Differentially private (DP) pipelines often combine heterogeneous mechanisms, yet their guarantees are best analyzed using different notions of privacy (e.g., bounded range, zCDP, ADP). When composing them, we have to analyze the guarantees through a reduced common representation that loses accounting precision. This issue is particularly relevant in DP synthetic data generation, where data preprocessing, generation algorithms, and DP-SGD could appear within the same pipeline. We develop novel tools for tight end-to-end accounting of such compositions using privacy loss distributions (PLD), f-DP, and Gaussian DP (GDP). In particular, we derive PLD and GDP analyses of bounded-range mechanisms such as the Exponential mechanism. Building on these theoretical results, we introduce AIM-GDP, a GDP-native variant of AIM (a state-of-the-art DP synthetic data mechanism) that enables easy composability with complex pipelines via PLD, attack-aware risk calibration, and tight end-to-end auditing while consistently achieving better utility; and MixCal, an algorithm for calibrating adaptive mixed compositions using PLD accounting. Overall, our tools enable tighter end-to-end accounting and thus less noise at the same privacy level in DP synthetic data pipelines.
Figures & tables
Table 1
Figure 1: Our methods provide improved utility and enable new capabilities in DP synthetic data workflows. Top: Summary of theoretical results and algorithmic contributions. Bottom: (a) Our methods improve utility in synthetic text generation using LLMs. (b) Our methods enable to efficiently calibrate DP workflows to attack risk, with the first application of attack-aware calibration to synthetic data. (c) Our methods support tight end-to-end privacy audits, with the first end-to-end audit of the synthetic data generator, AIM-GDP , our version of AIM .
Figure 2: End-to-end synthesis.
Figure 3: Trade-off curves of a BR mechanism (higher is more precise) with ν=4 , given by our f -DP ( Theorem 3.1 ) and GDP analyses ( Theorem 3.2 ), and zCDP using the recent optimal conversion Harrison & Manurangsi (2026a) . To show the trade-off curves given by zCDP we use the conversion from RDP to f -DP Riess et al. (2026) , for orders >1 .
Figure 4: Our methods enable tighter accounting in the regimes of interest. On the y axis, we show the ε decrease ( >0 means our methods are better) at δ=10−5 . Left: Using GDP, as a function of the budget proportion of Gaussian mechanisms (x axis) and number of iterations (hue) in AIM -like workloads containing fully adaptive compositions of Exponential and Gaussians. Right: Using PLD, as a function of the number of features (x axis) and the per-feature privacy parameter μ in data preprocessing-like workloads containing compositions of Exponential and Threshold Gaussian mechanisms. Details in Appendix D .
Figure 5: Multimodal synthesis.
Algorithm
1-way
2-way
3-way
Full
#Marginals
Time (s)
Discrete
AIM
0.0035
0.0224
0.0556
0.0451
40.33
399.2
AIM-GDP (ours)
0.0033
0.0216
0.0542
0.0439
40.68
404.6
End-to-end
AIM
0.0038
0.0284
0.0763
0.0613
42.20
426.3
AIM-GDP (ours)
0.0036
0.0274
0.0746
0.0599
42.38
444.8
Table 3: AIM-GDP consistently shows better utility. We show 1/2/3-way and full marginal errors, number of measured marginals, and runtime, averaged across four datasets and four privacy budgets.
ε
RDP (Poisson)
PLD (Poisson)
PLD (Random Alloc.)
1
2.34
2.18
2.25
2
1.40
1.32
1.30
4
0.97
0.92
0.89
8
0.74
0.71
0.69
Table 4: Our analyses enable adding substantially less noise in ACTG pipelines (combination of synthetization and DP-SGD ). The table shows DP-SGD noise multipliers σSGD at fixed iterations T=512,K=8 , δ=10−6 for varying values of ε . Poisson subsampling uses q=K/T .
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: The DP ε at δ=10−5 reported using the PLD (ours), zCDP Harrison & Manurangsi (2026a) , and optimal Dong et al. (2020) analyses for the compositions of homogeneous BR mechanisms.
Mechanism
Param
Base Events
Fully Adaptive
Accounting
Preprocessing & Domain Discovery
DP Quantiles ( Gillenwater et al., 2021 )
ε
Exponential
No
ADP
DP Quantiles ( Kaplan et al., 2022 )
ε1,…,εl
Exponential
No
zCDP
Noisy Histogram
σ
Gaussian
No
GDP
Threshold Gaussian ( Gopi et al., 2020 )
σ,δ
Gaussian Failure
No
GDP
Optimal Partition ( Desfontaines et al., 2022 )
ε,δ
Laplace Failure
No
ADP
Appendix
Table 5: Classification of differentially private synthetic data mechanisms across domain discovery, tabular synthesis, and language model finetuning pillars.
Figure 7: Left: the original AIM with zCDP accounting ( orange ). Right: AIM-GDP , the same algorithm with the budget tracked in GDP units μ2 , which compose additively ( teal ). The Gaussian mechanism with noise scale σ is exactly \nicefrac1σ -GDP, and the exponential mechanism with parameter ν is a ν -BR mechanism with exact squared GDP budget b(ν)=(2Φ−1(eν/2+11))2 given by Theorem 3.2 , with b−1(μ2)=2lnΦ(−\nicefracμ2)Φ(\nicefracμ2) denoting its inverse used for calibrating the parameter to a given budget.
