As data storage and analysis are becoming more 2 cost effective, and data become more complex and un-3 structured, there is a growing need for sharing large 4 datasets for research and learning purposes. This is in 5 stark contrast to the previous statistical model where 6 a data curator would hold datasets and answer spe-7 cific queries from (potentially external) analysts. Shar-8 ing entire datasets allows analysts the freedom to per-9 form their analyses in-house with their own devices and 10 toolkits, without having to pre-specify the analyses they 11 wish to perform. However, datasets are often propri-12 etary or sensitive, and they cannot be shared directly.
This motivates the need for synthetic data generation,
where a new dataset is created that shares the same statistical properties as the original data. These data may not be of a single type: all binary, all categorial, or all real-valued; instead they may be of mixed-types, containing data of multiple types in a single dataset. These data may also be unlabeled, requiring techniques for unsupervised learning, which is typically a more challenging task than supervised learning when data are labeled.
Privacy challenges naturally arise when sharing highly sensitive datasets about individuals. Ad hoc anonymization techniques have repeatedly led to severe privacy violations when sharing "anonymized" datasets. Notable examples include the Netflix Challenge [1], AOL Search Logs [2], and Massachusetts State Health data [3], where linkage attacks to publicly available auxiliary datasets were used to reidentify individuals in the dataset. Even deep learning models have been shown to inadvertently memoize sensitive personal information such as Social Security Numbers during training [4].
ISSN 1872-4981/$35.00 c 2021 -IOS Press. All rights reserved. synthetic datasets to the unsupervised mixed-type data setting. Both of these contributions may be of independent interest.
Algorithmic framework. We propose a new data generation architecture which combines the versatility of an autoencoder [9] with the recent success of GANs on complex data. Our model extends previous autoencoder-based DP data generation [10,11] by removing an assumption that the distribution of the latent space follows a Gaussian mixture distribution. Instead, we incorporate GANs into the autoencoder framework so that the generator must learn the true latent distribution against the discriminator. We describe the composition analysis of differential privacy when the training consists of optimizing both autoencoders and GANs (with different noise parameters).
Empirical results. We empirically evaluate the performance of our algorithmic framework on the MIMIC-III medical dataset [12] and UCI ADULT Census dataset [13], and compare against previous approaches in the literature [10,[14][15][16]. Our experiments show that our algorithms perform better and obtain substantially improved values of ≈ 1, compared to ≈ 200 in prior work [15]. The performance of our algorithm remains high along a variety of quantitative and qualitative metrics, even for small values of , corresponding to strong privacy guarantees. Our code is publicly available for future use and research.
Early work on differentially private synthetic data generation was focused primarily on theoretical algorithms for solving the query release problem of privately and accurately answering a large class of pre-specified queries on a given database. It was discovered that generating synthetic data on which the queries could be evaluated allowed for better privacy composition than simply answering all the queries directly [7,8,17,18]. Bayesian inference has also been used for differentially private data generation [19,20] by estimating the correlation between features. See [21] for a survey of techniques used in private synthetic data generation. More recently, [22] introduced a framework for training deep learning models with differential privacy, which involved adding Gaussian noise to a clipped (norm-bounded) gradient in each training step. [22] also introduced the moment accountant privacy analysis, which provided a tighter Gaussian-based privacy composition and allowed for significant improvements in (PATE) [39,40] for the semi-supervised setting of multilabel classification when some unlabelled public data are available (or PATEGAN [41] when no public data are available). Our work focuses on the unsupervised setting where data are unlabeled, and no (relevant) labeled public data are available.
These existing works on differentially private synthetic data generation are summarized in Table 1.
Differentially private generation of mixed-type data. Next we describe the three most relevant recent works on privately generating synthetic mixed-type data. [10] considers the problem of generating mixed-type labeled data with k possible labels. Their algorithm, DP-SYN, partitions the dataset into k sets based on the labels and trains a DP autoencoder on each partition. Then the DP expectation maximization (DP-EM) algorithm of [42] is used to learn the distribution in the latent space of encoded data of the given label-class. The main workhorse, DM-EM algorithm, is designed and analyzed for Gaussian mixture models and more general factor analysis models. [11] works in the same setting, but replaces the DP autoencoder and DP-EM with a DP variational autoencoder (DP-VAE). Their algorithm assumes that the mapping from real data to the Gaussian distribution can be efficiently learned by the encoder.
