Privacy-Aware Time Series Synthesis via Public Knowledge Distillation
Authors: Penghang Liu
Haibei Zhu
Eleonora Kreacic
Svitlana Vyetrenko
Venue: Accepted by TMLR ()

Abstract: Sharing sensitive time series data in domains such as finance, healthcare, and energy consumption, such as patient records or investment accounts, is often restricted due to privacy concerns. Privacy-aware synthetic time series generation addresses this challenge by enforcing noise during training, inherently introducing a trade-off between privacy and utility. In many cases, sensitive sequences is correlated with publicly available, non-sensitive contextual metadata (e.g., household electricity consumption may be influenced by weather conditions and electricity prices). However, existing privacy-aware data generation methods often overlook this opportunity, resulting in suboptimal privacy-utility trade-offs. In this paper, we present Pub2Priv, a novel framework for generating private time series data by leveraging heterogeneous public knowledge. Our model employs a self-attention mechanism to encode public data into temporal and feature embeddings, which serve as conditional inputs for a diffusion model to generate synthetic private sequences. Additionally, we introduce a practical metric to assess privacy by evaluating the identifiability of the synthetic data. Experimental results show that Pub2Priv consistently outperforms state-of-the-art benchmarks in improving the privacy-utility trade-off across finance, energy, and commodity trading domains.

Published in Transactions on Machine Learning Research (11/2025)
Privacy-Aware Time Series Synthesis via Public Knowledge Distillation
Penghang Liu JPMorgan AT Research
Lenghang.luu@ppmccoe
Haibei Zhu JPMorgan AT Research
habber.thu@@ppmchsse.cco
Eleonora Kreacic JPMorgen AT Research
alamoor.kracccechhmccnseccom
Svitlana Vyetrenko JoMorgn Al Research
svitlona. s. www.sseeecceeeoiiipcccccs.ooooo
Reviewed on OpenReview: https: //
// openreview. net/ forum? id- TCSthoRuOc
Abstract
Sharing sensitive time series data in domains such as finance, healthcare, and energy con- sumption, such as palient records or investment accounts, is often restricted due to privacy concerns. Privacy-aware synthetic time series generation addresses this challenge by en- forcing noise during training, inherently introducing a tradc-off between privacy and utility. In many cases, sensitive sequences is correlated with publicly available, non-sensitive con- textual metadata (e.g., household electricity consumption may be influenced by weather conditions and electricity prices). However, existing privacy-aware data generation methods often overlook this opportunity, resulting in suboptimal privacy-utility trade-offs. In this paper, we present Pub2Priv, a novel framework for generating private time series data by leveraging heterogeneous public knowledge. Our model employs self-attention mechanism to encode public data into temporal and feature embeddings, which serve as conditional inputs for diffusion model to generate synthetic private sequences. Additionally, in- troduce a practical metric to assess privacy by evaluating the identifiability of the synthetic data. Experimental results show that Pub2Priv consistently outperforms state-of-the-art benchmarks improving the privacy-utility trade-off across finance, energy, and commod- ity trading domains.
1 Introduction
Synthetic data generation has emerged as a powerful approach for mitigating the risks associated with sharing sensitive real-world data, leading the development of numerous learning-based models designed for this purpose (Figucira Vaz [0222] Lu et al. 2023 Sezer et al., 2020: Pothuru et al. 2023). de facto standard for ensuring data privacy during training is differentially private stochastie gradient descent. (DP-SGD) (Abadi) et al. 2016), which provides strong privacy guarantees for individual data points by introducing gradient noise and normalization. Accordingly, various efforts have been made to integrate differential privacy (DP) into generative models (Xie et al. 2018 Papernot et al. 2018). These approaches inherently involve a privacy-utility trade-off, where stronger privacy protection often reduces the usefulness of the generated data for downstream tasks.
Researchers have explored methods to alleviate this trade-off by leveraging additional information that does not compromise privacy. Semi-private learning, for example, integrates publicly available and non-sensitive

---

Published in Transactions on Machine Learning Research (11/2025)
auxiliary datasets to enhance the privacy-utility trade-off (Pinto et al. 2024 Previous work such Wang & Zhouls (2020) utilized small amounts of public information to adjust parameters in DP-SGD and fine-tune results using model reuse. Additionally, studies by Alon et al. (2019); Lowy et al. (2024) demonstrate that differential private learning can significantly benefit from auxiliary public data, even unlabeled. Although these methods enhance the model's generalive capabilities, they are mainly effective under the assumption that public and private data originate from the same source and share similar distributions. However, this assumption rarely holds in real-world synthetic time series generation scenarios since homogeneous public data are often limited in availability and contain fewer samples than their private counterparts (Jordon et al. 2018).
A critical but often overlooked aspect in privacy-preserving data generation is the heterogeneous contextual metadata (Narasimhan et al., 2024), which can be closely connected to sensitive time series data of interest but does not raise any privacy concerns. For instance, local weather and energy pricing data can serve as valuable public signals for modeling houschold electricity consumption time series while maintaining the anonymity of individual usage patterns and hoseefi inn.rmation. Similarly, while investment, port- folios and personal trading activities are confidential, they exhibit correlations with publicly available stock market indices such as the S&PP 500 and Nasdaq Composite. Furthermore, recent studies have highlighted the potential capability of using empirical knowledge embedded in large language models (LLMs) to identify auxiliary datasets (Zhu et al. 2024), thereby exploring and collecting public knowledge that can enhance the privacy-utility trade-off for synthetic data generation. Motivated by this opportunity, we explore a new per- spective on privacy-aware data generation by leveraging publicly available contextual knowledge. Through our novel problem formulation, we seek to examine how public knowledge can enhance the privacy-utility trade-off across diverse real-world scenarios and domains.
To the best of our knowledge, no prior work has explored the use of public contextual information for time series generation with differential privacy (DP) guarantees. Moreover, it remains unclear how such information can be leveraged to enhance time series generation performance without incurring additional privacy loss. To address this gap, we introduce Pub2Priv, a diffusion model designed to generate sensitive time series using public knowledge. Our approach utilizes pre-trained transformer to extract embeddings from multi-dimensional public metadata, which are then used conditional inputs for diffusion model to generate synthetic private data. To ensure privacy protection, train our model using DP-SGD under specific privacy budget. We also propose a practical metric to evaluate the privacy of our framework by measuring the bdentifiability of synthetic data. Through experiments across multiple domains, including finance, energy, and commodity trading, we comprchensively evaluate the privacy and utility of the synthetic time series generated by Pub2Priv. Our key contributions are summarized as follows.
We introduce novel problem formulation of privacy-aware time series generation by considering publicly available heterogeneous metadata.
We develop Pub2Priv, conditional diffusion model framework to utilize public domain knowledge with no additional privacy cost. Our model utilizes self-attention layers to capture temporal and feature correlations in multidimensional contextual metadata, enabling realistic private time series synthesis.
We introduce a new practical privacy evaluation metric based on the identifiability the synthetic data, which serves as a more interprotable tool to assess and configure privacy guarantees in gener- ation models.
2 Related Works
2.1
Synthetic Data Generation Models
Synthetic data generation has been an active area research, with a broad range of models proposed capture and reproduce the statistical characteristics of real-world datascts (Dankar & Tbrahim| 2021 Raghunathan] 2021 Assefa et al. 2020). Early efforts focused on Generative Adversarial Networks (GANs) Goodfellow et al.] 2020) for image data. This framework has been extended to various data modalities.
2

---

Published in Transactions on Machine Learning Research (11/2025)
Public Data
Private Data
Temperature
Electricity Usage
Househdld 1
Household 3
Pub2Priv
Electricity Price
Figure 1: Pub2Priv generates private time series from heterogeneous public knowledge. The model generates realistic electricity consumption based on non-secret temperature and electricity price information. House- hold private data is protected by DP-SGD during training.
including labular, lext, and time series (Zhang el al. 2017 Xu el al.) 2019 Li et al. 2022). For tabular
data, methods such as CTGAN use conditional generators to capture complex interactions among categorical and continuous variables. Language models based on transformers have been widely used in text generation and successfully generated high-fidelity sentences or even entire documents (Achiam et al. 2023 Similarly, diffusion models have recently emerged as powerful generative models in various tasks via the interactive denoising process (Ho et al. 2020).
A significant body of work also focuses on time series data generation. For example, Esteban et al. (2017) proposed RCGAN to produce realistic real-valued multi-dimensional time series based on recurrent neural networks (RNNs) and generative adversarial networks (GANs). Yoon et al. (2019) presented TimeGAN, which combines the strengths of unsupervised GANs and supervised autoregressive models for controlling temporal dynamics. Desai et al. 2002T] further contributed to this field by introducing TimeVAF, a Vari- ational Auto-Encoder (VAE), to generate multivariate time scries with good interpretability. Alaa et al. (2021) presented a novel approach to time series generation by focusing on the frequency domain instead of the time domain. In parallel, recent research in autoregressive modeling leveraged large language models and structured narratives for improved sequence modcling and forecasting (Liu et al. 2024b a); while primarily targeted at forecasting rather than unconditional generation, these approaches are closely related to learning temporal dependencies.
More recently, diffusion models (Ho et al. 2020 Song et al. 2020 have emerged as promising approach for time series generation. Tashiro et al. (2021 introduced the CSDI model for time series imputation, showcasing the potential of diffusion models in handling missing data within temporal sequences. Building on this, Narasimhan et al. (2024) developed TIME WEAVER, a model specifically tailored for time series generation that leverages metadata to enhance the gencrative process. These diffusion- approaches highlight the evolving landscape of time series generation, where models increasingly incorporate context and external information to generate realistic and useful synthetic data.
2.2 Privacy-Aware Learning
Privacy-aware learning has gained significant attention recent years, particularly in protecting sensitive information while training machine learning models. Abadi et al. (2016) introducod Diffcrentially Privato Stochastic Gradient Descent (DP-SGD), method that has since become a standard for training models with privacy guarantees. DP-SGD works by applying gradient clipping and adding noise to the gradients during training, ensuring that the privacy of individual data points is preserved. Similarly, Yu et al. (202T) proposed gradient embedding perturbation techniques, which project gradients into a lover-dimensional space before applying noise, reducing the dimensionality of perturbations and improving model utility while maintaining privacy.
Semi- Semi-private learning has emerged as an effective approach to leverage both public and private data for
training models with enhanced accuracy (Pinto et al. 2024 Alon et. al. (2019); Wang & Zhou (0200
3

