Title: Private Evolution Converges
Venue: NeurIPS 2025
Accepted: yes
Keywords: Differential Privacy

Synthetic Data

Private Evolution
Abstract: Private Evolution (PE) is a promising training-free method for differentially private (DP) synthetic data generation. While it achieves strong performance in some domains (e.g., images and text), its behavior in others (e.g., tabular data) is less consistent. To date, the only theoretical analysis of the convergence of PE depends on unrealistic assumptions about both the algorithm’s behavior and the structure of the sensitive dataset. In this work, we develop a new theoretical framework to understand PE’s practical behavior and identify sufficient conditions for its convergence. For $d$-dimensional sensitive datasets with $n$ data points from a convex and compact domain, we prove that under the right hyperparameter settings and given access to the Gaussian variation API proposed in \cite{PE23}, PE 
produces an $(\varepsilon, \delta)$-DP synthetic dataset with expected 1-Wasserstein distance $\tilde{O}(d(n\varepsilon)^{-1/d})$ from the original; this establishes worst-case convergence of the algorithm as $n \to \infty$. Our analysis extends to general Banach spaces as well. We also connect PE to the Private Signed Measure Mechanism, a method for DP synthetic data generation that has thus far not seen much practical adoption. We demonstrate the practical relevance of our theoretical findings in experiments.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a new theoretical analysis of Private Evolution (PE), a training-free method for differentially private synthetic data generation. The authors identify limitations in prior work and propose a variant of PE for theoretical study (Algorithm 2) that more closely resembles the original PE. The main contribution is an upper bound on the Wasserstein distance between the synthetic data and the private data. The paper also draws an interesting connection between PE and the Private Signed Measure Mechanism (PSMM).\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**:\n- The theoretical analysis is sound and novel\n- The connection between PE and PSMM is interesting. It offers a new perspective on PE as an iterative method for constructing discrete support for data release.\n\n**Weaknesses**:\n- **Misleading convergence claim.**  The title \"Private Evolution Converges\" is misleading. Typically, the convergence of an iterative algorithm implies that a quality metric improves as the number of iterations $T \\to \\infty$. The analysis in this paper does not show this. Instead, the paper establishes convergence only in the limit of the dataset size $n \\to \\infty$. Furthermore, for the expected 1-Wasserstein distance to approach a small constant, $n$ must scale as $O(d^d)$, which is impossible in practice. \n- **Disconnect with empirical evidence.**  A major concern is the apparent disconnect between the paper's theoretical guarantees and the extensive empirical evidence on PE's behavior. \n  - Notably, multiple studies have documented that PE suffers from a lack of diversity or **mode collapse** (see Figs. 21 and 22 in [1] and Fig. 4 in [2]). This makes distributional convergence impossible. This critical point is not captured by the current analysis and has not been discussed in this paper.\n  - The analysis in Line 314 implies a monotonic progression of the Wasserstein distance, suggesting the optimal $T$ is either 1 or $\\infty$. This does not capture the U-shaped performance curves (e.g., Fig. 4 of [2]) where the fidelity of the synthetic data (e.g., FID) first improves and then degrades (due to overfitting to majority modes).\n- **Limited practical insights.**  The theoretical framework, while rigorous, struggles to provide new, actionable insights into PE's practical challenges. For example, the theory suggests that the optimal $T$ is 1 when the initial error is smaller than the asymptotic error term, which the authors use to explain PE's poor performance on tabular datasets. However, this explanation is not convincing, as the asymptotic error vanishes with $n$, and it is unclear why this condition would uniquely apply to tabular data.\n\nIn summary, while the paper succeeds as a theoretical exercise in deriving a bound for a variant of PE, it falls short of its goal to \"explain PE's practical behavior\". The core research question (convergence) is misaligned with PE's most pressing practical challenges, particularly mode collapse. A more interesting direction is to develop theory that explains why and when PE fails, as this would be more likely to guide the development of better algorithms for DP synthetic data generation (please cite [3] for this broad research topic).\n\n**References**\n\n[1] Lin, Zinan, et al. \"Differentially private synthetic data via foundation model apis 1: Images.\" arXiv preprint arXiv:2305.15560 (2023).\n\n[2] Hou, Charlie, et al. \"Private Federated Learning using Preference-Optimized Synthetic Data.\" arXiv preprint arXiv:2504.16438 (2025).\n\n[3] Hu, Yuzheng, et al. \"Sok: Privacy-preserving data synthesis.\" 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024.\n\nQUESTIONS:\n1. How does Lemma 3.1 change if we relax from pure DP to approximate DP?\n2. What does \"worst-case\" refer to in the convergence guarantee?\n\nLIMITATIONS:\nNo, the authors didn't discuss the limitations of this work. The authors should discuss the mismatch between the theoretical results and the empirical evidence, and what are the potential causes.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nPrivate Evolution (PE) is a synthetic data generation process that has shown some promising empirical results. A recent paper ([31] in the submission) gave convergence guarantees for a variant of PE, but this paper argues that the assumptions in [31] are quite unrealistic. Without those assumptions, the original method offers weak privacy guarantees. The current submission proposes a different (still not exactly the same as practical) variant of PE and proves worst-case convergence bounds for it.