Conformal Prediction for Privacy-Preserving Machine Learning

Alexander Balinsky; Alexander David Balinsky; Dominik Krzeminski

REVIEW 4 major objections 6 minor 16 references

Conformal Prediction for Privacy-Preserving Machine Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fixed-key encryption preserves exchangeability, so conformal prediction sets can be built on ciphertexts without decryption, and the paper reports 97.76% e-value coverage on AES-encrypted MNIST.

desk verdict The p-value-based split conformal result on encrypted MNIST is a valid, modest observation; the headline e-value claim looks like a misapplied theorem producing a meaningless 97.76% coverage. read the letter →

arxiv 2507.09678 v1 pith:NONKWJQM submitted 2025-07-13 cs.LG cs.AImath.STstat.TH

Alexander David Balinsky , Dominik Krzeminski , Alexander Balinsky This is my paper

classification cs.LGcs.AImath.STstat.TH

keywords conformalpredictione-valuesprivacy-preservingmachinelearningdeterministicencryptionAESexchangeabilityuncertaintyquantificationMNIST

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that conformal prediction's coverage guarantees survive when the data are encrypted with a fixed key, so uncertainty quantification can be performed directly on ciphertexts without ever decrypting them. On AES-encrypted MNIST, a simple feedforward network trained only on encrypted images reaches 36.88% test accuracy, well above the 9.56% obtained when each image is encrypted with its own key. The paper reports that an e-value-based predictor using the BB inequality captures the true label in 4888 of 5000 test cases (97.76% coverage) at a threshold of 4.29327, whereas the classical p-value approach gives smaller prediction sets but only 59.3% coverage. A sympathetic reader would take away that privacy and calibrated uncertainty are not mutually exclusive, provided the encryption is deterministic and uniformly applied.

What carries the argument

The load-bearing object is the BB-predictor (bounded-from-below) inequality: for exchangeable non-negative random variables $L_1,\dots,L_{n+1}$, $$P\left(L_{n+1} \ge \frac{1}{\$\alpha$}\cdot \frac{1}{1+\frac{1-1/\$\alpha$}{n}}\cdot \frac{L_1+\dots+L_n}{n}\right) \le \$\alpha$.$$ This inequality converts the mean calibration loss into a threshold for each test point's loss without estimating a quantile. The paper pairs that inequality with deterministic AES-CBC encryption under a fixed key and initialization vector, making encryption a fixed, invertible block-level transformation that preserves the exchangeability of the plaintext examples across training, calibration, and test partitions. Nonconformity scores are computed as softmax losses on encrypted inputs only, and the inequality is used to build prediction sets.

What would settle it

Split the encrypted MNIST test set not at random but sorted by true digit before calibration, so the calibration losses are no longer exchangeable with the test losses, then recompute the BB-predictor coverage; the claim predicts coverage should drop below $1-\alpha$, and a result near $97.76\%$ would show exchangeability is not the mechanism.

Watch

Extended reading notes

Core claim

The paper's central claim is that the validity of conformal prediction depends on exchangeability of the observations, not on their interpretability, and that fixed-key deterministic encryption is a fixed transformation that carries exchangeability from plaintext to ciphertext. On that basis it argues that split conformal prediction can run end-to-end in the encrypted domain, with nonconformity scores computed from softmax losses on ciphertexts. The empirical demonstration on AES-encrypted MNIST compares two scoring regimes: an e-value-based BB-predictor that, at $\alpha = 0.4$ and $n=5000$, yields a threshold of $4.29327$ and an observed coverage of $97.76\%$ ($4888/5000$), and a p-value-based predictor using the $(1-\epsilon)(n+1)$-th order statistic, which at $\epsilon=0.4$ gives a threshold of $1.8497$ and an observed coverage of $59.3\%$. The reported trade-off is that e-value sets are conservative and large, while p-value sets are compact but undershoot their nominal coverage.

