Clustering and Median Aggregation Improve Differentially Private Inference

Alex Bie; Kareem Amin; Natalia Ponomareva; Salman Avestimehr; Sara Babakniya; Umar Syed; Weiwei Kong

REVIEW 4 major objections 5 minor 25 references

Clustering and Median Aggregation Improve Differentially Private Inference

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that clustering sensitive inputs before batching, and aggregating next-token logits with a private median instead of an average, yields differentially private synthetic text that is more representative and produced at…

desk verdict The median aggregation and clustering are genuine improvements, but the 'significantly lower privacy cost' claim compares an ex-post data-dependent epsilon to a worst-case one, so the paper needs reframing before it's citable. read the letter →

arxiv 2506.04566 v1 pith:RPWGXZAR submitted 2025-06-05 cs.LG cs.AIcs.CLcs.CR

Kareem Amin , Salman Avestimehr , Sara Babakniya , Alex Bie , Weiwei Kong , Natalia Ponomareva , Umar Syed This is my paper

classification cs.LGcs.AIcs.CLcs.CR

keywords differentiallyprivateinferencesynthetictextgenerationmedianaggregationclusteringdata-dependentdifferentialprivacyex-postMAUVElargelanguagemodels

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the low quality of differentially private synthetic text comes from a fixable design choice: sampling sensitive seed texts uniformly at random forms batches that mix unrelated topics, so the aggregated rewrite averages distinct semantic clusters into mush. It proposes to first cluster the seeds, using centers learned from a public dataset (DBPedia) with a small privacy cost for rebalancing, and then to aggregate the LLM's next-token logits within each batch by a component-wise median of clipped logits rather than the mean used by prior work. This combination lets the authors state a data-dependent, ex-post differential privacy guarantee, Theorem 1, whose per-batch and per-token privacy cost shrinks when the batch's next-token predictions align. On AGNews, Yelp, and NYT Topics, the method improves MAUVE and maintains downstream BERT accuracy while reporting substantially lower epsilon than the mean-based baseline (e.g., about 2.4 vs 9.9 + 0.1 on AGNews at matched output). A reader should care because this is a path to generating large, useful, and formally private synthetic corpora from an off-the-shelf LLM without training.

What carries the argument

The central object is the median aggregation rule over clipped logit vectors, $\operatorname{aggregate}(Z) = \operatorname{median}(\{\operatorname{clip}_c(z) : z \in Z\})$, paired with cluster-based batching, $\operatorname{batch}(s) = (\operatorname{cluster}(s), r)$, where the cluster assignment $\operatorname{cluster}(s)$ uses public k-means centers in Gecko embedding space and a noisy rebalancing step chooses the top-$k'$ centers. Clipping maps each logit vector's maximum component to $c$, forcing alignment of the most likely token across inferences; the median's local sensitivity is then governed by the median gap, the distance from the median to its neighbors in each token component. The proof of Theorem 1 builds on Lemma 1, which bounds the median of a neighboring batch between the left- and right-medians of the original batch, sandwiching the ratio of next-token sampling probabilities and yielding the per-token privacy cost function $\gamma(Z, x)$ defined in Appendix A.

What would settle it

Run the method on a private corpus drawn from a domain far outside DBPedia's coverage, such as structured clinical notes or source code, with the same public centers from DBPedia, and compare the reported per-batch epsilon and MAUVE against the AGNews results. If the cluster-size distribution is highly skewed and the median-gap epsilon at matching output exceeds the mean-based unconditional epsilon, the claimed privacy advantage fails in that regime. A direct complementary test: compute the median gap for batches constructed from a single Yelp cluster versus batches sampled uniformly from all Yelp labels; if the uniform batches do not show a larger per-token gamma and a larger summed epsilon, the mechanism's central premise is falsified.

Watch

Extended reading notes

Core claim

The central claim is that clustering before batching and using the median instead of the mean for per-token aggregation yields differentially private synthetic text that is both more representative and cheaper in privacy. More precisely, the authors prove that Algorithm 1 with cluster-based batching (Eq. 1) and median aggregation (Eq. 2) satisfies $\varepsilon$-data-dependent ex-post differential privacy with $\varepsilon(D, X) = \max_{i \in [m]} \sum_{t=1}^{n} \gamma(Z_{i,t}, x_{i,t})$, where the per-token cost $\gamma$ is an increasing function of the median gap of the clipped logit scores for the sampled token. The mechanism of the proof is that clipping aligns the heads of predicted distributions, and the median's local sensitivity is small exactly when the batch's predictions are similar, so homogeneity converts directly into a privacy saving. The experiments separate the contributions: clustering alone improves MAUVE even with infinite epsilon, and median aggregation matches or exceeds mean-based quality while reporting a data-dependent epsilon about a quarter of the mean's unconditional epsilon in the best cases.

Load-bearing premise

The utility and the low reported privacy cost both rest on the assumption that public DBPedia cluster centers, after DP rebalancing, partition the private data into semantically homogeneous clusters; if the private domain differs greatly from Wikipedia-style text (for instance specialized medical records), clusters become imbalanced, batches stay heterogeneous, and the median's local sensitivity — and hence the reported epsilon — would be large, erasing the privacy-cost advantage.

Editorial extensions

If this is right

Uniform random batching is the wrong default for DP inference: clustering inputs before batching improves MAUVE even at infinite epsilon, and the gain stacks with other improvements.
Median aggregation converts the homogeneity gained from clustering into a formal privacy saving: because local sensitivity shrinks as predictions align, the same synthetic data can be generated with a smaller data-dependent epsilon than the mean-based baseline.
Data-dependent and ex-post accounting changes what practitioners should report: epsilon is now a function of the actual batch and output, so the effective privacy cost can be much lower than a worst-case bound; the paper's own per-batch plots show many batches below the reported max.
The method achieves high MAUVE (e.g., about 0.7 versus lower baseline scores) and BERT accuracy comparable to mean-based methods, meaning synthetic data is useful for downstream training.
Because the bound in Theorem 1 is a max over batches, adaptive generation that allocates more noise or more tokens to high-epsilon batches could bring the reported worst-case epsilon closer to the median batch epsilon.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the median's local sensitivity keeps falling as batches become more aligned, one could adaptively sub-cluster or merge clusters until a target per-batch epsilon is reached, spending a little more of the small rebalancing budget to save a larger amount of inference budget; the paper's own per-batch plots (median 1.41 vs max 2.40 on AGNews) suggest this headroom exists.
The public-center approach is a transferable prior: the same DBPedia centers are used for all three private datasets, so a natural extension is to combine public centers from multiple text domains, or to run the private rebalancing step on a proxy embedding summary, to widen the domain of applicability beyond Wikipedia-like text.
The requirement of logit access limits deployment on sampling-only APIs; a testable extension is to replace the median of logits with a private aggregation over top-k sampled tokens, which would trade some alignment for API compatibility.
Because the paper uses clustering only to form batches, the same public centers could be reused to condition prompts on cluster identity, potentially improving the generator's adherence to cluster-consistent style or topic without additional privacy cost.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. First, it does something real: replacing mean aggregation with median aggregation in DP inference, combined with public-center clustering and DP rebalancing, produces synthetic text that is much better by MAUVE and downstream accuracy metrics. The privacy proof (Theorem 1, Appendix A) is structurally sound—the per-token cost function is a genuine local-sensitivity calculation, and the chain-rule composition is correct. Second, the headline claim that this comes 'at significantly lower privacy cost' is not apples-to-apples. The median mechanism's epsilon is data-dependent and ex-post; the mean baseline's is a worst-case guarantee. The paper is explicit about this distinction in Section 5, but the abstract and Table 3 compare the realized median epsilon (2.40) with the unconditional mean epsilon (10), which overstates the advantage.

What's actually new here is the combination of clustering with median aggregation. Median aggregation alone is known, and DP clustering is known, but the way they use public DBPedia centers and rebalance with a small privacy budget (epsilon=0.1) is practical and clearly explained. The ablation of Baseline++ (pretrained model, two in-context examples) is honest—they separate the gains from clustering and from the median. The empirical improvements are consistent across AGNews, Yelp, and NYT Topics, which gives me some confidence.

