Pith. sign in

REVIEW 3 major objections 4 minor 39 references

Locally Private Sampling with Public Data

T0 review · 3 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves that, for finite discrete distributions, one ε-locally-private Markov kernel built from a public prior q is simultaneously minimax optimal for every f-divergence, with worst-case utility depending only on qmin.

desk verdict A clean minimax LDP-sampling result with a public prior, correct for full-support priors but missing a stated support assumption; worth a serious referee after revision. read the letter →

arxiv 2411.08791 v2 pith:L6HKM5PV submitted 2024-11-13 cs.LG

Behnoosh Zamanlooy , Mario Diaz , Shahab Asoodeh This is my paper · ORCID
classification cs.LG MSC 68P2762B1094A17
keywords localdifferentialprivacyprivatesamplingf-divergenceminimaxoptimalitypublicpriorMarkovkernelrandomizedresponseprivacy-utilitytradeoff
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks how a user can release one sample that approximates their private data distribution p while leaving a public prior distribution q untouched, under ε-local differential privacy. The authors prove that the best possible tradeoff over all ε-LDP Markov kernels that preserve q is exactly a value that depends on the prior only through its smallest atom qmin and on the privacy budget ε. They then give a recursive algorithm that constructs a kernel achieving this bound, and show that the same kernel is optimal no matter which f-divergence is used to measure utility. This matters because a public prior is often available—demographics, aggregate click rates, genre preferences—and the paper's experiments indicate that using it can sharply reduce worst-case distortion compared to private sampling without it.

What carries the argument

The central object is an ε-LDP Markov kernel K on the probability simplex that satisfies qK = q, meaning the public prior is a fixed point of the mechanism. The load-bearing identity is Lemma 1: sup_p D_f(p||pK) = max_i D_f(δ_i||δ_i K) = f(0)(1 − Kmin) + Kmin f(1/Kmin), with Kmin = min_i K_ii, which reduces an infinite worst case over all user distributions to a single diagonal entry. A companion bound shows that any ε-LDP kernel preserving q must have K_ii ≤ e^ε q_i/(e^ε q_i + 1 − q_i), hence min_i K_ii ≤ e^ε qmin/(e^ε qmin + 1 − qmin), and equality is achieved by the recursive construction in Algorithm 1. The mechanism is universal across f-divergences because both the reduction and the diagonal bound are independent of f, which enters only through the convex function used to evaluate the divergence.

What would settle it

Solve the minimax problem in (4) by linear programming for a fixed small q and ε, say q = (0.3, 0.7) with ε = 1, over all ε-LDP Markov kernels K satisfying qK = q; compare the resulting worst-case TV distance with the value in (6). A strict gap would refute Theorem 1, and running Algorithm 1 on a prior with qmin = 0 would expose whether the boundary case is covered.

Watch

Extended reading notes

Core claim

For a finitely supported public prior q with qmin > 0, the minimax value over ε-LDP Markov kernels K satisfying qK = q is Γ_f(q,ε) = ((1−qmin)/(e^ε qmin + 1 − qmin)) f(0) + ((e^ε qmin)/(e^ε qmin + 1 − qmin)) f((e^ε qmin + 1 − qmin)/(e^ε qmin)). Algorithm 1 constructs K_q,ε recursively: it sets the first diagonal entry to e^ε qmin/(e^ε qmin + 1 − qmin), fills the first column with qmin/(e^ε qmin + 1 − qmin), recursively builds the lower-right block from the renormalized tail of q scaled by m = 1 − qmin/(e^ε qmin + 1 − qmin), and sets the rest of the first row to q_j/(e^ε qmin + 1 − qmin). The proof hinges on the reduction showing that the worst case over p is attained at a Dirac distribution and equals f(0)(1 − Kmin) + Kmin f(1/Kmin), so only the smallest diagonal entry of K matters. Theorem 2 verifies that the construction is ε-LDP, preserves q, and attains Γ_f(q,ε), making it simultaneously optimal for every f-divergence.

Load-bearing premise

The construction assumes the public prior q assigns strictly positive probability to every outcome (qmin > 0), because Algorithm 1 and the formula divide by qmin, and the optimality claim is restricted to linear ε-LDP Markov-kernel samplers rather than all conceivable private samplers.

