Pith. sign in

REVIEW 2 major objections 5 minor 1 cited by

A Unified Framework for Adversary-Aware Differential Privacy Bounds

T0 review · 2 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One theorem now bounds membership, attribute, and reconstruction attacks under differential privacy.

desk verdict Pure-DP Theorem 3.2 is a real, useful generalization; the paper's single-run worst-case approximate/f-DP bounds (Theorems B.3/C.4) have a confirmed stochastic-dominance gap that the empirical sections depend on. read the letter →

arxiv 2507.08158 v2 pith:5S3VZ6EI submitted 2025-07-10 cs.CR

Marika Swanberg , Meenatchi Sundaram Muthu Selva Annamalai , Jamie Hayes , Borja Balle , Adam Smith This is my paper · ORCID
classification cs.CR MSC 68P27
keywords differentialprivacyleakageboundsmembershipinferenceattributedatareconstructionnon-uniformpriorsf-Differentialadversary-aware
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that membership inference, attribute inference, exact reconstruction, and approximate reconstruction against differential privacy are all governed by one high-probability tail bound. For any $(\varepsilon,0)$-DP mechanism, the number of targets an adversary successfully attacks, conditioned on any mechanism output, is stochastically dominated by a sum of independent Bernoulli variables whose per-target bias is $\beta_i = \mathrm{e}^{\varepsilon}/(\mathrm{e}^{\varepsilon} - 1 + 1/p_i)$, where $p_i$ is the adversary's prior success probability for that target. The bound depends only on the privacy parameters and this prior, so it lets a practitioner translate a DP guarantee into a concrete reconstruction risk for a specific deployment. The paper extends the same reasoning to approximate DP and f-DP at an additive $n\cdot\delta$ or $n\cdot\delta_f(\varepsilon)$ cost, and demonstrates the bounds on password and PII extraction from DP-finetuned language models and on tabular reconstruction from noisy marginals.

What carries the argument

The load-bearing object is the per-target posterior bound $\beta_i(z,\varepsilon) = \mathrm{e}^{\varepsilon}/(\mathrm{e}^{\varepsilon} - 1 + 1/p_i)$, where $p_i = \Pr_{X\sim D_i}[\ell_i(X,z)=1]$ is the adversary's chance of a correct guess on target $i$ using the prior alone. Applying Bayes' rule and the DP likelihood-ratio bound at each coordinate shows the true posterior success probability cannot exceed this value; the decomposability of the metric, $L(x,z)=\sum_i \ell_i(x_i,z)$, then lets the proof replace the whole attack with a sum of independent Bernoulli random variables and compare tails by stochastic dominance. An induction over targets, following the one-run auditing argument of the closest prior bound, carries the comparison from a single coordinate to the full dataset.

What would settle it

Run the attack game of Algorithm 1 on an $(\varepsilon,0)$-DP mechanism with a correlated prior, say $n=2$ records sharing a latent value, and compare the measured tail $\Pr[L(X,A(a))\geq v\mid M(X)=a]$ against the Bernoulli-sum tail from Theorem 3.2 using the same per-coordinate prior probabilities; a correlated prior for which the measured tail exceeds the bound on a nontrivial set of outputs would show that the product-distribution premise is the active assumption. A simpler check would compute the exact per-coordinate posterior for such a prior and test whether it can exceed $\beta_i(z,\varepsilon)$.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is Theorem 3.2: for a pure $\varepsilon$-DP mechanism $M$, targets drawn from a product distribution $D=D_1\otimes\cdots\otimes D_n$, a decomposable success metric $L$, and any adversary $A$, for every mechanism output $a$ the conditional tail $\Pr[L(X,A(a))\geq v\mid M(X)=a]$ is at most the tail of a sum of independent Bernoulli variables with biases $\beta_i(z,\varepsilon)$. The quantity $\beta_i$ is a per-target posterior bound obtained from Bayes' rule and the DP likelihood ratio; because the metric is a sum of per-target indicators, summing the per-target posterior bounds dominates the total attack success. Approximate DP adds an $n\cdot\delta$ term inside the tail, and f-DP uses $\delta_f(\varepsilon)$, with the caveat that the biases become random and must be estimated over mechanism runs. This unifies earlier single-target, uniform-prior, exact-match bounds and extends them to multiple simultaneously attacked targets, non-uniform priors, and approximate success criteria.

