Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

Zinan Lin; Tadas Baltrusaitis; Wenyu Wang; Sergey Yekhanin

cs.LGFeb 8, 2025

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

Authors: Zinan Lin, Tadas Baltrusaitis, Wenyu Wang, Sergey Yekhanin

Organizations: Microsoft Research Redmond, WA, USA · Microsoft Cambridge, UK · Redmond, WA, USA

Abstract

Differentially private (DP) synthetic data enables the use of sensitive datasets while providing strong privacy guarantees. Recently, Private Evolution (PE) has emerged as a promising framework for generating DP synthetic data using only inference APIs of foundation models. However, suitable foundation models are not always available for every private data domain. In this paper, we show that PE is more general than previously understood and can incorporate APIs beyond foundation models. In particular, we show that state-of-the-art non-neural-network data synthesizers, including computer graphics-based image generators and physics simulation tools (which we refer to as simulators), integrate naturally into PE. We call the resulting method Sim-PE. Sim-PE broadens the applicability of PE while improving performance. For image synthesis, Sim-PE improves downstream classification accuracy by up to 3x, reduces FID by up to 80%, and is significantly more efficient. We further show that simulators and foundation models can be seamlessly combined within Sim-PE for additional gains. Beyond performance improvements, Sim-PE enables new DP applications that are difficult or impossible for existing methods, including generating DP control signals whose execution reproduces the distribution of private observations. The code is open-sourced in the Private Evolution Python library: https://github.com/microsoft/DPSDA

Figures & tables

Figure 1: Unlike prior PE work that relies solely on foundation models, we show that PE is also compatible with non-neural-network data synthesis tools, which we call simulators . This greatly broadens PE ’s applicability, enables SoTA simulators for DP data synthesis, and unlocks new DP applications.

Panel of Figure 2 — Figure 2: The real and generated images on MNIST under the “ ClassUnavail ” setting. Each row corresponds to one class. The simulator generates images that are very different from the real ones and are from the incorrect classes. Starting from these bad images, Sim-PE can effectively guide the generation of the simulator towards high-quality images with correct classes.

Table 1: Accuracy and FID. The best between PE methods is in bold , and the best between all methods is underlined . “Simulator” refers to samples from the simulator’s RANDOM_API . Results other than Sim-PE and Simulator are taken from Gong et al. (2025) .

Algorithm	FID $\downarrow$		Classification Acc. $\uparrow$
Algorithm	$\epsilon=1$	$\epsilon=10$	$\epsilon=1$	$\epsilon=10$
PE with foundation models	23.4	22.0	70.5	74.2
PE with weak simulators (i.e., Sim-PE )	101.4	99.5	62.6	63.2
PE with both	15.0	11.9	72.7	78.1

Table 2: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on CelebA. The best results are highlighted in bold. Using a combination of both (weak) simulators and foundation models outperforms using either one alone.

Panel of Figure 3 — Figure 3: The real and generated images on CelebA. The top rows correspond to the “female” class, and the bottom rows correspond to the “male” class. The simulator generates images with incorrect classes. However, starting from these misclassified images, Sim-PE effectively selects those that better match the correct class.

Panel of Figure 4 — Figure 4: The quality of Sim-PE ’s generated data improves across iterations in the CartPole environment ( $\epsilon=1$ ).

Panel of Figure 5 — Figure 5: The quality of Sim-PE ’s generated data improves with more privacy budget in the CartPole environment.

Appendix figures & tables24 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: FID of the nearest neighbors of the selected and unselected samples.

Categorical Parameter ( $\xi$ )	Feasible Set ( $\Xi$ )	Variation Degrees ( $\beta$ ) across PE Iterations
Font	1 - 3589	0.8, 0.4, 0.2, 0.0
Text	‘0’ - ‘9’	0, 0, 0, 0

Appendix

Table 3: The configurations of the categorical parameters in MNIST with Text Rendering Program experiments.

