summaries: The paper has two main contributions:  1) It proposes a unifying framework called "Adaptive Measurements" that covers many differentially private synthetic data generation algorithms and show how these algorithms can be derived by modifying the loss function and distributional family.  2) Based on the above framework, two specific synthetic data generation algorithms called Private Entropy Projection (PEP) and Generative networks with Exponential Mechanism (GEM) have been proposed. Since PEP attempts to explicitly model the data distribution, it does not scale well to higher dimensions. GEM uses the well-known generative neural networks to overcome the above problem and can also effectively use public data for good initialization. The authors unify several algorithms for DP synthetic data generation for query release. Using this framework they create two algorithms, private entropy projection (PEP) and generative networks with the exponential mechanism (GEM). Then they empirically evaluate their algorithms in publicly available datasets and show that their algorithms (mostly) outperform existing ones. They also show how GEM can use public data to improve its accuracy.  This paper tackles the problem of synthetic data generation for query release. First, it presents a general algorithmic framework (Adaptive measurements) for the task, and interprets a long line of prior work under this lense. At a high level, these works solve the min max problem in Equation 1.   Given this formulation, the paper proposes two algorithms, PEP and GEM. PEP selects a maximum entropy distribution to minimize the error for a given query set by solving the dual of the constrained optimization problem. They offer an iterative algorithm for this.  To avoid the exponential runtime of approaches like PEP (because they maintain a distribution over entire data domains), the paper also proposes GEM, which uses a generator network to represent this high dimensional space.  GEM can easily incorporate public data (with various missingness) by using it for pretraining.   Empirically, GEM outperforms prior work in accuracy to privacy tradeoffs on ACS and the adult datasets, and is more robust to domain shift in the public data than PMW or PEP. This gain is most pronounced when the data is high dimensional.  # Summary of contributions  The paper studies the problem of synthesizing differentially private (DP) data for query release. Here we are given a sensitive dataset $P$ together with a set $\mathcal{Q}$ of queries of interest. The goal is to generate a DP synthetic dataset $D$ so that answering the queries using $D$ gives similar answers to those of $P$; more formally, we want to minimize the maximum error across the queries, i.e. $\max_{q \in \mathcal{Q}} |q(P) - q(D)|$. Several works have proposed algorithms for this problem, including MWEM [Hardt et al., NeurIPS'12] and FEM [Vietri et al., ICML'20].  The first contribution of the paper is in observing that essentially the previously proposed algorithms all fit into a single framework which they call "Adaptive Measurements". Specifically, the algorithm proceeds in iterations and, in each iteration, it uses the exponential mechanism to select one or more queries, asks for noisy values of those queries and it then updates the current synthetic dataset $D$ by minimizing some objective (which involves the answers to the queries so far and the current guess dataset).  With the above in mind, the authors then decide a new algorithm which fits into this framework called Private Entropy Projection (PEP) algorithm. At each step, PEP tries to find the distribution $D$ with maximum entropy among those whose max error w.r.t. the noisy measurements is at most $\gamma$ for some parameter $\gamma$. The authors note that PEP also gives exponentially weighted distributions, similar to MWEM, but the weights are more elaborated. Empirically, the authors show that PEP performs better than MWEM when $\epsilon$ is sufficiently large (and performs similarly for small $\epsilon$) on reduced versions of ADULT and ACS datasets for 3-way marginal queries.  The reason a reduced version of those datasets are used is because the original datasets have high-dimension, which is infeasible for MWEM or PEP since they have to keep the entire distribution explicitly. To overcome this, the authors propose a different algorithm called GEM which instead assume that the distribution is generated to some network $G_\theta$ with parameter $\theta$ (assuming that the inputs to the network is i.i.d. Gaussian). This can help reduce the computational cost dramatically since now only the network parameters $\theta$ is needed to be maintained. Here, GEM still works in the "Adaptive Measurements" framework and the authors use gradient descent to minimize the $\ell_1$ loss w.r.t. the noisy measurements so far. Note that this might not be easily differentiable for generic queries; fortunately, for k-way marginal queries, the authors point out that they are just product of the network's outputs and as a result the gradient can be easily found.  Finally, the authors consider the setting where there is some public data which one hopes to use to improve the quality of the synthetic dataset. Previous state-of-the-art called PMW$^{Pub}$ [Liu et al., 2021] simply uses limits the distribution to only those on the _support_ of the public data and runs MWEM. This has several limitations, such as when the support of the public data is not sufficient to express the sensitive data, or when some features are missing in the public dataset. The authors show that a modified version of GEM (called GEM$^{Pub}$) is more amenable for these cases: just use the public data to find an initial generator network, and then proceed with the GEM algorithm as usual. They demonstrate that this approach indeed works well in practice: although the performances of GEM$^{Pub}$ and PMW$^{Pub}$ are similar for large & similarly-distributed public data, GEM$^{Pub}$ significantly outperforms PMW$^{Pub}$ when public data is incomplete or its support not closely resembling the sensitive data.
abstractText: We study private synthetic data generation for query release, where the goal is to construct a sanitized version of a sensitive dataset, subject to differential privacy, that approximately preserves the answers to a large collection of statistical queries. We first present an algorithmic framework that unifies a long line of iterative algorithms in the literature. Under this framework, we propose two new methods. Our first method, generative networks with the exponential mechanism (GEM), circumvents computational bottlenecks in algorithms such as MWEM by optimizing over generative models parameterized by neural networks, which capture a rich family of distributions while enabling fast gradient-based optimization. The second method, private entropy projection (PEP), can be viewed as an advanced variant of MWEM that adaptively reuses past query measurements to boost accuracy. We demonstrate that GEM and PEP empirically outperform existing algorithms. Furthermore, we show that GEM nicely incorporates prior information from public data while overcoming limitations of PMWPub, the existing state-of-the-art method that also leverages public data.
