{"id":"91b77f6a-e34d-4acf-8f86-052103aeaa9f","arxiv_id":"2504.18411","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The symmetric alpha-stable mechanism with stability parameter between 1 and 2 achieves pure epsilon-differential privacy and remains closed under convolution.","lead":"This paper introduces a privacy mechanism that uses heavy-tailed symmetric alpha-stable noise and proves it provides pure differential privacy. It is relevant to privacy engineers because this noise family stays in the same family when summed, which is convenient for federated learning.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 16 is very likely correct; the only central gap is Lemma 15's sketch, whose substitution is misstated but whose conclusion follows by scaling.","rationale":"The reader's weakest_assumption identifies Lemma 15 as the delicate step, and I agree that this is where the written proof is least rigorous. However, the concern lands only as a proof-presentation gap, not as a substantive correctness risk. The underlying mathematical claim is supported by a direct scaling argument that the paper gestures at but does not state correctly. The missing Jacobian cancels in the privacy-loss ratio, and after rescaling the location parameter, the tail ratio still tends to 1 for every alpha in [1,2). Hence the central theorem is sound. The separate alpha = 1 omission is also patchable because the Cauchy density has a closed form and is treated later in Theorem 25. Because the reader's CONDITIONAL verdict was based on these rigor gaps rather than on a false conclusion, and because my assessment confirms the central claim while agreeing that the proof needs correction, the verdict should remain unchanged.","tokens_in":19411,"tokens_out":10430,"duration_ms":111309,"concrete_test":"Re-prove Theorem 16 in two independent steps: (1) for alpha = 1, use the closed-form Cauchy density to show max_x ln[(gamma^2 + (x - mu2)^2) / (gamma^2 + (x - mu1)^2)] is finite; (2) for alpha in (1,2), derive the tail expansion for general gamma via p_gamma(x; mu) = gamma^{-1} p_1((x - mu)/gamma) and Lemma 14, and check that the ratio tends to 1 as |x| tends to infinity on both tails. If the corrected scaling identity fails to yield a finite uniform bound, the pure-DP claim would need revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is pure DP for the SaS mechanism with alpha in [1,2). This hinges on the tail ratio p(x - mu1) / p(x - mu2) tending to 1 as |x| tends to infinity. That fact is true and can be shown directly: p_gamma(x; mu) = gamma^{-1} p_1((x - mu)/gamma), and for fixed mu1, mu2 the ratio of power-law tails tends to 1 as |x| grows. However, the paper's Lemma 15, which is invoked to remove gamma from the tail argument, is not actually proved as written. The displayed substitution in Eq. (27) omits the Jacobian factor 1/gamma and does not rescale the location parameter mu to mu/gamma; the printed identity p(x; gamma, mu) = p(x_hat; alpha, 1, mu) is false. The lemma's conclusion is nevertheless correct after adding the missing factor and rescaling mu, so this is a repairable rigor gap rather than a false theorem. In addition, Theorem 16 claims alpha = 1 but its proof invokes Lemma 14, which is stated only for alpha in (1,2]; the alpha = 1 case is handled later in Theorem 25 via the closed-form Cauchy density, but Theorem 16 should either cite that argument or give the direct Cauchy computation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces the Symmetric alpha-Stable (SaS) mechanism for differential privacy, with stability parameter alpha in [1,2), and claims that it satisfies pure epsilon-DP because the ratio of two shifted SaS densities tends to 1 as |x| tends to infinity. It further claims that the privacy budget scales linearly with the query's ell_1 sensitivity and inversely with the noise scale, provides explicit formulas for alpha = 1, and compares the mean absolute deviation of the mechanism with those of the Laplace and Gaussian mechanisms. The manuscript is an extension of a CISS conference paper and positions the SaS mechanism as combining the convolution closure of the Gaussian family with a pure, rather than approximate, DP guarantee.","tokens_in":19686,"tokens_out":4538,"duration_ms":47134,"significance":"If the central theorem is correct, the paper makes a useful conceptual contribution: stable noise with alpha < 2 is arguably the first commonly used noise family that is simultaneously closed under convolution and satisfies pure differential privacy, which matters for distributed and federated settings. The derivation is self-contained and parameter-free; it relies on classical external results (Nolan 2020, Bergstrom 1952) rather than on fitted constants, and the explicit alpha = 1 bounds together with the expected-distortion comparisons are concrete and reproducible. However, the paper's second contribution, the epsilon proportional to Delta_1/gamma scaling law, is only proved pointwise for general alpha and in closed form for alpha = 1; this is a substantive gap between what is claimed and what is established.","major_comments":[{"comment":"The