Pith. sign in

REVIEW 4 major objections 6 minor 135 references

SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Classifiers trained on synthetic diffusion images can beat DP-SGD classifiers on both utility and privacy in a three-dataset benchmark.

desk verdict Broadest empirical SoK on synthetic-image privacy to date; the headline ranking is plausible but metric-dependent and needs stronger attacks and pre-registered hyperparameters before it becomes a decision rule. read the letter →

arxiv 2506.19360 v2 pith:LWBKQDHN submitted 2025-06-24 cs.CR cs.CV

Yunsung Chung , Yunbei Zhang , Nassir Marrouche , Jihun Hamm This is my paper
classification cs.CRcs.CV
keywords syntheticimagegenerationprivacy-preservingdatasynthesismembershipinferenceattackdifferentialprivacydiffusionmodelsutility-privacytradeoffbenchmarkGAN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether synthetic images can replace real images in privacy-preserving machine learning, and which way of sharing them—releasing the synthetic images directly or releasing a classifier trained on them—balances utility against membership-inference privacy. It organizes the whole problem as a generation-sampling-classification pipeline and benchmarks GANs, VAEs, diffusion models, and data condensation methods, with and without differential privacy or other mitigations, on three image datasets. The central claim is that classifiers trained on high-quality synthetic data, especially from diffusion-based methods, can achieve better utility-privacy tradeoffs than classifiers trained directly on real data with differentially private SGD. The paper also finds that the safer release artifact depends on the dataset's visual homogeneity: classifiers are safer for visually diverse data, while direct image release can be safer for homogeneous chest X-rays. A sympathetic reader would take away that synthetic-data pipelines are a practical alternative to DP training, not just a theoretical fallback.

What carries the argument

The organizing object is the generation-sampling-classification pipeline: a generative model trained on private data, a synthetic dataset sampled from it, and a classifier trained on that dataset; the pipeline locates every attack and mitigation at stage A, B, or C. The measuring instrument is a benchmark with three model-agnostic membership-inference attacks: Attack 1 compares real queries to the whole synthetic set in an encoder's latent space, Attack 2 thresholds classifier losses, and Attack 3 adapts LiRA with label-flipped canaries to estimate individual-level privacy. Together they yield TPR@1%FPR and AUC privacy scores paired with classification-based utility scores, allowing direct comparison of GAN, VAE, diffusion, and data-condensation methods under the same threat model.

What would settle it

Run the same released artifacts through an independent, stronger membership-inference attack that does not reuse the benchmark's encoder or loss threshold—for example LiRA on every method, or a white-box diffusion attack—and check whether the ordering (diffusion-trained classifiers above DP-SGD classifiers, and images safer than classifiers on CheXpert) survives. If the rank order inverts under the alternative attack, the paper's central utility-privacy conclusions would fail.

Watch

Extended reading notes

Core claim

The paper's central claim is that synthetic image data, especially when produced by modern diffusion models and used to train a downstream classifier, can meet or beat the utility-privacy balance of classifiers trained directly on real data with differentially private SGD. On the benchmark, methods such as LoRA fine-tuning and SMP-LoRA achieved higher or equal utility than the non-private DP-SGD baseline while exhibiting lower membership-inference attack success, and on Fitzpatrick17k some synthetic-trained classifiers improved accuracy for darker skin types that DP-SGD tended to hurt. The authors also claim that the safer release artifact depends on the dataset: classifiers are the safer release for visually diverse data, while direct image release can be safer for homogeneous chest X-rays. Privacy gains arise both from explicit mitigation (adversarial training, DP fine-tuning) and from implicit choices such as LoRA rank, guidance scale, and generating multiple synthetic images per real example, which dilute individual-sample memorization.

Load-bearing premise

The privacy ranking assumes that the two model-agnostic membership-inference attacks (latent-similarity and loss-threshold), under the subset auxiliary threat model, measure privacy risk fairly across all generative methods; if the fixed encoder or the loss threshold is biased toward some architectures, or the hyperparameter selection overfits these attacks, the relative conclusions about images versus classifiers and diffusion versus GAN could change.

Editorial extensions

If this is right

  • For visually diverse datasets such as CelebA and Fitzpatrick17k, releasing a classifier trained on synthetic data is the safer artifact than releasing the synthetic images; on homogeneous CheXpert, the reverse can hold.
  • Classifiers trained on high-quality diffusion-generated data can land at more favorable utility-privacy points than DP-SGD classifiers trained on real data, sometimes with better minority-group accuracy.
  • Explicit mitigation is not required for strong privacy: careful hyperparameter choice and multi-instance synthesis act as implicit regularization.
  • Diffusion-based methods generally dominate the tested GAN and VAE models on the utility-privacy frontier, and the utility-privacy relationship is not a simple inverse tradeoff.
  • No single release strategy is universally best; the optimal choice depends on dataset visual characteristics, utility metric, and attack surface.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the multi-instance dilution effect observed for TI and LoRA suggests a testable standalone mechanism—generating several synthetic images per real example spreads the memorization signal across samples, weakening individual-level MIAs; this could be probed directly by sweeping the images-per-real ratio under a fixed generator.
  • Editorial inference: because the benchmark's privacy ordering relies on a fixed encoder in Attack 1 and a fixed loss threshold in Attack 2, practitioners should validate release-strategy choices with at least one independent MIA that shares neither component; the dataset-dependence claim would be strengthened by repeating the comparison with an independent attack suite.
  • Editorial inference: the finding that dataset homogeneity flips the safer release strategy implies a practical diagnostic—measuring intra-class visual similarity of a new dataset might predict which release artifact is privately safer before running the full benchmark.
  • Editorial inference: blending real and synthetic data, which the paper lists as future work, is the natural next test: if the privacy advantage comes from dilution rather than architecture, small real-sample admixtures should preserve much of the utility gain while lowering the privacy edge, and that is directly measurable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This SoK paper systematizes privacy-preserving synthetic image generation through a generation-sampling-classification pipeline, surveying generative models, membership inference attacks, and mitigations at three release stages (generator, synthetic images, trained classifier). The authors contribute a benchmark of representative methods—GAN (FreezeD), VAE, DDPM, LoRA, Textual Inversion, DCDM, DP-Sinkhorn, DP-LDMs, and SMP-LoRA—on CelebA, Fitzpatrick17k, and CheXpert, measuring utility via downstream classifier performance and privacy via two model-agnostic MIAs (Attack 1 on synthetic images; Attack 2 on classifier losses) plus an individual-level LiRA variant (Attack 3). The headline finding is that classifiers trained on high-quality synthetic data, especially from diffusion-based methods, can achieve superior utility-privacy tradeoffs compared to classifiers trained directly on real data with DP-SGD, with better fairness on minority subgroups in some settings. The paper also reports dataset-dependent tradeoffs between image release and classifier release and observes that multi-instance synthesis with TI/LoRA reduces individual-level memorization.

Significance. If the headline finding holds, the paper provides a practically important result: synthetic-data pipelines could serve as a viable alternative to differentially private training for image classifiers, with actionable guidance on release strategies and model choices. The paper's strengths include a broad and systematic taxonomy, a diverse benchmark spanning GANs, VAEs, diffusion models, and data condensation, evaluation across three datasets with error bars, a fairness analysis on Fitzpatrick skin types, runtime reporting, and a commitment to release code and processed data on Zenodo. The benchmark is a genuinely useful contribution to a field where direct cross-method comparisons are rare. However, the central quantitative claim is metric-dependent and the evaluation protocol contains selection-on-attack-results bias, so the headline conclusion needs additional validation before it can be accepted as stated.

major comments (4)
  1. [Sec. 7.4 (RQ3), Table 3] The central claim that synthetic-trained classifiers achieve superior privacy to DP-SGD classifiers depends on the choice of privacy metric. On CelebA, LoRA (r=256) has A2-TPR@1%FPR 0.012 versus DP-SGD(ε=∞) 0.028, but its A2-AUC is 0.710 versus 0.667; under AUC the synthetic-trained classifier exhibits worse privacy than the non-private DP-SGD baseline, reversing the conclusion. The paper should report and interpret both metrics throughout, and the RQ3 conclusion should be conditioned on metrics for which the claimed reversal actually holds, or be supported by an additional attack that is robust to this metric dependence.
  2. [Sec. 7.2 and Appendix A.2] The benchmark selects each method's reported hyperparameters after observing attack results: the authors state they 'identify five key hyperparameters... and systematically explore them' with the goal of finding settings yielding the best utility-privacy tradeoff, and Figure 2 plots the final chosen configurations. This post hoc selection can inflate the apparent utility-privacy frontier and biases comparisons against DP-SGD baselines, whose hyperparameters are not selected on the same privacy-utility objective. The paper should either pre-register a selection rule that does not use attack outcomes, or show that the headline conclusions are robust across all configurations reported in Tables 3-5, not merely the cherry-picked best point.
  3. [Sec. 7.3 (Attack 2) and Sec. 7.4 (RQ3)] Attack 2 is a single-feature loss-threshold attack applied to classifiers trained on synthetic data. For such classifiers, the real query images are out-of-distribution relative to the synthetic training distribution, so low loss-based TPR may reflect poor calibration on real data rather than genuine membership privacy. The paper's own Attack 1 shows substantial similarity-based leakage for the same pipelines (e.g., DCDM on Fitzpatrick A1-TPR up to 0.664, LoRA on CheXpert A1-TPR 0.240), indicating that the generative models do memorize training data. To support the 'superior utility-privacy balance against DP-SGD' claim, the authors should validate Attack 2 with a stronger classifier attack such as LiRA with shadow classifiers trained through the same synthetic pipeline, or at minimum include a calibration analysis showing that low attack TPR is not an artifact of distribution shift.
  4. [Sec. 7.4 (RQ7), Table 7 and Figure 2] The claim that 'three synthetic images per real image' decreases individual-level memorization for TI and LoRA is based on Attack 3, a LiRA variant with intentionally mislabeled canary samples. This protocol primarily measures label memorization rather than image-content memorization, and it is applied to only three non-mitigated methods, so the general finding that multi-instance synthesis 'reduces individual sample memorization' is not established at the level asserted in Summary of Findings item 3. The authors should narrow the claim to the specific canary-label setting or add an attack that targets pixel-level duplication.
minor comments (6)
  1. [Sec. 2] Reference [112] is cited as 'Truong et al.' in the text but appears as 'Troung et al.' in the bibliography; the spelling should be corrected.
  2. [Throughout] The paper frequently renders 'VAE' as 'V AE' and 'Fitzpatrick17k' as 'Fitpatrick17k' (e.g., Figure 3 caption); these spacing and typographical errors should be fixed.
  3. [Sec. 7.1] The sentence 'A dataset is widely used to test generative models' performance' lacks the subject 'CelebA' and should be rewritten.
  4. [Table 3] For DP-SGD(ε=∞), Attack 1 is reported as A1-AUC=1.000 and A1-TPR=1.000, but Attack 1 applies to released synthetic images, not to a classifier trained on real data; the table should explicitly label these entries as the 'real image release' baseline and clarify that they are not attack results on a synthetic pipeline.
  5. [Sec. 7.4 (RQ2)] The statement that 'DP-Sinkhorn consistently provide the lowest attack success rates' is not supported by the tables: on CelebA, DP-Sinkhorn(ε=10) has A2-TPR@1%FPR 0.105, higher than several LoRA and SMP-LoRA configurations, and on Fitzpatrick DP-Sinkhorn(ε=100) reaches 0.069; the claim should be qualified.
  6. [Appendix A.2, Table 2] The DDPM hyperparameter list is given as [0.5, 0.6, 0.7, 0.8, 0.8], but Table 3 reports results for α = 0.6, 0.7, 0.8, 0.9, 1.0; the list should be made consistent with the reported values.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the benchmark is an empirical measurement study, the attacks are adapted from prior independent work, and no load-bearing self-citation or fit-as-prediction step is present.

full rationale

This paper is a systematization plus an empirical benchmark, not a formal derivation. The central claims (RQ1 through RQ7) are summaries of measured utility and attack success rates reported in Tables 3-7 and Figure 2, and the conclusions follow from those measurements rather than from any equation that reduces to its own inputs. The privacy attacks are model-agnostic adaptations of published methods (Pang et al. for Attack 1, Yeom et al. for Attack 2, and Carlini et al.'s LiRA for Attack 3), and they are applied uniformly to all generative methods and baselines, so the comparison is not constructed to force a particular ranking. Hyperparameter selection in Sec. 7.2 and Appendix A.2 seeks the best observed utility-privacy tradeoff for each method and reports all configurations; this is tuning, not fitting a parameter to a quantity that is later called a prediction. There are no self-citations by the authors used as load-bearing evidence, no imported uniqueness theorem, and no ansatz smuggled in via a citation. The real-data baseline DP-SGD(epsilon=infinity) is an external training method, and its Attack 1 TPR of 1.000 is an expected sanity baseline because releasing real images is trivially maximally similar to real images; this is an explicit baseline choice, not a hidden definitional shortcut. Concerns that Attack 2 may measure calibration rather than memorization, or that TPR@1%FPR is metric-sensitive, are external validity or correctness risks, not circularity, because the paper does not define privacy as the attack score and then claim to derive that same score. Therefore, no circular step can be exhibited with a specific reduction, and the appropriate finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the experimental protocol: the choice of MIA attacks, the subset auxiliary threat model, and the post hoc selection of hyperparameters. These are not derived from first principles; they are assumptions about how to measure privacy and utility.

