{"id":"328f24fd-5d7d-46dc-8d7b-2150dcb9ccd0","arxiv_id":"2506.21308","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"BDP mechanisms can be built from standard DP mechanisms with bounded utility loss when correlations are Gaussian with small rho or Markov with similar transition probabilities.","lead":"This paper gives new mathematical bounds that let standard differentially private mechanisms be reused when database records are correlated, either through Gaussian dependencies or Markov-chain time series. The authors show that the privacy loss can be calibrated from a small number of correlation parameters instead of growing with the whole database, which makes Bayesian differential privacy practical in cases where it previously added too much noise.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Markov-chain empirical claims rely on stationarity assumption H2 being asserted rather than verified; irreducibility and aperiodicity only guarantee existence of a stationary distribution, not that the observed chain starts in it.","rationale":"The reader's weakest assumption is precisely the Markov-chain stationarity condition H2, and the manuscript evidence supports that concern. The theoretical content of Theorem 6.5 appears internally consistent under H1 and H2, and the Gaussian and general bounds are not affected by this issue. However, the empirical validation for the Markov model, including the headline utility gains on Activity and Electricity data, depends on an assumption that is asserted from irreducibility and aperiodicity rather than verified. A single trajectory cannot empirically determine the initial distribution, and the paper's own remark about asymptotic convergence indicates the need for burn-in that is never applied. This is not a fatal flaw in the theorems, but it is a load-bearing gap in the experimental claims. A concrete fix is to test stationarity or discard a burn-in period and show that the privacy-utility curves are unchanged; without that, the reported ε + 4 ln γ privacy levels for real-world Markov data should be treated as conditional on an unverified modeling assumption. The verdict should remain CONDITIONAL, with the condition being the verification or explicit limitation of H2 for the empirical Markov results. No objection is raised to the correctness of the theoretical derivations under their stated assumptions, and the general and Gaussian experiments provide independent support for the paper's main mechanism-construction methodology.","tokens_in":37295,"tokens_out":5603,"duration_ms":73744,"concrete_test":"Re-run the Markov experiments on Activity and Electricity with the first T observations discarded as burn-in (e.g., T = 10% and T = 50%), re-estimate the transition matrix on the remaining segment, and recompute γ and the resulting empirical 95% error curves in Figure 8. Additionally, for each fitted transition matrix, compute the exact maximum likelihood ratio max_{xU,xK,xi,xi'} Pr[xU | xK, xi] / Pr[xU | xK, xi'] using dynamic programming with a deliberately non-stationary initial distribution, and compare it with γ^4; if the ratio exceeds γ^4, or if the burn-in changes the achievable privacy-utility trade-off materially, the stationarity assumption H2 is essential and the current empirical privacy claims are not justified.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Theorem 6.5 and Corollary 6.6 require both H1 (positive transition probabilities) and H2 (initial distribution w satisfies wP = w). Lemma 6.4 depends on H2 to establish that Pr[Xi = x] = wx for every time step, which is then used to bound all likelihood-ratio terms by γ or γ^2. If the observed Activity or Electricity chain starts from a transient distribution, the marginal Pr[Xi = x] varies with i and can be arbitrarily far from w, so the γ^4 bound in Lemma 6.4 can fail and the advertised ε = τ + 4 ln γ privacy levels in Eq. (7.1) are unsupported. Section 7.1.2 states: both chains are irreducible and aperiodic, 'hence there exists a stationary initial distribution [11]. Therefore, we conclude that the databases fulfill the conditions.' This is a logical error: irreducibility and aperiodicity imply that a unique stationary distribution exists and that the chain converges to it, not that the single observed trajectory is already in that distribution from time step 1. The paper itself acknowledges that convergence holds only 'after discarding a sufficient initial portion of the process,' but no burn-in is removed in the experiments, and with one trajectory the initial distribution is not even identifiable from the data. The theoretical theorem may still be correct; the concern is load-bearing for the empirical Markov privacy guarantees and for the utility comparisons in Section 7.4 that depend on specific achievable ε values.