DP-2Stage: Adapting Language Models as Differentially Private Tabular Data Generators
Authors: Tejumade Afonja
Hui-Po Wang
Raouf Kerkouche
Mario Fritz
Venue: Accepted by TMLR ()

Abstract: Generating tabular data under differential privacy (DP) protection ensures theoretical privacy guarantees but poses challenges for training machine learning models, primarily due to the need to capture complex structures under noisy supervision signals. Recently, pre-trained Large Language Models (LLMs) -- even those at the scale of GPT-2 -- have demonstrated great potential in synthesizing tabular data. However, their applications under DP constraints remain largely unexplored. In this work, we address this gap by applying DP techniques to the generation of synthetic tabular data.  Our findings shows that LLMs face difficulties in generating coherent text when fine-tuned with DP, as privacy budgets are inefficiently allocated to non-private elements like table structures. To overcome this, we propose DP-2Stage, a two-stage fine-tuning framework for differentially private tabular data generation. The first stage involves non-private fine-tuning on a pseudo dataset, followed by DP fine-tuning on a private dataset. Our empirical results show that this approach improves performance across various settings and metrics compared to directly fine-tuned LLMs in DP contexts. We release our code and setup at https://github.com/tejuafonja/DP-2Stage.

Published in Transactions on Machine Learning Research (03/2025)
DP-2Stage: Adapting Language Models as Differentially Private Tabular Data Generators
Tejumade Afonja
hejumadee.connjn de
CISPA Helmholtz Center for Information Security
Hui-Po Wang
hui. wai..wang@ccispp.co de
CISPA Helmholtz Center for Information Security
Raouf Kerkouche
mouff
CISPA Helmholtz Center for Information Security
Mario Fritz
fritz@cispa. de
CISPA Heimholtz Center for Information Security
Reviewed on OpenReview: https: opwreevie......... net/ forum? id- www.uul))122222001eeee
Abstract
Generating tabular data under differential privacy (DP) protection ensures theoretical privacy guarantees but poses challenges for training machine learning models, primarily due to the need to capture complex structures under noisy supervision signals. Recently, pre-trained Large Language Models (LLMs) even those al the scale of GPT-2 have demonstrated great potential in synthesizing tabular data. However, their applications under DP constraints remaín largely unexplored. In this work, we address this gap by applying DP techniques the generation of synthetic tabular data. Our findings shows that LLMs face difficulties in generating coherent text when fine-tuned with DP, as privacy budgets inefficiently allocated to non-private elements like table structures. To overcome this, propose DP-2Stage, two-stage fine-tuning framework for differentially private tabular data generation. The first stage involves non-private fine-tuning on a pseudo dataset, followed by DP fine-tuning on a private dataset. Our empirical results show that this approach improves performance across various settings and metrics compared to directly fine-tuned tuned LLMs DP contexts. We release our code and setup https: //gtthub. com/tejuafonjal (aeejjuaaojjjj----aao DStagee
1 Introduction
Tabular data is one of the most prevalent data types, providing structured information in rows and columns, and has been extensively used across various applications. Due to privacy concerns, tabular data cannot be directly shared. A widely adopted approach to address this issue to train synthetic tabular data Different model classes have been proposed,
generators under differential privacy (DP) (Dwork 2006
from marginal-based statistical models (Zhang al. 2017 McKenna al., 2022) to prominent Generative
Adversarial Networks (GANs)-based tabular data generators (Xu et al.) 2019), trained with DP-Stochastic
Gradient Descent (DP-SGD) (Abadi et all 2016). These models aim to replicate the marginal distribution of the original data while preserving the utility of the synthetic data. At the same time, they enforce a strict theoretical upper bound on privacy leakage enabling users to generale realistic data samples without compromising privacy. Despite these advancements, existing techniques continue to grapple with major challenges, such as scalability limitations and difficultics in accuratoly modeling marginal distributions. These difficulties can be traced back to the intricate nature of tabular data and the challenges associated with training under noisy DP conditions.
1

---

Published in Transactions on Machine Learning Research (03/2025)
Recently, pre-trained Large Language Models (LLMs) (Radford et al. 2019 Touvron et al 2023 have
demonstrated remarkable adaptability to tasks they have never been specifically trained for (Wei et al. 2021
Chung et al., 2022 Wang & Fritz 2024 Acting as compact knowledge bases, LLMs present a promising
opportunity for developing practical tabular data generators by leveraging pre-existing knowledge an ability not currently feasible with traditional labular data generators.
Recent work from Borisov al. (2023) showcased how LLMs can effectively be used for synthetic tabular data generation, by representing each cell in the format "<key> is <value>,". While LLMs hold promise generative priors for tabular data, adapting them under DP constraints introduces unique challenges. In DP-SGD, noise is added to the gradients to ensure privacy, which affects all tokens, including key tokens that may not be privacy-sensitive, such as column names or structural markers (e.g., "<key> is ."). This indiscriminate application of noise can disrupt the model's ability to maintain the structural integrity and semantic clarity required for tabular data generation. As a result, both the utility and fidelity of the generated synthotic data are negatively affected, highlighting the need for more targeted noise application techniques minimize such impacts while adhering to DP constraints.
In this work, demonstrate that directly fine-tuning LLMs under DP constraints leads to sub-optimal performance. Our findings, shown in Figure g reveal that LLMs struggle to generate coherent and structured text. when fine-tuned directly with DP. This challenge stems from inefficient, privacy budget allocation to potentially non-private elements, such as the table column name "<key>" or non-functional tokens used to form a valid sentence for the LLM (e.g., "is ".)
To address this limitation, we propose DP-2Stage, two-stage fine-tuning framework for tabular data generation. In the first stage, DP-2Stage fine-tunes the pro-trained LLM non-privately pseudo datasct, allowing the model to learn lask-specific struct ures and patterns without consuming the privacy budget. In the second stage, fine-tuning proceeds on the private dataset with DP constraints (see Figure I for an overview of the approach). By learning the structural patterns in the first stage, the DP-constrained fine-tuning can focus on preserving the privacy of the data values.
For constructing pseudo datasets in the first stage, we investigated two strategies: (1) drawing data independently from uniform distribution using statistics constructed from the private dataset (DP-2Stago-U) and (2) using mut-of-distributii public dataset that is unrelated to the private data O0P-2Stage-O). These approaches offer varying levels of privacy protection, with DP-2Stage-O providing stronger protection as it does not require prior knowledge of the private data.
We evaluated DP-2Stage on three datasets and observed improvements in utility metric (F1-score) by 12- 25%, and marginal distribution metric (Hist) by 1-3% compared to direct DP fine-tuning (DP-Standard) demonstrating better utility and fidelity. Notably, DP-2Stage-U U achieved up to 21x faster inference compared to DP-2Stage-O and DP-Standard. This speedup stems from its higher similarity to private data-both in key structure and value distribution aalowing the second-stage DP fine-tuning to focus less on learning structural patterns. Additionally, we observe that fine-tuning with DP while avoiding column shuffling, as used in Borisov et al. (023), yielded better performance under DP constraints but underperformed in Non-DP scenarios.
We summarize our contributions as follows:
Proposed DP-2Stage, a two-stage fine-tuning framework for LLM-based tabular data generation under DP, which fine-tunes on pseudo datasets manv-aiivtlly learn task-specific structures, enabling more efficient use of the privacy budget during DP fino-tuning.
Achieved 3-7% relative reductions in perplexity, 12-25% improvements in the utility metric (F1-score), and 1 3% relative improvements in the marginal distribution metric (Hist) compared to direct DP fine-tuning (DP-Standard). Each experiment was repeated five times per model, with four synthetic datasets generated per model to ensure robust evaluation.
Despite the effectiveness of our approach, our findings highlight the complexity of fine-tuning LLMs under DP for tabular data generation, emphasizing the need for further research to advance privacy-preeerving
2

