Pith. sign in

REVIEW 3 major objections 5 minor 9 cited by

A practical guide argues that DP synthetic data can be treated as an anonymous, reusable stand-in for sensitive data in ordinary ML workflows.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 18:49 UTC pith:VWVP2DNV

load-bearing objection A genuinely useful survey of DP synthetic data with correct DP fundamentals and a strong practitioner layer; two overclaims (fully anonymous, cross-paper rankings) need fixing before it becomes canonical. the 3 major comments →

arxiv 2512.03238 v2 pith:VWVP2DNV submitted 2025-12-02 cs.CR cs.AIcs.LGstat.ML

How to DP-fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy

Natalia Ponomareva , Zheng Xu , H. Brendan McMahan , Peter Kairouz , Lucas Rosenblatt , Vincent Cohen-Addad , Crist\'obal Guzm\'an , Ryan McKenna
show 7 more authors
Galen Andrew Alex Bie Da Yu Alex Kurakin Morteza Zadimoghaddam Sergei Vassilvitskii Andreas Terzis
This is my paper
classification cs.CR cs.AIcs.LGstat.ML
keywords differential privacysynthetic dataprivacy unitDP-SGDpost-processingtabular data synthesisimage generationprivacy auditing
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This survey tries to establish that differentially private (DP) synthetic data can act as a safe, reusable replacement for sensitive data: once the data is generated under a chosen DP guarantee and audited, it can be treated as fully anonymous and used freely in standard machine-learning workflows. The claim matters because it would let practitioners concentrate the hard problem of anonymization into a single DP synthesis step and then reuse that asset for training, evaluation, labeling, and analysis without paying per-model privacy costs. The survey's operational core is a set of method rankings across modalities: workload-based query-measurement algorithms remain the strongest proven option for tabular data, DP-finetuning of pretrained diffusion models is almost always the highest-fidelity choice for images when data and compute are sufficient, Private Evolution is preferred for small datasets or very low epsilon, and DP-finetuning yields the best text quality when enough private text exists. It also concedes that the experimental literature behind these rankings may not be fairly comparable across papers, so the concrete numbers should be read as provisional and benchmark-relative.

Core claim

The central claim is that DP synthetic data, produced with an appropriate privacy unit, contribution bounding, and empirical privacy auditing, inherits a formal worst-case guarantee that survives all downstream use: by differential privacy's post-processing property, any model trained or any analysis performed on the synthetic data remains DP with respect to the original records. The survey's corollary is a practical decision map: for tabular data, measure-then-estimate algorithms that target a query workload are currently the most reliable default, while LLM-based generative models are promising but not yet uniformly better; for images, DP-finetuning of a pretrained diffusion model is the r

What carries the argument

Two mechanisms carry the argument. The first is differential privacy's post-processing property: a randomized computation whose output is (epsilon, delta)-DP — here, the synthetic dataset — can be transformed, shared, and reused indefinitely without spending any additional privacy budget. The second is the privacy unit, the definition of what counts as one record (example, user, or larger group); every comparison and recommendation in the survey is organized around choosing this unit correctly, bounding each user's contribution so the unit matches reality, and auditing the final data empirically. For tabular data the load-bearing device is the select-measure-estimate paradigm, which privatel

Load-bearing premise

The guide's rankings assume the experimental results of the compared papers are mutually comparable, while the survey itself concedes that differences in model architectures, privacy accounting, public pretraining data, hyperparameters, and downstream evaluators undermine fair comparison.

What would settle it

A single benchmark that re-runs the main methods with identical privacy accounting, identical pretrained checkpoints, identical hyperparameter budgets, and identical downstream evaluators across datasets and epsilon regimes would settle the rankings; if DP-finetuned diffusion no longer leads in data-rich settings, or workload-based tabular methods no longer beat generative ones, the survey's actionable guidance fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Once a DP synthetic dataset is released, any number of downstream models can be trained on it with no additional privacy cost; post-processing alone guarantees their outputs are still DP.
  • For typical tabular workloads, workload-adaptive measurement algorithms are currently the safer default than end-to-end generative models, which struggle to preserve low-order statistics under DP noise.
  • Given roughly tens of thousands of private images and ample compute, DP-finetuning a pretrained diffusion model is the highest-fidelity option; with small datasets or epsilon below 1, Private Evolution is the recommended route.
  • Production systems must budget for privacy-unit choice, contribution bounding, empirical privacy auditing, and lineage tracking; skipping any of these silently weakens the formal guarantee.
  • Headline utility numbers (FIDs, accuracies, epsilons) from different papers should not be taken as directly comparable until re-run on a unified benchmark with matched accounting and evaluators.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the one-time-synthesis framing holds, the economics favor DP synthetic data over per-model DP training even when a single DP model would be cheaper: the synthesis cost amortizes across every downstream use of the dataset.
  • A testable extension implied by the survey is a standardized benchmark that fixes privacy accounting, pretrained checkpoints, hyperparameters, and downstream evaluators; such a benchmark could confirm or overturn the diffusion-over-GAN and workload-over-generative rankings the survey tentatively endorses.
  • The privacy-unit discussion points to a gap between formal guarantees and deployed identity: audited user-id-level DP may not equal person-level DP when accounts are shared or duplicated, so audits should target realistic identity models rather than only the formal unit.
  • Quality may exhibit threshold behavior rather than a smooth privacy-utility curve, so practical guidance should be expressed as operating envelopes (minimum data volume, maximum epsilon) rather than as continuous trade-off statements.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper is a broad survey and practical guide to differentially private (DP) synthetic data generation. It covers the DP background, privacy units, and the main families of methods for tabular, image, text, and federated/decentralized data, followed by system-level considerations such as contribution bounding, empirical auditing, and lineage tracking. The survey proposes a taxonomy of methods (e.g., select-measure-estimate for tabular data; DP-finetuning vs. training-free methods for images and text), gives state-of-the-art comparisons, and makes concrete recommendations—most prominently that, for images, DP-finetuning of pretrained diffusion models is 'almost always' the best choice given sufficient data and compute, and that DP synthetic data can, with suitable protections and audits, be treated as 'fully anonymous.'

