{"id":"fea518b3-5670-416d-8942-9556f52a946d","arxiv_id":"2412.09842","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A stage-wise diffusion training method that substitutes synthetic images in coarse and cleaning steps to cut the privacy noise in DP image generation.","lead":"DP-SynGen proposes to replace the early 'coarse' and late 'cleaning' stages of a differentially private diffusion model with programmatically generated synthetic data, leaving the 'context' stage to be trained on private data. The reported quality gains are small and inconsistent, and the theoretical argument for replacing the cleaning stage does not go through.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theoretical justification for replacing private data with synthetic data at cleaning and coarse stages bounds the wrong quantity; the input distribution shift remains large, so the central claim is unsupported.","rationale":"The paper's central claim is that training the cleaning and coarse stages on programmatically generated synthetic data reduces the privacy budget without degrading generation quality. Theorems 1 and 2 are the only theoretical evidence for this equivalence. Both theorems compare properties of the forward noising process (X_t vs Y_t), but the diffusion model learns the reverse conditional distribution, which depends on the joint distribution of (X_0, X_t), not just on the marginal of X_t. In the cleaning stage, alpha_bar_t close to 1 makes the input X_t nearly equal to X_0 plus small noise, so the input difference between private and synthetic data is dominated by X_0 - Y_0. Theorem 2 explicitly discards this term by subtracting X_0 and Y_0. Thus the theorem cannot justify replacing the private data. The empirical results are also mixed: in Table I, DP-SynGen Coarse and Cleaning often have worse FID than DPDM (e.g., MNIST epsilon=10: 12.3 and 13.7 vs 11.5; Fashion MNIST epsilon=0.5: 83.3 and 83.4 vs 83.5). The only substantial improvements are at very low epsilon with high FID values, where stochasticity dominates. The proposed test, computing the divergence of optimal denoising targets at alpha_bar close to 1, would directly quantify whether the theoretical premise holds. Given that the central claim lacks valid theoretical support and the experimental evidence is inconsistent, the reader's REJECT verdict is appropriate; my analysis does not change it.","tokens_in":15690,"tokens_out":7689,"duration_ms":80572,"concrete_test":"Compute E[||E[Y0|Y_t] - E[X0|X_t]||^2] at a cleaning-stage noise level where alpha_bar_t is close to 1, for X0 drawn from the private data distribution (e.g., MNIST) and Y0 from the synthetic distribution (e.g., Dead-leaves), using an oracle or well-trained denoiser. If this quantity is on the same order as Var(X0), the synthetic-trained denoiser is not equivalent to the private-trained one, directly refuting the inference drawn from Theorem 2.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim, that cleaning and coarse stages can be trained without private data, rests on Theorems 1 and 2 in Section III-A. Theorem 2 bounds P(||X_t - X_0 - (Y_t - Y_0)|| > nu), i.e., the difference of the added noises, but the denoiser input is X_t itself. Since X_t - Y_t = sqrt(alpha_bar_t)(X_0 - Y_0) + sqrt(1-alpha_bar_t)(eta_1 - eta_2), the input distributions differ by roughly X_0 - Y_0 when alpha_bar_t is approximately 1; this term is absent from the theorem's bound. A model trained on synthetic data at cleaning steps therefore sees a shifted input distribution and will produce synthetic details, as the paper's own Figure 3 caption concedes ('some characteristics of the synthetic data were reflected'). Theorem 1 is similarly insufficient: even if the noised states X_t and Y_t are close at large t, the training targets X_0 and Y_0 remain different, so the coarse stage, which sets global structure, will reflect the synthetic distribution. The proof of Theorem 1 is also mathematically invalid, since independent noise sequences converge in distribution but not to a common random variable in probability. Thus the theoretical support for the paper's main claim does not hold.