Data-dependent PAC-Bayes priors via differential privacy

TL;DR

This paper introduces a method to derive valid PAC-Bayes generalization bounds using data-dependent priors chosen via differential privacy techniques, demonstrating empirical benefits over traditional bounds.

Contribution

It proposes a novel approach to obtain PAC-Bayes bounds with data-dependent priors through differential privacy, including practical mechanisms like SGLD for prior selection.

Findings

Data-dependent bounds can be nonvacuous where others are vacuous.

Differential privacy ensures valid PAC-Bayes bounds with data-dependent priors.

Empirical results show improved generalization bounds in practice.

Abstract

The Probably Approximately Correct (PAC) Bayes framework (McAllester, 1999) can incorporate knowledge about the learning algorithm and (data) distribution through the use of distribution-dependent priors, yielding tighter generalization bounds on data-dependent posteriors. Using this flexibility, however, is difficult, especially when the data distribution is presumed to be unknown. We show how an {\epsilon}-differentially private data-dependent prior yields a valid PAC-Bayes bound, and then show how non-private mechanisms for choosing priors can also yield generalization bounds. As an application of this result, we show that a Gaussian prior mean chosen via stochastic gradient Langevin dynamics (SGLD; Welling and Teh, 2011) leads to a valid PAC-Bayes bound given control of the 2-Wasserstein distance to an {\epsilon}-differentially private stationary distribution. We study our data-dependent bounds empirically, and show that they can be nonvacuous even when other distribution-dependent bounds are vacuous.

Figures

Equations

$$\underset{S\sim\mathcal{D}^{m}}{\mathbb{P}}\Bigl{(}\mathrm{kl}(\hat{L}_{S}(Q(S))||L_{\mathcal{D}}(Q(S)))\leq\frac{1}{m}\Big{(}\tau\sqrt{\frac{2}{m}\ln\frac{2\sqrt{m}}{\delta}+\frac{\tau^{2}}{2m}+\ln\frac{2\sqrt{m}}{\delta}}\Big{)}\Bigr{)}\geq 1-\delta.$$

$$L_{\mathcal{D}}(\mathbf{w})\stackrel{\text{def}}{=}\underset{z\sim \mathcal{D}}{\mathbb{E}}\{\ell (\mathbf{w},z)\},$$

$$L_{\mathcal{D}}(Q)\overset{\text{\smash{{def}}}}{=}\smash{\underset{\mathbf{w}\sim Q}{\mathbb{E}}\{L_{\mathcal{D}}(\mathbf{w})\}=\underset{z\sim\mathcal{D}}{\mathbb{E}}\Big{\{}\underset{\mathbf{w}\sim Q}{\mathbb{E}}\{\ell(\mathbf{w},z)\}\Big{\}}},$$

$${\hat{L}}_S(Q)\stackrel{\text{def}}{=}{L}_{\hat{\mathcal{D}}}(Q)=\frac{1}{m}{\sum }_{i=1}^m\underset{\mathbf{w}\sim Q}{\mathbb{E}}\{\ell (\mathbf{w},z_i)\},$$

$$\mathbb{P}\{(X,Y)\in E\}\le {\mathrm{e}}^k\mathbb{P}\{(X^{\prime },Y)\in E\}+\beta .$$

$$\mathrm{kl}(q||p)\stackrel{\text{def}}{=}\mathrm{KL}({\mathcal{B}}_q||{\mathcal{B}}_p)=q\ln \frac{q}{p}+(1-q)\ln \frac{1-q}{1-p}.$$

$$\underset{S\sim\mathcal{D}^{m}}{\mathbb{P}}\Bigl{(}(\forall Q)\ \mathrm{kl}(\hat{L}_{S}(Q)||L_{\mathcal{D}}(Q))\leq\frac{\mathrm{KL}(Q||P)+\ln\frac{2\sqrt{m}}{\delta}}{m}\Bigr{)}\geq 1-\delta.$$

$$\forall Q\in {\mathcal{M}}_1({\mathbb{R}}^p),\mathrm{kl}({\hat{L}}_S(Q)||L_{\mathcal{D}}(Q))\le \frac{\mathrm{KL}(Q||\mathcal{P}(S))+\ln \frac{4\sqrt{m}}{\delta }}{m}+{ϵ}^2/2+ϵ\sqrt{\frac{\ln (4/\delta )}{2m}}.$$

$$\Vert w(S)-w^{\ast }(S){\Vert }_2^2\le C$$

$$\forall Q\in {\mathcal{M}}_1({\mathbb{R}}^p),\mathrm{kl}({\hat{L}}_S(Q)||L_{\mathcal{D}}(Q))\le \frac{\mathrm{KL}(Q||\mathcal{P}(S))+\ln \frac{2\sqrt{m}}{\delta -\beta }}{m}+{ϵ}^2/2+ϵ\sqrt{\frac{\ln (2/\beta )}{2m}}.$$

$$R(P)=\Big{\{}S\in Z^{m}:(\exists Q)\ \mathrm{kl}(\hat{L}_{S}(Q)||L_{\mathcal{D}}(Q))\geq m^{-1}\big{(}\mathrm{KL}(Q||P)+\ln\frac{2\sqrt{m}}{\delta^{\prime}}\big{)}\Big{\}}.$$

$${\mathbb{P}}_{S\sim {\mathcal{D}}^m}\{S\in R(\mathcal{P}(S))\}$$

$$\le {\mathrm{e}}^{I_{\infty }^{\beta }(\mathcal{P};m)}{\delta }^{\prime }+\beta \stackrel{\text{def}}{=}\delta .$$

$$\exists Q\in {\mathcal{M}}_1({\mathbb{R}}^p),\mathrm{kl}({\hat{L}}_S(Q)||L_{\mathcal{D}}(Q))\ge \frac{\mathrm{KL}(Q||\mathcal{P}(S))+\ln \frac{2\sqrt{m}}{\delta -\beta }+I_{\infty }^{\beta }(\mathcal{P};m)}{m}.$$

$$\frac{\mathrm{KL}(Q||\mathcal{P}(S))+\ln \frac{4\sqrt{m}}{\delta }}{m}+{ϵ}^2/2+ϵ\sqrt{\frac{\ln (4/\delta )}{2m}}.$$

$$\mathrm{KL}(Q||P)-\mathrm{KL}(Q||P^{\prime })$$

$$\displaystyle=Q\Big{[}\ln\frac{\mathrm{d}Q}{\mathrm{d}P^{\prime}}+\ln\frac{\mathrm{d}P^{\prime}}{\mathrm{d}P}\Big{]}-\mathrm{KL}(Q||P^{\prime})$$

$$\displaystyle=\mathrm{KL}(Q||P^{\prime})+Q\Big{[}\ln\frac{\mathrm{d}P^{\prime}}{\mathrm{d}P}\Big{]}-\mathrm{KL}(Q||P^{\prime})$$

$$\displaystyle=Q\Big{[}\ln\frac{\mathrm{d}P^{\prime}}{\mathrm{d}P}\Big{]}.$$

$$\ln \frac{\mathrm{d}N(w^{\prime })}{\mathrm{d}N(w)}(v)$$

$$=⟨w^{\prime }-w,v{⟩}_{{\Sigma }^{-1}}+\frac{1}{2}\left(\Vert w{\Vert }_{{\Sigma }^{-1}}^2-\Vert w^{\prime }{\Vert }_{{\Sigma }^{-1}}^2\right)$$

$$=\frac{1}{2}⟨w^{\prime }-w,2v{⟩}_{{\Sigma }^{-1}}-\frac{1}{2}⟨w^{\prime }-w,w+w^{\prime }{⟩}_{{\Sigma }^{-1}}$$

$$=\frac{1}{2}⟨w^{\prime }-w,2v-w-2w^{\prime }+w^{\prime }{⟩}_{{\Sigma }^{-1}}$$

$$=\frac{1}{2}⟨w^{\prime }-w,2(v-w^{\prime })+w^{\prime }-w{⟩}_{{\Sigma }^{-1}}$$

$$\le \frac{1}{2}\Vert w^{\prime }-w{\Vert }_{{\Sigma }^{-1}}^2+\Vert w^{\prime }-w{\Vert }_{{\Sigma }^{-1}}\Vert v-w^{\prime }{\Vert }_{{\Sigma }^{-1}}.$$

