Pith. sign in

REVIEW 3 major objections 4 minor 68 references

DP-DocLDM: Differentially Private Document Image Generation using Latent Diffusion Models

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A class- and layout-conditioned latent diffusion model, fine-tuned under differential privacy on private document datasets, generates synthetic images that substitute for real data in downstream document classification, and on small dataset

desk verdict First DP latent diffusion paper for documents, but the public/private split is invalid—the pretraining corpus contains the private testbeds, so the headline privacy/utility claim does not survive contact with the data provenance. read the letter →

arxiv 2508.04208 v1 pith:XS6MMBFK submitted 2025-08-06 cs.CR

Saifullah Saifullah , Stefan Agne , Andreas Dengel , Sheraz Ahmed This is my paper
classification cs.CR
keywords differentialprivacylatentdiffusionmodelsdocumentimageclassificationsyntheticgenerationDPDMDP-Promiselayoutconditioning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that the usual pain of differential privacy — degraded accuracy and awkward training — can be sidestepped by replacing private document images with synthetic ones. It pretrains a latent diffusion model on public documents, privately fine-tunes it on private data, and then uses the generated samples to train ordinary classifiers. The claim is that this pipeline yields realistic, class-specific documents across privacy budgets ($\varepsilon \in \{1,5,10\}$), and that on a small benchmark it substantially outperforms the direct DP-Adam baseline while keeping the same formal privacy guarantee at the fine-tuning step.

What carries the argument

The load-bearing object is a latent diffusion model (LDM): a diffusion model that adds and removes noise in the compressed latent space of a pretrained autoencoder, rather than in pixel space. It is conditioned on class embeddings and on a binary layout mask derived from OCR text bounding boxes, and it is privately fine-tuned with DPDM (DP-SGD with noise multiplicity) or DP-Promise, with one model per label for the best-performing configuration. The same conditioning layout is applied at sampling time, and synthetic images are then used to train standard classifiers with standard, non-private procedures.

What would settle it

Run a nearest-neighbour or membership audit comparing synthetic images against the original IIT-CDIP images used in pretraining. If many generated samples are near-duplicates of specific RVL-CDIP or Tobacco3482 documents that the supposedly private fine-tuning could not have memorized alone, then the effective privacy is much weaker than the fine-tuning budget suggests, and the claim that the synthetic set substitutes for private data under strict DP fails.

Watch

Extended reading notes

Core claim

DP-DocLDM's central discovery is that per-label private fine-tuning — training one small latent diffusion model per document class with differential privacy — plus OCR-extracted layout conditioning produces synthetic documents good enough to train downstream classifiers. In the comparison study, layout- and class-conditioned pretraining combined with per-label DPDM fine-tuning reached the best downstream accuracy (77–78%) on RVL-CDIP, and in the full evaluation on the small Tobacco3482 dataset, classifiers trained on synthetic images reached 78–82% accuracy across privacy levels, well above the 44–74% range of direct DP-Adam training. The authors present this as evidence that synthetic data

Load-bearing premise

The public IIT-CDIP corpus used for non-private pretraining is assumed to be separate from the private datasets, but RVL-CDIP and Tobacco3482 are in fact subsets of IIT-CDIP, so the stated privacy guarantee protects only the fine-tuning step, not the pretraining exposure.

Editorial extensions

If this is right

  • On small-scale private document sets, DP-generated synthetic data can give downstream classifiers an edge over training with DP directly: Tobacco3482 accuracy jumps from roughly 44–74% to 78–82%.
  • Class-conditional generation from a single global model struggles to separate similar document classes; per-label models appear to be the more reliable private generation strategy.
  • Layout conditioning, extracted cheaply by OCR, contributes the largest single performance gain among the pretraining options tested.
  • Stronger privacy ($\varepsilon=1$) costs little in visual quality on the larger dataset but visibly degrades FID on the small dataset.
  • Self-supervised document-specific pretraining of the downstream classifier (DiT-B) exploits the synthetic data best.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors leave implicit that the quoted $\varepsilon$ protects only the private fine-tuning step; because RVL-CDIP and Tobacco3482 are subsets of the IIT-CDIP pretraining corpus, the non-private pretraining already saw the 'private' images, so the end-to-end guarantee is weaker than the fine-tuning budget alone suggests.
  • A direct test this suggests: a nearest-neighbour or membership audit of generated images against IIT-CDIP. If generated samples reproduce fragments of specific private documents that only pretraining could have seen, the synthetic set is not the clean private substitute the paper claims.
  • The same generate-then-train pipeline should transfer to other document tasks — key information extraction, layout analysis, form parsing — wherever DP training is expensive, provided the conditioning channels (class, layout, text) align with what the target task needs.
  • Because all setups used one fixed hyperparameter configuration, the DPDM-versus-DP-Promise ordering may be an artifact of that configuration; repeating the comparison with per-method tuning would show which algorithm actually carries the result.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes DP-DocLDM, a method to generate synthetic document images under differential privacy. It first non-privately pretrains a class- and layout-conditioned latent diffusion model on IIT-CDIP Test Collection 1.0, then privately fine-tunes the model on private document datasets (RVL-CDIP and Tobacco3482) using DPDM or DP-Promise, and finally uses the generated synthetic samples to train downstream classifiers. The authors report FID scores and downstream classification accuracies at privacy levels ε ∈ {1, 5, 10}, and claim that the approach outperforms directly applying DP-Adam, especially on the small-scale Tobacco3482 dataset.

