PaperlayerView exact revision on arXiv

Source-linked AI summary

Differentially Private Diffusion Models Generate Useful Synthetic Images

Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Ira Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L. Smith, Olivia Wiles, Borja Balle

arXiv:2302.13861v1cs.LGcs.CRcs.CVstat.ML

TL;DR

Sharing sensitive data can carry ethical and legal risks, and non-private generative models may reveal training examples. The paper privately fine-tunes ImageNet-pretrained diffusion models for synthetic image generation. It reports improved CIFAR-10 and Camelyon17 utility, and finds that synthetic-data tuning trends translate to private-data tuning.

  • Problem

    Sensitive data is difficult to use or share safely, while generative models can memorize training examples and expose private information.

    Source: §1 · pp. 1–2

  • Method

    The authors privately fine-tune ImageNet-pretrained diffusion models, using pre-training to support large models and substantial distribution shifts.

    Source: §1 · p. 2, §4 · p. 5

  • Results

    CIFAR-10 FID falls from 26.8 to 9.8, and Camelyon17 synthetic-data classification reaches 91.1% accuracy versus 96.5% on real data.

    Source: §1 · pp. 2–3, §7 · p. 11

  • Takeaways & Limitations

    Synthetic data can support downstream model selection: hyperparameter-tuning trends on synthetic data are reflected when tuning on private data.

    Source: §6 · p. 10, §7 · p. 11

    FID and related metrics can vary with image-quality-unrelated factors and may miss image-distribution nuances, especially when data differ substantially from ImageNet.

    Source: §5.1 · pp. 6–7

Abstract

from arXiv · show

The ability to generate privacy-preserving synthetic versions of sensitive image datasets could unlock numerous ML applications currently constrained by data availability. Due to their astonishing image generation quality, diffusion models are a prime candidate for generating high-quality synthetic data. However, recent studies have found that, by default, the outputs of some diffusion models do not preserve training data privacy. By privately fine-tuning ImageNet pre-trained diffusion models with more than 80M parameters, we obtain SOTA results on CIFAR-10 and Camelyon17 in terms of both FID and the accuracy of downstream classifiers trained on synthetic data. We decrease the SOTA FID on CIFAR-10 from 26.2 to 9.8, and increase the accuracy from 51.0% to 88.0%. On synthetic data from Camelyon17, we achieve a downstream accuracy of 91.1% which is close to the SOTA of 96.5% when training on the real data. We leverage the ability of generative models to create infinite amounts of data to maximise the downstream prediction performance, and further show how to use synthetic data for hyperparameter tuning. Our results demonstrate that diffusion models fine-tuned with differential privacy can produce useful and provably private synthetic data, even in applications with significant distribution shift between the pre-training and fine-tuning distributions.

1. Introduction

Sensitive-data access creates ethical and legal risks, while non-private generative models can memorize and reveal training examples. The paper privately fine-tunes ImageNet-pretrained diffusion models and reports useful synthetic data for downstream classification and model selection.

Motivation

  • Sharing sensitive personal data for real-world ML applications can introduce ethical and legal risks, motivating synthetic data that follows the same distribution.The desired synthetic data should also support downstream statistical analysis, exploration, model selection, training, and testing.Source: §1 · p. 1
  • Out-of-the-box generative models, including diffusion models, can memorize and regenerate training examples, potentially revealing private information.Differential privacy can bound information leaked about individual training examples, but DP-SGD slows training and large models trained from scratch often suffer utility degradation.Source: §1 · pp. 1–2

Contributions

  • ImageNet pre-training enables privately fine-tuned models with more than 80M parameters to outperform prior work on more challenging datasets, at 45x the model size of Dockhorn et al. (2022).The reported results include datasets with substantial distribution shift from pre-training to fine-tuning.Source: §1 · p. 2
  • CIFAR-10 FID falls from 26.8 to 9.8, while Camelyon17 synthetic-data classification reaches 91.1% accuracy versus 96.5% on real data.The paper also reports that larger synthetic datasets and ensembling further improve downstream accuracy without additional privacy cost.Source: §1 · pp. 2–3
  • Hyperparameter-tuning trends found on synthetic data are also reflected when tuning on the private dataset.The paper proposes synthetic data as a way to gain initial model-selection insights while reducing experiments on sensitive records.Source: §1 · p. 3

2. Related Work

Prior work on differentially private image generation has largely used GANs, VAEs, custom architectures, or relatively simple image datasets. The paper identifies limits in both the scope of prior image-generation results and how synthetic-data utility is evaluated.

