PaperlayerView exact revision on arXiv

Source-linked AI summary

Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models

Boming Miao, Tao Zhang, Netanel Raviv, Murat Kantarcioglu, Bradley A. Malin, Yevgeniy Vorobeychik

arXiv:2610.04038v1cs.LG

TL;DR

Diffusion models adapted on sensitive data can still expose training examples, while DP-SGD’s repeated enforcement and indirect connection to reconstruction privacy can reduce utility. This paper privatizes a compact diffusion adaptation once after training using PAC privacy, and reports greater utility than DP-SGD across matched-budget settings.

  • Problem

    Diffusion models can enable reconstruction of sensitive training data, and DP-SGD’s repeated privacy enforcement and indirect relationship to reconstruction privacy can degrade utility.

    Source: §1 · pp. 1–2

  • Method

    The framework uses PAC privacy to privatize a compact LoRA adapter or Textual Inversion embedding once after optimization, calibrating anisotropic Gaussian noise from repeated mechanism outputs.

    Source: §1 · p. 2, §4.1 · p. 5, §6 · p. 10

  • Results

    Across few-shot personalized generation and general-purpose synthesis, PAC-based final-output privatization typically preserves substantially greater utility than DP-SGD under matched privacy budgets.

    Source: §1 · p. 3, §6 · p. 11

  • Takeaways & Limitations

    The reported evaluations support final-output PAC privatization as an alternative to DP-SGD that retains more downstream and concept-specific utility across matched privacy budgets.

    Source: §1 · p. 3, §6 · p. 11

Abstract

from arXiv · show

Synthetic data are increasingly used as an alternative to sharing sensitive records. However, synthetic data generation does not guarantee privacy, as diffusion models trained or adapted on sensitive data remain susceptible to reconstruction attacks. Moreover, while approaches that use differential privacy (DP), such as DP-SGD, achieve provably private diffusion model training, the repeated gradient clipping and noise injection they require result in significant utility loss. An important limitation of DP-based privacy is that, although it has a provable relationship to reconstruction privacy (RP), that relationship is indirect. RP is defined in terms of limiting how much an adversary's posterior distribution over sensitive data differs from the prior, whereas DP provides guarantees by bounding the sensitivity of outputs to changes in individual records. This indirection is an important source of the utility loss. To address this, we propose a PAC-private diffusion model adaptation to achieve reconstruction privacy. Since PAC-privacy is defined directly with respect to posterior advantage over the prior, it directly implicates RP. To obtain scalable PAC privatization in high dimensions, we first learn a compact data-dependent diffusion model component using LoRA or Textual Inversion, and then calibrate anisotropic Gaussian noise from the covariance of repeated mechanism outputs. Unlike DP-SGD, our method perturbs the learned component only once after optimization, thereby avoiding privacy composition across gradient updates. We evaluate the framework on few-shot concept personalization and full-dataset image synthesis, and show that the proposed approach better preserves subject identity, generation quality, and downstream classification accuracy than DP while achieving the same reconstruction privacy.

1 Introduction

Diffusion models can expose sensitive training examples, while DP-SGD’s repeated privacy enforcement and indirect fit to reconstruction privacy can reduce utility. The paper proposes PAC-private adaptation and reports greater utility than DP-SGD across matched-budget synthesis settings.

1 Introduction

  • Diffusion synthesis can still reconstruct sensitive training data, and DP-SGD’s per-step enforcement and indirect relationship to reconstruction privacy contribute to utility loss.Reconstruction privacy concerns how much an adversary’s posterior over sensitive data differs from the prior.Source: §1 · pp. 1–2
  • PAC privacy targets reconstruction advantage directly, so the learned adaptation can be privatized once after training rather than clipping and perturbing gradients throughout optimization.The paper uses the data-processing inequality to justify privatizing the adaptation from which synthetic images are generated.Source: §1 · pp. 2–3
  • Compact LoRA adapters or Textual Inversion embeddings make PAC calibration practical by applying it to a lower-dimensional learned component instead of the full diffusion model.For LoRA, canonicalization removes factor-scale ambiguity before covariance estimation, improving calibration stability and downstream utility.Source: §1 · pp. 2–3
  • Across few-shot personalization and general-purpose synthesis, PAC-based final-output privatization typically preserves substantially greater utility than DP-SGD under matched privacy budgets.The evaluations cover concept or identity fidelity, text alignment, perceptual quality, and downstream classification accuracy.Source: §1 · p. 3

2 Related Work

Prior work improves private diffusion training through training refinements and parameter-efficient adaptation, while PAC privacy supports output privatization. The paper distinguishes its approach from pixel-space perturbation by privatizing compact adaptation parameters.

2 Related Work

  • Private diffusion work includes DP-SGD refinements and parameter-efficient methods, including latent-space training, attention-module tuning, and DP-LoRA.Examples include DPDM, DP-Promise, DP-FETA, and methods that restrict private optimization to a subset of parameters.Source: §2 · p. 3
  • PAC privacy limits an adversary’s improvement in recovering private data after observing a mechanism’s output, and later work develops automated privatization and related extensions.The cited extensions include database systems, autoregressive generation, and sign-quantized language-model fine-tuning.Source: §2 · pp. 3–4
  • P3DM studies PAC privacy by perturbing image-space data, but the paper notes that pixel-space noise can substantially degrade image quality and downstream utility.The proposed contrast is to perturb compact privacy-dependent adaptation parameters while leaving training images unchanged.Source: §2 · p. 4

3 Preliminaries

The preliminaries define reconstruction privacy in terms of an adversary’s reconstruction advantage over prior-only knowledge and relate it to information-theoretic bounds. They also review DP-SGD and latent diffusion’s noising and denoising process.

3 Preliminaries

  • Reconstruction privacy asks whether model or generated-data access lets an adversary reconstruct sensitive training data more successfully than prior-only knowledge would.The paper formalizes reconstruction success by whether an estimate lies within a distance threshold of a training example.Source: §3 · p. 4
  • The paper defines β-reconstruction privacy by bounding the KL divergence between posterior and prior reconstruction-success distributions, and notes that mutual information can bound this advantage.The optimal prior reconstruction error is compared with the attacker-optimal posterior reconstruction error after observing the mechanism output.Source: §3 · p. 4
  • Differential privacy bounds output-distribution changes between neighboring datasets, while DP-SGD applies Gaussian noise to clipped per-example gradients during training.The DP-SGD passage defines per-example gradients and describes clipping and minibatch aggregation.Source: §3 · pp. 4–5
  • Latent diffusion encodes images into a lower-dimensional space, trains a denoiser to predict injected noise, and generates images by reversing the noising process before decoding.Text conditioning supplies a representation to the denoiser, and classifier-free guidance combines conditional and unconditional predictions.Source: §3 · p. 5

4 Reconstruction-Private Diffusion Adaptation

The framework privatizes a compact diffusion adaptation once, after learning it, and provides a β-RP guarantee for the released adaptation and generated images. It uses parameter-efficient adaptation and covariance-based noise calibration, with a separate procedure for matching privacy budgets to DP.

4.1 Overall Framework

  • A public pretrained model is adapted on private data; bootstrap-trained adapters estimate covariance, which sets anisotropic Gaussian noise added once to the final adaptation.The privatized adaptation is released as the trained adapter plus Gaussian noise.Source: §4.1 · p. 5
  • The procedure provides β-RP: mutual information between the private data and released adaptation is bounded by β, and generated images inherit that bound.Source: §4.1 · pp. 5–6

4.2 Parameter-Efficient Diffusion Adaptation

  • LoRA updates key and value projections, with factors canonicalized before covariance estimation; Textual Inversion instead learns a pseudo-token embedding while freezing the model and encoder.Source: §4.2 · pp. 6–7

4.3 Privacy Budget Matching

  • The privacy-budget matching procedure translates an (ε, δ)-DP guarantee into a mutual-information budget β for the proposed method.Source: §4.3 · p. 7

5 Experiments

Across the evaluated privacy budgets, PAC preserves more personalized concept and identity information than DP-SGD, and retains more downstream utility in general image synthesis. The experiments also examine privacy-matched mechanisms, parameter-efficient adaptations, and LoRA canonicalization.

5.1 Experimental Setup

  • The setup compares PAC and (ε, δ)-DP for diffusion adaptation across few-shot personalization and general synthesis, using Stable Diffusion V-1.5 or BK-SDM-Small with LoRA or Textual Inversion.The evaluated datasets include DreamBooth, CustomConcept101, CelebA-HQ, FashionMNIST, EuroSAT, and BloodMNIST.Source: §5.1 · p. 7

5.2 Few-Shot Personalized Generation

  • Across DreamBooth and CustomConcept101, PAC achieves higher DINO-I at ε=3, 10, and 50 than DP-SGD under matched privacy budgets.PAC also improves CLIP-I across both datasets, while BRISQUE has no consistent winner.Source: §5.2 · p. 8, Table 1 · p. 9
  • On CelebA-HQ Textual Inversion, PAC improves ISM from 0.002 to 0.037 at ε=3 and reaches 0.195 ISM at ε=50, while DP-SGD remains nearly unchanged.PAC also improves DINO-I and CLIP-I, and achieves better perceptual quality for ε ≥5.Source: §5.2 · p. 9, Table 2 · p. 10

