Private Training & Data Generation by Clustering Embeddings

Alessandro Epasto; Felix Zhou; Samson Zhou; Vahab Mirrokni; Vincent Cohen-Addad

REVIEW 3 major objections 5 minor 8 references

Private Training & Data Generation by Clustering Embeddings

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By clustering CLIP embeddings, fitting a DP Gaussian mixture, and training a two-layer network on synthetic samples, the paper reaches 97.0% on CIFAR-10 and 93.1% on CAMELYON17 at equal privacy budgets, beating DP-SGD.

desk verdict New DP synthetic-data pipeline with strong empirical results, but the unaccounted hyperparameter search breaks the stated epsilon-DP guarantee for the SOTA claims. read the letter →

arxiv 2506.16661 v1 pith:Z26GJP77 submitted 2025-06-20 cs.LG cs.CRstat.ML

Felix Zhou , Samson Zhou , Vahab Mirrokni , Alessandro Epasto , Vincent Cohen-Addad This is my paper · ORCID

classification cs.LGcs.CRstat.ML

keywords differentialprivacysyntheticdatagenerationGaussianmixturemodelDPk-meansclusteringpretrainedembeddingsprivateimageclassificationCLIPpost-processing

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a differentially private pipeline that converts a sensitive image set into a private synthetic dataset by clustering the images' embeddings and fitting a Gaussian Mixture Model (GMM) within each cluster. The claimed payoff is that a simple two-layer neural network trained on the released synthetic embeddings becomes a state-of-the-art private classifier: 97.0% on CIFAR-10 at $\varepsilon=8$ versus the DP-SGD baseline's 96.6%, and 93.1% on CAMELYON17 at $\varepsilon=10$ versus 91.1%. The same embeddings can be decoded into images, and classifiers trained on those images are competitive with DP synthetic-image baselines on CIFAR-10. Because post-processing of a DP output leaks no additional privacy, the synthetic dataset can be inspected and reused for arbitrary non-private training. The paper also proves an $(\varepsilon,\delta)$-DP guarantee and a separation-based bound showing the GMM parameters are recoverable.

What carries the argument

The load-bearing object is a privately estimated Gaussian Mixture Model in the embedding space of a public image encoder: a GMM is a weighted sum $\sum_j w_j \mathcal{N}(\mu_j,\Sigma_j)$ of Gaussian components. Algorithm 1 computes $k$ cluster centers with a DP $k$-means subroutine, privately estimates each cluster's mean and diagonal covariance, and samples synthetic embeddings from the resulting mixture; unlimited sampling is free because it is post-processing. An optional private vote-based filter prunes generated embeddings or images using noisy nearest-neighbor counts from the original data. The analysis rests on two identities: a separation condition on the true mixture lets an approximate $k$-means solution classify points by nearest center, and a Wasserstein bound between two close GMMs converts parameter error into loss error.

What would settle it

Swap a single training image, run the full pipeline including the grid search over $k$ and clipping radii, and test whether an auditor can distinguish the two released synthetic datasets at a rate exceeding the $(\varepsilon,\delta)$ bound; if so, the DP claim for the full procedure fails. A cheaper check is to treat the grid search itself as a data-dependent mechanism, compose its privacy cost with the five $\varepsilon/5$ subroutines, and verify that the total stays within the reported $\varepsilon$.

Watch

Extended reading notes

Core claim

The central claim is that private training can be reframed as private distribution estimation: rather than perturbing gradients inside a neural-network training loop, estimate a GMM over the embedding of the sensitive data and release synthetic samples from it. The authors prove the pipeline is $(\varepsilon,\delta)$-DP by composing five $\varepsilon/5$ mechanisms (Theorem G.1) and that, when the embedding distribution is a well-separated GMM, the weight, mean, and covariance estimates are accurate to $\alpha$ (Theorem G.7); a Wasserstein-distance argument then shows every $(\lambda,z)$-Hölder continuous loss is preserved up to $\lambda\alpha$ (Theorem G.11). Empirically, the two-layer MLP on synthetic embeddings beats every compared DP training method on CIFAR-10 and CAMELYON17 at equal privacy budgets and matches SOTA on CIFAR-100, which the authors present as surprising because DP synthetic-data generation is a more general task than task-specific DP training.

