Pith. sign in

REVIEW 4 major objections 4 minor 2 cited by

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

T0 review · 4 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Private Evolution can run on ordinary simulators with the same privacy guarantee and better utility on off-domain data.

desk verdict Useful, clear extension of Private Evolution to simulator backends; the data-access mode's success hinges on an unquantified locality assumption that the paper's own weak-simulator results show can fail, but the work is honest and deserves serious refereeing. read the letter →

arxiv 2502.05505 v3 pith:I4GBGESF submitted 2025-02-08 cs.LG cs.CRcs.CVstat.ML

Zinan Lin , Tadas Baltrusaitis , Wenyu Wang , Sergey Yekhanin This is my paper · ORCID
classification cs.LGcs.CRcs.CVstat.ML
keywords differentialprivacysyntheticdataPrivateEvolutionsimulatorsimagegenerationfoundationmodelsselectionnearestneighborhistogram
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that Private Evolution—a framework for generating differentially private synthetic data that only needs two black-box operations, RANDOM_API and VARIATION_API—does not require a foundation model behind those operations. The authors show that a non-neural simulator (a graphics renderer, a rule-based avatar generator, or any program that can randomize parameters and perturb them) can fill both API slots, and they call the resulting method Sim-PE. In image experiments, Sim-PE lifts downstream classification accuracy from 27.9% (PE with an ImageNet foundation model) to 89.1% on MNIST at ε=1, reduces FID by up to 80%, and replaces GPU-heavy API calls with CPU work, roughly an 80× speedup. Because the private-data interaction in PE is untouched, the differential-privacy guarantee carries over exactly. The underlying claim is that any sufficiently aligned simulator can be turned into a differentially private synthetic-data generator.

What carries the argument

The load-bearing object is the abstract pair RANDOM_API and VARIATION_API, the two operations that Private Evolution needs from its data-generation backend. The paper's move is to implement these operations with simulators instead of neural models: with code access, sample parameter vectors uniformly and perturb them (α for numerical parameters, β for the resampling probability of categorical parameters); with data access, sample uniformly from the released simulator pool and return the γ-element nearest-neighbour set of the given sample. The privacy-relevant machinery—private samples voting for their nearest neighbour in the current pool, followed by Gaussian noise and thresholding in the DP nearest-neighbour histogram—is left exactly as in PE, so the same privacy and convergence guarantees apply. The efficiency win comes from replacing GPU diffusion steps with CPU rendering, random draws, or nearest-neighbour lookups.

What would settle it

Run Sim-PE on a private dataset with a simulator whose output provably has zero overlap with the private distribution (for instance, a renderer that only produces green squares, with natural images as private data). If classification accuracy still reaches the paper's reported levels, the alignment assumption is not the operative one; if accuracy collapses, the overlap assumption is confirmed as load-bearing. On the data-access side, compute the FID of the nearest neighbours of the samples the noisy histogram rejects: if those rejected samples' neighbours are closer to the private data than the selected samples' neighbours, the locality premise fails and Sim-PE should underperform the cluster-center baseline.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the two APIs at the heart of Private Evolution—RANDOM_API, which draws a random sample, and VARIATION_API, which returns a sample similar to the given one—constitute an interface, not a property of foundation models. When the simulator's code is accessible, RANDOM_API is a uniform draw over the simulator's categorical and numerical parameters, and VARIATION_API is a local perturbation: additive noise for numerical parameters, and for categorical parameters a resample with probability β or a keep with probability 1−β. When the simulator is inaccessible and only a released dataset is available, RANDOM_API draws uniformly from that dataset and VARIATION_API returns one of the γ nearest neighbours of the input sample in that pool; the authors justify pruning far-away samples by a locality argument, supported only empirically. Across four simulators—a text renderer on MNIST, a Blender-based face renderer and a rule-based avatar generator on CelebA, and ImageNet as a public pool for CIFAR-10—Sim-PE matches or improves upon foundation-model PE on aligned domains, and mixing a weak simulator with a foundation model in the same PE run outperforms either alone. Since the privacy mechanism (the noisy nearest-neighbour histogram over private votes) is unchanged, the DP guarantee and convergence analysis transfer verbatim from PE.

Load-bearing premise

The method's utility depends on the simulator's output distribution having enough overlap with the private data; when that alignment is weak, Sim-PE falls below standard PE in the paper's own results (62.6% vs 70.5% accuracy on CelebA at ε=1 with the avatar simulator), and no formal condition or lower bound on the required overlap is given.