Significance. If the privacy guarantee were valid, the paper would address an important problem: replacing sensitive document images with synthetic counterparts that preserve utility while satisfying differential privacy. The paper also provides a fairly extensive ablation of pretraining setups, private fine-tuning strategies, and autoencoder choices, and it releases source code. However, the central privacy claim is undermined by a data-provenance error: the 'public' pretraining corpus (IIT-CDIP) contains the very datasets used as 'private' benchmarks (RVL-CDIP and Tobacco3482 are subsets of IIT-CDIP). Consequently, the reported gains cannot be attributed to the DP fine-tuning, and the claim that the pretrained autoencoder 'does not introduce any privacy risks' (Section 4.1) is incorrect. The evaluation is therefore not a valid demonstration of differentially private document generation.

major comments (3)
  1. [Sections 4.1 and 5.1] The public/private data split is invalid. Section 4.1 states that the autoencoder is trained on the public dataset and therefore introduces no privacy risk, and Section 5.1 defines the public dataset as IIT-CDIP Test Collection 1.0 (all 11M images for the autoencoder). However, RVL-CDIP is a labeled subset of IIT-CDIP, and Tobacco3482 is drawn from the same IIT-CDIP collection. Thus the autoencoder and the diffusion pretraining already observed the exact 'private' images without any DP protection. The DP guarantee (from DPDM/DP-Promise) applies only to the fine-tuning step, so the full pipeline does not provide (ε,δ)-DP with respect to those records. The assertion that pretraining 'does not introduce any privacy risks' is false as stated.
  2. [Section 5.3 and Table 3] The downstream evaluation is further contaminated by the same overlap. The DiT-B classifier is described as pretrained in a self-supervised manner on IIT-CDIP, which includes the RVL-CDIP and Tobacco3482 training (and test) images. Therefore the downstream classifier has already seen the private data non-privately, making the accuracy numbers in Table 3 an unreliable measure of the utility of privately fine-tuned synthetic data. This is a separate leakage path from the pretraining of the diffusion model.
  3. [Abstract and Section 6] The headline claim that the approach brings 'substantial performance improvements' on small-scale datasets (Tobacco3482) is not supported by the evidence. Since the pretraining corpus contains the private evaluation data, the high downstream accuracies in Table 3 (e.g., 80-82% on Tobacco3482) can be explained by non-private exposure to the target distribution during pretraining, not by the DP fine-tuning. The comparison with DP-Adam [52] is therefore not an apples-to-apples comparison of privacy-preserving methods.
minor comments (4)
  1. [Section 5.1] Tobacco3482 is cited only via a Kaggle URL in a footnote; the original dataset reference should be provided.
  2. [Section 4.1] Typo: 'Romback et al.' should be 'Rombach et al.'
  3. [Abstract and Section 5.5] The abstract says 'DP-SGD' while Section 5.5 and Table 3 compare with 'DP-Adam' from [52]; please clarify the terminology consistently.
  4. [Section 5.4] The paper says DP-Promise requires manual tuning of σ for each scenario (Section 5.4), but Section 5.2 states that σ is computed by numerical optimization for DPDM only. Please specify how σ was set for DP-Promise in all experiments.

Circularity Check

2 steps flagged · score 8.0 of 10

The DP guarantee is void because the 'public' pretraining corpus (IIT-CDIP) contains the 'private' evaluation datasets (RVL-CDIP, Tobacco3482); downstream gains are forced by non-private pretraining exposure, and the best downstream classifier (DiT-B) is also pretrained on the same overlapping corpus.

  1. self definitional [Section 4.1 (Non-private Pretraining on Public Dataset) and Section 5.1 (Datasets); Eq. 7]
    "For public pretraining of both the autoencoder and the diffusion model, we utilize the large-scale public document dataset IIT-CDIP Test Collection 1.0 [56]. ... For private training, we evaluate our approach on two widely used document benchmark datasets: RVL-CDIP [25] and Tobacco3482 ... It is worth noting that since the autoencoder is trained on the public dataset, it does not introduce any privacy risks."