Load-bearing premise

The strict $(\varepsilon,\delta)$-DP guarantee for the reported numbers assumes that hyperparameters—the number of clusters $k$, the covariance clipping radius, and the vote threshold—can be chosen by grid search on the private data without charging any privacy loss, an assumption the paper states explicitly in Section 3.1.

Editorial extensions

If this is right

At equal privacy budgets, a non-private two-layer network trained on DP synthetic embeddings can outperform DP-SGD fine-tuning, so DP synthetic data need not be a strictly weaker substitute for direct private training.
The modular encoder/decoder design means the pipeline should transfer to other data modalities whenever a public embedding space with well-clustered class structure is available.
Because the released synthetic dataset is itself the private artifact, downstream users can train arbitrary numbers of models, inspect the data, and debug without accumulating further privacy loss.
The near-linear running time of the subroutines makes the method scalable to datasets with hundreds of thousands of images, as demonstrated on CAMELYON17.
Synthetic images retain classification utility at low privacy budgets even as visual fidelity degrades, suggesting the decoded images carry task-relevant signal despite added noise.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves open the possibility of a privacy-aware hyperparameter search whose budget is included in the composition; if analysis showed this only costs a small amount of $\varepsilon$, the current results would stand on firmer privacy ground.
One direct testable extension is to swap the public encoder for another self-supervised model and measure cluster separability on standard datasets; the theory predicts the method's utility tracks how close the embedding distribution is to a well-separated GMM.
Applying the same cluster-then-estimate scheme to text or tabular data with a suitable public embedding is a natural transfer, since the utility guarantee depends only on separation and Hölder continuity rather than on images.
A two-stage recipe—train on DP synthetic embeddings, then run a small DP-SGD fine-tuning step on top—would compose both privacy costs and might push accuracy beyond either method alone; the paper does not explore this.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this one if you're tracking DP synthetic data. The pipeline is genuinely new: privately cluster CLIP embeddings, fit a private GMM per cluster, sample synthetic embeddings, and optionally filter with private votes. It scales, it's modular, and the empirical results are reported carefully. The authors deserve credit for seeing that a simple two-layer MLP on these synthetic embeddings beats DP-SGD fine-tuning on CIFAR-10 and CAMELYON17 at the same nominal epsilon.

But the paper's own Section 3.1 admits that hyperparameter search is not charged to the privacy budget, and Appendix C.2 describes a grid search over k and covariance clipping radius—25 combinations. If that search is guided by private data—and the paper does not say it isn't—then publishing the best run is an adaptive composition of 25 (epsilon,delta)-DP mechanisms. The effective epsilon is at least 25epsilon, not epsilon, and the equal-epsilon comparison to DP-SGD is invalid. This isn't a nitpick; it's the load-bearing assumption behind the SOTA claim. The fix is straightforward: tune on a public validation set, use a private selection mechanism and account for it, or report the composed cost. The paper cites prior work that does the same, which makes it a community norm, but that doesn't make it correct.

The theory is honest but doesn't cover the practice. Theorem G.7 needs a well-separated GMM and a (zeta,eta)-approximate k-means; CLIP embeddings of CIFAR-10 likely aren't a well-separated GMM, and the implemented DP k-means isn't shown to satisfy that approximation guarantee. That's a theory-practice gap, not a fatal flaw, but it means the formal results don't justify the empirical setting. Minor: the pseudocode's DP-FilterImage consumes privacy, but the experiments seem to use non-private NIQE/PIQE filters; the paper should say which one is used and what budget it consumes.

All told: this deserves a serious referee. The core idea is good, the experiments are extensive and reproducible, and the privacy gap is fixable. I'd engage with it expecting a major revision that either removes the SOTA framing or properly accounts for tuning.