---

Published in Transactions on Machine Learning Research (11/2025)
explored the limits and potentials of semi-private learning, demonstrating that public data can be effectively used to adjust model parameters and improve the outcomes of differentially private learning. Lowy et al. (2024) further extended this by proposing optimal strategies for model training with public data, while Amid et al. (2022) discussed the benefits of using in-distribution versus out-of-distribution public data in privacy-preserve
machine learning. Another notable approach is the Private Aggregation of Teacher Ensembles (PATE) framework proposed by Papernot et al. (2016 2018), where teacher models trained on sensitive data transfer knowledge to a student model trained on public data, effectively balancing privacy and utility. While semi-private learning approaches provide opportunity to utilize public data in private data generation, most existing studies treat public information as an additional dataset rather than as heterogeneous contextual signals. In time series specifically, work under differential privacy has centered on forecasling (Arcolezi et al. 2022: Schuchardi et al. 2025) or on non-DP signal-processing style anonymization via multivariate all-pass filtering (Hore et al. 2024), whereas the DP time-series generators are usually unconditional DP-GAN without external context (Frigerio al., 2019). This leaves the use of heterogencous public context for generation under DP largely unexplored.
Despite these advancements, the application of privacy-aware learning techniques to synthetic data gener- ation, particularly in complex domains such as images and time scries, remains challenging task. Early attempts, such as Xie et al. (2018), incorporated DP-SGD into the GAN framework, while Jordon et al. (2018) developed a GAN model based on the PATE framework. For time-series data specifically, Frigerio it al. (2019) proposed a DP-GAN with an RNN-based generator to release synthetic sequences, but without conditioning on public metadata. More recently, Dockhorn et al. (2022) extended this line of research by applying DP-SGD to diffusion models, showcasing the adaptability of differential privacy across different generative paradigms.
An alternative approach to privacy-aware data generation is ADS-GAN, proposed by Yoon et al. (2020) which aims to generate synthetic data while minimizing patient identifiability. However, this method is more aligned with data anonymization rather than true data generation, as it requires real data as imput to produce synthetic outputs. The focus of our work is on developing methods for dała generation rather than data anonymization or obfuscation. Specifically, we aim to address the gap in existing research by introducing a model that generates synthetic time series data using heterogeneous public data, offering novel approach to privacy-preserving data generation that leverages external information.
In parallel, another line of research focuses on generating synthetic data for query release by preserving marginal statistics. Notable examples include GEM (Liu et al.] 2021), which optimizes generative neural networks using the exponential mechanism, AIM (McKenna et al. 2022 , which iteratively selects queries in workload-adaptive manner, and Private-GSD) (Lāu et al. 2023 a zeroth-order optimization approach based on genetic algorithms. These methods aim to ensure high-fidelity answers to statistical queries under differential privacy constraints, offering strong empirical performance in structured data domains.
3
Preliminaries
3.1
Differential Privacy
In this study, we aim to protect the privacy of individual data x E Day such that given the data generated by our model Dz = G(Dx), an attacker can not identify any data point in the original data (i.e., can not cerlainly tell whether x E D.). One way to provide a strong guarantee of individual privacy is Differential Privacy (DP), which is defined as follows.
Definition 3.1 (e, dDiffrrrrllttaal Privacy). Dwork al. 2006 A randomized mechanism M: D R with domain D and range R is (c, differentially private if for any two neighboring datascts D' D that differ by at most one element, and for any subset of output S C R, it holds that,
Pr(M(D) E S] & *PHM((D) E S +
DP offers strong privacy guarantees by ensuring that the inclusion or exclusion of a single data point does not significantly affect the model's output. In the equation, e is the privacy budget and 8 denotes the
4

---

Published in Transactions on Machine Learning Research (11/2025)
Public Knowledge
Private Data
X0
1
X7
0r
P
Figure 2: Pub2Priv architecture. Given the original data sample zo, gradually add noise through forward process g(Zz ((-1). In the reverse process, we use self-attention layers 0r to create temporal and feature embedding of the metadata which passed to the conditional denoiser lDM to reconstruct the original sample.
probability of privacy breach (in practice, 5 is typically set to be smaller than 1/(D)). The level of privacy is controlled by the two positive parameters & and 6; smaller values these parameters correspond to stronger privacy protection. DP also known for its particularly useful properties. (1) Post-processing: Any mapping or operation applied to the output of differentially private mechanism will not compromise the privacy guarantees; (2) Composability: if all the components of mechanism differentially private, then their composition is also differentially private.
3.2 Diffusion Models
Diffusion models (DMs) are latent variable models trained to generate samples by gradually removing noise from data corrupted by Gaussian noise. The model learns a distribution Po(xo) that approximates a data distribution ((xo). Diffusion models consist of two steps: the forward process and the reverse process. Let X = (=00)) J.N denote the empirical training set, and xo X shorthand for sampling from its empirical distribution. The forward process gradually adds noise to the clean data sample ~ X, defined by the following Markov chain:
I II
q g( FT To)
( x(-1);
(1)
q( x1-1) = Naas / Br 3,1).
(2)
which is determined by fixed noise variance schedule (3i,..., Br), where Br E [0, and T is the total number of diffusion steps. The generation is performed by the reverse process, defined as the following Markov chain:
Po(xar)) p(rr) Il (o xz),
(3)
po(x x4) = Nox po 1), ())
(4)
where p(ær)= = (xr;;;; We parameterize He (2,,,)) t) and (0( t)) following the formulation of Ho et al. 22200. A deep neural network 0 is trained to approximate the denoising function co that predicts the noise from Zt, using the following loss function (where 2, ~ g( xo) via the forward process in equation
[[le- ea cx.,, 0)]
La =
(5)
5

---

Published in Transactions on Machine Learning Research (11/2025)
4 Problem Formulation
We consider each private multivariate time scries as x' E R where L the sequence length (horizon) and is the number of channels. Each times series sample represents a private entity, which is paired with conditional metadata representing public knowlodge. While c can be categorical or continuous in general, in this work lake to be Lime-varying metadata C R
Let Dr.c= (Iz, a==== be dataset consisting of n independent and identically distributed samples, where each sample (zz, c.) comprises a private multivariate time scries I2 E RLXP and its public metadata C; E RL (time points and channels within each Vi are not i.i.d.).
Our goal is to learn a conditional generation model G, which generates data Dr {='|=' = G(c) such that p(a/(c) = p(zlc), and G E, e differentially private with respect to the sensitive component D,-
5
Methodology
Here we propose Pub2Priv, a privacy-aware conditional diffusion framework for generating private data using public knowledge. Our model is trained with strong differential privacy (DP) guarantees through the application of DP-SGD (Abadi et al. 2016). While DP-SGD is well-established method for deep learning with differential privacy, our goal is not to re-invent it. Instead, the novelty of our work lies in problem formulation itself and leveraging heterogeneous public data within the privacy-aware generation framework. Our model is composed of two main components, as illustrated in Figure 2 a conditional diffusion model ODM that generales privale time series data H, and a knowledge translormer Or that creates temporal and feature embedding of public metadata
5.1 Public Knowledge Embedding
CSDI-style encoder. The first component of our model is a pre-trained transformer that produces beddings from heterogeneous public metadata Following Tashiro et al. (2021); Narasimhan et al. (2024), we adopt a two-dimeent pro-dimensional self-attention architecture that alternates attention along the temporal and feature axes to jointly model dynamics over time and dependencies across channels. Tet c E R demote k public signals obscrved over L time steps. We first applies a temporal Transformer encoder to every channel independently (self-allention over 1,.., L} at fixed i), and then a feature Transformer encoder to every time step independently (self-attention over {i = l...., k} fixed t). This dual-axis factorization captures long-range temporal structure and inter-signal correlations while remaining memory--fficient for multivariate sequences. Variable-length sequences and missing entries handled with attention masks
in Tashiro et al. (2021). The encoder output is per-time embedding
= (r(c) I.xducta
which conditions the downstream diffusion model.
Positional encodings. We use 2D positional signals to distinguish order in time and features. In partic- ular, add sinusoidal temporal position Pa Rd, and learned feature embedding fs Rd to before providing it as input to 0r. The temporal encoder attends over [G.,,..., C.,.} ) at fixed i, while the feature encoder attends over {ci.,..., c at fixed t. For padding or irregular sampling, we supply a binary mask mi, to both attention passes so that padded/misssing missing positions neither attend nor are attended to.
Pretraining objective for 0r. We pretrain Or on publicly available time series data including stock prices and weather from Yahoo Finance and NCEI, using a masked reconstruction objective that encourages the encoder to capture both temporal and cross-channel structure. Let M E (0, 1) 1x (with indicating a masked entry) and let é e () be the masked input. We use one-layer decoder 9o map encoder states to reconstructions 2 (0)...)) We minimize the per-feature normalized mean-squared error the