Load-bearing premise

The argument depends on the assertion that encrypting every observation with the same key leaves the data interchangeable in the precise sense conformal prediction requires, and on the quoted BB-predictor bound applying to the softmax loss scores; if either fails, the reported coverage guarantees do not follow.

Editorial extensions

If this is right

Conformal coverage guarantees transfer to deterministic encrypted data without any decryption step, because the validity condition is exchangeability of the observations, not their visibility.
A machine-learning service could return a prediction set with a stated coverage level while only ever seeing ciphertext, with the user holding the key.
Per-example encryption with a unique key destroys both accuracy (9.56%, at chance) and the basis for informative conformal sets, so privacy gains from per-instance randomization come at the cost of learnability.
At the chosen 60% coverage target, e-value sets are safer but large, with many sets containing 8-10 classes, while p-value sets are compact but empirically under-covered at 59.3%; this trade-off is the paper's core design constraint.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the exchangeability argument is the engine, the same recipe should work for any fixed, deterministic, invertible preprocessing (random projections, linear transforms, hash embeddings), not just AES; testing this across preprocessing families would separate the encryption-specific claim from a more general invariance claim.
The gap between the nominal 60% target and the observed 97.76% coverage suggests the BB-predictor bound is conservative on this loss distribution; empirically recalibrating the e-value threshold on the calibration set could shrink prediction sets while holding nominal coverage, which the paper does not do.
The ciphertext accuracy of 36.88% despite t-SNE showing no obvious clusters invites a label-permutation test: if shuffling class labels in the encrypted training set still yields near-36.88% accuracy, the apparent signal is an artifact of the cipher rather than class-correlated structure.
Extending the approach to homomorphic encryption would require checking that ciphertext noise preserves exchangeability of the nonconformity scores; in approximate homomorphic schemes, plaintext-dependent noise could break the guarantee.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

My take: the useful part is the p-value side. The paper runs split conformal on AES-encrypted MNIST and gets 59.3% coverage against a 60% target, which is exactly what the standard quantile construction should give. That's a clean confirmation that deterministic encryption preserves exchangeability, and it is the thing worth keeping. The t-SNE and the 36.88% accuracy (above chance, far below plaintext) are honest, and the code is on GitHub, so the empirical work is reproducible.

The problem is the e-value claim. Lemma 2 bounds a test loss relative to the mean of the other losses; it does not produce an absolute threshold. The paper just states \u201cthe threshold is 4.29327\u201d without showing the calibration mean or the multiplier from the formula. Then it applies that fixed number to every test point. That is not how conformal prediction works, even the e-value variant, and the 97.76% coverage is what you get from an overly permissive cutoff: the prediction sets are enormous (average 6.88 labels, with 3400 of 5000 sets containing 7\u20138 labels). The abstract's \u201cover 60%\u201d framing masks that this is over-conservative to the point of being useless. The stress-test note is on target here.

Other soft spots: no unencrypted CP baseline, one random seed with no error bars, and no formal privacy model beyond the encryption setup. Those are fixable. The e-value section is not; it needs to either be derived correctly (compute the mean, use the ratio, then show sets) or, more sensibly, dropped.

Who is this for? Someone working on privacy-preserving ML who wants a quick sanity check that standard CP can carry over to deterministic encryption. The paper is not groundbreaking, but the p-value portion is a legitimate empirical data point and the code helps.

Recommendation: send to a serious referee. The paper deserves referee time because the p-value result is testable and correct, and the code is available. The referee should insist on fixing or removing the e-value section before publication. My own verdict would be conditional acceptance, with the e-value claim gutted.

