves differential privacy guarantee equivalent to that of the composition of M 1 , M 2 .
Proof.
DP-auto-GAN needs to release only generator and decoder as an output.
Releasing the decoder incurs cost of privacy equal to that of M 1 .
The generator accesses the data only through a discriminator, which is differentially private by mechanism M 2 , so releasing the generator has the same privacy loss as M 2 from post-processing.
Therefore, releasing both decoder and generator incurs privacy loss of composition of M 1 and M 2 .
Proposition 3 is stated more formally using the RDP notion of privacy (where the privacy parameters are a function of α ) in Corollary 2 in the main body.
That corollary follows immediately from
Propositions 3 and 4.
1: architecture input: Private dataset D m where X is the set raw) data universe preprocessed data dimension n , latent space dimension d preprocessing function Pre : X → R n , post-processing function Post : R n → X encoder architecture En φ : R n → R d parameterized by
, decoder architecture De θ : R d → R n parameterized by θ generator’s noise distribution Z sample space Ω Z generator architecture G w : Ω
Z ) R d parameterized w discriminator architecture D y : R n 2: autoencoder training parameters : Learning rate η 1 , number of iteration rounds (or optimization steps) T 1 , loss function L auto optimization method optim auto batch sampling rate the batch expectation size b 1 =
1 m ) clipping
C noise multiplier microbatch r3: generator training parameters : Learning rate , batch size loss function L G optimization method optim G number of generator iteration 4: discriminator training parameters : Learning rate number discriminator iterations per generator step t D , loss function L D , optimization method optim D , batch sampling rate 3 (for the batch expectation size b q 3 m ) clipping
C 3 , noise multiplier ψ 3 , microbatch size r5: privacy parameter δ >6: procedure DP AUTO GAN 7:
X ← Pre ( D ) 8:
Initialize φ, θ, w, y for En φ , De θ , G w , D y (cid:46) Phase 1: autoencoder training 9: for t = 1 . . .
T 1 do 10:
DPT RAIN AUTO ( X , En , De , autoencoder training parameters) (cid:46) Phase : GAN training 11: for t =
T 2 do 12: for j
D do (cid:46) (privately) train D y for t D iterations 13:
DPT RAIN D ISCRIMINATOR ( X , Z , G, De , D , discriminator training parameters) 14:
T RAIN G ENERATOR ( Z, G, De, D , generator training parameters) (cid:46)
Privacy accounting 15:
RDP auto ( · ) ← RDP-A CCOUNT ( T 1 , q 1 , ψ 1 , r 1 ) 16:
RDP D ( · ) ← RDP-A CCOUNT ( T 2 · t D , q 3 , ψ 3 , r 3 ) 17: (cid:15) ← G ET -E PS (RDP auto ( · ) + RDP D ( · ) ) 18: return model ( G w , De θ ) , privacy ( (cid:15), δ )
1: training parameter input : Learning rate η 1 , number of iteration rounds (or optimization steps)
T 1 , loss function L auto , optimization method optim auto batch sampling rate q 1 (for the batch expectation size b 1 = q 1 m ), clipping norm C 1 , noise multiplier ψ 1 , microbatch size r2: goal : train one step of autoencoder ( En φ , De θ ) 3: procedure DPT RAIN AUTO 4:
B ← S AMPLE B ATCH ( X, q 1 ) 5:
Partition B into B 1 , . . .
, B k each of size r (ignoring the dividend) 6: ˆ k ← q 1 mr (cid:46) an estimate of k 7: for j = 1 . . .
k do (cid:46)
Both g jφ , g jθ can be computed in one backpropagation 8: g jφ , g jθ ← ∇ φ ( L auto ( De θ ( En φ ( B j )) , B j )) , ∇ θ ( L auto ( De θ
( En φ ( B j )) , B j ) 9: g
φ ← 1ˆ k (cid:80) kj =1 g jφ 10: g θ ← 1ˆ k
(cid:16)(cid:16)(cid:80) [Equation] 11: ( φ, θ ) ← optim auto ( φ, θ, g φ , g θ , η 1 )
1: training parameter input : Learning rate η 3 , number of discriminator iterations per generator step t D , loss function L D , optimization method optim D , batch sampling rate q 3 (for the batch expectation size b 3 = q 3 m ), clipping norm C 3 , noise multiplier ψ 3 , microbatch size r2: goal : train one step of discriminator D y 3: procedure DPT RAIN DISCRIMINATOR 4:
B ← S AMPLE B ATCH ( X, q 3 ) 5:
Partition B into B 1 , . . .
