Differentially Private Manifold Denoising

Jiaqi Wu; Yiqing Sun; Zhigang Yao

cs.LGApr 1, 2026

Differentially Private Manifold Denoising

Authors: Jiaqi Wu, Yiqing Sun, Zhigang Yao

Organizations: Department of Statistics and Data Science, National University of Singapore

Abstract

We introduce a differentially private manifold denoising framework that allows users to exploit sensitive reference datasets to correct noisy, non-private query points without compromising privacy. The method follows an iterative procedure that (i) privately estimates local means and tangent geometry using the reference data under calibrated sensitivity, (ii) projects query points along the privately estimated subspace toward the local mean via corrective steps at each iteration, and (iii) performs rigorous privacy accounting across iterations and queries using $(\varepsilon,δ)$ -differential privacy (DP). Conceptually, this framework brings differential privacy to manifold methods, retaining sufficient geometric signal for downstream tasks such as embedding, clustering, and visualization, while providing formal DP guarantees for the reference data. Practically, the procedure is modular and scalable, separating DP-protected local geometry (means and tangents) from budgeted query-point updates, with a simple scheduler allocating privacy budget across iterations and queries. Under standard assumptions on manifold regularity, sampling density, and measurement noise, we establish high-probability utility guarantees showing that corrected queries converge toward the manifold at a non-asymptotic rate governed by sample size, noise level, bandwidth, and the privacy budget. Simulations and case studies demonstrate accurate signal recovery under moderate privacy budgets, illustrating clear utility-privacy trade-offs and providing a deployable DP component for manifold-based workflows in regulated environments without reengineering privacy systems.

Figures & tables

\varsigma=\frac{\sqrt{2\ln(c_{1}/\delta)}}{\varepsilon\cdot nh^{d}}

Algorithm 1 DP-Projector at query

\mathbf{z}

Figure 1: Synthetic manifold denoising results. (A–C) Circle, torus, and Swiss roll: geometric visualization and error trends. (D–E) Sphere error vs ambient dimension $D$ and privacy-utility tradeoff.

Figure 2: Manifold denoising preserves local geometric stability while remaining compatible with downstream biomedical risk modeling. (A) PCA embedding of the raw biomarker space, with subject-level displacement vectors induced by denoising. (B) Local geometry diagnostics showing bounded distortion and stable neighborhood structure relative to raw references. (C) Changes in out-of-sample risk discrimination across a pre-specified panel of clinically interpretable cardio-metabolic endpoints. Detailed results are provided in Fig. S.4 and Table S.3 of the Appendix . (D) Subject-level illustration linking coordinated biomarker shifts to coherent movement along a clinically meaningful risk axis.

Dataset	Original (ARI)	Nonprivate-MD (ARI)	DP-MD (ARI)
Goolam	0.734 (0.063)	0.807 (0.059)	0.805 (0.057)
Schaum2	0.681 (0.032)	0.723 (0.034)	0.737 (0.027)
Yan	0.825 (0.025)	0.862 (0.023)	0.844 (0.020)
He	0.711 (0.025)	0.744 (0.026)	0.734 (0.031)
Pollen	0.925 (0.021)	0.951 (0.014)	0.943 (0.016)
Wang	0.801 (0.023)	0.826 (0.030)	0.827 (0.029)

Table 1: Clustering performance (ARI) on single-cell RNA-seq datasets (mean (SE)).

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure S.1: Robustness under Gaussian ambient noise across different manifolds. Rows correspond to circle, Swiss roll, and torus manifolds. Left panels show reconstruction error as a function of sample size $n$ under fixed noise scale, and right panels show reconstruction error as a function of noise scale $\sigma$ under fixed sample size. Results are averaged over repeated trials; shaded regions indicate 95% confidence intervals.

Panel of Figure 6 — Figure S.2: Scalability with ambient dimension on high-dimensional spheres. (Top) Reconstruction error as a function of ambient dimension $D$ under Gaussian noise. (Bottom left) Average neighborhood size used for local geometry estimation as $D$ increases. (Bottom right) Computational runtime as a function of $D$ under bounded noise. Sample size is fixed across experiments.

Panel of Figure 7 — Figure S.3: Privacy–utility tradeoff on nontrivial manifolds. Reconstruction error as a function of the privacy budget for (top) Swiss roll and (bottom) torus manifolds. Curves compare the non-private manifold denoising method with its differentially private counterpart calibrated under the $\rho$ -zCDP mechanism.

Figure S.4: Full ICD-coded endpoint panel. Prediction changes after manifold denoising across all ICD-coded disease endpoints in the UK Biobank application. Each facet corresponds to one ICD category; full endpoint definitions are provided in Table S.2 .

