Research map / Federated learning and privacy / Differential privacy
In-distribution Public Data Synthesis with Diffusion Models for Differentially Private Image Classification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Synthesizes in-distribution public data (2K CIFAR-10 images) with EDM diffusion models, adds augmentation and warm-up optimization (SAM) to achieve 85.48% accuracy under (2, 1e-5)-DP without extra public data.
Problem
Differentially private image classification suffers utility loss; with only a small in-distribution public dataset (4% of training data), repeated use causes memorization and overfitting, limiting how much the public data can help DP-SGD.
Approach
Amplify scarce in-distribution public data by training an EDM diffusion model on it and generating a 50K synthetic set, then improve it via diversity-oriented augmentation (cutout), discriminator guidance, and sharpness-aware warm-up to find well-generalizing minima before DP-SGD fine-tuning on private data.
Key results
- Achieves 85.48% test accuracy on CIFAR-10 under (2, 1e-5)-DP with 4% public data, versus 75.1% for prior SOTA WarmSE (DDPM-based).
- On CIFAR-100 with 4% public data and no pre-training, reaches 48.61% at epsilon=2 versus 25.15% for Warm.
- Distribution shift CIFAR-100 to CIFAR-10 at epsilon=2 gives 73.46% vs 50.65% for Warm.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace DDPM synthesis with EDM synthesis (ablation) | WarmSyn on CIFAR-10 · CIFAR-10 | test accuracy: 72.0% -> 75.13 % | Helped |
| add generation diversity to EDM synthesis (ablation) | WarmSyn on CIFAR-10 · CIFAR-10 | test accuracy: 75.13 % -> 77.66% | Helped |
| add augmentation diversity to EDM synthesis (ablation) | WarmSyn on CIFAR-10 · CIFAR-10 | test accuracy: 75.13 % -> 84.88% | Helped |
| use a well-generalizing minimum during warm-up (ablation) | WarmSyn on CIFAR-10 · CIFAR-10 | test accuracy: 84.88% -> 85.48% | Helped |
| increase discriminator-guidance weight from wd=0 to wd=20 (ablation) | EDM synthesis · CIFAR-10 synthetic data | CAS: 62.82 -> 67.61 | Helped |
| increase discriminator-guidance weight from wd=20 to wd=30 (ablation) | EDM synthesis · CIFAR-10 synthetic data | CAS: 67.61 -> 66.53 | Hurt |
| add common augmentation to synthetic-data warm-up (ablation) | EDM warm-up · CIFAR-10 | test accuracy: 75.13 -> 83.97 | Helped |
| add Cutout to common augmentation (ablation) | EDM warm-up · CIFAR-10 | test accuracy: 83.97 -> 84.88 | Helped |
| add Cutmix to common augmentation instead of Cutout (ablation) | EDM warm-up · CIFAR-10 | test accuracy: 84.88 -> 82.20 | Hurt |
| use AutoAugment instead of no augmentation (ablation) | EDM warm-up · CIFAR-10 | test accuracy: 75.13 -> 83.45 | Helped |
| add EDM synthesis to public-data warm-up (ablation) | Warm training · CIFAR-100 | test accuracy: 25.15 -> 31.53±0.04 | Helped |
| add augmentation to WarmSyn (ablation) | WarmSyn training · CIFAR-100 | test accuracy: 31.53±0.04 -> 44.52±0.01 | Helped |
Surprising findings
- Existing extended optimization methods (mirror GD, DOPE-SGD) provide no further gain once synthesis, augmentation and warm-up are applied, and can be unstable.
- Augmentation-induced diversity (Cutmix, cutout) helps more than generation-side diversity via discriminator guidance, and CAS and test accuracy are not always aligned.
Limitations
- Experiments limited to relatively small image datasets; authors leave larger and more sensitive datasets to future work.
- Efficiency of the method (diffusion training and sampling cost) is not addressed.
- Diffusion models trained on sensitive public data are not themselves privacy-preserving; DP diffusion is left to future work.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 EuroSAT PathMNIST FairFace ImageNet
Benchmarks: CIFAR-10 CIFAR-100 EuroSAT PathMNIST FairFace
Metrics: test accuracy FID Inception Score Precision Recall Classification Accuracy Score (CAS)
Baselines: Cold DP-SGD Warm WarmSyn (DDPM) [43] WarmExt / DOPE-SGD [43] Mirror GD [2] De et al. WRN-16-4 Ganesh et al. ViT pre-training
Builds on: DOPE-SGD Elucidating Diffusion Model (EDM) Wide ResNet DP training tricks (De et al.) Discriminator guidance Sharpness-aware minimization
Closest papers by meaning
- Differentially Private Prototypes for Imbalanced Transfer Learning (AAAI 2025 · similarity 0.87)
- Optimal Differentially Private Model Training with Public Data (ICML 2024 · similarity 0.87)
- Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining (ICML 2024 · similarity 0.86)
- The importance of feature preprocessing for differentially private linear optimization (ICLR 2024 · similarity 0.86)
- RAPID: Retrieval Augmented Training of Differentially Private Diffusion Models (ICLR 2025 · similarity 0.86)
- PID: Prompt-Independent Data Protection Against Latent Diffusion Models (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.