Pith. sign in

REVIEW 3 major objections 4 minor 41 references

Privatize the second stage only: calibrating noise to weight stability gives differentially private two-stage ERM with far less noise than composition baselines.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 23:45 UTC pith:2KG3L35S

load-bearing objection Useful framing and likely the right idea, but this version does not support its central claims: the proofs are missing and the experiments tune parameters the privacy analysis treats as fixed. the 3 major comments →

arxiv 2602.12604 v2 pith:2KG3L35S submitted 2026-02-13 math.ST stat.MLstat.TH

Differentially Private Two-Stage Empirical Risk Minimization with Applications to Individualized Treatment Rule

Joowon Lee , Guanhua Chen This is my paper
classification math.ST stat.MLstat.TH MSC 68P2762F1062J02
keywords differential privacytwo-stage empirical risk minimizationobjective perturbationcovariate balancing weightsindividualized treatment rulesentropy balancinginverse probability weightingweight stability
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tackles the problem of releasing a two-stage estimator—where data-dependent weights are first computed to balance covariates and a parameter is then fit by weighted empirical risk minimization—under differential privacy. The authors argue that the standard fix of privatizing both stages and composing their privacy losses is needlessly wasteful: the first-stage weights are nuisance quantities that are never released, and worst-case uniform privacy across all possible weights forces noise that destroys utility. They propose DP-2ERM, which leaves the first stage non-private and privatizes only the final weighted ERM by injecting calibrated objective perturbation. The key theoretical work is bounding how much a single-record change perturbs the balancing weights (deterministic stability bounds for IPW, MMD, and entropy-balancing weights) and then translating that weight perturbation into a probabilistic sensitivity bound for the final estimator. The resulting noise calibration is provably sharper than stage-wise composition, and simulations and a Twins benchmark show substantially better privacy–utility trade-offs, with entropy-balancing weights performing best.

Core claim

The central claim is that end-to-end differential privacy for a two-stage weighted ERM can be guaranteed by perturbing only the second-stage objective, provided the added noise and regularization are calibrated to the data-dependent sensitivity of the entire pipeline—specifically to the quantities W1 := ‖w − w′‖1 + max_i(w_i ∧ w′_i) and W2, which measure how much the first-stage weight vector changes when one data point is altered. The paper proves a data-sensitivity bound (Theorem 3.1) showing that the Radon–Nikodym derivative between the private estimator's distributions under neighboring datasets is controlled by these weight-perturbation terms, and then derives deterministic bounds on th

What carries the argument

The central object is the weight-perturbation norm W(D, D′) = (W1, W2), which quantifies how a single-record change propagates through the first-stage balancing-weight optimization into the second-stage weighted ERM objective. The argument rests on three levers: (a) a general stability theorem (Theorem 4.1) that bounds ‖w(D) − w(D′)‖ for any weights obtained from a strongly convex optimization, with explicit instantiations for IPW, MMD weights, and entropy balancing weights; (b) a perturbation bound for the determinant of weighted sums of positive semidefinite matrices (Lemma 5.1), which controls the Jacobian ratio in the objective-perturbation analysis; and (c) a constrained-minimizer stabi

Load-bearing premise

The privacy guarantee rests on the weight optimization being strongly convex with a uniformly positive curvature (e.g., λ_min(Σ̂) bounded away from zero) and on the regularization parameters being fixed in advance; if the data covariance is nearly singular or the regularization is tuned using the data, the calibrated noise may no longer meet the promised privacy level.

What would settle it

Construct a dataset with n=400 in which the empirical covariance matrix of the covariates (or of the extended moment matrix for EBW) has a very small minimum eigenvalue, and run DP-2ERM with the paper's calibrated noise; if an attacker can reliably distinguish the output from two neighboring datasets at the claimed (ε,δ) level, the stability-based calibration fails. Concretely, one could empirically estimate the privacy loss by the standard 'auditing' approach—comparing the distribution of outputs under many random neighboring pairs—for a case where λ_min(Σ̂) is near zero and the regularizatio

