Newest papers

Privacy Accounting for Empirical Denoisers

William Cheng, Dongjun Kim, Mijung Park · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27710 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

虽然Cel differentially private (DP) 培训提供了正式的保证,它是通过私人样品质量的成本,在这个工作中,我们研究了一个补充的问题:在采样过程中发生了多少隐私损失,但他们的高记忆能力在隐私问题上提出了挑战,因为他们对单一的培训示例的敏感性通常是无法克服的。为了克服这一挑战,我们构建和分析了一种切割的隐私负责任的经验证词,一个Bayes最优的采样器的训练免受损失的列车估计,其每一步的敏感性可以被明确计算,允许每个采样步骤成为一个Gaussian信念机制。 我们的观点允许在Gaus DPebridion下快速计算隐私,当每个培训示例只为每一个采样贡献,并且在

Machine translation (Meta M2M100); the English original follows.

Abstract

Diffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns. While differentially private (DP) training provides formal guarantees, it comes at a cost in sample quality. In this work, we study a complementary question: how much privacy loss is incurred during the sampling process itself? Directly analyzing modern neural denoisers is challenging because their sensitivity to a single training example is generally intractable. To overcome this challenge, we construct and analyze a clipped privacy-accountable empirical denoiser, a training-free estimator of the Bayes-optimal denoiser, whose per-step sensitivity can be computed explicitly, allowing each denoising step to be a Gaussian mechanism. This perspective enables privacy accounting under Gaussian DP when each training example contributes to each denoising step, and under $f$-DP trade-off functions when each generated sample uses a single randomly subsampled block of the training data. We report every $(\varepsilon, δ)$ guarantee as a certified upper bound from a privacy loss distribution accountant, and use a cumulant-based Edgeworth approximation as a fast diagnostic, characterizing where it is reliable and where it becomes anti-conservative. We also analyze the privacy loss along the denoising trajectory and show that it grows steeply near the critical window in which semantic content is formed. This observation motivates hybrid samplers that use the private empirical denoiser through the formative steps where it remains a faithful proxy for the neural denoiser, then switch to a public neural denoiser for the remaining refinement. Our results on CIFAR-10 and CelebA-64 show that the privacy of diffusion models depends not only on the training procedure, but also on sampling-time design choices such as subsampling, stopping time, and hybrid denoising.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Estimator, Artificial intelligence, Machine learning, Sample (material), Importance sampling

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange