Privacy Accounting for Empirical Denoisers

William Cheng; Dongjun Kim; Mijung Park

cs.LGOct 20, 2026

Privacy Accounting for Empirical Denoisers

Authors: William Cheng, Dongjun Kim, Mijung Park

Organizations: University of British Columbia · Stanford University · Now at Adobe.

Abstract

Diffusion models have emerged as the foundation of modern generative systems, yet their high memorization capacity raises privacy concerns. While differentially private (DP) training provides formal guarantees, it comes at a cost in sample quality. In this work, we study a complementary question: how much privacy loss is incurred during the sampling process itself? Directly analyzing modern neural denoisers is challenging because their sensitivity to a single training example is generally intractable. To overcome this challenge, we construct and analyze a clipped privacy-accountable empirical denoiser, a training-free estimator of the Bayes-optimal denoiser, whose per-step sensitivity can be computed explicitly, allowing each denoising step to be a Gaussian mechanism. This perspective enables privacy accounting under Gaussian DP when each training example contributes to each denoising step, and under $f$ -DP trade-off functions when each generated sample uses a single randomly subsampled block of the training data. We report every $(\varepsilon, δ)$ guarantee as a certified upper bound from a privacy loss distribution accountant, and use a cumulant-based Edgeworth approximation as a fast diagnostic, characterizing where it is reliable and where it becomes anti-conservative. We also analyze the privacy loss along the denoising trajectory and show that it grows steeply near the critical window in which semantic content is formed. This observation motivates hybrid samplers that use the private empirical denoiser through the formative steps where it remains a faithful proxy for the neural denoiser, then switch to a public neural denoiser for the remaining refinement. Our results on CIFAR-10 and CelebA-64 show that the privacy of diffusion models depends not only on the training procedure, but also on sampling-time design choices such as subsampling, stopping time, and hybrid denoising.

Figures & tables

Figure 1: Cosine similarity between the denoising directions, i.e.,

\text{Cos}(\mathbf{x}_{t}-\hat{\mathbb{E}},\mathbf{x}_{t}-D)

, by empirical and neural denoisers. Here,

\mathbf{x}_{t}-\hat{\mathbb{E}}

denotes the actual denoising direction induced by the update rule in eq. 1 . Results are reported along the log-SNR axis ( Kingma et al., 2021 ) , where

\mathrm{SNR}=1/4t^{2}

, providing a unified noise-scale representation across diffusion formulations (e.g., EDM, DDPM, FM).

		CLIP ( Radford et al., 2021 )			DINO ( Oquab et al., 2024 )
Window	$t$ range	swap	ref.	rel.	swap	ref.	rel.
high-noise	19.15–7.47	0.0097	0.0917	0.11 $\times$	0.0717	0.5792	0.12 $\times$
mid-noise	6.09–1.98	0.0772	0.1000	0.77 $\times$	0.5175	0.6203	0.83 $\times$
low-noise	1.54–0.38	0.1127	0.0687	1.64 $\times$	0.6910	0.4431	1.56 $\times$
min-noise	0.14–0.018	0.2147	0.0241	8.90 $\times$	0.8758	0.1376	6.37 $\times$

Table 1: Endpoint distance (

1-\cos

) after substituting the empirical denoiser inside one window (swap) and after re-drawing only that window’s noise with the neural denoiser kept (ref.). rel. = swap/ref.

Figure 2: Output-wise vs. per-step subsampling, $B=25$ , identical initial noise. Each row is one sample; columns show decreasing noise levels. Under output-wise subsampling (a) the subsample is reused, so each row progressively denoises the same emerging image. Under per-step subsampling (b) a fresh subsample is drawn each step, pulling the trajectory toward a different subset: semantic content changes between columns and never settles. This instability motivates block reuse.

Figure 3: Privacy-utility trade-offs of the output-wise subsampled hybrid sampler on CIFAR-10. We report FID against the certified PLD upper bound

\varepsilon_{u}

(

\delta=10^{-5}

, values from Table 8 ) while varying (a) the handoff time

t_{0}

, (b) the number of public re-noising steps from

t_{0}

t_{1}

, and (c) the subsampling rate

q=B/n

CIFAR-10			CelebA-64
Method	$\varepsilon$	FID	Method	$\varepsilon$	FID
DP-Diffusion ( Ghalebikesabi et al., 2023 )	10	9.8	DP-LDM ( Liu et al., 2024 )	10	14.3
DP-LDM ( Liu et al., 2024 )	10	8.4	DP-MEPF ( Harder et al., 2023 )	10	17.4
DP-API ( Lin et al., 2023 )	0.67	7.87	DP-DM ( Dockhorn et al., 2023 )	10	78.3
DP-MEPF ( Harder et al., 2023 )	10	29.1	DP-Promise ( Wang et al., 2024 )	10	25.3
DP-DM ( Dockhorn et al., 2023 )	10	97.7

Table 2: Comparison of DP generative models on CIFAR-10 and CelebA-64. Our method performs a short private editing block using an output-wise subsampled empirical denoiser, then hands off to a publicly pretrained neural denoiser (ImageNet for CIFAR-10, FFHQ for CelebA-64) to complete sampling. FID is computed for

N_{out}=50,000

samples. Lower FID is better.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

$\beta$	Edgeworth estimate	Certified PLD upper bound	FID
4	0.438	0.438	132.89
2	1.218	1.217	62.81
1	10.777	11.381	27.13
0.5	256.624	259.761	53.54
0.25	unstable	unstable	81.43

Appendix

Table 3: Effect of the public normalization

\beta

on privacy and utility.

$t$	% gen.	log SNR	$\cos(x_{t}-\widehat{\mathbb{E}},\,x_{t}-D)$	MSE	denoiser
$80.0$	$0\%$	$-10.2$	$1.0000$	$3.24\pm 0.03$	emp.
$10.2$	$32\%$	$-6.0$	$1.0000$	$1.84\pm 0.07$	emp.
$3.29$	$46\%$	$-3.8$	$0.9965$	$14.63\pm 0.20$	emp.
$1.29$	$55\%$	$-1.9$	$0.9895$	$10.13\pm 0.09$	switch 55%
$0.55$	$65\%$	$-0.2$	$0.9766$	$6.40\pm 0.05$	switch 65%
$0.27$	$70\%$	$+1.3$	$0.9568$	$4.23\pm 0.04$	switch 70%

Appendix

Table 4: Directional cosine similarity (Fig. 1 ) and per-step MSE

\|\widehat{\mathbb{E}}-D\|^{2}

between empirical and neural denoiser outputs, along the sampling trajectory. Rows are labelled by the denoiser active at that noise level under the hybrid sampler, and switch marks the empirical

\to

public handoff for the

55/65/70\%

configurations. Rows use the

N=50

EDM grid (percent = step

/N

). On the

N=39

grid of the hybrid runs these handoffs fall near

t=1.5

0.52

, and

0.28

. MSE is mean

\pm

standard error over 3 seeds.

Window	$t$ range	CLIP	DINO	$\Delta$ CLIP [95% CI]
high-noise	19.15–7.47	0.990 [0.989, 0.991]	0.928 [0.922, 0.934]	$+0.0821$ $[+0.0801,+0.0840]$
mid-noise	6.09–1.98	0.923 [0.921, 0.925]	0.483 [0.474, 0.491]	$+0.0228$ $[+0.0207,+0.0248]$
low-noise	1.54–0.38	0.887 [0.886, 0.889]	0.309 [0.303, 0.315]	$-0.0441$ $[-0.0459,-0.0422]$
min-noise	0.14–0.018	0.785 [0.783, 0.788]	0.124 [0.119, 0.129]	$-0.1906$ $[-0.1930,-0.1881]$
all steps	80–0.002	0.794 [0.792, 0.796]	0.121 [0.117, 0.126]	–

Appendix

Table 5: Endpoint agreement between the all-neural reference and the path with the empirical denoiser substituted in one window (2048 paired trajectories,

N=39

). CLIP and DINO are cosine similarities (

1-

the swap distance of Table 1 ), with 95% bootstrap CIs in brackets.

\Delta

CLIP is noise-control distance minus swap distance, with 95% paired-bootstrap CIs. Image-space metrics are in Table 6 .

Window (steps)		PSNR (dB)	SSIM	Label agreement
high-noise (9–14)	swap	33.19 [32.88, 33.50]	0.981 [0.979, 0.983]	0.867 [0.853, 0.882]
	ref.	11.77 [11.67, 11.86]	0.634 [0.629, 0.639]	0.412 [0.391, 0.433]
mid-noise (15–20)	swap	14.74 [14.63, 14.84]	0.731 [0.726, 0.736]	0.462 [0.440, 0.483]
	ref.	10.40 [10.36, 10.45]	0.466 [0.463, 0.469]	0.390 [0.368, 0.411]
low-noise (21–26)	swap	12.23 [12.19, 12.27]	0.412 [0.410, 0.415]	0.255 [0.236, 0.274]
	ref.	11.98 [11.94, 12.03]	0.415 [0.412, 0.419]	0.603 [0.582, 0.624]

Appendix

Table 6: Image-space agreement between the all-neural endpoint and each variant, from the same starting noise (2048 trajectories,

N=39

, windows of 6 steps). swap : empirical denoiser substituted inside the window. ref. : neural denoiser kept and only that window’s noise re-drawn. Higher means closer to the all-neural endpoint for all three metrics. Brackets are 95% paired bootstrap CIs.

Empirical block (%)	$\bar{\mu}_{\mathcal{B}}$	Edgeworth estimate $\varepsilon_{\mathrm{ew}}$	PLD lower bound	PLD upper bound	RDP upper bound
55	0.69	0.2987	0.04880	0.2988	0.36
62	1.56	1.68	1.44	1.69	2.63
65	2.09	5.33	6.05	6.29	7.81
67	2.84	23.0	25.49	25.7	48.8

Appendix

Table 7: Privacy accounting comparison for different empirical block sizes.

Panel of Figure 4 — Figure 4: GDP Analysis of Diffusion-Based Sampling (full batch) and Corresponding Diffusion Process Visualization. The noise scheduling constants are $\sigma_{max}=80$ , $N=50$ , $\beta=1$ , and $\rho=7$ . The $(\epsilon,\delta)$ -DP guarantees account for a single sample. Left. GDP conversion to $(\epsilon,\delta)$ -DP for varying $\sigma_{\min}$ . Middle. Type I and Type II Error under full-batch GDP with varying $\sigma_{min}$ . Right. Visualization of Diffusion Process with Varying $\sigma_{\min}$ . Only six timesteps are shown for figure clarity.

Figure 5:

\mu

-GDP for each time step with a full batch of data.

Panel of Figure 6 — Figure 6: Detection of critical window. (a) zero-shot CLIP model detects the probability of an image being generated belonging to the ship class. (b) Privacy costs at three time points. (c) Generated images denoised at varying timesteps.

Panel of Figure 7 — Figure 7: $(\epsilon,\delta)$ -DP traces (Left) and Type I and II error profiles (Right) under GDP with varying stopping time points in the reverse process

Noise Steps	Prop. Empirical (%)	Subsample Batch Size	FID $\downarrow$	PLD $[\bm{\varepsilon}_{\ell},\bm{\varepsilon}_{u}]$ $\downarrow$	$\bm{\varepsilon}_{ew}$ $\downarrow$
1	55	25	147.43	$[0.049,\,0.299]$	0.299
	55	50	143.57	$[0.386,\,0.636]$	0.636
	55	100	141.23	$[1.111,\,1.361]$	1.360
	55	200	139.74	$[2.702,\,2.952]$	2.946
	62	25	78.79	$[1.442,\,1.691]$	1.683
	62	50	78.23	$[3.172,\,3.422]$	3.513

Appendix

Table 8: Hyperparameter search for output-wise subsample SDEdit on CIFAR-10. We sweep the number of re-noising steps

T\in\{1,3,5,7,9\}

, the proportion of empirical (denoiser) generation

p\in\{55,62,65,67,70\}\%

, and the subsample batch size

B\in\{25,50,100,200\}

;

95

configurations in total. FID measures sample quality (lower is better).

\mathrm{PLD}\,[\varepsilon_{\ell},\varepsilon_{u}]

is the PLD interval under the sampling model of Section 4 (optimistic lower / pessimistic upper estimate, Google dp_accounting ). Only

\varepsilon_{u}

is a certified bound.

\varepsilon_{ew}

is the second degree Edgeworth approximation (lower is better).

Noise Steps	Prop. Empirical (%)	Subsample Batch Size	FID $\downarrow$	PLD $[\bm{\varepsilon}_{\ell},\bm{\varepsilon}_{u}]$ $\downarrow$	$\bm{\varepsilon}_{ew}$ $\downarrow$
1	55	25	116.96	$[0.000,\,0.099]$	0.099
	55	50	113.07	$[0.000,\,0.208]$	0.208
	55	100	109.95	$[0.185,\,0.435]$	0.435
	55	200	107.90	$[0.666,\,0.916]$	0.915
	62	25	45.45	$[0.516,\,0.767]$	0.563
	62	50	45.23	$[1.179,\,1.430]$	1.150

Appendix

Table 9: Hyperparameter search for output-wise subsample SDEdit on CelebA . The base grid sweeps re-noising steps

T\in\{1,3,5,7,9\}

, proportion of empirical (denoiser) generation

p\in\{55,62,65,67,70\}\%

, and subsample batch size

B\in\{25,50,100,200\}

; at

T=3

we additionally refine

B

(to

\{60,70\}

for

p\in\{62,65\}\%

and to

\{80,90,120,140\}

for

p\in\{65,67\}\%

), giving

112

configurations. FID measures sample quality (lower is better).

