Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Sequential Auditing for f-Differential Privacy

T0 review · 4 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Sequential testing can audit f-differential privacy adaptively, holding the user's significance level while using a near-optimal sample size.

desk verdict First sequential f-DP auditor with a real practical win on sample sizes; the advertised level guarantee doesn't yet cover the refitting classifier the algorithm actually runs, so treat Theorem 3.1 as a theorem about a component, not about the full APT as implemented. read the letter →

arxiv 2602.06518 v2 pith:DRRFRTSO submitted 2026-02-06 cs.CR stat.MEstat.ML

Tim Kutta , Martin Dunsche , Yu Wei , Vassilis Zikas This is my paper
classification cs.CRstat.MEstat.ML
keywords f-differentialprivacysequentialtestingauditingtradeofffunctionanytime-validinferenceDP-SGDhypothesissignificancelevel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces APT, the first sequential auditor for f-differential privacy (f-DP). It aims to decide, as samples arrive one by one, whether a mechanism's output distributions on neighboring databases satisfy a claimed privacy tradeoff curve f, while holding the false-rejection rate at a user-set level γ and stopping as soon as evidence is sufficient. The paper proves that APT rejects a true f-DP claim with probability at most γ (up to a vanishing term) and detects genuine violations with certainty, using a sample count within a logarithmic factor of the theoretically optimal fixed-batch test. Because the auditor adapts its sample size instead of requiring a fixed n, it avoids the massive oversampling that plagues batch auditing, and empirically uses only 10–25% of the samples needed by a recently proposed sequential (ε,δ)-DP auditor. A new 45-degree classifier-tuning rule is also shown to improve detection power even in fixed-batch f-DP auditing.

What carries the argument

The tradeoff function T(α) (the minimal type-II error achievable at type-I error α) encodes the full privacy leakage; a mechanism is f-DP if T(α) ≥ f(α) for all α. APT picks a classifier φ from a family parameterized by likelihood-ratio thresholds η, estimates its error point (αφ, βφ), and uses anytime-valid confidence rectangles (Algorithm 4) built from a KMT-type Gaussian (Brownian) approximation, so that the event 'the confidence rectangle dips below f' has controlled probability over all stopping times. The 45-degree rule (equation (8)) selects the η whose estimated point maximizes the axis-aligned square that fits below f, targeting the geometry of detection.

What would settle it

Construct a mechanism whose tradeoff curve dips below the claimed f only at small α, and instantiate APT with a threshold grid that produces no empirical point below f in that region; if the auditor never rejects despite an arbitrarily large sample size, the dependence of detection on classifier coverage of the violating α-region is confirmed.

Watch

Extended reading notes

Core claim

The central claim is that f-DP can be audited sequentially: rather than drawing a pre-specified number of outputs, APT monitors a classifier's empirical error rates (α̂, β̂) and rejects the claimed curve f only when confidence-adjusted estimates fall below f by a margin derived from the fluctuations of a Brownian motion, which guarantees that the false rejection over an arbitrarily long audit stays at the significance level. Formally, for any fixed classifier φ, Theorem 3.1 shows the rejection probability is o(1) when the true error point lies above f, γ+o(1) when it lies on f, and 1 when it lies below f, and Remark 3.2 shows the required sample size is within a log factor of the optimal fix

Load-bearing premise

The auditor's power rests on the chosen classifier family containing an operating point that lies below the claimed curve f at the α where the true tradeoff curve T dips below f; if no selected classifier realizes such a point, APT can run forever without rejecting even though f-DP is violated.