Editorial extensions

If this is right

  • One mechanism K_q,ε solves the design problem for every f-divergence, so changing the utility measure from TV distance to KL or another divergence does not require re-optimizing.
  • With a uniform public prior, the optimal mechanism reduces to the n-ary randomized response mechanism, recovering the no-prior result as a special case.
  • The worst-case utility is governed only by qmin and ε; priors with a larger smallest atom yield a strictly smaller worst-case divergence.
  • Algorithm 1 runs in O(n^3) time, versus O(n^5 log(n/δ)) for a naive linear-programming solution of the TV version.
  • The invariance qK = q means a user whose private distribution equals the public prior suffers no distortion, and users close to the prior are guaranteed small TV error.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because Γ depends on q only through qmin, an applied user could rebalance or merge the smallest atoms of a raw public prior before invoking Algorithm 1 to obtain a better guarantee; this preprocessing is not discussed in the paper.
  • Editorial inference: the universality holds within the linear Markov-kernel class; the nonlinear samplers identified in the preceding minimax work are outside the minimization, so whether a nonlinear sampler could beat Γ_f(q, ε) while preserving q remains open.
  • Editorial inference: nothing in the discrete proof transfers directly to continuous distributions, so a natural next step—quantizing continuous public and private data and tracking the resulting minimax value—is a testable extension rather than a result of this paper.
  • Editorial inference: the boundary qmin = 0 is silently excluded; checking whether any finite-ε LDP kernel preserving such a prior satisfies the paper's sup-ratio definition would clarify the scope of Theorem 2.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces a framework for locally private sampling in which each user holds a private distribution p and a public prior q, and the goal is to output a sample from a distribution pK that is close to p while satisfying qK = q. The main theoretical contribution is a minimax characterization of the best worst-case f-divergence over all ε-LDP Markov kernels that preserve q, together with an O(n^3) recursive algorithm that outputs a mechanism attaining the bound. The paper further shows that the optimal mechanism is independent of the choice of f-divergence, recovers randomized response when q is uniform, and validates the sampler empirically against the relative-mollifier baseline on synthetic data, the Avazu CTR dataset, and MovieLens.

Significance. If the main result is taken in its intended domain, it is a clean and useful characterization: the worst-case f-divergence depends on the public prior only through its smallest atom, and a single mechanism is simultaneously optimal for every f-divergence. The lower-bound part (Proposition 2, via Lemmas 1--3) is self-contained and sound, and recovering Park et al.'s uniform-prior utility from the new theorem is a meaningful consistency check. The availability of code and the explicit O(n^3) construction are also strengths. The main caveat is that the theorem statements omit a strict-positivity assumption on q, and the proof of Proposition 3 is incomplete for general columns; both issues are fixable but are load-bearing for the stated claims.