\n\nSTRENGTHS AND WEAKNESSES:\nThe paper does a nice job framing the problem, situating prior work, pointing out its limitations, and explaining the contribution clearly. This feels like a meaningful theoretical step toward understanding a practical method. I’m not an expert in this area, but the proof of Theorem 4.1 definitely doesn’t look routine. The sketch was helpful too: after applying some triangle inequalities, the key step becomes controlling uniform convergence over 1-Lipschitz functions under Gaussian perturbations, which his is handled using Gaussian complexity, and Wasserstein distance between a measure and its empirical version. That seems nontrivial.\n\nOn the downside, the introduction says that PE is competitive with—or even outperforms—state-of-the-art models in terms of FID and downstream task performance. But the algorithm in this paper isn’t exactly that practical version—it’s a variant. So it would’ve been useful to compare Algorithm 2 with the real-world PE.\n\nQUESTIONS:\nI’m a little confused about the implication of Lemma 3.1. There is no qualifier on $\\mathcal{A}$. Does this mean the lower bound applies to *any* algorithm $\\mathcal{A}$? If so, why doesn’t it apply to your algorithm? Or maybe you meant $\\mathcal{A}$ refers specifically to Algorithm 1?\n\nAlso, just a minor formatting thing, but in Algorithm 1, the line $S_0 \\gets \\mathrm{Random} \\\\_ \\mathrm{API}(n)$ is highlighted in blue, while the same step in Algorithm 2 isn’t. Was that intentional?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n### Summary\n\nThis paper provides novel worst-case theoretical analysis for the Private Evolution (PE) algorithm, a promising training-free method for differentially private (DP) synthetic data generation. PE iteratively refines an initial synthetic dataset (generated independently of private data) by creating variations and privately voting for those closest to the private dataset.\n\nPrevious theoretical analyses of PE relied on highly unrealistic assumptions (e.g., every private data point is duplicated many times), making those convergence guarantees inapplicable in practice. This paper carefully analyzes these limitations, proving lower bounds that show why such assumptions are necessary for prior proofs.\n\nThe authors then propose a new theoretical variant of PE that better resembles the practical implementation. The authors prove worst-case convergence guarantees in terms of expected 1-Wasserstein distance under $(\\varepsilon, \\delta)$-DP, showing that PE's error decays as roughly $O(d(n\\varepsilon)^{-1/d})$. They also generalize parts of their analysis to Banach spaces and establish connections to the Private Signed Measure Mechanism (PSMM).\n\nThe paper includes simulations on synthetic datasets to validate and illustrate the theory, showing how PE’s convergence depends on initialization and parameter choices.\n\n---\n\n### Contributions\n\nThe main conceptual contribution is a more principled variant of PE that better resembles the practical implementation of PE and also lends itself well to worst-case theoretical analysis.\nSome experiments on synthetic datasets verify the worst-case rates.\n\nSome beyond worst-case analysis is also developed for \"well-clustered\" datasets, but it is unclear if the assumptions are realistic in practice.\n\nA connection is also made to the private signed measure mechanism (PSMM) to interpret PE as an iterative version of PSMM.\n\n---\n\n### Techniques\n\nThe authors show that the variation step of PE contracts the $W_1$ distance to the dataset in expectation while carefully controlling the error introduced in the private voting step.\nThe analysis of the variation step seems to be mostly taken from [31].\nThe private voting step uses empirical process theory, which, as the authors mention, resembles [24].\n\n---\n\n#### References\n\n[24] Y. He, R. Vershynin, and Y. Zhu. Algorithmically effective differentially private synthetic data. COLT'23\n\n [31] Z. Lin, S. Gopi, J. Kulkarni, H. Nori, and S. Yekhanin. Differentially private synthetic data via foundation model APIs 1: Images. ICLR'24\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n\n1. The main strength is a careful, rigorous analysis of PE’s convergence with more realistic assumptions.\nThis is important as PE is popular and seems to be quite practical.\n\n1. The exposition is clear, and the proof overview in the main body is very intuitive. The proofs included in the appendix are also well-structured and include a nice application of chaining.\n\n---\n\n### Weaknesses\n\n1. While the paper makes progress towards bridging theory and practice of PE, a major assumption that was not discussed at all is the theoretical formulation of the variation step, which is defined as taking random spherical Gaussian steps from the current synthetic data point, with variance chosen at different scales. While it may be very difficult to theoretically model the variation step of the actual PE implementation, as it relies on calling foundation model APIs, a paper that attempts to eliminate unrealistic assumptions should at least discuss this definition.\n\n1. While the algorithmic variation is interesting, the analysis mainly consists of (cleverly) bringing together existing techniques.\n\n1. The experiments do not vary the dimension and are performed in $\\mathbb{R}^2$. This cannot confirm how accurate the theoretical predictions are for higher dimensional settings, which is the main regime of interest these days.\n\n1. There are some small inconsistencies in the proofs within the appendix which should be easily addressable; I include the ones I found in the Questions section.\n\nQUESTIONS:\n### Main Questions\n1. How reasonable is the current definition of VARIATION_API?