authors.name: Terrance Liu
authors.name: Giuseppe Vietri
authors.name: Zhiwei Steven Wu
references.authors: John M. Abowd
references.title: The U.S. census bureau adopts differential privacy
references.venue: In ACM International Conference on Knowledge Discovery & Data Mining,
references.authors: Noga Alon Raef Bassily Shay Moran
references.title: Limits of private learning with access to public data
references.venue: Advances in Neural Information Processing Systems,
references.authors: Sergul Aydore William Brown Michael Kearns Krishnaram Kenthapadi Luca Melis Aaron Roth Ankit Siva
references.title: Differentially private query release through adaptive projection
references.venue: arXiv preprint arXiv:2103.06641,
references.authors: Raef Bassily Albert Cheu Shay Moran Aleksandar Nikolov Jonathan R. Ullman Zhiwei Steven Wu
references.title: Private query release assisted by public data
references.venue: In Proceedings of the 37th International Conference on Machine Learning,
references.authors: Raef Bassily Shay Moran Anupama Nandi
references.title: Learning from mixtures of private and public populations
references.venue: Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems
references.authors: Brett K Beaulieu-Jones Zhiwei Steven Wu Chris Williams Ran Lee Sanjeev P Bhavnani James Brian Byrd Casey S Greene
references.title: Privacy-preserving generative deep neural networks support clinical data sharing. Circulation: Cardiovascular Quality and Outcomes
references.authors: Avrim Blum Katrina Ligett Aaron Roth
references.title: A learning theory approach to non-interactive database privacy
references.venue: Proceedings of the 40th Annual ACM Symposium on Theory of Computing,
references.authors: Mark Bun Thomas Steinke
references.title: Concentrated differential privacy: Simplifications, extensions, and lower bounds
references.venue: In Proceedings of the 14th Conference on Theory of Cryptography, TCC ’16-B,
references.authors: Mark Bun Jonathan Ullman Salil Vadhan
references.title: Fingerprinting codes and the price of approximate differential privacy
references.venue: SIAM Journal on Computing,
references.authors: Mark Cesar Ryan Rogers
references.title: Unifying privacy loss composition for data analytics
references.venue: arXiv preprint arXiv:2004.07223,
references.authors: Dheeru Dua Casey Graff
references.title: UCI machine learning repository, 2017
references.venue: URL http://archive. ics.uci.edu/ml
references.authors: Cynthia Dwork Guy N. Rothblum
references.title: Concentrated differential privacy, 2016
references.authors: Cynthia Dwork Frank McSherry Kobbi Nissim Adam Smith
references.title: Calibrating noise to sensitivity in private data analysis
references.venue: In Proceedings of the 3rd Conference on Theory of Cryptography,
references.authors: Cynthia Dwork Moni Naor Omer Reingold Guy N. Rothblum Salil Vadhan
references.title: On the complexity of differentially private data release: Efficient algorithms and hardness results
references.venue: In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing,
references.authors: Alexander Edmonds Aleksandar Nikolov Jonathan Ullman
references.title: The power of factorization mechanisms in local and central differential privacy
references.venue: In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing,
references.authors: Ferdinando Fioretto Cuong Tran Pascal Van Hentenryck
references.title: Decision making with differential privacy under a fairness lens
references.venue: arXiv preprint arXiv:2105.07513,
references.authors: Marco Gaboardi Emilio Jesús Gallego Arias Justin Hsu Aaron Roth Zhiwei Steven Wu
references.title: Dual query: Practical private query release for high dimensional data
references.venue: In International Conference on Machine Learning,
references.authors: Anupam Gupta Aaron Roth Jonathan Ullman
references.title: Iterative constructions and private data release
references.venue: In Proceedings of the 9th International Conference on Theory of Cryptography, TCC’12,
references.authors: Moritz Hardt Guy N Rothblum
references.title: A multiplicative weights mechanism for privacy-preserving data analysis
references.venue: IEEE 51st Annual Symposium on Foundations of Computer Science,
references.authors: Moritz Hardt Katrina Ligett Frank Mcsherry
references.title: A simple and practical algorithm for differentially private data release
references.venue: Advances in Neural Information Processing Systems,
references.authors: Ron Jarmin
references.title: Census bureau continues to boost data safeguards
references.venue: U.S. Census: Random Samplings Blog. URL https://www.census.gov/newsroom/blogs/random-samplings/2019/07/ boost-safeguards.html
references.authors: Daniel Kifer
references.title: Consistency with external knowledge: The topdown algorithm, 2019
references.venue: http: //www.cse.psu.edu/~duk17/papers/topdown.pdf
references.authors: Chao Li Gerome Miklau Michael Hay Andrew Mcgregor Vibhor Rastogi
references.title: The matrix mechanism: Optimizing linear counting queries under differential privacy
references.venue: The VLDB Journal,
references.authors: Terrance Liu Giuseppe Vietri Thomas Steinke Jonathan Ullman Zhiwei Steven Wu
references.title: Leveraging public data for practical private query release
references.venue: arXiv preprint arXiv:2102.08598,
references.authors: Andre Martins Ramon Astudillo
references.title: From softmax to sparsemax: A sparse model of attention and multi-label classification
references.venue: In International conference on machine learning,
references.authors: Ryan McKenna Gerome Miklau Michael Hay Ashwin Machanavajjhala
references.title: Optimizing error of high-dimensional statistical queries under differential privacy
references.venue: Proc. VLDB Endow.,
references.authors: Ryan McKenna Daniel Sheldon Gerome Miklau
references.title: Graphical-model based estimation and inference for differential privacy
references.venue: In International Conference on Machine Learning,
references.authors: Marcel Neunhoeffer Steven Wu Cynthia Dwork
references.title: Private post-{gan} boosting
references.venue: In International Conference on Learning Representations,
references.authors: Aleksandar Nikolov Kunal Talwar Li Zhang
references.title: The geometry of differential privacy: The sparse and approximate cases
references.venue: In Proceedings of the Forty-Fifth Annual ACM Symposium on Theory of Computing,