free parameters (2)
  • Per-method best hyperparameter configuration = e.g., LoRA rank 64, TI guidance 4.0, SMP-LoRA lambda 0.1, DP-Sinkhorn epsilon 500
    Each method is tuned over a small grid; the best utility-privacy point is reported in Figure 2. This selection is data-dependent and can inflate the apparent tradeoff.
  • Synthetic images per real image = 3
    The paper fixes a 3-to-1 synthesis ratio across methods; the authors note the impact of this ratio on memorization is unknown (Sec. 7.4, RQ7), so the choice is an unexamined knob.
assumptions (5)
  • domain assumption Membership inference attack success (TPR at 1% FPR) is a valid and sufficient proxy for privacy risk in synthetic data sharing.
    The paper uses two model-agnostic MIAs as the sole privacy metric, without comparing to other privacy definitions (e.g., differential privacy guarantees, reconstruction risk). Invoked in Sec. 7 and Sec. 3.2.
  • domain assumption The subset auxiliary assumption, where the adversary has access to some members and non-members from the training distribution, is the appropriate threat model for evaluating PPDS.
    Sec. 3.2 states the survey includes all three assumptions and Sec. 7 uses the subset assumption, the strongest challenge.
  • ad hoc to paper The generation-conditioning uses member test data (Dm_te) as part of the generator's training set; therefore the MIA evaluation on Dm_te is a valid test of training-data leakage.
    Sec. 7.1 defines Dtr = Dm_aux U Dm_te, so synthetic images are generated from the same images later used as member queries. The paper does not analyze the effect of this overlap on Attack 1, which could inflate success.
  • domain assumption Classification accuracy on a pre-trained ResNet-18 is an adequate utility measure, replacing direct image quality metrics like FID.
    Sec. 7 justifies excluding FID due to small dataset size, but this means image fidelity is only indirectly measured via downstream classifier performance.
  • ad hoc to paper Hyperparameters selected by two-fold cross-validation to optimize utility-privacy tradeoff are representative of each method's achievable performance.
    Sec. 7.2 describes selecting the best configuration per method, which is a free choice affecting the central comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generation." pith.science (2026). https://pith.science/paper/LWBKQDHN

@misc{pith2026250619360,
  author       = {Pith},
  title        = {Pith review of: SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LWBKQDHN}},
  note         = {Machine review of arXiv:2506.19360}
}
read the original abstract

Advances in generative models have transformed the field of synthetic image generation for privacy-preserving data synthesis (PPDS). However, the field lacks a comprehensive survey and comparison of synthetic image generation methods across diverse settings. In particular, when we generate synthetic images for the purpose of training a classifier, there is a pipeline of generation-sampling-classification which takes private training as input and outputs the final classifier of interest. In this survey, we systematically categorize existing image synthesis methods, privacy attacks, and mitigations along this generation-sampling-classification pipeline. To empirically compare diverse synthesis approaches, we provide a benchmark with representative generative methods and use model-agnostic membership inference attacks (MIAs) as a measure of privacy risk. Through this study, we seek to answer critical questions in PPDS: Can synthetic data effectively replace real data? Which release strategy balances utility and privacy? Do mitigations improve the utility-privacy tradeoff? Which generative models perform best across different scenarios? With a systematic evaluation of diverse methods, our study provides actionable insights into the utility-privacy tradeoffs of synthetic data generation methods and guides the decision on optimal data releasing strategies for real-world applications.

Figures

Figures reproduced from arXiv: 2506.19360 by the authors.

Figure 1
Figure 1. The generation-classification pipeline for sharing synthetic images. Privacy data can be shared as (A) a trained [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Privacy-Utility Tradeoff on CelebA (Top), Fitzpatrick17k (Middle), and CheXpert (Bottom). Each row displays results [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Examples of synthetic images generated by different methods for CelebA (Left), Fitpatrick17k (Middle), and Chexpert [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

135 extracted references · 30 canonical work pages

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016

    2016

  2. [2]

    Big healthcare data: preserving secu- rity and privacy.Journal of big data, 5(1):1–18, 2018

    Karim Abouelmehdi, Abderrahim Beni-Hessane, and Hayat Khaloufi. Big healthcare data: preserving secu- rity and privacy.Journal of big data, 5(1):1–18, 2018

    2018

  3. [3]

    Evaluations of Machine Learning Privacy Defenses are Misleading

    Michael Aerni, Jie Zhang, and Florian Tramèr. Eval- uations of machine learning privacy defenses are mis- leading.arXiv preprint arXiv:2404.17399, 2024

    work page Pith review arXiv 2024

  4. [4]

    Wasserstein gan, 2017

    Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein gan, 2017

    2017

  5. [5]

    Feedback-guided data synthesis for imbal- anced classification.arXiv e-prints, pages arXiv–2310, 2023

    Reyhane Askari Hemmat, Mohammad Pezeshki, Flo- rian Bordes, Michal Drozdzal, and Adriana Romero- Soriano. Feedback-guided data synthesis for imbal- anced classification.arXiv e-prints, pages arXiv–2310, 2023

    2023

  6. [6]

    Automatic Discovery of Privacy-Utility Pareto Fronts

    Brendan Avent, Javier González, Tom Diethe, An- drei Paleyes, and Borja Balle. Automatic discov- ery of privacy-utility pareto fronts.arXiv preprint arXiv:1905.10862, 2019

    work page Pith review arXiv 1905

  7. [7]

    Synthetic data from diffusion models improves imagenet classifica- tion.arXiv preprint arXiv:2304.08466, 2023

    Shekoofeh Azizi, Simon Kornblith, Chitwan Saharia, Mohammad Norouzi, and David J Fleet. Synthetic data from diffusion models improves imagenet classifica- tion.arXiv preprint arXiv:2304.08466, 2023

    arXiv 2023

  8. [8]

    Differential privacy has disparate impact on model accuracy.Advances in neural information processing systems, 32, 2019

    Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy.Advances in neural information processing systems, 32, 2019

    2019

Show all 135 references
  1. [9]

    Leaving reality to imagination: Robust classification via generated datasets.arXiv preprint arXiv:2302.02503, 2023

    Hritik Bansal and Aditya Grover. Leaving reality to imagination: Robust classification via generated datasets.arXiv preprint arXiv:2302.02503, 2023

    2023 arXiv

  2. [10]