---

Published in Transactions on Machine Learning Research (11/2025)
masked set Ω {(i,t) M, 1}:
C.,, Ci.t 12
Cor
1
Σ (K.))n
of +
where of is the variance of feature i estimated the public corpus (stabilized by 0). During pretraining we apply zero-padding and attention masking for variable-length sequences, with the same masks passed to both temporal and feature attention. After pretraining, Or is fixed and its outputs 2 E RLxdmeta serve as the conditioning signal for our diffusion model.
Remark. This design is inspired by CSDI and Time Weaver of factorize attention along time and features to efficiently encode multivariate sequences (Tashiro et al.) 2021; Narasimhan et al. 2024), while tailoring the objective to produce reusable public-context embeddings for conditioning.
5.2 Conditional Diffusion Model trained using DP-SGD
We employ the diffusion model the backbone of Pub2Priv to provide generative capability. To utilize both private data and meladata embedding 2, condition the diffusion model on the public knowledge embedding to generate private time series data. Following the recent work on conditional diffusion mod- els (Tashiro et al., 2021 we maintain the same forward process as in eq. (2), and define the reverse process as follows:
Po (ft [+,, 2) == (1 4/2), on (Ire 42))
(6)
This formulation provides the knowledge embedding during cach diffusion step without any added noise. Given the denoiser ODM and the knowledge transformer Ór, Pub2Priv minimize the following modified loss function:
Cor = -ExxX. [lle (DM ((0(()))))
We employ DP-SGD to protect the private data during training, which consists of two major procedures: gradient clipping and gradient noise addition. As illustrated in algorithm D DP-SGD randomly samples mini-batches B, from the training data with probability E and computes the gradients (where B the size of the mini-batch).. To bind the influence of each individual data point on model parameters, the gradients are clipped according their & norm and the clipping threshold C' (we explore C' E (0.1,0.5, 1.0, 1.5, 2.0} and select the one with lowest validation loss). After clipping, Gaussian noise NNO, is added to the averaged gradient to protect privacy, and the model parameters are updated using the noisy gradients. The overall privacy loss is tracked throughout the training process using techniques such as the moments' accountant or Rényi Differential Privacy (RDP), ensuring that the cunulative privacy budget remains within and 8.
5.3 Privacy Analysis
According to Abadi et al. (0016). the generator OpM is differentially private for D2 with the protection from gradeint noise and norms. Since 0r is pre-trained model that have no access the private data, it does not bring any privacy loss to the model. Therefore, (e,5)-DP holds for our model (detail proof included in the appendix Bh.
6 Experiments
In this section, we assess the performance of Pub2Priv by analyzing the privacy-utility trade-off in comparison to state-of-the-art baselines across multiple domains.
7

---

Published in Transactions on Machine Learning Research (11/2025)
Algorithm 1 Training Algorithm for Differentially Private Generator 0DM
1: Initialize 6DM randomly
2: for r= 1 to N do
3: Sample mini-batch B, with probability B
4: for each E B, do
(2,, t Venu Co (Is: ci)
6: Gradient clipping:
7: (DM((;,C)) (a) + (D, c max (1, (1sox((a,
Adding noise:
ÿDM ( (DM(I, N(0,
10: Model update:
11: PDM 0DM 1) JDM
6.1
Baselines
Since there are no existing privacy-aware data generation model utilizing heterogencous metadata, we adapt state-of-the-art DP generation models to incorporate metadata conditions alongside private inputs. In par- ticular, we consider DP-GAN (Xie al. 2018), which incorporates DP-SGD into the discriminator of the GAN framework, and PATE-GAN (Jordon et al. 2018) GAN model leveraging Private Aggregation of Teacher Ensembles (PATE). These models are widely recognized as state-of-the-art approaches for integrat- ing differential privacy into deep generalive frameworks, focusing on minimizing per-sample reconst loss. In addition, we consider other leading methods for synthetic data generation that preserve marginal
statistics, particularly for query release purposes. These inchude GEM (Liu ct al. 2021 AIM (McKenna)
et al. 2022 and Private-GSD (Liu el al. 2023). Implementaatio details and model parameters of the baselines are shown in appendix
6.2
Datasets
While our model is broadly applicable to various data modalities, in this study we focus on three time series datasets from the finance, energy, and international trade domains.
6.2.1 Investment portfolios.
One of the most important secrets in financial activities is the investment portfolio, which represents the number of assets possessed by an investor. The changes in portfolios over time reveal private information of clients and their strategies. We consider the private data, which contains 1260 portfolio time series, each representing the daily holding positions of four unknown stock according to the contrarian strategy (Sharpe, 2010) or momentum strategy (Jegadcesh & Titman 1993). We use the corresponding S&P500, Dow Jones industrial index, and common stock prices public knowledge of the market (more information of the dataset can be found in appendix C).
6.2.2 Electricity usage.
The private data contains the daily electricity consumption 370 users in Évora, Portugal (Bessa al. 2015 Trindade 2015) from 2011 2014. We utilize the daily average temperature and the monthly electricity price as public knowledge.
6.2.3 Semiconductor trading.
We also collected international trading data from the UN Comtrade dataset Specifically, we selected ten representative countries and collected their monthly import values in the electronic integrated circuit category from the year 2010 to 2023 as the private datasct. We collected the corresponding Philadelphia
IUN Comtrade dataset: ntaps:/coomtradeplus.uo
8

---

Published in Transactions on Machine Learning Research (11/2025)
Table 1: Utility of Pub2Priv and the baseline models (e = 1, 1 10-9). For all metrics, smaller values indicate better utility. The best performances among Pub2Priv and the baselines are marked in bold text, excluding the ablation models.
Model
KSR
KSAR
CorTmeta
TSTR (discri.)
TSTR (predic.)
Pub2Priv
0.28 + 0.02
0.17 + 0.05
0.18 + 0.01
0.100 0.08
0.003 + 0.000
Pub2Priv(w/o c)
0.43 0.04
0.42 0.02
0.53 = 0.00
0.210 + 0.065
0.008 + 0.001
Pub2Priv(w/o 0r)
0.42
0.44
0.48 = 0.03
0.220 0.057
0.016 = 0.003
DP-GAN
0.29
0.26
0.38
0.262 0.065
0.006 = 0.000
Portfolio
PATE-GAN
0.46
0.42
0.52 0.01
0.282
0.054 = 0.009
GEM
0.36
0.00
0.53 = 0.00
0
0.053 = 0.010
AIM
0.00
0.00
0.53 = 0.00
0.340 0.163
0.008 = 0.000
Private-GSD
0.46 0.00
0.56 1.60
0.53 + 0.00
0.391 + 0.011
0.063 + 0.004
Pub2Priv
0.26 1.6:00000
0.08 - 0.02
1119
0.00000000
Pub2Priv(w/o c)
0.28 0.01
0.32 0.01
0.35 = 0.00
0.015 0.001
Pub2Priv(w/o 0r)
0.26 0.01
0.18 0.01
0.08 = 0.02
0.121 + 0.048
0.007 + 0.005
DP-GAN
0.25 + 0.01
0.18
0.10 = 0.03
0.111 0.145
0.012 0.001
Electricity
PATE-GAN
0.29 + 0.00
0.32 0.32 0.01
0.35 - 0.00
0.125 0.161 0.161
0.042 + 0.001
GEM
0.34 0.00
0.32
0.34 0.00
0
0.054 0.006
AIM
0.25 0.00
0.32 =
0.34 0.00
+
0.049 + 0.004
Private-GSD
0.34 0.00
0.32 1 0.00
0.35 + 0.00
+.088
0.051 + 0.006
Pub2Priv
0.32 + 0.03
0.77 0.01
0.44 0.05
1113:0.08
0.013 0.000
Pub2Priv(w/o c)
0.37 = 0.00
-.77
0.68 = 0.01
0.332 + 0.045
0.015 0.002
Pub2Priv(w/o 0r)
0.03
0.77
0.48 + 0.04
0.111 0.038
0.011 0.001
DP-GAN
0.32
0.79
0.59 = 0.06
0.303
0.013
Comtrade
PATE-GAN
0
0.70
0.68 = 0.01
0.290
0.046 0.005
GEM
0.19
0.00
0.33 = 0.00
0.145
0.073 = 0.008 0.008
ATM
0.20 + 0.00
0.25 0.25
0.32 - 0.00
0.040
0.044 + 0.003
Private-GSD
0.22 + 0.00
0.26 + 0.00
0.33 = 0.01
0.275
0.061 + 0.009
semiconductor sector index (SOX) time series, using Yahoo Finance Python APT as the public data since the index values are highly correlated to the semiconductor import volume.
6.3
Utility Evaluation
6.3.1
Time series utility metrics
We consider five metrics for assessing the utility of generated time series: KSR and KSAR (Kol- mogorov-Smirrov
mogorov Smirnov statistics of return and autocorrelation distributions, respectively); |Corrmetals the ab- solute gap between real and synthetic metadata data correlations; and two Train on Synthetic Test on Real scores TSTR discriminative and predictive. Formal definitions, aggregation rules, and implementation details are provided in App. F
The discriminative score measures how well an RNN-based discriminator distinguish between original and synthetic time series data samples. The original and synthetic data are evenly distributed in both training and testing datasets. The discriminative score is defined as the absolute difference between the testing accuracy and 0.5, which is the probability of random guess. Thus, score close to 0 indicates that the synthetic data is indistinguishable from the real data. Conversely, a score farther from 0 implies that synthetic data samples are less realistic and significantly different. from real data samples.
The predictive score accesses how well the synthetic data captures the underlying patterns and dynamics in the real data. All synthetic data is utilized to train an RNN-based predictor, and all real data is used for testing. The predictive score is the mean square error between the predicted values and the real values.
2yfinance Python package: https://pppp.oon//prjee///////// fytianne/tttt///cee////

