{"id":"ef5a9e45-5549-4e11-acb5-da390a605134","arxiv_id":"1908.03995","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Temporal discounting of privacy losses lets a privacy-preserving mechanism release time-series statistics with bounded or slowly growing noise over an infinite horizon.","lead":"This paper relaxes differential privacy by discounting privacy losses from the distant past, allowing a data curator to keep adding the same small amount of noise forever. It shows that with exponential discounting, constant noise is enough, and with hyperbolic discounting, noise needs to grow only slowly.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The bounded-noise result is mathematically correct, but the 'meaningful relaxation' claim depends on the normative discounting premise: a mechanism satisfying exponential discounted DP can leak the same fixed secret with undiscounted privacy loss growing linearly in time.","rationale":"The paper's stated mathematical results, especially Corollary 12, are internally correct: the constant-noise mechanism does satisfy exponentially discounted differential privacy as defined. I do not see a technical flaw in the central derivation. The soft spot is the interpretation of that guarantee as a meaningful relaxation of standard DP. The definition of discounted DP changes the adversary model: it asserts that privacy loss at time k contributes to the time-t guarantee only through alpha^(t-k). The repeated-query example shows this is not merely a cosmetic change. When the same sensitive statistic is reported at every time, the discounted definition certifies the mechanism as private while the undiscounted privacy loss of the transcript grows linearly and an adversary's estimate improves with the square root of the horizon. This is exactly the concern the reader identified as the weakest assumption. Because the paper is transparent about the discounting premise and even lists adversary modelling as future work, a conditional verdict is appropriate; the contribution is a well-defined relaxation conditional on a normative choice, not a privacy guarantee in the standard adversary model. I also noticed a possible issue in the proof of Corollary 16: the integral comparison for the increasing part of the sum has the wrong direction, since for an increasing function the sum over integer points is at least the integral over the same interval. This does not affect the exponential bounded-noise result, which is the paper's central claim, but it would be worth a separate check if hyperbolic discounting is emphasized in a revision.","tokens_in":11624,"tokens_out":16544,"duration_ms":176373,"concrete_test":"Instantiate the repeated-query mechanism f_t(X(t)) = x_1(1) with Laplace noise scale b = Delta/(epsilon(1-alpha)), alpha = 0.9, and horizon t = 100. First verify the discounted condition: compute sum_{k=1}^{100} alpha^{100-k} Delta/b = epsilon(1-alpha) sum_{j=0}^{99} alpha^j <= epsilon. Then compute the exact worst-case undiscounted log-likelihood ratio for the full transcript between neighboring datasets with x_1(1) = theta and x_1(1) = theta + Delta: sup_{y(1:t)} log( prod_{k=1}^t p(y_k | theta) / p(y_k | theta + Delta) ) = t Delta/b = t epsilon(1-alpha) = 10 epsilon. Also compute the standard deviation of the adversary's sample mean estimator, sqrt(2)b/sqrt(t), and compare it with the one-shot epsilon-DP noise scale Delta/epsilon.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Corollary 12 is correct under the paper's Definition 10: with b = Delta_f/(epsilon(1-alpha)), each per-step privacy loss rho(k) <= epsilon(1-alpha), so the discounted sum is at most epsilon. The central claim, however, is that this constitutes a meaningful relaxation of differential privacy over an infinite horizon. That claim rests entirely on the assumption that privacy losses from the distant past matter less than recent ones. The load-bearing weakness is that Definition 10 bounds only a weighted sum of per-step privacy losses, not the undiscounted privacy loss of the entire transcript. Concretely, choose f_t(X(t)) = x_1(1) for every t, i.e., every report is the same first measurement of individual 1, with sensitivity Delta_f = Delta. With b = Delta/(epsilon(1-alpha)), the mechanism satisfies (epsilon, alpha)-exponentially discounted DP for every t because sum_{k=1}^t alpha^{t-k} Delta/b <= epsilon. Yet the worst-case undiscounted log-likelihood ratio between neighboring datasets differing in x_1(1) is sum_{k=1}^t Delta/b = t epsilon(1-alpha), which grows without bound. An adversary who averages the t independent Laplace reports estimates x_1(1) with standard deviation sqrt(2)b/sqrt(t), so statistical confidence about the fixed secret improves over time. Thus the bounded noise scale is purchased by discounting repeated leaks of the same secret; if the individual or adversary treats all leaks of that secret as equally sensitive, the total disclosure is unbounded. The paper itself acknowledges this gap in Section V, where future work is to capture the effect of temporal discounting on the ability of an adversary to observe private information.