Pith. sign in

REVIEW 2 major objections 5 minor 48 references

Interpreting Differential Privacy in Terms of Disclosure Risk

T0 review · 2 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An (ε,δ)-differentially private mechanism implies that an adversary's posterior belief about any individual's membership lies in a computable interval with probability at least 1−δ′, for any δ′>δ.

desk verdict The core Bayesian semantics for approximate DP are correct and genuinely useful, but the paper's own worked examples on composition and budget setting do not survive their cited formulas; fix those numbers before publication. read the letter →

arxiv 2507.09699 v1 pith:OXLF23TJ submitted 2025-07-13 cs.CR

Zeki Kazan , Sagar Sharma , Wanrong Zhang , Bo Jiang , Qiang Yan This is my paper
classification cs.CR
keywords differentialprivacydisclosureriskBayesiansemanticsmembershipinferenceposteriorprobabilitylossrandomvariablecompositionapproximateDP
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to make differential privacy (DP) understandable as a concrete statement about what a Bayesian adversary can learn. Its central claim is that approximate DP—the version used in practice—implies a probabilistic bound on an adversary's posterior probability that a target is in the database: for any failure tolerance δ′>δ, with probability at least 1−δ′ the posterior lies between $p/(p+(1-p)e^{-\varepsilon'})$ and $p/(p+(1-p)e^{\varepsilon'})$, where $\varepsilon'$ is a simple function of $\varepsilon$, $\delta$, and $\delta'$. The same framework yields equivalence results for pure DP and for probabilistic DP, relating them to posterior-to-prior ratios and differences. If true, these results let practitioners explain DP guarantees to non-experts, interpret composition theorems as growth in posterior risk, and choose privacy budgets under approximate DP.

What carries the argument

The central object is the privacy loss random variable (PLRV), the log-likelihood ratio between the mechanism's output distributions on neighboring databases, together with the strong-adversary model in which the adversary knows everything except the target's membership indicator. Theorem 3.1 supplies the identity $X_i = p_i/(p_i+(1-p_i)e^{-Z_i})$ when the output comes from the full database, and the symmetric form using $Z'_i$ otherwise, converting PLRV bounds into posterior bounds. The parameter-conversion formula $\varepsilon'=\log(\delta' e^{\varepsilon}+\delta)-\log(\delta'-\delta)$ carries the argument from approximate DP to probabilistic DP, and Lemma 3.4 identifies the priors $p_i=1/(1+e^{\pm \varepsilon/2})$ that extremize the posterior-to-prior difference.

What would settle it

Take a specific $(\varepsilon,\delta)$-DP mechanism with a known privacy loss random variable, such as the Gaussian or Laplace mechanism, choose a prior $p_i$ and a failure tolerance $\delta'>\delta$, compute $\varepsilon'$ by the paper's formula, and Monte Carlo the mechanism's outputs to measure how often the adversary's posterior falls outside the claimed interval; any observed frequency above $\delta'$ would refute the theorem for that mechanism.

Watch

Extended reading notes

Core claim

The paper's core discovery is a family of equivalences between DP variants and disclosure-risk quantities in a strong-adversary membership inference setting. Theorem 3.1 expresses the adversary's posterior exactly as a logistic-style function of the privacy loss random variable, so any bound on privacy loss becomes a bound on posterior belief. Corollary 3.10(2) is the load-bearing application: an $(\varepsilon,\delta)$-DP mechanism guarantees, for every $\delta'>\delta$, that the posterior stays in $[p/(p+(1-p)e^{\varepsilon'}), \, p/(p+(1-p)e^{-\varepsilon'})]$ with probability $1-\delta'$, where $\varepsilon'=\log(\delta' e^{\varepsilon}+\delta)-\log(\delta'-\delta)$. The paper also proves that pure DP is equivalent to such posterior bounds holding with certainty, and that probabilistic DP is equivalent to them holding with probability $1-\delta$.

Load-bearing premise

The results rely on the strong-adversary assumption that the adversary knows the entire database except the target row, along with the target's attributes, so the only uncertainty is the membership indicator; the posterior formula is exact only under this model.