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies Bayesian differential privacy (BDP) for correlated data and asks whether BDP mechanisms can be built from standard DP mechanisms without prohibitive utility loss. The authors prove a general bound (Theorem 4.3): any ε-DP mechanism on data with at most m correlated records satisfies mε-BDP, and they give a tightness example. They then derive two correlation-specific improvements: for multivariate Gaussian data with bounded pairwise Pearson correlation ρ and at most m correlated variables, a clipped εℓ1-private mechanism satisfies hMε-BDP with h = m²/(4(1/ρ − m + 2)) + 1 when ρ(m−2) < 1 (Theorem 5.9); for Markov-chain data with positive transition probabilities and a stationary initial distribution, an ε-DP mechanism satisfies (ε + 4 ln γ)-BDP, where γ is the ratio of the largest to smallest transition probability (Theorem 6.5). Accuracy corollaries give the corresponding Laplace-mechanism error inflation factors. The paper also reports experiments on Galton height, FamilyIQ, Activity, and Electricity data, claiming that the correlation-specific bounds substantially improve utility over the general bound and over prior work.","tokens_in":37601,"tokens_out":10211,"duration_ms":113963,"significance":"If the results hold, they give a practical recipe for recalibrating standard Laplace mechanisms to satisfy BDP under Gaussian and Markov correlation models, improving on the Gaussian Markov random field bound of Yang et al. and on the binary Markov-chain randomized-response mechanism of Chakrabarti et al. The theoretical core is a clear contribution: Theorems 4.3, 5.9, and 6.5 are stated formally and proved with explicit arguments, the tightness of the general bound is demonstrated by a concrete construction, reproducible code is provided, and the accuracy corollaries give directly usable noise-calibration formulas. The main caveat is empirical: the Markov-chain experiments rely on a stationarity assumption that is asserted but not verified, and the Gaussian experiments do not check the block-independence and constant-variance conditions of the model. These issues do not invalidate the theoretical theorems, but they do undermine the paper's claim of demonstrating practical applicability on real-world data as currently written.","major_comments":[{"comment":"The inference from irreducibility and aperiodicity to the stationarity assumption H2 is a logical error. The text states that the Activity and Electricity chains are irreducible, aperiodic, and have positive transition probabilities, 'hence there exists a stationary initial distribution [11]. Therefore, we conclude that the databases fulfill the conditions.' Existence of a stationary distribution does not imply that the observed time series starts in that distribution. Lemma 6.4 and Theorem 6.5 explicitly require H2 (wP = w) to conclude Pr[Xi = x] = wx for every time step and to derive the γ⁴ density-ratio bound. Without H2, the privacy levels in Eq. (7.1) and the utility comparisons in Section 7.4 for Activity and Electricity are unsupported. The authors need to verify stationarity empirically (for example, by testing whether the estimated initial distribution satisfies wP ≈ w), discard a burn-in period and restate the guarantee for the post-burn-in process, or clearly label the experiments as conditional on an unverified H2 assumption.","section":"Section 7.1.2"},{"comment":"The paper itself repeats the same conflation in the discussion following Theorem 6.5: condition (H1) is said to imply irreducibility and aperiodicity, 'which in turn guarantees the existence of a unique stationary distribution w [32], thereby satisfying (H2).' Convergence to a stationary distribution is not the same as being initialized in it. This sentence should be corrected to state that H2 is an additional modeling assumption that must be justified for the data at hand, not a consequence of H1.","section":"Section 6.1, after Theorem 6.5"},{"comment":"The Gaussian theorems are stated for a 'limited covariance matrix' with constant diagonal and pairwise correlations bounded by