PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Authors: Jianqing Zhang
Yang Liu
JIE FU
Yang Hua
Tianyuan Zou
Jian Cao
Qiang Yang
Venue: ICML 2025 spotlightposter (2025)
Keywords: synthetic data generation
differential privacy
evolution algorithm
Primary area: social_aspects->privacy

Abstract: The rise of generative APIs has fueled interest in privacy-preserving synthetic data generation. While the Private Evolution (PE) algorithm generates Differential Privacy (DP) synthetic images using diffusion model APIs, it struggles with few-shot private data due to the limitations of its DP-protected similarity voting approach. In practice, the few-shot private data challenge is particularly prevalent in specialized domains like healthcare and industry. To address this challenge, we propose a novel API-assisted algorithm, Private Contrastive Evolution (PCEvolve), which iteratively mines inherent inter-class contrastive relationships in few-shot private data beyond individual data points and seamlessly integrates them into an adapted Exponential Mechanism (EM) to optimize DP’s utility in an evolution loop. We conduct extensive experiments on four specialized datasets, demonstrating that PCEvolve outperforms PE and other API-assisted baselines. These results highlight the potential of leveraging API access with private data for quality evaluation, enabling the generation of high-quality DP synthetic images and paving the way for more accessible and effective privacy-preserving generative API applications. Our code is available at https://github.com/TsingZ0/PCEvolve.

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Jianqing Zhang"
Yang Liu
Jie Fu
Yang Hua
Tianyuan Zou
Jian Cao 17 Qiang Yang*
Abstract
Similarity Votes
The rise of generative APIs has fueled interest in
synthetic data generation. While the Private Evolution (PE) algorithm gen- erates Differential Privacy (DP) synthetic images using diffusion model APIs, it struggles with few-shot private data due to the limitations of its DP- -P-protected similarity voting approach. In practice, the few-shot private data challenge is particularly prevalent in specialized domains like healthcare and industry. To address this challenge, we propose novel APl-assisted algorithm, Pri- vate Contrastive Evolution (PCEvol ve), which iteratively mines inherent inter-class contrastive relationships in few-shot private data beyond indi- vidual data points and seamlessly integrates them into an adapted Exponential Mechanism (EM) to optimize DP's utility in an evolution loop. We conduct extensive experiments on four specialized datasets, demonstrating that PCEvo lve outper- forms PE and other APl-assisted baselines. These results highlight the potential of leveraging API access with private data for quality evaluation, en- abling the generation of high-quality DP synthetic images and paving the way for more accessible and effective privacy-preservinn generative API applications. Our code is available https: t/github.comm////
11
30 40
60
70
Synthetic Data Index
Figure A scenario with 10-shot private images and 100- shot synthetic images in PE. Private data contribute only 10 votes (red), while the noise (blue) exceeds the red votes.
COVID-19 pneumonia recognition (Harmon et al., 2020) and industry anomaly detection (Roth et al., 2022). How- ever, training effective model requires a sufficient number of images and computing resources, which often impracti- cal for resource- constreenndtr clients (e.g., clinics) in special- ized domains, where each data producer typically possesses only a few data (Chen et al., 2023; 2020b). To tackle data scarcity, data owners are increasingly turning to external sources, but most specialized data are private (Boland et al., 2017), raising significant privacy concerns (Zhang al., 2022). Healthcare data breaches incur substantial costs, averaging $9.2 million per year (Hu et al., 2024).
Differential Privacy (DP) (Dwork et al., 2006) is a widely used privacy protection method. However, traditional training-based approaches like DP-GAN (Zhang et al., 2024b) and DP-Diffusion (Ghalebikesabi et al., 2023) for image generation are impractical for resource-constraine clients due their high computational cost and substantial data requirements (Hu et al., 2020). Nowadays, using pow- erful generative APIs for image generation has emerged as compelling and training-free free alternative (Lin et al., 2024). However, since black-box API providers are untrusted, pro- tecting user privacy becomes crucial (Lin al., 2024). The latest Private Evolution (PE) algorithm (Lin et al., 2024) leverages diffusion model APIs (Rombach al., 2022) generate DP synthetic images without any training in an evolution loop. Specifically, PE generates random synthetic images from APIs and iteratively improves them by se- lecting (with DP) the most similar synthetic images to the private dataset, and then querying APIs to generate more similar images. DP synthetic data can be reused infinitely
1. Introduction
Recent advances in machine learning for image tasks have significantly improved efficiency in various fields, such
'Shanghai Jiao Tong University "Institute for Al Indus- try Research (AIR), Tsinghua University 'Hong Kong Poly- technic University * "Shanghai Artificial Intelligence Laboratory "Steven Institute of Technology 'Qeenns University Belfast "Shanghai Key Laboratory of Trusted Data Cireulation and Governance in Web3, Correspondence Yang Liu <yang- vironica. @ww.y..cd..o.........ooo Jian Cao Ecao-jian@e sjtu.edu.cn.>
Proceedings of the nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
for potential models on various downstream tasks without additional privacy costs, thanks the post-processing prop- erty of DP (Dwork et al., 2006; Hu et al., 2024; Fu et al., 2024b;a).
2. Related Work
Synthetic image data with APIs. In recent years, numerous studies have focused on synthetic image generation using generative models, such as Stable Diffusion (SD) (Rombach et al., 2022; Moor et al., 2023; Yang et al., 2023; Zhang et al., 2023b; Brooks et al., 2023). However, in specialized domains like healthcare, generative models often require fine-tuning or even redesigning on local platforms with GPU resources (Ji & Chung, 2024; Guan & Liu, 2021; Kather et al., 2022), demanding significant human effort and financial ceessteent-mainng them impractical for resource- constrained clients (Abou Baker et al., 2024; Wornow et al., 2023). An alternative is leveraging kloud-based APIs from service providers (He et al., 2023; Seo et al., 2024; Samuel et al., 2024), customizing them through API-based fine- tuning (OpenAI, 2024) or prompt engineering (Hao et al., 2024). While this approach reduces resource consumption, it raises serious privacy concerns (Qi et al., 2024), as local private data must be uploaded untrusted API providers for fine-tuning or prompting (Chen et al., 2024). Although some API APl-assisted text data generation methods (Ye et al., 2022; Gao et al., 2023) avoid using private data, they rely on specific downstream models, limiting their utility.
However, PE was originally designed for data parties with large-scale private image datasets, and its performance de- grades with limited private data due to its reliance on DP- protected (based on Gaussian Mechanism (GM) (Dwork et al., 2014)) similarity voting, where one private data gives one vote to the most similar synthetic data with DP. For example, the original PE uses 302,436 images from the Camelyon17 dataset (Koh et al., 2021) as private data'. However, as shown in Fig. 1, when dealing with few-shot private data, the added noise overwhelms the actual votes, leading to nearly random similarity voting and selection. Subsequently, querying APIs with randomly selected im- ages as guidance yields nearly random outputs, ultimately degrading the quality of synthetic data (Pan et al., 2023).
To address the few-shot private data challenge in API- assisted DP generation inside the evolution loop. we pro- pose an algorithm called Private Contrastive Evolution (PCEvol ve) by incorporating two key components for se- lecting high-quality prototypical synthetic data as feedback to APIs:
DP synthetic image data with APIs. DP (Dwork et al., 2006) a widely used technique for protecting privacy in image data (Ziller et al., 2021) and has also been applied to synthetic image generation (Li et al., 2024; Hu et al., 2024; Chen et al., 2022; De Cristofaro, 2024). However, DP-based generative methods like DP-GAN (Zhang et al., 2024b) and DP- Diffffuusoo (Ghalebikesabi et al., 2023) are impractical for resource-constrained clients (Hu et al., 2020) and infeasible when models are accessed via APIs (Xie et al., 2024; Lin et al., 2024). Directly adding DP noise images makes DP images nearly unusable input guidance for APIs, as ensuring privacy demands excessive noise (Croft et al., 2021). Recently, Private Evolution (PE) (Lin et al., 2024) optimizes synthetic image data to resemble private data with DP, performing well with large private datasets but struggling in few-shot scenarios due to its GM-based similarity voting. Two follow-up methods in the text do- main (Xie et al., 2024; Hou et al., 2024) retain PE's core GM-based similarity voting while equipping it with more synthetic data per generation (Xie et al., 2024) or more pri- vate data from large-scale federated learning (Hou et al., 2024).
(1) We devise a contrastive filter to iteratively exploit inter- class contrastive relationships between different classes within the private data, beyond individual data points, thereby enhancing the disrimiicriminabilitt of synthetic data w.z.f private data.
(2) We adapt the Exponential Mechanism (EM) (Dwork et al., 2014) to preserve private inter-class contrastive re- lationships, addressing the excessive noise from the high sensitivity of GM. Specifically, we devise a similarity cali- brator to enhance EM's utility by prioritizing high-quality synthetic data that closely resembles private data.
To evaluate the effectiveness of PCEvolve, we conduct extensive experiments in two aspects:
(I) We show that PCEvolve surpasses six APl-assisted synthetic data generation baselines across four practical datasets from specialized domains like healthcare and in- dustry. Additionally, we demonstrate the applicability of PCEvolve in various scenarios, such as varying amounts of private/synthetic data, different APIs, etc. Our DP syn- thetic dataset works effectively with six diverse downstream models, thanks to its enhanced class-iicriminabiiity.
3. Preliminaries
(2) We analyze the properties of eCEvolva. lve, including the visible quality of synthetic images, the effectiveness of each component, and the influence of the single hyperparameter.
Definition 3.1 (Differential Privacy (Dwork et al., 2006)).
Let D be any private database with data from a space X.
denoted as D E X, with a symmetric neighbor D', where D and D' differ in only one element. Let > 0 and 5 E (0, 1] be two privacy parameters. A randomized algorithm M
PE also considers Cat dataset with 200 images, hut only shows synthetic images with a large domain gap to private data.
2