Referee Report

4 major / 6 minor

Summary. The manuscript proposes applying conformal prediction (CP) to supervised learning on deterministically AES-encrypted MNIST data. A feedforward network is trained on ciphertext images, and two CP variants are evaluated on a held-out partition: a p-value-based split-conformal method and an e-value-based method relying on the BB-predictor inequality of Balinsky and Balinsky (2024). The reported results are 36.88% test accuracy under fixed-key encryption, 59.3% coverage for the p-value method at threshold 1.8497, and 97.76% coverage for the e-value method at a fixed threshold 4.29327. The paper concludes that CP remains feasible in the encrypted domain, provided encryption is deterministic and exchangeability is preserved.

Significance. If the quantitative claims were properly supported, the paper would be a useful empirical demonstration that conformal uncertainty quantification can be combined with deterministic encryption, which is relevant to privacy-preserving machine learning. The manuscript has concrete strengths: the code is made available, experiments use a fixed seed, the t-SNE visualizations clarify the effect of encryption on data structure, and the comparison against per-instance encryption provides a sensible baseline. However, the central e-value result is not currently derived from the stated BB-predictor inequality, and the p-value quantile is miscomputed; as presented, the empirical numbers do not establish the paper's main claims.

major comments (4)

[Section 3.3.1, Eq. (2)] The threshold 4.29327 is not derived from the BB-predictor inequality. Eq. (2) states that P( L_{n+1} >= (1/alpha) * (1/(1+(1-1/alpha)/n)) * (L_1+...+L_n)/n ) <= alpha. For alpha=0.4 and n=5000 the multiplier is approximately 2.5008, so the threshold in Eq. (2) is a scalar multiple of the mean calibration loss, not a fixed absolute number. The paper neither reports the calibration mean nor shows that the mean equals 4.29327/2.5008, which would be about 1.717. As written, the display 'P{LossFunction >= 4.29327} < 0.4' does not follow from Eq. (2), and the observed 97.76% coverage is therefore not evidence that the e-value method has a conformal guarantee.
[Section 3.3.1] The procedure for converting a scalar loss threshold into a prediction set is unspecified. Lemma 2 bounds the probability that a single additional exchangeable loss exceeds a multiple of the mean of the other n losses; it does not by itself define a prediction set for a ten-class problem. The manuscript must state how per-label losses are computed, how the threshold is applied to each test example, and how dependence among candidate labels is handled. Without this, the label-set size distributions in Table 1 are not interpretable as conformal prediction sets.
[Section 3.3.2, Lemma 1] The conformal quantile index is miscomputed. With n=5000 calibration losses and epsilon=0.4, the standard quantile index is ceil((1-epsilon)(n+1)) = ceil(0.6*5001) = 3001, not 3000 as stated in the text. The reported threshold 1.8497 is therefore taken from the 3000th order statistic and is slightly too low; the observed coverage of 59.3% below the nominal 60% is exactly what would be expected from this off-by-one error. The p-value experiment as reported does not implement the quantile stated in Lemma 1.
[Section 3.3] The role of n in the two lemmas is ambiguous. The text says the test set is randomly partitioned into the Calibration Set and the Conformal Prediction Test Set, each of size 5000, but then states that the BB-predictor inequality is applied 'with a test set size of n=5000'. In Lemma 2, n is the number of exchangeable 'other' losses that form the mean in the denominator; if the calibration set has 5000 losses, then n should be 5000 there as well, but the notation should be defined explicitly to avoid confusion between the calibration size and the CP test size. This ambiguity directly affects the numerical constants in Eq. (2).

minor comments (6)