    Conditional image generation with score-based diffusion models.arXiv preprint arXiv:2111.13606, 2021

    Georgios Batzolis, Jan Stanczuk, Carola-Bibiane Schönlieb, and Christian Etmann. Conditional image generation with score-based diffusion models.arXiv preprint arXiv:2111.13606, 2021

    2021 arXiv

  3. [11]

    Privacy in social me- dia: Identification, mitigation and applications.arXiv preprint arXiv:1808.02191, 2018

    Ghazaleh Beigi and Huan Liu. Privacy in social me- dia: Identification, mitigation and applications.arXiv preprint arXiv:1808.02191, 2018

    2018 arXiv

  4. [12]

    Pri- vate gans, revisited.arXiv preprint arXiv:2302.02936, 2023

    Alex Bie, Gautam Kamath, and Guojun Zhang. Pri- vate gans, revisited.arXiv preprint arXiv:2302.02936, 2023

    2023 arXiv

  5. [13]

    Large scale gan training for high fidelity natural image synthesis.arXiv preprint arXiv:1809.11096, 2018

    Andrew Brock. Large scale gan training for high fidelity natural image synthesis.arXiv preprint arXiv:1809.11096, 2018

    2018 arXiv

  6. [14]

    Instructpix2pix: Learning to follow image editing in- structions

    Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing in- structions. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pages 18392–18402, 2023

    2023

  7. [15]

    Don’t generate me: Training differen- tially private generative models with sinkhorn diver- gence.Advances in Neural Information Processing Systems, 34:12480–12492, 2021

    Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don’t generate me: Training differen- tially private generative models with sinkhorn diver- gence.Advances in Neural Information Processing Systems, 34:12480–12492, 2021

    2021

  8. [16]

    Member- ship inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Member- ship inference attacks from first principles. In2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022

    1914

  9. [17]

    Dataset distil- lation by matching training trajectories

    George Cazenavette, Tongzhou Wang, Antonio Tor- ralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distil- lation by matching training trajectories. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4750–4759, 2022

    2022

  10. [18]

    Gs-wgan: A gradient-sanitized approach for learning differentially private generators.Advances in Neural Information Processing Systems, 33:12673– 12684, 2020

    Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. Gs-wgan: A gradient-sanitized approach for learning differentially private generators.Advances in Neural Information Processing Systems, 33:12673– 12684, 2020

    2020

  11. [19]

    Gan-leaks: A taxonomy of membership inference at- tacks against generative models

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference at- tacks against generative models. InProceedings of the 2020 ACM SIGSAC conference on computer and communications security, pages 343–362, 2020

    2020

  12. [20]

    Dpgen: Differentially private generative energy-guided network for natural image synthesis

    Jia-Wei Chen, Chia-Mu Yu, Ching-Chia Kao, Tzai- Wei Pang, and Chun-Shien Lu. Dpgen: Differentially private generative energy-guided network for natural image synthesis. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 8387–8396, 2022

    2022

  13. [21]

    Variational lossy autoencoder.arXiv preprint arXiv:1611.02731, 2016

    Xi Chen, Diederik P Kingma, Tim Salimans, Yan Duan, Prafulla Dhariwal, John Schulman, Ilya Sutskever, and Pieter Abbeel. Variational lossy autoencoder.arXiv preprint arXiv:1611.02731, 2016

    2016 arXiv

  14. [22]

    Very deep vaes generalize autoregressive models and can outperform them on images.arXiv preprint arXiv:2011.10650, 2020

    Rewon Child. Very deep vaes generalize autoregressive models and can outperform them on images.arXiv preprint arXiv:2011.10650, 2020

    2011 arXiv

  15. [23]

    Label-only membership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. InInternational confer- ence on machine learning, pages 1964–1974. PMLR, 2021

    1964

  16. [24]

    On the vulnerability of data points under multiple membership inference attacks and target models.arXiv preprint arXiv:2210.16258, 2022

    Mauro Conti, Jiaxin Li, and Stjepan Picek. On the vulnerability of data points under multiple membership inference attacks and target models.arXiv preprint arXiv:2210.16258, 2022

    2022 arXiv

  17. [25]

    End- to-end sinkhorn autoencoder with noise generator

    Kamil Deja, Jan Dubi´nski, Piotr Nowak, Sandro Wen- zel, Przemysław Spurek, and Tomasz Trzcinski. End- to-end sinkhorn autoencoder with noise generator. IEEE Access, 9:7211–7219, 2020

    2020

  18. [26]

    Diffusion models beat gans on image synthesis.Advances in neural information processing systems, 34:8780–8794, 2021

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis.Advances in neural information processing systems, 34:8780–8794, 2021

    2021

  19. [27]

    Differentially private diffusion models

    Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. arXiv preprint arXiv:2210.09929, 2022

    2022 arXiv

  20. [28]

    Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730

    Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable to membership inference attacks? InInternational Conference on Machine Learning, pages 8717–8730. PMLR, 2023

    2023

  21. [29]

    Jan Dubi’nski, A. D. Kowalczuk, Stanislaw Pawlak, Przemyslaw Rokita, Tomasz Trzci’nski, and Paweł Morawiecki. Towards more realistic membership inference attacks on large diffusion models.2024 IEEE/CVF Winter Conference on Applications of Com- puter Vision (WACV), pages 4848–4...

    2024

  22. [30]

    Calibrating noise to sensitivity in pri- vate data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in pri- vate data analysis. InTheory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265–284. Springer, 2006

    2006

  23. [31]

    The algorithmic foundations of differential privacy.Foundations and Trends® in Theoretical Computer Science, 9(3–4):211– 407, 2014

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy.Foundations and Trends® in Theoretical Computer Science, 9(3–4):211– 407, 2014

    2014

  24. [32]

    Privacy distillation: reducing re-identification risk of multimodal diffusion models.arXiv preprint arXiv:2306.01322, 2023

    Virginia Fernandez, Pedro Sanchez, Walter Hugo Lopez Pinaya, Grzegorz Jacenków, Sotirios A Tsaftaris, and Jorge Cardoso. Privacy distillation: reducing re-identification risk of multimodal diffusion models.arXiv preprint arXiv:2306.01322, 2023

    2023 arXiv

  25. [33]

    Privacy-preserving data publishing: A survey of recent developments.ACM Computing Surveys (Csur), 42(4):1–53, 2010

    Benjamin CM Fung, Ke Wang, Rui Chen, and Philip S Yu. Privacy-preserving data publishing: A survey of recent developments.ACM Computing Surveys (Csur), 42(4):1–53, 2010

    2010

  26. [34]

    An image is worth one word: Personalizing text- to-image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen- Or. An image is worth one word: Personalizing text- to-image generation using textual inversion.arXiv preprint arXiv:2208.01618, 2022