    RVL-CDIP is a labeled subset of IIT-CDIP, and Tobacco3482 is drawn from the same IIT-CDIP collection. Therefore the 'public' data used in Eq. 7/8 already contains the exact private images claimed to be protected. The DP guarantee from DPDM/DP-Promise applies only to the private fine-tuning step, not to the non-private pretraining that already observed these records. Any ability of the model to generate private-like documents, and the downstream improvements in Table 3, are explained by this non-private exposure rather than by the private fine-tuning. The assertion that the autoencoder 'does not introduce any privacy risks' is definitional only under a public/private split that the paper's own dataset choices violate. Thus the central privacy claim reduces to the choice of pretraining corpu

  2. other [Section 5.3 (Evaluation protocol), final paragraph]
    "DiT-B [36] model is pretrained in a self-supervised manner on the IIT-CDIP Test Collection 1.0 [56] dataset."

    DiT-B is the best-performing downstream classifier in Table 3 (e.g., 80.21% on RVL-CDIP at ε=1 and 82.57% on Tobacco3482 at ε=10). Its self-supervised pretraining used IIT-CDIP, which contains the RVL-CDIP and Tobacco3482 data, including their test portions. Consequently, the downstream evaluation is not independent: the classifier has already been exposed to the target document distribution during pretraining. This is a second instance of the same public/private overlap, making the reported downstream results for DiT-B a function of leaking the evaluation data into the pretraining corpus rather than a clean measure of the proposed DP generation method.

full rationale

The paper's central contribution is a claim of differentially private document generation: pretrain non-privately on a public corpus, fine-tune with DP on a private corpus, then use synthetic samples for downstream tasks. The argument stands only if the public corpus is truly disjoint from the private data. The paper defines the public corpus as IIT-CDIP Test Collection 1.0 and the private corpora as RVL-CDIP and Tobacco3482. However, these benchmark datasets are subsets of or drawn from IIT-CDIP, so the non-private pretraining already observed the exact records that the DP fine-tuning is supposed to protect. This invalidates the privacy guarantee for the full pipeline and confounds the evaluation: the model's ability to produce documents resembling RVL-CDIP/Tobacco3482, and the downstream accuracy gains, are forced by the pretraining data rather than by the private fine-tuning. The same overlap affects the DiT-B downstream classifier, which is pretrained on IIT-CDIP and then evaluated on those benchmarks. This is not a minor self-citation issue or a matter of tuning; it is a structural circularity in the central claim. If the authors could demonstrate genuine disjointness, the derivation could be independent, but the paper's own Section 5.1 identifies the public corpus in a way that makes that impossible. Score 8 reflects that the headline result is effectively forced by the input pretraining choice and by definition of 'public' rather than by the proposed DP mechanism.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

No new physical or mathematical entities are introduced. The load-bearing assumptions are the correctness of standard DP accountants and, critically, the disjointness of the public and private datasets, which is violated. Free parameters are standard training hyperparameters fixed by hand rather than fitted to the downstream metric.

free parameters (4)
  • Gradient clipping threshold C = 0.01
    Fixed for all private training; chosen by hand rather than tuned per dataset or model.
  • Batch size = 1096
    Fixed for all private fine-tuning experiments.
  • Learning rate = 3e-4
    Fixed for all private fine-tuning; no grid search reported.
  • Number of generated samples for downstream training = 50K
    Used for all downstream classifier training in Stage 1 and Stage 2 comparisons; affects downstream accuracy.
assumptions (3)
  • standard math Rényi DP accountant correctly tracks privacy loss for DPDM with noise multiplicity eta, and GDP accountant for DP-Promise.
    Invoked in Section 5.2 and Appendix A to compute the noise multiplier for epsilon in {1,5,10}.
  • ad hoc to paper RVL-CDIP and Tobacco3482 are disjoint from the IIT-CDIP pretraining corpus.
    Assumed in Section 4.1 ('it does not introduce any privacy risks'); actually false since RVL-CDIP and Tobacco3482 are subsets of IIT-CDIP.
  • domain assumption Training per-class DP models with per-class epsilon yields an overall epsilon equal to the per-class epsilon, because class subsets are disjoint.
    Implied in Section 5.2 ('the noise multiplier sigma is computed separately for each labeled subset'); reasonable for disjoint subsets, but class labels are also private and the composition argument is not stated explicitly.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DP-DocLDM: Differentially Private Document Image Generation using Latent Diffusion Models." pith.science (2026). https://pith.science/paper/XS6MMBFK

@misc{pith2026250804208,
  author       = {Pith},
  title        = {Pith review of: DP-DocLDM: Differentially Private Document Image Generation using Latent Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XS6MMBFK}},
  note         = {Machine review of arXiv:2508.04208}
}
abstract

