Newest papers

Privacy Accounting for Empirical Denoisers

William Cheng, Dongjun Kim, Mijung Park · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27710 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

Este modelo de difusão permanece perto da privacidade, como a base de dados de sistemas geradores modernos, mas sua alta capacidade de memória cumural levanta preocupações de privacidade. Enquanto o treinamento diferencial privado (DP) fornece garantias formais, ele vem a um custo de qualidade de amostra privada. Neste trabalho, estudamos uma pergunta complementar: quanta perda de privacidade é incorrida durante o processo de amostragem em si? Analisar diretamente sobre os denoisores neurais modernos por passo é desafiador porque sua sensibilidade a um único exemplo de treinamento é geralmente intractable. Para superar esse desafio, construímos e analisamos uma contabilidade de privacidade dividida com critérios difusos de privacidade. Neste trabalho, estudamos um critério empírico dividido, um estimador de motivação

Machine translation (Meta M2M100); the English original follows.

Abstract

Diffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns. While differentially private (DP) training provides formal guarantees, it comes at a cost in sample quality. In this work, we study a complementary question: how much privacy loss is incurred during the sampling process itself? Directly analyzing modern neural denoisers is challenging because their sensitivity to a single training example is generally intractable. To overcome this challenge, we construct and analyze a clipped privacy-accountable empirical denoiser, a training-free estimator of the Bayes-optimal denoiser, whose per-step sensitivity can be computed explicitly, allowing each denoising step to be a Gaussian mechanism. This perspective enables privacy accounting under Gaussian DP when each training example contributes to each denoising step, and under $f$-DP trade-off functions when each generated sample uses a single randomly subsampled block of the training data. We report every $(\varepsilon, δ)$ guarantee as a certified upper bound from a privacy loss distribution accountant, and use a cumulant-based Edgeworth approximation as a fast diagnostic, characterizing where it is reliable and where it becomes anti-conservative. We also analyze the privacy loss along the denoising trajectory and show that it grows steeply near the critical window in which semantic content is formed. This observation motivates hybrid samplers that use the private empirical denoiser through the formative steps where it remains a faithful proxy for the neural denoiser, then switch to a public neural denoiser for the remaining refinement. Our results on CIFAR-10 and CelebA-64 show that the privacy of diffusion models depends not only on the training procedure, but also on sampling-time design choices such as subsampling, stopping time, and hybrid denoising.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Estimator, Artificial intelligence, Machine learning, Sample (material), Importance sampling

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange