Pith. sign in

REVIEW 3 major objections 5 minor 38 references

Differentially Private Synthetic Data Release for Topics API Outputs

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper releases a differentially private synthetic version of Topics API outputs whose re-identification risk under two attacks matches real data within one standard deviation.

desk verdict Useful, credible DP synthetic data release for Topics API traces; the re-id risk match holds up, but stationarity and DP reporting are the soft spots. read the letter →

arxiv 2506.23855 v1 pith:3F4QKJY2 submitted 2025-06-30 cs.CR cs.AIcs.LG

Travis Dick , Alessandro Epasto , Adel Javanmard , Josh Karlin , Andres Munoz Medina , Vahab Mirrokni , Sergei Vassilvitskii , Peilin Zhong This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords differentiallyprivatesyntheticdataTopicsAPIre-identificationriskPrivacySandboxGaussianmechanismtracegenerationstationarityassumptionprivacy-preservingads
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish that a synthetic dataset of Topics API outputs, built from only differentially private aggregate statistics, can be realistic enough for outside researchers to study the API's privacy properties. The Topics API, a component of the Privacy Sandbox initiative, emits a weekly topic per user per site, and prior measurements of how easily such outputs re-identify users disagree by orders of magnitude depending on whether the analysis used hundreds of millions of real users or a few thousand. The proposed pipeline computes private statistics of topic popularity, topic co-occurrence, and week-to-week topic transitions from real browsing data; fits a parameterized distribution over multi-week traces to those statistics; samples synthetic traces; and verifies that the re-identification risk of two published attacks on the synthetic data matches the risk on real data within one standard deviation. If the claim holds, researchers without access to proprietary browsing logs can run realistic re-identification analyses and audit privacy claims about the API.

What carries the argument

The machinery is a two-stage design: private statistics first, then a trainable generative model. From two weeks of real data the authors compute three families of statistics, $q^*_{\mathrm{single}}(o)$ (the chance a random user has topic $o$ in a random week), $q^*_{\mathrm{within}}(o_1,o_2)$ (the chance two distinct topics co-occur in a week), and $q^*_{\mathrm{across}}(o_1,o_2)$ (the chance topic $o_1$ in one week is followed by topic $o_2$ in the next), noised with the Gaussian mechanism calibrated by the $\ell^2$ sensitivity of the counts. The generative model is a uniform mixture of $T=500$ types; each type holds one slot per week per topic position ($r \times k$ slots, with $k=5$), each slot is a softmax distribution over the 469-topic taxonomy, and a sampled trace takes the set of unique topics drawn from each week's slots, padded to size $k$. By the inclusion-exclusion principle all three target statistics are differentiable functions of the slot logits, so gradient descent with the Adam optimizer can drive the model's statistics toward the private targets, and because everything downstream is post-processing of differentially private counts, the fitted model and the sampled traces inherit the privacy guarantee.

What would settle it

Collect real Topics API outputs from a period not adjacent to the training weeks, for instance several months later or after the topic taxonomy changes, and rerun the Hamming and Asymmetric Hamming attacks on traces generated from the released model. If the re-identification rate on real data moves outside one standard deviation of the synthetic rate, or if the single-week and transition statistics correlate with the released ones below the 99.8% level reported in the paper's own validation, the stationarity assumption, and with it the claim that the released traces faithfully represent the API's re-identification risk, fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that its release pipeline produces a differentially private dataset that closely matches the re-identification risk properties of the real Topics API data. On a comparison of 10 million real user traces against 10 million synthetic traces over four weeks, both the Hamming and the Asymmetric Hamming attacks re-identify users at a rate below 1%, and on both attacks the synthetic-data risk falls within one standard deviation of the mean risk on the real data. The fitted model also reproduces statistics that were not part of its training objective, such as the distribution of the total number of distinct topics a user sees over four weeks, which matches the real distribution with 89% Pearson correlation. The authors present the result as the first public large-scale dataset of Topics API outputs derived from the real browsing data of hundreds of millions of users, released under an $(\varepsilon,\delta)$-differential-privacy guarantee with $\varepsilon = \log(3)$ and $\delta = 10^{-15}$.

Load-bearing premise

The load-bearing premise is that the statistics describing which topics appear, co-occur, and transition from week to week stay essentially unchanged over time, so numbers measured on two weeks of real data can generate traces of any length that still match the real joint distribution; if topic interests drift over longer horizons, the synthetic data stops resembling reality.