---

Published in Transactions on Machine Learning Research (03/2025)
DP-2Slage Private data LLM-based fine-tuning:
Private Tabular Data Generator
Stage 1: Template
Stage 2: Private-Content Learning
Learning
Pre-trained LLM (e.g. GPT2)
Pre-trained LLM
Fine-tuned LLM (Non-DP)
Fine-tuned LLM (DP)
Pseudo Tabular
Non private Optimizer
Private Tabular Dataset
Private Optimizer
Dataset
Figure 1: Overview of DP DP-2Stage. In stage 1, the pre-trained LLM is fine-tuned on the respective pseudo data. Subsequently, stage 2, the model from stage undergoes further fine-tuning using the real private data.
L.M--based tabular data generators. To support future advancements, we release our code and provide a detailed discussion guide further investigation.
2 Related Work
Tabular data generation. As prominent solution for data sharing, a large and growing body of research has been focused on tabular data generation. These methods can be generally categorized into marginal-baser and deep learning-base based methods. Marginal-based methods, such as those developed by Zhang et al. (011
Aviñó et al. (2018: McKenna et al. (2022), view each table column as a distinct random variable and model them using specific distributions. This approach often requires prior understanding or domain expertise
the data, hindering their scalability. Nevertheless, marginal-based methods (e.g. McKenna et al. 2022) have
proven effective in integrating DP guarantees, making them compelling choice for privacy-preservine data generation. On the other hand, deep learning (DL)-based methods such as (Choi et al. 2017 Park al.
2018 Xu et al. 2019: Kotelnikov et al.
2023)
leverage cutting-edge generative models such as Variational
Autoencoders ( (VAEs) (Kingma & Welling 2014). Generative Adversarial Networks (GANs) (Goodfellow et al.,
2014), or diffusion models (Schl-Dicksteinn et al. 2015) to synthesize tabular data. These models can capture
complex patterns and correlations present in tabular data, often producing high-fidelity outputs. However, by default, these prominent DI-bbsod tabular data generators (c.g Xu et al. (2019); Kotclnikov al. (2023) do not adhere to DP standards, which is significant limitation for applications requiring strong privacy guarantees. Recent advances have introduced privacy-pree preseeviige mechanisms, such as Differentially Private Stochastic Gradient Descent (DPSGD) (Abadi et al. 2016), to modify these models for DP compliance (Xie ct al. 2018). Despite this progress, ensuring DP within tabular-based deep learning models poses unique challenges due to the complexity of the preprocessing steps. For example, proposed improvements like mode-specific normalization introduced in (Xu et al. 2019) must also satisfy DP, as preprocessing steps themselves can impact privacy (Ponomareva et al.) 2023). this work, we leverage pro-trained LLMs for tabular data generation, taking advantage of their natural language processing capabilities, and investigate their potential for generating tabular data that compliant with DP standards.
Large Language Models (LLMs). Language models have been extensively studied over the years, evolving from statistical models [Jelinek 1998) and recurrent neural networks (Hochreiter & Schmidhuber 1997) to the latest transformer-basee architectures (Vaswani et al. 2017). These advancements, supported by the attention mechanisms and rich text datasets, have led to the emergence of large-scale language models [Radford et al. 2019 Brown et al. 2020 Touvron et al. 2023 Achiam et al. 2023 new generation
of language models. These models, together with various fine-tuning strategies (Hu el al. 2021 Zhou el al., 2022), have enabled several interesting applications (Borisov et al., 2023 Wang Fritz 2024). Borisov et al. (2023) proposed using pro-trained LLMs for synthesizing tabular data a non-private setting by converting tabular data into text-like formats, significantly improving the performance and paving a new path toward M..M-based tabular generators. In light of the potential, our work apply these advanced models to relatively
3

---

Published in Transactions on Machine Learning Research (03/2025)
unexplored domain: the generation of tabular data under differential privacy constraints. While previous studies (Yu et al. 2021 Li et al. 2022) have explored private fine-tuning of LLM, our focus specifically targets tabular data generation, a unique challenge that diverges from the broader scope of text comprehension. Recently, a concurrent work (Tran & Xiong 2024) shared a similar spirit of employing two-stage training technique to DP fine-tune LLM for tabular data generation. However, this work does not. provide insight into the impact of pscudo data used the first stage and examines a different family of LLM and fine-tuning strategy compared this work. Our focus is on GPT-2, as utilized in the pioneering work by Borisov et al. 2023 to gain deeper insights into how effective design choices in non-differentially private (Non-DP) settings translate to DP contexts. We offer a detailed analysis of pscudo-data choice, the impact of column shuffling on generation of coherent synthetic tabular data, identify the limitations of the two-stage approach, and discuss open challenges.
3 Background
3.1 Language Models for Tabular Data
Language models designed to model the probability of text sequences. Consider text corpus, denoted S = (w: ) comprising N sentences. Each sentence w (41....,4x) .x) within S consists of an ordered sequence of K tokens. These tokens may represent either whole words or parts of words, generated through a tokenization process such as Byte-Pair Encoding (BPE) introduced by SSenniich et al. 2015 The tokenization process can be expressed as (f1,...,ta tx) = tokenizer(w.,) The probability of a given sentence w is formulated
as:
p(w,) = p(t ................................ tk) = II p(talt<a),
(1)
where Le* (f1....,44, 42-1) represents all tokens preceding the k-th token, and p(tx|tee)) denotes the conditional probability of token t given all prior tokens.
In the context of tabular data, data records w = (K,, v) are defined as a collection of key-value pairs, where K = 1 represents the set of keys and V = fem 1/ represents the corresponding set of values. To enable LLMs to process these records, we define the serialization process below, which converts the key-value pairs into a format understandable to models.
Definition 3.1 (Serialization) Let f represent template, which defines the general pattern for orga- nizing tabular data. Using GReaT serialization Borisov et al. 2023), the template is expressed as f = *<key> is <value>,", specifying how keys (k K.), values (u E V), and non-functional tokens (e E C, such as "is" " and ".") combine to form a record. An inpul dataset denoted as S, realized instance of this f, instantiated with tokens (ks, v) from a record = (K, V). For example, with {age} and u = {32), S is instantiated as ok, "age is 32."
Following tokenization, tokens associated with elements in the key or value set are denoted as t, E IC or Ij V, with and j being the position indices, respectively. Note that, due to tokenization, the number of tokens for the keys IC and the values are not necessarily equal.
With definition
3.1 any content can be applied to specified template.
Column Shuffling. Column shuffling involves randomly altering the order of column-aligned values within cach batch during training. For example, given columns age, ser, and income with values 32, female, and >50k. A detailed illustration is provided in Figure 2 This mechanism happens at every iteration and has been shown to effectively prevent the model from relying on spurious dependency in Non-DP settings (Borisov) ct al. 2023). However, complicates DP training due to gradient perturbations, often resulting higher perplexity and different behavior compared Non-DP models, shown in Figure 3 Disabling shuffling fixes the order across iterations simplifying DP training.
4

---

Published in Transactions on Machine Learning Research (03/2025)
age
sex
income
Example lable
32
female
>50k
Iteration 1: age is 32, is female, income is 550k.
Ittration 2: income is >50k, age is 32, sex is female. Iteration 3: sex is female, income is >50k, age 32.
Figure 2: Illustration of column shuffling. The order of entries is permuted in each iteration. This mechanism happens every iteration and has been shown effectively prevent the model from relying on spurious dependency in Non-DP settings (Borisov et al. 2023 However, we find that it complicates DP training due to gradient perturbations, often resulting in higher perplexity compared to Non-DP models, shown in Figure
3.2 Differential Privacy
Differential Privacy (DP) mechanisms enable the confidential disclosure of information about dataset by perturbing function of the input datasct. This ensures that any information capable of distinguishing specific record from the remainder of the datasel is constrained, as outlined by Dwork el al. (2014). In this work, we consider privacy-preservngg tabular data generators to ensure that any information leakage from the generated data is bounded by DP. We review the necessary definitions, the threat model, and the privacy model below.
Definition 3.2 (Differential Privacy (Dwork el al. 2014)) A randomized mechanism M with range R satisfies (E, didifferrrnt privacy, if for any two adjacent datasets and E', ie E' = EU {z} for some a in the data domain (or vice versa), and for any subset of outputs O S R, holds that
Pr[M(E) E O] < e Pr[M(E") E 0
(2)
where is the privacy budget and is the probability of the mechanism failing.
Intuitively, this guarantees that an advensary, provided with the output M, can draw almost the same conclusions (up to with probability larger than 1- 8) about any record no matter if it is included in the input of M or not (Dwork et al. 2014). That is, for any record owner, a privacy breach unlikely due to their participation in the datasel.
Definition 3.3 (Gaussian Mechanism Dwork et al. 2014)) Let f : + Rd an arbitrary function that maps n n-dimensional input to d logits with sensitivity being:
S max E.E
(f(()) f(E')ll
33)
over all adjacent dalasets E and E' E E. The Gaussian Mechanism Ma, parameterized by a, adds noise into the output t.e.,
Mo(x)= = N(0.000
(4)
Threat Model. We outline a threat model where the goal of the adversary is infer information about individuals in the training dataset by launching diverse privacy attacks. One such attack is the Membership Inference Attack (Shokri al. 2017 Hilprecht et al. 2019 Chen et al. 2020), which determines whether specific data point was included in the model's training set. We imagine scenario involving a strong adversary who possesses complete access to the model post-training, known as "whitc-box access". This scenario is considerably more critical than a "black-bos access" selting, where the adversary is limited to interacting with and analyzing the synthetic data produced by the model, without insight into its internal workings. In addition, the adversary computationally unbounded. The impact of the threat model the potential exposure of sensitive individual data from the training set, thereby compromising data privacy and undermining trust in the model.
5