ρ, but the proof of Theorem 5.6 also uses the block-independence structure of Definition 4.2, i.e., that the covariance matrix is block diagonal with blocks of size at most m and zeros between independent blocks. This block structure is not stated in Theorem 5.6 or Theorem 5.9. Moreover, Section 7.1.1 claims that all explored datasets fulfill the conditions of Theorem 5.9, but it only reports the Pearson correlation ρ and the condition ρ(m−2)<1; it does not verify the constant-variance requirement or the block-independence of the Galton and FamilyIQ records. The empirical support for the Gaussian bound would be strengthened by explicitly stating and checking these assumptions, or by acknowledging them as additional unverified modeling choices.","section":"Section 5 and Section 7.1.1"}],"minor_comments":[{"comment":"The chain of equalities contains an algebraic error: e^{-ε}(1−β) is not equal to 1/(e^ε+1). The conclusion β > 1/(e^ε+1) follows from the assumption β < 1/(e^ε+1) via the inequality e^{-ε}(1−β) > β, so the equality signs should be replaced by an inequality or the intermediate expression should be corrected.","section":"Section 4.1, proof of Proposition 4.1"},{"comment":"In the case U = ∅, the text says 'ε ≤ ε + 4γ', but the bound should read 'ε ≤ ε + 4 ln γ'. This is a typographical error, but it appears in a proof and should be fixed.","section":"Section 6.1, proof of Theorem 6.5"},{"comment":"The notation in the proof is inconsistent: 'x'_H = (x_K, x'_m)' should be 'x'_R = (x_K, x'_m)', and the shift vector γ is written with different signs at different points in the proof. The final norm is unaffected by the sign, but the derivation should be aligned to avoid confusion.","section":"Section 5.1, Lemma 5.5"},{"comment":"The symbol M is overloaded: it denotes both a mechanism and the diameter of the clipping interval. Using a different symbol, such as L = |b−a|, would improve readability.","section":"Section 5.2, Theorem 5.9"},{"comment":"The example shows that BDPL is arbitrarily close to 2ε as r → ∞, not exactly equal to 2ε for any finite r. Since the bound is an upper bound, the limit argument is sufficient for tightness, but the wording 'we have BDPL = 2ε' should be softened to 'BDPL can be made arbitrarily close to 2ε' to be precise.","section":"Section 4.1, Example 4.4"}],"recommendation":"major_revision","confidential_remarks":"The theoretical results appear sound and are likely to be of interest to the privacy community. The main obstacle is the unverified stationarity assumption in the Markov experiments, which is load-bearing for the empirical privacy and utility claims. I would also ask the authors to double-check the novelty claim in Section 4 that they are the first to formalize the free-lunch limitation using (α,β)-accuracy, as this is a strong statement. I have no concerns about citation behavior or scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the theoretical core is solid and genuinely useful. Theorem 4.3 formalizes the m*epsilon heuristic with a nice tightness example where Pearson correlation is arbitrarily small. Theorem 5.9 gives a real improvement over Yang et al.'s GMRF bound, and Theorem 6.5 is the first direct DP-to-BDP conversion for general non-lazy, non-symmetric Markov chains. The proofs are explicit, and I did not find a load-bearing gap in the derivations. The code and data are available, which makes the empirical part checkable. That said, the Markov-chain experiments overclaim. Section 7.1.2 infers stationarity (H2) from irreducibility and aperiodicity, and that inference is just wrong. Those properties guarantee existence of and convergence to a stationary distribution, not that the observed chain starts in one. Lemma 6.4 and Theorem 6.5 rely on w being the initial distribution; with a single trajectory and no burn-in removed, the gamma^4 bound is not supported, so the advertised epsilon = tau + 4 ln gamma values in Eq. (7.1) for Activity and Electricity should not be taken at face value. This is load-bearing for the empirical utility comparison, not for the theorem itself. The Gaussian experiments have a milder but related issue: rho and gamma are estimated from the same data used to report privacy levels, so the accounting should either treat those estimates as part of the model assumption or fold their uncertainty in. There is also a wording slip where Section 7.1.2 calls the setting 'local privacy' while the mechanism is a central Laplace