, B k each of size r (ignoring the dividend) 6: ˆ k ← q 1 mr (cid:46) an estimate of k 7: for j = 1 . . .
k do 8: { z i } ri =1 ∼ Z r 9:
B (cid:48)
← { De ( G w ( z i )) } r i = 10: g j ← ∇ y ( L D ( B j , B (cid:48) , D y ))
(cid:46)
In the case of WGAN,
L D ( B j , B (cid:48) , D y ) :
= 1 r (cid:88) b ∈ B j
D y ( b ) − 1 r (cid:88) b (cid:48)
∈ B (cid:48)
D y ( b (cid:48) ) 11: g ← 1ˆ k (cid:16)(cid:16)(cid:80) kj =1 C LIP ( g j , C 3 ) (cid:17) + N (0 , C 23 ψ 23 I ) (cid:17) 12: y ← optim D ( y, g, η 3 ) one step of generator G w 3: procedure T RAIN GENERATOR 4:
[Equation]
B [Equation]
De
[Equation] 6: g ← ∇ w [Equation]
(cid:46)
In the case of WGAN,
[Equation] 7: w ← optim G
[Equation]
w [Equation] g [Equation]
η 2 ) B M ORE D ETAILS ON M ETRIC E VALUATION We recall the notations from the main body. We explain the scoring used more speciﬁcally.
Dimension-wise prediction.
We describe the model’s accuracy using the following well known metrics:
1.Area under the ROC curve (AUROC) score and F 1 score for classiﬁcation: The F 1 score of a classiﬁer is deﬁned as F 1 :=
2 × precision × recall precision + recall , where precision is ratio of true positives to true and false positives, and recall is ratio of true positives to total positives.
AUROC score is graphical measure capturing area under ROC (receiver operating characteristic) curve.
Both metrics take values in interval [0 , 1] with larger values implying good ﬁt.
R 2 score for regression: R 2 score is deﬁned as 1 − (cid:80) ( y i − (cid:98) y i ) 2 (cid:80) ( y i − y ) 2 , where y i is the true label, (cid:98)
y i is the predicted label and y is the mean of the true labels.
This is a popular metric used to measure goodness of ﬁt as well as future prediction accuracy for regression
C E XPERIMENTAL D ETAILS C. M ODEL AND T RAINING S PECIFICATION OF E XPERIMENT ON MIMIC-III DATA
The autoencoder was trained with Adam with Beta 1 = 0.9, Beta 2 = 0.999.
The learning rate was set to 0.001.
It was trained on minibatches of size 100 and microbatches of size 1.
L2 clipping norm was set to 0.8157 and L2 penalty 0.001.
The noise multiplier was changed to achieve different privacy guarantees.
The layers of the autoencoder used for training were:
(encoder):
Sequential( (0): Linear(in-feature=60, out-feature=15, bias=
True) (1): LeakyReLU(negative-slope=0.2) )
(decoder): Sequential( (0): Linear(in-feature=15, out-feature=60, bias =True) (1): Sigmoid() )
The GAN was trained with optimizer RMSProp, whose Alpha value equalled 0.99.
The learning rate was 0.001, training ran on minibatches of size 1,000 and microbatches of size 1.
L2 clipping norm was set to 0.35, and the L2 penalty to 0.001.
The L2 clipping norm was selected to be the median L2 norm observed in a non-private training loop.
The noise multiplier was tuned to achieve desired privacy guarantees.
