Tight End-to-End Accounting for Differentially Private Synthetic Data

Georgi Ganev; Vadym Doroshenko; Arun Ganesh; Juan Felipe Gomez; Ryan McKenna; Bogdan Kulynych

cs.CROct 12, 2026

Tight End-to-End Accounting for Differentially Private Synthetic Data

Authors: Georgi Ganev, Vadym Doroshenko, Arun Ganesh, Juan Felipe Gomez, Ryan McKenna, Bogdan Kulynych

Organizations: UCL · SAS · Google · Google Research · Hasso Plattner Institute · Lausanne University Hospital (CHUV)

Abstract

Differentially private (DP) pipelines often combine heterogeneous mechanisms, yet their guarantees are best analyzed using different notions of privacy (e.g., bounded range, zCDP, ADP). When composing them, we have to analyze the guarantees through a reduced common representation that loses accounting precision. This issue is particularly relevant in DP synthetic data generation, where data preprocessing, generation algorithms, and DP-SGD could appear within the same pipeline. We develop novel tools for tight end-to-end accounting of such compositions using privacy loss distributions (PLD), $f$ -DP, and Gaussian DP (GDP). In particular, we derive PLD and GDP analyses of bounded-range mechanisms such as the Exponential mechanism. Building on these theoretical results, we introduce AIM-GDP, a GDP-native variant of AIM (a state-of-the-art DP synthetic data mechanism) that enables easy composability with complex pipelines via PLD, attack-aware risk calibration, and tight end-to-end auditing while consistently achieving better utility; and MixCal, an algorithm for calibrating adaptive mixed compositions using PLD accounting. Overall, our tools enable tighter end-to-end accounting and thus less noise at the same privacy level in DP synthetic data pipelines.

Figures & tables

Table 1

Panel of Figure 1 — Figure 1: Our methods provide improved utility and enable new capabilities in DP synthetic data workflows. Top: Summary of theoretical results and algorithmic contributions. Bottom: (a) Our methods improve utility in synthetic text generation using LLMs. (b) Our methods enable to efficiently calibrate DP workflows to attack risk, with the first application of attack-aware calibration to synthetic data. (c) Our methods support tight end-to-end privacy audits, with the first end-to-end audit of the synthetic data generator, AIM-GDP , our version of AIM .

Panel of Figure 3 — Figure 3: Trade-off curves of a BR mechanism (higher is more precise) with $\nu=4$ , given by our $f$ -DP ( Theorem 3.1 ) and GDP analyses ( Theorem 3.2 ), and zCDP using the recent optimal conversion Harrison & Manurangsi (2026a) . To show the trade-off curves given by zCDP we use the conversion from RDP to $f$ -DP Riess et al. (2026) , for orders $>1$ .

Panel of Figure 4 — Figure 4: Our methods enable tighter accounting in the regimes of interest. On the y axis, we show the $\varepsilon$ decrease ( $>0$ means our methods are better) at $\delta=10^{-5}$ . Left: Using GDP, as a function of the budget proportion of Gaussian mechanisms (x axis) and number of iterations (hue) in AIM -like workloads containing fully adaptive compositions of Exponential and Gaussians. Right: Using PLD, as a function of the number of features (x axis) and the per-feature privacy parameter $\mu$ in data preprocessing-like workloads containing compositions of Exponential and Threshold Gaussian mechanisms. Details in Appendix D .

	Algorithm	1-way	2-way	3-way	Full	#Marginals	Time (s)
Discrete	AIM	0.0035	0.0224	0.0556	0.0451	40.33	399.2
	AIM-GDP (ours)	0.0033	0.0216	0.0542	0.0439	40.68	404.6
End-to-end	AIM	0.0038	0.0284	0.0763	0.0613	42.20	426.3
	AIM-GDP (ours)	0.0036	0.0274	0.0746	0.0599	42.38	444.8

Table 3: AIM-GDP consistently shows better utility. We show 1/2/3-way and full marginal errors, number of measured marginals, and runtime, averaged across four datasets and four privacy budgets.

$\varepsilon$	RDP (Poisson)	PLD (Poisson)	PLD (Random Alloc.)
1	2.34	2.18	2.25
2	1.40	1.32	1.30
4	0.97	0.92	0.89
8	0.74	0.71	0.69

Table 4: Our analyses enable adding substantially less noise in ACTG pipelines (combination of synthetization and DP-SGD ). The table shows DP-SGD noise multipliers

\sigma_{\mathrm{SGD}}

at fixed iterations

T=512,K=8

\delta=10^{-6}

for varying values of

\varepsilon

. Poisson subsampling uses

q=K/T

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 6 — Figure 6: The DP $\varepsilon$ at $\delta=10^{-5}$ reported using the PLD (ours), zCDP Harrison & Manurangsi (2026a) , and optimal Dong et al. (2020) analyses for the compositions of homogeneous BR mechanisms.