major comments (3)
  1. [§3.1, Theorem 1; Algorithm 1; Corollary 1] The theorems state only that q is finitely supported and define qmin = min_x q(x), but they require qmin > 0. If q has an atom with q_i = 0, the feasible set {K ∈ Q_ε : qK = q} is empty under Definition 4. For example, with q = (0, 1/2, 1/2), the invariance qK = q forces K_{j1} = 0 for j = 2, 3, so for output 1 the ratio pK(1)/p'K(1) is either undefined or infinite for suitable p, p'; no ε-LDP mechanism exists. Algebraically, qK = q and nonnegativity give zero off-diagonal entries in the zero-mass column, and Definition 4's ratio condition then forbids any positive diagonal entry in that column, making the column identically zero and the ratio 0/0. Algorithm 1 does not detect this case, and the formal qmin → 0 value in Corollary 1 is not attained: for this q with ε = 1 and TV, the true minimax value would be at least the infinite divergence at a Dirac mass on the zero-probability atom. The fix is to state explicitly that supp(q) = X, or equivalently to replace X by supp(q) throughout including the supremum over p; this assumption must appear in Theorem 1, Theorem 2, Corollary 1, and Algorithm 1.
  2. [Appendix A.5, proof of Proposition 3] The proof that the mechanism output by Algorithm 1 is ε-LDP is incomplete. The induction verifies the first column and then treats only column j = 2 in detail, deriving (46) and (48), and the bounds for the remaining columns are dismissed with 'With minimal changes'. The missing general-column argument is not a purely cosmetic repetition: for a general column j, one must control K_{1j} against m e^{±ε} times the minimum or maximum of the j-th column of the recursively constructed M, which uses the sortedness of q and the invariant structure of M in a way that is not sketched. Since Theorem 2's validity depends on K being ε-LDP, this gap must be closed. The same proof also contains an obvious typo, 'qK = K' at the end of the LDP verification, which should read 'qK = q'.
  3. [Lemma 1 and Theorem 1; Appendix A.6] The paper states that f is convex on (0, ∞) with f(1)=0, and permits f(0)=f(0+) to be infinite, but Lemma 1 and Proposition 2 use the expression g(x)=f(0)+x(f(1/x)-f(0)), which is not well-defined as a difference when f(0)=∞. The proof of Proposition 4 begins 'Assume that f(0) < ∞, since otherwise Γf(q,ε)=∞', but this assumption is not carried into Theorem 1's statement that the characterization holds for 'general f-divergences'. The manuscript should either state the condition f(0)<∞ for the finite closed-form expression or spell out the separate degenerate case f(0)=∞. This is a real mismatch between the theorem statement and the proof, even though it does not affect the main examples (KL, TV) used in the paper.
minor comments (4)
  1. [Algorithm 1 caption] The input description says 'increasingly sorted pulic prior'; 'pulic' should be 'public'.
  2. [Appendix A.7, Corollary 2 proof] In the displayed utility formula, 'eε + k − 1' should be 'eε + n − 1'; 'k' is not defined in that context.
  3. [Definition 4] Definition 4 writes the ratio pK(x)/p'K(x) without requiring the denominator to be positive. The authors should either define the convention for zero denominators or restrict the supremum to outputs with positive probability, since this ambiguity is the source of the qmin=0 infeasibility noted above.
  4. [§5 and related-work discussion] The paper calls the relative mollifier framework the 'state-of-the-art private sampler', but Park et al. (2024), whose linear setting is the direct precursor, is not included in the experimental comparison. The scope statement says the paper considers only linear samplers, so a short clarifying sentence that the empirical baseline is the relevant prior linear-sampler method would prevent overclaiming.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: Theorem 1 and Theorem 2 are proved from new Lemmas 1–3 and a matching construction; the only self-citation is non-load-bearing framework inheritance from Park et al. (2024).

full rationale

The central minimax claim is self-contained. The lower bound in Proposition 2 is obtained from Lemma 1 (the supremum over p reduces to Dirac masses) and Lemma 3 (qK=q plus the ε-LDP ratio condition implies min_i K_ii ≤ e^ε q_min/(e^ε q_min+1-q_min)); neither lemma invokes the authors' prior results. The upper bound is an explicit achievability construction: Algorithm 1 sets the smallest diagonal exactly to that upper bound and Propositions 3–4 verify ε-LDP, q-invariance, and attainment of the lower bound. Matching a derived lower bound by construction is standard achievability, not circularity. The claimed universality over f-divergences follows because Lemma 1 expresses the worst-case divergence as g(min_i K_ii) with g(x)=f(0)+x(f(1/x)-f(0)), so both the bound and the constructed mechanism depend on f only through this monotone function. The only self-citation is the linear-sampler framework inherited from Park et al. (2024), which is co-authored by Asoodeh; Corollary 2's recovery of the uniform-prior utility is a consistency check, not load-bearing. Separately, the paper silently assumes q has full support (or that outputs with q_i=0 are handled by a zero-column convention): for q=(0,1/2,1/2) Definition 4's ratio condition and qK=q can force a zero column and an undefined 0/0 ratio, and Lemma 1 breaks if K_ii=0. That is an assumption/correctness gap, not a circular dependence.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The derivation has no fitted constants and introduces no new entities. It rests on standard convex-analysis facts, the LDP-for-distributions model, and two modeling choices: exact q-invariance and linear kernels. The only unstated boundary condition is full support of q.