Differentially private synthetic image generation

  • DP image generation has mainly applied private gradient procedures to GANs or VAEs, with only Dockhorn et al. (2022) analyzing DP gradient descent on diffusion models; other efforts use custom architectures.Harder et al. (2022) privatize the mean of public-pretrained perceptual feature embeddings before training a generative model.Source: §2 · p. 3

Limited success on natural images

  • Most prior DP image-generation results concern MNIST, FashionMNIST, or downsampled CelebA, while CIFAR-10 and Camelyon are more complex; prior CIFAR-10 work reported FID 97.7 from scratch and FID 26.8 with pre-training.Harder et al. (2022) also reported 51% downstream accuracy for its pre-trained CIFAR-10 model.Source: §2 · p. 3

Limited targeted evaluation

  • FID and synthetic-trained classifier performance can give different conclusions, and FID varies with factors such as sample count and Inception-network version.Dockhorn et al. (2022) identify samplers that minimize FID or downstream test loss, respectively.Source: §2 · p. 4
  • High scores on common metrics may still miss important first- or second-order statistics, motivating additional downstream evaluations.The cited work reports such shortcomings for synthetic data despite high metric scores.Source: §2 · p. 4

3. Background

The background introduces diffusion models, differential privacy, and DP-SGD, then explains why privately training diffusion models is difficult. Diffusion models learn to reverse a noise process, while DP-SGD clips and noises gradients under a privacy budget.

3.1. Denoising Diffusion Probabilistic Models

  • Diffusion models learn a backward denoising chain, training a network to predict the noise in samples corrupted at different timesteps.At inference, a noise sample is progressively denoised to produce a final sample.Source: §3.1 · p. 4

3.2. Differential Privacy

  • Differential privacy bounds how much one observation can change a randomized algorithm’s output distribution, with smaller ε and δ providing stronger privacy.The pair (ε, δ) is the privacy budget.Source: §3.2 · p. 4

3.3. Differentially Private Stochastic Gradient Descent

  • DP-SGD clips per-example gradients and adds Gaussian noise to the minibatch gradient; noise, batch size, and training iterations are constrained by the privacy budget.These hyperparameters can substantially affect model accuracy.Source: §3.3 · p. 5
  • Diffusion models are costlier to train than classifiers and their training noise compounds with DP-SGD noise, making efficient and accurate private training unclear.The cited CIFAR-10 example uses 800k diffusion-training steps versus fewer than 80k steps for a Wide ResNet classifier.Source: §3.3 · p. 5

4. Improvements towards Fine-Tuning Diffusion Models with Privacy

The paper adapts pre-training, augmentation multiplicity, and timestep sampling to private diffusion fine-tuning. Its sampling results support focusing limited training capacity on moderately noisy, harder-to-learn timesteps.

Pre-training

  • Pre-training on ImageNet32 is used by default and supports realistic image generation despite substantial distribution shift between pre-training and fine-tuning data.The paper identifies pre-training as integral to generating realistic image datasets.Source: §4 · p. 5

Augmentation multiplicity with timesteps

  • Augmentation multiplicity averages gradients across image augmentations and sampled timesteps before clipping, combining random crops and flips with timestep multiplicity.Unlike Dockhorn et al. (2022), the authors report increasing benefits with more augmentation samples and use up to 128 for computational reasons.Source: §4 · p. 6

Modified timestep sampling

  • Modified timestep sampling assigns lower probability outside CIFAR-10 timesteps [30, 600] for T = 1,000, and focusing on harder moderate timesteps improves test performance even on MNIST trained from scratch.The authors reason that pre-trained models transfer more readily at small and large timesteps, while moderate timesteps require more awareness of the target distribution.Source: §4 · p. 6

5. Empirical Results on Differentially Private Image Generation and their Evaluation

The experiments evaluate private diffusion models through image-quality metrics and downstream utility, reporting results on MNIST, Camelyon17, and CIFAR-10. Fine-tuning improves CIFAR-10 results over prior work, while synthetic-data classifiers also perform strongly on Camelyon17 despite distribution shift.

5.1. Current Evaluation Framework for DP Image Generators

  • FID can mislead because it varies with factors unrelated to image quality and may miss image-distribution nuances, motivating evaluation through downstream prediction and model selection.The paper also frames statistical and exploratory analysis as downstream uses.Source: §5.1 · pp. 6–7

5.2. Experimental Setup

  • Experiments cover MNIST, CIFAR-10, and Camelyon17, which remain challenging benchmarks for DP image generation; a direct DP-classifier baseline is also trained on sensitive data.The authors note that these benchmarks are small-scale by modern non-private standards.Source: §5.2 · pp. 7–8

5.3. Training from Scratch (∅→MNIST)

  • 98.6% MNIST top-1 accuracy exceeds Dockhorn et al. (2022)'s 98.1%, and biased timestep sampling is important to reach that result.Without timestep biasing, accuracy is 98.2%.Source: §5.3 · p. 8

5.4. Fine-tuning on a Medical Application (ImageNet32 →Camelyon17)

  • 91.1% Camelyon17 accuracy comes from training only on synthetic data, versus 90.5% for the best DP classifier trained on real data.The task tests out-of-distribution classification across hospitals with different staining techniques.Source: §5.4 · pp. 8–9

5.5. Fine-tuning on Natural Images (ImageNet32 →CIFAR-10)

  • FID improves from 26.8 to 9.8 against ImageNet-pretrained SOTA, while CIFAR-10 downstream accuracy rises from 51.0% to 72.9% without classifier pre-training.At ε=5, the method also beats the ImageNet-pretrained SOTA at ε=∞.Source: §5.5 · p. 9, Figure 2 · p. 9

