Differentially Private Latent Diffusion Models
Authors: Michael F Liu
Saiyue Lyu
Margarita Vinaroz
Mijung Park
Venue: Accepted by TMLR ()

Abstract: Diffusion models (DMs) are one of the most widely used generative models for producing high-quality images. However, a flurry of recent papers points out that DMs are least private forms of image generators, by extracting a significant number of near-identical replicas of training images from DMs. Existing privacy-enhancing techniques for DMs, unfortunately, do not provide a good privacy-utility tradeoff. In this paper, we aim to improve the current state of DMs with differential privacy (DP) by adopting the Latent Diffusion Models (LDMs). LDMs are equipped with powerful pre-trained autoencoders that map the high-dimensional pixels into lower-dimensional latent representations, in which DMs are trained, yielding a more efficient and fast training of DMs. Rather than fine-tuning the entire LDMs, we fine-tune only the attention modules of LDMs with DP-SGD, reducing the number of trainable parameters by roughly 90% and achieving a better privacy-accuracy trade-off. Our approach allows us to generate realistic, high-dimensional images (256x256) conditioned on text prompts with DP guarantees, which, to the best of our knowledge, has not been attempted before. Our approach provides a promising direction for training more powerful, yet training-efficient differentially private DMs, producing high-quality DP images. Our code is available at https://anonymous.4open.science/r/DP-LDM-4525.

Published in Transactions on Machine Learning Research (11/2024)
DP-LDMs: Differentially Private Latent Diffusion Models
Michael Liu'
mfliu@cs.ubc.cor ubc.ca
Deportment of Computer Science University of British Columbia
Saiyue Lyu"
saiyuel@cs. ubc.
Deportment of Computer Science University of British Columbia
Margarita Vinaroz*
University of Tübingen
International Max Planck Research Schaol for Intelligent Systems (IMPRS-IS)
Mijung Park!
mejunggp ubc.ca
Department of Computer Science University of British Columbia
Reviewed on OpenReview: https: opwnrevvee.ee net/ formm? id- AkdQ266kHj
Abstract
Diffusion models (DMs) are one of the most widely used generative models for producing high quality images. However, flurry of recent papers points out that DMs are least private forms of image generators, by extracting a significant number of near-identical replicas of training images from DMs. Existing privacy-enhancing techniques for DMs, unfortunately, do not provide good privacy-utility tradeoff. In this paper, we aim to improve the current state of DMs with differential privacy (DP) by adopting the Latent Diffusion Models (LDMs). LDMs are equipped with powerful pre-trained autoencoders that map the high-dimensional pixels into lower-dimensional latent representations, in which DMs are trained, yielding more efficient and fast training of DMs. Rather than fine-tuning the entire LDMs, we fine-lune only the attention modules of LDMs with DP-SGD, reducing the number of trainable parameters by roughly 90% and achieving a better privacy-accuracy tradc-off. Our approach allows us to generate realistic, high-dimensional images (256x256) conditioned on text prompts with DP guarantees. Our approach provides a promising direction for training more powerful, yet laining-efficient differentially private DMs, producing high-quality DP images. Our code is available at https://gitee thtbg com/ wttp:/o.oocc.aa/aaeeeee ParkLabbL/DDPLDA
1 Introduction
A flurry of recent work highlights the tension between increasingly powerful diffussio models and data privacy, e.g,, (Wu et al., 2023; Carlini et al., 2023; Tang et al., 2023; Hu & Pang, 2023; Duan et al., 2023; Matsumoto et al., 2023; Somepalli et al., 2023) among many. These papers commonly conclude that diffusson models are extremely good memorizing training data, leaking more than twice as much training data as GANs (Carlini al., 2023). This raises the question of how diffusion models should be responsibly deployed. Carlini et al. (2023) seek to use differential privacy unsuccessful due to the scalability issues of differential privacy. Our paper provides practical and scalable fine-tuning routine for diffusion models with differential privacy guarantees to avoid generating identical images to those in the private dataset.
remedy for the memorization problem, but their attempt
* "Equal contribution.
This work dome during research visit to the Department of Computer Science the University of British Columbia. Some part of this project was done the Technical University of Denmark.

---

Published in Transactions on Machine Learning Research (11/2024)
To tackle the privacy concerns, Dockhorn et al. (2023) propose to use DP-SGD (Abadi et al., 2016) when training DMs, creating a method called DPDM. However, DP trained DMs yield rather underwhelming performance when evaluated on datasets such as CIFARIO and CelebA. Recently, Ghalebikesabi et al. (2023) proposed a method, which is often referred to as DP-Diffusion, to pro-train a large diffusion-based generator using public data, then fine-tune with private data for a relatively small number of epochs using DP-SGD.
In this paper, our goal is to further improve the performance of up-fine-tuned DMs. To achieve this, we build latent diffussion models (LDMs) (Rombach et al., 2022), which uses pre-trained autoencoder to map the high-dimensional pixels to the so-called latent variables, which enter into the diffusion model. The latent diffusion model defined on the lower-dimensional latent space has significantly lower number of parameters to fine-tune than the diffusion model defined on the pixel space.
Rather than fine-tuning the entire LDM, in our method called differentially private latent diffusion models (DP-LDMs), we choose to fine-tune only the attention modules (and conditioning embedders for conditional generation) in the LDM using DP-SGD. As a result, the number of trainable parameters under our approach is only 10% of that of the diffusion models used in DP-Diffusion (Ghalebikesabi et al., 2023) and achieves a better privacy-accuracy trade-off. Our choice fine-tune the attention modules only is inspired by recent observations that altering attention modules in large language models (LLMs) substantially alters the models' behaviors (Shi et al., 2023; Hu et al., 2021). Therefore, either manipulating or fine-tuning attentoon modules can yield a more targeted generation, e.g., targeted for a user- preeprrfeeeece (Zhang et al., 2023b) and transferring to a target distribution (You & Zhao, 2023). See Sec. 3 for further discussion.
The combination of considering LDMs and fine-tuning attention modules using DP-SGD is simple, yet a solid tool whose potential impact is substantial for the following reasons:
Improved performance: DP-LDMs outperform many state-of-the-art methods in FID (Heusel et al., 2017) and downstream classification accuracy when evaluated on several commonly used image benchmark datasets in DP literature. This is due to unique aspects of our proposed method training DMs in the latent space and fine-tuning only a few selected parameters. This makes our training process considcrably more efficient than training a DM from scratch with DP-SGD in DPDM (Dockhorn et al., 2023), or fine-tuning the entire DM with DP-SGD in DP-Diffusion (Ghalcbikesabi et al., 2023).
Significantly Reduced GPU hours: Reducing the fine-tuning space in DP-LDMs not only improves the performance but also helps democratize DP image generation using DMs, which otherwise have to rely massive computational resources only available to small fraction of the field and would leave a huge carbon footprint. For instance, to generate the CIFAR10 synthetic images using an NVIDIA V100 32GB, a recent work called DP-API by Lin et al. (2023) requires 500 GPU hours and DP-Diffusion requires 1250 GPU hours (See Figure 42 in (Lin et al., 2023)). In our case, when using an NVIDIA RTX A4000 16GB GPU (slower than V100 32GB), fine-tuning took 15 GPU hours, and pre-training took 192 GPU hours. Pre-training is not always necessary; we used a single pre-trained LDM for CelebA32, CIFARIO and Camelyon17.
For-the-frrs--ine DP Text-to-Image Generation: We push the boundory of what DP-SGD fine- funed generative models can achieve, by being the first to produce high-dimensional images (256x256) at reasonable privacy level. We showcase this in text-conditioned and classcoondtionee image generation, where we input a certain text prompt (or class label) and generate corresponding image from a DP-fine-tuned LDM for CelebAHQ. These conditional, high-dimensionall image generation tasks present more complex and more realistic benchmarks compared to the conventional CIFAR10 and MNIST datasets. These latter datasets, though widely used in DP image generation literature for years, are now rather simplistic and outdated. Our work contributes to narrowing down the large gap between the current state of synthetic image generation in non-DP scttings and that in DP settings.
Application of DP-L LDMs:
We apply the low-rank approximation (Hu et al., 2021) to the attention modules in DMs further decrease the number of parameters to fine-tune. Interestingly, the performance from LoRA was slightly worse than that of fine-tuning entire attention modules.
2

---

Published in Transactions on Machine Learning Research (11/2024)
This improvement is due to the large batch size use, which enhances the signal-to-noise ratio and significantly boosts the performance of the fully fine-tuned model. This phenomenon is similar to what Li et al. (2022) observed when fine-tuning LLMs.
In the following section, we provide relevant background information. We then present our method along with related work and experiments on benchmark datasets.
2
Background
We first describe latent diffusion models (LDMs), then the definition of differential privacy (DP) and finally the DP-SGD algorithm, which we will use train the LDMs our method.
2.1 Latent Diffusion Models (LDMs)
Diffusion Models gradually denoise a normally distributed variable through learning the reverse direction of a Markov Chain of length T. Latent diffusion models (LDMs) by Rombach et al. (2022) are modification of denoising diffusion probabilistic models (DDPMs) by Ho et al. (2020) in the following way. First, Rombach et al. (2022) uses powerful auto-encoder, consisting of an encoder denoted by Enc and a decoder denoted by Dec The encoder transforms a high-dimensional pixel representation x into a lower-dimensional latent representation z via z = Enc(x); and the decoder transforms the diverddimesional latent representation back to the original space via x= Dec(z). Rombach et al. (2022) use a combination of perceptual loss and a patch-based adversarial objective, with extra regularization for better-controlled variance the Icarned latent space, to obtain powerful auboencoders (See section 3 in (Rombach et al., 2022) for details). This training loss helps the latent representations to carry equivalent information (e.g., the spatial structure of pixels) as the pixel representations, although the dimensionality of the former is greatly reduced.
Second, equipped with the powerful auto-encoder, Rombach et al. (2022) trains diffusion model (lypically a UNet (Ronneberger et al., 2015)) in the latent space. Training a DM in this space can significantly expedite the training process of diffusion modcls, c.g., from hundreds of GPU days to several GPU hours for similar accuracy.
Third, LDMs also contain attention modules (Vaswani et al., 2017) that take inputs from conditioning embedder, inserted into the layers of the underlying UNet backbone as the way illustrated in Fig. 1 to achieve flexible conditional image generation (e.g., generating images conditioning on text, image layout, class labels, etc.). The modified UNet is then used as a function approximator To to predict an initial noise from the noisy lower-dimensional latent representations at several finite time steps t, where in LDMs, the noisy representations (rather than data) follow the diffusion process defined in Ho al. (2020).
The parameters of the approximator are denoted by 0 |0" @Attn, ,0*), where 0 the parameters of the undcrlying UNet backbone excluding the parameter of attention modules g and 0cn are the parameters of the conditioning embedder (We will explain these further in Sec. 3). These parameters are then optimized by minimizing the prediction error defined by
Liam (0) = (l [||T - (Ze, 4, v)1
(1)
where 7 NN(0,)) I), l uniformly sampled from (1.... , T), x, is the noisy version of the input x at step 4 z, Enc(x;) and y is what the model is conditioning on to generate data, e.g., class labels, or prompt. The function approximator To To(z,, f, y) takes the condition time step t, and latent input z, and then maps to an initial noise estimate. Once the approximator is trained, the drawn samples in latent space, ž, are transformed back to pixel space through the decoder, i.e., x = Dec(z). Our work introduced in Sec. 3 pre-trains both auto-encoder and тo using public data, then fine-tunes only Attn, Ocn, the parameters of the attention modules and the conditioning embedded, for private data, using DP-SGD to be explained next.
2.2 Differential Privacy (DP)
A mechanism M is (c. 8) for a given e 2 and 0 < 8
< 1 and only Pr[M(D) E $) ef -PPr[M(D') e S] + 5 for all possible sets of the mechanism's outputs S and all neighbouring datasets D, D' that differ by
3

---

Published in Transactions on Machine Learning Research (11/2024)
Latent Space
Condition Embedder
Res
Res
Res
D pub
Res
Out
Attn
Attn
Res
Enc(D pub)
Res
Res
Res
Dec(D (pppb))))
Res
D pri
Attn
Attn
Res
Res
Res
Res
Attn
Attn
Alln
Atin
input_ blocks
middle_block block
out blocklocks
Figure 1: A schematic of DP-LDM. In the non-private step, we pre-train the auto-encoder depicted in yellow (Right and Left) with public data. We then forward pass the public data through the encoder (blue arrow on the left) to obtain latent representations. We then train the diffusion model (depicted in the green box) on the lover-dimensional latent representations. The diffusion model consists of the UNet backbone and added attention modules (in Red) with a conditioning embedder (in Red, at top-right corner). In the private step, we forward pass the private data (red arrow on the left) through the encoder to obtain latent representations of the private data. We then fine-tune only the red blocks, which are attention modules and conditioning embedder, with DP-SGD. Once the training is done, we sample the latent representations from the dilfusion model, and pass them through the decoder to obtain the samples in the pixel space.
a single entry. A single entry difference could come from either replacing or including/exclluingg one entry to/from the dataset D.
One of the most well-known and widely used DP mechanisms is the Gaussian mechanism. The Gaussian mechanism adds a calibrated level of noise to a function μ D + IP to ensure that the output of the Here, a is often called privacy
mechanism is (e,8)-DP: (DD) = ((D) + n, where ~ 0(0,0o2 parameter, which is a function of e and 5. Ap is often called the global sensitivity (Dwork et al., 2006; 2014), which is the maximum difference T--normm given two neighbouring and DD' IIx(D) - u(D"))l2- Because we are adding noise, the natural consequence is that the released function (D(D is less accurate than the non-DP counterpart, (DD). This introduces privacy-aceuracy trade-offs.
DP-SGD (Abadi et al., 2016) is an instantiation of the Gaussian mechanism in stochastic gradient descent (SGD) by adding an appropriate amount of Gaussian noise to the gradients in every training step, to ensure the parameters of a neural network are differentially privale. When using DP-SGD, due to the composability property of DP Dwork et al. (2006; 2014), privacy loss accumulating over a typically long course of training. Abadi al. (2016) exploit the subsampled Gaussian mechanism (i.c., applying the Gaussian mechanism on randomly subsampled data) to achieve light privacy bound. The Opacus package (Yousefpour el al., 2021) implements the privacy analysis in DP-SGD, which adopt in our method. One thing to note is that we use the inclusion/een matsssion/xxxussiiie excllsion definition of DP in the experiments as in Opacus.
3 Differentially private latent diffusion models (DP-LDMs)
In our method, which we call differentially private latent diffusion models (DP-LDMss, we carry out two training steps: non-private and private steps.
Non-Private Step: Pre-training an autoencoder and a DM using public data. Following Rombach et al. (2022), we first pre-train an auto-encoder. The encoder scales down an image x E #x X3 to a 3-dimensional latent representation z E Raxuxe by a factor of f, where f H/h W/w. This 3-dimensional latent representation is chosen to take advantage of imago-specific inductive biases that the UNet contains, e.g., 2D convolutional layers. Following Rombach et al. (2022), we also train the autoencoder by minimizing
4

---

Published in Transactions on Machine Learning Research (11/2024)
combination of different losses, such as perceptual loss and adversarial loss, with some form of regularization. See Appendix Sec. A.1 for details. As noted by Rombach et al. (2022), we also observe that a mild form of downsampling performs the best, achieving a good balance between training efficiency and perceptually decent results. See Appendix Sec. A.1 for details on different scaling factors f = 2nh, with a different value of m. Training an aulo-encoder does not incur any privacy loss, as we use public data Dpub considered to be similar to private data Dprie at hand. The trained autoencoder is, therefore, a function of public data: an encoder Enc(Dpus) and decoder Dec(Ppub).
A forward pass through the trained encoder Enc(Dpub) gives us latent representation of each image, which we use to train a diffusion model. As in (Rombach et al., 2022), we consider modified UNet for the function approximator To shown in Fig. 1. We minimize the loss given in eq. 1 to estimate the parameters of To as:
0 Dpuc Dyob' Dauc
arg min Lidm
0
Since we use public data, there is no privacy loss incurred in estimating the parameters, which are a function of public data Dpub.
Private Step: Fine-tuning attention modules conditioning embedder for private data. Given a pre-trained diffusion model, we fine-tune the attention modules and a conditioning embedder using our private data.
For the models with the conditioned generation, the attention modules refer to the spatial transformer blocks shown in Fig, 2(a) which contains cross-attentions and multiple heads. For the models with an unconditional generation, the attention modules refer to the attention blocks shown in Fig. 2(b). Consequently, the parameters of the attention modules, denoted by 0 differ, depending on the conditioned or unconditioned casos. The conditioning embedder only exists in the conditioned case. Depending on the different modalities the model is trained on, the conditioning embedder takes different form. For instance, if the model generates images conditioning on the class labels, the conditioning embedder is simply class embedder, which embeds class labels to a latent dimension. If the model conditions on language prompts, the embedder can be a transformer.
The core part of the spatial transformer block and the attention block is the attention layer, which has the following parameterization. Here, we explain it under the conditioned case:
Attention((:<24)) Q,);; softmax
QK"
E ERdx
(3)
vin
where (z,) E Nx is an intermediate representation of the latent representation z, through the ith residual convolutional block in the backbone UNet, and @(v) E R Mxde is the embedding of what the generation is conditioned on (e-g., class labels, or CL.IP embedding). Furthermore,
K= = (z) ===000 ==b)))W( K V= W=)W)W((T
(4)
where the parameters are denoted by w E Rddedd w( E Rdexd.; and w(Y E Rde Uulike the conditioned case, where the key (K) and value (V) vectors are computed as a projection of the conditioning embodder, the key and value vectors are a projection of the pixel embedding (2,)), only in the case of the unconditioned model. We run DP-SGD to fine-tune these parameters to obtain differentially private 0 Attn prrio
and ohn Dpm..: starting from 0ftm OCn Buus Our algorithm is given in Algorithm 1.
Why fine-tune attention modules only? The output of the attention in eq. 3 assigns high focus to the features that are more important, by zooming into what truly matters in an image depending on a particular context, e.g., relevant to what the image is conditioned on. This can be quite different when we move from one distribution to the other. By fine-tuning the attention modules (together with the conditioning embedder when conditioned casc), we effectively transfer what we learned from the public data distribution to the private data distribution. However, if we fine-tune other parts of the model, e.g., the ResBlocks, the fine-tuning of these blocks can make a large change in the features themselves, degrading the performance. See
5

---

Published in Transactions on Machine Learning Research (11/2024)
Norm
Norm
Conv2d
Hends
Convid
CrossAttn CrossAttn
QKV Attn
FeedForward
Convid
Conv2d
Attention
Trantalrr Block
(a)
(b)
Figure 2: (a) SpatialTrransfrmmr Block; (b) AttentionBlock
Algorithm DP-LDM
Input: Latent representations and conditions conditional: {(z,, v)) M)) a pre-trained model 0, mumber of iterations P, mini-batch size B, clipping norm C, learning rate 7) privacy parameter a corresponding (c, 8)-DP. Denote Agtth gen]
for p to P do
Step 1. Take
mini-batch Bp uniformly at random with sampling probability, q B/N Vo,
Step 2. For each sample i E Bp compute the gradient:
9p (p 366 =V Liám (0p. 24, U1)
Step 3. Clip the gradient:
9p (z,, y/) = 9p(z.. vi)/ max(1, 119 /l2
Step 4. Add noise:
9p = B E (z, M) + _0(0002
Step 5. Gradient descent: 0pt1 0, 119p
end for Return: (c, d)diiffrrettill private Op / 05n)
Sec. 5. The idea of fine-tuning attention blocks is explored elsewhere. In fine-tuning large language models, existing work introduces few new paramcters to transformer attention blocks, and those new parameters are fine-tuned (Yu et al., 2022; Hu et al., 2021) to adapt to new distributions. In the context of pre-trained diffusion models, adding, modifying, and controlling attention layers are gaining popularity for tasks such as image editing and text-to-image generation (Hertz al., 2022; Park al., 2023; Zhang al., 2023a; You & Zhao, 2023).
Which public dataset to use given a private dataset? This is an open question transfer learning literature. Generally, if the two datasets are close to each other in some sense, they are assumed to be a better pair. However, similarity in what sense has to be chosen differently depending on particular data domain and appropriately privatized if private data is used in this step. For instance, if the data is in 2D space, similarity in L2-distance sense might make sense. Our data lies in high dimensional pixel space, where judging similarity in the FID sense is widely used (when comparing two image distributions using each distribution's image samples). Hence, we use FID as a proxy to judge the similarity between two image datascts (Soc Sec. 5.1 how we privatize this step). In other datascts, out of the image domain, there could be a more appropriate metric use than FID, e.g., in the case of discrete data, kernel- based distance metrics with appropriately chosen kernel could be more useful.

---

Published in Transactions on Machine Learning Research (11/2024)
4 Related Work
Initial efforts generating high-dimensional image data with differential privacy have focused on leveraging advanced generative models to achieve better differentially private synthetic data (Hu et al., 2023). Some of them (Xie et al., 2018; Torkzadehmahani et al., 2019; Frigerio et al., 2019; Yoon et al., 2019; Chen et al,, 2020) utilize generative adversarial networks (GANS) (Goodfellow et al., 2014), or trained GANs with the PATE structure (Papernot et al., 2017). Other works have employed variational autoencoders (VAEs) (Acs et al., 2018; Jiang et al., 2022; Pfitzner & Arnrich, 2022), or proposed customized structures (Harder et al., 2021; Vinaroz et al., 2022; Cao et al., 2021; Liew et al., 2022a; Harder et al., 2023). For instance, Harder et al. (2023) pretrained perceptual features using public data and privatized only data-dependent terms using maximum mean discrepancy.
Limited works have so far delved into privatizing diffusion models. Dockhorn et al. (2023) develop a DP score- generative models (Song et al., 2021) using DP-SGD, applied to relatively simple datasets such as MNIST, FashionMNIST and CelebA (downsampled to x2)) Ghalebikesabi et al. (2023) fine-tune the ImageNet pre-trained diffusion model (DDPM) (Ho et al., 2020) with more than 80 M parameters using DP-SGD for CIFAR-10. We instead adopt different model (LDM) and fine-tune only the small part of the DM in our model to achieve better privacy-aceuracy trade-offs. As concurrent work to ours, Lin et al. (2023) propose DP-histogram mechanism to generate synthetic data through the utilization of publicly accessible concurrent work to ours, DP-Promise (Wang et al., 2024) leverages the diffusion model's 's noise during the forward process to improve the privacy-accuracy trade-offs in diffusion model training.
5 Experiments
We demonstrate the performance of our method in comparison with the statc-of-tho-art methods in DP data generation, using several combinations of public/private data of different levels of complexity at varying privacy levels.
Implementation. We implemented DP-LDMs PyTorch Lightning (Paszke et al., 2019) building on the LDM codebase by Rombach et al. (2022) and Opacus (Yousefpour et al., 2021) for DP-SGD training. Several recent papers present. the importance of using large batches in DP-SGD training to improve accuracy at fixed privacy level (Ponomareva et al., 2023; De et al., 2022; Bu et al., 2022). To incorporate this finding in our work, we wrote custom batch splitting code that integrates with Opacus and Pytorch Lightning, allowing us to test arbitrary batch sizes. Our DP-LDM also improves significantly with large batches as will be shown soon, consistent with the findings in recent work. For our experiments incorporating LoRA, we use the loralib (Hu et al., 2021) Python library.
Datasets' and Evaluation. We list all the private and public dataset pairs with corresponding evaluation metrics in Table 1. Regarding high-quality generation, we use CelebAHQ for class conditional generation and
(MM-CelebAHHQ for text-to-image generation. Our choice of evaluation metric is either based on standard practice or following previous work to do a fair comparison. We measure the model performance by computing the Fréchet Inception Distance (FID) (Heusel et al., 2017) between the generated samples and the real data. For downstream task, we consider CNN (LeCun et al., 2015), ResNet-9 (He el al., 2016), and WRN40-4 (Zagoruyko Komodakis, 2017) to evaluate the classification performance of synthetic data. Each number in our tables represents an average value across three independent runs, with standard deviation (unless stated otherwisc). Note that some standard deviation values are reported 0.0 due to rounding. Values for comparison methods are taken from their papers, with exception for the DP-MEPF comparison to CelebAHQ, which we ran their code by loading this data.
5.1 Comparisons to faate-of-the-r methods
We start with testing our method on private and public dataset pairs at varying complexity, which are generally considered to be relatively similar to each other. In particular, we present the results of transferring from
Dataset licenses: MNIST: CC BY-SA 3.0; CelebA: see https://umlab.. ie. cubk, edu. htwpprooeecteeeeeeb....t htm]; CIFAR-10. 10: MIT; Camelyon17: CCO
7

---

Published in Transactions on Machine Learning Research (11/2024)
Similarity Evaluation
Downstream
Private Dataset.
Public Dataset
Classifiers
MNIST
EMNIST(letter) (Cohen et al., 2017)
CNN,,
(LeCun & Cortes, 2010)
WRN40-4
CTFAR-10
ImageNet32
ResNet-9,
FID
(Krizhevsky et al., 2009)
(Deng et al., 2009)
WRN40-4
Camelyon17-WILD
ImageNet32
WRN40-4
(Koh et al., 2021)
(Deng et al., 2009)
CelebA32
ImageNet332
FID
(Liu et al., 2015)
(Deng et al., 2009)
CelebA64
ImageNet64
FID
ResNet-9
(Liu et al., 2015)
(Deng et al., 2009)
CelebAHQ
ImageNet256
FID
(Karras et al., 2018)
(Deng et al., 2009)
MM (Xia et al., 2021)
LAION-400M
FID
(Schuhmann et al., 2021)
Table 1: Private and public dataset pairs, with corresponding evaluation metric and choices of classifiers.
10
5
0.67
DP-LDM(ours)
8.4
0.2
13.4
0.4
22.9
0.5
CIFAR-10
DP-Diffusion
9.8
15.1
25.2
32x32
DP-MEPF (#1,02)
29.1
30.0
54.0
(5 = 10-5)
DP-MEPF (Φ1)
30.3
35.6
56.5
DPDM
97.7
DP-API
7.87
DP-Promise
17.9
18.9
21.8
(P-LDM(ours)
16.2 + 0.2
16.8 0.3
25.8 0.9
CelebA 32x32 (6 10
DP-MEPF (Φ1)
16.3
17.2
17.2
DP-GAN (pre-trained)
58.1
66.9
81.3
DPDM
21.2
71.8
DP Sinkhorn
189.5
DP-Promise
6.0
6.5
9.0
DP-LDM(ours)
14.3 + 0.1
16.1 + 0.2
21.1 + 0.2
CelebA 64x64
DP-MEPF (Φ))
17.4
16.5
20.4
DP-GAN (pre-trained)
57.1
62.3
72.5
= 10-6)
DPDM
78.3
DP-Promise
25.3
26.2
29.1
Table 2: FID scores (lower is better) for synthetic CIFAR-10, CelebA32, and CelebA64 data, comparison with DP-Diffusion (Ghalebikesabi al., 2023), DP-MEPF (Harder et al., 2023), DPDM (Dockhorn al., 2023), DP-GAN (Xie et al., 2018), DP Sinkhorn (Cao et al., 2021), and DP-Promise (Wang et al., 2024)
Imagenet to CIFAR-10 and CelebA distributions and from EMNIST to MNIST distribution. Additionally, test our method's effoctiveness transforring knowledge across large domain gap, we present the results of transferring from Imagenet to 1ieelyon17-WIDDS Further details these experiments available in appendix A.
FID. Comparison to other SOTA methods in terms of FID (the lower the better) is illustrated in Table 2. When lested on CIFAR-10, our DP-LDM outperforms other meth at all epsilon levels (e = 1,5, 10 and = 10-50 5) except for DP-API Our FID values correspond to the case where only 9-16 attention modules are finc-tuned (i.c., finc-tuning only 10% of trainable parameters in the model) and the rest remain fixed. See Table 13 for ablation experiments for fine-tuning different attention modules. When tested on CelebA32, DP-Promise achieved the best FID at all levels by large margin compared to other existing methods. When
8

---

Published in Transactions on Machine Learning Research (11/2024)
tested on CelebA64, unconditional LDM achieves new SOTA results at 10, and are comparable to DP-MEPF at 1. Samples are available in Fig. 11.
c= 10
=
5
==]
(PurD
65.3 + 0.3
59.1 + 0.2
51.3
0.1
CIFAR-10
DP-MEPF (Φ1, (2)
48.9
47.9
28.9
ResNet-9
DP-MEPF (Φ1)
51.0
48.5
29.4
DP-MERF
13.2
13.4
13.8
CIFAR-10
(ous)
78.6 + 0.3
WRN-10-1
DP-Diffusion
75.6
CelebA64
(P-L)
96.4 + 0.0
96.0 + 0.0
94.5 + 0.0
ResNet-9
DP-MEPF (Φ1)
93.9 + 2.1
93.7
82.9
MNIST
(o-LDM(ours)
97.4 + 0.1
96.8
95.9 0.1
CNN
DPDM
98.1
95.2
MNIST
DP-LDM(ours))
97.5 + 0.0
WRN-40-4
DP-Diffusion
98.6
Camelyon117
(P-LDM(ours)
85.4 + 0.0
WILDS
DP-Diffusion
91.1
WRN-4004
DP-API
80.5
Table 3: Classification accuracies (higher is better) evaluated on real test data, when the classifiers are trained with synthetic CIFAR-10, CelebA64, and MNIST datasets. Comparison methods include DP-MEPF (Harder al., 2023), DP-MERF (Harder et al., 2021), DP-Diffusion (Ghalebikesabi et al., 2023), and DPDM (Dockhorn al., 2023). For Camelyon17 dataset, following Ghalebikesabi et al. (2023) and Lin et al. (2023), we set 8 = 3 10-6 Each classifier's architecture is written below each name of data. We choose to use these classifiers by following previous works (Harder et al., 2023; Ghalcbikesabi et al., 2023; Dockhorn et al., 2023).
Downstream Classification. FID can be viewed as a fidelity metric, serving as a proxy for the utility of the synthetic data. To directly present the utility results of the model, we also consider accuracy on the classification task, which listed Table 3. All the classifiers are trained with 50K synthetic samples and then evaluated on real data samples. For each dataset, we follow previous work choose classifier models for fair comparison.
When tested on CIFAR-10, DP-LDM again outperforms others except DP-API. Compared to DP-LDM, the performance of DP-API seems more susceptible to the amount of domain shift from public to private data distributions. When there is small domain gap, e.g., from Imagenet (public data) to CIFARIO (private data), DP-API performs better than DP-LDM. However, when there is a large domain shift between public data (Imagenet) to privale data (Camelyou17)) the accuracies of downstream classifier (WRN-40-4) trained with each synthetic dataset are 85.7 for DP-LDMs and 80.5 for DP-AP1, respectively, at 10. Hence, DP-LDMs seem better suited than DP-API when the domain shift is large fine-tuning small part of diffusion models in DP-LDMs helps incorporate such shift effectively.
For testing on CelebA64, we began with an LDM pre-trained on conditional ImageNet at the same resolution, and then fine-tuned it on CelebA where the (binary) class labels were given by the "Male" attribute. Our method achieves a new SOTA performance at all epsilon levels.
When tested on MNIST, we surpass the previous methods at <= 1 and achieve comparable results c 10. One thing to note is that DPDM takes 1.75M parameters and 192 GPU hours to achieve 98.1 accuracy, and DP-Diffusion takes 4.2M parameters (GPU hours not showing), while our methods takes only 0.8M parameters and 10 GPU hours to achieve 97.4 accuracy, which significantly reduces the parameters and saves much computing resources.
When tested on Camelyon17, our method seems to underperform DP-Diffusion (Ghalebikesabi et al., 2023). However, this could be due to their use of pre-trained WRN-40-4 classifier (pre-trained with ImageNet32). Ghalebikesabi et al. (2023) has not published their code and the pre-trained classifier (using ImageNet32)) that they started fine-tuning with, so could not directly compare the results between ours and theirs.
9

---

Published in Transactions on Machine Learning Research (11/2024)
"This woman has brown hair, and black hair. She is attractive and wears lipstick"
"This man has sideburns, and mustache."
input
10
Figure 3: Text-to-image generation of 256 256 CelebAHQ with prompts at 10. FID: 15.6
Why do we select EMNIST a public dataset? Previous work (Harder et al., 2023) used SVHN as a public dataset to MNIST since they are both number images. However, SVHN and MNIST differ significantly (SVHN contains several digits per image with 3 channels while MNIST contains one digit per image with channel). So we considered other, more similar dalasets such as EMNIST and KMNIST as public dataset candidates. We used FID scores judge the closeness between public and private data, using privatized FID statistics by following the mechanisms used in (Park et al., 2017). Soe Table 11 and Appendix Sec. A.2 which verifies our choice of EMNIST.
5.2 Differentially private high-quality image generation
With the latent representations of the inputs, LDMs can better improve DP training. To the best of our knowledge, we the first to achieve high-dimensional differentially private generation.
Text-to-image generation. For text-to-iman -oittto-mmaee generation, fine-tune the LDM models pretrained with LATON-400M (Schuhmann et al., 2021) for MM-CelebAHQ (256 x 256). Fach image is described by caption, which is fed to the conditioning embedder, BERT (Devlin et al., 2018). We freeze the BERT embedder as well during fine-tuning attention modules to reduce the trainable parameters, then we bring back BERT for sampling. DP-LDM achieves FID scores of 15.6 for = 10. As illustrated Fig. 3, the samples are faithful our input prompts, but not identical the training sample, unlike the memorization behavior of the non-private Stable Diffussin (Carlini et al., 2023).
Class conditional generation. We build our model the LDM model provided by Rombach et al. (2022) which is pretrained on Imagenct at resolution of 256 x 256. Following our experiments in Sec. 5.1, we blocks. While CelebAHQ does not provide class labels, each image is
fine-tune all of the associated with 40 binary attributes. We choose the attribute "Male" to act as a binary class label for each image. Generated samples are available in Fig. along with FID values. Compared to DP-MEPF, based on the FID scores and perceptual image quality, DP-LDM is better suited for generating detailed, plausible samples from the high-resolution dataset at wide range of privacy levels.
10