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper defines discounted differential privacy for evolving datasets: at evaluation time t, the privacy loss incurred at time k is weighted by α^(t−k) (exponential discounting) or by 1/(1+β(t−k)) (hyperbolic discounting). For additive i.i.d. Laplace noise, it shows that exponential discounting allows a constant noise scale b=Δ_f/(ε(1−α)) over an infinite horizon, whereas ordinary ε-differential privacy forces the noise scale to grow without bound (e.g., quadratically, Corollary 8). A hyperbolic variant yields b_k=O(√k). The mechanisms are evaluated on real smart-meter data from Ausgrid, comparing expected relative error under the three definitions.","tokens_in":11950,"tokens_out":10190,"duration_ms":98972,"significance":"If the discounted privacy definition is accepted, the paper is a useful contribution: it makes the implicit temporal weighting in privacy loss explicit, gives elementary sufficient conditions for additive Laplace mechanisms, and demonstrates a clear utility advantage on a real dataset. The core calculations in Theorems 6 and 11 are standard and correct, and the paper is self-contained. The main caveat, which the paper does not address, is that the relaxation is normative: it assumes that old leaks are less sensitive, and it does not bound the undiscounted cumulative privacy loss of the transcript. The practical significance therefore hinges on whether the discounted-loss premise is appropriate for the application.","major_comments":[{"comment":"The central claim that bounded noise gives a meaningful relaxation of differential privacy over an infinite horizon is not supported as stated. Definition 10 bounds only the discounted sum ∑_{k=1}^t α^{t−k}ρ(k); it does not bound the undiscounted privacy loss of the full transcript. To see the gap, take f_t(X(t))=x_1(1) for all t (each report is the same first measurement of individual 1) with sensitivity Δ_f=Δ and b=Δ/(ε(1−α)). Corollary 12 applies and the mechanism is (ε,α)-exponentially discounted DP for every t, since ∑_{k=1}^t α^{t−k}Δ/b ≤ ε. However, the worst-case log-likelihood ratio between neighboring datasets differing in x_1(1) is tΔ/b = tε(1−α), which grows linearly in t, and an adversary who averages the t independent Laplace reports obtains a standard error of order b/√t, so confidence about the fixed secret improves over time. The bounded noise scale is thus purchased by discounting repeated leaks of the same secret. I recommend that the paper either prove an additional guarantee on undiscounted transcript leakage under reasonable conditions (e.g., each individual's data changes over time, or queries are distinct), or explicitly state this limitation in the abstract and conclusions and temper the claim that this is a meaningful relaxation of differential privacy.","section":"§III-A, Definition 10 and Corollary 12"},{"comment":"Theorem 5 is stated without the conditional independence assumption that its proof requires. The decomposition p(Y(t)|X(t)) = ∏_{k=1}^t p(y(k)|X(k)) is valid only if the reports are conditionally independent given X(t), together with causality; without such an assumption the theorem is false. Please add this assumption explicitly to the statement of Theorem 5 (and clarify whether Definitions 9–14 inherit it). Note that the specific mechanism (5) with i.i.d. Laplace noise does satisfy the assumption, so the later results are not affected.","section":"§II-B, Theorem 5"},{"comment":"The proof of Corollary 16 is not fully justified. The integral approximations used to bound the two parts of the sum are not accompanied by error analysis: the first inequality integrates over [0,t0−1] instead of [0,t0], and the second integrates over [t0+1,t]. Because Corollary 16 is a central contribution (bounded-noise variant for hyperbolic discounting), please supply a complete proof or state the approximation error explicitly.","section":"§III-B, Corollary 16"}],"minor_comments":[{"comment":"The sentence 'smart meter measurements of of households' contains a duplicated preposition; also, 'The individuals in both these datasets' refers to only one dataset.","section":"§IV-A"},{"comment":"The phrase 'avrage expected relative error' should be 'average expected relative error'.","section":"§IV-B"},{"comment":"The statement 'lim_{k→} b_k = +∞' is missing the target of the limit; it should read lim_{k→∞} b_k = +∞.","section":"§II-A, Corollary 7"},{"comment":"The argument of atanh in the displayed formula should be √(β/(1+β)) rather than √β/(1+β), to match the derivation in the proof.","section":"§III-B, Eq. (14)"}],"recommendation":"major_revision","confidential_remarks":"The paper is technically sound in its core Laplace derivations, but the narrative overstates the privacy guarantee. The main revision risk is that the repeated-query counterexample directly undermines the 'meaningful relaxation' claim; the author should be asked to delimit precisely what discounted DP does and does not protect. If Theorem 5 is corrected, Corollary 16 is given a rigorous proof, and the limitations are stated clearly, the paper would be a valid contribution to the privacy literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe paper does what it says: it defines discounted differential privacy, proves sufficient Laplace-noise conditions, and shows that exponential discounting lets the noise scale stay constant over an infinite horizon. Theorems 6, 11, 15, and Corollary 12 are straightforward and, as far as I checked, correct. The genuinely new piece is Corollary 16, where hyperbolic discounting leads to noise that grows like sqrt(k), much slower than the standard unbounded-growth result. The paper also credits Bolot et al. for the exponential case, so the novelty claim is honest. The empirical section is simple but decent; the Ausgrid data is public and the explicit formulas make reproduction easy.\n\nThe soft spot is not the math, it is the interpretation. Definition 10 bounds the weighted sum alpha^{t-k} rho(k), not the undiscounted privacy loss of the full transcript. The stress-test example is the right one: if every report is the same query about the same individual, the mechanism satisfies the definition with constant noise, yet an adversary who averages the reports learns that fixed secret with confidence growing linearly in time. The paper's own conclusion admits that capturing this adversary is future work. So the bounded-noise claim is real, but it is meaningful only if you accept the normative premise that old leaks matter less. For an adversary or a user who cares equally about all leaks of one secret, the relaxation does not control disclosure.\n\nA smaller issue: Theorem 5 is stated without the conditional-independence assumption that its proof relies on. For the additive-noise mechanisms later in the paper the assumption holds because the noise is i.i.d., but the theorem as written overstates its generality. That should be fixed, along with the abstract's phrasing, which does not distinguish the exponential result from the hyperbolic one.\n\nThe hyperbolic proof in Corollary 16 uses integral approximations and a monotonicity argument. I did not machine-check it, but the steps look plausible and nothing in the result is implausible. The citation pattern is fine, and the overlap with Bolot et al. is disclosed.\n\nWho benefits: readers working on continual release, stream privacy, or privacy-utility trade-offs under non-standard loss models will find a clean formal starting point. It is not a replacement for differential privacy, and the authors do not claim it is. If you accept the discounting premise, the exponential result gives a genuinely bounded-noise mechanism; if you do not, the definition is just a weighted sum with no adversary-based justification.\n\nI would send this to serious peer review, with the repeated-query example and the scope of the guarantee made explicit before publication. The derivations deserve to be in the literature; the interpretation needs to be more honest about what the definition does not control.\n\nBest","headline":"The bounded-noise result is mathematically correct under the paper's own definition, but the definition's normative discounting premise is what does the work, and the paper should be clearer about what it does and does not guarantee.","tokens_in":12433,"tokens_out":2888,"would_cite":true,"duration_ms":34244,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Discounted differential privacy relaxes the definition enough that an infinite stream of noisy reports can be released with bounded noise, whereas standard differential privacy forces noise to grow without bound.","keywords":["differential privacy","evolving datasets","temporal discounting","privacy loss","Laplace noise","infinite horizon","exponential discounting","hyperbolic discounting"],"falsifier":"Run a controlled study in which people state how much compensation they would demand for releasing a sensitive reading from 1, 10, or 100 days ago; if the demanded compensation does not decline roughly like $\\alpha^{t-k}$ or $1/(1+\\beta(t-k))$, the normative premise that justifies bounded