Supplementary Materials for " Private Set Generation with Discriminative Information "

These supplementary materials include the privacy analysis ( A), the details of the adopted algorithms ( B), and the details of experiment setup ( C), and additional results and discussions ( D). Our privacy computation is based on the notion of Rényi-DP, which we recall as follows. Lastly, we use the following theorem to convert (α, ε)-RDP to (ε, δ)-DP. We present the pseudocode of the generator prior experiments (Section 6 of the main paper) in Algorithm 2, which is supplementary to Figure 4,5 and Equation 8 of the main paper. While it is possible to allow random sampling of the latent code and generate changeable S to mimic the training of generative models (i.e., train a generative network using the gradient matching loss), we observe that the training easily fails in the early stage.