REVIEW 3 major objections 3 minor 23 references
Knockoffs Inference under Privacy Constraints
T0 review · 3 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read A differentially private knockoff procedure that peels away noisy statistics keeps exact finite-sample FDR control, regardless of the privacy noise level and sample size.
desk verdict Mirror-peeling DP knockoffs is a real new idea, but the posted paper has a load-bearing boundedness contradiction and no proofs, so it is not ready for peer review. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The object that carries the argument is the mirror-peeling step inside Algorithm 1, combined with a fixed-seed knockoff construction. The knockoff variables are generated as $\tilde{X}_{i,\cdot} = f(X_{i,\cdot}, R_i)$ with the exogenous randomness $R_i$ fixed by a seed, so that two neighboring datasets $[X, \tilde{X}, y]$ and $[X', \tilde{X}', y']$ differ in exactly one row and the $\ell^1$ sensitivity $\Delta_n$ of each statistic $W_j = w_j([X,\tilde{X}], y)$ is well-defined. The algorithm then peels, for $j = 1, \dots, m$, the index $i_j = \arg\max_k \{|W_k| + Z_{k,j}\}$ with $Z_{k,j} \sim N(0, 8m\Delta_n^2/\mu^2)$, and releases only the masked values $\tilde{W}_{i_j} = W_{i_j} + \tilde{Z}_{i_j}$ with $\tilde{Z}_{i_j} \sim N(0, 2m\Delta_n^2/\mu^2)$. Because the peeling uses only magnitudes plus independent noise, and the masking noise is symmetric, each null statistic retains the 'coin flip' property — conditional on $|W_j|$, its sign is equally likely to be positive or negative — and the knockoff threshold $\tilde{T}$ computed on $\{\tilde{W}_j : j \in D_m\}$ inherits the finite-sample FDR control of the original threshold in (6).
What would settle it
Evaluate the $\ell^1$ sensitivity in Definition 2 for the marginal-correlation statistic $W_j = n^{-1}(|X_j^T y| - |\tilde{X}_j^T y|)$ under the paper's own Gaussian construction $X \sim N(0, \Sigma)$ with unbounded $Y$. The first-row term $n^{-1}|X_{1,j}y_1 - X'_{1,j}y'_1|$ is unbounded over neighboring datasets, so $\Delta_1(W_j) = \infty$, the Gaussian-mechanism noise scale $8m\Delta_n^2/\mu^2$ in Algorithm 1 is undefined, and no $\mu$-GDP certification exists for that construction; a simulation that draws unbounded Gaussian rows and reports the empirical supremum over neighboring pairs will confirm the divergence.
Extended reading notes
Core claim
The paper's central claim is Theorem 2: for any $m \in [p]$, any sensitivity bound $\Delta_n > 0$, any privacy parameter $\mu > 0$, and any sample size $n$, the output $\tilde{S}$ of Algorithm 1 satisfies $\mathrm{FDR}(\tilde{S}) \le q$. In other words, the differentially private mirror-peeling knockoff procedure inherits the exact, model-free, finite-sample FDR control of the original model-X knockoff, regardless of the privacy noise level and regardless of how $Y$ depends on $X$. The proof shows that the filtered index set $D_m$ depends only on the absolute values $\{|W_j| : j \in [p]\}$ and on the independent Gaussian noises $\{Z_{k,j}\}$, while each released statistic $\tilde{W}_{i_j} = W_{i_j} + \tilde{Z}_{i_j}$ adds a symmetric, independent noise; consequently the null statistics keep their sign-exchange property and the martingale argument of Barber and Candès (2015) and Candès et al. (2018) applies unchanged. On the privacy side, Theorem 1 certifies that the whole procedure is $\mu$-GDP, and Theorems 3–4 give sufficient conditions — mainly a small noise budget $b_n = 8\Delta_n \mu^{-1}\sqrt{3m\log p}$ and a peeling size $m$ large enough to retain the would-be selected statistics — under which the relative power loss against the non-private knockoff is asymptotically zero.
Load-bearing premise
The load-bearing premise is that changing a single data point can change each knockoff statistic by at most a fixed finite amount, which the paper secures by assuming both the covariates and the response are almost surely bounded ($\|X\|_\infty \le C_x$ and $|Y| \le C_y$); the paper's own Gaussian model for $X$ is unbounded, and under that model the $\ell^1$ sensitivity is not finite, leaving the privacy guarantee undefined for the paper's main example.
Editorial extensions
If this is right
- Validity and privacy decouple: Theorem 2 says $\mathrm{FDR}(\tilde{S}) \le q$ holds for every $n$, $m$, $\Delta_n$, and $\mu$, so the data curator may choose the privacy budget purely from power considerations without ever breaking the FDR guarantee.
- The procedure is certified as $\mu$-GDP (Theorem 1), so it composes with other differentially private analyses under the GDP composition rule rather than relying on heuristic noise addition.
- Under the conditions of Theorem 3 and Lemma 1 — for instance $s^{-\gamma} d_n d_{n,0}^{-1}\sqrt{\log(p/a_n)} = o(1)$ and $\Delta_n d_n \mu^{-1}\sqrt{m\log p} = o(1)$ — the relative power loss to the non-private knockoff vanishes asymptotically, meaning privacy can be asymptotically free in terms of selection power.
- The sensitivity classification has a concrete dimensionality consequence: statistics with dimension-free sensitivity (marginal correlation, HSIC) tolerate much larger $p$ under a fixed privacy budget, while dimension-dependent statistics (ridge and SGD coefficient differences) restrict dimensionality but can carry higher power; the proposed two-step sample-splitting variant aims at unconditional F
- The required peeling size is explicit: $m > (1 + 2(1+\varepsilon)q)s$ suffices when almost all signals are strong (Theorem 4), while the general condition in Theorem 3 demands an additional allowance for null statistics whose tails reach near the threshold.
Reading between the lines
- The sign-exchange argument that makes Theorem 2 work is generic: any peeling rule that selects indices using only magnitudes plus independent symmetric noise, followed by symmetric independent masking noise, should preserve FDR control — so mirror peeling is a template that could be reused with other noise families, other statistics, or other sign-exchange selection procedures, with the same finit
- A direct testable consequence of Theorem 2 that the paper does not run: simulate bounded data with a strongly nonlinear response, run Algorithm 1 at wildly different noise scales, and verify that the empirical FDR stays at or below $q$ in every configuration while power decays smoothly with $b_n$.
- The boundedness assumption needed for finite sensitivity is a data-processing decision as much as a model assumption: clipping or truncating covariates and response to $[-C_x, C_x]$ and $[-C_y, C_y]$ before analysis would restore finite sensitivity for unbounded data (including the paper's own Gaussian example), and whether this pre-processing changes the FDR guarantee in practice is a question th
- For practitioners, the sensitivity classification implies a design rule the paper states only implicitly: under a fixed privacy budget, use marginal or kernel-based statistics for ultra-high-dimensional screening and reserve joint-dependence statistics for moderate dimensions, accepting their polynomial-in-$p$ sensitivity cost.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a differentially private model-X knockoff framework. It introduces a mirror-peeling algorithm (Algorithm 1) that filters a subset of knockoff statistics before adding Gaussian noise, and claims both μ-GDP privacy (Theorem 1) and exact finite-sample FDR control (Theorem 2). A power analysis (Theorems 3 and 4) gives conditions under which the relative power loss vanishes asymptotically. Sensitivity analyses for several knockoff statistics are sketched in Section 4. The central proof of Theorem 2 is deferred to a non-included supplement, and Sections 4.1–4.6 are written as proofs of lemmas that are never stated; the promised simulation section is absent.