---

Published in Transactions on Machine Learning Research (11/2024)
DP-LDM (Ours)
DP-MEPF
10
c=1
Figure 4: Synthetic 256 x 256 CelebA samples generated at varying c. Samples for DP-MEPF are generated from code available Harder et al. (2023). We computed FID between our generated samples and the real data and achieve FIDs of 19.0 0.0 10, 20.5 0.1 at 5, and 25.6 + 0.1 at DP-MEPF achieves FID of 41.8 at 10 and 101.5 at 1.
<= 10
c=
Batch
8192
14.3
16.1 + 0.2
21.1 + 0.2
Size
2048
16.2 0.2
17.1 0.2
22.1 + 0.1
512
17.2
18.0
22.3 = 0.2
Fine-tune
Attention Modules
8.4 + 0.2
13.4 + 0.4
22.9 + 0.5
Different
Resblooks
105.5
127.7
149.7
Parts
Out_blocks blocks
45.8
48.3
57.2
Input blocks
54.2
56.9
70.4
Table 4: Top. Effect of increasing batch size on FID (CelebA64). At a fixed epsilon level, larger batches improve FIDs, Bottom. Effect of fine-tunig only the selected part of the model (CIFAR-10), At a fixed epsilon level, fino-tuning attention modules only achieves best results.
5.3
Ablation studies
In this section, present ablation studies for strategically improving performances and reducing parameters.
Increasing batch size. Table 4 (Top) shows results for DP-LDM trained with CelebA64 under different training batch sizes, which provides evidence suggesting that training with larger batch sizes improves the performance of the model.
Fine-tuning attention modules different layers. To further reduce more trainable parameters, we consider fine-tuning only portion of attention modules See Table 13 for CIFAR-10 and Table 12 for
11

---

Published in Transactions on Machine Learning Research (11/2024)
DP-LDM
LoRA (differ in rank)
Rank
64
8
2
= 10
14.3
16.0
17.0
18.5
20.6
22.6
E = 5
16.1
18.2
17.6
19.4
21.3
22.7
21.1
22.3
23.1
21.5
24.3
26.3
# Parameters
8.0M
1.3M
16k
80k
40k
20k
trainable/total
11.03%
1.74%
0.22%
0.11%
0.06%
0.03%
Table FID scores (lower is better) for incorporating LoRA into DP-LDM with different ranks with CelebA64. Each model was trained for 70 epochs.
Camelyon17
CIFAR1O
Classification Acc (WRN-40-4)
methods
FID
methods
FID
DP-LDM (layer=13-1) 13-16)
64.86
85.4
DP-LDM (layer=9-16)
8.4
DP-LDM 1layer=1-16)
69.55
DP-LDM (layer-1-16)
25.8
DP-LoRA (rank=8)
66.41
82.6
DP-LoRA (rank=4)
26.77
Table 6: FID scores and Classification Accuracy of DP-LoRA trained for Camelyon17 and CIFAR10, at = 10. The best DP-LoRA models (the best ranks shown parentheses) still lag the best DP-LDMs (the layer ablations shown parentheses).
See also Appendix Sec. A.3 and Appendix Sec. A.2.3 for details. The best results are achieved when fine-tuning the attention modules in the out blocks in the UNet (out_blocks blocks shown in Fig. 1), consistently throughout all datasets we lested. If a limited privacy budget is given, we suggest fine-tuning the attention modules in the out blocks only to achieve better accuracies.
MNIST.
Finc-tuning a different part of the Unet. Previous results focused on fine-tuning attention modules varying layers. Here, we present the performance of fine-tuning different part of the Unet while the rest of the model is frozen. In Table 4 (Bottom), images. The main takcaway messages are (a) fine-tuning Resblocks hurts the performance, possibly because the learned features during the pre-training stage are altered, and (b) fine-tuning out out_ blocks is more useful than input blocks, while the best strategy is fine-tuning the attention modules in the out blocks.
show the FID scores evaluated synthetic CIFAR10
5.4 DP-LoRA: Applying LoRA to LDM and fine-tuning with attention modules using DP-SGD.
Provious work (Yu et al., 2022) has explored LoRA during training to reduce the fine-tuning parameters. We performed additional experiments by applying LoRA the QKV matrices in all the atlention modules for CelebA64, CIFAR10, and Camelyon17 datasets, In LoRA, each QKV matrix reparameterized W W pretrained rank BA, where W is the dosired result of finctuning, W pretrained is the pretrained weight matrix, A and B are the low rank matrices, and is a scaling hyperparameter. Following Hu et al. (2022), we set to be equal to the first rank we try for each experiment, which in all of our runs is 1. In DP-LORA, A and B are updated during fine-tuning with DP-SGD and Wpretrained is frozen. As shown in Table and Table 6, DP-LoRA was not particularly useful under the LDMs and our current DP-LDM still outperformed. A possible explanation could be the phenomenon previously observed fine-tuning L.MSs (Li et al., 2022): They reasoned that the large batch size improves the signal-to-noise ratio (shown Fig [1] of Li et al. (2022)), which significantly helps improve the performance of the model with full updates, compared to low-rank updates.
For more curious readers, we show the empirical distances between Wnew and W pretrrained for the LoRA models fine-tuned for CelebA64. We compute the & distance between the prerained and finetuned weight matrices for DP-LDM (vanilla), and the F-norm of rank BA for DP-LoRA, in Table Two remarks: First, given that the domain shift between ImageNet and CelebA is relatively large, the adaptation matrices in LoRA, in some cases (e.g., at e 10), completely overwhelm W Wpretrained- We suspect that the larger F. norms in the case of DP-LoRA (relative to DP-LDM) are due to its updates being restricted to be low-rank.
&
12

---

Published in Transactions on Machine Learning Research (11/2024)
Layer mumber
6
9
11
133
14
Paraas
pretrnined
15.85
17.81
27.95
27.82 .2
44.53
45.51
46.
16.01
46.39
46.57
25.68
26.93
30.3
20.51
20.23
18.03
136.47
Enetuned
10
6.36
8.00
13:43
13:44
26.94
26.95
26.95
26.92
26.95
27.02
13.25
13.24
13.73
6.81
0.40
6.00
74.15
DP-LDM
6.52
6.68
13.46
26
26.53
26.90
13.02
13.67
13.30
6.76
6.58
6.33
74.00
6.66
6.73
13.43
13.44
26.92
26.02
26.93
26.88
26.91
26.95
13.48
13.49
13.43
6.65
6.66
6.65
73.99
Inetonee
10
17.08
19.68
53.05
60.60
141.35
145.08
145.71
143.37
141.00
133.56
47.97
41. 41.20
41.25
15.41
14.48
14.40
364.64
DP-LoRA
5
6.49
6.90
13.54
14.10
28. 56
29. 08
28. 42
30.26
29 01
28. 75
15.72
14.90
16.02
7.89
6.95
5.68
79,90
7.14
17.31
16.98
37.50
37.41
38.14
15.32
14.79
15.93
7.31
6.91
Table 7: F-norms of pretrained parameters (QKV matrices) are in the top part of the table; the &g distances between the pretrained and finctuned weight matrices for DP-LDM (Middle); DP-LoRA (Bottom). For each layer, the F-norm of rank BA is computed, and for the final columm, the rank BA matrices are first concatenated across all layers, then the norms are computed. Following the original code of LoRA, we set
a
a=
finetuned99-15 15)
finetuned(-115 15))
pretrained
40
90
layer=15
4W, (9-15)
20
10-
1.0
AMG
8W) (9-25)
0.0
0.2
0L0
0.2
-0.7
0.0
0.8
AW, (0-25)
AMV, (9:
40
20-
8WA, (0-15)
0.6
20-
0.-
0.2
0.0
0.2
-0.2
0.0
0.2
-0.2
0.0
0.2
0.2
40-
40-
20
0.0
0
20
40
60
80
100
120
-0.2
0.0
0.2
-0.2
0.0
0.2
0
-0.2
0.0
0.2
singular values
(a) Histogram of W,,WL,W, each model.
(b) Singular values of AW, AWL, AW. each model.
Figure 5: The Q.K,V V matrices in cross-attention modules in two fine-tuned models for CIFARIO at e 10. Fine-tuned indicates attention modules of all layers are fine-tuned, while Fine-tumed99-13 indicates only the ion modules at layers 9-15 are fine-tuned. (a) Each row corresponds to W₂ Wa (middle), and W, (bottom). (b) Pink represents AW,, g, blue AW2, and green AW, respectively. Solid lines represent the model(9-15) and dotted lines represent the (0-15.
While DP-LDM may find configuration of parameter values that achieve low loss (and good performance) relatively closer to the initial parameters, DP-LoRA may need to search further in parameter space for a set of parameter values that achieves similar performance. Second, the fact that DP-LoRA gets the best FID score at rank 64 at e = 10 (the smallest amount of noise we tried out) while it does at rank 4 at e = 1 and rank 8 at = 5, the optimal adaptation matrix in the UNet might not be necessarily rank-deficient as in the transformer case. Next, visualize the fine-tuned attention modules in an attempl to gain insights into our fine-tuned models.
5.5 Visualization of fine-tuned attention modules
We first show the histogram of Wg. Wk, We matrices in cross-attention modules before and after fino-tuming for CIFARIO in (a) of Fig. 5. Because we fine-tune only the atlention modules while the intermediate representations are fixed, the distributions over Wg, Wa, W. matrices after fine-tuning (first and second columns) are significantly different from those before finc-tuning (third column). When fine-tuning smaller number of layers (9-15), larger changes have to be made per layer (indicated by the large spread in the histogram for WG, WR, W, matrices) to compensate for the distributional shift from D Drus to Dpriv, compared to funettunig all layers (0-15).
We then computed the singular values of AW,- W. finetundd W prettaiiie (AWR. AW, are defined with respect to k, v matrices). As shown in (b) of Fig. 5, AW for K,V matrices are correlated possibly because
13

