{"id":"22785c25-0ffc-42a8-a435-13d8d4f67e22","arxiv_id":"2606.20546","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Predictability is defined as incremental predictive gain for attackers with partial dataset knowledge; it is incomparable to DP in general but implies mutual-information DP in the worst case of one uncompromised individual and all binary queries, with a GMM-based asymptotic analysis yielding a calib","lead":"The paper introduces predictability as a privacy metric that quantifies the additional ability an attacker gains to predict sensitive information about unknown individuals after seeing an algorithm's output, given some compromised data from a stochastic process. This offers a more tailored alternative to differential privacy by incorporating specific attacker knowledge and query families.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"GMM analysis for asymptotic predictability and ERM perturbation scheme requires stationary ergodic mixing process","rationale":"The reader's weakest_assumption exactly identifies the load-bearing technical precondition for the GMM-derived scheme. No other internal inconsistency or unsupported step is visible from the abstract and stated claims; the worst-case implication to MI-DP stands apart from the stochastic-process requirement. Because the assumption is disclosed rather than hidden, the appropriate response is to keep the existing UNVERDICTED verdict while noting the scope limitation.","tokens_in":1746,"tokens_out":341,"duration_ms":17232,"concrete_test":"Generate synthetic compromised datasets from a non-mixing process (e.g., a deterministic periodic sequence with period larger than sample size) and recompute the GMM-based asymptotic predictability estimator; compare against direct Monte-Carlo estimation of the incremental prediction gain. Divergence larger than the claimed convergence rate indicates the assumption is necessary for the reported guarantees.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's general framework for analyzing asymptotic predictability (and the derived predictability-calibrated output perturbation for ERM) rests on the compromised data being generated by a stationary, ergodic, mixing stochastic process so that the generalized method of moments applies. This is stated explicitly as the setting for the analysis. If typical datasets violate mixing or ergodicity (long-range dependence, non-stationary regimes, or finite-sample effects that break the asymptotic GMM conditions), the predictability bounds and the resulting calibration scheme lose their justification. The incomparability result and the worst-case implication to mutual-information DP are presented separately and do not invoke this assumption, but the concrete algorithmic contribution does.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces 'privacy via predictability,' a fine-grained privacy framework that measures leakage as the incremental gain in an attacker's ability to predict sensitive attributes of unknown individuals after observing an algorithm's output, given a compromised portion of the dataset generated by a stochastic process and a specified family of queries. It establishes general incomparability between predictability and differential privacy, shows that predictability implies mutual-information DP in the worst-case regime (all but one individual compromised, all binary queries sensitive), and develops a GMM-based framework for asymptotic predictability analysis under stationary ergodic mixing processes, from which a predictability-calibrated output perturbation scheme for ERM is derived. The approach is positioned as complementary to DP.","tokens_in":1888,"tokens_out":508,"duration_ms":19380,"significance":"If the formal results and derivations hold, the work provides a useful complementary metric to DP by explicitly modeling partial attacker knowledge and query families, enabling finer control over privacy-accuracy tradeoffs. The worst-case implication to MI-DP is a concrete bridge to existing privacy notions, and the GMM analysis under explicit stochastic assumptions is a methodological strength for asymptotic regimes. The ERM perturbation scheme offers a practical instantiation.","major_comments":[{"comment":"The GMM framework for asymptotic predictability (and the derived predictability-calibrated output perturbation for ERM) is explicitly conditioned on the compromised data being generated by a stationary, ergodic, mixing stochastic process. This assumption is load-bearing for the algorithmic contribution, as violations (e.g., long-range dependence or non-stationarity common in real datasets) would invalidate the GMM conditions and the resulting bounds.","section":"GMM analysis framework (abstract and associated sections)"},{"comment":"The claim that predictability implies mutual-information DP in the worst-case regime (all but one individual compromised, all binary queries sensitive) is stated as a derived result. Without the explicit definitions of predictability, the formalization of the implication, or the proof details, it is not possible to assess whether the implication is independent or follows tautologically from the definitions.","section":"Worst-case implication to MI-DP (abstract and associated sections)"}],"minor_comments":[{"comment":"The abstract states the incomparability result and the worst-case implication but does not preview the precise conditions or counter-examples; expanding this would improve clarity for readers.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback and for recognizing the potential of predictability as a complementary privacy metric. We address each major comment below with specific responses and proposed revisions where appropriate.","responses":[{"response":"We agree that the GMM framework is conditioned on the compromised data following a stationary, ergodic, mixing process, as explicitly stated in the abstract and developed in the relevant sections. This assumption enables the asymptotic analysis and the derivation of the calibrated perturbation scheme. We will revise the manuscript to add an expanded discussion subsection on the scope and limitations of these assumptions, including examples of when they may not hold (e.g., non-stationary data) and noting that the results apply in regimes satisfying the conditions. This addresses the concern without changing the core technical contribution.","revision_made":"partial","referee_comment":"[GMM analysis framework (abstract and associated sections)] The GMM framework for asymptotic predictability (and the derived predictability-calibrated output perturbation for ERM) is explicitly conditioned on the compromised data being generated by a stationary, ergodic, mixing stochastic process. This assumption is load-bearing for the algorithmic contribution, as violations (e.g., long-range dependence or non-stationarity common in real datasets) would invalidate the GMM conditions and the resulting bounds."},{"response":"The definitions of predictability (including the incremental predictive gain measure) are provided in Section 2, with the formal definition in Definition 2.3. The worst-case implication is stated and proved as Theorem 4.2 in Section 4, showing that zero predictability implies the relevant mutual information term vanishes in the specified regime (all but one compromised, binary queries). The proof in Appendix C establishes the connection by relating the predictability metric to conditional mutual information under the worst-case attacker; it is not tautological, as it requires a non-trivial bounding argument. We will revise to include a high-level proof sketch in the main text of Section 4 to facilitate assessment.","revision_made":"partial","referee_comment":"[Worst-case implication to MI-DP (abstract and associated sections)] The claim that predictability implies mutual-information DP in the worst-case regime (all but one individual compromised, all binary queries sensitive) is stated as a derived result. Without the explicit definitions of predictability, the formalization of the implication, or the proof details, it is not possible to assess whether the implication is independent or follows tautologically from the definitions."}],"tokens_in":1470,"tokens_out":520,"duration_ms":24017,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper defines predictability as the extra ability an attacker gains to predict sensitive info about uncompromised individuals after seeing the output, on top of what they already know from the compromised part of the data. It shows this measure is generally incomparable to differential privacy, yet implies mutual-information DP in the worst case where only one record is uncompromised and all binary queries count as sensitive. They also supply a GMM framework to analyze asymptotic predictability when the compromised data comes from a stationary ergodic mixing process, and they use that to build a predictability-calibrated output perturbation for ERM.\n\nThe definition itself is the clearest addition. It makes the attacker's prior knowledge and the query family explicit parameters, which lets the privacy level adjust to the actual setting instead of always taking the worst case. That is a reasonable direction if the goal is to avoid over-protecting against unrealistic attackers.\n\nThe main limitation is the mixing and ergodicity requirement for the GMM analysis and the resulting perturbation scheme. Real datasets often have long-range dependence or non-stationarity, so the concrete algorithmic contribution would lose its justification outside that regime. The incomparability and worst-case implication do not rely on the assumption, but without the full proofs it is hard to see how tight those results are or whether the derivation introduces hidden circularity.