Load-bearing premise

The load-bearing premise is that the attacked records are independent draws from a product distribution; if real data contain correlations across records, such as multiple rows for one person or sequential text, the per-coordinate induction breaks and the bound no longer follows from the DP guarantee.

Editorial extensions

If this is right

  • For any deployment of a pure-DP mechanism, one can upper-bound the chance that an adversary recovers more than $v$ of $n$ targeted records using only $\varepsilon$ and the adversary's per-target prior.
  • Privacy parameters can be calibrated to concrete risks: the paper's experiments put the $\varepsilon$ that keeps generalized advantage below 0.05 at about 17.8 for a uniform 9-digit canary, 0.25 for a common password, and 2.37 for PII, so non-uniform priors change the required protection dramatically.
  • The one-run auditing view now extends to reconstruction with non-uniform priors and multiple targets, not just membership inference on uniform canaries.
  • For randomized response on near-uniform priors, the bound is tight, so at least one concrete mechanism is proved to hit the bound exactly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if real datasets violate the product prior, the immediate practical check is correlation in the privacy unit; correlated records are the first place the bound could fail silently, and the paper flags this as a structural requirement.
  • Beyond the paper: the dependence on $p_i$ suggests a per-user calibration rule the authors do not state: users whose data are easy to guess need smaller $\varepsilon$, while high-entropy records tolerate looser privacy parameters, turning the bound into a risk-based budget allocator.
  • Beyond the paper: comparing the Bernoulli-tail bound to empirical attack success isolates bound slack from attack suboptimality; where an idealized Gaussian attack meets the bound but a black-box model attack does not, the gap is an attack-design problem, not a privacy guarantee failure.
  • Beyond the paper: the f-DP version's dependence on $\delta_f(\varepsilon)$ invites mechanism-specific refinements, such as a bespoke Gaussian-mechanism bound, which the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes a unified framework for upper-bounding the success of privacy attacks against differentially private (DP) mechanisms, covering membership inference, attribute inference, and reconstruction, with multiple simultaneous targets, non-uniform priors, and approximate success metrics. The centerpiece is Theorem 3.2, an output-conditioned bound for pure DP mechanisms showing that the posterior distribution of a decomposable attack score is stochastically dominated by a sum of independent Bernoulli variables with probabilities β_i(z,ε) = e^ε/(e^ε−1+1/p_i), where p_i is the prior success probability of the attack attempt z. The authors then extend this to approximate DP and f-DP (Theorems B.1–B.3 and C.3–C.4), including a 'single-run' worst-case-prior version (Theorems B.3 and C.4), and use these bounds to interpret experiments on DP-finetuned GPT-2 extraction (uniform canaries, passwords, PII) and on tabular data reconstruction from noisy marginals.

Significance. If the bounds were valid, the framework would be a useful unification: it strictly generalizes the MI- and reconstruction-focused bounds of Steinke et al., Hayes et al., Cummings et al., and related work, and it is the first to treat multiple simultaneous targets with general non-uniform priors and approximate reconstruction metrics in a single bound. The pure-DP proof is clean, the randomized-response tightness result (Proposition A.2) is explicit, and the empirical sections honestly report that concrete attacks fall short of the bounds. However, the single-run approximate/f-DP theorems on which the empirical evaluation rests are not correct as stated; the contribution therefore currently reduces to the output-conditioned pure-DP bound and its extensions with output-dependent parameters, and the advertised practical risk estimates are not established.

