[Paper Review] Differentially Private Generative Adversarial Network

Liyang Xie, Kaixiang Lin+3 more|arXiv (Cornell University)|Feb 19, 2018

Generative Adversarial Networks and Image SynthesisComputer Science30 references313 citations

TL;DR

DPGAN adds gradient-level noise within training of a GAN to provide differential privacy, producing high-quality samples while protecting training data.

ABSTRACT

Generative Adversarial Network (GAN) and its variants have recently attracted intensive research interests due to their elegant theoretical foundation and excellent empirical performance as generative models. These tools provide a promising direction in the studies where data availability is limited. One common issue in GANs is that the density of the learned generative distribution could concentrate on the training data points, meaning that they can easily remember training samples due to the high model complexity of deep networks. This becomes a major concern when GANs are applied to private or sensitive data such as patient medical records, and the concentration of distribution may divulge critical patient information. To address this issue, in this paper we propose a differentially private GAN (DPGAN) model, in which we achieve differential privacy in GANs by adding carefully designed noise to gradients during the learning procedure. We provide rigorous proof for the privacy guarantee, as well as comprehensive empirical evidence to support our analysis, where we demonstrate that our method can generate high quality data points at a reasonable privacy level.

Motivation & Objective

• Motivate privacy concerns when sharing GAN-generated data from sensitive domains like medicine.
• Propose a DP-GAN framework that provides formal differential privacy guarantees during GAN training.
• Show that privacy can be achieved by gradient-level noise addition and discriminator weight clipping.
• Demonstrate that DP-GAN can generate high-quality data under reasonable privacy budgets across benchmarks.

Proposed method

• Adopt Wasserstein GAN (WGAN) framework and add carefully designed gradient noise and clipping.
• Use moment accountant to bound the privacy loss and derive ε, δ guarantees.
• Clip discriminator weights to bound gradient norms and add Gaussian noise to gradient estimates.
• Prove that discriminator training with noise satisfies (ε, δ)-differential privacy and that post-processing yields private generator parameters.
• Demonstrate privacy guarantees via experiments on MNIST and MIMIC-III with varying ε values.

Experimental results

Research questions

• RQ1 Can a DP-GAN framework provide formal differential privacy guarantees during training?
• RQ2 How does gradient-level noise impact the quality of generated data across privacy budgets?
• RQ3 What is the relationship between privacy level (ε) and generation performance in DP-GAN?
• RQ4 Can the generator produce useful data without memorizing training samples under DP constraints?

Key findings

• DPGAN can generate high-quality data points at a reasonable privacy level while protecting training data.
• The Wasserstein distance converges during training and fluctuates more with stronger privacy (more noise).
• Generated data remain distinct from training samples, as shown by nearest-neighbor comparisons at varying ε.
• Classification tasks on MNIST using generated data show performance degrades with stronger privacy (smaller ε) due to noise.
• The framework generalizes to different network structures and datasets (MNIST and MIMIC-III).