Editorial extensions

If this is right

  • Any simulator that can produce random samples and slight variations becomes a differentially private synthetic-data generator with the same (ε,δ) guarantee as the original PE.
  • The data-access variant works on any public dataset, not just simulator output; the paper demonstrates this with ImageNet as the pool and CIFAR-10 as the private data.
  • Simulators and foundation models can be combined inside one PE run—the paper's avatar-plus-diffusion experiment beats both backends used alone.
  • The compute cost of DP synthesis drops from thousands of GPU-seconds per API call to tens of CPU-seconds, opening the method to settings without GPU access.
  • The API view is domain-agnostic, so the authors' claimed extension includes networking and robotics simulators, where foundation models are weak or absent.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The interface view implies that any program with a well-defined parameter space—not just image renderers—can be slotted into PE; text templates, log generators, and structured-event simulators are natural next candidates, something the paper does not itself test.
  • The locality property (far samples have far neighbours) is the empirical hinge of the data-access mode; a practitioner should verify it on each new simulator pool before trusting the pruning step, since a pool where rejected samples bridge toward the private data would invert the benefit.
  • The α, β, and γ schedules are hand-designed; the ablation study in Appendix H.1 shows fixed small values sometimes beat the default schedule, so an adaptive schedule driven by the noisy histogram's mass could be a concrete improvement the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Sim-PE, an extension of the Private Evolution (PE) framework that replaces foundation-model-based random generation and variation APIs with non-neural simulators for differentially private synthetic image generation. Two access modes are considered: code access, where RANDOM_API and VARIATION_API are implemented by sampling and perturbing simulator parameters, and data-only access, where they are implemented by uniform sampling and nearest-neighbor selection from a fixed simulator-generated dataset. The authors report that on MNIST and CelebA, Sim-PE improves downstream classification accuracy over PE with foundation models by up to 3x and reduces FID by up to 80%, while being substantially more computationally efficient, and that combining simulators with foundation models yields further gains. Privacy is inherited from PE's DP_NN_HISTOGRAM mechanism, since Sim-PE only replaces the two backend APIs. The paper also reports controlled experiments on weak simulators and on alignment-degraded subsets of simulator data to characterize when Sim-PE helps.

Significance. If the claims hold, the paper's significance is genuine: it broadens PE from foundation models to an entire class of non-neural data synthesizers, which is a new capability for DP synthetic image generation and could extend to domains such as networking and robotics where simulators are already the standard tools. The main strengths are the clean API-level abstraction of PE, the open-sourced implementation, and the honest inclusion of failure cases such as the weak avatar simulator and the D4 subset in Appendix H.2. The paper also correctly identifies that the privacy argument is unchanged because private-data interaction is confined to the existing DP_NN_HISTOGRAM. However, the central empirical claims rest on single-run experiments and on an unquantified locality/alignment assumption for the data-only access mode, and the convergence analysis is transferred from PE without checking whether the new variation distributions satisfy the original assumptions. These issues do not invalidate the framework, but they need to be addressed before the 'up to 3x / up to 80%' headline claims can be accepted as robust.

major comments (4)
  1. [§3.3, Appendix C] The data-access VARIATION_API is justified by the locality assumption that if a sample zi is far from the private data, then its γ nearest neighbors in Ssim are also far. This assumption is load-bearing: without it, the iterative selection in Lines 6–9 of Algorithm 1 has no advantage over directly applying DP_NN_HISTOGRAM to all of Ssim, and the paper's own Table 2 and Appendix H.2 show that Sim-PE can perform worse than PE when alignment degrades. However, the only evidence offered, Appendix C, compares FID(selected) with FID(unselected) on a single, well-aligned simulator (DIGIFACE-1M); it does not directly measure the distance correlation the algorithm assumes, and it does not cover the weak-simulator or D4 regimes where the assumption is most questionable. Please provide either a formal condition with a bound on the error introduced by relying on locality, or a direct empirical verification across the spectrum of alignment used in Appendix H.2.
  2. [Tables 1–4] All reported accuracy and FID numbers appear to come from a single run with no error bars, standard deviations, or number of seeds. The headline claims in the abstract ('improving the downstream classification accuracy of PE by up to 3x, reducing FID by up to 80%') are differences between single runs of Sim-PE and external baselines from [22], so they could be affected by run-to-run variance in the DP noise, the classifier training, and the selection process. Please report at least 3–5 seeds for the main comparisons in Tables 1, 2, 3, and 4, or otherwise justify why the reported margins exceed the expected noise level.
  3. [Appendix D] The convergence analysis is asserted to transfer unchanged from PE because only RANDOM_API and VARIATION_API are modified. Yet Appendix D itself states that PE's analysis assumes VARIATION_API draws from a Gaussian distribution, which is an essential assumption. Section 3.3's VARIATION_API draws uniformly from a discrete set of γ nearest neighbors, and Section 3.2's VARIATION_API draws uniformly from intervals or re-draws categorical parameters with probability β; neither is Gaussian. This is not merely a cosmetic mismatch: the original convergence argument relies on the distributional form of the variation step. Either adapt the convergence analysis to the actual variation distributions, or explicitly restate the claim as applying to the privacy guarantee only and remove or qualify the convergence-transfer claim.
  4. [§4.4 and §H.2] The paper's framing that Sim-PE 'performs well' across four diverse simulators is too strong given the results it reports. With the weak avatar simulator, Sim-PE is below PE in both accuracy (62.6% vs. 70.5% at ϵ=1) and FID (101.4 vs. 23.4), and in Appendix H.2 the least-aligned subset D4 also falls below PE. These are not failures of the experiment; they are evidence that the proposed method's utility is contingent on simulator–private alignment, and the paper currently gives no way to predict or measure this alignment in advance. Please add a clear statement of the alignment condition under which Sim-PE is expected to help, and provide a practical diagnostic (e.g., a data-dependent measure of overlap between Ssim and the private data) that a user could compute before committing to Sim-PE.
minor comments (4)
  1. [Throughout] There are inconsistent spellings and acronyms: 'DIGI FACE-1M' in Appendices C and G vs. 'DIGIFACE-1M' in Table 1/§4.3, and 'PYTHON-AVATAR' vs. 'python_avatars' in §3.1. Please standardize.
  2. [§4.5 and Appendix J] The efficiency claim in the main text ('each PE's API call takes over 2400 GPU seconds, whereas Sim-PE takes less than 30 CPU seconds') is not directly supported by Table 10, which reports per-iteration runtime rather than per-API-call runtime; please align the statement with the table or add the per-call numbers to the table.
  3. [Table 5] The categorical parameter 'Text' has β set to 0 across all iterations, meaning the text never varies after the initial random draw. This deserves a brief explanation, because it affects how the class-correction behavior shown in Figure 2 is achieved.
  4. [§4.1.2] The paragraph on classifier selection says the validation set is used with Report Noisy Max, but the privacy accounting for this selection step is not stated explicitly. Please clarify how the privacy cost of this step is included in the reported ϵ.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Sim-PE's results are measured against external baselines, and the inherited PE privacy argument is an independent proof rather than a redefinition.

full rationale

The central empirical claims (e.g., MNIST accuracy 89.1% vs PE 27.9%, FID 20.7 vs 48.8) are comparisons to results compiled in the external DPImageBench benchmark [22], not outputs of a model fitted to those numbers. The new hyperparameters alpha, beta, and gamma are heuristic schedules; Appendix H.1 shows the default schedule is not always optimal, so the headline numbers are not forced by fitting. The locality assumption in Section 3.3 is an empirical premise, explicitly tested in Appendix C and Appendix H.2, and the paper reports cases where it fails (weak avatar simulator, D4 subset), which is inconsistent with circular self-confirmation. The privacy guarantee is inherited from the authors' earlier PE paper [46], but that is an independent proof with stated assumptions that do not include the Sim-PE claim. The convergence analysis transfer is admittedly imperfect because the kNN VARIATION_API is not Gaussian (Appendix D), but that is an unsupported transfer, not a circular reduction. No equation is defined in terms of the quantity it predicts, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or model entities. Its new free parameters are the variation hyperparameters alpha, beta, and gamma. It relies on inherited DP machinery, a transfer of PE's convergence analysis, and an empirically motivated locality assumption.