major comments (2)
  1. [Appendix B, Theorem B.3] The stochastic-dominance step in the proof is invalid. The proof asserts that, for z* maximizing the total prior success, S* = Σ Bernoulli(β_i(z*,ε)) stochastically dominates S(a) = Σ Bernoulli(β_i(A(a),ε)) for every mechanism output a. Maximizing the sum of the prior success probabilities p_i(z) does not imply domination of the tail probabilities of the sum of the transformed Bernoulli variables. Concretely, take n=3, a constant mechanism (0,0)-DP, the approximate metric ℓ_i(x,z)=1{|x−z|≤1}, and the product prior with D1: 0.85 at 0.5, 0.05 at −1, 0.10 at 1.5; D2: 0.3 at 0.5, 0.6 at −1, 0.1 at 1.5; D3: 0.1 at −1, 0.5 at 1.5, 0.4 at 100. For guess z=0 the prior success vector is (0.9,0.9,0.1), total 1.9; for z=1 it is (0.95,0.4,0.5), total 1.85, so z*=0 is the a priori Bayes optimal single guess. Let the adversary always output z=1. With ε=0 and δ=0, the theorem predicts Pr[Σ Bernoulli(0.95,0.4,0.5) ≥ 3] = 0.19 ≤ Pr[Σ Bernoulli(0.9,0.9,0.1) ≥ 3] = 0.081, which is false. The theorem as stated is therefore not a valid bound for arbitrary adversaries.
  2. [Appendix C, Theorem C.4; Sections 4.3 and E] Theorem C.4 inherits the same flaw from Theorem B.3, since its proof is stated to follow immediately from the (ε,δ)-DP analog. Theorem C.4 is exactly the bound used to compute the single-run posterior and advantage numbers in Figures 2, 3, and Appendix E (Figure 4–7). Because the underlying stochastic-dominance claim fails, the reported upper bounds and the derived quantities such as ε_protect are not mathematically justified by the theorems as stated. The output-dependent bounds (Theorem 3.3 and Theorem B.2) do not rely on the invalid domination step, but they require multiple mechanism runs and are not the basis for the empirical comparisons.
minor comments (5)
  1. [Theorem 3.2 statement] The phrase 'for all mechanism outputs a⊆Supp(M)' should read 'a∈Supp(M)', since a is a single output, not a subset.
  2. [Theorem 3.3 statement] The definition of β_i(A(a), ε) is repeated verbatim in the displayed equation; one occurrence appears to be a typographical duplication.
  3. [Appendix B, proof of Theorem B.1] The proof introduces a variable k without defining its role, and switches between the symbols F and G for the same random variable; this makes a compressed proof harder to follow.
  4. [Section 3.2] The sentence claiming the bound is tight for 'distributions that are sufficiently close to uniform' is too vague and should refer explicitly to Proposition A.2 and its precise condition on D(a)e^ε ≥ D(b).
  5. [Figure 3] The legend contains the string 'A/t_tack Success', which appears to be a formatting error for 'Attack Success'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the bounds are derived from the DP guarantee and explicit prior probabilities, with no fitted parameter renamed as a prediction.

full rationale

The central derivation is self-contained. Theorem 3.2 proves, via Bayes' rule and the pure-DP likelihood ratio, that the output-conditioned success count is stochastically dominated by a sum of independent Bernoullis whose biases beta_i(z,eps) depend only on the declared product prior and the privacy parameter (Appendix A). The prior success probabilities p_i are inputs to the bound, not quantities fitted to observed attack outcomes; the bound would remain meaningful even if the empirical attacks succeeded at very different rates. The approximate-DP and f-DP extensions (Theorems B.1-B.3, C.3-C.4) are reductions to the same argument using standard tools from Steinke et al. and the f-DP/approx-DP equivalence; no step defines the claimed conclusion in terms of itself. The empirical prior estimates (Zipf's law, GPT-2 perplexity, BayNet) are constructed before attacks are run and are not calibrated to attack success. The use of a pretrained GPT-2 both for prior estimation and as the initialization for fine-tuning is a mild modeling overlap, but it does not make the theoretical bound equivalent to its inputs: the prior is an adversary-knowledge assumption, and the bound is evaluated independently of the attack results. The paper's self-citations (e.g., Hayes et al. for the Model Attack, Kulynych et al. for comparison) are contextual or implementational and are not load-bearing for the derivation. The skeptical counterexample to Theorem B.3/C.4, if valid, is a correctness concern about a stochastic-dominance step, not a demonstration of circularity: a false or unproved step does not make the result true by construction or equivalent to its assumptions. Overall, no circular step was identified, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The theoretical central claim rests on standard DP assumptions, the product-independence of targets, decomposable success metrics, and exact prior knowledge by the adversary. The empirical demonstrations introduce prior-estimation choices (Zipf, GPT-2 perplexity, BayNet) that are inputs to the comparison, not fitted to the attack outcomes.