---

Published in Transactions on Machine Learning Research (03/2025)
Total Perplexity
Perplexity
Key Perplexity
Other Perplexity
DP-2Stage-O [x-
8.00
1.10
Without Column Shuffling
3.00
DP-2Stage-U (6- 1)
1.05
7.00
1.08
Perpladty
2.50
Non-DP (c w)
DP-Standard (x- 1)
Perplesity
1.06-
Perp/owty
1.04
1.03
2.00
5.00
1.04
1,02
4.00
1.01
1.50
3.00
1.00
1.00
2500
5000
7500
10000
2500
5000
7500
10000
2500
5000
7500
10000
2500
5000
7500
10000
Steps
Steps
Total Perplexity
Value Perplexity
Key Perplesity
Other Perplexity
3.00
8.00
3.50
With Shuftling
1.15
7.00
3.25
Perplexity
Pureleaity
6.00
3.00
Perplexity
2.10
5.00
2.75
2.00
4.00
2.50
1.05
3.00
2.25
2500
5000
7500
10000
2500
5000
7500
10000
2500
5000
7500
10000
2500
5000
7300
10000
Steps
Steps
Steps
Steps
Figure 3: DP-2Stage (Ours) vs. Standard DP fine-tuning on the Adult dataset with 8 1,6 10-5. DP-2Stage-O refers to the stage 2 model fine-tuned using ont-distribution pseudo data (Airline dataset) in stage 1, while DP-2Stage-U U is the stage model fine-tuned using data sampled independently from Uniform distribution, with statistics derived from the Adult dataset as the beedo-datasee in stage 1. Perplexity results are displayed from left to right for tokens, values, keys, and non-functional tokens (c.f. section 3.1 The top plot shows model trained without column shuffling, and the bottom shows model trained with column shuffling. Total and Value Perplexity for top and bottom plots have fixed y-axis for ease comparison. The perplexity values are higher with column shuffligg (bottom) than without (top).
Privacy Model. To defend against such threat, we aim to develop a solution that protects against potential privacy attacks targeting individuals in our training dataset. To achieve this, we employ DP, which was specifically designed to address this challenge. DP provides the assurance of plausible deniability, meaning that any potential privacy infringement on an individual for example, a patient in the dataset cannot. be conclusively linked to their participation in the model's training phase up to with probability larger than 1- 6. Consider a scenario where an insurance company decides to raise patient's insurance premium after analyzing model trained a medical dataset. In such case, owing to the principles of DP, the increase cannot be directly attributed to the inclusion of that patient's 's data in the training process. We provide further details in Appendix A
4 DP-2Stage
While large language models (LLMs) demonstrate impressive capabilities in generating synthetic tabular data in non-differentially private (Non-DP) settings, as we will later show, fine-tuning them under DP constraints remains challenging for tabular data generation. As illustrated in Figure 3 (bottom), slandard DP training,
where the LLM model is directly fine-tuned using DPSGD (Abadi et al. 2016 (see Appendix A.1 for more details), often results in suboptimal performance terms of the perplexity metric. We hypothesize that this is due to the inefficient allocation of the privacy budget during the learning of data structures. Models employing this approach struggle to reduce the perplexity of keys (e.g., column names) and other non-functional tokens, despite these elements typically posing minimal privacy risks. Consequently, applying DP to such components not only wastes the privacy budget but also diminishes the overall utility of the model.
Motivated by this observation, we propose DP-2Stage, a two-stage learning approach designed to progressively capture tabular data structures. An overview of our method is presented in Figure
In the first stage (section 1.1, we train the model on non-private pseudo data synthesized based on (1) prior knowledge of the private data and (2) publicly available out-of-distributton public dataset, guiding it to learn
6

---

Published in Transactions on Machine Learning Research (03/2025)
the underlying structure. In the second stage (section 1.2 ensuring DP protection. The goal of our two-stage approach is to decouple the process of learning the table's structure from learning the private content.
the model is fine-tuned on the private data while
4.1 Stage 1: Template Learning
The goal of the first stage is to enable the model to learn the structure of the data table, such as identifying key-value relationships, without consuming any privacy budget. We achieve it by constructing a pseudo dataset that retain the structural information while eliminating privacy risks. To achieve this, we investigated two different methods for constructing a pseudo dataset S: (1) Sampled data from a uniform distribution using the private data statistics and (2) -istr--dist public dataset. Each method provides different. levels of reliance on privale data while aiming to preserve privacy and utility.
Independently Sampled data from a Uniform Distribution (uniform pseudo data). This dataset is designed to resemble the private dataset we aim to protect. We assume that column names are public information and can be utilized without any privacy concerns. Additionally, we assume that the data owner can provide the range (maximum and minimum values) for numerical columns and the list of categories for each categorical column. For each column, samples are independently drawn from uniform distribution, where all clements have an equal probability of being selected using the statistics from the private data such as the range of numerical column, and the categories in each categorical column. This assumption is minimal compared to requiring detailed distributional information, which may be unrealistic. However, while this approach minimizes reliance on private data, it still presumes access to basic information, such as category labels and numerical ranges.
Out-of-distribution Public data (out-distribution pseudo data). In contrast to the previous method, this approach eliminates the reliance on private data by using a publicly available dataset. In this work, we refer to distt--oiittiiuutionn as any publicly available dataset that is not the private data. This approach avoids the need infer statistical properties of the original dataset, relying instead on the structure provided by the public data. As we will show, despite not requiring any information from the original dataset, this method performs comparably to uniform pseudo data in many cases and even outperforms it in certain scenarios.
Objective function. In the first stage, the model is trained using standard training protocols on the serialized version of the pseudo dataset. In particular, we fine-tune pre-trained LLM pe, parameterized by 0, using cross-entropy loss for causal language modeling in non non-private setup. We formalize the loss function as follows.
L C= C=
Σ log lote (xx)
(5)
we3
NEW
where S, w, and t represent the pscudo datasct, individual sentences, and the corresponding tokens.
4.2 Stage 2: Private-Content learning
In the second stage, we fine-tune the stage model to learn the private content by applying DP-SGD (Aaai et al.) 2016) the private data = (K,C, V). To encourage the model to prioritize learning value tokens, apply weighted loss that balances the learning between value tokens and non-private tokens (key and non-functional tokens). This approach builds on the insight that the stage 1 model has already effectively learned the non-privale tokens (particularly when using uniform pseudo-data) and acquired the overall structure from the first stage based on the specified template. Since Stage 1 also learns the content (key and value) while learning the template, we assign higher weight À value tokens f in this second stage reinforce the learning of private values as proposed by Tran Xiong (2024). The complete loss function is defined follows:
7

