# Differential Privacy Under Class Imbalance: Methods and Empirical Insights

arXiv: https://arxiv.org/abs/2411.05733 · HTML: https://mlsanity.com/paper/2411.05733/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 97 references that are in the map.
- First posted on arXiv 8 Nov 2024.

## Builds on (most cited first, 12 of 12)

- [Opacus: User-Friendly Differential Privacy Library in PyTorch](https://mlsanity.com/paper/2109.12298/) (2021)
- [Hyperparameter Tuning with Renyi Differential Privacy](https://mlsanity.com/paper/2110.03620/) (2021)
- [AIM: An Adaptive and Iterative Mechanism for Differentially Private Synthetic Data](https://mlsanity.com/paper/2201.12677/) (2022)
- [Benchmarking Differentially Private Synthetic Data Generation Algorithms](https://mlsanity.com/paper/2112.09238/) (2021)
- [Differentially Private Synthetic Data: Applied Evaluations and Enhancements](https://mlsanity.com/paper/2011.05537/) (2020)
- [Removing Disparate Impact of Differentially Private Stochastic Gradient Descent on Model Accuracy](https://mlsanity.com/paper/2003.03699/) (2020)
- [Mean estimation in the add-remove model of differential privacy](https://mlsanity.com/paper/2312.06658/) (2023)
- [On the Intrinsic Differential Privacy of Bagging](https://mlsanity.com/paper/2008.09845/) (2020)
- [Improving Correlation Capture in Generating Imbalanced Data using Differentially Private Conditional GANs](https://mlsanity.com/paper/2206.13787/) (2022)
- [A Differentially Private Weighted Empirical Risk Minimization Procedure and its Application to Outcome Weighted Learning](https://mlsanity.com/paper/2307.13127/) (2023)
- [A Minimax Theory for Adaptive Data Analysis](https://mlsanity.com/paper/1602.04287/) (2016)
- [Statistical Privacy Guarantees of Machine Learning Preprocessing Techniques](https://mlsanity.com/paper/2109.02496/) (2021)

## Built on by (most cited first, 6 of 6)

- [Privately Fine-Tuned LLMs Preserve Temporal Dynamics in Tabular Data](https://mlsanity.com/paper/2602.02766/) (2026)
- [Bayesian Pseudo Posterior Mechanism for Differentially Private Machine Learning](https://mlsanity.com/paper/2503.21528/) (2025)
- [Steps Adaptive Decay DPSGD: Enhancing Performance on Imbalanced Datasets with Differential Privacy with HAM10000](https://mlsanity.com/paper/2507.06619/) (2025)
- [A theoretical framework for M-posteriors: frequentist guarantees and robustness properties](https://mlsanity.com/paper/2510.01358/) (2025)
- [Informationally Compressive Anonymization: Non-Degrading Sensitive Input Protection for Privacy-Preserving Supervised Machine Learning](https://mlsanity.com/paper/2603.15842/) (2026)
- [Imbalanced Classification under Capacity Constraints](https://mlsanity.com/paper/2605.03289/) (2026)

## Abstract (arXiv)

Imbalanced learning occurs in classification settings where the distribution of class-labels is highly skewed in the training data, such as when predicting rare diseases or in fraud detection. This class imbalance presents a significant algorithmic challenge, which can be further exacerbated when privacy-preserving techniques such as differential privacy are applied to protect sensitive training data. Our work formalizes these challenges and provides a number of algorithmic solutions. We consider DP variants of pre-processing methods that privately augment the original dataset to reduce the class imbalance; these include oversampling, SMOTE, and private synthetic data generation. We also consider DP variants of in-processing techniques, which adjust the learning algorithm to account for the imbalance; these include model bagging, class-weighted empirical risk minimization and class-weighted deep learning. For each method, we either adapt an existing imbalanced learning technique to the private setting or demonstrate its incompatibility with differential privacy. Finally, we empirically evaluate these privacy-preserving imbalanced learning methods under various data and distributional settings. We find that private synthetic data methods perform well as a data pre-processing step, while class-weighted ERMs are an alternative in higher-dimensional settings where private synthetic data suffers from the curse of dimensionality.