Differentially Private Generative Models

• Differentially private generative models are techniques that integrate privacy guarantees like (ε,δ)-DP and RDP to ensure that individual data points minimally influence the generated output.
• They encompass diverse architectures—including representation-based, adversarial, and diffusion models—where privacy is maintained via mechanisms such as DP-SGD, local randomization, and privatized gradient aggregation.
• These models enable practical applications by producing robust synthetic data for cloud training, federated learning, and graph synthesis while balancing utility and strict privacy requirements.

Differentially private generative models are generative models trained so that releasing the model, or synthetic data sampled from it, provides formal privacy guarantees with respect to the underlying sensitive dataset. In the standard central setting, the training algorithm is required to satisfy $(\varepsilon,\delta)$-differential privacy; in local settings, the curator may only observe already-privatized samples and train a generator from those observations. Across the literature, the released object may be a generator, a representation map, a score model, or a diffusion model, but the common objective is the same: expose useful synthetic data while limiting the effect of any single training record on the learned distribution (Chen et al., 2018, Reshetova et al., 2023, Jiang et al., 18 Feb 2025).

1. Formal privacy notions and induced guarantees

A standard definition used throughout this literature is that a randomized algorithm $\mathcal{A} : \mathcal{D}\to\mathcal{R}$ is $(\varepsilon,\delta)$-differentially private if for any two adjacent datasets $d,d' \subseteq \mathcal{D}$ differing in at most one training point and any subset $S\subseteq \mathcal{R}$,

$$\Pr[\mathcal{A}(d)\in S] \le e^{\varepsilon} \Pr[\mathcal{A}(d')\in S] + \delta.$$

One paper makes this notion explicit for generators themselves: a generative model $\mathcal{M}:\mathcal{D}\to\mathcal{Z}$ is $(\varepsilon,\delta)$-differentially private if for any adjacent private datasets $\mathcal{X},\hat{\mathcal{X}}\subseteq \mathcal{D}$ differing in one entry and any $S\subseteq \mathcal{Z}$,

$\mathcal{A} : \mathcal{D}\to\mathcal{R}$0

This framing is central to representation-based generators, VAE-based generators, and later teacher–student or diffusion-based systems (Chen et al., 2018).

A recurring structural result is the post-processing property. If a private mechanism outputs a generator, latent code, synthetic dataset, or critic signal, then any downstream computation that depends only on that output preserves the same privacy guarantee. This observation is used in several distinct ways: a downstream classifier trained on DP-AuGM outputs inherits the same $\mathcal{A} : \mathcal{D}\to\mathcal{R}$1-DP guarantee with respect to the original private data; a VAE sampler using only internal noise is DP once VAE training is DP; a generator trained against privatized teacher signals in data-free distillation is DP by post-processing; and a non-private public decoder applied to DP latent samples in DPMI preserves privacy (Chen et al., 2018, Chen et al., 2022, Liu et al., 2023).

Several works instead use Rényi differential privacy for accounting. In that setting, a mechanism $\mathcal{A} : \mathcal{D}\to\mathcal{R}$2 satisfies $\mathcal{A} : \mathcal{D}\to\mathcal{R}$3-RDP if $\mathcal{A} : \mathcal{D}\to\mathcal{R}$4 for adjacent $\mathcal{A} : \mathcal{D}\to\mathcal{R}$5, and this can be converted to $\mathcal{A} : \mathcal{D}\to\mathcal{R}$6-DP. RDP appears in DP-Sinkhorn, G-PATE, DP-CGAN, RAPID, and DPDFD because it composes cleanly over many training steps (Cao et al., 2021, Long et al., 2019, Torkzadehmahani et al., 2020, Jiang et al., 18 Feb 2025, Liu et al., 2023).

Local differential privacy introduces a different training interface. Instead of privatizing optimization, each user privatizes their own sample before release. One work shows that with Laplace or Gaussian local randomization, entropically regularized optimal transport can be used to train a generator on privatized samples while still recovering the raw distribution $\mathcal{A} : \mathcal{D}\to\mathcal{R}$7 at the population optimum, provided the mechanism is non-degenerate in the KL sense (Reshetova et al., 2023).

2. Architectural families

Published work spans representation-learning generators, adversarial models, optimal-transport models, score-based systems, and diffusion models.