The soft spots are in the framing and transparency. The worst-case sensitivity of the median over logits in [-c,c] is bounded by the full range 2c, which, at c=6 and temperature 1.5, gives a per-token cost around exp(12/1.5)~2981; summed over ~1000 tokens, the worst-case epsilon is effectively unbounded. The algorithm only provides a finite guarantee ex-post, for the realized data and output. That's fine for a research contribution, but the comparison in the abstract needs a clear caveat. There's also an inconsistency: the paper motivates its clustering by saying prior work samples batches uniformly at random, but its own baseline (Amin et al.) uses within-label batching. That weakens the 'uniform sampling degrades quality' motivation. No code is released, and the reported epsilon values come from one run without seed variance, so it's hard to know how brittle the 2.4 number is.

Bottom line: this is a solid paper worth a serious referee. The privacy proof holds, and the empirical improvements are real on the domains tested. But before the 'significantly lower privacy cost' claim is citable, the authors need to reframe the comparison as ex-post vs. worst-case, report the worst-case sensitivity of the median, and clarify the batching history. I'd suggest the editor send it out, with a request for revisions along those lines. After that, I'd cite it.

Referee Report

4 major / 5 minor

Summary. The paper studies differentially private (DP) language model inference for synthetic text generation. It observes that uniform random batching of sensitive seed texts yields heterogeneous batches and poor representativeness, and proposes to group seeds by clustering before batching. For aggregation of next-token logits, it replaces the mean of clipped logit vectors with a component-wise median, and proves (Theorem 1) an epsilon-data-dependent ex-post DP guarantee whose per-token cost depends on the local sensitivity of the median on the realized logit set. The paper evaluates the method on AGNews, Yelp, and NYT Topics using DBPedia as public clustering data, reporting improvements in MAUVE and downstream BERT accuracy, and reporting lower realized privacy costs than a mean-aggregation baseline.

Significance. If the claims hold, this work makes a useful contribution: clustering improves the representativeness of DP-inference synthetic text, and the median local-sensitivity analysis is a legitimate extension of the DP-inference toolkit. The privacy proof is structurally sound, and the experimental protocol is detailed, with multiple seeds and clearly reported hyperparameters. However, the headline privacy-cost advantage is not established as a like-for-like comparison: the reported median epsilon is a realized ex-post value, not a worst-case bound, and the comparison is also confounded by different clipping constants. The paper's empirical contribution remains valuable, but the central privacy-cost claim needs substantial reframing and additional analysis.

major comments (4)