[Abstract] The phrase 'e-value-based CP achieves predictive set coverage of over 60% with 4.3 loss-threshold calibration' is misleading because the realized coverage is 97.76%; please state the actual value and explain why a threshold calibrated for alpha=0.4 produces coverage far above 60%.
[Section 3.3.1] The expression 'P{LossFunction >= 4.29327} < 0.4' does not define the probability space; the randomness should be made explicit (e.g., the random split into calibration and test sets, and any randomness in the model).
[Tables 1 and 2] The paper discusses a trade-off between set compactness and reliability but reports only the size distribution, not the average prediction set size; adding the mean and median set size for each method would make the trade-off quantitative.
[Figure 4] The histogram and sorted-loss plot lack axis labels and units; please add them so the reader can connect the displayed loss values to the thresholds 1.8497 and 4.29327.
[Section 3] AES in CBC mode with a fixed key and fixed IV is deterministic but not semantically secure; the manuscript should acknowledge that this is deterministic encryption and not a modern encryption mode for confidentiality, since equal plaintexts map to equal ciphertexts.
[References] Lemma 2 is a self-cited result from Balinsky and Balinsky (2024); given its centrality, please state the theorem exactly as proved in the source or provide an independent proof or verification.

Circularity Check

0 steps flagged · score 0.0 of 10

No construction-level circularity: the central CP-on-encrypted-MNIST claims are held-out empirical observations supported by an imported general exchangeability lemma.

full rationale

The paper's derivation chain is: deterministic encryption preserves exchangeability; Lemma 1 (standard rank p-values) and Lemma 2 (the BB-predictor, cited from Balinsky and Balinsky 2024) provide thresholding inequalities for exchangeable losses; thresholds are computed from a calibration split; and coverage is measured on a disjoint held-out test split. None of these steps defines the output in terms of the input. The e-value guarantee is a general result whose stated assumptions—exchangeable non-negative losses—do not include encrypted MNIST, so the self-citation is independent support rather than load-bearing circularity. The observed p-value coverage near 60% and e-value coverage above the 60% lower bound are consequences of the calibration construction, not fitted predictions presented as discoveries. Any concern that Lemma 2 may be misapplied, or that the absolute threshold 4.29327 is not transparently derived from the calibration mean, is a correctness or transparency issue, not circularity. No self-definitional step, renamed known result, or fitted parameter renamed as a prediction was found.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The ledger is small: no free parameters are fitted, no new entities are introduced. The central assumptions are the exchangeability of encrypted data and the correctness of two published lemmas, one of which is self-cited.

assumptions (4)

domain assumption Fixed-key deterministic encryption preserves exchangeability of the data.
Stated in Section 2 and 3; this is the foundation for applying CP in the encrypted domain.
standard math Lemma 1 (p-value CP inequality) holds for exchangeable random variables.
Standard result from Vovk et al. 2005, used directly in Section 3.3.2.
standard math Lemma 2 (BB-predictor inequality) holds for exchangeable non-negative random variables.
Self-cited result from Balinsky and Balinsky 2024, used in Section 3.3.1; the paper relies on it without reproving.
domain assumption The trained model is kept fixed and the calibration/test split is random, ensuring score exchangeability.
Implicit in split conformal prediction; the paper states calibration is a random partition of the original test set.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Conformal Prediction for Privacy-Preserving Machine Learning." pith.science (2026). https://pith.science/paper/NONKWJQM

@misc{pith2026250709678,
  author       = {Pith},
  title        = {Pith review of: Conformal Prediction for Privacy-Preserving Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NONKWJQM}},
  note         = {Machine review of arXiv:2507.09678}
}

abstract

We investigate the integration of Conformal Prediction (CP) with supervised learning on deterministically encrypted data, aiming to bridge the gap between rigorous uncertainty quantification and privacy-preserving machine learning. Using AES-encrypted variants of the MNIST dataset, we demonstrate that CP methods remain effective even when applied directly in the encrypted domain, owing to the preservation of data exchangeability under fixed-key encryption. We test traditional $p$-value-based against $e$-value-based conformal predictors. Our empirical evaluation reveals that models trained on deterministically encrypted data retain the ability to extract meaningful structure, achieving 36.88\% test accuracy -- significantly above random guessing (9.56\%) observed with per-instance encryption. Moreover, $e$-value-based CP achieves predictive set coverage of over 60\% with 4.3 loss-threshold calibration, correctly capturing the true label in 4888 out of 5000 test cases. In contrast, the $p$-value-based CP yields smaller predictive sets but with reduced coverage accuracy. These findings highlight both the promise and limitations of CP in encrypted data settings and underscore critical trade-offs between prediction set compactness and reliability. %Our work sets a foundation for principled uncertainty quantification in secure, privacy-aware learning systems.