---

Published in Transactions on Machine Learning Research (11/2025)
Pub2Pr
0.5
GEM
DA-GAN
PATE-GAN
0.00
GEM
DP-GAN
PATE-GAM
TSTR(discri.
0.4
CG3
TSTR(predic))
0.05
AIN
0.3
0.04
0.2
6.1
0.00
6.9
0.00
Epsilon
Epsilon
(a) (STR(discri))
(b) (peR(pe
Figure 3: The fiility-privacyy trade-off for Pub2Priv and the benchmark models the portfolio dataset.
A lower score indicates that synthetic data samples capture important patterns and features in real data, making them useful in developing predictive models.
6.3.2 Experimental results
We compare our model to baselines under the same privacy budget (s= 1, 6 == 1==1x10-9) Each experiment is repeated times; we report mean + standard deviation in table Formal metric definitions and aggregation rules are in App. F]
Distributional fidelity. As shown in (able 1 our model achieves the best performance in preserving the return distribution the Portfolio dataset and attains better comparable KS₂ the other two datasets. For autocorrelations, method consistently outperforms all baselines across datasets in KSAR-
Private publite-public correlations. We report Corrmeta lo assess how well synthetic data reproduce correlations between private data x and public metadata c. Note that while our model is specifically designed to extract and utilize knowledge from heterogeneous metadata, |Corrmeta| is a diagnostic metric which not included in the training objectives of fr the diffusion model 0DaS. Our model yields the smallest [Corrmeta| across datasets, indicating better preservation of crivate-publle dependencies (table)
Downstream utility (TSTR). Our approach delivers superior TSTR performance on average: the dis- criminative score improves by 0.118 (higher is better) and the predictive score by 0.013 (lower MSE is better) compared to baselines (table DP GAN achieves the best discriminative TSTR on the Electricity dataset but exhibits high variance (standard deviation larger than the mean), indicating instability.
Privacy-utility trade-off. Across privacy budgets, our method consistently yields better TSTR scores than baselines (fig. 3). When the budget is very tight, all methods struggle; as E- our model increasingly captures useful structure tied to the public signals, improving utility. We observed that the marginal- statistics-based baselines (GEM, ATM, and Private-GSD) perform poorly in terms of TSTR scores. This is primarily because these methods are designed to generate synthetic data that supports accurate responses to aggregate queries, rather than to capture realistic individual-level patterns. Consequently, they fail to produce synthetic samples that reflect plausible trajectories or behaviors, such as realistic investment portfolios. As a result, their TSTR performance is significantly lower due to the lack of individual-level fidelity.
Qualitative distributional coverage. In addition to the quantitative evaluations, we use t-SNE Van der Maaten & Hinton 2008) plots to visualize the distributions of the synthetic and real data. Figure 4 shows that DP-GAN, PATE GAN, and AIM deviate substantially from the real distribution under 1, = 1 x 10-5 GEM and Private GSD tend to cluster around a few outliers rather than covering the bulk of the data. Tn contrast, our samples more closely match the real distribution.
Summary. Overall, our model surpasses baselines on most metrics and datasets and improves the pri- vacy-utility trade-off (see table and fig. 3
10

---

Published in Transactions on Machine Learning Research (11/2025)
datn
cata D4-
Renl cats
Real data GEM
Resl dats
Real Dota Private-GGD
PATE-GAN
(a) Pub2Priv
b DP-GAN
(c) PATE-GAN
(d) GEM
(e) AIM
(f) Private-GSD
Real data
Real 6912 GAN
Real dats
Real dann Pruate-G3D
(g) Pub2Priv
(h) DP-GAN
(1) PATE-GAN
(i) GEM
(k) AIM
(l) Private-GSD
Figure 4: 1-SNE visualizations of synthetic data generated by Pub2Priv and the baseline models based on 1,6 10-5, where the top row shows portfolio dataset and the bottom are electricity dataset. We omit the t-SNE plots for the Comtrade datasct due to its relatively small size, which results in sparse visua lizatisis
0.07
GEN
Pob3PtN
GEN
GSD
ER-SAV
0.06
POTT-GAA
Meent/hbblli
0.01
Identi/fubiilit
0.66L
identifiability
0.04
COL
A.
0.05
0.00
0.7
33
30"
10
10
327
15"
10"4
Epsilon
Epsilon
Epsilon
(a) Portsolio
(b) Electricity
(c) Contrade
Figure 5: The identifiability I(D, D') of synthetic data generated by Pub2Pub and the benchmark models given different (with 8 10-5).
6.4 Empirical Identifiability Evaluation
While DP-SGD provides a strong (e, DP guarantee to our model training, we consider a practical privacy metrics that allow compare with models trained with other privacy mechanisms. Similar Yoon et al. 2020 propose the synthetic data identifiability, which is defined as:
DDD - o le <d nI -
(8)
where D and D' are the real and synthetic data. For a synthetic sannheticssapple ol E D', d, = min || - represents
2,ED
the minimum distance between z/ and all samples in the real data, whereas dj = min || x'yl denotes
the minimum distance to all other synthetic data samples. If d, < d; x is closer to real data æj E D than any other synthetic data points, posing a potential risk of exposing the information of æy. The identifiability I(D, D') represents the proportion of synthetic data that might be "identifiable" to the real data, where less identifiability indicates stronger privacy.
Now we evaluate the practical identifiability I(D, D') of the synthetic data generated by our model. Figure 5 shows that our model yields synthetic data with similar level of identifiability compared to the baseline
11

---

Published in Transactions on Machine Learning Research (11/2025)
(SSR(Discri.)
0.4
DP-GAN
PATE-GAN
Pub2Priv
(Pedic)
0.05
DP-GAN
Pub2Priv
PATE-GAN
0.04
0.2
0.02
0.1
0.01
5
0.00
4
# strategies
of strategies
(a) (disciis
(b) TSTR(predic.)
Figure 6: The utility of synthetic data generated by Pub2Priv and the benchmark models given private portfolios different complexity (s 1, 8 == x 10-5). As the number strategies increases, the portfolios are more diverse and the complexity of public-private data relations increases. TSTR scores from the three marginal statistics based methods (GEM, AIM, Private-GSD) are omitted as they are significantly worse than the above.
models. For all datascts, inchuding portfolio, electricity, and Comtrade, the synthetic data generated by Pub2Priv has I(D,D) < 0.04 when = meaning that less than 4% of the synthetic time series is closer to the real private data. We also observe that I(D,D) and are positively correlated in most cases, which indicates that identifiability can be considcred as an altornative way to evaluate and configure the privacy of generation models. However, it's important to note that & alone does not guarantee low identifiability. For example, consider a model that generates synthetic data concentrated around the geometric center of the training distribution. Such a model may yield a low (since individual points have minimal influence). yet still result in high identifiability loss esseccapyy if there is a real individual near the center. This kind of behavior can be seen in the t-SNE plots of PATE-GAN, GEM, and Private-GSDD which emphasize the importance of evaluating empirical privacy lcakage (c.g., identifiability) in addition to enforcing theorctical DP guaranlees.
6.5 Impact of public-private interconnection
Our method is particularly effective when there a correlation between public and private data. To further assess its robustness, we investigate performance changes as the private data to be generated becomes more complex while the public metadata given remains the same. Specifically, given the same public metadata, we consider private data comprising various portfolio strategies and evaluate model's effectiveness (details of these strategies are provided in appendix C.I.. Since investments in the same set of assets yield different portfolios depending on the trading strategy used, private data containing large number of strategies tends to have more indirect and loosely defined relationship with the public metadata (i.e., stock prices). As a result, inferring private data from public knowledge bocomes significantly more challenging. Figure 0 presents the TSTR scores when varying the number of strategies in the Portfolio dataset (public metadata held fixed). As the number of strategies increases, the diversity and complexity of the portfolio dataset grows and we observe general decline performance across methods within this controlled setting. However, while the baselines exhibit much steeper rise in TSTR loss, model more effectively captures the intricate and diverse public-private intercomnections, resulting in more gradual increase in TSTR loss. We further data correlations and show the results in appendix G.1
evaluate the impact by controlling the
6.6 Ablation Study
The superior performance of Pub2Priv comes from two key components: (1) the use of public metadata and (2) the knowledge transformer êT that incorporates the temporal and feature embedding of public knowledge. We conduct the ablation study investigate the effectiveness of these two modules. The first ablation method Pub2Priv(w/o c), which is simply our generator without giving any public metadata. The second ablation method Pub2Priv(ww) (w// 0r) created by removing Or and feeding directly to the denoiser
12

