Pith. sign in

REVIEW 3 major objections 5 minor 69 references

Enforcing Demographic Coherence: A Harms Aware Framework for Reasoning about Private Data Release

T0 review · 3 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Demographic coherence is a necessary condition for private data release, and it is provably weaker than differential privacy.

desk verdict Useful DP-to-coherence conversion and audit framework, but the 'necessary for privacy' claim is unsupported—coherence is at best necessary for distributionally detectable predictive harms. read the letter →

arxiv 2502.02709 v1 pith:IEGVN3R6 submitted 2025-02-04 cs.CR cs.DB

Mark Bun , Marco Carmosino , Palak Jain , Gabriel Kaptchuk , Satchit Sivakumar This is my paper · ORCID
classification cs.CRcs.DB MSC 68P27
keywords demographiccoherencedifferentialprivacynecessaryconditionsattackspredictiveharmsmax-informationWassersteindistanceconfidence-ratedpredictors
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Privacy research usually separates into sufficient conditions (differential privacy is the standard) and concrete attacks that demonstrate leaks, with little work on what any private release must guarantee. This paper proposes that a release must satisfy demographic coherence: a confidence-rated predictor built from the release on one random half of a fixed dataset should not produce noticeably different prediction distributions on the two halves, within any sufficiently large demographic subgroup. The central technical result is that every order-invariant differentially private release enforces this condition, with explicit parameter conversions, while there exist demographically coherent releases that are not differentially private. The definition is distributional and does not depend on accuracy, so it yields a concrete experimental audit of privacy risk and applies even when ground truth is unavailable.

What carries the argument

The load-bearing machinery is the demographic coherence experiment $\mathrm{DemCoh}$, together with a bridge through bounded max-information. $\mathrm{DemCoh}$ uniformly splits a fixed dataset $X$ into $X_a$ and $X_b$, forms a report from $X_a$ through a curator $A$, lets an arbitrary algorithm $L$ turn that report into a confidence-rated predictor $h$, and measures the 1-Wasserstein distance between $h$'s prediction distributions on $X_a$ and $X_b$, restricted to a lens $\rho$ and to each subpopulation $C$ of size at least $\gamma$. The proof of Theorem 6 uses max-information to decouple the predictor from the half it was trained on: Claim 1 replaces the dependent split with an independent half-sample at a multiplicative cost $e^\zeta$ plus an additive $\eta$, and Claim 2 bounds the distance for an independent predictor using a hypergeometric concentration inequality. Feeding known pure-DP and approximate-DP max-information bounds into Theorem 6 produces the parameter conversions in Theorems 7 and 8.

What would settle it

A concrete counterexample would settle the matter: exhibit a finite data universe, an order-invariant $\varepsilon$-DP algorithm $A$, a predictor-builder $L$, a collection $\mathcal{C}$, and a dataset $X$ such that, for parameters satisfying Theorem 7's regime, with probability greater than $\beta$ the predictor separates the two halves of $X$ on some subpopulation of size at least $\gamma$ (1-Wasserstein distance exceeds $\alpha$). Less formally, running the DemCoh experiment on a real DP release with protected subgroups as $\mathcal{C}$, and finding a confidence-rated predictor whose prediction distributions on $X_a$ and $X_b$ differ by more than $\alpha$ at a sample size the theorem says should be safe, would falsify the claimed conversion.

Watch

Extended reading notes

Core claim

The paper's central claim is that demographic coherence is a necessary condition for private data release, and that it is strictly weaker than differential privacy. An algorithm is coherence enforcing if, for every predictor-building algorithm $L$, whenever a dataset $X$ is split uniformly into halves $X_a$ and $X_b$ and $h$ is the confidence-rated predictor $L$ produces from a report generated from $X_a$, the 1-Wasserstein distance between the empirical prediction distributions $h(\pi_\rho(X_a|C))$ and $h(\pi_\rho(X_b|C))$ is at most $\alpha$ with probability at least $1-\beta$, for every subpopulation $C$ in the collection that has at least $\gamma$ members in $X$. Theorem 6 proves that bounded max-information implies coherence enforcement; Theorem 7 and Theorem 8 give explicit $(\alpha,\beta,\gamma)$ regimes under which any order-invariant pure-DP or approximate-DP algorithm enforces Wasserstein coherence. The paper also shows that coherence does not imply differential privacy: on a simple binary universe, a curator that publishes its input in the clear is vacuously coherence enforcing, because no confidence-rated predictor can separate the two halves even with full access to the data. The intended interpretation is that differential privacy is one sufficient route to the necessary condition, and demographic coherence gives an audit-able check that non-DP releases can also pass.

