mlsanityData to 7 Oct 2026

Differentially Private Diffusion Models

arXiv 2210.09929 ↗First posted 18 Oct 2022stat.ML cs.CR cs.LGcited by 118

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

While modern machine learning models rely on increasingly large training datasets, data is often limited in privacy-sensitive domains. Generative models trained with differential privacy (DP) on sensitive data can sidestep this challenge, providing access to synthetic data instead. We build on the recent success of diffusion models (DMs) and introduce Differentially Private Diffusion Models (DPDMs), which enforce privacy using differentially private stochastic gradient descent (DP-SGD). We investigate the DM parameterization and the sampling algorithm, which turn out to be crucial ingredients in DPDMs, and propose noise multiplicity, a powerful modification of DP-SGD tailored to the training of DMs. We validate our novel DPDMs on image generation benchmarks and achieve state-of-the-art performance in all experiments. Moreover, on standard benchmarks, classifiers trained on DPDM-generated synthetic data perform on par with task-specific DP-SGD-trained classifiers, which has not been demonstrated before for DP generative models. Project page and code: https://nv-tlabs.github.io/DPDM.

Key facts. Cited by 118 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 83 of its 121 references that are in the map. First posted on arXiv 18 Oct 2022.

Builds on

83 of 121 references.

References · 83

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  11. 2022Classifier-Free Diffusion Guidancecited by 5,717
  12. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
38 more
  1. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  2. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  3. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  4. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  7. 2020Extracting Training Data from Large Language Modelscited by 2,144
  8. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  9. 2022Imagen Video: High Definition Video Generation with Diffusion Modelscited by 1,765
  10. 2022Make-A-Video: Text-to-Video Generation without Text-Video Datacited by 1,725
  11. 2021Image Super-Resolution via Iterative Refinementcited by 1,506
  12. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  13. 2021Palette: Image-to-Image Diffusion Modelscited by 1,296
  14. 2020Training Generative Adversarial Networks with Limited Datacited by 1,184
  15. 2021Alias-Free Generative Adversarial Networkscited by 1,181
  16. 2021Cascaded Diffusion Models for High Fidelity Image Generationcited by 1,155
  17. 2021Variational Diffusion Modelscited by 1,145
  18. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  19. 2022Denoising Diffusion Restoration Modelscited by 951
  20. 2021Diffusion Probabilistic Models for 3D Point Cloud Generationcited by 734
  21. 2022Pseudo Numerical Methods for Diffusion Models on Manifoldscited by 695
  22. 2018Which Training Methods for GANs do actually Converge?cited by 672
  23. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  24. 2017Renyi Differential Privacycited by 643
  25. 2021Score-based Generative Modeling in Latent Spacecited by 634
  26. 2020WaveGrad: Estimating Gradients for Waveform Generationcited by 620
  27. 2022LION: Latent Point Diffusion Models for 3D Shape Generationcited by 552
  28. 2022Fast Sampling of Diffusion Models with Exponential Integratorcited by 526
  29. 20213D Shape Generation and Completion through Point-Voxel Diffusioncited by 516
  30. 2021Tackling the Generative Learning Trilemma with Denoising Diffusion GANscited by 515
  31. 2017Towards Principled Methods for Training Generative Adversarial Networkscited by 460
  32. 2021SRDiff: Single Image Super-Resolution with Diffusion Probabilistic Modelscited by 415
  33. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 405
  34. 2021Differentially Private Fine-tuning of Language Modelscited by 392
  35. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
  36. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  37. 2018Scalable Private Learning with PATEcited by 266
  38. 2020The Creation and Detection of Deepfakes: A Surveycited by 246

50 most cited of 83 All 83 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 31; 2024: 33; 2025: 30; 2026: 22.

118 papers.