Significance. If the theorems were rigorously established and the assumptions reconciled, the paper would be a useful contribution: it is, to my knowledge, a plausible route to combining model-X knockoffs with differential privacy, and the mirror-peeling idea of releasing only a subset of noisy statistics is attractive for controlling noise variance. The power-analysis framework and the explicit sensitivity bounds for several statistics are also potentially valuable. However, in its current form the central FDR claim cannot be verified from the manuscript, the main Gaussian example contradicts the paper's own boundedness assumption, and the paper is incomplete in ways that go beyond presentation.
major comments (3)
- [Section 2.3, Eq. (4); Section 4, p. 18] The almost-sure boundedness assumption ∥X∥∞≤C_x and |Y|≤C_y imposed in Section 4 is incompatible with the Gaussian knockoff construction in Eq. (4), which assumes X∼N(0,Σ). For unbounded Gaussian covariates, the l1 sensitivity in Definition 2 is infinite: for the marginal-correlation statistic W_j=n^{-1}(|X_j^T y|-|\tilde X_j^T y|), neighboring datasets differing in a single row with x_{1,j}=M vs 0 and y_1=y'_1=1 give a difference growing without bound as M grows. Consequently the noise scales 8mΔ_n^2/μ^2 and 2mΔ_n^2/μ^2 in Algorithm 1 are undefined, Theorem 1 is vacuous for this example, and Theorem 2 cannot be instantiated for the paper's leading Gaussian setting. The authors need to either restrict the entire model to bounded covariates with a valid bounded knockoff construction or provide a truncation/relaxation analysis that makes the sensitivity finite.
- [Section 3.1 and Algorithm 1] The claim that \tilde W_{i_j}=W_{i_j}+\tilde Z_{i_j} 'still satisfies the coin flip property' is not established. Adding noise to W_j breaks the antisymmetry condition (5), because under a swap of feature j the noise \tilde Z_j is not flipped. Moreover, the sign of \tilde W_j is not fair conditional on |\tilde W_j|: if a null W_j is ±a with a>0 and \tilde Z_j=z>0, then the value |\tilde W_j|=a+z occurs only when W_j=+a, so the conditional probability that \tilde W_j>0 is 1. Since the threshold \tilde T in (8) is a function of |\tilde W_j|, the standard Barber–Candès martingale argument does not apply to \tilde W_j in the way the sketch suggests. The supplement must supply a detailed proof showing how exact FDR control is restored for the noisy released statistics.
- [Sections 3.1, 4.1–4.6, and Section ??] The manuscript is incomplete in ways that prevent verification of the central claims. Theorem 2's proof is deferred to 'Section ?? in the Supplement' (not included); Sections 4.1–4.6 are each titled 'Proof of Lemma ??', but no lemma statements are given; and the numerical section promised in the abstract is missing ('Section ??'). As a result, I cannot check the validity of the FDR control proof, the sensitivity bounds, or the claimed practical demonstrations.
minor comments (3)
- [Section 4.3, Eq. (23)] There is a typo: 'obatin' should be 'obtain'.
- [Throughout] Several cross-references are unresolved placeholders ('Section ??', 'Lemma ??'), which makes it difficult to assess the logical structure of the paper.
- [Section 3.2] The paper borrows asymptotic decay results from Fan et al. (2025a) without stating the precise conditions; since that paper is co-authored by two of the current authors, the supplement should restate the needed results to make the dependence self-contained.
Circularity Check
No significant circularity: FDR control is proven via the standard external Barber–Candès martingale argument, and the power analysis relies on an external asymptotic result rather than on a definitional identity or fitted prediction.
full rationale
The paper's central claim, Theorem 2, is that the mirror-peeling DP knockoff procedure controls FDR at level q in finite samples. The proof sketch given in Section 3.1 is direct: conditional on the absolute values {|W_j| : j ∈ [p]} and the independent noises {Z_{k,j}}, the peeled index set D_m is determined, and each released statistic ~W_{i_j} = W_{i_j} + ~Z_{i_j} retains the coin-flip symmetry required by the Barber–Candès/Candès et al. martingale argument. This is an external, standard technique, not an equation that reduces the conclusion to the paper's own inputs. No fitted parameter is renamed as a prediction, and no uniqueness theorem from the authors' prior work is invoked to force the construction. The power analysis (Theorem 3 and surrounding text) cites Fan et al. (2025a), which shares two authors with the present paper, for the asymptotic vanishing of P(B^c_{1,M_n}) and P(B^c_{2,ε,M_n}). This is a self-citation, but it functions as an external asymptotic result borrowed from a separate published analysis; it does not presuppose the present paper's FDR-control conclusion, and the paper's own contribution—the bound (11) and the sensitivity analysis—does not collapse into that citation. The manuscript does contain a serious internal inconsistency: Section 4 assumes ―X―_∞ ≤ C_x almost surely, while Eq. (4) constructs Gaussian knockoffs for X ~ N(0,Σ), which is unbounded, making the l1 sensitivity infinite and the DP noise scale in Algorithm 1 undefined for that primary example. This is a correctness or validity concern about the paper's assumptions, not a circular derivation: the claimed FDR control does not hold by definition of the boundedness assumption, and the boundedness assumption is not derived from the FDR conclusion. Accordingly, the circularity score is 0.