As deep learning-based, data-driven information extraction systems become increasingly integrated into modern document processing workflows, one primary concern is the risk of malicious leakage of sensitive private data from these systems. While some recent works have explored Differential Privacy (DP) to mitigate these privacy risks, DP-based training is known to cause significant performance degradation and impose several limitations on standard training procedures, making its direct application to downstream tasks both difficult and costly. In this work, we aim to address the above challenges within the context of document image classification by substituting real private data with a synthetic counterpart. In particular, we propose to use conditional latent diffusion models (LDMs) in combination with differential privacy (DP) to generate class-specific synthetic document images under strict privacy constraints, which can then be utilized to train a downstream classifier following standard training procedures. We investigate our approach under various pretraining setups, including unconditional, class-conditional, and layout-conditional pretraining, in combination with multiple private training strategies such as class-conditional and per-label private fine-tuning with DPDM and DP-Promise algorithms. Additionally, we evaluate it on two well-known document benchmark datasets, RVL-CDIP and Tobacco3482, and show that it can generate useful and realistic document samples across various document types and privacy levels ($\varepsilon \in \{1, 5, 10\}$). Lastly, we show that our approach achieves substantial performance improvements in downstream evaluations on small-scale datasets, compared to the direct application of DP-Adam.

Figures

Figures reproduced from arXiv: 2508.04208 by the authors.

Figure 1
Figure 1. Overview of the proposed approach, DP-DocLDM. The input image is [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Visual comparison of the synthetic RVL-CDIP [ [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Visual comparison of synthetic RVL-CDIP [ [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visual comparison of the synthetic Tobacco3482 dataset samples gener [PITH_FULL_IMAGE:figures/full_fig_p022_4.png]
Figure 5
Figure 5. Figure 5: Visual comparison of synthetic Tobacco3482 samples generated using KL [PITH_FULL_IMAGE:figures/full_fig_p023_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

68 extracted references · 47 canonical work pages

  1. [52]

    International Journal on Document Analysis and Recognition (IJDAR) 27(3), 475–499 (jun 2024), http://dx.doi.org/10.1007/s10032-024-00469-8

    Saifullah, S., Mercier, D., Agne, S., Dengel, A., Ahmed, S.: Towards privacy pre- served document image classification: a comprehensive benchmark. International Journal on Document Analysis and Recognition (IJDAR) 27(3), 475–499 (jun 2024), http://dx.doi.org/10.1007/s10032-024-00469-8

    work page doi:10.1007/s10032-024-00469-8 2024

  2. [1]

    In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM (oct 2016), https://doi.org/10.1145%2F2976749.2978318

    arXiv 2016

  3. [2]

    Proceedings of the International Conference on Document Analysis and Recognition, ICDAR1, 883–888 (2017)

    Afzal, M.Z., Kolsch, A., Ahmed, S., Liwicki, M.: Cutting the error by half: Investi- gation of very deep cnn and advanced training strategies for document image clas- sification. Proceedings of the International Conference on Document Analysis and Recognition, ICDAR1, 883–888 (2017). https://doi.org/10.1109/ICDAR.2017.149

    work page doi:10.1109/icdar.2017.149 2017

  4. [3]

    IEEE Secur

    Al-Rubaie, M., Chang, J.M.: Privacy-Preserving Machine Learning: Threats and Solutions. IEEE Secur. Priv.17(2), 49–58 (mar 2019)

    work page 2019

  5. [4]

    In: Ranzato, M., Beygelzimer, A., Dauphin, Y., Liang, P., Vaughan, J.W

    Andrew, G., Thakkar, O., McMahan, B., Ramaswamy, S.: Differentially pri- vate learning with adaptive clipping. In: Ranzato, M., Beygelzimer, A., Dauphin, Y., Liang, P., Vaughan, J.W. (eds.) Advances in Neural In- formation Processing Systems. vol. 34, pp. 17455–17466. Curran Asso- ciates, Inc. (2021), https://proceedings.neurips.cc/paper_files/paper/2021/...

    work page 2021

  6. [5]

    In: Proceedings of the 3rd Workshop on Economics and Natural Language Processing, ECONLP

    Basu, P., Roy, T.S., Naidu, R., Muftuoglu, Z.: Privacy enabled Financial Text Classification using Differential Privacy and Federated Learning. In: Proceedings of the 3rd Workshop on Economics and Natural Language Processing, ECONLP

    work page

  7. [6]

    Basu, P., Roy, T.S., Naidu, R., Muftuoglu, Z., Singh, S., Mireshghallah, F.: Bench- marking differential privacy and federated learning for bert models (2022)

    work page 2022

  8. [7]

    In: Proc

    Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., Song, D.: The secret Sharer: Evaluating and testing unintended memorization in neural networks. In: Proc. 28th USENIX Secur. Symp. pp. 267–284 (2019)

    work page 2019

Show all 68 references
  1. [8]

    In: 30th USENIX Security Symposium (USENIX Security 21)

    Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, Ú., Oprea, A., Raffel, C.: Extracting training data from large language models. In: 30th USENIX Security Symposium (USENIX Security 21). pp. 2633–2650....

