Research map / Federated learning and privacy / Differential privacy
Differentially Private Synthetic Data via Foundation Model APIs 1: Images
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Private Evolution (PE), which generates DP synthetic images using only blackbox inference APIs (random generation and variation) of pretrained diffusion models, guided by DP nearest-neighbor histogram voting from private samples, without any model training.
Problem
Generating differentially private synthetic images is typically done by training or fine-tuning generative models with DP-SGD, which is hard to deploy and inapplicable when foundation models are API-only; the paper asks whether DP synthetic data can be generated using only blackbox inference APIs wh
Approach
Treat pretrained models as blackboxes accessed via random-generation and sample-variation APIs; iteratively use noisy nearest-neighbor votes from private samples in an embedding space to select generated samples and evolve them, with DP Gaussian noise and thresholding, so the whole evolutionary loop is DP without any gradient or training.</ättribute>
Key results
- On CIFAR10 (delta=1e-5), PE reaches FID<=7.9 at epsilon=0.67, versus prior SOTA DP-Diffusion needing epsilon=32.
- On Camelyon17 with an ImageNet-pretrained model, PE achieves 80.33% downstream accuracy at epsilon=10 versus prior SOTA 91.1%.
- Generating unlimited samples, PE with a 5-classifier ensemble reaches 89.13% CIFAR10 accuracy with 1M samples.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Private Evolution instead of DP-Diffusion | DP synthetic image generation on CIFAR10 · CIFAR10 | privacy cost at FID ≤7.9: 32 -> 0.67 | Helped |
| Use Private Evolution instead of prior SOTA | DP synthetic data for downstream classification · CIFAR10 test | accuracy: +6.1% | Helped |
| Use Private Evolution instead of prior SOTA | DP synthetic data for downstream classification · Camelyon17 test | accuracy: 80.33% vs 91.1% | Hurt |
| Generate more samples by repeatedly applying the variation API | Private Evolution · CIFAR10 test | accuracy: 89.13% | Helped |
| Use the 270M pre-trained network instead of the 100M network (ablation) | Private Evolution · CIFAR10 and Camelyon17 | results | Helped |
| Use a 100M pre-trained network instead of the 270M network (ablation) | Private Evolution · CIFAR10 and Camelyon17 | convergence speed | Hurt |
| Use CLIP embeddings instead of ImageNet inception embeddings (ablation) | Private Evolution · CIFAR10 | results | No clear effect |
| Vary lookahead degree, number of generated samples, threshold, and embedding network (ablation) | Private Evolution · CIFAR10 and Camelyon17 | results | No clear effect |
Surprising findings
- PE outperforms SOTA training-based DP image generators on CIFAR10 FID without any model training, despite blackbox API-only access.
- PE reaches non-trivial results on Camelyon17 despite large distribution shift between ImageNet and the private medical data.
Limitations
- Worse than SOTA training-based methods when public and private distributions differ greatly and private data is plentiful (Camelyon17 result).
- Does not account for number of API calls in optimization.
- Requires a good embedding network for measuring sample similarity, which may not exist for other modalities.
Experimental setup
Datasets: CIFAR10 ImageNet Camelyon17 Cat Cookie and Cat Doudou (author's cat photos, 100 512x512 each)
Benchmarks: CIFAR10 Camelyon17
Metrics: FID downstream classification accuracy privacy epsilon
Baselines: DP-Diffusion DP-MEPF DP-GAN
Builds on: Improved Diffusion DP-SGD DP-Diffusion Stable Diffusion evolutionary algorithms
Closest papers by meaning
- Differentially Private Synthetic Data via Foundation Model APIs 2: Text (ICML 2024 · similarity 0.93)
- PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs (ICML 2025 · similarity 0.91)
- Private Evolution Converges (NeurIPS 2025 · similarity 0.91)
- A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · similarity 0.88)
- Synthesize Privacy-Preserving High-Resolution Images via Private Textual Intermediaries (NeurIPS 2025 · similarity 0.88)
- Analysis of Differentially Private Synthetic Data: A Measurement Error Approach (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.