---

Published in Transactions on Machine Learning Research (11/2025)
lDM as conditional imput. Table represents the utility of synthetic data generated by Pub2Priv(w/oc) and Pub2Priv(w) (erriviww///// 0r). The results indicate that the TSTR scores of Pub2Priv(no w/o c) are 15% to 194% worse than those of the original model across all datasets, highlighting the benefit of utilizing public metadata. Although performance degradation is also observed Pub2Priv(w/o 0r), the effectiveness of fr is diminished for datasets with lower dimensionality and less informative public While performance declines are also observed for Pub2Priv(w/o 0r), the Or is less effective for datasots with lower dimensionality and a smaller amount of public information (electricity and comtrade datasets). Overall, the ablation study demonstrates that both the public metadaa and knowledge transformer 0r essential components of Pub2Priv, and their removal significantly weakens the model's generative capabilities.
7 Limitations and Discussion
While our model has shown promising results in enhancing the privacy-utility trade-off, it represents only an initial step in the broader exploration of leveraging heterogeneous public knowledge for privacy-aware data generation. In this study, the selection of public metadata was guided by discretion on the following three factors:
Utility. Like other studies
learning (Alon et al. 2019 Lowy et al. 2023 Wang & Zhou
2020), our method relies on the assumption that public data is both relevant and useful. Experimental results indicate that our approach benefits more from richer public metadata with higher dimensionality (e.g., portfolio dala) compared to lower-dimensional sources (e.g., electricity and Comtrade data). If the private data distribution becomes more complex (larger variety of strategies in section 6.5), larger amount of public metadata may be necessary to preserve the utility of the generated synthetic data.
Safety. We exclusively consider non-sensitive contextual information that does not reveal any individual details from the private data. For instance, market indices used as public data reflect overall market condi- tions without disclosing specific portfolio compositions or strategics. Likewise, semiconductor stock prices as public data are not tied to any particular country. To mitigate this restriction, future research could explore additional mechanisms for incorporating sensitive metadata in privacy-preserving manner.
Availability. While our approach expands existing semi-private learning research by leveraging hetero- geneous public metadata rather than solely homogeneous public data, identifying relevant public information still requires domain expertise. To overcome this limitation, future work could harness the empirical knowl- edge embedded in large language models (LLMs) to automatically identify useful public datasets (Zhu et al. 2024).
8 Conclusion
In this study, we introduce a conditional diffusion framework for privacy-aware time series generation that leverages heterogeneous public knowledge. Our model incorporates a self-attention mechanism to capture the temporal and feature correlations in the heterogeneous metadata, and employs DP-SGD to protect data privacy. Experiment evaluations show that given the same privacy budget, our model generates time series with better privacy-utility trade-off for datasets in various domains. Ablation studies validate the importance of the use of public metaldata and the knowledge transformer.
Acknowledgments
We thank Flizabeth Fons and Vamsi K. Potluru for their thoughtful feedback and support.
Disclaimer
This paper was prepared for informational purposes by the CDAO group of JPMorgan Chase & Co and its affiliates ('J.P. Morgan") and not product of the Research Department of J.P. Morgan. J.P. Morgan makes no representation and warranty whatsoever and disclaims all liability, for the completeness, accuracy
13

---

Published in Transactions on Machine Learning Research (11/2025)
reliability of the information contained herein. This document is not intended investment research investment advice, or a recommendation, offer or solicitation for the purchase or sale of any security, financial instrument, financial product or service, or to be used in any way for evaluating the merits of participating in any transaction, and shall not constitute a solicitation under any jurisdiction or to any person, if such solicitation under such jurisdiction or to such person would be unlawful.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Nya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Tgge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint Ftfe:2303.0877. 2023.
Ahmed Alaa, Alex James Chan, and Mihacla van der Schaar. Generative timo-serics modcling with fourier flows. In International Conference Learning Represenlations, 2021.
Noga Alon, Racf Bassily, and Shay Moran. Limits of private learning with access to public data. Advances in neural information processing systems, 32, 2019.
Ehsan Amid, Arun Ganesh, Rajiv Mathews, Swaroop Ramassamy, Shuang Song, Thomas Steinke, Vinith M Suriyakumar, Om Thakkar, and Abhradeep Thakurta. Public data- assisted mirror descent for private model training. In International Conference on Machine Learning, pp. 517-535. PMLR, 2022.
Héber Hwang Arcolezi, François Couchot, Denis Renaud, Bechara Al Bouna, and Xiaokui Xiao. Dif- ferentially private multivariate time series forecasting of aggregated human mobility with deep learning: Input gradient perturbation? Newral Computing and Applications, 31366,13336,,,333, 2022.
Samuel A Assefa, Danial Dervovic, Mahmoud Mahfouz, Robert Tillman, Prashant Reddy, and Manuela Veloso. Generating synthetic data in finance: Opportunitics, challenges and pitfalls. In Proceedings of the First ACM International Conference on AI in Finance, pp. 1-8, 2020.
Ricardo J. Bessa, Artur Trindade, and Vladimiro Miranda. Apatial-tempont solar power forecasting for smart grids. IEEE Transactions on Industrial Informatics, 11(1):232 (11122222 2013. doi: 1111109/T11.014..000
Thomas Cover. An algorithm for maximizing expected log investment return. IEEE Transactions on Infor- malion Theory, 30(2):363 373, 1984.
Fida K Dankar and Mahmoud Ibrahim. Fake it till you make it: Guidelines for effective synthetic data generation. Applied Sciences, (5):2115,, 2021.
Abhyuday Desai, Cynthia Freeman, Zuhui Wang, and Ian Beaver. Timevae: variational auto-encoder for multivariate time series generation. arXiv preprint arXim:2111.0800 2021.
Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. arXiv preprint 2rXiv:2210.m 099999, 2022.
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Lya Mironov, and Moni Naor. Our data, our-
selves: Privacy via distributed noise generation. In Advances in GraplolayyPURROCRYY 2006: 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 486
503, Berlin, Heidelberg, 2006. Springer-Verlag, ISBN 35400345469. doi: 1110007/1766669 29. URL https:///oi..oo org/ 10. 10t./0000011100
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trendso in Theoretical Computer Science, 9(3 4):211-407, 2014.
Cristóbal Esteban, Stephanic L Hyland, and Gunnar Rätsch. Real-valued (medical) time series generation with recurrent conditional gans. Xixiv preprint arxiv Nix:1706.00200 1706.02633, 2017.
14

---

Published in Transactions on Machine Learning Research (11/2025)
Alvaro Figucira and Bruno Vaz. Survey synthetic data generation, evaluation methods and gans. Moth- ematics, 10(15):2733, 2022.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differentially private generative adversarial networks for time series, continuous, and discrete open data. In IFIP International Conference ICT Systems Security and Privacy Protection, pp. 151-164. Springer, 2019.
lan Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Gencrative adversarial networks. Communications of the ACM, 63(11): 139-144, 2020.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in newral information processing systems, 33:6840-6851, 2020.
Gaurab Hore, Tucker McElroy, and Anindya Roy. Achieving privacy utility balance for multivariate time series data. arxwv preprint arXiv:2 11/11...100 17015 2024.
Narasimhan Jegadeesh and Sheridan Titman. Returns buying winners and selling losers: Implications for stock market efficiency. The Journal of finance, 48(1):65-911 1993.
James Jordon, Jinsung Yoon, and Mihacla Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International conference on learning representations, 2018.
Xiaomin Li, Vangelis Metsis, Huangyingrui Wang, and Anne Hee Hiong Ngu. Tts-gan: A transformer- based time-series generative adversarial network. In International Conference on Artificial Intelligence in Medicine, pp. 133-143 143-113.000 Springer, 2022.
Ran Liu, Wenrui Ma, Ellen Zippi, Hadi Pouransari, Jingyun Xiao, Chris Sandino, Behrooz Mahasseni, Juri Minxha, Erdrin Azemi, Eva I. Dyer, et al. Generalizable autoregressive modeling of time series through functional narratives. arXiv preprint 2xXiv2240.084222 2024a.
Terrance Liu, Giuseppe Vietri, and Steven Z Wu. Iterative methods for private synthetic data: Unifying framework and new methods. Advances in Neural Information Processing Systems, 34:690-702, 2021.
Terrance Liu, Jingwu Tang, Giusoppe Victri, and Steven Wu. Generating private synthetic data with genetic algorithms. In International Conference on Machine Learning, pp. 22009 22027. PMIR,, 2023.
Yong Liu, Guo Qin, Xiangdong Huang, Jianmin Wang, and Mingsheng Long. Autotimes: Autoregressive time series forecasters via large language models. Advances in Neural Information Processing Systems, 37:
122154-122184, 2024b.
Andrew Lowy, Zeman Li, Tianjian Huang, and Meisam Razaviyayn. Optimal differentially private learning with public data. arXiv preprint arXiv:2006. 15056, 2023.
Andrew Lowy, Zeman Li, Tianjian Huang, and Mcisam Razaviyayn. Optimal diffcrentially private model training with public data. In Forty-firs International Conference on Machine Learning, 2024. URL https://openrevier hett/forunidd-MPEJUUU
Yingzhou Lu, Minjie Shen, Huazheng Wang, Xiao Wang, Capucine van Rechem, Tianfan Fu, and Wenqi Wei. Machine learning for synthetic data generation: A review. arXiv preprint arxiv:200..0 04062, 2023.
Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. Aim: an adaptive and iterative mech- anism for differentially private synthetic data. Proc. VLDB Endow., 15(11) 2559 2612, July 2022. ISSN 2150-8097. doi: 10.14778/
URL https:///doo wtt.a.orgg11......
Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pp. 263-275. IEEE, 2017.
Ilya Mironov, Kunal Talwar, and Li Zhang. R\ 'enyi differential privacy of the sampled gaussian mechanism. arXiv preprint or Xio: 10530, 2019.
15

