Results 901 - 910 of 24443

Diffusion models produce high-fidelity samples and have recently become the de facto approach for synthetic image generation. However, prior work shows that these models exhibit strong vulnerability to privacy attacks, including reconstruction and membership inference (e.g., Carlini et al.), which makes adoption difficult in sensitive domains such as healthcare. Unfortunately, existing approaches that apply differential privacy during training often fail to preserve the high fidelity that makes diffusion models effective. In this talk I will present a new approach for training diffusion models in the federated setting, where clients hold non-IID data and seek formal privacy guarantees. The key idea in our approach is personalization, which helps alleviate the tension between privacy and utility in federated learning. Our method exploits the coarse-to-fine refinement structure that characterizes diffusion models: a shared diffusion model learns the coarse structure that appears across clients, while client-specific models perform the finer refinements that encode client-level information. This design lets clients benefit from collaboration while preventing the shared model from reproducing any individual client’s data, since it only observes noisy privatized versions of each client’s data. The method provides formal local differential privacy guarantees for each client while empirically preserving the high fidelity of diffusion models, which allows each client to release their personalized model publicly without compromising the privacy of other clients. We also show in a toy Gaussian mixture model that collaboration in this framework improves sample quality relative to private non-collaborative training. Extensive experiments on CIFAR-10, Colorized MNIST, and CelebA support these results: the framework generates high-fidelity samples, improves performance on minority and underrepresented classes, and maintains strong protection against membership inference, memorization, and reconstruction attacks.

The talk is based on joint work with Bingqing Jiang, A F M Mahfuzul Kabir, Weitong Zhang, Difan Zou, Lingxiao Wang and will appear in CVPR 2026.

In this talk, I will discuss differentially private algorithms for computing the geometric median, a basic and robust estimation problem. Standard private optimization methods, such as DP gradient descent, require an a priori bound on a ball of radius R containing the data, and their error scales linearly with this worst-case radius. For the geometric median, this can be overly pessimistic: a small number of outliers may make R very large even when most datapoints lie in a much smaller region. I will show how to go beyond this worst-case dependence by designing private algorithms whose error depends instead on the effective diameter of most of the data. 

Local differential privacy is a powerful method for privacy-preserving data collection. In this paper, we develop a framework for training Generative Adversarial Networks (GANs) on differentially privatized data. We show that entropic regularization of optimal transport - a popular regularization method in the literature that has often been leveraged for its computational benefits - enables the generator to learn the raw (unprivatized) data distribution even though it only has access to privatized samples. We prove that at the same time this leads to fast statistical convergence at the parametric rate. This shows that entropic regularization of optimal transport uniquely enables the mitigation of both the effects of privatization noise and the curse of dimensionality in statistical convergence. We provide experimental evidence to support the efficacy of our framework in practice.

Pan-privacy was proposed by Dwork et al. as an approach to designing a private analytics system that retains its privacy properties in the face of intrusions that expose the system's internal state. Motivated by federated telemetry applications, in this talk we will define local pan-privacy, where privacy should be retained under repeated unannounced intrusions on the local state. We will consider the problem of monitoring the count of an event in a federated system, where event occurrences on a local device should be hidden even from an intruder on that device. We’ll show that under reasonable constraints, the goal of providing information-theoretic differential privacy under intrusion is incompatible with collecting telemetry information. Finally we’ll discuss how this problem can be solved in a scalable way using standard cryptographic primitives. Joint work with Vitaly Feldman, Guy Rothblum and Kunal Talwar. 

Statistical heterogeneity of data in FL has motivated the design of personalized learning, where individual (personalized) models are trained, through collaboration. We build on a statistical framework to propose adaptive methods called ADEPT, which balance local information and collaboration. We examine through this lens, personalized unsupervised learning tasks including diffusion based generative models. We also develop a different methodology for personalized diffusion models called SPIRE, which we show arises from a Gaussian mixture model heterogeneity. This also allows for lightweight adaptation for new users who did not participate in collaboration, supporting privacy through data minimization directly. We finally  focus on online learning, where we first present privacy for multi-arm bandit problems. Then we present an  instantiation of personalized online learning through multi-agent multi-armed bandit problems, where we demonstrate a complete characterization for regret of heterogeneous stochastic linear bandits. 

Parts of this work are joint with Kaan Ozkara, Ruida Zhou, Bruce Huang and Antonious Girgis.

In this work, we identify a set of side-channels in our Confidential Federated Compute platform that a hypothetical insider could exploit to circumvent differential privacy (DP) guarantees. We show how DP can mitigate two of the side-channels, one of which has been implemented in our open-source library.

When and how can we guarantee that the conclusions arrived at by a complicated and expensive data analysis are correct? A sequence of recent works explores the possibility of constructing interactive proof systems that can verify the conclusions using less data and computation than would be needed to replicate the analysis. I will survey this line of work, highlighting positive and negative results.

Based on joint works with Tal Herman.