displayed substitution in Eq. (27) is incorrect. The correct scaling identity is p(x; alpha, gamma, mu) = gamma^{-1} p((x - mu)/gamma; alpha, 1, 0), so the integral is missing the Jacobian factor 1/gamma and the location parameter must be rescaled to mu/gamma rather than left as mu. The conclusion of the lemma is true, but the printed proof does not establish it; please replace Eq. (27) with the correct identity and re-derive Eqs. (28)-(29) from it.","section":"Section 4, Lemma 15, Eq. (27)"},{"comment":"Theorem 16 is stated for alpha in [1,2), but the asymptotic argument invokes Lemma 14, which is stated only for alpha in (1,2]. The case alpha = 1 is therefore not covered by the proof as written. Since the alpha = 1 density has the closed Cauchy form, either prove the tail-ratio limit directly for alpha = 1 or cite the computation in Theorem 25 and make explicit that it supplies the missing boundary case.","section":"Section 4, proof of Theorem 16"},{"comment":"The proof of Theorem 19 is an informal geometric argument about shifting bell-shaped curves, and the statement that the distance between the two curves necessarily increases under the shift is asserted rather than derived from Lemma 18. Because Corollary 20, Theorem 21, and the normalized form in Eq. (51) all rely on the maximizer being at the range boundary, this issue is load-bearing. Please provide a rigorous argument (for example, via monotonicity of the likelihood ratio on each side of the modes) or state precisely which additional hypothesis is needed.","section":"Section 5.1, Theorem 19 and its use"},{"comment":"Theorem 24 establishes the pointwise bound |L(x)|(gamma) = O(Delta_1/gamma) for each fixed observation x as gamma tends to infinity. It does not prove that max_x |L(x)|(gamma) = O(Delta_1/gamma), which is the quantity identified with epsilon in Eq. (11). The sentence immediately after Theorem 24 acknowledges this limitation, but Eq. (41) and the surrounding text nonetheless assert the scaling law for the mechanism's privacy budget. Please either provide a uniform-in-x argument or explicitly restate the scaling law as a conjecture supported by Figure 8.","section":"Section 5.1, Theorem 24 and Eq. (41)"}],"minor_comments":[{"comment":"There is a grammatical error: 'we present and analyze of the Symmetric alpha-Stable mechanism' should read 'we present and analyze the Symmetric alpha-Stable mechanism'.","section":"Abstract"},{"comment":"The proof refers to 'Lemma 19', which does not exist; the reference should be to Theorem 19.","section":"Section 5.1, proof of Theorem 24"},{"comment":"The notation x-hat is used before it is defined; please define x-hat = (x - mu)/gamma or an equivalent rescaling.","section":"Section 4, Eq. (27)"},{"comment":"The convention that a mechanism whose supports differ is assigned epsilon = infinity is nonstandard and can conflict with the usual formulation of pure DP on a common support; please clarify this convention.","section":"Section 2.1, Definition 5"},{"comment":"The numerical claim that the maximum privacy loss falls off at the same rate as the Laplace mechanism is presented without confidence intervals or a fitted slope; adding the fitted asymptotic slope or an error measure would make the claim more transparent.","section":"Section 5, Figure 8"}],"recommendation":"major_revision","confidential_remarks":"The paper is an extension of a conference paper with a likely-correct central theorem, but several supporting proofs need repair. The most important issue for the editor is the mismatch between the claimed scaling law epsilon proportional to Delta_1/gamma for general alpha and what is actually proved, which is only a pointwise O(Delta_1/gamma) bound. The pure-DP theorem itself is probably salvageable with the fixes to Lemma 15 and the alpha = 1 case, so I do not recommend rejection, but the manuscript should not appear in its current form."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core theorem is true and the paper fills a small but real gap: SaS noise with alpha in [1,2) gives pure epsilon-DP while staying closed under convolution, which neither Laplace nor Gaussian can do alone. The tail-ratio argument in Theorem 16 is the right one and the Cauchy closed form is a nice check. That said, the main theorem is not new — it appeared in the authors' CISS 2024 paper. What this version adds is the closed-form epsilon for alpha=1, the asymptotic O(Delta/gamma) analysis, and the error comparison. Those are useful extensions.\n\nThe soft spots are real but mostly cosmetic. Lemma 15's proof as printed has a wrong change of variables: Eq. (27) drops the 1/gamma Jacobian and fails to rescale mu, so the displayed identity is false. The lemma's conclusion is correct and follows directly from the scaling property p(x;gamma,mu)=gamma^{-1} p_1((x-mu)/gamma), so this is a typo-adjacent rigor gap, not a fatal flaw. Lemma 14 is stated for alpha in (1,2] but is cited in Theorem 16 to cover alpha=1; the alpha=1 case is handled later in Theorem 25 via the Cauchy density, so the proof just needs to point there earlier. Theorem 19's geometric argument is informal and not a proof, though it is plausible and consistent with the numerics. Theorem 24 only shows pointwise scaling; the paper honestly acknowledges it cannot get the max without more information. The later claim that epsilon scales like Delta/gamma is only proven for alpha=1 and suggested by numerics for other alpha; that should be labeled as a conjecture.