Significance. If the recommendations were fully supported, this would be a valuable and timely reference: it fills a genuine gap by assembling the DP synthetic data literature across modalities and by connecting formal DP guarantees to practical engineering components like privacy accounting, contribution bounding, and auditing. The DP mathematics is standard and correctly presented: Definition 1 matches Dwork–Roth, the advanced composition expression in Section 2.3 is correct, the Gaussian mechanism noise scale is right, and Algorithm 2 correctly mirrors AIM. The tabular-data treatment, in particular, is careful and technically solid, and the discussion of workload-adaptive vs. workload-agnostic methods is nuanced. However, the survey's practical guidance—especially the method rankings and the 'fully anonymous' framing—rests on cross-paper comparisons and legal/technical assumptions that the manuscript itself partly undermines. These issues are fixable in revision but are load-bearing for the guide's central claims.

major comments (3)
  1. [§4.4, §4.6, §4.7, Table 7] The manuscript's actionable rankings presuppose that the reported numbers across papers are mutually comparable, but the manuscript itself cites Gong et al. (2025) in §4.7, documenting that DP image-generation papers differ in model architectures, privacy accounting assumptions, public pretraining datasets, hyperparameters, and downstream evaluators. Yet §4.4 presents a headline comparison ('an FID score below 7.9 was achieved with epsilon = 0.67, whereas prior work required epsilon values around 32 for similar FID levels') and §4.6/Table 7 make 'Preferred'/'Not recommended' recommendations based on exactly such incomparable numbers. This is internally inconsistent: the evidence base does not support the strength of the ranking claims. The authors should either (a) provide a meta-analysis or re-evaluation on even footing (e.g., using a unified benchmark such as DPImageBench, which they c
  2. [§1.3 and §2.4] The assertion that 'with suitable protections including appropriate DP parameters and audits, this DP synthetic data can be treated as fully anonymous' and hence 'used relatively freely in any standard ML workflow' is an overclaim. Differential privacy is a mathematical guarantee about the indistinguishability of neighboring datasets; it is not, by itself, a legal determination of anonymity (e.g., under GDPR or other data-protection frameworks), and empirical auditing cannot certify 'full anonymity.' The manuscript later acknowledges caveats around privacy units and group privacy in §2.2, but the §1.3 statement is presented without qualification and is used as a central motivation for the whole guide. This should be rewritten to distinguish the DP guarantee from legal anonymity, and to note that 'free use' still depends on the privacy unit, the chosen epsilon/delta, contribution bounding
  3. [§4.6 / Table 7] Even aside from cross-paper comparability, the Table 7 recommendation structure is not fully supported by the cited evidence. For example, the row 'Model access required' states that DP-finetuning requires weights, while Private Evolution requires only API access—this is accurate—but the 'Target privacy guarantee' row recommends DP-finetuning for high epsilon and PE for low epsilon, without citing any head-to-head study that varies epsilon and data size while controlling for architecture and evaluation protocol. The 'Preferred' entries are thus a reasonable synthesis of the literature but are presented as settled fact. The authors should mark these as provisional, based on heterogeneous evidence, and ideally accompany Table 7 with a statement of the confidence level and the main confounds.
minor comments (5)
  1. [Throughout] The manuscript contains numerous typos and grammatical slips, e.g., 'much hider fidelity' (§1.2), 'daata' (§1.4), 'cateogrical' (§3.8), 'emprically' (§3.7), 'Kolmogrov' (§3.8), and 'Pairwire' (§3.8). A thorough proofreading pass is needed.
  2. [§4.6] The section is about image synthesis, but the opening line says 'choosing the method for DP synthetic text data generation' and the text later refers to 'DP text synthesis.' This should be corrected to 'image.'
  3. [§4.6 / Table 7] The placeholder '>XXK datapoints' is undefined. Either give a concrete number or remove the 'XXK' notation; as written it is not actionable.
  4. [§3.6] When discussing DP-TBART and TabularARGN, the manuscript reports comparative results but does not consistently state whether the cited comparisons used the same privacy budget and evaluation protocol. A short paragraph on evaluation comparability in the tabular setting would help readers interpret these results.
  5. [§2.3] The advanced composition formula is stated correctly, but it would be helpful to include the standard citation to Dwork, Rothblum, and Vadhan (2010) in addition to Theorem 3.20 of Dwork–Roth, since the theorem originates there.

Circularity Check

0 steps flagged

No circular derivation: the survey is a literature synthesis; its rankings are comparative claims about external benchmarks, not fitted values renamed as predictions.

full rationale

This paper is a survey, not a derivation, so the core circularity patterns (self-definitional equations, fitted inputs called predictions, uniqueness theorems imported from prior work, ansatz-smuggling via citation) do not apply. The main load-bearing assertion—that DP synthetic data can be treated as anonymous and reused—is stated as a practical position in §1.3 and is not derived from any equation in the paper; it rests on standard DP post-processing (§2.3) and on external legal/technical assumptions that the paper itself does not prove. An unsupported or overbroad claim is a correctness risk, not an equivalence-by-construction. The method rankings in §4.6 and Table 7 are literature comparisons. The paper explicitly concedes the evidence base may not support fair comparisons: 'recent work by Gong et al. (2025) points out the lack of fair comparison in the DP image generation literature' (§4.7). This is an underdetermination problem with the external evidence, not a circular reduction of the survey's output to its input. Many cited methods (AIM, Private-PGM, DP-FTRL, multi-attribution privacy, some GAN comparisons) are the authors' own prior work, but they are cited as separate papers with their own benchmarks and are not used as a self-referential uniqueness proof; the survey's recommendations are not justified only by those self-citations. No equation in the paper is defined in terms of the quantity it is used to predict, no fitted parameter is relabeled as a prediction, and no uniqueness theorem or ansatz is imported via self-citation. The acknowledged fair-comparison limitation in §4.7 should be weighed as a reliability caveat, but it does not make the survey circular.

Axiom & Free-Parameter Ledger

0 free parameters · 5 axioms · 0 invented entities

No free parameters: the survey fits nothing; the epsilon/delta/FID/accuracy numbers are inherited from cited papers. Five axioms carry the argument: two standard DP facts (definition and post-processing), two domain assumptions about how DP maps to real-world privacy (user-id vs person-level; DP vs legal anonymization), and one assumption about the comparability of the literature evidence base. The last three are the load-bearing premises a reader should interrogate before acting on the recommendations.

axioms (5)
  • standard math (epsilon, delta)-DP as defined in Definition 1 (Section 2.1) is the operative privacy guarantee and captures meaningful protection for real datasets.
    Standard definition attributed to Dwork & Roth; the survey builds all method comparisons and system guidance on it. The translation from definition to real-world privacy is a separate domain assumption, listed below.
  • standard math Post-processing invariance: any computation on the output of a DP algorithm (sampling from a DP generator, training downstream models on DP synthetic data) incurs no additional privacy cost (Sections 2.3, 2.4).
    Correct and standard property of DP, and load-bearing for the survey's core promise that DP synthetic data can be 'used relatively freely in any standard ML workflow' (Section 1.3).
  • domain assumption User-id-level privacy approximates person-level privacy; group privacy converts small-unit guarantees to larger units (Section 2.2.2).
    The survey admits that perfect person attribution 'is essentially never the case in practice' (Section 2.2.2), yet its recommended practice (user-level privacy units) rests on treating user-id-level DP as a faithful proxy for person-level protection.
  • domain assumption DP synthetic data 'can be treated as fully anonymous' (Section 1.3).
    A legal/ethical translation asserted without citation. Contested by prior empirical and legal analyses (not cited here) showing DP synthetic data can leak under practical epsilons and that DP is not definitionally equivalent to legal anonymization. This is a load-bearing premise for the claim that the data can be 'used relatively freely'.
  • domain assumption Reported experimental results compared across papers are accurate and mutually comparable (Sections 3.7, 4.7; Tables 5-7).
    The survey itself cites Gong et al. (2025) in Section 4.7 noting the field lacks fair comparison due to differing accounting, architectures, public pretraining, and evaluators — undermining the cross-paper rankings and headline FID/epsilon comparisons the guidance depends on.

pith-pipeline@v1.3.0-alltime-deepseek · 46146 in / 14719 out tokens · 133083 ms · 2026-08-03T18:49:10.013517+00:00 · methodology

0 comments
read the original abstract

High quality data is needed to unlock the full potential of AI for end users. However finding new sources of such data is getting harder: most publicly-available human generated data will soon have been used. Additionally, publicly available data often is not representative of users of a particular system -- for example, a research speech dataset of contractors interacting with an AI assistant will likely be more homogeneous, well articulated and self-censored than real world commands that end users will issue. Therefore unlocking high-quality data grounded in real user interactions is of vital interest. However, the direct use of user data comes with significant privacy risks. Differential Privacy (DP) is a well established framework for reasoning about and limiting information leakage, and is a gold standard for protecting user privacy. The focus of this work, \emph{Differentially Private Synthetic data}, refers to synthetic data that preserves the overall trends of source data,, while providing strong privacy guarantees to individuals that contributed to the source dataset. DP synthetic data can unlock the value of datasets that have previously been inaccessible due to privacy concerns and can replace the use of sensitive datasets that previously have only had rudimentary protections like ad-hoc rule-based anonymization. In this paper we explore the full suite of techniques surrounding DP synthetic data, the types of privacy protections they offer and the state-of-the-art for various modalities (image, tabular, text and decentralized). We outline all the components needed in a system that generates DP synthetic data, from sensitive data handling and preparation, to tracking the use and empirical privacy testing. We hope that work will result in increased adoption of DP synthetic data, spur additional research and increase trust in DP synthetic data approaches.

Figures

Figures reproduced from arXiv: 2512.03238 by Alex Bie, Alex Kurakin, Andreas Terzis, Crist\'obal Guzm\'an, Da Yu, Galen Andrew, H. Brendan McMahan, Lucas Rosenblatt, Morteza Zadimoghaddam, Natalia Ponomareva, Peter Kairouz, Ryan McKenna, Sergei Vassilvitskii, Vincent Cohen-Addad, Zheng Xu.

Figure 1
Figure 1. Figure 1: Visual representation of choice of privacy unit for a toy private dataset of emails, reproduced with permission [PITH_FULL_IMAGE:figures/full_fig_p012_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: DP synthetic data can be used as a drop-in replacement for the original private data and can be safely used for [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The select-measure-estimate paradigm. (1) A mechanism or domain expert [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: A typical cross-device federated learning system for mobile applications. The figure is adapted from ( [PITH_FULL_IMAGE:figures/full_fig_p055_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Federated learning with differential privacy deploying Algorithm [PITH_FULL_IMAGE:figures/full_fig_p057_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. ContinuousBench: Can Differentially Private Synthetic Text Improve Capabilities?

    cs.LG 2026-06 unverdicted novelty 8.0

    ContinuousBench shows non-private synthetic text transfers corpus-specific capabilities while state-of-the-art DP methods fail to do so even at ε=100.

  2. Contrastive Identification and Generation in the Limit

    cs.LG 2026-05 unverdicted novelty 8.0

    Contrastive pair presentations yield exact identifiability characterizations via a geometric refinement of Angluin's condition, a new contrastive closure dimension for generation, mutual incomparability with text iden...

  3. Fixed-Parameter Tractability of Private Synthetic Data Generation

    cs.DS 2026-06 unverdicted novelty 7.0

    Proves FPT for differentially private synthetic data generation with treewidth parameter on query incidence graph, achieving optimal error rates via LP and subsampled private multiplicative weights unified by tree dec...

  4. Fixed-Parameter Tractability of Private Synthetic Data Generation

    cs.DS 2026-06 conditional novelty 7.0

    Private synthetic data generation is fixed-parameter tractable in the treewidth of the query family's incidence graph, with error rates matching known optimal bounds.

  5. Minimax optimal differentially private synthetic data for smooth queries

    math.ST 2026-02 conditional novelty 7.0

    The minimax error for (epsilon,delta)-differentially private synthetic data under k-smooth queries on the d-cube is (n·epsilon)^(-min{1,k/d}) up to log factors, attained by noisy Chebyshev moment matching and matched ...

  6. Optimal Domain-Aware Privacy Mechanisms for Synthetic Data Generation

    cs.IT 2026-07 conditional novelty 6.0

    For histogram-based DP synthetic data, mixing the private histogram with a floor-raised version of a same-domain public distribution is asymptotically the best linear privacy mechanism.

  7. Phantoms and Disclosures: A Statistical Framework for Auditing Privacy in Synthetic Data

    cs.LG 2026-06 conditional novelty 6.0

    A model-agnostic audit detects synthetic data disclosures via feature-match and membership-inference tests that separate true from phantom leaks and give empirical differential-privacy lower bounds.

  8. Advancing the State-of-the-Art in Empirical Privacy Auditing

    cs.LG 2026-06 unverdicted novelty 6.0

    Proposes high-temperature synthetic canaries and auxiliary-model auditing to improve empirical privacy measurement for LLM fine-tuning and synthetic data generation.

  9. MAPLE: Metadata Augmented Private Language Evolution

    cs.CL 2026-02 conditional novelty 5.0

    MAPLE boosts Private Evolution's initial prompt with DP tabular metadata and donated in-context examples, improving synthetic-text utility, convergence, and API cost on specialized corpora.