Editorial extensions

If this is right

  • Approximate DP releases can be described to non-experts as: after seeing the output, an adversary's belief about your presence will, with high probability, move only within a fixed range around the prior.
  • Composition theorems (basic, advanced, optimal) can be compared by converting their $(\varepsilon,\delta)$ summaries into posterior bounds, showing, for example, how many queries push the posterior above 80%.
  • The framework extends the disclosure-risk-profile method for setting $\varepsilon$ from pure DP to approximate DP, roughly doubling the allowable per-release $\varepsilon$ in the paper's illustrative example.
  • For a given risk criterion, the worst-case adversary prior is identified; for posterior-to-prior difference it is $p=1/(1+e^{\pm \varepsilon'/2})$, so analysts can focus risk assessments on those priors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If these bounds hold for the strong adversary, they should hold a fortiori for weaker real-world adversaries who know less auxiliary information, although the paper does not prove this.
  • Because the bound is worst-case over all $(\varepsilon,\delta)$-DP mechanisms, mechanisms with known privacy loss distributions (e.g., Gaussian) admit tighter, exact posterior distributions via Theorem 3.1; computing those is a natural next step.
  • The $\varepsilon'\approx \varepsilon$ regime when $\delta'\gg \delta$ suggests that for cryptographically small $\delta$, approximate DP can be communicated almost like pure DP with an added 'with high probability' caveat; a usability study could test whether this framing changes data-sharing decisions.
  • The same parameter-conversion technique could plausibly be adapted to local DP or bounded DP, where neighboring databases differ by attribute replacement, but the paper leaves those settings open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper develops Bayesian semantic characterizations of pure, approximate, and probabilistic differential privacy under a strong-adversary membership-inference model. Theorem 3.1 expresses the adversary's posterior as a one-to-one function of the privacy loss random variable; Theorems 3.2, 3.3, and 3.5 establish equivalences between PDP and posterior, posterior-to-prior ratio, and posterior-to-prior difference bounds; Corollaries 3.6-3.8 specialize these to pure DP; Theorem 3.9 converts approximate DP into PDP; and Corollaries 3.10-3.12 convert approximate DP into probabilistic posterior bounds. Sections 4.1-4.4 propose applications to explaining DP, interpreting composition theorems, setting privacy budgets, and identifying worst-case prior probabilities. The central theoretical results appear sound, but the numerical and applied claims in Sections 4.2 and 4.3 contain inconsistencies with the paper's own composition formulas, and these inconsistencies affect the paper's advertised practical framework.

Significance. If the main theorems are correct, the paper provides a valuable posterior-probability interpretation of approximate DP, which prior work had not characterized in this form, and it supplies self-contained proofs of the equivalences. The appendix is thorough, the PLRV derivation is clean, and the paper is transparent about the strong-adversary assumptions that the results require. The paper also honestly acknowledges prior appearance of a similar conversion result in [46]. However, the significance of the work as a practical tool currently rests on the application section, and the numerical errors there prevent the paper from delivering on its claimed applications until those sections are corrected.