Load-bearing premise

The load-bearing premise is that every privacy harm worth preventing appears as a distributional difference between a confidence-rated predictor's behavior on two random halves of the same fixed dataset, with no auxiliary information and no purely single-individual effects; if that is false, demographic coherence is not necessary for privacy, and the theorem statements additionally need a finite universe and order-invariant mechanisms.

Editorial extensions

If this is right

  • If the central claim is right, any order-invariant $\varepsilon$-DP release automatically enforces Wasserstein demographic coherence with the explicit parameter regimes of Theorems 7 and 8, so coherence adds no new implementation burden for DP deployments.
  • Because coherent algorithms need not be differentially private, demographic coherence can certify releases that DP would forbid, opening a formal middle ground between no guarantee and full differential privacy.
  • Bounded max-information is the structural driver of the guarantee, so new algorithms can obtain coherence by proving max-information bounds rather than by adding noise calibrated to sensitivity.
  • The $\mathrm{DemCoh}$ experiment yields an operational, accuracy-free audit: on a fixed dataset, a practitioner can estimate $\alpha$ and $\beta$ empirically and use Theorem 7's conversion to choose an $\varepsilon$ that rules out a chosen level of demographic incoherence.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the necessity claim is only as strong as the Section 3.1 identification of privacy harms with distributional incoherence; harms that change a prediction about one individual without moving subgroup-level distributions, or that rely on auxiliary information, are outside the formal condition even if they matter in practice.
  • Editorial inference: because the proof chain goes through Theorem 6 and the DP-to-max-information bounds, a testable extension is to run the $\mathrm{DemCoh}$ experiment on real releases across protected subgroups and lenses and check whether coherence violations appear at DP parameters the theorems deem safe.
  • Editorial inference: the finite-universe and order-invariance assumptions in Theorems 7 and 8 are technical boundary conditions; extending the argument to infinite universes and non-order-invariant mechanisms, or finding boundary counterexamples, would sharpen the scope of the necessary-condition claim.
  • Editorial inference: since coherence is accuracy-independent and strictly weaker than DP, it could serve as a lower-cost certification when ground truth is unavailable, but the paper claims sufficiency only for DP, not for coherence.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces 'demographic coherence,' a distributional property of confidence-rated predictors, and uses it to define coherence-enforcing data curation algorithms. It proves that algorithms with bounded max-information are coherence-enforcing (Theorem 6) and, via known differential-privacy-to-max-information bounds, that pure- and approximate-DP algorithms enforce Wasserstein demographic coherence for explicit parameter conversions (Theorems 7 and 8). An appendix example shows that a simple non-DP algorithm can be coherence-enforcing, supporting the claim that coherence is weaker than DP. The paper further argues that demographic coherence is a necessary condition for privacy, motivated by predictive harms, and proposes an experimental auditing methodology based on comparing predictions on a random split of a fixed dataset.

Significance. If the technical results are correct, the paper contributes a novel, attack-inspired necessary condition with formal parameter conversions and a concrete experimental evaluation methodology, connecting privacy to distributional properties of predictors via max-information. The appendix gives a detailed proof with explicit constants, which is a strength. However, the central necessity claim is not established formally, and the proof of the main theorem has a distributional subtlety that needs addressing. The framework is likely to be useful for auditing and for reasoning about predictive harms, but its scope should be stated more carefully.

major comments (3)
  1. [Abstract, §1, §3.1] The paper claims that demographic coherence is 'necessary for data privacy' (abstract, §1), but all formal results are one-way implications (DP ⇒ coherence, Theorems 6–8). The bridge from predictive harms to the split-dataset distributional experiment is argued by example (the Asahi/Blair case) rather than proved, and the paper itself excludes auxiliary-information attacks that single out an individual without moving subgroup-level distributions (§3.1, §1.2). Concretely, a predictor that outputs a special value only on one targeted record identified via the lens yields Wasserstein distance at most 2/|X∩C| for any subgroup C, so it is α-coherent with probability 1 for |X∩C| ≥ 2/α while disclosing that record's attribute. Thus the necessity claim overreaches; it should be qualified to distributionally detectable predictive harms, or the abstract and introduction should be revised.
  2. [§5.2, Claim 1 in proof of Theorem 6] The proof applies the bounded max-information assumption to the pair (Xa, A*(Xa)) where Xa is a random half of an arbitrary fixed dataset X. However, Definition 8 defines I^β_∞(A,n) for a sample drawn from the data universe X, not from an arbitrary subset X of it. The proof provides no argument that the bound transfers to every fixed dataset X, and the identity 'since (Xa,A*(S)) is distributed exactly the same as (S,A*(Xa))' does not bridge this gap. Unless the definition is interpreted as a worst-case over distributions/datasets (and the theorem statement says so), Theorem 6's universal quantification over all datasets is not justified by the stated assumption. This is a load-bearing gap in the main technical proof.
  3. [§5.3, Theorems 7 and 8] The stated γ (size constraint) expressions do not match the max-information bounds used in the proofs. In Theorem 7, the proof invokes the bound ε√(n ln(4|C|/β))/4 from Theorem 11, but the γ expression contains ε√(n ln(4|C|/β))/2. In Theorem 8, the proof derives a max-information bound of 265ε²n/2 + 12ε√(n/2 ln(4|C|/β)), while the γ expression uses 265ε²n and 12ε√(n ln(4|C|/β)). Since the paper emphasizes exact parameter conversions, these statements should be corrected so that the stated γ values are exactly those obtained by substituting the max-information bounds into Theorem 6.
minor comments (5)
  1. [Theorems 6, 7, 8] Several γ expressions have missing closing parentheses, e.g., '36 ln((3/α)' should be '36 ln(3/α)'; these should be fixed throughout.
  2. [Proof of Theorem 6] The line 'ln((|X∩ C| + 1)≤ 1.01 ln((|X∩ C| + 1)' is nonsensical; presumably one side should be ln(|X∩C|), and the inequality should be stated cleanly.
  3. [Definition 8] The max-information of an algorithm as defined depends on the universe size m, but m is not specified in the statements of Theorems 6–8; the authors should clarify whether the bound is assumed to hold uniformly for all universe sizes or for a particular one.
  4. [§2 (informal Theorems 1 and 2)] The informal statements use 'ε ≤ k·α/ln(1/β)' and 'n ≥ k·(ζ+ln(1/β))/α²', which do not precisely match the formal γ expressions; aligning the informal and formal statements would help readability.
  5. [Throughout] There are residual typos, e.g., 'us the term' in footnote 1, 'is demographically coherent' repeated in §2, and inconsistent hyphenation of 'confidence-rated'; a proofreading pass is recommended.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the DP-to-coherence implication is derived from external max-information and concentration bounds, not assumed; the 'necessary' claim is an argued scope limitation rather than a circular step.

full rationale

The paper's formal chain is not circular. It proves DP implies bounded max-information (Theorems 11 and 12, and Corollary 2 in Appendix B, adapted from Dwork et al. and Rogers et al.) and then proves bounded max-information implies Wasserstein coherence enforcement (Theorem 6 via Lemma 1). The key decoupling step in Lemma 1 uses the independent notion of max-information to replace the training half Xa with an independent half-sample S, and then applies the external Hush-Scovel hypergeometric concentration bound. This is a genuine derivation, not an identity by construction. No fitted parameters are renamed as predictions, and no uniqueness theorem from the authors' prior work is invoked to force a choice. The only self-citation of a current-author paper, reference [8], is used in Section 1.1 and Appendix A for a comparison definition of perfect generalization and is not load-bearing for the main theorems. The conceptual claim that demographic coherence is 'necessary for data privacy' is argued from the Asahi/Blair motivating example in Section 3.1 rather than proved, and the paper itself concedes in Section 1.2 that singling-out attacks are outside the model. That is a burden-of-proof and scope limitation, not mathematical circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No data-fitting parameters appear. The theorems rely on the finite-universe max-information framework, order-invariance, the conceptual harm bridge, and standard concentration inequalities. The framework's general universe is infinite while the max-information definition is finite, an unresolved mismatch.