Editorial extensions

If this is right

  • External researchers can now run re-identification studies of the Topics API on a public dataset comparable in scale to industry-internal ones, without access to private browsing logs.
  • The statistics, the fitted model, and the sampled traces all carry a provable differential-privacy guarantee because each is derived by post-processing of the private counts.
  • Both attacks studied stay below a 1% re-identification rate on real and synthetic data alike, with the synthetic rate inside one standard deviation of the real rate.
  • The same fixed parameter set can generate traces of any length, because the stationarity assumption lets the model impose the same statistics on every week rather than learning week-specific ones.
  • The methodology is presented as generalizable to other Privacy-Preserving Ads APIs, as long as analogous single-week and transition statistics can be defined.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the claim holds, the dataset likely supports studies beyond re-identification, such as cross-site topic overlap or ad-tech reach, but only for properties that depend on the same single-topic, pair-within-week, and pair-across-week marginals the model was fitted to; higher-order structure across more than two weeks is not guaranteed.
  • A testable extension the paper does not run is generating traces of lengths beyond four weeks and checking that re-identification risk still tracks real data, since the stationarity validation only covers four adjacent weeks.
  • The privacy budget is reported at a single setting; how much the re-identification match degrades at tighter budgets is not measured, so dataset users cannot tell from the release alone how sensitive the fit is to the noise scale.
  • A user of the released data should treat weeks 3 and 4 of the four-week traces as extrapolations, because the model is fitted to statistics from the first two weeks and their fidelity rests entirely on the stationarity assumption.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a method for releasing differentially private synthetic Topics API output traces. It computes a set of DP statistics (single-topic frequencies, within-week topic-pair frequencies, and across-week transition frequencies) from two weeks of real Chrome logs, fits a mixture-of-types generative model to those statistics via gradient-based optimization, and samples synthetic user traces from the fitted model. The central empirical claim is that re-identification risk measured on 4-week synthetic traces is within one standard deviation of the risk on real traces for two attacks from prior work (Hamming and Asymmetric Hamming). The paper also reports that an unconstrained statistic, the number of distinct topics over 4 weeks, has 89% Pearson correlation between real and synthetic data.

Significance. If the central claim holds, the paper provides a valuable community resource: a large-scale, publicly released synthetic dataset of Topics API outputs with explicit DP guarantees, enabling external researchers to replicate and audit prior re-identification studies that previously required proprietary data. Strengths include the open-source code and data release, a clean DP pipeline with stated epsilon/delta and sensitivity analysis, and two independent validation checks (the re-identification attack match and the unconstrained distinct-topics statistic) that go beyond reporting the training objective. The principal weakness is that the stationarity assumption, which the authors themselves flag as crucial, is validated only over four adjacent weeks of a single data collection window, and the independent validation is limited to two specific attacks and one unconstrained statistic.

major comments (3)
  1. [Section 4.1 / Appendix C / Section 7] The stationarity assumption is load-bearing: q*_single and q*_within are averaged over two training weeks, and q*_across is estimated from the single observed transition, then imposed on every week and every consecutive pair in generated r-week traces (Section 4.1). Section 7 states this assumption is 'crucial for the validity of our results.' The only direct evidence is Appendix C, which reports Pearson correlations >=99.8% among four adjacent weeks within one Dec 2024-Jan 2025 window. Those correlations concern the marginal/pairwise statistics, not the user-level joint distribution over traces, and the window is the same period from which the re-identification comparison is drawn. Please either add a validation on a temporally non-overlapping period (or with a longer horizon) or explicitly scope all portability claims to the measured four-week window and describe the released dataset accordingly.
  2. [Section 6.1.3 / Figure 6] The central empirical claim is stated as 'within 1 standard deviation' but the text does not report the numeric means, standard deviations, or the number of users/trials for each attack. With only visual error bars over 10 trials, the reader cannot judge whether the agreement is meaningful or dominated by sampling noise; for the real data the 10 trials resample the same four-week dataset, so the error bars do not capture temporal variation. Please report exact re-identification rates and standard deviations for both attacks, and consider a formal comparison (e.g., confidence intervals for the difference or an equivalence test) rather than a one-standard-deviation overlap heuristic.
  3. [Section 4.2] The description of the DP budget split is inconsistent: it states that 'the count vectors in f11 and f22 received 25% of this budget while the counts f22 received 50%,' which must be a typo for f12 in the second clause. The Gaussian noise scale (sigma) is not reported, so the realized noise level cannot be audited from the paper even though epsilon, delta, and sensitivity are given. Please correct the split and report the per-statistic noise scale or the exact mechanism configuration (e.g., the Plume pipeline parameters) used in the release.
minor comments (5)
  1. [Section 4.2] The heading 'Differentially privacy' should be 'Differential privacy.'
  2. [Section 5.1] The sentence 'The proof of Section 5.1 essentially uses the inclusion-exclusion principle...' should reference Appendix A and be phrased as a proposition or claim rather than as a citation to a proof.
  3. [Section 6.1.3] Clarify what the 10 independent trials for the real data represent (resampling the 10,240 attack users versus resampling the 10-million-user population) and confirm that the synthetic trials include re-training the model.
  4. [Figure 5] The 89% Pearson correlation is between the two probability-mass functions shown; please state the binning and sample sizes so the reader can interpret the correlation.
  5. [Section 4.1] The statement 'There are 469^2 = 219,961 such statistics' is correct but would be clearer with the multiplication formatted consistently as 469^2.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the re-identification match is an emergent, externally benchmarked property rather than a fitted input.