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DP-SynGen, a framework for differentially private diffusion training that uses programmatically generated synthetic images in the coarse-noise and low-noise cleaning stages, reserving the context stage for DP-SGD-trained private data. The authors present two theorems (Theorems 1 and 2) intended to show that these stages are insensitive to the training-data distribution, together with stage-replacement toy experiments and FID/CAS experiments on MNIST and Fashion MNIST for several privacy budgets.","tokens_in":15984,"tokens_out":9999,"duration_ms":92772,"significance":"The idea of reducing the privacy budget by replacing some diffusion stages with non-private synthetic data is interesting and, if valid, would be practically useful. The paper includes helpful toy illustrations and states that code will be released. However, the theoretical core is not sound: Theorem 1 is false as stated for independent diffusion processes, and Theorem 2 bounds the wrong quantity for the cleaning stage. The experimental improvements over DPDM are modest and not consistent across settings, so the central claim is not established.","major_comments":[{"comment":"Theorem 1 claims that for any two data distributions X0 and Y0, P(||X_n - Y_n|| > nu) <= gamma for all sufficiently large n. This is not implied by convergence of X_n and Y_n in distribution to the standard normal. For two independent forward processes, X_n - Y_n converges in distribution to the difference of two independent normal vectors, so the probability in (5) tends to a positive constant rather than to zero. The proof uses 'Xn -> N and Yn -> N in probabilistically', which assumes a common limit random variable N that is not provided by the diffusion process in Equation (1). Thus Theorem 1 does not support the claim that the coarse stage can be trained on synthetic data.","section":"Section III-A / Appendix, Theorem 1"},{"comment":"Theorem 2 bounds P(||X_t - X_0 - (Y_t - Y_0)|| > nu), i.e., the difference of the noise increments. The denoising model, however, receives X_t as input. The input gap is X_t - Y_t = sqrt(alpha_bar_t)(X_0 - Y_0) + sqrt(1-alpha_bar_t)(Z_1 - Z_2). In the cleaning stage alpha_bar_t is close to 1, so the first term is approximately X_0 - Y_0 and can be arbitrarily large; the theorem does not control this term. The observation in the main text (after Figure 3) that 'some characteristics of the synthetic data were reflected' corroborates that the cleaning model is not insensitive to the training distribution. Hence Theorem 2 does not justify training the cleaning stage on synthetic data.","section":"Section III-A / Appendix, Theorem 2"},{"comment":"The sentence 'DP-SynGen FineTune generally outperforms DPDM EDM in both FID and CAS' is not supported by the reported numbers. For MNIST at epsilon=10, DPDM EDM obtains conditional FID 11.5 versus DP-SynGen FineTune 11.9; for Fashion MNIST at epsilon=0.5, DPDM EDM matches or exceeds FineTune on most accuracy columns; and at epsilon=0.2 almost all differences are within a few points. With the theoretical justification absent, this mixed evidence does not substantiate the abstract's claim that DP-SynGen improves generation quality by mitigating privacy-induced noise.","section":"Section IV-B / Table I"}],"minor_comments":[{"comment":"The pseudocode contains an 'end' statement before the 'else' branch, which makes the conditional structure ambiguous; please reformat so that each 'if' has exactly one matching 'end'.","section":"Algorithm 1 (Appendix)"},{"comment":"In the Chernoff bound line, the first expression with exponent -nu^2/(8(1-alpha_bar_t)) - d/2 - (d/2) ln(nu^2/(8d(1-alpha_bar_t))) is not algebraically equal to the following line -nu^2/(16(1-alpha_bar_t)) + d/2 - (d/2) ln(nu^2/(8d(1-alpha_bar_t))); the factor of 2 and the sign of d/2 appear inconsistent.","section":"Appendix, Proof of Theorem 2"},{"comment":"The paper uses the DDPM alpha_bar_t notation in Equation (2) and in the theorems, but the experiments use the EDM sigma-parameterization (Equation 3). The relation between alpha_bar_sigma