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
X Y with a value range Y is (e,6)-DP if the following inequality holds for any & C W:
Following PE, we randomly initialize De using an untrusted text-to-image (12i) API G125 with simple text prompt T-containing only the domain and class label names, with- out any prompt engineering (Meskó, 2023) (e.g., T = "A leather texture image with cut defect"). We then iteratively refine D. (omitting the iteration superscript ł for simplicity) through the following steps. In each iteration, given the previously generated D, and a pre-trained encoder" (feature extractor) Ej, we select high-quality prototypical ("proto") data points, denoted as Pyro. from D,. This selection is guided by Dp using Ma. Next, we refine the synthetic dataset by leveraging an untrusted image-to-image (i2i) API G using Dpro as feedback and guidance. As this evolu- tion loop progresses, we iteratively optimize D,.-
Pr(M(D) E E e Pr(M(DD) E El+ 6.
If 5 = O, we say that M is e-DP. Any proteprocsssing of a DP mechanism's output incurs no additional privacy loss.
Definition 3.2 (Gaussian Mechanism (Dwork et al., 2014)). Let f : X + IR'' D be a D-dimensional function with & sensitivity to be ر == m IDf - f(2')ll2- The Gaussian Mechanism (GM) Ma with parameter a adds noise scaled to (1, o²) to each of the D components of the output, i.e., (D) = (DD) (O o ID)) For 6 (0, 1), .Ma with o= 2 log((125//))))) is (c.
Definition 3.3 (Exponential Mechanism (Dong et al., 2020: McSherry & Talwar, 2007)). Given a parameter e, an arbi- trary range R. and a utility function u: X x R - IR with sensitivity A. == m maxp,p' uD' r)).a randomized algorithm My is called the Exponential Mech- anism (EM), if the outcome is sampled with probability proportional to exp ( 2A.
A crucial aspect of this process is the selection of Dyro- According to Definition 3.3 of Mu. Dpro is obtained by sampling data from D, with probabilities proportional to their corresponding scores. Thus, the effectiveness of our approach hinges on the design of the utility function u.
(=u(Dr)) and Mn, is e-DP:
Threat Model. We assume that the API provider is honest- but-curious, aiming to extract private information (e.g.. membership information) from the private data uploaded by the client device. While the provider can only access public images selected by the client's private data, it can leverage this information to attack the client's privacy (Duan et al., 2024). Specifically, by repeatedly observing the output im- ages, the provider can infer whether a particular sample ex- ists in the client's dataset. Empirical studies have confirmed privacy risks through viable attacks, such as membership inference attacks (Shokri et al., 2017; Carlini et al., 2022).
exp (Cu(D.))) 23,..
(D(M,(D)=r) EPER exp( (.((Dr))
24,
Definition 3.4 (Sequential Composition (Dwork et al., 2006)). Given any mechanism M.(-) that satisfies DD, and M2 that satisfies Dp for any s, then (DD) M2 (M1 (D), D) satisfies (f1 + DD)
Remark 3.5. Given the same c, .M (c-DP) provides stronger privacy protection than Mr ((c, 5)-DP) for 8 0.
4.1. PCEvolve
4. Method
Overview, As shown in Fig. 2, our PCEvolve iteratively enhances the synthetic data with a DP-protected selector as the core engine. To tackle the few-shot challenge with DP, we leverage inter-class contrastive relationships from private data and optimize the utility of MM, within the selec- tor. Specifically, we (1) aggregate private class centers to reduce bias caused by the few-shot problem, (2) introduce a contrastive filter g to improve the class- dlus--iisrimiiabblityy of synthetic data, (3) design a similarity calibrator h maxi- mize the selection probability of the most similar synthetic data by M,,, where u := h g. and (4) utilize the scores from u (i.e., outputs of h) to construct Drro via M..
Motivation. The Gaussian DP ( (Ma.)-asedd similarity vot- ing approach in the existing method PE corresponds to the function f (in Definition 3.2) of Mn- However, due to the few-shot private dataset Dp, the values in (D,) are extremely small, making the noise from (N appear larger than (Dp) and rendering the final votes, pD) nearly random, as shown in Fig. 1. In contrast, EM M, is tailored for selection, with privacy guarantee depending the sensitivity of utility function u (Dwork, 2008). There- fore, we propose PCEvol ve based on Mn, and adapt EM to select synthetic (public) data instead of private data, re- ducing the influence of private data volume and making it suitable for few-shot scenarios.
(1) Aggregating Class Centers. The fundamental chal- lenge in few-shot data scenarios the lack of sufficient information to represent the entire real data distribution, leading to inadequate and biased learning of downstream models (Song et al., 2023; Xu et al., 2022), especially the
Problem Definition. Our goal is to generate DP syn- thetic dataset DD that closely resembles DD and effectively supports potential downstream C-class classification tasks within the same domain as Dp- To achieve this, D, must satisfy two key criteria: (1) class dlass-discriminabiii and (2) high similarity to Dp-
All distance measures are computed in the feature space after applying Ey. For simplicity, we omit Ey in the following.
3

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Synthetic Dataset D3 ==
Synthetic
Private Dataset D,
Proto Dataset pro
(1) Agg
(2)
(3) Jz
(4) Exp
0.9
API Server
0.3
(1) Agg
(2)
(3) h
(4) Exp
Proto
Selector
Client
Dp = 80o
003
D3 = 14
A
Dpro
Figure Illustration of our PCEvoive, whose core is the DP-protected selector. Different colors denote distinct data classes (two classes are explicitly shown, with others indicated by "..."). "Agg" and "Exp" denote the class center aggregation and the EM My (u g). respectively.
few but useful data that near the distribution bound- ary (Yang et al., 2021). To reduce bias from boundary data, we aggregate few-shot private data to obtain the private center set D,- == [dg)e eejcy, where de == DD Ede-D; de where we define D as the subset of any set D that contains all data with label c.
In practice, &2 values rarely span the full range of [0, +o0). Due to random initialization and the large gap between Dj and Dp, initial & values are excessive, leading most u values to fall near O. This under-utilizes the full range [0, 1] of u and causes M, to sample data almost randomly. address this issue, we propose calibrating the original similarity scores ensure values span the full range of 0. 1] in two steps: (1) normalizing the original l values to [0, and (2) scaling them to [0, r]. where is the only hyperparameter. This forces u values to fall within {0) U [e [e-T,1] 1]. By selecting an appropriate value, we can ensure that e = 0. Consequently, we assign the maximum u value (i.e., 1) to the best (the most similar) candidate to maximize its selection probability when applying M,. Formally, we rewrite
(2) Contrastive Filter g. Then, we leverage inter-class con- trastive relationships to utilize private data fully. Inspired by metric learning (Kulis et al., 2013) and contrastive learn- ing (Chen et al., 2020a), we design a contrastive filter g to select synthetic data that can be correctly classified into their corresponding classes using D, as class identifiers, i.e..
1I, if le de) < mine minn d Dp),
0 otherwise
(1)
Adz E Dr, (C), E [C),d c. We use &g norm (Luo et al., 2016) for distance measure. Using for selection aligns our discriminability goal by assigning positive scores discriminative synthetic data.
tydd), Smin, mmax min
if g (p) =1
Dp)
otherwise
(3) Similarity Calibrator h. Given the initial large dif- ference between the synthetic and private domains, solely emphasizing discriminability with while neglecting sim- ilarity will barely reduce this gap in the next generation iteration. Thus, we calculate the similarity of discriminative synthetic data Dp by
s.t. maxx
max A. ((d..D.)
(2(dg, Dp),
min gc m d.D,, o(dg,D))=
(d Dp),
Agg E DE, [C]. As per Definition 3.3, this rewriting does not impact A., since values still belong to [0, 1].
(.)) if g(d =
(4) Applying Ma. Given u and A., we simply run Ma to sample synthetic data from D, into Dpro based on Defini- tion 3.3. Each execution of M,, consumes portion of the total privacy cost e.. To balance the utility-privacy trade- off (Dwork et al., 2014), select only one candidate per class form Dpro. The best candidate with the highest h value has the greatest probability of being selected. Then, we can generate refined D, using an improved D Dpro as the input to G.z.. We show the overall algorithm in Algorithm I.
hids, Dp)
0,
otherwise
VdG E D E [C]. We apply exponent arithmetic and negation convert lg distances into similarities. Since the range of f2 is [0, +o.), the range of h is [0, 1]. making hog with a sensitivity of A, = according to Definition 3.3. Since M,, samples data from D, into D Dpro based on u's
values, candidates with higher u values are more likely to be included in D Drro-

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Algorithm 1 PCEvolve
datasets across two specialized domains under K-shot set- tings. In healthcare, we use (1) COVIDx (Wang al., 2020) (chest X-ray images for COVID-19, 19, two classes), (2) Camelyon17 (Koh et al., 2021) (tumor tissue patches from breast cancer metastases, two classes), and (3) KVASIR-f (endoscopic images for gastrointestinal abnormal findings detection subset from KVASIR (Pogorelov et al., 2017), three classes). In industry, we use MVTecAD-I (leather sur- face anomaly detection subset from MVTecAD (Bergmann et al., 2019), three classes). By default, we set K = 10, as MVTecAD-1 has only 19 images per class. This value of K is typical for few-shot image tasks (He et al., 2023).
Input:
Private dataset Dp. 12i API Gi2s. t2i API Grzi. text prompt T, total privacy cost number of class C,
number of iteration T, encoder E and similarity cali- brating factor T.
Output: Synthetic dataset De.
D2 GT) and < T'C' ...
2: for evolution iteration
.....: T do
3: for class = ...... do
4: Get u scores for D via Eq. (1) and Eq. (3).
5: Get Dio by sampling data from Dr.c, with the index set R of oe and probabilities
Baselines. We compare PCEvolve with six baselines across three categories, all of which focus on generating image datasets using untrusted black-box API(s), without training:
exp (*p("
(t.a(Dp.t)) 24,
Pr(Mu(Dp)) =r
24 ENER exp ( (..(Dppr')
2A
6: Dj+ (T, Drro), where Deroo = (Diro 1-
(I) Using 12i APIs for image generation:
7: return Synthetic dataset D.T.
B (He et al., 2023), which uses only a 12i API with a simple text prompt T that includes only the domain and class label name. LE (Seo et al., 2024), which extends B with a LLaMA (Touvron et al., 2023) API to enhance T. RF (Samuel et al., 2024), which filters out bad t2i- generated data that closely resemble private data from dif- ferent classes. GCap, which generates images using a t2i API with LLaVA (Liu et al., 2023) API for extracting private image captions.
4.2. Privacy Analysis
Theorem 4.1. Algorithm / PCEvolve satisfied DD..
Proof. Firstly, conduct privacy analysis for each query to privacy dataset Dp (Line 5 in Algorithm 1). For any synthetic data set D. and its corresponding indexes set R, the sensitivity A. between two adjacent datasets Dp. D' E D is bound by according to our scoring function u = hog
(II) Using i2i APIs for image generation with DP:
DPImg, which directly adds DP (GM) noise to few-shot private images to generate DP replicas, which are then input to an i2i API. DPImg adapts RG (He et al., 2023) to ensure DP while avoiding modifications to the generative API.
A, max max FER Dp.D,ED ED
[u(Dp.r) u(Dy 1.
Thus, based on Definition 3.3, each time privacy dataset D, satisfies e-D..
(III) Using 12i and i2i APIs for image generation with DP: PE (Lin et al., 2024), like PCEvolve, generates DP syn- thetic image datasets using private data along with both t2i and i2i APIs within savvacy-rrseevingg evolution loop.
Since we access T x C' times to private data Dp, according to the Definition 3.4, finally our PCEvolve satisfies 6,- DP.
Implementation Details. To maximize performance in few-shot scenarios following He et al. (2023), we train a new classification head for given pre-trained backbone model on the final synthetic dataset D,. We report the Top-1 accuracy on the entire downstream test sets from the above datasets Top-1 accuracy, also known as the classification accuracy score (CAS) (Ravuri & Vinyals, 2019), is widely used metric for assessing the quality of synthetic datasets in downstream tasks (Frolov et al., 2021; Lee et al., 2024). By default, we use ResNet- 18 (He et al., 2016) as the pre- trained backbone model and encoder Ey due to its broad applicability across resource-consen constraindd clients. For DP methods, the overall privacy cost c, is set to 10, 8, 8, and 10 for COVIDx, Camelyon 17, KVASIR-F, and MVTecAD-I, respectively. For GM in DPIng and PE, set 8 to 10-5,
5. Experiments
5.1. Setup
We consider three image gener- ation APIs: Stable Diffusion (SD) (Rombach et al., 2022), SD with the IP-Adapter (Ye et al., 2023) plug-in (SD+IPA), and online OpenJourney (PromptHero, 2023) API (OJ (on- line)). We primarily use the widely adopted SD API (Lin et al., 2024) the image generation API. Following PE, we generate N-shot synthetic images per class in the dataset D.. with a default setting of N = 100. In our scenario, an ex- cessively large N is impractical for resource-constrained client to generate image data using generative APIs.
Image Generation APIs.
Few-Shot Datasets.
We evaluate PCEvolve on four
'For simplicity, we focus on balanced sets, following PE.
5

