Pith. sign in

REVIEW 3 major objections 5 minor 40 references

Privacy Amplification Through Synthetic Data: Insights from Linear Regression

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Random inputs amplify privacy of synthetic regression data

desk verdict First rigorous look at synthetic-data privacy amplification in linear regression, with clean negative results and a promising but incomplete positive story; worth refereeing, not ready as is. read the letter →

arxiv 2506.05101 v1 pith:56PNJJF3 submitted 2025-06-05 cs.LG cs.CRstat.ML

Clément Pierquin , Aurélien Bellet , Marc Tommasi , Matthieu Boussard This is my paper
classification cs.LGcs.CRstat.ML
keywords differentialprivacysyntheticdataamplificationlinearregressionoutputperturbationf-differentialRényiGaussianmatrixproduct
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether releasing synthetic data can be more private than the private model used to generate it, and answers the question rigorously in the tractable setting of linear regression. It first proves a negative result: if an adversary controls the random seed fed to the model, a single synthetic point can leak as much information as releasing the whole model, so no amplification is possible. It then proves the positive counterpart: when the seed is a hidden Gaussian random matrix and only a limited number of synthetic points are released, the privacy loss is bounded below by a term that can beat the post-processing bound in high input dimension $d$. The core mechanism is that a product of a Gaussian-perturbed regression matrix with a hidden Gaussian seed converges to a Gaussian in total variation, converting a mean shift between adjacent models into a much smaller variance shift. If correct, the paper gives a formal footing for the empirical claim that synthetic data can inherit stronger privacy than the model that produced it, and it shows seed secrecy is the condition that makes this happen.

What carries the argument

The load-bearing object is the product $VZ$ of a Gaussian-perturbed regression matrix $V=v+\sigma_\theta N$ and a hidden Gaussian seed matrix $Z$; for $v=0$ and $l=1$ this is a generalized Laplace distribution, and for general $v$ it has no closed-form density. The proof stacks three tools. First, the f-DP framework: a trade-off function $T(P,Q)(\alpha)$ records the smallest type-II error a hypothesis test can achieve at type-I error $\alpha$, and Gaussian differential privacy is the special case $T(\mathcal N(0,1),\mathcal N(\mu,1))=G_\mu$, which exactly describes output perturbation with shift $\Delta/\sigma_\theta$. Second, a total-variation central limit theorem for Gaussian-matrix products and its shifted version, which show $(\sigma_\theta N+v)Z$ converges to $\sigma_\theta\sqrt{d-s}G+vZ'$ at rate $C'\sqrt{nls/(d-s)}$ independent of the shift $v$. Third, a lemma converts total-variation closeness into two-sided bounds on trade-off functions, and the standard f-DP-to-RDP conversion turns the approximate trade-off curve into R\'enyi privacy loss. The uniformity of the approximation error in $v$ is what allows the error to be absorbed into an additive $C/d$ term instead of growing with the model shift, and this absorption is what makes the lower bound $h=\max\{T(V,W),\tilde g\}$ nontrivial.

What would settle it

Numerically compute the total-variation distance between $(\sigma_\theta N+v)Z$ and $\sigma_\theta\sqrt{d-s}\,G+vZ'$ for a rank-one shift $v$ with growing norm, at $d$ just above $\max\{n,l\}$: if the distance is not bounded by a constant times $\sqrt{nls/(d-s)}$ uniformly in $v$, then the main amplification theorem fails; conversely, a separate numerical computation of the exact R\'enyi divergence $D_\alpha(VZ,WZ)$ at moderate $d$ would show whether the predicted $O(1/d)$ rate holds for the true distribution or only for its Gaussian limit.