Referee Report

3 major / 5 minor

Summary. The paper proposes a differentially private synthetic data generation pipeline: embed images with a pre-trained CLIP encoder, run DP k-means to cluster the embeddings, estimate per-cluster means and (diagonal) covariances with DP Gaussian estimation, sample from the resulting GMM, optionally filter the generated embeddings/images, and train a non-private classifier on the synthetic embeddings or decode them into images. The central empirical claims are state-of-the-art private classification: 97.0% on CIFAR-10 at ε=8, 80.5% on CIFAR-100, and 93.1% on CAMELYON17 at ε=10 (Table 1), together with a formal (ε,δ)-DP guarantee (Theorem G.1) and utility theorems for well-separated GMMs (Theorems G.7 and G.11).

Significance. If the privacy accounting were correct, the paper would make a valuable contribution: it shows that a simple clustering+GMM pipeline in a pre-trained embedding space can rival DP-SGD on standard benchmarks while offering the flexibility of synthetic data release and linear-time subroutines. The experimental reporting is careful (3 runs with means and standard deviations), the method is modular, and the theoretical analysis follows a clean cluster-then-learn template. However, the headline privacy guarantee is compromised by unaccounted data-dependent hyperparameter selection, and the utility analysis does not match the implemented covariance estimator; these issues must be resolved before the significance claims can be accepted.

major comments (3)

[Section 3.1, Appendix C.2, Theorem G.1] The privacy guarantee asserted for the reported results does not account for the grid search over k ∈ {1,2,4,8,16} and the covariance clipping radius ∈ {2.0,4.0,6.0,8.0,10.0} performed on the private data (Appendix C.2), and Section 3.1 states explicitly that 'we do not account for hyperparameter search as part of the privacy budget.' Publishing the best of 25 (ε,δ)-DP pipeline runs is an adaptive composition that costs at least 25ε and 25δ under basic composition (Theorem D.9), not ε and δ, unless a separate private selection mechanism is used. Therefore Theorem G.1, as instantiated in the experiments, does not provide the claimed (ε,δ)-DP guarantee for the released synthetic data or the classifier, and the comparisons to DP-SGD and other baselines at equal ε in Tables 1–2 and Figure 2 are not on equal footing. This should be fixed by choosing all hyperparameters on public data, by using a private selection mechanism and accounting for its cost, or by reporting the privacy loss of the full selection procedure.
[Section 2.2 vs. Theorems G.7 and G.11] The utility analysis assumes DP-Mean and DP-Covariance are instantiated with the general-covariance estimator of Theorem E.1, whose sample complexity contains d^2 terms, but the experiments use diagonal covariance estimates ('we empirically noticed that diagonal covariances yield the best performance', Section 2.2). Since the implemented estimator differs from the analyzed one, the formal GMM recovery guarantee (Theorem G.7) does not apply to the experimental configuration. The authors should either analyze the diagonal-covariance estimator (using, e.g., the diagonal case of Theorem E.2) or implement the general estimator.
[Lemma G.5 and Theorem G.7] The theory requires DP-Cluster to be a (ζ,η)-approximate k-means algorithm with η = o(ζ σ^2 d N), and the separation condition Δ ≥ 3σ(√d + √(2 log(3N/β)) + √(12ζ d / w_min)) is stated as an assumption on the data. The paper does not demonstrate that the Chang-Kamath DP k-means implementation used in the experiments satisfies the approximation condition with the stated η, nor that the CLIP embeddings of CIFAR-10/CIFAR-100/CAMELYON17 satisfy the separation condition. Consequently, the abstract's claim that the method 'provably learns a GMM under separation conditions' is not connected to the empirical pipeline; this gap should be stated explicitly, and the dependence of the empirical claims on these unverified assumptions acknowledged.

minor comments (5)