noise does not describe actual privacy preferences.","tokens_in":11406,"feed_emoji":"🔒","tokens_out":8495,"duration_ms":91928,"temperature":0.7,"pith_summary":"Standard differential privacy treats a privacy loss from long ago as exactly as serious as one from today, and for evolving datasets that forces the added noise to grow without bound over an infinite horizon. This paper proposes discounted differential privacy, in which a privacy loss at time $k$ is weighted by $\\alpha^{t-k}$ (exponential) or $1/(1+\\beta(t-k))$ (hyperbolic) when judged at time $t$. The main result is that under exponential discounting a constant Laplace noise scale $b = \\Delta f/(\\epsilon(1-\\alpha))$ satisfies the discounted guarantee for every report time, so report quality never degrades. Under hyperbolic discounting the noise still must grow, but only as $\\sqrt{k}$. The paper demonstrates the practical difference on household smart-meter data, where the discounted mechanisms keep expected relative error low over a year while standard differential privacy degrades quickly.","feed_headline":"Discount old privacy leaks to keep noise bounded forever","feed_subtitle":"Exponential discounting of privacy losses lets an infinite stream of reports stay accurate; standard differential privacy cannot.","key_machinery":"The load-bearing object is the discounted privacy loss, which replaces the uniform sum of per-report privacy losses with a weighted sum in which older losses count less. The privacy-loss decomposition $p(Y(t)|X(t))=\\prod_{k=1}^t p(y(k)|X(k))$, inherited from standard differential privacy, turns the definition into the inequality $\\sum_{k=1}^t \\alpha^{t-k}\\rho(k)\\le \\epsilon$. Because the geometric series $\\sum_{j=0}^{\\infty}\\alpha^j = 1/(1-\\alpha)$ is finite, a constant per-report privacy loss of $\\epsilon(1-\\alpha)$ fits inside the budget for every $t$, which is exactly why the Laplace scale $b=\\Delta f/(\\epsilon(1-\\alpha))$ works. Hyperbolic discounting gives a divergent series, which is why its noise must still grow, but the slower divergence yields only $\\sqrt{k}$ growth.","core_discovery":"The paper's central claim is that a time-dependent weighting of privacy losses converts an impossibility into a feasibility result: an infinite sequence of reports can be protected with noise of constant magnitude if old losses are allowed to count for less. Formally, for reports $y(t)=f_t(X(t))+w(t)$ with i.i.d. Laplace noise, standard $\\epsilon$-differential privacy requires $\\sum_{k=1}^t \\Delta f_k/b_k \\le \\epsilon$, so with constant query sensitivity $\\Delta f$ the noise scale $b_k$ must diverge. The paper defines discounted privacy loss, $\\rho(k,t)=\\alpha^{t-k}\\rho(k)$, and proves that $(\\epsilon,\\alpha)$-exponentially discounted differential privacy holds for all $t$ with the constant choice $b_k=\\Delta f/(\\epsilon(1-\\alpha))$. Hyperbolic discounting, with weight $1/(1+\\beta(t-k))$, gives a slower-growing scale proportional to $\\sqrt{k}$. These are relaxations: setting $\\alpha=1$ or $\\beta=0$ recovers standard differential privacy, so the bounded-noise conclusion is bought precisely by the decision to forget.","pith_inferences":["One could calibrate the discount factor to a measured 'privacy half-life' from behavioral studies and check whether the resulting noise level matches what people accept in real data-sharing decisions.","The same reweighting of per-time privacy losses could be applied to other definitions that compose over time by summing a privacy-loss measure, potentially yielding bounded-noise analogues for privacy-loss random variables with finite moments.","If a legal retention period is known in advance, a curator could set $\\alpha$ so that the discounted weight of any record falls below a chosen threshold by the end of the period; discounted differential privacy would then formalize forgetting without deleting data."],"forward_implications":["Under exponentially discounted differential privacy, a curator can publish an endless stream of noisy answers without ever increasing the noise, so reports do not become meaningless over time.","Standard $\\epsilon$-differential privacy on the same problem forces the noise scale to grow without bound; the paper gives the explicit choice $b_k = \\Delta f \\pi^2 k^2 / (6\\epsilon)$ as one valid schedule.","Hyperbolic discounting still requires growing noise, but only as $\\sqrt{k}$, which is slow enough that on a one-year smart-meter horizon the degradation is barely visible.","The results apply to any sequence of queries with bounded sensitivity when reports are generated by adding i.i.d. Laplace noise, not only to averaging queries."],"supporting_citations":[{"why":"Supplies the privacy-loss decomposition and composition