Protecting sensitive data in image generation with new privacy method
Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models
Machine Learning
Summary
Creating artificial images from sensitive data can risk revealing private details, even when using existing privacy tools that reduce image quality. The authors propose a new way to adapt image generation models that directly limits how much an attacker can learn about the private data. Their approach adds noise only once after model training, preserving better image quality and identity features. Tests show it keeps the generated images safer and more accurate compared to traditional privacy methods.
What this means in practice
- •For enterprise data teams: Generate synthetic images that protect customer privacy without heavily degrading image usefulness by applying the PAC-private diffusion model adaptation.
- •For ai product developers: Develop personalized image generation features that maintain user identity and protect sensitive data using the single-noise perturbation method.
Authors
Boming Miao, Tao Zhang, Netanel Raviv, Murat Kantarcioglu, Bradley A. Malin, Yevgeniy Vorobeychik
Abstract
Synthetic data are increasingly used as an alternative to sharing sensitive records. However, synthetic data generation does not guarantee privacy, as diffusion models trained or adapted on sensitive data remain susceptible to reconstruction attacks. Moreover, while approaches that use differential privacy (DP), such as DP-SGD, achieve provably private diffusion model training, the repeated gradient clipping and noise injection they require result in significant utility loss. An important limitation of DP-based privacy is that, although it has a provable relationship to reconstruction privacy (RP), that relationship is indirect. RP is defined in terms of limiting how much an adversary's posterior distribution over sensitive data differs from the prior, whereas DP provides guarantees by bounding the sensitivity of outputs to changes in individual records. This indirection is an important source of the utility loss. To address this, we propose a PAC-private diffusion model adaptation to achieve reconstruction privacy. Since PAC-privacy is defined directly with respect to posterior advantage over the prior, it directly implicates RP. To obtain scalable PAC privatization in high dimensions, we first learn a compact data-dependent diffusion model component using LoRA or Textual Inversion, and then calibrate anisotropic Gaussian noise from the covariance of repeated mechanism outputs. Unlike DP-SGD, our method perturbs the learned component only once after optimization, thereby avoiding privacy composition across gradient updates. We evaluate the framework on few-shot concept personalization and full-dataset image synthesis, and show that the proposed approach better preserves subject identity, generation quality, and downstream classification accuracy than DP while achieving the same reconstruction privacy.