[Section 5, Table 3, Abstract] The abstract and Section 8 claim 'significantly lower privacy cost' based on Table 3, but the comparison is between the median mechanism's realized ex-post epsilon (e.g., 2.40 + 0.16) and the mean baseline's worst-case unconditional epsilon (10 or 3). These are not comparable quantities: Theorem 1's epsilon(D,X) is a function of the actual logit vectors and the sampled output, while the baseline epsilon is an algorithm-level worst-case bound. The median mechanism has no useful worst-case bound: from Definition 3, the per-token cost gamma can grow linearly in c/tau for adversarial median gaps, and the sum in Theorem 1 over the realized sequence length (up to 733 tokens at epsilon=3 in Table 5) can be in the thousands, far exceeding the baseline's 10. The reported low values are empirical observations on the three evaluated datasets. The paper should either explicitly qualify the privacy-cost claim as a realized ex-post cost on these benchmarks, or provide a like-for-like comparison (e.g., a worst-case analysis of the median mechanism, or the realized ex-post cost of the mean baseline).
[Table 5] The median runs use clipping constant c=6, while all mean-based runs use c=9. Because both the global sensitivity of the mean aggregation and the local sensitivity in Definition 3 depend on c, the difference in reported privacy cost between the median and mean methods is confounded with the choice of c. To attribute the improvement to median aggregation rather than to a smaller clipping range, the paper should match c across the compared methods or provide a sweep over c.
[Section 4.1, Table 3] The utility and the realized privacy cost both rely on the assumption that the public DBPedia centers, after rebalancing, assign the private data to semantically homogeneous clusters. The three target datasets (AGNews, Yelp, NYT Topics) are all Wikipedia-based or news/review text, so they are aligned with the public data. For a private domain far from Wikipedia-like text (e.g., medical records), the rebalanced clusters could remain heterogeneous, the median gaps would be large, and the realized epsilon could exceed the mean baseline's worst-case epsilon, eliminating the claimed advantage. The paper should test at least one non-Wikipedia-like domain, or provide an explicit limitation plus a quantitative relation between cluster heterogeneity and the realized epsilon.
[Section 5, Theorem 1] The proof of Theorem 1 assumes the batch() function is fixed: it conditions on the random r and then argues that only one batch changes between neighboring datasets. The experimental pipeline 'public centers with rebalancing' (Section 4.1) selects the top-k' cluster centers using noisy counts of the private data, making batch() data-dependent. For neighboring datasets, the selected centers can change, so many seeds can be reassigned simultaneously and the 'single batch' step no longer holds. The paper should provide a formal composition argument: the rebalancing is an epsilon1-DP mechanism producing centers, and for every fixed center set, Algorithm 1 with the resulting batch() satisfies the ex-post guarantee; the total guarantee then follows by composition. As written, the theorem covers only the fixed-centers variant, not the exact procedure used in the experiments.

minor comments (5)

[Appendix A, Definition 2] In the even-cardinality case, 'right-median(Z)_x = c' refers to an undefined c; it should be b.
[Appendix A, Proof of Theorem 1] The notation for the neighboring batch's generated sequence is inconsistent: the text defines x'_{i,1},...,x'_{i,t} and later uses x'_{i,n}; please clarify the intended sequence length.
[Table 3] The entries '2.40 + 0.16' in the Privacy epsilon column are easy to misread as a sum of two privacy parameters; consider writing e.g. '2.40 (inference) + 0.10 (rebalancing)' or explaining the additive term directly in the table caption.
[Section 8] The word 'embarassingly' should be 'embarrassingly'.
[Figures 3-4] The Greek letter epsilon appears as a box glyph in the plain-text captions; please check the rendering in the compiled version.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the median mechanism's ex-post DP guarantee is a genuine local-sensitivity calculation; the only self-referential element is a non-load-bearing self-cited baseline.

full rationale

The paper's derivation chain is self-contained. Theorem 1 (Section 5) proves a data-dependent ex-post DP guarantee for Algorithm 1 with median aggregation; the per-token cost gamma (Definition 3, Appendix A) is derived from the local sensitivity of the component-wise median via Lemma 1 and Lemma 2, and the proof uses the actual probability ratio of the sampling mechanism, not a fitted value. The reported epsilons (e.g., 2.40 + 0.16 in Table 3) are realized ex-post values, explicitly labeled as such ('data-dependent and ex-post DP guarantee' in the abstract; 'report the resultant data-dependent ex-post epsilon' in Section 6.1), so they are not a fitted parameter renamed as a prediction. The clustering step uses public DBPedia centers plus a DP rebalanced count; the 0.16 privacy cost is an additional DP mechanism, not a hidden input. The only self-referential element is the baseline 'Mean Baseline [Amin et al., 2024]', which is the authors' own prior work; however, it is externally published, and the median mechanism's privacy theorem is proved independently of that baseline. The headline claim of 'significantly lower privacy cost' compares an ex-post data-dependent epsilon with a worst-case unconditional epsilon for the mean baseline; this is a comparability caveat (a correctness risk), not a circular reduction. No equation reduces to its own input by construction.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

No new theoretical entities are introduced; the ex-post data-dependent DP notion is from prior literature (Ligett et al., Papernot et al.). The central claims rest on standard DP machinery plus a domain assumption that public Wikipedia-derived clusters transfer to private text domains. The free parameters are hyperparameters of the generation and clustering pipeline, not quantities fitted to force a specific privacy number.