full rationale

The derivation chain is: (1) compute DP statistics q*_single, q*_within, and q*_across from two weeks of real traces; (2) fit a slot-mixture model by minimizing J(theta), which measures the mismatch between model-induced and target statistics; (3) sample synthetic traces; and (4) validate against the same statistics, an unconstrained distinct-topics statistic, and the re-identification risk under the Hamming and Asymmetric Hamming attacks from Carey et al. Re-identification risk is not a term in J(theta) and is measured on four-week traces, while the fit uses only the first two weeks; the match in Figure 6 is therefore an emergent, externally benchmarked property rather than a fitted value. The fit-quality plots in Figures 3 and 4 are convergence checks on the training objective, not predictions, and the paper does not present them as independent evidence. The only self-citations, Dick et al. for model inspiration and the authors' own data release, are not load-bearing: the model is optimized from the DP statistics and validated against open-source attacks and an unconstrained statistic. The stationarity assumption is explicitly flagged in Section 7 as 'crucial for the validity of our results' and is tested in Appendix C; it is a limitation about generalizability, not a circular reduction. No equation in the paper defines a target statistic in terms of the final claim, and no fitted parameter is renamed as a prediction. Accordingly, no circular step is exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The ledger reflects that the method's fidelity rests on the API model, the stationarity of statistics, the expressiveness of the fitted mixture, and the correctness of the DP instantiation. No exotic entities are postulated.

free parameters (4)
  • Model logits theta (T x r x k x |O|) = Optimized (4,690,000 values)
    Section 5.1: all logits are fitted by Adam to minimize J(theta), the squared error against the DP statistics. This is the central fitted quantity.
  • Number of types T = 500
    Section 5: chosen to balance expressiveness and generalization; not derived from data.
  • Optimization hyperparameters = Adam lr=1.0, batch=8192, epochs=8000
    Section 5.1: manual choices; paper states results are stable to changes.
  • Privacy budget split = 25% f11, 25% f22, 50% f12 (text has typo)
    Section 4.2: allocation of epsilon between the three count vectors; affects accuracy of the released statistics.
assumptions (5)
  • domain assumption The Topics API behaves as described in Algorithm 1: top-5 weekly profile, 5% random topic probability, no filtering, no caching.
    The trace distribution D(u) is derived entirely from this model (Section 3, footnote 2); deviations in the real API would break the synthetic traces' fidelity. The filtering omission is a deliberate pessimistic choice.
  • domain assumption The statistics q_single, q_within, and q_across are stationary over time.
    Section 4.1 imposes these statistics on every simulated week; Appendix C reports >= 99.8% Pearson correlations across four adjacent weeks, but not across a longer independent period; Section 7 states this assumption is crucial.
  • domain assumption A uniform mixture of T=500 types with independent slots can approximate the real distribution well enough for the target statistics and re-identification risk.
    Section 5 argues expressiveness as T grows, but for T=500 the sufficiency is empirical, validated only on two attacks and one unconstrained statistic.
  • ad hoc to paper The Google DP pipeline correctly instantiates the Gaussian mechanism with the stated budget and sensitivity.
    Section 4.2 gives the budget and sensitivity proofs but not the noise scale sigma or the composition details, so the DP guarantee cannot be independently re-derived from the paper.
  • standard math Differential privacy post-processing applies to the model and sampled data.
    Standard property of DP (Dwork and Roth 2014), used to claim the model and synthetic samples are DP.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Differentially Private Synthetic Data Release for Topics API Outputs." pith.science (2026). https://pith.science/paper/3F4QKJY2

@misc{pith2026250623855,
  author       = {Pith},
  title        = {Pith review of: Differentially Private Synthetic Data Release for Topics API Outputs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3F4QKJY2}},
  note         = {Machine review of arXiv:2506.23855}
}
read the original abstract

The analysis of the privacy properties of Privacy-Preserving Ads APIs is an area of research that has received strong interest from academics, industry, and regulators. Despite this interest, the empirical study of these methods is hindered by the lack of publicly available data. Reliable empirical analysis of the privacy properties of an API, in fact, requires access to a dataset consisting of realistic API outputs; however, privacy concerns prevent the general release of such data to the public. In this work, we develop a novel methodology to construct synthetic API outputs that are simultaneously realistic enough to enable accurate study and provide strong privacy protections. We focus on one Privacy-Preserving Ads APIs: the Topics API, part of Google Chrome's Privacy Sandbox. We developed a methodology to generate a differentially-private dataset that closely matches the re-identification risk properties of the real Topics API data. The use of differential privacy provides strong theoretical bounds on the leakage of private user information from this release. Our methodology is based on first computing a large number of differentially-private statistics describing how output API traces evolve over time. Then, we design a parameterized distribution over sequences of API traces and optimize its parameters so that they closely match the statistics obtained. Finally, we create the synthetic data by drawing from this distribution. Our work is complemented by an open-source release of the anonymized dataset obtained by this methodology. We hope this will enable external researchers to analyze the API in-depth and replicate prior and future work on a realistic large-scale dataset. We believe that this work will contribute to fostering transparency regarding the privacy properties of Privacy-Preserving Ads APIs.

Figures

Figures reproduced from arXiv: 2506.23855 by the authors.

Figure 1
Figure 1. Top topics distribution as represented by the top DP statistics in [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. The modeled topic trace distribution is a uniform mixture of [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Cumulative distribution of absolute and relative errors over the terms of [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Histograms of the absolute and relative errors over the terms of [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Fraction of users with a given number of distinct topics in their sets over 4 weeks. Notice the strong [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: The re-identification rates of the Hamming and Asymmetric Hamming attacks on the real and synthetic data [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Topics and pairs of topics with the largest values of [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: Pearson correlation coefficient between statistics computed in two periods of time. Pearson correlation [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 30 canonical work pages

  1. [1]

    A Quantitative Information Flow Analysis of the Topics API

    M ´ario S. Alvim et al. “A Quantitative Information Flow Analysis of the Topics API”. In: Proceedings of the 22nd Workshop on Privacy in the Electronic Society. WPES ’23. Copenhagen, Denmark: Association for Com- puting Machinery, 2023, pp. 123–127. ISBN : 9798400702358. DOI: 10.1145/3603216.3624959 . URL: https://doi.org/10.1145/3603216.3624959

    work page arXiv 2023

  2. [2]

    The Privacy-Utility Trade-off in the Topics API

    M ´ario S. Alvim et al. “The Privacy-Utility Trade-off in the Topics API”. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. CCS ’24. Salt Lake City, UT, USA: Associ- ation for Computing Machinery, 2024, pp. 1106–1120. ISBN : 9798400706363. DOI: 10.1145/3658644. 3670368. URL: https://doi.org/10.1145/3658644.3670368

    arXiv 2024

  3. [3]

    Plume: differential privacy at scale

    Kareem Amin et al. “Plume: differential privacy at scale”. In: arXiv preprint arXiv:2201.11603 (2022)

    arXiv 2022

  4. [4]

    AdAttributionKit

    Apple. “AdAttributionKit”. In: Available at https:// developer.apple.com/ documentation/ AdAttributionKit (2024)

    work page 2024

  5. [5]

    Machine Learning Techniques for Fingerprint Identification: A Short Review

    Ali Ismail Awad. “Machine Learning Techniques for Fingerprint Identification: A Short Review”. In: Advanced Machine Learning Technologies and Applications - First International Conference, AMLTA 2012, Cairo, Egypt, December 8-10, 2012. Proceedings. Ed. by Aboul Ella Hassanien et al. V ol. 322. Communications in Computer and Information Science. Springer, ...

    work page 2012

  6. [6]