references.authors: Adam Paszke Sam Gross Francisco Massa Adam Lerer James Bradbury Gregory Chanan Trevor Killeen Zeming Lin Natalia Gimelshein Luca Antiga Alban Desmaison Andreas Kopf Edward Yang Zachary DeVito Martin Raison Alykhan Tejani Sasank Chilamkurthy Benoit Steiner Lu Fang Junjie Bai Soumith Chintala
references.title: Pytorch: An imperative style, highperformance deep learning library
references.venue: Advances in Neural Information Processing Systems
references.authors: Aaron Roth Tim Roughgarden
references.title: Interactive privacy via the median mechanism
references.venue: Proceedings of the 42nd ACM Symposium on Theory of Computing,
references.authors: S Ruggles
references.title: Ipums usa: Version 10.0
references.venue: doi: 10.18128/d010. V10
references.authors: Jonathan Ullman
references.title: Answering n<sub>2+o(1)</sub> counting queries with differential privacy is hard
references.venue: In Proceedings of the Forty-Fifth Annual ACM Symposium on Theory of Computing,
references.authors: Jonathan Ullman
references.title: Private multiplicative weights beyond linear queries
references.venue: In Proceedings of the 34th ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems,
references.authors: Jonathan Ullman Salil Vadhan
references.title: Pcps and the hardness of generating private synthetic data
references.venue: In Theory of Cryptography Conference,
references.authors: Jonathan Ullman Salil Vadhan
references.title: Pcps and the hardness of generating private synthetic data
references.venue: In Yuval Ishai, editor, Theory of Cryptography,
references.authors: Giuseppe Vietri Grace Tian Mark Bun Thomas Steinke Steven Wu
references.title: New oracle-efficient algorithms for private synthetic data release
references.venue: In International Conference on Machine Learning,
references.authors: Ronald J Williams
references.title: Simple statistical gradient-following algorithms for connectionist reinforcement learning
references.venue: Machine learning,
references.authors: Liyang Xie Kaixiang Lin Shu Wang Fei Wang Jiayu Zhou
references.title: Differentially private generative adversarial network
references.venue: CoRR, abs/1802.06739,
references.authors: Yasin Yazıcı Chuan-Sheng Foo Stefan Winkler Kim-Hui Yap Georgios Piliouras Vijay Chandrasekhar
references.title: The unusual effectiveness of averaging in gan training
references.venue: arXiv preprint arXiv:1806.04498,
references.authors: Jinsung Yoon James Jordon Mihaela van der Schaar
references.title: PATE-GAN: Generating synthetic data with differential privacy guarantees
references.venue: In International Conference on Learning Representations,
sections.heading: 1 Introduction
sections.text: As the collection and analyses of sensitive data become more prevalent, there is an increasing need to protect individuals’ private information. Differential privacy [15] is a rigorous and meaningful criterion for privacy preservation that enables quantifiable trade-offs between privacy and accuracy. In recent years, there has been a wave of practical deployments of differential privacy across organizations such as Google, Apple, and most notably, the U.S. Census Bureau [3].
  In this paper, we study the problem of differentially private query release: given a large collection of statistical queries, the goal is to release approximate answers subject to the constraint of differential privacy. Query release has been one of the most fundamental and practically relevant problems in differential privacy. For example, the release of summary data from the 2020 U.S. Decennial Census can be framed as a query release problem. We focus on the approach of synthetic data generation—that is, generate a privacy-preserving "fake" dataset, or more generally a representation of a probability distribution, that approximates all statistical queries of interest. Compared to simple Gaussian or Laplace mechanisms that perturb the answers directly, synthetic data methods can provably answer an exponentially larger collection of queries with non-trivial accuracy. However, their statistical advantage also comes with a computational cost. Prior work has shown that achieving better accuracy than simple Gaussian perturbation is intractable in the worst case even for the simple query class of 2-way marginals that release the marginal distributions for all pairs of attributes [38].
  ∗First two authors contributed equally.
  35th Conference on Neural Information Processing Systems (NeurIPS 2021).
  Despite its worst-case intractability, there has been a recent surge of work on practical algorithms for generating private synthetic data. Even though they differ substantially in details, these algorithms share the same iterative form that maintains and improves a probability distribution over the data domain: identifying a small collection of high-error queries each round and updating the distribution to reduce these errors. Inspired by this observation, we present a unifying algorithmic framework that captures these methods. Furthermore, we develop two new algorithms, GEM and PEP, and extend the former to the setting in which public data is available. We summarize our contributions below:
  Unifying algorithmic framework. We provide a framework that captures existing iterative algorithms and their variations. At a high level, algorithms under this framework maintain a probability distribution over the data domain and improve it over rounds by optimizing a given loss function. We therefore argue that under this framework, the optimization procedures of each method can be reduced to what loss function is minimized and how its distributional family is parameterized. For example, we can recover existing methods by specifying choices of loss functions—we rederive MWEM [21] using an entropy-regularized linear loss, FEM [40] using a linear loss with a linear perturbation, and DualQuery [19] with a simple linear loss. Lastly, our framework lends itself naturally to a softmax variant of RAP [5], which we show outperforms RAP itself.2
  Generative networks with the exponential mechanism (GEM). GEM is inspired by MWEM, which attains worst-case theoretical guarantees that are nearly information-theoretically optimal [11]. However, MWEM maintains a joint distribution over the data domain, resulting in a runtime that is exponential in the dimension of the data. GEM avoids this fundamental issue by optimizing the absolute loss over a set of generative models parameterized by neural networks. We empirically demonstrate that in the high-dimensional regime, GEM outperforms all competing methods.
