Privacy Accounting for Empirical Denoisers

Key points

• Diffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns.1
• This perspective enables privacy accounting under Gaussian DP when each training example contributes to each denoising step, and under $f$-DP trade-off functions when each generated sample uses a single randomly subsampled block of the training data.1
• We also analyze the privacy loss along the denoising trajectory and show that it grows steeply near the critical window in which semantic content is formed.1
• Our results on CIFAR-10 and CelebA-64 show that the privacy of diffusion models depends not only on the training procedure, but also on sampling-time design choices such as subsampling, stopping time, and hybrid denoising.1

Sources (1)

• [1]Privacy Accounting for Empirical Denoisers
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 20, 06:30 AM

  To overcome this challenge, we construct and analyze a clipped privacy-accountable empirical denoiser, a training-free estimator of the Bayes-optimal denoiser, whose per-step sensitivity can be computed explicitly, allowing each denoising step to be a Gaussian mechanism.

  Diffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns.

Extractive summary: sentences quoted from the sources.