---

Published in Transactions on Machine Learning Research (03/2025)
C = E(vexjes
Σ GEV
logp(ts ((2) - (1-)) x)
Σ CEEKK,C
logp(ti bcii)
(6)
where À controls the emphasis on content learning.
To summarize, the stage 2 fine-tuned LLM model is categorized based on the type of pseudo data used during stage 1. The model fine-tuned with out-distribution pseudo data is labeled as DP-2Stage-O, while the one fine-tuned with uniform pseudo data is labeled as DP-2Stage-U, In stage 1, the pre-trained LLM initially fine-tuned on the selected pseudo data. stage 2, this stage model undergoes additional fino-tuning on the real privale data (refer to Figure 1 for overview).
5 Experiments
In this section, we outline the experimental protocol and evaluate our proposed method against the DP- Standard method, other Non-LLMMbased DP methods, and Non-DP approaches.
5.1 Implementation Details
GPT-2 Fine-tuning. We utilized the GPT-2 (Radford et al. 2019) model from HuggingFacd and integrated Opacus for differential privacy (DP) training, leveraging the Batchhemoryyanaaeee for efficient micro-batching. We fully fine-tuned the model with DP-Adam optimizer using a learning rate of 5e-5 and a linear scheduler, setting the maximum gradient norm C = 1 and a target delta = 10-5, 5, stage of DP-2Stage, the parameter À was consistently set to 0.65 across all experiments. To convert the table-to-texi, we used the GReaT serialization method (Borisov al. 2023 Unlike GReaT, we maintained a fixed column ordering for each sampled dataset for the DP. We structure the dataset so that each row begins with the target column for that dataset. The Non-DP benchmark using GPT-2, the DP-Standard model, and the stage 2 models of DP-2Stage are all trained for 10 epochs, while the stage model of DP-2Stage is trained for 5 epochs.
In the second
GPT-2 Sampling. To sample from the model, we condition on the target column for each dataset. For example, in the Adult datasct, where "income" is the target column, sampling begins with the prompt "income is " and generation continues until all columns have been sampled. We use a rejection sampling approach discard incomplete generations. However, for the ablation results in Table where column shuffling is enabled, rejection sampling proved to be very slow and sometimes failed to complete any generation. In these conutatioo-based approach, as detailed in Appendix B.1
cases, employed
Baseline Models. We compare our approach to Non-LLMMbbssed methods under DP and Non-DP settings. For Non-DP baselines, we considered CTGAN, TVAE (Xu et al. 2019) and VAE (adaptation of TVAE using standardized preprocessing technique for the numerical columns i.e removing the mean and scaling to unit variance) while DP baselines include DP-CTGAN, DP-GAN, and DP-VAF. For CTGAN and TVAE, we used the implementation from the Synthetic Data Vault project while DP-CTGAN and DP-GAN were implemented using the SmartNoise SDK The numerical column preprocessing was conducted with 0.1, while the remaining privacy budget was reserved for private training, For DP-VAE, we adapted the VAE model using SmartNoise preprocessing with c = 0.1.
All experiments were conducted using NVIDIA A A100-SXM4-40GB GPUs. We train the models five times and generated four synthetic datasets per run. The size the synthethic data is the same as the training data.
httpp: https://hugringffcc co/
https://opacus.al.
bttps://github.. henp/sdv-deeee com/sdv-dew/CTGAT
https://github. com/ wwwndp/maattniiieeee..
8

---

Published in Transactions on Machine Learning Research (03/2025)
5.1.1 Datasets
We evaluated three tabular datasets: the Adult Income dataset, which contains over 30,000 samples and 15 altributes used lo predict whether an individual's annual income exceeds $50,000, hosted on the UCI Machine Learning Repository the Airline Passenger Satisfaction dataset, which includes over 100,000 samples and 24 attributes related passenger satisfaction, available on Kaggle and the Texas Hospital Discharge datase large publicly available dataset provided by the Texas Department of State Health Services. We used the 2013 patient dataset that is preprocessed by (Stadler et al. 2022) and available on Githul P Following Afonja et al. (023) we framed the task as a binary classification problem, predicting minor vs. major mortality risk. Unlike the more commonly benchmarked Adult dataset, the Airline and Texas dataset offers a fresh
perspective on the ability of deep learning models to capture complex relationships within diverse tabular data and large sample sizes. Table summarizes the statistics of the tabular data. Class Ratio represents the proportion of larget class categories within each dataset. We provide more details in Appendix D.I
# Train
# Test
#
N
# C
# Total
Class Ratio
Adult Airline
30932
16858
6
9
15
76:24
103904
24976
19
5
24
57:43
Texas
60127
13978
7
11
18
81:19
Table 1: Tabular Datasct statistics. # N and # C are the numbers of numerical and categorical columns, respectively.
Out-of-Distribution Public Data. When training DP-2Stage-O on the Adult dataset, which is treated as the private dataset to be protected, we use the publicly available Airline and Texas datasets as out-of- distribution pseudo data for training the Stage I model. Similarly, for the Airline dataset, we use Adult and Texas, and for Texas, we use Adult and Airline as pseudo data.
5.1.2 Evaluation Metrics
We assess the quality of synthetic tabular datasets using held-out test set and four key metrics inspired by prior work (Xu et al. 2019. Afonja et al. 2023 Tao al. 2021 These metrics are categorized into two groups: Utility and Fidelity.
Utility metrics evaluate how well synthetic data preserves patterns relevant to downstream machine learning tasks. Specifically, we use (i) Machine Learning Efficacy (ML Efficacy), which compares the predictive performance of models trained on synthetic data to those trained on real data.
Fidelity metrics assess the statistical similarity between real and synthetic data. (ii) The Normalized Histogram Intersection (HIST) measures how closely the marginal distributions of synthetic data align with those of real data. (iii) Pairwise Correlation Similarity Accuracy (CorAcc) evaluates how well synthetic data preserves pairwise column correlations from the real dataset. (iv) Pairwise Attribute Distribution Similarity (Pair) computes the similarity of all two-way attribute distributions by averaging histogram intersections, with numerical attributes discretized into bins.
By employing these metrics, we ensure that synthetic datasets not only support effective machine learning tasks but also maintain key statistical properties of the private data.
For ML Efficacy metric, we train logistic regressior and XGB mode reporting the F1-score (F1), area under the receiver operating characteristic curve (AUC), and the accuracy score (ACC), For HIST and Pair, we compute averages using bins of 20 and 50. CorAce is computed using Cramer's V (with bias correction) for
https://archive..tt ica. uci edu/dattasee/22/ahu3
https://wwv.dss
http://sppoct.rrtthheee..

---

Published in Transactions on Machine Learning Research (03/2025)
categorical columns, Correlation Ratio for numerical-categgriicn columns and Pearson Correlation Coefficient (absolute values) for the numerical columns.
Additionally, for language model-based methods, we evaluate the perplexity, specifically focusing on value perplexity (Value Perp), which measures the model's ability to generate accurate next token while masking out the perplexity of the value tokens. More details about the metrics can be found in Appendix C
5.2 Non-DP Benchmarks
Table 2 highlights the elfectiveness of LLMs using GPT-2 in comparison to other benchmark methods. GPT-2, fine-tuned over 10 epochs outperforms other models in terms of utility on the Adult dataset and achieves competitive results for Pair and Hist metric. For the Airline and Texas dataset, the LLM either outperforms the GAN and VAE-based methods or achieves the second best. These results clearly demonstrate the strong performance and capability of L.LMs in this context. The Real data baseline represents the optimal performance achievable, calculated by evaluating the metrics using the real training data and comparing them against the real lest data.
Dataset
Method
F1
AUC
ACC
CorAce
Pair
HIST
Adult
Real data
69.912
91.721
84.021
97.3
97.51o
99.110
CTGAN
59.5+o
88.5+0
80.2+a
74.9=4
85.0+1
91.2+1
TVAE
63.2+2
87.5+1
77.7+4
76.6=2
84.5+1
91.5+1
VAE
53.8210
86.621
80.5
65.3=a
60.212
73.31s
GPT-2
68.92o
90.7=0
83.7
79.9
83.72a
90.7
Airline
Real data
90.6
96.2
91.8*7
97.2
98.4.a
99.4
CTGAN
87.2
94.7=2
88.9
84.4=1
89.3
94.4+1
TVAE
85.845
93.0a6
87.226
78.02a
82.81a
90.3
VAE
79.8
91.1
80.0a1
67.82s
60.421
76.820
GPT-2
89.6+6
95.9 +
91.4+4
86.5+4
85.5+2
90.8+1
Texas
Real data
86.612
98.820
95.0
96.3ge
98.91o
99.510
=
CTGAN
80,8+
96.8+2
92.8+2
72.8+
88.3+3
93.1
TVAE
76.7+7
95.3+a
90.9
61.2=4
63.4+7
93.5+1
VAE
74.313
95.621
90.622
51.527
57.521
89.3
GPT-2
83.9
98.6
93.621
72.8
82.8
94.9:0
Table 2: Non-DP Benchmark. The Real data baseline represents the optimal achievable performance, determined by evaluating metrics using real training data compared to real test data. F1, AUC and ACC are reported as averages of two ML Models (XGBoost and Logistic Regression). Pair, and Hist are reported as averages of two bin sizes (Bins 20 and 50). Each model run five times and four synthetic datasets generated per run with standard deviation reported after =. The best value per column for each e shown in bold while the second best value is underlined.
5.3
DP Benchmarks
Table g presents comparison of DP-2Stage against GAN and VAE-basod methods under strict privacy sctting of 1. Our proposed methods, DP-2Stage-U and DP-2Stage-O, demonstrate competitive performance across all metrics on all datasets. Notably, DP-CTGAN and DP-GAN show greater utility metric improvements the Adult dataset but underperform on fidelity metries (CorAcc, Pair, and Hist). These metrics are crucial for assessing the model's ability to preserve statistical relationships in real data, including marginal distributions and pairwise correlations.
In Appendix F Table 7 we present results for higher privacy budget (e = 8). As the privacy budget increases meaning privacy constraints are relaxed we observe corresponding improvements the utility metrics for 2Stage.
10

