Generating tabular data under differential privacy (DP) protection ensures theoretical privacy guarantees but poses challenges for training machine learning models, primarily due to the need to capture complex structures under noisy supervision signals. Recently, pre-trained Large Language Models (LLMs) -- even those at the scale of GPT-2 -- have demonstrated great potential in synthesizing tabular data. However, their applications under DP constraints remain largely unexplored. In this work, we address this gap by applying DP techniques to the generation of synthetic tabular data. Our findings shows that LLMs face difficulties in generating coherent text when fine-tuned with DP, as privacy budgets are inefficiently allocated to non-private elements like table structures. To overcome this, we propose DP-2Stage, a two-stage fine-tuning framework for differentially private tabular data generation. The first stage involves non-private fine-tuning on a pseudo dataset, followed by DP fine-tuning on a private dataset. Our empirical results show that this approach improves performance across various settings and metrics compared to directly fine-tuned LLMs in DP contexts. We release our code and setup at https://github.com/tejuafonja/DP-2Stage.
Hazy（Hazy公司）；University of Edinburgh（爱丁堡大学）；University College London（伦敦大学学院）
We propose a general, flexible, and scalable framework dpart, an open source Python library for differentially private synthetic data generation. Central to the approach is autoregressive modelling -- breaking the joint data distribution to a sequence of lower-dimensional conditional distributions, captured by various methods such as machine learning models (logistic/linear regression, decision trees, etc.), simple histogram counts, or custom techniques. The library has been created with a view to serve as a quick and accessible baseline as well as to accommodate a wide audience of users, from…
Austin Health（奥斯汀健康）；University of Melbourne（墨尔本大学）
We propose an approach for adapting the DeBERTa model for electronic health record (EHR) tasks using domain adaptation. We pretrain a small DeBERTa model on a dataset consisting of MIMIC-III discharge summaries, clinical notes, radiology reports, and PubMed abstracts. We compare this model's performance with a DeBERTa model pre-trained on clinical texts from our institutional EHR (MeDeBERTa) and an XGBoost model. We evaluate performance on three benchmark tasks for emergency department outcomes using the MIMIC-IV-ED dataset. We preprocess the data to convert it into text format and generate fo…
Maastricht University（马斯特里赫特大学）；Institute of Data Science（数据科学研究所）；Brightlands Institute of Smart Society（布赖特兰兹智能社会研究所）
Despite the remarkable success of Generative Adversarial Networks (GANs) on text, images, and videos, generating high-quality tabular data is still under development owing to some unique challenges such as capturing dependencies in imbalanced data, optimizing the quality of synthetic patient data while preserving privacy. In this paper, we propose DP-CGANS, a differentially private conditional GAN framework consisting of data transformation, sampling, conditioning, and networks training to generate realistic and privacy-preserving tabular data. DP-CGANS distinguishes categorical and continuous…
Learning from continuous data streams via classification/regression is prevalent in many domains. Adapting to evolving data characteristics (concept drift) while protecting data owners' private information is an open challenge. We present a differentially private ensemble solution to this problem with two distinguishing features: it allows an \textit{unbounded} number of ensemble updates to deal with the potentially never-ending data streams under a fixed privacy budget, and it is \textit{model agnostic}, in that it treats any pre-trained differentially private classification/regression model …
Diferentially private (DP) synthetic datasets are a powerful approach for training machine learning models while respecting the privacy of individual data providers. The effect of DP on the fairness of the resulting trained models is not yet well understood. In this contribution, we systematically study the effects of differentially private synthetic data generation on classification. We analyze disparities in model utility and bias caused by the synthetic dataset, measured through algorithmic fairness metrics. Our first set of results show that although there seems to be a clear negative corr…