free parameters (3)
  • Zipf prior for numerical passwords = Not stated; normalized over 10 secret tokens
    The bound's p_i is computed from this prior, and the empirical attack and the bound both depend on it. The Zipf exponent and the way the real password distribution is scaled down to 10 tokens are not reported.
  • GPT-2 perplexity-based PII prior = Normalized perplexity scores over candidate PIIs
    Used to set p_i for the PII extraction experiment. The choice of candidate set and pretrained model affects both the bound and the attack.
  • BayNet prior for tabular data = Bayesian network fit to ACS and FIRE raw datasets; structure not specified
    Defines the prior for the noisy-marginal reconstruction experiments and initializes the M-AI attack. Reproducing the exact prior requires unspecified fitting details.
assumptions (6)
  • domain assumption Replace-one adjacency (Section 2)
    The bounds assume exactly one record is replaced with another; other adjacency notions would change the DP ratios.
  • domain assumption Target records are independent: D = D1 x ... x Dn (Section 3.1)
    The proof's induction over coordinates requires independence; correlated records break the argument and are acknowledged as outside the framework.
  • domain assumption Success metric is decomposable: L(x,z) = sum_i ell_i(x_i,z) (Definition 3.1)
    The bound sums per-target successes; non-decomposable metrics such as holistic reconstruction quality are listed as future work.
  • domain assumption Adversary has exact knowledge of the prior D and the mechanism M (Section 3.1 and Limitations)
    The bound and the empirical comparison both assume the adversary knows the true data-generating distribution; approximate priors are left to future work.
  • standard math Lemma 4.9 and Lemma 5.6 from Steinke et al. [64]
    Invoked without restatement in the proofs of Theorem 3.2 and Theorem B.1.
  • standard math f-DP is equivalent to a family of (epsilon, delta_f(epsilon))-DP guarantees (Dong et al. [25], Proposition 2.12)
    Used in Appendix C to lift the approximate-DP bounds to f-DP mechanisms.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Unified Framework for Adversary-Aware Differential Privacy Bounds." pith.science (2026). https://pith.science/paper/5S3VZ6EI

@misc{pith2026250708158,
  author       = {Pith},
  title        = {Pith review of: A Unified Framework for Adversary-Aware Differential Privacy Bounds},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5S3VZ6EI}},
  note         = {Machine review of arXiv:2507.08158}
}
read the original abstract

Differential Privacy (DP) bounds the privacy leakage of a mechanism against worst-case membership inference, but the precise tradeoff between complex adversarial models and DP protections remains poorly understood. In this paper, we present a unified framework that generalizes the patchwork of existing bounds across membership inference, attribute inference, and data reconstruction attacks. Crucially, our framework is the first to evaluate attacks that target multiple individuals simultaneously and measure success beyond exact matches under a single cohesive bound. Our bounds capture this broad family of previously unexplored attack settings by relying solely on the privacy parameters and the adversary's baseline success rate (i.e. its prior without access to the mechanism's output). To illustrate this, we compare our high-probability guarantees to empirical attacks in two novel settings: extracting multiple non-uniform secrets (passwords and PII) from DP-finetuned language models, and reconstructing tabular data from noisy marginals. Ultimately, this framework provides a rigorous theoretical foundation to investigate the risk landscape of DP algorithms in new adversarial settings.