---

Published in Transactions on Machine Learning Research (11/2024)
layer=5
layer=13
AW4 (CIF10)
14-
AWA (CIF10)
2W9, (CAM17)
CWA, (C/M177
J09, (CIF10)
JW, (CIF10)
4W% (CAM17)
(WA, (CAM17)
1.-
DPV, (0))
BWY, (CF
1.0
AW, (CAM17)
SW, (CAM17)
0.8
0.8
0.6
0.4
0.4
0.2
0.2
0.0
3.0
250
singular values
singular values
(4) Singular values of AW,, AW.. AW. at layer 5
(b) Singular values of AW,, AWs, AW, at layer 13
Figure 6: Singular values of AWg. AWR, AW, in cross-attention modules in the conditional LDMs fine-tuned for CIFAR10 (CIF10) and that for Camelyon17 (CAM17), at e = 10 with = 10-5 for CIFAR10 and = 3- 10 for Camelyon17. Dotted lines represent CAM17, while solid lines represent CIF10. Purple and green solid lines are overlapping in both plots.
layer=0
layer=15
0.7
JWG
AWV
JWG 10
0.5
AWV
AwV, m1
AWA at - 10
AWl at 10
0.-
AW, 6
Aw, x-
10
c-
0.4
0.4
0.1
0.3
0.2
0
20
60
80
100
120
0
20
40
80
150
100
120
singular values
singular values
(a) Layer O
(b) Layer
Figure 7: Singular values of AW,, AW,, AW, in self-attention modules at varying layers of an unconditional LDM, fine-tuned for CelebA64, = 10 and e 1. Dotted lines represent. the model fine-tuned at 10, and solid lines that at 1.
the role of We and W. is to pick which class embeddings are more useful (both are multiplied by the class embedding as in eq. 4), their fine-tuned values remain similar. The singular values fall off fast in the case of AWg, while those of AW2 and AW, fall off slowly and even the smallest singular values are far from zero. Similarly, Fig. 6, the singular values of fine-tuned model for Camelyon17 seem to decay faster than those for CIFAR10. However, the smallest singular values the later layer are again far from zero. This might imply low rank approximation to these matrices can cause losing information. This observation is consistent. with the performance of DP-LoRA lagging that of DP-LDM shown in Table 5 and Table 6.
Fig. 7 shows the singular values of AW,, AW. AW, in the unconditional LDM finc-tuned for CclebA64. There is only a slight difference between the singular values of the model fine-tuned al e = 1 and the model fine-tuned at = 10. This could be explained by using a fixed random seed during training. As the random soed determines the order of training batches as well as the direction of the random noise injected by DP-SGD, each model converges to similar areas of the parameter space. Thus, differences in the fine-tuned weight matrices arise from the different magnitudes of noise added. On the other hand, this is longer the case,
14

---

Published in Transactions on Machine Learning Research (11/2024)
when the target datasets change like in Fig. 6, or when the ablation setting (which layers to be fine-tuned) changes like in Fig. 5, even if we set the seed number to be the same across different settings.
6 Conclusion
In Differentially Privale Lalent Diffussion Models (DP-LDM), we utilize DP-SGD to fine-tune only the attention modules (and embedders for conditioned generation) the pretrained LDM at varying layers with privacy-sensitiee data. We demonstrate that our method is capable of generating quality images various scenarios. We perform an in-depth analysis of the ablation of DP-LDM to explore the strategy for reducing parameters for more applicable training of DP-SGD. Based our promising results, we conclude that fine-tuning LDMs is efficient and effective framework for DP generative learning, We hope results can contribute to future research in DP data generation, considering the rapid advances in diffusion-based generative modelling.
Broader Impact Statement
As investigated in Carlini et al. (2023), diffusion models can memorize individual images from the training data set and generate an identical synthetic image to the training image. Aiming impact society positively, we provide a method fine-tune latent diffusion models with differential privacy guarantees that the fine-tuned models do not generate identical images to those in the private data.
Our method relies public data for better scalability of differential privacy, which needs some attention. As Tramèr et al. (2022) pointed out, public data themselves may still contain sensitive information. From our perspective and as many other DP generative modelling papers also noticed, auxiliary public data still emerges as the most promising option for attaining satisfactory utility, for the models at this large scale. We hope for better-curated public datasets be available in the near future.
During the review process, one of the reviewers mentioned that generative tools are becoming more and more realistic and of general availability, with the risk of generating harmful content, especially when generating human-related content. Broadly speaking, our method does not stop malicious users from creating harmful content, as the diffusion model will generate images based on any input prompt given by the malicious user. However, what our method can do is protect the privacy of the individuals whose data was in the private dataset, meaning the faces in the private dataset will not appear when generating images from the DP fine-tuned models.
To encourage reproducible rescarch practices, code is available DP-LDM with detailed instructions. And all the hyperparameters are discussed in detail in Appendix Sec. B.
//gh:::///thbb// com/ParLLaMML/
Limitations
While the paper proposes technique to counter-attack the privacy risks of diffusion models, the evaluation has not been done against existing privacy attacks. So we know that the diffusion model is private "under the definition of DP", but we caution practitioners against making an assumption that DP image generative model protects private data against all possible attack methods.
This may not be direct limitation of our work itself, but it is restrictive that there is agreement within the community on which definition of privacy should be used to assess the privacy of generated images. Carlini et al. (2023) provided single example of exploitation, but it remains unclcar what aspects we aim to protect in generaled data. Unfortunately, the privacy parameters and in our method are especially difficult to interpret in the image domain. While private images may be protected, it unclear whether perceptually similar images enjoy the same level of privacy. Further work required to suggest more appropriate definitions of privacy for practitioners employ to avoid providing vague sense of privacy in the image generation domain.
15

---

Published in Transactions on Machine Learning Research (11/2024)
Acknowledgments
We thank our anonymous reviewers for their constructive feedback, which has helped significantly improve our manuscript. We thank the Digital Research Alliance Canada (Compule Canada) for computational resources and services. M. Liu was funded by the Canada Graduate Scholarships Master's program of the Natural Sciences and Engineering Rescarch Council of Canada (NSERC). S. Lyu, M. Vinaroz, and M. Park were supported in part by the Natural Sciences and Engineering Research Council of Canada (NSERC) and the Canada CIFAR AI Chairs program. M. Park was also partially funded by Novo Nordisk Fonden RECUIT grant no.0065800 during her stay at the Technical University of Denmark.
References
Martin Abadi, Andy Chu, lan J. Goodfellow, Н. Brendan McMahan, 1lya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, COS '16 pp. 308 318, New York, NY, USA, 2016. Association for Computing Machinory. ISBN 9781450341394. doi: 01145/977749.2998883
Gergely Acs, Luca Melis, Claude Castelluccia, and Emiliano De Cristofaro. Differentially private mixture of genorative neural networks. IEEE Transactions on Knowledge and Data Engineering, (166:11199-112) 2018.
Alex Bie, Gautam Kamath, and Guojun Zhang. Private GANs, revisited. In NewrIPS 2022 Workshop on Synthelic Dala for Empowering ML Research, 2022.
Zhiqi Bu, Jialin Mao, and Shiyun Xu. Scalable and efficient training of large convolutional neural networks with differential privacy, 2022.
Tiansii Cao, Alex Bie, Arash Vahdat, Sanja Fidler, and Karsten Kreis. Don't generate me: Training differentially private generative models with sinkhorn divergence. In Neural Information Processing Systems (NeurIPS), 2021.
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramér, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC '23, USA, 2023. USENIX Association. ISBN 978-1-9331333-7--3
Dingfan Chen, Tribhuvanesh Orekondy, and Mario Fritz. Gs-wgan: A gradient-sanitizee approach for learning differentially private generators. In Advonces in Neural Information Processing Systems 33, 2020.
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (IJCNN), pp. 2921-2926. IEEE, 2017.
Soham De, Leonard Berrada, Jamic Hayes, Samuel L. Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale, 2022.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248 255. Leee, 2009.
Jacob Devlin, Ming-Was Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.0440 04805, 2018.
Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models, 2023. URL attps://openrreier nett//oorrmmiidddxepppe.a....
Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu. Are diffusion models vulnerable membership inference attacks? In Proceedings of the 40th International Conference on Machine Learning, TCMT,23. JML.R.rrg 2023.
16

---

Published in Transactions on Machine Learning Research (11/2024)
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Advances in Cryplology EUROCRYPT 2006, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, volume 4004 of Lecture Notes in Computer Science, pp. 503. Springer, 2006. doi: 10.1007/117616799 29.
Cynthia Dwork, Aaron Roth, et al. The algorithinic foundations of differential privacy. Foundations and Trends@ in Theoretical Computer Science, 9(3 4):211 1071 2014.
Lorenzo Frigerio, Anderson Santana de Oliveira, Laurent Gomez, and Patrick Duverger. Differentially private generative adversarial networks for time scries, continuous, and discrete open data. In ICT Systems Security and Privacy Protection 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings, pp. 151-164, 2019. doi: 10. 101007/976-3-000-22233
11.
Sahra Ghalebikesabi, Leonard Berrada, Sven Gowal, Tra Ktena, Robert Stanforth, Jamie Hayes, Soham De, Samuel L. Smith, Olivia Wiles, and Borja Balle. Differentially private diffusion models generate useful syuthetic images, 2023.
I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio. Generative adversarial networks. In Advances in Neural Information Processing Systems, 2014.
Frederik Harder, Kamil Adamczewski, and Mijung Park. DP-MERF: Differentially private mean embeddings with random features for practical pivacy-preserving data generation. In AISTATS, volume 130 of Proceedings of Machine Learning Research, pp. 1819-1827. PMLR, 2021.
Frederik Harder, Milad Jalali, Danica J. Sutherland, and Mijung Park. Pre-trained perceptual features improve differentially private image generation. Transactions Machine Leorning Research, 2023. ISSN 2835-8856. URL /ttps://openrewee
net/forumiid-Reee
Kaiming Hc, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on compuler vision and paltern recognilion, pp. 770 778, 2016.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or Or. Prompt-to- prompt image editing with cross attention control, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two timo-scale update rule converge to local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 6840 6851. Curran Associates, Inc., 2020. URL /4t.c/tteeeaa100071110000000aaa0 cc/paper_fill files/ /ttp//aapee////0/ http:////aa...//.e////////eeeee.
stw.oeeeeiinnnnnuniiss.... neurips. .df.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Represenlations, 2022. URL https: https:// http:::////ppeeeiiere/e http:///wvviii.eeeeeorr/rr////// net/foruuniiddzZeWeeet
Hailong Hu and Jun Pang. Membership inference of diffusion models, 2023.
Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. Sok: Privacy-preserving data synthesis. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 2. IEEE Computer Society, 2023.
Dihong Jiang. Guojun Zhang, Mahdi Karami, Xi Chen, Yunfeng Shao, and Yaoliang Yu. Dp2-vae: Differentially private pre-trained variational autoencoders. arXiv preprint ar arii:22008. 03409, 2022.
17

---

Published in Transactions on Machine Learning Research (11/2024)
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. In International Conference on Learning Represenlations, 2018. URL
btttp:://peenreview.eeee
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, Tony Lee, Etienne David, Ian Stavness, Wei Guo, Berton A. Earnshaw, Imran S. Haque, Sara Beery, Jure Leskovec, Anshul Kundaje, Emma Pierson, Sergey Levine, Chelsea Finn, and Percy Liang. Wilds: A benchmark of in-the-wild distribution shifts, 2021.
Alex Krizhevsky, GeolTrey Hinton, et al. Learning multiple layers of features from liny images. Technical report, University of Toronto, Toronto, ON, Canada, 2009.
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. http://soom.eccm..oom//x////m//p 2010. URL httt:://yann.... www.lleccccccoom cwwm exdb/mnis///.
Yann LeCun, Yoshua Bengio, and Gooffrey Hinton. Deep learning. nature, (7553)) 2015.
Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In International Conference on Learning Representations, 2022.
Seng Pei Liew, Tsubasa Takahashi, and Michihiko Ueno. PEART: Data synthesis via private embeddings and adversarial reconstruction learning. In International Conference on Learning Representations, 2022a.
Seng Pei Liew, Tsubasa Takahashi, and Michíhiko Ueno. PEARL: Data syuthesis via private emboddings and
adversarial reconstruction learning. In International Conference on Learning Representations, 2022b.
Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, Harsha Nori, and Sergey Yekhanin. Differentially private synthetic data via foundation model apis 1: Images, 2023.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
Tomoya Matsumoto, Takayuki Miura, and Naoto Yanai. Membership inference allacks against diffusion models. In 2023 IEEE Security and Privacy Workshops (SPW), pp. 77-83, 2023. doi: 10. 55300//PW55333.222
Nicolas Papernot, Martín Abadi, Úlfar Frlingsson, Tan J. Goodfellow, and Kunal Talwar. Semi-supervised knowledge transfer for deep learning from private training data. In Proceedings of the International Conference on Learning Represenlations (ICLR), 2017.
Dong Huk Park, Grace Luo, Clayton Toste, Samaneh Azadi, Xihui Liu, Maka Karalashvili, Anna Rohrbach, and Trevor Darrell. Shape-guided diffusion with inside-outside attention, 2023.
Mijung Park, James Foulds, Kamalika Choudhary, and Max Welling, Dp-em: Differentially private expectation maximization. In Artificial Intelligence and Statistics, pp. 896-904. PMLR, 2017.
Adam Paszke, Sam Gross, Francisco Massa, Adamn Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, perforaeform deep learning library. Advances in neural information processing systems, 32, 2019.
Bjarne Pfitzner and Bert Arnrich. Dpd-fvae: Syuthetic data generation using federated variational autoen- coders with differentially-privall decoder. arXiv preprint arXiv:2211.11591 2022.
Natalia Ponomareva, Sergei Vassilvitskii, Zheng Xu, Brendan McMahan, Alexey Kurakin, and Chiyaun Zhang. How to dp-fy ml: A practical tutorial to machine learning with differential privacy. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 223, pp. 5823-5824, New York, NY, USA, 2023. Association for Computing Machinery. ISBN 9798400701030. doi: 10. 101111//580305355600 URL https: / //wii. oto/iioor/1... 1145/35883055355555555
18

---

Published in Transactions on Machine Learning Research (11/2024)
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. Tn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10684 10695, June 2022.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-A Assisted Intervention -ICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part 111 18, pp. 234-241. Springer, 2015.
Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarezyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs. arXiv preprint orXiv:2111.021 2021.
Baifeng Shi, Siyu Gai, Trevor Darrell, and Xin Wang. Toast: Transfer learning via attention steering, 2023.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pollern Recognition (CVPR), pp. 6048 6058, June 2023.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. International Conference on Learning Representations, 2021.
Shuai Tang, Zhiwei Steven Wu, Sergul Aydore, Michael Kearns, and Aaron Roth. Membership inference attacks on diffusion models via quantile regression, 2023.
Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. Dp-ogan: Differentially private synthelic data and label generation. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2019.
Florian Tramer, Gautam Kamath, and Nicholas Carlini. Considerations for differentially private learning with large-scale public pretraining. arXio preprint arXiw:2212.064 70, 2022.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
Margarita Vinaroz, Mohammad-Amin Charusaic, Frederik Harder, Kamil Adamczewski, and Mi Jung Park. Hermite polynomial features for private data generation. In ICML, volume 162 of Proceedings of Machine Learning Research, pp. 22300 22324. PMLR, 2022.
Haichen Wang, Shuchao Pang, Lu Zhigang, Yihang Rao, Yongbin Zhou, and Xue Minhui. dp-promisc: Differentially private diffusion probabilistic models for image synthesis. In 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, August 2024. USENIX Association. URL https: //tp:////wwwwwee usenix. org/ heg/conferencel wuwnnnceeuueniieeeeee /ttpa//attt////pesttttttttoooott
hai chen.
Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang. Membership inference attacks against text-to-image generation models, 2023. URL https: http://rww......ooooooeeeaaaaaaa
Weihao Xia, Yujiu Yang, Hao Xue, and Baoyuan Wu. Tedigan: Text-guided diverse face image generation and manipulation. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 2256-2265, 2021.
Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Diffcrentially private generative adversarial network. arXiv preprint ar:iv: 1022. 102,0099,, 2018.
Jinsung Yoon, James Jordon, and Mihacla van der Schaar. PATE- GAN:: Generating synthetic data with differential privacy guarantees. In International Conference on Learning Representations, 2019.
19

---

Published in Transactions on Machine Learning Research (11/2024)
Fuming You and Zhou Zhao. Transferring pretrained diffusion probabilistic models, 2023. URL https: wew.://orunnddd-uueeeettutte
Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao; Graham Cormode, and Nla Mironov. Opacus: User-friendly differential privacy library in PyTorch. arXiv preprint arXiv:2109. 120.0.222.... 2021.
Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models. In International Conference Learning Represenlations, 2022. URL
https://openreview htt.:pppnrrrvieee.eeettttrrrrrra (
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks, 2017.
Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models, 2023a.
Qingru Zhang, Chandan Singh, Liyuan Liu, Xiaodong Liu, Bin Yu, Jianfeng Gao, and Tuo Zhao. Tell your model where to attend: Post-hoc attention steering for Imss, 2023b.
20

---

Published in Transactions on Machine Learning Research (11/2024)
Appendix
A Additional Experiments
A.1 Scaling factor effect in pre-training the autoencoder
In Table 8, we provide FID results after pre-training the autoencoder with Imagenet dataset for different. scaling factors f and number of channels.
# channels
128
64
32
f = 2
27.6
36.4
46.8
= 32.9
51.0
83.5
Table 8: FID scores (lower is better) for pre-trained autoencoders with different, and number of channels.
A.2 Transferring from EMNIST to MNIST distribution
Here are the details when we compare DP-LDM to existing methods with the most common DP settings 1, 10 and 8 10-5 in Table 9.
DP-LDM (Ours)
DP-DM
DP-Diffusion
DP-HP
PEARL
DPGAN=
CNN
97.4+ 0.1
98.1
788
95.0
WRN
97.5+ 0.0
98.6
CNN
95.9 0.1
95.2
81.5
78.2
80.1
# params
0.8M
1.75M
4.2M
GPU Hours
10h
192h
Table 9: Downstream accuracics by CNN, MLP and WRN-40-4, evaluated the generated MNIST data samples. We compare our results with existing work DPDM (Dockhorn et al., 2023), DP-Diffusion (Ghalebikesabi et al., 2023), PEARL (Liew et al., 2022b), DPGANr (Bie et al., 2022), and DP-HP (Vinaroz et al., 2022). The GPU hours is for DP training only. The GPU hours for pretraining steps of our method are present in Table 17 and Table 18.
A.2.1 Choosing public dataset with DP constraint
FID scores are commonly used for measuring the similarity of two dataset. Tt first uses a pre-trained neural network (such as InceptionV3) to extract features from both datasets; then fits two Gaussian distributions to both datasets respectively, via computing the mean and covariance of the feature representations for both of them; then use the means and covariances to calculate the Fréchet distance. Following Park et al. (2017), we computed the FID scores between public data and private data in a differentially private manner. Le. consider data matrix by X, where n i.i.d. observations in srivacy-sensitive dataset are stacked in each of X. We denote each observation of this dataset. by X; Rd Hence, X E Rxd We denote the inception feature given datapoint x; by Φ(x.). We further denote the mean and the covariance of the inception features, computed on public datasct, by μo and Σp. Similarly, we denote those computed on privacy- privacy-sensitive dataset by μ4 Σ. The non-DP computation of FID is given by the following formula (nolations are only used in this subsection):
FID || 1u123
En - 2
21

---

Published in Transactions on Machine Learning Research (11/2024)
We will need to privatize j and E. Following Park et al. (2017), we privatize the mean vector using (e1, dDP Gaussian mechanism. Let us first recall the definition of la given by
(xx)).
Assuming |[x(x;)] S 1 for any i, the sensitivity of the mean vector denoted by Au is:
1 1 (xx)) + x(xx)) ) - n 3
4
max
||
((x) + o(x)) I
(xx)
Xj x
1
max [1((x)) - [[x2)]|
n x
1 -2 2xx((ll)))1
71
2/n
i.c., bounded by 2/n, when using the replacement definition of diffcrential privacy (it is 1/n when using the inclusion/enn /excuuionn definition of DP). Hence,
= /1 + n1,
(5)
where n, is drawn from (0,, 1) Here, 01 is a function of the privacy level given by (c1, (1)DP). The exact relationship between 01 and (e1, varies depending on how to compute the DP bound. We use the bound introduced in the analytic Gaussian mechanism in https://gi thub. comm/yxiingg//uut /autodp.
Recall the definition of covariance given by:
1 x x pupt == n
Since we have a privatized mean from above, we need to privatize the second-moment matrix 1 X = Maec to privatize the covariance matrix.
As before, assuming [x,(x;))| s 1, Vi, the sensitivity of the second moment matrix denoted by A Mmn is
A Mice
max ((x))
||
x(x))((x) + o(xx) n2
1 n 11.
Σ
n
olx))xx( o(xx) ) ll
n
| (xx(x,) d (xx)) ((x)))((x))
max n ((x))
< n (xx)
max (x(x,) (x(55 )lF
(WLOG, say (1x(x Il S ((x(x)))xxx))) IFF)
2 max
Σ> k=1
0 2
(Say Φ(x;) [an, ad) as column vector)
n (xx;)
2 max n (xx,)
2 max,
)(x,)
2
max n ((x;)
V
1|x((x)1133
2
<
22