Reference graph

Works this paper leans on

276 extracted references · 47 linked inside Pith · cited by 8 Pith papers

  1. [1]

    Azure ai language personally identifiable information (pii) detection

    (2025). Azure ai language personally identifiable information (pii) detection

    2025

  2. [2]

    Google cloud sensitive data protection

    (2025). Google cloud sensitive data protection

    2025

  3. [3]

    Z., Teo, S

    Abacha, F. Z., Teo, S. G., Cordeiro, L. C., and Mustafa, M. A. (2024). Synthetic data aided federated learning using foundation models. In International Workshop on Trustworthy Federated Learning , pages 106--118. Springer

    2024

  4. [4]

    Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G. S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Levenberg, J., Man\' e , D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., T...

    2015

  5. [5]

    B., Mironov, I., Talwar, K., and Zhang, L

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. (2016). Deep learning with differential privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

    2016

  6. [6]

    Abay, N., Zhou, Y., Kantarcioglu, M., Thuraisingham, B., and Sweeney, L. (2018). Privacy preserving synthetic data release using deep learning. pages 510--526

    2018

  7. [7]

    Abowd, J., Ashmead, R., Simson, G., Kifer, D., Leclerc, P., Machanavajjhala, A., and Sexton, W. (2019). Census topdown: Differentially private data, incremental schemas, and consistency with public knowledge. US Census Bureau , pages 1--21

    2019

  8. [8]

    Abowd, J. M., Ashmead, R., Cumings-Menon, R., Garfinkel, S., Heineck, M., Heiss, C., Johns, R., Kifer, D., Leclerc, P., Machanavajjhala, A., Moran, B., Sexton, W., Spence, M., and Zhuravlev, P. (2022). The 2020 census disclosure avoidance system topdown algorithm

    2022

  9. [9]

    Acs, G., Melis, L., Castelluccia, C., and Cristofaro, E. D. (2018). Differentially private mixture of generative neural networks

    2018

  10. [10]

    A., and Yekhanin, S

    Afonja, G., Sim, R., Lin, Z., Inan, H. A., and Yekhanin, S. (Accessed 2025a). The crossroads of innovation and privacy: Private synthetic data for generative ai. https://www.microsoft.com/en-us/research/blog/the-crossroads-of-innovation-and-privacy-private-synthetic-data-for-generative-ai/

  11. [11]

    Afonja, T., Wang, H.-P., Kerkouche, R., and Fritz, M. (2025b). Dp-2stage: Adapting language models as differentially private tabular data generators

  12. [12]

    M., van Breugel, B., Saveliev, E., and van der Schaar, M

    Alaa, A. M., van Breugel, B., Saveliev, E., and van der Schaar, M. (2022). How faithful is your synthetic data? sample-level metrics for evaluating and auditing generative models

    2022

  13. [13]

    Amin, K., Avestimehr, S., Babakniya, S., Bie, A., Kong, W., Ponomareva, N., and Syed, U. (2025). Clustering and median aggregation improve differentially private inference. CoRR

    2025

  14. [14]

    Amin, K., Bie, A., Kong, W., Kurakin, A., Ponomareva, N., Syed, U., Terzis, A., and Vassilvitskii, S. (2024). Private prediction for large-scale synthetic text generation. In Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, Florida, USA, November 12-16, 2024 , pages 7244--7262. Association for Computational Linguistics

    2024

  15. [15]

    Amin, K., Kulesza, A., Munoz, A., and Vassilvtiskii, S. (2019). Bounding user contributions: A bias-variance trade-off in differential privacy. In Chaudhuri, K. and Salakhutdinov, R., editors, Proceedings of the 36th International Conference on Machine Learning , volume 97 of Proceedings of Machine Learning Research , pages 263--271. PMLR

    2019

  16. [16]

    Annamalai, M. S. M. S., Balle, B., Hayes, J., and Cristofaro, E. D. (2025). To shuffle or not to shuffle: Auditing dp-sgd with shuffling

    2025

  17. [17]

    B., Ramage, D., Ramaswamy, S., Kairouz, P., Chen, M., Mathews, R., and y Arcas, B

    Augenstein, S., McMahan, H. B., Ramage, D., Ramaswamy, S., Kairouz, P., Chen, M., Mathews, R., and y Arcas, B. A. (2020). Generative models for effective ML on private, decentralized datasets. In International Conference on Learning Representations

    2020

  18. [18]

    Aydore, S., Brown, W., Kearns, M., Kenthapadi, K., Melis, L., Roth, A., and Siva, A. A. (2021). Differentially private query release through adaptive projection. In Meila, M. and Zhang, T., editors, Proceedings of the 38th International Conference on Machine Learning , volume 139 of Proceedings of Machine Learning Research , pages 457--467. PMLR

    2021

  19. [19]

    Bagdasaryan, E., Poursaeed, O., and Shmatikov, V. (2019). Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems

    2019

  20. [20]

    Balle, B., Barthe, G., and Gaboardi, M. (2018). Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advances in neural information processing systems , 31

    2018

  21. [21]

    Balle, B., Berrada, L., Charles, Z., Choquette-Choo, C. A., De, S., Doroshenko, V., Dvijotham, D., Galen, A., Ganesh, A., Ghalebikesabi, S., Hayes, J., Kairouz, P., McKenna, R., McMahan, B., Pappu, A., Ponomareva, N., Pravilov, M., Rush, K., Smith, S. L., and Stanforth, R. (2025). JAX - P rivacy: Algorithms for privacy-preserving machine learning in jax

    2025

  22. [22]

    Barak, B., Chaudhuri, K., Dwork, C., Kale, S., McSherry, F., and Talwar, K. (2007). Privacy, accuracy, and consistency too: a holistic solution to contingency table release. In PODS , pages 273--282

    2007

  23. [23]

    and Kohavi, R

    Becker, B. and Kohavi, R. (1996). Adult . UCI Machine Learning Repository. DOI : https://doi.org/10.24432/C5XW20

    doi:10.24432/c5xw20 1996

  24. [24]

    Bie, A., Kamath, G., and Zhang, G. (2023). Private GAN s, revisited. Transactions on Machine Learning Research . Survey Certification

    2023

  25. [25]

    Blum, A., Ligett, K., and Roth, A. (2013). A learning theory approach to noninteractive database privacy. J. ACM , 60(2):12:1--12:25

    2013

  26. [26]

    Boedihardjo, M., Strohmer, T., and Vershynin, R. (2024). Private measures, random walks, and synthetic data. Probability theory and related fields , pages 1--43

    2024

  27. [27]

    A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M

    Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosselut, A., Brunskill, E., et al. (2021). On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258

    Pith/arXiv arXiv 2021

  28. [28]

    Bommasani, R., Wu, S., and Schofield, X. (2019). Towards private synthetic text generation. In NeurIPS 2019 Machine Learning with Guarantees Workshop

    2019

  29. [29]

    Bonawitz, K., Kairouz, P., Mcmahan, B., and Ramage, D. (2022). Federated learning and privacy. Communications of the ACM , 65(4):90--97

    2022

  30. [30]

    Borisov, V., Seßler, K., Leemann, T., Pawelczyk, M., and Kasneci, G. (2023). Language models are realistic tabular data generators

    2023

  31. [31]

    A., and Choquette-Choo, C

    Borkar, J., Jagielski, M., Lee, K., Mireshghallah, N., Smith, D. A., and Choquette-Choo, C. A. (2025). Privacy ripple effects from adding or removing personal information in language model training. arXiv preprint arXiv:2502.15680

    Pith/arXiv arXiv 2025

  32. [32]

    Bousquet, O., Livni, R., and Moran, S. (2020). Synthetic data generators - sequential and private. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H., editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual

    2020

  33. [33]

    W., Chawla, N

    Bowyer, K. W., Chawla, N. V., Hall, L. O., and Kegelmeyer, W. P. (2011). SMOTE: synthetic minority over-sampling technique. CoRR , abs/1106.1813

    Pith/arXiv arXiv 2011

  34. [34]

    Brown, H., Lee, K., Mireshghallah, F., Shokri, R., and Tramèr, F. (2022). What does it mean for a language model to preserve privacy?

    2022

  35. [35]

    and Steinke, T

    Bun, M. and Steinke, T. (2016). Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of cryptography conference , pages 635--658. Springer

    2016

  36. [36]

    Cai, K., Lei, X., Wei, J., and Xiao, X. (2021a). Data synthesis via differentially private markov random fields. Proceedings of the VLDB Endowment , 14(11):2190--2202

  37. [37]

    Cai, K., Xiao, X., and Cormode, G. (2023). Privlava: synthesizing relational data with foreign keys under differential privacy. Proceedings of the ACM on Management of Data , 1(2):1--25

    2023

  38. [38]

    Cai, Z., Xiong, Z., Xu, H., Wang, P., Li, W., and Pan, Y. (2021b). Generative adversarial networks: A survey toward private and secure applications. ACM Computing Surveys (CSUR) , 54(6):1--38

  39. [39]

    Cao, T., Bie, A., Vahdat, A., Fidler, S., and Kreis, K. (2021). Don’t generate me: Training differentially private generative models with sinkhorn divergence. Advances in Neural Information Processing Systems , 34:12480--12492

    2021

  40. [40]

    Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramer, F. (2022). Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP) , pages 1897--1914. IEEE

    2022

  41. [41]

    Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramer, F., Balle, B., Ippolito, D., and Wallace, E. (2023). Extracting training data from diffusion models. In 32nd USENIX security symposium (USENIX Security 23) , pages 5253--5270

    2023

  42. [42]

    Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., Oprea, A., and Raffel, C. (2021). Extracting training data from large language models

    2021

  43. [43]

    Carranza, A., Farahani, R., Ponomareva, N., Kurakin, A., Jagielski, M., and Nasr, M. (2024). Synthetic query generation for privacy-preserving deep retrieval systems using differentially private language models. In Duh, K., Gomez, H., and Bethard, S., editors, Proceedings of the 2024 Conference of the North American Chapter of the Association for Computat...

    2024

  44. [44]

    Castellon, R., Gopal, A., Bloniarz, B., and Rosenberg, D. (2023). Dp-tbart: A transformer-based autoregressive model for differentially private tabular data generation

    2023

  45. [45]

    A., and Nasr, M

    Chadha, K., Jagielski, M., Papernot, N., Choquette - Choo, C. A., and Nasr, M. (2024). Auditing private prediction. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024 . OpenReview.net

    2024

  46. [46]

    B., Mitchell, N., Pillutla, K., and Rush, K

    Charles, Z., Ganesh, A., McKenna, R., McMahan, H. B., Mitchell, N., Pillutla, K., and Rush, K. (2024). Fine-tuning large language models with user-level differential privacy

    2024

  47. [47]

    S., Chuah, C., and Ozonoff, S

    Chen, D., Cheung, S. S., Chuah, C., and Ozonoff, S. (2022a). Differentially private generative adversarial networks with model inversion. CoRR , abs/2201.03139

    Pith/arXiv arXiv

  48. [48]

    Chen, D., Orekondy, T., and Fritz, M. (2020a). Gs-wgan: A gradient-sanitized approach for learning differentially private generators. Advances in Neural Information Processing Systems , 33:12673--12684

  49. [49]

    Chen, J.-W., Yu, C.-M., Kao, C.-C., Pang, T.-W., and Lu, C.-S. (2022b). Dpgen: Differentially private generative energy-guided network for natural image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8387--8396

  50. [50]

    Chen, K., Li, X., Gong, C., McKenna, R., and Wang, T. (2025). Benchmarking differentially private tabular data synthesis

    2025

  51. [51]

    Chen, M., Radford, A., Child, R., Wu, J., Jun, H., Dhariwal, P., Luan, D., and Sutskever, I. (2020b). Generative pretraining from pixels

  52. [52]

    J., Liu, L., Xu, Z., Fahrezi, A., and Joshi, G

    Cho, Y. J., Liu, L., Xu, Z., Fahrezi, A., and Joshi, G. (2024). Heterogeneous lora for federated fine-tuning of on-device foundation models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages 12903--12913

    2024

  53. [53]

    Chua, L., Ghazi, B., Kamath, P., Kumar, R., Manurangsi, P., Sinha, A., and Zhang, C. (2024a). How private are dp-sgd implementations?

  54. [54]

    Chua, L., Ghazi, B., Kamath, P., Kumar, R., Manurangsi, P., Sinha, A., and Zhang, C. (2024b). Scalable dp-sgd: Shuffling vs. poisson subsampling. Advances in Neural Information Processing Systems , 37:70026--70047

  55. [55]

    Chua, L., Ghazi, B., Kamath, P., Kumar, R., Manurangsi, P., Sinha, A., and Zhang, C. (2024c). Scalable dp-sgd: Shuffling vs. poisson subsampling

  56. [56]

    W., Hou, L., Longpre, S., Zoph, B., Tay, Y., Fedus, W., Li, Y., Wang, X., Dehghani, M., Brahma, S., Webson, A., Gu, S

    Chung, H. W., Hou, L., Longpre, S., Zoph, B., Tay, Y., Fedus, W., Li, Y., Wang, X., Dehghani, M., Brahma, S., Webson, A., Gu, S. S., Dai, Z., Suzgun, M., Chen, X., Chowdhery, A., Castro-Ros, A., Pellat, M., Robinson, K., Valter, D., Narang, S., Mishra, G., Yu, A., Zhao, V., Huang, Y., Dai, A., Yu, H., Petrov, S., Chi, E. H., Dean, J., Devlin, J., Roberts,...

    2022

  57. [57]

    Cohen, E., Lyu, X., Nelson, J., Sarl \' o s, T., and Stemmer, U. (2023). Hot PATE: private aggregation of distributions for diverse task. CoRR , abs/2312.02132

    arXiv 2023

  58. [58]

    Cohen-Addad, V., Epasto, A., Lee, J., and Zadimoghaddam, M. (2025). Scalable contribution bounding to achieve privacy. arXiv preprint arXiv:2507.23432

    Pith/arXiv arXiv 2025

  59. [59]

    Cormode, G., Procopiuc, C., Srivastava, D., Shen, E., and Yu, T. (2012). Differentially private spatial decompositions. In ICDE , pages 20--31

    2012

  60. [60]

    and Kur, G

    Dagan, Y. and Kur, G. (2022). A bounded-noise mechanism for differential privacy. In COLT , pages 625--661

    2022

  61. [61]