major comments (2)
  1. [§4.2, Figure 3] The statement that the 80% posterior upper bound is exceeded after 51 queries under advanced composition is not consistent with Theorem 2.8(2) and Corollary 3.10(2). Using the paper's own formulas with ε_j=0.05, δ=10^-6, δ'=0.05, and p_i=0.5, I obtain ε_total≈1.407 at k=26, which gives a posterior upper bound of about 0.803, already above 0.8; at k=51 the same formulas give ε_total≈2.008 and a posterior bound of about 0.881. The basic-composition value of 28 is consistent with the formulas, but the advanced-composition column and the conclusions drawn from Figure 3 need to be recomputed. The optimal-composition value of 96 also needs to be rederived from Theorem 2.8(3), since a normal approximation of the associated privacy-loss sum at k=96 gives a total ε around 2.4 for δ=10^-6, not the roughly 1.386 that would be needed for an 80% posterior bound.
  2. [§4.3, Example 4.2] The claim that ε≈0.135 per release is feasible for twelve (ε, 10^-8)-DP releases to yield a total (0.81, 10^-6)-DP guarantee is not supported by Theorem 2.8(3). For k=12, ε'=0.135, and ℓ=3, the formula gives ε=(12-6)·0.135=0.81, but δ_3 evaluates to about 9×10^-3, many orders of magnitude larger than the desired δ=10^-6; even ℓ=1 gives δ_1≈3×10^-5. The largest per-release ε that satisfies the stated optimal-composition formula with δ≤10^-6 appears to be roughly 0.0675, i.e., the value obtained at ℓ=0 with basic composition. Consequently, the 'factor of two' comparison in this example is not a consequence of the proposed framework, and the example's budget-selection recommendation is not justified by the paper's own equations.
minor comments (5)
  1. [§4.3] The text refers to 'Theorem 3.10' in the sentence about using the upper bound over all DP mechanisms; the result is Corollary 3.10, so the cross-reference should be corrected.
  2. [§5.1] The phrase 'Bayesian sematic characterizations' contains a typo; it should be 'Bayesian semantic characterizations'.
  3. [Appendix A.5] The proof of Theorem 3.5 Part 2 is terse: the algebra connecting the three choices of p_i to equations (22)-(27) is not shown. A short derivation would help readers verify the claimed implication.
  4. [§2.1, Theorem 2.8(3)] The use of δ' in the statement of optimal composition is easy to confuse with the posterior failure probability δ' used in Corollary 3.10. Renaming one of the two quantities, or explicitly disambiguating them in Section 4, would improve readability.
  5. [§5.3] The paper explicitly states that the budget-selection extension of Section 4.3 is not fully developed; the introduction and Section 4.3 should temper the language accordingly, since the current wording implies a completed framework.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the DP-to-posterior derivations are self-contained from the DP/PLRV definitions and standard external theorems; self-citations appear only in application framing, not as premises.

full rationale

The paper's central chain (Theorem 3.1, Theorem 3.2, Theorem 3.3, Theorem 3.5, Theorem 3.9, Corollaries 3.10-3.12) is not circular. Theorem 3.1 derives the posterior membership probability from Bayes' theorem and the adversary model, expressing it exactly as a function of the privacy loss random variable; this is a definitional computation, not an assumption of the target result. Theorem 3.2 proves an equivalence between (ε,δ)-PDP and the posterior-probability bound by rewriting the PDP condition on the PLRV through the one-to-one function in (2); the proof is explicit in Appendix A.2 and does not invoke the conclusion. Theorem 3.3 and Theorem 3.5 similarly follow from Theorem 3.1 and elementary algebra, with the parameter loss in the difference bound demonstrated by a concrete counterexample in Appendix A.6. Theorem 3.9, the key approximate-DP-to-PDP conversion, is proved directly from the PLRV characterization (Theorem A.2, an external result of Canonne et al.) using Markov's inequality, and the paper explicitly notes that the same result is implied by [46] but gives its own proof 'in an effort to be self-contained.' Thus Corollary 3.10(2) does not smuggle the posterior bound into the definition of approximate DP; it is a genuine implication with a relaxed δ'. The applications in Section 4 compute posterior bounds from standard composition theorems (Theorem 2.8 and Theorem 2.9), so they are consequences, not fitted inputs, of the framework. No parameter is fitted to the quantity that is later 'predicted': ε' is derived from ε, δ, and δ' by a closed formula, and the posterior bounds are evaluated rather than calibrated. Self-citations to the first author's prior work ([25], [26]) occur when the paper positions its budget-selection proposal as an extension of Kazan & Reiter's pure-DP framework and when citing prior disclosure-risk measures; these citations are not premises of Theorems 3.1-3.12. The paper even states in Section 5.3 that the budget-selection extension is not fully developed. The only concerns visible in the manuscript are numerical: Section 4.2's '51 queries' threshold and Example 4.2's per-release ε≈0.135 appear inconsistent with the stated composition formulas of Theorem 2.8. Those are arithmetic/application errors or unsupported applied claims, not circular derivations, and under the reviewing rules they belong to correctness risk rather than circularity.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The theoretical results rest on standard probability, the PLRV representation of DP, and the strong-adversary membership model. No new entities or fitted constants are introduced; the parameters epsilon, delta, delta-prime, p_i, and rho in examples are user-chosen inputs, not fitted values.