and the truncated normal sampling in ln(sigma) is not stated, which makes it hard to verify the reported thresholds tau_1 and tau_2.","section":"Section II-A and III-B"},{"comment":"The selection of tau_1 and tau_2 is described via an 'elbow point' without a formal definition or sensitivity analysis; because these thresholds directly determine which stages use synthetic data, a quantitative criterion and robustness check would strengthen the presentation.","section":"Section III-C"}],"recommendation":"reject","confidential_remarks":"The reader's assessment is accurate: the theoretical results do not support the main claim, and the empirical gains are too small and inconsistent to salvage it. A fundamentally different argument or substantially stronger experiments would be needed; I recommend rejection. I also note that the abstract's phrase 'theoretically and empirically verified' overstates what is demonstrated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: the idea of splitting DP diffusion training into stages and using programmatic synthetic data for coarse and cleaning steps is genuinely novel, but the theoretical justification in Section III-A doesn't hold up. Theorem 1 is false as stated: independent forward processes converge in distribution to the same Gaussian, not to a common random variable, so their difference doesn't vanish in probability. The proof's use of convergence in probability is invalid. Theorem 2 bounds ||Xt - X0 - (Yt - Y0)||, i.e. the difference of the added noise terms, but the denoiser's input is Xt itself, and Xt - Yt = sqrt(alpha)(X0 - Y0) + noise difference. When alpha is close to 1, the shift term is large, so the theorem doesn't justify using a synthetic-trained model on private inputs. The paper's own Figure 3 caption concedes that synthetic characteristics leak through.\n\nWhat the paper does well: it identifies the context stage as crucial, which aligns with prior perception-prioritized training, and the toy examples are a clean way to show stage-wise behavior. The framework is modular and easy to understand. That's real value.\n\nWhere it falls short: the experiments are inconsistent with the abstract's claim. At epsilon=0.5, DP-SynGen Coarse has FID 89.6 vs DPDM's 84.6; at epsilon=10 it's 12.3 vs 11.5. The favorable results cluster at epsilon=0.2 with high noise multiplicity on MNIST. The threshold selection (tau1, tau2) is done by inspecting SNR plots on the same datasets, which is post-hoc tuning. None of this is fatal on its own, but the central claim is not empirically established either.\n\nBottom line: a plausible engineering trick with a broken theoretical wrapper. The right move is to send it to peer review — a good referee will demand a correct theorem or a reframing as an empirical method — but the paper as written overstates what is verified. I'd not cite the theorems, but I might point to the stage-splitting idea if it gets cleaned up.","headline":"Clever stage-splitting idea, but the theory behind it bounds the wrong quantity and the experiments don't support the abstract's claims.","tokens_in":16469,"tokens_out":3506,"would_cite":false,"duration_ms":38513,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Training the coarse and cleaning stages of a private diffusion model on synthetic images leaves only the context stage to spend the privacy budget; this scheme (DP-SynGen) improves generation quality, especially at small ε.","keywords":["differential privacy","diffusion models","DP-SynGen","programmatically generated synthetic data","image generation","noise multiplicity","denoising stages","SNR thresholding"],"falsifier":"Train DP-SynGen Cleaning with the cleaning threshold moved to a higher noise level where $\\bar{\\alpha}_\\tau \\approx 0.95$ instead of $0.998$ on MNIST; Theorem 2's data-difference term grows like $(1 - \\sqrt{\\bar{\\alpha}_\\tau})E\\|X_0 - Y_0\\|$, roughly twenty-five times larger, so if the bound is what makes the stage replaceable, FID should visibly degrade toward the DPDM-EDM baseline. A direct companion measurement: compute the empirical distribution of $\\|X_t - Y_t\\|$ between noised MNIST and noised Dead Leaves images at the chosen thresholds and compare it with $\\sqrt{1-\\bar{\\alpha}_t}$; if the full-input gap is not small relative to that noise scale, the cleaning-stage replacement is not supported by the paper's own mechanism.","tokens_in":15495,"feed_emoji":"🔒","tokens_out":16700,"duration_ms":148452,"temperature":0.7,"pith_summary":"Diffusion models trained under differential privacy pay a noise penalty at every denoising step, but this paper argues that most of that penalty is wasted. It claims that the forward diffusion process splits into three stages — coarse (high noise, where global structure forms), context (where content is produced), and cleaning (where residual noise is removed) — and that only the middle context stage actually needs private data. The supporting argument is two probabilistic bounds: at high noise levels any two data distributions become statistically close under the forward process (Theorem 1), and at low noise levels, where $\\bar{\\alpha}_t \\approx 1$, the noise component a denoiser has to remove is nearly independent of which distribution the image came from (Theorem 2). Building on these bounds, the paper's DP-SynGen trains the coarse and cleaning stages on programmatically generated synthetic images and spends the private budget only on the context stage, which reduces per-step privacy noise. The experiments report better FID and classifier accuracy than the DP diffusion baseline on MNIST, Fashion MNIST, and CelebA, with the clearest gains at small privacy budgets ($\\varepsilon = 0.2$–$1$).","feed_headline":"Synthetic images can cut the private data needs of diffusion training","feed_subtitle":"Spends the privacy budget only on the context stage of denoising, improving FID at low epsilon.","key_machinery":"The load-bearing objects are two probabilistic bounds set against the three-stage (coarse, context, cleaning) decomposition of the diffusion process, plus the truncated-noise sampling that turns them into a training schedule. Theorem 1 is a forgetting bound: the forward process converges to a normal distribution, so for large $n$ the noised states of any two sources differ by at most $\\nu$ with probability at least $1-\\gamma$; this licenses synthetic data in the coarse (low-SNR) stage. Theorem 2 is a cleaning-stage bound: when $\\bar{\\alpha}_t \\approx 1$, the added-noise pieces $X_t - X_0$ and $Y_t - Y_0$ are close in probability, with $\\gamma$ controlled by $1 - \\sqrt{\\bar{\\alpha}_t}$ times $E\\|X_0 - Y_0\\|$ (Markov) plus a chi-squared tail (Chernoff); this licenses synthetic data in the cleaning stage. The mechanism connecting the bounds to a practical algorithm is stage-conditioned training: synthetic epochs sample $\\ln\\sigma$ from a truncated normal above $\\tau_1$ (coarse) or below $\\tau_1$ (cleaning), and private DP epochs sample the complementary range governed by $\\tau_2$, with $\\tau_2 \\ge \\tau_1$ allowing overlap between the two phases. All thresholds come from the schedule alone — the SNR elbow marks the context/coarse boundary and $\\bar{\\alpha}_\\sigma \\approx 1$ marks the cleaning boundary — so no privacy budget is spent choosing them.","core_discovery":"The paper's central claim is that private data are indispensable in only one slice of the denoising schedule. Splitting the diffusion process into coarse, context, and cleaning stages, it shows that at very high noise the forward process has effectively forgotten its source: for any two distributions $X_0$ and $Y_0$, one can find a time $N$ such that for all $n \\ge N$, $P(\\|X_n - Y_n\\| > \\nu) \\le \\gamma$, so the coarse stage can be learned from synthetic images (Theorem 1). At the opposite end, when $\\bar{\\alpha}_t \\approx 1$, the added-noise difference $X_t - X_0 - (Y_t - Y_0)$ is small in probability, with the bound shrinking through $1 - \\sqrt{\\bar{\\alpha}_t}$ and a chi-squared tail (Theorem 2), so the cleaning stage's denoising target is also nearly distribution-free. DP-SynGen turns these bounds into a training scheme: synthetic-data training on the coarse or cleaning noise range first, then DP training only on the remaining range, using truncated $\\ln\\sigma$ sampling from the EDM schedule with thresholds chosen from the SNR elbow and the $\\bar{\\alpha}_\\sigma \\approx 1$ condition — both computable without touching private data. The paper reports that the scheme reduces private training iterations from 300 to 250, lowers per-step DP noise, and yields better FID and CAS than the DPDM-EDM baseline, with the advantage growing as $\\varepsilon$ and the noise multiplicity shrink.","pith_inferences":["Editorial extension: the same coarse/context/cleaning split could apply to other iterative generators — flow matching, consistency models, hierarchical VAEs — whose early and late steps play analogous roles; the paper tests only diffusion.","Editorial test: the cleaning-stage margin should shrink as the synthetic–private gap widens, so the method should be re-checked with synthetic distributions far from Dead Leaves (e.g., pure Gaussian noise) at the same thresholds.","Editorial flag: the proof of Theorem 1 cites the convergence of the forward process to a normal distribution only as '[]' — a blank reference — so the derivation chain as printed contains an unsourced standard fact.","Editorial suggestion: since the paper randomly labels its synthetic images and notes they give no class guidance, pseudo-labeling the synthetic corpus with a differentially private classifier is a direct, testable route to improving conditional DP-SynGen."],"forward_implications":["The privacy budget concentrates on the context stage: private training epochs drop from 300 to 250, per-step DP noise falls, and FID and CAS improve over the DPDM-EDM baseline at the same $\\varepsilon$, with the largest gains at $\\varepsilon = 0.2$–$1$.","Synthetic pre-training provides a better-than-random initialization: DP-SynGen FineTune beats random initialization on FID and CAS, indicating that the coarse stage carries transferable structure.","The two stage replacements have complementary effects: coarse-stage synthetic training improves FID (pixel fidelity), while cleaning-stage synthetic training improves CAS (downstream classifier accuracy), particularly at small privacy budgets.","Threshold choice costs no privacy: $\\tau_1$ and $\\tau_2$ are read off the SNR curve and the $\\bar{\\alpha}_\\sigma \\approx 1$ condition, both determined by hyperparameters alone.","The advantage over DPDM grows as privacy noise grows: smaller $\\varepsilon$ and smaller noise multiplicity $k$ both enlarge the gap, because the synthetic-only phases inject no privacy noise."],"supporting_citations":[{"why":"Supplies the three-stage coarse/context/cleaning decomposition of the diffusion process that DP-SynGen exploits to decide where synthetic data can substitute for private data.","marker":"[9]"},{"why":"The DP diffusion baseline (DPDM with EDM) that DP-SynGen modifies; provides the noise multiplicity mechanism and the comparison results the method must beat.","marker":"[5]"},{"why":"Defines the EDM $\\sigma$-noise parameterization and SNR $=1/\\sigma^2$ used to stage the training and to compute the thresholds.","marker":"[13]"},{"why":"Gives the discrete forward process $X_t = \\sqrt{\\bar{\\alpha}_t} X_0 + \\sqrt{1-\\bar{\\alpha}_t}\\,\\eta$ that Theorem 2's cleaning-stage bound analyzes.","marker":"[11]"},{"why":"Shows DP training has an optimal number of training iterations, justifying DP-SynGen's reduction of private training epochs.","marker":"[3]"},{"why":"Shows programmatically generated synthetic data can provide better initial points in DP classification, motivating DP-SynGen FineTune.","marker":"[7]"},{"why":"SNR-based loss weighting for diffusion training; its SNR importance curve guides the coarse-stage elbow threshold choice.","marker":"[14]"},{"why":"The Dead-leaves random-process model is the synthetic data source used in the main cleaning-stage experiments.","marker":"[29]"},{"why":"Defines $(\\varepsilon,\\delta)$-differential privacy, the guarantee that the paper's budget-reduction argument is measured against.","marker":"[1]"}],"fun_headline_variants":["Only one stage needs private data in diffusion training","Synthetic data replaces private data in most of diffusion","DP-SynGen: synthetic data covers two diffusion stages","Diffusion forgets source, so synthetic data suffices for two stages","Synthetic data can cut privacy budget in diffusion training"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The theorems bound only the added-noise pieces of the noised images; they do not bound the full input gap $X_t - Y_t = \\sqrt{\\bar{\\alpha}_t}(X_0 - Y_0) + \\sqrt{1-\\bar{\\alpha}_t}(Z_1 - Z_2)$, so the claim that a model trained on synthetic images will denoise private images correctly rests on the unproven assumption that the remaining $\\sqrt{\\bar{\\alpha}_t}(X_0 - Y_0)$ shift in the denoiser's input is harmless.","fun_headline_variants_meta":{"raw":{"variants":["Only one stage needs private data in diffusion training","Synthetic data replaces private data in most of diffusion","DP-SynGen: synthetic data covers two diffusion stages","Diffusion forgets source, so synthetic data suffices for two stages","Synthetic data can cut privacy budget in diffusion training"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00115,"raw_usage":{"total_tokens":4809,"prompt_tokens":1030,"completion_tokens":3779,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":646,"completion_tokens_details":{"reasoning_tokens":3699}},"tokens_in":646,"tokens_out":3779,"duration_ms":24443,"temperature":1.0,"reasoning_tokens":3699,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T16:39:33.153520+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train DP-SynGen Cleaning with the cleaning threshold moved to a higher noise level where $\\bar{\\alpha}_\\tau \\approx 0.95$ instead of $0.998$ on MNIST; Theorem 2's data-difference term grows like $(1 - \\sqrt{\\bar{\\alpha}_\\tau})E\\|X_0 - Y_0\\|$, roughly twenty-five times larger, so if the bound is what makes the stage replaceable, FID should visibly degrade toward the DPDM-EDM baseline. A direct companion measurement: compute the empirical distribution of $\\|X_t - Y_t\\|$ between noised MNIST and noised Dead Leaves images at the chosen thresholds and compare it with $\\sqrt{1-\\bar{\\alpha}_t}$; if the full-input gap is not small relative to that noise scale, the cleaning-stage replacement is not supported by the paper's own mechanism.","supporting_citations":[{"cited_title":"Perception prioritized training of diffusion models,","cited_arxiv_id":null,"evidence_quote":"Supplies the three-stage coarse/context/cleaning decomposition of the diffusion process that DP-SynGen exploits to decide where synthetic data can substitute for private data."},{"cited_title":"Dif- ferentially Private Diffusion Models,","cited_arxiv_id":null,"evidence_quote":"The DP diffusion baseline (DPDM with EDM) that DP-SynGen modifies; provides the noise multiplicity mechanism and the comparison results the method must beat."},{"cited_title":"Elucidating the design space of diffusion-based generative mod- els,","cited_arxiv_id":null,"evidence_quote":"Defines the EDM $\\sigma$-noise parameterization and SNR $=1/\\sigma^2$ used to stage the training and to compute the thresholds."},{"cited_title":"Differ- entially private image classification by learning priors from random processes,","cited_arxiv_id":null,"evidence_quote":"Shows programmatically generated synthetic data can provide better initial points in DP classification, motivating DP-SynGen FineTune."},{"cited_title":"Efficient diffusion training via min-snr weighting strategy,","cited_arxiv_id":null,"evidence_quote":"SNR-based loss weighting for diffusion training; its SNR importance curve guides the coarse-stage elbow threshold choice."},{"cited_title":"Dead leaves models: from space tessellation to random functions,","cited_arxiv_id":null,"evidence_quote":"The Dead-leaves random-process model is the synthetic data source used in the main cleaning-stage experiments."},{"cited_title":"Differential privacy,","cited_arxiv_id":null,"evidence_quote":"Defines $(\\varepsilon,\\delta)$-differential privacy, the guarantee that the paper's budget-reduction argument is measured against."}],"review_version":1}