Research map / Federated learning and privacy / Differential privacy
Private training with public data
Reduce accuracy loss of differentially private models with public data, finetuning and new mechanisms.
96 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Differential privacy, keyword cluster “dp sgd · gradient · clipping”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
40 papers in 2023–24 and 34 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 18.6% to 12.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Differentially private Bayesian learning on distributed data (NeurIPS 2017 · 34 citations)
- 2019 · Differential Privacy Has Disparate Impact on Model Accuracy (NeurIPS 2019 · 76 citations)
- 2020 · Privacy-Preserving Gradient Boosting Decision Trees (AAAI 2020 · 67 citations)
- 2021 · Tempered Sigmoid Activations for Deep Learning with Differential Privacy (AAAI 2021 · 102 citations)
- 2022 · DPNAS: Neural Architecture Search for Deep Learning with Differential Privacy (AAAI 2022 · 29 citations)
- 2023 · Learning To Generate Image Embeddings With User-Level Differential Privacy (CVPR 2023 · 20 citations)
- 2024 · Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining (ICML 2024 · 9 citations)
- 2025 · Privacy, Utility and Fairness: Navigating Trade-offs in Differentially Private Machine Learning (AAAI 2025 · 2 citations)
- 2026 · Revisiting ML Training under Fully Homomorphic Encryption: Convergence Guarantees, Differential Privacy, and Efficient Algorithms (ICML 2026 · 0 citations)
Earliest papers here
- Differentially private Bayesian learning on distributed data (NeurIPS 2017 · 34 citations)
- Differential Privacy Has Disparate Impact on Model Accuracy (NeurIPS 2019 · 76 citations)
- Differentially Private Markov Chain Monte Carlo (NeurIPS 2019 · 10 citations)
What has been tried
72 papers here report 633 measured changes (a component added, removed or swapped, compared with a baseline): helped 64%, no clear effect 9%, hurt 22%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| replace DDPM synthesis with EDM synthesis | CIFAR-10 · test accuracy | 72.0% -> 75.13 % | Helped | In-distribution Public Data Synthesis with Diffusion Models for Differentially Private Image Classification (CVPR 2024 · 5 citations) |
| Freeze all weights while retaining forward hooks | QQP · training time per epoch | 119 minutes -> 80 minutes | Helped | Differentially Private Bias-Term Fine-tuning of Foundation Models (ICML 2024 · 5 citations) |
| increase synthetic initialization training by adding Shaders21K initialization | ImageNet-1K linear probing · accuracy | more than 24% | Helped | Differentially Private Representation Learning via Image Captioning (ICML 2024 · 3 citations) |
| Use noiseless rather than noisy training simulation to select the biased dimension | Housing · privacy auditing lower bound | Helped | Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model (ICLR 2025 · 1 citation) | |
| Use shared rather than unshared embedding parameters | MovieLens, ε=5 · NDCG@10 | Helped | Delving into Differentially Private Transformer (ICML 2024 · 1 citation) | |
| allow duplicate examples in greedy contribution bounding | arXiv test set · loss | Helped | It's My Data Too: Private ML for Datasets with Multi-User Training Examples (ICML 2025 · 0 citations) | |
| Add learning-rate decay to PMSVM-GP | UCI datasets · accuracy | Mixed | Multi-Class Support Vector Machine with Differential Privacy (NeurIPS 2025 · 0 citations) | |
| Increase the capped node degree K | Text-attributed graph relation prediction · utility | Helped | Differentially Private Relational Learning with Entity-level Privacy Guarantees (NeurIPS 2025 · 0 citations) | |
| Update the learning rate every iteration rather than less frequently | CIFAR100, ViT-Base · training time (minutes) | 152.617 (\times 1.370) -> 118.483 (\times 1.063) -> 113.317 (\times 1.017) | Hurt | Towards hyperparameter-free optimization with differential privacy (ICLR 2025 · 0 citations) |
| Set ν to 0, removing exponential damping from the correlations | CIFAR-10 and StackOverflow · accuracy | Hurt | Correlated Noise Provably Beats Independent Noise for Differentially Private Learning (ICLR 2024 · 0 citations) | |
| Project perturbed training and test features onto the top 10 PCA components | CIFAR-10 · accuracy | Helped | Neural Collapse meets Differential Privacy: Curious behaviors of NoisyGD with Near-Perfect Representation Learning (ICML 2024 · 0 citations) | |
| Evaluate the maximum rather than the mean across secrets | Experiments across datasets and models · Qualitative persistence of key results | No clear effect | Empirical Privacy Variance (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 17 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 7 of 17 papers
- CIFAR-100 · 3 of 17 papers
- Fashion-MNIST · 2 of 17 papers
- MNIST · 2 of 17 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 74 papers; from OpenAlex and the papers' affiliations).
- Google · 18 papers
- Princeton University · 4 papers
- Google DeepMind · 4 papers
- University of Illinois, Urbana Champaign · 4 papers
- New York University · 3 papers
- Seoul National University · 3 papers
- Harvard University · 3 papers
- Purdue University · 3 papers
- Stanford University · 3 papers
- University of Pennsylvania · 3 papers
Use it
Download BibTeX of 39 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Differentially private synthetic data (81 papers)
- DP-SGD refinements (60 papers)
- Differentially private federated learning (35 papers)
Elsewhere in the topic
- Privacy accounting and mechanisms (127 papers)
- Private online and user-level learning (116 papers)
- Local-DP and private estimation (113 papers)
- Private data analysis frameworks (105 papers)
- Differentially private clustering (41 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).