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
higher than EM's 0 in PCEvolve. We each experiment three times and report the mean. Please refer the specific experiments and Appendix for more details and results.
performance, as they can introduce noise (Barman al., 2024).
Within category III, PE-EM and FCEvolve-GM under- perform PE and PCEvolve. PE-EM lacks similarity Score calibration, weakening the EM, while PCEvolve- GM applies the GM to u scores, requiring high sensitivity (Ay K x N) and reducing utility. By design, the simi- larity votes in PE align with the GM, while the calibrated scores in PCEvolve match the EM. Compared to PE, PCEvolve is better suited for specialized domains with few-shot private data, as we incorporate inter-class con- trastive relationships and maximize the EM's effectiveness under the same privacy cost.
5.2. Performance of PCEvolve
CAS w.r.f. Four Specialized Datasets
Table I: T accuracy (%) on four specialized datasets.
COVIDx
Came17
KVASIR-f
MVAD-I
Init
49.34
50.47
33.43
33.33
RF
50.01
54.82
34.66
48.17
GCap
50.86
55,77
32,66
27.33
B
50.42
54.41
32.57
43.21
CAS w.r.t. K-Shot Private Data
50.02
55.44
35.51
27.93
DPIng
49.14
61.06
33.35
37.03
DPImg
PCEvolve
PE
59.63
63.66
48.88
57.41
Test Accuracy (%)
60
GCap
LE
PE-EM
57.60
63,34
43.01
50.06
PCEvolve-GM
56.91
62.63
43.55
55.56
50
PCEvolve 64.04
69.10
50.95
59.26
40
We first assess PCEvolve across four datasets from spe- cialized domains like healthcare and industry in Tab. 1, where "Init" refers to the downstream models with initial heads. "Came17" and "MVAD" abbreviate Camelyon17 and MV for space efficiency, respectively. For cat- egory III, additionally consider two variants of PE and PCEvolve ve as baselines: PE-EM, which applies the EM M,, to PE's original similarity votes, and PCEvolve-Gi which applies the GM M, to PCEvolve 's values.
30
K=1
K=5
K=50
K-Sht Private Data the Client
Figure 3: 1 accuracy of ResNet-18 on KVASIR-F with varying shots of private data per class.
In the previous experiments, we used the default setting of K = 10 for K'shot private data on the client. We now explore different values of K to examine how varying the amount of private data affects downstream models. As shown in Fig. 3, methods that leverage private data filter evaluate generated synthetic data, such as RF, PE, and PCEvol ve, tend to perform better given more private data. The performance improvement is particularly noticeable for PE and PCEvol ve, since both methods rely on an evo- lution loop that iteratively accesses private data multiple times. This repeated access allows them benefit more from richer private data, leading greater enhancement in the quality of the synthetic data generated and, consequently, the downstream model. In scenarios with extremely small amounts of private data, such as K = 1, the class center aggregation subroutine in our PCEvol vve becomes invalid, as the aggregated private class centers are identical to the pri- vate data. Despite this, PCEvolvv still outperforms other methods with our two key components: contrastive filter (g) and similarity calibrator (h). The performance of B and LE remains unaffected by K since they do not require private data. DPIng performs worse the amount of private data increases since DP requires adding more noise to ensure privacy.
As shown in Tab. 1, the methods from category out- perform the others, with PCEvolve achieving the best performance among them. Specifically, PCEvolve sur- passes baselines by up to 5.44% in accuracy on Came17. This phenomenon stems from the tion loop, which iteratively improves image quality while maintaining privacy within a given cost (i.e., the privacy cost 6.). RF and GCap indirectly utilize private images via private-image-bass based cost-filtering and captions. Without privacy-preserving techniques, they leak more privacy than DP-protected methods (Sander et al., 2024), despite access- ing private data only once without evolution. In contrast, B and LE use only text prompts, ensuring full privacy pro- tection. However, their performance slightly below RF and GCap. DPImg adds DP noise to private images, ren- dering them unrecognizable for required privacy, leading to poor or negative performance (Croft et al., 2021), especially on hard tasks, e.g., COVIDx and KVASIR-f. All methods perform better in less specialized domains (roughly, for two- class datasets, COVIDx (chest X-ray) is harder than Came 17 (tumor tissue), and for three-class datasets, KVASIR-f (med- ical) is harder than MVAD-I (industrial)). Additionally, APIs (SD, LLaMA, LLaVA, etc.) do not always enhance
evolu-
CAS w.r.t. N-Shot Synthetic Data
6

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
lic datasets (Schuhmann et al., 2022; Byeon al., 2022), resulting in varying knowledge. Despite these differences, PCEvolve adapts to different generative APIs while main- taining its superiority, as shown in Tab. 2. Since SD, SD+IPA, and OJ (online) share a similar generative back- bone, with OJ (online) fine-tuned on SD, we infer that SD+IPA and OJ (online) have been exposed to more public data than SD, leading broader knowledge. From Tab. I and Tab. 2, we observe interesting trend: PCEvol benefits from APIs trained on larger public datasets, whereas PE experiences slight performance decline under the same conditions.
RF
B
DPImg
PCEvolve
Test Accuracy (96)
70
GCap
LE
PE
60
50
N=50
N=100
N=150
N N=500
N-Shot Synthetic Data Using the Generative API
Figure 4: Top-1 accuracy of ResNet-18 18 on COVIDx with varying synthetic data shots per class per iteration.
CAS w.n.f. Various Downstream Models
We default to generating N = 100 synthetic images per class the client. This choice helps mitigate the risk of generative APIs introducing noise due to insufficient contex-
Test Test Accuracy (%)
70
DPimg
PCEvolve
Private
GCap
LE
PE
tual information (Ronanki et al., 2024; Wang et al., 2023),
which, in our scenario, comes from K-shot (K = 10) private data. The noise becomes even more pronounced when generating a large volume of synthetic data, as shown
50
40
in Fig. 4 (N 150/20 (500/200/500) where accumulated noise and potential inaccuracies degrade the overall quality and utility of the dataset. Moreover, a larger N increases API resource consumption, which may become unaffordable for resource-come ceoource-constrained clients. On the other hand, if the synthetic data amount is too small (e.g., N 50), there is insufficient knowledge for downstream models to effectively learn from the generative APIs. However, our PCEvolyv ve maintains its performance 0.95% drop in accuracy, whereas PE suffers 4.78% de- cline. This demonstrates that Puttoo PCEvolve is more adaptable to resource-constraaied clients, highlighting its practical value.
ResNet-18
ResNet-50 ResNet-15 152 Inceptionn VIT-816
VIT-L32
Downstream Models the Client
Figure 5: T accuracy of various downstream models on COVIDx. "Private" represents an additional private base- line, which directly trains downstream models on few-shot private data.
at N 50, with only
To evaluate the versatility of the synthetic dataset for down- stream models, we consider six models that are widely used in specialized image domains (Sarwinda et al., 2021; Man- zari al., 2023), as shown in Fig. 5. Following our setup in pre-trained backbones and train newly ini-
Sec. 5, tialized classification heads on the synthetic dataset. Here, we use the CLIP image encoder (Radford et al., 2021) as the encoder E following (Lin et al., 2024).
CAS w.n.t Various APIs
Table 2: Top-1 accuracy (%) on COVIDx and KVASIR-F using SD+IPA and OJ (online) APIs.
In Fig. 5, the synthetic image dataset generated by our PCEvo lvve is compatible with various downstream models of different architectures (e.g., CNNs (LeCun al., 2015) and Transformers (Vaswani et al., 2017)). Models trained our PCEvolve synthetic dataset achieve the best per- formance among all counterparts. Notably, PCEvolve sur- passes the "Private" baseline by up to 8.20% which directly trains downstream models on few-shot private data for the same number of training steps as PCEvolve This demon- strates that our synthetic dataset incorporates valuable infor- mation from the generative API beyond what private data alone provides. In contrast, PE underperforms compared to "Private" when using larger models other than ResNet- 18. While both PCEvolve and PE improve downstream model performance over their initial states, most one-time generation methods degrade, except for LE. This highlights the substantial domain gap between synthetic and private
COVIDx
K
APIs
SD+IPA
OJ (online)
SD+IPA
OJ (online)
RF
45.03
47.91
27.22
36.55
GCap
53.70
47.42
28.77
37.11
46.61
50.22
26.27
36.61
LE
49.79
53.17
31.22
37.38
DPImg
50.58
49.61
36.89
35.05
56.92
54.47
48.83
48.17
PCEvol Vee
60.46
65.88
52.77
54.58
To assess PCEvolve's applicability with other image gen- eration APIs, we additionally use SD+IPA and OJ (online) on COVIDx and KVASIR-F. Generative models behind different APIs are pre-trained on diverse large-scale pub-

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
datasets when an evolution loop is not used to incorporate sufficient private information.
thetic images.
Ablation Study
5.3. Properties of PCEvolve
Table 3: Top-1 accuracy (%) on four datasets using PCEvolve hog) variants with different u. h' denotes the initial h function in Eq. (2).
u h o
u=
u
h' o
COVIDx
64.04
56.59
56.11
55.58
Came17 17
69.10
66.51
65.29
59.39
KVASIR-F 50.95
44.61
50.67
47.78
MVAD-I 59.26
55.74
55.56
53.71
The design of the utility function " is pivotal to PCEvolve's effectiveness. In Tab. 3, we replace u with alternative variants to demonstrate the significance of each component in PCEvolve. Notably, the contrastive filter (g) plays an important role, achieving strong performance even when used alone. When combined with the similarity calibrator (h), PCEvolve achieves up to 7.45% accu- racy improvement COVIDx. However, directly using the uncalibrated similarity scores from h leads to performance drop of up to 7.93% accuracy on COVIDx compared to PCEvo lve. Furthermore, removing g leads to an even more significant performance drop, with accuracy decreasing by 9.71% 71% on Camel7 at most.
(a) Initial
(b) PE
(c) PCEvolve
(d) Private
Figure 6: Generated leather surface images w.r. MVAD-1 for industry anomaly detection. The three rows show normal images, cut defects, and droplet defects. "Initial" denotes the initial synthetic images in PE and PCEvolve. "Private" denotes the real images from MVAD-I.
Synthetic Images
Hy Hyperparameter Study
As illustrated in Fig. 6, the initial synthetic images differ significantly in meaning, content, color, and detail from few-shot private images. While PE employs an evolution loop to refine the initial images iteratively, its DP-protected similarity voting becomes nearly random with few-shot private dataset. This limitation results in synthetic images that retain much information from the initial data while remaining distant from the private data. For instance, the synthetic images Fig. 6(b) fail to accurately depict the cut defect, instead emphasizing the boundary of leather sur- face, in Fig. 6(a). Although the normal and droplet defect images align with the meaning of private images, they still differ in style and detail, leading to significant domain gap. Such synthetic images fail to enhance downstream tasks and may even negatively impact them (Hataya et al., 2023). In contrast, our PCEvolve lvv effectively tackles the few-shot challenge by leveraging inter-class contrastive relationships via the contrastive filter (g). resulting in diiissidiiriiiaaiivee leather images. As illustrated in Fig. 6(c), our synthetic im- ages demonstrate greater diversity, such varied lighting angles, across classes with additional knowledge extracted from APIs, while preserving a high degree of similarity to private images. This high similarity achieved through our similarity calibrator (h), which enhances the likelihood of selecting the most similar candidates as prototypical syn-
Table 4: Top-1 accuracy (%) on four datasets using
PCEvol ve with varying 7 values.
T
10
20
100
COVIDx
59.34
60.70
64.04
60.61
57.90
Came17 17
65,85
66.84
69.10
68.42
68.05
KVASTR-F MVAD-I
46.89
47.29
50.95
57.08
54.66
40.70
53.71
59.26
55.75
55.55
PCEvolve has only one hyperparameter, the similarity calibrating factor in the similarity calibrator (h) (Eq. (3)). As shown in Tab. 4, selecting an appropriate enhances PCEvolve's performance, with the optimal value be- ing T = 10 for COVIDx, Came17, and MVAD-I, while KVASIR-f achieves its best performance at = 20. When T too small (e.g., 7 1), the u scores (i.e., outputs of h) become similar among tiaassdiicriminative synthetic data, leading to nearly uniform selection probabilities after apply- ing the EM M,, (Definition 3.3). Conversely, when is too large (e.g., putes e ビ- where & is the normalized &g distance in Eq. (3), In this case, only the best candidate (with & = 0) retains a u score of 1, while all others -including non-discriminative candidates apphoaach (near) 0, inadvertently increasing the
100), most scores become zero, as com-
8