assumptions (5)
  • domain assumption The public prior q has finite support and q_i > 0 for every i in X.
    Algorithm 1 and Theorem 1 use qmin in denominators; zero-probability categories can make qK=q infeasible under finite-epsilon LDP, but this boundary case is not discussed.
  • standard math The utility measure is an f-divergence with convex f, f(1)=0, and finite f(0) in the interesting regime.
    Lemma 1 relies on joint convexity of Df; Lemma 2 requires convexity. Proposition 4 explicitly assumes f(0)<infinity.
  • domain assumption An epsilon-LDP mechanism is defined via row-wise output ratios for all pairs of input distributions.
    Definition 3/4 treats any two distributions as neighboring inputs; this strong adjacency is inherited from Husain et al. and Park et al.
  • ad hoc to paper Preserving public data is modeled as exact invariance qK=q.
    This is the paper's design choice in Section 3, not derived from an external notion; it drives the lower bound in Lemma 3.
  • ad hoc to paper Optimality is restricted to linear Markov kernels.
    Section 1 says 'in the linear setting'; nonlinear samplers are excluded from the minimax claim, though the abstract omits this qualification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Locally Private Sampling with Public Data." pith.science (2026). https://pith.science/paper/L6HKM5PV

@misc{pith2026241108791,
  author       = {Pith},
  title        = {Pith review of: Locally Private Sampling with Public Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L6HKM5PV}},
  note         = {Machine review of arXiv:2411.08791}
}
abstract

Local differential privacy (LDP) is increasingly employed in privacy-preserving machine learning to protect user data before sharing it with an untrusted aggregator. Most LDP methods assume that users possess only a single data record, which is a significant limitation since users often gather extensive datasets (e.g., images, text, time-series data) and frequently have access to public datasets. To address this limitation, we propose a locally private sampling framework that leverages both the private and public datasets of each user. Specifically, we assume each user has two distributions: $p$ and $q$ that represent their private dataset and the public dataset, respectively. The objective is to design a mechanism that generates a private sample approximating $p$ while simultaneously preserving $q$. We frame this objective as a minimax optimization problem using $f$-divergence as the utility measure. We fully characterize the minimax optimal mechanisms for general $f$-divergences provided that $p$ and $q$ are discrete distributions. Remarkably, we demonstrate that this optimal mechanism is universal across all $f$-divergences. Experiments validate the effectiveness of our minimax optimal sampler compared to the state-of-the-art locally private sampler.

Figures

Figures reproduced from arXiv: 2411.08791 by the authors.

Figure 1
Figure 1. Visualization of a single recursion step in Algorithm [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Comparison of our private sampling approach with the [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Comparison of our private sampling method with the rela [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Comparison of our private sampling method with the rel [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: One iteration of the recursion of Algorithm 1. [PITH_FULL_IMAGE:figures/full_fig_p018_5.png]
Figure 6
Figure 6. Figure 6: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p019_6.png]
Figure 7
Figure 7. Figure 7: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]
Figure 11
Figure 11. Figure 11: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the next website [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Comparison of our private sampling method with the relative mollifier sampling framework for predicting the genre of the next [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 32 canonical work pages

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

    2016

  2. [2]

    Acharya, Z

    J. Acharya, Z. Sun, and H. Zhang. Hadamard response: Estimating distributions privately, efficiently, and with little communication. In Proc. Conf. on Artificial Intelligence and Statistics, pages 1120--1129, 2019

    work page 2019

  3. [3]

    Unified lower bounds for interactive high-dimensional estimation under information constraints

    Jayadev Acharya, Cl \'e ment L Canonne, Ziteng Sun, and Himanshu Tyagi. Unified lower bounds for interactive high-dimensional estimation under information constraints. Advances in Neural Information Processing Systems, 36, 2024

    work page 2024

  4. [4]

    Rubinstein

    Francesco Ald\` a and Benjamin I.P. Rubinstein. The bernstein mechanism: function release under differential privacy. In Proceedings of the Thirty-First AAAI Conference on Artificial Intelligence, AAAI'17, page 1705–1711, 2017

    work page 2017

  5. [5]

    Limits of private learning with access to public data

    Noga Alon, Raef Bassily, and Shay Moran. Limits of private learning with access to public data. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d Alch\' e -Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019

    work page 2019

  6. [6]

    Public data-assisted mirror descent for private model training, 2022

    Ehsan Amid, Arun Ganesh, Rajiv Mathews, Swaroop Ramaswamy, Shuang Song, Thomas Steinke, Vinith Menon Suriyakumar, Om Thakkar, and Abhradeep Guha Thakurta. Public data-assisted mirror descent for private model training, 2022

    work page 2022

  7. [7]

    Contraction of locally differentially private mechanisms

    Shahab Asoodeh and Huanyu Zhang. Contraction of locally differentially private mechanisms. IEEE Journal on Selected Areas in Information Theory, 5: 0 385--395, 2024. doi:10.1109/JSAIT.2024.3397305

    arXiv 2024

  8. [8]

    L. P. Barnes , W. N. Chen , and A. \"O zg\"ur. Fisher information under local differential privacy. Journal on Selected Areas in Information Theory, 1 0 (3): 0 645--659, 2020

    work page 2020

Show all 39 references
  1. [9]

    Private query release assisted by public data

    Raef Bassily, Albert Cheu, Shay Moran, Aleksandar Nikolov, Jonathan Ullman, and Steven Wu. Private query release assisted by public data. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings ...

    2020

  2. [10]

    Private distribution learning with public data: The view from sample compression

    Shai Ben-David, Alex Bie, Cl\' e ment L Canonne, Gautam Kamath, and Vikrant Singhal. Private distribution learning with public data: The view from sample compression. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Informatio...

    2023

  3. [11]

    Private estimation with public data

    Alex Bie, Gautam Kamath, and Vikrant Singhal. Private estimation with public data. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 18653--18666. Curran Associates, Inc., 2022

    2022

  4. [12]

    Prochlo: Strong privacy for analytics in the crowd

    Andrea Bittau, \'U lfar Erlingsson, Petros Maniatis, Ilya Mironov, Ananth Raghunathan, David Lie, Mitch Rudominer, Ushasree Kode, Julien Tinnes, and Bernhard Seefeld. Prochlo: Strong privacy for analytics in the crowd. In Proceedings of the 26th symposium on operating systems ...

    2017

  5. [13]

    Algorithms for minimization without derivatives

    Richard P Brent. Algorithms for minimization without derivatives. Courier Corporation, 2013

    2013

  6. [14]

    Solving linear programs in the current matrix multiplication time

    Michael B Cohen, Yin Tat Lee, and Zhao Song. Solving linear programs in the current matrix multiplication time. Journal of the ACM (JACM), 68 0 (1): 0 1--39, 2021

    2021

  7. [15]

    Learning with privacy at scale, 2017

    Differential Privacy team Apple . Learning with privacy at scale, 2017

    2017

  8. [16]

    Collecting telemetry data privately

    Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In Advances in Neural Information Processing Systems, pages 3571--3580, 2017

    2017

  9. [17]

    Rappor: Randomized aggregatable privacy-preserving ordinal response

    \'U lfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. Rappor: Randomized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pages 1054--1067. ACM, 2014

    2014

  10. [18]

    Feldman and K

    V. Feldman and K. Talwar. Lossless compression of efficient private local randomizers. In Proc. International Conference on Machine Learning, pages 3208--3219, 2021

    2021

  11. [19]

    Private frequency estimation via projective geometry

    Vitaly Feldman, Jelani Nelson, Huy Nguyen, and Kunal Talwar. Private frequency estimation via projective geometry. In International Conference on Machine Learning, pages 6418--6433. PMLR, 2022

    2022

  12. [20]

    Differentially private next-token prediction of large language models

    James Flemings, Meisam Razaviyayn, and Murali Annavaram. Differentially private next-token prediction of large language models. arXiv preprint arXiv:2403.15638, 2024

    2024 arXiv

  13. [21]

    On differentially private sampling from gaussian and product distributions

    Badih Ghazi, Xiao Hu, Ravi Kumar, and Pasin Manurangsi. On differentially private sampling from gaussian and product distributions. In Advances in Neural Information Processing Systems. Curran Associates, Inc., 2024

    2024

  14. [22]

    The movielens datasets: History and context

    F Maxwell Harper and Joseph A Konstan. The movielens datasets: History and context. Acm transactions on interactive intelligent systems (tiis), 5 0 (4): 0 1--19, 2015

    2015

  15. [23]

    Local differential privacy for sampling

    Hisham Husain, Borja Balle, Zac Cranko, and Richard Nock. Local differential privacy for sampling. In International Conference on Artificial Intelligence and Statistics, pages 3404--3413. PMLR, 2020