Sort:

By area:

  1. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 921
  2. 2023Extracting Training Data from Diffusion Modelscited by 723
  3. 2023Machine Learning for Synthetic Data Generation: A Reviewcited by 118
  4. 2023Differentially Private Diffusion Models Generate Useful Synthetic Imagescited by 85
  5. 2023When Foundation Model Meets Federated Learning: Motivations, Challenges, and Future Directionscited by 83
  6. 2023On the Generalization Properties of Diffusion Modelscited by 67
  7. 2023Differentially Private Synthetic Data via Foundation Model APIs 1: Imagescited by 63
  8. 2024Erasing Undesirable Influence in Diffusion Modelscited by 52
  9. 2024Towards Memorization-Free Diffusion Modelscited by 49
  10. 2023A Pathway Towards Responsible AI Generated Contentcited by 38
  11. 2023SoK: Privacy-Preserving Data Synthesiscited by 37
  12. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Modelscited by 35
38 more
  1. 2024Privacy-Preserving Instructions for Aligning Large Language Modelscited by 34
  2. 2024On the Challenges and Opportunities in Generative AIcited by 31
  3. 2024PrE-Text: Training Language Models on Private Federated Data in the Age of LLMscited by 29
  4. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 28
  5. 2024ClavaDDPM: Multi-relational Data Synthesis with Cluster-guided Diffusion Modelscited by 28
  6. 2023AutoDiff: combining Auto-encoder and Diffusion model for tabular data synthesizingcited by 24
  7. 2025Bigger Isn't Always Memorizing: Early Stopping Overparameterized Diffusion Modelscited by 24
  8. 2024How Private are DP-SGD Implementations?cited by 22
  9. 2025Training-Free Safe Denoisers for Safe Use of Diffusion Modelscited by 19
  10. 2023Privacy Distillation: Reducing Re-identification Risk of Multimodal Diffusion Modelscited by 18
  11. 2024Differentially Private Fine-Tuning of Diffusion Modelscited by 18
  12. 2023Private GANs, Revisitedcited by 17
  13. 2023Training Data Protection with Compositional Diffusion Modelscited by 16
  14. 2024Scalable DP-SGD: Shuffling vs. Poisson Subsamplingcited by 16
  15. 2023Differentially Private Neural Tangent Kernels for Privacy-Preserving Data Generationcited by 15
  16. 2023Challenges and Remedies to Privacy and Security in AIGC: Exploring the Potential of Privacy Computing, Blockchain, and Beyondcited by 14
  17. 2024Balls-and-Bins Sampling for DP-SGDcited by 13
  18. 2025Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Modelcited by 13
  19. 2023PrivImage: Differentially Private Synthetic Image Generation using Diffusion Models with Semantic-Aware Pretrainingcited by 12
  20. 2024Iterative Ensemble Training with Anti-Gradient Control for Mitigating Memorization in Diffusion Modelscited by 12
  21. 2022A New Linear Scaling Rule for Private Adaptive Hyperparameter Optimizationcited by 11
  22. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  23. 2025Stochastic Forward-Backward Deconvolution: Training Diffusion Models with Finite Noisy Datasetscited by 11
  24. 2025DPImageBench: A Unified Benchmark for Differentially Private Image Synthesiscited by 11
  25. 2023Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacycited by 10
  26. 2025InvisibleInk: High-Utility and Low-Cost Text Generation with Differential Privacycited by 10
  27. 2023A Survey of Emerging Applications of Diffusion Probabilistic Models in MRIcited by 9
  28. 2024Unconditional Latent Diffusion Models Memorize Patient Imaging Data: Implications for Openly Sharing Synthetic Datacited by 9
  29. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  30. 2025Synthesize Privacy-Preserving High-Resolution Images via Private Textual Intermediariescited by 8
  31. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  32. 2025From Easy to Hard: Building a Shortcut for Differentially Private Image Synthesiscited by 6
  33. 2023Generating tabular datasets under differential privacycited by 5
  34. 2024DP-TLDM: Differentially Private Tabular Latent Diffusion Modelcited by 5
  35. 2024Risks When Sharing LoRA Fine-Tuned Diffusion Model Weightscited by 5
  36. 2023PriSampler: Mitigating Property Inference of Diffusion Modelscited by 4
  37. 2023A Unified View of Differentially Private Deep Generative Modelingcited by 4
  38. 2023Differentially Private Gradient Flow based on the Sliced Wasserstein Distancecited by 4

50 most cited of 118 All 118 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training
  2. 2025DP-DocLDM: Differentially Private Document Image Generation using Latent Diffusion Models
  3. 2024Efficient Differentially Private Fine-Tuning of Diffusion Models
  4. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoising
  5. 2024Gradient Inversion of Federated Diffusion Models
  6. 2024Private Synthetic Text Generation with Diffusion Models
  7. 2026Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models
  8. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation