Optimal noise calibration improves privacy in diffusion models
Diffusion Sensitivity Geometry and Strong Duality for Optimal Privacy-Utility Tradeoffs
Information TheoryCryptography and Security
Summary
Keeping data private while still getting useful results is a difficult balance. Existing methods for protecting privacy in diffusion models use simple, broad estimates that add too much noise. The authors show a way to precisely measure how sensitive these models are to changes in data and adjust noise exactly right, improving accuracy. Their approach works efficiently even with large datasets, provides exact privacy guarantees, and finds the best possible tradeoff between privacy and accuracy.
What this means in practice
- •For privacy engineers: Design privacy mechanisms for machine learning models with exact noise levels to minimize accuracy loss.
- •For healthcare data teams: Share sensitive patient data using diffusion models while ensuring tight privacy guarantees and better data utility.
- •For financial data platform developers: Implement optimal differential privacy safeguards in data release systems to improve the balance between privacy and data usefulness.$Commercial implications: Enables selling privacy-enhanced financial analysis platforms that meet strict privacy regulations with minimal loss in data value.
Authors
Tue Do, Daniel Alabi
Abstract
Existing approaches to differential privacy in diffusion models rely on loose sensitivity bounds and isotropic Gaussian noise, leading to unnecessary estimation error. We develop a framework for the optimal privacy-utility tradeoff of ideal diffusion denoisers, replacing conservative bounds with exact sensitivity characterizations and provably optimal noise calibration. First, we show that worst-case sensitivity over datasets of arbitrary size can be characterized exactly using only two records. For a data domain of size $m$, this reduces the analysis to at most $m(m-1)$ constraints, regardless of dataset size. Our characterization can be arbitrarily tighter than conventional diameter-based sensitivity bounds, revealing potentially unbounded improvements in noise calibration. Second, we obtain exact privacy guarantees for Rényi, approximate, and Gaussian differential privacy, as well as mutual-information privacy for binary records, avoiding the looseness of previous generic privacy conversions. Finally, we show that the minimum achievable weighted mean-squared error can be computed through a semidefinite program and prove strong duality, providing certificates of global optimality.