[Section 3.1] The statement that hyperparameter search is not charged to the privacy budget is a major caveat and should be presented in the main text at the first mention of the privacy guarantee, rather than as a single sentence in the experimental setup.
[Section 2.2 and Appendix C.2] The vote threshold of 6.0 for DP-FilterEmbedding is introduced as a hyperparameter, but Appendix C.2 reports only the grid over k and the clipping radius; please clarify whether this threshold and any other hyperparameters were also selected on private data.
[Section 2.3 and Appendix C.4] The evaluation of synthetic images encodes and decodes the original test set to match the distributional shift introduced by the decoder, but this preprocessing of the test set is only described in the appendix; it should be stated in Section 3.3 so readers can interpret the reported accuracies correctly.
[Theorem G.1 and Algorithm 1] The proof of Theorem G.1 applies basic composition to five subroutines, but DP-FilterEmbedding and DP-FilterImage are optional in Algorithm 1; the theorem should state which configuration (with or without filters) the privacy guarantee covers.
[Equation (1)] The brace annotations below the three terms in Equation (1) appear visually misaligned in the typeset version; please fix the typesetting so that the labels 'training error', 'synthetic data generation error', and 'estimation error' clearly refer to the intended terms.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the GMM utility theorems are conditional reductions and the SOTA numbers are external benchmarks; the main caveat is an omitted privacy cost for grid-search tuning, a correctness gap rather than a circular step.

full rationale

The paper's derivation chain is not circular. Algorithm 1 combines DP-Cluster, DP-Mean, DP-Covariance, and private filters; Theorem G.1 is an ordinary composition argument over five ε/5-DP subroutines, and Theorems G.6/G.7 are conditional reductions: if DP-Cluster is an (ε,δ)-DP (ζ,η)-approximate k-means algorithm and the embeddings form a well-separated GMM, then the output parameter estimates are close in the stated norms. No equation in the chain is defined in terms of the quantity it is supposed to prove, and no fitted parameter is relabeled as a prediction: the 97.0% CIFAR-10 and 93.1% CAMELYON17 accuracies are measured against external DP-SGD and DP-Diffusion baselines, not derived from the GMM estimates. The self-citations [CEL+22; CEM+22] supply the near-linear DP-clustering runtime used in Theorem G.2; these are published, independent algorithmic results whose assumptions do not include the present target result, so they are real evidence rather than a circularity. The main caveat is the one explicitly admitted in Section 3.1: grid search over k ∈ {1,2,4,8,16} and covariance clipping radius ∈ {2.0,...,10.0} is performed on the private data and 'we do not account for hyperparameter search as part of the privacy budget.' By basic composition, publishing the best of 25 runs is not covered by the single-run (ε,δ) bound of Theorem G.1, so the stated privacy level for the reported SOTA numbers is not supported. That is a privacy-accounting validity gap, not a circular step: the empirical accuracy numbers do not reduce by construction to the GMM parameter estimates, and the theory does not define its output in terms of its input. Correctness risk should be recorded separately; circularity score remains 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claims rest on several assumptions: the embedding distribution is a well-separated GMM for the theory, the loss is Holder continuous, the black-box DP k-means satisfies a strong approximation guarantee, and public models (CLIP, Stable Diffusion) are treated as free public data. The empirical pipeline also relies on several hand-tuned hyperparameters that are not privacy-accounted.

free parameters (4)

number of clusters k = grid search over {1,2,4,8,16}
Tuned on the private benchmark data to maximize accuracy; not accounted in privacy budget (Section 3.1, C.2).
intra-cluster clipping radius for covariance estimation = grid search over {2.0,4.0,6.0,8.0,10.0}
Tuned on private data; not included in the privacy budget (Section C.2).
DP-FilterEmbedding vote threshold = 6.0
Keeps generated embeddings with noisy vote at least 6.0; hand-set and not privacy-accounted (Section C.2).
NIQE/PIQE image quality thresholds = 20.0
Filters decoded images; data-independent but threshold chosen by the authors (Section C.2).

