  Counterfactual, serving as one emerging type of model explanation, has
attracted tons of attentions recently from both industry and academia.
Different from the conventional feature-based explanations (e.g.,
attributions), counterfactuals are a series of hypothetical samples which can
flip model decisions with minimal perturbations on queries. Given valid
counterfactuals, humans are capable of reasoning under ``what-if''
circumstances, so as to better understand the model decision boundaries.
However, releasing counterfactuals could be detrimental, since it may
unintentionally leak sensitive information to adversaries, which brings about
higher risks on both model security and data privacy. To bridge the gap, in
this paper, we propose a novel framework to generate differentially private
counterfactual (DPC) without touching the deployed model or explanation set,
where noises are injected for protection while maintaining the explanation
roles of counterfactual. In particular, we train an autoencoder with the
functional mechanism to construct noisy class prototypes, and then derive the
DPC from the latent prototypes based on the post-processing immunity of
differential privacy. Further evaluations demonstrate the effectiveness of the
proposed framework, showing that DPC can successfully relieve the risks on both
extraction and inference attacks.