5.3 General Data Synthesis

  • At ε=50, PAC-generated data reach TSTR test accuracies of 52.6% on FashionMNIST, 46.4% on EuroSAT, and 30.2% on BloodMNIST, approaching clean LoRA ceilings.DP-SGD averages below 40% on FashionMNIST and EuroSAT and reaches 14.8% on BloodMNIST; at tighter budgets, both methods struggle, though PAC remains slightly higher.Source: §5.3 · pp. 9–10, Table 3 · p. 10

5.4 Effect of LoRA Canonicalization

  • The canonicalization evaluation measures FashionMNIST TSTR test accuracy, reporting means with 95% confidence-interval half-widths.Source: Table 4 · p. 10

6 Conclusion

The paper privatizes a learned diffusion adaptation once, using calibrated anisotropic noise, and evaluates this approach with LoRA and Textual Inversion. Across general-purpose synthesis and personalized generation, it reports greater utility than DP-SGD at matched privacy budgets.

6 Conclusion

  • The method converts (ε, δ)-DP parameters to a comparable mutual-information budget, estimates output covariance through repeated training runs, and calibrates anisotropic noise for a final release.It perturbs the learned output once after training, avoiding privacy composition across optimization steps.Source: §6 · p. 10
  • LoRA and Textual Inversion make the procedure computationally feasible for diffusion-model adaptation, with function-preserving canonicalization addressing LoRA factor-scale ambiguity.The evaluation covers general-purpose data synthesis and few-shot personalized generation.Source: §6 · p. 11
  • Across matched privacy budgets, the approach preserves substantially more downstream and concept-specific utility than DP-SGD.The reported scope includes both general-purpose synthesis and few-shot personalized generation.Source: §6 · p. 11

AI Use Statement

The authors disclose generative-AI assistance for manuscript editing, code debugging, formatting, and figure and table presentation, while stating that it did not support research ideation.

AI Use Statement

  • Generative-AI tools assisted with manuscript clarity and grammar, typo detection, code debugging, LaTeX formatting, and figure and table presentation.The authors reviewed assisted content and verified assisted code through executed experiments.Source: AI Use Statement · p. 11
  • The authors state that generative-AI tools were not used for research problem formulation or ideation.They also state that the synthetic image datasets were generated by the studied diffusion models, not an external AI assistant.Source: AI Use Statement · p. 11
  • The authors take responsibility for the final manuscript content and state that reported numerical results came from experiments, not an AI assistant.Source: AI Use Statement · p. 11

Ethics Statement

The paper describes its data and privacy scope, reviews f-DP's hypothesis-testing perspective, and presents bounds connecting differential privacy to reconstruction advantage.

Ethics Statement

  • Experiments use publicly available benchmarks and collect no new human-subject data; CelebA-HQ identifiable faces are used only for benchmark personalization evaluation.Source: Ethics Statement · p. 11

A.1 f-Differential Privacy

  • f-DP characterizes privacy through binary hypothesis testing on neighboring datasets, with a trade-off function relating type-I and type-II test errors.Source: §A.1 · p. 15

A.2 Reconstruction Advantage Provided by DP

  • The appendix states that the reconstruction-advantage bound derived for a strong adversary also applies to the weaker output-only adversary considered in this setting.Source: §A.2 · pp. 15–16
  • The appendix defines reconstruction errors and advantage for an adversary using a partial dataset, target record, and mechanism output, then states an f-DP bound on datapoint reconstruction advantage.It also gives an output-only corollary; the proof notes that an output-only attack is no stronger than an attack that also sees the partial dataset.Source: §A.2 · pp. 15–16
  • The output-only reconstruction bound is related to a mutual-information budget, which yields the same posterior reconstruction-success upper bound at a fixed prior success rate.The argument states that an output-only adversary is no stronger than one that also observes the partial dataset.Source: §A.2 · p. 16

B.1 Training Configurations

The training configurations align PAC and DP-SGD on core experimental choices while specifying adaptation setups and privacy-calibration procedures across tasks.

B.1 Training Configurations

  • PAC and DP-SGD use identical pretrained models, initialization, adaptation architecture, optimization schedule, preprocessing, and training prompts.The configurations are summarized in Table 5.Source: §B.1 · p. 17, Table 5 · p. 17
  • DreamBooth and CustomConcept101 use rank-one LoRA on cross-attention key and value projections, while CelebA-HQ uses a 768-dimensional Textual Inversion embedding.Reference sets contain 4–6 images per DreamBooth subject, 3–15 per CustomConcept101 subject, and 12 images per CelebA-HQ identity.Source: §B.1 · p. 17
  • DP-SGD clips per-example gradients at C = 0.01 and uses δ = 10−5, while PAC calibration repeats training K = 96 times to estimate output covariance.At K = 96, the relative trace change falls below τ = 0.05.Source: §B.1 · p. 17

B.2 Evaluation Settings

The appendix specifies prompt construction, image-generation settings, personalization metrics, and held-out evaluation for concept personalization and general synthesis.