  Private Entropy Projection (PEP). The second algorithm we propose is PEP, which can be viewed as a more advanced version of MWEM with an adaptive and optimized learning rate. We show that PEP minimizes a regularized exponential loss function that can be efficiently optimized using an iterative procedure. Moreover, we show that PEP monotonically decreases the error over rounds and empirically find that it achieves higher accuracy and faster convergence than MWEM.
  Incorporating public data. Finally, we consider extensions of our methods that incorporate prior information in publicly available datasets (e.g., previous data releases from the American Community Survey (ACS) prior to their differential privacy deployment). While Liu et al. [26] has established PMWPub as a state-of-the-art method for incorporating public data into private query release, we discuss how limitations of their algorithm prevent PMWPub from effectively using certain public datasets. We then demonstrate empirically that GEM circumvents such issues via simple pretraining, achieving max errors on 2018 ACS data for Pennsylvania (at ε = 1) 9.23x lower than PMWPub when using 2018 ACS data for California as the public dataset.
sections.heading: 1.1 Related work
sections.text: Beginning with the seminal work of Blum et al. [9], a long line of theoretical work has studied private synthetic data for query release [33, 21, 22, 20]. While this body of work establishes optimal statistical rates for this problem, their proposed algorithms, including MWEM [22], typically have running time exponential in the dimension of the data. While the worst-case exponential running time is necessary (given known lower bounds [16, 36, 39]), a recent line of work on practical algorithms leverage optimization heuristics to tackle such computational bottlenecks [19, 40, 5]. In particular, DualQuery [19] and FEM [40] leverage integer program solvers to solve their NP-hard subroutines, and RAP [5] uses gradient-based methods to solve its projection step. In Section 3, we demonstrate how these algorithms can be viewed as special cases of our algorithmic framework. Our work also relates to a growing line of work that use public data for private data analyses [6, 4, 7]. For query release, our algorithm, GEM, improves upon the state-of-the-art method, PMWPub [26], which is more limited in the range of public datasets it can utilize. Finally, our method GEM is related to a line
  2We note that Aydore et al. [5] have since updated the original version (https://arxiv.org/pdf/2103. 06641v1.pdf) of their work to include a modified version of RAP that leverages SparseMax [27], similar to way in which the softmax function is applied in our proposed baseline, RAPsoftmax.
  of work on differentially private GANs [8, 44, 30, 42]. However, these methods focus on generating synthetic data for simple downstream machine learning tasks rather than for query release.
  Beyond synthetic data, a line of work on query release studies "data-independent" mechanisms (a term formulated in Edmonds et al. [17]) that perturb the query answers with noise drawn from a data-independent distribution (that may depend on the query class). This class of algorithms includes the matrix mechanism [25], the high-dimensional matrix mechanism (HDMM) [28], the projection mechanism [31], and more generally the class of factorization mechanisms [17]. In addition, McKenna et al. [29] provide an algorithm that can further reduce query error by learning a probabilistic graphical model based on the noisy query answers released by privacy mechanisms.
sections.heading: 2 Preliminaries
sections.text: Let X denote a finite d-dimensional data domain (e.g., X = {0, 1}d). Lete U be the uniform distribution over the domain X . Throughout this work, we assume a private dataset P that contains the data of n individuals. For any x ∈ X , we represent P (x) as the normalized frequency of x in dataset P such that ∑ x∈X P (x) = 1. One can think of a dataset P either as a multi-set of items from X or as a distribution over X . We consider the problem of accurately answering an extensive collection of linear statistical queries (also known as counting queries) about a dataset. Given a finite set of queries Q, our goal is to find a synthetic dataset D such that the maximum error over all queries in Q, defined as maxq∈Q |q(P )− q(D)|, is as small as possible. For example, one may query a dataset by asking the following: how many people in a dataset have brown eyes? More formally, a statistical linear query qφ is defined by a predicate function φ : X → {0, 1}, as qφ(D) = ∑ x∈X φ(x)D(x) for any normalized dataset D. Below, we define an important, and general class of linear statistical queries called k-way marginals. Definition 1 (k-way marginal). Let the data universe with d categorical attributes be X = (X1 × . . .×Xd), where each Xi is the discrete domain of the ith attribute Ai. A k-way marginal query is defined by a subset S ⊆ [d] of k features (i.e., |S| = k) plus a target value y ∈ ∏ i∈S Xi for each feature in S. Then the marginal query φS,y(x) is given by:
  φS,y(x) = ∏ i∈S 1 (xi = yi)
  where xi ∈ Xi means the i-th attribute of record x ∈ X . Each marginal has a total of ∏k i=1 |Xi| queries, and we define a workload as a set of marginal queries.
  We consider algorithms that input a dataset P and produce randomized outputs that depend on the data. The output of a randomized mechanismM : X ∗ → R is a privacy preserving computation if it satisfies differential privacy (DP) [15]. We say that two datasets are neighboring if they differ in at most the data of one individual. Definition 2 (Differential privacy [15]). A randomized mechanism M : Xn → R is (ε, δ)differentially privacy, if for all neighboring datasets P, P ′ (i.e., differing on a single person), and all measurable subsets S ⊆ R we have:
  Pr [M(P ) ∈ S] ≤ eεPr [M(P ′) ∈ S] + δ
  Finally, a related notion of privacy is called concentrated differential privacy (zCDP) [14, 10], which enables cleaner composition analyses for privacy. Definition 3 (Concentrated DP, Dwork and Rothblum [14], Bun and Steinke [10]). A randomized mechanismM : Xn → R is 12 ε̃
  2-CDP, if for all neighboring datasets P, P ′ (i.e., differing on a single person), and for all α ∈ (1,∞),
  Rα (M(P ) ‖ M(P ′)) ≤ 1
  2 ε̃2α
  where Rα (M(P ) ‖ M(P ′)) is the Rényi divergence between the distributionsM(P ) andM(P ′).
sections.heading: 3 A Unifying Framework for Private Query Release
sections.text: In this work, we consider the problem of finding a distribution in some family of distributions D that achieves low error on all queries. More formally, given a private dataset P and a query set Q, we
  solve an optimization problem of the form:
  min D∈D max q∈Q |q(P )− q(D)| (1)
  In Algorithm 1, we introduce Adaptive Measurements, which serves as a general framework for solving (1). At each round t, the framework uses a private selection mechanism to choose k queries Q̃t = {q̃t,1, . . . , q̃t,k} with higher error from the set Q. It then obtains noisy measurements for the queries, which we denote by Ãt = {ãt,1, . . . , ãt,k}, where ãt,i = q̃t,i + zt,i and zt,i is random Laplace or Gaussian noise. Finally, it updates its approximating distribution Dt, subject to a loss function L that depends on Q̃1:t = ⋃t i=1 Q̃i and Ã1:t = ⋃t i=1 Ãi. We note that L serves as a surrogate problem to (1) in the sense that the solution of minD∈D L(D) is an approximate solution for (1). We list below the corresponding loss functions for various algorithms in the literature of differentially private synthetic data. (We defer the derivation of these loss functions to the appendix.)
  MWEM from Hardt et al. [22] MWEM solves an entropy regularized minimization problem:
  LMWEM(D, Q̃1:t, Ã1:t) = t∑ i=1 ∑ x∈X D(x)q̃i(x) (ãi − q̃i(Di−1)) + ∑ x∈X D(x) logD(x)
  We note that PMWPub [26] optimizes the same problem but restrictsD to distributions over the public data domain while initializing D0 to be the public data distribution.
  DualQuery from Gaboardi et al. [19] At each round t, DualQuery samples s queries (Q̃t = {q̃t,1, . . . q̃t,s}) from Qt and outputs Dt that minimizes the the following loss function:
  LDualQuery(D, Q̃t) = s∑ i=1 q̃t,i(D)
  FEM from Vietri et al. [40] The algorithm FEM employs a follow the perturbed leader strategy, where on round t, FEM chooses the next distribution by solving:
  LFEM(D, Q̃1:t) = t∑ i=1 q̃t(D) + Ex∼D,η∼Exp(σ)d (〈x, η〉)
  RAPsoftmax adapted from Aydore et al. [5] We note that RAP follows the basic structure of Adaptive Measurements, where at iteration t, RAP solves the following optimization problem:
  LRAP(D, Q̃1:t, Ã1:t) = ∑ i,j (q̃i,j(D)− ãi,j)2
  However, rather than outputting a dataset that can be expressed as some distribution over X , RAP projects the noisy measurements onto a continuous relaxation of the binarized feature space of X , outputting D ∈ [−1, 1]n′×d (where n′ is an additional parameter). Therefore to adapt RAP to Adaptive Measurements, we propose a new baseline algorithm that applies the softmax function instead of clipping each dimension of D to be between −1 and 1. For more details, refer to Section 4 and Appendix B, where describe how softmax is applied in GEM in the same way. With this slight modification, this algorithm, which we denote as RAPsoftmax, fits nicely into the
  Adaptive Measurements framework in which we output a synthetic dataset drawn from some probabilistic family of distributions D = { σ(M)|M ∈ Rn′×d } .
  Algorithm 1: Adaptive Measurements Input: Private dataset P with n records, set of linear queries Q, distributional family D, loss
  functions L, number of iterations T Initialize distribution D0 ∈ D for t = 1, . . . , T do
  Sample: For i ∈ [k], choose q̃t,i using a differentially private selection mechanism. Measure: For i ∈ [k], let ãt,i = q̃t,i(P ) + zt,i where z is Gaussian or Laplace noise Update: Let Q̃t = {q̃t,1, . . . , q̃t,k} and Ãt = {ãt,1, . . . , ãt,k}. Update distribution D:
  Dt ← arg minD∈D L ( Dt−1, Q̃1:t, Ã1:t ) where Q̃1:t = ⋃t i=1 Q̃i and Ã1:t = ⋃t i=1 Ãi.
  end Output H ( {Dt}Tt=0 ) where H is some function over all distributions Dt (such as the average)
  Finally, we note that in addition to the loss function L, a key component that differentiates algorithms under this framework is the distributional family D that the output of each algorithm belongs to. We refer readers to Appendix A.2, where we describe in more detail how existing algorithms fit into our general framework under different choices of L and D.
sections.heading: 3.1 Privacy analysis
sections.text: We present the privacy analysis of the Adaptive Measurements framework while assuming that the exponential and Gaussian mechanism are used for the private sample and noisy measure steps respectively. More specifically, suppose that we (1) sample k queries using the exponential mechanism with the score function:
sections.heading: Pr [q̃t,i = q] ∝ exp (αε0n|q(P )− q(Dt−1)|)
sections.text: and (2) measure the answer to each query by adding Gaussian noise
  zt,i ∼ N ( 0, ( 1
  n(1− α)ε0
  )2) .
  Letting ε0 = √
  2ρ
  T(α2+(1−α)2) and α ∈ (0, 1) be a privacy allocation hyperparameter (higher values
  of α allocate more privacy budget to the exponential mechanism), we present the following theorem: Theorem 1. When run with privacy parameter ρ, Adaptive Measurements satisfies ρ-zCDP. Moreover for all δ > 0, Adaptive Measurements satisfies(ε(δ), δ)-differential privacy, where ε(δ) ≤ ρ+ 2 √ ρ log(1/δ).
  Proof sketch. Fix T ≥ 1 and α ∈ (0, 1). (i) At each iteration t ∈ [T ], Adaptive Measurements runs the exponential mechanism k times with parameter 2αε0, which satisfies k8 (2αε0) 2 = k2 (αε0)
  2- zCDP [12], and the Gaussian mechanism k times with parameter (1 − α)ε0, which satisfies k 2 [(1− α)ε0]
  2-zCDP [10]. (ii) using the composition theorem for concentrated differential privacy [10], Adaptive Measurements satisfies kT2 [ α2 + (1− α)2 ] ε20-zCDP after T iterations. (iii) Set-
  ting ε0 = √
  2ρ
  kT(α2+(1−α)2) , we conclude that Adaptive Measurements satisfies ρ-zCDP, which in turn implies ( ρ+ 2 √ ρ log(1/δ), δ ) -differential privacy for all δ > 0 [10].
sections.heading: 4 Overcoming Computational Intractability with Generative Networks
sections.text: We introduce GEM (Generative Networks with the Exponential Mechanism), which optimizes over past queries to improve accuracy by training a generator network Gθ to implicitly learn a distribution
  of the data domain, where Gθ can be any neural network parametrized by weights θ. As a result, our method GEM can compactly represent a distribution for any data domain while enabling fast, gradient-based optimization via auto-differentiation frameworks [32, 2].
  Concretely, Gθ takes random Gaussian noise vectors z as input and outputs a representation Gθ(z) of a product distribution over the data domain. Specifically, this product distribution representation takes the form of a d′-dimensional probability vector Gθ(z) ∈ [0, 1]d ′ , where d′ is the dimension of the data in one-hot encoding and each coordinate Gθ(z)j corresponds to the marginal probability of a categorical variable taking on a specific value. To obtain this probability vector, we choose softmax as the activation function for the output layer in Gθ. Therefore, for any fixed weights θ, Gθ defines a distribution over X through the generative process that draws a random z ∼ N (0, σ2I) and then outputs random x drawn from the product distribution Gθ(z). We will denote this distribution as Pθ.
  To define the loss function for GEM, we require that it be differentiable so that we can use gradientbased methods to optimize Gθ. Therefore, we need to obtain a differentiable variant of q. Recall first that a query is defined by some predicate function φ : X → {0, 1} over the data domain X that evaluates over a single row x ∈ X . We observe then that one can extend any statistical query q to be a function that maps a distribution Pθ over X to a value in [0, 1]:
  q(Pθ) = Ex∼Pθ [φ(x)] = ∑ x∈X φ(x)Pθ(x) (2)
  Note that any statistical query q is then differentiable w.r.t. θ:
  ∇θ [q(Pθ)] = ∑ x∈X ∇θPθ(x)φ(x) = Ez∼N(0,Ik) ∑ x∈X φ(x)∇θ 1 k k∑ i d′∏ j=1 (Gθ(zi)j) xj  and we can compute stochastic gradients of q w.r.t. θ with random noise samples z. This also allows us to derive a differentiable loss function in the Adaptive Measurements framework. In each round t, given a set of selected queries Q̃1:t and their noisy measurements Ã1:t, GEM minimizes the following `1-loss:
  LGEM ( θ, Q̃1:t, Ã1:t ) = t∑ i=1 |q̃i(Pθ)− ãi| . (3)
  where q̃i ∈ Q̃1:t and ãi ∈ Ã1:t.
  In general, we can optimize LGEM by running stochastic (sub)-gradient descent. However, we remark that gradient computation can be expensive since obtaining a low-variance gradient estimate often requires calculating∇θPθ(x) for a large number of x. In Appendix B, we include the stochastic gradient derivation for GEM and briefly discuss how an alternative approach from reinforcement learning.
  For many query classes, however, there exists some closed-form, differentiable function surrogate to (3) that evaluates q(Gθ(z)) directly without operating over all x ∈ X . Concretely, we say that for certain query classes, there exists some representation fq : ∆(X )→ [0, 1] for q that operates in the probability space of X and is also differentiable. In this work, we implement GEM to answer k-way marginal queries, which have been one of the most important query classes for the query release literature [22, 40, 19, 26] and provides a differentiable form when extended to be a function over distributions. In particular, we show that k-way marginals can be rewritten as product queries (which are differentiable). Definition 4 (Product query). Let p ∈ Rd′ be a representation of a dataset (in the one-hot encoded space), and let S ⊆ [d′] be some subset of dimensions of p. Then we define a product query fS as
  fS(p) = ∏ j∈S pj (4)
  A k-way marginal query φ can then be rewritten as (4), where p = Gθ(z) and S is the subset of dimensions corresponding to the attributes A and target values y that are specified by φ (Definition 1). Thus, we can write any marginal query as ∏ j∈S Gθ(z)j , which is differentiable w.r.t. Gθ (and therefore differentiable w.r.t weights θ by chain rule). Gradient-based optimization techniques can then be used to solve (3); the exact details of our implementation can be found in Appendix B.
sections.heading: 5 Maximum-Entropy Projection Algorithm
sections.text: Next, we propose PEP (Private Entropy Projection) under the framework Adaptive Measurements. Similar to MWEM, PEP employs the maximum entropy principle, which also recovers a synthetic data distribution in the exponential family. However, since PEP adaptively assigns weights to past queries and measurements, it has faster convergence and better accuracy than MWEM. PEP’s loss function in Adaptive Measurements can be derived through a constrained maximum entropy optimization problem. At each round t, given a set of selected queries Q̃1:t and their noisy measurements Ã1:t, the constrained optimization requires that the synthetic data Dt satisfies γ-accuracy with respect to the noisy measurements for all the selected queries in Q̃1:t. Then among the set of feasible distributions that satisfy accuracy constraints, PEP selects the distribution with maximum entropy, leading to the following regularized constraint optimization problem:
  minimize: ∑ x∈X D(x) log (D(x)) (5)
  subject to: ∀i∈[t] |ãi − q̃i(D)| ≤ γ, ∑ x∈X D(x) = 1
  We can ignore the constraint that ∀x∈XD(x) ≥ 0, because it will be satisfied automatically. The solution of (5) is an exponentially weighted distribution parameterized by the dual variables λ1, . . . , λt corresponding to the t constraints. Therefore, if we solve the dual problem of (5) in terms of the dual variables λ1, . . . , λt, then the distribution that minimizes (5) is given by Dt(x) ∝ exp (∑t i=1 λiq̃i(x) ) . (Note that MWEM simply sets λi = ãi− q̃i(Dt−1) without any optimization.) Given that the set of distributions is parameterized by the variables λ1, . . . , λt, the constrained optimization is then equivalent to minimizing the following exponential loss function:
  LPEP ( λ, Q̃1:t, Ã1:t ) = log (∑ x∈X exp ( t∑ i=1 λi (q̃i(x)− ãi) )) + γ‖λ‖1
  Since PEP requires solving this constrained optimization problem on each round, we give an efficient iterative algorithm for solving (5). We defer the details of the algorithm to the Appendix C.
  6 Extending to the public-data-assisted setting
  Incorporating prior information from public data has shown to be a promising avenue for private query release [6, 26]. Therefore, we extend GEM to the problem of public-data-assisted private (PAP) query release [6] in which differentially private algorithms have access to public data. Concretely, we adapt GEM to utilize public data by initializing D0 to a distribution over the public dataset. However, because in GEM, we implicitly model any given distribution using a generator G, we must first train without privacy (i.e., without using the exponential and Gaussian mechanisms) a generator Gpub, to minimize the `1-error over some set of queries Q̂. Note that in most cases, we can simply let Q̂ = Q where Q is the collection of statistical queries we wish to answer privately. GEMPub then initializes G0 to Gpub and proceeds with the rest of the GEM algorithm.
  6.1 Overcoming limitations of PMWPub.
  We describe the limitations of PMWPub by providing two example categories of public data that it fails to use effectively. We then describe how GEMPub overcomes such limitations in both scenarios.
  Public data with insufficient support. We first discuss the case in which the public dataset has an insufficient support, which in this context means the support has high best-mixture-error [26]. Given some support S ⊆ X , the best-mixture-error can be defined as
  min µ∈∆(S) max q∈Q ∣∣∣∣∣q (D)−∑ x∈S µxq(x) ∣∣∣∣∣
  where µ ∈ ∆(S) is a distribution over the set S with µ(x) ≥ 0 for all x ∈ S and ∑ x∈S µ(x) = 1.
  In other words, the best-mixture-error approximates the lowest possible max error that can be achieved by reweighting some support, which in this case means PMWPub cannot achieve max errors lower that this value. While Liu et al. [26] offer a solution for filtering out poor public datasets ahead of time using a small portion of the privacy budget, PMWPub cannot be run effectively if no other suitable public datasets exist. GEMPub however avoids this issue altogether because unlike MWEM (and therefore PMWPub), which cannot be run without restricting the size of D, GEMPub can utilize public data without restricting the distributional family it can represent (since both GEM and GEMPub compactly parametrize any distribution using a neural network).
  Public data with incomplete data domains. Next we consider the case in which the public dataset only has data for a subset of the attributes found in the private dataset. We note that as presented in Liu et al. [26], PMWPub cannot handle this scenario. One possible solution is to augment the public data distribution by assuming a uniform distribution over all remaining attributes missing in the public dataset. However, while this option may work in cases where only a few attributes are missing, the missing support grows exponentially in the dimension of the missing attributes. In contrast, GEMPub can still make use of such public data. In particular, we can pretrain a generator G on queries over just the attributes found in the public dataset. Again, GEMPub avoids the computational intractability of PMWPub in this setting since it parametrizes its output distribution with G.
sections.heading: 7 Empirical Evaluation
sections.text: In this section, we empirically evaluate GEM and PEP against baseline methods on the ACS [34] and ADULT [13] datasets in both the standard3 and public-data-assisted settings.
  Data. To evaluate our methods, we construct public and private datasets from the ACS and ADULT datasets by following the preprocessing steps outlined in Liu et al. [26]. For the ACS, we use 2018 data for the state of Pennsylvania (PA-18) as the private dataset. For the public dataset, we select 2010 data for Pennsylvania (PA-10) and 2018 data for California (CA-18). In our experiments on the ADULT dataset, private and public datasets are sampled from the complete dataset (using a 90-10 split). In addition, we construct low-dimensional versions of both datasets, which we denote as ACS (reduced) and ADULT (reduced), in order to evaluate PEP and MWEM.