    2020

  16. [24]

    Avazu click-through rate prediction dataset

    Kaggle. Avazu click-through rate prediction dataset. Kaggle, https://www.kaggle.com/c/avazu-ctr-prediction/data, 2015. Accessed: October 2024

    2015

  17. [25]

    Kairouz, K

    P. Kairouz, K. Bonawitz, and D. Ramage. Discrete distribution estimation under local privacy. In Proc. Int. Conf. Machine Learning, volume 48, pages 2436--2444, 20--22 Jun 2016

    2016

  18. [26]

    (nearly) dimension independent private erm with adagrad rates\\ via publicly estimated subspaces

    Peter Kairouz, Monica Ribero Diaz, Keith Rush, and Abhradeep Thakurta. (nearly) dimension independent private erm with adagrad rates\\ via publicly estimated subspaces. In Mikhail Belkin and Samory Kpotufe, editors, Proceedings of Thirty Fourth Conference on Learning Theory, v...

    2021

  19. [27]

    Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith

    Shiva Prasad Kasiviswanathan, Homin K. Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. What can we learn privately? SIAM J. Comput., 40 0 (3): 0 793--826, June 2011

    2011

  20. [28]

    Coupling public and private gradient provably helps optimization

    Ruixuan Liu, Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Coupling public and private gradient provably helps optimization. CoRR, abs/2310.01304, 2023

    2023 arXiv

  21. [29]

    Optimal differentially private model training with public data

    Andrew Lowy, Zeman Li, Tianjian Huang, and Meisam Razaviyayn. Optimal differentially private model training with public data. In Forty-first International Conference on Machine Learning, 2024

    2024

  22. [30]

    Decision tree for locally private estimation with public data

    Yuheng Ma, Han Zhang, Yuchao Cai, and Hanfang Yang. Decision tree for locally private estimation with public data. Advances in Neural Information Processing Systems, 36, 2024

    2024

  23. [31]

    Differentially private sampling from distributions

    Sofya Raskhodnikova, Satchit Sivakumar, Adam Smith, and Marika Swanberg. Differentially private sampling from distributions. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pa...

    2021

  24. [32]

    Linkedin's audience engagements api: A privacy preserving data analytics system at scale, 2020

    Ryan Rogers, Subbu Subramaniam, Sean Peng, David Durfee, Seunghyun Lee, Santosh Kumar Kancha, Shraddha Sahay, and Parvez Ahammad. Linkedin's audience engagements api: A privacy preserving data analytics system at scale, 2020

    2020

  25. [33]

    Shah, W.-N

    A. Shah, W.-N. Chen, J. Balle, P. Kairouz, and L. Theis. Optimal compression of locally differentially private mechanisms. arXiv:2111.00092, 2021

    2021 arXiv

  26. [34]

    Differentially private learning with small public data

    Jun Wang and Zhi-Hua Zhou. Differentially private learning with small public data. Proceedings of the AAAI Conference on Artificial Intelligence, 34 0 (04): 0 6219--6226, Apr. 2020. doi:10.1609/aaai.v34i04.6088

    2020 doi

  27. [35]

    Randomized response: A survey technique for eliminating evasive answer bias

    Stanley L Warner. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American Statistical Association, 60 0 (309): 0 63--69, 1965

    1965

  28. [36]

    Differentially private generative adversarial network

    Liyang Xie, Kaixiang Lin, Shu Wang, Fei Wang, and Jiayu Zhou. Differentially private generative adversarial network. arXiv preprint arXiv:1802.06739, 2018

    2018 arXiv

  29. [37]

    Ye and A

    M. Ye and A. Barg . Optimal schemes for discrete distribution estimation under locally differential privacy. IEEE Trans. Inf. Theory, 64 0 (8): 0 5662--5676, 2018. doi:10.1109/TIT.2018.2809790

    2018

  30. [38]

    Opacus: User-friendly differential privacy library in pytorch, 2022

    Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in pytorch, 2022

    2022

  31. [39]

    Do not let privacy overbill utility: Gradient embedding perturbation for private learning

    Da Yu, Huishuai Zhang, Wei Chen, and Tie-Yan Liu. Do not let privacy overbill utility: Gradient embedding perturbation for private learning. In International Conference on Learning Representations, 2021

    2021

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.