Figures

Figures reproduced from arXiv: 2507.08158 by the authors.

Figure 1
Figure 1. Compare our bounds with prior state-of-the-art bounds (KGK+ [ [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Bounding advantage of data extraction for different prior distributions at fixed [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Compare our bounds with success of reconstructing 100 canaries (with 95% CI) from a [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Success of reconstructing a single column at [PITH_FULL_IMAGE:figures/full_fig_p021_4.png]
Figure 5
Figure 5. Figure 5: Success of reconstructing a single column at varying privacy levels [PITH_FULL_IMAGE:figures/full_fig_p022_5.png]
Figure 6
Figure 6. Figure 6: Success of reconstructing multiple columns at [PITH_FULL_IMAGE:figures/full_fig_p022_6.png]
Figure 7
Figure 7. Figure 7: Success of approximately reconstructing a single column (up to [PITH_FULL_IMAGE:figures/full_fig_p023_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Edit-Neighboring Data Streams and Privacy under Continual Observation

    cs.DS 2026-07 accept novelty 8.0 of 10

    Under the new 'edit-neighboring' privacy definition, private continual counting is possible with only polylogarithmic error, while every additive-noise counter provably needs polynomial error.

Reference graph

Works this paper leans on

69 extracted references · 62 canonical work pages · cited by 1 Pith paper

  1. [1]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep Learning with Differential Privacy. InCCS, 2016

    work page 2016

  2. [2]

    J. M. Abowd. The U.S. Census Bureau Adopts Differential Privacy. InKDD, 2018

    work page 2018

  3. [3]

    M. S. M. S. Annamalai and E. De Cristofaro. Nearly Tight Black-Box Auditing of Differentially Private Machine Learning. InNeurIPS, 2024

    work page 2024

  4. [4]

    M. S. M. S. Annamalai, A. Gadotti, and L. Rocher. A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Data. InUSENIX Security, 2024

    work page 2024

  5. [5]

    M. S. M. S. Annamalai, B. Balle, J. Hayes, G. Kaissis, and E. De Cristofaro. The Hitchhiker’s Guide to Efficient, End-to-End, and Tight DP Auditing.arXiv:2506.16666, 2025

    arXiv 2025

  6. [6]

    Learning with privacy at scale

    Apple Differential Privacy Team. Learning with privacy at scale. https://machinelearning.apple. com/docs/learning-with-privacy-at-scale/appledifferentialprivacysystem.pdf, 2017

    work page 2017

  7. [7]

    Aydore, W

    S. Aydore, W. Brown, M. Kearns, K. Kenthapadi, L. Melis, A. Roth, and A. A. Siva. Differentially Private Query Release Through Adaptive Projection. InICML, 2021

    work page 2021

  8. [8]

    Balle, G

    B. Balle, G. Cherubin, and J. Hayes. Reconstructing Training Data with Informed Adversaries. InIEEE S&P, 2022

    work page 2022

Show all 69 references
  1. [9]

    K. Cai, X. Lei, J. Wei, and X. Xiao. Data Synthesis via Differentially Private Markov Random Fields. VLDB, 2021

    2021

  2. [10]

    Carlini, C

    N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, and D. Song. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks. InUSENIX Security, 2019

    2019

  3. [11]

    Carlini, F

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. Extracting Training Data from Large Language Models. InUSENIX Security, 2021

    2021

  4. [12]

    Cebere, A

    T. Cebere, A. Bellet, and N. Papernot. Tighter Privacy Auditing of DP-SGD in the Hidden State Threat Model. InICLR, 2025

    2025

  5. [13]

    Cherubin

    G. Cherubin. Bayes, not Naïve: Security Bounds on Website Fingerprinting Defenses.PETS, 2017

    2017

  6. [14]