    2022 arXiv

  27. [35]

    Inverting gradients-how easy is it to break privacy in federated learning?Advances in neural information processing systems, 33:16937– 16947, 2020

    Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients-how easy is it to break privacy in federated learning?Advances in neural information processing systems, 33:16937– 16947, 2020

    2020

  28. [36]

    Learning generative models with sinkhorn divergences

    Aude Genevay, Gabriel Peyré, and Marco Cuturi. Learning generative models with sinkhorn divergences. InInternational Conference on Artificial Intelligence and Statistics, pages 1608–1617. PMLR, 2018

    2018

  29. [37]

    Dif- ferentially private diffusion models generate useful synthetic images.arXiv preprint arXiv:2302.13861, 2023

    Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Ira Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L Smith, Olivia Wiles, and Borja Balle. Dif- ferentially private diffusion models generate useful synthetic images.arXiv preprint arXiv:2302.13861, 2023

    2023 arXiv

  30. [38]

    Generative adversar- ial nets.Advances in neural information processing systems, 27, 2014

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversar- ial nets.Advances in neural information processing systems, 27, 2014

    2014

  31. [39]

    Evaluating deep neural networks trained on clinical images in dermatology with the fitzpatrick 17k dataset

    Matthew Groh, Caleb Harris, Luis Soenksen, Felix Lau, Rachel Han, Aerin Kim, Arash Koochek, and Omar Badri. Evaluating deep neural networks trained on clinical images in dermatology with the fitzpatrick 17k dataset. InProceedings of the IEEE/CVF Conference on Computer Vision a...

    2021

  32. [40]

    Dp-merf: Differentially private mean em- beddings with randomfeatures for practical privacy- preserving data generation

    Frederik Harder, Kamil Adamczewski, and Mijung Park. Dp-merf: Differentially private mean em- beddings with randomfeatures for practical privacy- preserving data generation. InInternational conference on artificial intelligence and statistics, pages 1819–

  33. [41]

    Logan: Membership inference attacks against generative models.arXiv preprint arXiv:1705.07663, 2017

    Jamie Hayes, Luca Melis, George Danezis, and Emil- iano De Cristofaro. Logan: Membership inference attacks against generative models.arXiv preprint arXiv:1705.07663, 2017

    2017 arXiv

  34. [42]

    Is synthetic data from generative models ready for image recognition?arXiv preprint arXiv:2210.07574, 2022

    Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wen- qing Zhang, Philip Torr, Song Bai, and Xiaojuan Qi. Is synthetic data from generative models ready for image recognition?arXiv preprint arXiv:2210.07574, 2022

    2022 arXiv

  35. [43]

    Prompt-to- prompt image editing with cross attention control

    Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aber- man, Yael Pritch, and Daniel Cohen-Or. Prompt-to- prompt image editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022

    2022 arXiv

  36. [44]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems, 30, 2017

    2017

  37. [45]

    Monte carlo and reconstruction membership inference attacks against generative models.Proceed- ings on Privacy Enhancing Technologies, 2019

    Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against generative models.Proceed- ings on Privacy Enhancing Technologies, 2019

    2019

  38. [46]

    Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  39. [47]

    Cas- caded diffusion models for high fidelity image genera- tion.Journal of Machine Learning Research, 23(47):1– 33, 2022

    Jonathan Ho, Chitwan Saharia, William Chan, David J Fleet, Mohammad Norouzi, and Tim Salimans. Cas- caded diffusion models for high fidelity image genera- tion.Journal of Machine Learning Research, 23(47):1– 33, 2022

    2022

  40. [48]

    Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  41. [49]

    Membership inference of diffusion models.ArXiv, abs/2301.09956, 2023

    Hailong Hu and Jun Pang. Membership inference of diffusion models.ArXiv, abs/2301.09956, 2023

    2023 arXiv

  42. [50]

    Membership in- ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dob- bie, Philip S Yu, and Xuyun Zhang. Membership in- ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    2022

  43. [51]

    Sok: Privacy- preserving data synthesis

    Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gon- zalo Munilla Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. Sok: Privacy- preserving data synthesis. In2024 IEEE Symposium on Security and Privacy (SP), pages 4696–4713. IEEE, 2024

    2024

  44. [52]

    Chexpert: A large chest radiograph dataset with uncer- tainty labels and expert comparison

    Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ilcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al. Chexpert: A large chest radiograph dataset with uncer- tainty labels and expert comparison. InProceedings of the AAAI...

    2019

  45. [53]

    Provable membership inference privacy.arXiv preprint arXiv:2211.06582, 2022

    Zachary Izzo, Jinsung Yoon, Sercan O Arik, and James Zou. Provable membership inference privacy.arXiv preprint arXiv:2211.06582, 2022

    2022 arXiv

  46. [54]

    MIAShield: Defend- ing membership inference attacks via preemptive ex- clusion of members.arXiv preprint arXiv:2203.00915, 2022

    Ismat Jarin and Birhanu Eshete. MIAShield: Defend- ing membership inference attacks via preemptive ex- clusion of members.arXiv preprint arXiv:2203.00915, 2022

    2022 arXiv

  47. [55]

    Evaluating differ- entially private machine learning in practice

    Bargav Jayaraman and David Evans. Evaluating differ- entially private machine learning in practice. In28th USENIX Security Symposium (USENIX Security 19), pages 1895–1912, 2019

    1912

  48. [56]

    Dp 2-vae: Differ- entially private pre-trained variational autoencoders

    Dihong Jiang, Guojun Zhang, Mahdi Karami, Xi Chen, Yunfeng Shao, and Yaoliang Yu. Dp 2-vae: Differ- entially private pre-trained variational autoencoders. arXiv preprint arXiv:2208.03409, 2022

    2022 arXiv

  49. [57]

    Progressive growing of gans for im- proved quality, stability, and variation.arXiv preprint arXiv:1710.10196, 2017

    Tero Karras. Progressive growing of gans for im- proved quality, stability, and variation.arXiv preprint arXiv:1710.10196, 2017

    2017 arXiv

  50. [58]

    Training gener- ative adversarial networks with limited data.Advances in neural information processing systems, 33:12104– 12114, 2020

    Tero Karras, Miika Aittala, Janne Hellsten, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Training gener- ative adversarial networks with limited data.Advances in neural information processing systems, 33:12104– 12114, 2020

    2020

  51. [59]

    Analyzing and improving the image quality of stylegan

    Tero Karras, Samuli Laine, Miika Aittala, Janne Hell- sten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. InProceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8110–8119, 2020

    2020

  52. [60]

    Imagic: Text-based real image editing with dif- fusion models

    Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. Imagic: Text-based real image editing with dif- fusion models. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 6007–6017, 2023

    2023

  53. [61]

    When does data augmentation help with membership inference attacks? InInternational conference on machine learn- ing, pages 5345–5355

    Yigitcan Kaya and Tudor Dumitras. When does data augmentation help with membership inference attacks? InInternational conference on machine learn- ing, pages 5345–5355. PMLR, 2021

    2021

  54. [62]

    Privacy-preserving artificial intelligence in healthcare: Techniques and applications.Computers in Biology and Medicine, 158:106848, 2023

    Nazish Khalid, Adnan Qayyum, Muhammad Bilal, Ala Al-Fuqaha, and Junaid Qadir. Privacy-preserving artificial intelligence in healthcare: Techniques and applications.Computers in Biology and Medicine, 158:106848, 2023

    2023

  55. [63]

    Auto-encoding variational bayes.arXiv preprint arXiv:1312.6114, 2013

    Diederik P Kingma and Max Welling. Auto-encoding variational bayes.arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  56. [64]

    An ef- ficient membership inference attack for the diffusion model by proximal initialization

    Fei Kong, Jinhao Duan, RuiPeng Ma, Heng Tao Shen, Xiaoshuang Shi, Xiaofeng Zhu, and Kaidi Xu. An ef- ficient membership inference attack for the diffusion model by proximal initialization. InThe Twelfth In- ternational Conference on Learning Representations, 2024

    2024

  57. [65]

    Deep learning for medical image cryptography: A compre- hensive review.Applied Sciences, 13(14):8295, 2023

    Kusum Lata and Linga Reddy Cenkeramaddi. Deep learning for medical image cryptography: A compre- hensive review.Applied Sciences, 13(14):8295, 2023

    2023

  58. [66]

    Syntheval: A framework for detailed utility and privacy evaluation of tabular synthetic data.arXiv preprint arXiv:2404.15821, 2024

    Anton Danholt Lautrup, Tobias Hyrup, Arthur Zimek, and Peter Schneider-Kamp. Syntheval: A framework for detailed utility and privacy evaluation of tabular synthetic data.arXiv preprint arXiv:2404.15821, 2024

    2024 arXiv

  59. [67]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language mod- els

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language mod- els. InInternational conference on machine learning, pages 19730–19742. PMLR, 2023

    2023

  60. [68]

    Exploring the benefits of visual prompting in differential privacy

    Yizhe Li, Yu-Lin Tsai, Chia-Mu Yu, Pin-Yu Chen, and Xuebin Ren. Exploring the benefits of visual prompting in differential privacy. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 5158–5167, 2023

    2023

  61. [69]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  62. [70]

    G- pate: Scalable differentially private data generator via private aggregation of teacher discriminators.Ad- vances in Neural Information Processing Systems, 34:2965–2977, 2021

    Yunhui Long, Boxin Wang, Zhuolin Yang, Bhavya Kailkhura, Aston Zhang, Carl Gunter, and Bo Li. G- pate: Scalable differentially private data generator via private aggregation of teacher discriminators.Ad- vances in Neural Information Processing Systems, 34:2965–2977, 2021

    2021

  63. [71]

    Repaint: Inpainting using denoising diffusion probabilistic mod- els, 2022

    Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic mod- els, 2022

    2022

  64. [72]

    Privacy-preserving low-rank adaptation for latent diffusion models.arXiv preprint arXiv:2402.11989, 2024

    Zihao Luo, Xilie Xu, Feng Liu, Yun Sing Koh, Di Wang, and Jingfeng Zhang. Privacy-preserving low-rank adaptation for latent diffusion models.arXiv preprint arXiv:2402.11989, 2024

    2024 arXiv

  65. [73]

    Differentially private latent diffusion models.arXiv preprint arXiv:2305.15759, 2023

    Saiyue Lyu, Michael F Liu, Margarita Vinaroz, and Mijung Park. Differentially private latent diffusion models.arXiv preprint arXiv:2305.15759, 2023

    2023 arXiv

  66. [74]

    Membership inference attacks against diffusion mod- els

    Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. Membership inference attacks against diffusion mod- els. In2023 IEEE Security and Privacy Workshops (SPW), pages 77–83. IEEE, 2023

    2023

  67. [75]

    Exploiting unintended feature leakage in collaborative learning

    Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In2019 IEEE sym- posium on security and privacy (SP), pages 691–706. IEEE, 2019

    2019

  68. [76]

    Sdedit: Guided image synthesis and editing with stochastic dif- ferential equations.arXiv preprint arXiv:2108.01073, 2021

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic dif- ferential equations.arXiv preprint arXiv:2108.01073, 2021

    2021 arXiv

  69. [77]

    Conditional gener- ative adversarial nets.arXiv preprint arXiv:1411.1784, 2014

    Mehdi Mirza and Simon Osindero. Conditional gener- ative adversarial nets.arXiv preprint arXiv:1411.1784, 2014

    2014 arXiv

  70. [78]

    Freeze the discriminator: a simple baseline for fine-tuning gans

    Sangwoo Mo, Minsu Cho, and Jinwoo Shin. Freeze the discriminator: a simple baseline for fine-tuning gans. arXiv preprint arXiv:2002.10964, 2020

    2002 arXiv

  71. [79]

    Null-text inversion for editing real images using guided diffusion models

    Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6038–6047, 2023

    2023

  72. [80]

    Ma- chine learning with membership privacy using adver- sarial regularization

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Ma- chine learning with membership privacy using adver- sarial regularization. InProceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 634–646, 2018

    2018

  73. [81]

    Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Com- prehensive privacy analysis of deep learning: Passive and active white-box inference attacks against central- ized and federated learning. In2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019

    2019

  74. [82]

    Dataset meta-learning from kernel ridge-regression

    Timothy Nguyen, Zhourong Chen, and Jaehoon Lee. Dataset meta-learning from kernel ridge-regression. arXiv preprint arXiv:2011.00050, 2020

    2011 arXiv

  75. [83]

    Dataset distillation with infinitely wide convolutional networks.Advances in Neural Informa- tion Processing Systems, 34:5186–5198, 2021

    Timothy Nguyen, Roman Novak, Lechao Xiao, and Jaehoon Lee. Dataset distillation with infinitely wide convolutional networks.Advances in Neural Informa- tion Processing Systems, 34:5186–5198, 2021

    2021

  76. [84]

    Sok: Comparing different membership inference attacks with a comprehensive benchmark.arXiv preprint arXiv:2307.06123, 2023

    Jun Niu, Xiaoyan Zhu, Moxuan Zeng, Ge Zhang, Qingyang Zhao, Chunhui Huang, Yangming Zhang, Suyu An, Yangzhong Wang, Xinghui Yue, et al. Sok: Comparing different membership inference attacks with a comprehensive benchmark.arXiv preprint arXiv:2307.06123, 2023