Numerical Parameter ( $\phi$ )	Feasible Set ( $\Phi$ )	Variation Degrees ( $\alpha$ ) across PE Iterations
Font size	[10, 30]	5, 4, 3, 2
Font rotation	[-30, 30]	9, 7, 5, 3
Stroke width	[0, 2]	1, 1, 0, 0

Appendix

Table 4: The configurations of the numerical parameters in MNIST with Text Rendering Program experiments.

Panel of Figure 7 — Figure 7: The real and generated images on CelebA. The simulator is a weak rule-based avatar generator Escartín (2021) significantly different from the real dataset. The top rows correspond to the “female” class, and the bottom rows correspond to the “male” class. The simulator generates images with incorrect classes. Sim-PE tends to generate faces with long hair for the female class and short hair for the male class (correctly), but the generated images have mode collapse issues.

Figure 8: Sim-PE (using DigiFace-1M )’s FID on CelebA improves over the course of the PE iterations.

Figure 9: The number of unique generated samples in each iteration of Sim-PE (using DigiFace-1M ) on CelebA.

Iteration	Accuracy	1-way TVD	2-way TVD
0	56.48	0.29	0.46
1	56.48	0.29	0.45
2	56.48	0.28	0.44
3	56.75	0.27	0.43
4	57.08	0.27	0.42
5	58.28	0.26	0.41

Appendix

Table 5: Performance of Sim-PE on networking data across iterations.

Algorithm	FID $\downarrow$		Classification Acc. $\uparrow$
Algorithm	$\epsilon=1$	$\epsilon=10$	$\epsilon=1$	$\epsilon=10$
DP_NN_HISTOGRAM on $S_{\mathrm{syn}}$	36.2	29.3	61.5	71.9
DP_NN_HISTOGRAM on cluster centers of $S_{\mathrm{syn}}$	26.4	18.3	74.7	77.7
Sim-PE	24.7	20.8	80.0	82.5

Appendix

Table 6: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on CelebA. The best results are highlighted in bold. Sim-PE outperforms the baselines in most metrics.

Panel of Figure 10 — Figure 10: Sim-PE ’s FID and accuracy generally improve over the course of the iterations.

Panel of Figure 11 — Figure 11: Accuracy and FID on MNIST with different $\alpha,\beta$ schedules ( $\epsilon=10$ ). The “base” parameter schedule across iterations is: (a) font size’s $\alpha=[5,4,3,2]$ , (b) rotation degree’s $\alpha=[9,7,5,3]$ , (c) stroke width’s $\alpha=[1,1,0,0]$ , (d) font’s $\beta=[0.8,0.4,0.2,0.0]$ , (e) text’s $\beta=[0.8,0.4,0.2,0.0]$ . “Small” (“large”) means fixing $\alpha/\beta$ to be the smallest (largest) value across iterations. For example, the unit under “font variation” and “large” indicates the results when we set font’s $\beta=[0.8,0.8,0.8,0.8]$ .

Panel of Figure 12 — Figure 12: Accuracy and FID on CelebA using simulator-generated data with different $\gamma$ schedules ( $\epsilon=10$ ). The “base” parameter schedule across iterations is $[1000,500,200,100,50,20]$ . “Small” (“large”) means fixing $\gamma$ to be the smallest (largest) value across iterations. For example, the unit under “large” indicates the results when we set $\gamma=[1000,1000,1000,1000,1000,1000]$ .