free parameters (6)

clipping constant c = 6 (median), 9 (mean)
Bounds logits to [-c,c]; affects both utility and privacy cost. Chosen per aggregation method, tuned on AGNews.
sampling temperature tau = 1.5
Used in softmax and in privacy cost gamma; higher tau reduces privacy cost. Set as standard generation temperature.
number of public clusters k = 1000
Initial k-means clusters from DBPedia; affects granularity of batching.
target clusters after rebalancing k' = 60 (AGNews/Yelp), 80 (NYT)
Chosen to balance cluster sizes; affects batch homogeneity.
rebalancing privacy budget = 0.1 to 0.18
Noisy counts of seeds per public cluster to select top-k' centers.
batch size (parallel contexts) = 64 or 256
Number of seeds per batch; larger batch lowers per-token privacy cost but increases compute.

assumptions (6)

standard math Exponential mechanism privacy guarantee for softmax sampling with logit scores
Used to bound token sampling probability ratio; standard DP result.
standard math Composition of per-token privacy costs across tokens and batches
Chain rule over generated tokens; standard composition.
standard math Local sensitivity of median shifts only to adjacent values when one element changes (Lemma 1)
Core lemma for median sensitivity; proven in appendix.
domain assumption Public DBPedia cluster centers transfer to private data domains
Needed for clustering to work; paper argues Wikipedia is universal, but no formal guarantee.
domain assumption Semantic embeddings (Gecko) place similar texts close
Clustering relies on embedding quality; not proven for all domains.
domain assumption Access to logits from the generation model
Median aggregation requires logits, not just sampling APIs; noted as limitation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Clustering and Median Aggregation Improve Differentially Private Inference." pith.science (2026). https://pith.science/paper/RPWGXZAR

@misc{pith2026250604566,
  author       = {Pith},
  title        = {Pith review of: Clustering and Median Aggregation Improve Differentially Private Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RPWGXZAR}},
  note         = {Machine review of arXiv:2506.04566}
}

read the original abstract

Differentially private (DP) language model inference is an approach for generating private synthetic text. A sensitive input example is used to prompt an off-the-shelf large language model (LLM) to produce a similar example. Multiple examples can be aggregated together to formally satisfy the DP guarantee. Prior work creates inference batches by sampling sensitive inputs uniformly at random. We show that uniform sampling degrades the quality of privately generated text, especially when the sensitive examples concern heterogeneous topics. We remedy this problem by clustering the input data before selecting inference batches. Next, we observe that clustering also leads to more similar next-token predictions across inferences. We use this insight to introduce a new algorithm that aggregates next token statistics by privately computing medians instead of averages. This approach leverages the fact that the median has decreased local sensitivity when next token predictions are similar, allowing us to state a data-dependent and ex-post DP guarantee about the privacy properties of this algorithm. Finally, we demonstrate improvements in terms of representativeness metrics (e.g., MAUVE) as well as downstream task performance. We show that our method produces high-quality synthetic data at significantly lower privacy cost than a previous state-of-the-art method.

Figures

Figures reproduced from arXiv: 2506.04566 by the authors.

**Figure 2.** Cluster sizes of different clustering methods for AGNews dataset. a) [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** We plot the distribution of per-batch ε costs of the median mechanism on AGNews. The maximum over all batches obtains ε = 2.40, which is the privacy guarantee we report in [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: We plot the distribution of [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]

**Figure 5.** Figure 5: We plot the average per-token ε costs of the median mechanism on AGNews (ε = 2.40). Consensus builds throughout generation, decreasing the privacy cost. 0 50 100 150 200 250 Token position 0.000 0.002 0.004 0.006 0.008 increment Per-token (mean ± 2SE) mean increment ±2…

**Figure 6.** Figure 6: We plot the average per-token ε costs of the median mechanism on Yelp (ε = 2.21). B.2 Evaluation hyperparameters MAUVE. The absolute value of MAUVE scores can vary due to the precise implementation details, however the relative rankings it assigns to datasets is robust…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 14 canonical work pages

[1]

Most batches have substantially smaller privacy cost. 1 2 3 4 5 Batch 0 20 40 60 80 100 120 140Count Distribution of Batch 's median = 2.18 .75 = 2.45 max = 5.04 1 2 3 4 5 Batch 0.0 0.2 0.4 0.6 0.8 1.0Cumulative fraction Empirical CDF of Batch 's median = 2.18 .75 = 2.45 max = 5.04 Figure 4: We plot the distribution ofper-batchε costsof the median mechani...

work page 2021
[2]

```" for PT,

21 B.4 Datasets and models Datasetn train Description Usage Source DBPedia 560,000 14-category Wikipedia article topic Public clusters [Zhang et al., 2015] 2 AGNews 108,000 4-way news topic classification Synthesis target [Zhang et al., 2015] 3 Yelp Polarity 504,000 2-way review sentiment classification Synthesis target [Zhang et al., 2015]4 NYT Topics 23...

work page 2015
[4]

Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

Xinyu Tang, Richard Shin, Huseyin A. Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim. Privacy-preserving in-context learning with differentially private few-shot generation. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024,

work page 2024
[7]

Frank McSherry and Kunal Talwar

doi: 10.48550/ARXIV.2403.20327. Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In48th Annual IEEE Symposium on Foundations of Computer Science (FOCS’07), pages 94–103. IEEE,

arXiv doi:10.48550/arxiv.2403.20327
[8]

DPM: Clustering Sensitive Data through Separation

URLhttps://arxiv. org/abs/2307.02969. Andrew Rosenberg and Julia Hirschberg. V-measure: A conditional entropy-based external cluster evaluation measure. InProceedings of the 2007 joint conference on empirical methods in natural language processing and computational natural language learning (EMNLP-CoNLL), pages 410–420,

work page Pith review arXiv 2007
[12]

Synthetic text generation with differential privacy: A simple and practical recipe.arXiv preprint arXiv:2210.14348,

Xiang Yue, Huseyin A Inan, Xuechen Li, Girish Kumar, Julia McAnallen, Hoda Shajari, Huan Sun, David Levitan, and Robert Sim. Synthetic text generation with differential privacy: A simple and practical recipe.arXiv preprint arXiv:2210.14348,

arXiv
[13]

Justus Mattern, Zhijing Jin, Benjamin Weggenmann, Bernhard Schoelkopf, and Mrinmaya Sachan

doi: 10.18653/v1/2023.acl-long.74. Justus Mattern, Zhijing Jin, Benjamin Weggenmann, Bernhard Schoelkopf, and Mrinmaya Sachan. Differentially private language models for secure data sharing. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 4860–4873, A...

doi:10.18653/v1/2023.acl-long.74 2023
[14]

doi: 10.18653/v1/2022.emnlp-main.323

Association for Computational Linguistics. doi: 10.18653/v1/2022.emnlp-main.323. Aldo Carranza, Rezsa Farahani, Natalia Ponomareva, Alexey Kurakin, Matthew Jagielski, and Milad Nasr. Synthetic query generation for privacy-preserving deep retrieval systems using differentially private language models. In Kevin Duh, Helena Gomez, and Steven Bethard, editors...

doi:10.18653/v1/2022.emnlp-main.323 2022

Show all 25 references

[15]

Alexey Kurakin, Natalia Ponomareva, Umar Syed, Liam MacDermed, and Andreas Terzis

Association for Computational Linguistics. Alexey Kurakin, Natalia Ponomareva, Umar Syed, Liam MacDermed, and Andreas Terzis. Harnessing large-language models to generate private synthetic text.arXiv preprint arXiv:2306.01684,

arXiv
[16]

Knowledgesg: Privacy-preserving synthetic text generation with knowledge distillation from server.arXiv preprint arXiv:2410.05725,

Wenhao Wang, Xiaoyu Liang, Rui Ye, Jingyi Chai, Siheng Chen, and Yanfeng Wang. Knowledgesg: Privacy-preserving synthetic text generation with knowledge distillation from server.arXiv preprint arXiv:2410.05725,

arXiv
[17]

Differentially private tabular data synthesis using large language models

Toan V Tran and Li Xiong. Differentially private tabular data synthesis using large language models. arXiv preprint arXiv:2406.01457,

arXiv
[18]

Differentially private synthetic data via foundation model APIs 2: Text

Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, Bo Li, and Sergey Yekhanin. Differentially private synthetic data via foundation model APIs 2: Text. InICLR 2024 Workshop on Secure and Trustw...

2024
[19]

Differentially private synthetic data via apis 3: Using simulators instead of foundation model.arXiv preprint arXiv:2502.05505,