\mathrm{PLD}\,[\varepsilon_{\ell},\varepsilon_{u}]

is the PLD interval under the sampling model of Section 4 (optimistic lower / pessimistic upper estimate, Google dp_accounting ). Only

\varepsilon_{u}

is a certified bound.

\varepsilon_{ew}

is the (diagnostic) Edgeworth symmetric privacy loss; it is marked invalid where the reuse validity flag is false or a cumulant ratio

\rho\geq 1

(diagnostics available only for the refined

T=3

rows).

Handoff	Edgeworth estimate	PLD lower	Certified PLD upper	FID
55%	0.43	0.19	0.44	$37.39\pm 0.05$
62%	2.36	2.31	2.56	$30.45\pm 0.17$
65%	7.14	8.48	8.74	$27.31\pm 0.07$
67%	30.09	34.12	34.39	$23.75\pm 0.08$
70%	132.91	140.11	140.39	$20.98\pm 0.05$

Appendix

Table 10: CelebA-64,

B=100

, three public re-noising steps,

\delta=10^{-6}

N_{\mathrm{out}}=50{,}000

. FID is mean

\pm

standard deviation over three generation seeds.

Handoff (%)	Edgeworth estimate	CLT estimate	Certified PLD upper
55	0.299	0.296	0.299
62	1.683	1.388	1.691
65	5.331	4.313	6.289
67	22.982	45.101	25.696
70	104.035	25,905.494	108.444

Appendix

Table 11: Edgeworth and CLT estimates of

\varepsilon

against the certified PLD upper bound (CIFAR-10,

B=25

, three re-noising steps,

\delta=10^{-5}

). Neither approximation is a bound. The CLT estimate understates the certified value by 18% and 31% at the 62% and 65% blocks and overstates it by more than 200 times at the 70% block. The Edgeworth estimate stays within 1% for

\varepsilon\lesssim 2

and understates it by 15%, 11%, and 4% at the 65%, 67%, and 70% blocks.

Configuration	RDP $\varepsilon$ , $\delta=10^{-5}$	RDP $\varepsilon$ , $\delta=4\times 10^{-10}$
55%, $B=25$	0.36	0.71
62%, $B=25$	2.63	5.16
65%, $B=25$	7.81	12.87

Appendix

Table 12: Certified RDP

\varepsilon

for CIFAR-10 output-wise subsampled blocks at

\delta=10^{-5}

and at the stricter

\delta=4\times 10^{-10}=1/n^{2}

(

B=25

N_{\mathrm{out}}=50{,}000

$t$	$T$	$\tfrac{3}{4}T$	$\tfrac{1}{2}T$	$\tfrac{1}{4}T$
Cosine similarity (Fig. 1 )	1.000	0.999	0.956	0.845
Theoretical ASR at $q=0.5$	0.5019	0.5204	0.6909	0.9999
Theoretical ASR at $q=0.01$	0.5000	0.5002	0.5031	0.6927
Theoretical ASR at $q=0.005$	0.5000	0.5001	0.5012	0.6371
Numerical ASR	0.5005 $\pm$ 0.0025	0.5001 $\pm$ 0.0011	0.5072 $\pm$ 0.0007	0.5096 $\pm$ 0.0026

Appendix

Table 13: Membership inference. Theoretical: ASR implied by our

\varepsilon

for the subsampled empirical sampler at rate

q

. Numerical: ASR of the attack of Duan et al. (2023) on a neural denoiser trained on all of CIFAR-10. Both stop at time

t

of a

T=1000

step discretization. The neural denoiser is not subsampled, so the theoretical rows are not a bound on it.

Differential Privacy

Differential privacy limits how much an algorithm’s outputs can reveal about any one person’s data, with formal guarantees.

See all 274 papers

Feb 26, 2026

DP-aware AdaLN-Zero: Taming Conditioning-Induced Heavy-Tailed Gradients in Differentially Private Diffusion