\n\nThis is for researchers who already work on privacy notions that try to incorporate partial attacker knowledge. A reader looking for complements to DP rather than replacements would find the framing useful. The work deserves a serious referee because the core idea is cleanly stated and the worst-case link to MI-DP is worth checking in detail, even if the GMM part needs the assumption to hold.","headline":"Predictability gives a tunable privacy metric weaker than DP when attacker knowledge is partial, but the ERM perturbation scheme rests on a strong assumption about the data process.","tokens_in":2375,"tokens_out":414,"would_cite":false,"duration_ms":16390,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Privacy via predictability measures leakage as the extra predictive power an algorithm output gives on sensitive queries about uncompromised individuals.","keywords":["predictability","privacy","differential privacy","generalized method of moments","stochastic processes","output perturbation","empirical risk minimization","mutual information"],"falsifier":"A concrete instance with all but one record compromised and binary queries where predictability is small yet the mutual information between the output and the sensitive bit on the remaining record is large.","tokens_in":2643,"feed_emoji":"🔐","tokens_out":692,"duration_ms":23522,"temperature":0.7,"pith_summary":"The paper defines predictability as the gain in an attacker's ability to predict sensitive information about unknown individuals from the algorithm output, after already using knowledge of a compromised data portion generated by a stochastic process. This produces a privacy metric that incorporates the attacker's specific knowledge and a chosen family of queries, making it finer-grained than differential privacy. The two measures are shown to be incomparable in general, yet predictability implies mutual-information differential privacy when all but one individual is compromised and queries are binary. A generalized method of moments framework analyzes asymptotic predictability under stationary ergodic mixing processes and yields a calibrated output perturbation for empirical risk minimization.","feed_headline":"Predictability measures privacy leakage as prediction gain on unknowns","feed_subtitle":"It accounts for known compromised data and specific queries, implying mutual-information DP when nearly all records are compromised.","key_machinery":"Generalized method of moments analysis of asymptotic predictability for data generated by stationary, ergodic, mixing stochastic processes, which supports construction of output perturbations that control predictability.","core_discovery":"Predictability is the incremental improvement in an attacker's ability to predict sensitive information about unknown individuals from the algorithm's output, beyond what is inferable from the compromised data portion. In the regime where all but one record is compromised and all binary queries are sensitive, this measure implies mutual-information differential privacy. A GMM-based analysis under stationary ergodic mixing processes enables derivation of predictability-calibrated perturbation schemes for ERM algorithms.","pith_inferences":["Mechanisms could achieve higher accuracy by exploiting known structure in the data generation process instead of worst-case assumptions.","Layering predictability with DP could protect against both known and unknown threats in the same system.","The GMM approach could extend to other algorithms or mildly non-stationary processes if the mixing condition is relaxed appropriately.","Finite-sample predictability could be validated directly on synthetic data drawn from mixing processes to test the asymptotic bounds."],"forward_implications":["Predictability and differential privacy are incomparable: each can be small while the other is large.","In the worst-case regime where all but one individual is compromised and all binary queries are sensitive, predictability implies mutual-information DP.","The GMM framework permits asymptotic analysis of predictability when the compromised data follows a stationary, ergodic, mixing process.","A predictability-calibrated output perturbation scheme exists for empirical risk minimization.","Predictability supplies finer-grained control by tailoring the metric to specific sensitive information and attacker models."],"fun_headline_variants":["Predictability gauges privacy as attacker prediction gains","Fine grained privacy via predictability beyond compromised data","Predictability implies mutual info DP near full compromise","GMM analysis calibrates ERM output perturbations for privacy"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The compromised portion of the dataset is generated by a stationary, ergodic, mixing stochastic process.","fun_headline_variants_meta":{"raw":{"variants":["Predictability gauges privacy as attacker prediction gains","Fine grained privacy via predictability beyond compromised data","Predictability implies mutual info DP near full compromise","GMM analysis calibrates ERM output perturbations for privacy"]},"model":"grok-4.3","cost_usd":0.006081,"raw_usage":{"total_tokens":2878,"prompt_tokens":676,"num_sources_used":0,"completion_tokens":58,"cost_in_usd_ticks":60812000,"prompt_tokens_details":{"text_tokens":676,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2144,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":676,"tokens_out":58,"duration_ms":15017,"temperature":1.0,"reasoning_tokens":2144,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-26T17:31:51.560679+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A concrete instance with all but one record compromised and binary queries where predictability is small yet the mutual information between the output and the sensitive bit on the remaining record is large.","supporting_citations":[],"review_version":1}