Learning from data you are not allowed to look at

This is the core of the programme and where most of my published work sits. The setting is the PATE framework: an ensemble of teacher models is trained on disjoint partitions of the sensitive data, their votes are aggregated with calibrated noise, and only a student model, which never touches the sensitive data directly, is released. Because the student learns only through the noisy aggregation, its privacy guarantee follows by post-processing.

My contribution has been to question the architecture inside that framework rather than the framework itself. Tabular data is full of dependencies between heterogeneous columns, and the multilayer perceptron used as the student discriminator in PATE-GAN is a weak instrument for capturing them. Replacing it with a transformer that attends over categorical and continuous columns changes what the generator is able to learn, without changing what is being guaranteed.

A generator can only be judged by what is done with its output, so the evaluation has to run all the way through to the downstream task. That means training several families of classifier on the synthetic data, testing them against real data, and comparing across datasets rather than reporting a single favourable number. It also means treating the comparison as a statistical claim: when several models are evaluated across several datasets, a Friedman test with post-hoc Nemenyi analysis says whether an apparent difference is real, and a bar chart does not.

Trustworthiness has a second component, which is whether a decision can be explained to the person who has to act on it. This is where my work on language models for network intrusion detection belongs. In that setting a classification alone is close to useless operationally, an analyst needs to know what in the traffic led to the verdict, and a regulator may need it on record. Explanation quality becomes an evaluation target in its own right rather than a presentation layer bolted on afterwards.

This is the newest of the three and the one with the least behind it. That is deliberate rather than an omission: it is the direction my doctoral research is taking, not a body of work I can already point to.

The starting observation is that both halves of the problem above assume a world that stands still. A privacy budget is accounted for once, over a fixed training run. A utility evaluation is performed once, against a fixed test set. Neither assumption holds for data that arrives as a stream, across several modalities, from sources whose behaviour changes. A generator that must keep learning spends privacy budget continuously; a downstream model that was decision-faithful last month may not be now, and detecting that without access to the real data is its own problem. Extending both the guarantees and the evaluation to non-stationary, multi-modal, continually learned settings is what the PhD is for.

These have not been separate projects so much as successive attempts at the same problem. The diabetes study came first and was, in effect, a methodology exercise: it established how I evaluate synthetic data, multiple classifiers, real versus synthetic, differences confirmed by statistical testing rather than asserted. That evaluation protocol is what made the next step assessable.

PATE-TabTransGAN then attacked the generator itself, keeping the same downstream-utility framing but adding a formal privacy guarantee and a stronger architecture. The 6G intrusion-detection work approached the trustworthiness question from the opposite end: instead of asking whether a model trained on synthetic data decides correctly, it asks whether a model's decision can be explained well enough to be acted on and audited.

What the doctoral work adds is time. Each of these results was obtained on a fixed dataset. The open question is what survives when the data keeps arriving and keeps changing.

Privacy-Preserving Synthetic Data Generation for Trustworthy and Adaptive Machine Learning

PhD in Information and Communication Technology, Wrocław University of Science and Technology. The work focuses on designing decision-faithful and privacy-preserving synthetic data generators across multi-modal data streams, under non-stationary distributions and continual learning setups.

It follows directly from my master's thesis, Privacy-Preserving Synthetic Data Generation for Pattern Classification Tasks, which developed methodologies for generating tabular synthetic data that preserve privacy guarantees while maintaining downstream classifier performance, and compared them empirically against PATE-GAN, DP-CTGAN and DP-GAN.

On the generative side: differentially private generative modelling, PATE-style teacher, student training with noisy vote aggregation, GAN and variational autoencoder architectures for tabular data, transformer-based representation learning over mixed categorical and continuous columns, and Rényi differential privacy accounting for tracking the privacy budget.

On the evaluation side: downstream classifier benchmarking across several model families, AUROC and AUCPR under class imbalance, statistical distance metrics for fidelity, and non-parametric significance testing, Friedman with post-hoc Nemenyi, for comparisons across multiple datasets and models.

On the language-model side: parameter-efficient fine-tuning with QLoRA, and explainability evaluation for classification decisions.

Implementation is mostly Python, PyTorch, TensorFlow, scikit-learn, HuggingFace PEFT, pandas and NumPy, with R for statistical work, and Docker, MLflow and Git for keeping experiments reproducible.

Code for the projects below is public. Release of the PATE-TabTransGAN implementation is still pending.