mechanism. None of this sinks the theory. Theorem 6.5 is new, the comparison with Chakrabarti et al. is careful, and the Gaussian bound is tighter and broader than prior work. The target audience is anyone working on DP under correlation, Pufferfish instantiations, or privacy accounting for time series. This paper deserves a serious referee; the theory is worth engaging even if the empirical section needs revision. My recommendation: engage, but require the authors to either verify stationarity (for example, with a burn-in or a formal test) or weaken the empirical claims to what the assumptions actually support.","headline":"Solid theory, overclaimed Markov experiments: the new DP-to-BDP bounds are worth refereeing, but the stationarity assumption in the empirical section is asserted, not established.","tokens_in":38146,"tokens_out":2269,"would_cite":true,"duration_ms":27697,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves that standard differentially private mechanisms can be recalibrated to satisfy Bayesian differential privacy under Gaussian and Markov correlations, with bounded utility loss.","keywords":["Bayesian differential privacy","correlated data","Markov chains","multivariate Gaussian","Laplace mechanism","privacy-utility trade-off","accuracy guarantee","differential privacy"],"falsifier":"Take a real binary time series, estimate its transition matrix $P$, and split it into a burn-in segment and a test segment; if the empirical initial distribution of the test segment differs substantially from the stationary vector $w$ of $P$, then feed the test segment through a Laplace mechanism calibrated as $\\varepsilon' = \\varepsilon - 4\\ln\\gamma$ and measure the worst-case log-ratio $\\log \\frac{\\Pr[Y \\in S \\mid X_K,X_i=x_i]}{\\Pr[Y \\in S \\mid X_K,X_i=x_i']}$; an observed BDPL exceeding $\\varepsilon + 4\\ln\\gamma$ would falsify the Markov-chain claim outside stationarity. For the Gaussian claim, construct data with $\\rho(m-2)<1$ but $\\rho$ chosen so that the bound $hM\\varepsilon$ is just below $m\\varepsilon$; if the empirical BDPL of the clipped Laplace mechanism exceeds the predicted $hM\\varepsilon$, Theorem 5.9 fails.","tokens_in":2177,"feed_emoji":"🔐","tokens_out":8214,"duration_ms":145645,"temperature":0.7,"pith_summary":"Standard differential privacy (DP) underestimates leakage when database records are correlated, and Bayesian differential privacy (BDP) closes that gap but has seemed too noisy to use. This paper shows that the pessimism is not inherent: it proves a tight general bound (any $\\varepsilon$-DP mechanism on data with at most $m$ correlated records is $m\\varepsilon$-BDP), then derives much tighter bounds for two common correlation structures—multivariate Gaussian data and Markov chains. For Gaussian data the BDP leakage of a clipped $\\varepsilon\\ell_1$-private mechanism is bounded by roughly $\\left(\\frac{m^2}{4(1/\\rho - m + 2)} + 1\\right) M \\varepsilon$, and for Markov chains it is $\\varepsilon + 4\\ln \\gamma$ where $\\gamma$ is the ratio of largest to smallest transition probability. These bounds translate directly into a practical recipe: recalibrate an existing DP Laplace mechanism with a smaller privacy budget, and the result is a BDP mechanism with accuracy loss bounded by a constant factor instead of by database size. On four real datasets the recalibrated mechanisms match the theoretical accuracy, showing that correlation-aware BDP can be usable when the correlation model is right.","feed_headline":"Tighter BDP bounds make correlated data privacy usable","feed_subtitle":"Recalibrated Laplace mechanisms keep error low when correlations are known.","key_machinery":"The central object is the Bayesian differential privacy leakage (BDPL), defined as the supremum over adversaries, target values, known records, and output sets of the log-ratio of posterior output probabilities; BDP is the requirement $\\mathrm{BDPL} \\le \\varepsilon$. The argument is carried by three mechanisms. The general bound uses the observation that conditioning on known records, the target's correlated block can be replaced by a full block of unknowns, reducing the worst case to $m$-record DP. The Gaussian bound works through metric privacy: it first proves a Bayesian metric privacy bound (Lemma 5.5) using the fact that conditioning a multivariate Gaussian yields a translated density, with the shift vector $\\gamma = \\Sigma_{U;T} \\Sigma_T^{-1} e_{k+1}$; Gershgorin's