mlsanityData to 14 Oct 2026

Position: Considerations for Differentially Private Learning with Large-Scale Public Pretraining

arXiv 2212.06470 ↗First posted 13 Dec 2022cs.LG cs.CR stat.MLcited by 88

Not on the map. Why?

Abstract (arXiv)

The performance of differentially private machine learning can be boosted significantly by leveraging the transfer learning capabilities of non-private models pretrained on large public datasets. We critically review this approach. We primarily question whether the use of large Web-scraped datasets should be viewed as differential-privacy-preserving. We caution that publicizing these models pretrained on Web data as "private" could lead to harm and erode the public's trust in differential privacy as a meaningful definition of privacy. Beyond the privacy considerations of using public data, we further question the utility of this paradigm. We scrutinize whether existing machine learning benchmarks are appropriate for measuring the ability of pretrained models to generalize to sensitive domains, which may be poorly represented in public Web data. Finally, we notice that pretraining has been especially impactful for the largest available models -- models sufficiently large to prohibit end users running them on their own devices. Thus, deploying such models today could be a net loss for privacy, as it would require (private) data to be outsourced to a more compute-powerful third party. We conclude by discussing potential paths forward for the field of private learning, as public pretraining becomes more popular and powerful.

Key facts. Cited by 88 papers in the map (data through 14 Oct 2026). Builds on 53 of its 97 references that are in the map. First posted on arXiv 13 Dec 2022.

Builds on

53 of 97 references.

References · 53

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  5. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  6. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  7. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  10. 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
  11. 2022Training Compute-Optimal Large Language Modelscited by 3,019
  12. 2016Deep Learning with Differential Privacycited by 2,728
38 more
  1. 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,411
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2019CheXpert: A Large Chest Radiograph Dataset with Uncertainty Labels and Expert Comparisoncited by 1,423
  5. 2018Datasheets for Datasetscited by 1,386
  6. 2020WILDS: A Benchmark of in-the-Wild Distribution Shiftscited by 1,375
  7. 2019Deep Leakage from Gradientscited by 1,021
  8. 2021Scaling Vision Transformerscited by 999
  9. 2017ChestX-ray8: Hospital-scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseasescited by 972
  10. 2017Revisiting Unreasonable Effectiveness of Data in Deep Learning Eracited by 919
  11. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  12. 2021Deduplicating Training Data Makes Language Models Bettercited by 714
  13. 2017Renyi Differential Privacycited by 650
  14. 2020What Neural Networks Memorize and Why: Discovering the Long Tail via Influence Estimationcited by 497
  15. 2020MobileBERT: a Compact Task-Agnostic BERT for Resource-Limited Devicescited by 482
  16. 2022MaxViT: Multi-Axis Vision Transformercited by 476
  17. 2019Does Learning Require Memorization? A Short Tale about a Long Tailcited by 460
  18. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  19. 2021Large Language Models Can Be Strong Differentially Private Learnerscited by 412
  20. 2021Differentially Private Fine-tuning of Language Modelscited by 400
  21. 2019Transfusion: Understanding Transfer Learning for Medical Imagingcited by 368
  22. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  23. 2021CUAD: An Expert-Annotated NLP Dataset for Legal Contract Reviewcited by 236
  24. 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 235
  25. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 224
  26. 2022What Does it Mean for a Language Model to Preserve Privacy?cited by 195
  27. 2021Combined Scaling for Zero-shot Transfer Learningcited by 182
  28. 2021When the Curious Abandon Honesty: Federated Learning Is Not Privatecited by 127
  29. 2021Large-Scale Differentially Private BERTcited by 118
  30. 2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 102
  31. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 88
  32. 2022Toward Training at ImageNet Scale with Differential Privacycited by 87
  33. 2021Do Not Let Privacy Overbill Utility: Gradient Embedding Perturbation for Private Learningcited by 86
  34. 2022TAN Without a Burn: Scaling Laws of DP-SGDcited by 52
  35. 2022Geographic Spines in the 2020 Census Disclosure Avoidance Systemcited by 44
  36. 2022Large Scale Transfer Learning for Differentially Private Image Classificationcited by 41
  37. 2022On the Impossible Safety of Large AI Modelscited by 28
  38. 2022Measuring Datacited by 18

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 27; 2024: 22; 2025: 25; 2026: 14.

88 papers.