free parameters (3)
  • alpha (variation noise scale for numerical simulator parameters) = schedules such as font size [5,4,3,2], rotation [9,7,5,3], stroke width [1,1,0,0]
    Controls how much numerical parameters are perturbed in VARIATION_API (Eq. 2). Chosen by heuristic, ablated in Appendix H.1, and the paper notes defaults do not always give the best result.
  • beta (re-draw probability for categorical simulator parameters) = schedules such as font [0.8,0.4,0.2,0.0], avatar [0.8,0.6,0.4,0.2,0.1,0.08,0.06]
    Controls how often categorical parameters are redrawn rather than kept. Introduced in Eq. 2, chosen by heuristic, ablated in Appendix H.1.
  • gamma (size of nearest-neighbor pool for data-access variation) = [1000,500,200,100,50,20]
    Controls how many nearest neighbors are eligible when VARIATION_API selects a variation from the simulator dataset (Section 3.3). Chosen by heuristic, ablated in Appendix H.1.
assumptions (4)
  • standard math Gaussian mechanism and Report Noisy Max provide the stated (epsilon, delta)-DP guarantees (Dwork et al., 2006, 2014).
    Used in DP_NN_HISTOGRAM (Algorithm 2) and in classifier selection (Section 4.1.2).
  • domain assumption PE's privacy and convergence analysis from [46] applies unchanged to Sim-PE.
    Invoked in Section 3.1 and Appendix D. The privacy part is sound because only public APIs change, but the convergence part originally assumes Gaussian VARIATION_API, which Sim-PE's nearest-neighbor or parameter-perturbation variation does not satisfy. The transfer is asserted, not proven.
  • ad hoc to paper If a simulator sample is far from the private data, its nearest neighbors in the simulator dataset are also far.
    Used in Section 3.3 to justify iterative selection instead of histogramming all simulator samples. Only empirical support is given in Appendix C for one dataset; no bound or proof is provided.
  • domain assumption A pre-trained image embedding (Inception) provides a distance metric in which nearest-neighbor voting aligns with downstream utility.
    Inherited from PE and used in Algorithms 1 and 2 for all nearest-neighbor computations; the paper does not test alternative embeddings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model." pith.science (2026). https://pith.science/paper/I4GBGESF

@misc{pith2026250205505,
  author       = {Pith},
  title        = {Pith review of: Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I4GBGESF}},
  note         = {Machine review of arXiv:2502.05505}
}
read the original abstract

Differentially private (DP) synthetic data, which closely resembles the original private data while maintaining strong privacy guarantees, has become a key tool for unlocking the value of private data without compromising privacy. Recently, Private Evolution (PE) has emerged as a promising method for generating DP synthetic data. Unlike other training-based approaches, PE only requires access to inference APIs from foundation models, enabling it to harness the power of state-of-the-art (SoTA) models. However, a suitable foundation model for a specific private data domain is not always available. In this paper, we discover that the PE framework is sufficiently general to allow APIs beyond foundation models. In particular, we demonstrate that many SoTA data synthesizers that do not rely on neural networks--such as computer graphics-based image generators, which we refer to as simulators--can be effectively integrated into PE. This insight significantly broadens PE's applicability and unlocks the potential of powerful simulators for DP data synthesis. We explore this approach, named Sim-PE, in the context of image synthesis. Across four diverse simulators, Sim-PE performs well, improving the downstream classification accuracy of PE by up to 3x, reducing FID by up to 80%, and offering much greater efficiency. We also show that simulators and foundation models can be easily leveraged together within PE to achieve further improvements. The code is open-sourced in the Private Evolution Python library: https://github.com/microsoft/DPSDA.

Figures

Figures reproduced from arXiv: 2502.05505 by the authors.

Figure 1
Figure 1. Unlike prior PE work that relies solely on foundation models, we show that PE is also compatible with non-neural-network data synthe￾sis tools, which we call simulators. This greatly broadens PE’s applicability and enables SoTA sim￾ulators for DP data synthesis. In this paper, we propose Sim-PE ( [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The real and generated images on MNIST under the “ [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 4
Figure 4. The real and generated images on CelebA. The simulator is a weak rule-based avatar [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Sim-PE’s FID and accuracy generally improve over the course of the PE iterations [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: FID of the nearest neighbors of the selected and unselected samples. [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: shows that FID between generated images and the private dataset decreases (improves) across iterations, confirming that generated images better align with the private distribution over iterations. However, the number of unique samples in the generated dataset drops sig…
Figure 8
Figure 8. Figure 8: The number of unique generated samples in each iteration of [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Accuracy and FID on MNIST with different [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Accuracy and FID on CelebA using simulator-generated data with different [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: FID between the 5 constructed subsets of D [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Results of Sim-PE-generated data using the subsets in [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: The real and generated images on MNIST under the “ [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Phantoms and Disclosures: A Statistical Framework for Auditing Privacy in Synthetic Data

    cs.LG 2026-06 conditional novelty 6.0 of 10

    A model-agnostic audit detects synthetic data disclosures via feature-match and membership-inference tests that separate true from phantom leaks and give empirical differential-privacy lower bounds.

