Differentially private (DP) synthetic data enables the use of sensitive datasets while providing strong privacy guarantees. Recently, Private Evolution (PE) has emerged as a promising framework for generating DP synthetic data using only inference APIs of foundation models. However, suitable foundation models are not always available for every private data domain. In this paper, we show that PE is more general than previously understood and can incorporate APIs beyond foundation models. In particular, we show that state-of-the-art non-neural-network data synthesizers, including computer graphics-based image generators and physics simulation tools (which we refer to as simulators), integrate naturally into PE. We call the resulting method Sim-PE. Sim-PE broadens the applicability of PE while improving performance. For image synthesis, Sim-PE improves downstream classification accuracy by up to 3x, reduces FID by up to 80%, and is significantly more efficient. We further show that simulators and foundation models can be seamlessly combined within Sim-PE for additional gains. Beyond performance improvements, Sim-PE enables new DP applications that are difficult or impossible for existing methods, including generating DP control signals whose execution reproduces the distribution of private observations. The code is open-sourced in the Private Evolution Python library: https://github.com/microsoft/DPSDA
Figures & tables
Figure 1: Unlike prior PE work that relies solely on foundation models, we show that PE is also compatible with non-neural-network data synthesis tools, which we call simulators . This greatly broadens PE ’s applicability, enables SoTA simulators for DP data synthesis, and unlocks new DP applications.
Figure 2: The real and generated images on MNIST under the “ ClassUnavail ” setting. Each row corresponds to one class. The simulator generates images that are very different from the real ones and are from the incorrect classes. Starting from these bad images, Sim-PE can effectively guide the generation of the simulator towards high-quality images with correct classes.
Table 1: Accuracy and FID. The best between PE methods is in bold , and the best between all methods is underlined . “Simulator” refers to samples from the simulator’s RANDOM_API . Results other than Sim-PE and Simulator are taken from Gong et al. (2025) .
Algorithm
FID ↓
Classification Acc. ↑
ϵ=1
ϵ=10
ϵ=1
ϵ=10
PE with foundation models
23.4
22.0
70.5
74.2
PE with weak simulators (i.e., Sim-PE )
101.4
99.5
62.6
63.2
PE with both
15.0
11.9
72.7
78.1
Table 2: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on CelebA. The best results are highlighted in bold. Using a combination of both (weak) simulators and foundation models outperforms using either one alone.
Figure 3: The real and generated images on CelebA. The top rows correspond to the “female” class, and the bottom rows correspond to the “male” class. The simulator generates images with incorrect classes. However, starting from these misclassified images, Sim-PE effectively selects those that better match the correct class.
Figure 4: The quality of Sim-PE ’s generated data improves across iterations in the CartPole environment ( ϵ=1 ).
Figure 5: The quality of Sim-PE ’s generated data improves with more privacy budget in the CartPole environment.
Appendix figures & tables24 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: FID of the nearest neighbors of the selected and unselected samples.
Categorical Parameter ( ξ )
Feasible Set ( Ξ )
Variation Degrees ( β ) across PE Iterations
Font
1 - 3589
0.8, 0.4, 0.2, 0.0
Text
‘0’ - ‘9’
0, 0, 0, 0
Appendix
Table 3: The configurations of the categorical parameters in MNIST with Text Rendering Program experiments.
Numerical Parameter ( ϕ )
Feasible Set ( Φ )
Variation Degrees ( α ) across PE Iterations
Font size
[10, 30]
5, 4, 3, 2
Font rotation
[-30, 30]
9, 7, 5, 3
Stroke width
[0, 2]
1, 1, 0, 0
Appendix
Table 4: The configurations of the numerical parameters in MNIST with Text Rendering Program experiments.
Figure 7: The real and generated images on CelebA. The simulator is a weak rule-based avatar generator Escartín (2021) significantly different from the real dataset. The top rows correspond to the “female” class, and the bottom rows correspond to the “male” class. The simulator generates images with incorrect classes. Sim-PE tends to generate faces with long hair for the female class and short hair for the male class (correctly), but the generated images have mode collapse issues.
Figure 8: Sim-PE (using DigiFace-1M )’s FID on CelebA improves over the course of the PE iterations.
Figure 9: The number of unique generated samples in each iteration of Sim-PE (using DigiFace-1M ) on CelebA.
Iteration
Accuracy
1-way TVD
2-way TVD
0
56.48
0.29
0.46
1
56.48
0.29
0.45
2
56.48
0.28
0.44
3
56.75
0.27
0.43
4
57.08
0.27
0.42
5
58.28
0.26
0.41
Appendix
Table 5: Performance of Sim-PE on networking data across iterations.
Algorithm
FID ↓
Classification Acc. ↑
ϵ=1
ϵ=10
ϵ=1
ϵ=10
DP_NN_HISTOGRAM on Ssyn
36.2
29.3
61.5
71.9
DP_NN_HISTOGRAM on cluster centers of Ssyn
26.4
18.3
74.7
77.7
Sim-PE
24.7
20.8
80.0
82.5
Appendix
Table 6: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on CelebA. The best results are highlighted in bold. Sim-PE outperforms the baselines in most metrics.
Figure 10: Sim-PE ’s FID and accuracy generally improve over the course of the iterations.
Figure 11: Accuracy and FID on MNIST with different α,β schedules ( ϵ=10 ). The “base” parameter schedule across iterations is: (a) font size’s α=[5,4,3,2] , (b) rotation degree’s α=[9,7,5,3] , (c) stroke width’s α=[1,1,0,0] , (d) font’s β=[0.8,0.4,0.2,0.0] , (e) text’s β=[0.8,0.4,0.2,0.0] . “Small” (“large”) means fixing α/β to be the smallest (largest) value across iterations. For example, the unit under “font variation” and “large” indicates the results when we set font’s β=[0.8,0.8,0.8,0.8] .
Figure 12: Accuracy and FID on CelebA using simulator-generated data with different γ schedules ( ϵ=10 ). The “base” parameter schedule across iterations is [1000,500,200,100,50,20] . “Small” (“large”) means fixing γ to be the smallest (largest) value across iterations. For example, the unit under “large” indicates the results when we set γ=[1000,1000,1000,1000,1000,1000] .
Diffusion Start
FID ( ε=1 )
Acc ( ε=1 )
FID ( ε=10 )
Acc ( ε=10 )
After iter 0
14.2
74.3
13.2
73.6
After iter 1
15.0
72.7
11.9
78.1
After iter 2
16.0
73.6
14.2
76.5
Appendix
Table 7: Comparison of FID and accuracy with different diffusion start iterations for ε=1 and ε=10 .
Range
Metric
Iter=0
Iter=1
Iter=2
Iter=3
Iter=4
[15, 25)
Accuracy
13.6
71.6
81.4
87.4
84.8
FID
88.1
61.8
45.3
31.1
22.4
[10, 30)
Accuracy
16.6
76.7
86.7
89.5
89.1
FID
85.8
57.0
42.4
28.7
20.7
[5, 35)
Accuracy
13.3
66.0
82.8
90.6
86.2
FID
87.2
58.2
41.4
28.7
20.2
Appendix
Table 8: Effect of font size range on accuracy and FID.
Range
Metric
Iter=0
Iter=1
Iter=2
Iter=3
Iter=4
[–15, 15]
Accuracy
14.5
75.7
86.0
88.3
87.7
FID
83.1
56.7
42.3
28.6
19.7
[–30, 30]
Accuracy
16.6
76.7
86.7
89.5
89.1
FID
85.8
57.0
42.4
28.7
20.7
[–60, 60]
Accuracy
13.3
72.3
83.0
88.5
86.3
FID
86.6
56.0
40.9
27.5
19.4
Appendix
Table 9: Effect of rotation degree range on accuracy and FID.
Range
Metric
Iter=0
Iter=1
Iter=2
Iter=3
Iter=4
[0, 1]
Accuracy
12.8
70.0
87.6
91.5
91.3
FID
69.0
48.7
35.3
25.1
18.1
[0, 2]
Accuracy
16.6
76.7
86.7
89.5
89.1
FID
85.8
57.0
42.4
28.7
20.7
[0, 3]
Accuracy
20.4
71.6
75.4
84.6
85.2
FID
109.1
67.6
47.4
31.3
22.4
Appendix
Table 10: Effect of stroke width range on accuracy and FID.
#Samples
FID
Accuracy
30,000
14.4
87.2
60,000
20.7
89.1
120,000
32.9
85.4
Appendix
Table 11: Performance comparison with different numbers of samples.
Figure 13: FID between the 5 constructed subsets of DigiFace-1M and CelebA.
Figure 14: Results of Sim-PE -generated data using the subsets in Fig. 13 ( ϵ=10 ).
Figure 15: The real and generated images on MNIST under the “ ClassAvail ” setting. Each row corresponds to one class. The simulator generates images that are very different from the real ones. Starting from these bad images, Sim-PE can effectively guide the generation of the simulator towards high-quality images that are more similar to real data.
Algorithm
FID ↓
Classification Acc. ↑
ϵ=1
ϵ=10
ϵ=1
ϵ=10
Simulator
86.0 ( ϵ=0 )
92.2 ( ϵ=0 )
Sim-PE
20.7
8.6
93.9
95.5
Appendix
Table 12: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on MNIST under the “ ClassAvail ” setting. See Tab. 1 for results under the “ ClassUnavail ” setting for reference.
Time
Peak CPU Memory
Peak GPU Memory
PE
RANDOM_API
3920.30 seconds (GPU)
15292.98 MB
13859.10 MB
VARIATION_API
2422.44 seconds (GPU)
15880.25 MB
16203.89 MB
Sim- PE
RANDOM_API
27.17 seconds (CPU)
758.90 MB
0 MB
VARIATION_API
18.51 seconds (CPU)
1083.11 MB
0 MB
Appendix
Table 13: Efficiency comparison of PE and Sim-PE on the MNIST dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .
Time
Peak CPU Memory
Peak GPU Memory
PE
RANDOM_API
39272.33 seconds (GPU)
15293.29 MB
13859.10 MB
VARIATION_API
31028.24 seconds (GPU)
15879.47 MB
16203.89 MB
Sim- PE
RANDOM_API
0.04 seconds (CPU)
61416.62 MB
0 MB
VARIATION_API
0.03 seconds (CPU)
61427.29 MB
0 MB
Sim- PE Setup
1450.94 seconds (GPU)
61420.69 MB
3728.16 MB
Appendix
Table 14: Efficiency comparison of PE and Sim-PE (with data access) on the CelebA dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .
Time
Peak Memory
Peak GPU Memory
PE
RANDOM_API
39272.33 seconds (GPU)
15293.29 MB
13859.10 MB
VARIATION_API
31028.24 seconds (GPU)
15879.47 MB
16203.89 MB
Sim- PE
RANDOM_API
46.69 seconds (CPU)
811.72 MB
0 MB
VARIATION_API
48.78 seconds (CPU)
1067.93 MB
0 MB
Appendix
Table 15: Efficiency comparison of PE and Sim-PE (with code access) on the CelebA dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .
MNIST
CelebA ( Sim-PE with data access)
CelebA ( Sim-PE with code access)
PE
22243.32
279695.52
279695.52
Sim- PE
607.95
441.63
880.38
Appendix
Table 16: The runtime (seconds) of one iteration in PE and Sim-PE . Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .
Differentially private (DP) fine-tuning of large language models (LLMs) requires massive compute and full model access, which rules out state-of-the-art proprietary APIs for general users. Generating DP synthetic data offers a practical workaround. This approach also allows for transparent exploratory data analysis and arbitrary reuse across downstream tasks, sidestepping the rigid constraints of a model's parameter space. Private Evolution (PE) provides a promising API-based framework for generating this data, but its success relies heavily on initialization. If the private data distribution falls too far outside the foundation model's pre-training priors -- a common issue in highly specialized domain -- PE struggles to align with the target data. This misalignment causes poor convergence, degraded utility, and wasted API calls. To solve this initialization bottleneck, we introduce Metadata Augmented Private Language Evolution (MAPLE). MAPLE extracts DP tabular metadata and uses in-context learning to firmly ground the initial synthetic distribution in the target domain. Our evaluations on domain-specific text generation tasks show that MAPLE yields a strictly better privacy-utility trade-off, converges significantly faster, and sharply reduces API costs compared to baseline PE methods.
Eli Chien, Yuzheng Hu, Ryan McKenna +3
National Taiwan University · University of Illinois Urbana-Champaign · Google Research +1
This paper investigates the problem of generating synthetic tabular data with differential privacy (DP) guarantees, enabling data sharing in sensitive domains. Despite extensive study, state-of-the-art methods often focus on minimizing low-order marginal query errors and overlook the challenges posed by high-order correlations. To address this gap, we extend the Private Evolution (PE) framework, originally developed for DP-compliant image and text synthesis, to tabular data. We introduce Tab-PE -- an algorithm for synthetic tabular data generation under DP constraints. Tab-PE iteratively improves a candidate dataset via an evolutionary process that leverages tabular-specialized operators to produce variations, privately scores them, and selects the highest-quality samples to retain and propagate. In contrast to the original PE, which relies on large foundation models, Tab-PE employs heuristic operators with significantly lower computational costs, making PE more practical and scalable for tabular data. Through extensive experiments on real-world and simulation datasets, we demonstrate that Tab-PE substantially outperforms prior baselines on datasets exhibiting high-order correlations. Compared to the best baseline -- AIM, Tab-PE improves classification accuracy by up to 10% while running 28 times faster.
LLM-based simulators offer a promising path for generating complex synthetic data where traditional differentially private (DP) methods struggle with high-dimensional user profiles. But can LLMs faithfully reproduce statistical distributions from DP-protected inputs? We evaluate this using PersonaLedger, an agentic financial simulator, seeded with DP synthetic personas derived from real user statistics. We find that PersonaLedger achieves promising fraud detection utility (AUC 0.70 at epsilon=1) but exhibits significant distribution drift due to systematic LLM biases--learned priors overriding input statistics for temporal and demographic features. These failure modes must be addressed before LLM-based methods can handle the richer user representations where they might otherwise excel.