bound that the discounted definitions modify.","marker":"[5]"},{"why":"Introduces Laplace noise calibrated to sensitivity, which is the mechanism studied throughout the paper.","marker":"[6]"},{"why":"Defines differential privacy, the baseline notion that the paper relaxes.","marker":"[7]"},{"why":"Shows that differential privacy under continual observation requires growing noise, motivating the relaxation.","marker":"[9]"},{"why":"Argues that finite noise can be impossible for some queries, supporting the unboundedness conclusion.","marker":"[13]"},{"why":"Provides the hyperbolic discounting model of delayed rewards that motivates the hyperbolic definition.","marker":"[24]"},{"why":"Supplies the intertemporal choice framework used to justify discounting privacy losses over time.","marker":"[25]"},{"why":"Earlier work on exponentially decaying privacy on streams, which this paper extends to hyperbolic discounting.","marker":"[39]"},{"why":"Provides the smart-meter dataset used to illustrate report quality under the different privacy notions.","marker":"[42]"}],"fun_headline_variants":["Forget old privacy leaks to keep noise finite","Time-decaying privacy lets noise stay bounded on infinite streams","Bounded privacy noise forever via exponential discounting","Infinite data streams, finite noise: discounted differential privacy","Choosing to forget keeps privacy noise from blowing up"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that an individual's concern about a privacy leak decays with the time since the leak, so old losses can be down-weighted; if every past leak matters as much as today's, the total privacy loss of an infinite release remains unbounded despite the relaxation.","fun_headline_variants_meta":{"raw":{"variants":["Forget old privacy leaks to keep noise finite","Time-decaying privacy lets noise stay bounded on infinite streams","Bounded privacy noise forever via exponential discounting","Infinite data streams, finite noise: discounted differential privacy","Choosing to forget keeps privacy noise from blowing up"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00023,"raw_usage":{"total_tokens":1495,"prompt_tokens":970,"completion_tokens":525,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":586,"completion_tokens_details":{"reasoning_tokens":450}},"tokens_in":586,"tokens_out":525,"duration_ms":7033,"temperature":1.0,"reasoning_tokens":450,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:55:30.675444+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a controlled study in which people state how much compensation they would demand for releasing a sensitive reading from 1, 10, or 100 days ago; if the demanded compensation does not decline roughly like $\\alpha^{t-k}$ or $1/(1+\\beta(t-k))$, the normative premise that justifies bounded noise does not describe actual privacy preferences.","supporting_citations":[{"cited_title":"The algorithmic foundations of dif ferential privacy,","cited_arxiv_id":null,"evidence_quote":"Supplies the privacy-loss decomposition and composition bound that the discounted definitions modify."},{"cited_title":"Calibrat ing noise to sensitivity in private data analysis,","cited_arxiv_id":null,"evidence_quote":"Introduces Laplace noise calibrated to sensitivity, which is the mechanism studied throughout the paper."},{"cited_title":"Differential privacy,","cited_arxiv_id":null,"evidence_quote":"Defines differential privacy, the baseline notion that the paper relaxes."},{"cited_title":"Differ ential privacy under continual observation,","cited_arxiv_id":null,"evidence_quote":"Shows that differential privacy under continual observation requires growing noise, motivating the relaxation."},{"cited_title":"The complexity of differential privacy,","cited_arxiv_id":null,"evidence_quote":"Argues that finite noise can be impossible for some queries, supporting the unboundedness conclusion."},{"cited_title":"Discounting of delayed reward s: Models of individual choice,","cited_arxiv_id":null,"evidence_quote":"Provides the hyperbolic discounting model of delayed rewards that motivates the hyperbolic definition."},{"cited_title":"Intertemp oral choice– toward an integrative framework,","cited_arxiv_id":null,"evidence_quote":"Supplies the intertemporal choice framework used to justify discounting privacy losses over time."},{"cited_title":"Private decayed predicate sums on streams,","cited_arxiv_id":null,"evidence_quote":"Earlier work on exponentially decaying privacy on streams, which this paper extends to hyperbolic discounting."},{"cited_title":"Solar home electricity data,","cited_arxiv_id":null,"evidence_quote":"Provides the smart-meter dataset used to illustrate report quality under the different privacy notions."}],"review_version":1}