assumptions (4)
  • domain assumption Max-information is defined for samples without replacement from a finite data universe (Definition 8), while the framework's general universe is infinite.
    Theorem 6 and the DP corollaries rely on the finite-universe max-information bounds; the paper does not show how they transfer to the infinite universe defined in Section 4.1.
  • domain assumption Algorithms are order-invariant (Definition 9).
    Theorems 7 and 8 require order-invariance. The paper notes it can be enforced by shuffling or relaxed with a factor of two, but this is a stated technical restriction.
  • domain assumption Predictive harms are captured by demographically incoherent predictions.
    The normative bridge from privacy attacks to the formal definition is argued by the Asahi/Blair example in Section 3.1, not derived from a prior definition.
  • standard math Standard concentration inequalities, including Hush-Scovel hypergeometric concentration, McDiarmid for sampling without replacement, and Azuma's inequality.
    These are used in Claim 2 and Appendix B to prove the max-information bounds and the split-sampling concentration.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enforcing Demographic Coherence: A Harms Aware Framework for Reasoning about Private Data Release." pith.science (2026). https://pith.science/paper/IEGVN3R6

@misc{pith2026250202709,
  author       = {Pith},
  title        = {Pith review of: Enforcing Demographic Coherence: A Harms Aware Framework for Reasoning about Private Data Release},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IEGVN3R6}},
  note         = {Machine review of arXiv:2502.02709}
}
read the original abstract

The technical literature about data privacy largely consists of two complementary approaches: formal definitions of conditions sufficient for privacy preservation and attacks that demonstrate privacy breaches. Differential privacy is an accepted standard in the former sphere. However, differential privacy's powerful adversarial model and worst-case guarantees may make it too stringent in some situations, especially when achieving it comes at a significant cost to data utility. Meanwhile, privacy attacks aim to expose real and worrying privacy risks associated with existing data release processes but often face criticism for being unrealistic. Moreover, the literature on attacks generally does not identify what properties are necessary to defend against them. We address the gap between these approaches by introducing demographic coherence, a condition inspired by privacy attacks that we argue is necessary for data privacy. This condition captures privacy violations arising from inferences about individuals that are incoherent with respect to the demographic patterns in the data. Our framework focuses on confidence rated predictors, which can in turn be distilled from almost any data-informed process. Thus, we capture privacy threats that exist even when no attack is explicitly being carried out. Our framework not only provides a condition with respect to which data release algorithms can be analysed but suggests natural experimental evaluation methodologies that could be used to build practical intuition and make tangible assessment of risks. Finally, we argue that demographic coherence is weaker than differential privacy: we prove that every differentially private data release is also demographically coherent, and that there are demographically coherent algorithms which are not differentially private.

Figures

Figures reproduced from arXiv: 2502.02709 by the authors.

Figure 1
Figure 1. Demographic Coherence Experiment A natural formalization of the intuition we developed in Section 3 would say that an algorithm L produces (α, β)-demographically coherent predictions with respect to collections C and lens ρ if the following holds for all datasets X: Pr[DemCohL,X,C,ρ(α) = 0] ≤ β. However, this definition cannot be realized with respect to arbitrary categories C and all datasets, because the sampling … view at source ↗
Figure 2
Figure 2. Comparing the definition of sample perfect general [PITH_FULL_IMAGE:figures/full_fig_p034_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 65 canonical work pages

  1. [1]

    John M. Abowd. The U.S. Census Bureau adopts Differential Privacy. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledg e Discovery & Data Mining, KDD ’18, page 2867, New York, NY, USA, 2018. Association for Computing Machinery

    work page 2018

  2. [2]

    3 Resume Screening Tools That Every Recrui ter Should Know About

    Adrian Dixon. 3 Resume Screening Tools That Every Recrui ter Should Know About. https://ideal.com/resume-screening-tools/ ., November 2016. Accessed on 21 January 2025

    work page 2016

  3. [3]

    Machine-learning- based disease diagnosis: A comprehensive review

    Md Manjurul Ahsan, Shahana Akter Luna, and Zahed Siddiqu e. Machine-learning- based disease diagnosis: A comprehensive review. Healthcare, 10(3), 2022

    work page 2022

  4. [4]

    Pr actical considerations for dif- ferential privacy, 2024

    Kareem Amin, Alex Kulesza, and Sergei Vassilvitskii. Pr actical considerations for dif- ferential privacy, 2024

    work page 2024

  5. [5]

    Learning with privacy a t scale

    Apple Differential Privacy Team. Learning with privacy a t scale. 2017

    work page 2017

  6. [6]