Family	Representative methods	Distinctive mechanism
Representation / autoencoding	DP-AuGM, DP-VaeGM, mixture of generative neural networks	DP-SGD on autoencoders or per-cluster VAEs/RBMs
Adversarial	DPGAN, dp-GAN, DP-InfoGAN, DP-CGAN, G-PATE, DP-NetGAN	DP critic training, PATE-style aggregation, or edge-DP
Non-adversarial / score / diffusion	DP-Sinkhorn, DPMI, DPPM, DPDFD, RAPID	OT loss, latent DP-GAN, private score estimation, data-free distillation, retrieval-augmented DP diffusion

DP-AuGM is a representation-learning generator: a DP autoencoder is trained on private data, the decoder is discarded, and the encoder maps public or user-held data into a latent code space. DP-VaeGM is a fully generative model trained with one VAE per class; synthetic samples are produced by sampling $\mathcal{A} : \mathcal{D}\to\mathcal{R}$8 and decoding within each class-specific model. “Differentially Private Mixture of Generative Neural Networks” instead combines differentially private kernel $\mathcal{A} : \mathcal{D}\to\mathcal{R}$9-means with a mixture of RBMs or VAEs, so that each generator models a simpler cluster-specific distribution (Chen et al., 2018, Acs et al., 2017).

GAN-based models are more varied. DPGAN adds Gaussian noise to discriminator gradients in WGAN training; dp-GAN likewise releases a DP-trained generator for semantic-rich data and adds multi-fold optimization strategies for scalability and stability; DP-InfoGAN and DPD-InfoGAN preserve the mutual-information structure of InfoGAN while making discriminator training private; DP-CGAN adds label generation and uses a Rényi accountant; G-PATE replaces a single private discriminator with an ensemble of teacher discriminators and a private gradient aggregation mechanism; and DP-NetGAN adapts DP-SGD to edge-list generation for graphs under edge-differential privacy (Xie et al., 2018, Zhang et al., 2018, Mugunthan et al., 2020, Torkzadehmahani et al., 2020, Long et al., 2019, Zheng et al., 2021).

Non-adversarial approaches target optimization stability directly. DP-Sinkhorn trains a conditional generator by minimizing a semi-debiased Sinkhorn divergence and sanitizing gradients with respect to generated images, rather than parameter gradients. DPMI first trains a non-private public generator, inverts private samples into its latent space, and then trains a low-dimensional DP-GAN on those latent codes. DPPM replaces generator learning with private score estimation via sliced score matching and Hamiltonian dynamics. DPDFD converts a pretrained teacher into a privacy-preserving student through a generator and a DP mechanism on student-output gradients. RAPID shifts the focus to latent diffusion models and uses retrieval-augmented training so that only later diffusion steps are optimized privately (Cao et al., 2021, Chen et al., 2022, Liu et al., 2023, Liu et al., 2023, Jiang et al., 18 Feb 2025).

This suggests that “differentially private generative models” is best understood as a design space defined less by a single architecture than by where privacy enters: the optimizer, the critic interface, the latent representation, the score-estimation query, or the data collection process.

3. Privacy mechanisms and training strategies

The most common mechanism is DP-SGD. In its standard form, a minibatch is sampled, per-example gradients $(\varepsilon,\delta)$0 are computed, clipped to a norm bound $(\varepsilon,\delta)$1,

$(\varepsilon,\delta)$2

and Gaussian noise is added to the batch aggregate. One formulation writes

$(\varepsilon,\delta)$3

This pattern appears in DP-AuGM, DP-VaeGM, DP-InfoGAN, DPMI, DP-NetGAN, activity-diary synthesis, and many GAN baselines (Chen et al., 2018, Mugunthan et al., 2020, Chen et al., 2022, Zheng et al., 2021, Badu-Marfo et al., 2020).

Several works privatize only the discriminator or critic. DP-InfoGAN explicitly argues that only discriminator training must be differentially private; the generator and the auxiliary $(\varepsilon,\delta)$4 network are private by post-processing. DPGAN and dp-GAN make the same structural choice in WGAN-style training. DP-NetGAN applies the same principle to graph generation, where the per-example unit is an edge and the resulting guarantee is edge-differential privacy (Mugunthan et al., 2020, Xie et al., 2018, Zhang et al., 2018, Zheng et al., 2021).