    2021

  2. [9]

    In: Larochelle, H., Ran- zato, M., Hadsell, R., Balcan, M., Lin, H

    Chen, D., Orekondy, T., Fritz, M.: Gs-wgan: A gradient-sanitized ap- proach for learning differentially private generators. In: Larochelle, H., Ran- zato, M., Hadsell, R., Balcan, M., Lin, H. (eds.) Advances in Neural Information Processing Systems. vol. 33, pp. 12673–12684. C...

    2020

  3. [10]

    In: Proc

    Coavoux, M., Narayan, S., Cohen, S.B.: Privacy-preserving neural representations of text. In: Proc. 2018 Conf. Empir. Methods Nat. Lang. Process. EMNLP 2018. pp. 1–10 (2020). https://doi.org/10.18653/v1/d18-1001

    2018 doi

  4. [11]

    In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)

    Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: Pre-training of deep bidirectional transformers for language understanding. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies...

    2019

  5. [12]

    Dhariwal, P., Nichol, A.: Diffusion models beat gans on image synthesis (2021), https://arxiv.org/abs/2105.05233 DP-DocLDM: Differentially Private Document Image Generation 17

    2021 arXiv

  6. [13]

    Dockhorn,T.,Cao,T.,Vahdat,A.,Kreis,K.:Differentiallyprivatediffusionmodels (2023), https://openreview.net/forum?id=pX21pH4CsNB

    2023

  7. [14]

    In: International Conference on Learning Representations (2021), https://openreview

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., Houlsby, N.: An image is worth 16x16 words: Transformers for image recognition at scale. In: International Conference on L...

    2021

  8. [15]

    Foundations and Trends R in Theoretical Computer Science9, 211–407 (2014)

    Dwork, C., Roth, A., Dwork, C., Roth, A.: The Algorithmic Foundations of Dif- ferential Privacy. Foundations and Trends R in Theoretical Computer Science9, 211–407 (2014). https://doi.org/10.1561/0400000042

    2014 doi

  9. [16]

    In: Automata, Languages and Programming

    Dwork, C.: Differential Privacy. In: Automata, Languages and Programming. pp. 1–12. Springer Berlin Heidelberg, Berlin, Heidelberg (2006), http://link.springer. com/10.1007/11787006{_}1

    2006 doi

  10. [17]

    European Parliament, Council of the European Union: Regulation (EU) 2016/679 of the European Parliament and of the Council, https://data.europa.eu/eli/reg/ 2016/679/oj

    2016

  11. [18]

    In: Krzhizhanovskaya, V.V., Závodszky, G., Lees, M.H., Dongarra, J.J., Sloot, P.M.A., Brissos, S., Teixeira, J

    Ferrando, J., Domínguez, J.L., Torres, J., García, R., García, D., Garrido, D., Cor- tada, J., Valero, M.: Improving accuracy and speeding up document image classifi- cation through parallel systems. In: Krzhizhanovskaya, V.V., Závodszky, G., Lees, M.H., Dongarra, J.J., Sloot,...

    2020

  12. [19]

    In: Proceedings - IEEE International Conference on Data Mining, ICDM

    Feyisetan, O., Diethe, T., Drake, T.: Leveraging hierarchical representations for preserving privacy and utility in text. In: Proceedings - IEEE International Conference on Data Mining, ICDM. vol. 2019-Novem, pp. 210–219 (oct 2019), http://arxiv.org/abs/1910.08917

    2019 arXiv

  13. [20]

    In: Proc

    Fredrikson, M., Jha, S., Ristenpart, T.: Model inversion attacks that exploit confi- dence information and basic countermeasures. In: Proc. ACM Conf. Comput. Com- mun. Secur. vol. 2015-Octob, pp. 1322–1333. ACM, New York, NY, USA (2015), http://dx.doi.org/10.1145/2810103.2813677

    2015

  14. [21]

    Ghalebikesabi, S., Berrada, L., Gowal, S., Ktena, I., Stanforth, R., Hayes, J., De, S., Smith, S.L., Wiles, O., Balle, B.: Differentially private diffusion models generate useful synthetic images (2023), https://arxiv.org/abs/2302.13861

    2023 arXiv

  15. [22]