Machine learning practitioners frequently seek to leverage the most informative available data, without violating the data owner's privacy, when building predictive models. Differentially private data synthesis protects personal details from exposure, and allows for the training of differentially private machine learning models on privately generated datasets. But how can we effectively assess the efficacy of differentially private synthetic data? In this paper, we survey four differentially private generative adversarial networks for data synthesis. We evaluate each of them at scale on five s…
Indian Institute of Science（印度科学研究院）；Wayne State University（韦恩州立大学）；The Ohio State University（俄亥俄州立大学）
In this paper, we study the problem of regret minimization in reinforcement learning (RL) under differential privacy constraints. This work is motivated by the wide range of RL applications for providing personalized service, where privacy concerns are becoming paramount. In contrast to previous works, we take the first step towards non-tabular RL settings, while providing a rigorous privacy guarantee. In particular, we consider the adaptive control of differentially private linear quadratic (LQ) systems. We develop the first private RL algorithm, PRL, which is able to attain a sub-linear regr…
Differentially Private Neural Tangent Kernels for Privacy-Preserving Data Generation
University of British Columbia（不列颠哥伦比亚大学）；ETH Zurich（苏黎世联邦理工学院）；Alberta Machine Intelligence Institute（阿尔伯塔省机器智能研究所）；Technical University of Denmark（丹麦技术大学）
Max Planck Institute for Intelligent Systems（马克斯·普朗克智能系统研究所）；University of Tübingen（图宾根大学）；ETH Zurich（苏黎世联邦理工学院）
We propose a differentially private data generation paradigm using random feature representations of kernel mean embeddings when comparing the distribution of true data with that of synthetic data. We exploit the random feature representations for two important benefits. First, we require a minimal privacy cost for training deep generative models. This is because unlike kernel-based distance metrics that require computing the kernel matrix on all pairs of true and synthetic data points, we can detach the data-dependent term from the term solely dependent on synthetic data. Hence, we need to pe…
Auditing mechanisms for differential privacy use probabilistic means to empirically estimate the privacy level of an algorithm. For private machine learning, existing auditing mechanisms are tight: the empirical privacy estimate (nearly) matches the algorithm's provable privacy guarantee. But these auditing techniques suffer from two limitations. First, they only give tight estimates under implausible worst-case assumptions (e.g., a fully adversarial dataset). Second, they require thousands or millions of training runs to produce non-trivial statistical estimates of the privacy leakage. This w…
Randomized Least Squares Value Iteration itself is Joint Differentially Private
Laboratoire d’Informatique Fondamentale d’Orléans (LIFO), Université d’Orléans（奥尔良基础信息学实验室（LIFO），奥尔良大学）；College of Control Science and Engineering, Zhejiang University（浙江大学控制科学与工程学院）；Department of Computer Science, University of Copenhagen（哥本哈根大学计算机科学系）
Huazhong University of Science and Technology（华中科技大学）；University of Florida（佛罗里达大学）
With the rapid growth in multimedia services and the enormous offers of video contents in online social networks, users have difficulty in obtaining their interests. Therefore, various personalized recommendation systems have been proposed. However, they ignore that the accelerated proliferation of social media data has led to the big data era, which has greatly impeded the process of video recommendation. In addition, none of them has considered both the privacy of users' contexts (e,g., social status, ages and hobbies) and video service vendors' repositories, which are extremely sensitive an…
DP-TLDM: Differentially Private Tabular Latent Diffusion Model
TU Delft, Delft, Netherlands , University of Neuchâtel, Neuchâtel, Switzerland Universidad de los Andes, Bogotá, Colombia Centrum Wiskunde \& Informatica, Amsterdam, Netherlands
Language Modeling on Tabular Data: A Survey of Foundations, Techniques and Evolution
Saw Swee Hock School of Public Health, National University of Singapore（新加坡国立大学陈笃生公共卫生学院）；Institute of Data Science, National University of Singapore（新加坡国立大学数据科学研究院）
School of Electrical and Computer Engineering, Purdue University（普渡大学电气与计算机工程学院）；Department of Computer Science and Engineering, Yonsei University（延世大学计算机科学与工程系）
Lumberjack: Better Differentially Private Random Forests through Heavy Hitter Detection in Trees
PreMeDICaL；Inria（法国国家信息与自动化研究所）；Université de Montpellier（蒙彼利埃大学）；INSERM（国家医学研究院）；Technical University of Munich（慕尼黑技术大学）
本文提出Lumberjack算法，通过构建大规模随机决策树并应用隐私保护的剪枝技术，显著提升了差分隐私随机森林的实用性。该方法引入了新的（ε，δ）-DP Heavy Hitter检测算法，具有O_{ε,δ}(√log h)的误差，使得树的高度可以更深，从而在隐私约束下提高表达能力。实验表明，Lumberjack在基准数据集上优于现有差分隐私随机森林方法，特别是在隐私预算下的隐私-效用权衡上取得显著改进。
University of Washington（华盛顿大学）；Google Research（谷歌研究院）
We study the canonical statistical task of computing the principal component from $n$ i.i.d.~data in $d$ dimensions under $(\varepsilon,δ)$-differential privacy. Although extensively studied in literature, existing solutions fall short on two key aspects: ($i$) even for Gaussian data, existing private algorithms require the number of samples $n$ to scale super-linearly with $d$, i.e., $n=Ω(d^{3/2})$, to obtain non-trivial results while non-private PCA requires only $n=O(d)$, and ($ii$) existing techniques suffer from a non-vanishing error even when the randomness in each data point is arbitrar…
Differentially Private Non Parametric Copulas: Generating synthetic data with non parametric copulas under privacy guarantees
School of Applied Sciences and Engineering, Universidad EAFIT（应用科学与工程学院，埃法特大学）；Digital Health and Biomedical Technologies, Vicomtech Foundation, Basque Research and Technology Alliance (BRTA)（数字健康与生物医学技术，维科姆科技基金会，巴斯克研究与技术联盟（BRTA））；eHealth Group, Biogipuzkoa Health Research Institute（eHealth组，比戈普西亚健康研究 institutes）
Differential Privacy (DP) is the leading approach to privacy preserving deep learning. As such, there are multiple efforts to provide drop-in integration of DP into popular frameworks. These efforts, which add noise to each gradient computation to make it DP, rely on composition theorems to bound the total privacy loss incurred over this sequence of DP computations. However, existing composition theorems present a tension between efficiency and flexibility. Most theorems require all computations in the sequence to have a predefined DP parameter, called the privacy budget. This prevents the des…
Adapting to Fragmented and Evolving Data: A Fisher Information Perspective
School of Mathematics and Computer Science, Institute of Business Administration（数学与计算机科学学院，商业行政研究所）；National University of Computer and Emerging Sciences（计算机与新兴科学国立大学）
Indian Institute of Science（印度科学理工学院）；Wayne State University（韦恩州立大学）
We study regret minimization in finite horizon tabular Markov decision processes (MDPs) under the constraints of differential privacy (DP). This is motivated by the widespread applications of reinforcement learning (RL) in real-world sequential decision making problems, where protecting users' sensitive and private information is becoming paramount. We consider two variants of DP -- joint DP (JDP), where a centralized agent is responsible for protecting users' sensitive data and local DP (LDP), where information needs to be protected directly on the user side. We first propose two general fram…
Max Planck Institute for Intelligent Systems（马克斯·普朗克智能系统研究所）；University of British Columbia（不列颠哥伦比亚大学）
Kernel mean embedding is a useful tool to represent and compare probability measures. Despite its usefulness, kernel mean embedding considers infinite-dimensional features, which are challenging to handle in the context of differentially private data generation. A recent work proposes to approximate the kernel mean embedding of data distribution using finite-dimensional random features, which yields analytically tractable sensitivity. However, the number of required random features is excessively high, often ten thousand to a hundred thousand, which worsens the privacy-accuracy trade-off. To i…
University of Warwick（华威大学）；Meta AI；University of Virginia（弗吉尼亚大学）；University of Wisconsin-Madison（威斯康星大学麦迪逊分校）
There is great demand for scalable, secure, and efficient privacy-preserving machine learning models that can be trained over distributed data. While deep learning models typically achieve the best results in a centralized non-secure setting, different models can excel when privacy and communication constraints are imposed. Instead, tree-based approaches such as XGBoost have attracted much attention for their high performance and ease of use; in particular, they often achieve state-of-the-art results on tabular data. Consequently, several recent works have focused on translating Gradient Boost…