The GAN architecture is as follows:
Generator( (block-0):Sequential( (0):Linear(in-feature=64, out-feature=128, bias=False) (1): ReLU(negative-slope=0.2) )
(block-1): Sequential( (0): Linear(in-feature=128, out-feature=64, bias=False) (1): ReLU(negative-slope=0.2) ) )
Discriminator( (model):Sequential( (0):Linear(in-feature=70, out-feature=256, bias=
True) (1): ReLU(negative-slope=0.2) [Figure]
C. A DDITIONAL MIMIC-III E MPIRICAL R ESULTS
Figure 3 showed dimension-wise prediction plot for different values of (cid:15) .
As one can see, for (cid:15)
= ∞ , many points are concentrated along the lower side of line y = x which is the ideal performance.
This shows that AUROC score of the real dataset is marginally higher than that of synthetic dataset.
For (cid:15) = 3 .
11865 and (cid:15) = 1 .
27655 , there is a gradual shift downwards compared to line y =
x with larger variance in the plotted points.
This means that AUROC scores of real and synthetic data shows more difference for smaller values of (cid:15) .
For (cid:15) = 0 . 94145 , which shows the same trend, one can also see that number of datapoints plotted have reduced signiﬁcantly.
This is since many features in synthetic data have very high proportion of 0 , so logistic regression classiﬁer trained on these features uniformly outputs 0 on the hold-out test dataset T .
In such cases, AUROC score outputs 1 / 2 by default and as such, does not have any meaning.
Hence we drop those features from the plot.
Below we show the full plots of dimension-wise prediction for MIMIC-III dataset.
[Figure]
Below we provide 1-way histogram for ADULT dataset.
As one can see, DP-auto-GAN identiﬁes the marginal distribution of capital gain and capital loss quite well and it does reasonably well on hours-per-week feature.
C. M ODEL AND T RAINING S PECIFICATION OF E XPERIMENT ON ADULT DATA
The autoencoder was trained via Adam with Beta 1 = 0.9, Beta 2 = 0.999, and a learning rate of 0.005 for 20,000 minibatches of size 64 and a microbatch size of 1.
The L2 clipping norm was selected to be the median L2 norm observed in a non-private training loop, equal to 0.012.
The noise multiplier was then calibrated to achieve the desired privacy guarantee.
The GAN was composed of two neural networks, the generator and the discriminator.
The generator used a ResNet architecture, adding the output of each block to the output of the following block.
It was trained via RMSProp with alpha = 0.99 with a learning rate of 0.005.
The discriminator was a simple feed-forward neural network with LeakyReLU hidden activation functions, also trained via
RMSProp with alpha = 0.99.
The L2 clipping norm of the discriminator was set to 0.022.
The pair was trained on 15,000 minibatches of size 128 and a microbatch size of 1, with 15 updates to the discriminator per 1 update to the generator.
Again, the noise multiplier was then calibrated to achieve the desired privacy guarantee.
A serialization of the model architectures used in the experiment can be found below.
Autoencoder(
(encoder): Sequential( 0: Linear(in-features=106, out-feature=60, bias= True) (1): LeakyReLU(negative-slope=0.2) (2): Linear(in-feature=60, out-feature=15, bias=
True) (3): LeakyReLU(negative-slope=0.2) )
(decoder): Sequential(
[Figure]
LeakyReLU
BatchNorm1d
(2): LeakyReLU Sequential (0): Linear feature feature bias=False) (1): BatchNorm1d (2): LeakyReLU negative
Discriminator( ( Sequential
Linear feature bias LeakyReLU(negative-slope=0.2) (2): Linear(in-feature=70, out-feature=35, bias=
True)
(3): LeakyReLU(negative-slope=0.2) (4): Linear(in-feature=35, out-feature=1, bias=
True) ) )
D A DDITIONAL B ACKGROUND AND R ELATED W ORK D. D ETAILS OF DP-SGD
The DP-SGD framework (given formally in Algorithm 5) is generically applicable to private nonconvex optimization.
