mlsanityData to 14 Oct 2026

Differentially Private Diffusion Models Generate Useful Synthetic Images

arXiv 2302.13861 ↗First posted 27 Feb 2023cs.LG cs.CR cs.CVcited by 86

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

The ability to generate privacy-preserving synthetic versions of sensitive image datasets could unlock numerous ML applications currently constrained by data availability. Due to their astonishing image generation quality, diffusion models are a prime candidate for generating high-quality synthetic data. However, recent studies have found that, by default, the outputs of some diffusion models do not preserve training data privacy. By privately fine-tuning ImageNet pre-trained diffusion models with more than 80M parameters, we obtain SOTA results on CIFAR-10 and Camelyon17 in terms of both FID and the accuracy of downstream classifiers trained on synthetic data. We decrease the SOTA FID on CIFAR-10 from 26.2 to 9.8, and increase the accuracy from 51.0% to 88.0%. On synthetic data from Camelyon17, we achieve a downstream accuracy of 91.1% which is close to the SOTA of 96.5% when training on the real data. We leverage the ability of generative models to create infinite amounts of data to maximise the downstream prediction performance, and further show how to use synthetic data for hyperparameter tuning. Our results demonstrate that diffusion models fine-tuned with differential privacy can produce useful and provably private synthetic data, even in applications with significant distribution shift between the pre-training and fine-tuning distributions.

Key facts. Cited by 86 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 66 of its 93 references that are in the map. First posted on arXiv 27 Feb 2023.

Builds on

66 of 93 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  2. 2023Extracting Training Data from Diffusion Models30 Jan
  3. 2023Membership Inference of Diffusion Models24 Jan
  4. 2022Differentially Private Diffusion Models18 Oct

Other references · 62

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  7. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  8. 2022Generative Adversarial Networkscited by 5,627
  9. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
  10. 2016Wide Residual Networkscited by 3,070
  11. 2016Improved Techniques for Training GANscited by 2,970
  12. 2016Deep Learning with Differential Privacycited by 2,728
38 more
  1. 2020WILDS: A Benchmark of in-the-Wild Distribution Shiftscited by 1,375
  2. 2018Demystifying MMD GANscited by 1,293
  3. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  4. 2018Assessing Generative Models via Precision and Recallcited by 406
  5. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 377
  6. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  7. 2019Transfusion: Understanding Transfer Learning for Medical Imagingcited by 368
  8. 2022Brain Imaging Generation with Latent Diffusion Modelscited by 268
  9. 2018Differentially Private Generative Adversarial Networkcited by 235
  10. 2020Deep Domain-Adversarial Image Generation for Domain Generalisationcited by 231
  11. 2022Unlocking High-Accuracy Differentially Private Image Classification through Scalecited by 224
  12. 2022The Role of ImageNet Classes in Fr'echet Inception Distancecited by 213
  13. 2021Towards Faster and Stabilized GAN Training for High-fidelity Few-shot Image Synthesiscited by 140
  14. 2018Differentially Private Empirical Risk Minimization Revisited: Faster and More Generalcited by 128
  15. 2019Reconstruction and Membership Inference Attacks against Generative Modelscited by 122
  16. 2020DP-CGAN: Differentially Private Synthetic Data and Label Generationcited by 118
  17. 2020GS-WGAN: A Gradient-Sanitized Approach for Learning Differentially Private Generatorscited by 117
  18. 2020Synthetic Data -- Anonymisation Groundhog Daycited by 108
  19. 2021Hyperparameter Tuning with Renyi Differential Privacycited by 104
  20. 2022AIM: An Adaptive and Iterative Mechanism for Differentially Private Synthetic Datacited by 90
  21. 2022RoentGen: Vision-Language Foundation Model for Chest X-ray Generationcited by 89
  22. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 88
  23. 2022Automatic Clipping: Differentially Private Deep Learning Made Easier and Strongercited by 88
  24. 2022Position: Considerations for Differentially Private Learning with Large-Scale Public Pretrainingcited by 88
  25. 2022Adapting Pretrained Vision-Language Foundational Models to Medical Imaging Domainscited by 86
  26. 2019Generative Models for Effective ML on Private, Decentralized Datasetscited by 85
  27. 2018A General Approach to Adding Differential Privacy to Iterative Training Procedurescited by 84
  28. 2020DP-MERF: Differentially Private Mean Embeddings with Random Features for Practical Privacy-Preserving Data Generationcited by 78
  29. 2021Don't Generate Me: Training Differentially Private Generative Models with Sinkhorn Divergencecited by 54
  30. 2020Differentially Private Synthetic Medical Data Generation using Convolutional GANscited by 52
  31. 2022Scalable and Efficient Training of Large Convolutional Neural Networks with Differential Privacycited by 48
  32. 2022A Multifaceted Benchmarking of Synthetic Electronic Health Record Generation Modelscited by 43
  33. 2022No Free Lunch Theorem for Security and Utility in Federated Learningcited by 39
  34. 2019PPGAN: Privacy-preserving Generative Adversarial Networkcited by 34
  35. 2022Private Set Generation with Discriminative Informationcited by 34
  36. 2021Drawing Multiple Augmentation Samples Per Image During Training Efficiently Decreases Test Errorcited by 33
  37. 2021DataLens: Scalable Privacy Preserving Training via Gradient Compression and Aggregationcited by 31
  38. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28

50 most cited of 62 All 62 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 23; 2024: 27; 2025: 24; 2026: 12.

86 papers.