assumptions (5)

domain assumption The data distribution in the embedding space is a well-separated Gaussian mixture model (separation condition in Theorem G.7).
Required for the theoretical GMM learning guarantee; not verified for CLIP embeddings of CIFAR-10 or CAMELYON17, as the authors acknowledge in Section 2.
domain assumption The loss function is (lambda,z)-Holder continuous for z in [1,2].
Used in Theorem 1.2 and Theorem G.11; prior work (ACH+24) provides experimental support, but it is not measured in this paper.
ad hoc to paper There exists an (epsilon,delta)-DP (zeta,eta)-approximate k-means algorithm with eta=o(zeta sigma^2 d N).
Assumed in Theorem G.6 and G.7; the practical DP k-means used in experiments (Chang and Kamath 2021) is not shown to satisfy this approximation guarantee.
domain assumption CLIP and Stable Diffusion are public, non-private resources that can be used freely.
The method depends on these public models; their training data may overlap with benchmark distributions, a point the paper does not discuss.
standard math DP composition rules (basic and parallel composition) apply to the five subroutines in Algorithm 1.
Standard DP results (Theorems D.9 and D.10); no issue.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Private Training & Data Generation by Clustering Embeddings." pith.science (2026). https://pith.science/paper/Z26GJP77

@misc{pith2026250616661,
  author       = {Pith},
  title        = {Pith review of: Private Training & Data Generation by Clustering Embeddings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z26GJP77}},
  note         = {Machine review of arXiv:2506.16661}
}

read the original abstract

Deep neural networks often use large, high-quality datasets to achieve high performance on many machine learning tasks. When training involves potentially sensitive data, this process can raise privacy concerns, as large models have been shown to unintentionally memorize and reveal sensitive information, including reconstructing entire training samples. Differential privacy (DP) provides a robust framework for protecting individual data and in particular, a new approach to privately training deep neural networks is to approximate the input dataset with a privately generated synthetic dataset, before any subsequent training algorithm. We introduce a novel principled method for DP synthetic image embedding generation, based on fitting a Gaussian Mixture Model (GMM) in an appropriate embedding space using DP clustering. Our method provably learns a GMM under separation conditions. Empirically, a simple two-layer neural network trained on synthetically generated embeddings achieves state-of-the-art (SOTA) classification accuracy on standard benchmark datasets. Additionally, we demonstrate that our method can generate realistic synthetic images that achieve downstream classification accuracy comparable to SOTA methods. Our method is quite general, as the encoder and decoder modules can be freely substituted to suit different tasks. It is also highly scalable, consisting only of subroutines that scale linearly with the number of samples and/or can be implemented efficiently in distributed systems.

Figures

Figures reproduced from arXiv: 2506.16661 by the authors.

**Figure 2.** Downstream classification accuracy on 50,000 generated CIFAR-10 images at various levels [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

**Figure 3.** CIFAR-10 synthetic images at ε = 8, δ = 10−5 . Each row corresponds to a different class. The left-most columns are synthetic images while the right-most columns are original images. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: CIFAR-10 synthetic images at ε = 4, δ = 10−5 . Each row corresponds to a different class. The left-most columns are synthetic images while the right-most columns are original images [PITH_FULL_IMAGE:figures/full_fig_p025_4.png]

**Figure 5.** Figure 5: CIFAR-10 synthetic images at ε = 2, δ = 10−5 . Each row corresponds to a different class. The left-most columns are synthetic images while the right-most columns are original images. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_5.png]

**Figure 6.** Figure 6: CIFAR-10 synthetic images at (ε = 1, δ = 10−5 ). Each row corresponds to a different class. The left-most columns are synthetic images while the right-most columns are original images. B Related Work The areas most related to our work are that of data selection, (non-p…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

8 extracted references · 2 canonical work pages

[1]