---

Published in Transactions on Machine Learning Research (11/2025)
Sai Shankar Narasimhan, Shubhankar Agarwal, Oguzhan Akcin, Sujay Sanghavi, and Sandeep Chinchali. Time weaver: A conditional time series generation model. arXiv preprinl orXin:2/03.00 03.02682. 2024.
Nicolas Papernot, Martín Abadi, Ulfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. arXiv preprint arXiv:1610.057: 05555550. 2016.
Nicolas Papernot, Shuang Song, Iya Mironov, Ananth Raghunathan, Kunal Talwar, and Ülfar Erlingsson. Scalable private learning with pate, arXiv preprint arXiv:1802.0820 2018.
Francesco Pinto, Yaxi Hu, Fanny Yang, and Amartya Sanyal. Pillar: How to make semi cemi-private learning more effective. In 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp- 110 139. IEEE, 2024.
Vamsi K Potluru, Daniel Borrajo, Andrea Coletta, Niccolò Dalmasso, Yousef El-Laham, Elizabeth Fons, Mohsen Ghassemi, Sriram Gopalakrishnan, Vikesh Gosai, Eleonora Kreačić, et al. Synthetic data appli- cations in finance. arxiv preprint arXiv:2401.000 2023.
Trivellore Raghunathan. Synthetic data. Annual Review of Statistics and Its Application, 8(1):129-14) 2021.
Jan Schuchardt, Mina Dalirrooyfard, Jed Guzelkabaagac, Anderson Schneider, Yuriy Nevmyvaka, and Stephan Günnemann. Privacy amplification by structured subsampling for deep differentially private time series forecasting. arXiv preprint urXiv:2502.02/ 10, 2025.
Omer Berat Sezer, Mehmet Ugur Gudelek, and Ahmet Murat Ozbayoglu. Financial time series forecasting with doep learning: systematic literature review: 2005-2019. Applied Soft Computing, 90:106181, 2020.
William F Sharpe. Adaptive asset allocation policies. Financial Analysts Journal, 66(3):45-59 2010.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020.
Yusuke Tashiro, Jiaming Song, Yang Song, and Stefano Ermon. Csdi: Conditional score based diffusion models for probabilistic time series imputation. Advances in Neural Information Processing Systems, 34: 2021.
Artur Trindade. Elerriittyladdiigrrmm2201111...1 UCI Machine Learning Repository, 10:C58C86, 2015.
Laurens Van der Maaten and Gcoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, (11),, 2008.
Jun Wang and Zhi-Hua Zhou. Differentially private learning with small public data. In Proceedings of the AAAT Conference on Artificial Intelligence, volume 34, pp. 2219-6226, 2020.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXi::1802.0677 06739, 2018
Lei Xu, Maria Skoularidou, Alfredo Cuesta- Cuesta-Infante, and Kalyan Veeramachaneni. Modeling tabular data using conditional gan. Advances in Neural Information Processing Systems, 32, 2019.
Jinsung Yoon, Daniel Jarrett, and Mihaela Van der Schaar. Time-series generative adversarial networks.
Aduances in neural information processing systems, 32, 2019.
Jinsung Yoon, Lydia N Drumright, and Mihaela Van Der Schaar. Anonymization through data synthesis using generative adversarial networks (ads-gan). IEEE journal of biomedical and health informatics, 24 (8):2378-2388, 2020.
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, al. Opacus: User-friendly differential privacy library in pytorch. arXiv preprint ar arxiv:2100 12998, 2021.
16

---

Published in Transactions on Machine Learning Research (11/2025)
Da Yu, Huishmai Zhang, Wei Chen, and Tic-aan Liu. Do not let privacy overbill utility: Gradient embedding perturbation for private learning. ArXin, abs/2102.12677, 2021. URL. httpp::/app..smmmmiicchhhh... semanticcchollar
//s/OorppuIDD:2224668888
Yizhe Zhang, Zhe Gan, Kai Fan, Zhi Chen, Ricardo Henao, Dinghan Shen, and Lawrence Carin. Adversarial feature matching for text generation. In International Conference on Machine Learning, pp. 4006-4015. PMLR, 2017.
Haibei Zhu, Yousef El-Lahm,, Elizabeth Fons, and Svitlana Vyetrenko. A language model-guided framework for mining time series with distributional shifts. arviv preprint arXiv:2406.0550 05.49 2024.
17

---

Published in Transactions on Machine Learning Research (11/2025)
A Broader Impact
Our paper brings novel problem formulation and introduces the first approach of privacy-aware data generation by leveraging public contextual information. We believe this is an important research area which extends semi-private learning to heterogeneous public data from non-sensitive sources and domains. For instance:
In domains such as finance, generating syuthetic portfolios and trading transactions enables re- scarchers and analysts to develop and validate trading strategics without risking disclosing sensitive market positions. In this case, non-sensitive market indices and common stock prices can be used to enhance the generation of private portfolios.
In healthcare, synthetic patient data can facilitate disease progression and resource allocation re- search without exposing individuals' private health records. Public available metadata like the spread of discascs and distribution of vaccine be utilized.
In energy domain, synthetic electrical consumption patterns can assist in smart grid simulations and forccasting while safeguarding the identitics of houscholds, which can benefit from the public knowledge of weather conditions and electricity pricing.
B Proof of Differential Privacy in Pub2Priv
In this section, provide a concise proof that the gradients in Pub2Priv differentially private (DP). Specifically, we consider the definition of Rényi Differential Privacy (RDP) from Mironov (2017):
Definition Rényi Differential Privacy A randomized mechanism M D - R. with domain D and range R satisfies (o, if for any adjacent D, D' E D:
(d M(d)) Se,
(9)
where Da is the Rényi divergence of order Any M that satisfies (a,c)-RDP also satisfies (e + log //((- 1), 6)PD..
Theorem B.1. Mironoor 2017) For a query function f with Sensitivity $ = maxa,e [If(d) - f2d the Gaussian mechanism that releases l(d) + +0,,o²? satisfies (a, as2 (
In each iteration of Algorithm 1, we randomly sample mini-batel B, with expected size with no repeated indices. We implement our model based on Yousefpour al. (2021) which applies the Gaussian mechanism for gradient sanitization. After computing the gradient of C(x,, 4)), we apply clipping with norm C, and then divide the elipped gradients by the expected batch size B to obtain the batched gradient GDM:
GDM((Zn,2) =
Σ
clipo((ennn e C(x,,
(10)
B
iEB
Finally, Gaussian noise e ~ NO, o²) is added to GDM and released as the response GDM:
C ČDM xi)in) GDM({ zhenn) + B²
(11)
Since 2; is metadata embedding of & which is free of privacy concerns, we can restate Theorem 2 as follow: Theorem B.2. For noise magnilude aDp, dalaset. d = (ar) and a set of samples Br, releasing GDM((= satisfies (a, RDD.
Proof. Considering two neighboring datascts d= [ and d' d {x'}, where x' & d, and mini-batcher (atheB and {a'} (Z))eB that differs by one additional entry z'. We can bound the difference of their gradients in L--norm as
18

---

Published in Transactions on Machine Learning Research (11/2025)
Datasct # of Samples
Length
Pcarson(x; c)
Private Data
Public Data
Portfolio 1260
360
0.573
Daily hoding positions
Market indices and common stocks
Daily average temperature;
Electriciy
1404
365
0.386
Electriciy usage
monthly electricity price
Comtrade
100
120
0.761
Monthly trading values
Semiconductor index (SOX)
Table 2: Summary of the datasets.
(DM((H:heB) GDM((=') ( (zihen)llz
1 (clipc - --
(lep((
clipo V VoL(()))
B YEB
B
SEB
clipo clipp (VoC(2))l2 - C
(12)
This difference is bounded by the sensitivity of B, which is accounted for in the Gaussian mechanism
under Mironov (2017). Furthermore, since <~ N it follows that &e N (G) d²) Following
standard arguments, relcasing (Dm((=:)eB) GDM((<;)ee)) f satisfics (a, ) Since e is not private data, Or does not. bring additional privacy cost by the post-processing property of differential privacy (Dwork al.) 2014). In practice, construct mini-batchan by sampling the training dataset for privacy amplification via Poisson Sampling [Mironov et al.) 2019). The overall privacy cost of training 0DM is computed via RDP composition (Mironov 2017). using the processes implemented in Opacus (Yousefpour
et al. 2021
C
Dataset Description
In this section, we describe the details of the datasets used for our experiment evaluation, including the private time series data and public domain knowledge. Table / presents the summary statistics of all datasets.
C.1 Portfolio Dataset
We consider the classic investment return maximization problem (Cover 1984) which allocates investment capital over the stocks. The private data presents the amount of holdings on each day, which contains 1260 portfolio time scries created based the following two strategies:
C.1.1 Contrarian Strategy
The contrarian trading strategy introduced by Sharpe (2010), which represents an adaptive asset allocation policy. An investor starts with an initial portfolio of value Vi Σ, X; where X; is the amount of money invested in asset i. At each reviewing period t, the investor adjust the proportion of assets by adding the adjusting value D, (purchase if positive and sell if negative) for each assets:
D, = (K, K2)X,
(13)
where K,
Ve and k; the return of the asset.
C.1.2 Momentum Strategy
The momentum strategy is based on the principle that stocks that have performed well in the past will continue to perform well in the future, while stocks that have performed poorly will continue underperform. At each reviewing period 6, it set the invested value X; K;V, for each asset.
19