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
likelihood of selecting poor candidates according Defini- tion 3.3. To balance this trade-off, we choose appropriate 10 for PCEvolve.
simple rules to enable multi-site collaborations through data sharing, 2017.
Brooks, T., Holynski, A., and Efros, A. A. Instructpix2pix:
Learning to follow image editing instructions. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
6. Conclusion and Limitation
Our proposed PCEvolve effectively addresses the few- shot private data challenge in DP generation with APIs, particularly for specialized domains like healthcare and in- dustry, shown by PCEvolve's 's superiority four spe- cialized datasets with various scenarios. By leveraging ex- tra inter-class contrastive relationships in private data and proposing an adapted EM, PCEvol ve outperforms existing APl-assisted methods, enabling high-quality DP synthetic images while leaving more practical few-shot scenarios for future exploration.
Byeon, M., Park, B., Kim, H., Lee, S., Back, W., and Kim, S. Coyo-700m: Image-text pair dataset. coyo-datased 2022.
com/kakaobrain/
Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramer, F. Membership inference attacks from first prin- ciples. 2022 IEEE Symposium on Security and Privacy (SP), 2022.
Chen, J., Tang, J., and Li, W. Industrial edge intelligence: Federated meta learning framework for few-shot fault diagnosis. IEEE Transactions on Network Science and Engineering, 106))3351133573, 2023.
Acknowledgments
This work was supported by the National Key R&D Pro- gram of China under Grant No.2022ZD0160504, the In- terdisciplinary Program of Shanghai Jiao Tong University (project number YG2024QNB05), and the Tsinghua Uni- versity (AIR)-Asiainfo Technologies (China) Inc. Joint Re- search Center. We also thank Dr. Zinan Lin for his valuable support and guidance.
Chen, J.-W., Yu, C.-M., Kao, C.-C., Pang, T.W., and Lu, C.-S. Dpgen: Differentially private generative energy- guided network for natural image synthesis. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Impact Statement
Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. Simple Framework for Contrastive Learning of Visual Representations. In International Conference on Machine Learning (ICMI., 2020a.
This work highlights practical preeeeypress generative API applications with Differential Privacy (DP) guarantee, demonstrating the effectiveness of APl-assisted training-free DP synthetic data generation in specialized domains. Apart from this contribution, we do not identify any significant societal implications that require specific attention.
Chen, X., Tang, S., Zhu, R., Yan, S., Jin, L.., Wang, 7., Su, L., Zhang, Z., Wang, X., and Tang, H. The janus inter- face: How fine-tuning in large language models amplifies the privacy risks. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024.
References
Abou Baker, N., Rohrschneider, D., and Handmann, U. Parameter-efficient fine-tuning of large pretrained models for instance segmentation tasks. Machine Learning and Knowledge Extraction, 6(4):2783-2807) 2024.
Chen, Y., Qin, X., Wang, J., Yu, C., and Gao, W. Fed- health: A federated transfer learning framework for wear- able healthcare. IEEE Intelligent Systems, 35(4):83-93, 2020b.
Barman, D., Guo, Z.,, and Conlan, O. The dark side of
Croft, W. L., Sack, J.-R., and Shi, W. Obfuscation of images via differential privacy: From facial images general images. Peer-to-Peer Networking and Applications, 14: 1705-1733, 2021.
language models: Exploring the potential of Imms mul- timedia disinformation generation and dissemination. Ma- chine Learning with Applications, pp. 100545, 2024.
De Cristofaro, F. Synthetic data: Methods, use cases, and risks. IEEE Security Privacy, 2024.
Bergmann, P., Fauser, M., Sattlegger, D., and Steger, C. Mvtec ad-a a comprehensive real-world dataset for unsu- pervised anomaly detection. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
Dong, J., Durfee, D., and Rogers, R. Optimal differential privacy composition for exponential mechanisms. In International Conference on Machine Learning (ICML), 2020.
Boland, M. R., Karczewski, K. J., and Tatonetti, N. P. Ten

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Duan, H., Dziedzic, A., Papernot, N., and Boenisch, F. Flocks of stochastic parrots: Differentially private prompt learning for large language models. Advances in Neural Information Processing Systems (NeurIPS), 2024.
Hataya, R., Bao, H., and Arai, H. Will large-scale generative models corrupt future datasets? In IEEE International Conference on Computer Vision (ICCV), 2023.
He, K., Zhang, X., Ren, S., and Sun, Deep Residual Learning for Image Recognition. In IEEE Conference on Computer Vision and Puttern Recognition (CVPR), 2016.
Dwork, C. Differential privacy:
A survey of results. In International conference on theory and applications of models of computation, 2008
He, R., Sun, S., Yu, X., Xue, C., Zhang, W., Torr, P., Bai, S., and Qi. X. Is synthetic data from generative models ready for image recognition? In International Conference on Learning Representations (ICLR), 2023.
Dwork, C., McSherry, F., Nissim, K., and Smith, A. Cali- brating noise to sensitivity in private data analysis. Theory of Cryptography, pp. 265-284, 2006.
Dwork, C., Roth, A., et al. The algorithmic foundations of differential privacy. Foundations and Trends@ in Theo- retical Computer Science, 9(3-4):211-40) 2014.
Hou, C., Shrivastava, A., Zhan, H., Conway, R., Lc, T., Sagar, A., Fanti, G., and Lazar, D. Pre-text: Training language models on private federated data the age of llms. In International Conference on Machine Learning (ICML), 2024.
Frolov. S., Hinz, T., Raue, F,, Hees, J., and Dengel, A.
Adversarial text-to-image synthesis: A review. Neural Networks, 144:187-209, 2021.
Hu, R., Guo, Y., Ratazzi, E. P., and Gong, Y. Differentially private federated learning for resource-constrainee inter- net of things. arXiv preprint arXiv:2003. 12705, 2020.
Fu, J., Hong, Y., Ling, X., Wang, L., Ran, X., Sun, Z., Wang, W. H., Chen, Z., and Cao, Y. Differentially private federated learning: systematic review. arXiv preprint arXiv:2405.08299 2024a.
Hu, Y., Wu, F., Li, Q., Long, Y., Garrido, G. M., Ge, C., Ding, B., Forsyth, D., Li, B., and Song, D. Sok: Privacy- preserving data synthesis. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024.
Fu, J., Ye, Q. Hu, H., Chen, Z., Wang. L., Wang, K., and Ran, X. Dpsur: Accelerating differentially private stochastic gradient descent using selective update and release. Proceedings of the VLDB Endowment, 2024b.
Ji, W. and Chung, A. C. Diffusion Diffusion-based domain adaptation for medical image segmentation using stochastic step alignment. In International Conference on Medical Image Computing and Computer-Assisted Intervention. Springer, 2024.
Gao, J., Pi, R., Yong, L., Xu, H., Ye, J., Wu, 7., ZHANG, W., Liang, X., Li, Z., and Kong, L. Self-guided noise- free data generation for efficient zero-shot learning. In International Conference on Learning Representations (ICLR), 2023.
Kather, N., Ghaffari Laleh, N., Foersch, S., and Truhn, D. Medical domain knowledge in domain- agnostic genera- tive ai. NPJ digital medicine, 5(1):90, 2022.
Ghalebikesabi, S., Berrada, L., Gowal, S., Ktena, I., Stan- forth, R., Hayes, J., De, S., Smith, S. L.., Wiles, O., and Balle, B. Differentially private diffusion mod- els generate useful synthetic images. arXiv preprint 20X. 2023.
Koh, P. W., Sagawa, S., Marklund, H., Xie, S. M., Zhang, M., Balsubramani, A., Hu, W., Yasunaga, M., Phillips, R. L., Gao, I., et al. Wilds: A benchmark of in-the- wild distribution shifts. In International Conference on Machine Learning (ICML), 2021.
Guan, H. and Liu, M. Domain adaptation for medical image analysis: survey, IEEE Transactions Biomedical Engineering, 6933)1113311185, 2021.
Kulis, B. et al. Metric learning: A survey, Foundations and Trends@ in Machine Learning, 5(4):287-364, 20133.
Hao, Y., Chi, Z.. Dong, L., and Wei, F. Optimizing prompts for text-to-image generation. Advances in Neural Infor- mation P Processing Systems (NeurIPS), 2024.
LeCun, Y., Bengio, Y. and Hinton, G. Deep Learning. Nature, 521(7553):336 444, 2015.
Harmon, S. A., Sanford, T. H., Xu, S., Turkbey, E. B., Roth, H., Xu, Z., Yang, D., Myronenko, A., Anderson, V., Amalou, A., et al. Artificial intelligence for the detection of 19 pneumonia on chest et using multinational datasets. Nature communications, 4(1):4080, 2020.
Lee, T., Yasunaga M., Meng, C., Mai, Y., Park, J. S., Gupta, A., Zhang, Y., Narayanan, D., Teufel, H., Bel- lagente, M., et al. Holistic evaluation of text-to-image models. Advances in Neural Information Processing Sys- tems (NeurIPS), 2024.
10

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Li, K., Gong, C., Li, Z.,, Zhao, Y., Hou, X., and Wang, T. (Privlmage): Differentially private synthetic im- age generation using diffusion models with (Semantic- }ware) pretraining, In 33rd USENIX Security Symposium (USENIX Security 24), 2024.
Qi, X., Zeng, Y., Xie, T., Chen, P.Y.,, Jia, R., Mittal, P., and Henderson, P. Fine-tuning aligned language models compromises safety, even when users do not intend to! In International Conference on Learning Representations (ICIR), 2024.
Lin, Z.,, Gopi, S., Kulkarni, J., Nori, H., and Yekhanin, S. Differentially private synthetic data via foundation model apis I: Images. International Conference on Learning Representations (ICLR), 2024.
Radford, A., Kim, J. W., H.Hllay, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML), 2021.
Liu, H., Li, C., Wu, Q., and Lee, J. Visual instruction tun- ing. Advances in Neural Information Processing Systems (NeurIPS), 2023.
Ravuri, S. and Vinyals, O. Classification accuracy score for conditional generative models. Advances in Neural Information Processing Systems (NeurIPS), 2019.
Luo, X., Chang, X., and Ban, X. Regression and classifica- tion using extreme learning machine based on 11 Il-norm and 12-norm. Neurocomputing, 174:179- 2016.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and
Ommer, B. High-resolution image synthesis with latent diffusion models. IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Manzari, O. N., Ahmadabadi, H., Kashiani, H., Shokouhi, S. B., and Ayatollahi, A. Medvit: robust vision trans- former for generalized medical image classification. Com- puters in Biology and Medicine, 157:106791, 2023.
Ronanki, K., Cabrero-Daniel, B., and Berger, C. Prompt smells: An omen for undesirable generative ai outputs. Proceedings of the IEEE/ACM 3rd International Con- ference on Al AngineerringSoffweee Engineering for Al, 2024.
McSherry, F. and Talwar, K. Mechanism design via dif- ferential privacy. In 48th Annual IEEE Symposium Foundations of Computer Science (FOCS), 2007.
Roth, K., Pemula, L., Zepeda, J., Schölkopf, B., Brox, T., and Gehler, P. Towards total recall industrial anomaly detection. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Meskó, B. Prompt engineering important emerging skill for medical professionals: tutorial. Journal of medi- cal Internet research, 25:e50638, 2023.
Samuel, D., Ben-Ari, R., Raviv, S., Darshan, N., and Chechik, G. Generating images of rare concepts using pre-trained diffusion models. In AAAI Conference Artificial Intelligence (AAAI), 2024.
Moor, M., Banerjee, O., Abad, Z. S. H., Krumholz, H. M., Leskovec, J., Topol, E. J., and Rajpurkar, P. Founda- tion models for generalist medical artificial intelligence. Nature, 616(7956):259-225) 2023.
Sander, T., Yu, Y., Sanjabi, M., Durmus, A. O., Ma, Y., Chaudhuri, K., and Guo, C. Differentially private repre- sentation learning via image captioning. In International Conference on Machine Learning (ICML), 2024.
OpenAL. Fine-tuning models openai platform, 2024. URL https://platfot opw.ooo..oooooiio..oooooooo..a.e openai com/ddooaooooooo com/docs/ docs/ (il.ee//Ein--tuinnge 01-22.
Accessed: 2025-
Sarwinda, D.,, Paradisa, R. H., Bustamam, A., and Anggia, P. Deep learning in image classification using residual net- work (resnet) variants for detection of colorectal cancer. Procedia Computer Science, 179:423-431 2021.
Pan, Z., Zhou, X., and Tian, H. Arbitrary style guidance for enhanced diffusion-basee text-to-image generation. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision, 2023.
Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., et al. Laion-5b: An open large- scale dataset for training next generation image-text mod- els. Advances in Neural Information Processing Systems (NeurIPS), 2022.
Pogorelov, K., Randel, K. R., Griwodz, C., Eskeland, S. L., de Lange, T., Johansen, D., Spampinato, C., Dang- Nguyen, D.-T., Lux, M., Schmidt, P. T., et al. Kvasir: A multi-class image dataset for computer aided gastroin- testinal disease detection. In Proceedings of the 8th ACM on Multimedia Systems Conference, 2017.
Seo, M., Cho, S., Lee, M., Misra, D., Choi, H., Kim, S. J., and Choi, J. Just say the name: Online continual learning with category names only via data generation. arXiv preprint arXiv:2403. 10853, 2024.
PromptHero. Openjourny,, 2023. open journey. cawtr/eey.rrr......
URL https://

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
Shokri, R., Stronati, M., Song, C., and Shmatikov, V. Mem- bership inference attacks against machine learning mod- els. In 2017 IEEE symposium security and privacy 2017.
Ye, H., Zhang, J., Liu, S., Han, X., and Yang, W. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models. arXiv preprint arXiv:3308.0672. 2023.
Song, Y. Wang, T., Cai, P., Mondal, S. K., and Sahoo, J. P. A comprehensive survey of few-shot learning: Evolu- tion, applications, challenges, and opportunities. ACM Computing Surveys, 55(13s):1-40, 2023.
Ye, J., Gao, J., Wu, Z.,, Feng, J., Yu, T., and Kong, L. Progen: Progressive zero-shot dataset generation via in-context feedback. In Findings of the Association for Computa- tional Linguistics: EMNLP 2022, 2022.
Zhang, J., Chen, Y., and Li, H. Privacy leakage of adversar- ial training models in federated learning systems. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR),200)
Touvron, H., Martin, L.., Stone, K., Albert, P., Almahairi, A., Babaci, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., al. Llama 2: Open foundation and fine- tuned chat models. arXiv preprint 200702230,.09288, 2023.
Zhang. J., Hua, Y., Wang, H., Song, T., Xue, Z., Ma, R., and Guan, H. FedALA: Adaptive Local Aggregation for Personalized Federated Learning. In AAAI Conference on Artificial Intelligence (AAAI), 2023a.
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L.,, and Polosukhin, I. Attention is All You Need. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
Zhang. J.. Liu, Y.. Hua, Y., and Cao, J. Fedtgp: Train- able global prototypes with adaptive-margin-ennaaee margin-enhancedd contrastive learning for data and model heterogeneity in federated learning. In AAAI Conference on Artificial Intelligence (AAAI), 2024a.
Wang, L.. Lin, Z. Q., and Wong, A. Covid-net: A tailored deep convolutional neural network design for detection of covid-19 19 cases from chest x-ray images. Scientific reports, 10(1):19549) 2020.
Zhang, J., Liu, Y., Hua, Y., Wang, H., Song, T., Xue, Z., Ma, R., and Cao, J. Pfllib: A beginner-friendly and comprehensive personalized federated learning library and benchmark. Journal of Machine Learning Research, 26(50):1-10, 2025.
Wang, Y. Shen, S., and Lim, B. Y. Reprompt: Automatic prompt editing refine ai-generative art towards precise expressions. In Proceedings of the 2023 CHll conference on human factors in computing systems, 2023.
Wornow, M., Xu, Y., Thapa, R., Patel, B., Steinberg, E.,, Fleming, S., Pfeffer, M. A., Fries, J., and Shah, N. H. The shaky foundations of large language models and foun- dation models for electronic health records. npj Digital Medicine, 6(1):135, 2023.
Zhang, L.,, Rao, A., and Agrawala, M. Adding conditional control to text-to-image diffusion models. In IEEE Inter- national Conference on Computer Vision (ICCV), 2023b.
Zhang, Y., Liang, X., Du, R., and Tian, J. Dp-discriminator: A differential privacy evaluation tool based on gan. In Proceedings of the 21 ACM International Conference on Computing Frontiers, 2024b.
Xie, C., Lin, Z., Backurs, A., Gopi, S., Yu, D., Inan, H. A., Nori, H., Jiang, H., Zhang, H., Lee, Y. T., et al. Differen- tially private synthetic data via foundation model apis 2: Text. International Conference on Machine Learning (ICML), 2024.
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueck- ert, D., and Kaissis, G. Medical imaging deep learning with differential privacy. Scientific Reports, 11(1):13524, 2021.
Xu, J., Luo, X., Pan, X., Li, Y., Pei. W., and Xu, Z. Alle- viating the sample selection bias in few-shot learning by removing projection to the centroid. Advances in Neural Information Processing Systems (NeurIPS), 2022.
Yang, L.. Zhang, Z., Song, Y., Hong, S., Xu, R., Zhao, Y., Zhang, W., Cui, B., and Yang, M.-H. Diffusion models: A comprehensive survey of methods and applications. ACM Computing Surveys, 560o),,6641111111 56(4):1-39, 2023.
Yang, S., Liu, L.,, and Xu, M. Free lunch for few-shot leam- ing: Distribution calibration. In International Conference on Learning Representations (ICIR), 2021.
12

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
A. Experimental Details
We have included the necessary experimental details in the main body, and show more details here.
A.1. Image Generation APIs
We consider three image generation APIs: Stable Diffusion (SD) (Rombach et al., 2022), SD with the IP-Adapter (SD+IPA) (Ye et al., 2023), and the online OpenJoumey (OJ) API (PromptHero, 2023) (OJ (online)). Following PE (Lin al., 2024), we manually implement SD on server, providing an SD API with both text-to-image (12i) and image-to-image (i2i) features. Specifically, we use the pre-trained open-source SD v1.5 model from HuggingFace and wrap to expose only the API interface and serve as API server, keeping the model details hidden from clients. SD+IPA is implemented similarly, by integrating pre-trained open-source IP-Adapter' to the SD APL. For the OJ (online) API, we use the geting.ai platform to access the online OJ API, which requires payments before usage. We retain the default settings (such as num wwmmiinferencesteeee.
=50, guidance_sca le =7.5, etc.) for all APIS to ensure better generalization. Similar to PE, we initialize the strength at 0.8 and anneal it to 0.6 with a 0.02 decrease per iteration for the i2i API. Additionally, we set scale to 0.5 for the A--adpeeer Further details are available in our code.
A.2. Few-Shot Datasets
We evaluate PCEvolve on four datasets across two specialized domains under K-shot settings. In healthcare, we use (1) COVIDx² (Wang al., 2020) (chest X-ray images for COVID-19 two classes), (2) Camelyon17* (Koh et al., 2021) (tumor tissue patches from breast cancer metastases, two classes), and (3) KVASIR-f (endoscopie images for gastrointestinal abnormal findings detection subset from KVASIR (Pogorelov et al., 2017), three classes). In industry, use MVTecAD-1" (leather surface anomaly detection subset from MVTecAD (Bergmann et al., 2019), three classes). Specifically, KVASIR-F is a subset of KVSIIR containing all pathological finding images, while MVTecAD-I is a subset of MVTeccD focused on leather surface images. By default, we set = 10 for MVTecAD--I, containing only 19 leather surface images per class. We use images for synthetic image generation and reserve the remaining images for evaluating the test accuracy of the fine-tuned downstream models. This value of K is typical for few-shot image tasks (He al., 2023). We create few-shot subsets from these datasets represent realistic scenarios. In Tab. 5, we list each dataset's details. We use uniform simple text prompt T := "A DOMAIN image with LABEL", where "DOMAIN" and "LABEL" placeholders for respective domain and label names, for all datasets and tasks. More details are available in our code.
Table 5: The details of four few-shot datasets from two specialized domains.
Dataset
Image Size
Test Set Size
Domain
Labels
COVIDx
256x256
8482
"chest radiography (X-ray)" "histological lymph node section" "pathological damage in mucosa of gastrointestinal tract"
[" "COVID-19 pneumonia"]
Camelyon17
96x96
85054
"breast cancer with tumor tissue"]
KVASTR-F
256x256
600
Mesophagiiis", "polyps", "ulcerative-colitis""
MVTecAD-1
256x256
27
"leather texture"
[" "cut defect", "droplet defect"]
A.3. Baselines
We compare PCEvolve ve with six baselines across three categories, all of which focus on generating image datasets using untrusted box API(s), without training:
(I) Using 12i APIs for image generation:
B (He al., 2023), which uses only 12i API with simple text prompt T that includes only the domain and class label
ctw./oooiiiiiooo cxx2
13

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
name. LE (Seo al., 2024), which extends B with LLaMA (Touvron al., 2023) API enhance T. Specifically, we
additional text prompt enhance T with the LLaMA API: "refine this description of images to introduce rich context: ".
RF (Samuel et al., 2024), which filters out bad (2i-generated data that closely resemble private data from different classes.
GCap, which generates images using f2i API with LLaVA (Liu et al., 2023) API for extracting private image captions.
(II) Using 12i APIs for image generation with DP:
DPImg, which directly adds DP (GM) noise to few-shot private images to generate DP replicas, which are then input to an i2i API. DPImg adapts RG (He al., 2023) ensure DP while avoiding modifications to the generative API. We compute the a for GM based on Definition 3.2 given a total privacy cost E+.
(III) Using 12i and i2i APIs for image generation with DP:
PE (Lin et al., 2024), like PCEvol ve, generates DP synthetic image datasets using private data along with both t2i and i2i APIs within a privacy-preserving evolution loop. In few-shot scenarios, there are too few votes but too much noise in PE, making the thresholding operation on similarity votes meaningless. Therefore, we set H = 0 for PE. Additionally, as shown the paper, PE performs similarly for H when e, 2.
A.4. Implementation Details
To maximize performance in few-shot scenarios, following (He et al., 2023), we train a new classification head on a pre-trained backbone model using the final synthetic dataset D.. The downstream model training during evaluation done with batch size of 16, a learning rate of 0,001, and 100 epochs. We report the Top-1 accuracy on the entire downstream test sets (see Tab. 5). Top-1 accuracy, also known the classification accuracy score (CAS) (Ravuri & Vinyals, 2019), is widely used metric for assessing the quality of synthetic datasets in downstream tasks (Frolov et al., 2021; Lee et al., 2024). By default, we use ResNet-18 18 (He et al., 2016; Zhang et al., 2025; 2023a; 2024a) as the pre-trained backbone model and encoder E due to its broad applicability across resource-constraiine clients. For DP methods, the overall privacy cost e. is set to 10, 8, 8, and 10 for COVIDx, Camelyon17, KVASIR-f, and MVTecAD-I, respectively. For GM in DPImg and PE, we set 10-5, higher than EM's 0 in PCEvol ve. By default, we set the total generation iteration = 20 for PCEvol ve. Most of our experiments are run on a machine with 64 Intel(R) Xeon(R) Platinum 8362 CPUs, 256GB of memory, eight NVIDIA 3090 GPUs, and Ubuntu 20.04.4 LTS. While most experiments are completed within 48 hours, those involving large N for N-shot image generation may take up to week.
B. CAS w.r.f. Overall Privacy Cost c,
Table 6: Top-1 accuracy (%) on four specialized datasets with varying overall privacy cost c..
Dataset
DP Algorithm
6.
6, 8
6, = 10
6. =
PE
52.76
57.83
59.63
62.44
COVIDx
PCEvolve
56.74
60.21
64.04
63.82
PE 62.29
63.66
63.37
65.29
Camelyon17
PCEvolve
68.05
69.11
69.58
69.95
PE 43.72
48.88
51.01
51.83
KVASIR-F
PCEvolve
50.44
50.95
51.67
52.11
PE
50.21
55.85
57.41
58.02
MVTecAD-1
PCEvolve
51.84
57.41
59.26
60.67
To study the impact of the overall privacy cost 6, on iterative generation algorithms, such as PE and our PCEvolve, we vary e, and present the results in Tab. 6. We observe that both PE and PCEvolve ve achieve lower accuracy with a smaller c, and perform better with larger values, consistent with the DP literature (Dwork et al., 2014). To balance the privacy-utility trade-off, selecting an appropriate 6, crucial for different tasks and environments (Lin al., 2024).
14

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
0.10
Downstream Model Loss
0.3
PE PCEvolve
PCEvolve
Downstream Model
0.08
0.2
0.06
0.02
0.0
1
4 5 8 9 11 12 13 15 16
19
1
7 10 11 12 13 16 17 19 Synthetic Data Generation Iterations
4
Synthetic Data Generation Iterations
(a) COVIDx
(b) KVASIR-F
Figure 7: The loss curves of ResNet-18 (He et al., 2016), which is retrained at each iteration synthetic data generation for algorithm performance evaluation. We use CLIP image encoder (Radford al., 2021) the encoder.
C. Iterative Improvement in the Evolution Loop
In the main body, following (He et al., 2023), we train a new classification head for pre-trained downstream model (e.g., ResNet-18) on the final synthetic dataset D..- To demonstrate the iterative improvement in the evolution loop, we retrain a new classification head for the given downstream model at each generation iteration and track the loss value after training on the synthetic data. The loss curves are shown Fig. 7. Although the downstream model starts with the same initial loss value the Oth iteration for all methods, our PCEvolve rapidly reduces the loss in early iterations and consistently maintains near-zero loss value in subsequent iterations, demonstrating steady iterative improvement. In contrast, PE also starts with the same initial loss but experiences fluctuations throughout the evolution process, ultimately reaching higher loss. This is due to its GM-based similarity voting approach, which results in noisy synthetic images that hinder its performance.
D. CAS w.r.t. Various Encoders E,
Init
PE
PCEvolve
Test Accuracy (%6
60
55
45
40
ResNet-18
Inception-v3
VIT-B16
CLIP
Encoders on the Client
Figure 8: Top-1 accuracy of R8 on COVIDx using four encoders. "CLIP" is short for CLIP image encoder.
Here, we analyze PE and PCEvolve to assess the impact of different encoders, which map images into feature vectors for efficient distance computation when evaluating synthetic data quality against private data. In Fig. 8, we observe that the downstream model (ResNet-13) 18) achieves optimal performance when paired with the same encoder (ResNet-18), When using other encoders, our PCEvolve ve shows less performance degradation (4.50%) compared to PE (6.41%). A small encoder like 18 (0.01B parameters) is more practical than large one like CLIP image encoder (0.3B parameters), as encoding performed on resource-constraingg constrained clients and is required throughout the iterative synthetic data generation process. Both PCEvol and PE improve the performance of the initial downstream models with different encoders.
15

---

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation via Few-Shot Private Data and Generative APIs
E. CAS on the Mixture of Synthetic and Private Data
follow PE (Lin et al., 2024) to evaluate the quality of the synthetic image data the main body, considering scenarios where synthetic data is widely utilized in various downstream tasks outside the private client, and the original private dataset typically not accessible. specific cases where private data owners wish to augment their local private datasets with synthetic data, the private data be accessed, and the synthetic and private data be mixed for augmentation.
Table Top-1 accuracy (%) on the mixture of synthetic and private data based on KVASIR-F. "Syn" short for synthetic.
Syn
Syn + Private
Init Private
33.43
83.17
34.66
81.61 (-1.56)
GCap
32.66
84.78 (+1.61)
B
32.57
81.01 (-2.16)
LE
35.51
84.61 (+1.44)
DPIng
33.35
62.94 (-20.23)
PE
48.88
88.67 (+5.50)
PCEvolve
50.95
90.51 (+7.34)
For this scenario, we follow He et al. (2023) and apply the mix training with the default downstream model (ResNet-18) As shown Tab. 7, most baselines improve the performance when mixing synthetic and private data, with PCEvo ve showing the highest improvement by enhancing the class-disermminabiity of synthetic data, which benefits classification tasks. Although some t2i baselines (e.g., GCap and LE) perform poorly when evaluated on synthetic data alone, they show positive performance when applied to mixed datasets, as they bring additional valuable knowledge from APIs to the private data. In contrast, DPImg negatively impact private data, its synthetic data contains significant noise.
16