\n1. Is the worst-case dependence on dimension reflected in practice? It would be interesting to see if the dependence on dimension matches even on synthetic datasets. \n\n---\n\n### Minor Nitpicks\n1. The current proof of Theorem 4.1 (main theorem) might need to restrict $\\sigma$; the number of synthetic points $n_S\\propto \\sigma^{-1}$ wouldn't make sense for $\\sigma$ arbitrarily large.\n1. The domain $\\Omega$ should probably be taken to be closed and convex, otherwise the projection of the VARIATION_API does not necessarily shrink the distance from the unprojected point (Lemma D.1 Case 2)\n1. The statement of Lemma D.2 is intuitive, but its proof is notationally dense. A summary of the idea might help readers.\n1. Is the term $C$ in the statement of Lemma D.4 an absolute constant? Please state so if it is.\n1. Lemma D.4 is a nice application of chaining, but I wonder if a one-step discretization bound already suffices? Chaining usually helps to remove some log factors to achieve a sharp analysis but this doesn't seem to apply here.\n1. The proof of Lemma D.4 (Line 939) doesn't seem to go through as stated. For an arbitrary pair $f_k\\in T_k, f_{k-1}\\in T_{k-1}$, their value can vary significantly. Indeed, the current proof uses the fact that there is a fixed function $f$ that is close to both. But this is not guaranteed for all pairs. Some slightly smarter choice of $f_k, f_{k-1}$'s should still work.\n1. The $(5/\\beta)^{d/2}$ term in the integral of the proof of Corollary D.1 (Line 951) should be $(5{\\color{red}D}/\\beta)^{d/2}$.\n1. I believe Lemma D.5 can be proved via chaining and analyzing the Rademacher complexity of $\\mathcal{F}_{BL}$. Since the Gaussian complexity already upperbounds this quantity, it might make sense to briefly mention this fact to make the paper even more self-contained.\n\nLIMITATIONS:\nThe authors claim that the only difference from practical PE is the projection in bounded Lipschitz distance. However, it is unclear if the current definition of VARIATION_API is a realistic model of the foundation model APIs applied in practice.\n\nTo be clear, I believe this work is a solid theoretical contribution.\nHowever, it is presented as an attempt to bridge theory and practice and thus merits a discussion of this issue.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nPrivate evolution (PE) is a recently developed method for generating private synthetic data from generative AI systems. PE algorithms work by generating random initial data then iteratively re-sampling them to be more similar to a private dataset while respecting differential privacy. These methods have shown promise, particularly in the text and image domains but prior to this work there has only been one work that attempts to analyze PE and give a convergence result. The authors of this work show that the previous analysis of PE depends on several limiting assumptions and that the PE algorithm they analyze is significantly different from the PE algorithms that are used in practice. This paper analyzes a version of PE that is similar to practical PE algorithms and shows and gives both a worst case convergence guarantee and a data-dependent bound in terms of Wasserstein 1 distance. This new analysis also connects to the existing PSMM method and shows how it is related to PE.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nThe paper is written well and does a good job of giving the main proof ideas in the main text so that readers can understand the contribution at a high level before reading the full details in the supplementary material.\n\nThe authors clearly explain the assumptions made by the previous analysis of PE and give a convincing lower bound showing that those assumptions are necessary for their proof approach.\n\nThe proof techniques developed by the authors give reasonable upper bounds with respect to a version of PE that is more similar to the PE algorithms that are used in practice.\n\nThe connection between PE and the Private Signed Measure Mechanism (PSMM) is clear and gives a useful lens for understanding PE.\n\nWeaknesses:\n\nThe authors claim that their analysis gives useful information for practitioners who are trying to utilize PE (how to select the number of rounds and number of synthetic data points). The support for this empirical claim is all with respect to simulation studies where the data are points in a ball within R2. This is very different from the domains where the mechanism is actually being used in practice (text and images) so it is unclear if the insights from their analysis will transfer to these domains.\n\nQUESTIONS:\nThe authors model the variation api as being a noise addition step, it is unclear how accurate of an approximation this is for what generative models do when asked to create variations of an image. What kind of conditions are necessary for the variation api to meet to make this analysis work?\n\nIs the noise scale for the variation api given in section 3 optimal under both the previous analysis and your analysis. Do you believe that practitioners should be tweaking their variation api to target a particular amount of variation?\n\nLIMITATIONS:\nI believe the authors overstate how similar their theoretical PE is to practical PE, especially w.r.t. how they represent the variation api, this should be discussed as a limitation.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

comments: SUMMARY:
The authors provide new theoretical results supporting privacy evolution

STRENGTHS AND WEAKNESSES:
Theoretical support for existing approaches is a positive aspect. It was difficult to see what affect the results have in practical terms, especially for high dimensional data.

QUESTIONS:
It would be good to discuss scalability issues to high-dimensional data, or for small / large data sets.

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-12