Editorial extensions

If this is right

  • Auditing DP-SGD and other costly mechanisms becomes much cheaper: the number of training runs adapts to the severity of the violation, so strong violations stop early and subtle ones trigger more sampling.
  • Because f-DP covers the entire (ε,δ) spectrum, one sequential audit can detect violations a local (ε,δ)-DP test would miss, without committing to a specific ε.
  • The anytime-valid confidence bounds mean the same auditor can be embedded in one-run canary pipelines, scoring more canaries only as needed while keeping the significance guarantee.
  • The 45-degree classifier-selection rule is a drop-in improvement for existing fixed-batch f-DP auditors, not just for sequential ones.
  • Users no longer need to guess a sample size; the auditor stops when evidence suffices, eliminating the oversampling by orders of magnitude seen in current practice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the dependence extension mentioned in Remark 3.3 is used, APT could audit mechanisms with correlated outputs, e.g., iterative algorithms, as long as long-run variances are estimated — widening applicability beyond i.i.d. settings the main theorem assumes.
  • The log-factor gap to the fixed-batch optimum suggests that in practice the dominant cost is the quality of the classifier, not the sequential testing overhead; investing in better density estimates or learned scores may yield larger gains than refining the boundary function.
  • A natural extension is to run APT simultaneously over a grid of α-values with a Bonferroni (or more careful) correction, turning the pointwise rejection rule into a whole-curve test — aligning the test statistic with the full-curve hypothesis pair and softening the dependence on a single classifier's operating point.
  • Practitioners could use the burn-in and non-rejection behavior to report a certificate: if APT has not rejected after a long run and the selected classifier's point sits above f, the mechanism is empirically compatible with f-DP in the tested regions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces APT, claimed to be the first sequential auditor for f-Differential Privacy. APT monitors a classifier's empirical type-I/type-II errors on samples from two neighboring distributions, using a Brownian-motion/KMT boundary to make the repeated testing anytime-valid. The stated contributions are: (i) a theorem (Theorem 3.1) that APT holds a user-specified significance level gamma and eventually detects violations; (ii) a near-optimal sample-size claim (Remark 3.2); (iii) a new 45-degree rule (Eq. (8)) for tuning likelihood-ratio classifiers; and (iv) experiments in blackbox, whitebox, and one-run DP-SGD settings showing large sample savings over the parallel sequential (epsilon,delta)-DP auditor of [23]. The paper is clearly written and contains a real fixed-classifier theorem, but the implemented algorithm differs from the theorem's assumptions in ways the authors acknowledge but do not resolve.

Significance. If the guarantees were established for the actual implemented procedure, this would be a substantial contribution: it is the first sequential f-DP auditor, it offers anytime-valid significance control without a pre-specified sample size, its empirical sample savings over [23] are large and reproducible, and the new diagonal classifier-tuning rule appears to improve fixed-batch auditing as well. The authors also provide an open-source implementation and are candid about the theory/practice gap. However, the headline guarantees—global level control and full-spectrum detection—are not consequences of Theorem 3.1 as applied to Algorithm 1, and the near-optimality claim is only a sketch. The central idea is defensible and the gaps appear fixable, but the paper in its current form does not prove what it claims for the method it evaluates.

major comments (4)
  1. [§3.2, Theorem 3.1, Algorithm 1] Theorem 3.1 is stated and proved only for a classifier phi fixed in advance, but Algorithm 1 builds phi from the burn-in sample via BUILDCLASSIFIER (line 3), re-selects/thresholds using Eq. (8), refits phi every M1 steps (lines 8–10), and reuses the same burn-in data in the test statistics (line 12). Section 3.2 explicitly says 'In this version the classifier phi is fixed'; the claim that 'related results are available' is not backed by a proof. The eta*-maximization over the candidate grid is data-dependent multiple testing, and the fixed-phi boundary q_{1-gamma/2} does not account for it. Thus the central claim that APT holds a user-set significance level gamma is unproven for the actual algorithm.
  2. [Eq. (5), Algorithm 1 line 14, Remark 3.2] The hypothesis pair in (5) is about the entire tradeoff curve T, but the rejection rule is pointwise in one classifier's empirical point (alpha_hat_phi, beta_hat_phi). Theorem 3.1(c) only states that if a fixed classifier has f(alpha_phi)>beta_phi then rejection is eventual; it does not imply that whenever H1 holds the auditor rejects, because the violation may occur at an alpha-region not realized by the selected classifier family. The abstract's 'full privacy spectrum' detection claim is therefore not derived. A condition linking H1 to the selected classifier's operating point (as assumed informally in Remark 3.2) must be stated and proved, or the claim should be weakened.
  3. [Appendix A, Algorithm 4] The proof replaces the empirical process D(k) by the Gaussian process D_Z(k) and uses quantiles of sup_{k>=M} D_Z(k). However, Algorithm 4 plugs in estimated standard deviations s1,s2 computed from the burn-in sample, while the quantile is derived for known variance. The appendix calls this a 'minor gap' and invokes Slutsky, but in an anytime-valid sequential test the variance estimator is used at every k and is also correlated with the classifier-selection step. No uniformity argument over k and over the selection event is supplied. This is load-bearing for the level guarantee, not a cosmetic issue.
  4. [Remark 3.2] The near-optimal sample-size claim is presented as a consequence of Theorem 3.1 but is only a sketch. No theorem bounds the stopping time tau = inf{k: APT rejects} under H1; the asserted O_P(delta^{-2}) and O_P(delta^{-2} log(delta^{-1})) rates are not derived. Since 'near-optimal number of samples' is a headline contribution, this should be a formal statement with proof, or explicitly labeled as an empirical heuristic.
minor comments (5)
  1. [Algorithm 1, Algorithm 4] The signature of CONFADJ is inconsistent: Algorithm 4 lists parameters (T1,T2,s1,s2,q,M,k), but Algorithm 1 line 5 and the text call it with (alpha_hat,beta_hat,q,M). Please align the pseudocode and the calls.
  2. [§4.4] The text says 'we re-sample with replacement from P and Q a total of 250 times'; it should clarify that these are the empirical distributions of the canary-included and no-canary scores, not the unknown theoretical P and Q.
  3. [Algorithm 3] The perturbation parameter h enters the PLRT estimator, but no guidance or sensitivity analysis is given for h. A brief remark on how h affects the estimates and the boundary would help reproducibility.
  4. [Figure 3] The displayed boundary g(x) = sqrt((x/4) log(20+x)) is not clearly related to the boundary used in Algorithm 4 or Algorithm 5. Please connect the figure to the actual formula.
  5. [Remark 3.3] The claim that Theorem 3.1 extends to dependent data is stated without proof and with only a pointer to [8]. Since the formal proof in Appendix A is explicitly for i.i.d. data, this remark should be softened or accompanied by a precise statement of the dependence conditions.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the audit's validity rests on an external KMT/Brownian-motion argument; the eta-selection/refit gap and self-citations are correctness/evidence issues, not reductions.