Mechanism	Param	Base Events	Fully Adaptive	Accounting
Preprocessing & Domain Discovery
DP Quantiles ( Gillenwater et al., 2021 )	$\varepsilon$	Exponential	No	ADP
DP Quantiles ( Kaplan et al., 2022 )	$\varepsilon_{1},\dots,\varepsilon_{l}$	Exponential	No	zCDP
Noisy Histogram	$\sigma$	Gaussian	No	GDP
Threshold Gaussian ( Gopi et al., 2020 )	$\sigma,\delta$	Gaussian Failure	No	GDP
Optimal Partition ( Desfontaines et al., 2022 )	$\varepsilon,\delta$	Laplace Failure	No	ADP

Appendix

Table 5: Classification of differentially private synthetic data mechanisms across domain discovery, tabular synthesis, and language model finetuning pillars.

Figure 7: Left: the original AIM with zCDP accounting ( orange ). Right: AIM-GDP , the same algorithm with the budget tracked in GDP units

\smash{\mu^{2}}

, which compose additively ( teal ). The Gaussian mechanism with noise scale

\sigma

is exactly

\nicefrac{{1}}{{\sigma}}

-GDP, and the exponential mechanism with parameter

\nu

is a

\nu

-BR mechanism with exact squared GDP budget

b(\nu)=\big(2\Phi^{-1}\big(\tfrac{1}{e^{\nu/2}+1}\big)\big)^{2}

given by Theorem 3.2 , with

b^{-1}(\smash{\mu^{2}})=2\ln\frac{\Phi(\nicefrac{{\mu}}{{2}})}{\Phi(-\nicefrac{{\mu}}{{2}})}

denoting its inverse used for calibrating the parameter to a given budget.

Figure 8: One-way marginal measurement recycling after preprocessing.

Dataset	$n$	$d$	$d_{\mathrm{num}}$	$d_{\mathrm{cat}}$	Largest categorical domain
Adult	32,561	11	0	11	native_country (42)
Fire	244,106	10	0	10	Station Area (46)
Page blocks	4,378	11	10	1	block (2)
Gas	22,191	11	10	1	TEY (2)

Appendix

Table 6: Datasets used in our discrete/end-to-end synthetic data experiments.

n

is the number of training records,

d

the number of columns, and

d_{\mathrm{num}}

and

d_{\mathrm{cat}}

the numbers of numerical and categorical columns, respectively. The final column reports the categorical column with the largest domain and its domain size.

Panel of Figure 9 — Figure 9: AIM-GDP vs. AIM across full marginal error across four datasets in a discrete pipeline. We report 95% bootstrap CI over the replications.

Figure 10: AIM-GDP vs. AIM across number of rounds and noise (

\sigma

) per round averaged across 25 runs on Adult in a discrete pipeline.

Panel of Figure 11 — Figure 11: AIM-GDP vs. AIM across the selected marginal per round averaged across 25 runs on Adult in a discrete pipeline.

Panel of Figure 12 — Figure 12: AIM-GDP vs. AIM across full marginal error across four datasets in an end-to-end pipeline. We report 95% bootstrap CI over the replications.

Figure 13: DP

\varepsilon

\delta=10^{-6}

across Poisson sampling probabilities

p=2^{-k}

(

k=0,\dots,6

), with

\rho

calibrated to an un-amplified

\varepsilon=1.0

p=1

Explore similar work

Tight Auditing of Differential Privacy in MST and AIM
Apr 20, 2026Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Bogdan KulynychPrivacy Auditing Synthetic Data Generation
1UCL · 2SAS · 3Lausanne University Hospital
Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model
Feb 8, 2025Zinan Lin, Tadas Baltrusaitis, Wenyu Wang +1Synthetic Data Generation Privacy-Preserving ML
Microsoft Research Redmond, WA, USA · Microsoft Cambridge, UK · Redmond, WA, USA
Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data
Jul 8, 2026Vinícius Gabriel Angelozzi, Héber H. ArcoleziAlgorithmic Fairness Group Fairness
Centre Inria de l’Université Grenoble Alpes · ÉTS Montréal, Inria Grenoble

Apr 20, 2026J/K move · Enter open · S save

Tight Auditing of Differential Privacy in MST and AIM

Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Bogdan Kulynych

1UCL · 2SAS · 3Lausanne University Hospital

Privacy Auditing Synthetic Data Generation Differential Privacy Gaussian Differential Privacy

Open paper AskPDF arXiv

State-of-the-art Differentially Private (DP) synthetic data generators such as MST and AIM are widely used, yet tightly auditing their privacy guarantees remains challenging. We introduce a Gaussian Differential Privacy (GDP)-based auditing framework that measures privacy via the full false-positive/false-negative tradeoff. Applied to MST and AIM under worst-case settings, our method provides the first tight audits in the strong-privacy regime. For

(ε,δ)=(1,10^{-2})

, we obtain

μ_{emp}\approx0.43

vs. implied

μ=0.45

, showing a small theory-practice gap. Our code is publicly available: https://github.com/sassoftware/dpmm.

Abstract

Explore similar work

Tight Auditing of Differential Privacy in MST and AIM

Differentially Private Synthetic Data via APIs 3: Using Simulators Instead of Foundation Model

Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data