---

Published in Transactions on Machine Learning Research (03/2025)
Dataset
Method
F1
AUC
ACC
CorAce
Pair
HIST
Adult 1,
Non-LLM
DP-GAN
33
67.7
64.2
39.913
41.221
63.7as
= 10
DP-CTGAN
42.2
78.027
75.7
51.313
59.222
75.7
DP-VAE 0.0
50.0+0
75.6+0
48.8+1
40.3+1
61.8+2
GPT-2 DP-Slandard
27.8+15
58.5+7
65.2
55.0+1
68.4
85.7+2
DP- DP-2Stage-U
21.2212
48.9as
61.9a13
55.021
76.1
86.7
DP-2Stage-O
+airline
30.4
61.61s
66.71s
55.421
72.3
88.521
+texas
31.6+18
60.5+7
66.4+s
55.6+1
71.3+1
86.9+1
Airline E 1,
Non-LLM
DP-GAN
40.2+24
63.9
59.8
37.4+o
22.2+
44.7=12
== 10-3
DP-CTGAN
67.1=s
76.7*s
68 08.0+6
31.7+a
62.2#2
78.7
DP-VAE 26.5
57.9
57.3
46.6t1
20.6=0
41.8s1
GPT-2 DP-Standard
60.52T
65.31
62.417
64.012
77.0
90.3aa
DP-2Stage-U
68.519
77.8210
72.127
65.311
80.811
90.7
DP-2Stage-O
+adult
55.2+18
62.5+19
60.0+16
66.8+1
80.1+1
92.5+1
Hexas
52.5
61.0
58.4
66.1
78.7
90.4s:
Texas 1,
Non-LLM
DP-GAN
13.7
58.3
78.3as
36.1
34.6an
68.3
8 = 10
DP-CTGAN
63.9+11
91.4+s
82.6+19
43.9
66.9
84.7+s
DP-VAE
0.0=a
50.0+o
82.5+o
62.1+1
43.9+1
77.9+1
GPT-2
DP-Standard
55.4+10
90.2+
77.1+11
70.3+1
60.6+1
92.3+1
DP-2Stage-U
23.5+11
59.8+14
67.3+17
68 2
80.7#6
93.4#
DP-2Stage-O
+adult
74.8
96.7
89.1=a
69.9
60.5
91.7
+airline
74.3=a
96.4+o
88.8
70.9
62.0#a
93.2
Table 3: DP Benchmark. Utility metries (F1, AUC, and ACC) presented as the averages of two ML Models (XGBoost and Logistic Regression). Pair, and Hist are reported as averages two bin sizes (Bins 20 and 50). Results are averaged across five model runs and four synthetic datasets per with standard deviation reported after The best value per column for is shown in bold while second best value underlined.
5.4 DP-2Stage Benchmark
We compare our proposed DP-2Stage methods, which leverage two pseudo-dataset approaches (DP-2Stage-U and DP- DP-2Stage-O) described in Section 4.1 against DP-Standard, which directly fine-tunes the LLM under strict privacy budget (a 1). Our methods consistently improve downstream task utility and fidelity. As shown in Table 3 DP-2Stago-O achieves the highest F1, AUC, and ACC scores on the Adult and Texas datasets but performs slightly worse on the Airline dataset compared to DP-2Stage-U and DP-Standard. We hypothesize that the choice of pseudo data may have influenced this outcome Adult and Texas datasets may not provide sufficient structural information for effective second-stage DP fine-tuning on Airline. Further investigation is needed understand the key properties required in pseudo data optimize performance. Additionally, our approaches achieve the best results across all fidelity metrics iee CorAce, Pair, and Hist.
11

---

Published in Transactions on Machine Learning Research (03/2025)
5.4.1 Impact of Column Shuffling
Next, we evaluate the impact of column shuflling. In Figure g we compare the perplexity of DP and Non-Di DP LLM models on the Adult dataset. The top section illustrates the evolution of perplexity with column shufiling enabled the default setting in prior work by Borisov et al. (2023) while the bottom section shows perplexity without shuffling. The results indicate that the non-shufiling configuration yields the lowest perplexily under DP.
Table presents detailed comparison of these two approaches on the Adult and Airline datasets. The findings suggest that column shuffling gencrally benefits the Non-DP setting, which may explain its widespread use in prior research. However, under DP, models without shuffling lend to achieve better performance, as highlighted by the bold values. This ad advantage may stem from the added complexity that shuffling introduces to DP training, potentially amplifying the effects of gradient perturbation H That said, the Hist metric show better performance with shuffing except for DP- DP-2Stage-O O on Adult dataset.
Additionally, enabling shuffling significantly increases sampling time (approximately 42-51 hours per model run), particularly for DP-Standard and DP-2Stage-O (see Table f in Appendix D As a result, to ensure a fair evaluation when shufflig is enabled, we report results from a single training run for DP-Standard and DP-2Stage-O.
Adult
Airline
Method
Shuffie
Value Perp
AUC
ACC
IIST
Value Perp
AUC
ACC
HIST
GPT--2
Non-DP
2.398
68.94a
90.7-
63.7
a0.7
2.865
89.6-s
95.9
91.4:4
90.8-1
c 00
2.482gmm
69.0gt
90.7."
83.3
90.2g
2.901 gras
76.5gz
91.3ar
84.0g
93.5gx
GPT-2
Stantadd
3.537
24.62m
62.4
63.9 2314
87-4sa
4.276
44.8
73.9
66.9
93.3.1
1,
S.224
31.4
62.1 s
68.41s
85.911
3.790
39.4.c
65.814
61.8.
$8.3.1
6 = 10
DP-2StageU U
2.973..ool
19.7
48.0.s
61.9.15
87.6.1
18.8.11
57.517
55.2..
93.4.1
2.867 Ho.0s
21.2
48.9
61.9-
86.7
3.633 10..
68.5
77.8 1:
72.1
90.7
DP- DStagee Iadult
3.948
59.8::
68, 9..
68.3
92.0s:
3.787
73.2
82.0g²
75.723
91.721
tairline
3,270
22.7
68.0
87.1
3.049
27.8
60.2
65.529
88.4g
Table 4: Comparison of Methods with Shuffle Enabled (V) or Disabled (X). The best result under DP is highlighted in bold, while the nop-performing result for each shuffle setting is underlined. Non-DP methods generally perform comparably across both settings but tend to show better results with shuffle enabled (V). Conversely, DP methods often achieve higher performance when shuffle is disabled (X). Results are averaged across five model runs, each using a different random seed, with four synthetic datasets generated per run. For DP-Standard and DP-2Stage-O, results are based on single model run, averaging across four synthetic datasets, due the high inference time required with shuffle enabled (approximately 12 51 hours per run; see Appendix + Table 3 ensuring fair evaluation.
5.4.2 Impact of Weighted Loss
To assess the impact of loss weighting in the second stage (see Equation 0 we conducted experiments using both the default setting (A 0.33) and the proposed weighting value (A = 0.65). As shown in Table 5
emphasizing value tokens during second-stage DP fine-tuning leads to the best overall performance. This approach also improves DP-Standard, though the gains are more pronounced for DP-2Stage-O.
On the Adult dataset, DP-2Stage-U generally performs better with the default loss, except for the F1 score, whereas on the Airline dataset, it performs worse with the default loss. These results suggest that loss weighting benefits both DP-2Stage-O and DP-Standard, though its effects on DP-2Stage-U remain inconsistent, warranting further investigation.
When column shuffling applied during DP training, adds complexity the learning process. This additional complexity could make it harder for the model learn meaningful patterns, especially under DP constraints, where noise is deliberately added to gradients to ensure privacy. Because DP alrcady introduces randomness into the training process, shuffing may further disrupt the model's ability to learn effectively by increasing variability in the data order. This, in turn, could amplify the impact of the noise added by DP, making training less stable and reducing performance.
12

