Research map / Federated learning and privacy / Differential privacy

PFGuard: A Generative Framework with Privacy and Fairness Safeguards

ICLR 2025 · Federated learning and privacy › Differential privacy · approach: Differentially private synthetic data · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PFGuard, a generative framework that combines fair balanced-minibatch sampling for teacher models with private teacher ensemble learning (PTEL) so that only the DP generator is released, achieving both DP and fairness on image data.

Problem

Generative models must be both privacy-preserving and fair, but naively combining DP and fairness techniques causes privacy-fairness conflicts (sensitivity blow-up, gradient clipping cancelling reweighting) and poor fairness-utility tradeoffs, especially on high-dimensional image data.

Approach

Perform fair training by sampling balanced minibatches (SIR-based resampling) from disjoint teacher data partitions, then transfer teacher knowledge to the generator only through a PTEL noisy-voting mechanism, so the sensitivity analysis of the underlying PTEL generator is preserved and fairness is achieved without changing the loss function.

Key results

• On MNIST subgroup bias under epsilon=10, GS-WGAN + PFGuard reduces KL group-size divergence from 0.177 to 0.067 and distribution disparity from 0.383 to 0.242 relative to GS-WGAN alone.
• Reweighting baselines with DP-SGD consume a larger privacy budget (e.g., epsilon 13) while PFGuard keeps epsilon=10 with KL 0.004 and distribution disparity 0.041 in the unknown subgroup setting.
• On CelebA binary class bias under epsilon=1, DataLens + PFGuard lowers accuracy disparity from 0.793 to 0.725 on CelebA(S).

Measured effects reported in the paper

Surprising findings

• Naively combining reweighting with DP-SGD can increase the effective privacy cost (e.g., epsilon 13 vs 10), showing privacy-fairness conflicts.
• Existing private generative models can produce highly biased synthetic data even under simple binary class bias on CelebA.

Limitations

• Multiple teachers increase training cost.
• Fairness upper bound on number of teachers depends on minority group size; performance drops when bias level exceeds the bound.
• Convergence guarantee may not hold when sensitive attribute labels are unavailable and partitioning ignores them; CelebA high-dimensional results still show room for improvement.

Experimental setup

Datasets: MNIST FashionMNIST CelebA

Benchmarks: MNIST FashionMNIST CelebA

Metrics: FID KL divergence to uniform group distribution distribution disparity equalized odds disparity demographic parity disparity accuracy disparity downstream accuracy privacy budget epsilon

Baselines: GS-WGAN G-PATE DataLens Reweighting DP-SGD-F DPSGD-Global-Adapt

Builds on: GS-WGAN G-PATE DataLens PATE Sampling-Importance Resampling

Closest papers by meaning

• Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training (NeurIPS 2024 · similarity 0.86)
• A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · similarity 0.86)
• Can Private Machine Learning Be Fair? (AAAI 2025 · similarity 0.86)
• AIM-Fair: Advancing Algorithmic Fairness via Selectively Fine-Tuning Biased Models with Contextual Synthetic Data (CVPR 2025 · similarity 0.85)
• Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.85)
• PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs (ICML 2025 · similarity 0.85)