Algorithm
SGD (
iteration
4: procedure S AMPLE B ATCH
X
B ←
} 6: for
n do 7:
Add to q return B 8:
Partition B into B
B k size r ignoring the dividend) 9: ˆ k ← qmr (cid:46) an estimate of k 10: g ← 1 k (cid:16)(cid:80)
[Equation]
X
[Equation]
) (cid:17) 11: θ ← O PTIM ( θ, g, η )
Performance improvements.
In general, the descent step can be performed using other optimization methods—such as Adam or RMSProp—in a private manner, by replacing the gradient value with g in each step.
Also, one does not need to clip the individual gradients, but can instead clip the gradient of a group of datapoints, called a microbatch (McMahan & Andrew, 2018).
Mathematically, the batch B is partitioned into microbatches B 1 , . . .
, B k each of size r , and the gradient clipping is performed on the average of each microbatch:
[Equation]
Standard DP-SGD corresponds to setting r = 1 , but setting higher values of r (while holding | B | ﬁxed) signiﬁcantly decreases the runtime and reduces the accuracy, and does not impact privacy signiﬁcantly for large dataset.
Other clipping strategies have also been suggested.
We refer readers to McMahan & Andrew (2018) for more details of clipping and other optimization strategies.
The improved privacy analysis by Abadi et al.
(2016) (which has been implemented in Google (2018) and is widely used in practice) obtains a tighter privacy bound when data are subsampled, as in SGD.
This analysis requires independently sampling each datapoint with a ﬁxed probability q in each step.
D. C ONVERTING R ENYI DP TO DP
To compute the ﬁnal ( (cid:15), δ ) -differential privacy parameters from iterative runs of DP-SGD, there are three key steps.
Step 1: Subsampled Renyi Divergence.
Given sampling rate q and noise multiplier ψ , one can obtain RDP ( · ) values as a function of α ≥ 1 for one run of DP-SGD (Mironov, 2017).
We denote this function by RDP T =1 ( · ) , which will depend on q and ψ .
Step 2: Composition of RDP.
When DP-SGD is run iteratively, we can compose the Renyi privacy parameter across all runs using the following proposition.
Proposition 4 ((Mironov, 2017)) .
If M 1 , M 2 respectively satisfy ( α, (cid:15) 1 ) , ( α, (cid:15) 2 ) -RDP for α ≥ 1 , then the composition of two mechanisms M 2 ( M 1 ( X ))
satisﬁes
( α, (cid:15) 1 + (cid:15) 2 ) -RDP.
Hence, we can compute RDP ( · ) values for T iterations of DP-SGD as RDP-A CCOUNT ( T, q , ψ ) :=
T · RDP T =1 ( · ) .
Step 3: Conversion to ( (cid:15), δ ) -DP.
After obtaining the ﬁnal RDP ( · ) function, any ( α, (cid:15) )
-RDP guarantee can be converted into ( (cid:15), δ ) -DP.
Proposition 5 ((Mironov, 2017)) .
If M satisﬁes ( α, (cid:15) ) -RDP for α > 1 , then for all δ > 0 , M satisﬁes ( (cid:15) + log1 /δ
α − 1 , δ ) -DP.
Since the (cid:15) privacy parameter of RDP is also a function of α , this last step involves optimizing for the α that achieves smallest privacy parameter in Proposition 5.
D. D IFFERENTIALLY P RIVATE GAN A RCHITECTURES
Training deep learning models reduces to minimizing some (empirical) loss function f
( X ; θ ) :
=m (cid:80) mi =1 f ( x i ; θ ) on a dataset X = { x i ∈ R n } mi =1 .
Typically f is a nonconvex function, and a common method to minimize f is by iteratively performing stochastic gradient descent (SGD):
[Equation]
The size of B is typically ﬁxed as a moderate number to ensure quick computation of gradient, while maintaining that 1 | B | (cid:80) i ∈
B ∇ f ( x i , θ ) is a good estimate of true gradient ∇ θ f
( X ; θ ) .
In the setting of differential privacy, X is a dataset of m individual’s sensitive information, and two datasets are neighbors if one can be obtained from another by the addition or deletion of one datapoint.
To make SGD private, a standard method proposed by Abadi et al.