$$\Vert fg{\Vert }_{L^1(P)}$$

$$\le \Vert f\chi {\Vert }_{L^{\infty }(P)}\Vert g{\Vert }_{L^1(P)}+\Vert f\bar{\chi }{\Vert }_{L^1(P)}\Vert g{\Vert }_{L^{\infty }(P)}=R+\sqrt{\frac{2}{\pi }}{\mathrm{e}}^{-\frac{R^2}{2}}{\mathrm{e}}^{\Vert h{\Vert }_{L^{\infty }(P)}},$$

$$Q\left[\ln \frac{\mathrm{d}{P}^S}{\mathrm{d}{P}^{\ast }(S)}\right]$$

$$\le \frac{1}{2}C/{\sigma }_{\min }+\sqrt{C/{\sigma }_{\min }}\underset{v\sim Q}{\mathbb{E}}\Vert v-w(S){\Vert }_{{\Sigma }^{-1}}.$$

$$\psi (p)={\mathrm{e}}^{-{\ell }_{\text{max}}}+(1-2{\mathrm{e}}^{-{\ell }_{\text{max}}})p$$

$$\mathrm{KL}(Q_{\tau }||P)$$

$$\displaystyle=Q_{\tau}\Big{[}\ln\frac{\exp(-\tau\hat{L}_{S})}{Z_{\tau}}\Big{]}$$

$$=-\tau Q_{\tau }[{\hat{L}}_S]-\ln Z_{\tau }.$$

$$\displaystyle Q_{\tau}[\hat{L}_{S}]=\sum_{i=1}^{n}Q_{\tau}[\hat{L}_{S}]=\mathbb{E}\Big{[}\frac{1}{n}\sum_{i=1}^{n}\hat{L}_{S}(W_{i})\Big{]}.$$

$$-\ln Z_{\tau }=-\ln P[\exp (-\tau {\hat{L}}_S)]$$

$$\displaystyle\leq\mathbb{E}\Big{[}-\ln\frac{1}{n}\sum_{i=1}^{n}\exp(-\tau\hat{L}_{S}(V_{i}))\Big{]},$$

Full text

1 Introduction

There has been a resurgence of interest in PAC-Bayes bounds, especially towards explaining generalization in large-scale neural networks trained by stochastic gradient descent [14, 31, 30, 23]. See also [5, 16, 39, 2, 34, 18, 37].

PAC-Bayes bounds control the generalization error of Gibbs classifiers (aka PAC-Bayes “posteriors”) in terms of the Kullback–Leibler (KL) divergence to a fixed probability measure (aka PAC-Bayes “prior”) on the space of classifiers. PAC-Bayes bounds depend on a tradeoff between the empirical risk of the posterior $Q$ and a penalty $\frac{1}{m}\mathrm{KL}(Q||P)$, where $P$ is the prior, fixed independently of the sample $S\in Z^{m}$ from some space $Z$ of labelled examples. The KL penalty is typically the largest contribution to the bound and so finding the tightest possible bound generally depends on minimizing the KL term.

The KL penalty vanishes for $Q=P$, but typically $P$, viewed as a randomized (Gibbs) classifier, has poor performance since it has been chosen independently of the data. On the other hand, since $P$ is chosen independently of the data, posteriors $Q$ tuned to the data to achieve minimal empirical risk often bear little resemblance to the data-independent prior $P$, causing $\mathrm{KL}(Q||P)$ to be large. As a result, PAC-Bayes bounds can be loose or even vacuous.

The problem of excessive KL penalties is not inherent to the PAC-Bayes framework. Indeed, the PAC-Bayes theorem permits one to choose the prior $P$ based on the distribution $\mathcal{D}$ of the data. However, since $\mathcal{D}$ is considered unknown, and our only insight as to $\mathcal{D}$ is through the sample $S$, this flexibility would seem to be useless, as $P$ must be chosen independently of $S$ in existing bounds. Nevertheless, it is possible to make progress in this direction, and it is likely the best way towards tighter bounds and deeper understanding.

There is a growing body of work in the PAC-Bayes literature on data-distribution-dependent priors [7, 33, 22]. Our focus is on generalization bounds that use all the data, and in this setting, [22] prove a remarkable result for Gibbs posteriors. Writing $\hat{L}_{S}$ for the empirical risk function with respect to the sample $S$, [22] study the randomized classifier $Q$ with density (relative to some base measure) proportional to $\exp(-\tau\hat{L}_{S})$. For large values of $\tau$, $Q$ concentrates increasingly around the empirical risk minimizers. As a prior, the authors consider the probability distribution with density proportional to $\exp(-\tau L_{\mathcal{D}})$, where the empirical risk has been replaced by its expectation, $L_{\mathcal{D}}$, the (true) risk. Remarkably, [22] are able to upper bound the KL divergence between the two distributions by a term independent of $\mathcal{D}$, yielding the following result: Here $\mathrm{kl}(q||p)$ is the KL divergence between Bernoulli measures with mean $q$ and $p$. See Section 4 for more details.

Theorem 1.1** ([22]).**

Fix $\tau>0$. For $S\in Z^{m}$, let $Q(S)=P_{\exp(-\tau\hat{L}_{S})}$ be a Gibbs posterior with respect to some base measure $P$ on $\mathbb{R}^{p}$, where the empirical risk $\hat{L}_{S}$ is bounded in $[0,1]$. For every $\delta>0$, $m\in\mathbb{N}$, distribution $\mathcal{D}$ on $Z$,

[TABLE]

The dependence on the data distribution is captured through $\tau$, which is ideally chosen as small as possible, subject to $Q(S)$ yielding small empirical risk. (One can use a union bound to tune $\tau$ based on $S$.) The fact that the KL bound does not depend on $\mathcal{D}$, other than through $\tau$, implies that the bound must be loose for all $\tau$ such that there exists a distribution $\mathcal{D}$ that causes $Q$ to overfit with high probability on size $m$ datasets $S\sim\mathcal{D}^{m}$. In other words, for fixed $\tau$, the bound is no longer distribution dependent. This would not be important if not for the following empirical finding: weights sampled according to high values of $\tau$ do not overfit on real data, but they do on data whose labels have been randomized. Thus these bounds are vacuous in practice when the generalization error is, in fact, small. Evidently, the KL bound gives up too much.

Our work launches a different attack on the problem of using distribution-dependent priors. Loosely speaking, if a prior is chosen on the basis of the data, but in a way that is very stable to perturbations of the data set, then the resulting data-dependent prior should reflect the underlying data distribution, rather than the data, resulting in a bound that should still hold, perhaps with smaller probability.

We formalize this intuition using differential privacy [9, 13]. We show that an $\epsilon$-differentially private prior mean yields a valid, though necessarily looser, PAC-Bayes generalization bound. (See Theorem 4.2.) The result is a straightforward application of results connecting privacy and adaptive data analysis [13, 12].

The real challenge is using such a result: In practice, $\epsilon$-differentially private mechanisms can be expensive to compute. In the context of generalization bounds for neural networks, we consider the possibility of using stochastic gradient Langevin dynamics [41, SGLD;] to choose a data-dependent prior by way of stochastic optimization/sampling.

By various results, SGLD is known to produce an $(\epsilon,\delta)$-differentially private release  [29, 3, 8, 40, 28] A gap remains between pure and approximate differential privacy. Even if this gap were to be closed, the privacy/accuracy tradeoff of these analyses is too poor because they do not take advantage of the fact that, under some technical conditions, the distribution of SGLD’s output converges weakly towards a stationary distribution [38, Thm. 7], which is $\epsilon$-differentially private. One can also bound the KL divergence (and then 2-Wasserstein distance) of SGLD to stationarity within a constant given an appropriate fixed step size [34]. Neither result implies that SGLD achieves pure $\epsilon$-differential privacy.

We show that we can circumvent this barrier in our PAC-Bayes setting. We give a general PAC-Bayes bound for non-private data-dependent priors and then an application to multivariate Gaussian priors with non-private data-dependent means, with explicit bounds for the case of Gibbs posteriors. In particular, conditional on a data set, if a data-dependent mean vector $\mathbf{w}$ is close in 2-Wasserstein distance to an $\epsilon$-differentially private mean vector, then the generalization errors is close to that of the $\epsilon$-differentially private mean. The data-dependent mean $\mathbf{w}$ is not necessarily differentially private, even approximately. As a consequence, under suitable assumptions, SGLD can be used to optimize a data-dependent mean and still yield a valid PAC-Bayes bound.

