Per-Class Statistical Guidance for Differentially Private Image Synthesis

Training machine learning models on sensitive data raises serious privacy concerns. Differentially private image synthesis addresses this by generating synthetic images that preserve useful properties of private data without exposing it (Gong et al., 2025; Wang et al., 2026). DP-ImgSyn is a non-generative pipeline for this task: it trains a privacy-protected teacher model, uses the teacher's global batch-normalisation statistics to guide synthesis of public images, and releases the resulting images with soft labels for downstream classification (Soufleri et al., 2024). We extend this global-statistics approach by guiding synthesis with per-class statistics instead: mean, variance, skewness, and kurtosis collected from the teacher's GroupNorm activations for each class, rather than a single global target shared across all classes. Because these statistics are derived from an already privacy-protected teacher (trained with DP-SGD at ε=10), collecting them incurs no additional privacy cost by the post-processing property of differential privacy (Dwork & Roth, 2014); the total privacy budget remains ε=10. We compare our class-conditional approach against the original global-statistics baseline using a ResNet18 teacher and student, evaluated across three seeds on FashionMNIST, MNIST, and CIFAR-10. The benefit of class-conditional guidance depends on the quality of the underlying DP teacher. On MNIST, where the teacher reaches 96.30% accuracy, class-conditional guidance improves student accuracy over the global-statistics baseline from 92.93% ± 0.26% to 93.58% ± 0.20%, a consistent gain of +0.65 pp across all three seeds. On FashionMNIST, where the teacher reaches 81.25% accuracy, the effect is smaller and less consistent: 78.03% ± 0.11% (baseline) versus 78.26% ± 0.25% (class-conditional), a +0.23 pp mean gain that falls within one standard deviation of zero, with one of three seeds favoring the baseline. On CIFAR-10, where the teacher reaches only 58.57% accuracy, class-conditional guidance underperforms the baseline: 56.85% ± 0.30% (baseline) versus 56.35% ± 0.10% (class-conditional), a consistent −0.50 pp gap across all three seeds. To explain this pattern, we conducted a signal-to-noise ratio (SNR) analysis across all GroupNorm layers, measuring how much between-class signal survives DP noise for each statistic used in our class-conditional guidance. Higher-order statistics prove consistently more robust to DP noise, not less: kurtosis retains substantially more relative signal (SNR = 0.667) than the mean (SNR = 0.161), the statistic the global-statistics baseline relies on exclusively. This suggests that richer statistics are not inherently more fragile under privacy noise. Instead, the limiting factor appears to be how much class-discriminative signal the DP teacher retains in the first place: a strong teacher (MNIST, 96.30%) provides enough signal for class-conditional guidance to exploit, while weaker teachers (FashionMNIST, 81.25%; CIFAR-10, 58.57%) leave less signal available, and the benefit shrinks or reverses accordingly. These results suggest that the value of class-conditional synthesis guidance is gated primarily by DP teacher capacity rather than by the statistical richness of the guidance itself. Future work should therefore prioritise improving teacher quality under DP alongside, rather than instead of, richer synthesis guidance.