circle theorem keeps the inverse covariance entries controlled when $\\rho(m-2)<1$. The Markov bound rests on a generalized Markov property (Lemma 6.3) and Lemma 6.4, which shows that under positivity and stationarity the conditional density ratio for the unknown block is at most $\\gamma^4$; combining this with $\\varepsilon$-DP of the mechanism yields $\\varepsilon + 4\\ln\\gamma$. Clipping (Definition 5.7) is what makes the Gaussian reasoning finite, since it bounds the $\\ell_1$ distance between any two databases by $M$.","core_discovery":"The paper's central discovery is a set of three transfer theorems connecting DP to BDP. Theorem 4.3 proves that an $\\varepsilon$-DP mechanism applied to data whose records form blocks of at most $m$ mutually correlated variables is $m\\varepsilon$-BDP, and Example 4.4 shows the bound is tight even when the Pearson correlation coefficient is arbitrarily small. Theorem 5.9 improves this for data drawn from a multivariate Gaussian with bounded pairwise correlation $\\rho$: a clipped $\\varepsilon\\ell_1$-private mechanism has BDPL at most $\\left(\\frac{m^2}{4(1/\\rho - m + 2)} + 1\\right) M \\varepsilon$, provided $\\rho(m-2)<1$, where $M$ is the clipping interval's length; this is smaller than the general bound whenever $\\rho$ is of order $1/m$. Theorem 6.5 handles Markov chains with positive transition probabilities and a stationary initial distribution: any $\\varepsilon$-DP mechanism is $(\\varepsilon + 4\\ln \\gamma)$-BDP, with $\\gamma$ the ratio of the largest to the smallest transition probability, so the leakage no longer grows with the number of records. Corollaries 4.5, 5.10, and 6.6 turn these bounds into accuracy statements for Laplace-based mechanisms: the error $\\alpha$ inflates by factor $m$, $h = \\frac{m^2}{4(1/\\rho - m + 2)} + 1$, and $\\frac{\\varepsilon}{\\varepsilon - 4\\ln\\gamma}$, respectively. The experiments on Galton height, IQ, activity, and electricity data show that the correlation-specific mechanisms achieve substantially lower error than the general-bound mechanism and prior work.","pith_inferences":["The stationarity caveat implies that applying Theorem 6.5 to real time series requires checking whether the observed process actually starts in the stationary distribution; irreducibility and aperiodicity alone do not license the bound, so a practical deployment would need a burn-in discard or a transient-state analysis.","The tightness example in Section 4 suggests that no universal bound can beat linear scaling in the correlated block size, so the practical route to BDP is model identification: if the correlation structure is unknown, the $m\\varepsilon$ penalty is unavoidable.","The Markov-chain result being independent of $n$ points to a scalable privacy accounting method for long streams and sensor data, where event-level BDP budgets could depend only on the transition-ratio $\\gamma$ and not on the trace length, provided mixing is fast enough.","A natural testable extension is to relax the stationarity assumption to approximate stationarity and measure how the $\\gamma^4$ density-ratio bound degrades as the initial distribution moves away from the stationary vector; the paper's convergence remark suggests a quantitative version involving the mixing time, which is not derived."],"forward_implications":["An analyst who already has an $\\varepsilon$-DP Laplace mechanism can obtain an $\\varepsilon$-BDP mechanism for data with at most $m$ correlated records by using privacy budget $\\varepsilon/m$; the accuracy guarantee degrades by the same factor $m$ (Corollary 4.5).","For weakly correlated Gaussian data with $\\rho(m-2)<1$, the same recalibration costs only a factor $h = \\frac{m^2}{4(1/\\rho - m + 2)} + 1$, which is less than $m$ whenever $\\rho \\le \\frac{m-1}{(5/4)m^2 - 3m + 2}$ (Theorem 5.9 and Corollary 5.10).","For Markov chains with stationary initial distribution and transition ratio $\\gamma$, a DP mechanism with budget $\\varepsilon - 4\\ln\\gamma$ becomes $\\varepsilon$-BDP, and this bound is independent of the chain length $n$; it improves on the general bound whenever $\\gamma < \\exp\\left(\\frac{n-1}{4}\\varepsilon\\right)$ (Theorem 6.5 and Corollary 6.6).","The Markov-chain bound carries a minimum achievable privacy level: because $\\varepsilon - 4\\ln\\gamma$ must be positive, no mechanism built this way can reach $\\varepsilon$ below $4\\ln\\gamma$ for a given transition matrix.","On Galton