Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training

We thank the reviewer for the thoughtful review and for appreciating the merits of the work! If there are any further questions that might lead to improving your score please let us know.

We appreciate the reviewer’s careful reading of our paper and thoughtful comments!

Q1. Weak baselines

A1. We have added experimental comparisons to the state-of-the-art MERF method in the attached pdf. In Figure 1 of the attached PDF, we have considered private image generative modeling for MNIST, showing that our approach outperforms the state-of-the-art baseline MERF method for larger privacy budgets. In this experiment, note that MERF, as implemented by the authors thereof, only uses the mean embedding of the real data in each class. This allows them to use much lower noise and achieve better results for low epsilon levels, but damages performance for higher privacy budgets since their approach cannot learn the diversity of each class’s distribution (due to taking the mean only). This explains the trends we see and emphasizes the advantages of our approach that requires no such limiting preprocessing step and can retain the full diversity of the data distribution.

In Table 1 of the PDF, we also add MERF as a baseline to the tabular data experiment in the main text, showing that our proposed method (often significantly) outperforms MERF in 20 out of the 24 metrics across five datasets, including all 10 categorical metrics, 4 out of 5 classifier F1 scores, and 6 ouf of 9 numerical metrics. We used the implementation at https://github.com/ParkLabML/DP-MERF for this experiment.

Q2. Other types of data.

A.2 See the response to the question above, where we expand our treatment of image data (in addition to the domain-adaptation experiments in the original submission for image data).

Q3. Why the proposed approach could be better than the baseline algorithms

A3. Our intuition is that training generative models can be very unstable and requires careful design of the model architecture. Traditional approaches like DP-SGD, PATE, and their variants ensure differential privacy (DP) by modifying the training algorithm. This modification makes the model hard to converge due to gradient clipping and the noise added to the gradient, leading to potential issues like mode collapse, especially since hyperparameter tuning is challenging under DP constraints. In contrast, our algorithm separates DP from the generative model training by adding noise to low-dimensional projections of real data, which are then used to train the generative models. Although the noisy data may still affect the quality of the synthetic data, hyperparameter tuning becomes much easier, and any optimizer (e.g., SGD) can be applied effectively to optimize the generative model.

Q4. Discussions about limitations.

A.4. Thank you for highlighting this matter. In response to your concerns, we provide a discussion on the limitations and potential future directions below. We will ensure this discussion is incorporated into the revised paper.

In this paper, we introduce a generic framework for training generative models with differential privacy guarantees. We demonstrate the efficacy of our method through numerical experiments on both tabular and image data. It would be interesting to extend our framework to other types of data, such as natural language processing and time-series data. We establish an asymptotic statistical consistency guarantee for our algorithm. An interesting direction for future research would be to derive finite sample guarantees, specifically sample complexity bounds for our method. Additionally, we believe it is crucial to investigate the capabilities and limitations of private synthetic data from various perspectives. For instance, if a machine learning model trained on synthetic data exhibits algorithmic bias when deployed on real data, it is important to identify the source of this bias and correct the model.

We hope the above answers address your concerns, and if any questions remain, please let us know!

Q6. In remark 1 the authors claim that [RL21] did something wrong in their derivation because the slicing matrix U is not included in the privacy mechanism. Is U independent of the dataset X? Why will U affect the privacy analysis?

A.6. Yes, U is generated independently of the dataset X, but the sliced output UX is clearly dependent on U, hence conditioned on (UX), U and X are now dependent! Since the generative model training requires both the projected data and the projection directions (i.e., the U matrix must be known to the model during training), not accounting for the fact U is known can result in privacy leakage. As an analogy, let’s consider the simple additive noise setting, where the output from a Laplace mechanism is used. In such a case, any downstream operation must not access the Laplace noise added by the privacy mechanism. If it did, the noise could be used to denoise the answer, even if the noise is independent of the real data. This is a crucial oversight, which we remedy by explicitly including all needed factors in the privacy analysis.

Q7. Line 221, "...we can achieve a tighter privacy bound by reducing a factor of..." How this factor is derived?

A7. The intuition is that a deterministic U corresponds to a scenario where the adversary can engage with the design of the privacy mechanism and choose how to project the data. This grants the adversary more freedom to influence the design of the privacy mechanism, resulting in a less effective privacy protection.

Technically, we derive this factor by comparing the Renyi divergence between two privacy mechanisms, where one has random U and the other has deterministic U (see Proposition 3 in the appendix).

Q8. Is the proposed approach scalable to other domains like image datasets as well?

A.8. Thank you for bringing up this concern. Indeed, our proposed approach is applicable and scalable to other domains, including image data. For instance, please refer to our domain adaptation experiment (Section 4.2), where we apply our method to MNIST and USPS datasets.

In Figure 1 of the attached PDF, we also have considered private image generative modeling for MNIST, showing that our approach outperforms the state-of-the-art baseline MERF method for larger privacy budgets. In this experiment, note that MERF, as implemented by the authors thereof, only uses the mean embedding of the real data in each class. This allows them to use much lower noise and achieve better results for low epsilon levels, but damages performance for higher privacy budgets since their approach cannot learn the diversity of each class’s distribution (due to taking the mean only). This explains the trends we see and emphasizes the advantages of our approach that requires no such limiting preprocessing step and can retain the full diversity of the data distribution.