Finally, [14] uses a Wasserstein GAN (WGAN) to generate differentially private mixed-type synthetic data, which uses a Wasserstein-distance-based loss function in training. Their algorithmic framework privatizes the WGAN using DP-SGD, similar to previous approaches for image datasets [15,43]. The methodology of [14] for generating mixed-type synthetic data involves two main ingredients: changing discrete (categorical) data to binary data using one-hot encoding, and adding an output softmax layer to the WGAN generator for every discrete variable.
Our framework is distinct from these three approaches. We use a differentially private autoencoder Galley Proof 3/12/2021; 10:00 File: idt-1-idt210195.tex; BOKCTP/ljl p. 4 In the setting of differential privacy, a dataset X 263 consists of m individuals' sensitive information, and 264 two datasets are neighbors if one can be obtained from 265 the other by the addition or deletion of one datapoint. 266 Differential privacy requires that an algorithm produce 267 similar outputs on neighboring datasets, thus ensuring 268 that the output does not overfit to its input dataset, and 269 that the algorithm learns from the population but not 270 from the individuals.
Definition 1 (Differential privacy [5]). For , δ > 0, an 273 algorithm M is ( , δ)-differentially private if for any 274 pair of neighboring databases X, X and any subset S 275 File: idt-1-idt210195.tex; BOKCTP/ljl p. 5 A smaller value of implies stronger privacy guarantees (as the constraint above binds more tightly), but usually corresponds with decreased accuracy, relative to non-private algorithms or the same algorithm run with a larger value of . Differential privacy is typically achieved by adding random noise that scales with the sensitivity of the computation being performed, which is the maximum change in the output value that can be caused by changing a single entry. Differential privacy has strong composition guarantees, meaning that the privacy parameters degrade gracefully as additional algorithms are run on the same dataset. It also has a post-processing guarantee, meaning that any function of a differentially private output will retain the same privacy guarantees.
Training deep learning models reduces to minimizing some (empirical) loss function f (X; θ) :=
Typically f is a nonconvex function, and a common method to minimize f is by iteratively performing stochastic gradient descent (SGD) on a batch B of sampled data points:
The size of B is typically fixed as a moderate number to ensure quick computation of gradient, while main-
To make SGD private, Abadi et al. [22] proposed to first clip the gradient of each sample to ensure the 2 -norm is at most C:
Then a multivariate Gaussian noise parametrized by noise multiplier ψ is added before taking an average across the batch, leading to noisy-clipped-averaged gradient estimate g:
The quantity g is now private and can be used for the 312 descent step θ ← θ -η • g in place of Eq. (1).
Performance Improvements. In general, the descent 314 step can be performed using other optimization meth-315 ods -such as Adam or RMSProp -in a private man-316 ner, by replacing the gradient value with g in each step. 317 Also, one does not need to clip the individual gradients, 318 but can instead clip the gradient of a group of data-319 points, called a microbatch [48]. Mathematically, the 320 batch B is partitioned into microbatches B 1 , . . . , B k 321 each of size r, and the gradient clipping is performed 322 on the average of each microbatch:
Standard DP-SGD corresponds to setting r = 1, but 324 setting higher values of r (while holding |B| fixed) sig-325 nificantly decreases the runtime and reduces the accu-326 racy, and does not impact privacy significantly for large 327 dataset. Other clipping strategies have also been sug-328 gested. We refer the interested reader to [48] for more 329 details of clipping and other optimization strategies.
The improved moment accountant privacy analysis 331 by [22] (which has been implemented in Google [49] 332 and is widely used in practice) obtains a tighter privacy 333 bound when data are subsampled, as in SGD. This anal-334 ysis requires independently sampling each datapoint 335 with a fixed probability q in each step.