(2016) is to ﬁrst clip the gradient of each sample to ensure the (cid:96) 2 -norm is at most C :
[Equation]
:= x · min (1 , C/ || x || 2 ) .
Then a multivariate Gaussian noise parametrized by noise multiplier ψ is added before taking an average across the batch, leading to noisy-clipped-averaged gradient estimate g :
[Equation]
The quantity g is now private and can be used for the descent step θ ← θ − η · g in place of equation 4.
Variants of DP GANs have been used for synthetic data generation, including the Wasserstein GAN (WGAN) (Arjovsky et al., 2017; Gulrajani et al., 2017) and DP-WGAN (Alzantot & Srivastava, 2019; Triastcyn & Faltings, 2018) that use a Wasserstein-distance-based loss function in training (Arjovsky et al., 2017; Gulrajani et al., 2017; Alzantot & Srivastava, 2019; Triastcyn & Faltings, 2018); the conditional GAN (CGAN) (Mirza & Osindero, 2014) and DP-CGAN (Torkzadehmahani et al., 2019) that operate in a supervised (labeled) setting and use labels as auxiliary information in training; and Private Aggregation of Teacher Ensembles (PATE) (Papernot et al., 2017; 2018) for the semi-supervised setting of multi-label classiﬁcation when some unlabelled public data are available (or PATEGAN (Jordon et al., 2018) when no public data are available).
Our work focuses on unsupervised setting where data are unlabeled, and no (relevant) labeled public data are available.
Existing works in differentially private synthetic data generation can be summarized in Table 4.
D. D IFFERENTIALLY P RIVATE T RAINING OF D EEP M ODELS
There are numerous works on optimizing the performance of differentially private GANs, including data partitioning (either by class of labels in supervised setting or a private algorithm)
(Yu et al., 2019; Papernot et al., 2017; 2018; Jordon et al., 2018;
Abay et al., 2018;
Acs et al., 2018; Chen et al., 2018); reducing the number of parameters in deep models (McMahan et al., 2017); changing the norm clipping for the gradient in DP-SGD during training (McMahan et al., 2017; van der Veen et al., 2018; Thakkar et al., 2019); changing parameters of the Gaussian noise used during training (Yu et al., 2019); and using publicly available data to pre-train the private model with a warm start (Zhang et al., 2018; McMahan et al., 2017).
Clipping gradients per-layer of models (McMahan &
Andrew, 2018; McMahan et al., 2017) and per-dynamic parameter grouping (Zhang et al., 2018) are also proposed.
Additional details for some of these optimization approaches are given below.
[Table]
SmallDB ( ? ), PMW (Hardt & Rothblum, 2010), MWEM Hardt et al.
(2012), DualQuery Gaboardi et al.
DataSynthesizer (Ping et al., 2017), PriBayes (Zhang et al., 2017)
Batch Sampling Three ways are known to sample a batch from data in each optimization step.
The three methods are described in McMahan & Andrew (2018).
We also summarize here for the completeness of DP-SGD background.
The ﬁrst is to sample each individual’s data with a ﬁxed probability independently.
This sampling procedure is one used in analysis of subsampled moment account in Abadi et al.
; McMahan & Andrew (2018) and subsampled RDP composition in Mironov (2017).
This RDP composition is publicly available at Tensorﬂow Privacy (Google, 2018).
We implement this sampling procedure and use Tensorﬂow Privacy to account Renyi Divergence during the training.
Another sampling policy is to sample uniformly at random a subset of ﬁxed size of all datapoints.
This achieves a different RDP guarantee from the ﬁrst one, but the analysis of this sampling has been done in Wang et al.
Finally, a common subsampling procedure is to shufﬂe the data at random, and take a ﬁxed-size batch in the order of the shufﬂing without replacement.
The process is repeated after a pass over all datapoints (an epoch).
Though this batch sampling is most common in practice, no subsampled privacy composition is known in this case.
Hyperparameter Tuning Training a deep learning models involves hyperparameter tuning to ﬁnd good architecture and optimization parameters.