    Recons tructing training data with informed adversaries

    Borja Balle, Giovanni Cherubin, and Jamie Hayes. Recons tructing training data with informed adversaries. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022 , pages 1138–1156. IEEE, 2022

    work page 2022

  7. [7]

    Typicality-based stabili ty and privacy

    Raef Bassily and Yoav Freund. Typicality-based stabili ty and privacy. CoRR, abs/1604.03336, 2016

    arXiv 2016

  8. [8]

    Stabilit y is stable: Connections between replicability, privacy, and adaptive generalization

    Mark Bun, Marco Gaboardi, Max Hopkins, Russell Impaglia zzo, Rex Lei, Toniann Pitassi, Satchit Sivakumar, and Jessica Sorrell. Stabilit y is stable: Connections between replicability, privacy, and adaptive generalization. In Barna Saha and Rocco A. Servedio, editors, Proceedings of the 55th Annual ACM Symposium on Theory of Com puting, STOC 2023, Orlando,...

    work page 2023

Show all 69 references
  1. [9]

    Appendix b — 2010 reconstruction-abetted re-identification simulated atta ck

    The U.S Census Bureau. Appendix b — 2010 reconstruction-abetted re-identification simulated atta ck. https://www2.census.gov/about/policies/foia/records/disclosure-avoidance/appendix-b-su

    2010

  2. [10]

    The census bureau’s simulated reconstruction-abetted re-identification attack on the 20 10 census

    The U.S Census Bureau. The census bureau’s simulated reconstruction-abetted re-identification attack on the 20 10 census. https://www.census.gov/data/academy/webinars/2021/disclosure-avoidance-series/simulate May 2021

    2021

  3. [11]

    Is private learning possible with instance encoding?, 2021

    Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha , Saeed Mahloujifar, Moham- mad Mahmoody, Shuang Song, Abhradeep Thakurta, and Florian Tramer. Is private learning possible with instance encoding?, 2021

    2021

  4. [12]

    Attacks on deidentification’s defenses

    Aloni Cohen. Attacks on deidentification’s defenses. p ages 1469–1486. USENIX Asso- ciation, 2022

    2022

  5. [13]

    Attacks on deidentification’s defenses

    Aloni Cohen. Attacks on deidentification’s defenses. I n Kevin R. B. Butler and Kurt Thomas, editors, 31st USENIX Security Symposium, USENIX Security 2022, Bost on, MA, USA, August 10-12, 2022 , pages 1469–1486. USENIX Association, 2022

    2022

  6. [14]

    Linear program reconstru ction in practice

    Aloni Cohen and Kobbi Nissim. Linear program reconstru ction in practice. J. Priv. Confidentiality , 10(1), 2020

    2020

  7. [15]

    Towards formalizing the g dpr’s notion of singling out

    Aloni Cohen and Kobbi Nissim. Towards formalizing the g dpr’s notion of singling out. Proc. Natl. Acad. Sci. USA , 117(15):8344–8352, 2020

    2020

  8. [16]

    Data reconstruction: When you see it and w hen you don’t

    Edith Cohen, Haim Kaplan, Yishay Mansour, Shay Moran, K obbi Nissim, Uri Stemmer, and Eliad Tsfadia. Data reconstruction: When you see it and w hen you don’t. arXiv preprint arXiv:2405.15753 , 2024

    2024 arXiv

  9. [17]

    ATTAXON- OMY: unpacking differential privacy guarantees against pra ctical adversaries

    Rachel Cummings, Shlomi Hod, Jayshree Sarathy, and Mar ika Swanberg. ATTAXON- OMY: unpacking differential privacy guarantees against pra ctical adversaries. CoRR, abs/2405.01716, 2024

    2024 arXiv

  10. [18]

    Adaptive learning with robust generalization guarantees

    Rachel Cummings, Katrina Ligett, Kobbi Nissim, Aaron R oth, and Zhiwei Steven Wu. Adaptive learning with robust generalization guarantees. In Vitaly Feldman, Alexander Rakhlin, and Ohad Shamir, editors, Proceedings of the 29th Conference on Learning Theory, COLT 2016, New York...

