Research map / Federated learning and privacy / Differential privacy
Privacy Amplification Through Synthetic Data: Insights from Linear Regression
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies privacy of releasing synthetic data from a DP linear regression model (output perturbation / noisy GD) theoretically: shows no amplification when adversary controls the seed, but amplification for Gaussian random seeds with few released points.
Problem
Whether synthetic data generated from a differentially private generative model enjoys privacy amplification beyond the model's post-processing guarantee, which has lacked rigorous theory.
Approach
Uses linear regression as an analytically tractable case study: with adversarial seeds a single synthetic point leaks as much as the model; with random Gaussian seeds, releasing synthetic points yields a variance-shift Gaussian approximation (CLT in total variation) giving privacy amplification of order O(1/d) in the number of model dimensions d, scaling with the number of released points nl.
Key results
- With adversarially chosen seed z, a single synthetic output can reach the same trade-off function as releasing the full model (Proposition on output perturbation and NGD).
- With Gaussian random seeds and l=n=1, the trade-off function converges to a Gaussian variance-shift trade-off at rate O(1/d), giving Rényi divergence about (1/2d) of the post-processing bound D_alpha(V,W).
- For multiple points, a shifted product-of-Gaussians TV bound gives privacy loss scaling like nl/(d-n) times the model's divergence, numerically observed O(d^{-1/2}) decay for fixed n,l.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| allow the adversary to choose the synthetic-data seed | output-perturbed linear regression · fixed-input synthetic data | privacy trade-off | No clear effect |
| allow the adversary to choose the synthetic-data seed | Noisy Gradient Descent linear regression · fixed-input synthetic data, label DP | privacy trade-off | No clear effect |
| generate synthetic data from concealed Gaussian random inputs and release one point | output-perturbed linear regression · single-point release, n = l = 1 and large d | Rényi divergence: Dα(νv*^d,νw*^d) = αΔ^2/(4 d σθ^2) + o(d^{-1}) | Helped |
| generate synthetic data from concealed Gaussian random inputs and release multiple points | output-perturbed linear regression · multiple-point release, d ≥ max{n,l} | Rényi divergence: Dα(Gv,Gw) ≤ αnlΔ^2/(4(d-n)σθ^2) + o(d^{-1}) | Helped |
| release multiple points rather than one | random-input synthetic data release · multiple-point release, fixed n and l | Rényi divergence convergence rate: O(d^{-1/2}) | Mixed |
Surprising findings
- Adversarial control of the generator seed eliminates any amplification: one synthetic point can leak as much as the released model.
Limitations
- Analysis restricted to linear regression with output perturbation and noisy GD; no general bounds for neural networks.
- Amplification bounds require d large relative to n and l (d >= max{n,l}); no result for small d.
- Multivariate bounds rely on product-of-Gaussian convergence theorems; numerical Rényi estimates via Monte Carlo rather than closed form.
Experimental setup
Metrics: trade-off function Rényi divergence
Baselines: post-processing bound
Builds on: f-DP Gaussian differential privacy output perturbation noisy gradient descent Rényi differential privacy
Closest papers by meaning
- Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.94)
- A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · similarity 0.90)
- The Canary’s Echo: Auditing Privacy Risks of LLM-Generated Synthetic Text (ICML 2025 · similarity 0.89)
- Does Training with Synthetic Data Truly Protect Privacy? (ICLR 2025 · similarity 0.89)
- Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training (NeurIPS 2024 · similarity 0.88)
- Bounding the Excess Risk for Linear Models Trained on Marginal-Preserving, Differentially-Private, Synthetic Data (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.