assumptions (5)
  • standard math Bayes' theorem and standard probability theory
    Used in Theorem 3.1 to express the posterior probability as a function of the privacy loss random variable.
  • domain assumption Unbounded differential privacy with neighboring databases differing by one row
    All results are stated for the unbounded, central model of DP; Section 5.3 lists bounded and local DP as future work.
  • domain assumption Strong adversary knows all records except the target and knows the target's attributes
    Defines the membership inference setting in Section 3.1; makes the posterior update in Theorem 3.1 exact. Equivalence results are proven only under this assumption.
  • standard math Privacy loss random variable characterization of DP (Theorem A.2, attributed to Canonne et al. 2020)
    Used in the proof of Theorem 3.9 to convert approximate DP to probabilistic DP; this is an external theorem invoked without derivation in the paper.
  • standard math Existing PLRV equivalence results for pure DP and PDP (Theorems 2.3, 2.5, 2.7 from prior literature)
    Used to tie the new PDP characterizations to pure and approximate DP; cited from the literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Interpreting Differential Privacy in Terms of Disclosure Risk." pith.science (2026). https://pith.science/paper/OXLF23TJ

@misc{pith2026250709699,
  author       = {Pith},
  title        = {Pith review of: Interpreting Differential Privacy in Terms of Disclosure Risk},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OXLF23TJ}},
  note         = {Machine review of arXiv:2507.09699}
}
read the original abstract

As the use of differential privacy (DP) becomes widespread, the development of effective tools for reasoning about the privacy guarantee becomes increasingly critical. In pursuit of this goal, we demonstrate novel relationships between DP and measures of statistical disclosure risk. We suggest how experts and non-experts can use these results to explain the DP guarantee, interpret DP composition theorems, select and justify privacy parameters, and identify worst-case adversary prior probabilities.

Figures

Figures reproduced from arXiv: 2507.09699 by the authors.

Figure 1
Figure 1. If [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. The total privacy parameter, 𝜀, as a function of 𝑘 for the composition of 𝑘 pure DP mechanisms, each with 𝜀𝑗 = 0.05. We take 𝛿 = 10−6 . Colors correspond to composition methods. 0.5 0.6 0.7 0.8 0.9 1.0 0 25 50 75 100 Number of Queries, k Posterior Bound Method Basic Advanced Optimal [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 4
Figure 4. The posterior upper bound of an adversary with [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figures from the paper (1 more)
Figure 6
Figure 6. Figure 6: Worst-case bounds an adversary’s posterior-to-prior [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

48 extracted references · 35 canonical work pages

  1. [46]

    Jun Zhao, Teng Wang, Tao Bai, Kwok-Yan Lam, Zhiying Xu, Shuyu Shi, Xuebin Ren, Xinyu Yang, Yang Liu, and Han Yu. 2019. Reviewing and Improving the Gaussian Mechanism for Differential Privacy. arXiv:1911.12060 [cs.CR] https: //arxiv.org/abs/1911.12060

    arXiv 2019

  2. [1]

    Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

    Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (Vienna, Austria) (CCS ’16). Association for Computing Machinery, New York, NY, USA, 308–318. https://doi.org/10.1145/2...

    arXiv 2016

  3. [2]

    John M Abowd, Robert Ashmead, Ryan Cumings-Menon, Simson Garfinkel, Micah Heineck, Christine Heiss, Robert Johns, Daniel Kifer, Philip Leclerc, Ash- win Machanavajjhala, et al. 2022. The 2020 census disclosure avoidance system topdown algorithm. Harvard Data Science Review 2 (2022), 1–72

    work page 2022

  4. [3]

    Abowd and Lars Vilhuber

    John M. Abowd and Lars Vilhuber. 2008. How Protective Are Synthetic Data?. In Privacy in Statistical Databases , Josep Domingo-Ferrer and Yücel Saygın (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 239–246

    work page 2008

  5. [4]

    Temilola Adeleye, Skye Berghel, Damien Desfontaines, Michael Hay, Isaac John- son, Cléo Lemoisson, Ashwin Machanavajjhala, Tom Magerlein, Gabriele Mod- ena, David Pujol, Daniel Simmons-Marengo, and Hal Triedman. 2023. Publishing Wikipedia usage data with strong privacy guarantees. arXiv:2308.16298 [cs.CR] https://arxiv.org/abs/2308.16298

    work page Pith review arXiv 2023

  6. [5]

    Ahmet Aktay, Shailesh Bavadekar, Gwen Cossoul, John Davis, Damien Des- fontaines, Alex Fabrikant, Evgeniy Gabrilovich, Krishna Gadepalli, Bryant Gip- son, Miguel Guevara, Chaitanya Kamath, Mansi Kansal, Ali Lange, Chinmoy Mandayam, Andrew Oplinger, Christopher Pluntke, Thomas Roessler, Arran Schlosberg, Tomer Shekel, Swapnil Vispute, Mia Vu, Gregory Welle...

    arXiv 2020

  7. [6]

    Aleix Bassolas, Hugo Barbosa-Filho, Brian Dickinson, Xerxes Dotiwalla, Paul Eastham, Riccardo Gallotti, Gourab Ghoshal, Bryant Gipson, Surendra A Hazarie, Henry Kautz, et al. 2022. Reply to: On the difficulty of achieving differential privacy in practice: user-level guarantees in aggregate location data. Nature Communications 13, 1 (2022), 30

    work page 2022

  8. [7]

    Mark Bun and Thomas Steinke. 2016. Concentrated Differential Privacy: Simpli- fications, Extensions, and Lower Bounds. In Theory of Cryptography, Martin Hirt and Adam Smith (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 635–658

    work page 2016

Show all 48 references
  1. [8]

    Clément L Canonne, Gautam Kamath, and Thomas Steinke. 2020. The discrete gaussian for differential privacy. Advances in Neural Information Processing Systems 33 (2020), 15676–15688

    2020

  2. [9]

    Rachel Cummings, Shlomi Hod, Jayshree Sarathy, and Marika Swanberg. 2024. ATTAXONOMY: Unpacking Differential Privacy Guarantees Against Practical Adversaries. arXiv:2405.01716 [cs.CR] https://arxiv.org/abs/2405.01716

    2024 arXiv

  3. [10]

    I need a better description

    Rachel Cummings, Gabriel Kaptchuk, and Elissa M. Redmiles. 2021. "I need a better description": An Investigation Into User Expectations For Differential Privacy. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, Republic o...

    2021

  4. [11]

    Ngong, Yuanyuan Feng, and Joseph P

    Onyinye Dibia, Brad Stenger, Steven Baldasty, Mako Bates, Ivoline C. Ngong, Yuanyuan Feng, and Joseph P. Near. 2024. SoK: Usability Studies in Differential Privacy. arXiv:2412.16825 [cs.HC] https://arxiv.org/abs/2412.16825

    2024 arXiv

  5. [12]

    George T Duncan and Diane Lambert. 1986. Disclosure-limited data dissemina- tion. Journal of the American statistical association 81, 393 (1986), 10–18

    1986

  6. [13]

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. 2006. Our Data, Ourselves: Privacy Via Distributed Noise Generation. In Advances in Cryptology - EUROCRYPT 2006 , Serge Vaudenay (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 486–503. 1...

    2006

  7. [14]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating Noise to Sensitivity in Private Data Analysis. In Theory of Cryptography , Shai Halevi and Tal Rabin (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 265–284

    2006

  8. [15]

    Cynthia Dwork and Rebecca Pottenger. 2013. Toward practicing privacy.Journal of the American Medical Informatics Association 20, 1 (2013), 102–108

    2013

  9. [16]

    Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    2014

  10. [17]

    Rothblum, and Salil Vadhan

    Cynthia Dwork, Guy N. Rothblum, and Salil Vadhan. 2010. Boosting and Differ- ential Privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science. IEEE, Piscataway, NJ, USA, 51–60. https://doi.org/10.1109/FOCS.2010.12

    2010 doi

  11. [18]

    Daniel Franzen, Saskia Nuñez von Voigt, Peter Sörries, Florian Tschorsch, and Claudia Müller-Birn. 2022. Am I Private and If So, how Many? Communicating Privacy Guarantees of Differential Privacy with Risk Communication Formats. In Proceedings of the 2022 ACM SIGSAC Conference...

    2022

  12. [19]

    Marco Gaboardi, Michael Hay, and Salil Vadhan. 2020. A programming frame- work for opendp

    2020

  13. [20]

    A Herdağdelen, Alex Dow, S Bogdan, M Payman, and A Pompe. 2020. Protecting privacy in Facebook mobility data during the COVID-19 response

    2020

  14. [21]

    V Joseph Hotz, Christopher R Bollinger, Tatiana Komarova, Charles F Manski, Robert A Moffitt, Denis Nekipelov, Aaron Sojourner, and Bruce D Spencer. 2022. Balancing data privacy and usability in the federal statistical system. Proceedings of the National Academy of Sciences 11...

    2022

  15. [22]

    Mark F. St. John, Grit Denker, Peeter Laud, Karsten Martiny, Alisa Pankova, and Dusko Pavlovic. 2021. Decision Support for Sharing Data using Differential Privacy. In2021 IEEE Symposium on Visualization for Cyber Security (VizSec). IEEE, Piscataway, NJ, USA, 26–35. https://doi...

    2021

  16. [23]

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2015. The Composi- tion Theorem for Differential Privacy. In Proceedings of the 32nd International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 37), Francis Bach and David Blei (Eds.). PMLR, Lil...

    2015

  17. [24]

    Kasiviswanathan and Adam Smith

    Shiva P. Kasiviswanathan and Adam Smith. 2014. On the ’Semantics’ of Differ- ential Privacy: A Bayesian Formulation. Journal of Privacy and Confidentiality 6, 1 (Jun. 2014), 1–16. https://doi.org/10.29012/jpc.v6i1.634

    2014 doi

  18. [25]

    Zeki Kazan and Jerome Reiter. 2025. Assessing Statistical Disclosure Risk for Differentially Private, Hierarchical Count Data, with Application to the 2020 US Decennial Census. Statistica Sinica 35 (2025), 1–21

    2025

  19. [26]

    Zeki Kazan and Jerome P. Reiter. 2024. Prior-itizing Privacy: A Bayesian Ap- proach to Setting the Privacy Budget in Differential Privacy. Advances in Neural Information Processing Systems 37 (2024), 90384–90430

    2024

  20. [27]

    Abowd, Robert Ashmead, Ryan Cumings-Menon, Philip Leclerc, Ashwin Machanavajjhala, William Sexton, and Pavel Zhuravlev

    Daniel Kifer, John M. Abowd, Robert Ashmead, Ryan Cumings-Menon, Philip Leclerc, Ashwin Machanavajjhala, William Sexton, and Pavel Zhuravlev. 2022. Bayesian and Frequentist Semantics for Common Variations of Differential Privacy: Applications to the 2020 Census. arXiv:2209.033...

    2022 arXiv

  21. [28]

    Daniel Kifer and Bing-Rong Lin. 2012. An Axiomatic View of Statistical Privacy and Utility. Journal of Privacy and Confidentiality 4, 1 (Jul. 2012), 5—-49. https: //doi.org/10.29012/jpc.v4i1.610

    2012 doi

  22. [29]

    Daniel Kifer and Ashwin Machanavajjhala. 2014. Pufferfish: A framework for mathematical privacy definitions. ACM Transactions on Database Systems (TODS) 39, 1 (2014), 1–36

    2014

  23. [30]

    Tumult Labs. 2023. Illuminating College Outcomes | Tumult Labs. https://www. tmlt.io/casestudy/illuminating-college-outcomes-while-protecting-privacy

    2023

  24. [31]

    Jaewoo Lee and Chris Clifton. 2011. How Much Is Enough? Choosing 𝜖 for Differential Privacy. In Information Security, Xuejia Lai, Jianying Zhou, and Hui Li (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 325–340

    2011

  25. [32]

    Ashwin Machanavajjhala, Daniel Kifer, John Abowd, Johannes Gehrke, and Lars Vilhuber. 2008. Privacy: Theory meets Practice on the Map. In 2008 IEEE 24th International Conference on Data Engineering . IEEE, IEEE, 277–286. https: //doi.org/10.1109/ICDE.2008.4497436

    2008

  26. [33]

    David McClure and Jerome P Reiter. 2012. Differential Privacy and Statistical Dis- closure Risk Measures: An Investigation with Binary Synthetic Data.Transactions on Data Privacy 5, 3 (2012), 535–552

    2012

  27. [34]

    Sebastian Meiser. 2018. Approximate and probabilistic differential privacy defi- nitions

    2018

  28. [35]

    Solomon Messing, Christina DeGregorio, Bennett Hillenbrand, Gary King, Saurav Mahanti, Zagreb Mukerjee, Chaya Nayak, Nate Persily, Bogdan State, and Arjun Wilkins. 2020. Facebook Privacy-Protected Full URLs Data Set. https://doi.org/ 10.7910/DVN/TDOAPG

    2020 doi

  29. [36]

    Jack Murtagh and Salil Vadhan. 2016. The Complexity of Computing the Optimal Composition of Differential Privacy. In Theory of Cryptography , Eyal Kushilevitz and Tal Malkin (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 157–175

    2016

  30. [37]

    Redmiles

    Priyanka Nanayakkara, Mary Anne Smart, Rachel Cummings, Gabriel Kaptchuk, and Elissa M. Redmiles. 2023. What Are the Chances? Explaining the Epsilon Parameter in Differential Privacy. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA, 1613...

    2023

  31. [38]

    Alisa Pankova and Peeter Laud. 2022. Interpreting Epsilon of Differential Privacy in Terms of Advantage in Guessing or Approximating Sensitive Attributes. In 2022 IEEE 35th Computer Security Foundations Symposium (CSF). IEEE, Piscataway, NJ, USA, 96–111. https://doi.org/10.110...

    2022

  32. [39]

    Mayana Pereira, Allen Kim, Joshua Allen, Kevin White, Juan Lavista Ferres, and Rahul Dodhia. 2021. U.S. Broadband Coverage Data Set: A Differentially Private Data Release. https://europepmc.org/article/PPR/PPR343016

    2021

  33. [40]

    Spectus. 2022. Differential Privacy. https://spectus.ai/wp-content/uploads/2022/ 10/Spectus_DPWhitepaper_v01b.pdf

    2022

  34. [41]

    Thomas Steinke. 2022. Composition of Differential Privacy & Privacy Amplifica- tion by Subsampling. arXiv:2210.00597 [cs.CR] https://arxiv.org/abs/2210.00597

    2022 arXiv

  35. [42]

    Jun Tang, Aleksandra Korolova, Xiaolong Bai, Xueqiang Wang, and Xiaofeng Wang. 2017. Privacy Loss in Apple’s Implementation of Differential Privacy on MacOS 10.12. arXiv:1709.02753 [cs.CR] https://arxiv.org/abs/1709.02753

    2017 arXiv

  36. [43]

    Anvith Thudi, Ilia Shumailov, Franziska Boenisch, and Nicolas Papernot. 2024. From Differential Privacy to Bounds on Membership Inference: Less can be More. https://openreview.net/forum?id=daXqjb6dVE

    2024

  37. [44]

    Alexandra Wood, Micah Altman, Aaron Bembenek, Mark Bun, Marco Gaboardi, James Honaker, Kobbi Nissim, David R O’Brien, Thomas Steinke, and Salil Vadhan

  38. [45]

    Alexandra Wood, Micah Altman, Kobbi Nissim, and Salil Vadhan. 2020. Designing access with differential privacy

    2020

  39. [47]

    −𝑒𝜀/2− 1 𝑒𝜀/2+ 1 ≤𝐷𝑖≤ 𝑒𝜀/2− 1 𝑒𝜀/2+ 1 # ≥ 1−𝛿. (8) 13 Kazan et al. (2) If𝑀 is such that for any database x, target𝑖,𝑝𝑖∈[ 0, 1], and under both𝑌←𝑀(x) and𝑌←𝑀(x−𝑖), 𝑃

    Yuqing Zhu, Jinshuo Dong, and Yu-Xiang Wang. 2022. Optimal Accounting of Differential Privacy via Characteristic Function. In Proceedings of The 25th International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research, Vol. 151), Gustau...

    2022

  40. [2018]

    Differential privacy: A primer for a non-technical audience. Vand. J. Ent. & Tech. L. 21 (2018), 209

    2018

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.