    2016

  11. [19]

    Confidence-ranked reconstruc tion of census microdata from published statistics

    Travis Dick, Cynthia Dwork, Michael Kearns, Terrance L iu, Aaron Roth, Giuseppe Vietri, and Zhiwei Steven Wu. Confidence-ranked reconstruc tion of census microdata from published statistics. CoRR, abs/2211.03128, 2022

    2022 arXiv

  12. [20]

    Confidence-ranked reconstruc tion of census micro- data from published statistics

    Travis Dick, Cynthia Dwork, Michael Kearns, Terrance L iu, Aaron Roth, Giuseppe Vietri, and Zhiwei Steven Wu. Confidence-ranked reconstruc tion of census micro- data from published statistics. Proceedings of the National Academy of Sciences , 120(8):e2218605120, 2023. 28

    2023

  13. [21]

    C ollecting telemetry data pri- vately

    Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. C ollecting telemetry data pri- vately. Advances in Neural Information Processing Systems , 30, 2017

    2017

  14. [22]

    Revealing information whi le preserving privacy

    Irit Dinur and Kobbi Nissim. Revealing information whi le preserving privacy. In Frank Neven, Catriel Beeri, and Tova Milo, editors, Proceedings of the Twenty-Second ACM SIGACT-SIGMOD-SIGART Symposium on Principles of Database Systems, June 9-12, 2003, San Diego, CA, USA , pag...

    2003

  15. [23]

    Generalization in adaptive data analysis and ho ldout reuse

    Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann P itassi, Omer Reingold, and Aaron Roth. Generalization in adaptive data analysis and ho ldout reuse. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, a nd Roman Garnett, editors, Advances in Neural Info...

    2015

  16. [24]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D . Smith. Calibrating noise to sensitivity in private data analysis. J. Priv. Confidentiality , 7(3):17–51, 2016

    2016

  17. [25]

    Exposed! a survey of attacks on private data

    Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonatha n Ullman. Exposed! a survey of attacks on private data. Annual Review of Statistics and Its Application (2017), 2017

    2017

  18. [26]

    Smith, Thomas Steinke, Jonathan R

    Cynthia Dwork, Adam D. Smith, Thomas Steinke, Jonathan R. Ullman, and Salil P. Vadhan. Robust traceability from trace amounts. In Venkate san Guruswami, edi- tor, IEEE 56th Annual Symposium on Foundations of Computer Scien ce, FOCS 2015, Berkeley, CA, USA, 17-20 October, 2015 ...

    2015

  19. [27]

    RAPPOR: Randomized aggre- gatable privacy-preserving ordinal response

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolov a. RAPPOR: Randomized aggre- gatable privacy-preserving ordinal response. In Gail-Joo n Ahn, Moti Yung, and Ninghui Li, editors, ACM CCS 2014 , pages 1054–1067. ACM Press, November 2014

    2014

  20. [28]

    A unified framework for quantifying privacy risk in synthetic data

    Matteo Giomi, Franziska Boenisch, Christoph Wehmeyer , and Borbála Tasnádi. A unified framework for quantifying privacy risk in synthetic data. arXiv preprint arXiv:2211.10459, 2022

    2022 arXiv

  21. [29]

    Lower b ound on SNARGs in the random oracle model

    Iftach Haitner, Daniel Nukrai, and Eylon Yogev. Lower b ound on SNARGs in the random oracle model. In CRYPTO 2022, Part III , LNCS, pages 97–127, August 2022

    2022

  22. [30]

    Kim, Omer Reingold, and Guy N

    Úrsula Hébert-Johnson, Michael P. Kim, Omer Reingold, and Guy N. Rothblum. Multi- calibration: Calibration for the (computationally-ident ifiable) masses. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Ma- chine Learning, ICML...

    2018

  23. [31]

    Kim, Omer Reingold, and Guy N

    Úrsula Hébert-Johnson, Michael P. Kim, Omer Reingold, and Guy N. Rothblum. Multi- calibration: Calibration for the (computationally-ident ifiable) masses. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Ma- chine Learning, ICML...

    2018

  24. [32]

    Pearson, Dietrich A

    Nils Homer, Szabolcs Szelinger, Margot Redman, David D uggan, Waibhav Tembe, Jill Muehling, John V. Pearson, Dietrich A. Stephan, Stanley F. N elson, and David W. Craig. Resolving individuals contributing trace amounts o f dna to highly complex mix- tures using high-density sn...