  Baselines. We compare our algorithms to the strongest performing baselines in both low and highdimensional settings, presenting results for MWEM, DualQuery, and RAPsoftmax in the standard setting45 and PMWPub in the public-data-assisted setting.
  Experimental details. To present a fair comparison, we implement all algorithms using the privacy mechanisms and zCDP composition described in Section 3.1. To implement GEM for k-way marginals, we select a simple multilayer perceptron for Gθ. Our implementations of MWEM and PMWPub output the last iterate Dt instead of the average and apply the multiplicative weights update rule using past queries according to the pseudocode described in Liu et al. [26]. We report the best performing 5-run average across hyperparameter choices (see Tables 1, 2, 3, 4, and 5 in Appendix D.1) for each algorithm.
sections.heading: 7.1 Results
sections.text: Standard setting. In Figure 1, we observe that in low-dimensional settings, PEP and GEM consistently achieve strong performance compared to the baseline methods. While MWEM and PEP are similar in nature, PEP outperforms MWEM on both datasets across all privacy budgets except
  3We refer readers to Appendix D.7 where we include an empirical evaluation on versions of the ADULT and LOANS [13] datasets used in other related private query release works [28, 40, 5].
  4Having consulted McKenna et al. [28], we concluded that running HDMM is infeasible for our experiments, since it generally cannot handle a data domain with size larger than 109. See Appendix D.5 for more details.
  5Because RAP performs poorly relative to the other methods in our experiments, plotting its performance would make visually comparing the other methods difficult. Thus, we exclude it from Figure 1 and refer readers to Appendix D.3, where we present failure cases for RAP and compare it to RAPsoftmax.
  ε ∈ {0.1, 0.15} on ACS (reduced), where the two algorithms perform similarly. In addition, both PEP and GEM outperform RAPsoftmax. Moving on to the more realistic setting in which the data dimension is high, we again observe that GEM outperforms RAPsoftmax on both datasets.
  Public-data-assisted setting. To evaluate the query release algorithm in the public-data-assisted setting, we present the three following categories of public data:
  Public data with sufficient support. To evaluate our methods when the public dataset for ACS PA-18 has low best-mixture-error, we consider the public dataset ACS PA-10. We observe in Figure 1 that GEMPub performs similarly to PMWPub, with both outperforming GEM (without public data).
  Public data with insufficient support. In Figure 2a, we present CA-18 as an example of this failure case in which the best-mixture-error is over 10%, and so for any privacy budget, PMWPub cannot achieve max errors lower that this value. However, for the reasons described in Section 6.1, GEMPub is not restricted by best-mixture-error and significantly outperforms GEM (without public data) when using either public dataset.
  Public data with incomplete data domains. To simulate this setting, we construct a reduced version of the public dataset in which we keep only 7 out of 13 attributes in ADULT. In this case, 6 attributes are missing, and so assuming a uniform distribution over the missing attributes would cause the dimension of the approximating distribution D to grow from≈ 4.4×103 to a≈ 3.2×109. PMWPub would be computationally infeasible to run in this case. To evaluate GEMPub, we pretrain the generator G using all 3-way marginals on both the complete and reduced versions of the public
  dataset and then finetune on the private dataset (we denote these two finetuned networks as GEMPub and GEMPub (reduced) respectively). We present results in Figure 2b. Given that the public and private datasets are sampled from the same distribution, GEMPub unsurprisingly performs extremely well. However, despite only being pretrained on a small fraction of all 3-way marginal queries (≈ 20k out 334k), GEMPub (reduced) is still able to improve upon the performance of GEM and achieve lower max error for all privacy budgets.
sections.heading: 8 Conclusion
sections.text: In this work, we present a framework that unifies a long line of iterative private query release algorithms by reducing each method to a choice of some distributional family D and loss function L. We then develop two new algorithms, PEP and GEM, that outperform existing query release algorithms. In particular, we empirically validate that GEM performs very strongly in high dimensional settings (both with and without public data). We note that we chose a rather simple neural network architecture for GEM, and so for future work, we hope to develop architectures more tailored to our problem. Furthermore, we hope to extend our algorithms to other query classes, including mixed query classes and convex minimization problems [37].
  Limitations. While our empirical study is structured based on past work in the literature, real-world deployment of differential privacy may be more nuanced. For example, though GEM achieves strong performance on the ACS dataset in our experiments, we (and possibly the U.S. Census Bureau itself) do not know yet what the end goals of a differentially private ACS release should be. Given different constraints or evaluation metrics, it is possible for another technique to be more suitable.
  Broader impacts. We note that a possible consequence of privacy preserving methods is their potential to bring about unfair outcomes. Fioretto et al. [18], for example, show that decisions based on DP analyses may disproportionately impact certain groups. Because the U.S. Census Bureau has plans to adopt differential privacy for ACS releases after 2025 [23], the ACS dataset serves as the main test bed for our algorithms. We believe it is important to ensure that fairness is preserved for downstream tasks that use DP synthetic dataset, since the ACS provides statistics that are critical to many important decision processes (e.g., Title I grant allocations [1]).
sections.heading: Acknowledgments
sections.text: ZSW is supported by NSF grant SCC-1952085, Carnegie Mellon CyLab’s Secure and Private IoT Initiative, and a Google Faculty Research Award.
title: Iterative Methods for Private Synthetic Data: Unifying Framework and New Methods