Figures

Figures reproduced from arXiv: 2507.09678 by the authors.

**Figure 2.** 2-dimensional t-SNE projection of the training dataset. 3.1 Data Visualisation with t-SNE We begin our empirical evaluation with a qualitative analysis of the MNIST dataset and its encrypted variants using dimensionality reduction. Specifically, we compare three scenarios: (a) the original, unencrypted MNIST dataset; (b) the dataset encrypted with a fixed encryption key; and (c) the dataset encrypted with a unique e… view at source ↗

**Figure 3.** The diagram of a simple neural network used. The architecture of the network did not change across the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: The histogram and the sorted loss function values for the [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

16 extracted references · 11 canonical work pages

[1]

Angelopoulos and S

A.N. Angelopoulos and S. Bates. Conformal Prediction: A Gentle Introduction. Foundations and Trends in Machine Learning Series. Now Publishers, 2023. ISBN 9781638281580. URL https://books.google.co.uk/books?id=3gK8zwEACAAJ

work page 2023
[2]

Conformal prediction for reliable machine learning: theory, adaptations and applications

Vineeth Balasubramanian, Shen-Shyang Ho, and Vladimir Vovk. Conformal prediction for reliable machine learning: theory, adaptations and applications. Newnes, 2014

2014
[3]

A. A. Balinsky and A. D. Balinsky. Enhancing conformal prediction using e-test statistics. In Simone Vantini, Matteo Fontana, Aldo Solari, Henrik Boström, and Lars Carlsson, editors, Proceedings of the Thirteenth Symposium on Conformal and Probabilistic Prediction with Applications, volume 230 of Proceedings of Machine Learning Research, pages 65--72. PML...

work page 2024
[4]

A. D. Balinsky. Encryption C onformal COPA 2025 github repository. https://github.com/AlexanderBalinsky/EncryptionConformalCOPA2025/, 2025

work page 2025
[5]

Cand \`e s, Lihua Lei, Yaniv Romano, and Matteo Sesia

Stephen Bates, Emmanuel J. Cand \`e s, Lihua Lei, Yaniv Romano, and Matteo Sesia. Testing for outliers with conformal p-values. The Annals of Statistics, 2021. URL https://api.semanticscholar.org/CorpusID:233301258

work page 2021
[6]

Fontana, G

M. Fontana, G. Zeni, and S. Vantini. Conformal prediction: A unified review of theory and new challenges . Bernoulli, 29 0 (1): 0 1 -- 23, 2023. doi:10.3150/21-BEJ1447. URL https://doi.org/10.3150/21-BEJ1447

doi:10.3150/21-bej1447 2023
[7]

Gauthier, F

E. Gauthier, F. Bach, and M. Jordan. E- V alue E xpand the S cope of C onformal P rediction. Technical report, 2025. hal-05003357

work page 2025
[8]

The MNIST database of handwritten digits

Yann LeCun. The MNIST database of handwritten digits. http://yann.lecun.com/exdb/mnist/ , 1998

work page 1998

Show all 16 references

[9]

Tibshirani, and Larry Wasserman

Jing Lei, Max G'Sell, Alessandro Rinaldo, Ryan J. Tibshirani, and Larry Wasserman. Distribution-free predictive inference for regression, 2017. URL https://arxiv.org/abs/1604.04173

2017 arXiv
[10]

Safe planning in dynamic environments using conformal prediction

Lars Lindemann, Matthew Cleaveland, Gihyun Shim, and George J Pappas. Safe planning in dynamic environments using conformal prediction. IEEE Robotics and Automation Letters, 8 0 (8): 0 5116--5123, 2023