    Guan, H., Wang, Y., Xie, L., Nag, S., Goel, R., Swamy, N.E.N., Yang, Y., Xiao, C., Prisby, J., Maciejewski, R., Zou, J.: Idnet: A novel dataset for identity document analysis and fraud detection (2024), https://arxiv.org/abs/2408.01690

    2024 arXiv

  16. [23]

    In: Barney Smith, E.H., Liwicki, M., Peng, L

    Hamdani, S.J.H., Saifullah, S., Agne, S., Dengel, A., Ahmed, S.: Latent diffusion for guided document table generation. In: Barney Smith, E.H., Liwicki, M., Peng, L. (eds.) Document Analysis and Recognition - ICDAR 2024. pp. 368–383. Springer Nature Switzerland, Cham (2024)

    2024

  17. [24]

    Transactions on Machine Learning Research (2023), https://openreview.net/forum?id=R6W7zkMz0P

    Harder, F., Jalali, M., Sutherland, D.J., Park, M.: Pre-trained perceptual features improve differentially private image generation. Transactions on Machine Learning Research (2023), https://openreview.net/forum?id=R6W7zkMz0P

    2023

  18. [25]

    In: International Conference on Document Analysis and Recognition (ICDAR)

    Harley, A.W., Ufkes, A., Derpanis, K.G.: Evaluation of deep convolutional nets for document image classification and retrieval. In: International Conference on Document Analysis and Recognition (ICDAR)

  19. [26]

    2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) pp

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) pp. 770–778 (2015), https://api.semanticscholar.org/CorpusID:206594692

    2016

  20. [27]

    He, L., Lu, Y., Corring, J., Florencio, D., Zhang, C.: Diffusion-Based Document Layout Generation, p. 361–378. Springer Nature Switzerland (2023), http://dx. doi.org/10.1007/978-3-031-41676-7_21 18 S. Saifullah et al

    2023 doi

  21. [28]

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models (2020), https: //arxiv.org/abs/2006.11239

    2020 arXiv

  22. [29]

    Ho, J., Salimans, T.: Classifier-free diffusion guidance (2022), https://arxiv.org/ abs/2207.12598

    2022 arXiv

  23. [30]

    In: Findings of the Association for Computational Linguistics, Findings of ACL: EMNLP 2021

    Hoory, S., Feder, A., Tendler, A., Cohen, A., Erell, S., Laish, I., Nakhost, H., Stemmer, U., Benjamini, A., Hassidim, A., Matias, Y.: Learning and Evaluating a Differentially Private Pre-trained Language Model. In: Findings of the Association for Computational Linguistics, Fi...

    2021 doi

  24. [31]

    arXivabs/2301.09112 (2023), https://arxiv.org/abs/2301.09112

    Hu, L., Habernal, I., Shen, L., Wang, D.: Differentially private natural language models: Recent advances and future directions. arXivabs/2301.09112 (2023), https://arxiv.org/abs/2301.09112

    2023 arXiv

  25. [32]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Huang, Y., Lv, T., Cui, L., Lu, Y., Wei, F.: LayoutLMv3: Pre-training for Docu- ment AI with Unified Text and Image Masking. In: Proceedings of the 30th ACM International Conference on Multimedia. pp. 4083–4091. ACM, New York, NY, USA (oct 2022), https://dl.acm.org/doi/10.1145...

    2022

  26. [33]

    In: The Eleventh International Conference on Learning Representations (2023), https://openreview.net/forum?id=JmC_Tld3v-f

    Koskela, A., Tobaben, M., Honkela, A.: Individual privacy accounting with gaus- sian differential privacy. In: The Eleventh International Conference on Learning Representations (2023), https://openreview.net/forum?id=JmC_Tld3v-f

    2023

  27. [34]

    Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., Jana, S.: Certified robustness to adversarial examples with differential privacy (2019), https://arxiv.org/abs/1802. 03471

    2019

  28. [35]

    In: Proceedings of the Annual Meeting of the Association for Computational Linguistics

    Lee, C.Y., Li, C.L., Dozat, T., Perot, V., Su, G., Hua, N., Ainslie, J., Wang, R., Fujii, Y., Pfister, T.: FormNet: Structural Encoding beyond Sequential Modeling in Form Document Information Extraction. In: Proceedings of the Annual Meeting of the Association for Computationa...

    2022 doi

  29. [36]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Li, J., Xu, Y., Lv, T., Cui, L., Zhang, C., Wei, F.: Dit: Self-supervised pre-training for document image transformer. In: Proceedings of the 30th ACM International Conference on Multimedia. p. 3530–3539. MM ’22, Association for Computing Machinery, New York, NY, USA (2022), h...