2 Other Related Work

Our analysis relies on the stability of a data-dependent prior. Stability has long been understood to relate to generalization [6]. Our result relies on the connection between generalization and differential privacy [13, 12, 4, 32], which can be viewed as a particularly stringent notion of stability. See [10] for a survey of differential privacy.

[19, Thm. 1 ] also establish a “limit” theorem for differential privacy, showing that the almost sure convergence of mechanisms of the same privacy level admits a private mechanism of the same privacy level. Our result can be viewed as a significant weakening of the hypothesis to require only that the weak limit be private: no element on the sequence need be private.

The bounds we establish hold for bounded loss functions and i.i.d. data. Under additional assumptions, one can obtain PAC-Bayes generalization and excess risk bounds for unbounded loss with heavy tails [7, 16, 17, 1]. [1] also consider non-i.i.d. training data. Our approach to differentially private data-dependent priors can be readily extended to these settings.

3 Preliminaries

Let $Z$ be a measurable space, let $\mathcal{M}_{1}(Z)$ denote the space of probability measures on $Z$, and let $\mathcal{D}\in\mathcal{M}_{1}(Z)$ be unknown. We consider the batch supervised learning setting under a loss function bounded below: having observed $S\sim\mathcal{D}^{m}$, i.e., $m$ independent and identically distributed samples from $\mathcal{D}$, we aim to choose a predictor, parameterized by weight vector $\mathbf{w}\in\mathbb{R}^{p}$, with minimal risk

[TABLE]

where $\ell:\mathbb{R}^{p}\times Z\to\mathbb{R}$ is measurable and bounded below. (We ignore the possibility of constraints on the weight vector for simplicity.) We also consider randomized predictors, represented by probability measures $Q\in\mathcal{M}_{1}(\mathbb{R}^{p})$, whose risks are defined via averaging,

[TABLE]

where the second equality follows from Tonelli’s theorem and the fact that $\ell$ is bounded below.

Let $S=(z_{1},\dots,z_{m})$ and let $\hat{\mathcal{D}}\overset{\text{\smash{{def}}}}{=}\frac{1}{m}\sum_{i=1}^{m}\delta_{z_{i}}$ be the empirical distribution. Given a randomized predictor $Q$, such as that chosen by a learning algorithm on the basis of data $S$, its empirical risk

[TABLE]

is studied as a stand-in for its risk, which we cannot compute. While $\hat{L}_{S}(Q)$ is easily seen to be an unbiased estimate of $L_{\mathcal{D}}(Q)$ when $Q$ is independent of $S$, our goal is to characterize the (one-sided) generalization error $L_{\mathcal{D}}(Q)-\hat{L}_{S}(Q)$ when $Q$ is random and dependent on $S$.

Finally, when optimizing the weight vector or defining tractable distributions on $\mathbb{R}^{p}$, we use a (differentiable) surrogate risk $\tilde{L}_{S}$, which is the empirical average of a bounded surrogate loss, taking values in an interval of length $\Delta$.

3.1 Differential privacy

For readers not familiar with differential privacy, Appendix A provides the basic definitions and results. We use the notation $\mathscr{A}\colon R\rightsquigarrow T$ to denote a randomized algorithm $\mathscr{A}$ that takes an input in a measurable space $R$ and produces a random output in the measurable space $T$.

Definition 3.1**.**

A randomized algorithm $\mathscr{A}\colon Z^{m}\rightsquigarrow T$ is $(\epsilon,\delta)$-differentially private if, for all pairs $S,S^{\prime}\in Z^{m}$ that differ at only one coordinate, and all measurable subsets $B\subseteq T$, we have $\mathbb{P}\{\mathscr{A}(S)\in B\}\leq\mathrm{e}^{\epsilon}\,\mathbb{P}\{\mathscr{A}(S^{\prime})\in B\}+\delta.$ Further, $\epsilon$-differentially private means $(\epsilon,0)$-differentially private.

For our purposes, max-information is the key quantity controlled by differential privacy.

Definition 3.2** ([12, §3]).**

Let $\beta\geq 0$, let $X$ and $Y$ be random variables in arbitrary measurable spaces, and let $X^{\prime}$ be independent of $Y$ and equal in distribution to $X$. The $\beta$-approximate max-information between $X$ and $Y$, denoted $I_{\infty}^{\beta}(X;Y)$, is the least value $k$ such that, for all product-measurable events $E$,

[TABLE]

The max-information $I_{\infty}(X;Y)$ is defined to be $I_{\infty}^{\beta}(X;Y)$ for $\beta=0$. For $m\in\mathbb{N}$ and $\mathscr{A}\colon Z^{m}\rightsquigarrow T$, the $\beta$-approx. max-information of $\mathscr{A}$, denoted $I_{\infty}^{\beta}(\mathscr{A},m)$, is the least value $k$ such that, for all $\mathcal{D}\in\mathcal{M}_{1}(Z)$, $I_{\infty}^{\beta}(S;\mathscr{A}(S))\leq k$ when $S\sim\mathcal{D}^{m}$. The max-information of $\mathscr{A}$ is defined similarly.111Note that in much of the literature it is standard to express the max-information in bits, i.e., the factor $\mathrm{e}^{k}$ above is replaced by $2^{k^{\prime}}$ with $k^{\prime}=k\log_{2}e$.

In Section 4.1, we consider the case where the dataset $S$ and a data-dependent prior $\mathscr{P}(S)$ have small approximate max-information. The above definition tells us that we can almost treat the data-dependent prior as if it was chosen independently from $S$. The following is the key result connecting pure differential privacy and max-information:

Theorem 3.3** ([12, Thms. 19–20]).**

Fix $m\in\mathbb{N}$. Let $\mathscr{A}\colon Z^{m}\rightsquigarrow T$ be $\epsilon$-differentially private. Then $I_{\infty}(\mathscr{A},m)\leq\epsilon m$ and, for all $\beta>0$, $I_{\infty}^{\beta}(\mathscr{A},m)\leq\epsilon^{2}m/2+\epsilon\sqrt{m\ln(2/\beta)/2}$.

4 PAC-Bayes bounds

Let $Q,P\in\mathcal{M}_{1}(\mathbb{R}^{p})$. When $Q$ is absolutely continuous with respect to $P$, written $Q\ll P$, we write $\frac{\mathrm{d}Q}{\mathrm{d}P}:\mathbb{R}^{p}\to\mathbb{R}_{+}\cup\{\infty\}$ for some Radon–Nikodym derivative of $Q$ with respect to $P$. The Kullback–Liebler (KL) divergence from $Q$ to $P$ is $\mathrm{KL}(Q||P)=\int\ln\frac{\mathrm{d}Q}{\mathrm{d}P}\,\mathrm{d}Q$ if $Q\ll P$ and $\infty$ otherwise. Let $\mathcal{B}_{p}$ denote the Bernoulli distribution on $\{0,1\}$ with mean $p$. For $p,q\in[0,1]$, we abuse notation and define

[TABLE]

The following PAC-Bayes bound for bounded loss is due to [25], and extends the 0–1 bound established by [21], building off the seminal work of [26] and [36]. See also [20] and [7].

Theorem 4.1** (PAC-Bayes; [25, Thm. 5]).**

Under bounded loss $\ell\in[0,1]$, for every $\delta>0$, $m\in\mathbb{N}$, distribution $\mathcal{D}$ on $Z$, and distribution $P$ on $\mathbb{R}^{p}$,

[TABLE]

One can use Pinsker’s inequality to obtain a bound on the generalization error $\lvert\hat{L}_{S}(Q)-L_{\mathcal{D}}(Q)\rvert$, however this significantly loosens the bound, especially when $\hat{L}_{S}(Q)$ is close to zero. We refer to the quantity $\mathrm{kl}(\hat{L}_{S}(Q)||L_{\mathcal{D}}(Q))$ as the KL-generalization error. From a bound on this quantity, we can bound the risk as follows: given empirical risk $q$ and a bound on the KL-generalization error $c$, the risk is bounded by the largest value $p\in[0,1]$ such $\mathrm{kl}(q||p)\leq c$. See [14] for a discussion of this computation. When the empirical risk is near zero, the KL-generalization error is essentially the generalization error. As empirical risk increases, the bound loosens and the square root of the KL-generalization error bounds the generalization error.