    Cherubin, B

    G. Cherubin, B. Köpf, A. Paverd, S. Tople, L. Wutschitz, and S. Zanella-Béguelin. Closed-Form Bounds for DP-SGD against Record-level Inference Attacks. InUSENIX Security, 2024

    2024

  7. [15]

    A. Cohen. Attacks on Deidentification’s Defenses. InUSENIX, 2022

    2022

  8. [16]

    Cohen and K

    A. Cohen and K. Nissim. Linear Program Reconstruction in Practice.Journal of Privacy and Confidentiality, 2020

    2020

  9. [17]

    Cohen and K

    A. Cohen and K. Nissim. Towards formalizing the GDPR’s notion of singling out.PNAS, 2020

    2020

  10. [18]

    Cohen, H

    E. Cohen, H. Kaplan, Y . Mansour, S. Moran, K. Nissim, U. Stemmer, and E. Tsfadia. Data Reconstruction: When You See It and When You Don’t. InInnovations in Theoretical Computer Science Conference (ITCS), 2025. 10

    2025

  11. [19]

    Cummings, S

    R. Cummings, S. Hod, J. Sarathy, and M. Swanberg. ATTAXONOMY: Unpacking Differential Privacy Guarantees Against Practical Adversaries.arXiv:2405.01716, 2024

    2024 arXiv

  12. [20]

    Fire Department Calls for Service

    DataSF. Fire Department Calls for Service. https://data.sfgov.org/Public-Safety/ Fire-Department-Calls-for-Service/nuek-vuh3, 2020

    2020

  13. [21]

    T. Dick, C. Dwork, M. Kearns, T. Liu, A. Roth, G. Vietri, and Z. S. Wu. Confidence-ranked reconstruction of census microdata from published statistics.PNAS, 2023

    2023

  14. [22]

    Diffie and M

    W. Diffie and M. E. Hellman. New Directions in Cryptography. InDemocratizing Cryptography: The Work of Whitfield Diffie and Martin Hellman. 2022

    2022

  15. [23]

    Z. Ding, Y . Wang, G. Wang, D. Zhang, and D. Kifer. Detecting Violations of Differential Privacy. InCCS, 2018

    2018

  16. [24]

    Dinur and K

    I. Dinur and K. Nissim. Revealing information while preserving privacy. InProceedings of the twenty- second ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, pages 202–210, 2003

    2003

  17. [25]

    J. Dong, A. Roth, and W. J. Su. Gaussian Differential Privacy.arXiv:1905.02383, 2019

    1905 arXiv

  18. [26]

    Dwork, F

    C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating Noise to Sensitivity in Private Data Analysis. InTheory of Cryptography, 2006

    2006

  19. [27]

    Erlingsson, V

    Ú. Erlingsson, V . Pihur, and A. Korolova. RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response. InCCS, 2014

    2014

  20. [28]

    Gadotti, F

    A. Gadotti, F. Houssiau, L. Rocher, B. Livshits, and Y .-A. de Montjoye. When the signal is in the noise: Exploiting Diffix’s Sticky Noise. InUSENIX, 2019

    2019

  21. [29]

    Gadotti, F

    A. Gadotti, F. Houssiau, M. S. M. S. Annamalai, and Y .-A. de Montjoye. Pool Inference Attacks on Local Differential Privacy: Quantifying the Privacy Guarantees of Apple’s Count Mean Sketch in Practice. In USENIX Security, 2022

    2022

  22. [30]

    Ganju, Q

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov. Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations. InCCS, 2018

    2018

  23. [31]

    Hayes, B

    J. Hayes, B. Balle, and S. Mahloujifar. Bounding Training Data Reconstruction in DP-SGD.NeurIPS, 2023

    2023

  24. [32]

    Homer, S

    N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V . Pearson, D. A. Stephan, S. F. Nelson, and D. W. Craig. Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays.PLoS Genetics, 2008

    2008

  25. [33]

