Research map / Federated learning and privacy / Differential privacy
Private data analysis frameworks
Design private release, counting and sensitivity-bounding methods for data analysis.
105 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Differential privacy, keyword cluster “estimation · error · algorithms”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
28 papers in 2023–24 and 23 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 13.0% to 8.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Differentially Private Chi-Squared Hypothesis Testing: Goodness of Fit and Independence Testing (ICML 2016 · 39 citations)
- 2017 · Collecting Telemetry Data Privately (NeurIPS 2017 · 262 citations)
- 2018 · Scalable Private Learning with PATE (ICLR 2018 · 313 citations)
- 2019 · Bounding User Contributions: A Bias-Variance Trade-off in Differential Privacy (ICML 2019 · 33 citations)
- 2020 · Auditing Differentially Private Machine Learning: How Private is Private SGD? (NeurIPS 2020 · 73 citations)
- 2021 · Differentially Private and Fair Deep Learning: A Lagrangian Dual Approach (AAAI 2021 · 45 citations)
- 2022 · Differentially Private Graph Learning via Sensitivity-Bounded Personalized PageRank (NeurIPS 2022 · 3 citations)
- 2023 · Echo of Neighbors: Privacy Amplification for Personalized Private Federated Learning with Shuffle Model (AAAI 2023 · 13 citations)
- 2024 · One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · 5 citations)
- 2025 · Federated t-SNE and UMAP for Distributed Data Visualization (AAAI 2025 · 5 citations)
- 2026 · Accuracy-First Rényi Differential Privacy and Post-Processing Immunity (ICML 2026 · 0 citations)
Earliest papers here
- Differentially Private Chi-Squared Hypothesis Testing: Goodness of Fit and Independence Testing (ICML 2016 · 39 citations)
- Logical Foundations of Privacy-Preserving Publishing of Linked Data (AAAI 2016 · 29 citations)
- Differential Privacy without Sensitivity (NeurIPS 2016 · 19 citations)
What has been tried
88 papers here report 637 measured changes (a component added, removed or swapped, compared with a baseline): helped 65%, no clear effect 8%, hurt 21%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add noise for privacy protection | MNIST IID · NMI | 0.7534±0.0202 -> 0.7471±0.0073 | Hurt | Federated t-SNE and UMAP for Distributed Data Visualization (AAAI 2025 · 5 citations) |
| Increase the number of canary presentations | Stackoverflow and EMNIST · ε estimate | Hurt | One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · 5 citations) | |
| increase Phase 1 failure rate F1 | Connecticut, race groups · survey cost | Hurt | Fairness Issues and Mitigations in (Differentially Private) Socio-Demographic Data Processes (AAAI 2025 · 1 citation) | |
| Vary the buffer parameter λₙ among n⁻¹ᐟ², n⁻¹ᐟ⁴, and 1 | Simulations: sampled distributions · error across location, scale, skewness, and tails | No clear effect | Differentially Private Boxplots (ICML 2025 · 1 citation) | |
| Use degree-based thresholding instead of graph-independent uniform thresholding | BlogCatalog · NDCG | 0.15 to 0.2 | Helped | Differentially Private Graph Diffusion with Applications in Personalized PageRanks (NeurIPS 2024 · 1 citation) |
| set gamma to 1/K with sigma = 10 | Gaussian mixture simulation · variance | Hurt | Improving the Variance of Differentially Private Randomized Experiments through Clustering (ICML 2025 · 0 citations) | |
| Vary α toward 1 | Contextual bandit experiment (CATE) · regret | Helped | Privacy Preserving Adaptive Experiment Design (ICML 2024 · 0 citations) | |
| remove warm start | synthetic Gaussian linear regression · test loss | No clear effect | Optimal Differentially Private Model Training with Public Data (ICML 2024 · 0 citations) | |
| add NFR to MBM | Cora · accuracy | 64.5 -> 71.3; 77.9 -> 80.6; 78.9 -> 81.5 | Helped | Going Deeper into Locally Differentially Private Graph Neural Networks (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 17 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- MNIST · 2 of 17 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 51 papers; from OpenAlex and the papers' affiliations).
- Google · 12 papers
- University of Virginia · 3 papers
- Georgia Institute of Technology · 3 papers
- Purdue University · 3 papers
- Nokia Bell Labs · 3 papers
- University of Southern California · 3 papers
- Massachusetts Institute of Technology · 3 papers
- LinkedIn · 3 papers
- Tel Aviv University · 3 papers
- Harvard University · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Privacy accounting and mechanisms (127 papers)
- Private online and user-level learning (116 papers)
- Local-DP and private estimation (113 papers)
- Differentially private clustering (41 papers)
Elsewhere in the topic
- Private training with public data (96 papers)
- Differentially private synthetic data (81 papers)
- DP-SGD refinements (60 papers)
- Differentially private federated learning (35 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).