This process is private and privacy budget must be accounted for.
Abadi et al.
(2016) accounts for hyperparameter search using the work of Gupta et al.
Beaulieu-Jones et al.
(2019) uses Report Noisy Max Dwork & Roth (2014) to private select a model with top performance when a model evaluation metric is known.
Some works are done to account for selecting high-performance models without losing much privacy (Chaudhuri &
Vinterbo, 2013; Liu & Talwar, 2019).
In our experimental work, we omit the privacy accounting of hyperparameter search as this is not the focus fof our contribution (new algorithmic framework using RDP subsampled composition for privacy analysis), following most literatures in differentially private synthetic data generation.
D. E VALUATION M ETRICS FOR S YNTHETIC D ATA
Now we review the evaluation schemes for measuring quality of synthetic data.
Various evaluation metrics have been considered in the literature to quantify the quality of the synthetic data (Charest, 2011).
Broadly, evaluation metrics can be divided into two major categories: supervised and un- supervised.
Unsupervised metrics can then be divided into three broad types: prediction-based, distributional-distance-based, and qualitative- (or visualization-) based.
Metrics in previous work and our proposed metrics are summarized in Table 1.
Supervised evaluation metrics.
These metrics are used when clear distinctions exist between feature and labels of the dataset, e.g., for healthcare applications, whether a person has a disease or not could be a label.
The main aim of generating synthetic data is to best understand the relationship between features and labels.
A popular metric for such cases is to train a machine learning model on the synthetic data and report its accuracy on the real test data (Xie et al., 2018).
Zhang et al.
(2018) used inception scores on the image data with classiﬁcation tasks.
Inception scores were proposed in Salimans et al.
(2016) for images which measure quality as well as diversity of the generated samples.
Another metric used in Jordon et al.
(2018) reports whether the accuracy ranking of different machine learning models trained on the real data is preserved when the same machine learning model is trained on the synthetic data.
All the evaluation metrics focus on understanding relationship between labels and features of the data and hence we call them supervised evaluation metrics.
Also, in the literature, these metrics are used for classiﬁcation setting but can be generalized to regression setting easily.
The disadvantage of supervised metric is that in some application, it is not clear if any feature can appropriately be a label.
For example, the data analyst who wants to learn a pattern from synthetic data may not know what speciﬁc prediction tasks to perform, but rather wants to explore the data by several ways including by a unsupervised algorithm such as Principle Component Analysis (PCA).
As a result, we now turn our focus to unsupervised evaluation metric – a metric when no feature of the data can be decisively termed as a label.
We list all three types of evaluation metrics below.
Unsupervised evaluation metric, prediction-based.
One metric of this type is proposed by Choi et al.
(2017) for binary data.
Instead of measuring accuracy score of one particular feature in supervised-setting, one can predict every single feature by using the rest of features.
The prediction score is therefore created for each single feature, creating a list of dimension- (or feature-) wise prediction scores.
A good synthetic data should resemble dimension-wise prediction score of that of real data.
Intuitively, similar dimension-wise prediction shows that synthetic data correctly captures inter-feature relationships in the real data.
Though this was proposed for binary data, we extend this to mixed type data by allowing varieties of predictive models appropriate for each data type present in the dataset.
For each feature, we try predictive models on the real dataset in order of increasing complexity until a good accuracy score is achieved.
For example, to predict real-valued feature, we use linear classiﬁer and then neural network predictor.
This ensures that a choice of predictive model is ﬁrst appropriate to the feature.
Synthetic data is then evaluated by measuring the accuracy of the same trained predictive model, but on the synthetic data.
A high accuracy score of the model on synthetic data close to original accuracy score on real data indicates that synthetic data resembles real data well.
Zhang et al.
(2018) also provides a Jensen-Shannon score metric which measures the JensenShannon divergence between output of a discriminating neural network on the real and synthetic dataset, and a Bernoulli random variable with 0 .
5 probability.
This metric differs from dimensionwise prediction in that the predictive model (discriminator) is trained over the whole dataset at once, rather than dimension-wise, to obtain a score.
