Pith. sign in

REVIEW 4 major objections 4 minor 2 cited by

Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data?

T0 review · 4 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read API access to LLMs does not improve DP tabular synthetic data on the tested workloads, and the best LLM-informed method ties with uniform random data.

desk verdict Negative result with real value: API-only LLM access does not beat strong non-LLM baselines for DP tabular synthesis on tested workloads, and the paper's naive-baseline discipline is the main reason to believe it. read the letter →

arxiv 2502.06555 v1 pith:US63NSOP submitted 2025-02-10 cs.LG cs.CR

Marika Swanberg , Ryan McKenna , Edo Roth , Albert Cheu , Peter Kairouz This is my paper · ORCID
classification cs.LGcs.CR
keywords differentialprivacysynthetictabulardatalargelanguagemodelsAPIaccessprivateevolutionworkload-awaredistancepublicmarginalqueries
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether calling a large language model through its public API can improve differentially private (DP) synthesis of tabular data, and it answers with a cautiously negative result. The authors adapt Private Evolution, previously used for images and text, to tables by introducing a workload-aware distance between records. They also propose one-shot methods that feed LLM-generated records into DP mechanisms as a substitute for public data. On the UCI Adult dataset with 2-way marginal workloads, the best LLM-informed method matches the same mechanism run on uniform random data, so the LLM's prior adds no measurable accuracy. The paper's value lies in the negative result, the new distance measure, and the warning that strong baselines are needed before crediting LLM priors.

What carries the argument

The central new object is a workload-aware distance function $Wdist_{\psi}(x,c)=\sum_{i\in[k]} |\psi_i(x)-\psi_i(c)|$, which lets Private Evolution run on tabular records without public embeddings: each private record votes for the closest synthetic candidate, and the DP histogram over those votes drives evolution. The second mechanism is one-shot generation: query the LLM once, offline, with only column names and types, to produce a public auxiliary dataset called Gem Synth, then feed those records into PMWpub, MST, or JAM as public data. The argument's negative result is carried by the comparison between JAM with Gem Synth and JAM with uniform data, which ties.

What would settle it

Run the one-shot JAM comparison on a tabular dataset whose 2-way marginals Gemini reproduces accurately, for example a public dataset released after the model's training cutoff; if JAM with Gemini-generated records then beats JAM with uniform data by a margin larger than sampling noise, the paper's central negative result would not generalize.

Watch

Extended reading notes

Core claim

The central claim is that API access to a powerful LLM does not always improve the quality of DP synthetic tabular data compared to established baselines that do not use the LLM. In the strongest reported case, JAM using Gemini-generated records and JAM using uniform data achieve the same workload error, meaning the Gemini records contribute nothing beyond what uniform random public data provides. The adapted Private Evolution algorithm also fails to beat the simple independent and DP workload baselines. The paper's own conclusion is that current API-accessible LLMs are not, by themselves, a useful ingredient for this task on the tested workloads.

Load-bearing premise

The conclusion treats Gemini 1.0 Pro's outputs as a fair representative of powerful LLMs and UCI Adult 2-way marginals as a fair workload; if a model with stronger tabular priors or a different workload were tested, LLM-augmented methods could plausibly beat the baselines.

Editorial extensions

If this is right

  • LLM API access cannot be assumed to help DP tabular synthesis; the burden of proof shifts to demonstrating a workload where the LLM prior beats uniform public data.
  • The workload-aware distance makes Private Evolution applicable to tables and could be reused in other distance-based DP mechanisms.
  • One-shot API use is preferable to multi-round evolution here, because the privacy cost of composing iterations outweighs the marginal gains.
  • Evaluations of LLM-based DP tabular methods should include uniform-data versions of public-data baselines, or they risk false positives.
  • Improvements in LLM tabular priors, not just scale, are the route the paper points to for future gains.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves open that a model with stronger tabular priors could break the tie with uniform data; the result is a lower bound tied to Gemini 1.0 Pro, not a general impossibility.
  • The workload-aware distance could serve as an evaluation metric independent of LLMs, directly linking synthetic-data quality to the query workload.
  • A sharper test would hold the LLM fixed and vary only the schema; if descriptive column names carry the prior, more informative schemas might extract value where the current tests saw none.
  • Combining one-shot generation with Private Evolution, which the paper mentions as future work, could let the LLM polish candidates without paying iterative privacy costs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies whether API access to a large language model can improve the quality of differentially private synthetic tabular data. It first adapts Private Evolution to tabular data by introducing a workload-aware distance function and evaluates it on a modified NYC Taxi dataset, finding that the method fails to beat simple non-LLM baselines such as the independent marginal baseline and direct DP workload answering. It then proposes a one-shot approach in which Gemini generates synthetic 'public' records from only the column names and datatypes, which are fed into existing public-data-aware algorithms (PMWpub, a modified MST, and JAM). On UCI Adult with 2-way marginal workloads, the best LLM-based method, JAM with Gemini-generated data, ties with JAM using uniform random data, and does not outperform the strongest non-LLM baselines. The paper concludes that API access to LLMs does not always improve DP tabular synthetic data and discusses possible reasons and future directions.