Watch

Extended reading notes

Core claim

The paper's central claim is that privacy amplification for synthetic data is real, but it depends entirely on where the randomness comes from. In the output-perturbation model $M(D)=v^*+\sigma_\theta N$, where $v^*$ minimizes the regularized least-squares objective and $N$ is a standard Gaussian matrix, the synthetic-release mechanism is $M_Z(v)=M(v)Z$ with $Z\in\mathbb{R}^{d\times l}$ having i.i.d. Gaussian entries. The discovery is that $VZ$, with $V=v+\sigma_\theta N$, is not just a post-processed version of $V$: for $d\ge\max\{n,l\}$, the shifted Gaussian product $(\sigma_\theta N+v)Z$ is within total-variation distance $O(\sqrt{nls/(d-s)})$ of $\sigma_\theta\sqrt{d-s}\,G+vZ'$, uniformly in the shift $v$. This lets the paper bound the exact trade-off function $T(VZ,WZ)$ between two adjacent synthetic releases by the better of the post-processing guarantee $T(V,W)$ and a Gaussian-approximation trade-off $\tilde{g}$ with an additive $C/d$ correction. In the single-output case $n=l=1$, the limiting R\'enyi divergence is $\alpha\Delta^2/(4d\sigma_\theta^2)+o(d^{-1})$, about $1/(2d)$ of the divergence from releasing the model itself; in the multi-output case the corresponding loss is at most $\alpha nl\Delta^2/(4(d-n)\sigma_\theta^2)+o(d^{-1})$. The negative results complement this: with a fixed or adversary-chosen seed, one query can already equal the full-model leakage for both output perturbation and noisy gradient descent, so hidden randomness is not a convenience but a necessary condition for amplification.

Load-bearing premise

The positive result rests on the assumption that the shifted Gaussian product $(\sigma_\theta N+v)Z$ is close in total variation to a Gaussian matrix at rate $C'\sqrt{nls/(d-s)}$ with a constant independent of the shift $v$, and on the condition $d\ge\max\{n,l\}$; if the rate degrades with $\|v\|$ or the constant is not universal, the additive $C/d$ correction becomes shift-dependent and the amplification bound collapses.

Editorial extensions

If this is right

  • Releasing a small number of synthetic points from a hidden-seed linear model in high dimension gives a privacy loss that shrinks with the input dimension $d$; the limiting R\'enyi loss is $\alpha nl\Delta^2/(4(d-n)\sigma_\theta^2)+o(d^{-1})$, compared with $\alpha\Delta^2/(2\sigma_\theta^2)$ for the model itself.
  • The synthetic-release guarantee is never worse than post-processing, since $T(VZ,WZ)\ge T(V,W)$, and can be strictly better when the Gaussian-approximation term $\tilde g$ dominates; the improvement grows with $d$ and is largest when few synthetic points are released.
  • Each released synthetic point behaves like a separate query whose privacy cost composes: the multi-output bound contains the factor $nl$, so the total loss scales with the number and dimension of released points rather than with the full model.
  • If an adversary knows or controls the seed, the amplification disappears entirely: a single chosen query can match the full-model leakage for both output perturbation and noisy gradient descent.
  • The Gaussian-product technique has a hard small-$d$ limit: when $d\le C''\max\{n,l\}^{1/2}\min\{n,l\}^{3/2}$, the total-variation distance between the product and a Gaussian is at least $2/3$, so this proof route cannot yield amplification in that regime.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the same variance-shift mechanism suggests that any generative model that projects a high-dimensional private Gaussian mechanism through a hidden random matrix could exhibit a similar amplification, even when the model is not linear; the paper only proves the Gaussian-product case.
  • A concrete operational reading follows: keep the generation seed secret, publicize only a small number of samples, and work in large input dimension; the numerical results suggest the effect is visible at moderate $d$, but the existential constants mean a certified deployment threshold still needs to be computed.
  • The negative seed-control result gives an inexpensive auditing recipe: an auditor who can query the generator with chosen seeds should treat a single worst-case query as already saturating the post-processing bound, so audits should be designed against seed-controlling adversaries.
  • One direct testable extension would be to compute $D_\alpha(VZ,WZ)$ exactly for the true generalized-Laplace-type distribution at moderate $d$ and compare with the predicted $\alpha\Delta^2/(4d\sigma_\theta^2)$; agreement would certify that the asymptotic amplification is real rather than an artifact of the Gaussian approximation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies whether releasing synthetic data generated from a differentially private linear regression model can amplify privacy beyond the post-processing guarantee. Section 3 gives negative results for the threat model where the adversary controls the seed: with output perturbation (Proposition 3.1) and with noisy gradient descent (Propositions 3.2 and 3.3), a single synthetic point can match the full-model leakage in the worst case. Section 4 analyzes the opposite setting, where the seeds are random Gaussian inputs and the model is privatized by output perturbation. The main positive claims are Theorem 4.3 (single output, d large) and Theorem 4.6 (multiple outputs), which lower-bound the trade-off function T(VZ,WZ) by h = max{T(V,W), g~ minus a vanishing correction}, where g~ is a Gaussian trade-off whose variance separation shrinks as d grows. The paper also gives Rényi-divergence interpretations and numerical estimates suggesting an O(1/d) privacy loss for a single released point. All Section 3 proofs are presented in the appendix; Section 4 relies on CLT-type approximations for products of Gaussian matrices.