Clustering and Median Aggregation Improve Differentially Private Inference

[AAB+25] Kareem Amin, Salman Avestimehr, Sara Babakniya, Alex Bie, Weiwei Kong, Na- talia Ponomareva, and Umar Syed. “Clustering and Median Aggregation Improve Differentially Private Inference”. In:arXiv preprint arXiv:2506.04566(2025) (cit. on p. 2). [AAK21] Ishaq Aden-Ali, Hassan Ashtiani, and Gautam Kamath. “On the Sample Complexity of Privately Learni...

arXiv 2025
[8]

Differentially Private Synthetic Data via Foundation Model APIs 2: Text

JMLR Workshop and Conference Proceedings. 2016, pp. 478–487 (cit. on p. 3). [XLB+24] Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A. Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, Bo Li, and Sergey Yekhanin. “Differentially Private Synthetic Data via Foundation Model APIs 2: Text”. In:Forty- first International Con...

arXiv 2014
[20]

Scalable Differentially Private Clustering via Hierarchically Separated Trees

2018 (cit. on p. 2). [CEL+22] Vincent Cohen-Addad, Alessandro Epasto, Silvio Lattanzi, Vahab Mirrokni, An- dres Muñoz Medina, David Saulpic, Chris Schwiegelshohn, and Sergei Vassilvitskii. “Scalable Differentially Private Clustering via Hierarchically Separated Trees”. In: KDD ’22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 202...

arXiv 2024
[48]

Unsupervised Deep Embedding for Clustering Analysis

Cambridge university press, 2019 (cit. on p. 4). [XGF16] Junyuan Xie, Ross B. Girshick, and Ali Farhadi. “Unsupervised Deep Embedding for Clustering Analysis”. In:Proceedings of the 33nd International Conference on Machine Learning, ICML. Vol

work page 2019
[2000]

NIMA: Neural Image Assessment

Ed. by Craig Boutilier and Moisés Goldszmidt. Morgan Kaufmann, 2000, pp. 152–159. url: https://dslpitt.org/uai/displayArticleDetails.jsp?mmnu=1%5C&smnu= 2%5C&article%5C_id=18%5C&proceeding%5C_id=16 (cit. on p. 6). [EM18] Hossein Talebi Esfandarani and Peyman Milanfar. “NIMA: Neural Image Assessment”. In: IEEE Trans. Image Process.27.8 (2018), pp. 3998–401...

arXiv 2018
[2010]

Harnessing large-language models to generate private synthetic text

Ed. by Leonard J. Schulman. ACM, 2010, pp. 553–562.doi: 10.1145/1806689.1806765 . url: https://doi.org/10.1145/1806689.1806765 (cit. on p. 6). [KPS+23] Alexey Kurakin, Natalia Ponomareva, Umar Syed, Liam MacDermed, and Andreas Terzis. “Harnessing large-language models to generate private synthetic text”. In: arXiv preprint arXiv:2306.01684(2023) (cit. on ...

arXiv 2023
[2014]

Pre-trained Perceptual Features Improve Differentially Private Image Generation

IEEE Computer Society, 2014, pp. 1532–1537 (cit. on p. 3). 16 [HJS+23] Frederik Harder, Milad Jalali, Danica J. Sutherland, and Mijung Park. “Pre-trained Perceptual Features Improve Differentially Private Image Generation”. In:Trans. Mach. Learn. Res.2023 (2023) (cit. on pp. 2, 5, 11). [HK13] Daniel Hsu and Sham M Kakade. “Learning mixtures of spherical g...

work page 2023
[2019]

Gaussian mixture models

ACM, 2019, pp. 65–72 (cit. on p. 3). [Rey+09] Douglas A Reynolds et al. “Gaussian mixture models.” In:Encyclopedia of biometrics 741.659-663 (2009), p. 3 (cit. on pp. 6, 29). [RKH+21] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ily...

arXiv 2009

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Clustering and Median Aggregation Improve Differentially Private Inference