    2022

  30. [37]

    In: International Conference on Learning Represen- tations (2022), https://openreview.net/forum?id=bVuP3ltATMz

    Li, X., Tramer, F., Liang, P., Hashimoto, T.: Large language models can be strong differentially private learners. In: International Conference on Learning Represen- tations (2022), https://openreview.net/forum?id=bVuP3ltATMz

    2022

  31. [38]

    In: International Confer- ence on Learning Representations (2022), https://openreview.net/forum?id= M6M8BEmd6dq

    Liew, S.P., Takahashi, T., Ueno, M.: PEARL: Data synthesis via private embeddings and adversarial reconstruction learning. In: International Confer- ence on Learning Representations (2022), https://openreview.net/forum?id= M6M8BEmd6dq

    2022

  32. [39]

    Transactions on Machine Learning Research (2024), https://openreview

    Liu, M.F., Lyu, S., Vinaroz, M., Park, M.: Differentially private latent diffusion models. Transactions on Machine Learning Research (2024), https://openreview. net/forum?id=AkdQ266kHj

    2024

  33. [40]

    In: The Thirteenth International Conference on Learning Representations (2025), https://openreview.net/forum?id=2kGKsyhtvh

    Liu,R.,Bu,Z.:Towardshyperparameter-freeoptimizationwithdifferentialprivacy. In: The Thirteenth International Conference on Learning Representations (2025), https://openreview.net/forum?id=2kGKsyhtvh

    2025

  34. [41]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2022)

    Liu, Z., Mao, H., Wu, C.Y., Feichtenhofer, C., Darrell, T., Xie, S.: A convnet for the 2020s. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2022)

    2022

  35. [42]

    In: International Conference on Learning Representa- tions (2017) DP-DocLDM: Differentially Private Document Image Generation 19

    McMahan, H.B., Ramage, D., Talwar, K., Zhang, L.: Learning differentially private recurrent language models. In: International Conference on Learning Representa- tions (2017) DP-DocLDM: Differentially Private Document Image Generation 19

    2017

  36. [43]

    IEEE Transactions on Industrial Informatics (2021)

    Mercier, D., Lucieri, A., Munir, M., Dengel, A., Ahmed, S.: Evaluating privacy- preserving machine learning in critical infrastructures: A case study on time-series classification. IEEE Transactions on Industrial Informatics (2021)

    2021

  37. [44]

    In: 2017 IEEE 30th Computer Security Foundations Symposium (CSF)

    Mironov, I.: Rényi differential privacy. In: 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE (aug 2017), https://doi.org/10.1109%2Fcsf. 2017.11

    2017

  38. [45]

    Papernot, N., Chien, S., Song, S., Thakurta, A., Erlingsson, U.: Making the shoe fit:Architectures,initializations,andtuningforlearningwithprivacy(2020),https: //openreview.net/forum?id=rJg851rYwH

    2020

  39. [46]

    In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    Plant, R., Gkatzia, D., Giuffrida, V.: CAPE: Context-aware private embeddings for private language learning. In: Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. pp. 7970–7978. Association for Com- putational Linguistics, Online and Punta...

    2021

  40. [47]

    In: Lladós, J., Lopresti, D., Uchida, S

    Powalski Rafałand Borchmann, Ł., Jurkiewicz, D., Dwojak, T., Pietruszka Michałand Pałka, G.: Going Full-TILT Boogie on Document Understanding with Text-Image-Layout Transformer. In: Lladós, J., Lopresti, D., Uchida, S. (eds.) Doc- ument Analysis and Recognition – ICDAR 2021. p...

    2021

  41. [48]

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models (2021)

    2021

  42. [49]

    Sadat, S., Buhmann, J., Bradley, D., Hilliges, O., Weber, R.M.: Cads: Unleash- ing the diversity of diffusion models through condition-annealed sampling (2024), https://arxiv.org/abs/2310.17347

    2024 arXiv

  43. [50]

    Saifullah, S., Agne, S., Dengel, A., Ahmed, S.: Docxclassifier: Towards an inter- pretable deep convolutional neural network for document image classification (9 2022), https://doi.org/10.36227/techrxiv.19310489.v4

    2022 doi

  44. [51]

    Saifullah, S., Agne, S., Dengel, A., Ahmed, S.: Pried-kie: Towards privacy preserved document key information extraction (2023)

    2023

  45. [53]

    In: Lladós, J., Lopresti, D., Uchida, S

    Shen, Z., Zhang, R., Dell, M., Lee, B.C.G., Carlson, J., Li, W.: Layoutparser: A unified toolkit for deep learning based document image analysis. In: Lladós, J., Lopresti, D., Uchida, S. (eds.) Document Analysis and Recognition – ICDAR 2021. pp. 131–146. Springer International...