---

Published in Transactions on Machine Learning Research (11/2024)
0.1
0.5
5
10
0.1
0.5
2
SVHN
78.9930
17.3465
8.9223
4.7426
2.1582
1.3368
SVHN KMNIST EMNIST
0.2675
0.2662
0.2663
0.2663
KMNIST
79.9224
17.5794
9.0605
4,6092
1.9300
1.0794
0.0489
0.0459
0.0457
0.0455
EMNIST
80.4267
17.3617
8,9058
4.4561
1.8926
1.0242
0.0228
0.0201
0.0201
0.0197
Table 10: Left: Perturbed FIDs when privatizing both mean and covariance. Note e listed the sum of
Cp + 6x, we take Eu = eg. Right Perturbed mean differences when privatizing mean only. listed is en
L.e, bounded by 2/n, when using the replacement definition of differential privacy (it is 1/n when using the inclusion/exclusion definition of DP). See eq(17) in Park et al. (2017) for derivation of the sensitivity.
Given a privacy budget (c2, DD) assigned to this privatization step, which gives us a corresponding privacy parameter 02, we first draw noise ny from (N0, o o2/ We then add this noise to the upper triangular part of the matrix, including the diagonal component. To ensure the symmetry of the perturbed second-moment matrix Mace, we copy the noise added to the upper triangular part and add one by one to the lower triangular part, We then obtain
= = pipt.
(6)
Note E may not be positive definite. In such a case, we can project the negative eigenvalue to some small value close to zero to guarantee the positive definite property of the covariance matrix. This safe to do, as DP post-processing invariant.
Using the aforementioned privatized mean given in eq. and covariance given in eq. 6, we can compute the final FID score, given by
DP-FID | - :il2 No Σ (2:0)*}
which is (Ei + E2, +
Following the above method, compute the DP-FID scores of SVHN, KMNIST, and EMNIST, with respect to private dataset MNIST. We sampled 60k data from each public dataset candidates to do fair comparison, the results are in Table 10 left. One could consider only privatizing the mean only, and the results are in Table 10 right. Based on these results, we choose EMNIST as a public dataset.
A.2.2 Additional experiments with SVHN and KMNIST
To verify our choice of EMNIST emperically, also did ablation experiments SVHN and KMNIST under the same privacy condition 10, 10-5 to compare with EMNIST, the results are illustrated in Table
11.
Dataset pair (SVHN, MNIST) (KMNIST, MNIST)
CNN accuracy
94.3
96.3
(EMNIST, MNIST)
97.4
Table 11: We also pretrained LDMs using SVHN and KMNIST then fine-tuned with MNIST, and list the CNN accuracy here respectively.
Latent Space
Condition Embeddee
A.2.3 Ablation experiments for MNIST
Ries
There are 7 allettion modules in the UNet structure for MNIST, 1-2 are in input_blocke blocks, 3 in mid- dle block, 4-7 are in out blocks as illustrated in Fig. 8. Modules in blue are frozen during fine-tuning. Parameters of condition embedder is always trained.
Res
input. middle block
out blocks
Figure 8: UNet. Structure for MNIST.
23

---

Published in Transactions on Machine Learning Research (11/2024)
Condition Embedder
Latent Space
Res
In
Res
Out
2
14
15
16
Res
Res
Res
Res 12
Res
Res
11
13
Res
Res
Res
Res
Res
Res
10
Res
Res
Res
Res
Res
Res
Res
input blocks
middle block
out blocks
Figure 9: UNet Structure for CIFAR-10
We consider fine tune only i-th to 7th attention mod-
ules to reduce more trainable parameters. Results
for = 10, 8 = 10-5 are listed in Table 12. The best results achieved when fine tune with 4-7 attention blocks, which means out blocks more important than others during training.
1-7(all)
2-7
3-7
4-7
5-7
CNN # of trainable paramn
97.3
97.3
90
97.4
97.3
1.6M
1.5M
1.2M
0.8M
0.5M
out of 4.6M total params
(34.3%)
(32.4%)
(25.2%)
(18.0%)
(10.9%)
Table 12:
CNN accuracy and number of trainable parameters for MNIST ablation experiments with varying number of fine-tuning layers. Privacy condition is set to 10, 5 = 10-5.
A.3 Transferring from Imagenet to CIFAR10 distribution
Here, provide the results for ablation experiments to test the performance of DP-LDM when fine-tuning only certain attention modules inside the pre-trained model and keeping the rest of the parameters fixed. There are 16 attention modules in total as illustrated in Fig. 9. Table 13 shows the FID obtained for 6 1= 5, 10 and 10-5 for the different number attention modules fine-tuned. The results show that fixing up to the first half of the attention layers in the LDM has positive effect terms of the FID (the lower the better) in our model.
DP-LDM
< 10
1-16 layers
25.8 + 0.3
29.9 + 0.2
33.0 0.3
5 16 layers
15.7 0.3
21.2
1 0.2
28.9
0.2
9 16 layers
8.4 + 0.2
13.4
= 0.4
22.9
- 0.5
13 - 16 layers
12.3 + 0.2
18.5
+ 0.2
25.2 + 0.5
Table 13: FID scores (lower is better) for synthetic CIFAR-10 data with varying the number of fine-tuning layers and privacy guarantees. Top row (1-16 layers): Fine-tuning all attention modules. Second row (5-16 layers): Keep first attention modules fixed and fine-tuning from 5 to 16 attention modules. Third row (9-16 layers): Keep first 8 attention modules fixed and fine-tuning from 9 to 16 attention modules. Bottom row (13-16 layors): Keep first 12 attention modules fixed and fine-tuning from 13 to 16 attention modules.
We also report the different. hyper-parameter settings used in ablation experiments in table Table 14.
24

---

Published in Transactions on Machine Learning Research (11/2024)
c
c
batch size
1000
2000
1000
clipping norm
10 5
10 5
10
1-16 layers (24.4M parameters)
learning rate
10
10
10
epochs
30
30
10
batch size
5000
5000
2000
clipping
10-6
10-5
10-3
5-16 layers (20.8M parameters)
learning rate
10-6
10-6
10-5
epochs
50
50
10
batch size
2000
2000
5000
clipping norm
10 6
10 6
10
9-16 layers (10.2M parameters)
learning rate
10
10
10-6
epochs
30
batch size
2000
2000
2000
clipping norm learning
10-6
10-6
10-2
13-16 layers (4M parameters)
10-6
10-6 6
10-6
epochs
30
30
10
Table 14: DP-LDM hyper-parameter setting on CIFAR-10 for different ablation experiments.
ResNet9
WRN-40-4
learning rate
0.5
0.1
batch size
512
1000
epochs
10
10000
optimizer
SGD
SGD
label smoothing
0.1
0.0
weight decay
5 10
5-10
momentum
0.9
0.9
Table 15: Hyperparameters for downstream classification ResNet9 and WRN-40-4 trained on CIFAR10 synthetic data
Table 15 shows the eeper-parametens used during training ResNet9 and WRN-40-4 downstream classifiers CIFAR10 synthetic samples.
A.4 Transferring from Imagenet to CelebA32
We also apply our model in the task of generating 32 32 CelebA images. The same pretrained autoencoder our CIFAR-10 experiments in Section 5.1 is used, but since this experiment is for unconditional generation, we are unable to re-use the LDM. A new LDM is pretrained on Imagenet without class conditioning information, and then fine-tuned on CelebA images scaled and cropped to 32 x 32 resolution. Our FID results for ò = 10-6 = 1, 10 are summarized in Table 16. We achieve similar results to DP-MEPP for e = 5 and = 10. As with our results at 64 64 resolution, our LDM model does not perform as well in higher privacy settings (c 1). Sample images are provided in Fig. 10
A.5 Transferring from Imagenet to Camelyon17-WILDS
Camelyon17-WIILDS is part of the WILDS benchmark suite of datasets, containing 455, 954 medical images at 96 x 96 resolution. The downstream task is to determine whether the center 32 x 32 patch of the image contains any tumor pixels. In our experiment, we crop the image so that only the center 32 32 patch is passed the model. We begin with the same pretrained autoencoder and LDM as in our CIFAR-10 experiments (Section 5.1), and fine-tune C We then generate 25, 000 images conditioned
25

---

Published in Transactions on Machine Learning Research (11/2024)
== 10
6 ==3
DP-LDM (ours, average)
16.2 + 0.2
16.8 0.3
25.8 + 0.9
DP-LDM (ours, best)
16.1
16.6
24.6
DP-MEPF (Φ1)
16.3
17.2
17.2
DP-GAN (pre-trained)
58.1
66.9
81.3
DPDM (no public data)
21.2
71.8
DP Sinkhorn (no public data)
189.5
Table 16: CelebA FID scores (lower is better) for images of resolution 32 x 32 comparing with results from
DPDM (Dockhorn et al., 2023), DP Sinkhorn (Cao et al., 2021), and DP-MEPF (Harder et al,, 2023).
Real Data
DP-MERF (< = 10)
pre-trained DP GAN (e 10) pre trainee DP-GAN (e = 1)
DP Sinkhorn 10)
DP- OP-MEPP (e 10)
DP DEPM (e (c= 1)
DPDM (e = 10)
Ours (c 10)
Ours (t = 1)
Figure 10: Synthotic 32 32 CelebA samples generated at different levels privacy. Samples for DP-MERF and DP-Sinkhorn are taken from (Cao et al., 2021), DPDM samples are taken from (Dockhorn et al., 2023), and DP-MEPF samples are taken from (Harder al., 2023).
each of the two classes, and combine them create synthetic dataset of 50, 000 images. Finally, the synthetic dataset is used to train a WRN-40-4 classifier.
B Hyperparameters
Here provide overview of the hyperparameters of the pretrained autoencoder in Table 17, hyperpa- rameters of the pretrained diffusion models in Table 18. Note that base learning rate is the one set in the yaml files. The real learning rate passed to the optimizor is accumulate _gred batches x num gpus x batch size base learning rale.
EMNIST (to MNIST)
ImageNet (to CLEAR1O)
ImageNct (to CelobA 32)
ImageNet
(to CalebA 64)
Input size
32 8 4 x 4 x 128
32
32 16
64
Latent size
16
32
f
2
2
2
2-shape
16 16 x 3
16 16 3
64 x 64 3
Channels
128
128
192
Channel maltiplier
[1,2,3.5]
[1.2]
[1.2]
[1.2] [16,8]
Attention resolutions
[32,16,8]
[16, 8]
[16, 8]
num blocks
2
Batch size
Base learning rate
4.5 10-6
10-6
10-6
1.0 x 10-6
Learning rate
4.5 10-4
10-4
1.4 x 10
1.4 x 10-4
Epochs
50
2
GPU(s)
1 NVIDIA V100 NVIDIA RTX. A4000
NVIDIA RIX A4000
NVIDIA V100
Time
8 hours
1 day
day
day
Table 17: Hyperparameters for the pretrained autoencoders for different datascts.
26

---

Published in Transactions on Machine Learning Research (11/2024)
EMNIST (to MNIST)
ImageNet (to CIEAR1O)
ImageNet (to CelobA 32)
ImageNet (to CclobA64)
input size
32
latent size
16
32
f
8
2
2
e-shape
4 x x
16 16 x
16 x 16 3
32 x 32 x
chaunels
64
128
192
192
channel multiplier
[1,2]
[1,2,2.4]
11,24
[1,2,4]
attention resolutions
[1.2]
[1,2.4]
[1,2.4
[1,2.4
blocks
2
heads
mamn head channels
32
batch size
384
base learning rate
5 10-6
10-1
x 10-7
10-6
learning rate
2.6 10
x 10
2 x 10
2.6 10-4
epochs
120
30
13
40
# trainable parameters
4.6M
90.8M
162.3M
72.2M
GPU(s)
NVIDIA V100
NVIDIA RTX A4000
NVIDIA V100
I NVIDIA V100
time
6 hours
7 days
30 hours
10 days
spatial transformer
True class label
True
False
False
cond stage key
class label
conditioning key
crossattn
croseatin
mam mum_classee classes
26
1000
embedding dimension
5
512
transformer depth
Table 18: Hyperparameters for the pretrained diffuusio models for different datasets.
Table 19 shows the hyperparameters used for fine-tuning MNIST. Table 20 shows the hyperparameters we used for CelebA32. Table 21 shows the hyperparameters we used for CelebA64. Table 23 shows the hyperparameters we used for text-to-image CelebAHQ generation. Table 24 shows the hyperparmeters we used for class-codd CelebAHQ generation.
10
batch size base learning rate
2000
2000
x 10-7
6 10-7
learning rate
x 10-3
1.2 x 10-3
epochs
200
200
clipping norm
0.01
0.001
noise scale
1.47
9.78
ablation
-1
of params
0.8M
1.6M
use spatial transformer cond stage key conditioning_lry num classes
'True class label
True
class label
crossatin
crossatin
26
26
embedding dimension trausformer depth train coudition only attention Haag
13
13
True spatial
Truc
spatial
condition params
338
Table 19: Hyperparameters for fine-tuning diffusion models with DP constraints = 10, and ó -= 10-5 on MNIST. The "ablation" hyperparameter determines which attention modules are fine-tuned, where value of means that the first attention modules are frozen and others are trained. Setting "ablation" -1 (default) fine-tunes all attention modules.
27