full rationale

The central guarantee (Theorem 3.1) is proved for a fixed classifier phi using the KMT approximation (Theorem A.1) and Brownian supremum quantiles (Algorithm 5); the decision boundary is distributional, not fitted to rejection outcomes. The ground-truth tradeoff curves (Gaussian/Laplace from [18], DP-SGD from [5]) are fixed closed-form benchmarks with stated assumptions, and the same authors' PLRT estimator is an input subroutine, not the source of the theorem. The paper itself flags the two real gaps: Section 3.2 says 'In this version the classifier phi is fixed, even though related results are available for adequate updating rules,' while the implemented Algorithm 1 selects eta* by (8) and refits phi on the burn-in/test data; and Appendix A calls the estimated-variance step 'a minor gap.' These are validity/robustness concerns about applying a fixed-phi theorem to a data-dependent procedure, not circular reductions--the theorem does not assume the selected eta*, and the rejection rule is not definitionally equal to a fitted parameter. The hypothesis pair (5) is about the whole curve T while the test uses a single point (alpha_hat_phi, beta_hat_phi); that is a power/detection limitation, also not circular. Self-citations to [5] and [29] are used as reproducible estimators/benchmarks, so they do not make the derivation circular.

Assumptions & free parameters 6 free parameters · 7 assumptions · 0 invented entities

The central guarantee is imported from KMT/Brownian-motion theory rather than derived from a privacy law; no new entities are postulated. The ground-truth f-DP curves come from prior literature, including the authors' own [5] for DP-SGD; this is self-citation but not circular because those curves are fixed benchmarks, not fitted to make the audits pass. The main hand-chosen ingredients are M, h, eta_max, M2, the refit threshold, and the Monte Carlo quantile truncations; the theory is asymptotic and does not pin down their finite-sample effect.

