Pith. sign in

REVIEW 3 major objections 4 minor 29 references

Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Training the coarse and cleaning stages of a private diffusion model on synthetic images leaves only the context stage to spend the privacy budget; this scheme (DP-SynGen) improves generation quality, especially at small ε.

desk verdict Clever stage-splitting idea, but the theory behind it bounds the wrong quantity and the experiments don't support the abstract's claims. read the letter →

arxiv 2412.09842 v1 pith:FU66QOHU submitted 2024-12-13 cs.LG cs.CV

Yujin Choi , Jinseong Park , Junyoung Byun , Jaewook Lee This is my paper · ORCID
classification cs.LGcs.CV
keywords differentialprivacydiffusionmodelsDP-SynGenprogrammaticallygeneratedsyntheticdataimagegenerationnoisemultiplicitydenoisingstagesSNRthresholding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Diffusion models trained under differential privacy pay a noise penalty at every denoising step, but this paper argues that most of that penalty is wasted. It claims that the forward diffusion process splits into three stages — coarse (high noise, where global structure forms), context (where content is produced), and cleaning (where residual noise is removed) — and that only the middle context stage actually needs private data. The supporting argument is two probabilistic bounds: at high noise levels any two data distributions become statistically close under the forward process (Theorem 1), and at low noise levels, where $\bar{\alpha}_t \approx 1$, the noise component a denoiser has to remove is nearly independent of which distribution the image came from (Theorem 2). Building on these bounds, the paper's DP-SynGen trains the coarse and cleaning stages on programmatically generated synthetic images and spends the private budget only on the context stage, which reduces per-step privacy noise. The experiments report better FID and classifier accuracy than the DP diffusion baseline on MNIST, Fashion MNIST, and CelebA, with the clearest gains at small privacy budgets ($\varepsilon = 0.2$–$1$).

What carries the argument

The load-bearing objects are two probabilistic bounds set against the three-stage (coarse, context, cleaning) decomposition of the diffusion process, plus the truncated-noise sampling that turns them into a training schedule. Theorem 1 is a forgetting bound: the forward process converges to a normal distribution, so for large $n$ the noised states of any two sources differ by at most $\nu$ with probability at least $1-\gamma$; this licenses synthetic data in the coarse (low-SNR) stage. Theorem 2 is a cleaning-stage bound: when $\bar{\alpha}_t \approx 1$, the added-noise pieces $X_t - X_0$ and $Y_t - Y_0$ are close in probability, with $\gamma$ controlled by $1 - \sqrt{\bar{\alpha}_t}$ times $E\|X_0 - Y_0\|$ (Markov) plus a chi-squared tail (Chernoff); this licenses synthetic data in the cleaning stage. The mechanism connecting the bounds to a practical algorithm is stage-conditioned training: synthetic epochs sample $\ln\sigma$ from a truncated normal above $\tau_1$ (coarse) or below $\tau_1$ (cleaning), and private DP epochs sample the complementary range governed by $\tau_2$, with $\tau_2 \ge \tau_1$ allowing overlap between the two phases. All thresholds come from the schedule alone — the SNR elbow marks the context/coarse boundary and $\bar{\alpha}_\sigma \approx 1$ marks the cleaning boundary — so no privacy budget is spent choosing them.

What would settle it

Train DP-SynGen Cleaning with the cleaning threshold moved to a higher noise level where $\bar{\alpha}_\tau \approx 0.95$ instead of $0.998$ on MNIST; Theorem 2's data-difference term grows like $(1 - \sqrt{\bar{\alpha}_\tau})E\|X_0 - Y_0\|$, roughly twenty-five times larger, so if the bound is what makes the stage replaceable, FID should visibly degrade toward the DPDM-EDM baseline. A direct companion measurement: compute the empirical distribution of $\|X_t - Y_t\|$ between noised MNIST and noised Dead Leaves images at the chosen thresholds and compare it with $\sqrt{1-\bar{\alpha}_t}$; if the full-input gap is not small relative to that noise scale, the cleaning-stage replacement is not supported by the paper's own mechanism.