Figure 8: One-way marginal measurement recycling after preprocessing.
Dataset
n
d
dnum
dcat
Largest categorical domain
Adult
32,561
11
0
11
native_country (42)
Fire
244,106
10
0
10
Station Area (46)
Page blocks
4,378
11
10
1
block (2)
Gas
22,191
11
10
1
TEY (2)
Appendix
Table 6: Datasets used in our discrete/end-to-end synthetic data experiments. n is the number of training records, d the number of columns, and dnum and dcat the numbers of numerical and categorical columns, respectively. The final column reports the categorical column with the largest domain and its domain size.
Figure 9: AIM-GDP vs. AIM across full marginal error across four datasets in a discrete pipeline. We report 95% bootstrap CI over the replications.
Figure 10: AIM-GDP vs. AIM across number of rounds and noise ( σ ) per round averaged across 25 runs on Adult in a discrete pipeline.
Figure 11: AIM-GDP vs. AIM across the selected marginal per round averaged across 25 runs on Adult in a discrete pipeline.
Figure 12: AIM-GDP vs. AIM across full marginal error across four datasets in an end-to-end pipeline. We report 95% bootstrap CI over the replications.
Figure 13: DP ε at δ=10−6 across Poisson sampling probabilities p=2−k ( k=0,…,6 ), with ρ calibrated to an un-amplified ε=1.0 at p=1 .
State-of-the-art Differentially Private (DP) synthetic data generators such as MST and AIM are widely used, yet tightly auditing their privacy guarantees remains challenging. We introduce a Gaussian Differential Privacy (GDP)-based auditing framework that measures privacy via the full false-positive/false-negative tradeoff. Applied to MST and AIM under worst-case settings, our method provides the first tight audits in the strong-privacy regime. For (ε,δ)=(1,10−2), we obtain μemp≈0.43 vs. implied μ=0.45, showing a small theory-practice gap. Our code is publicly available: https://github.com/sassoftware/dpmm.
Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Bogdan Kulynych
Differentially private (DP) synthetic data enables the use of sensitive datasets while providing strong privacy guarantees. Recently, Private Evolution (PE) has emerged as a promising framework for generating DP synthetic data using only inference APIs of foundation models. However, suitable foundation models are not always available for every private data domain. In this paper, we show that PE is more general than previously understood and can incorporate APIs beyond foundation models. In particular, we show that state-of-the-art non-neural-network data synthesizers, including computer graphics-based image generators and physics simulation tools (which we refer to as simulators), integrate naturally into PE. We call the resulting method Sim-PE. Sim-PE broadens the applicability of PE while improving performance. For image synthesis, Sim-PE improves downstream classification accuracy by up to 3x, reduces FID by up to 80%, and is significantly more efficient. We further show that simulators and foundation models can be seamlessly combined within Sim-PE for additional gains. Beyond performance improvements, Sim-PE enables new DP applications that are difficult or impossible for existing methods, including generating DP control signals whose execution reproduces the distribution of private observations. The code is open-sourced in the Private Evolution Python library: https://github.com/microsoft/DPSDA
Zinan Lin, Tadas Baltrusaitis, Wenyu Wang +1
Microsoft Research Redmond, WA, USA · Microsoft Cambridge, UK · Redmond, WA, USA
Machine learning models are increasingly deployed in high-stakes domains, raising concerns about both privacy and fairness. Differential Privacy (DP) has become a gold standard for privacy-preserving data analysis, while fairness-aware mechanisms aim to mitigate discrimination against underrepresented groups. However, these objectives can conflict: DP often amplifies disparities across demographic groups, and little is known about whether established fairness interventions remain effective under DP constraints. In this work, we present, to our knowledge, the first systematic evaluation of fairness interventions on differentially private synthetic tabular data. Our benchmark centers on the Adaptive Iterative Mechanism (AIM), identified as the state-of-the-art marginal-based DP synthesizer (Cormode et al. 2025). We thus evaluate fairness interventions across four datasets, multiple group fairness metrics, and three categories of mitigation strategies (pre-processing, in-processing, and post-processing) under a wide range of privacy budgets. We compare four pipeline configurations: (Baseline) training on original data; (DP-only) training on DP synthetic data; (Fair-only) applying fairness mechanisms on original data; and (DP+Fair) combining fairness mechanisms with DP synthetic data. Our results demonstrate that while DP alone can degrade both utility and fairness, applying fairness interventions can partially restore equitable outcomes. Among them, post-processing methods tend to provide more stable fairness-utility trade-offs across privacy budgets and synthesizers, achieving strong fairness improvements while preserving competitive utility relative to other intervention stages. We release all code, data, and experimental artifacts in an open-source repository to ensure full reproducibility and to support future research on the privacy-fairness-utility trade-off.
Vinícius Gabriel Angelozzi, Héber H. Arcolezi
Centre Inria de l’Université Grenoble Alpes · ÉTS Montréal, Inria Grenoble