Diffusion Start	FID ( $\varepsilon=1$ )	Acc ( $\varepsilon=1$ )	FID ( $\varepsilon=10$ )	Acc ( $\varepsilon=10$ )
After iter 0	14.2	74.3	13.2	73.6
After iter 1	15.0	72.7	11.9	78.1
After iter 2	16.0	73.6	14.2	76.5

Appendix

Table 7: Comparison of FID and accuracy with different diffusion start iterations for

\varepsilon=1

and

\varepsilon=10

Range	Metric	Iter=0	Iter=1	Iter=2	Iter=3	Iter=4
[15, 25)	Accuracy	13.6	71.6	81.4	87.4	84.8
	FID	88.1	61.8	45.3	31.1	22.4
[10, 30)	Accuracy	16.6	76.7	86.7	89.5	89.1
	FID	85.8	57.0	42.4	28.7	20.7
[5, 35)	Accuracy	13.3	66.0	82.8	90.6	86.2
	FID	87.2	58.2	41.4	28.7	20.2

Appendix

Table 8: Effect of font size range on accuracy and FID.

Range	Metric	Iter=0	Iter=1	Iter=2	Iter=3	Iter=4
[–15, 15]	Accuracy	14.5	75.7	86.0	88.3	87.7
	FID	83.1	56.7	42.3	28.6	19.7
[–30, 30]	Accuracy	16.6	76.7	86.7	89.5	89.1
	FID	85.8	57.0	42.4	28.7	20.7
[–60, 60]	Accuracy	13.3	72.3	83.0	88.5	86.3
	FID	86.6	56.0	40.9	27.5	19.4

Appendix

Table 9: Effect of rotation degree range on accuracy and FID.

Range	Metric	Iter=0	Iter=1	Iter=2	Iter=3	Iter=4
[0, 1]	Accuracy	12.8	70.0	87.6	91.5	91.3
	FID	69.0	48.7	35.3	25.1	18.1
[0, 2]	Accuracy	16.6	76.7	86.7	89.5	89.1
	FID	85.8	57.0	42.4	28.7	20.7
[0, 3]	Accuracy	20.4	71.6	75.4	84.6	85.2
	FID	109.1	67.6	47.4	31.3	22.4

Appendix

Table 10: Effect of stroke width range on accuracy and FID.

#Samples	FID	Accuracy
30,000	14.4	87.2
60,000	20.7	89.1
120,000	32.9	85.4

Appendix

Table 11: Performance comparison with different numbers of samples.

Figure 13: FID between the 5 constructed subsets of DigiFace-1M and CelebA.

Panel of Figure 14 — Figure 14: Results of Sim-PE -generated data using the subsets in Fig. 13 ( $\epsilon=10$ ).

Panel of Figure 15 — Figure 15: The real and generated images on MNIST under the “ ClassAvail ” setting. Each row corresponds to one class. The simulator generates images that are very different from the real ones. Starting from these bad images, Sim-PE can effectively guide the generation of the simulator towards high-quality images that are more similar to real data.

Algorithm	FID $\downarrow$		Classification Acc. $\uparrow$
	$\epsilon=1$	$\epsilon=10$	$\epsilon=1$	$\epsilon=10$
Simulator	86.0 ( $\epsilon=0$ )		92.2 ( $\epsilon=0$ )
Sim-PE	20.7	8.6	93.9	95.5

Appendix

Table 12: Accuracy (%) of classifiers trained on synthetic images and FID of synthetic images on MNIST under the “ ClassAvail ” setting. See Tab. 1 for results under the “ ClassUnavail ” setting for reference.

		Time	Peak CPU Memory	Peak GPU Memory
PE	RANDOM_API	3920.30 seconds (GPU)	15292.98 MB	13859.10 MB
PE	VARIATION_API	2422.44 seconds (GPU)	15880.25 MB	16203.89 MB
Sim- PE	RANDOM_API	27.17 seconds (CPU)	758.90 MB	0 MB
Sim- PE	VARIATION_API	18.51 seconds (CPU)	1083.11 MB	0 MB

Appendix

Table 13: Efficiency comparison of PE and Sim-PE on the MNIST dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .

		Time	Peak CPU Memory	Peak GPU Memory
PE	RANDOM_API	39272.33 seconds (GPU)	15293.29 MB	13859.10 MB
PE	VARIATION_API	31028.24 seconds (GPU)	15879.47 MB	16203.89 MB
Sim- PE	RANDOM_API	0.04 seconds (CPU)	61416.62 MB	0 MB
Sim- PE	VARIATION_API	0.03 seconds (CPU)	61427.29 MB	0 MB
Sim- PE Setup		1450.94 seconds (GPU)	61420.69 MB	3728.16 MB

Appendix

Table 14: Efficiency comparison of PE and Sim-PE (with data access) on the CelebA dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .

		Time	Peak Memory	Peak GPU Memory
PE	RANDOM_API	39272.33 seconds (GPU)	15293.29 MB	13859.10 MB
PE	VARIATION_API	31028.24 seconds (GPU)	15879.47 MB	16203.89 MB
Sim- PE	RANDOM_API	46.69 seconds (CPU)	811.72 MB	0 MB
Sim- PE	VARIATION_API	48.78 seconds (CPU)	1067.93 MB	0 MB

Appendix

Table 15: Efficiency comparison of PE and Sim-PE (with code access) on the CelebA dataset. Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .

	MNIST	CelebA ( Sim-PE with data access)	CelebA ( Sim-PE with code access)
PE	22243.32	279695.52	279695.52
Sim- PE	607.95	441.63	880.38

Appendix

Table 16: The runtime (seconds) of one iteration in PE and Sim-PE . Tested on a Linux server with AMD EPYC 7V12 64-Core Processor and one NVIDIA RTX A6000 GPU .

Explore similar work

MAPLE: Metadata Augmented Private Language Evolution
Feb 26, 2026Eli Chien, Yuzheng Hu, Ryan McKenna +3Privacy-Preserving Language Models Synthetic Data Generation
National Taiwan University · University of Illinois Urbana-Champaign · Google Research +1
Differentially Private Synthetic Data via APIs 4: Tabular Data
Jun 6, 2026Toan Tran, Arturs Backurs, Zinan Lin +3Synthetic Data Generation Synthetic Tabular Data Generation
Emory University · Microsoft Research
Evaluating LLM Simulators as Differentially Private Data Generators
Apr 16, 2026Nassima M. Bouzid, Dehao Yuan, Nam H. Nguyen +1Synthetic Data Generation Differential Privacy
Capital One

Feb 26, 2026J/K move · Enter open · S save

MAPLE: Metadata Augmented Private Language Evolution

Eli Chien, Yuzheng Hu, Ryan McKenna, Shanshan Wu+2

National Taiwan University · University of Illinois Urbana-Champaign · Google Research+1

Privacy-Preserving Language Models Synthetic Data Generation Privacy-Preserving ML Differential Privacy Synthetic Data Generation for Language Models

Open paper AskPDF arXiv

Differentially private (DP) fine-tuning of large language models (LLMs) requires massive compute and full model access, which rules out state-of-the-art proprietary APIs for general users. Generating DP synthetic data offers a practical workaround. This approach also allows for transparent exploratory data analysis and arbitrary reuse across downstream tasks, sidestepping the rigid constraints of a model's parameter space. Private Evolution (PE) provides a promising API-based framework for generating this data, but its success relies heavily on initialization. If the private data distribution falls too far outside the foundation model's pre-training priors -- a common issue in highly specialized domain -- PE struggles to align with the target data. This misalignment causes poor convergence, degraded utility, and wasted API calls. To solve this initialization bottleneck, we introduce Metadata Augmented Private Language Evolution (MAPLE). MAPLE extracts DP tabular metadata and uses in-context learning to firmly ground the initial synthetic distribution in the target domain. Our evaluations on domain-specific text generation tasks show that MAPLE yields a strictly better privacy-utility trade-off, converges significantly faster, and sharply reduces API costs compared to baseline PE methods.

Abstract

Explore similar work

MAPLE: Metadata Augmented Private Language Evolution

Differentially Private Synthetic Data via APIs 4: Tabular Data

Evaluating LLM Simulators as Differentially Private Data Generators