Reviews:
[{"review_id": "0iBdG8Vxnz", "reviewer": "Reviewer_wkDt", "summary": "The authors present an interesting approach to an API-assisted algorithm called Private Contrastive Evolution (PCE) to address the challenge of generating high-quality differentially private (DP) synthetic images from few-shot private data using generative APIs. \n\nThe authors introduce a contrastive filter to exploit inter-class contrastive relationships within the few-shot private data, enhancing the class-discriminability of synthetic images.\n\nAnother interesting point is that the exponential mechanism was adapted to preserve private inter-class contrastive relationships, addressing the excessive noise issue from the high sensitivity of the Gaussian Mechanism. A similarity calibrator is designed to prioritize high-quality synthetic data that closely resembles private data.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your time and effort in reviewing our work! Below, we provide responses to address your concerns, with *Lines xxx* and *Section x* referring to specific parts of our paper. We hope these clarifications effectively resolve your concerns.\n\n**Concern 1: An Ablative Analysis**\n\nWe have only two components: the contrastive filter ($g$) and the similarity calibrator ($h$). In *Section Ablation Study* (page 8),  **we have provided an ablative analysis** of these two components. We *remove each component individually* to evaluate their effects. As shown in *Table 3*, eliminating either $g$ or $h$ results in a significant performance drop. **$g$ and $h$ must function together to address the few-shot issue; neither can be used in isolation.** While $g$ leverages inter-class contrastive information, it introduces a trade-off by sacrificing similarity measurement, which is then compensated by $h$. \n\n**Concern 2: Other APIs for More Comprehensive Results**\n\n- **The reason for choosing Stable Diffusion, SD+IPA, and OJ** is that diffusion models dominate image generative models, and these three are among the most widely used and recognized approaches [1].\n\n- **We add** a structurally distinct *Transformer-based* API based on FLUX.1-dev, along with the closed commercial API GPT-4o, and show our PCE's generality to these new distinct APIs in R-Table 1 and R-Table 2.\n\n**R-Table 1: Top-1 accuracy (%) with FLUX.1 API**\n| |COVIDx|KVASIR-f|\n|-|:-:|:-:|\nPE|52.38|45.67|\nOur PCE|**58.58**|**55.83**|\n\n**R-Table 2: Top-1 accuracy (%) with GPT-4o API**\n| |COVIDx|KVASIR-f|\n|-|:-:|:-:|\nPE|62.32|56.32|\nOur PCE|**70.41**|**64.52**|\n\n[1] Croitoru, Florinel-Alin, et al. \"Diffusion models in vision: A survey.\" IEEE Transactions on Pattern Analysis and Machine Intelligence 45.9 (2023).\n\n**Concern 3: Impact of Privacy Parameters ϵ***\n\n- **We follow PE** in using ϵ* near 10 (see Section 5.1.2 in PE's paper) for specialized domains like medicine to ensure a fair comparison.  \n- **We have provided results** for different ϵ* values ranging from 4 to 20 in *Appendix B*, showed the robustness of our PCE, and analyze their impact on the privacy-utility trade-off. As shown in *Table 6*, ϵ*=8/10 emerges as the optimal choice for balancing privacy and utility, where the accuracy decreases greatly when ϵ*<8 but increases slightly when ϵ*>10, since the private information is limited for few-shot scenarios.\n- **We include** results with a wider range of ϵ* in R-Table 3, demonstrating that our PCE consistently outperforms PE.\n\n**R-Table 3: Top-1 accuracy (%) with more values of ϵ* on Camelyon17**\n| |0.01|0.1|1|100\n|-|:-:|:-:|:-:|:-:|\nPE|55.41|55.83|58.65|66.72\nOur PCE|**60.02**|**61.78**|**65.38**|**72.68**\n\n**Concern 4: Qualitative Metrics**\n\n- **Using CAS (top-1 accuracy) aligns with our goal.** Our objective is to achieve high quantitative accuracy in downstream models, which directly reflects the value of synthetic data for these tasks. **As mentioned in our paper** (*Lines 254-256*), the CAS metric (top-1 accuracy) is widely used for assessing the quality of synthetic datasets in downstream tasks. This is also supported by prior influential work [2], which states that *\"traditional GAN metrics such as Inception Score [3] and FID are neither predictive of CAS nor useful when evaluating non-GAN models.\"*\n- **We have provided visual analyses with high perceptual quality** in *Section Synthetic Images* (page 7). From *Figure 6*, our PCE can generate visually high-quality images that align with downstream tasks. The FID (↓) value on MVAD-l is 8.47 for PCE but 58.14 for PE. \n- **Metrics for perceptual quality pose risks.** While visually high-quality synthetic data may appear realistic, it can exhibit high similarity (low diversity) to private data, reducing its informativeness and utility for downstream tasks.  \n- **Our PCE is also effective in diversity metrics.** \n  - Our PCE is designed to enhance diversity. The core of PCE lies in its contrastive filter ($g$), which explicitly improves class discrimination. \n  - On MVAD-l, PCE achieves 12.51, whereas PE only reaches 82.17 in the Inception Score (↓). \n\n[2] Ravuri, Suman, and Oriol Vinyals. \"Classification accuracy score for conditional generative models.\" NeurIPS (2019).\n\n[3] Chong, Min Jin, and David Forsyth. \"Effectively unbiased fid and inception score and where to find them.\" CVPR 2020.\n\n**Concern 5: Computational Cost**\n\nOur PCE can be *applied to real* scenarios across resource-constrained clients (*Line 258*), as the client-side computational cost is negligible, limited to feature extraction (with a small encoder and few-shot private data) and minimal distance calculations. R-Table 4 further demonstrates this. The API service requires no local computational resources. \n\n**R-Table 4: Total time cost (seconds) under 20 iterations.**\n| |COVIDx|Came17|KVASIR-f|MVAD-l\n|-|:-:|:-:|:-:|:-:|\nOur PCE|11.17|9.59|18.68|17.82", "claims_and_evidence": "In relation to the claim about the effectiveness of the \"few-shot\" problem in differentially private synthetic image generation. Although the numerical results show significant improvement over the baseline (PE), I believe the paper does not present sufficiently detailed evidence regarding the isolated impact of the contrastive filter versus the similarity calibrator. I suggest an ablative analysis to determine which component of the method actually solves or mitigates the few-shot problem.\n\nThe broad generality and adaptability to different generative APIs are also not clear as the tests performed are limited to three related APIs (Stable Diffusion, SD+IPA, OJ), all based on the same paradigm. I think there are no clear tests with structurally distinct or closed commercial APIs. That will be a very interesting and more comprehensive analysis.\n\nOne point I like about robust privacy protection is related to the use of differential privacy. I think the approach is theoretically sound, but the justification for the exact values ​​of the privacy parameters (ϵ*) is superficial. I suggest the authors elaborate a better discussion about the specific choice of these values ​​and their impact on the trade-off between privacy and utility.", "methods_and_evaluation_criteria": "I found the use of differential privacy mechanisms combined with contrastive (interclass) techniques and adapted exponential mechanisms really interesting, especially considering the context of the problem.\n\nThe selected datasets related to COVIDx (medical images), Camelyon17 (tumor tissues), KVASIR-f (endoscopic images), and MVtecAD-l (industrial defects) represent practical scenarios.\n\nI agree that the metric used is well-established in the literature and makes sense. However, I miss other qualitative metrics (e.g., FID - Fréchet Inception Distance), visual analyses, or specific metrics for the visual quality of the images.", "theoretical_claims": "I was especially interested in theorem 4.1 (Privacy analysis of the PCE method), which states that the PCE algorithm satisfies the differential privacy property with the total parameter ϵ. The presented proof uses the classical definitions of sequential composition and the exponential mechanism (EM), demonstrating that the repeated application of the exponential mechanism in each iteration of the algorithm satisfies the global differential privacy requirement due to the sequential composition of the mechanisms. Seems ok to me, but it could be improved with a more detailed discussion on the practical justification of the values ​​chosen for the parameter ϵ. I am especially concerned about the trade-off between utility and privacy in the real context of the data used.", "experimental_designs_or_analyses": "I tried to map ​​some aspects of the experiment as:\n- selection of experimental datasets. The chosen are recognized benchmarks ensuring comparability.\n- selection of baselines. The comparisons are extensive and use recent methods such as PE (Lin et al., 2024), as well as variants (DPImg, RF, GCap, etc.).\n- metrics used for Top-1 accuracy are standard in the literature.\n- ablative and sensitivity studies help to understand some model parameters.\n\nI miss qualitative and visual assessments, some kind of evaluation of the computational cost for real scenarios, and a detailed analysis of the privacy-utility trade-off as discussed previously.", "relation_to_broader_scientific_literature": "I found the main contribution to be directly aligned with the foundations of differential privacy, which introduced the formal concept of DP and privacy assurance mechanisms. The proposed method specifically uses the exponential mechanism and adapts it in an innovative way to the synthetic image generation scenario, which is very interesting.\n\nThe use of interclass contrastive relations, which is very important in the proposed method, is related to an established line of literature on contrastive learning and metric learning to allow learning robust representations with little available data.", "essential_references_not_discussed": "I am ok with the references.", "other_strengths_and_weaknesses": "The use of only quantitative metrics (Top-1 accuracy) to assess the results is critical as it may mask situations where synthetic images have high quantitative accuracy but low perceptual quality or insufficient diversity. \n\nI miss a detailed justification for the values of differential privacy ϵ to understand the effectiveness of the privacy protection offered.\n\nI liked the idea of using limited computing resources, but I missed the quantitative or qualitative assessment of the actual cost involved in multiple calls to external APIs. The evaluated APIs have the same paradigm. I was thinking about the performance of other approaches.", "other_comments_or_suggestions": "NA", "questions_for_authors": "I have made some comments and suggestions in the previous analysis. If I made some mistake or missed some point, please let me know.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "NA"}}, {"review_id": "jrr88SSrI3", "reviewer": "Reviewer_JiZb", "summary": "This paper introduces a new method for generating synthetic images under differential privacy called Private Contrastive Evolution (PCE).\nThis method is designed for the case of few-shot private data, which is prevalent in healthcare, using a generative model behind an API.\nPCE works by initializing a synthetic image dataset using a text-to-image API from the class labels. This synthetic dataset is iteratively updated for a fixed number of rounds by privately selecting an image from the synthetic dataset for each class that mostly closely resembles the private images and updating the synthetic dataset to more closely resemble the selected images.\nThe authors conduct experiments on various datasets within the problem domain and find that PCE outperforms the existing API-assisted baseline: Private Evolution (PC).", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your time and effort in reviewing our work! Below, we provide responses to address your concerns and suggestions for extensions, with *Lines xxx* and *Section x* referring to specific parts of our paper. We hope these clarifications effectively resolve your concerns. We also thank you for your creative suggestions for extensions!\n\n**Concern 1: Additional Privacy Budgets for ϵ***\n\n- **We follow PE** in using ϵ* near 10 (see Section 5.1.2 in PE's paper) for specialized domains like medicine to ensure a fair comparison.\n- **We have provided results** for different ϵ* values ranging from 4 to 20 in *Appendix B*, showed the robustness of our PCE, and analyze their impact on the privacy-utility trade-off. As shown in *Table 6*, ϵ*=8/10 emerges as the optimal choice for balancing privacy and utility, where the accuracy decreases greatly when ϵ*<8 but increases slightly when ϵ*>10, since the private information is limited for few-shot scenarios.\n- **We include** results with a wider range of ϵ* in R-Table 1, demonstrating that our PCE consistently outperforms PE.\n\n**R-Table 1: Top-1 accuracy (%) with more values of ϵ* on Camelyon17**\n| |0.01|0.1|1|100\n|-|:-:|:-:|:-:|:-:|\nPE|55.41|55.83|58.65|66.72\nOur PCE|**60.02**|**61.78**|**65.38**|**72.68**\n\n**Concern 2: At what dataset size does PE overtake PCE?**\n\nWe analyzed the impact of the few-shot dataset size ($K$) in *Section CAS w.r.t. K-Shot Private Data* and *Figure 3*, finding that PCE maintains superiority over PE when $K \\leq 100$. In R-Table 2, we extend our analysis to a larger $K$ and observe that **PE outperforms PCE slightly (0.51%) when $K \\ge 1000$**. *However, $K \\ge 1000$ does not represent a few-shot setting*, while PCE is best suited for few-shot scenarios.\n\n**R-Table 2: Top-1 accuracy (%) with more private data (large $K$) on KVASIR-f**\n| |$K=500$|$K=1000$|\n|-|:-:|:-:|\nPE|61.32|**65.53**|\nOur PCE|**62.47**|65.02|\n\n**Suggestion for Extension 1: Parallel Composing for DP**\n\nWe really appreciate your suggestions on strengthen our method with parallel composition. \n\nHowever, since our PCE addresses the few-shot issue by leveraging inter-class contrastive information through the contrastive filter ($g$), it requires access to private data across all classes when evaluating each synthetic sample, making parallel composition challenging. Therefore, we believe that parallel composition deserves a separate paper in the future.\n\n**Suggestion for Extension 2: Combining PE and PCE for Class Imbalance Scenarios**\n\nWe thank you again for your suggestions on combining PE and PCE for class imbalanced data.\n\nFollowing your suggestion, for class imbalanced scenarios, we combine PE and PCE, terming it PE+PCE. Specifically, in PE+PCE, PE is applied to the majority private classes, while PCE is used for minority (few-shot) classes. We compare PE, PCE, and PE+PCE in a class imbalanced experiment as follows. Specifically, we design an imbalanced dataset with 1,000 samples from class 0 (normal) and 10 samples from class 1 (breast cancer with tumor tissue) based on the Camelyon17 dataset, while keeping all other settings unchanged (still generating 100 samples per class). The results can be found in R-Table 3. \n\nIn this class-imbalanced experiment, both PE and PCE perform better with more private data, but PCE still outperforms PE. Since one class remains few-shot, PE suffers from noise overwhelming the actual votes, leading to nearly random similarity voting and selection for the synthetic data in this minority class. In contrast, PCE alleviates this few-shot issue, providing more informative scores to evaluate the synthetic data. By leveraging PE's advantage in majority private classes and using PCE to address the issues in minority (few-shot) classes, PE+PCE performs the best. \n\nHowever, simply replacing PCE with PE for majority private classes limits improvement by losing inter-class contrastive information. Future work needs a more creative combination of PE and PCE to fully leverage their advantages. \n\n**R-Table 3: Top-1 accuracy (%) on class-imbalanced Camelyon17**\n||Accuracy (%)|\n|-|:-:|\nPE|72.36|\nPCE|74.58|\nPE+PCE|**75.39**|\n\n**Suggestion for Typos**\n\nThank you for pointing out the two typos. We will correct them in the revised version.", "claims_and_evidence": "The proposed method PCE outperforms the competitor method PE and several data-independent baseline methods across four image datasets for the few-shot case. At present, these experiments consider performance at a single privacy budget (either $\\epsilon = 8$ or $\\epsilon = 10$). The paper would be improved by considering comparative performance on additional privacy budgets. It is typical consider budgets such that $\\epsilon \\in (0.1, 10)$. Since this is in the image domain, it may be worth considering $\\epsilon \\in (0.01, 100)$.", "methods_and_evaluation_criteria": "The proposed methods and datasets are appropriate for the problem.", "theoretical_claims": "The privacy proof and the definitions appear correct. However, it appears that the method and can be strengthened by applying parallel composition to the exponential mechanism step at each iteration. This is possible because the private images are partitioned by class and only those of a given class are used in the exponential mechanism. In this case, you still need to sequentially compose the iterations of the algorithm but can parallel compose the class iterations. With respect to the privacy analysis, you can achieve the same DP guarantee by setting the $\\epsilon = \\frac{\\epsilon_*}{T}$ rather than $\\epsilon = \\frac{\\epsilon_*}{TC}$.", "experimental_designs_or_analyses": "The experiments appear well-designed but could be improved by considering additional privacy budgets. For the image domain, it may be reasonable to consider budgets in the range of $\\epsilon \\in (0.01, 100)$.", "relation_to_broader_scientific_literature": "The proposed method improves on the Private Evolution method from Lin et al. 2024 for the case of few-shot private synthetic image generation using APIs. This paper does not introduce new methods into the broader literature but successfully applies known building blocks to a specific problem (private synthetic image generation) to improve on existing approaches.", "essential_references_not_discussed": "I am not aware of essential references that are not discussed.", "other_strengths_and_weaknesses": "Figure 2 was helpful to understand Alg. 1.", "other_comments_or_suggestions": "Some typos:\n\n>Private Evaluation (PE)\n\nLine 86, 2nd column: Should read \"Private Evolution\"\n\n>that near distribution boundary\n\nLine 155. 