Zinan Lin, Tadas Baltrusaitis, and Sergey Yekhanin. Differentially private synthetic data via apis 3: Using simulators instead of foundation model.arXiv preprint arXiv:2502.05505,

arXiv
[20]

Data-adaptive differentially private prompt synthesis for in-context learning.arXiv preprint arXiv:2410.12085,

Fengyu Gao, Ruida Zhou, Tianhao Wang, Cong Shen, and Jing Yang. Data-adaptive differentially private prompt synthesis for in-context learning.arXiv preprint arXiv:2410.12085,

arXiv
[23]

Iulia Turc, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova

URLhttps://www.kaggle.com/datasets/ aryansingh0909/nyt-articles-21m-2000-present. Iulia Turc, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Well-read students learn better: On the importance of pre-training compact models.arXiv preprint arXiv:1908.08962v2,

2000 arXiv
[2006]

Data-dependent differentially private parameter learning for directed graphical models

Amrita Roy Chowdhury, Theodoros Rekatsinas, and Somesh Jha. Data-dependent differentially private parameter learning for directed graphical models. InInternational Conference on Machine Learning, pages 1939–1951. PMLR,

1939
[2007]

Synthesizing privacy-preserving text data via finetuning without finetuning billion-scale llms.arXiv preprint arXiv:2503.12347,

Bowen Tan, Zheng Xu, Eric Xing, Zhiting Hu, and Shanshan Wu. Synthesizing privacy-preserving text data via finetuning without finetuning billion-scale llms.arXiv preprint arXiv:2503.12347,

arXiv
[2015]

Nyt articles: 2.1m+ (2000-present),

Aryan Singh. Nyt articles: 2.1m+ (2000-present),

2000
[2017]

Differentially private k-means clustering via exponential mechanism and max cover.arXiv preprint arXiv:2009.01220,

Anamay Chaturvedi, Huy Nguyen, and Eric Xu. Differentially private k-means clustering via exponential mechanism and max cover.arXiv preprint arXiv:2009.01220,

2009 arXiv
[2018]

Prompt public large language models to synthesize data for private on-device applications.arXiv preprint arXiv:2404.04360, 2024a

Shanshan Wu, Zheng Xu, Yanxiang Zhang, Yuanbo Zhang, and Daniel Ramage. Prompt public large language models to synthesize data for private on-device applications.arXiv preprint arXiv:2404.04360, 2024a. Antonio Ginart, Laurens van der Maaten, James Zou, and Chuan Guo. Submix: P...

arXiv
[2021]

Jinhyuk Lee, Zhuyun Dai, Xiaoqi Ren, Blair Chen, Daniel Cer, Jeremy R. Cole, Kai Hui, Michael Boratko, Rajvi Kapadia, Wen Ding, Yi Luan, Sai Meher Karthik Duddu, Gustavo Hernández Ábrego, Weiqiang Shi, Nithi Gupta, Aditya Kusupati, Prateek Jain, Siddhartha Reddy Jonnala- gadda...

arXiv
[2022]

Differentially private decoding in large language models

Jimit Majmudar, Christophe Dupuy, Charith Peris, Sami Smaili, Rahul Gupta, and Richard Zemel. Differentially private decoding in large language models. InNAACL 2022 Second Workshop on Trustworthy Natural Language Processing (TrustNLP),

2022
[2023]

Adaptively private next-token prediction of large language models.arXiv preprint arXiv:2410.02016, 2024a

James Flemings, Meisam Razaviyayn, and Murali Annavaram. Adaptively private next-token prediction of large language models.arXiv preprint arXiv:2410.02016, 2024a. James Flemings, Meisam Razaviyayn, and Murali Annavaram. Differentially private next-token prediction of large lan...

arXiv
[2024]

Private prediction for large-scale synthetic text generation

13 Kareem Amin, Alex Bie, Weiwei Kong, Alexey Kurakin, Natalia Ponomareva, Umar Syed, Andreas Terzis, and Sergei Vassilvitskii. Private prediction for large-scale synthetic text generation. In Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, Florid...

2024
[2025]

Calibrating noise to sensitivity in private data analysis

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. InTheory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7,

2006

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Most batches have substantially smaller privacy cost. 1 2 3 4 5 Batch 0 20 40 60 80 100 120 140Count Distribution of Batch 's median = 2.18 .75 = 2.45 max = 5.04 1 2 3 4 5 Batch 0.0 0.2 0.4 0.6 0.8 1.0Cumulative fraction Empirical CDF of Batch 's median = 2.18 .75 = 2.45 max = 5.04 Figure 4: We plot the distribution ofper-batchε costsof the median mechani...

work page 2021

[2] [2]