  2. Clustering and Median Aggregation Improve Differentially Private Inference

    cs.LG 2025-06 conditional novelty 6.0 of 10

    Clustering seed texts and privately aggregating median token logits improves representativeness and reduces reported privacy cost for DP synthetic text generation.

Reference graph

Works this paper leans on

71 extracted references · 34 canonical work pages · cited by 2 Pith papers

  1. [22]

    Dpimagebench: A unified benchmark for differentially private image synthesis

    Chen Gong, Kecen Li, Zinan Lin, and Tianhao Wang. Dpimagebench: A unified benchmark for differentially private image synthesis. arXiv preprint arXiv:2503.14681, 2025

    arXiv 2025

  2. [1]

    The crossroads of innovation and privacy: Private synthetic data for generative ai

    Gbola Afonja, Robert Sim, Zinan Lin, Huseyin Atahan Inan, and Sergey Yekhanin. The crossroads of innovation and privacy: Private synthetic data for generative ai. https://www.microsoft.com/en-us/research/blog/ the-crossroads-of-innovation-and-privacy-private-synthetic-data-for-generative-ai/ , 2024

    work page 2024

  3. [2]

    Understanding aggregate trends for apple intelligence using dif- ferential privacy

    Apple. Understanding aggregate trends for apple intelligence using dif- ferential privacy. https://machinelearning.apple.com/research/ differential-privacy-aggregate-trends , 2025

    work page 2025

  4. [3]

    Genesis: A universal and generative physics engine for robotics and beyond, December 2024

    Genesis Authors. Genesis: A universal and generative physics engine for robotics and beyond, December 2024

    work page 2024

  5. [4]

    Digiface-1m: 1 million digital face images for face recognition

    Gwangbin Bae, Martin de La Gorce, Tadas Baltrušaitis, Charlie Hewitt, Dong Chen, Julien Valentin, Roberto Cipolla, and Jingjing Shen. Digiface-1m: 1 million digital face images for face recognition. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3526–3535, 2023

    2023

  6. [5]

    Privacy-preserving generative deep neural networks sup- port clinical data sharing

    Brett K Beaulieu-Jones, Zhiwei Steven Wu, Chris Williams, Ran Lee, Sanjeev P Bhavnani, James Brian Byrd, and Casey S Greene. Privacy-preserving generative deep neural networks sup- port clinical data sharing. Circulation: Cardiovascular Quality and Outcomes, 12(7):e005122, 2019

    work page 2019

  7. [6]

    Improving image generation with better captions

    James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf, 2(3):8, 2023

    2023

  8. [7]

    Comparative study of differentially private synthetic data algorithms from the nist pscr differential privacy synthetic data challenge

    Claire McKay Bowen and Joshua Snoke. Comparative study of differentially private synthetic data algorithms from the nist pscr differential privacy synthetic data challenge. arXiv preprint arXiv:1911.12704, 2019. 10

    arXiv 1911

Show all 71 references
  1. [8]

    Don’t generate me: Training differentially private generative models with sinkhorn divergence

    Tianshi Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don’t generate me: Training differentially private generative models with sinkhorn divergence. Advances in Neural Information Processing Systems, 34:12480–12492, 2021

    2021

  2. [9]

    GS-WGAN: A gradient-sanitized approach for learning differentially private generators

    Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. GS-WGAN: A gradient-sanitized approach for learning differentially private generators. In Advances in Neural Information Processing Systems, 2020

    2020

  3. [10]

    Dpgen: Differentially private generative energy-guided network for natural image synthesis

    Jia-Wei Chen, Chia-Mu Yu, Ching-Chia Kao, Tzai-Wei Pang, and Chun-Shien Lu. Dpgen: Differentially private generative energy-guided network for natural image synthesis. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 8387–8396, 2022

    2022

  4. [11]

    Blender - a 3D modelling and rendering package

    Blender Online Community. Blender - a 3D modelling and rendering package . Blender Foundation, Stichting Blender Foundation, Amsterdam, 2018

    2018

  5. [12]

    Meta-sim2: Unsupervised learning of scene structure for synthetic data generation

    Jeevan Devaranjan, Amlan Kar, and Sanja Fidler. Meta-sim2: Unsupervised learning of scene structure for synthetic data generation. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XVII 16, pages 715–733. Springer, 2020

    2020

  6. [13]

    Differentially private diffusion models

    Tim Dockhorn, Tianshi Cao, Arash Vahdat, et al. Differentially private diffusion models. Transactions on Machine Learning Research, 2023

    2023

  7. [14]

    Differentially private diffusion models

    Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. arXiv preprint arXiv:2210.09929, 2022