    Differentially private query release through adaptive projection

    Sergul Aydore et al. “Differentially private query release through adaptive projection”. In: International Con- ference on Machine Learning. PMLR. 2021, pp. 457–467

    work page 2021

  7. [7]

    Improving the gaussian mechanism for differential privacy: Analytical cali- bration and optimal denoising

    Borja Balle and Yu-Xiang Wang. “Improving the gaussian mechanism for differential privacy: Analytical cali- bration and optimal denoising”. In: International Conference on Machine Learning. PMLR. 2018

    work page 2018

  8. [8]

    A Public and Reproducible Assessment of the Topics API on Real Data

    Yohan Beugin and Patrick McDaniel. A Public and Reproducible Assessment of the Topics API on Real Data

    work page

Show all 38 references
  1. [9]

    Measuring re-identification risk

    CJ Carey et al. “Measuring re-identification risk”. In: Proceedings of the ACM on Management of Data 1.2 (2023), pp. 1–26

    2023

  2. [10]

    Confidence-ranked reconstruction of census microdata from published statistics

    Travis Dick et al. “Confidence-ranked reconstruction of census microdata from published statistics”. In: Pro- ceedings of the National Academy of Sciences 120.8 (2023), e2218605120

    2023

  3. [11]

    Data release of the DP synthetic Topics API outputs

    Travis Dick et al. Data release of the DP synthetic Topics API outputs. Available athttps://www.kaggle. com/datasets/googleai/topics-api-private-data-release/ . 2025

    2025

  4. [12]

    The algorithmic foundations of differential privacy

    Cynthia Dwork and Aaron Roth. “The algorithmic foundations of differential privacy”. In: Foundations and Trends® in Theoretical Computer Science9.3–4 (2014), pp. 211–407

    2014

  5. [13]

    Calibrating noise to sensitivity in private data analysis

    Cynthia Dwork et al. “Calibrating noise to sensitivity in private data analysis”. In: Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 . Springer. 2006, pp. 265–284

    2006

  6. [14]

    How Unique is Your Web Browser?

    Peter Eckersley. “How Unique is Your Web Browser?” In: Proceedings of the 10th International Conference on Privacy Enhancing Technologies. Berlin, Germany: Springer-Verlag, 2010, pp. 1–18. ISBN : 3642145264

    2010

  7. [15]

    Online tracking: A 1-million-site measurement and analysis

    Steven Englehardt and Arvind Narayanan. “Online tracking: A 1-million-site measurement and analysis”. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 2016, pp. 1388– 1401

    2016

  8. [16]

    Clustering for Private Interest-based Advertising

    Alessandro Epasto et al. “Clustering for Private Interest-based Advertising”. In: KDD ’21: The 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, Singapore, August 14-18, 2021. Ed. by Feida Zhu, Beng Chin Ooi, and Chunyan Miao. ACM, 2021, pp. 280...

    2021

  9. [17]

    Measures of Cross-Site Re-Identification Risk: an Analysis of the Topics API Pro- posal

    Alessandro Epasto et al. Measures of Cross-Site Re-Identification Risk: an Analysis of the Topics API Pro- posal. https://github.com/patcg- individual- drafts/topics/blob/main/topics_ analysis.pdf. 2022

    2022

  10. [18]

    On the Differential Privacy and Interactivity of Privacy Sandbox Reports

    Badih Ghazi et al. “On the Differential Privacy and Interactivity of Privacy Sandbox Reports”. In: arXiv preprint arXiv:2412.16916 (2024)

    2024 arXiv

  11. [19]

    Hiding in the Crowd: an Analysis of the Effec- tiveness of Browser Fingerprinting at Large Scale

    Alejandro G ´omez-Boix, Pierre Laperdrix, and Benoit Baudry. “Hiding in the Crowd: an Analysis of the Effec- tiveness of Browser Fingerprinting at Large Scale”. In: Proceedings of the 2018 World Wide Web Conference on World Wide Web, WWW 2018, Lyon, France, April 23-27, 2018. ...