The DP-SGD framework (Algorithm 1) is generically 337 applicable to private non-convex optimization. In our 338 proposed model, we use this framework to train the 339 autoencoder and GAN. procedure SAMPLEBATCH(X, q) 5:
B ← {} 6:
for i = 1 . . . m do 7:
Add x i to B with probability q 8: Return B 9:
Partition B into B 1 , . . . , B k each of size r (ignoring the dividend) 10:
k ← qm r an estimate of k Step 1: Subsampled renyi divergence. Given sampling rate q and noise multiplier ψ, one can obtain RDP privacy parameters as a function of α 1 for one run of DP-SGD [23]. We denote this function by RDP T =1 (•), which will depend on q and ψ.
Step 2: Composition of RDP. When DP-SGD is run iteratively, we can compose the Renyi privacy parameter across all runs using the following proposition.
). If M 1 , M 2 respectively satisfy 366 (α, 1 ), (α, 2 )-RDP for α 1, then the composition of 367 two mechanisms (M 2 (X), M 1 (X)) satisfies (α, 1 + 368
2 )-RDP.
Hence, we can compute RDP privacy parameters for 370 T iterations of DP-SGD as RDP-ACCOUNT(T, q , ψ) : 371 = T • RDP T =1 (•).
Step 3: Conversion to ( , δ)-DP. After obtaining an 373 expression for the overall RDP privacy parameter val-374 ues, any (α, )-RDP guarantee can be converted into 375 ( , δ)-DP.
376 Proposition 2 ([23]). If M satisfies (α, )-RDP for 377 α > 1, then for all δ > 0, M satisfies ( + log 1/δ α-1 , δ)-378 DP.
Since the privacy parameter of RDP is also a func-380 tion of α, this last step involves optimizing for the α that 381 achieves smallest privacy parameter in Proposition 2. The overview of our algorithmic framework DP-auto-384 GAN is shown in Fig. 1, and the full details are given 385 in Algorithm 2.
The algorithm takes in m raw data points, and pre-387 processes these points into m vectors x 1 , . . . , x m ∈ 388 R n to be read by DP-auto-GAN, where usually n is very large. For example, categorical data may be preprocessed using one-hot encoding, or text may be converted into high-dimensional vectors. Similarly, the output of DP-auto-GAN can be post-processed from R n back to the data's original form. We assume that this pre-and post-processing can done based on public knowledge, such as possible categories for qualitative features and reasonable bounds on quantitative features, and therefore do not incur a privacy cost. as well as our algorithm's overall privacy guarantee, are described in the remainder of this section.
An autoencoder consists of an encoder En φ (•) :
where x (j) is the jth coordinate of the data x ∈ [0, 1] n after our preprocessing.
This motivates a definition of a (true) loss function
when data are drawn independently from an underlying distribution Z X . The corresponding empirical loss function when we have an
(2) Finding a good autoencoder requires optimizing φ and θ to yield small empirical loss in Eq. ( 2).
We minimize Eq. ( 2) privately using DP-SGD (Sec-436 tion 2.1). Our approach follows previous work on pri-437 vate training of autoencoders [10,11,16] by adding 438 noise to both the encoder and decoder. In our DP-auto-439 GAN framework, the autoencoder is trained first until 440 completion, and is then fixed while training the GAN. 441 As noted earlier, the decoder is trained privately by 442 clipping gradient norm and injecting Gaussian noise in 443 order to obtain the gradient of decoder g θ , while the 444 gradient of encoder g φ can be used directly as encoder 445 can be trained non-privately. B ← SAMPLEBATCH(X, q 1 ) 5:
Partition R into B 1 , . . . , B k each of size r (ignoring the dividend) 6:
k ← q 1 m r an estimate of k 7:
for j = 1 . . . k do Both g j φ , g j θ can be computed in one backpropagation 8:
by weights w and y. The aim of the generator G w is to synthesize (fake) data similar to the real dataset, while the discriminator aims to determine whether an input
x i is from the generator's synthesized data (and assign label D y (x i ) = 0) or is real data (and assign label
). The generator is seeded with a random noise z ∼ Z that contains no information about the real dataset, such as a multivariate Gaussian vector, and aims to generate a distribution G w (z) that is hard for D y to distinguish from the real data. Hence, the generator wants to minimize the probability that D y makes a correct guess,
The discriminator wants to maximize its probability of a correct guess, which is
We extend the binary output of D y to a continuous range [0, 1], with the value indicating the confidence that a sample is real. We use the zero-sum objective for the discriminator and generator [34], which is motivated by the Wasserstein distance of two distributions.
