Technical Summary: CONTINUOUSBENCH

Problem Statement

Differentially private (DP) text synthesis aims to unlock sensitive corpora (e.g., clinical notes, proprietary user data) for model training while preserving privacy. However, it remains unclear whether DP synthetic data genuinely transmits the high-value facts and capabilities present in the original restricted corpora. Existing evaluations fail to answer this "substitutability" question due to three primary confounders:

1. Pretraining Contamination: Standard benchmarks (e.g., IMDB sentiment, OpenReview scores) are often near-saturated for modern language models. Strong performance on these tasks may reflect knowledge already present in the base model's pretraining rather than knowledge transferred from the private corpus.
2. Task Simplicity: Common metrics like next-token prediction or distributional similarity (e.g., MAUVE) can improve through superficial style matching without requiring the model to recover specific, high-value facts.
3. Teacher-Student Distillation: Many evaluations use a stronger generator to produce data for a weaker downstream model. Performance gains may stem from distillation effects rather than the utility of the private data itself.

Consequently, current benchmarks cannot distinguish whether a DP synthesis method successfully preserves corpus-specific capabilities or merely mimics the source distribution.

Methodology: CONTINUOUSBENCH

The authors introduce CONTINUOUSBENCH, a continuously regenerated benchmark designed to rigorously measure capability gains from DP synthetic text. The framework enforces three design principles:

1. Access Dependency and Freshness: Tasks are constructed to be unsolvable without access to the released training corpus. This is achieved through:
   • Procedural Generation (GEMINON): A fictional, Pokémon-inspired world where entities, stats, and evolution lines are procedurally generated for each release, ensuring the knowledge is entirely new to pre-trained models.
   • Post-Cutoff Collection (NEWS): A stream of real-world news articles crawled after the training cutoff of modern LLMs, capturing time-evolving facts.
2. Grounded Factual QA: Evaluation is performed via short-answer question answering (QA). Questions are constructed such that the answer is supported by hundreds of independent records within the corpus. This ensures the task tests population-level knowledge (learnable under DP) rather than singleton memorization (which DP is designed to suppress).
3. Frontier Constraint: To eliminate distillation confounds, the generator and the downstream evaluator are identical base models (e.g., Gemma 3 1B PT or 4B). The evaluator is fine-tuned on the synthetic data and tested on a held-out QA set derived from the same corpus.

The benchmark operates on a quarterly cycle, automatically regenerating new corpora and QA sets to prevent contamination and ensure freshness for future model releases. It includes two tracks: GEMINON (controlled, fictional) and NEWS (noisy, real-world).

Key Contributions

• A Continuous, Regenerated Benchmark: CONTINUOUSBENCH provides a standardized, open-source harness that couples fresh training corpora with derived QA sets, enforcing access dependency and eliminating pretraining contamination.
• Evaluation of Population-Level Knowledge: By stratifying questions based on the number of supporting records (from singletons to high-repetition), the benchmark measures how well DP methods learn facts supported by redundancy, distinguishing them from singleton memorization.
• Standardized Comparison: The framework fixes the downstream training recipe, checkpoint selection, and evaluation prompts, ensuring performance differences are attributable to the data synthesis method rather than training hyperparameters.
• Open-Source Release: The authors release the corpus, QA sets, training recipes, and evaluation scripts to facilitate reproducible progress in DP synthetic data.

Experimental Results

The authors evaluated state-of-the-art DP synthesis methods (including DP-SGD fine-tuning and Private Evolution) against non-private synthesis baselines using Gemma 3 models.

1. Significant Capability Gap: While non-private synthesis (ε = ∞) transfers substantial factual knowledge (e.g., achieving ~92.5% accuracy on GEMINON and ~65.5% on NEWS with 4B models), state-of-the-art DP synthesis methods fail to do so.
   • At ε = 100, DP synthesis accuracy drops drastically to ~13.7% (GEMINON) and ~20.5% (NEWS).
   • At ε = 10, performance falls further to ~3.9% and ~5.8%, respectively.
2. Distributional vs. Factual Utility: Metrics like MAUVE show that DP generators preserve the distributional form (style, topic, structure) of the corpus (MAUVE scores remain relatively high), yet they fail to preserve the specific factual content required for grounded QA. This indicates that distributional similarity is insufficient for evaluating DP text synthesis.
3. Failure of Training-Free Methods: Private Evolution (PE), a popular training-free DP method, performed worse than random guessing on GEMINON and failed to improve over the base checkpoint on NEWS. This suggests PE relies on knowledge already present in the generator, which is insufficient for "fresh" facts.
4. Direct DP Fine-Tuning: Even when the evaluator is directly fine-tuned on the original corpus using DP-SGD (bypassing the synthetic data step), performance remains far below non-private training. This indicates the bottleneck lies in the fundamental difficulty of learning fresh factual signals under DP constraints, not just in the synthesis or sampling process.
5. Support Count Sensitivity: Knowledge transferability correlates strongly with the number of supporting records. While high-repetition facts are learnable (though still degraded under DP), singleton facts (appearing in only one record) are effectively suppressed, confirming the privacy mechanism works as intended for instance-level data.

Significance and Claims

The paper claims that CONTINUOUSBENCH reveals a "stark gap" in the current state of DP text synthesis. The authors argue that:

• Current methods are insufficient: Even at high privacy budgets (ε = 100), DP synthesis fails to recover the capability gains that access to the original sensitive corpus would provide.
• Existing benchmarks are misleading: Standard saturated benchmarks and distributional metrics overstate the utility of DP synthetic data by failing to test for corpus-specific capability transfer.
• A core open problem: The inability of DP methods to recover information attested across hundreds of independent records suggests a fundamental limitation in current approaches. The authors posit that a method that cannot recover population-level knowledge has not meaningfully preserved the corpus.
• Future Progress: CONTINUOUSBENCH serves as a reproducible yardstick to measure and accelerate progress, highlighting that closing the gap between non-private and DP synthesis is the central challenge for the field.

The paper concludes that while DP text synthesis can preserve stylistic properties, it currently fails to transmit the high-value, factual knowledge that motivates the use of sensitive data in the first place.