In Table 1 of the PDF, we add MERF to the experiment in the main text, showing that our proposed method (often significantly) outperforms MERF in 20 out of the 24 metrics across five datasets, including all 10 categorical metrics, 4 out of 5 classifier F1 scores, and 6 ouf of 9 numerical metrics. We used the implementation at https://github.com/ParkLabML/DP-MERF for this experiment.

We hope the above answers clarify the reviewer’s view of our work, and if any questions remain, please let us know!

PART 1

We thank the reviewer for the thoughtful comments and for appreciating the novelty of the work!

Q1. Comparison with MMD-based methods.

A1. Indeed, this is a great point! As mentioned in the general response, we have added new experiments to address this.

In Figure 1 of the attached PDF, we have considered private image generative modeling for MNIST, showing that our approach outperforms the state-of-the-art baseline MERF method for larger privacy budgets (MERF is an MMD-based method). In this experiment, note that MERF, as implemented by the authors thereof, only uses the mean embedding of the real data in each class. This allows them to use much lower noise and achieve better results for low epsilon levels, but damages performance for higher privacy budgets since their approach cannot learn the diversity of each class’s distribution (due to taking the mean only). This explains the trends we see and emphasizes the advantages of our approach that requires no such limiting preprocessing step and can retain the full diversity of the data distribution.

In Table 1 of the PDF, we also add MERF as a baseline to the tabular data experiment in the main text, showing that our proposed method (often significantly) outperforms MERF in 20 out of the 24 metrics across five datasets, including all 10 categorical metrics, 4 out of 5 classifier F1 scores, and 6 ouf of 9 numerical metrics. We used the implementation at https://github.com/ParkLabML/DP-MERF for this experiment.

KME in theory is an infinite-dimensional embedding, which is not convenient to add Gaussian noise, so those works propose to approximate KME by projecting it into a finite-dimensional space. In this work, in theory you have infinitely many directions to slice where only a finite number (m) of directions are randomly chosen. So both of you apply the finite-projection idea and therefore both of you will have approximation errors.

Note that using a finite number of slices is a very different form of approximation than simply projecting onto a finite-dimensional space. As a result, our approach is much more amenable to theoretical guarantees. Firstly, in our setting, any errors from finite numbers of slices can be easily controlled since the slices are independent and identically distributed, while errors from truncating an infinite-dimensional space to a few dimensions is difficult to control theoretically. Secondly, note that our total projection dimension (number of slices X slice dimension) is actually fairly large, oftentimes on the order or larger than the ambient dimension of the data itself. This should imply that the loss of distributional information due to slicing is quite minimal indeed.

Q2. Sensitivity analysis

A.2. You are absolutely right. In most DP work, particularly when noise is added to a statistical query, a sensitivity analysis lemma is derived to prove the DP theorem. However, our privacy mechanism differs as it is not an additive mechanism; instead, it uses Gaussian noise to randomly project data into a lower-dimensional space and then adding noise. We established our (Renyi)-DP guarantee by directly bounding the Renyi divergence (Lemma 2 in Appendix), and leveraging a prior result that bounds traditional epsilon-delta differential privacy in terms of Renyi-DP. This strategy significantly simplifies our proof. Similar ways for proving DP theorem (without a sensitivity lemma) have been used in other privacy mechanisms, such as in the DP proof for the Johnson-Lindenstrauss transform in [BBDS12].

Q3. Adding noise to synthetic data (eq. 2) is unnecessary and will hurt the model utility

A3. Adding noise to synthetic data may seem counterintuitive, but it is essential for our approach to ensure that the learned model is consistent with the true data distribution. Recall that we minimize the loss function, specifically the smoothed-slicing f-divergence (SD), between the distributions of synthetic and real data. Proposition 1 states that SD = 0 iff the real and synthetic data distributions perfectly match. This property holds only if we apply the same amount of noise to both the real and synthetic data distributions.

To illustrate this intuition, consider an example: let the real data follow a 1D normal distribution $N(0,1)$ and the synthetic data follow $N(0, \sigma)$ with a trainable parameter $\sigma$. If we add noise only to the real data distribution, for instance, Gaussian noise $N(0, \sigma_{\text{noise}})$, minimizing our loss function to zero will lead to the synthetic data having a greater variance than the real data: $\sigma = 1 + \sigma_{\text{noise}} > 1$.

Q4. Does the proposed method suffer from scalability issues or not friendly to gradient-based optimization?

A.4. Our proposed method should indeed not suffer from these issues, as we circumvent the need for noisy gradients and our objective function is well-behaved and not a min-max problem.

Q5. What does "slicing and smoothing" (line 116) exactly mean?

A5. “Slicing” refers to (randomly) projecting high-dimensional data into lower-dimensional spaces, like slicing a loaf of bread into thinner pieces. “Smoothing” refers to adding Gaussian noise, which makes the resulting distribution less peaked and more spread out.

We term the proposed divergence “smoothed-sliced f-divergence” since it (randomly) projects the original and synthetic data distributions onto lower-dimensional spaces (i.e., slicing), followed by adding isotropic Gaussian noise (i.e., smoothing), and averaging their f-divergence over all projections.