Setting the Privacy Budget in Differential Privacy by Bounding Adversaries' Odds of Learning Sensitive Information

Jerome P. Reiter; Ruwimal Y. Pathiraja

REVIEW 2 major objections 4 minor 11 references

Setting the Privacy Budget in Differential Privacy by Bounding Adversaries' Odds of Learning Sensitive Information

T0 review · 2 major / 4 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An agency can set the differential-privacy budget ε by declaring how much any adversary’s posterior odds of learning a sensitive fact may grow, then taking the smallest ε that meets that bound for every possible prior odds.

desk verdict Clean, usable P2P odds-profile recipe for pure-DP ε that is a direct analogue of Kazan & Reiter (2024); algebra holds under the stated assumptions, with the usual independence caveat. read the letter →

arxiv 2607.04004 v1 pith:PZHAVYA6 submitted 2026-07-04 stat.ME

Ruwimal Y. Pathiraja , Jerome P. Reiter This is my paper

classification stat.ME MSC 62A0168P27

keywords differentialprivacybudgetposterior-to-posteriorriskoddsprofilecase-controlstudydisclosure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Choosing the privacy budget ε in differential privacy is hard because the number itself is hard to interpret and because smaller ε also hurts accuracy. This paper gives agencies a concrete way to choose it. First the agency writes down an “odds risk profile”: for every possible prior odds ratio an adversary might hold, it states the largest multiplicative increase in posterior odds of learning a sensitive attribute that it is willing to tolerate. Under a standard rational-adversary model the paper then proves that any ε-DP release multiplies those odds by at most exp(2ε). Consequently the agency simply takes ε equal to half the log of the smallest allowed multiplier in its profile. The resulting ε is guaranteed to keep every adversary’s posterior-to-posterior odds ratio inside the declared tolerance. The method is illustrated on a case-control study of Crohn’s disease, where a simple piecewise profile yields ε ≈ 0.35.

What carries the argument

The posterior-to-posterior odds ratio R10 = R1,i / R0,i. It equals the product of the DP likelihood ratio (bounded by exp(±2ε)) and the adversary’s prior odds ratio P10; the risk profile B(P10) then converts the inequality R10 ≤ B(P10)·P10 into an explicit upper bound on ε.

What would settle it

Construct a small finite population with known population totals or dependent records, run a pure ε-DP mechanism, and check whether an adversary whose beliefs violate independence can still force the realized R10 above B(P10)·P10 for the ε chosen by the formula; if so the guarantee collapses.

Watch

Extended reading notes

Core claim

Under the paper’s adversary model any pure ε-DP release multiplies an adversary’s prior odds ratio P10 by a factor lying between exp(-2ε) and exp(2ε). Therefore an agency that requires the posterior odds ratio R10 never to exceed B(P10)·P10 for a chosen function B can safely release data with ε_min = min over P10 of (1/2) log B(P10). That single number simultaneously satisfies the entire odds-risk profile.

Load-bearing premise

The adversary’s beliefs about everyone else in the sample are assumed independent of whether the target person is present and of that person’s value; if this fails the link between R10 and the DP likelihood ratio no longer holds.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This is a short, clean methods note that gives agencies a concrete way to turn an odds-risk profile into a pure-DP budget. The new piece is the construction itself: define B(P10) as the maximum tolerable multiplicative increase in the posterior odds ratio R10, then take ε_min = min (1/2) log B(P10). That is the direct P2P counterpart of the posterior-to-prior profiles in Kazan & Reiter (2024), and it is useful for people who prefer the Jarmin et al. framing.

The algebra is solid under the three modeling assumptions they state. From pure DP plus the rational-adversary conditions they get the exp(±2ε) envelope on the likelihood ratio, multiply by the prior odds P10, and invert. Equation (16) follows immediately. The case-control illustration is transparent: with their example B they land at ε ≈ 0.35, which is the kind of number a steward can actually discuss. Citations are appropriate; they correctly locate themselves relative to Kifer et al. and Lee & Clifton.