Manifold	$\boldsymbol{d}$	$\boldsymbol{D}$	$\boldsymbol{n}$	$\boldsymbol{\sigma}$	$\boldsymbol{\varepsilon}$
Circle ( $\mathbb{S}^{1}$ )	1	2	10,000; 20,000; 30,000; 40,000; 50,000	0.05; 0.10; 0.20; 0.30; 0.40	0.05; 0.10; 0.30; 0.50; 0.70; 1.0; 2.0; 3.0
Torus ( $\mathbb{T}^{2}$ )	2	3	10,000; 20,000; 30,000; 40,000; 50,000	0.05; 0.10; 0.15; 0.25; 0.35	0.05; 0.10; 0.30; 0.50; 0.70; 1.0; 2.0; 3.0
Swiss roll	2	3	10,000; 20,000; 30,000; 40,000; 50,000	0.05; 0.10; 0.15; 0.25; 0.35	0.05; 0.10; 0.30; 0.50; 0.70; 1.0; 2.0; 3.0
Sphere ( $\mathbb{S}^{2}$ )	2	5; 10; 20; 50; 100	30,000	0.30	1.0

Appendix

Table S.1: Simulation parameter settings across synthetic manifold experiments. Summary of sample sizes, noise levels, ambient dimensions, and privacy budgets used in the simulation studies. For all experiments,

n

denotes the number of reference points used for local geometry estimation and

m

denotes the number of query points to be denoised. Unless otherwise stated, reference points are perturbed with noise of magnitude

O(\sigma)

and query points with noise of magnitude

O(\sqrt{\sigma})

. Bounded

\ell_{2}

noise is used by default; additional experiments under Gaussian noise with matched scale are reported in the Appendix.

Clinical label	ICD-10 codes	Axis
Other metabolic disorders (E88)	E88	Metabolic / hepatic
Fatty liver / other liver disease (K76)	K76	Metabolic / hepatic
Cholelithiasis (K80)	K80	Metabolic / hepatic
Volume depletion (E86)	E86	Renal / fluid / electrolyte
Electrolyte / acid–base disorders (E87)	E87	Renal / fluid / electrolyte
Urolithiasis / renal colic (N20–N23)	N20, N21, N22, N23	Renal / fluid / electrolyte

Appendix

Table S.2: ICD-10 endpoint panel used in the UK Biobank application. This endpoint panel was pre-specified based on established biological relationships between systemic biomarkers and disease pathophysiology prior to any denoising analysis. Endpoints are defined using first-occurrence ICD-10 codes; for grouped endpoints, the event date was taken as the earliest occurrence among listed codes. Prevalent cases (event date on or before baseline) were excluded from reference training.

Disease label	Events in reference	Events in queries	C-index (95% CI)
			Raw	Nonprivate-MD	DP-MD
Other metabolic disorders (E88)	118	2	0.590 [0.391,0.798]	0.703 [0.611,0.795]	0.751 [0.624,0.877]
Volume depletion (E86)	846	18	0.755 [0.658,0.847]	0.786 [0.701,0.865]	0.799 [0.718,0.873]
Urolithiasis/renal colic (N20–N23)	654	13	0.697 [0.545,0.844]	0.718 [0.559,0.860]	0.722 [0.571,0.866]
Sepsis (A41)	1321	27	0.659 [0.570,0.752]	0.679 [0.578,0.778]	0.677 [0.577,0.778]
Acute lower respiratory infection (J20–J22)	2959	75	0.630 [0.565,0.692]	0.649 [0.586,0.709]	0.644 [0.581,0.707]

Appendix

Table S.3: C-index with 95% confidence intervals across endpoint sets. C-index values are reported for raw features, Nonprivate-MD, and DP-MD. Confidence intervals were obtained via bootstrap.

Data	Accession Code	Tissue	# Cell Types	# Cells	# Genes
Goolam ( Goolam et al., 2016 )	E-MTAB-3321	Embryos ( M. musculus )	5	124	41428
Schaum2 ( Schaum et al., 2018 )	GSE132042	Intestine ( M. musculus )	5	1887	17985
Yan ( Yan et al., 2013 )	GSE36552	Embryonic stem cells ( H. sapiens )	6	90	20214
He ( He et al., 2022 )	E-MTAB-11265	Embryonic/fetal lungs ( H. sapiens )	5	649	16122
Pollen ( Pollen et al., 2014 )	SRP041736	Cerebral cortex ( H. sapiens )	11	249	8869
Wang ( Wang et al., 2016 )	GSE83139	Pancreatic endocrine ( H. sapiens )	7	457	19950

Appendix

Table S.4: Summary of scRNA-seq datasets used in clustering analysis.