---

Published in Transactions on Machine Learning Research (03/2025)
Adult
Airline
Method
A
F1
AUC
ACC
HIST
F1
AUC
ACC
HIST
GPT-2
DP-Standard
default 0.65
27.8 17.8+1a
58.5+7
65.2+a
85.7+2
60.5
65.3+>
62.4+7
90.3-s
8
28.9
60.9
66.81a
87.41
59.9
65.719
62.917
91.61
6
0= 10
DP-2Stage-U
default 0.65
20,8+14 21.2=12
49.7+7
63.0+12
87.3+1
65.0+10
74.5+9
69.3+s
91.1+1
48.9aa
61.9218
86.7.1
68.5
77.82100
72.1
90.7=1
DP-2Stago-O
tadult
default 0.65
48 8
55.6.19
92.4=: 60.0116
54.4=1s
55.2
62.51>9
92.511
airline
default
30.3+1a
60.4+1
65.8+9
87.3+1 88.511
0.65
30.4_17
61.61s
66.71s
Table 5: Comparison À Values for Weighting the Stage Loss. Results are averaged over five model with different random seeds, and four syuthetic datasets generaled per run.
5.4.3 Understanding the Ueility-Prrplexity Gap in DP-2Stage-U
In Table we present perplexity values with and without column shufiling alongside utility performance metrics. While uniform pscudo-data (DP-2Stago-U) U) often achieves lower perplexity, this does not always translate to improved downst utility histogram scores. In some cases, the out-distribution pseudo-dala (DP-2Stage-O) approach yields better performance. We hypothesize that this discrepancy observed in DP- 2Stage-U may result from overfitting when pseudo-data closely resembles the private data. In such cases, the model may lack sufficient incentive to learn meaningful correlations in the private data during the second stage. Conversely, when out-distribution pseudo-data is used (DP-2Stage-O), the model is encouraged to learn these correlations while retaining the structural information established during stage This approach may provide better overall performance compared to directly applying DP. Notably, DP-2Stage-U achieves the fastest inference time- up to 21x faster (see Appendix for real-world deployment.
B Table
making particularly advantageous
5.4.4 Marginal-based DP-Baselines
In Appendix F.2 we present results for two marginal-based DP methods: MST McKKnnna et al. 2021 and AIM McCKenna et al. 2022). As shown in Appendix F.2 Table these methods achieve strong performance across most metrics. However, they underperform on certain fidelity metries, such as Pair and Hist, particularly for the Airline dataset likely due to the large number of numerical columns in this dataset.
6 Limitations & Future Work
Stage 1 Training Iterations. In our proposed DP-2Stage approach, we trained the stage 1 model for 5 epoch, as done in concurrent work Tran & Xiong 2024 However, further exploration is needed assess the impact of varying the number of training iterations and identifying an optimal checkpoint during stage one. This could enhance the performance of stage two by providing more refined initialization point. Future research could also investigate (1) alternative strategies for constructing the stage one dataset, and (2) how variations in stage one datasets influence DP fine-tuning performance in stage two.
Serialization Methods. The serialization method employed in this work, based on the approach proposed by Borisov et al. (2023). has not been compared with alternative methods. Exploring different serialization strategies could reveal approaches that are better suited for DP, potentially leading to enhanced performance. Future research could investigate the impact of various serialization methods to identify those that most. effectively address the needs of DP.
DP Hyperparameters Tuning. This work did not involve an extensive exploration of hyperparameters, such batch size, learning rate schedulers, learning rate, or clipping straeggess, which are critical for DP
13

---

Published in Transactions on Machine Learning Research (03/2025)
performance. Conducting systematic analysis of these hyperparameters could yield valuable insights into optimixing LLMs for use as DP tabular data generators. Future research in this direction could help unlock the full potential of LLMs in this domain.
Scaling to Larger Models. Exploring the use of larger models presents promising avenue for enhancing performance. However, this work did not investigate this direction due to the significant computational costs associated with training and inference for models with a high number of parameters. Balancing the trade-off between performance gains and computational feasibility remains a critical challenge. Future research could focus on developing strategies to mitigate these costs, enabling a more practical evaluation of larger models.
Privacy Guarantees (in Stage 1). In Stage 1, assuming that the public dataset used is indeed "public", the privacy guarantees of our method hold exactly, as only Stage exposed to private data and is trained with differential privacy. This is the case for our DP-2Stage-O method.
However, in Stage 1, the proposed DP-2Stage-U method utilizes private data to compute statistics for the uniformly sampled dataset, which weakens the stated privacy guarantees. To ensure that the privacy guarantees from the second stage hold completely, these statistics should instead be computed in a differentially private manner by allocating a small privacy budget. Future work should explore this approach.
7 Conclusion
In this work, we investigated the use of pre-trained LLMs for tabular dala generation under DP protection. Our analysis indicates that naïvely finettniig the model results in sub-optimal performance due to inefficient allocation of privacy budgets. In light of this, we propose DP-2Stage, a two-stage optimization approach that first adapt the model to the format of the task in the first stage and procoeds with fine-tuning the model for the DP task. This two-stage stralegy secures robust privacy protection while ensuring that privacy budgets are spent on the actual sensitive data, leading to improved data utility and efficient data generation. Despite the competitive performance and increased efficiency, further investigation is needed to optimize privacy budget allocation and improve scalability, as discussed in section 0
Broader Impact Statement
This research examines the privacy risks of using pre-trained LLMs, such as GPT-2, for generating tabular data and introduces a differentially private fine-tuning process to address these concerns. While this approach reduces re-identification and data lcakage by incorporating DP into the training process, it also incurs significant environmental costs due to the high computational demands. For example, training a non- disferentially private CTGAN for 300 epochs takes around 10 minutes, whereas fine-tuning GPT-2 for 10 epochs requires approximately 2 hours on the same hardware and dataset, with DP training extending the time further due to per-example gradient computations. This disparity underscores the greater computational expense of LLMs for both training and inference compared to traditional GAN-based tabular data generatons. We hope to inspire dialogue on how to leverage the capabilities of LLMs for tabular generation task in a more sustainable and environmentally conscious manner.
Reproducibility Statement
To ensure reproducibility, we outline several key efforts throughout the paper. The methodology for proposed DP-2Stage framework is detailed in section + and section describes the public datasets and open-source model used in our experiments. Additionally, we have released the source code to enable further experimentation and validation of our findings httpp:///ithh wtwpiittuu.cooooeeee jaaejjufooaaaD-P2200
Acknowledgement
This work supported by ELSA European Lighthouse on Secure and Safe AI funded by the European Union under grant agreement No. 101070617, Bundesministeriuns fur Bikdung und Forschung (PriSyn), grant No. 16KISAO29K, and Medizininforrmtik-PPe Plattfforr "Privatsphärrenchatzeedee Analytik in der Medizin" (PrivateATM), grant No. 017723316G.
14

---

Published in Transactions on Machine Learning Research (03/2025)
Compulation resources used in this work supported by the Helmholtz Association's Initiative and Networking Fund on the HAICORE@FZJ partition and CISPA Helmholtz Center for Information Security computing services. Views and opinions expressed those of the authors only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the European Commission can be held responsible for them. We thank the TMLR, reviewers and action editor for their detailed feedback, which has undoubtedly improved the quality of our work. We also thank Joscha Cúppers for providing valuable feedback on this work.
References
Martin Abadi, Andy Chu, Ian Goodfellow, Brendan McMahan, Tyya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2016.
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Tgee Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint orXXi:2303308777 2023.
Tejumade Afonja, Dinglan Chen, and Mario Fritz. Margcigan: A "marginally" better etgan for the low sample regime. Germon Conference on Pattern Recogrittio (GCPR), 2023.
Laura Aviño, Matleo Rulfini, and Ricard Gavaldà. Generating synthetic but plausible healthcare record datasets. KDD workshop Machine Learning for Medicine and Healtheure, 2018
Borja Balle, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Tetsuya Sato. Hypothesis testing interpretations and renyi differential privacy. In Proceedings of the International Conference on Artificial Intelligence and Statistics (AISTATS), 2020.
Vadim Borisov, Kathrin Sessler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. Language models are realistic tabular data generators. In Proceedings of the International Conference on Learning Representations (ICLR), 2023.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda. Askell, et al. Language models are few-shot learners. Advances in Neural Information Processing Systems (NeurIPS), 2020.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. Gan-leaks: A taxonomy of membership inference attacks against generative models. In Proceedings of the ACM Conference on Computer and Communicaations Security (CCS), 2020.
Edward Choi, Siddharth Biswal, Bradley Malin, Jon Duke, Walter F Stewart, and Jimeng Sun. Generating multi-label discrete patient records using generative adversarial networks. In Machine learning for healtheare conference, 2017.
Hyung Won Chung, Hou, Shayne Longpre, Barret Zoph, Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, et al. Scaling instruction-finetmeed language models. 2022.
Cynthia Dwork. Differential privacy. In International colloquium on automala, languages, and programmiing, 2006.
Cyuthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends6 in Theoretical Compuler Science, 9(3-4):211-1 2014.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Adoances in Neurul Information Processing Systems (NewrIPS). 2014.
Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. Monte carlo and reconstruction membership inference attacks against generative models. Proc. Priv. Enhancing Technol, 2019.
Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural computation, 1997.
Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. In Proceedings of the International Conference on Learning Representations (ICLR), 2021.
Frederick Jelinek. Statistical methods for speech recognation. MIT press, 1998.
15