    2018

  12. [20]

    The Privacy Sandbox

    Google. “The Privacy Sandbox”. In: Available at https:// privacysandbox.com/ intl/ en_us/ (Accessed January 25, 2025) (2025)

    2025

  13. [21]

    The Topics API

    Google. “The Topics API”. In: Available at https://github.com/patcg-individual-drafts/ topics (Accessed January 25, 2025) (2025)

    2025

  14. [22]

    Re-Identification Attacks against the Topics API

    Nikhil Jha et al. “Re-Identification Attacks against the Topics API”. In: ACM Trans. Web 18.3 (Aug. 2024). ISSN : 1559-1131. DOI: 10.1145/3675400. URL: https://doi.org/10.1145/3675400

    2024 doi

  15. [23]

    Unearthing Privacy-Enhancing Ad Technologies (PEAT): The Adoption of Google’s Privacy Sandbox

    Garrett Johnson. “Unearthing Privacy-Enhancing Ad Technologies (PEAT): The Adoption of Google’s Privacy Sandbox”. In: Available at SSRN (2024)

    2024

  16. [24]

    Adam: A Method for Stochastic Optimization

    Diederik P Kingma and Jimmy Ba. “Adam: A Method for Stochastic Optimization”. In: 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings. 2015

    2015

  17. [25]

    Browser Fingerprinting: A Survey

    Pierre Laperdrix et al. “Browser Fingerprinting: A Survey”. In: ACM Transactions on the Web14.2 (2020)

    2020

  18. [26]

    Differentially private synthetic data via foundation model apis 1: Images

    Zinan Lin et al. “Differentially private synthetic data via foundation model apis 1: Images”. In: arXiv preprint arXiv:2305.15560 (2023)

    2023 arXiv

  19. [27]

    Third-Party Web Tracking: Policy and Technology

    Jonathan R. Mayer and John C. Mitchell. “Third-Party Web Tracking: Policy and Technology”. In: 2012 IEEE Symposium on Security and Privacy. 2012, pp. 413–427. DOI: 10.1109/SP.2012.47

    2012 doi

  20. [28]

    New Privacy Preserving Ads API

    Microsoft. “New Privacy Preserving Ads API”. In: Available at https : / / blogs . windows . com / msedgedev/2024/03/05/new-privacy-preserving-ads-api/ (2024)

    2024

  21. [29]

    Cookiegraph: Understanding and detecting first-party tracking cookies

    Shaoor Munir et al. “Cookiegraph: Understanding and detecting first-party tracking cookies”. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 2023, pp. 3490–3504

    2023

  22. [30]

    How to DP-fy ML: A practical guide to machine learning with differential privacy

    Natalia Ponomareva et al. “How to DP-fy ML: A practical guide to machine learning with differential privacy”. In: Journal of Artificial Intelligence Research 77 (2023), pp. 1113–1201

    2023

  23. [31]

    Technical Comments on FLoC Privacy

    Eric Rescorla and Martin Thomson. Technical Comments on FLoC Privacy. Available athttps://mozilla. github.io/ppa-docs/floc_report.pdf (2021/06/10). 2021

    2021

  24. [32]

    Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data? 2025

    Marika Swanberg et al. Is API Access to LLMs Useful for Generating Private Synthetic Tabular Data? 2025. arXiv: 2502.06555 [cs.LG]. URL: https://arxiv.org/abs/2502.06555

    2025 arXiv

  25. [33]

    Privacy-preserving in-context learning with differentially private few-shot generation

    Xinyu Tang et al. “Privacy-preserving in-context learning with differentially private few-shot generation”. In: arXiv preprint arXiv:2309.11765 (2023)

    2023 arXiv

  26. [34]

    A First View of Topics API Usage in the Wild

    Alberto Verna et al. “A First View of Topics API Usage in the Wild”. In: Proceedings of the 20th International Conference on Emerging Networking EXperiments and Technologies . CoNEXT ’24. Los Angeles, CA, USA: Association for Computing Machinery, 2024, pp. 48–54. ISBN : 979840...

    2024

  27. [36]

    For every week i ∈ [r] and topic o ∈ O, we have Pr(o ∈ Si) = qsingle(θ; i, o)

  28. [37]

    For every week i ∈ [r] and distinct topics o1, o2 ∈ O, we have Pr({o1, o2} ⊂Si) = qwithin(θ; i, o1, o2)

  29. [38]

    For distinct weeks i1, i2 ∈ [r] and any topics o1, o2 ∈ O, we have Pr(o1 ∈ Si1 ∧ o2 ∈ Si2 ) = qacross(θ; i1, i2, o1, o2). Proof. Let θ ∈ RT ×r×k×|O| be the model parameters and let I, S1, . . . , Sr be the type index and sequence of topic sets sampled by Algorithm 2 using para...

  30. [2024]

    URL: https://arxiv.org/abs/2403.19577

    arXiv: 2403.19577 [cs.CR]. URL: https://arxiv.org/abs/2403.19577

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.