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the paper is right, practitioners can get end-to-end differential privacy for ITR learning without ever privatizing the covariate-balancing weights, avoiding the bias that noisy weights would introduce.
  • The privacy–utility trade-off becomes tied to the stability of the weighting scheme: entropy-balancing weights, with their O(1/√n) perturbation bound, allow far less noise than inverse propensity weights at the same privacy budget.
  • The framework extends beyond causal inference to any two-stage pipeline with data-dependent weights, such as covariate-shift correction and importance-weighted domain adaptation, provided the first-stage weights are stable enough.
  • The composition-based baseline, which the paper's analysis also supplies, is shown to be overly conservative for this class of problems, suggesting that many existing private pipelines for such tasks are leaving substantial utility on the table.
  • The utility guarantee (Theorem 3.5) indicates that the private estimator's objective gap shrinks as O(1/√n), so for moderately large samples the added privacy noise need not compromise the quality of the learned treatment rule.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to use the stability bounds to choose the first-stage regularization strength (e.g., λ_EBW or λ_MMD) deliberately to minimize the privacy noise required for a target ε, treating stability as a tunable resource rather than a fixed property of the weighting method.
  • The framework suggests a broader principle: in sequential pipelines, the privacy budget should be allocated to the final release only, while intermediate nuisance computations are shielded by the stability of the whole map from data to output—a view that could reformulate how differential privacy is composed in multistage statistical workflows.
  • The paper's stability bounds assume the weight optimization is strongly convex with fixed regularization; in practice, when hyperparameters are selected by data-dependent validation (as in the simulations), the true sensitivity of the pipeline is not exactly what the theory calibrates for, so the DP guarantee may be optimistic unless the tuning procedure itself is private or the bounds are made ro
  • The O(1/√n) EBW bound suggests that entropy balancing is not just a good empirical choice but a structurally privacy-friendly weighting scheme; this could motivate re-examining other balance-inducing weights (e.g., energy balancing or stable balancing weights) through the same stability lens.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The manuscript proposes DP-2ERM, a two-stage empirical-risk-minimization framework for differentially private estimation in pipelines where a first stage computes sample weights for covariate balancing and a second stage solves a weighted ERM. The proposal is to keep the first stage non-private and to prove an end-to-end privacy guarantee for the final estimator by objective perturbation, with noise and regularization calibrated to deterministic bounds on the sensitivity of the first-stage weights. The paper states general sensitivity bounds (Theorem 3.1), DP calibrations (Theorem 3.2), utility bounds (Theorem 3.5), and stability bounds for IPW, MMD, and entropy-balancing weights (Section 4), and it reports simulations and a Twins application comparing the method with a strong-composition baseline. The proofs of Theorems 3.1, 3.2, 3.5 and the Section 4 stability bounds are deferred to Appendices A and B, which are omitted in the submitted arXiv version.

Significance. The core idea—avoiding stage-wise composition by bounding how single-record changes amplify through the weight map—is well-motivated and, if rigorously established, would give a substantially sharper privacy–utility tradeoff than composition for ITR learning. The explicit stability bounds for common covariate-balancing weight families are a useful potential contribution. However, at present the central claims are unverifiable because the full proofs are missing, and two gaps in the stated assumptions (rank-deficiency in the stability denominators, and data-dependent hyperparameter tuning in the experiments) mean that the algorithm as stated and as run is not covered by the theory.

major comments (3)
  1. [§3.4, Appendices A–B] All proofs of the main results are omitted. Theorems 3.1, 3.2, and 3.5, as well as the stability results in Section 4 (Propositions 4.4–4.9 and Theorem 4.9), are stated with proofs deferred to Appendices A and B, and both appendices are explicitly labeled as omitted. Theorem 3.2's noise calibration depends on the exact W1 and W2 constants, which in turn depend on Lemma 5.1 and the unproved stability bounds. Without these proofs, none of the paper's central privacy or utility claims can be independently verified. This is a load-bearing gap, not a presentation issue.
  2. [§4.2.1, Prop. 4.6; §4.2.3, Thm 4.9] The stability bounds have denominators λ_IPW + λ_min(Σ̂) and r_q e^{-2R} λ_min(Σ̂) + λ_EBW. No lower bound on λ_min(Σ̂) is stated in the hypotheses. If λ_IPW = 0 or λ_EBW = 0 (both are allowed, and EBW is motivated in the λ_EBW = 0 case) and the empirical covariance is rank-deficient, the claimed bound is infinite. Consequently the O(·) rates in Theorem 4.2 and the finite W1, W2 in Corollary 4.3 are not established. Please add an explicit uniform lower bound λ_min(Σ̂) ≥ c > 0 over neighboring datasets, or a regularizer that guarantees such a lower bound, and verify that the condition holds in the experiments.
  3. [§7, with §3.4 and §4] The simulations tune the first-stage regularization parameters (λ_IPW, λ_MMD, λ_EBW) by a bootstrap-based data-dependent selection, while Theorems 3.2 and 4.2 treat these parameters as fixed. Data-dependent hyperparameter selection is part of the mechanism, and the DP guarantee supplied by the theorems does not cover the algorithm actually executed. The Section 9 remark that tuning choices are internal and not released is insufficient: DP is a property of the full output distribution, and internal data-dependence must be accounted for. Please either extend the privacy analysis to incorporate the tuning rule, or fix the hyperparameters in advance (e.g., on public or separately held-out data) and state that the selection is not part of the private mechanism.
minor comments (4)
  1. [§7, §8] Several cross-references are unresolved, e.g., 'Appendix??' in Sections 7 and 8. These need to be completed.
  2. [Throughout] The symbol λ is used both for the Hessian trace bound in Theorem 3.1 and for the regularization coefficients in Section 4. This is confusing; consider using distinct symbols (e.g., λ_H for the Hessian bound).
  3. [Throughout] There are small typos and nomenclature issues: 'Chaudhari' should be 'Chaudhuri'; 'SUTV A' should be 'SUTVA'; in Section 6 the set Θ is defined via ∥θ∥_1 ≤ λ_1 but the text later uses λ_1 also as a regularization symbol. Please proofread.
  4. [Theorems 4.2 and Corollary 4.3] The O(·) notation suppresses constants that enter the privacy calibration directly. Since W1 and W2 feed into the noise scale, please state the constants or at least the full dependence on M, R, r_q, α, and λ_min(Σ̂).

Circularity Check

0 steps flagged

No circularity; DP-2ERM’s privacy calibration is derived from stated sensitivity and stability assumptions, with self-citations only as auxiliary implementation/construction references.

full rationale

The paper’s derivation chain is not circular. Algorithm 1’s privacy guarantee is built on Theorem 3.1, which bounds the Radon–Nikodym derivative between neighboring outputs in terms of weight shifts W1 and W2; Theorem 3.2 then calibrates noise and regularization from worst-case W1, W2; Section 4 supplies deterministic bounds on ‖w(D)−w(D′)‖ for IPW, MMD, and EBW; Corollary 4.3 combines these pieces. Each step is stated as a derived bound from explicit assumptions (strong convexity, bounded gradients/Hessians, bounded covariates), not as a restatement of the desired conclusion. The only self-citations are auxiliary: “Following Lee et al. [26], we solve (6.1) using projected gradient descent (PGD)” (Section 6.2) and “Following [8], we can rewrite (4.15) as the following constrained quadratic minimization problem” (Section 4.2.2). These do not supply the privacy theorem or the stability bounds, and no fitted parameter is renamed as a prediction. The genuine weaknesses are not circularity: Appendices A and B state “Omitted for the initial arXiv submission,” leaving the proofs of Theorems 3.1 and 4.9 unverifiable; and Section 7 says “we tune regularization parameters via a bootstrap-based validation procedure,” while the theory treats those parameters as fixed, so the DP calibration may not cover the exact hyperparameter-selection mechanism. These are correctness/completeness concerns, not circular reductions.

Axiom & Free-Parameter Ledger

6 free parameters · 6 axioms · 0 invented entities

The central claim rests on strong-convexity and boundedness assumptions for the loss and the weight optimizations, plus uniform lower bounds on empirical covariance and fixed hyperparameters. The data-dependent tuning of hyperparameters in experiments is not part of the theoretical assumptions.

free parameters (6)
  • MMD regularization λ_MMD = tuned via bootstrap in simulations; theoretical bound depends on it
    Controls the stability bound O(n/λ_MMD); chosen data-dependently in experiments (§4.2.2, §7).
  • EBW regularization λ_EBW = tuned via bootstrap
    Appears in denominator of Theorem 4.9; selected by bootstrap validation (§7).
  • IPW logistic regularization λ_IPW = tuned via bootstrap
    Denominator in Proposition 4.6; selected in simulations (§7).
  • Sup-norm bound R for MMD/EBW = chosen by analyst
    Used to enforce bounded weights/dual variables; appears in Proposition 4.7 and Theorem 4.9 (§4.2.2, §4.2.3).
  • MMD mixing parameter α = chosen (not specified)
    Combines MMD terms in (4.15); affects stability bound.
  • EBW moment functions g_0,...,g_K = analyst-chosen
    Define the balancing constraints; K and g affect λ_min(Σ̂) in Theorem 4.9.
axioms (6)
  • domain assumption Loss ℓ(θ;d) is convex with continuous Hessian and bounded gradient/Hessian-trace (ζ, λ).
    Needed for Theorem 3.1/3.2; assumed in Algorithm 1 input.
  • domain assumption Weight optimization E(λ;D) is ρ-strongly convex and F is L_F-Lipschitz.
    Theorem 4.1 requires these to bound weight perturbations.
  • domain assumption Empirical covariance λ_min(Σ̂) is bounded away from zero.
    Denominator in Proposition 4.6 and Theorem 4.9; without this the stability bounds blow up.
  • domain assumption Data are bounded: ∥x_i∥≤M, |y_i|≤M'.
    Used to compute ζ, λ in Corollary 6.1 and to make weight bounds finite.
  • domain assumption The map F in Lemma 5.2 is a continuously differentiable diffeomorphism with bounded determinant ratio.
    Change-of-variables argument for DP; requires smoothness of the noise-to-solution map.
  • domain assumption Overlap/positivity holds so balancing weights exist.
    Stated in Section 4.2.3; ensures feasibility of entropy balancing.

pith-pipeline@v1.3.0-alltime-deepseek · 23405 in / 16652 out tokens · 130987 ms · 2026-08-02T23:45:25.743329+00:00 · methodology

0 comments
read the original abstract

Differential privacy provides a formal framework for releasing statistical estimators that limit how much any single observation can influence the output, by injecting calibrated random noise. We study differentially private estimation in two-stage procedures common in causal inference and individualized treatment rule (ITR) learning, in which data-dependent weights are first estimated to enforce covariate balance and a parameter of interest is then obtained by weighted empirical risk minimization. We propose Differentially Private Two-Stage Empirical Risk Minimization (DP-2ERM), which privatizes the final estimator directly through objective perturbation calibrated to the data-dependent sensitivity of the full pipeline. The analysis combines deterministic weight-perturbation bounds for several covariate-balancing methods (inverse propensity weighting, entropy balancing weighting, and maximum mean discrepancy weighting) with probabilistic sensitivity bounds for the second-stage solution. The resulting calibration is sharper than the natural stage-wise composition baseline, which the same sensitivity analysis supplies as a byproduct. Simulation studies and a benchmark application to ITR learning demonstrate the improved privacy--utility trade-off.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 2 canonical work pages

  1. [1]

    B., MIRONOV, I., TALWAR, K

    ABADI, M., CHU, A., GOODFELLOW, I., MCMAHAN, H. B., MIRONOV, I., TALWAR, K. and ZHANG, L. (2016). Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security308–318

    2016

  2. [2]

    ALMOND, D., CHAY, K. Y. and LEE, D. S. (2005). The costs of low birth weight.The Quarterly Journal of Economics1201031–1083

    2005

  3. [3]

    and STEINKE, T

    BUN, M. and STEINKE, T. (2016). Concentrated differential privacy: Simplifications, extensions, and lower bounds. InTheory of cryptography conference635–658. Springer

    2016

  4. [4]

    and VARSHNEY, K

    CALMON, F., WEI, D., VINZAMURI, B., RAMAMURTHY, N. and VARSHNEY, K. R. (2017). Optimized pre-processing for discrimination prevention. InAdvances in Neural Information Processing Systems 30

    2017

  5. [5]

    and SARWATE, A

    CHAUDHURI, K., MONTELEONI, C. and SARWATE, A. D. (2011). Differentially private empirical risk minimization.Journal of Machine Learning Research12

    2011

  6. [6]

    and YU, M

    CHEN, R., CHEN, G. and YU, M. (2023). Entropy balancing for causal generalization with target sample summary information.Biometrics793179–3190

    2023

  7. [7]

    D., CHEN, G

    CHEN, R., HULING, J. D., CHEN, G. and YU, M. (2023). Robust Sample Weighting to Facilitate Individ- ualized Treatment Rule Learning for a Target Population.Biometrika. , doi: 10.1093/biomet/asad038. DIFFERENTIALLY PRIV ATE TWO-STAGE EMPIRICAL RISK MINIMIZATION25

    work page doi:10.1093/biomet/asad038 2023

  8. [8]

    D., CHEN, G

    CHEN, R., HULING, J. D., CHEN, G. and YU, M. (2024). Robust sample weighting to facilitate individu- alized treatment rule learning for a target population.Biometrika111309–329

    2024

  9. [9]

    and YU, M

    CHEN, S., TIAN, L., CAI, T. and YU, M. (2017). A general statistical framework for subgroup identification and comparative treatment scoring.Biometrics731199–1209

    2017

  10. [10]

    and VANDERSCHAAR, M

    CRABBÉ, J., CURTH, A., BICA, I. and VANDERSCHAAR, M. (2022). Benchmarking heterogeneous treat- ment effect models through the lens of interpretability.Advances in Neural Information Processing Systems3512295–12309

    2022

  11. [11]

    and SU, W

    DONG, J., ROTH, A. and SU, W. J. (2022). Gaussian differential privacy.Journal of the Royal Statistical Society: Series B (Statistical Methodology)843–37

    2022

  12. [12]

    S., WANG, T., HUANG, C

    DU, M., YUE, X., CHOW, S. S., WANG, T., HUANG, C. and SUN, H. (2023). Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security2665–2679

    2023

  13. [13]

    and LEI, J

    DWORK, C. and LEI, J. (2009). Differential privacy and robust statistics. InProceedings of the forty-first annual ACM symposium on Theory of computing371–380

    2009

  14. [14]

    and SMITH, A

    DWORK, C., MCSHERRY, F., NISSIM, K. and SMITH, A. (2006). Calibrating noise to sensitivity in private data analysis. InTheory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3265–284. Springer

    2006

  15. [15]

    DWORK, C., ROTH, A. et al. (2014). The algorithmic foundations of differential privacy.Foundations and Trends® in Theoretical Computer Science9211–407

    2014

  16. [16]

    DWORK, C., ROTHBLUM, G. N. and VADHAN, S. (2010). Boosting and differential privacy. In2010 IEEE 51st annual symposium on foundations of computer science51–60. IEEE

    2010

  17. [17]

    R., BRINKMAN, T

    GIDDENS, S., ZHOU, Y., KRULL, K. R., BRINKMAN, T. M., SONG, P. X. and LIU, F. (2023). A Dif- ferentially Private Weighted Empirical Risk Minimization Procedure and its Application to Outcome Weighted Learning.arXiv preprint arXiv:2307.13127

    Pith/arXiv arXiv 2023

  18. [18]

    M., RASCH, M

    GRETTON, A., BORGWARDT, K. M., RASCH, M. J., SCHÖLKOPF, B. and SMOLA, A. (2012). A Kernel Two-Sample Test.Journal of Machine Learning Research13723-773

    2012

  19. [19]

    and SCHÖLKOPF, B

    GRETTON, A., SMOLA, A., HUANG, J., SCHMITTFULL, M., BORGWARDT, K. and SCHÖLKOPF, B. (2009). Covariate shift by kernel mean matching. InDataset shift in machine learning131–160. MIT Press

    2009

  20. [20]

    HAINMUELLER, J. (2012). Entropy balancing for causal effects: A multivariate reweighting method to produce balanced samples in observational studies.Political analysis2025–46

    2012

  21. [21]

    HULING, J. D. and MAK, S. (2020). Energy balancing of covariate distributions.arXiv preprint arXiv:2004.13962

    Pith/arXiv arXiv 2020

  22. [22]

    and VISWANATH, P

    KAIROUZ, P., OH, S. and VISWANATH, P. (2015). The composition theorem for differential privacy. In International conference on machine learning1376–1385. PMLR

    2015

  23. [23]

    KALLUS, N. (2020). Generalized optimal matching methods for causal inference.The Journal of Machine Learning Research212300–2353

    2020

  24. [24]

    and CALDERS, T

    KAMIRAN, F. and CALDERS, T. (2012). Data preprocessing techniques for classification without discrimi- nation.Knowledge and Information Systems331–33

    2012

  25. [25]

    and THAKURTA, A

    KIFER, D., SMITH, A. and THAKURTA, A. (2012). Private convex empirical risk minimization and high- dimensional regression. InConference on Learning Theory25–1. JMLR Workshop and Conference Proceedings

    2012

  26. [26]

    LEE, J., HULING, J. D. and CHEN, G. (2024). An effective framework for estimating individualized treat- ment rules. InAdvances in Neural Information Processing Systems(A. GLOBERSON, L. MACKEY, D. BELGRAVE, A. FAN, U. PAQUET, J. TOMCZAKand C. ZHANG, eds.)378411–8476. Curran Associates, Inc

    2024

  27. [27]

    and TAO, D

    LIU, T. and TAO, D. (2015). Classification with noisy labels by importance reweighting.IEEE Transactions on Pattern Analysis and Machine Intelligence38447–461

    2015

  28. [28]

    M., D HULING, J

    MARONGE, J. M., D HULING, J. and CHEN, G. (2023). A reluctant additive model framework for inter- pretable nonlinear individualized treatment rules.The annals of applied statistics173384

    2023

  29. [29]

    B., ANDREW, G., ERLINGSSON, U., CHIEN, S., MIRONOV, I., PAPERNOT, N

    MCMAHAN, H. B., ANDREW, G., ERLINGSSON, U., CHIEN, S., MIRONOV, I., PAPERNOT, N. and KAIROUZ, P. (2018). A general approach to adding differential privacy to iterative training proce- dures.arXiv preprint arXiv:1812.06210

    Pith/arXiv arXiv 2018

  30. [30]

    MIRONOV, I. (2017). Rényi differential privacy. In2017 IEEE 30th computer security foundations sympo- sium (CSF)263–275. IEEE

    2017

  31. [31]

    and KANNAN, A

    NIU, F., NORI, H., QUISTORFF, B., CARUANA, R., NGWE, D. and KANNAN, A. (2022). Differentially private estimation of heterogeneous causal effects. InConference on Causal Learning and Reasoning 618–633. PMLR

    2022

  32. [32]

    and LIU, Y

    QI, Z. and LIU, Y. (2018). D-learning to estimate optimal individual treatment rules. 26

    2018

  33. [33]

    and MURPHY, S

    QIAN, M. and MURPHY, S. A. (2011). Performance guarantees for individualized treatment rules.Annals of statistics391180

    2011

  34. [34]

    ROSENBAUM, P. R. and RUBIN, D. B. (1983). The central role of the propensity score in observational studies for causal effects.Biometrika7041–55

    1983

  35. [35]

    RUBIN, D. B. (1980). Randomization analysis of experimental data: The Fisher randomization test com- ment.Journal of the American statistical association75591–593

    1980

  36. [36]

    S., FU, H

    SHAH, K. S., FU, H. and KOSOROK, M. R. (2022). Stabilized direct learning for efficient estimation of individualized treatment rules.Biometrics. doi: 10.1111/biom.13818

    work page doi:10.1111/biom.13818 2022

  37. [37]

    SHIMODAIRA, H. (2000). Improving predictive inference under covariate shift by weighting the log- likelihood function.Journal of Statistical Planning and Inference90227–244

    2000

  38. [38]

    A., GENTLES, A

    TIAN, L., ALIZADEH, A. A., GENTLES, A. J. and TIBSHIRANI, R. (2014). A simple method for estimating interactions between a treatment and a large number of covariates.Journal of the American Statistical Association1091517–1532

    2014

  39. [39]

    and ZHANG, W

    VADHAN, S. and ZHANG, W. (2023). Concurrent composition theorems for differential privacy. InPro- ceedings of the 55th Annual ACM Symposium on Theory of Computing507–519

    2023

  40. [40]

    and ZUBIZARRETA, J

    WANG, Y. and ZUBIZARRETA, J. R. (2020). Minimal dispersion approximately balancing weights: asymp- totic properties and practical considerations.Biometrika10793–105

    2020

  41. [41]

    ZUBIZARRETA, J. R. (2015). Stable weights that balance covariates for estimation with incomplete outcome data.Journal of the American Statistical Association110910–922. DIFFERENTIALLY PRIV ATE TWO-STAGE EMPIRICAL RISK MINIMIZATION1 APPENDIX A: PROOFS OF KEY LEMMAS AND MAIN RESULTS Omitted for the initial arXiv submission. APPENDIX B: PROOF OF STABILITY OF...

    2015