2023
[11]

Advanced E ncryption S tandard ( AES )

NIST. Advanced E ncryption S tandard ( AES ). Federal Information Processing Standards Publication FIPS 197-upd1, U.S. Department of Commerce, 2001. URL https://doi.org/10.6028/NIST.FIPS.197-upd1. Updated May 9, 2023

2001 doi
[12]

Tibshirani, Rina Foygel Barber, Emmanuel J

Ryan J. Tibshirani, Rina Foygel Barber, Emmanuel J. Candes, and Aaditya Ramdas. Conformal prediction under covariate shift, 2020. URL https://arxiv.org/abs/1904.06019

2020 arXiv
[13]

Visualizing data using t- SNE

Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t- SNE . Journal of machine learning research, 9 0 (11), 2008

2008
[14]

Conformal prediction in clinical medical sciences

Janette Vazquez and Julio C Facelli. Conformal prediction in clinical medical sciences. Journal of Healthcare Informatics Research, 6 0 (3): 0 241--252, 2022

2022
[15]

V. Vovk, A. Gammerman, and G. Shafer. Algorithmic Learning in a Random World. Springer-Verlag, Berlin, Heidelberg, 2005. ISBN 0387001522

2005
[16]

Application of conformal prediction interval estimations to market makers’ net positions

Wojciech Wisniewski, David Lindsay, and Sian Lindsay. Application of conformal prediction interval estimations to market makers’ net positions. In Conformal and probabilistic prediction and applications, pages 285--301. PMLR, 2020

2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Angelopoulos and S

A.N. Angelopoulos and S. Bates. Conformal Prediction: A Gentle Introduction. Foundations and Trends in Machine Learning Series. Now Publishers, 2023. ISBN 9781638281580. URL https://books.google.co.uk/books?id=3gK8zwEACAAJ

work page 2023

[2] [2]

Conformal prediction for reliable machine learning: theory, adaptations and applications

Vineeth Balasubramanian, Shen-Shyang Ho, and Vladimir Vovk. Conformal prediction for reliable machine learning: theory, adaptations and applications. Newnes, 2014

2014

[3] [3]

A. A. Balinsky and A. D. Balinsky. Enhancing conformal prediction using e-test statistics. In Simone Vantini, Matteo Fontana, Aldo Solari, Henrik Boström, and Lars Carlsson, editors, Proceedings of the Thirteenth Symposium on Conformal and Probabilistic Prediction with Applications, volume 230 of Proceedings of Machine Learning Research, pages 65--72. PML...

work page 2024

[4] [4]

A. D. Balinsky. Encryption C onformal COPA 2025 github repository. https://github.com/AlexanderBalinsky/EncryptionConformalCOPA2025/, 2025

work page 2025

[5] [5]

Cand \`e s, Lihua Lei, Yaniv Romano, and Matteo Sesia

Stephen Bates, Emmanuel J. Cand \`e s, Lihua Lei, Yaniv Romano, and Matteo Sesia. Testing for outliers with conformal p-values. The Annals of Statistics, 2021. URL https://api.semanticscholar.org/CorpusID:233301258

work page 2021

[6] [6]

Fontana, G

M. Fontana, G. Zeni, and S. Vantini. Conformal prediction: A unified review of theory and new challenges . Bernoulli, 29 0 (1): 0 1 -- 23, 2023. doi:10.3150/21-BEJ1447. URL https://doi.org/10.3150/21-BEJ1447

doi:10.3150/21-bej1447 2023

[7] [7]

Gauthier, F

E. Gauthier, F. Bach, and M. Jordan. E- V alue E xpand the S cope of C onformal P rediction. Technical report, 2025. hal-05003357

work page 2025

[8] [8]

The MNIST database of handwritten digits

Yann LeCun. The MNIST database of handwritten digits. http://yann.lecun.com/exdb/mnist/ , 1998

work page 1998