---

Published in Transactions on Machine Learning Research (11/2025)
Input x
Metadata c
Temporal Transformer Layer
Conv1D
Timestep
K
Feature Transformer Layer
FC Layer
L
Conv1x1
Knowledge embedding Z
Conv1x1
Gated Activation Unit
Conv1xt and ReLU
Residual layers
Input to next layer
Output
Figure 7: Pub2Priv architecture. We use self-attention layers OT to create temporal and feature embedding of the metadata c, which is passed to every residual layers of the denoiser lDM to generate the output for each denoising step t.
Note that multiple strategies be derived from the above two policies by considering different length of reviewing period for caleulating asset returns. To protect investor identity and their business strategies, each portfolios was built on unknown stocks from the Dow Jones composite components during an unknown time period of 360 consecutive days excluding weekends. For public knowledge, we consider the Standard and Poor's 500 index (S&P 500), which is a stock market index tracking the stock performance of 500 of the largest publicly traded companies on stock exchanges in the United States. We also consider the Dow Jones Industrial index and the price of common stocks including AAPL, AMZN, MSFT, NVDA, and TSLA.
C.2 Electricity Dataset
The electricity dataset contains power consumption recorded for 370 users over period years from 2011 to 2015 provided by Trindade (2015). Daily usage are created by aggregating the 15 minutes power consumption in the raw data. As all users located in Evora, Portugal, randomly selected four 1-year samples for each user in order to create datasel for conditionally generating time series based on specific public metadata. This results in 1404 time series as some users have consumption record shorter or equal to one year. We consider the daily average temperature and the monthly electricity price as public knowledge.
C.3 Comtrade Dataset
We also collected time scries data from the UN Comtrade data source, which is comprchensive and widcly- used data resource for international trading staties. This dataset provides data recorded by the United Nations about many aspects in global trading, including information on imports and exports, trading cate- gories, trading values and volumes. We specifically focused on the import values of the electronic integrated circuits category, which category code is 8542, from 10 selected countries (Spain, USA, Germany, Japan, United Kingdom, France, Brazil, Italy, Canada, Australia). We collected the corresponding monthly trad-
20

---

Published in Transactions on Machine Learning Research (11/2025)
ing values from Jan 2010 to Dec 2023. For each country, sampled 10 time series samples with random starting months, and we set the length of samples to 120. Thus, we collected 100 time series samples with each length of 120 as the private dataset for our utility studies. The corresponding public data was the Philadelphia semiconductor sector index (SOX) monthly time series collected via the Yahoo Finance Python API. Similarly, the SOX samples were also collected with the length of 120. So that the public dataset share the same data quantity as the private datasot.
D Pub2Priv Model Architecture
We present additional details about the Pub2Priv architetcture in order to improve the reproducibility and usage of our framework. Figure 7 shows the architecture of the knowledge transformer 0DM and denoiser Pr- Inspired by Tashiro et al. (2021), we use the self-attention layers to capture the temporal and feature correlations of the metadata c. We implemented the denoiser network 0DM using residual layers similar to Narasimhan et al. (002)), which utilize the public knowledge embedding & at each step mitagate the loss from DP-SGD. Our model parameters are listed in table
Parameter Or embedding size
Value
128
Parameter
Value
0r attention heads
8
Generator layers
4
Or sell-atlention layers
8
Generator hidden dimensions
256
0r dropout
0.05
Discriminator layers
3
0r activation
GELU
Discriminator hidden dimensions
128
size
128
Discriminator iterations (DP-GAN)
20
# of residual layers
4
# of teachers (PATE-GAN)
10
8pm hidden dimension
256
noise ratio (PATE-GAN) noise size (PATE-GAN) À (ADS-GAN)
1.0
# of diffusion steps
400
1.0
31
0.0001
1.0
3r
0.2
128 (port. & elec.);
Batch size
128 (port. & elec.);
16 (Comtrade)
Batch size
16 (Comtrade)
Learning rate
1 10-4
Learning rate
1 x 10-1
Table 4: Hyperparameters of baseline models.
Table 3: Hyperparamters of Pub2Priv.
E
Baseline Model Implementations
Here report the hyerparameter configurations for the baseline models in table 4 We use the implementa- tion provided by the original authors for all baseline methods: DP-GAN (Xie et al. 2018 PATE-GAN (Jor- don et al. 2018 and ADS-GAN (Yoon et al. 2020). We concatenate the metadata as conditional input and add 1D convolution layer to adapt the baselines models for time series data. In addition, we adjusted the number of parameters the generator and discriminator to roughly match the Pub2Priv models. Preserving marginal statistics has proven effective for generating synthetic data with privacy guarantees, particularly the context of query release. However, these methods primarily target tabular data, focusing on queries such the average age of individuals carning above $20k. To adapt state-of-the-art marginal cattistiss-based approaches (GEM, AIM, and Private-GSD) to time series data, apply aggressive preprocessing strat- egy. Specifically, we divide cach time scries into 10 temporal segments and quantize the feature values into 50 discrete levels. This flattening process allows us to approximate the data as a 2D table for the query workloads, but at the cost of significant loss in temporal resolution and structure. We acknowledge that this approach a crude and lossy adaptation, and indcod confirms our concern: methods designed for preserving marginal statistics in static tabular data are not suitable for generating temporally coherent, realistic synthetic trajectories.
21

---

Published in Transactions on Machine Learning Research (11/2025)
F Evaluation Metrics
Let Dreal (x(m) E RdxL)y Dayn = {x E g the corresponding synthetic set, and eln) E IR the public metadata. Unless noted, all computations are performed per sequence and per channel, then aggregated as specified.
Jn=1 be the set of real private time scries (with d channels and length L);
KSR: KS distance of return distributions. For each channel and sequence n, define first-diflerence returns
(m)
(n) -
(n)
(())
(n) t L.
Tit 111-11
(1) Let Fi(u) and (u) be the empirical CDFs of (r Jn and (ri,)) In,e obtained by pooling over all and t.
The per-channel KS statistic is
KSR(i) = sup
F((u) (7)
uER
We report the average across channels:
KSR 1 KSR(t).
KSAR: KS distance of auto-correlation distributions. Fix set of lags A {1, {I,..., Lmmax. For each channel sequence n, and lag l E A, define the sample auto-correlation
(m) El (1 x((")) (x (1 I
(n) P.
(p)
(m)
Σ (x, x z(11)2
and similarly Pit from x((n) For each lag let Ge(u) and (u) be the empirical CDFs of (2))) Jin and (())
(n)
{PEe hin- The lag- wise KS statistic is
KSAR(f) = sup uE(-1,1)
G ())
and we aggregate over lags by averaging:
KSAR
1 A
Σ KS)R(f) PEA
CorTmetal: metadata-dae data correlation gap. For each private channel E (1,...,)) .d), metadata channel E (I,...,k), and sequence n, compute the Pearson correlation across time
corr (n)
Pearson (n) (,1L S,LLL,
(m)
cont (n) Pearson (n) (n) x 1.1: (.1LL)
The absolute correlation gap is then averaged over all triplets:
N
Corrmeta
(n) corr corr
(n)
Ndk
TSTR (discriminative). Given a supervised discriminative task with real labels ()( (e.g., classifica- tion), train a predictor he on {(z'(n), (a ((())} using the synthetic inputs, then evaluate on a held-out real test set Treat:
0yyn arg min Laise (ho; Dayn),
TSTRase
MMisse (hagp: Treal),
where Ldise is a standard discriminative loss (e.g., cross-entropy) and Maise is the target metric (e.g., accuracy AUROC). Higher is better for accuracy AUROC.
22