2nd column", "questions_for_authors": "It would be interesting to know at roughly which dataset size does PE overtake PCE. Or in cases of class imbalanced data e.g. healthy images vs sick images, should the larger class use the Gaussian mechanism applied to a voting histogram and the smaller class use the exponential mechanism as implemented by PCE?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UJypmbyVvk", "reviewer": "Reviewer_CXCp", "summary": "This paper proposes Privacy Contrastive Evolution (PCE), a new algorithm for generating high-quality differentially private (DP) synthetic images from small amounts of private data using a generative API. PCE addresses the limitations of existing Privacy Evolution (PE) algorithms, which struggle with high noise levels in small datasets. PCE introduces a contrastive filter to enhance class discrimination and an adaptive exponential mechanism with a similarity calibrator to improve the quality of selection under DP constraints. Experiments on four professional datasets (e.g., medical and industrial) show that PCE outperforms PE and other baselines, achieving up to 5.44% accuracy improvement on downstream tasks while maintaining strong privacy guarantees.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your time and effort in reviewing our work! Below, we provide responses to address your concerns, with *Lines xxx* and *Section x* referring to specific parts of our paper. We hope these clarifications effectively resolve your concerns.\n\n**Concern 1: Generalization to Broader Domains**\n\n- **As mentioned** in *Section Introduction*, we focus on the few-shot issue, which is a critical challenge especially in specialized domains such as medical fields. Therefore, we prioritize these domains to showcase the value of our PCE. Furthermore, publicly available *specialized* pre-trained large models are scarce, making PCE— which relies solely on *general* pre-trained large model APIs— even more valuable. Our PCE can be applied to any domain to address the few-shot issue, as the underlying concept of using additional inter-class contrastive information is general and adaptable.\n- **We include a dataset from the natural domain with a larger number of classes** while keeping other settings fixed and demonstrate that our PCE can also generalize to the natural domain in R-Table 1.\n- **Large-scale datasets are out of scope, as our paper focuses on few-shot scenarios.**\n\n**R-Table 1: Top-1 accuracy (%) on Cifar100 (10 private samples per class)**\n||Accuracy (%)|\n|-|:-:|\nPE|24.23|\nOur PCE|**34.69**|\n\n**Concern 2: A Larger ϵ\\* Range Such as ϵ\\* ≤ 1**\n\n- **We follow PE** in using ϵ* near 10 (see Section 5.1.2 in PE's paper) for specialized domains like medicine to ensure a fair comparison. \n- **We have provided results** for different ϵ* values ranging from 4 to 20 in *Appendix B*, showed the robustness of our PCE, and analyze their impact on the privacy-utility trade-off. As shown in *Table 6*, ϵ*=8/10 emerges as the optimal choice for balancing privacy and utility, where the accuracy decreases greatly when ϵ*<8 but increases slightly when ϵ*>10, since the private information is limited for few-shot scenarios.\n- **We include** results with a wider range of ϵ* in R-Table 2, demonstrating that our PCE consistently outperforms PE.\n\n**R-Table 2: Top-1 accuracy (%) with more values of ϵ* on Camelyon17**\n| |0.01|0.1|1|100\n|-|:-:|:-:|:-:|:-:|\nPE|55.41|55.83|58.65|66.72\nOur PCE|**60.02**|**61.78**|**65.38**|**72.68**\n\n**Concern 3: Empirical Attack Results**\n\n- First of all, Differential Privacy (DP) techniques, such as the Exponential Mechanism (EM), **have been widely proven** to resist empirical attacks [1]. Since the privacy protection ability of our PCE is supported by DP, implemented via the EM in PCE, our approach is **guaranteed** to resist empirical attacks. Our primary focus is on addressing the few-shot issue when applying DP techniques.\n\n- **We incorporate a membership inference attack (MIA)** for COVIDx, where the attack model achieves 50.86% success with DP and 65.27% without, showing PCE's protection ability to such attacks. Specifically, we select shadow data from the public [covid-chestxray-dataset](https://github.com/ieee8023/covid-chestxray-dataset), which is similar to COVIDx, and train an attack model until convergence using the ResNet-18 [2] architecture with randomly initialized parameters and default settings of SGD. \n\n[1] Nasr, Milad, Reza Shokri, and Amir Houmansadr. \"Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning.\"  IEEE symposium on security and privacy (SP), 2019.\n\n[2] He, Kaiming, et al. \"Deep residual learning for image recognition.\" CVPR 2016.\n\n**Concern 4: Computational Cost on Clients**\n\nOur PCE can be *applied to real* scenarios across resource-constrained clients (*Line 258*), as the client-side computational cost is negligible, limited to feature extraction (with a small encoder and few-shot private data) and minimal distance calculations. R-Table 4 further demonstrates this. The API service requires no local computational resources. \n\n**R-Table 3: Total time cost (seconds) under 20 iterations.**\n| |COVIDx|Came17|KVASIR-f|MVAD-l\n|-|:-:|:-:|:-:|:-:|\nOur PCE|11.17|9.59|18.68|17.82", "claims_and_evidence": "The paper's key claims are generally supported by evidence, but some limitations merit discussion:\n1. Experiments focus on specialized domains (medical/industrial). Generalization to broader domains (e.g., natural images) remains unverified.\n2. Total $$\\epsilon_* = 8-10$$ (Tab. 6) might be not strict enough for strict DP applications.", "methods_and_evaluation_criteria": "The proposed methods are well-suited to the problem. PCE addresses PE’s limitations in few-shot scenarios through a Contrastive Filter that leverages inter-class relationships and an Adapted EM with a utility function $u = h \\circ g$ normalized to sensitivity ($\\Delta_u = 1$), reducing noise dominance.  \n\nPCE’s effectiveness is validated through performance gain over PE and other baselines (Table 1). Ablation studies (Table 3) confirm that both components ($g$ and $h$) are essential, supporting the method's relevance to the task.", "theoretical_claims": "Yes, the theoretical claims are technically sound. Class-center aggregation reduces bias from boundary samples, while the similarity calibrator ensures that the utility function $u \\in [1] $ for stable EM sampling. Additionally, the sequential composition guarantees total $\\epsilon_*$-DP, confirming the soundness of the approach.", "experimental_designs_or_analyses": "The experimental design is generally sound but has areas for improvement.\n1. Generalization could be strengthened by testing on larger-scale or natural image datasets (e.g., ImageNet subsets).\n2. Privacy verification lacks empirical attack results (e.g., membership inference) to validate the theoretical analysis. \n3. Additionally, the computational cost of 20 iterations may be high for some clients, though the API-based design helps offset local compute limitations.", "relation_to_broader_scientific_literature": "This paper builds on [1], whose similarity voting approach failed in few-shot settings due to noise dominance from the Gaussian mechanism’s high sensitivity. By adopting the Exponential Mechanism, this work improves noise efficiency in DP distillation.\n\n[1] Lin, Z., Gopi, S., Kulkarni, J., Nori, H.,and Yekhanin, S. Differentially private synthetic data via foundation model apis1: Images. In International Conferenceon Learning Representations (ICLR), 2024.", "essential_references_not_discussed": "As far as I know, no related works that are essential to understanding the (context for) key contributions of the paper, but are not currently cited/discussed in the paper.", "other_strengths_and_weaknesses": "Strengths\n1. First work to address few-shot DP synthesis via APIs.\n\n2. Enables privacy-preserving medical/industrial AI with SOTA performance.\n\n3. Releases code and provides  full API/dataset specifications  and hyperparameter details.\n\nWeaknesses\n1. Tested only on specific datasets, so it’s unclear if the results would apply to more general datasets like ImageNet.  \n2. Only evaluated at high privacy levels ($\\epsilon \\geq 4$), so it's unclear if the method would work well with stronger privacy ($\\epsilon \\leq 1$).", "other_comments_or_suggestions": "It would be better if authors can demonstrate the effectiveness of the method on natural images (e.g., ImageNet subsets).", "questions_for_authors": "Does the method have inherent limitations in natural images or low-$\\epsilon$ regimes?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Ol4mMBz7eF", "reviewer": "Reviewer_DFDh", "summary": "The paper addresses the problem of generating Differentially Private (DP) synthetic images using APIs, focusing on the setting in which only a small number of private data samples are available.    \n\nThe authors observe that a popular prior work, Private Evolution, struggles in few-shot private data scenarios due to limitations in its DP-protected similarity voting approach. This is because with few-shot private data, the noise added for DP overwhelms the actual votes, leading to nearly random similarity voting and selection.\n\nTo address this, the authors propose Private Contrastive Evolution (PCE).  PCE iteratively mines inter-class contrastive relationships in the few-shot private data and integrates them into an adapted Exponential Mechanism (EM)  to directly select candidates rather than vote.    \n\nPCE includes several key components:   \n- A contrastive filter to improve the class-discriminability of synthetic data.    \n- A similarity calibrator on top of the contrastive filter to maximize the selection probability of the most similar synthetic data.    \n- A score function with sensitivity 1 based on the similarity calibrator / contrastive filter\n\nThen, using the score function above, a synthetic dataset is generated from the exponential mechanism. This process is then repeated in an evolutionary loop.    \n\nThe authors conduct experiments on four specialized datasets from healthcare and industry domains, demonstrating that PCE outperforms PE and other API-assisted baselines.  They also analyze PCE's properties, including synthetic image quality, component effectiveness, and hyperparameter influence.\nThe experimental code is provided in an anonymous repo.\n\n-----\n## update after rebuttal\nI am positive about the paper and the rebuttals have reinforced my stance.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your time and effort in reviewing our work! Below, we provide responses to address your concerns and suggestions, with *Lines xxx* and *Section x* referring to specific parts of our paper. We hope these clarifications effectively resolve your concerns, and we also thank you for your constructive feedback!\n\n**Concern 1: Could the pre-trained dataset of a generative model overlap with sensitive datasets?**\n\nWe verified that the following pre-trained datasets of our generative models do not overlap with our private few-shot data by cross-referencing unique identifiers and metadata, and using hash comparisons. Specifically:\n\n- Stable Diffusion (SD) is pre-trained on the public multi-modal dataset LAION-2B [1].\n- SD+IPA is pre-trained on the same LAION-2B dataset, supplemented with the public multi-modal dataset [COYO-700M](https://github.com/kakaobrain/coyo-dataset).\n- OpenJourney is pre-trained on LAION-2B and an additional set of over 100K images from [Midjourney v4](https://www.midjourney.com/home) (a commercial image generative model API).\n\nReasonably, the images we used to construct the few-shot specialized domains (medical and industrial images) are originally images without corresponding textual data and, therefore, cannot be added to these multi-modal datasets.\n\n[1] Schuhmann, Christoph, et al. \"Laion-5b: An open large-scale dataset for training next generation image-text models.\" NeurIPS 2022. \n\n**Concern 2: Is it correct that we can generate as many images as we want after the final iteration of PCE? If so, does generating more synthetic images enhance downstream classification performance?** \n\n- The answer to the first question is **YES**. We can generate as many images as needed using PCE.\n  \n- The answer to the second question is **NO**. We have demonstrated this in *Section CAS w.r.t. N-Shot Synthetic Data* and *Figure 4*, where we show that the utility of the synthetic dataset decreases when generating more than 150 images per class, given noisy data generation APIs, a fixed privacy budget ϵ*, and cost in few-shot private data scenarios. Specifically:\n  \n  1. **Noise**: As the number of synthetic images increases, the valuable information plateaus due to the limited few-shot private data, while noise continues to increase. Since current generative models cannot produce content free of noise, finding a balance is essential to optimize the utility of the synthetic dataset. \n  \n  2. **Privacy**: PCE's privacy protection relies on differential privacy, constrained by a given privacy budget ϵ*. Each PCE iteration consumes a portion of the privacy budget, so PCE will stop once the total privacy budget exceeds ϵ*, meaning that PCE cannot run indefinitely. Thus, the total number of synthetic images is finite when the number of synthetic images is fixed in each PCE iteration.\n  \n  3. **Cost**: Each image generation requires a request to the image generation API service, which incurs a corresponding cost. If cost is not an issue, it is possible to generate as many images as needed in each PCE iteration.\n\n**Suggestion 1: Performance on a Private Dataset with More Classes but Fewer Images per Class to Further Show the Advantage of the Contrastive Filter**\n\nWe thank you for the suggestion to consider a private dataset with more classes to highlight the advantage of our contrastive filter in our PCE.\n\n- **Private datasets in specialized domains typically have only a few classes**, such as positive vs. negative, which is common in fields like medicine. The few-shot issue is particularly prevalent in these specialized domains. After a thorough survey of the literature, we selected four representative specialized datasets used in our paper, each of which has a limited number of classes.\n- **We have included the Cifar100 dataset** in R-Table 1 with other settings fixed, where our PCE outperforms PE by 10.46% in accuracy. This improvement is greater than that observed with existing datasets in *Table 1*, demonstrating the advantage and adaptability of our contrastive filter, even though Cifar100 is not from a specialized domain.\n\n**R-Table 1: Top-1 accuracy (%) on Cifar100 (10 private samples per class)**\n||Accuracy (%)|\n|-|:-:|\nPE|24.23|\nOur PCE|**34.69**|\n\n\n**Suggestion 2: Consider Using Approx-DP Instead of Pure-DP for Stronger Composition and Improved Results**\n\nWe thank you for the suggestion of considering approx-DP to further improve our PCE.\n\nWhile stronger privacy budget compositions for approx-DP may exist, we chose to use the same composition method as the baseline PE for a fair comparison when calculating the total privacy budget. Using pure-DP in PCE ensures that utility improvements are attributable solely to our methodological innovations rather than differences in privacy accounting. Additionally, pure-DP can provide stronger differential privacy guarantees than approx-DP under the same $\\epsilon$. Improving PCE with approx-DP could be explored in the future.", "claims_and_evidence": "The claims are supported by empirical evidence.", "methods_and_evaluation_criteria": "The proposed methods and/or evaluation criteria seem reasonable.", "theoretical_claims": "I verified the proof of privacy, which is straightforward.", "experimental_designs_or_analyses": "I checked the experimental designs/analyses.\nMy only concern is whether the data used to pre-train the backbone model has overlap with the sensitive datasets.", "relation_to_broader_scientific_literature": "The key contribution is a variation of private evolution for generating private synthetic image data in the few-shot learning case. Previous methods ignored inter-class relationships and just generated data for each class in parallel based on similarity scores between the synthetic data and private data. By applying a contrastive filter before the similarity scores, this work is able to better leverage inter-class information.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. It seems that it is possible to generate as many images as desired after the final iteration of PCE, simply by using an i2i model repeatedly on the synthetic dataset. Is my understanding correct? \nIf so, does generating more synthetic images improve downstream classification? If this is the case, it could be highlighted as a further benefit of PCE that we can generate large synthetic datasets from only a small number of private data points.\n1. How is the performance of PCE on large image datasets with a small number of images per class (e.g. CIFAR-100)? It seems like the contrastive filter should improve upon prior works (e.g. private evolution), which essentially ignore the inter-class relationship.\n1. Is there a specific reason to consider pure-DP and not approx-DP? The privacy analysis of PCE seems to be a simple composition over iterations/classes, and using strong composition under approx-DP should lead to stronger results.\n1. Which dataset(s) is the pre-trained backbone model trained on? Could there be an overlap with the sensitive datasets?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper addresses the challenge of generating private synthetic images with limited private data. All reviewers agree that the limitations in prior work such as Private Evolution is substantial in few-shot settings. The paper proposes an approach that uses contrastive signals and a modified Exponential Mechanism to enable more effective candidate selection. 

Though there are concerns about the range of parameters evaluated in the experiments, the consensus among reviewers is that the algorithmic approach and the included experiments are sufficient to merit acceptance.
Decision: Accept (spotlight poster)