    2021

  46. [54]

    In: Proc

    Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership Inference Attacks Against Machine Learning Models. In: Proc. - IEEE Symp. Secur. Priv. pp. 3–18 (2017). https://doi.org/10.1109/SP.2017.41

    2017 doi

  47. [55]

    In: ICDAR ’07: Proceedings of the Ninth International Conference on Document Analysis and Recognition

    Smith, R.: An overview of the tesseract ocr engine. In: ICDAR ’07: Proceedings of the Ninth International Conference on Document Analysis and Recognition. pp. 629–633. IEEE Computer Society, Washington, DC, USA (2007), https://storage. googleapis.com/pub-tools-public-publicati...

    2007

  48. [56]

    Soboroff, I.: Complex document information processing (cdip) dataset, national institute of standards and technology (2022)

    2022

  49. [57]

    Saifullah et al

    Sohl-Dickstein, J., Weiss, E.A., Maheswaranathan, N., Ganguli, S.: Deep unsuper- vised learning using nonequilibrium thermodynamics (2015), https://arxiv.org/ abs/1503.03585 20 S. Saifullah et al

    2015 arXiv

  50. [58]

    In: Document Analysis and Recognition - ICDAR 2023: 17th Interna- tional Conference, San José, CA, USA, August 21–26, 2023, Proceedings, Part III

    Tanveer, N., Ul-Hasan, A., Shafait, F.: Diffusion models for document image gen- eration. In: Document Analysis and Recognition - ICDAR 2023: 17th Interna- tional Conference, San José, CA, USA, August 21–26, 2023, Proceedings, Part III. p. 438–453. Springer-Verlag, Berlin, Hei...

    2023

  51. [59]

    In: Bar- ney Smith, E.H., Liwicki, M., Peng, L

    Tito, R., Nguyen, K., Tobaben, M., Kerkouche, R., Souibgui, M.A., Jung, K., Jälkö, J., D’Andecy, V.P., Joseph, A., Kang, L., Valveny, E., Honkela, A., Fritz, M., Karatzas, D.: Privacy-aware document visual question answering. In: Bar- ney Smith, E.H., Liwicki, M., Peng, L. (ed...

    2024

  52. [60]

    In: Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition Workshops

    Torkzadehmahani, R., Kairouz, P., Paten, B.: Dp-cgan: Differentially private syn- thetic data and label generation. In: Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition Workshops. pp. 0–0 (2019)

    2019

  53. [61]

    Tsai, Y.L., Li, Y., Chen, Z., Chen, P.Y., Yu, C.M., Ren, X., Buet-Golfouse, F.: Differentially private fine-tuning of diffusion models (2024), https://arxiv.org/abs/ 2406.01355

    2024 arXiv

  54. [62]

    In: USENIX Se- curity Symposium (2024), https://www.usenix.org/conference/usenixsecurity24/ presentation/wang-haichen

    Wang, H., Pang, S., Lu, Z., Rao, Y., Zhou, Y., Xue, M.: dp-promise: Differen- tially private diffusion probabilistic models for image synthesis. In: USENIX Se- curity Symposium (2024), https://www.usenix.org/conference/usenixsecurity24/ presentation/wang-haichen

    2024

  55. [63]

    Applied Sciences (Switzerland) 12(21) (mar 2022), http://arxiv.org/abs/2103

    Wunderlich, D., Bernau, D., Aldà, F., Parra-Arnau, J., Strufe, T.: On the Pri- vacy–Utility Trade-Off in Differentially Private Hierarchical Text Classification. Applied Sciences (Switzerland) 12(21) (mar 2022), http://arxiv.org/abs/2103. 02895

    2022

  56. [64]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Yin, H., Mallya, A., Vahdat, A., Alvarez, J.M., Kautz, J., Molchanov, P.: See through gradients: Image batch recovery via gradinversion. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 16337–16346 (June 2021)

    2021

  57. [65]

    org/abs/1905.04899

    Yun, S., Han, D., Oh, S.J., Chun, S., Choe, J., Yoo, Y.: Cutmix: Regularization strategy to train strong classifiers with localizable features (2019), https://arxiv. org/abs/1905.04899

    2019 arXiv

  58. [66]

    Zhang, H., Cisse, M., Dauphin, Y.N., Lopez-Paz, D.: mixup: Beyond empirical risk minimization (2018), https://arxiv.org/abs/1710.09412

    2018 arXiv

  59. [67]

    Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., Kaissis, G.: Medical imaging deep learning with differential privacy. Scientific Reports11(1) (jun 2021), http://dx.doi.org/10.1038/s41598-021-93030-0 DP-DocLDM: Differentially Private Document Image Generation 21...

    2021 doi

  60. [2021]

    pp. 50–55. Association for Computational Linguistics, Stroudsburg, PA, USA (oct 2021), https://aclanthology.org/2021.econlp-1.7

    2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.