Research map / Federated learning and privacy / Differential privacy
Do You Really Need Public Data? Surrogate Public Data for Differential Privacy on Tabular Data
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes generating "surrogate public" tabular data from schema-only metadata using LLMs (direct CSV generation and an agent-built SCM), and evaluates it for DP classifier pretraining, DP synthesizer hyperparameter tuning, and privacy-utility estimation.
Problem
Differentially private tabular methods often need public data for pretraining, hyperparameter tuning, and privacy-utility estimation, but suitable public tabular data is rarely available due to heterogeneity and privacy/legal constraints.
Approach
Synthesize surrogate public datasets without touching sensitive data, using only schema-level metadata, by prompting LLMs either to write CSV records directly or to build a structural causal model (DAG plus structural equations, compiled to Pyro) through a state-machine agent with validation loops, then mixing multiple generated datasets.
Key results
- On EDAD at epsilon=1, CSV (Claude 3.5 Sonnet) pretraining gives AUC advantage 0.17 versus 0.19 for traditional public data, while baselines give near-zero benefit.
- On WE at epsilon=1, Agent (Claude 3.5 Sonnet, Unif.) achieves AUC advantage 0.21, the top value, exceeding traditional public data (0.11).
- Surrogate data (CSV and Agent methods) yields the best aggregate Pareto trade-offs for hyperparameter tuning of DP synthesizers, though no single method dominates across metrics.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Pretrain FTTransformer on Claude 3.5 Sonnet CSV surrogate data | FTTransformer DP classifier · EDAD, ε=1 | AUC advantage: .00 -> .11 | Helped |
| Pretrain FTTransformer on Claude 3.5 Sonnet Agent surrogate data using Max Cov. mixing | FTTransformer DP classifier · WE, ε=1 | AUC advantage: .00 -> .11 | Helped |
| Pretrain FTTransformer on surrogate data | FTTransformer DP classifier · ACS | AUC advantage: .00 -> .01 | No clear effect |
| Use LLM-generated CSV or Agent surrogate data for pretraining instead of no pretraining | FTTransformer DP classifier · EDAD and WE | AUC advantage | Helped |
| Use surrogate data for hyperparameter selection | DP synthetic data generators · ACS, EDAD, and WE | hyperparameter-selection performance across metric categories | Mixed |
| Use traditional public data rather than surrogate data for privacy-utility curve estimation | DP synthetic data generators · ACS, EDAD, and WE | privacy-utility curve distance | Helped |
| Use an Agent-generated SCM surrogate rather than no pretraining | FTTransformer DP classifier · WE | AUC advantage: .00 -> .11 | Helped |
Surprising findings
- Traditional public data gave the best or second-best privacy-utility curve estimation in most cases, and dataset similarity metrics (TVD, 3WM) did not explain usefulness rankings.
- Pretraining with the Arbitrary Bayesian-network baseline or simple univariate/uniform baselines gives essentially no benefit, showing that generic structure alone is not enough for classification pretraining.
Limitations
- Surrogate data is weaker than traditional public data for privacy-utility estimation and in many cases for pretraining on large datasets such as ACS.
- Expert modification of the agent-generated SCM is left for future work, and the approach relies on LLM priors that may be uncalibrated for new domains.
- Common similarity metrics such as TVD and 3WM do not explain the usefulness rankings of public data variants.
Experimental setup
Datasets: ACS EDAD WE
Benchmarks: ACS EDAD WE
Metrics: AUC AUC advantage total variation distance 3-way marginal error Pearson/Cramer's V correlation difference classification AUC diff l1/l2 distance of privacy-utility curves Pareto frontier
Baselines: Uniform (domain) Univariate Arbitrary Bayesian network Traditional public data
Builds on: FTTransformer PrivBayes AIM GEM Private-PGM
Closest papers by meaning
- Breaking the Quality–Privacy Tradeoff in Tabular Data Generation via In-Context Learning (NeurIPS 2026 · similarity 0.88)
- HARMONIC: Harnessing LLMs for Tabular Data Synthesis and Privacy Protection (NeurIPS 2024 · similarity 0.87)
- Privacy-Preserving Data Release Leveraging Optimal Transport and Particle Gradient Descent (ICML 2024 · similarity 0.87)
- Synthesizing Privacy-Preserving Text Data via Finetuning *without* Finetuning Billion-Scale LLMs (ICML 2025 · similarity 0.85)
- RAPID: Retrieval Augmented Training of Differentially Private Diffusion Models (ICLR 2025 · similarity 0.85)
- In-distribution Public Data Synthesis with Diffusion Models for Differentially Private Image Classification (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.