---

Published in Transactions on Machine Learning Research (11/2024)
< 10
<=5
batch size
8192
8192
2048
base learning rate
10-?
5 10
10 -7
learning rate
10-3
x 10-3
1 x 10-3
epochs
20
clipping norm
5.0 10 -1
5.0 x 10
5.0 10
ablation
-1
-1
spatial transformer
Falsc
False
False
cond stage key conditioning_key
num classes
embedding dimension
transformer depth
train aattention_onll
True
True
Truc
Table 20: Hyperparametens for fine-tuning diffusion models with DP constraints -00,5, and 5 = 10-6 CelebA32.
c=
batch size
8192
8192
8192
base learning rate
10-7
1 x 10-7
1 x 10
learning rate
8.2 10
8.2 10
8.2 10
epochs
70
70
70
clipping
5.0 10
5.0 10-4
5.0 x 10
ablation uSe sce__ppatilll. transformer
Falsc
False
False
cond stage__ker
conditioning_lyy
mum classes
embedding dimension
transformer depth
train attention only
True
True
True
Table 21: Hyperparameters for fine-tuning diffusion models with DP constraints e = =10055, 5, and å = 10 on CelebA64.
<= 10
batch size
20000
base learning rate
1.0 10-7
learning rate
2.0 10-3
epochs
30
clipping norm ablation
1.0 10-8
13
spatial transformer
True class label
cond stage_ key conditioning key mmm classes
crossatta
1001
embedding dimension transformer depth train condition oonditioo__oll attention flng # condition params
512
True
spetial
512, 512
Table 22: Hyperparameters for fine-tuning diffusion models with DP constraint c 10 and 5 = 3 10-6 on Camelyon17-WTL.
28

---

Published in Transactions on Machine Learning Research (11/2024)
10
<=
batch size
256
256
base learning rate
x 10
X 10
learning ratc
2.6 x 10
2.6 x 10-5
epochs
10
10
clipping norm
0.01
0.01
noise scale ablation
0.55
1.46
-1
-1
of paramss
280M
280M
use use__pase sne__paaaal_... transformer
True caption
True
cond cond_stage _stge__key key
caption
context dim
1280
1280
conditioning key
crossattn
crossattn
transformer depth
1
Table 23: Hyperparameters for fine-tuning diffusion models with DP constraints 100, and 5 10-5 text-conditioned CelebAHQ.
10
c=3
batch size
2048
2048
2048
base learning rate
x 10-7
1 x 10
x 10-7
learning rate epochs
2.0 x 10
2.0 10-1
2.0 x 10-1
50
50
50
clipping norm ablation
5.0 x 10 5.0 10
5.0 x 10-4
-1
-1
-1
use tnve_spaataal__ ______aatal_traassstooo transformer cond stage key context. dim conditioning key transformer depth
True class label 512 crossattn
True class label
True
class label
512
512
crossatia
crossatta 1
Table 24: Hyperparameters for fine-tuning diffusion models with DP constraints 10, 5, and 8 10-5 class-conditional CelebAHQ.
29

---

Published in Transactions on Machine Learning Research (11/2024)
C
Additional Samples
DP-LDM (Ours)
DP-MEPF
6=5
6=1
Figure 11: Synthetic 64 x 64 CelebA samples generated at different levels of privacy. Samples for DP-MEPP are taken from Harder et al. (2023).
DP-LDM (Ours)
DP-Diffusion
Figure 12: Synthetic 32 x 32 CamelyonI7-WILDS samples at c 10 and = 3 x 10 Samples for
DP-Diffusion are taken from table in Ghalebikesabi et al. (2023).
D Comparison between DP and non-DP Samples
30

---

Published in Transactions on Machine Learning Research (11/2024)
LDM (without DP)
10
DP-LDM
6=1
Figure 13: Synthetic CelebAHQ images from a non-DP-trained LDM (Top, black box, images taken from Rombach et al. (2022)) versus those from DP-trained LDMs (Bottom, red box). The non-DP synthetic images exhibit humanly discernible characteristics of faces. On the other hand, DP synthetic samples exhibit. distortions at varying levels, where higher privacy guarantee (e 1) yields more distortion.
31


Reviews:
[{"review_id": "nC0YgIsf2S", "reviewer": "Reviewer_HLp2", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n- The proposed approach is faster, while maintaining good generation quality comparing to some DP diffusion model baselines.\n\n### Weaknesses\n- The novelty is very limited because it simply combines existing techniques such as LDM, DP-SGD, and fine-tuning attention layers.\n- The paper lacks the depth discussion of DP for diffusion models or generative models. Generally, we do not want the leak of private data in the diffusion models, however, we can use the diffusion models to regenerate the private data. This seems controversy to me if this is not deliberately discussed.\n-  In experiments, the paper reports the FID score and accuracy of the downstream tasks, I cannot see any performance metrics about the differential privacy. Therefore, it is unable to justify if the proposed approach is more DP than others or if it can guarantee DP up to any extent.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes to fine-tune the attention layer of latent diffusion models for imposing differential privacy on them. The main idea is to train a latent diffusion model on a public dataset and then fine-tune the attention layers of this latent diffusion model on the private dataset.  For this purpose, it applies the idea of DP-SGD by adding a Gaussian noise to the gradients.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Discuss more about DP in diffusion models and generative models including what we aim to obtain and how to measure/quantify them.\n\n- Discuss more about the difference of generated images of the standard diffusion models and DP ones. Why can you say that the generated images of DP diffusion models do not reveal the information of private data?\n\n- Incorporate the performance metrics to measure/quantify the DP level of the proposed and baseline approaches.", "broader_impact_concerns": "No concerns on ethical implications of the work.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "g24U44dN60", "reviewer": "Reviewer_ofXX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n1. Privacy is a crucial subject and this is a subject that is relevant to the readers of TMLR\n2. The proposed method seems to perform quite well compared to the state of the art\n3. The method dictates to finetune only the attention modules (10% of the parameters) and there is a computation time comparison with the literature\n4. The paper's claims are supported by the results. Also the quantity of the experiments and ablations is satisfactory\n\nWeaknesses\n\n1. Although the manuscript is not bad written, it seems a bit rushed, for example there is no consistency between references (Fig. 5 vs Figure 11), or instead of \"figure 3\" and \"figure 4\" there is \"figure 5.1\" and \"figure 5.2\" which is the numbering of the subsections.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduce differential privacy to the latent diffusion models while finetuning only 10% of their parameters. The idea is simple, it shows good results, and reduces the recources needed for this task by a lot.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I think the paper needs a refinement but this is not a major problem for me", "broader_impact_concerns": "none", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "CdZFUwtXHG", "reviewer": "Reviewer_g9at", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n\n- ****Innovative Methodology:**** The integration of LDMs with DP-SGD represents a significant advancement in the field, allowing for efficient training while addressing privacy concerns effectively. \n- ****Performance Improvement:**** The proposed DP-LDMs outperform many existing methods, showcasing their ability to generate high-quality images while maintaining differential privacy. \n- ****Reduced Resource Requirements:**** By significantly lowering the number of parameters that need to be fine-tuned, the authors demonstrate a substantial decrease in GPU hours required for training, making the approach more accessible to researchers and practitioners. \n- ****First Attempy:**** This work is notable for being the first to produce high-dimensional images conditioned on text prompts with DP guarantees. \n\n## Weaknesses\n\nMy main concern regards the clarity of the paper. There are several undefined notations or paragraphs that would benefit from re-writing. Examples include the missing definition of $\\tau_\\theta$ in Sec. 2.1 (especially since this replaces the traditional \\eps in Diffusion Models), the paragraph **Which public dataset to use given a private dataset?** where it is not clear what the authors mean by \"similarity in what sense\".\n\nFrom the evaluation point of view, I have doubts regarding the comparison of the proposed method w.r.t. LoRA fine-tuning, as the number of parameters for LoRA is almost an order a magnitude different from the proposed one. What would be the impact of a higher rank with a similar number of parameters to the authors' proposal?\n\nAdditionally, a couple of other remarks:\n- The tables captions position is not consistent across the paper.\n- $\\alpha$ in LoRA is not defined as $1/r$ as reported in Sec. 5.4. It is an hyperparameter whose default value is $r$ as reported in the original LoRA paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper addresses the significant privacy concerns associated with diffusion models (DMs), which are widely used for image generation but have been shown to leak training data. The authors propose a novel approach that combines differential privacy (DP) with latent diffusion models (LDMs) to enhance privacy while maintaining image quality. By fine-tuning only the attention modules of the LDMs using differential privacy stochastic gradient descent (DP-SGD), they reduce the number of trainable parameters by approximately 90%, leading to improved efficiency and a better privacy-utility trade-off. The method allows for the generation of high-dimensional images (256x256) conditioned on text prompts, marking a first in the field of differentially private image generation. The authors demonstrate that their approach outperforms existing state-of-the-art methods on various benchmark datasets. Additionally, the reduced computational requirements make this method more accessible and environmentally friendly, democratizing the use of DP in image generation.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper needs some revision from a clarity point of view. Additionally, I feel like the comparison with LoRA is not completely fair in the current setting.", "broader_impact_concerns": "Generative tools are becoming more and more realistic and of general availability, with the risk of generating harmful content, especially when generating human-related content. A Broader Impact Statement analyzing the impact of these tools is required.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Two of our three reviewers recommended acceptance, and the AE agrees with the recommendations that the benefits of publishing this paper in our community outweigh any downsides. The AE has made some recommendations to mitigate these downsides in future research and looks forward to seeing them addressed in the camera-ready version.

Limitation section

I encourage the authors to have the limitation section at the end of the main body.

>  While the paper proposes a technique to counterattack the privacy risks of diffusion models, the evaluation has not been done against existing privacy attacks. So we know that the diffusion model is private "under the definition of DP," but we do not know whether this is sufficient to mitigate our privacy concerns. 

> I would also emphasize that the definition of privacy within the community has not yet reached a consensus. Carlini et al.'s work is a single example of exploitation, but it remains unclear what aspects we aim to protect in generated data. For instance, should we expect a private model to avoid generating a small pimple on my left nostril, for example? Such an unclear definition may expose practitioners employing this private training mechanism to the "false sense of privacy"---they thought that they were private but turned out not to be.

Presentations

1. I would remove "which, to the best of our knowledge, has not been attempted before," as the implications are unclear.
2. I would revise the paragraph starting with "Great performance..." in the introduction. It's unclear what it means to be "great" when generating photos from private diffusion models.
3. Figures and Tables: The current structure of tables and figures does not look professional—the fonts are too small, or the photos are too small to identify and compare the differences. The placements are sometimes off from the text explaining figures and tables. I would fix them.
4. In Broader Impact Statement: "To guarantee the reproducibility" -> "To encourage the reproducible research practices,"
Decision: Accept (poster)