[AAB+25] Kareem Amin, Salman Avestimehr, Sara Babakniya, Alex Bie, Weiwei Kong, Na- talia Ponomareva, and Umar Syed. “Clustering and Median Aggregation Improve Differentially Private Inference”. In:arXiv preprint arXiv:2506.04566(2025) (cit. on p. 2). [AAK21] Ishaq Aden-Ali, Hassan Ashtiani, and Gautam Kamath. “On the Sample Complexity of Privately Learni...

arXiv 2025

[2] [8]

Differentially Private Synthetic Data via Foundation Model APIs 2: Text

JMLR Workshop and Conference Proceedings. 2016, pp. 478–487 (cit. on p. 3). [XLB+24] Chulin Xie, Zinan Lin, Arturs Backurs, Sivakanth Gopi, Da Yu, Huseyin A. Inan, Harsha Nori, Haotian Jiang, Huishuai Zhang, Yin Tat Lee, Bo Li, and Sergey Yekhanin. “Differentially Private Synthetic Data via Foundation Model APIs 2: Text”. In:Forty- first International Con...

arXiv 2014

[3] [20]

Scalable Differentially Private Clustering via Hierarchically Separated Trees

2018 (cit. on p. 2). [CEL+22] Vincent Cohen-Addad, Alessandro Epasto, Silvio Lattanzi, Vahab Mirrokni, An- dres Muñoz Medina, David Saulpic, Chris Schwiegelshohn, and Sergei Vassilvitskii. “Scalable Differentially Private Clustering via Hierarchically Separated Trees”. In: KDD ’22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 202...

arXiv 2024

[4] [48]

Unsupervised Deep Embedding for Clustering Analysis

Cambridge university press, 2019 (cit. on p. 4). [XGF16] Junyuan Xie, Ross B. Girshick, and Ali Farhadi. “Unsupervised Deep Embedding for Clustering Analysis”. In:Proceedings of the 33nd International Conference on Machine Learning, ICML. Vol

work page 2019

[5] [2000]

NIMA: Neural Image Assessment

Ed. by Craig Boutilier and Moisés Goldszmidt. Morgan Kaufmann, 2000, pp. 152–159. url: https://dslpitt.org/uai/displayArticleDetails.jsp?mmnu=1%5C&smnu= 2%5C&article%5C_id=18%5C&proceeding%5C_id=16 (cit. on p. 6). [EM18] Hossein Talebi Esfandarani and Peyman Milanfar. “NIMA: Neural Image Assessment”. In: IEEE Trans. Image Process.27.8 (2018), pp. 3998–401...

arXiv 2018

[6] [2010]

Harnessing large-language models to generate private synthetic text

Ed. by Leonard J. Schulman. ACM, 2010, pp. 553–562.doi: 10.1145/1806689.1806765 . url: https://doi.org/10.1145/1806689.1806765 (cit. on p. 6). [KPS+23] Alexey Kurakin, Natalia Ponomareva, Umar Syed, Liam MacDermed, and Andreas Terzis. “Harnessing large-language models to generate private synthetic text”. In: arXiv preprint arXiv:2306.01684(2023) (cit. on ...

arXiv 2023

[7] [2014]

Pre-trained Perceptual Features Improve Differentially Private Image Generation

IEEE Computer Society, 2014, pp. 1532–1537 (cit. on p. 3). 16 [HJS+23] Frederik Harder, Milad Jalali, Danica J. Sutherland, and Mijung Park. “Pre-trained Perceptual Features Improve Differentially Private Image Generation”. In:Trans. Mach. Learn. Res.2023 (2023) (cit. on pp. 2, 5, 11). [HK13] Daniel Hsu and Sham M Kakade. “Learning mixtures of spherical g...

work page 2023

[8] [2019]

Gaussian mixture models

ACM, 2019, pp. 65–72 (cit. on p. 3). [Rey+09] Douglas A Reynolds et al. “Gaussian mixture models.” In:Encyclopedia of biometrics 741.659-663 (2009), p. 3 (cit. on pp. 6, 29). [RKH+21] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ily...

arXiv 2009