Paper accounts privacy loss during diffusion-model sampling
Original title: Privacy Accounting for Empirical Denoisers
On CIFAR-10 and CelebA-64, loss rises sharply while semantic content forms, motivating hybrid denoisers.
The paper studies privacy loss during diffusion sampling rather than only during differentially private training. It analyzes a clipped, training-free empirical denoiser whose per-step sensitivity can be treated as a Gaussian mechanism, with guarantees reported as certified upper bounds. Results on CIFAR-10 and CelebA-64 say sampling choices such as subsampling, stopping time and hybrid denoising also affect privacy.
Unconfirmed: The Edgeworth approximation can become anti-conservative outside the region the authors characterize as reliable.
- Each denoising step is modeled as a Gaussian mechanism.
- Gaussian DP and f-DP cover different data-use settings.
- An Edgeworth approximation is used only as a fast diagnostic.
- Hybrid samplers switch to a public neural denoiser after formative steps.
From the original article
1 min read at arxiv.orgDiffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns. While differentially private (DP) training provides formal guarantees, it comes at a cost in sample quality. In this work, we study a complementary question: how much privacy loss is incurred during the sampling process itself?
By William Cheng · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.