    2022 arXiv

  8. [15]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pages 265–284. Springer, 2006

    2006

  9. [16]

    The algorithmic foundations of differential privacy

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Founda- tions and Trends® in Theoretical Computer Science, 9(3–4):211–407, 2014

    2014

  10. [17]

    A framework for the quantitative evaluation of disentangled representations

    Cian Eastwood and Christopher KI Williams. A framework for the quantitative evaluation of disentangled representations. In 6th International Conference on Learning Representations, 2018

    2018

  11. [18]

    Unreal engine

    Epic Games. Unreal engine. https://www.unrealengine.com

  12. [19]

    python avatars

    Ibon Escartín. python avatars. https://github.com/ibonn/python_avatars, 2021

    2021

  13. [21]

    Differentially private diffusion models generate useful synthetic images

    Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Ira Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L Smith, Olivia Wiles, and Borja Balle. Differentially private diffusion models generate useful synthetic images. arXiv preprint arXiv:2302.13861, 2023

    2023 arXiv

  14. [23]

    Generative adversarial networks

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139–144, 2020

    2020

  15. [24]

    Google fonts

    Google. Google fonts. https://github.com/google/fonts, 2022

    2022

  16. [25]

    Klaus Greff, Francois Belletti, Lucas Beyer, Carl Doersch, Yilun Du, Daniel Duckworth, David J Fleet, Dan Gnanapragasam, Florian Golemo, Charles Herrmann, Thomas Kipf, Abhijit Kundu, Dmitry Lagun, Issam Laradji, Hsueh-Ti (Derek) Liu, Henning Meyer, Yishu Miao, Derek Nowrouzeza...

    2022

  17. [26]

    DP-MERF: differentially private mean embeddings with random features for practical privacy-preserving data generation

    Frederik Harder, Kamil Adamczewski, and Mijung Park. DP-MERF: differentially private mean embeddings with random features for practical privacy-preserving data generation. In AISTATS, pages 1819–1827, 2021. 11

    2021

  18. [27]

    Dp-merf: Differentially private mean embeddings with randomfeatures for practical privacy-preserving data generation

    Frederik Harder, Kamil Adamczewski, and Mijung Park. Dp-merf: Differentially private mean embeddings with randomfeatures for practical privacy-preserving data generation. In International conference on artificial intelligence and statistics , pages 1819–1827. PMLR, 2021

    2021

  19. [28]

    Pre-trained perceptual features improve differentially private image generation

    Frederik Harder, Milad Jalali, Danica J Sutherland, and Mijung Park. Pre-trained perceptual features improve differentially private image generation. Transactions on Machine Learning Research, 2023

    2023

  20. [29]

    Exploring the limits of differentially private deep learning with group-wise clipping

    Jiyan He, Xuechen Li, Da Yu, Huishuai Zhang, Janardhan Kulkarni, Yin Tat Lee, Arturs Backurs, Nenghai Yu, and Jiang Bian. Exploring the limits of differentially private deep learning with group-wise clipping. arXiv preprint arXiv:2212.01539, 2022

    2022 arXiv

  21. [30]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  22. [31]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017

    2017

  23. [32]

    Pre-text: Training language models on private federated data in the age of llms

    Charlie Hou, Akshat Shrivastava, Hongyuan Zhan, Rylan Conway, Trang Le, Adithya Sagar, Giulia Fanti, and Daniel Lazar. Pre-text: Training language models on private federated data in the age of llms. arXiv preprint arXiv:2406.02958, 2024

    2024 arXiv

  24. [33]

    Private federated learning using preference-optimized synthetic data

    Charlie Hou, Mei-Yu Wang, Yige Zhu, Daniel Lazar, and Giulia Fanti. Private federated learning using preference-optimized synthetic data. arXiv preprint arXiv:2504.16438, 2025

    2025 arXiv

  25. [34]

    Sok: Privacy-preserving data synthesis

    Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo Munilla Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. Sok: Privacy-preserving data synthesis. In 2024 IEEE Symposium on Security and Privacy (SP), pages 4696–4713. IEEE, 2024

    2024

  26. [35]

    Introduction to network simulator 2 (NS2)

    Teerawat Issariyakul, Ekram Hossain, Teerawat Issariyakul, and Ekram Hossain. Introduction to network simulator 2 (NS2). Springer, 2009

    2009

  27. [36]

    Functional renyi differential privacy for generative modeling

    Dihong Jiang, Sun Sun, and Yaoliang Yu. Functional renyi differential privacy for generative modeling. In Advances in Neural Information Processing Systems, 2023

    2023

  28. [37]

    PATE-GAN: Generating synthetic data with differential privacy guarantees

    James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. PATE-GAN: Generating synthetic data with differential privacy guarantees. In International conference on learning representa- tions, 2019

    2019

  29. [38]

    Meta-sim: Learning to generate synthetic datasets

    Amlan Kar, Aayush Prakash, Ming-Yu Liu, Eric Cameracci, Justin Yuan, Matt Rusiniak, David Acuna, Antonio Torralba, and Sanja Fidler. Meta-sim: Learning to generate synthetic datasets. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4551–4560, 2019

    2019

  30. [39]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  31. [40]

    The mnist database of handwritten digits

    Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/, 1998

    1998

  32. [41]

    PrivImage: Differentially private synthetic image generation using diffusion models with Semantic-Aware pretraining

    Kecen Li, Chen Gong, Zhixiang Li, et al. PrivImage: Differentially private synthetic image generation using diffusion models with Semantic-Aware pretraining. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4837–4854, 2024

    2024

  33. [42]

    Large language models can be strong differentially private learners

    Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. arXiv preprint arXiv:2110.05679, 2021

    2021 arXiv

  34. [43]

    Data Sharing with Generative Adversarial Networks: From Theory to Practice

    Zinan Lin. Data Sharing with Generative Adversarial Networks: From Theory to Practice. PhD thesis, Carnegie Mellon University, 2022

    2022

  35. [44]

    Differentially private synthetic data via APIs 3: Using simulators instead of foundation model

    Zinan Lin, Tadas Baltrusaitis, and Sergey Yekhanin. Differentially private synthetic data via APIs 3: Using simulators instead of foundation model. In ICLR 2025 Workshop on Navigating and Addressing Data Problems for Foundation Models, 2025

    2025

  36. [45]

    Differentially private synthetic data via APIs 3: Using simulators instead of foundation model

    Zinan Lin, Tadas Baltrusaitis, and Sergey Yekhanin. Differentially private synthetic data via APIs 3: Using simulators instead of foundation model. In ICLR 2025 Workshop: Will Synthetic Data Finally Solve the Data Access Problem?, 2025. 12

    2025

  37. [46]

    Differen- tially private synthetic data via foundation model APIs 1: Images

    Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, Harsha Nori, and Sergey Yekhanin. Differen- tially private synthetic data via foundation model APIs 1: Images. In NeurIPS 2023 Workshop on Synthetic Data Generation with Generative AI, 2023

    2023

  38. [47]

    Using gans for sharing networked time series data: Challenges, initial promise, and open questions

    Zinan Lin, Alankar Jain, Chen Wang, Giulia Fanti, and Vyas Sekar. Using gans for sharing networked time series data: Challenges, initial promise, and open questions. In Proceedings of the ACM Internet Measurement Conference, pages 464–483, 2020

    2020

  39. [48]

    Infogan-cr and modelcen- trality: Self-supervised model training and selection for disentangling gans

    Zinan Lin, Kiran Thekumparampil, Giulia Fanti, and Sewoong Oh. Infogan-cr and modelcen- trality: Self-supervised model training and selection for disentangling gans. In international conference on machine learning, pages 6127–6139. PMLR, 2020

    2020

  40. [49]

    Distilled decoding 1: One-step sampling of image auto-regressive models with flow matching

    Enshu Liu, Xuefei Ning, Yu Wang, and Zinan Lin. Distilled decoding 1: One-step sampling of image auto-regressive models with flow matching. arXiv preprint arXiv:2412.17153, 2024

    2024

  41. [50]

    Liu, Saiyue Lyu, Margarita Vinaroz, and Mijung Park

    Michael F. Liu, Saiyue Lyu, Margarita Vinaroz, and Mijung Park. Differentially private latent diffusion models. 2024

    2024

  42. [51]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015

    2015

  43. [52]

    Gpt-4 technical report, 2023

    OpenAI. Gpt-4 technical report, 2023

    2023

  44. [53]

    The ns-3 network simulator

    George F Riley and Thomas R Henderson. The ns-3 network simulator. In Modeling and tools for network simulation, pages 15–34. Springer, 2010

    2010

  45. [54]

    High- resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 2022

    2022

  46. [55]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. Advances in neural information processing systems, 29, 2016

    2016

  47. [56]

    Deep unsuper- vised learning using nonequilibrium thermodynamics

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning, pages 2256–2265. PMLR, 2015

    2015

  48. [57]