Sort:

By area:

  1. 2023One-Dimensional Adapter to Rule Them All: Concepts, Diffusion Models and Erasing Applicationscited by 169
  2. 2023On the Generalization Properties of Diffusion Modelscited by 68
  3. 2023Differentially Private Synthetic Data via Foundation Model APIs 1: Imagescited by 65
  4. 2023Enhancing Deep Reinforcement Learning: A Tutorial on Generative Diffusion Models in Network Optimizationcited by 56
  5. 2023MedSyn: Text-guided Anatomy-aware Synthesis of High-Fidelity 3D CT Imagescited by 41
  6. 2024Privacy-Preserving Instructions for Aligning Large Language Modelscited by 35
  7. 2023DP-LDMs: Differentially Private Latent Diffusion Modelscited by 29
  8. 2024ClavaDDPM: Multi-relational Data Synthesis with Cluster-guided Diffusion Modelscited by 28
  9. 2023Augmenting medical image classifiers with synthetic data from latent diffusion modelscited by 22
  10. 2025On the Edge of Memorization in Diffusion Modelscited by 22
  11. 2024Differentially Private Fine-Tuning of Diffusion Modelscited by 20
  12. 2023Differentially Private Image Classification by Learning Priors from Random Processescited by 19
38 more
  1. 2023Synthetically Enhanced: Unveiling Synthetic Data's Potential in Medical Imaging Researchcited by 18
  2. 2023Training Data Protection with Compositional Diffusion Modelscited by 17
  3. 2024Shake to Leak: Fine-tuning Diffusion Models Can Amplify the Generative Privacy Riskcited by 17
  4. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  5. 2023Image retrieval outperforms diffusion models on data augmentationcited by 14
  6. 2025Provable Separations between Memorization and Generalization in Diffusion Modelscited by 14
  7. 2023PrivImage: Differentially Private Synthetic Image Generation using Diffusion Models with Semantic-Aware Pretrainingcited by 13
  8. 2025Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Modelcited by 13
  9. 2024Iterative Ensemble Training with Anti-Gradient Control for Mitigating Memorization in Diffusion Modelscited by 12
  10. 2025DPImageBench: A Unified Benchmark for Differentially Private Image Synthesiscited by 11
  11. 2023Using Diffusion Models to Generate Synthetic Labelled Data for Medical Image Segmentationcited by 10
  12. 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
  13. 2024Forte : Finding Outliers with Representation Typicality Estimationcited by 9
  14. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  15. 2024Neural Collapse Meets Differential Privacy: Curious Behaviors of NoisyGD with Near-perfect Representation Learningcited by 8
  16. 2023Boosting Data Analytics With Synthetic Volume Expansioncited by 7
  17. 2024On Differentially Private 3D Medical Image Synthesis with Controllable Latent Diffusion Modelscited by 7
  18. 2025From Easy to Hard: Building a Shortcut for Differentially Private Image Synthesiscited by 7
  19. 2025Struct-Bench: A Benchmark for Differentially Private Structured Text Generationcited by 7
  20. 2024Exploring Privacy and Fairness Risks in Sharing Diffusion Models: An Adversarial Perspectivecited by 6
  21. 2025Gradient Variance Reveals Failure Modes in Flow-Based Generative Modelscited by 6
  22. 2024DP-TLDM: Differentially Private Tabular Latent Diffusion Modelcited by 5
  23. 2024Clip Body and Tail Separately: High Probability Guarantees for DPSGD with Heavy Tailscited by 5
  24. 2024TimeAutoDiff: A Unified Framework for Generation, Imputation, Forecasting, and Time-Varying Metadata Conditioning of Heterogeneous Time Series Tabular Datacited by 5
  25. 2025Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data?cited by 5
  26. 2025CheXGenBench: A Unified Benchmark For Fidelity, Privacy and Utility of Synthetic Chest Radiographscited by 5
  27. 2023A Unified View of Differentially Private Deep Generative Modelingcited by 4
  28. 2023Differentially Private Gradient Flow based on the Sliced Wasserstein Distancecited by 4
  29. 2024CCFC: Bridging Federated Clustering and Contrastive Learningcited by 4
  30. 2024DP-RDM: Adapting Diffusion Models to Private Domains Without Fine-Tuningcited by 4
  31. 2024MemControl: Mitigating Memorization in Diffusion Models via Automated Parameter Selectioncited by 4
  32. 2024CollaFuse: Collaborative Diffusion Modelscited by 4
  33. 2025Generating Synthetic Data with Formal Privacy Guarantees: State of the Art and the Road Aheadcited by 4
  34. 2025Improving Noise Efficiency in Privacy-preserving Dataset Distillationcited by 4
  35. 2025Improving the Generation and Evaluation of Synthetic Data for Downstream Medical Causal Inferencecited by 4
  36. 2023When Synthetic Data Met Regulationcited by 3
  37. 2024Synthetic Data Aided Federated Learning Using Foundation Modelscited by 3
  38. 2024Enhancing the Utility of Privacy-Preserving Cancer Classification using Synthetic Datacited by 3

50 most cited of 86 All 86 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Leveraging Programmatically Generated Synthetic Data for Differentially Private Diffusion Training
  2. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoising
  3. 2024Private Synthetic Text Generation with Diffusion Models
  4. 2024Gradient Inversion of Federated Diffusion Models
  5. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation
  6. 2023Privacy Distillation: Reducing Re-identification Risk of Multimodal Diffusion Models
  7. 2025Enabling PSO-Secure Synthetic Data Sharing Using Diversity-Aware Diffusion Models
  8. 2023PriSampler: Mitigating Property Inference of Diffusion Models