Sort:

By area:

  1. 2023Extracting Training Data from Diffusion Modelscited by 732
  2. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 258
  3. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  4. 2023How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacycited by 153
  5. 2024Guardrail Baselines for Unlearning in LLMscited by 96
  6. 2023Differentially Private Diffusion Models Generate Useful Synthetic Imagescited by 86
  7. 2024Differentially Private Synthetic Data via Foundation Model APIs 2: Textcited by 76
  8. 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progresscited by 63
  9. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 45
  10. 2024LLM-PBE: Assessing Data Privacy in Large Language Modelscited by 41
  11. 2023Why Is Public Pretraining Necessary for Private Model Training?cited by 37
  12. 2024Privacy-Preserving Instructions for Aligning Large Language Modelscited by 35
38 more
  1. 2024The Future of Large Language Model Pre-training is Federatedcited by 30
  2. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 29
  3. 2024PrE-Text: Training Language Models on Private Federated Data in the Age of LLMscited by 29
  4. 2023Selective Pre-training for Private Fine-tuningcited by 23
  5. 2023Differentially Private Image Classification by Learning Priors from Random Processescited by 19
  6. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 18
  7. 2023Exploring the Benefits of Visual Prompting in Differential Privacycited by 17
  8. 2024Prompt Public Large Language Models to Synthesize Data for Private On-device Applicationscited by 17
  9. 2025Does Generation Require Memorization? Creative Diffusion Models using Ambient Diffusioncited by 17
  10. 2023Choosing Public Datasets for Private Machine Learning via Gradient Subspace Distancecited by 16
  11. 2023Unlocking Accuracy and Fairness in Differentially Private Image Classificationcited by 16
  12. 2023Rethinking Privacy in Machine Learning Pipelines from an Information Flow Control Perspectivecited by 16
  13. 2025VaultGemma: A Differentially Private Gemma Modelcited by 16
  14. 2025Tokens for Learning, Tokens for Unlearning: Mitigating Membership Inference Attacks in Large Language Models via Dual-Purpose Trainingcited by 15
  15. 2023TMI! Finetuned Models Leak Private Information from their Pretraining Datacited by 14
  16. 2023Private Distribution Learning with Public Data: The View from Sample Compressioncited by 14
  17. 2023PrivImage: Differentially Private Synthetic Image Generation using Diffusion Models with Semantic-Aware Pretrainingcited by 13
  18. 2023On the Efficacy of Differentially Private Few-shot Image Classificationcited by 12
  19. 2023Privately Customizing Prefinetuning to Better Match User Data in Federated Learningcited by 12
  20. 2023Recent Advances of Differential Privacy in Centralized Deep Learning: A Systematic Surveycited by 12
  21. 2025The 2025 Foundation Model Transparency Indexcited by 11
  22. 2023PILLAR: How to make semi-private learning more effectivecited by 10
  23. 2025InvisibleInk: High-Utility and Low-Cost Text Generation with Differential Privacycited by 10
  24. 2024Pre-training Differentially Private Models with Limited Public Datacited by 8
  25. 2023Safeguarding Data in Multimodal AI: A Differentially Private Approach to CLIP Trainingcited by 7
  26. 2023Optimal Locally Private Nonparametric Classification with Public Datacited by 7
  27. 2025Mitigating Unintended Memorization with LoRA in Federated Learning for LLMscited by 7
  28. 2025Position: Machine Learning Conferences Should Establish a "Refutations and Critiques" Trackcited by 7
  29. 2024Estimating Privacy Leakage of Augmented Contextual Knowledge in Language Modelscited by 6
  30. 2025Membership Inference Attacks on Sequence Modelscited by 6
  31. 2025On Design Principles for Private Adaptive Optimizerscited by 6
  32. 2023On the Benefits of Public Representations for Private Transfer Learning under Distribution Shiftcited by 5
  33. 2024Delving into Differentially Private Transformercited by 5
  34. 2025Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data?cited by 5
  35. 2023Equivariant Differentially Private Deep Learning: Why DP-SGD Needs Sparser Modelscited by 4
  36. 2023A Unified View of Differentially Private Deep Generative Modelingcited by 4
  37. 2025Generating Synthetic Data with Formal Privacy Guarantees: State of the Art and the Road Aheadcited by 4
  38. 2025Towards Harnessing the Collaborative Power of Large and Small Models for Domain Taskscited by 4

50 most cited of 88 All 88 (JSON)