Watch

Extended reading notes

Core claim

The paper's central claim is that private data are indispensable in only one slice of the denoising schedule. Splitting the diffusion process into coarse, context, and cleaning stages, it shows that at very high noise the forward process has effectively forgotten its source: for any two distributions $X_0$ and $Y_0$, one can find a time $N$ such that for all $n \ge N$, $P(\|X_n - Y_n\| > \nu) \le \gamma$, so the coarse stage can be learned from synthetic images (Theorem 1). At the opposite end, when $\bar{\alpha}_t \approx 1$, the added-noise difference $X_t - X_0 - (Y_t - Y_0)$ is small in probability, with the bound shrinking through $1 - \sqrt{\bar{\alpha}_t}$ and a chi-squared tail (Theorem 2), so the cleaning stage's denoising target is also nearly distribution-free. DP-SynGen turns these bounds into a training scheme: synthetic-data training on the coarse or cleaning noise range first, then DP training only on the remaining range, using truncated $\ln\sigma$ sampling from the EDM schedule with thresholds chosen from the SNR elbow and the $\bar{\alpha}_\sigma \approx 1$ condition — both computable without touching private data. The paper reports that the scheme reduces private training iterations from 300 to 250, lowers per-step DP noise, and yields better FID and CAS than the DPDM-EDM baseline, with the advantage growing as $\varepsilon$ and the noise multiplicity shrink.

Load-bearing premise

The theorems bound only the added-noise pieces of the noised images; they do not bound the full input gap $X_t - Y_t = \sqrt{\bar{\alpha}_t}(X_0 - Y_0) + \sqrt{1-\bar{\alpha}_t}(Z_1 - Z_2)$, so the claim that a model trained on synthetic images will denoise private images correctly rests on the unproven assumption that the remaining $\sqrt{\bar{\alpha}_t}(X_0 - Y_0)$ shift in the denoiser's input is harmless.

Editorial extensions

If this is right

  • The privacy budget concentrates on the context stage: private training epochs drop from 300 to 250, per-step DP noise falls, and FID and CAS improve over the DPDM-EDM baseline at the same $\varepsilon$, with the largest gains at $\varepsilon = 0.2$–$1$.
  • Synthetic pre-training provides a better-than-random initialization: DP-SynGen FineTune beats random initialization on FID and CAS, indicating that the coarse stage carries transferable structure.
  • The two stage replacements have complementary effects: coarse-stage synthetic training improves FID (pixel fidelity), while cleaning-stage synthetic training improves CAS (downstream classifier accuracy), particularly at small privacy budgets.
  • Threshold choice costs no privacy: $\tau_1$ and $\tau_2$ are read off the SNR curve and the $\bar{\alpha}_\sigma \approx 1$ condition, both determined by hyperparameters alone.
  • The advantage over DPDM grows as privacy noise grows: smaller $\varepsilon$ and smaller noise multiplicity $k$ both enlarge the gap, because the synthetic-only phases inject no privacy noise.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the same coarse/context/cleaning split could apply to other iterative generators — flow matching, consistency models, hierarchical VAEs — whose early and late steps play analogous roles; the paper tests only diffusion.
  • Editorial test: the cleaning-stage margin should shrink as the synthetic–private gap widens, so the method should be re-checked with synthetic distributions far from Dead Leaves (e.g., pure Gaussian noise) at the same thresholds.
  • Editorial flag: the proof of Theorem 1 cites the convergence of the forward process to a normal distribution only as '[]' — a blank reference — so the derivation chain as printed contains an unsourced standard fact.
  • Editorial suggestion: since the paper randomly labels its synthetic images and notes they give no class guidance, pseudo-labeling the synthetic corpus with a differentially private classifier is a direct, testable route to improving conditional DP-SynGen.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes DP-SynGen, a framework for differentially private diffusion training that uses programmatically generated synthetic images in the coarse-noise and low-noise cleaning stages, reserving the context stage for DP-SGD-trained private data. The authors present two theorems (Theorems 1 and 2) intended to show that these stages are insensitive to the training-data distribution, together with stage-replacement toy experiments and FID/CAS experiments on MNIST and Fashion MNIST for several privacy budgets.

Significance. The idea of reducing the privacy budget by replacing some diffusion stages with non-private synthetic data is interesting and, if valid, would be practically useful. The paper includes helpful toy illustrations and states that code will be released. However, the theoretical core is not sound: Theorem 1 is false as stated for independent diffusion processes, and Theorem 2 bounds the wrong quantity for the cleaning stage. The experimental improvements over DPDM are modest and not consistent across settings, so the central claim is not established.

major comments (3)
  1. [Section III-A / Appendix, Theorem 1] Theorem 1 claims that for any two data distributions X0 and Y0, P(||X_n - Y_n|| > nu) <= gamma for all sufficiently large n. This is not implied by convergence of X_n and Y_n in distribution to the standard normal. For two independent forward processes, X_n - Y_n converges in distribution to the difference of two independent normal vectors, so the probability in (5) tends to a positive constant rather than to zero. The proof uses 'Xn -> N and Yn -> N in probabilistically', which assumes a common limit random variable N that is not provided by the diffusion process in Equation (1). Thus Theorem 1 does not support the claim that the coarse stage can be trained on synthetic data.
  2. [Section III-A / Appendix, Theorem 2] Theorem 2 bounds P(||X_t - X_0 - (Y_t - Y_0)|| > nu), i.e., the difference of the noise increments. The denoising model, however, receives X_t as input. The input gap is X_t - Y_t = sqrt(alpha_bar_t)(X_0 - Y_0) + sqrt(1-alpha_bar_t)(Z_1 - Z_2). In the cleaning stage alpha_bar_t is close to 1, so the first term is approximately X_0 - Y_0 and can be arbitrarily large; the theorem does not control this term. The observation in the main text (after Figure 3) that 'some characteristics of the synthetic data were reflected' corroborates that the cleaning model is not insensitive to the training distribution. Hence Theorem 2 does not justify training the cleaning stage on synthetic data.
  3. [Section IV-B / Table I] The sentence 'DP-SynGen FineTune generally outperforms DPDM EDM in both FID and CAS' is not supported by the reported numbers. For MNIST at epsilon=10, DPDM EDM obtains conditional FID 11.5 versus DP-SynGen FineTune 11.9; for Fashion MNIST at epsilon=0.5, DPDM EDM matches or exceeds FineTune on most accuracy columns; and at epsilon=0.2 almost all differences are within a few points. With the theoretical justification absent, this mixed evidence does not substantiate the abstract's claim that DP-SynGen improves generation quality by mitigating privacy-induced noise.
minor comments (4)
  1. [Algorithm 1 (Appendix)] The pseudocode contains an 'end' statement before the 'else' branch, which makes the conditional structure ambiguous; please reformat so that each 'if' has exactly one matching 'end'.
  2. [Appendix, Proof of Theorem 2] In the Chernoff bound line, the first expression with exponent -nu^2/(8(1-alpha_bar_t)) - d/2 - (d/2) ln(nu^2/(8d(1-alpha_bar_t))) is not algebraically equal to the following line -nu^2/(16(1-alpha_bar_t)) + d/2 - (d/2) ln(nu^2/(8d(1-alpha_bar_t))); the factor of 2 and the sign of d/2 appear inconsistent.
  3. [Section II-A and III-B] The paper uses the DDPM alpha_bar_t notation in Equation (2) and in the theorems, but the experiments use the EDM sigma-parameterization (Equation 3). The relation between alpha_bar_sigma and the truncated normal sampling in ln(sigma) is not stated, which makes it hard to verify the reported thresholds tau_1 and tau_2.
  4. [Section III-C] The selection of tau_1 and tau_2 is described via an 'elbow point' without a formal definition or sensitivity analysis; because these thresholds directly determine which stages use synthetic data, a quantitative criterion and robustness check would strengthen the presentation.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: thresholds come from the noise scheduler, the theorems are general diffusion properties, and the central claim is not obtained by renaming a fitted parameter or by a load-bearing self-citation.

full rationale

The paper claims that the coarse and cleaning stages of diffusion training can be trained on programmatically generated synthetic data, reducing the private training budget. I find no circular step. The thresholds tau1 and tau2 are chosen from the EDM scheduler's SNR and alpha-bar-sigma curves (Section III-C, Figure 5), not from the FID or CAS numbers reported later, so the experiments are not predictions of fitted constants. Theorems 1 and 2 are general statements about the forward diffusion process: convergence to a noise-dominated state at large t, and small perturbation relative to the clean image when alpha-bar-t is approximately 1. They do not assume the conclusion that synthetic and private training are equivalent; they are offered as independent mathematical support. The toy experiments in Section III-A provide additional, independent empirical support for the stage decomposition. The paper cites overlapping-author prior work for the coarse/context/cleaning taxonomy ([9], [10]), but the argument does not reduce to that citation because the present paper's own figures and theorems carry the load; this is a minor, non-load-bearing self-citation rather than circularity. The skeptical concern that Theorem 2 bounds the difference of noise increments rather than the input shift is a soundness gap in the theoretical justification, and the Appendix's admission that cleaning-stage outputs reflected some synthetic characteristics (Figure 3 caption, Appendix toy-example discussion) is an empirical limitation; neither is a case of deriving the conclusion from its own definition or fitting a parameter and calling it a prediction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central result depends on two pairs of hand-chosen thresholds and on a transfer assumption for the cleaning stage that is not established by the provided theory. The standard diffusion convergence result is the only solid mathematical input; the cleaning-stage premise is ad hoc.

free parameters (3)
  • Coarse thresholds (tau1, tau2) = tau1=2.0, tau2=3.0 in ln(sigma) space
    Chosen from the SNR elbow plot for MNIST/Fashion MNIST; they determine which noise levels use synthetic vs private data and directly control the privacy budget.
  • Cleaning thresholds (tau1, tau2) = tau1=-4.0, tau2=-3.0 in ln(sigma) space
    Chosen so that alpha_bar_sigma is close to 1; they determine the cleaning stage where synthetic data is used.
  • Dead-leaves color probabilities = 1/3 for color 0, 1/3 for color 1, 1/3 uniform
    A modified synthetic data generator selected by the authors to improve cleaning-stage toy results; it is a design choice fitted to the datasets.
assumptions (5)
  • standard math Forward diffusion converges in distribution to a Gaussian independent of the initial data (used in Theorem 1)
    The proof of Theorem 1 relies on Xn converging to N and Yn converging to N in probability.
  • standard math Markov's inequality and Chernoff's bound for chi-squared variables
    Used in the proof of Theorem 2.
  • domain assumption The three-stage coarse/context/cleaning decomposition of diffusion sampling is meaningful and transferable
    Borrowed from Choi et al. [9] and used to justify stage-wise training.
  • ad hoc to paper A model trained on synthetic denoising targets in the cleaning stage denoises private images correctly because the noise parts are close
    This transfer assumption is the core of the cleaning-stage argument and is not proven by Theorem 2, which only bounds the added noise difference, not the input distribution shift.
  • domain assumption Truncating the EDM noise-level sampling distribution does not break DP accounting
    The paper assumes the truncated normal sampling for sigma is independent of the data and that standard DP-SGD composition applies to the reduced number of private steps.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training." pith.science (2026). https://pith.science/paper/FU66QOHU

@misc{pith2026241209842,
  author       = {Pith},
  title        = {Pith review of: Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FU66QOHU}},
  note         = {Machine review of arXiv:2412.09842}
}
read the original abstract

Programmatically generated synthetic data has been used in differential private training for classification to enhance performance without privacy leakage. However, as the synthetic data is generated from a random process, the distribution of real data and the synthetic data are distinguishable and difficult to transfer. Therefore, the model trained with the synthetic data generates unrealistic random images, raising challenges to adapt the synthetic data for generative models. In this work, we propose DP-SynGen, which leverages programmatically generated synthetic data in diffusion models to address this challenge. By exploiting the three stages of diffusion models(coarse, context, and cleaning) we identify stages where synthetic data can be effectively utilized. We theoretically and empirically verified that cleaning and coarse stages can be trained without private data, replacing them with synthetic data to reduce the privacy budget. The experimental results show that DP-SynGen improves the quality of generative data by mitigating the negative impact of privacy-induced noise on the generation process.

Figures

Figures reproduced from arXiv: 2412.09842 by the authors.

Figure 1
Figure 1. Samples context stage t ∈ (250, 750] with (a) synthetic data- and (b) private data-trained model. For other stages, the private data- and synthetic data-trained model are used, respectively. Synthetic data can replace coarse stages. Next, to verify the usability of synthetic data in the coarse stage, we trained one model using synthetic data and the other using MNIST data for the diffusion step t ∈ (τ, T], where τ s… view at source ↗
Figure 3
Figure 3. Samples from (a) diffusion model trained with private data for total [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Illustration of (a) DP-SynGen Coarse and (b) DP-SynGen Cleaning, [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Visualization of α¯σ and SNR to search the threshold τ can affect the quality of the samples, as shown in [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Samples from (a) diffusion model trained with private data for total [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Samples from (a) diffusion model trained with private data for total [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Generated examples of MNIST dataset. Method DP-ϵ Multiplicity 1 4 8 16 DP-SynGen Coarse 0.2 183.8 171.6 152.8 148.4 DP-SynGen Cleaning 0.2 184.0 172.0 153.6 149.1 DP-SynGen FineTune 0.2 180.4 163.6 158.0 149.2 DPDM EDM 0.2 184.0 171.1 167.6 163.2 DP-SynGen Coarse 0.5 1…
Figure 9
Figure 9. Figure 9: Generated examples of Fashion MNIST dataset. [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Generated example of CelebA dataset with DP-SynGen Cleaning [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 21 canonical work pages

  1. [1]

    Differential privacy,

    C. Dwork, “Differential privacy,” in International col- loquium on automata, languages, and programming . Springer, 2006, pp. 1–12

    work page 2006

  2. [2]

    In-distribution public data synthesis with diffusion models for differentially private image classification,

    J. Park, Y . Choi, and J. Lee, “In-distribution public data synthesis with diffusion models for differentially private image classification,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 236–12 246

    work page 2024

  3. [3]

    Unlocking high-accuracy differentially pri- vate image classification through scale,

    S. De, L. Berrada, J. Hayes, S. L. Smith, and B. Balle, “Unlocking high-accuracy differentially pri- vate image classification through scale,” arXiv preprint arXiv:2204.13650, 2022

    arXiv 2022

  4. [4]

    Position: Consid- erations for differentially private learning with large-scale public pretraining,

    F. Tram `er, G. Kamath, and N. Carlini, “Position: Consid- erations for differentially private learning with large-scale public pretraining,” in Forty-first International Confer- ence on Machine Learning , 2022

    work page 2022

  5. [5]

    Dif- ferentially Private Diffusion Models,

    T. Dockhorn, T. Cao, A. Vahdat, and K. Kreis, “Dif- ferentially Private Diffusion Models,” Transactions on Machine Learning Research , 2023. [Online]. Available: https://openreview.net/forum?id=ZPpQk7FJXF

    work page 2023

  6. [6]

    Learning to see by looking at noise,

    M. Baradad Jurjo, J. Wulff, T. Wang, P. Isola, and A. Tor- ralba, “Learning to see by looking at noise,” Advances in Neural Information Processing Systems , vol. 34, pp. 2556–2569, 2021

    work page 2021

  7. [7]

    Differ- entially private image classification by learning priors from random processes,

    X. Tang, A. Panda, V . Sehwag, and P. Mittal, “Differ- entially private image classification by learning priors from random processes,” Advances in Neural Information Processing Systems, vol. 36, 2024

    work page 2024

  8. [8]

    Vip: A differentially private foundation model for com- puter vision,

    Y . Yu, M. Sanjabi, Y . Ma, K. Chaudhuri, and C. Guo, “Vip: A differentially private foundation model for com- puter vision,” arXiv preprint arXiv:2306.08842 , 2023

    arXiv 2023

Show all 29 references
  1. [9]

    Perception prioritized training of diffusion models,

    J. Choi, J. Lee, C. Shin, S. Kim, H. Kim, and S. Yoon, “Perception prioritized training of diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 11 472–11 481

    2022

  2. [10]

    Fair sam- pling in diffusion models through switching mechanism,

    Y . Choi, J. Park, H. Kim, J. Lee, and S. Park, “Fair sam- pling in diffusion models through switching mechanism,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 20, 2024, pp. 21 995–22 003

    2024

  3. [11]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems, vol. 33, pp. 6840–6851, 2020

    2020

  4. [12]

    Varia- tional diffusion models,

    D. Kingma, T. Salimans, B. Poole, and J. Ho, “Varia- tional diffusion models,” Advances in neural information processing systems, vol. 34, pp. 21 696–21 707, 2021

    2021

  5. [13]

    Elucidating the design space of diffusion-based generative mod- els,

    T. Karras, M. Aittala, T. Aila, and S. Laine, “Elucidating the design space of diffusion-based generative mod- els,” Advances in neural information processing systems , vol. 35, pp. 26 565–26 577, 2022

    2022

  6. [14]

    Efficient diffusion training via min-snr weighting strategy,

    T. Hang, S. Gu, C. Li, J. Bao, D. Chen, H. Hu, X. Geng, and B. Guo, “Efficient diffusion training via min-snr weighting strategy,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 7441–7451

    2023

  7. [15]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  8. [16]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium,

    M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter, “Gans trained by a two time-scale update rule converge to a local nash equilibrium,” Advances in neural information processing systems , vol. 30, 2017

    2017

  9. [17]

    Classification accuracy score for conditional generative models,

    S. Ravuri and O. Vinyals, “Classification accuracy score for conditional generative models,” Advances in neural information processing systems , vol. 32, 2019. 7

    2019

  10. [18]

    Denoising diffu- sion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffu- sion implicit models,” arXiv preprint arXiv:2010.02502 , 2020

    2010 arXiv

  11. [19]

    Opacus: User-friendly differential privacy library in pytorch,

    A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testug- gine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao et al. , “Opacus: User-friendly differential privacy library in pytorch,” arXiv preprint arXiv:2109.12298, 2021

    2021 arXiv

  12. [20]

    Pearl: Data synthesis via private embeddings and adversarial re- construction learning,

    S. P. Liew, T. Takahashi, and M. Ueno, “Pearl: Data synthesis via private embeddings and adversarial re- construction learning,” arXiv preprint arXiv:2106.04590, 2021

    2021 arXiv

  13. [21]

    Private gans, revis- ited,

    A. Bie, G. Kamath, and G. Zhang, “Private gans, revis- ited,” arXiv preprint arXiv:2302.02936 , 2023

    2023 arXiv

  14. [22]

    Hermite polynomial features for private data generation,

    M. Vinaroz, M.-A. Charusaie, F. Harder, K. Adam- czewski, and M. J. Park, “Hermite polynomial features for private data generation,” in International Conference on Machine Learning. PMLR, 2022, pp. 22 300–22 324

    2022

  15. [23]

    Don’t generate me: Training differentially private generative models with sinkhorn divergence,

    T. Cao, A. Bie, A. Vahdat, S. Fidler, and K. Kreis, “Don’t generate me: Training differentially private generative models with sinkhorn divergence,” Advances in Neural Information Processing Systems , vol. 34, pp. 12 480– 12 492, 2021

    2021

  16. [24]

    Scalable differentially private data generation via private aggregation of teacher ensembles,

    Y . Long, S. Lin, Z. Yang, C. A. Gunter, H. Liu, and B. Li, “Scalable differentially private data generation via private aggregation of teacher ensembles,” 2019

    2019

  17. [25]

    Dp- cgan: Differentially private synthetic data and label gen- eration,

    R. Torkzadehmahani, P. Kairouz, and B. Paten, “Dp- cgan: Differentially private synthetic data and label gen- eration,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2019, pp. 0–0

    2019

  18. [26]

    Datalens: Scalable privacy preserving training via gradient compression and aggregation,

    B. Wang, F. Wu, Y . Long, L. Rimanic, C. Zhang, and B. Li, “Datalens: Scalable privacy preserving training via gradient compression and aggregation,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 2146–2168

    2021

  19. [27]

    Dp-merf: Differentially private mean embeddings with randomfea- tures for practical privacy-preserving data generation,

    F. Harder, K. Adamczewski, and M. Park, “Dp-merf: Differentially private mean embeddings with randomfea- tures for practical privacy-preserving data generation,” in International conference on artificial intelligence and statistics. PMLR, 2021, pp. 1819–1827

    2021

  20. [28]

    Dpgen: Differentially private generative energy- guided network for natural image synthesis,

    J.-W. Chen, C.-M. Yu, C.-C. Kao, T.-W. Pang, and C.- S. Lu, “Dpgen: Differentially private generative energy- guided network for natural image synthesis,” in Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 8387–8396

    2022

  21. [29]

    Dead leaves models: from space tessellation to random functions,

    D. Jeulin, “Dead leaves models: from space tessellation to random functions,” in Proc. of the Symposium on the Advances in the Theory and Applications of Random Sets, 1997, pp. 137–156. 8 APPENDIX TRAINING DETAILS In this section, we provide the training details of our experim...

    1997

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.