Significance. If the empirical conclusion is robust, this is a useful negative result for a rapidly growing area: it warns against assuming that LLM priors automatically help DP tabular synthesis and emphasizes the need for strong, sometimes naive, baselines. The workload-aware distance function for Private Evolution is a reasonable contribution that may be of independent interest. The paper is also commendably honest: it reports the uniform-data control for JAM and explicitly scopes its claims to the tested LLM, datasets, and workloads. However, the empirical evidence base is narrow (one LLM, two datasets, one workload family), and several methodological details are missing, so the central claim needs strengthening before publication.

major comments (4)
  1. [§4.3, Figure 2] No error bars, confidence intervals, or multiple-seed results are reported for any method. The key negative result—that JAM with Gem Synth performs equally well as JAM with uniform data—is presented as a point comparison, and without variance information the reader cannot tell whether the observed tie reflects a true lack of improvement or simply run-to-run noise. Please report the number of independent runs and the mean and standard deviation (or other dispersion measure) of workload error for every method and every epsilon value.
  2. [§4.3] The paper uses UCI Adult as the 'private' dataset, but UCI Adult is a canonical public benchmark that is very likely present in Gemini 1.0 Pro's training data. The one-shot Gem Synth may therefore contain memorized records from the very dataset that is supposed to be private. This has two consequences: (i) it is not a faithful test of the scenario in which the private data is unseen by the LLM, and (ii) the public data may contain actual sensitive records, which is a privacy concern outside the DP guarantee. The authors should acknowledge this contamination risk explicitly and, ideally, repeat the one-shot experiment on a dataset that postdates the LLM's training cutoff, as they did for the NYC Taxi experiments in Section 3.2.
  3. [§3.2] The evaluation of the adapted Private Evolution algorithm is not reproducible as written. The manuscript says the experiments use a 'modified version of NYC Taxi' without specifying the modification, the column schema, the exact workload queries, the prompt templates for the Random and Variation APIs, the number of candidates, the privacy budget split across iterations, or the hyperparameter values tested. Since one of the paper's main negative findings is that this algorithm fails to beat simple baselines, these details need to be provided, at least in an appendix, before the result can be verified.
  4. [§4.1–§4.3] The construction and use of Gem Synth is underspecified. The paper states that 131,000 records were sampled with top-k=1 and temperature=1, but it does not report how the response schema was defined, how invalid or duplicate records were handled, how the public support was passed to PMWpub and the MST modification, or how the domain size and record count affect the public-data subroutines. These choices can materially change the measured workload error, so they should be documented in detail.
minor comments (4)
  1. [Abstract and §5] The abstract and conclusion refer to 'powerful LLMs' in general, but the experiments use only Gemini 1.0 Pro. The wording should be qualified as 'the tested LLM' to avoid overgeneralization.
  2. [§3.2] There is a typo: 'to to avoid' should be 'to avoid'. Also, the phase 'scaled ℓ1-distance on numerical variables for each combination of categorical variables' should be defined precisely in terms of the workload predicates ψ_i introduced in Section 3.1.
  3. [§4.2] The text says 'publically data'—this should be 'public data'. In addition, the baselines labeled 'no privacy' are described only informally; please clarify which of them are used as upper bounds on achievable error and which are actual privacy-free comparisons.
  4. [§4.4, Figure 2] The figure legends are not described in the text in enough detail; the reader cannot tell which curves correspond to which methods from the caption alone. Please add a clear legend and refer to it explicitly in the results discussion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the negative claim is an empirical comparison controlled by a uniform-data baseline, and the workload-aware distance is an explicitly constructed proxy rather than a fitted prediction.