    B., Ramage, D., and Xu, Z

    Daly, K., Eichner, H., Kairouz, P., McMahan, H. B., Ramage, D., and Xu, Z. (2024). Federated learning in practice: reflections and projections. In 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) , pages 148--156. IEEE

    2024

  62. [62]

    and Ghemawat, S

    Dean, J. and Ghemawat, S. (2008). Mapreduce: simplified data processing on large clusters. Communications of the ACM , 51(1):107--113

    2008

  63. [63]

    Dockhorn, T., Cao, T., Vahdat, A., and Kreis, K. (2023). Differentially private diffusion models

    2023

  64. [64]

    Dong, J., Roth, A., and Su, W. J. (2022). Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology) , 84(1):3--37

    2022

  65. [65]

    Donhauser, K., Lokna, J., Sanyal, A., Boedihardjo, M., H \" o nig, R., and Yang, F. (2023). Sample-efficient private data release for lipschitz functions under sparsity assumptions. CoRR , abs/2302.09680

    Pith/arXiv arXiv 2023

  66. [66]

    Google's differential privacy libraries

    DP Team (2022). Google's differential privacy libraries. https://github.com/google/differential-privacy

    2022

  67. [67]

    Duan, H., Dziedzic, A., Papernot, N., and Boenisch, F. (2023). Flocks of stochastic parrots: Differentially private prompt learning for large language models. Advances in Neural Information Processing Systems , 36:76852--76871

    2023

  68. [68]

    and Rogers, R

    Durfee, D. and Rogers, R. M. (2019). Practical differentially private top-k selection with pay-what-you-get composition. In Advances in Neural Information Processing Systems , volume 32. Curran Associates, Inc

    2019

  69. [69]

    and Feldman, V

    Dwork, C. and Feldman, V. (2018). Privacy-preserving prediction. In Conference On Learning Theory , pages 1693--1702. PMLR

    2018

  70. [70]

    N., and Vadhan, S

    Dwork, C., Naor, M., Reingold, O., Rothblum, G. N., and Vadhan, S. (2009). On the complexity of differentially private data release: efficient algorithms and hardness results. In Proceedings of the forty-first annual ACM symposium on Theory of computing , pages 381--390

    2009

  71. [71]

    and Roth, A

    Dwork, C. and Roth, A. (2014). The algorithmic foundations of differential privacy

    2014

  72. [72]

    E., Akintoye, S., Knight, W., Karakasidis, A., Mikulan, E., Ochang, P., Ogoh, G., Oostenveld, R., Pigorini, A., Stahl, B

    Eke, D., Aasebø, I. E., Akintoye, S., Knight, W., Karakasidis, A., Mikulan, E., Ochang, P., Ogoh, G., Oostenveld, R., Pigorini, A., Stahl, B. C., White, T., and Zehl, L. (2021). Pseudonymisation of neuroimages and data protection: Increasing access to data while retaining scientific utility. Neuroimage: Reports , 1(4):100053

    2021

  73. [73]

    and Salem, A

    Elmahdy, A. and Salem, A. (2024). Deconstructing classifiers: Towards a data reconstruction attack against text classification models. In Habernal, I., Ghanavati, S., Ravichander, A., Jain, V., Thaine, P., Igamberdiev, T., Mireshghallah, N., and Feyisetan, O., editors, Proceedings of the Fifth Workshop on Privacy in Natural Language Processing , pages 143...

    2024

  74. [74]

    M., Mirrokni, V., Vassilvitskii, S., and Zhong, P

    Epasto, A., Mao, J., Medina, A. M., Mirrokni, V., Vassilvitskii, S., and Zhong, P. (2023). Differentially private continual releases of streaming frequency moment estimations. In ITCS , pages 48:1--48:24

    2023

  75. [75]

    Fan, A., Lewis, M., and Dauphin, Y. (2018). Hierarchical neural story generation. In Gurevych, I. and Miyao, Y., editors, Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages 889--898, Melbourne, Australia. Association for Computational Linguistics

    2018

  76. [76]

    Feldman, V., McMillan, A., Sivakumar, S., and Talwar, K. (2024). Instance-optimal private density estimation in the wasserstein distance. Advances in Neural Information Processing Systems , 37:90061--90131

    2024

  77. [77]

    Flemings, J., Gan, H., Li, H., Razaviyayn, M., and Annavaram, M. (2025). Differentially private in-context learning via sampling few-shot mixed with zero-shot outputs

    2025

  78. [78]

    Flemings, J., Razaviyayn, M., and Annavaram, M. (2024a). Adaptively private next-token prediction of large language models. arXiv preprint arXiv:2410.02016

    Pith/arXiv arXiv

  79. [79]

    Flemings, J., Razaviyayn, M., and Annavaram, M. (2024b). Differentially private next-token prediction of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages 4390--4404, Mexico City, Mexico. Association for Co...

    2024

  80. [80]

    Fredrikson, M., Jha, S., and Ristenpart, T. (2015). Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security , pages 1322--1333

    2015

Showing first 80 references.