    2008

  25. [33]

    Concentration of the hyperge ometric distribution

    Don Hush and Clint Scovel. Concentration of the hyperge ometric distribution. Statistics & Probability Letters , 75:127–132, 11 2005

    2005

  26. [34]

    Reproducibility in learning

    Russell Impagliazzo, Rex Lei, Toniann Pitassi, and Jes sica Sorrell. Reproducibility in learning. In Stefano Leonardi and Anupam Gupta, editors, STOC ’22: 54th Annual ACM SIGACT Symposium on Theory of Computing, Rome, Italy, Ju ne 20 - 24, 2022 , pages 818–831. ACM, 2022

    2022

  27. [35]

    Machine Learn- ing in Recruitment: Revolutionize Your Hiring Process

    Indeed Employer Content Team. Machine Learn- ing in Recruitment: Revolutionize Your Hiring Process. https://www.indeed.com/hire/c/info/machine-learning-recruitment . Ac- cessed on 21 January 2025

    2025

  28. [36]

    Ullman, and Alina Oprea

    Matthew Jagielski, Jonathan R. Ullman, and Alina Oprea . Auditing differentially pri- vate machine learning: How private is private sgd? In Hugo La rochelle, Marc’Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Ti en Lin, editors, Advances in Neural Information P...

    2020

  29. [37]

    Evaluating different ially private machine learning in practice

    Bargav Jayaraman and David Evans. Evaluating different ially private machine learning in practice. In Nadia Heninger and Patrick Traynor, editors , 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, Augu st 14-16, 2019 , pages 1895–1912. USENIX Associat...

    2019

  30. [38]

    Kasiviswanathan and Adam Smith

    Shiva P. Kasiviswanathan and Adam Smith. On the ’semant ics’ of differential privacy: A bayesian formulation. Journal of Privacy and Confidentiality , 6(1), Jun. 2014

    2014

  31. [39]

    Sallie Ann Keller and John M. Abowd. Database reconstru ction does compromise con- fidentiality. Proceedings of the National Academy of Sciences , 120(12):e2300976120, 2023

    2023

  32. [40]

    Os Keyes and Abraham D. Flaxman. How census data put tran s children at risk. https://www.scientificamerican.com/article/how-census-data-put-trans-children-at-risk/ Sep 2022

    2022

  33. [41]

    Kim, Amirata Ghorbani, and James Y

    Michael P. Kim, Amirata Ghorbani, and James Y. Zou. Mult iaccuracy: Black-box post-processing for fairness in classification. In Vincent Conitzer, Gillian K. Hadfield, and Shannon Vallor, editors, Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society, AIES 2019,...

    2019

  34. [42]

    Robust de-anon ymization of large sparse datasets

    Arvind Narayanan and Vitaly Shmatikov. Robust de-anon ymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy (SP 2008), 18-21 May 2008, Oakland, California, USA , pages 111–125. IEEE Computer Society, 2008. 30

    2008

  35. [43]

    Robust de-anon ymization of large sparse datasets

    Arvind Narayanan and Vitaly Shmatikov. Robust de-anon ymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy , pages 111–125. IEEE Computer Society Press, May 2008

    2008

  36. [44]

    Tight aud iting of differentially pri- vate machine learning

    Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, F lorian Tramèr, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis. Tight aud iting of differentially pri- vate machine learning. In Joseph A. Calandrino and Carmela T roncoso, editors, 32nd USENIX Security Symposium, ...

    2023

  37. [45]

    Top 40+ Pre-Employment Assessment T ools

    Neelie Verlinden. Top 40+ Pre-Employment Assessment T ools. https://www.aihr.com/blog/top-pre-employment-assessment-tools/ ., July

  38. [46]

    A survey of privacy a ttacks in machine learning

    Maria Rigaki and Sebastián García. A survey of privacy a ttacks in machine learning. ACM Comput. Surv. , 56(4):101:1–101:34, 2024

    2024

  39. [47]

    Rogers, Aaron Roth, Adam D

    Ryan M. Rogers, Aaron Roth, Adam D. Smith, and Om Thakkar . Max-information, differential privacy, and post-selection hypothesis testi ng. In Irit Dinur, editor, IEEE 57th Annual Symposium on Foundations of Computer Science, F OCS 2016, 9-11 Oc- tober 2016, Hyatt Regency, New B...