Although the proposed Wasserstein objective cannot be computed exactly, it can be approximated by optimizing:
We optimize Eq. (3) privately using the DP-SGD framework described in Section 2.1. We differ from prior work on DP-GANs in that our generator G w (•) B ← SAMPLEBATCH(X, q 3 ) 5:
Partition R into B 1 , . . . , B k each of size r (ignoring the dividend) 6:
k ← q 1 m r an estimate of k 7:
for j = 1 . . . k do 8:
After this two-phase training (of the autoencoder 496 and GAN), the noise distribution Z, trained generator 497 G w (•), and trained decoder De θ (•) are released to the 498 public. The public can sample z ∼ Z to obtain a syn-499 thesized datapoint De θ (G y (z)) repeatedly to obtain a 500 synthetic dataset of any desired size.
In the case of WGAN,
. Then, we have
where the two inequalities use the definitions of 1 , 2 , , and the second inequality uses the fact that r i is an increasing function of α [50].
For most settings of training parameters, we found that by RDP composition in Lemma 1 is ≈ 30% smaller than that of the standard composition (see Fig. 2 for this privacy saving in our DP-auto-GAN = 0.51 ADULT setting). The observation can be support by theoretical analysis as follows. It is observed in [51] that r i (α) appears linear until a phase transition at some α, and is close to linear again. In our parameter settings, the optimal order to achieve smallest is before the phase transition, and thus r i (α) "practically" behaves linear as the privacy analysis never uses r i (α) at α beyond the phase transition. This is illustrated in Fig. 3 by an example of our DP-auto-GAN = 0.51 ADULT setting.
Assuming linear r i (α) = c i α, we can compute the analytical solutions:
In practice, δ is small compared to c i 's and the term c i log 1/δ dominates. Hence,foot_1 ≈ 2 1 + 2 2 , and for many settings where we set 1 close to 2 (such as in our setting or DP-SYN [10]), this implies ≈ 0.707( 1 + Fig. 2. Privacy for different training phases of the algorithm in = 0.51 DP-auto-GAN parameter setting for ADULT data: the sampling rate q and noise multiplier ψ for autoencoder and GAN are q = 64 32561 , ψ = 2.5 and q = 128 32561 , ψ = 7.5, respectively. We target δ = 10 -5 overall and δ = 1 2 • 10 -5 for each training phase.
tings, a predictive model is typically trained on the synthetic data, and its accuracy is measured with respect to the real (test) dataset. Unsupervised evaluation metrics are used when no feature of the data can be decisively termed as a label. Recently proposed metrics include dimension-wise probability for binary data [47], which compares the marginal distribution of real and synthetic data on each individual feature, and dimension-wise prediction, which measures how closely synthetic data captures relationships between features in the real data. This metric was proposed for binary data, and we extend it here to mixed-type data. Recently, NIST [44] used a 3-way marginal evaluation metric which used three random features of the real and synthetic datasets to compute the total variation distance as a statistical score.
Supervised evaluation metrics. The main aim of generating synthetic data in a supervised setting is to best understand the relationship between features and labels. A popular metric for such cases is to train a machine learning model on the synthetic data and report its accuracy on the real test data [15]. Zhang et al. [43] used inception scores on the image data with classification tasks. Inception scores were proposed in Salimans et al. [27] for images which measure quality as well as diversity of the generated samples. Another metric used in Jordon et al. [41] reports whether the accuracy ranking of different machine learning models trained on the real data is preserved when the same machine learning model is trained on the synthetic data. Although these metrics are used for classification in the literature, they can be easily generalized to the regression setting.
In the DP setting of synthetic data generation, supervised metrics also differ from unsupervised in that the label feature is sometimes treated as public (e.g. in DP-SYN [10]), whereas in unsupervised setting, all features are treated as private. We note it as this may create a slight difference in privacy accounting.
Unsupervised evaluation metrics, predictionbased. Rather than measuring accuracy by predicting one particular feature as in supervised-setting, one can predict every individual feature using the rest of features. The prediction score is therefore created for each single feature, creating a list of dimension-(or feature-) wise prediction scores. Good synthetic data should have similar dimension-wise prediction scores to that of the real data. Intuitively, similar dimension-wise prediction shows that synthetic data correctly captures interfeature relationships in the real data.
One metric of this type is proposed by Choi et al. [47] for binary data. Although it was originally proposed Diversity metric. Inception score is one common metric for evaluating the quality of data generated by GAN [52]. Both inception and Jensen-Shannon scores aim to capture both the accuracy and diversity of generated data through comparing the distributions of predictions by a fixed classifier on original and synthetic data. Inception score is similar to µ-smoothed KL divergence we propose in Section 5, but we apply it to discrete distribution and use a smoothing to avoid divergence being undefined. Our metric also differs from inception scores in that it is based on the distributions of synthetic and original data, and not on predictions on those datasets by any classifier. We observed that introducing a classifer can itself be a reason for lack of diversity, and concern that a predictive model in general can introduce bias and unfairness in other forms. For example, we found that in a categorical feature with one strong majority class, the classifier predicts only the majority to maximize a standard notion of "accuracy," hence U.T. Tantipongpipat et al. / Differentially private synthetic mixed-type data generation for unsupervised learning making a synthetic data that ignore minority classes represent the original data perfectly well, as predictions on synthetic and original data are identical. Therefore, for diversity applications, we prefer distribution-based metric to a distribution-based metric.
Moreover, we aim our metric to be appropriate in differential privacy setting. A natural metric to penalize missing a minority class is KL divergence, as used in the definitions of inception and Jensen-Shannon scores. However, it is impossible for a private model to recognize if a minority exists if the class is really small, simply due to the definition of differential privacy (unless the algorithm assumes existence of all possible classes in the dataset, but this would greatly impact accuracy as the number of classes increase). Bagdasaryan et al. [53] observed a phenomena that differentially private training indeed impacts minority classes more than majority class, as we also observed in our work. Missing a minority class, therefore, is sometimes unavoidable with DP guarantees. Since missing any class makes KL divergence undefined, we added a smoothing term to KL divergence so that the penality of missing a minority class is finite, yet significant.
Unsupervised evaluation metrics, distributionalbased. One way to evaluate the quality of synthetic data is computing a dimension-wise probability distribution, which was also proposed in Choi et al. [47] for binary data. This metric compares the marginal distribution of real and synthetic data on each individual feature.
Below we survey other metrics in this class that can extend to mixed-type data.
Recently, the NIST [44] challenge used a 3-way marginal evaluation metric in which three random features of the real and synthetic data R, S are used to compute the total variation distance as a statistical score. This process is repeated a few times and finally, average score is returned. In particular, values for each of the three features are partitioned in 100 disjoint bins as follows: Let B R , B S be the set of all 3-tuple bins in datasets 735 R and S, and let |B| denote number of datapoints in 3-736 tuple bin B, normalized by total number of data points. 737 Then, the 3-way marginal metric reports the 1 -norm of 738 the bin-wise difference of B R and B S as follows:
Both aforementioned metrics (dimension-wise prob-740 ability from [47] and 3-way marginal from [44]) involve 741 two steps. First, a projection (or a selection of features) 742 of data is specified, and second some statistical distance 743 or visualization of synthetic and real data in the pro-744 jected space is computed. Dimension-wise probability 745 for binary data corresponds to projecting data into each 746 single dimension, and visualizing synthetic and real 747 distributions in projected space by histograms (for bi-748 nary data, the histogram can be specified by one single 749 number: probability of the feature being 1). The 3-way 750 marginal metric first selects a three-dimensional space 751 specified by three features as a space into which data 752 projected, discretizes the synthetic and real distributions 753 on that space, then computes a total variation distance 754 between discretized distributions. We can generalize 755 these two steps process and conceptually design a new 756 metric as follows.
Generalization of data projection: One can general-758 ize selection of 3 features (3-way marginal) to any k 759 features (k-way marginal). However, one can also select 760 k principle components instead of k features. We distin-761 guish these as k-way feature marginal (projection onto 762 a space spanned by feature dimensions) and k-way PCA 763 marginal (projection onto a space spanned by principle 764 components of the original dataset). Intuitively, k-way 765 PCA marginal best compresses the information of the 766 real data into a small k-dimensional space, and hence is 767 a better candidate for comparing projected distributions. 768 Generalization of distributional distance: Total vari-769 ation distance can be misleading as it does not encode 770 any information on the distance between the supports of 771 two distributions. In general, one can define any metric 772 of choice (optionally with discretization) on two pro-773 jected distributions, such as Wasserstein distance which 774 also depends on the distance between the supports of 775 the two distributions. File: idt-1-idt210195.tex; BOKCTP/ljl p. 13 U.T. information and ease of visualization on two datasets.
This visualization can be augmented with a distribu-803 tional distance of choice over the two distributions on 804 these two spaces to get a quantitative metric. For each feature, the closer the proportion of 1's in the original dataset is to that of synthetic dataset, the better. Dimension-wise prediction. This metric evaluates whether synthetic data maintain relationships between features. For the k-th feature of training set R and synthetic dataset S, we choose y R k ∈ R m1 and y S k ∈ R m2 as labels of a classification or regression task based on the type of that feature, and the remaining features R -k and S -k are used for prediction. We train either a classification or regression model on R -k and S -k , and measure goodness of fit based on the model's accuracy by testing on T . That is, we "train on synthetic, test on original" to evaluate the quality of synthetic data. The closer of accuracy scores obtained from original and synthetic data, the better.
Model accuracy can be reported using AUROC, F 1 , or R 2 scores, as appropriate. We describe the model's accuracy as follows:
1. Area under the ROC curve (AUROC) score and F 1 score for classification: The F 1 score of a classifier is defined as F 1 := 2×precision×recall precision+recall , where precision is ratio of true positives to true and false positives, and recall is ratio of true positives to total true positives (i.e., true positives plus false negatives). F 1 score on multi-class features are averaged using micro-averaging. AUROC score is a graphical measure capturing the area under ROC (receiver operating characteristic) curve, and is only intended for binary data. Both metrics take values in interval [0, 1] with larger values implying good fit. The ROC curve are pairs of true and false positive rates obtained from setting different thresholds at the classifier's predicted probability. Note that when the classifier is trained on the data with one class and predicts always with probability 0 (or 1), ROC curve is a single pair, and AUROC is thus undefined.
2. R 2 score for regression: The R 2 score is defined
, where y i is the true label, y i is the predicted label, and ȳ is the mean of the true labels. This is a popular metric used to measure goodness of fit as well as future prediction accuracy for regression.
1-Way feature marginal (histogram). We compute probability distribution of the feature of interest of both real and synthetic data. For continuous features, we partition the range into intervals. This can be extended to kway feature marginals by considering joint distribution over k features and made into a quantitative measure by adding a distance measure between the histograms. tively show the proportion of 1s in the real and synthetic datasets. Points closer to the y = x line correspond to better performance, because this indicates the distribution is similar in the real and synthetic datasets. As shown in Fig. 4, the proportion of 1's in the marginal distribution for is similar on the real and synthetic datasets in the non-private ( = ∞) and private settings. The marginal distributions of the privately generated data from DP-auto-GAN remain a close approximation of the real dataset, even for small values of , because nearly all points fall close to the line y = x. We note that our results are significantly stronger than the ones obtained in [15] with ∈ [96. 5,231] because we obtain dramatically better performance with values that are two orders of magnitude smaller. For visual performance comparison, see Fig. 4
Dimension-wise prediction. Figure 5 shows dimension-wise prediction using DP-auto-GAN for different values of . Each point in the figure corresponds to a feature in the dataset, and the x and y coordinates respectively show the AUROC score of a logistic regression classifier trained on the real and synthetic datasets, and points closer to the y = x line still correspond to better performance. As shown in the figure, for = ∞, many points are concentrated along the lower side of line y = x, which indicates that the AUROC score of the real dataset is only marginally higher than that of the synthetic dataset. When privacy is added, there is a gradual shift downwards relative to the line y = x, with larger variance in the plotted points, indicating that AU-ROC scores of real and synthetic data show more difference when privacy is introduced. Surprisingly, there is little degradation in performance for smaller values, including = 0.81. For sparse features with few 1's in the data, the generative model will output all 0's for that feature, making AUROC ill-defined. We follow [15] by excluding those features from dimension-wise prediction plots.
Our results for DP-auto-GAN under this metric are also significantly stronger than the ones obtained in [15] with much larger values of ∈ [96. 5,231]; for visual performance comparison, see Fig. 5 those with unmeaningful AUROC have less than 0.2% proportion of 1's in the original dataset. Figure 6 shows dimension-wise prediction scatterplots of full 925 of 1071 features where AUROC is defined. When = ∞, DP-auto-GAN generates all 0's in many of the sparse features in the synthetic dataset, including all 146 features with no 1's in the original datasets. Those features obtain scores of 0.5, giving the horizontal line y = 0.5 in Fig. 6a. When noise is injected, DP-auto-GAN generates few but enough of 1's in all features that AUROC is not 0.5, and thus the horizontal line is no longer present in Fig. 6b-d. The vertical line x = 0.5 represents 69 features that the classifier is unable to learn in the orignal dataset due to the sparsity and learn from random noise injected in the synthetic data generator.
by deleting features which synthetic dataset contain no 1's. While this conveniently deletes points on the horizontal and vertical lines, the features being deleted are dependent on the synthetic dataset, which can ob-scure the presentation of its quality. For example, if 1015 the generator performs poorly on non-sparse features 1016 by outputting only one class, that feature is not on the 1017 plot rather than being presented as far away from the 1018 line y = x. Since we observe that prediction scores on 1019 sparse features are unstable, thus necessarily showing 1020 large variances in the context of differential privacy, 1021 we propose to delete features whose proportions of 1's 1022 in the original dataset are below a threshold. The set 1023 of deleted feature is therefore fixed and independent 1024 of synthetic data to be evaluated. In Fig. 7, we show 1025 dimension-wise prediction scatterplots of MIMIC-III 1026 dataset with the thresholds set at 1%, 2.5%, and 5%. 1027 We are able to more clearly see the performance of 1028 DP-auto-GAN than plotting all 925 features and better 1029 observe a slight change of performance as decreases 1030 across three values. performance for all values tested. As expected, its performance degrades as decreases, but not substantially. DP-WGAN [14] performs well at = 1.01, but its performance degrades rapidly with smaller . This is consistent with [14], which uses higher = 3, 7.
values. DP-SYN [10] is able to capture relationships between features well even for small using this metric.
1-Way marginal and diversity divergence. While DP-SYN has good dimension-wise prediction, this does not capture diversity, a concern of bias known for DP-SGD ( [53]). For features with a large majority class and many minority classes, the classifier often predicts the majority class with probability one. We found that for four features, DP-SYN generates data from only one class, whereas all other algorithms do not behave this way for any feature. Lack of diversity in synthetic data can raise fairness concerns, as societal decisions based on the private synthetic data will inevitably ignore minority groups.
