Research map / Federated learning and privacy / Differential privacy
Differentially private synthetic data
Generate private synthetic data or text and in-context examples under differential privacy.
81 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Differential privacy, keyword cluster “dp sgd · gradient · clipping”
State History Tried Baselines Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
17 papers in 2023–24 and 48 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 7.9% to 18.0%.
Open questions the data points to
- Papers report DP-MERF on Fashion-MNIST (FID) anywhere from 37 to 132.6: comparisons against it depend on whose number you take.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Learning Differentially Private Recurrent Language Models (ICLR 2018 · 743 citations)
- 2019 · PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees (ICLR 2019 · 278 citations)
- 2020 · GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators (NeurIPS 2020 · 56 citations)
- 2021 · G-PATE: Scalable Differentially Private Data Generator via Private Aggregation of Teacher Discriminators (NeurIPS 2021 · 19 citations)
- 2022 · Large Language Models Can Be Strong Differentially Private Learners (ICLR 2022 · 72 citations)
- 2023 · Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Models (NeurIPS 2023 · 6 citations)
- 2024 · Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generation (ICLR 2024 · 8 citations)
- 2025 · DR-Encoder: Encode Low-rank Gradients with Random Prior for Large Language Models Differentially Privately (AAAI 2025 · 4 citations)
- 2026 · DP-GenG: Differentially Private Dataset Distillation Guided by DP-Generated Data (AAAI 2026 · 1 citation)
Earliest papers here
- Learning Differentially Private Recurrent Language Models (ICLR 2018 · 743 citations)
- PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees (ICLR 2019 · 278 citations)
- GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generators (NeurIPS 2020 · 56 citations)
What has been tried
47 papers here report 508 measured changes (a component added, removed or swapped, compared with a baseline): helped 64%, no clear effect 8%, hurt 22%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Vary demonstration count from 4-shot to 1-, 2-, 8-, or 12-shot | DBPedia test · accuracy | 83.1 (4.3); 75.4 (4.2); 76.0 (5.7); 82.7 (1.0); 80.7 (2.4) | Mixed | Privacy-Preserving In-Context Learning with Differentially Private Few-Shot Generation (ICLR 2024 · 8 citations) |
| Set privacy budget ε=0.25 rather than ε=8.0 | MMLU · Average accuracy | 56.48 -> 51.23 | Hurt | DR-Encoder: Encode Low-rank Gradients with Random Prior for Large Language Models Differentially Privately (AAAI 2025 · 4 citations) |
| Add fine-tuning on the logical constraint before rejection sampling | Adult logical constraints · XGB accuracy [%] | 82.9 ± 0.8 -> 84.7 ± 0.1; 84.5 ± 0.1 -> 84.8 ± 0.2; 85.1 ± 0.1 -> 85.0 ± 0.18 | Mixed | CuTS: Customizable Tabular Synthetic Data Generation (ICML 2024 · 4 citations) |
| Increase the number of teachers beyond the proposed upper bound | MNIST multi-class bias, minority class accuracy · Accuracy | Hurt | PFGuard: A Generative Framework with Privacy and Fairness Safeguards (ICLR 2025 · 2 citations) | |
| Use API new-vote selection instead of standard API rephrase | Yelp, ε=∞ · Rating accuracy | 0.542 -> 0.6645 | Helped | Differentially Private Synthetic Data via Foundation Model APIs 2: Text (ICML 2024 · 2 citations) |
| Use LLM-assisted CFG reformatting | ShareGPT · CFG-PR | + over 20% | Helped | Struct-Bench: A Benchmark for Differentially Private Structured Text Generation (NeurIPS 2025 · 1 citation) |
| increase Gaussian noise scale | Sycophancy · alignment accuracy | 68.09 -> 66.4 -> 61.3 -> 60.3 | Hurt | Differentially Private Steering for Large Language Model Alignment (ICLR 2025 · 1 citation) |
| Use BK-MixOpt for DP-MemArc_side instead of Opcaus | privacy constraint ε=1.6 · memory | 7.45 -> 6.18 | Helped | DP-MemArc: Differential Privacy Transfer Learning for Memory Efficient Language Models (AAAI 2025 · 0 citations) |
| Use physical batch size 128 rather than larger physical batch sizes | BertTiny training set · cross entropy | 3.586 vs 3.971, 4.01, and 4.057 | Helped | Scaling Laws for Differentially Private Language Models (ICML 2025 · 0 citations) |
| add similarity calibrator h to the contrastive filter g | COVIDx · Top-1 accuracy (%) | 56.59 -> 64.04 | Helped | PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs (ICML 2025 · 0 citations) |
| add contextual logits to the distance-only utility | SST-2 · classification accuracy | Helped | Cape: Context-Aware Prompt Perturbation Mechanism with Differential Privacy (ICML 2025 · 0 citations) | |
| Add low-quality examples to the contrastive prompt | IMDb · accuracy | 89.21 -> 89.52; 0.31% decrease without contrastive prompting | Helped | Contrastive Private Data Synthesis via Weighted Multi-PLM Fusion (ICML 2025 · 0 citations) |
Baseline numbers that disagree
The same baseline on the same benchmark and metric, reported more than 5% apart by different papers here. Training budgets, data splits and reimplementations differ, so state which number you compare with.
| Baseline | Benchmark | Metric | Reported | Papers |
|---|---|---|---|---|
| DP-MERF | Fashion-MNIST | FID | 37 – 132.6 | 2 papers, e.g. ICLR 2022 and NeurIPS 2021 |
What reviewers will expect
Datasets and baselines named in the 24 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- SST-2 · 3 of 24 papers
- QNLI · 2 of 24 papers
- AGNews · 2 of 24 papers
- DBPedia · 2 of 24 papers
- TREC · 2 of 24 papers
- MNIST · 2 of 24 papers
- CIFAR-10 · 2 of 24 papers
Baselines
- Aug-PE · 3 of 24 papers
- DPSGD · 2 of 24 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 65 papers; from OpenAlex and the papers' affiliations).
- Microsoft · 5 papers
- Tsinghua University · 4 papers
- Google · 4 papers
- Massachusetts Institute of Technology · 3 papers
- Shanghai Jiao Tong University · 3 papers
- Southeast University · 2 papers
- Zhejiang University · 2 papers
- University of California, Los Angeles · 2 papers
- University of Washington · 2 papers
- Princeton University · 2 papers
Use it
Download BibTeX of 35 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Private training with public data (96 papers)
- DP-SGD refinements (60 papers)
- Differentially private federated learning (35 papers)
Elsewhere in the topic
- Privacy accounting and mechanisms (127 papers)
- Private online and user-level learning (116 papers)
- Local-DP and private estimation (113 papers)
- Private data analysis frameworks (105 papers)
- Differentially private clustering (41 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).