4.1 Data-dependent priors

The prior $P$ that appears in the PAC-Bayes generalization bound must be chosen independently of the data $S\sim\mathcal{D}^{m}$, but can depend on the data distribution $\mathcal{D}$ itself. If a data-dependent prior $\mathscr{P}(S)$ does not depend too much on any individual data point, it should behave as if it depends only on the distribution. Theorem 3.3 allows us to formalize this intuition: we can obtain new PAC-Bayes bounds that use data-dependent priors, provided they are $\epsilon$-differentially private: We provide an example using the bound of Maurer (Theorem 4.1).

Theorem 4.2** (PAC-Bayes with private data-dependent priors).**

Fix a bounded loss $\ell\in[0,1]$. Let $m\in\mathbb{N}$, let $\mathscr{P}\colon Z^{m}\rightsquigarrow\mathcal{M}_{1}(\mathbb{R}^{p})$ be an $\epsilon$-differentially private mechanism for choosing a data-dependent prior, let $\mathcal{D}\in\mathcal{M}_{1}(Z)$, and let $S\sim\mathcal{D}^{m}$. Then, with probability at least $1-\delta$,

[TABLE]

See Appendix B for a proof of a more general statement of the theorem and further discussion. The main innovation here is recognizing the potential to choose data-dependent priors using private mechanisms. The hard work is done by Theorem 3.3: obtaining differentially private versions of other PAC-Bayes bounds is straightforward.

When one is choosing the privacy parameter, $\epsilon$, there is a balance between minimizing the direct contributions of $\epsilon$ to the bound (forcing $\epsilon$ smaller) and minimizing the indirect contribution of $\epsilon$ through the KL term for posteriors Q that have low empirical risk (forcing $\epsilon$ larger). The optimal value for $\epsilon$ is often much less than one, which can be challenging to obtain. We discuss strategies for achieving the required privacy in later sections.

5 Weak approximations to $\epsilon$-differentially private priors

Theorem 4.2 permits data-dependent priors that are chosen by $\epsilon$-differentially private mechanisms. In this section, we discuss concrete families of priors and mechanisms for choosing among them in data-dependent ways. We also relax Theorem 4.2 to allow non-private priors.

We apply our main result to non-private data-dependent Gaussian priors with a fixed covariance matrix. Thus, we choose only the mean $\mathbf{w}_{0}\in\mathbb{R}^{p}$ privately in a data-dependent way. We show that it suffices for the data-dependent mean to be merely close in 2-Wasserstein distance to a private mean to yield a generalization bound. (It is natural to consider also choosing a data-dependent covariance, but as it is argued below, the privacy budget we have in applications to generalization is very small.)

Ideally, we would choose a mean vector $\mathbf{w}_{0}$ that leads to a tight bound. A reasonable approach is to choose $\mathbf{w}_{0}$ by approximately minimizing the empirical risk $\hat{L}_{S}$ or surrogate risk $\tilde{L}_{S}$, subject to privacy constraints. A natural way to do this is via an exponential mechanism. We pause to introduce some notation for Gibbs distributions: For a measure $P$ on $\mathbb{R}^{p}$ and measurable function $g:\mathbb{R}^{p}\to\mathbb{R}$, let $P[g]$ denote the expectation $\int g(h)P(\mathrm{d}h)$ and, provided $P[g]<\infty$, let $P_{g}$ denote the probability measure on $\mathbb{R}^{p}$, absolutely continuous with respect to $P$, with Radon–Nikodym derivative $\frac{\mathrm{d}P_{g}}{\mathrm{d}P}(h)=\frac{g(h)}{P[g]}.$ A distribution of the form $P_{\exp(-\tau g)}$ is generally referred to as a Gibbs distribution with energy function $g$ and inverse temperature $\tau$. In the special case where $P$ is a probability measure, we call $P_{\exp(-\tau\tilde{L}_{S})}$ a “Gibbs posterior”.

Lemma 5.1** ([27, Thm. 6]).**

Let $q:Z^{m}\times\mathbb{R}^{p}\to\mathbb{R}$ be measurable, let $P$ be a $\sigma$-finite measure on $\mathbb{R}^{p}$, let $\beta>0$, and assume $P[\exp(-\beta\,q(S,\cdot))]<\infty$ for all $S\in Z^{m}$. Let $\Delta q\overset{\text{\smash{{def}}}}{=}\operatorname*{\mathrm{sup}\vphantom{\mathrm{infsup}}}_{S,S^{\prime}}\operatorname*{\mathrm{sup}\vphantom{\mathrm{infsup}}}_{\mathbf{w}\in\mathbb{R}^{p}}|q(S,\mathbf{w})-q(S^{\prime},\mathbf{w})|$, where the first supremum ranges over pairs $S,S^{\prime}\in Z^{m}$ that disagree on no more than one coordinate. Let $\mathscr{A}:Z^{m}\rightsquigarrow\mathbb{R}^{p}$, on input $S\in Z^{m}$, output a sample from the Gibbs distribution $P_{\exp(-\beta q(S,\cdot))}$. Then $\mathscr{A}$ is $2\beta\Delta q$-differentially private.

The following result is a straightforward application of Lemma 5.1 and essentially equivalent results have appeared in numerous studies of the differential privacy of Bayesian and Gibbs posteriors [29, 3, 8, 40, 28].

Corollary 5.2**.**

Let $\tau>0$ and let $\tilde{L}_{S}$ denote the surrogate risk, taking values in an interval of length $\Delta$. One sample from the Gibbs posterior $P_{\exp(-\tau\tilde{L}_{S})}$ is $\frac{2\tau\Delta}{m}$-differentially private.

5.1 Weak convergence yields valid PAC-Bayes bounds

Even for small values of the inverse temperature, it is difficult to implement the exponential mechanism because sampling from Gibbs posteriors exactly is intractable. On the other hand, a number of algorithms exist for generating approximate samples from Gibbs posteriors. If one can control the total-variation distance, one can obtain a bound like Theorem 4.2 by applying approximate max-information bounds for $(\epsilon,\delta)$-differential private mechanisms. However, many algorithms do not control the total-variation distance to stationarity, or do so poorly.

The generalization properties of randomized classifiers are generally insensitive to small variations of the parameters, however, and so it stands to reason that our data-dependent prior need only be itself close to an $\epsilon$-differentially private prior. We formalize this intuition here by deriving bounds on $\mathrm{KL}(Q||\mathscr{P}(S))$ in terms of a non-private data-dependent prior $P^{S}$. We start with an identity:

Lemma 5.3**.**

If $P^{\prime}\ll P$ then $\mathrm{KL}(Q||P)=\mathrm{KL}(Q||P^{\prime})+Q[\ln\frac{\mathrm{d}P^{\prime}}{\mathrm{d}P}]$.

The proof is straightforward. The lemma highlights the role of $Q$ in judging the difference between $P^{\prime}$ and $P$, and leads immediately to the following corollary (see Appendix C).

Lemma 5.4** (Non-private priors).**

Let $m\in\mathbb{N}$, let $\mathscr{P}\colon Z^{m}\rightsquigarrow\mathcal{M}_{1}(\mathbb{R}^{p})$ be $\epsilon$-differentially private, let $\mathcal{D}\in\mathcal{M}_{1}(Z)$, let $S\sim\mathcal{D}^{m}$, and let $P^{S}$ be a data-dependent prior such that, for some $P^{*}(S)$ satisfying $\mathbb{P}[P^{*}(S)|S]=\mathbb{P}[\mathscr{P}(S)|S]$, we have $P^{S}\ll P^{*}(S)$ with probability at least $1-\delta^{\prime}$. Then, with probability at least $1-\delta-\delta^{\prime}$, Eq. 4.2 holds with $\mathrm{KL}(Q||\mathscr{P}(S))$ replaced by $\mathrm{KL}(Q||P^{S})+Q[\ln\frac{\mathrm{d}P^{S}}{\mathrm{d}P^{*}(S)}]$.

The conditions that $P^{S}\ll P^{*}(S)$ and $Q[\ln\frac{\mathrm{d}P^{S}}{\mathrm{d}P^{*}(S)}]\leq\infty$ for some $Q$ do not constrain $P^{S}$ to be differentially private. In fact, $S$ could be $P^{S}$-measurable!

Lemma 5.4 is not immediately applicable because $P^{*}(S)$ is intractable to generate. The following application considers multivariate Gaussian priors, $N(w)$, indexed by their mean vectors $w\in\mathbb{R}^{p}$, with a fixed positive definite covariance matrix $\Sigma\in\mathbb{R}^{p\times p}$. We require two technical results: The first implies that we can bound $Q[\ln\frac{\mathrm{d}P^{S}}{\mathrm{d}P^{*}(S)}]$ if $Q$ concentrates near the non-private mean; The second characterizes this concentration for Gibbs posteriors built from bounded surrogate risks.

Lemma 5.5**.**

$Q[\ln\frac{\mathrm{d}N(w^{\prime})}{\mathrm{d}N(w)}]\leq\frac{1}{2}\lVert w-w^{\prime}\rVert^{2}_{\Sigma^{-1}}+\lVert w-w^{\prime}\rVert_{\Sigma^{-1}}\,\,\underset{v\sim Q}{\mathbb{E}}\lVert v-w^{\prime}\rVert_{\Sigma^{-1}}.$**

Lemma 5.6**.**

Let $P=N(w)$ and $Q=P_{\exp(h)}$ for $h\geq 0$. Then $\underset{v\sim Q}{\mathbb{E}}\lVert v-w\rVert_{\Sigma^{-1}}\leq\sqrt{2\smash{\lVert h\rVert_{L^{\infty}(P)}}}+\sqrt{2/\pi}.$

Corollary 5.7** (Gaussian means close to private means).**

Let $m\in\mathbb{N}$, let $\mathcal{D}\in\mathcal{M}_{1}(Z)$, let $S\sim\mathcal{D}^{m}$, let $\mathscr{A}:Z^{m}\rightsquigarrow\mathbb{R}^{p}$ be $\epsilon$-differentially private, and let $w(S)$ denote a data-dependent mean vector such that, for some $w^{*}(S)$ satisfying $\mathbb{P}[w^{*}(S)|S]=\mathbb{P}[\mathscr{A}(S)|S]$, we have

[TABLE]

with probability at least $1-\delta^{\prime}$. Let $\sigma_{\mathrm{min}}$ be the minimum eigenvalue of $\Sigma$. Then, with probability at least $1-\delta-\delta^{\prime}$, Eq. 4.2 holds with $\mathrm{KL}(Q||\mathscr{P}(S))$ replaced by $\mathrm{KL}(Q||N(w(S)))+\frac{1}{2}\,{C}/{\sigma_{\mathrm{min}}}+\sqrt{{C}/{\sigma_{\mathrm{min}}}}\,\mathbb{E}_{v\sim Q}\lVert v-w(S)\rVert_{\Sigma^{-1}}$. In particular, for a Gibbs posterior $Q=P^{S}_{\exp(-\tau\smash{\tilde{L}_{S}})}$, we have $\mathbb{E}_{v\sim Q}\lVert v-w(S)\rVert_{\Sigma^{-1}}\leq\sqrt{2\tau\Delta}+\sqrt{2/\pi}$.

See Appendix C for details and further discussion.

One way to achieve Eq. 5.1 is to construct $w_{1}(S),w_{2}(S),\dots$ so that $\mathbb{P}[w_{n}(S)|S]\to\mathbb{P}[\mathscr{A}(S)|S]$ weakly with high probability. Skorohod’s representation theorem then implies the existence of $w^{*}(S)$. One of the standard algorithms used to generate such sequences for high-dimensional Gibbs distributions is stochastic gradient Langevin dynamics [41, SGLD;].

In order to get nonasymptotic results, it suffices to bound the 2-Wasserstein distance of the SGLD Markov chain to stationarity. Recall that the $p$-Wasserstein distance between $\mu$ and $\nu$ is given by $(\mathcal{W}_{p}(\mu,\nu))^{p}=\operatorname*{\mathrm{inf}\vphantom{\mathrm{infsup}}}_{\gamma}\int\lVert v-w\rVert_{2}^{p}\,\mathrm{d}\gamma(v,w)$ where the infimum runs over couplings of $\mu$ and $\nu$, i.e., distributions $\gamma\in\mathcal{M}_{1}(\mathbb{R}^{p}\times\mathbb{R}^{p})$ with marginals $\mu$ and $\nu$, respectively.

Let $\mathscr{A}(S)$ return a sample from the Gibbs posterior $P_{\exp(-\tau\smash{\tilde{L}_{S}})}$ with Gaussian $P$ and surrogate risk $\smash{\tilde{L}_{S}}$ constructed from smooth loss functions taking values in a length-$\Delta$ interval. By Corollary 5.2, $\mathscr{A}$ is $\frac{2\tau\Delta}{m}$-differentially private. Consider running SGLD to target $\mathbb{P}[\mathscr{A}(S)|S]=P_{\exp(-\tau\smash{\tilde{L}_{S}})}$. Assume222 The status of this assumption relates to results by [24, Thm. 7.3 ] and [34, Prop. 3.3 ], under so-called dissipativity conditions on the regularized loss. We have hidden potentially exponential dependence on $\tau$, which is problem dependent. See also [15]. that, for every $c>0$, there is a step size $\eta>0$ and number of SGLD iterations $n\in O(\frac{1}{c^{q}})$, such that the $n$-th iterate $w(S)\in\mathbb{R}^{p}$ produced by SGLD satisfies \mathcal{W}_{2}\big{(}\mathbb{P}[w(S)|S],\mathbb{P}[\mathscr{A}(S)|S]\big{)}\leq c. Markov’s inequality and the definition of $\mathcal{W}_{2}$ immediately implies the following.

Corollary 5.8** (Prior via SGLD).**

Under the above assumption, for some step size $\eta>0$, the $n$-th iterate $w(S)$ of SGLD targeting $P_{\exp(-\tau\smash{\tilde{L}_{S}})}$ satisfies Corollary 5.7 with $\epsilon=\frac{2\tau\Delta}{m}$ and $C\in O(\frac{1}{\delta^{\prime}n^{1/q}})$.

The dependence on $\delta^{\prime}$ is poor. However, one can construct Markov chain algorithms that are geometrically ergodic, in which case $n^{-1/q}$ is replaced by a term $2^{-\Omega(n)}$, allowing one to spend computation to control the $1/\delta^{\prime}$ term.

6 Empirical studies

We have presented data-dependent bounds and so it is necessary to study them empirically to evaluate their usefulness. The goal of this section is to make a number of arguments. First, it is an empirical question as to what value of the inverse temperature $\tau$ is sufficient to yield small empirical risk from a Gibbs posterior. Indeed, we compare to the bound of [22], presented above as Theorem 1.1. As [22] point out, this bound depends explicitly on $\tau$, where it plays an obvious role as a measure of complexity. Second, despite how tight this bound is for small values of $\tau$, the bound must become vacuous before the Gibbs posterior would have started to overfit on random labels because this bound holds for all data distributions. We demonstrate that this phase transition happens well before the Gibbs posterior achieves its minimum risk on true labels. Third, because our bound retains the KL term, we can potentially identify easy data. Indeed, our risk bound decreases beyond the point where the same classifier begins to overfit to random labels. Finally, our results suggest that we can use the property that SGLD converges weakly to investigate the generalization properties of Gibbs classifiers. More work is clearly needed to scale our study to full fledged deep learning benchmarks. (See Appendix E for details on how we compute the KL term and challenges there due to Gibbs posteriors $Q$ not be exactly samplable.)

More concretely, we perform an empirical evaluation using SGLD to approximate simulating from Gibbs distributions. Corollary 5.7 provides some justification by showing that a slight weakening of the PAC-Bayes generalization bound is valid provided that SGLD eventually controls the 2-Wasserstein distance to stationarity. However, because we cannot measure our convergence in practice, it is an empirical question as to whether our samples are accurate enough.

Violated bounds would be an obvious sign of trouble. We expect the bound on the classification error not to go below the true error as estimated on the heldout test set (with high probability). We perform an experiment on a MNIST (and CIFAR10, with the same conclusion so we have not included it) using true and random labels and find that no bounds are violated. The results suggest that it may be useful to empirical study bounds for Gibbs classifiers using SGLD.

Our main focus is a sythentic experiment comparing the bounds of [22] to our new bounds based on privacy. The main finding here is that, as expected, the bounds by [22] must explode when the Gibbs classifier begins to overfit random labels, whereas our bounds, on true labels, continue to track the training error and bound the test error.

6.1 Setup

Our focus is on classification by neural networks into $K$ classes. Thus $Z=X\times[K]$, and we use neural networks that output probability vectors over these $K$ classes. Given weights $\mathbf{w}\in\mathbb{R}^{p}$ and input $x\in X$, the probability vector output by the network is $p(\mathbf{w},x)\in[0,1]^{K}$. Networks are trained by minimizing cross entropy loss: $\ell(\mathbf{w},(x,y))=g(p(\mathbf{w},x),y)$, where $g((p_{1},\dots,p_{K}),y)=-\ln p_{y}$. Note that cross entropy loss is merely bounded below. We report results in terms of $\{0,1\}$-valued classification error: $\ell(\mathbf{w},(x,y))=0$ if and only if $y$ is the largest coordinate of $p(\mathbf{w},x)$.

We refer to elements of $\mathbb{R}^{p}$ and $\mathcal{M}_{1}(\mathbb{R}^{p})$ as classifiers and randomized classifiers, respectively, and to the (empirical) 0–1 risk as the (empirical) error. We train two different architectures using SGLD on MNIST and a synthetic dataset, SYNTH. The experimental setup is explained in Appendix F.

One-stage training procedure

We run SGLD for $T$ training epochs with a fixed value of the parameter $\tau$. We observe that convergence appears to occur within 10 epochs, but use a much larger number of training epochs to potentially expose nonconvergence behavior. The value of the inverse temperature $\tau$ is fixed during the whole training procedure.

Two-stage training procedure

In order to evaluate our private PAC-Bayes bound (Theorem 4.2), we perform a two-stage training procedure:

• •

Stage One. We run SGLD for $T_{1}$ epochs with inverse temperature $\tau_{1}$, minimizing the standard cross entropy objective. Let $w_{0}$ denote the neural network weights after stage one.

• •

Transition. We restart the learning rate schedule and continue SGLD for $T_{1}$ epochs with linearly annealing the temperature between $\tau_{1}$ and $\tau_{2}$, i.e., inverse temperature $\tau_{t}=((t-T_{1})\tau_{2}+(2T_{1}-t)*\tau_{1})/T_{1}$, where $t$ is the current epoch number. The objective at $\mathbf{w}$ is the cross entropy loss for $\mathbf{w}$ plus a weight-decay term $\frac{\gamma}{2}\|\mathbf{w}-\mathbf{w}_{0}\|_{2}^{2}$.

• •

Stage Two. We continue SGLD for $T_{2}-T_{1}$ epochs with inverse temperature $\tau_{2}$. The objective is the same as in the transition stage.

During the first stage, the $k$-step transitions of SGLD converge weakly towards a Gibbs distribution with a uniform base measure, producing a random vector $\mathbf{w}_{0}\in\mathbb{R}^{p}$. The private data-dependent prior $P_{\mathbf{w}_{0}}$ is the Gaussian distribution centred at $\mathbf{w}_{0}$ with diagonal covariance $\frac{1}{\gamma}I_{p}$. During the second stage, SGLD converges to the Gibbs posterior with a Gaussian base measure $P_{\mathbf{w}_{0}}$, i.e., $Q_{\tau_{2}}=P_{\exp(-\tau_{2}\hat{L}_{S})}$.

Bound calculation

Our experiments evaluate different values of the inverse temperature $\tau$.

We evaluate Lever bounds for the randomized classifier $Q_{\tau}$ obtained by the one-stage training procedure, with $T=1000$. We do so on both the MNIST and SYNTH datasets.

We also evaluate our private PAC-Bayes bound (Theorem 4.2) for the randomized classifier $Q_{\tau_{2}}$ and the private data-dependent prior $P_{\mathbf{w}_{0}}$, where the privacy parameter depends on $\tau_{1}$. The bound depends on the value of the $\mathrm{KL}(Q_{\tau_{1}}||P_{\mathbf{w}_{0}})$. The challenges of estimating this term are described in Appendix E. We only evaluate the differentially private PAC-Bayes bounds on the small neural network and SYNTH dataset,

The parameter settings for SYNTH experiments are: $T1=100$, $T2=1000$, $\gamma=2$; for MNIST: $T1=500$, $T2=1000$, $\gamma=5$. When evaluating Lever bounds with a one-stage learning procedure for either datasets, $T=1000$.

6.2 Results

Results are presented in Figs. 1 and 2. We never observe a violation of the PAC-Bayes bounds for Gibbs distributions. This suggests that our assumption that SGLD has nearly converged is accurate enough or the bounds are sufficiently loose that any effect from nonconvergence was masked.

Our MNIST experiments highlight that the Lever bounds upper bound the risk for every possible data distribution, including the random label distribution. In the random label experiment (Fig. 1, right plot), when $\tau$ gets close to the number of training samples, the generalization error starts increasing steeply. This phase transition is captured by the Lever bound. In the true label experiment (right plot), the generalization error does not rise with $\tau$. Indeed, it continues to decrease, and so the Lever bound quickly becomes vacuous as we increase $\tau$. The Lever bound cannot capture this behavior because it must simultaneously bound the generalization error under random labels.

On the SYNTH dataset, we see the same phase transition under random labels and so Lever bounds remain vacuous after this point. In contrast, we see that our private PAC-Bayes bounds can track the error beyond the phase transition that occurs under random labels. (See Fig. 2.) At high values of $\tau$, our KL upper bound becomes very loose.

Private versus Lever PAC-Bayes bound

While Lever PAC-Bayes bound fails to explain generalization for high $\tau$ values, our private PAC-Bayes bound may remain nonvacuous. This is due to the fact that it retains the KL term, which is sensitive to the data distribution via $Q$, and thus it can be much lower than the upper bound on the KL in [22] for datasets with small true Bayes risk. Two stage optimization, inspired by the DP PAC-Bayes bound, allows us to obtain more accurate classifiers by setting a higher inverse temperature parameter at the second stage, $\tau_{2}$.

We do not plot DP PAC-Bayes bound for MNIST experiments due to the computational challenges approximating the KL term for a high-dimensional parameter space, as discussed in Appendix E. We evaluate our private PAC-Bayes bound on MNIST dataset only for a combination of $\tau_{1}=10^{3}$ and $\tau_{2}\in[3*10^{3},3*10^{4},10^{5},3*10^{5}]$. The values are chosen such that $\tau_{1}$ gives a small penalty for using the data to learn the prior and $\tau_{2}$ is chosen such that at $\tau=\tau_{2}$ Lever’s bound returns a vacuous bound (as seen in Fig. 1). We use $10^{5}$ number of samples from the DP Gaussian prior learnt in stage one to approximate $\ln Z$ term that appears in the KL, as defined in Eq. E.5.

The results are presented in the table below. While DP PAC-Bayes bound is very loose, it is still smaller than Lever’s bound for high values of inverse temperature.

Note, that for smaller values $\tau_{2}$, we can use Lever’s upper bound on the KL term instead of performing a Monte Carlo approximation. Since $\tau_{1}$ is small and adds only a small penalty ($\sim 1\%$), the DP PAC-Bayes bound is equal to Lever’s bound plus a differential privacy penalty ($\sim 1\%$).

[TABLE]

Acknowledgments

The authors would like to thank Olivier Catoni, Pascal Germain, Mufan Li, David McAllester, and Alexander Rakhlin, John Shawe-Taylor, for helpful discussions. This research was carried out in part while the authors were visiting the Simons Institute for the Theory of Computing at UC Berkeley. GKD was additionally supported by an EPSRC studentship. DMR was additionally supported by an NSERC Discovery Grant and Ontario Early Researcher Award.

Appendix A Basic Differential Privacy

See [9, 11] for more details.

Let $U,U_{1},U_{2},\dots$ be independent uniform $(0,1)$ random variables, independent also of any other random variables unless stated otherwise, and let $\pi:\mathbb{N}\times[0,1]\to[0,1]$ satisfy $(\pi(1,U),\dots,\pi(k,U))\overset{{}_{d}}{=}(U_{1},\dots,U_{k})$ for all $k\in\mathbb{N}$. Write $\pi_{k}$ for $\pi(k,\cdot)$.

Definition A.1**.**

Let $R,T$ be measurable spaces. A randomized algorithm $\mathscr{A}$ from $R$ to $T$, denoted $\mathscr{A}\colon R\rightsquigarrow T$, is a measurable map $\mathscr{A}\colon[0,1]\times R\to T$. Associated to $\mathscr{A}$ is a (measurable) collection of random variables $\{\mathscr{A}_{r}:r\in R\}$ that satisfy $\mathscr{A}_{r}=\mathscr{A}(U,r)$. When there is no risk of confusion, we write $\mathscr{A}(r)$ for $\mathscr{A}_{r}$.

For our purposes, we rely only on the fact that privacy is preserved under post-processing, which we now define.333It is sometimes more natural to refer to the differential privacy of probability kernels, i.e., measurable maps from $Z^{m}$ to $\mathcal{M}_{1}(T)$, and to $S$-measurable random probability measures $Q$, i.e., probability kernels defined on the basic probability space satisfying $Q=g(S)$ for some probability kernel $g:Z^{m}\to\mathcal{M}_{1}(T)$, where $S\sim\mathcal{D}^{m}$. In both cases, the connection to the above definition is the same: for every probability kernel $\kappa:R\to\mathcal{M}_{1}(T)$ there exists $\mathscr{A}\colon[0,1]\times R\to T$ such that $\mathscr{A}(U,r)\sim\kappa(r)$ for every $r\in R$. In the other direction, clearly $\kappa(r)(A)=\mathbb{P}\{\mathscr{A}(U,r)\in A\}$ for every measurable $A\subseteq T$.

Definition A.2**.**

Let $\mathscr{A}\colon R\rightsquigarrow T$ and $\mathscr{A}^{\prime}\colon T\rightsquigarrow T^{\prime}$. The composition $\mathscr{A}^{\prime}\circ\mathscr{A}\colon R\rightsquigarrow T^{\prime}$ is given by $(\mathscr{A}^{\prime}\circ\mathscr{A})(u,r)=\mathscr{A}^{\prime}(\pi_{2}(u),\mathscr{A}(\pi_{1}(u),r))$.

Lemma A.3** (post-processing).**

Let $\mathscr{A}\colon Z^{m}\rightsquigarrow T$ be $(\epsilon,\delta)$-differentially private and let $F\colon T\rightsquigarrow T^{\prime}$ be arbitrary. Then $F\circ\mathscr{A}$ is $(\epsilon,\delta)$-differentially private.

Appendix B Proof of Theorem 4.2

We prove a slightly more general result.

Theorem B.1**.**

Fix a bounded loss $\ell\in[0,1]$. Let $m\in\mathbb{N}$, let $\mathscr{P}\colon Z^{m}\rightsquigarrow\mathcal{M}_{1}(\mathbb{R}^{p})$ be an $\epsilon$-differentially private data-dependent prior, let $\mathcal{D}\in\mathcal{M}_{1}(Z)$, and let $S\sim\mathcal{D}^{m}$. Then, for all $\delta\in(0,1)$ and $\beta\in(0,\delta)$, with probability at least $1-\delta$,

[TABLE]

Proof.

For every distribution $P$ on $\mathbb{R}^{p}$, let

[TABLE]

It follows from Theorem 4.1 that $\mathbb{P}_{S\sim\mathcal{D}^{m}}\{S\in R(P)\}\leq\delta^{\prime}.$ Let $\beta>0$. Then, by the definition of approximate max-information, we have

[TABLE]

We have $\delta^{\prime}=\mathrm{e}^{-I_{\infty}^{\beta}(\mathscr{P};m)}(\delta-\beta)$. Therefore, with probability no more than $\delta$ over $S\sim\mathcal{D}^{m}$,

[TABLE]

The result follows from replacing the approximate max-information $I_{\infty}^{\beta}(\mathscr{P};m)$ with the bound provided by Theorem 3.3. ∎

The theorem leaves open the choice of $\beta<\delta$. For any fixed values for $\epsilon$, $m$, and $\delta$, it is easy to optimize $\beta$ to obtain the tighest possible bound. In practice, however, the optimal bound is almost indistinguishable from that obtained by taking $\beta=\delta/2$. For the remainder of the paper, we take this value for $\beta$, in which case, the r.h.s. of Eq. 4.2 is

[TABLE]

Note that the bound holds for all posteriors $Q$. In general the bounds are interesting only when $Q$ is data dependent, otherwise one can obtain tighter bounds via concentration of measure results for empirical means of bounded i.i.d. random variables.

When one is choosing the privacy parameter, $\epsilon$, there is a balance between minimizing the direct contributions of $\epsilon$ to the bound (forcing $\epsilon$ smaller) and minimizing the indirect contribution of $\epsilon$ through the KL term for posteriors Q that have low empirical risk (forcing $\epsilon$ larger). One approach is to compute the value of $\epsilon$ that achieves a certain bound on the excess generalization error. In particular, choosing $\epsilon^{2}/2=\alpha$ contributes an additional gap of $\alpha$ to the KL-generalization error. Choosing $\alpha$ is complicated by the fact that there is a non-linear relationship between the generalization error and the KL-generalization error, depending on the empirical risk. A better approach is often to attempt to balance the direct contribution with the indirect one. Regardless, the optimal value for $\epsilon$ is much less than one, which can be challenging to obtain. We discuss strategies for achieving the required privacy in later sections.

Appendix C Proofs for Section 5.1

These results connect approximations to differential privacy with bounds on the KL term in a PAC-Bayesian bound, yielding PAC-Bayes bounds that hold even if the prior is chosen via a nonprivate mechanism. In independent work, subsequent to our original arXiv preprint, [35] combined PAC-Bayesian bounds and stability to leverage distribution dependent priors. Their approach is distinct, though complimentary. See also work by [23], who combines stability and PAC-Bayesian bounds in yet another way.

Proof of Lemma 5.3.

Assume $Q\ll P^{\prime}$, for otherwise the bound is trivial as $\mathrm{KL}(Q||P^{\prime})=\infty$. Then $Q\ll P$, because $P^{\prime}\ll P$, and so $\frac{\mathrm{d}Q}{\mathrm{d}P}=\frac{\mathrm{d}Q}{\mathrm{d}P^{\prime}}\frac{\mathrm{d}P^{\prime}}{\mathrm{d}P}$ and

[TABLE]

∎

Proof of Lemma 5.4.

Let $P^{*}(S)$ satisfy the conditions in the statement of the theorem. Then $P^{*}(S)$ is $\epsilon$-differentially private. By Theorem 4.2, the bound in Eq. 4.2 holds with probability at least $1-\delta$ for the data-dependent prior $P^{*}(S)$ and all posteriors $Q$. By hypothesis, with probability $1-\delta-\delta^{\prime}$, $P^{S}\ll P^{*}(S)$, and so, by Lemma 5.3, $\mathrm{KL}(Q||P^{*}(S))=\mathrm{KL}(Q||P^{S})+Q[\ln\frac{\mathrm{d}P^{S}}{\mathrm{d}P^{*}(S)}].$ ∎

Proof of Lemma 5.5.

Expanding the log ratio of Gaussian densities and then applying Cauchy–Schwarz, we obtain

[TABLE]

The result follows by taking the expectation with respect to $v\sim Q$. ∎

Proof of Lemma 5.6.