    Humphries, S

    T. Humphries, S. Oya, L. Tulloch, M. Rafuse, I. Goldberg, U. Hengartner, and F. Kerschbaum. Investigating membership inference attacks under data dependencies, 2023. URL https://arxiv.org/abs/2010. 12112

    2023

  26. [34]

    T. Hunt, C. Hunt, and S. J. Sigurðarson. Have I been pwned.https://haveibeenpwned.com/, 2025

    2025

  27. [35]

    Jagielski, J

    M. Jagielski, J. Ullman, and A. Oprea. Auditing Differentially Private Machine Learning: How Private is Private SGD?NeurIPS, 2020

    2020

  28. [36]

    Jayaraman and D

    B. Jayaraman and D. Evans. Are Attribute Inference Attacks Just Imputation? InCCS, 2022

    2022

  29. [37]

    Kairouz, S

    P. Kairouz, S. Oh, and P. Viswanath. The Composition Theorem for Differential Privacy. InICML, 2015

    2015

  30. [38]

    S. P. Kasiviswanathan, M. Rudelson, A. Smith, and J. Ullman. The price of privately releasing contingency tables and the spectra of random matrices with correlated rows. InSTOC, 2010

    2010

  31. [39]

    Keinan, M

    A. Keinan, M. Shenfeld, and K. Ligett. How Well Can Differential Privacy Be Audited in One Run? arXiv:2503.07199, 2025

    2025

  32. [40]

    Klimt and Y

    B. Klimt and Y . Yang. Introducing the Enron Corpus. InCEAS, 2004

    2004

  33. [41]

    Koller and N

    D. Koller and N. Friedman.Probabilistic Graphical Models: Principles and Techniques. MIT press, 2009

    2009

  34. [42]

    Kulynych, J

    B. Kulynych, J. F. Gomez, G. Kaissis, J. Hayes, B. Balle, F. Calmon, and J. L. Raisaro. Unifying Re- Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy. InNeurIPS, 2025. 11

    2025

  35. [43]

    X. Li, F. Tramer, P. Liang, and T. Hashimoto. Large Language Models Can Be Strong Differentially Private Learners. InICLR, 2022

    2022

  36. [44]

    K. Z. Liu, C. A. Choquette-Choo, M. Jagielski, P. Kairouz, S. Koyejo, P. Liang, and N. Papernot. Language Models May Verbatim Complete TextThey Were Not Explicitly Trained On.arXiv:2503.17514, 2025

    2025 arXiv

  37. [45]

    Lukas, A

    N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Zanella-Béguelin. Analyzing Leakage of Personally Identifiable Information in Language Models. InIEEE S&P, 2023

    2023

  38. [46]

    Mahloujifar, L

    S. Mahloujifar, L. Melis, and K. Chaudhuri. Auditing f-Differential Privacy in One Run. InICML, 2025

    2025

  39. [47]

    McKenna, G

    R. McKenna, G. Miklau, and D. Sheldon. Winning the NIST Contest: A scalable and general approach to differentially private synthetic data.JPC, 2021

    2021

  40. [48]

    McKenna, B

    R. McKenna, B. Mullins, D. Sheldon, and G. Miklau. AIM: An Adaptive and Iterative Mechanism for Differentially Private Synthetic Data.VLDB Endowment, 2022

    2022

  41. [49]

    McMahan and A

    B. McMahan and A. Thakurta. Differential Privacy. https://ai.googleblog.com/2022/02/ federated-learning-with-formal.html, 2022

    2022

  42. [50]

    I. Mironov. Rényi Differential Privacy. InCSF, 2017

    2017

  43. [51]

    Differential Privacy

    Multiple Authors. Differential Privacy. https://github.com/google/differential-privacy, 2020

    2020

  44. [52]

    M. Nasr, J. Hayes, T. Steinke, B. Balle, F. Tramèr, M. Jagielski, N. Carlini, and A. Terzis. Tight Auditing of Differentially Private Machine Learning. InUSENIX Security, 2023

    2023

  45. [53]