```" for PT,

21 B.4 Datasets and models Datasetn train Description Usage Source DBPedia 560,000 14-category Wikipedia article topic Public clusters [Zhang et al., 2015] 2 AGNews 108,000 4-way news topic classification Synthesis target [Zhang et al., 2015] 3 Yelp Polarity 504,000 2-way review sentiment classification Synthesis target [Zhang et al., 2015]4 NYT Topics 23...

work page 2015

[3] [4]

Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

Xinyu Tang, Richard Shin, Huseyin A. Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim. Privacy-preserving in-context learning with differentially private few-shot generation. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024,

work page 2024

[4] [7]

Frank McSherry and Kunal Talwar

doi: 10.48550/ARXIV.2403.20327. Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In48th Annual IEEE Symposium on Foundations of Computer Science (FOCS’07), pages 94–103. IEEE,

arXiv doi:10.48550/arxiv.2403.20327

[5] [8]

DPM: Clustering Sensitive Data through Separation

URLhttps://arxiv. org/abs/2307.02969. Andrew Rosenberg and Julia Hirschberg. V-measure: A conditional entropy-based external cluster evaluation measure. InProceedings of the 2007 joint conference on empirical methods in natural language processing and computational natural language learning (EMNLP-CoNLL), pages 410–420,

work page Pith review arXiv 2007

[6] [12]

Synthetic text generation with differential privacy: A simple and practical recipe.arXiv preprint arXiv:2210.14348,

Xiang Yue, Huseyin A Inan, Xuechen Li, Girish Kumar, Julia McAnallen, Hoda Shajari, Huan Sun, David Levitan, and Robert Sim. Synthetic text generation with differential privacy: A simple and practical recipe.arXiv preprint arXiv:2210.14348,

arXiv

[7] [13]

Justus Mattern, Zhijing Jin, Benjamin Weggenmann, Bernhard Schoelkopf, and Mrinmaya Sachan

doi: 10.18653/v1/2023.acl-long.74. Justus Mattern, Zhijing Jin, Benjamin Weggenmann, Bernhard Schoelkopf, and Mrinmaya Sachan. Differentially private language models for secure data sharing. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 4860–4873, A...

doi:10.18653/v1/2023.acl-long.74 2023

[8] [14]

doi: 10.18653/v1/2022.emnlp-main.323

Association for Computational Linguistics. doi: 10.18653/v1/2022.emnlp-main.323. Aldo Carranza, Rezsa Farahani, Natalia Ponomareva, Alexey Kurakin, Matthew Jagielski, and Milad Nasr. Synthetic query generation for privacy-preserving deep retrieval systems using differentially private language models. In Kevin Duh, Helena Gomez, and Steven Bethard, editors...

doi:10.18653/v1/2022.emnlp-main.323 2022