The soft spot is assumption (7)—adversary beliefs about the rest of the sample do not depend on the target’s presence or value. That factorization is load-bearing for equating R10 to the mechanism ratio times P10. It is mild in large independent samples and is already flagged by the authors, but it is violated (weakly) by the fixed-size case-control design they use as the running example. The global bound in the appendix still holds without (7), so the paper is not empty if the assumption fails; the profile-to-ε conversion just loses its guarantee. The hand-chosen B is also free, but that is intentional: it is an agency preference, not a fitted parameter.

This is for statistical disclosure control people and applied DP practitioners who already release statistics and want an interpretable knob. It does not open new theory, but it is honest, short, and usable. I would send it to peer review; a referee can ask them to stress the scope of (7) more prominently and to give a couple of default profiles. Worth engaging if you work on ε selection or risk communication.

Referee Report

2 major / 4 minor

Summary. The paper develops a method for choosing the pure-DP privacy budget ε by having an agency specify an odds risk profile B(P10) that upper-bounds the multiplicative inflation of an adversary’s posterior odds ratio R10 of learning that a target’s sensitive value lies in a disclosure set S, relative to the adversary’s prior odds ratio P10. Under an independence assumption on the rest of the sample (eq. 7) together with rational-adversary conditions (8)–(9), the authors show that any ε-DP release satisfies exp(-2ε)P10 ≤ R10 ≤ exp(2ε)P10; consequently the agency may safely release with ε_min = min_P10 (1/2)log B(P10). The approach is illustrated on a case-control design for Crohn’s disease, yielding a concrete recommendation near ε ≈ 0.35 for an example profile.

Significance. If the modeling assumptions hold, the framework supplies a transparent, practitioner-facing translation of ε into posterior-to-posterior odds ratios—the disclosure-risk measure advocated by Jarmin et al. (2023). It cleanly extends the posterior-to-prior risk-profile idea of Kazan & Reiter (2024) and the P2P analysis of Kifer et al. (2022) by introducing an explicit, agency-chosen function B that can be communicated to study participants. The derivation itself is parameter-free once B is fixed, and the case-control numbers give an immediately usable illustration. These features make the paper a useful contribution to the still-open problem of setting ε in applied DP releases.

major comments (2)

[Section 3, eqs. (7)–(16) and Section 4] Section 3, displayed equation (7) and the subsequent derivation of (12): the independence assumption P_M[Y_{-i}|I_i=1,Y_i=y]=P_M[Y_{-i}|I_i=0] is load-bearing for equating R10 to the mechanism likelihood ratio times P10 and therefore for the conversion ε_P10=(1/2)log B(P10) in (16). When the assumption fails (fixed-size sampling, known population totals, or dependent records) the mixture weights differ across the events Y_i∈S versus Y_i∉S, so the ratio of posteriors need not remain inside the exp(±2ε) envelope. The paper’s own case-control illustration (Section 4) uses a fixed total sample size 2n+1=1095 with a randomly chosen final case/control; this design induces precisely the weak dependence that violates (7). The authors should either (i) supply a quantitative sensitivity analysis showing that the violation is negligible for n≈500, (ii) replace the illustration with a design that sa
[Section 4] Section 4, paragraph beginning “According to the sampling design…”: the authors set q_i=0.5 by design and q_i^{(0)}=π≈0.00125, producing P10≈800, then invoke the profile B of (13) to obtain ε_800≈0.805. Because the same fixed-size design already violates the independence assumption used to justify the exp(±2ε) envelope, it is unclear whether the numerical recommendation ε_min≈0.347 actually enforces R10≤B(P10)P10 for the adversaries under consideration. A short Monte-Carlo check of the realized R10 under the true sampling distribution would resolve the issue.

minor comments (4)

[Section 3] Figure 1 caption and surrounding text: the piecewise definition of B(P10) in (13) is clear, but the figure itself is never described in the body; a one-sentence pointer (“the solid line in Figure 1”) would help readers locate the example profile.
[Section 3] Page 8, after (16): the claim that the formulas “apply for any ε-DP algorithm and any function of D_obs” is true for the upper bound, yet the multivariate remark that follows (“use the selected ε_min as the total privacy budget”) deserves a short citation to the composition theorem so that non-specialists understand why the same ε can be spent across several statistics.
[Appendix A] Appendix A: the global bound exp(±2ε) on the single P2P risk R_i is derived without (7); a cross-reference from the main text noting that this bound remains available when independence fails would strengthen the practical guidance.
[References] References: the arXiv identifier for Kifer et al. (2022) is given, but the published venue (if any) is omitted; likewise the full page range for Kazan & Reiter (2024) would aid readers.

Circularity Check

1 steps flagged · score 1.0 of 10

Minor self-citation of a paraphrased lemma from overlapping authors; the R10-to-ε conversion is otherwise an independent application of the pure-DP definition under explicit modeling assumptions.

self citation load bearing [Section 3, paragraph containing Eq. (14)–(16)]
"We now show how ε is computed in terms of the parameters above. To do so, we make use of Lemma 1 in Kazan and Reiter (2024), which we paraphrase here for completeness. Under the assumptions in (7)–(9), if the release of T∗=t∗ satisfies ε-DP, then … exp(-2ε)≤ au … ≤ exp(2ε). … ε_P10=(1/2)log(B(P10))."

The conversion of an arbitrary odds-risk profile B into a concrete privacy budget ε_min rests entirely on the exp(±2ε) envelope supplied by the cited lemma. The lemma is taken from prior work whose author list overlaps the present paper and is only paraphrased, not re-proved, in the main text. (Appendix A later supplies a related but weaker global bound, so the dependence is partial rather than total.)

full rationale

The paper's central claim (any ε-DP mechanism satisfies exp(-2ε)P10 ≤ R10 ≤ exp(2ε)P10, hence ε_min = min (1/2)log B(P10)) follows from the definition of pure DP plus three stated adversary-model assumptions ((7)–(9)). The only potential circularity is the load-bearing appeal to Lemma 1 of Kazan & Reiter (2024) (same senior author). That lemma is merely paraphrased rather than re-derived in the main text; however, an essentially identical global bound is independently proved in Appendix A from the DP definition alone, the assumptions are restated explicitly, and the lemma itself does not embed the risk-profile construction or the target ε formula. No parameters are fitted to data and then re-labeled as predictions, no uniqueness theorem is imported to forbid alternatives, and the agency-chosen function B is not derived from the same quantities it is used to bound. Consequently the derivation is self-contained once the external DP definition and the three modeling assumptions are granted; the self-citation raises the score only to 1.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The central claim rests on the standard pure-DP definition, three modeling assumptions about the adversary (independence of the rest of the sample, and that the adversary knows the true DP mechanism), and an agency-chosen function B that is not derived from data. No new physical or statistical entities are postulated; the ‘odds risk profile’ is a decision-theoretic construct, not an empirical object.

free parameters (2)

odds risk profile B(P10)
Entire function chosen by the agency; the illustrative piecewise-linear profile (Eq. 13) with caps 10, 2 and 5 is hand-selected and directly determines ε_min.
population prevalence π ≈ 0.00125
Used only in the case-control illustration to set one particular P10 ≈ 800; not needed for the general method but affects the numerical example.

assumptions (4)

domain assumption Pure ε-differential privacy (Definition in §2, Eq. 1 / Eq. 2)
The entire bound chain starts from the standard pure-DP inequality; the paper does not re-derive DP.
ad hoc to paper Adversary’s beliefs about Y_{-i} are independent of I_i and of Y_i (Assumption 7)
Explicitly introduced in §3; the authors note it may fail for small samples or known population totals.
domain assumption Rational adversary knows the true DP mechanism (Assumptions 8–9)
Standard in Bayesian analyses of DP; stated explicitly so that likelihood ratios equal the mechanism probabilities.
domain assumption Unbounded neighboring relation (add/remove one record)
Chosen over bounded DP; changes the interpretation of participation risk.

invented entities (1)

odds risk profile B(P10)
purpose: Encodes the agency’s maximum tolerable multiplicative increase in the posterior odds ratio for every possible prior odds ratio, thereby selecting ε.
A decision-theoretic construct introduced by the paper (analogous to the risk profiles of Kazan & Reiter 2024 but defined on P2P odds). No independent empirical existence; it is a policy choice.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Setting the Privacy Budget in Differential Privacy by Bounding Adversaries' Odds of Learning Sensitive Information." pith.science (2026). https://pith.science/paper/PZHAVYA6

@misc{pith2026260704004,
  author       = {Pith},
  title        = {Pith review of: Setting the Privacy Budget in Differential Privacy by Bounding Adversaries' Odds of Learning Sensitive Information},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PZHAVYA6}},
  note         = {Machine review of arXiv:2607.04004}
}

abstract

Differential privacy is a mathematical definition of what it means to protect data subjects' privacy in data releases. Differential privacy depends on a parameter $\epsilon$ known as the privacy budget. The value of $\varepsilon$ determines the nature of the privacy guarantee, with smaller values generally offering more privacy. However, reducing $\varepsilon$ also tends to decrease the accuracy of results protected with differentially private algorithms. Setting a value for $\varepsilon$ that satisfactorily balances this risk/accuracy trade off is complicated in practice, and there is not a standard approach to doing so. In part this is because practitioners may struggle to understand the privacy guarantee afforded by $\varepsilon$. We present an approach to interpreting and setting $\varepsilon$ in which (i) the practitioner establishes bounds on the posterior odds that adversaries can learn sensitive information, and (ii) the practitioner converts these bounds to values of $\varepsilon$. We illustrate the approach using data from a case control study.

Figures

Figures reproduced from arXiv: 2607.04004 by the authors.

**Figure 1.** Example of an agency’s risk tolerance profile for increases in the odds ratio. (𝑃10) from the risk profile. The agency uses the smallest value of 𝜀 among these solutions to release 𝑇 ∗ (𝐷𝑜𝑏𝑠). When using odds risk profiles specific to individuals, the agency uses the smallest value of 𝜀 across the profiles. We now show how 𝜀 is computed in terms of the parameters above. To do so, we make use of Lemma 1 in Kazan and… view at source ↗

**Figure 2.** Implied values of 𝜀 for different adversary’s prior odds ratios using the illustrative risk profile. The agency would use the smallest value of 𝜀 for the data release, which occurs when the prior odds 𝑃10 = 1 for this profile. These determinations of 𝜀 are based on two specific assumptions about 𝑃10. The agency may want to use a privacy budget that satisfies the risk profile for any adversary’s 𝑃10 [PITH_FULL_IMAGE… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

11 extracted references · 1 linked inside Pith

[1]

, title =

Kazan, Zeki and Reiter, Jerome P. , title =. Advances in Neural Information Processing Systems , volume =
[2]

Joseph and Bollinger, Christopher R

Hotz, V. Joseph and Bollinger, Christopher R. and Komarova, Tatiana and Manski, Charles F. and Moffitt, Robert A. and Nekipelov, Denis and Sojourner, Aaron and Spencer, Bruce D. , title =. Proc. Natl. Acad. Sci. U.S.A. , volume =. 2022 , doi =

2022
[3]

Jarmin, R. S. and Abowd, J. M. and Ashmead, R. and Cumings-Menon, R. and Goldschlag, N. and Hawes, M. B. and Keller, S. A. and Kifer, D. and Leclerc, P. and Reiter, J. P. and Rodríguez, R. A. and Schmutte, I. and Velkoff, V. A. and Zhuravlev, P. , title =. Proc. Natl. Acad. Sci. U.S.A. , volume =. 2023 , doi =

2023
[4]

and Ashmead, Robert and Cumings-Menon, Ryan and Leclerc, Philip and Machanavajjhala, Ashwin and Sexton, William and Zhuravlev, Pavel , title =

Kifer, Daniel and Abowd, John M. and Ashmead, Robert and Cumings-Menon, Ryan and Leclerc, Philip and Machanavajjhala, Ashwin and Sexton, William and Zhuravlev, Pavel , title =. 2022 , archivePrefix =. 2209.03310 , primaryClass =

arXiv 2022
[5]

Theory of Cryptography , editor =

Dwork, Cynthia and McSherry, Frank and Nissim, Kobbi and Smith, Adam , title =. Theory of Cryptography , editor =. 2006 , doi =

2006
[6]

Dwork, Cynthia and Roth, Aaron , title =. Found. Trends Theor. Comput. Sci. , volume =. 2014 , doi =

2014
[7]

and Taylor, Kent D

Duerr, Richard H. and Taylor, Kent D. and Brant, Steven R. and Rioux, John D. and Silverberg, Mark S. and Daly, Mark J. and Steinhart, A. Hillary and Abraham, Clara and Regueiro, Miguel and Griffiths, Anne and Dassopoulos, Themistocles and Bitton, Alain and Yang, Hui and Targan, Stephan R. and Datta, Lisa W. and Kistner, Emily O. and Schumm, L. Philip and...

2006
[8]

Automata, Languages and Programming , series =

Dwork, Cynthia , title =. Automata, Languages and Programming , series =. 2006 , doi =

2006

Show all 11 references

[9]

and Steinke, Thomas and Vadhan, Salil , title =

Wood, Alexandra and Altman, Micah and Bembenek, Aaron and Bun, Mark and Gaboardi, Marco and Honaker, James and Nissim, Kobbi and O'Brien, David R. and Steinke, Thomas and Vadhan, Salil , title =. Vand. J. Ent. & Tech. L. , volume =
[10]

de Waal, Ton and Hundepool, Anco and Willenborg, Leon and Gouweleeuw, Jeroen and Franconi, Luisa and Polettini, Silvia , title =
[11]

Information Security , series =

Lee, Jaewoo and Clifton, Chris , title =. Information Security , series =

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.

[1] [1]

, title =

Kazan, Zeki and Reiter, Jerome P. , title =. Advances in Neural Information Processing Systems , volume =

[2] [2]

Joseph and Bollinger, Christopher R

Hotz, V. Joseph and Bollinger, Christopher R. and Komarova, Tatiana and Manski, Charles F. and Moffitt, Robert A. and Nekipelov, Denis and Sojourner, Aaron and Spencer, Bruce D. , title =. Proc. Natl. Acad. Sci. U.S.A. , volume =. 2022 , doi =

2022

[3] [3]

Jarmin, R. S. and Abowd, J. M. and Ashmead, R. and Cumings-Menon, R. and Goldschlag, N. and Hawes, M. B. and Keller, S. A. and Kifer, D. and Leclerc, P. and Reiter, J. P. and Rodríguez, R. A. and Schmutte, I. and Velkoff, V. A. and Zhuravlev, P. , title =. Proc. Natl. Acad. Sci. U.S.A. , volume =. 2023 , doi =

2023

[4] [4]

and Ashmead, Robert and Cumings-Menon, Ryan and Leclerc, Philip and Machanavajjhala, Ashwin and Sexton, William and Zhuravlev, Pavel , title =

Kifer, Daniel and Abowd, John M. and Ashmead, Robert and Cumings-Menon, Ryan and Leclerc, Philip and Machanavajjhala, Ashwin and Sexton, William and Zhuravlev, Pavel , title =. 2022 , archivePrefix =. 2209.03310 , primaryClass =

arXiv 2022

[5] [5]

Theory of Cryptography , editor =

Dwork, Cynthia and McSherry, Frank and Nissim, Kobbi and Smith, Adam , title =. Theory of Cryptography , editor =. 2006 , doi =

2006

[6] [6]

Dwork, Cynthia and Roth, Aaron , title =. Found. Trends Theor. Comput. Sci. , volume =. 2014 , doi =

2014

[7] [7]

and Taylor, Kent D

Duerr, Richard H. and Taylor, Kent D. and Brant, Steven R. and Rioux, John D. and Silverberg, Mark S. and Daly, Mark J. and Steinhart, A. Hillary and Abraham, Clara and Regueiro, Miguel and Griffiths, Anne and Dassopoulos, Themistocles and Bitton, Alain and Yang, Hui and Targan, Stephan R. and Datta, Lisa W. and Kistner, Emily O. and Schumm, L. Philip and...

2006

[8] [8]

Automata, Languages and Programming , series =

Dwork, Cynthia , title =. Automata, Languages and Programming , series =. 2006 , doi =

2006