Unsupervised evaluation metric, distributional-distance-based.
Instead of computing dimension-wise prediction score, one can also compute the dimension-wise probability distribution, also proposed in Choi et al.
(2017) for binary data.
This metric compares the marginal distribution of real and synthetic data on each individual feature.
3-way marginal : Recently, NIST (2019) challenge used a 3-way marginal evaluation metric in which random three feature of the real and synthetic data R, S are used to compute the total variation distance as a statistical score.
This process is repeated a few times and ﬁnally, average score is returned.
In particular, values of each of the three features are partitioned in 100 disjoint bins as follows:
[Equation]
(cid:22) ( R ik − R k, min ) ∗
R k, max − R k, min (cid:23) and B i S,k = (cid:22) ( S ik − R k, min ) ∗
R k, max − R k, min , (cid:23) where R ik , S
ik is the value of i -th datapoint’s k -th feature in datasets R and S .
R k, min , R k, max are respectively the minimum and maximum value of the k -th feature in R .
For example, if k = 1 , 2 ,are the selected features then i -th data points of R and S are put into bins identiﬁed by a 3-tuple, ( B iR, 1 , B iR, 2 , B iR, 3 ) and ( B iS, 1 , B iS, 2 , B iS, 3 ) , respectively.
Let B R , B S be the set of all 3-tuple bins in datasets R and S , and let | B | denote number of datapoints in 3-tuple bin B , normalized by total number of data points.
Then, the 3-way marginal metric reports the (cid:96) 1 -norm of the bin-wise difference of B R and B S as follows:
[Equation]
Both aforementioned metrics involve two steps.
First, a projection (or a selection of features) of data is speciﬁed, and second some statistical distance or visualization of synthetic and real data in the projected space is computed.
Dimension-wise probability for binary data corresponds to projecting data into each single dimension, and visualize synthetic and real distributions in projected space by histograms (for binary data
, histogram can be speciﬁed by one single number, i.e. probability of feature being 1).
3-way marginal ﬁrst selects a three-dimensional space speciﬁed by three features as a space to project data to, discretize the synthetic and real distributions on that space, then compute a total variation distance between discretized distributions.
Our proposed metric generalizes both steps of designing the metric as follow(s).
Generalization of Data Projection: One can generalize selection of 3 features (3-way marginal) to any k features ( k -way marginal).
However, one can also select k principle components instead of k features.
We distinguish this as k -way feature marginal (projection onto a space spanned by feature dimensions) and k -way PCA marginal (projection onto a space spanned by principle components of original datasets).
Intuitively, k -way PCA marginal best compress information of real data in small k -dimension space, and hence is a better candidate for comparing projected distributions.
Generalization of Distributional Distance: Total variation distance can be misleading as it does not encode any information on distance of support of two distributions.
In general, one can deﬁne any metric of choice (optionally with discretization) on two projected distributions, such as Wasserstein distance which also depends on distance of supports of two distributions.
Finally, we deﬁne Distributional Distance metric without any data projection.
Computing statistical score on full-dimensional and big data is likely computationally hard.
However, we can subsample uniformly at random points from two distributions to compute the score more efﬁciently, then average this distance over many iterations.
Unsupervised evaluation metric, qualitative.
As mentioned earlier, dimension-wise probability is a speciﬁc application of comparing histogram under binary data.
One can hence plot histogram of each feature (1-way feature marginal) for inspection.
In practice, histogram visualization is particularly helpful when a feature is strongly skewed, sparse (majority is zero), and/or hard to be predicted well by predictive models.
An example of this is when predictive models do not have meaningful predictive accuracy on certain features of ADULT dataset, making prediction-based metric inappropriate, but an inspection of histograms of those features on synthetic and real data indicate that synthetic data replicates those features well.
In addition, 2 -way PCA marginal is a visual representation of data that explains as much variance as possible in a plane, a good trade-off between ease of visualization and information on two datasets.
As mentioned earlier, a distributional distance of choice can be deﬁned on two distributions on these two spaces to get a quantitative metric.