    2023 arXiv

  77. [85]

    Black-box membership inference attacks against fine-tuned diffusion models

    Yan Pang and Tianhao Wang. Black-box membership inference attacks against fine-tuned diffusion models. arXiv preprint arXiv:2312.08207, 2023

    2023 arXiv

  78. [86]

    White-box membership inference attacks against diffusion models.arXiv preprint arXiv:2308.06405, 2023

    Yan Pang, Tianhao Wang, Xuhui Kang, Mengdi Huai, and Yang Zhang. White-box membership inference attacks against diffusion models.arXiv preprint arXiv:2308.06405, 2023

    2023 arXiv

  79. [87]

    Scalable private learning with pate.arXiv preprint arXiv:1802.08908, 2018

    Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Erlingsson. Scalable private learning with pate.arXiv preprint arXiv:1802.08908, 2018

    2018 arXiv

  80. [88]

    Sinkhorn autoencoders

    Giorgio Patrini, Rianne Van den Berg, Patrick Forre, Marcello Carioni, Samarth Bhargav, Max Welling, Tim Genewein, and Frank Nielsen. Sinkhorn autoencoders. InUncertainty in Artificial Intelligence, pages 733–

  81. [89]

    Synthcity: facilitating innovative use cases of synthetic data in different data modalities

    Zhaozhi Qian, Bogdan-Constantin Cebere, and Mi- haela van der Schaar. Synthcity: facilitating innovative use cases of synthetic data in different data modalities. arXiv preprint arXiv:2301.07573, 2023

    2023 arXiv

  82. [90]

    Unsupervised representation learning with deep convolutional generative adversarial networks

    A Radford. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434, 2015

    2015 arXiv

  83. [91]

    Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125, 1(2):3, 2022

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents.arXiv preprint arXiv:2204.06125, 1(2):3, 2022

    2022 arXiv

  84. [92]

    Generating diverse high-fidelity images with vq-vae-2

    Ali Razavi, Aaron Van den Oord, and Oriol Vinyals. Generating diverse high-fidelity images with vq-vae-2. Advances in neural information processing systems, 32, 2019

    2019

  85. [93]

    High-resolution im- age synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution im- age synthesis with latent diffusion models. InProceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022

    2022

  86. [94]

    Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation

    Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 22...

    2023

  87. [95]

    Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information processing systems, 35:36479– 36494, 2022

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Sal- imans, et al. Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural informatio...

    2022

  88. [96]

    Ml-leaks: Model and data independent membership inference at- tacks and defenses on machine learning models.arXiv preprint arXiv:1806.01246, 2018

    Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference at- tacks and defenses on machine learning models.arXiv preprint arXiv:1806.01246, 2018

    2018 arXiv

  89. [97]

    Improving gans using optimal transport

    Tim Salimans, Han Zhang, Alec Radford, and Dim- itris Metaxas. Improving gans using optimal transport. arXiv preprint arXiv:1803.05573, 2018

    2018 arXiv

  90. [98]

    Synthetic data: Re- visiting the privacy-utility trade-off.arXiv preprint arXiv:2407.07926, 2024

    Fatima Jahan Sarmin, Atiquer Rahman Sarkar, Yang Wang, and Noman Mohammed. Synthetic data: Re- visiting the privacy-utility trade-off.arXiv preprint arXiv:2407.07926, 2024

    2024 arXiv

  91. [99]

    Dragdiffusion: Harnessing diffusion models for interactive point-based image editing

    Yujun Shi, Chuhui Xue, Jun Hao Liew, Jiachun Pan, Hanshu Yan, Wenqing Zhang, Vincent YF Tan, and Song Bai. Dragdiffusion: Harnessing diffusion models for interactive point-based image editing. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2024

  92. [100]

    Diversity is definitely needed: Improving model-agnostic zero-shot classi- fication via stable diffusion

    Jordan Shipard, Arnold Wiliem, Kien Nguyen Thanh, Wei Xiang, and Clinton Fookes. Diversity is definitely needed: Improving model-agnostic zero-shot classi- fication via stable diffusion. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pag...

    2023

  93. [101]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership inference attacks against machine learning models. In2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  94. [102]

    De- noising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    Jiaming Song, Chenlin Meng, and Stefano Ermon. De- noising diffusion implicit models.arXiv preprint arXiv:2010.02502, 2020

    2010 arXiv

  95. [103]

    Systematic evaluation of privacy risks of machine learning models

    Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models. In30th USENIX Security Symposium (USENIX Security 21), pages 2615–2632, 2021

    2021

  96. [104]

    Generative modeling by estimating gradients of the data distribution.Ad- vances in neural information processing systems, 32, 2019

    Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution.Ad- vances in neural information processing systems, 32, 2019

    2019

  97. [105]

    Improved techniques for training score-based generative models.Advances in neural information processing systems, 33:12438– 12448, 2020

    Yang Song and Stefano Ermon. Improved techniques for training score-based generative models.Advances in neural information processing systems, 33:12438– 12448, 2020

    2020

  98. [106]

    Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456, 2020

    2011 arXiv

  99. [107]

    Synthetic data–anonymisation groundhog day

    Theresa Stadler, Bristena Oprisanu, and Carmela Tron- coso. Synthetic data–anonymisation groundhog day. In 31st USENIX Security Symposium (USENIX Security 22), pages 1451–1468, 2022

    2022

  100. [108]

    Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architec- ture

    Xinyu Tang, Saeed Mahloujifar, Liwei Song, Virat She- jwalkar, Milad Nasr, Amir Houmansadr, and Prateek Mittal. Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architec- ture. In31st USENIX Security Symposium (USENIX Security 22), pages ...

    2022

  101. [109]

    Benchmarking differentially private synthetic data generation algo- rithms.arXiv preprint arXiv:2112.09238, 2021

    Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algo- rithms.arXiv preprint arXiv:2112.09238, 2021

    2021 arXiv

  102. [110]

    Dp-cgan: Differentially private synthetic data and label generation

    Reihaneh Torkzadehmahani, Peter Kairouz, and Bene- dict Paten. Dp-cgan: Differentially private synthetic data and label generation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition Workshops, pages 0–0, 2019

    2019

  103. [111]

    Effective data aug- mentation with diffusion models.arXiv preprint arXiv:2302.07944, 2023

    Brandon Trabucco, Kyle Doherty, Max Gurinas, and Ruslan Salakhutdinov. Effective data aug- mentation with diffusion models.arXiv preprint arXiv:2302.07944, 2023

    2023 arXiv

  104. [112]

    Attacks and defenses for generative diffusion models: A comprehensive survey.arXiv preprint arXiv:2408.03400, 2024

    Vu Tuan Truong, Luan Ba Dang, and Long Bao Le. Attacks and defenses for generative diffusion models: A comprehensive survey.arXiv preprint arXiv:2408.03400, 2024

    2024 arXiv

  105. [113]

    Membership inference attacks against synthetic data through overfitting detection

    Boris Van Breugel, Hao Sun, Zhaozhi Qian, and Mi- haela van der Schaar. Membership inference attacks against synthetic data through overfitting detection. arXiv preprint arXiv:2302.12580, 2023

    2023 arXiv

  106. [114]

    Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning.Advances in neural information processing systems, 30, 2017

    2017

  107. [115]

    dp-promise: Differentially private diffusion probabilistic models for image synthesis

    Haichen Wang, Shuchao Pang, Zhigang Lu, Yihang Rao, Yongbin Zhou, and Minhui Xue. dp-promise: Differentially private diffusion probabilistic models for image synthesis. USENIX, 2024

    2024

  108. [116]

    Dataset distillation.arXiv preprint arXiv:1811.10959, 2018

    Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation.arXiv preprint arXiv:1811.10959, 2018

    2018 arXiv

  109. [117]

    Against membership inference attack: Pruning is all you need.arXiv preprint arXiv:2008.13578, 2020

    Yijue Wang, Chenghong Wang, Zigeng Wang, Shanglin Zhou, Hang Liu, Jinbo Bi, Caiwen Ding, and Sanguthevar Rajasekaran. Against membership inference attack: Pruning is all you need.arXiv preprint arXiv:2008.13578, 2020

    2008 arXiv

  110. [118]

    Balancing privacy and progress: a review of privacy challenges, systemic oversight, and patient perceptions in ai-driven healthcare.Applied Sciences, 14(2):675, 2024

    Steven M Williamson and Victor Prybutok. Balancing privacy and progress: a review of privacy challenges, systemic oversight, and patient perceptions in ai-driven healthcare.Applied Sciences, 14(2):675, 2024

    2024

  111. [119]

    Membership inference attacks against text-to-image generation models

    Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against text-to-image generation models. 2022

    2022

  112. [120]

    Smartbrush: Text and shape guided object inpainting with diffusion model

    Shaoan Xie, Zhifei Zhang, Zhe Lin, Tobias Hinz, and Kun Zhang. Smartbrush: Text and shape guided object inpainting with diffusion model. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22428–22437, 2023

    2023

  113. [121]

    Uni- paint: A unified framework for multimodal image in- painting with pretrained diffusion model

    Shiyuan Yang, Xiaodong Chen, and Jing Liao. Uni- paint: A unified framework for multimodal image in- painting with pretrained diffusion model. InProceed- ings of the 31st ACM International Conference on Mul- timedia, pages 3190–3199, 2023

    2023

  114. [122]

    Privacy risk in machine learning: An- alyzing the connection to overfitting

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: An- alyzing the connection to overfitting. In2018 IEEE 31st computer security foundations symposium (CSF), pages 268–282. IEEE, 2018

    2018

  115. [123]

    How does data augmentation affect privacy in machine learning? InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10746–10753, 2021

    Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. How does data augmentation affect privacy in machine learning? InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10746–10753, 2021

    2021

  116. [124]

    Real-fake: Effective training data syn- thesis through distribution matching.arXiv preprint arXiv:2310.10402, 2023

    Jianhao Yuan, Jie Zhang, Shuyang Sun, Philip Torr, and Bo Zhao. Real-fake: Effective training data syn- thesis through distribution matching.arXiv preprint arXiv:2310.10402, 2023

    2023 arXiv

  117. [125]

    Low- cost high-power membership inference attacks

    Sajjad Zarifzadeh, Philippe Liu, and Reza Shokri. Low- cost high-power membership inference attacks. In Forty-first International Conference on Machine Learn- ing, 2024

    2024

  118. [126]

    Membership inference on text-to-image diffusion models via conditional likelihood discrepancy.arXiv preprint arXiv:2405.14800, 2024

    Shengfang Zhai, Huanran Chen, Yinpeng Dong, Jiajun Li, Qingni Shen, Yansong Gao, Hang Su, and Yang Liu. Membership inference on text-to-image diffusion models via conditional likelihood discrepancy.arXiv preprint arXiv:2405.14800, 2024

    2024 arXiv

  119. [127]

    Self-attention generative adversarial networks

    Han Zhang, Ian Goodfellow, Dimitris Metaxas, and Augustus Odena. Self-attention generative adversarial networks. InInternational conference on machine learning, pages 7354–7363. PMLR, 2019

    2019

  120. [128]

    Adding conditional control to text-to-image diffusion models

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836–3847, 2023

    2023

  121. [129]

    Generated distributions are all you need for membership inference attacks against genera- tive models

    Minxing Zhang, Ning Yu, Rui Wen, Michael Backes, and Yang Zhang. Generated distributions are all you need for membership inference attacks against genera- tive models. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 4839–4849, 2024

    2024

  122. [130]

    Dataset condensation with differentiable siamese augmentation

    Bo Zhao and Hakan Bilen. Dataset condensation with differentiable siamese augmentation. InInternational Conference on Machine Learning, pages 12674–12685. PMLR, 2021

    2021

  123. [131]

    Dataset condensation with distribution matching

    Bo Zhao and Hakan Bilen. Dataset condensation with distribution matching. InProceedings of the IEEE/CVF Winter Conference on Applications of Com- puter Vision, pages 6514–6523, 2023

    2023

  124. [132]

    Dataset condensation with gradient matching.arXiv preprint arXiv:2006.05929, 2020

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching.arXiv preprint arXiv:2006.05929, 2020

    2006 arXiv

  125. [133]

    Differentially private dataset condensation

    Tianhang Zheng and Baochun Li. Differentially private dataset condensation. 2023

    2023

  126. [134]

    Train- ing on thin air: Improve image classification with gen- erated data.arXiv preprint arXiv:2305.15316, 2023

    Yongchao Zhou, Hshmat Sahak, and Jimmy Ba. Train- ing on thin air: Improve image classification with gen- erated data.arXiv preprint arXiv:2305.15316, 2023

    2023 arXiv

  127. [135]

    Last-1” to “Last-5

    Haowei Zhu, Ling Yang, Jun-Hai Yong, Wentao Zhang, and Bin Wang. Distribution-aware data expansion with diffusion models.arXiv preprint arXiv:2403.06741, 2024. A Supplementary Details and Full Results A.1 Details of Benchmarked Generative Meth- ods In this section, we provide ...

    2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.