    2016

  40. [48]

    The role of chance in the census bureau database reconstruction experiment

    Steven Ruggles and David Van Riper. The role of chance in the census bureau database reconstruction experiment. Population Research and Policy Review , 41(3):781–788, 2022

    2022

  41. [49]

    Sok: Let the privacy games begin! A unified treatment of data inference privacy in machi ne learning

    Ahmed Salem, Giovanni Cherubin, David Evans, Boris Köp f, Andrew Paverd, Anshu- man Suri, Shruti Tople, and Santiago Zanella Béguelin. Sok: Let the privacy games begin! A unified treatment of data inference privacy in machi ne learning. In 44th IEEE Symposium on Security and Pr...

    2023

  42. [50]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vital y Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE Symposium on Secu- rity and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pages 3–18. IEEE Computer Society, 2017

    2017

  43. [51]

    Pri vacy auditing with one (1) training run

    Thomas Steinke, Milad Nasr, and Matthew Jagielski. Pri vacy auditing with one (1) training run. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neura...

    2023

  44. [52]

    k-anonymity: A model for protecting p rivacy

    Latanya Sweeney. k-anonymity: A model for protecting p rivacy. International journal of uncertainty, fuzziness and knowledge-based systems , 10(05):557–570, 2002

    2002

  45. [53]

    Uber releases open source project fo r differential privacy, 2017

    Katie Tezapsidis. Uber releases open source project fo r differential privacy, 2017. 31

    2017

  46. [54]

    I. O. Tolstikhin. Concentration inequalities for samp les without replacement. Theory of Probability & Its Applications , 61(3):462–481, 2017

    2017

  47. [55]

    Vapnik and A.Ya

    V.N. Vapnik and A.Ya. Chervonenkis. On the uniform conv ergence of relative frequen- cies of events to their probabilities. Theory of Probability and Its Applications , 1971

    1971

  48. [56]

    too much

    Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and So mesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, United K ingdom, July 9-12, 2018 , pages 268–282. IEEE Computer So...

    2018

  49. [58]

    (β, ε, δ )-sample perfectly generalizing if ∀ distributionsD overX , with probability at least 1− β over Xa, X b∼D n/2: A(Xa)≈ε,δA(Xb)

  50. [59]

    Figure 2: Comparing the definition of sample perfect general ization to a simplified definition of demographic coherence

    (α, β )-coherence enforcing if ∀ datasets X∈X n, learnersL :Y→ (X→ [−1, 1]), with probability at least 1− β over the random split Xa∪ Xb = X and the coins of A,L: distW (ha(Xa), h a(Xb))≤ α where ha←L◦A (Xa) is a confidence rated predictor, and ha(Xi) is the distribution induce...

  51. [60]

    5εe3ε ( 4e3ε(3ε + ˆδ

  52. [61]

    5ε)) + 4 ˆδ + 1 ) + ˆδ (−2

  53. [62]

    5ε + 2ˆδ + 1 ) + 6ε(e6ε− 1) ≤ 8 e6εˆδ

  54. [63]

    5εe3ε ( 4ˆδ + 1 ) + ˆδ (−2

  55. [64]

    5ε + 2ˆδ + 1 ) + 6ε(e6ε− 1) ≤e3ε≤ 1+7ε,e6ε≤ 1+40ε for ε∈ [0,0.5] 8 (1 + 40ε)ˆδ

  56. [65]

    5ε ( 4ˆδ + 1 ) + ˆδ (−2

  57. [66]

    5ε + 2ˆδ + 1 ) + 6ε(40ε) ≤ (8 + 320ε)ˆδ

  58. [67]

    5ε ( 4ˆδ2 + ˆδ ) − 2ˆδ

  59. [68]

    5ε + 2ˆδ2 + ˆδ + 240ε2 ≤ε<0.5 168ˆδ

  60. [69]

    good” tuples of outcomes and databases, and (2) a variable Ti that will match Zi for “good events

    5 ˆδ + 2ˆδ2 + ˆδ + 240ε2 ≤ε≤ 0.5 347ˆδ + 75 ( ˆδ ε )2 + 24 ˆδ2 ε + 240ε2 def = ν(ˆδ) (16) ■ Finally, we need to apply Azuma’s inequality (stated in Theo rem 10) to a set of variables that are bounded with probability 1, not just with high probability. Towards this end, we now ...

  61. [2020]

    Accessed on 21 January 2025

    2025

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.