full rationale

The paper's central claim is empirical and negative: on the tested workloads, API access to Gemini 1.0 Pro does not improve DP tabular synthetic data over established non-LLM baselines. The experimental design includes the critical control 'JAM with uniform data,' which matches 'JAM with Gem Synth,' explicitly ruling out the alternative that any public data helps JAM. The workload-aware distance in Section 3.1 is defined directly from the workload predicates, but this is an explicitly constructed objective for the Private Evolution adaptation, not a fitted parameter or a prediction derived from the data; the paper does not use this definition to infer the headline conclusion. Self-citations to JAM, MST, and PMWpub identify standard baselines and algorithms from the authors' prior work, but those are used as external comparison points and the negative conclusion is not justified by citing them. No load-bearing step reduces to its own inputs, and no uniqueness theorem or ansatz is imported via self-citation. The paper even foregrounds the uniform-data baseline as a guard against a false positive conclusion, demonstrating care against self-confirmation. Score 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. The central evaluation relies on standard DP definitions, a workload-linearity assumption, and the modeling choice that Gemini outputs are useful public data. The only hand-chosen quantities are experimental hyperparameters, which are transparently reported.

free parameters (3)
  • PE hyperparameters: number of candidates, iterations, noise multiplier, budget schedule = Not fixed; tuned experimentally (e.g., single iteration was optimal)
    Section 3.2 reports experimenting with various hyperparameters and selecting settings that work best. These hand-tuned choices affect the results.
  • Per-column rescaling for numerical variables = e.g., trip distance in miles vs duration in seconds
    Section 3.2: 'We rescale the numerical variables to account for different value ranges.' This choice affects the workload-aware distance and the PE results.
  • Gemini sampling parameters = temperature=1, top-k=1
    Section 4.3 specifies these values for generating Gem Synth. The quality of the generated public data depends on these choices.
assumptions (4)
  • standard math Differential privacy definition with epsilon and delta as standard
    Definition 1 states the standard DP guarantee. All algorithms are assumed to satisfy it.
  • domain assumption Workload queries are linear and decompose as sums over record predicates
    Section 3.1: 'assuming the queries are linear, then they correspond to a sum over a predicate on data records'. This justifies the workload-aware distance definition.
  • domain assumption Public foundation models can be treated as non-private
    Footnote 1 in the Introduction: the paper sidesteps the contested question of whether LLM training data is compatible with privacy goals and assumes public models are fair to treat as non-private.
  • domain assumption Gemini-generated records can serve as public data for PMWpub, MST, and JAM
    Section 4.1 uses Gem Synth as the public dataset for these algorithms. The validity of the one-shot approach depends on the quality and distributional similarity of the LLM-generated records.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data?." pith.science (2026). https://pith.science/paper/US63NSOP

@misc{pith2026250206555,
  author       = {Pith},
  title        = {Pith review of: Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/US63NSOP}},
  note         = {Machine review of arXiv:2502.06555}
}
read the original abstract

Differentially private (DP) synthetic data is a versatile tool for enabling the analysis of private data. Recent advancements in large language models (LLMs) have inspired a number of algorithm techniques for improving DP synthetic data generation. One family of approaches uses DP finetuning on the foundation model weights; however, the model weights for state-of-the-art models may not be public. In this work we propose two DP synthetic tabular data algorithms that only require API access to the foundation model. We adapt the Private Evolution algorithm (Lin et al., 2023; Xie et al., 2024) -- which was designed for image and text data -- to the tabular data domain. In our extension of Private Evolution, we define a query workload-based distance measure, which may be of independent interest. We propose a family of algorithms that use one-shot API access to LLMs, rather than adaptive queries to the LLM. Our findings reveal that API-access to powerful LLMs does not always improve the quality of DP synthetic data compared to established baselines that operate without such access. We provide insights into the underlying reasons and propose improvements to LLMs that could make them more effective for this application.

Figures

Figures reproduced from arXiv: 2502.06555 by the authors.

Figure 1
Figure 1. Top 1-way marginals on private (outlined) and synthetic (yellow) data. Bottom workload error of synthetic data over time for Private Evolution with ε = ∞. With differential privacy, the private evolution algorithm failed to beat two simple baselines: inde￾pendent which privately computes all 1-way marginals and samples data from the product over the private marginals, and DP workload which directly computes the work… view at source ↗
Figure 2
Figure 2. (Left) Workload error for baseline methods for generating tabular synthetic data without use of Gemini. (Right) Workload error for baseline methods and our one-shot methods that use API access to Gemini. • MST algorithm: a tabular synthetic data algorithm that does not use public data. • PMWpub with uniform data and JAM with uniform data: using data that is drawn uni￾formly from the domain as public data for these a… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Differentially Private Synthetic Data Release for Topics API Outputs

    cs.CR 2025-06 conditional novelty 6.0 of 10

    The paper presents a differentially private methodology and a public synthetic dataset of Topics API traces that match real re-identification risk within one standard deviation on two attacks.