\n\nThe least fair part is the conclusion that \"there is little reason to use the Gaussian mechanism.\" That overreaches. Gaussian approximate DP composes better, and for many applications delta is tiny. SaS also has infinite variance, which raises its own utility questions. The paper's own Table 1 shows that for alpha close to 2 the error is nearly identical, so the practical gain is marginal. The right claim is that SaS is a legitimate alternative for settings where pure DP and convolution closure both matter.\n\nCitation pattern looks honest. The self-citation is the predecessor paper, not a hidden dependency. Benchmarks to Nolan and Bergstrom are appropriate.\n\nVerdict: deserving of peer review. The main theorem is correct, the extensions are useful, and the gaps are fixable with a careful revision. A serious referee should engage.","headline":"Correct core result with real but fixable rigor gaps; worth a serious referee.","tokens_in":20185,"tokens_out":2267,"would_cite":true,"duration_ms":21728,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["60E07","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that adding symmetric alpha-stable noise to bounded query answers yields pure ε-differential privacy while keeping the Gaussian mechanism's closure under convolution.","keywords":["differential privacy","pure differential privacy","symmetric alpha-stable distribution","heavy-tailed noise","stable distributions","convolution closure","federated learning","mean absolute error"],"falsifier":"For α=1.5, γ=1 and sensitivity Δ=1, evaluate the density ratio p_SaS(x−1;α,γ)/p_SaS(x;α,γ) by high-precision numerical inversion of the characteristic function at |x|=$10^{3}$, $10^{4}$ and $10^{5}$; if the log-ratio does not tend to 0 as |x| grows, the tail argument behind Theorem 16 is wrong, and if the supremum over a nested grid grows without bound, the claimed finite ε does not hold.","tokens_in":19237,"feed_emoji":"🔒","tokens_out":8435,"duration_ms":78397,"temperature":0.7,"pith_summary":"This paper introduces the Symmetric alpha-Stable (SaS) privacy mechanism, which perturbs query answers with noise drawn from a symmetric stable distribution with tail parameter α in [1,2). Its central claim is that this mechanism satisfies pure ε-differential privacy, not merely the approximate (ε,δ) guarantee that the Gaussian mechanism provides, while remaining closed under convolution like the Gaussian. If correct, the result gives distributed and federated settings a noise distribution that can be added locally by many clients and still aggregate into the same family with a pure privacy guarantee. The paper also shows that the privacy budget scales inversely with the noise scale and that the mean absolute error can be made nearly equal to the Gaussian's by taking α close to 2.","feed_headline":"Stable noise gives pure privacy and composes like Gaussian","feed_subtitle":"A strict epsilon guarantee that still sums cleanly across clients like Gaussian noise","key_machinery":"The load-bearing object is the symmetric $\\alpha$-stable density p_SaS(x;α,γ,μ) defined through its characteristic function φ(t)=exp(-|γt|^α - i t μ) and the integral inversion formula; the mechanism adds independent SaS noise to each query coordinate. The proof machinery consists of two asymptotic expansions of this density due to Bergström: one at infinity showing p(x) ~ -(1/π) Γ(α+1) sin(απ/2) $x^{{-(α+1)}}$, which makes the shifted-density ratio tend to 1 and kills the privacy loss at large |x|, and one near zero used to show that the privacy loss scales as O(Δ1/γ). Bell-shape monotonicity is used to show that the worst case occurs at the extremes of the query range, and the closed Cauchy form (α=1) supplies explicit asymptotic formulas.","core_discovery":"The paper's central discovery is Theorem 16: for a bounded query f, for any neighboring datasets D1 and D2, and for any stability parameter α∈[1,2), the SaS mechanism satisfies p1(x) ≤ e^ε p2(x) for all outputs x, i.e. pure differential privacy. The argument splits the privacy loss into compact and tail regions; on compact sets, the density is strictly positive and bounded, and in the tail, a series expansion shows the density decays as |x|^{-(α+1)} with a location-independent leading term, so the log-ratio of the two shifted densities tends to 0 as |x|→∞. The paper further claims the level of privacy is governed by the ratio of query sensitivity to noise scale, ε = O(Δ1/γ), and that for α near 2 the mean absolute error is almost identical to the Gaussian's, leading to the conclusion that the SaS mechanism can replace the Gaussian without sacrificing the convolution property or the purity of the guarantee.","pith_inferences":["The convolution-closure argument suggests a local-DP pipeline: each client adds SaS noise locally, the server averages, and the aggregate noise remains SaS; the paper does not carry out the full composition or shuffling privacy accounting, so the exact ε for the aggregated mechanism is an open computation.","The proof's tail mechanism is generic: any symmetric noise whose shifted densities have matching power-law tails should admit a similar pure-DP argument, which would generalize the mechanism beyond the stable family if such densities remain closed enough for aggregation.","The m-factor bound in the proof is crude for vector queries; numerical optimization of the multidimensional privacy loss could reveal that practical ε budgets are smaller than the paper's worst-case bound, a testable refinement.","As α→2 the SaS privacy loss approaches the unbounded linear loss of the Gaussian, so the practical choice of α is a continuous knob trading purity of the guarantee against tail risk; the paper leaves the optimal choice to application-specific tuning."],"forward_implications":["In settings that aggregate many local noise additions, the SaS mechanism keeps the Gaussian's advantage: a sum of independent SaS noises is again SaS, so the aggregate mechanism remains in the same family and can still claim the same pure-DP structure.","Choosing α=1.999 gives almost the same expected absolute error as Gaussian noise (about 0.04% larger) while providing a pure privacy guarantee instead of an approximate one.","The privacy budget scales as ~Δ1/γ for large noise scale, matching Laplace; for small scale and α=1 it grows only as O(log(1/γ)), so over-noising is less punishing than for the Laplace mechanism in that regime.","Real-valued queries that currently force a δ term under Gaussian noise can instead be answered with a strict ε bound using SaS noise, at the cost of heavier tails and occasional large perturbations.","The inverse relation between ε and γ carries over: improving privacy (smaller ε) necessarily increases the expected distortion of query answers."],"supporting_citations":[{"why":"Supplies the density-ratio form of pure DP, the privacy-loss definition, the Laplace/Gaussian baseline mechanisms, and the mean-absolute-deviation error measure used throughout.","marker":"Dwork and Roth (2014)"},{"why":"Provides the asymptotic series for the stable density at infinity and near zero that Theorem 16 and Theorem 24 use to bound the privacy loss.","marker":"Bergström (1952)"},{"why":"Establishes that stable densities have full real-line support and supplies the strictly-stable mean-absolute-deviation formula used in the error analysis.","marker":"Nolan (2020)"},{"why":"Sets out how Laplace and Gaussian noise are calibrated to sensitivity, defining the approximate-DP baseline the SaS guarantee is compared against.","marker":"Dwork et al. (2006b)"},{"why":"Source of the stable family and the closure-under-convolution property that makes the SaS mechanism aggregation-friendly.","marker":"Lévy (1925)"},{"why":"Shows that stable densities are bell-shaped, used to prove that the maximum privacy loss occurs at the boundary of the query range.","marker":"Kwaśnicki (2020)"}],"fun_headline_variants":["Stable noise: pure differential privacy, additive like Gaussian","Symmetric alpha-stable mechanism delivers pure DP, sums cleanly","Pure epsilon privacy from heavy-tailed noise, no Gaussian crutch","Alpha-stable noise: strict privacy with convolution-friendly tails","SaS mechanism: pure DP with error rivaling Gaussian near alpha 2"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof rests on the assumption that at very large outputs the two shifted stable densities look identical in their tails, so their ratio approaches 1; that asymptotic scale-independence is asserted in Lemma 15 rather than fully proved, and if it failed the privacy loss could become unbounded and pure DP would collapse.","fun_headline_variants_meta":{"raw":{"variants":["Stable noise: pure differential privacy, additive like Gaussian","Symmetric alpha-stable mechanism delivers pure DP, sums cleanly","Pure epsilon privacy from heavy-tailed noise, no Gaussian crutch","Alpha-stable noise: strict privacy with convolution-friendly tails","SaS mechanism: pure DP with error rivaling Gaussian near alpha 2"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000236,"raw_usage":{"total_tokens":1496,"prompt_tokens":930,"completion_tokens":566,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":546,"completion_tokens_details":{"reasoning_tokens":478}},"tokens_in":546,"tokens_out":566,"duration_ms":5987,"temperature":1.0,"reasoning_tokens":478,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:17:13.605222+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For α=1.5, γ=1 and sensitivity Δ=1, evaluate the density ratio p_SaS(x−1;α,γ)/p_SaS(x;α,γ) by high-precision numerical inversion of the characteristic function at |x|=$10^{3}$, $10^{4}$ and $10^{5}$; if the log-ratio does not tend to 0 as |x| grows, the tail argument behind Theorem 16 is wrong, and if the supremum over a nested grid grows without bound, the claimed finite ε does not hold.","supporting_citations":[],"review_version":1}