Significance. If the positive results are fully established, the paper would provide a first rigorous theoretical demonstration that hidden-seed synthetic-data release can beat the post-processing bound in high dimension, with a composition-like dependence on the number of released points. The negative results in Section 3 are clean, complete, and potentially useful for privacy auditing. The use of f-DP trade-off functions and the Gaussian-product approximation (Li and Woodruff) is a sensible framework, and the authors are explicit about several limitations, including the fact that the O(1/d) Rényi rate is not a theorem. However, the positive contribution is currently not fully supported: Theorem 4.6 is stated without proof, the hypotheses of Theorem 4.5 are insufficient for the proof as written, and no finite-d threshold is certified where the lower bound strictly exceeds the post-processing baseline, because the constants are existential and set to 1 in the numerics without justification. The significance is therefore conditional on substantial repair of Section 4.

major comments (3)
  1. [§4.3, Theorem 4.5] The hypothesis d ≥ max{n,l} is not sufficient for the proof. The proof applies Theorem 4.4 to the product N_{-s}Z_{-s}, whose inner dimension is d-s, and Theorem 4.4 requires the inner dimension to be at least max{n,l}. Since s = rank(v) can be as large as n, the stated assumption does not guarantee d-s ≥ max{n,l}. The theorem should either assume d-s ≥ max{n,l}, or, if the intent is to use the worst-case s=n, this should be stated and the Gaussian target adjusted accordingly. This issue propagates to Theorem 4.6 and to the Discussion's claim that the analysis 'holds only when d ≥ max{n,l}'; the correct regime for the d-n scaling appears to be d ≥ n + max{n,l}.
  2. [§4.3, Theorem 4.6] No proof of Theorem 4.6 is provided anywhere in the paper or appendix. This theorem is the central multi-output positive result, and it is not an immediate corollary of Theorem 4.5 as stated: Theorem 4.5 is a one-sided total-variation bound for a single distribution, whereas Theorem 4.6 compares two Gaussian approximations and applies Lemma 4.2. While a proof can likely be assembled from Lemma 4.2 and Theorem 4.5, this must be written out explicitly, including the handling of the two different shifts v and w and the replacement of d-s by d-n. As submitted, the main claim of privacy amplification for l ≥ 1 rests on an unproved statement.
  3. [§4.2, §4.3, abstract] The paper never proves that the lower bound h exceeds the post-processing baseline T(V,W) for any finite d. The theorems provide the bound T(VZ,WZ) ≥ h, but the step h > T(V,W) is only illustrated numerically (Figure 1) and asserted asymptotically. The constants C and C' in Theorems 4.3 and 4.6 are existential (from Bally and Caramellino and from Li and Woodruff), and Appendix B.7 sets them to 1 without a computable bound. Consequently the abstract's claim that 'releasing a limited number of synthetic data points amplifies privacy beyond the model's inherent guarantees' is not quantitatively certified for any concrete d, and the paper should either prove an existence statement for a finite d0 (which would follow from pointwise convergence of g~ to 1-α if the constants were tracked) or explicitly state the asymptotic-only nature of the amplification claim in the abstract and conclusion.
minor comments (5)
  1. [§4.2, Lemma 4.3] The displayed factor √d in Lemma 4.3 is actually consistent with the appendix proof: the proof works with the un-scaled variables and derives TV(VZ, σz√(σθ²+∥v∥²/d)G) ≤ A/d, and total variation is invariant under the common rescaling x ↦ √d x, giving the displayed statement. The authors may wish to add one sentence noting this invariance to avoid apparent inconsistency.
  2. [§4.3, paragraph after Theorem 4.6] The sentence 'We note h this upper bound, with a slight abuse of notation' should read 'lower bound', since h lower-bounds T(VZ,WZ).
  3. [§4.3, Theorem 4.6] The definition C_{n,l,d} = C' n √(l/(d-n)) is not connected in the text to the rank parameter s of Theorem 4.5; if the intent is to use the worst-case s=n, this should be stated explicitly, together with the resulting condition d-n ≥ max{n,l}.
  4. [Figures 2 and 3, Appendix B.7] The captions in Figures 2 and 3 say 'estimation of Dα(VZ,WZ)', but the quantity computed is the Rényi bound lα(h) derived from the lower bound h on the trade-off function. This is an upper bound on the Rényi divergence, not an estimate of the true Dα(VZ,WZ); the text and captions should say 'estimated Rényi upper bound' to avoid overinterpretation of the plotted rates.
  5. [§4.1, Lemma 4.1] The displayed density for the generalized Laplace distribution has typographical issues (e.g., '2p πn(2σzσθ)n+d' and misplaced exponents); please fix the typesetting and verify the normalization.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the claimed privacy-amplification bounds are derived from external CLT and Gaussian-product approximation theorems, and the paper's own admissions that the Rényi-rate conclusions are only asymptotic or numerical are rigor gaps rather than self-referential derivation.