    Is api access to llms useful for generating private synthetic tabular data? arXiv preprint arXiv:2502.06555, 2025

    Marika Swanberg, Ryan McKenna, Edo Roth, Albert Cheu, and Peter Kairouz. Is api access to llms useful for generating private synthetic tabular data? arXiv preprint arXiv:2502.06555, 2025

    2025 arXiv

  49. [58]

    Benchmarking differentially private synthetic data generation algorithms

    Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. arXiv preprint arXiv:2112.09238, 2021

    2021 arXiv

  50. [59]

    Differentially private fine-tuning of diffusion models

    Yu-Lin Tsai, Yizhe Li, Zekai Chen, Po-Yu Chen, Chia-Mu Yu, Xuebin Ren, and Fran- cois Buet-Golfouse. Differentially private fine-tuning of diffusion models. arXiv preprint arXiv:2406.01355, 2024

    2024 arXiv

  51. [60]

    Hermite polynomial features for private data generation

    Margarita Vinaroz, Mohammad-Amin Charusaie, Frederik Harder, Kamil Adamczewski, and Mi Jung Park. Hermite polynomial features for private data generation. In International Conference on Machine Learning, pages 22300–22324. PMLR, 2022

    2022

  52. [61]

    Fake it till you make it: face analysis in the wild using synthetic data alone

    Erroll Wood, Tadas Baltrušaitis, Charlie Hewitt, Sebastian Dziadzio, Thomas J Cashman, and Jamie Shotton. Fake it till you make it: face analysis in the wild using synthetic data alone. In Proceedings of the IEEE/CVF international conference on computer vision, pages 3681–3691, 2021

    2021

  53. [62]

    Differentially private synthetic data via foundation model apis 2: Text

    Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, et al. Differentially private synthetic data via foundation model apis 2: Text. arXiv preprint arXiv:2403.01749, 2024

    2024 arXiv

  54. [63]

    Differentially private generative adversarial network

    Liyang Xie, Kaixiang Lin, and et al. Differentially private generative adversarial network. CoRR, abs/1802.06739, 2018

    2018 arXiv

  55. [64]

    Aggregated residual transformations for deep neural networks

    Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1492–1500, 2017

    2017

  56. [65]

    Differentially private neural tangent kernels for privacy-preserving data generation

    Yilin Yang, Kamil Adamczewski, and et al. Differentially private neural tangent kernels for privacy-preserving data generation. CoRR, abs/2303.01687, 2023. 13

    2023 arXiv

  57. [66]

    Practical gan-based synthetic ip header trace generation using netshare

    Yucheng Yin, Zinan Lin, Minhao Jin, Giulia Fanti, and Vyas Sekar. Practical gan-based synthetic ip header trace generation using netshare. In Proceedings of the ACM SIGCOMM 2022 Conference, pages 458–472, 2022

    2022

  58. [67]

    Selective pre-training for private fine-tuning

    Da Yu, Sivakanth Gopi, Janardhan Kulkarni, Zinan Lin, Saurabh Naik, Tomasz Lukasz Religa, Jian Yin, and Huishuai Zhang. Selective pre-training for private fine-tuning. arXiv preprint arXiv:2305.13865, 2023

    2023 arXiv

  59. [68]

    Differentially private fine-tuning of language models

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. arXiv preprint arXiv:2110.06500, 2021

    arXiv

  60. [69]

    Synthetic text generation with differential privacy: A simple and practical recipe

    Xiang Yue, Huseyin A Inan, Xuechen Li, Girish Kumar, Julia McAnallen, Huan Sun, David Levitan, and Robert Sim. Synthetic text generation with differential privacy: A simple and practical recipe. arXiv preprint arXiv:2210.14348, 2022

    arXiv

  61. [70]

    Wide residual networks

    Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  62. [71]

    simulators

    Tianyuan Zou, Yang Liu, Peng Li, Yufei Xiong, Jianqing Zhang, Jingjing Liu, Xiaozhou Ye, Ye Ouyang, and Ya-Qin Zhang. Contrastive private data synthesis via weighted multi-plm fusion. arXiv preprint arXiv:2502.00245, 2025. 14 A The Prevalence and Importance of Simulators In th...

    2025 arXiv

  63. [72]

    Following [22], we set the number of generated samples to be 60,000

    with variation degrees [96, 94, 92, 90]. Following [22], we set the number of generated samples to be 60,000. J Efficiency Evaluation As simulators could be much cheaper to generate samples than the foundation models, we show in this section that Sim-PE is much more efficient ...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.