---

Published in Transactions on Machine Learning Research (03/2025)
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. Proceedings of the International Conference on Learning Representations (ICLR), 2014.
Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. Tabddpm: Modelling tabular data with diffusion models. Proceedings of the International Conference on Machine Learning (ICML), 2023.
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Representations (ICLR), 2022. URL httpss///axxi>
org/abs/2110 959/0009/110000679 05679
Ryan McKenna, Gerome Miklau, and Daniel Sheldon. Winning the nist contest: A scalable and general approach to differentially private synthetic data. Journal of Privacy and Confddnniality, 11(3), 2021.
Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. Aim: an adaptive and iterative mechanism for differentially private synthetic data. Proceedings of the VLDB Endowment, 2022.
Tlya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSP). IEEE, 2017.
Byy Mironov, Kunal Talwar, and Li Zhang. Rényi differential privacy of the sampled gaussian mechanism. ar preprint 190: 10530, 2019.
Noseong Park, Mahmoud Mohammadi, Kshitij Gorde, Sushil Jajodia, Hongkyu Park, and Youngmin Kim. Data synthesis based on generative adversarial networks. Proc. VLDB Endow. 2018.
Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H Brendan McMahan, Sergei Vassílvitskii, Steve Chien, and Abhradeep Guha Thakurta. How dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research, 77:1118-1201, 2023.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 2019.
Rico Sennrich, Barry Haddow, and Alexandra Birch. Neural machine translation rare words with subword units. arXiv preprint 3tl::1588007000 2015.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEFF, 2017.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. Proceedings of the International Conference on Machine Learning (ICML), 2015.
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic data anta-anonymisation groundhog day. In 31st USENIX Security Symposium (USENIX Security 22), pp. 1451-1468, 2022.
Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. Benchmarking differentially private synthetic data generation algorithms. arXiv preprint arXlw:2112.09238, 2021.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Razière, Naman Goyal, Eric Hambro, Faisal Azhar, al. Llama: Open and efficient foundation language models. arXiv preprint ar arXiv:2302.19977 18971, 2023.
Toan V Tran and Li Xiong. Differentially private tabular data synthesis using large language models. ar preprint ar 2rXi::2406.01 2024.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakoh Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems (NeurIPS), 2017.
Hui-Po Wang and Mario Fritz. Language models as zero-shot lossless gradient comppeessors Towards general neural parameter prior models. Advances in Neural Information Processing Systems (NeurIPS), 2024.
Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M Dai, and Quoe V Le. Finetuned language models are zero-shot learners. In Proceedings of the International Conference on Learning Representations (ICLR), 2021.
16

---

Published in Transactions on Machine Learning Research (03/2025)
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generalive adversarial network. arxiv preprind urXiv:1802.0674 06709, 2018.
Lei Xu, Maria Skoularidou, Alfredo Cuesta- Infante, and Kalyan Veeramachaneni. Modeling tabular data using conditional gan. Advonces Neural Information Processing Systems (NewrIPS), 2019.
Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin Inan, Gantam Kamath, Janardhan Kulkarni,
Yin Tat Lee, Andre Manoel, Lukas Wutschitz, et al. Differentially private fine-tuning of language models. In Proceedings of International Conference on Learning Representations (ICLR), 2021.
Jun Zhang, Graham Cormode, Cecilia M Procopiue, Divesh Srivastava, and Xiaokui Xiao. Privbayes: Private data release via bayesian networks. ACM Transactions Database Systems (TODS), 2017.
Yongchao Zhou, Andrei Toan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. Large language models are human-level prompt engineers. In Proceedings of the International Conference on Learning Representations (ICLR), 2022.
17


