Research map / Federated learning and privacy / Differential privacy

Privacy Amplification Persists under Unlimited Synthetic Data Release

NeurIPS 2026 · Federated learning and privacy › Differential privacy · approach: Privacy accounting and mechanisms · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that privacy amplification by synthetic data release from a linear Gaussian generator persists as the number of synthetic records goes to infinity, via Fisher-information bounds on non-central chi-squared/Wishart divergences under bounded parameters.

Problem

Prior formal amplification guarantees for synthetic data from linear generators hold only when the number of synthetic records is small relative to model dimension; it is unclear whether amplification survives unlimited synthetic release.

Approach

Reduces infinite-release synthetic data privacy loss to the Rényi divergence between Gram matrices V^T V and W^T W, bounds their Fisher information via non-central chi-squared/Wishart results, and integrates along a path to get Rényi DP bounds independent of n_syn under a parameter-norm bound.

Key results

• For k=1, the amplification factor eta_d satisfies 2||w||^2/(2||w||^2+d) + o(1) <= eta_d <= 2C^2/(2C^2+d-3) + o(1), so amplification is O(1/d) for fixed C.
• For k>1, eta_{d,k} <= 2C^2/(2C^2 + floor(d/k) - 3) + o(1) under parameter-norm bound C.
• Numerical estimates show Rényi divergence for ZV,ZW plateaus quickly in n_syn, below the post-processing bound.

Surprising findings

• Without parameter boundedness, releasing infinitely many synthetic records yields no amplification (supremum equals post-processing loss).
• The bound on the infinite-release divergence does not depend on n_syn, contradicting the intuition that unlimited release eliminates privacy benefit.

Limitations

• Analysis restricted to a linear generator with output-perturbation (Gaussian) parameters and Gaussian latent inputs.
• Global Rényi bound is not expected to be tight; local bounds valid only for small sensitivity.
• Gap for n_syn <= d regime left as future work; a previously flawed Fisher-to-Rényi proof in prior literature is noted.

Experimental setup

Metrics: Rényi divergence amplification factor

Baselines: Pierquin et al. (2025) post-processing bound D_alpha(V,W)

Builds on: Pierquin et al. (2025) linear generator amplification Rényi differential privacy Convex-Conjugate Rényi Variational Formula Projected Noisy Gradient Descent

Closest papers by meaning

• Privacy Amplification Through Synthetic Data: Insights from Linear Regression (ICML 2025 · similarity 0.94)
• Exactly Minimax-Optimal Locally Differentially Private Sampling (NeurIPS 2024 · similarity 0.90)
• Privacy without Noisy Gradients: Slicing Mechanism for Generative Model Training (NeurIPS 2024 · similarity 0.89)
• A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · similarity 0.89)
• Does Training with Synthetic Data Truly Protect Privacy? (ICLR 2025 · similarity 0.89)
• Privacy amplification by random allocation (NeurIPS 2025 · similarity 0.89)