Assumptions & free parameters
assumptions (4)
- domain assumption Knockoff variables depend on original data via a deterministic function f with fixed external randomness (Eq. 7), and the same seed is used for neighboring datasets.
- domain assumption Covariates and response are almost surely bounded: ∥X∥_∞ ≤ C_x and |Y| ≤ C_y, with C_x, C_y possibly growing slowly with n.
- domain assumption The distribution of X is known so that model-X knockoffs satisfying the swap property (3) can be generated.
- domain assumption Power analysis conditions in Theorem 3 and Lemma 1: continuity of the average tail function G, concentration of W_j, variance control of indicator sums, and existence of strong signals a_n.
Cite this review
Pith. "Pith review of Knockoffs Inference under Privacy Constraints." pith.science (2026). https://pith.science/paper/5NI5B2MI
@misc{pith2026250609690,
author = {Pith},
title = {Pith review of: Knockoffs Inference under Privacy Constraints},
year = {2026},
howpublished = {\url{https://pith.science/paper/5NI5B2MI}},
note = {Machine review of arXiv:2506.09690}
}
read the original abstract
Model-X knockoff framework offers a model-free variable selection method that ensures finite sample false discovery rate (FDR) control. However, the complexity of generating knockoff variables, coupled with the model-free assumption, presents significant challenges for protecting data privacy in this context. In this paper, we propose a comprehensive framework for knockoff inference within the differential privacy paradigm. Our proposed method guarantees robust privacy protection while preserving the exact FDR control entailed by the original model-X knockoff procedure. We further conduct power analysis and establish sufficient conditions under which the noise added for privacy preservation does not asymptotically compromise power. Through various applications, we demonstrate that the differential privacy knockoff (DP-knockoff) method can be effectively utilized to safeguard privacy during variable selection with FDR control in both low and high dimensional settings.
Reference graph
Works this paper leans on
-
[1]
Controlling the false discovery rate via knockoffs
Barber, R.F. and Cand` es, E.J. (2015). “Controlling the false discovery rate via knockoffs.” The Annals of Statistics,43(5), 2055–2085
work page 2015
-
[2]
Robust inference with knockoffs
Barber, R.F., Cand` es, E.J., and Samworth, R.J. (2020). “Robust inference with knockoffs.” The Annals of Statistics,48(3), 1409–1431
work page 2020
-
[3]
Private estimation and inference in high- dimensional regression with FDR control
Cai, Z., Li, S., Xia, X., and Zhang, L. (2023). “Private estimation and inference in high- dimensional regression with FDR control.”arXiv preprint arXiv:2310.16260. Cand` es, E., Fan, Y., Janson, L., and Lv, J. (2018). “Panning for gold:‘model-x’knockoffs for high dimensional controlled variable selection.”Journal of the Royal Statistical Society Series B...