free parameters (6)
  • Burn-in size M = not stated in Experiments (prose says M=50 sufficient)
    Input to Algorithm 1 determining the burn-in sample before testing; the o(1) terms in Theorem 3.1 are asymptotic in M, so the actual false-rejection level for finite M depends on this choice. Its experimental value is not reported in the main text.
  • Perturbation h = 0.1
    Hand-chosen smoothing parameter in the blackbox likelihood-ratio classifier (Algorithm 3); affects the estimated tradeoff points and therefore the audit's power.
  • eta_max = 15
    Hand-chosen upper bound of the threshold grid for the blackbox classifier; constrains which operating points the auditor can visit.
  • Refit threshold tau and exponent 1/5 = 0.1
    Controls the adaptive refresh period M1 via Algorithm 7; hand-chosen tuning that changes how often the classifier is rebuilt. The exponent 1/5 in the shrink function is also chosen ad hoc.
  • Evaluation period M2 = 10
    Static frequency at which the test checks for a violation; hand-chosen.
  • Monte Carlo quantile parameters R, T = R=10^5, T=10^4
    Truncations in Algorithm 5 that determine q_{1-gamma/2}; the critical value is computed numerically rather than analytically, so different truncations give slightly different boundaries.
assumptions (7)
  • standard math KMT strong approximation (Theorem A.1): bounded i.i.d. partial sums are approximable by a Gaussian process to within O(log k) almost surely.
    Imported from [27,28,8]; the main probabilistic tool behind the anytime-valid boundary. Requires boundedness and finite variance, which hold because the classifier phi is [0,1]-valued.
  • standard math The sup functional of the rescaled Gaussian process converges weakly to L = sup_{x>=1} W(x)/sqrt(x log(20+x)), with finite quantiles.
    Used in Appendix A.1 to claim that the precomputed Monte Carlo quantiles q_{1-gamma/2} are meaningful and finite; relies on the law of the iterated logarithm.
  • standard math Slutsky's theorem justifies replacing the unknown variance Var(phi(X1)) by the empirical burn-in variance uniformly in k.
    The paper itself calls this a 'minor gap'; pointwise consistency does not automatically yield the time-uniform probability bound used in Theorem 3.1.
  • domain assumption Gaussian and Laplace tradeoff curves from [18] are correct ground truth.
    Used to define the claimed curves f and the simulated mechanisms; not re-derived in this paper.
  • domain assumption DP-SGD tradeoff curve TSGD from [5] (own prior paper) is correct ground truth under the chosen hyperparameters.
    Adopted from the authors' own USENIX'25 paper; used for validation, so an error there would bias the DP-SGD experiments.
  • domain assumption Auditing the single adjacent pair D=(0,...,0), D'=(1,0,...,0) is sufficient to reveal f-DP violations.
    Standard in the auditing literature ([29]), but the auditor only tests the tradeoff function of this pair; mechanisms leaking on other pairs could evade detection.
  • domain assumption The whitebox Gaussian equal-variance model (and its plug-in threshold classifier) remains powerful for moderately non-Gaussian outputs.
    Stated in Section 4.2; a heuristic robustness assumption, not a theorem.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Sequential Auditing for f-Differential Privacy." pith.science (2026). https://pith.science/paper/DRRFRTSO

@misc{pith2026260206518,
  author       = {Pith},
  title        = {Pith review of: Sequential Auditing for f-Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DRRFRTSO}},
  note         = {Machine review of arXiv:2602.06518}
}
abstract

We present new auditors to assess Differential Privacy (DP) of an algorithm based on output samples. Such empirical auditors are common to check for algorithmic correctness and implementation bugs. Most existing auditors are batch-based or targeted toward the traditional notion of $(\varepsilon,\delta)$-DP; typically both. In this work, we shift the focus to the highly expressive privacy concept of $f$-DP, in which the entire privacy behavior is captured by a single tradeoff curve. Our auditors detect violations across the full privacy spectrum with statistical significance guarantees, which are supported by theory and simulations. Most importantly, and in contrast to prior work, our auditors do not require a user-specified sample size as an input. Rather, they adaptively determine a near-optimal number of samples needed to reach a decision, thereby avoiding the excessively large sample sizes common in many auditing studies. This reduction in sampling cost becomes especially beneficial for expensive training procedures such as DP-SGD. Our method supports both whitebox and blackbox settings and can also be executed in one-run frameworks.

Figures

Figures reproduced from arXiv: 2602.06518 by the authors.

Figure 1
Figure 1. Power, sample size, and effect size form a triad [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. False rejection rates in sequential testing without [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Realizations of the standard Brownian motion on [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The blue line corresponds to f, while the red line represents the estimated tradeoff curve Tˆ. The vertical green line and diagonal yellow line correspond to the rules of select￾ing η in (7) and (8), respectively. The rule (8) maximizes the size of the square that can …
Figure 5
Figure 5. Figure 5: Empirical rejection rates relative to sample sizes across 1 [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Empirical rejection rate (blue curve) and average [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Comparison for µclaim = 0.5 (in reality µ = 1) be￾tween one-shot t-test (green curve), Algorithm 1 (blue curve) and [5] (orange curve). 18 [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Comparison for µclaim = 0.8 (in reality µ = 1) be￾tween one-shot t-test (green curve), Algorithm 1 (blue curve) and [5] (orange curve). 19 [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 3 linked inside Pith

  1. [23]

    Sequentially auditing Differential Privacy

    Tomás González, Mateo Dulce Rubio, Aaditya Ramdas, and Mónica Ribero. Sequentially auditing Differential Privacy. InAdvances in Neural Information Processing Systems, 2025

    2025

  2. [5]

    General-purpose f -DP estimation and auditing in a black-box setting

    Önder Askin, Holger Dette, Martin Dunsche, Tim Kutta, Yun Lu, Yu Wei, and Vassilis Zikas. General-purpose f -DP estimation and auditing in a black-box setting. In Proceedings of the USENIX Security Symposium, pages 2713–2732, 2025

    2025

  3. [1]

    Goodfellow, H

    Martín Abadi, Andy Chu, Ian J. Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with Differential Privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318. ACM, 2016

    2016

  4. [2]

    John M. Abowd. The U.S. census bureau adopts Dif- ferential Privacy. InProceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, page 2867, 2018

    2018

  5. [3]

    Abowd, Robert Ashmead, Ryan Cumings- Menon, Simson L

    John M. Abowd, Robert Ashmead, Ryan Cumings- Menon, Simson L. Garfinkel, Matthew Heineck, Chris- tine Heiss, Robert Johns, Daniel Kifer, Patrick Leclerc, Ashwin Machanavajjhala, Benjamin Moran, William Sexton, Matthew Spence, and Pavel Zhuravlev. The 2020 Census Disclosure Avoidance System TopDown Algorithm.Harvard Data Science Review, 2022

    2020

  6. [4]

    Learning with pri- vacy at scale

    Apple Differential Privacy Team. Learning with pri- vacy at scale. Apple Machine Learning Research,

  7. [6]

    Optimizing noise for f -Differential Privacy via anti-concentration and stochastic dominance.Journal of Machine Learning Research, 25:1–32, 2024

    Jordan Awan and Aishwarya Ramasethu. Optimizing noise for f -Differential Privacy via anti-concentration and stochastic dominance.Journal of Machine Learning Research, 25:1–32, 2024

    2024

  8. [7]

    Raef Bassily, Adam Groce, Jonathan Katz, and Adam D. Smith. Coupled-worlds privacy: Exploiting adversarial uncertainty in statistical data privacy. InProceedings of the IEEE Symposium on Foundations of Computer Science, pages 439–448, 2013

    2013

Show all 44 references
  1. [8]

    Komlós– Major–Tusnády approximation under dependence.The Annals of Probability, 42(2):794–817, 2014

    István Berkes, Weidong Liu, and Wei Biao Wu. Komlós– Major–Tusnády approximation under dependence.The Annals of Probability, 42(2):794–817, 2014. 13

    2014

  2. [9]

    Benjamin Bichsel, Timon Gehr, Dana Drachsler-Cohen, Petar Tsankov, and Martin T. Vechev. DP-finder: Find- ing Differential Privacy violations by sampling and op- timization. InProceedings of the ACM SIGSAC Confer- ence on Computer and Communications Security, pages 508–524, 2018

    2018

  3. [10]

    Benjamin Bichsel, Samuel Steffen, Ilija Bogunovic, and Martin T. Vechev. DP-sniper: Black-box discovery of Differential Privacy violations using classifiers. InPro- ceedings of the IEEE Symposium on Security and Pri- vacy, pages 391–409, 2021

    2021

  4. [11]

    Brockwell and Richard A

    Peter J. Brockwell and Richard A. Davis.Introduc- tion to Time Series and Forecasting. Springer Texts in Statistics. Springer International Publishing AG, Cham, Switzerland, 3rd edition, 2016

    2016

  5. [12]

    Concentrated Differ- ential Privacy: Simplifications, extensions, and lower bounds

    Mark Bun and Thomas Steinke. Concentrated Differ- ential Privacy: Simplifications, extensions, and lower bounds. InProceedings of the Theory of Cryptography Conference, volume 9985 ofLecture Notes in Computer Science, pages 635–658, 2016

    2016

  6. [13]

    Membership in- ference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramèr. Membership in- ference attacks from first principles. InProceedings of the IEEE Symposium on Security and Privacy, pages 1897–1914, 2022

    1914

  7. [14]

    Advancing differential privacy: Where we are now and future directions for real-world deployment.Harvard Data Science Review, 6(1), 2024

    Rachel Cummings, Damien Desfontaines, David Evans, Roxana Geambasu, Yangsibo Huang, Matthew Jagiel- ski, Peter Kairouz, Gautam Kamath, Sewoong Oh, Olga Ohrimenko, Nicolas Papernot, Ryan Rogers, Mi- lan Shen, Shuang Song, Weijie Su, Andreas Terzis, Abhradeep Thakurta, Sergei Va...

    2024

  8. [15]

    An alternative to the coupling of Berkes–Liu–Wu for strong approximations.Chaos, Soli- tons & Fractals, 106:233–242, 2018

    Christophe Cuny, Jérôme Dedecker, and Florence Merlevède. An alternative to the coupling of Berkes–Liu–Wu for strong approximations.Chaos, Soli- tons & Fractals, 106:233–242, 2018

    2018

  9. [16]

    Smith, and Borja Balle

    Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, and Borja Balle. Unlocking high-accuracy dif- ferentially private image classification through scale. arXiv:2204.13650, 2022. Presented at TPDP Workshop at ICML 2022

    2022 arXiv

  10. [17]

    Collecting telemetry data privately

    Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. InAdvances in Neural Information Processing Systems, pages 3574– 3583, 2017

    2017

  11. [18]

    Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian Differential Privacy.Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3–37, 2022

    2022

  12. [19]

    Our data, ourselves: Privacy via distributed noise generation

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSh- erry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. InAdvances in Cryptology — EUROCRYPT 2006, volume 4004 of Lecture Notes in Computer Science, pages 486–503. Springer, 2006

    2006

  13. [20]

    The algorithmic foundations of Differential Privacy.Foundations and Trends in Theoretical Computer Science, 9(3–4):211– 407, 2014

    Cynthia Dwork and Aaron Roth. The algorithmic foundations of Differential Privacy.Foundations and Trends in Theoretical Computer Science, 9(3–4):211– 407, 2014

    2014

  14. [21]

    Rothblum, and Salil Vadhan

    Cynthia Dwork, Guy N. Rothblum, and Salil Vadhan. Boosting and differential privacy. In51st Annual IEEE Symposium on Foundations of Computer Science (FOCS 2010), pages 51–60. IEEE, 2010

    2010

  15. [22]

    RAPPOR: Randomized aggregatable privacy-preserving ordinal response

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. RAPPOR: Randomized aggregatable privacy-preserving ordinal response. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security, pages 1054–1067, 2014

    2014

  16. [24]

    On the geometry of Dif- ferential Privacy

    Moritz Hardt and Kunal Talwar. On the geometry of Dif- ferential Privacy. InProceedings of the 42nd ACM Sym- posium on Theory of Computing (STOC 2010), pages 705–714. ACM, 2010

    2010

  17. [25]

    Howard, Aaditya Ramdas, Jon McAuliffe, and Jasjeet Sekhon

    Steven R. Howard, Aaditya Ramdas, Jon McAuliffe, and Jasjeet Sekhon. Time-uniform, nonparametric, nonasymptotic confidence sequences.Annals of Statis- tics, 49(2):1055–1080, 2021

    2021

  18. [26]

    A Primer on Private Statistics.arXiv:2005.00010, 2020

    Gautam Kamath and Jonathan Ullman. A Primer on Private Statistics.arXiv:2005.00010, 2020

    2005 arXiv

  19. [27]

    An ap- proximation of partial sums of independent R.V.’s and the sample DF.I.Zeitschrift für Wahrscheinlichkeitsthe- orie und Verwandte Gebiete, 32:111–131, 1975

    János Komlós, Péter Major, and Gábor Tusnády. An ap- proximation of partial sums of independent R.V.’s and the sample DF.I.Zeitschrift für Wahrscheinlichkeitsthe- orie und Verwandte Gebiete, 32:111–131, 1975

    1975

  20. [28]

    An ap- proximation of partial sums of independent R.V.’s and the sample DF.II.Zeitschrift für Wahrscheinlichkeitsthe- orie und Verwandte Gebiete, 34:33–58, 1976

    János Komlós, Péter Major, and Gábor Tusnády. An ap- proximation of partial sums of independent R.V.’s and the sample DF.II.Zeitschrift für Wahrscheinlichkeitsthe- orie und Verwandte Gebiete, 34:33–58, 1976

    1976

  21. [29]

    Lower bounds for Rényi Differential Privacy in a black-box 14 setting

    Tim Kutta, Önder Askin, and Martin Dunsche. Lower bounds for Rényi Differential Privacy in a black-box 14 setting. InProceedings of the IEEE Symposium on Security and Privacy, pages 951–971, 2024

    2024

  22. [30]

    Lehmann and Joseph P

    Erich L. Lehmann and Joseph P. Romano.Testing Statis- tical Hypotheses. Springer Texts in Statistics. Springer Science+Business Media, New York, NY , USA, 3rd edi- tion, 2005

    2005

  23. [31]

    Minimax optimal estima- tion of approximate Differential Privacy on neighboring databases

    Xiyang Liu and Sewoong Oh. Minimax optimal estima- tion of approximate Differential Privacy on neighboring databases. InAdvances in Neural Information Process- ing Systems, pages 2414–2425, 2019

    2019

  24. [32]

    Eureka: A general framework for black-box Dif- ferential Privacy estimators

    Yun Lu, Malik Magdon-Ismail, Yu Wei, and Vassilis Zikas. Eureka: A general framework for black-box Dif- ferential Privacy estimators. InProceedings of the IEEE Symposium on Security and Privacy, pages 913–931, 2024

    2024

  25. [33]

    Auditing f -Differential Privacy in one run

    Saeed Mahloujifar, Luca Melis, and Kamalika Chaud- huri. Auditing f -Differential Privacy in one run. arXiv:2410.22235, 2024

    2024 arXiv

  26. [34]

    Mechanism design via differential privacy

    Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In48th Annual IEEE Sympo- sium on Foundations of Computer Science (FOCS 2007), pages 94–103. IEEE, 2007

    2007

  27. [35]

    Opacus: User-Friendly differential privacy library in PyTorch

    Meta AI. Opacus: User-Friendly differential privacy library in PyTorch. https://opacus.ai/, 2026. Ac- cessed 2026-02-05

    2026

  28. [36]

    Rényi Differential Privacy

    Ilya Mironov. Rényi Differential Privacy. InProceed- ings of the IEEE Computer Security Foundations Sym- posium, pages 263–275, 2017

    2017

  29. [37]

    Tight auditing of Differentially Private machine learning

    Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, and Andreas Terzis. Tight auditing of Differentially Private machine learning. InProceedings of the USENIX Security Symposium, pages 1631–1648, 2023

    2023

  30. [38]

    Privacy auditing with one (1) training run.Advances in Neural Information Processing Systems, 36:49268– 49280, 2023

    Thomas Steinke, Milad Nasr, and Matthew Jagielski. Privacy auditing with one (1) training run.Advances in Neural Information Processing Systems, 36:49268– 49280, 2023

    2023

  31. [39]

    Salil P. Vadhan. The complexity of differential privacy. In Yehuda Lindell, editor,Tutorials on the Foundations of Cryptography, pages 347–450. Springer International Publishing, 2017

    2017

  32. [40]

    R pack- age version 2.23-26

    Matt Wand.KernSmooth: Functions for Kernel Smooth- ing Supporting Wand & Jones (1995), 2025. R pack- age version 2.23-26. Available at https://CRAN.R- project.org/package=KernSmooth

    1995

  33. [41]

    Chendi Wang, Buxin Su, Jiayuan Ye, Reza Shokri, and Weijie J. Su. Unified enhancement of privacy bounds for mixture mechanisms via f -Differential Privacy. In Advances in Neural Information Processing Systems, 2023

    2023

  34. [42]

    Checkdp: An automated and integrated approach for proving Differential Privacy or finding precise coun- terexamples

    Yuxin Wang, Zeyu Ding, Daniel Kifer, and Danfeng Zhang. Checkdp: An automated and integrated approach for proving Differential Privacy or finding precise coun- terexamples. InProceedings of the ACM SIGSAC Con- ference on Computer and Communications Security, pages 919–938, 2020

    2020

  35. [43]

    the law of the iterated logarithm

    Hanshen Xiao and Srinivas Devadas. PAC privacy: Au- tomatic privacy measurement and control of data pro- cessing. InAdvances in Cryptology — CRYPTO 2023, volume 14082 ofLecture Notes in Computer Science, pages 611–644. Springer, 2023. 15 A Proofs and Technical Details The main...

    2023

  36. [2017]

    https://docs-assets.developer.apple.com/ml- research/papers/learning-with-privacy-at-scale.pdf

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.