Let $g=\frac{\mathrm{d}Q}{\mathrm{d}P}\overset{\text{\smash{{def}}}}{=}\frac{\mathrm{e}^{h}}{P[\mathrm{e}^{h}]}$. Then $\lVert g\rVert_{L^{1}(P)}=1$ and $\lVert g\rVert_{L^{\infty}(P)}\leq\mathrm{e}^{\lVert h\rVert_{L^{\infty}(P)}}$. Let $f(v)=\lVert v-w\rVert_{\Sigma^{-1}}$. Then $\underset{v\sim Q}{\mathbb{E}}{\lVert v-w\rVert_{\Sigma^{-1}}}=\lVert f\rVert_{L^{1}(Q)}=\lVert fg\rVert_{L^{1}(P)}$. Finally, let $\chi$ be the indicator function for the ellipsoid $\{v:\lVert v-w\rVert_{\Sigma^{-1}}\leq R\}$, and let $\bar{\chi}=1-\chi$. Then $\lVert f\chi\rVert_{L^{\infty}(P)}\leq R$ and

[TABLE]

where the inequalities follow from two applications of Hölder’s inequality. Choosing $R=\sqrt{2\lVert h\rVert_{L^{\infty}(P)}}$ gives $\lVert f\rVert_{L^{1}(Q)}\leq\sqrt{2\lVert h\rVert_{L^{\infty}(P)}}+\sqrt{2/\pi}.$ ∎

Proof of Corollary 5.7.

Let $P^{S}=N(w(S))$ and $P^{*}(S)=N(w^{*}(S))$. By the closure of $\epsilon$-differential privacy under composition, $P^{*}(S)$ is $\epsilon$-differentially private and is absolutely continuous with respect to $N(w)$ for all $w$, and so satisfies the conditions of Lemma 5.4. In particular, with probability $1-\delta$, Eq. 4.2 holds with $\mathrm{KL}(Q||P^{*}(S))$ replaced by $\mathrm{KL}(Q||P^{S})+Q[\ln\frac{\mathrm{d}P^{S}}{\mathrm{d}P^{*}(S)}]$.

By hypothesis, with probability at least $1-\delta-\delta^{\prime}$, it also holds that $\lVert w(S)-w^{*}(S)\rVert^{2}_{2}\leq C$. Then, by Lemma 5.5,

[TABLE]

By Lemma 5.6 $\underset{v\sim Q}{\mathbb{E}}\lVert v-w(S)\rVert_{\Sigma^{-1}}$ is bounded for Gibbs measures based on a surrogate risk taking values in a length-$\Delta$ interval by $\sqrt{2\tau\Delta}+\sqrt{2/\pi}$. ∎

Appendix D Bounded cross entropy

In order to achieve differential privacy, we work with a bounded version of the cross entropy loss. The problem is associated with extreme probabilities near zero and one. Our solution is to remap the probabilities $p\mapsto\psi(p)$, where

[TABLE]

is an affine transformation that maps $[0,1]$ to $[\mathrm{e}^{-\ell_{\text{max}}},1-\mathrm{e}^{-\ell_{\text{max}}}]$, removing extreme probability values. Cross entropy loss is then replaced by $g((p_{1},\dots,p_{K}),y)=-\ln\psi(p_{y})$. As a result, cross entropy loss is contained in the interval $[0,\ell_{\text{max}}]$. We take $\ell_{\text{max}}=4$ in our experiments.

Appendix E Computing PAC-Bayes bounds for Gibbs posteriors

For a given PAC-Bayes prior $P$ and dataset $S$, it is natural to ask which posterior $Q=Q(S)$ minimizes the PAC-Bayes bounds. In general, some Gibbs posterior (with respect to $P$) is the minimizer. We now introduce the Gibbs posterior and discuss how we can compute the term $\mathrm{KL}(Q||P)$ in the case of Gibbs posteriors.

For a $\sigma$-finite measure $P$ over $\mathbb{R}^{p}$ and function $g:\mathbb{R}^{p}\to\mathbb{R}$, let $P[g]$ denote the expectation $\int g(h)P(\mathrm{d}h)$ and, provided $P[g]<\infty$, let $P_{g}$ denote the probability measure on $\mathbb{R}^{p}$, absolutely continuous with respect to $P$, with Radon–Nikodym derivative $\frac{\mathrm{d}P_{g}}{\mathrm{d}P}(h)=\frac{g(h)}{P[g]}.$ A distribution of the form $P_{\exp(-\tau g)}$ is generally referred to as a Gibbs distribution. A Gibbs posterior is a probability measure of the form $P_{\exp(-\tau\hat{L}_{S})}$ for some constant $\tau>0$.

The challenge of evaluating PAC-Bayes bounds for Gibbs posteriors is computing the KL term. We now describe a classical estimate and show that it is going to be an upper bound with high probability. Fix a prior $P$ and $\tau\geq 0$, let $Q_{\tau}=P_{\exp(-\tau\hat{L}_{S})}$, and let $Z_{\tau}=P[\exp(-\tau\hat{L}_{S})]$. Then

[TABLE]

Letting $W_{1},\dots,W_{n}\sim Q_{\tau}$, we have

[TABLE]

(The quantity within the expectation on the r.h.s. thus defines an unbiased estimator of $Q_{\tau}$.) In the ideal case, the samples are independent, and then the variance decays at an $n^{-1}$ rate. In practice, it is often difficult to even sample from $Q_{\tau}$ for high values of $\tau$. Indeed, using this approach, we would generally overestimate the risk, which means that we do not obtain an upper bound on the KL term. So instead, we approximate $-\tau Q_{\tau}[\hat{L}_{S}]\approx 0$. Despite this, we obtain nonvacuous bounds. (For an alternative approach to this problem, see [39].)

The second term is challenging to estimate accurately, even assuming that $P$ and $Q_{\tau}$ can be efficiently simulated. One tack is to consider i.i.d. samples $V_{1},\dots,V_{n}\sim P$, and note that

[TABLE]

where the inequality follows from an application of Jensen’s inequality. The quantity within the expectation on the r.h.s. thus forms an upper bound, and indeed, it is possible to show that it does not fall below the l.h.s. by $\epsilon$ with probability exponentially small in $\epsilon$. Thus we have a high-probability (near) upper bound on the term in the KL. One might be inclined to compute a normalized importance sampler, but since $Q$ cannot be effectively sampled, one does not obtain an upper bound with high probability.

The term $\ln Z_{\tau}$ is a generalized log marginal likelihood, which, in our experiments, we approximate by sampling from a Gaussian distribution $P$. Numerical integration techniques rapidly diminish in accuracy with increasing dimensionality of the parameter space.

Note, that due to the convexity of the exponential, samples $W_{i}\sim P$, for which $\hat{L}_{S}(W_{i})$ is close to zero, will dominate $Z_{\tau}$. Due to high dimensionality of the neural network parameter space, with high probability a random sample $W_{i}$ from $P$ will not be far from minima of the empirical loss surface and therefore $\hat{L}_{S}(W_{i})$ will be high. As a results, in our experiments we obtain a very loose upper bound on the KL.

Appendix F Experimental setup

Bounded loss

While it is typical to train neural networks by minimizing cross entropy, this loss is unbounded and our theory is developed only for bounded loss. We therefore work with a bounded version of cross-entropy loss, which we obtain by preventing the network from producing extreme probabilities near zero and one. We describe our modification of the cross entropy in Appendix D.

Datasets

We use two datasets. The first is MNIST, which consists of handwritten digit images with labels in $\{0,...,9\}$. The dataset contains 50,000 training images and 10,000 validation images.

We also use a small synthetically generated dataset, which we refer to as SYNTH. The SYNTH dataset consists of 50 training data and 100 heldout data. Each input is a 4-dimensional vector sampled independently from a zero-mean Gaussian distribution with an identity covariance matrix. The true classifier is linear. The norm of the separating hyperplane is sampled from a standard normal.

The random label experiments are performed on a dataset where the labels are independently and uniformly generated and thus the risk is 0.5 under 0–1 loss.

Architectures

We use SGLD without any standard modifications (such as momentum and batch norm) to ensure that the stationary distribution is that of SGLD. For MNIST, we use a fully connected neural network architecture. The network has 3 layers and 600 units in each hidden layer. The input is a 784 dimensional vector and the output layer has 10 units. For the SYNTH dataset, we use a fully connected neural network with 1 hidden layer consisting of 100 units. The input layer has 4 units, and the output layer is a single unit.

Learning rate

At epoch $t$, the learning rate is $a_{t}=a_{0}*t^{-b}$, where $a_{0}$ is the initial learning rate and $b$ is the decay rate. We set $b=0.5$ and use $a_{0}=10^{-5}$ for MNIST experiments and $a_{0}=10^{-3}$ for SYNTH experiments.

Minibatches

An epoch refers to the full pass through the data in mini batches of size 128 for MNIST data, and 10 for SYNTH data.