B.2 Evaluation Settings

  • DreamBooth and CustomConcept101 adapters are evaluated with ten fixed class-name prompt templates, without identifier tokens, using four images per prompt.Generation uses 50 denoising steps, classifier-free guidance 7.5, and 256 × 256 resolution.Source: §B.2 · p. 17, Table 7 · p. 19
  • CelebA-HQ evaluation uses “a photo of sks person” to generate 16 images per identity at 512 × 512 resolution.Generation uses 50 denoising steps and classifier-free guidance 7.5.Source: §B.2 · p. 17, Table 7 · p. 19
  • FashionMNIST, EuroSAT, and BloodMNIST receive class-balanced synthetic training sets using the class-specific training prompts.Generation uses 25 denoising steps, classifier-free guidance 7.5, and 256 × 256 resolution.Source: §B.2 · p. 17, Table 7 · p. 19, Table 8 · p. 19
  • Object fidelity uses DINO-I and CLIP-I, text alignment uses CLIP-T, and perceptual quality uses BRISQUE, where lower values indicate better quality.DINO-I and CLIP-I compare generated images with reference images; CLIP-T compares images with their prompts.Source: §B.2 · pp. 17–18
  • LoRA personalization prompts use the semantic class from dataset metadata, not the subject-directory name.The class placeholder is defined for the training prompts in Table 6.Source: Table 6 · p. 18
  • Face personalization reports ISM only for images with a detected face and jointly reports the face-detection failure rate.ISM compares the largest detected face with an identity vector averaged from 12 reference images.Source: §B.2 · p. 19
  • General-synthesis utility is evaluated by training a ResNet-50 exclusively on generated images and testing on held-out real data.EuroSAT uses 21,600 training, 2,700 validation, and 2,700 test images; reported main-paper results use held-out test sets.Source: §B.2 · p. 19
  • Figures 3–5 compare PAC privatization and DP-SGD synthetic images on FashionMNIST, EuroSAT, and BloodMNIST at ε = 10 and δ = 10−5.The figures provide qualitative examples for the three general-synthesis datasets.Source: Figure 3 · p. 20, Figure 4 · p. 20, Figure 5 · p. 20

C Additional Qualitative Results

Across FashionMNIST, EuroSAT, and BloodMNIST, PAC-private generation more clearly preserves class-specific visual characteristics than DP-SGD.

C Additional Qualitative Results

  • On FashionMNIST, PAC-private generation more clearly preserves class-specific visual characteristics than DP-SGD.Figure 3 shows qualitative examples at ε = 10 and δ = 10−5.Source: C Additional Qualitative Results · p. 21
  • On EuroSAT, PAC-private generation more clearly preserves class-specific visual characteristics than DP-SGD.Figure 4 shows qualitative examples at ε = 10 and δ = 10−5.Source: C Additional Qualitative Results · p. 21
  • On BloodMNIST, PAC-private generation more clearly preserves class-specific visual characteristics than DP-SGD.Figure 5 shows qualitative examples at ε = 10 and δ = 10−5.Source: C Additional Qualitative Results · p. 21

D Additional Quantitative Results

Additional evaluations find higher PAC TSTR accuracy than DP-SGD across three datasets and all tested privacy budgets, alongside higher facial-identity and image-similarity scores on CelebA-HQ.

D Additional Quantitative Results

  • PAC achieves higher mean TSTR test accuracy than DP-SGD on all three datasets at every evaluated ε ∈ {3, 4, 5, 7, 10}.Table 9 reports TSTR test accuracy (%) across privacy budgets.Source: Table 9 · p. 21, D Additional Quantitative Results · p. 21
  • On BloodMNIST, the PAC–DP-SGD accuracy gap is particularly pronounced: PAC progressively recovers downstream utility while DP-SGD remains nearly unchanged.Across datasets, the performance gap generally increases as ε increases.Source: D Additional Quantitative Results · p. 21
  • Across all privacy budgets on CelebA-HQ, PAC has higher ISM, DINO-I, and CLIP-I scores, while DP-SGD changes only marginally as ε increases.Table 10 reports means and 95% confidence-interval half-widths across 50 identities; performance varies substantially by identity.Source: Table 10 · p. 21, D Additional Quantitative Results · p. 21

Related papers

Loading 2610.04038v1…