  2. Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

    cs.LG 2025-02 conditional novelty 4.0 of 10

    Sim-PE plugs non-neural simulators into Private Evolution to create differentially private images, improving downstream accuracy over foundation-model PE by up to 3x on MNIST.

Reference graph

Works this paper leans on

14 extracted references · 1 canonical work pages · cited by 2 Pith papers

  1. [3]

    Gemini: A family of highly capable multimodal models

    Gemini Team Google. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11805,

    arXiv

  2. [6]

    Harness- ing large-language models to generate private synthetic text

    Alexey Kurakin, Natalia Ponomareva, Umar Syed, Liam MacDermed, and Andreas Terzis. Harness- ing large-language models to generate private synthetic text. arXiv preprint arXiv:2306.01684,

    arXiv

  3. [7]

    Differentially private synthetic data via foundation model apis 1: Images

    Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, Harsha Nori, and Sergey Yekhanin. Differentially private synthetic data via foundation model apis 1: Images. arXiv preprint arXiv:2305.15560 ,

    arXiv

  4. [8]

    Leveraging public data for practical private query release

    Terrance Liu, Giuseppe Vietri, Thomas Steinke, Jonathan Ullman, and Steven Wu. Leveraging public data for practical private query release. In International Conference on Machine Learning, pp. 6968–6977. PMLR, 2021a. Terrance Liu, Giuseppe Vietri, and Steven Z Wu. Iterative methods for private synthetic data: Uni- fying framework and new methods. Advances ...

    arXiv

  5. [11]

    Benchmarking differentially private synthetic data generation algorithms

    Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. arXiv preprint arXiv:2112.09238,

    arXiv

  6. [12]

    Differentially private tabular data synthesis using large language models

    Toan V Tran and Li Xiong. Differentially private tabular data synthesis using large language models. arXiv preprint arXiv:2406.01457,

    arXiv

  7. [13]

    Differentially private synthetic data via foundation model apis 2: Text

    Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A Inan, Harsha Nori, Hao- tian Jiang, Huishuai Zhang, Yin Tat Lee, et al. Differentially private synthetic data via foundation model apis 2: Text. arXiv preprint arXiv:2403.01749,

    arXiv

  8. [14]

    Tabular data synthesis with differential privacy: A survey

    Mengmeng Yang, Chi-Hung Chi, Kwok-Yan Lam, Jie Feng, Taolin Guo, and Wei Ni. Tabular data synthesis with differential privacy: A survey. arXiv preprint arXiv:2411.03351,

    arXiv

Show all 14 references
  1. [1996]

    Kuntai Cai, Xiaoyu Lei, Jianxin Wei, and Xiaokui Xiao

    DOI: https://doi.org/10.24432/C5XW20. Kuntai Cai, Xiaoyu Lei, Jianxin Wei, and Xiaokui Xiao. Data synthesis via differentially private markov random fields. Proceedings of the VLDB Endowment, 14(11):2190–2202,

    doi

  2. [2012]

    Pre-text: Training language models on private federated data in the age of llms

    Charlie Hou, Akshat Shrivastava, Hongyuan Zhan, Rylan Conway, Trang Le, Adithya Sagar, Giulia Fanti, and Daniel Lazar. Pre-text: Training language models on private federated data in the age of llms. arXiv preprint arXiv:2406.02958,

    arXiv

  3. [2021]

    Aim: An adaptive and iterative mechanism for differentially private synthetic data

    Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. Aim: An adaptive and iterative mechanism for differentially private synthetic data. arXiv preprint arXiv:2201.12677,

    arXiv

  4. [2022]

    Privately generating tabular data using lan- guage models

    8 Alexandre Sablayrolles, Yue Wang, and Brian Karrer. Privately generating tabular data using lan- guage models. arXiv preprint arXiv:2306.04803,

    arXiv

  5. [2023]

    Differentially private diffusion models generate useful synthetic images

    Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Ira Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L Smith, Olivia Wiles, and Borja Balle. Differentially private diffusion models generate useful synthetic images. arXiv preprint arXiv:2302.13861,

    arXiv

  6. [2024]

    7 Kareem Amin, Alex Bie, Weiwei Kong, Alexey Kurakin, Natalia Ponomareva, Umar Syed, Andreas Terzis, and Sergei Vassilvitskii

    URL https://arxiv.org/ abs/2412.02467. 7 Kareem Amin, Alex Bie, Weiwei Kong, Alexey Kurakin, Natalia Ponomareva, Umar Syed, Andreas Terzis, and Sergei Vassilvitskii. Private prediction for large-scale synthetic text generation.arXiv preprint arXiv:2407.12108,

    arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.