arXiv 2023
-
[4]
Dong, J., Roth, A., and Su, W.J. (2022). “Gaussian differential privacy.”Journal of the Royal Statistical Society: Series B (Statistical Methodology),84(1), 3–37
work page 2022
-
[5]
Calibrating noise to sensi- tivity in private data analysis
Dwork, C., McSherry, F., Nissim, K., and Smith, A. (2006). “Calibrating noise to sensi- tivity in private data analysis.” In “Theory of cryptography conference,” pages 265–284. Springer
work page 2006
-
[6]
The algorithmic foundations of differential privacy
Dwork, C., Roth, A., et al. (2014). “The algorithmic foundations of differential privacy.” Foundations and Trends®in Theoretical Computer Science,9(3–4), 211–407
work page 2014
-
[7]
Differentially private false discovery rate control
Dwork, C., Su, W., and Zhang, L. (2021). “Differentially private false discovery rate control.” Journal of Privacy and Confidentiality,11(2). 25
work page 2021
-
[8]
Variable selection via nonconcave penalized likelihood and its oracle properties
Fan, J. and Li, R. (2001). “Variable selection via nonconcave penalized likelihood and its oracle properties.”Journal of the American statistical Association,96(456), 1348–1360
work page 2001
Show all 23 references
-
[9]
Sure independence screening for ultrahigh dimensional feature space
Fan, J. and Lv, J. (2008). “Sure independence screening for ultrahigh dimensional feature space.”Journal of the Royal Statistical Society Series B: Statistical Methodology,70(5), 849–911
2008
-
[10]
Rank: Large-scale inference with graphical nonlinear knockoffs
Fan, Y., Demirkaya, E., Li, G., and Lv, J. (2020). “Rank: Large-scale inference with graphical nonlinear knockoffs.”Journal of the American Statistical Association
2020
-
[11]
Asymptotic fdr control with model-x knockoffs: Is moments matching sufficient?
Fan, Y., Gao, L., Lv, J., and Xu, X. (2025b). “Asymptotic fdr control with model-x knockoffs: Is moments matching sufficient?”arXiv preprint arXiv:2502.05969
2025 arXiv
-
[12]
A kernel statistical test of independence
Gretton, A., Fukumizu, K., Teo, C., Song, L., Sch¨ olkopf, B., and Smola, A. (2007). “A kernel statistical test of independence.”Advances in neural information processing systems,20
2007
-
[13]
Train faster, generalize better: Stability of stochastic gradient descent
Hardt, M., Recht, B., and Singer, Y. (2016). “Train faster, generalize better: Stability of stochastic gradient descent.” In “International conference on machine learning,” pages 1225–1234. PMLR
2016
-
[14]
Differentially private permutation tests: Applications to kernel methods
Kim, I. and Schrab, A. (2023). “Differentially private permutation tests: Applications to kernel methods.”arXiv preprint arXiv:2310.19043
2023 arXiv
-
[15]
On high-dimensional gaussian comparisons for cross- validation
Kissel, N. and Lei, J. (2022). “On high-dimensional gaussian comparisons for cross- validation.”arXiv preprint arXiv:2211.04958. 26
2022 arXiv
-
[16]
Feature screening via distance correlation learning
Li, R., Zhong, W., and Zhu, L. (2012). “Feature screening via distance correlation learning.” Journal of the American Statistical Association,107(499), 1129–1139
2012
-
[17]
Is algorithmic stability testable? a unified framework under computational constraints
Luo, Y. and Barber, R.F. (2024). “Is algorithmic stability testable? a unified framework under computational constraints.”arXiv preprint arXiv:2405.15107
2024 arXiv
-
[18]
Derandomised knockoffs: leveraging e-values for false dis- covery rate control
Ren, Z. and Barber, R.F. (2024). “Derandomised knockoffs: leveraging e-values for false dis- covery rate control.”Journal of the Royal Statistical Society Series B: Statistical Method- ology,86(1), 122–154
2024
-
[19]
Regression shrinkage and selection via the lasso
Tibshirani, R. (1996). “Regression shrinkage and selection via the lasso.”Journal of the Royal Statistical Society: Series B (Methodological),58(1), 267–288
1996
-
[20]
The eu general data protection regula- tion (gdpr)
Voigt, P. and Von dem Bussche, A. (2017). “The eu general data protection regula- tion (gdpr).”A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10(3152676), 10–5555
2017
-
[21]
False discovery rate control with e-values
Wang, R. and Ramdas, A. (2022). “False discovery rate control with e-values.”Journal of the Royal Statistical Society Series B: Statistical Methodology,84(3), 822–852
2022
-
[22]
The 2020 census suggests that people live underwater. there’s a reason
Wines, M. (2022). “The 2020 census suggests that people live underwater. there’s a reason.” The New York Times,21
2022
-
[23]
Adaptive false discovery rate control with privacy guarantee
Xia, X. and Cai, Z. (2023). “Adaptive false discovery rate control with privacy guarantee.” Journal of Machine Learning Research,24, 1–35. 27
2023
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.