Condition injection enables diffusion models to generate context-aware outputs, which is essential for many time-series tasks. However, heterogeneous conditional contexts (e.g., observed history, missingness patterns or outlier covariates) can induce heavy-tailed per-example gradients. Under Differentially Private Stochastic Gradient Descent (DP-SGD), these rare conditioning-driven heavy-tailed gradients disproportionately trigger global clipping, resulting in outlier-dominated updates, larger clipping bias, and degraded utility under a fixed privacy budget. In this paper, we propose DP-aware AdaLN-Zero, a drop-in sensitivity-aware conditioning mechanism for conditional diffusion transformers that limits conditioning-induced gain without modifying the DP-SGD mechanism. DP-aware AdaLN-Zero jointly constrains conditioning representation magnitude and AdaLN modulation parameters via bounded re-parameterization, suppressing extreme gradient tail events before gradient clipping and noise injection. Empirically, DP-SGD equipped with DP-aware AdaLN-Zero improves interpolation/imputation and forecasting under matched privacy settings. We observe consistent gains on a real-world power dataset and two public ETT benchmarks over vanilla DP-SGD. Moreover, gradient diagnostics attribute these improvements to conditioning-specific tail reshaping and reduced clipping distortion, while preserving expressiveness in non-private training. Overall, these results show that sensitivity-aware conditioning can substantially improve private conditional diffusion training without sacrificing standard performance.

Tao Huang, Jiayang Meng, Xu Yang +2

School of Computer Science and Big Data, Minjiang University, Fuzhou, Fujian, China. · School of Information, Renmin University of China, Beijing, China.

Conditional Diffusion Models Privacy-Preserving ML Layer Normalization

Ask PDF

Oct 2, 2026

Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models

Synthetic data are increasingly used as an alternative to sharing sensitive records. However, synthetic data generation does not guarantee privacy, as diffusion models trained or adapted on sensitive data remain susceptible to reconstruction attacks. Moreover, while approaches that use differential privacy (DP), such as DP-SGD, achieve provably private diffusion model training, the repeated gradient clipping and noise injection they require result in significant utility loss. An important limitation of DP-based privacy is that, although it has a provable relationship to reconstruction privacy (RP), that relationship is indirect. RP is defined in terms of limiting how much an adversary's posterior distribution over sensitive data differs from the prior, whereas DP provides guarantees by bounding the sensitivity of outputs to changes in individual records. This indirection is an important source of the utility loss. To address this, we propose a PAC-private diffusion model adaptation to achieve reconstruction privacy. Since PAC-privacy is defined directly with respect to posterior advantage over the prior, it directly implicates RP. To obtain scalable PAC privatization in high dimensions, we first learn a compact data-dependent diffusion model component using LoRA or Textual Inversion, and then calibrate anisotropic Gaussian noise from the covariance of repeated mechanism outputs. Unlike DP-SGD, our method perturbs the learned component only once after optimization, thereby avoiding privacy composition across gradient updates. We evaluate the framework on few-shot concept personalization and full-dataset image synthesis, and show that the proposed approach better preserves subject identity, generation quality, and downstream classification accuracy than DP while achieving the same reconstruction privacy.

Boming Miao, Tao Zhang, Netanel Raviv +3

Department of Computer Science and Engineering, Washington University in St. Louis

Privacy-Preserving ML Diffusion-Based Image Generation Diffusion Model Fine-Tuning

Ask PDF

Apr 11, 2026

Transformers Learn the Optimal DDPM Denoiser for Multi-Token GMMs

Transformer-based diffusion models have demonstrated remarkable performance at generating high-quality samples. However, our theoretical understanding of the reasons for this success remains limited. For instance, existing models are typically trained by minimizing a denoising objective, which is equivalent to fitting the score function of the training data. However, we do not know why transformer-based models can match the score function for denoising, or why gradient-based methods converge to the optimal denoising model despite the non-convex loss landscape. To the best of our knowledge, this paper provides the first convergence analysis for training transformer-based diffusion models. More specifically, we consider the population Denoising Diffusion Probabilistic Model (DDPM) objective for denoising data that follow a multi-token Gaussian mixture distribution. We theoretically quantify the required number of tokens per data point and training iterations for the global convergence towards the Bayes optimal risk of the denoising objective, thereby achieving a desired score matching error. A deeper investigation reveals that the self-attention module of the trained transformer implements a mean denoising mechanism that enables the trained model to approximate the oracle Minimum Mean Squared Error (MMSE) estimator of the injected noise in the diffusion steps. Numerical experiments validate these findings.

Hongkang Li, Hancheng Min, Rene Vidal

Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, USA · Institute of Natural Sciences & School of Mathematical Sciences, Shanghai Jiao Tong University, Shanghai, China

Diffusion Models Diffusion-Based Denoising Diffusion Transformer Score Matching

Ask PDF

Abstract

Differential Privacy

Explore similar work

DP-aware AdaLN-Zero: Taming Conditioning-Induced Heavy-Tailed Gradients in Differentially Private Diffusion

Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models

Transformers Learn the Optimal DDPM Denoiser for Multi-Token GMMs