---

Published in Transactions on Machine Learning Research (11/2025)
Correlation 0.0
0.3
0.6
0.9
(Sssrrissrr)
0.480
0.385
0.450
0.480
ISTTR(predic 0.022
0.020
0.015
0.005
Table 5: The TSTR performance of Pub2Priv (s 1, = x 10-9) on the same toy private dataset given public metadata with different degrees public-private correlation.
TSTR (predictive). For forecasting task with horizon A and window size w, construct supervised pairs from sliding windows. Train a forecaster fo on synthetic pairs and evaluate mean squared error on real test pairs:
Jyyn
arg min
Σ
[16((X) X1 TSTRpred
(X) 1112
Sayn
Smeal
(XI,Y1)ES
(X,Y)ES
Here each X E Rdx= is a length-w window from a real series and Y E RdxA is the A-step-ahead target; (X', Y") are constructed analogously from synthetic series. Lower is better for MSE. We report means over multiple random seeds/splits
G Additional Experiment Results
In this section, present additional experiments that do not fit into the main body of the paper.
G.1 Impact of public-private interconnection
In addition the portfolio experiment in section 6.5 we have included new loy scenario to provide more intuitive understanding of how the correlation between public and private data affects our model. Specifically, construct toy dataset of 100 one-dimensional time series, where each private series 2; is composed of trend, scasonality, and small noise components. Corresponding public metadata q is generated as 6 ax; + v1 o N(,, o) where is the desired Pearson correlation. As shown in the table 5 we observe that stronger correlation improves the TSTR predictive score, suggesting that Pub2Priv can effectively leverage relevant public knowledge. Interestingly, TSTR discriminative scores are similar for different correlations, potentially due the diversity in random private samples, which makes classification inherently harder.
G.2 Visualization of synthetic data
Here provide visual comparison between original data and synthetic data generated by our model in fig. The time series generate by our model closely align with the original holding positions.
Real
Aaal
Bonl
Geal
(a)
(b)
(c)
(d)
Figure 8: Portfolio time series generated by Pub2Priv given the same metadata condition c.
23

---

Published in Transactions on Machine Learning Research (11/2025)
Aetocereete
Pr
DAC
Dn-cen
ORIGAN
(a) Returns
(b)
Anto-correlations
(c)
Correlations
with
public
metadata
Figure 9: Distributions of return, auto-correlation, and the correlations with metadata.
Input time series length
100
200
300
Pub2Priv
2m 16s
2m22s
3m21s
DP-GAN
3m32s
4m16s
5mm29
PATE-GAN
2m04s
2m14s
3m30s
Table 6:
The runtime of Pub2Priv, DP-GAN, and PATE-GAN for input time series with different length.
Data size (dimension x length) 1x100
1x200
Ix300
2x100
100
3x 100
Peak GPU memory usage (MB) 1208
1564
5764
1422
1970
2748
Table 7: The computational cost of Pub2Priv for input time series with different size.
G.3
Additional Time series utility metrics
In addition the KS statistics, here we take a closer look at fig. g which shows the distribution of time series stylized facts including return, auto-correlation, and private-public data correlations. We observe that Pub2Priv yields synthetic data with stylized facts distributionally close to the original datasct.
G.4 Scalability and Computational Cost Analysis
All experiments the paper were conducted on AWS g4dn. 4xlarge instances (16 vCPUs, 64 GB RAM, 16 GB GPU). Here further investigate the computational cost. (GPU usage) and the runtime of our models w.r.t. the size of the input data (dimension and length of ). Each dataset contains 500 samples, and we
train all models with batch size 32 for 100 epochs.
We show the results averaged over five runs in table g and table 7 similar as we match the size of the generator networks, and the runtime of our model scales comparably for varying data dimensionality.
The GPU usage of all models are very
24


Reviews:
[{"review_id": "FpiVzYgW4c", "reviewer": "Reviewer_tt2c", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The problem of generating private time series using public metadata is a useful problem. But I think there are several weaknesses with the state of the draft as is,\n\n1. The authors mention that \"no prior work has explored the use of public contextual information for time series generation with differential privacy.\" This is a rather strong claim for a problem statement that seems quite natural to study. Indeed a quick search shows quite some prior work (see below)\n\n* Differentially Private Generative Adversarial Networks for Time Series, Continuous, and Discrete Open Data, Frigerio et al.\n* Achieving Privacy Utility Balance for Multivariate Time Series Data, Hore et al. \n* Differentially private multivariate time series forecasting of aggregated human mobility with deep learning: Input or gradient perturbation?, Arcolezi et al.\n* Optimal Differentially Private Model Training with Public Data, Lowy et al.\n* Privacy Amplification by Structured Subsampling for Deep Differentially Private Time Series Forecasting, Schuchardt et al.\n\n\n2. The authors spend a lot more time explaining Diffusion models and DP-SGD than I would have liked -- it comes at the cost of several missing details about the stuff that actually matters. For instance, \n* What is the CSDI architecture?  \n* Are positional embeddings used? \n* What is the loss for $\\theta_T$? \n* The authors mention \"appendix\" several times. Which appendix? Please label them for the reader \n* What is k in 6.3.1, is it 4? \n* Please elaborate/explain/discuss the key metrics KSR, KSAR, TSTR etc \n\n3. One of the evaluation metrics |Corr_meta| directly measures what the model is designed to optimize. So not so surprising that the proposed model does well than the baseline.  \n\n4. Theorem 5.1 adds little value to the reader. \n\n5. A figure is worth a thousand words. It is always a good idea to show tables/plots/figures then verbally stating results c.f section 6.3.2\n\n6. Section 6.5 -- \"leading to a decline in performance for all models\". A rather important claim that is not backed by numbers for all 3 datasets (and only for small-ish k for investment dataset). If I am mistaken please point me to the right page.\n\n7. In my humble opinion, t-sne plots for contrasting different generative models especially when the original dimensions are so high, should be used with extreme caution since they could be so easily misinterpreted.  \n\n8. Could the authors please comment on why they used diffusion models especially when autoregressive models have been used quite extensively recently for time series modeling? [https://neurips.cc/virtual/2024/workshop/84712]", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors Pub2Priv, a framework for generating private time series using public contextual metadata through conditional diffusion models trained with DP-SGD.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "I am afraid that applying standard conditional diffusion models with DP-SGD using auxiliary data does not meet the bar for TMLR. I would encourage the authors to think about the limitations of their work (some of which are mentioned in section 7, and section 6.5) from a fresh perspective.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "cu3YHOAHmS", "reviewer": "Reviewer_Ygz9", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n- The paper solves an interesting and relevant problem, is quite well-written and easy to understand.\n- The experiment section is quite extensive.\n\n### Weaknesses\n\n### Section 3\n- In (5), what is $X$? The distribution of actual data samples? If yes, please clarify it.\n\n### Section 4\n- $D_{x,c}$ has $n$ i.i.d. data samples. But, how can time series data be i.i.d.? If it is i.i.d., it's not an interesting time series, and is no longer a challenging problem, right? Or are you considering multiple instances of the entire time series ($L \\times F$) as i.i.d.?\n\n### Section 5\n- It is said on page 5 that \"the novelty of our work lies in problem formulation itself ...\" Is the problem formulation in the paper first of its kind?\n- Section 5.3: \"$\\theta_T$ is a pre-trained model that have no access the public metadata data ...\" Do you mean \"private\" data?\n- In Algorithm 1, why is noise added (step 9) after averaging the individual gradients? Averaging reduces the variance of the stochastic gradients. If we added noise to individual stoch. gradients, we would perhaps need to add less noise. What am I missing? Also, what is $B,n$?\n\n### Section 6\n- This is perhaps a basic question: are measures of distributional similarity like t-SNE related to more classical distribution distances like TV, KL divergence or Wasserstein distances?\n- Section 6.4: \"proportion of synthetic data that might be “identifiable\" to the real data, where less identifiability indicates stronger privacy.\" I don't understand this: on one hand, we want the synthetic data to be close in terms of distribution to the real data. On the other hand, we want them to be farther in distance? Are these not slightly contradictory objectives? And the choice of Euclidean distance as the objective to measure identifiability also seems arbitrary. Why not distributional distance?\n- Section 6.5: \"However, while the baseline exhibits an exponential rise in TSTR loss, ...\" Where do we see this exponential rise? Is this a precise mathematical statement?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes incorporating public metadata for pirvacy-aware time-series data generation. Self-attention is used encode public data into temporal and feature embeddings. These are fed into diffusion models as conditional inputs and used for data generation.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "see above for questions and comments", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "d6nAb2ztqb", "reviewer": "Reviewer_X6Dd", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- In general I think the topic is interesting and the method seems sound to me.\n- Empirical performance seems quite strong.\n\nWeaknesses:\n- The method requires lots of public data. This has two issues: 1. it is unclear how similar the public data is to the private data. If there are a lot of similarity between the two, it would not be surprised that the utility is good but meanwhile it's hard to argue how much privacy about the private is leaked during public training of the embedder as the two distribution could overlap. 2. Correct me if wrong, training of GAN does not seem to require the public data, which makes the comparison with GAN unfair (as we are using more data here).\n- I'm a bit concerned about the empirical privacy metric of identifiability. Although the authors claim that identifiability is positively correlated with epsilon, it cannot be viewed as a proxy / a predictor / a way of auditing for DP. For example, identifiability=0.25 could mean eps=0.01 for AIM, and eps>>10 for Pub2Priv. Hence, I'm a bit concerned about what the practical usage of the identifiability metric is.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "In this work the authors propose a new way to generate private synthetic data. The proposed method requires using public context data, which is the same size as the private data, as context for conditional diffusion training with the private data. A text embedder needs to be trained using the public dataset to get the context for diffusion. Empirical comparison with other prior methods suggest that the proposed method achieves stronger privacy utility tradeoff. The author further propose an empirical DP metric called identifiability.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Explanation to the weaknesses part, ideally add discussion in the paper.\n- Does the author try different clipping bound for the same epsilon? If not how does the author ensure that the model is pareto optimal in terms of privacy utility tradeoff.\n- Provide a practical use case for identifiability would be helpful.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)