Dataset	Original	Nonprivate-MD	DP-MD
Goolam	0.861 (0.034)	0.874 (0.030)	0.865 (0.033)
Schaum2	0.806 (0.014)	0.809 (0.016)	0.820 (0.013)
Yan	0.847 (0.020)	0.879 (0.021)	0.863 (0.021)
He	0.837 (0.015)	0.853 (0.014)	0.849 (0.017)
Pollen	0.928 (0.013)	0.944 (0.012)	0.941 (0.013)
Wang	0.881 (0.015)	0.895 (0.018)	0.895 (0.018)

Appendix

Table S.5: Clustering performance on single-cell RNA-seq datasets. Clustering accuracy (ACC), normalized mutual information (NMI), and neighborhood purity (NP) are reported for Original , Nonprivate-MD , and DP-MD as mean (SE) across replicates.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Jul 31, 2026

Differentially Private Nonparametric Modal Learning with Applications to Regression and Clustering

Density modes provide a localized and interpretable summary of multimodal distributions, but their estimation under rigorous differential privacy constraints remains largely unexplored. We study differentially private recovery of density modes for multivariate distributions under local smoothness, curvature, and separation conditions. We propose DP-GRAMS, a mean-shift inspired method that performs noisy ascent on a differentially private score estimator. Assuming the density belongs locally to a Hölder class with smoothness parameter

β> 2

, our score estimator uses bias-reducing higher-order kernels, and then enforces privacy in the gradient ascent steps via gradient clipping and calibrated Gaussian noise. A private initialization scheme combines a density-aware utility with a suppression rule and, with

k\asymp M\log n

draws over a public

h_{\mathrm{DAP}}

-grid and suppression radius

ρ_{\mathrm{init}}\asymp (\log n)^{-1/d}

, achieves high-probability coverage of the modal basins by successively suppressing selected local neighborhoods in competitive regions, while correlated noise across multiple starts enables joint release under a single

(\varepsilon,δ)

-differential privacy guarantee. We prove that all population modes are recovered with high probability and establish asymptotic error rates of the form

O\!\left((\tfrac{\log n}{n})^{\frac{2(β-1)}{d+2β}}\right) + O\!\left((\tfrac{\mathrm{polylog}(n,δ)}{n^2\varepsilon^2})^{\frac{β-1}{d+β}}\right)

. We also provide minimax lower bounds for private mode estimation, and show that our estimators are nearly optimal, up to a logarithmic factor in the MSE. We present two natural extensions: DP-PMS, a private modal-regression method, and DP-GRAMS-C, a clustering pipeline. Extensive experiments on synthetic and real data demonstrate favorable privacy-utility trade-offs relative to common baselines.

Arkajyoti Bhattacharjee, Arnab Auddy

Department of Statistics The Ohio State University

Clustering Differential Privacy

Ask PDF

Mar 2, 2026

Manifold Aware Denoising Score Matching (MAD)

A major focus in designing methods for learning distributions defined on manifolds is to alleviate the need to implicitly learn the manifold so that learning can concentrate on the data distribution within the manifold. However, accomplishing this often leads to compute-intensive solutions. In this work, we propose a simple modification to denoising score-matching in the ambient space to implicitly account for the manifold, thereby reducing the burden of learning the manifold while maintaining computational efficiency. Specifically, we propose a simple decomposition of the score function into a known component

s^{base}

and a remainder component

s-s^{base}

(the learning target), with the former implicitly including information on where the data manifold resides. We derive known components

s^{base}

in analytical form for several important cases, including distributions over rotation matrices and discrete distributions, and use them to demonstrate the utility of this approach in those cases.

Alona Levy-Jurgenson, Alvaro Prat, James Cuin +1

Department of Statistics University of Oxford · Department of Mathematics, Imperial College London, London, United Kingdom

Score-Based Generative Modeling Generative Modeling Manifold Learning

Ask PDF

Mar 1, 2026

Differential privacy representation geometry for medical image analysis

Differential privacy (DP)'s effect in medical imaging is typically evaluated only through end-to-end performance, leaving the mechanism of privacy-induced utility loss unclear. We introduce Differential Privacy Representation Geometry for Medical Imaging (DP-RGMI), a framework that interprets DP as a structured transformation of representation space and decomposes performance degradation into encoder geometry and task-head utilization. Geometry is quantified by representation displacement from initialization and spectral effective dimension, while utilization is measured as the gap between linear-probe and end-to-end utility. Across over 594,000 images from four chest X-ray datasets and multiple pretrained initializations, we show that DP is consistently associated with a utilization gap even when linear separability is largely preserved. At the same time, displacement and spectral dimension exhibit non-monotonic, initialization- and dataset-dependent reshaping, indicating that DP alters representation anisotropy rather than uniformly collapsing features. Correlation analysis reveals that the association between end-to-end performance and utilization is robust across datasets but can vary by initialization, while geometric quantities capture additional prior- and dataset-conditioned variation. These findings position DP-RGMI as a reproducible framework for diagnosing privacy-induced failure modes and informing privacy model selection.

Soroosh Tayebi Arasteh, Marziyeh Mohammadi, Sven Nebelung +1

Lab for AI in Medicine, RWTH Aachen University, Aachen, Germany · Department of Diagnostic and Interventional Radiology, University Hospital RWTH Aachen, Aachen, Germany · INDA Institute, RWTH Aachen University, Aachen, Germany

Neural Representation Geometry Healthcare Privacy-Preserving ML Differential Privacy Medical Image Representation Learning

Ask PDF

Abstract

Privacy-Preserving ML

Explore similar work

Differentially Private Nonparametric Modal Learning with Applications to Regression and Clustering

Manifold Aware Denoising Score Matching (MAD)

Differential privacy representation geometry for medical image analysis