full rationale

Walking the derivation chain, the central lower bounds are not equivalent to their inputs by construction. The mechanism is MZ(v)=M(v)Z with hidden Gaussian Z, and the paper derives T(VZ,WZ) from (a) the post-processing baseline T(V,W), which is a lower bound already guaranteed and is used as a baseline rather than as the quantity to be derived, and (b) an approximation of VZ by a Gaussian whose variance shift is computed from the stated model (Section 4.2, Theorem 4.3; Section 4.3, Theorems 4.5 and 4.6). The approximation theorems are imported from Bally and Caramellino (2016) and Li and Woodruff (2021); these are external, machine-independent mathematical results, and the paper does not redefine them in terms of its target conclusion. No fitted parameter is renamed as a prediction: the constants C and C' are existential approximation constants, and although Appendix B.7 says 'We take C = 1 for our experiments,' that is an unjustified numerical choice, not a fitted model parameter being relabeled as a derived guarantee. The only self-citation, Cyffers and Bellet (2022), appears in related-work context and is not load-bearing. The manuscript does contain explicit limitations that reduce the strength of the headline claim but do not constitute circularity. Section 4.2 states: 'this observation alone does not suffice to conclude that D_alpha(VZ,WZ) = O(1/d)' and then says 'We thus numerically approximate D_alpha(VZ,WZ) using h,' so the advertised Rényi rate is supported only by estimating a lower-bound proxy, not by proving the actual divergence rate. Appendix B.7 sets C=1 without proof. The displayed Lemma 4.3 is internally inconsistent with its appendix proof (the left side carries an extra sqrt(d) while the proof derives the un-scaled version), and Theorem 4.6 is asserted without a visible proof. These are correctness and completeness concerns, not evidence that the derivation reduces to its own inputs. Because the positive results are computed from stated assumptions plus external theorems, and the admitted gaps concern whether the asymptotic approximation is quantitatively certified, the paper is self-contained against external benchmarks for the purposes of circularity analysis.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no fitted parameters and no new entities. Its results rest on external theorems about Gaussian products and CLTs, on the standard bounded-sensitivity assumptions of private linear regression, and on the threat model that random inputs Z remain hidden. The main gap is that all rate theorems are existential in their constants, and the numerical experiments instantiate C=1 without proof.

assumptions (5)
  • standard math Total-variation CLT for products of Gaussian matrices (Theorem 1 in Li and Woodruff 2021): TV(N Z, sqrt(d) G) <= C sqrt(nl/d).
    Used to prove Theorem 4.5, the main engine for the multi-output privacy amplification bound; invoked in Appendix B.6.
  • standard math Bally-Caramellino multivariate CLT in total variation with O(d^{-(r-1)/2}) rate.
    Invoked in Lemma 4.3 to approximate the univariate sum of i.i.d. products by a Gaussian with O(1/d) error.
  • domain assumption Bounded sensitivity of the ridge regression minimizer: ||x_i|| <= M_x, ||y_i|| <= M_y and sensitivity Delta = 2L/(m lambda) for output perturbation.
    Stated in Section 3.1 and used to normalize the shift ||v-w|| <= Delta throughout Section 4.
  • domain assumption The random inputs Z are i.i.d. Gaussian with variance sigma_z^2 and are not revealed to the adversary; the model M is also hidden and only VZ is released.
    Definition 4.1; this secrecy is the whole source of the positive amplification result and is structurally necessary (Section 3 shows its absence cancels amplification).
  • domain assumption Noisy gradient descent on the strongly convex ridge objective converges to its stationary Gaussian limit when eta(lambda + M_x^2/n) < 1, and this limit is used for the trade-off formulas.
    Proposition A.1 and A.2 in Appendix A.2-A.3 justify Prop 3.2 and 3.3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy Amplification Through Synthetic Data: Insights from Linear Regression." pith.science (2026). https://pith.science/paper/56PNJJF3

@misc{pith2026250605101,
  author       = {Pith},
  title        = {Pith review of: Privacy Amplification Through Synthetic Data: Insights from Linear Regression},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/56PNJJF3}},
  note         = {Machine review of arXiv:2506.05101}
}
read the original abstract

Synthetic data inherits the differential privacy guarantees of the model used to generate it. Additionally, synthetic data may benefit from privacy amplification when the generative model is kept hidden. While empirical studies suggest this phenomenon, a rigorous theoretical understanding is still lacking. In this paper, we investigate this question through the well-understood framework of linear regression. First, we establish negative results showing that if an adversary controls the seed of the generative model, a single synthetic data point can leak as much information as releasing the model itself. Conversely, we show that when synthetic data is generated from random inputs, releasing a limited number of synthetic data points amplifies privacy beyond the model's inherent guarantees. We believe our findings in linear regression can serve as a foundation for deriving more general bounds in the future.

Figures

Figures reproduced from arXiv: 2506.05101 by the authors.

Figure 1
Figure 1. Comparison of the lower bound h on T(V Z, W Z) to T(V, W) and G˜Λ(σθ,d,∆) α + C d  − C d for C = 1, ∆ = 1, σθ = 1, d = 12. This comparison with the post-processing upper bound Dα(V, W) suggests a privacy amplification of order O(1/d) in the asymptotic regime. However, this observation alone does not suffice to conclude that Dα(V Z, W Z) = O(1/d). The difficulty arises from the fact that the O(1/d) conver￾gence rate… view at source ↗
Figure 2
Figure 2. Privacy amplification in Rényi DP when releasing a sin￾gle point: estimation of Dα(V Z, W Z) as a function of log(d) for different values of ∆. 4.3. Releasing Multiple Points We now consider the more general case where l ≥ 1 syn￾thetic data points in dimension n ≥ 1 are released. In this case, the adversary can leverage correlations between the different outputs to better reconstruct V or W and thus yield higher pri… view at source ↗
Figure 3
Figure 3. Privacy amplification in Rényi DP when releasing mul￾tiple points (l = 10, n = 1): estimation of Dα(V Z, W Z) as a function of log(d) for different values of ∆. Discussion. When d is sufficiently large, the privacy loss incurred by releasing nl synthetic data points is lower than that of directly releasing the model parameters. The result￾ing guarantees are comparable in order to those obtained by training the model… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 35 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    B., Mironov, I., Talwar, K., and Zhang, L

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. (2016). Deep learning with differential privacy. In CCS

    work page 2016

  3. [3]

    Altschuler, J. M. and Talwar, K. (2022). Privacy of noisy stochastic gradient descent: More iterations without more privacy loss. In NeurIPS

    work page 2022

  4. [4]

    what do you want from theory alone?