We start by turning to 1-way marginal as a method of 1098 evaluation, which is able to detect such issues and give 1099 another perspective of synthetic data. Figure 9 shows 1100 histograms of synthetic data from the four algorithms 1101 on two categorical features: marital-status and race. 1102 Marital-status distributes more evenly across categories, 1103 and DP-VAE, DP-SYN and DP-auto-GAN are able to 1104 learn this distribution well. Race, on the other hand, has 1105 an 85.5% majority; DP-SYN only generated data from 1106 the majority class, whereas DP-auto-GAN and DP-VAE 1107 were able to detect the existence of minority classes. 1108 DP-WGAN suffered similar issues on the marital status 1109 feature. 1110 Figure 10 shows similar histograms for the native-1111 country feature of the ADULT dataset, where the ma-1112 jority class constitutes > 85% of the population. Each 1113 of the 41 minority classes in native-country constitute 1114 less than 2% in the original dataset, with most of them 1115 weighing less than 0.2% of the population. DP-auto-1116 GAN and DP-WGAN are able to capture some minor-1117 ity classes. DP-VAE was unable to accurately learn the 1118 majority structure and significantly overestimates the 1119 weight on all minority classes, which greatly impacts 1120 the estimate of the majority class. DP-SYN did not 1121 capture an existence of any minority classes.
A standard measure for diversity between the origi-1123 nal distribution P and synthetic distribution Q includes 1124 Kullback-Leibler (KL) divergence D KL (P ||Q). Under 1125 differential privacy the support of P is a private infor-1126 mation, so the private synthetic data inherently cannot 1127 ensure its support to align with the original data. This 1128 makes D KL (P ||Q) and D KL (Q||P ) (and related met-1129 rics such as Inception score [27]) undefined. One al-1130 ternative is Jensen-Shannon divergence (JSD) [24,54] We note that predictive scores may also not be appropriate for continuous features when no good classifier exists to predict the feature, even in the original dataset. In our setting, we found three continuous features with R 2 scores close to zero even with more complex regression models, and with negative R 2 scores on synthetic data, which is not meaningful. For those features, 1-way marginals (histograms, explored next) are preferred to prediction scores.
In general, we suggest that an evaluation of synthetic data should be based on probability measures (distributions of data) and not predictive scores of models. Models may be a source of not only unpredictability and instability, but also of bias and unfairness.
Histograms for continuous features with small r 2 scores. For three continuous features in the ADULT dataset (capital gain, capital loss, and hours worked per week), we were not able to find a regression model with File: idt-1-idt210195.tex; BOKCTP/ljl p. 20 Since the R 2 scores did not prove to be a good metric for these features, we instead plotted 1-way feature marginal histograms for each of these three remaining features to check whether the marginal distribution was learned correctly. These 1-way histograms for DP-auto-GAN are shown in Fig. 11. The figure shows that DPauto-GAN identifies the marginal distribution of capital gain and capital loss quite well, and it does reasonably well on the hours-per-week feature.
Random forest prediction scores. Following [14], 2-Way PCA. In order to understand combined qualitative performance of all features, we show 2-way PCA marginal in Fig. 12. We fix the same projection from the original data, and require the synthetic data to be of the same format and go through the same preprocessing. For this reason, we do not compare to DP-WGAN since the original implementation [14] does not handle continuous columns, and we apply our preprocessing rather than the original preprocessing for DP-SYN. A qualitative inspection of the plots clearly shows the similarities of trends between the plots for real dataset and synthetic data generated by DP-auto-GAN for different values of , as low as = 0.51. File: idt-1-idt210195.tex; BOKCTP/ljl p. 22 discriminator was set to 0.022. The pair was trained on 15,000 minibatches of size 128 and a microbatch size of 1, with 15 updates to the discriminator per 1 update to the generator. Again, the noise multiplier was then calibrated to achieve the desired privacy guarantee. The final noise multiplier used for = 0.36, 0.51, 1.01 are ψ = 8, 7.5, 3.5, respectively.
Model architecture. A serialization of the model architectures used in the experiment can be found below. Note that the number of latent dimension, 64, is the same as in the implementation of DP-SYN.
U.T. Tantipongpipat et al. / Differentially private synthetic mixed-type data generation for unsupervised learning
), an approximately
30% reduction of privacy cost.
File: idt-1-idt210195.tex; BOKCTP/ljl p. 12
File: idt-1-idt210195.tex; BOKCTP/ljl p. 16
File: idt-1-idt210195.tex; BOKCTP/ljl p. 18