Alternative mechanisms privatize smaller interfaces. G-PATE trains non-private teacher discriminators on disjoint data partitions and privatizes only the information sent from teachers to the student generator via DPGradAgg, which combines random projection, discretization, and Confident-GNMax voting. DPDFD does not perturb parameter gradients directly; it normalizes student-output gradients, adds Gaussian noise, and then updates the student and generator from those privatized outputs. DPPM does not use DP-SGD at all: it privatizes projection vectors in sliced score matching with randomized response, proving pure $(\varepsilon,\delta)$5-DP for the score-learning process (Long et al., 2019, Liu et al., 2023, Liu et al., 2023).

Optimal-transport methods privatize a different object again. DP-Sinkhorn clips and noises gradients with respect to generated images, not model parameters, and proves that releasing the sanitized image-gradient matrix yields $(\varepsilon,\delta)$6-RDP for one step. The locally private OT framework pushes privacy even further upstream: the data are privatized by Laplace or Gaussian mechanisms before training, and the training algorithm is only post-processing of those locally private samples (Cao et al., 2021, Reshetova et al., 2023).

RAPID modifies the diffusion pipeline rather than the noise mechanism. It still uses Poisson subsampling, per-sample clipping, Gaussian noise, and RDP accounting, but only for later denoising steps. Early trajectory segments are replaced by retrieved public surrogates from a knowledge base, reducing memory footprint, inference cost, and the burden on DP-SGD (Jiang et al., 18 Feb 2025).

4. Utility, evaluation, and deployment

Utility is measured differently across domains. In DP-AuGM and DP-VaeGM, the metric is downstream classification accuracy on held-out test sets; no distributional metric such as FID is reported. For DP-AuGM, public-only MNIST accuracy is 0.89, while DP-AuGM at $(\varepsilon,\delta)$7 reaches 0.95; the same paper reports gains of +14 points on Adult Census, +14 points on Hospital data, and +34 points on Malware over public-only training. On MNIST, DP-AuGM at $(\varepsilon,\delta)$8 is within 3% of baseline, and DP-VaeGM yields accuracy $(\varepsilon,\delta)$9 for $d,d' \subseteq \mathcal{D}$0 and $d,d' \subseteq \mathcal{D}$1 for $d,d' \subseteq \mathcal{D}$2 (Chen et al., 2018).

Image-generation papers typically report FID, Inception Score, or classification on synthetic data. DPMI reports that, under the same privacy guarantee, it outperforms image-space DP-GAN on CIFAR-10, SVHN, and ASDF, with improvements of about 39 percentage points in CIFAR-10 accuracy at $d,d' \subseteq \mathcal{D}$3 and 36 points in SVHN accuracy at $d,d' \subseteq \mathcal{D}$4. DP-Sinkhorn reports FID 48.4 and CNN accuracy 83.2% on MNIST at $d,d' \subseteq \mathcal{D}$5-DP, and FID 189.5 with CNN accuracy 76.3% on CelebA at $d,d' \subseteq \mathcal{D}$6-DP, outperforming several adversarial baselines in that study. DPPM reports CelebA FID 52.45 and IS 1.53 at $d,d' \subseteq \mathcal{D}$7, while supporting resolutions up to $d,d' \subseteq \mathcal{D}$8 (Chen et al., 2022, Cao et al., 2021, Liu et al., 2023).

G-PATE frames utility both as downstream accuracy and as image quality under strict privacy. It reports that it is the first work able to generate high-dimensional image data with high data utility under limited privacy budgets $d,d' \subseteq \mathcal{D}$9, and on several image datasets it substantially outperforms DP-GAN, PATE-GAN, and GS-WGAN at $S\subseteq \mathcal{R}$0. RAPID extends this trajectory to DP diffusion models, reporting markedly better FID than DPDM and DP-LDM on MNIST, CIFAR-10, and CelebA under the same privacy guarantees, while also reducing batch-size requirements and skipping a substantial fraction of sampling steps (Long et al., 2019, Jiang et al., 18 Feb 2025).

Domain-specific deployments broaden the notion of utility. DP-AuGM and DP-VaeGM are integrated with machine learning as a service and federated learning, with accuracy drop $S\subseteq \mathcal{R}$1 in MLaaS and $S\subseteq \mathcal{R}$2 in federated learning under the reported settings. DP-NetGAN evaluates graph statistics such as maximum degree, assortativity, triangle count, power-law exponent, clustering coefficient, characteristic path length, and link-prediction AUC/AP. The activity-diary model evaluates statistical distributions, pairwise correlations, full joint distributions, and tour distance distributions. The mixture-of-generative-neural-networks framework evaluates arbitrary counting queries on CDR and transit datasets and reports substantially smaller relative error than MWEM (Chen et al., 2018, Zheng et al., 2021, Badu-Marfo et al., 2020, Acs et al., 2017).