height, FamilyIQ, SyntheticIQ, Activity, and Electricity datasets, the Gaussian- and Markov-calibrated mechanisms reduce error by orders of magnitude compared to the general bound at the same BDPL, with empirical 95% confidence intervals matching the theoretical $\\alpha$."],"supporting_citations":[{"why":"Defines differential privacy, the Laplace mechanism, and the (α,β)-accuracy used throughout; supplies Proposition 3.5.","marker":"[18]"},{"why":"Introduces Bayesian differential privacy and the BDPL, and gives the Gaussian Markov random field bound that Theorem 5.9 and the experiments must beat.","marker":"[58]"},{"why":"Prior BDP mechanism for binary lazy symmetric Markov chains; the paper's Markov bound generalizes it and the comparison in Section 6.2.1 measures against it.","marker":"[8]"},{"why":"Pufferfish framework and the free-lunch/no-free-lunch results that underlie the impossibility Proposition 4.1.","marker":"[29]"},{"why":"Metric privacy, which Definition 5.3 and Theorem 5.9 build on via εℓ1-privacy and clipping.","marker":"[9]"},{"why":"Source of the (α,β)-accuracy definition used for the utility corollaries.","marker":"[5]"},{"why":"Gives the Markov chain background that supports the claim that positive transitions imply a unique stationary distribution and geometric convergence.","marker":"[32]"},{"why":"Gershgorin circle theorem used to bound eigenvalues of the sub-covariance matrix in the Gaussian proof.","marker":"[21]"}],"fun_headline_variants":["Correlated data privacy gets practical with BDP bounds","BDP mechanisms keep utility high for correlated data","New theorems link DP and BDP for real-world privacy","Correlation-aware privacy from DP to BDP","Making Bayesian differential privacy actually usable"],"cache_read_input_tokens":40192,"weakest_assumption_plain":"The Markov-chain bound requires the time series to actually start in the stationary distribution of its transition matrix; the paper infers this from irreducibility and aperiodicity, but those properties only guarantee that such a distribution exists, not that the observed process is drawn from it.","fun_headline_variants_meta":{"raw":{"variants":["Correlated data privacy gets practical with BDP bounds","BDP mechanisms keep utility high for correlated data","New theorems link DP and BDP for real-world privacy","Correlation-aware privacy from DP to BDP","Making Bayesian differential privacy actually usable"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000536,"raw_usage":{"total_tokens":2635,"prompt_tokens":1065,"completion_tokens":1570,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":681,"completion_tokens_details":{"reasoning_tokens":1499}},"tokens_in":681,"tokens_out":1570,"duration_ms":12210,"temperature":1.0,"reasoning_tokens":1499,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:30:27.173385+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a real binary time series, estimate its transition matrix $P$, and split it into a burn-in segment and a test segment; if the empirical initial distribution of the test segment differs substantially from the stationary vector $w$ of $P$, then feed the test segment through a Laplace mechanism calibrated as $\\varepsilon' = \\varepsilon - 4\\ln\\gamma$ and measure the worst-case log-ratio $\\log \\frac{\\Pr[Y \\in S \\mid X_K,X_i=x_i]}{\\Pr[Y \\in S \\mid X_K,X_i=x_i']}$; an observed BDPL exceeding $\\varepsilon + 4\\ln\\gamma$ would falsify the Markov-chain claim outside stationarity. For the Gaussian claim, construct data with $\\rho(m-2)<1$ but $\\rho$ chosen so that the bound $hM\\varepsilon$ is just below $m\\varepsilon$; if the empirical BDPL of the clipped Laplace mechanism exceeds the predicted $hM\\varepsilon$, Theorem 5.9 fails.","supporting_citations":[{"cited_title":"Optimal Local Bayesian Differential Privacy over Markov Chains","cited_arxiv_id":"2206.11402","evidence_quote":"Prior BDP mechanism for binary lazy symmetric Markov chains; the paper's Markov bound generalizes it and the comparison in Section 6.2.1 measures against it."},{"cited_title":"A learning theory approach to noninteractive database privacy","cited_arxiv_id":null,"evidence_quote":"Source of the (α,β)-accuracy definition used for the utility corollaries."},{"cited_title":"¨Uber die Abgrenzung der Eigenwerte einer Matrix","cited_arxiv_id":null,"evidence_quote":"Gershgorin circle theorem used to bound eigenvalues of the sub-covariance matrix in the Gaussian proof."}],"review_version":1}