5.6. Maximizing Downstream Prediction Performance by Sampling Arbitrary Many Data Records (ImageNet32 →CIFAR-10)

  • 88% CIFAR-10 test accuracy is achieved by ensembling five WRNs trained with different minibatch subsamples.Without classifier pre-training, increasing synthetic samples from 50K to 1M raises accuracy from 72.9% to 86.0%; the benefit of classifier pre-training diminishes at 1M samples.Source: §5.6 · p. 10

6. Model Selection (ImageNet32 →CIFAR-10)

The section tests whether synthetic data can guide downstream model selection for CIFAR-10. Models rank similarly on synthetic and real data, but synthetic-data tuning is best used for high-level research direction.

6. Model Selection (ImageNet32 →CIFAR-10)

  • The experiment evaluates three CIFAR-10 architectures—WRN-28-8, ResNet50, and VGG—across learning-rate and weight-decay combinations.The first stage assesses whether models trained on synthetic data rank similarly on real and synthetic test data.Source: §6 · p. 10
  • The second stage trains each model on 50K real or 50K synthetic samples and compares test-performance correlations across models with matching architectures and hyperparameters.This setting represents a third party selecting a pipeline while the data curator trains the final model on real data.Source: §6 · pp. 10–11
  • Models rank similarly on synthetic and real data, and synthetic-data tuning can identify the best or second-best hyperparameter constellation in both application settings.The authors recommend using synthetic data for high-level research direction because models can overfit to its distribution and the best constellation within a model group may be unclear.Source: §6 · p. 11, Figure 4 · p. 11
  • Synthetic-data rankings support model selection, but the authors advise using them for high-level orientation rather than choosing a precise constellation within a model group.Absolute test performance is not the focus; the comparison concerns whether model rankings transfer between synthetic and real data.Source: §6 · p. 11

7. Conclusion

The paper scales differentially private diffusion-based image generation to 32 × 32 × 3 RGB datasets and evaluates synthetic data for downstream use. It reports improved CIFAR-10 classification accuracy and strong Camelyon17 accuracy, while proposing larger synthetic datasets, ensembles, and synthetic-data hyperparameter tuning as evaluation strategies.

7. Conclusion

  • 91.1% accuracy on synthetic Camelyon17 data approaches 96.5% with real data, while CIFAR-10 downstream accuracy rises from 51.0% to 88.0%.The paper reports scaling DP image generation to 32 × 32 × 3 RGB datasets using pre-training, timestep augmentation multiplicity, and modified timestep sampling.Source: §7 · p. 11
  • Generating up to 1M synthetic samples and training ensembles can maximize downstream prediction performance without additional privacy cost.The conclusion presents these as components of an evaluation framework aimed at practitioners using DP synthetic data as a private-dataset replacement.Source: §7 · p. 11
  • Hyperparameter-tuning findings on synthetic data translate to corresponding findings on real data.Source: §7 · p. 11

A. Comparison to Related Work

This appendix section directs readers to a table comparing this work with Dockhorn et al. (2022). The supplied text identifies the comparison's purpose but does not report its specific findings.

A. Comparison to Related Work

B. Additional Experimental Details and Results

The appendix provides additional experimental details, including diffusion-model hyperparameters and synthetic image samples. It also presents CIFAR-10 augmentation-multiplicity results, downstream accuracy by synthetic sample count, and class-wise metrics.

B. Additional Experimental Details and Results

  • Table 3 lists diffusion-model hyperparameters and notes that gradient noise is adjusted to achieve the desired privacy budget, with results reported for ε∈{1, 5, 10, 32}.Source: Table 3 · p. 17
  • Figures 5–7 show random samples from DP diffusion models trained on MNIST, Camelyon17, and CIFAR-10, while Figure 8 shows Dockhorn et al. (2022) samples from CIFAR-10 training from scratch.The authors state that the baseline samples illustrate the importance of pre-training in large-scale DP image generation.Source: B. Additional Experimental Details and… · p. 17, Figure 5 · p. 18, Figure 6 · p. 18
  • Figure 9 reports CIFAR-10 FID decreasing as augmentation multiplicity increases up to 256.Source: Figure 9 · p. 20
  • Figure 10 plots downstream accuracy of an ImageNet32-pretrained CIFAR-10 WRN-40-4 against the number of synthetic training samples.Source: Figure 10 · p. 20
  • Figure 11 presents class-wise CIFAR-10 metrics, which the authors use to show that their model is not overfitting to a single class.Source: B. Additional Experimental Details and… · p. 17, Figure 11 · p. 20
  • Tables 4–6 provide hyperparameters for downstream WRNs, DP WRN classifiers trained on sensitive records, and classifiers used in the model-selection experiment.Table 5 notes that training stopped at ε=10; Table 6 states that all displayed learning-rate and weight-decay combinations were trained.Source: Table 4 · p. 21, Table 5 · p. 21, Table 6 · p. 21

Related papers

Loading 2302.13861v1…