5. Attacks, misconceptions, and limitations

A recurring misconception is that differential privacy eliminates all recognizable structure in synthetic data. The literature is more precise: differential privacy formally protects membership, not the overall shape of the learned distribution. This distinction is made explicitly in the DP-AuGM/DP-VaeGM work, which conjectures that defense against model inversion and GAN-based collaborative attacks comes substantially from data perturbation or representation distortion, not from DP per se. Empirically, DP-AuGM is robust to model inversion, membership inference, and GAN-based leakage, whereas DP-VaeGM is robust to membership inference but not to inversion or GAN-based attacks because it synthesizes samples in the original feature space (Chen et al., 2018).

Other papers rely primarily on formal guarantees rather than direct attack audits. DP-InfoGAN and DPD-InfoGAN emphasize that privacy should limit membership inference and related attacks, but they do not run empirical attack evaluations. DP-Sinkhorn states that formal $S\subseteq \mathcal{R}$3-DP implies robustness in the DP sense but likewise does not simulate membership inference. DPPM and RAPID focus on generative quality and privacy accounting, not explicit inversion or extraction attacks (Mugunthan et al., 2020, Cao et al., 2021, Liu et al., 2023, Jiang et al., 18 Feb 2025).

Limitations are method-specific and often severe under strong privacy. DP-VaeGM is evaluated only on MNIST and is unstable or lower quality at very small $S\subseteq \mathcal{R}$4. G-PATE may require thousands of teacher discriminators and careful tuning of projection dimension, bin count, and confidence thresholds. DP-InfoGAN reports degraded disentanglement as $S\subseteq \mathcal{R}$5 decreases. DPMI depends on a useful public generator and leaves model inversion itself non-private because making each inversion DP would destroy utility. DP-NetGAN protects edges, not nodes. Activity-diary synthesis shows that long sequences and exact geospatial outputs remain difficult, and the paper does not report explicit accountant-derived $S\subseteq \mathcal{R}$6 values. RAPID assumes available public data with sufficiently relevant trajectory structure (Chen et al., 2018, Long et al., 2019, Mugunthan et al., 2020, Chen et al., 2022, Zheng et al., 2021, Badu-Marfo et al., 2020, Jiang et al., 18 Feb 2025).

6. Applications and research directions

Applications already span cloud training, federated learning, graph release, mobility synthesis, and data-free model conversion. DP-AuGM and DP-VaeGM provide a reusable DP “data layer” for MLaaS and federated learning. DPD-InfoGAN shows a distributed setting with a shared $S\subseteq \mathcal{R}$7 network that allows clients to learn attributes present in other clients’ datasets in a privacy-preserving manner. DP-NetGAN extends the paradigm to graph synthesis under edge-DP. The Montréal activity-diary system shows that full micro-level travel diaries can be synthesized with structured socio-economic features and longitudinal tour activities in a differentially private manner. DPDFD shows that a privacy-preserving student and a DP generator can be obtained without access to the teacher’s original training data (Chen et al., 2018, Mugunthan et al., 2020, Zheng et al., 2021, Badu-Marfo et al., 2020, Liu et al., 2023).

Recent work indicates two particularly strong directions. One is replacing adversarial training with objectives that tolerate privacy noise better: optimal transport in DP-Sinkhorn, latent-space simplification in DPMI, and private score estimation in DPPM all target the instability of GAN-based DP learning. The other is exploiting public information structurally rather than only as warm start: the local-DP OT framework learns from already-privatized samples, and RAPID uses public trajectory retrieval to shift only later diffusion steps into the DP regime (Cao et al., 2021, Chen et al., 2022, Liu et al., 2023, Reshetova et al., 2023, Jiang et al., 18 Feb 2025).

Taken together, these results indicate that differentially private generative modeling is no longer a single recipe of “GAN plus DP-SGD.” It includes representation release, private latent modeling, teacher–student aggregation, optimal-transport objectives, score matching with randomized response, locally private training, and retrieval-augmented diffusion. A plausible implication is that future progress will continue to come from reducing the amount of the generative pipeline that must directly absorb privacy noise, while preserving the post-processing pathway that makes a trained generator or synthetic dataset reusable across many downstream tasks.