    M. Nasr, J. Rando, N. Carlini, J. Hayase, M. Jagielski, A. F. Cooper, D. Ippolito, C. A. Choquette-Choo, F. Tramèr, and K. Lee. Scalable Extraction of Training Data from Aligned, Production Language Models. InICLR, 2025

    2025

  46. [54]

    M. Nasr, T. Steinke, A. Ganesh, B. Balle, C. A. Choquette-Choo, M. Jagielski, J. Hayes, A. G. Thakurta, A. Smith, and A. Terzis. The Last Iterate Advantage: Empirical Auditing and Principled Heuristic Analysis of Differentially Private SGD. InICLR, 2025

    2025

  47. [55]

    Panda, X

    A. Panda, X. Tang, C. A. Choquette-Choo, M. Nasr, and P. Mittal. Privacy Auditing of Large Language Models. InICLR, 2025

    2025

  48. [56]

    Ponomareva, J

    N. Ponomareva, J. Bastings, and S. Vassilvitskii. Training text-to-text transformers with privacy guarantees. InFindings of the Association for Computational Linguistics: ACL 2022, pages 2182–2193, 2022

    2022

  49. [57]

    Ponomareva, H

    N. Ponomareva, H. Hazimeh, A. Kurakin, Z. Xu, C. Denison, H. B. McMahan, S. Vassilvitskii, S. Chien, and A. G. Thakurta. How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy. Journal of Artificial Intelligence Research, 2023

    2023

  50. [58]

    Radford, J

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever. Language Models are Unsupervised Multitask Learners. 2019

    2019

  51. [59]

    Rigaki and S

    M. Rigaki and S. Garcia. A Survey of Privacy Attacks in Machine Learning.ACM Computing Surveys, 2023

    2023

  52. [60]

    Salem, G

    A. Salem, G. Cherubin, D. Evans, B. Köpf, A. Paverd, A. Suri, S. Tople, and S. Zanella-Béguelin. SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning. In IEEE S&P, 2023

    2023

  53. [61]

    Differentially Private Release of Israel’s National Registry of Live Births

    Shlomi Hod and Ran Canetti. Differentially Private Release of Israel’s National Registry of Live Births. In IEEE S&P, 2025

    2025

  54. [62]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov. Membership Inference Attacks against Machine Learning Models. InIEEE S&P, 2017

    2017

  55. [63]

    Sinha, T

    A. Sinha, T. Mesnard, R. McKenna, D. Liu, C. A. Choquette-Choo, Y . Huang, D. Yu, G. Kaissis, Z. Charles, R. Liu, et al. VaultGemma: A Differentially Private Gemma Model.arXiv:2510.15001, 2025

    2025

  56. [64]

    Steinke, M

    T. Steinke, M. Nasr, and M. Jagielski. Privacy Auditing with One (1) Training Run.NeurIPS, 2024

    2024

  57. [65]

    Stock, I

    P. Stock, I. Shilov, I. Mironov, and A. Sablayrolles. Defending against Reconstruction Attacks with Rényi Differential Privacy.arXiv:2202.07623, 2022. 12

    2022 arXiv

  58. [66]

    American Community Survey

    US Census Bureau. American Community Survey. https://www.census.gov/programs-surveys/ acs.html, 2025

    2025

  59. [67]

    T. Wang, J. Blocki, N. Li, and S. Jha. Locally Differentially Private Protocols for Frequency Estimation. In USENIX Security, 2017

    2017

  60. [68]

    A. C. Yao. Theory and AppDcations of Trapdoor Functions. InSymposium on Foundations of Computer Science (SFCS), 1982

    1982

  61. [69]

    How many people areaged 40,unemployedandunmarried

    D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulkarni, Y . T. Lee, A. Manoel, L. Wutschitz, S. Yekhanin, and H. Zhang. Differentially Private Fine-tuning of Language Models. InICLR, 2022. A Pure DP Proofs Recall the definition of stochastic dominance. Definit...

    2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.