    Annamalai, M. S. M. S., Ganev, G., and Cristofaro, E. D. (2024). "what do you want from theory alone?" experimenting with tight auditing of differentially private synthetic data generation. In USENIX Security 24 , pages 4855--4871

    work page 2024

  5. [5]

    Balle, B., Barthe, G., and Gaboardi, M. (2018). Privacy amplification by subsampling: Tight analyses via couplings and divergences. In Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., and Garnett, R., editors, Advances in Neural Information Processing Systems , volume 31. Curran Associates, Inc

    work page 2018

  6. [6]

    and Caramellino, L

    Bally, V. and Caramellino, L. (2016). Asymptotic development for the CLT in total variation distance . Bernoulli , 22(4):2442 -- 2485

    work page 2016

  7. [7]

    D., and Thakurta, A

    Bassily, R., Smith, A. D., and Thakurta, A. (2014). Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Bounds . In FOCS

    work page 2014

  8. [8]

    Bie, A., Kamath, G., and Zhang, G. (2023). Private GAN s, revisited. Transactions on Machine Learning Research . Survey Certification

    work page 2023

Show all 40 references
  1. [9]

    Chaudhuri, K., Monteleoni, C., and Sarwate, A. D. (2011). Differentially private empirical risk minimization. Journal of Machine Learning Research , 12:1069–1109

    2011

  2. [10]

    and Bellet, A

    Cyffers, E. and Bellet, A. (2022). Privacy amplification by decentralization. In AISTATS

    2022

  3. [11]

    Dockhorn, T., Cao, T., Vahdat, A., and Kreis, K. (2023). Differentially Private Diffusion Models . Transactions on Machine Learning Research

    2023

  4. [12]

    Dohmatob, E., Feng, Y., and Kempe, J. (2024). Model collapse demystified: The case of regression. In Advances in Neural Information Processing Systems , volume 37, pages 46979--47013. Curran Associates, Inc

    2024

  5. [13]

    Dong, J., Roth, A., and Su, W. J. (2022). Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology , 84(1):3--37

    2022

  6. [14]

    Durmus, A., Majewski, S., and Miasojedow, B. (2019). Analysis of langevin monte carlo via convex optimization. Journal of Machine Learning Research , 20(73):1--46

    2019

  7. [15]

    and Roth, A

    Dwork, C. and Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9(3–4):211–407

    2014

  8. [16]

    Erlingsson, U., Feldman, V., Mironov, I., Raghunathan, A., Talwar, K., and Thakurta, A. (2019). Amplification by shuffling: From local to central differential privacy via anonymity. In SODA

    2019

  9. [17]

    Feldman, V., Mironov, I., Talwar, K., and Thakurta, A. (2018). Privacy amplification by iteration. 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS) , pages 521--532

    2018

  10. [18]

    A., Yang, D., Donoho, D

    Gerstgrasser, M., Schaeffer, R., Dey, A., Rafailov, R., Sleight, H., Hughes, J., Korbak, T., Agrawal, R., Pai, D., Gromov, A., Roberts, D. A., Yang, D., Donoho, D. L., and Koyejo, S. (2024). Is model collapse inevitable? breaking the curse of recursion by accumulating real and...

    2024 arXiv

  11. [19]

    Ghazi, B., Golowich, N., Kumar, R., Manurangsi, P., and Zhang, C. (2021). Deep learning with label differential privacy. In NeurIPS

    2021

  12. [20]

    Hastie, T., Montanari, A., Rosset, S., and Tibshirani, R. J. (2022). Surprises in high-dimensional ridgeless least squares interpolation . The Annals of Statistics , 50(2):949 -- 986

    2022

  13. [21]

    M., Ge, C., Ding, B., Forsyth, D., Li, B., and Song, D

    Hu, Y., Wu, F., Li, Q., Long, Y., Garrido, G. M., Ge, C., Ding, B., Forsyth, D., Li, B., and Song, D. (2024). SoK: Privacy-Preserving Data Synthesis . In 2024 IEEE Symposium on Security and Privacy (SP) , pages 4696--4713, Los Alamitos, CA, USA. IEEE Computer Society

