Imagine you're a chef who memorized a hundred recipes from a private cookbook. People worry about whether you memorized too much during study — but nobody asks how much you reveal each time you cook a dish to order. This paper asks exactly that question about diffusion models: how much private information leaks during the sampling process itself, independent of how the model was trained? The committed claim: the authors construct a "clipped privacy-accountable empirical denoiser" — a training-free estimator of the Bayes-optimal denoiser whose per-step sensitivity to any single training example can be computed in closed form. This lets each denoising step be treated as a Gaussian mechanism with a known privacy cost, enabling formal (ε, δ) accounting across the entire sampling trajectory. The key insight is that you don't need to analyze the intractable neural network; you can build a proxy denoiser from the raw training data whose privacy budget is analytically transparent. The architecture sits in the empirical Bayes / kernel density estimation family, not the neural network family. The empirical denoiser at each noise level computes a clipped weighted average over training examples, where the clipping bound controls sensitivity. Privacy accounting uses both a privacy loss distribution (PLD) accountant for certified upper bounds and a cumulant-based Edgeworth expansion as a fast diagnostic. The paper carefully characterizes where the Edgeworth approximation is reliable versus anti-conservative — a level of self-auditing you rarely see. Under full-data participation each step uses Gaussian DP; under random subsampling, the authors use f-DP trade-off functions to get tighter composition. The most striking finding is about the privacy loss trajectory: it grows steeply near the "critical window" where semantic content forms during denoising. Early steps (high noise) are cheap; the middle steps where the image's identity crystallizes are expensive. This motivates a hybrid sampler: use the private empirical denoiser through the formative steps where it faithfully proxies the neural denoiser, then switch to a public pre-trained neural denoiser for refinement. The handoff point becomes a design parameter that directly trades privacy for quality. Results on CIFAR-10 and CelebA-64 demonstrate that sampling-time choices — subsampling ratio, stopping time, hybrid switching point — materially affect the privacy guarantee, sometimes as much as the training procedure does. This reframes the privacy conversation: DP-SGD during training is necessary but not sufficient. A model trained with strong guarantees can still leak during generation if sampling isn't designed carefully. The integrity story is mixed but honest. The empirical denoiser is a weaker generator than state-of-the-art neural denoisers — the paper acknowledges this directly. The privacy bounds are certified upper bounds from PLD accounting, which is the gold standard for composition. But the experiments are on 32×32 and 64×64 images, well below production resolution, and the image quality of the empirical denoiser degrades at lower noise levels, which is precisely why the hybrid approach exists. The authors don't claim the empirical denoiser replaces neural denoisers; they claim it provides a privacy-auditable scaffold for the critical portion of the trajectory. The obvious next experiment is scaling to higher resolution (256×256 or above) and measuring whether the critical window's location and width change with image complexity — and whether the hybrid switching strategy remains effective when the gap between empirical and neural denoiser quality widens at scale. The authors likely didn't run this because compute for the empirical denoiser scales with training set size times image dimensionality, making it expensive at production scale. This is probably a compute budget constraint, not a buried negative result.