Reviews:
[{"review_id": "hys3UxjGSE", "reviewer": "Reviewer_hmKd", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "This paper introduces a method for generating private tabular data by fine-tuning large language models (LLMs). It is likely to attract attention within the LLM and Differential Privacy (DP) communities. However, the work has several notable weaknesses that need to be addressed:\n1. The paper introduces two versions of DP-2Stage, but it is unclear which version is the primary proposal. This ambiguity makes it difficult for readers to discern the main contributions and focus of the study.\n2. The Abstract and Introduction require more technical depth. For example, the abstract should elaborate on specific challenges encountered and performance results across various settings. Similarly, the introduction should discuss scalability concerns and other practical aspects of the approach.\n3. The paper posits some intuitive hypotheses but fails to substantiate them with sufficient experimental evidence. For instance, the authors suggest that inefficient allocation of privacy budgets in tabular data structures is the key reason for poor performance. However, this hypothesis is not empirically verified. Extending experiments to more general data generation settings, beyond tabular data, could significantly strengthen the paper's concreteness and contributions.\n4. The authors mentioned that \"this work does not analyze the impact of pseudo-data used in the first stage and only examines a different family of LLMs and fine-tuning strategies\". However, the addition of a new LLM type and fine-tuning method represents only a minor improvement and lacks originality. Furthermore, the proposed technique performs worse than established baselines like DP-CGAN and DP-GAN, as shown in Table 3. While the authors claim improvements in learning cost over these baselines, this argument could have been more compelling if the introduction had framed the study’s goals around optimizing Privacy, Accuracy, and Cost simultaneously.\n5. Critical analyses are missing in some sections. For example:\n- In Figure 3, the reason why the blue line performs better than the non-DP counterpart is not explained.\n- For the HIST metric, the trend differs from other metrics in Tables 2 and 4, but no rationale is provided for this discrepancy.\n6. To improve the reader's understanding, the Introduction section should include the storyline below:\n1) lack of tabular data. - 2) privacy concern when exchanging directly - 3) overcome via privacy-preserving data generator\n7. Minor error corrections:\n- In Figure 3, some subfigures are missing the blue curve.\n- References are missing in the first sentence of the Introduction section.\n- Function f should include the variable c in Definition 1.\n- An explanation is needed for why the curves converge with respect to steps in Figure 3.\n- I recommend the authors to add additional metrics for membership inference attacks, such as the attack success rate.\n- Bullets 1 and 2 of the contributions are incomplete sentences.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a method for tabular data generation using LLM fine-tuning, particularly in combination with differential privacy (DP), and explores its scalability through experiments.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see above.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "acGyUybygl", "reviewer": "Reviewer_6jAQ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength 1: The experiments considered in this paper are thorough, showing significant improvements compared to standard DP training with DPSGD.\n\nStrength 2: DP fine-tuning of LLMs is an exciting and promising research area. This paper makes a valuable contribution by exploring DP tabular generation in this innovative way.\n\nWeakness 1: A key challenge in the problem is that the non-private dataset may not resemble the real dataset. Additionally, in practice, it would be difficult to find a public dataset that has a similar data structure to the private dataset.\n\nWeakness 2: If the public dataset deviates significantly from the private dataset, the advantage over standard DPSGD may be weakened. I think certain experiments should be added to address this aspect.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper develops a two-stage procedure for training differentially private tabular data generators. The general process is training a model based on a non-private pseudo dataset. Then the DP fine-tuning is implemented on a private dataset.  Extensive empirical results are presented for showing the superiority of this framework. Overall, I think this paper is well presented.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "(1) Figure 3 presents various aspects of perplexity. However, this can be confusing for readers unfamiliar with the metric. I suggest that the authors include the formulas for perplexity in the main text for better clarification.\n\n(2) When evaluating the quality of synthetic data, the authors focus on assessing the utility of generative data in downstream learning tasks. Another commonly used approach is to evaluate the fidelity of generative data except statistical divergence metrics. Such as classification method for discriminating real and synthetic data. I suggest that the authors include this type of fidelity evaluation metric in the paper.\n\n(3) When utilizing private statistics from the private dataset for generating a pseudo dataset, the privacy budget for this part is not considered.\n\n(4) The authors should add experiments about the case that the pseudo dataset is significantly different from the private one.", "broader_impact_concerns": "At this stage, we believe that the work presented in this paper does not pose significant ethical or societal concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Rs5bIIvnQH", "reviewer": "Reviewer_XUE8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper is well written and the proposed method is understandable.\n2. The problem tackled is important, as DP tabular generation is understudied\n3. I like this idea/paradigm of first fine-tuning on a pseudo dataset (to help the model learn table structure), then privately fine-tuning on the original dataset. It makes a lot of sense.\n4. The code will be open-sourced.\n5. The experimental evaluations seem comprehensive; the proposed method was compared against many baselines in the evaluations. \n6. The experimental results on the impact of column shuffling for non DP and DP training is interesting and a useful result moving forward with DP training.\n\nWeaknesses:\n1. I’m a bit concerned about the uniform pseudo data method, particularly how the range of the numerical columns are selected. Because if the range is calculated based on the private data, then this would leak privacy. For example, if you know the age column of your dataset is bounded between 0-100, and generate pseudo data is using this bound, then the pseudo data contains private information about the original dataset. Hence, the LLM is non-privately fine-tuned on this uniform pseudo data, which would leak privacy. How did the authors control for this?\n2. The experimental results in section 5.3 are a bit inconclusive to me. The conclusion I drew is that the proposed method using GPT2 outperforms all baselines for the Airlines dataset, but is outperformed by DP-CTGAN on the Adult dataset (33.4 vs 46.5 F1 for $\\epsilon=8$). Furthermore, for no privacy, GPT-2 outperforms CTGAN on Adult (68.9 vs 59.6 F1, respectively). And the proposed method only improves over standard DP by 2 F1 for $\\epsilon=8$. Hence, although the proposed method does provide some improvement over standard DP, the gains feel marginal. And the relatively large gap between the proposed method and non-private baseline highlights the need for even more improvement. Also, it is a bit strange that for either dataset, one of the proposed methods performs worse than DP-Standard. \n3. Since stage 2 places a higher weight on the value tokens, I’m wondering if one could avoid template learning (skip stage 1) by just optimizing/learning only the token values of the serialized text/table. For example, if you have a serialized record “age is 32”, rather than DP fine-tuning on the entire sequence, which standard DP fine-tuning fails at, could one DP optimize on only the token values of the key-value pairs. I.e., calculate the loss only on “32” using “age is “ as the prefix/prior tokens. Then, during tabular generation, you can use the keys and non-functional elements as the prefix for prompts, e.g., “age is”, then have the LLM generate the value, e.g. “32”. We’d have to assume the column names are public, which is already the case in the uniform pseudo data. \n4. The authors briefly remark that DP-2Stage-U achieves the fastest inference time in section 5.4. However, I felt like there wasn’t much discussion/background on the inference aspect of the work (although, I guess, some details are included in the Appendix). Still, it is unclear to me why the DP-2Stage-U framework provides faster inference. \n5. It would be great to have a brief discussion/analysis as to why column shuffling does not work for DP training. The authors mention due to gradient perturbations, but a more detailed analysis would make this point more clear.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper makes the observation that standard DP tabular fine-tuning suffers from unnecessary private learning of non-private tabular elements, such as table structure, which does not need privacy. Hence, it proposes a two-stage fine-tuning framework where the first stage involves fine-tuning a pre-trained LLM on a pseudo dataset, to learn non-private tabular elements such as tabular structure, then privately fine-tune on the private dataset in the second stage. The paper proposes two methods to generate the pseudo dataset, one using a uniform distribution based on statistics from the private dataset, and another using out-of-distribution public data. The paper demonstrates that the proposed method can outperform all baselines for certain cases. Moreover, the paper experimentally demonstrates that column shuffling negatively affects DP tabular training.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. I would like to see a discussion on how the authors handled potential privacy leakage of the uniform pseudo data generation technique in Stage 1 (weakness 1). \n2. Address weakness 5.\n3. Since the authors claim inference latency improvement in the contributions, I recommend adding more discussion about inference/sampling in the main paper, since I feel like that aspect is lacking and should be emphasized more since it is a strong contribution. In particular, if space permits, move some information about GPT-2 sampling in the Appendix to the background section, to better understand how tabular generation works and where the inference latency could come from. Then move the sampling cost table (Table 7) to the experiments section (Section 5) and add a discussion about why DP-2Stage-U demonstrates significantly faster inference over DP-Standard.\n4. Since I couldn’t find a consistent trend for the proposed methods across both datasets (weakness 2)-- for example, DP-2Stage-U performs the worst for F1 compared to DP-2Stage-O and DP-Standard on Adult but performs the best on Airline– it would be great if the authors could include one more dataset to better understand the trends. I understand that it might be computationally expensive to run all baselines, but the inclusion of an additional dataset would be insightful.", "broader_impact_concerns": "The current Borader Impact Statement is sufficiently addressed.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "DqV2RqIlHY", "reviewer": "Reviewer_5EZR", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n\n- Experimentally, the proposed methods improve over the standard DP fine-tuning.\n- The proposed methods improve over other DP synthetic data methods in Normalized Histogram Intersection (Hist).\n\n## Weaknesses\n\n- As I understand, the authors report the classifications metrics at the average of both logistic regression's and XGBoost's scores. As a result, the standard deviations of these scores are quite large and hard to interpret. I think it makes more sense to report the averages and standard deviations of the individual models.\n-  Even though all the GPT-2-based methods achieve high Hist, their classification scores are quite low. Maybe the classification metrics are not quite indicative of the quality of the synthetic data? The authors might want to discuss the discrepancies between the classification metrics and Hist.\n- I do not know how the authors ensure that the fine-tuning in the first step in DP-2Stage-U", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes two methods for synthetic data generation via fine-tuning language models. Differentially private fine-tuning is performed in two steps: (1) fine-tune the LM on uniformly generated or public data, then (2) fine-tune with DP-SGD on private data.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Please include exact definitions of Standard-DP\n- Please include at least one metric to evaluate the quality of synthetic data\n- For the experiment, can the authors comment on whether the Adult and Airline datasets are already parts of the training set of GPT-2, and how this fact might affect the results of the experiments in this paper.\n- From Section 5.3 onwards, it should be emphasized in the tables that $\\delta=10^{-5}$.\n- Probably very minor, but I think $1e^{-5}$ has a very different meaning from `1e-5`; the former is $e^{-5}$ with the mathematical constant $e$, while the latter is $10^{-5}$.\n\nI also would like to make the following request. If the experimental results are convincing, I will recommend the paper for publication.\n- Could the authors also evaluate the data synthetic methods using pairwise metrics, such as \"Pair\" and \"Corr\" in [this paper](https://aaai-ppai22.github.io/files/26.pdf).\n- Could the authors also evaluate previous DP-focused tabular data synthetic methods such as [DPSyn](https://github.com/agl-c/deid2_dpsyn), [PrivMRF](https://github.com/caicre/PrivMRF) and [Private-PGM](https://github.com/ryan112358/private-pgm)?\n\n**Edit**: I believe the extensive experiment by the authors provides sufficient contribution in the field, and it shows that GPT2-based method can be competitive against the current best method. For this reason I recommend for acceptance.", "broader_impact_concerns": "The broader impact provided by the authors is sufficient.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper introduces a two-stage fine-tuning approach for differentially private (DP) tabular data generation using large language models (LLMs). It first fine-tunes on a pseudo dataset to learn tabular structures, then applies DP fine-tuning on private data for privacy protection. This method improves performance over existing DP approaches.


The paper would be of interest to researchers working on (synthetic) tabular data generation. According to the reviewers, the paper is well-structured, and provides empirical results to support its claims. While some concerns existed regarding experimental consistency, the authors have addressed reviewer concerns. Minor improvements, such as refining result interpretations, adding clarifications on privacy guarantees (in Stage 1), and structuring results more clearly, would enhance the paper. Please consider the final minor comments of the reviewers (e.g. clarification/presentation suggestions from reviewer's XUEB).
Decision: Accept (poster)