    2024

  14. [22]

    Jordon, J., Yoon, J., and van der Schaar, M. (2019). Pate-gan: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations (ICLR)

    2019

  15. [23]

    D., and Thakurta, A

    Kifer, D., Smith, A. D., and Thakurta, A. (2012). Private convex optimization for empirical risk minimization with applications to high-dimensional regression. In COLT , volume 23, pages 25.1--25.40

    2012

  16. [24]

    Lee, J., Kim, M., Jeong, Y., and Ro, Y. (2022). Differentially private normalizing flows for synthetic tabular data generation. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 36, pages 7345--7353

    2022

  17. [25]

    and Romano, J

    Lehmann, E. and Romano, J. (2006). Testing Statistical Hypotheses . Springer Texts in Statistics. Springer New York

    2006

  18. [26]

    and Woodruff, D

    Li, Y. and Woodruff, D. P. (2021). The Product of Gaussian Matrices Is Close to Gaussian . In Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques (APPROX/RANDOM 2021) , volume 207 of Leibniz International Proceedings in Informatics (LIPIcs) ...

    2021

  19. [27]

    and Razaviyayn, M

    Lowy, A. and Razaviyayn, M. (2024). Output perturbation for differentially private convex optimization: Faster and more general. arXiv:2102.04704

    2024 arXiv

  20. [28]

    Mattei, P.-A. (2017). Multiplying a gaussian matrix by a gaussian vector. Statistics & Probability Letters , 128(C):67--70

    2017

  21. [29]

    McKenna, R., Miklau, G., and Sheldon, D. (2021). Winning the nist contest: A scalable and general approach to differentially private synthetic data. Journal of Privacy and Confidentiality , 11(3)

    2021

  22. [30]

    McKenna, R., Sheldon, D., and Miklau, G. (2019). Graphical-model based estimation and inference for differential privacy. In Proceedings of the 36th International Conference on Machine Learning (ICML) , pages 4435--4444

    2019

  23. [31]

    Mironov, I. (2017). Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF) , pages 263--275

    2017

  24. [32]

    Neunhoeffer, M., Latner, J., and Drechsler, J. (2024). On the formal privacy guarantees of synthetic data. In Data Privacy Protection and the Conduct of Applied Research: Methods, Approaches and their Consequences . National Bureau of Economic Research

    2024

  25. [33]

    J., and Talwar, K

    Papernot, N., Abadi, M., Erlingsson, U., Goodfellow, I. J., and Talwar, K. (2017). Semi-supervised knowledge transfer for deep learning from private training data. In ICLR

    2017

  26. [34]

    Raič, M. (2019). A multivariate berry–esseen theorem with explicit constants. Bernoulli , 25(4A)

    2019

  27. [35]

    Redberg, R., Koskela, A., and Wang, Y. (2023). Improving the privacy and practicality of objective perturbation for differentially private linear learners. In NeurIPS

    2023

  28. [36]

    Song, S., Chaudhuri, K., and Sarwate, A. D. (2013). Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing

    2013

  29. [37]

    Wang, Y.-X. (2018). Revisiting differentially private linear regression: optimal and adaptive prediction & estimation in unbounded domain. In Conference on Uncertainty in Artificial Intelligence

    2018

  30. [38]

    Xie, L., Lin, K., Wang, S., Wang, F., and Zhou, J. (2018). Differentially private generative adversarial network. arXiv:1802.06739

    2018 arXiv

  31. [39]

    M., Srivastava, D., and Xiao, X

    Zhang, J., Cormode, G., Procopiuc, C. M., Srivastava, D., and Xiao, X. (2017a). Privbayes: Private data release via bayesian networks. ACM Trans. Database Syst. , 42(4)

    2017

  32. [40]

    Zhang, J., Zheng, K., Mou, W., and Wang, L. (2017b). Efficient private ERM for smooth objectives. In IJCAI

    2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.