Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits

Anuj Sharma; Ibne Farabi Shihab; Sanjeda Akter

REVIEW 2 major objections 4 minor 14 references

Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits

T0 review · 2 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A differentially private federated protocol can certify that the accepted outputs of a retrieval-augmented generator keep their expected error below a declared target, valid at every monitored round and threshold.

desk verdict Honest, carefully built private anytime selective-risk certificate; the math is sound and the empirical limits are reported straight, but the deployment guarantee rests on per-client TV bounds that are declared rather than externally justified. read the letter →

arxiv 2608.07913 v1 pith:6IIE3ZJ7 submitted 2026-08-08 cs.CR cs.AI

Sanjeda Akter , Ibne Farabi Shihab , Anuj Sharma This is my paper · ORCID

classification cs.CRcs.AI MSC 62F2562L1068T50

keywords selectiveriskcertificationfederatedlearningdifferentialprivacyretrieval-augmentedgenerationanytime-validinferencemartingaleconfidencesequenceshallucinationdetectionmixturetransfer

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a differentially private, federated calibration protocol can certify that the expected error among accepted retrieval-augmented generation outputs stays below a declared target, and can keep that promise valid no matter when the operator stops or which threshold it picks. The certificate works by having each client release only Gaussian-noised histograms of scores and losses, then combining two types of anytime-valid martingale bounds: one that controls sampling error over the record stream and one that controls the privacy noise accumulated over rounds. A single total-variation term, costing at most one unit of probability mass, transfers the guarantee from the realized mixture of client data to the mixture the operator actually wants to deploy on. If the paper is right, selective-risk certification for RAG outputs can be made privacy-preserving and federated without sacrificing the anytime-valid, post-selection-invariant character of the guarantee. The authors' own experiments, however, show sharp limits: the registered tight targets mostly abstain, and only a looser exploratory target fires under common privacy budgets.

What carries the argument

The machinery is a pair of simultaneous confidence envelopes built from martingales indexed differently: one record-indexed process that recenters at each chosen client's law under predictable recruitment, and one variance-indexed Gaussian process that charges only releases in which a given record participates, with the total-variation transfer term $\eta_t$ carrying the declared deployment-mismatch cost. Two constructions are offered, a range-only one with Hoeffding-style record epochs and a variance-adaptive one using a Freedman bound on the contrast's predictable quadratic variation; both are stitched over dyadic epochs to stay simultaneous in time and threshold.

What would settle it

Take a real deployment whose per-client shift is measured by an independent audit, run Fed-SRC with declared $\gamma_k$ below the measured total variation, and check whether any trial both fires with $\bar{d} \le 0$ and $\underline{a} \ge a_{\min}$ while exhaustive population risk exceeds $r^\star$; the paper reports no such event, but its transfer experiments use claimed radii, not externally audited ones.

Watch

Extended reading notes

Core claim

The central claim, stated as Theorem 1, is that under predictable calibration streams and declared conditional laws, with probability at least $1-\alpha_s-\alpha_n$ the true target-risk contrast $d_{Q^\star,j}$ is no greater than the certificate's upper bound $\bar{d}^M_{j,t}$ and the true accepted mass $a_{Q^\star,j}$ is no less than its lower bound $\underline{a}^M_{j,t}$, simultaneously for every registered threshold and every monitored round. Consequently any transcript-measurable threshold and stopping time that satisfy $\bar{d}^M_{j,t} \le 0$ and $\underline{a}^M_{j,t} \ge a_{\min}$ certify that the deployment selected risk $R_{Q^\star,j} \le r^\star$ with no additional correction. The proof splits the error probability into a sampling budget and a Gaussian-noise budget, and transfers the calibration mixture to the declared deployment mixture through a range-one total-variation term that costs $\eta_t$ for both numerator and denominator rather than $(1+r^\star)\eta_t$. The empirical companion claim is that across 500-trial audits over cells, privacy levels, and policies, no simultaneous-bound violation occurred, but the registered target $r^\star=0.10$ never certified and $r^\star=0.20$ certified only on HaluEval question answering without privacy.

Load-bearing premise

The certificate's deployment guarantee depends on independently justified per-client total-variation bounds $\mathrm{TV}(P^\star_k, P_k) \le \gamma_k$, which in the experiments are declared by the authors rather than fixed by an external shift audit; if real deployment drift exceeds the declared radii, the certificate can fire while the true deployment risk exceeds the target.

Editorial extensions

If this is right

An operator following the predictable-schedule rule can adaptively recruit clients, select thresholds, and stop without invalidating the certificate, because the simultaneous event covers all such choices in advance.
Privacy is event-level: each stream occurrence pays only for releases containing it, and the pathwise accountant converts the zCDP budget to $(\varepsilon,\delta)$-DP under adaptive composition.
The mixture-transfer term makes the deployment claim explicit: a mismatch between realized participation and declared deployment weights is priced into both acceptance and risk, so a large shift automatically forces abstention.
The empirical audit shows validity is not the bottleneck; score quality and privacy budget are. Tight targets ($r^\star=0.10$) never fire, and at $\varepsilon=4$ the exploratory target fires only 1% of trials on the information-lift score.
Naive privatization without the noise envelope breaks the bounds in 146 to 198 of 200 trials, demonstrating that the Gaussian envelope is load-bearing for validity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The dependence on declared $\gamma_k$ radii suggests a practical enhancement: pair Fed-SRC with an independent shift-audit stage that measures per-client total variation on a held-out sample and feeds audited radii into the certificate; the paper's experiments stop short of this.
The 30-to-78-fold event reuse means event-level privacy is weak protection for items or people that recur; a source- or person-level deployment would require bounded contribution and a recalibrated accountant, which the current guarantee does not provide.
The near-universal abstention at registered targets suggests the certificate's operational role may be to quickly retire a score/population combination rather than to certify often; this supports the paper's score-agnostic design, since the winning score is not knowable in advance.
If the range-one transfer is as tight as claimed, the same certificate could be extended to subgroup-conditional risk by pre-registering subgroup histograms and splitting the error and privacy budgets, at additional sample and communication cost.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know about this paper is that it is a genuinely serious contribution draped in unusually honest packaging. The core construction — federated histograms with event-level zCDP, record- and noise-variance-indexed martingales, and a range-one TV transfer to a declared deployment mixture — is assembled from known parts, but the joint anytime-valid deployment contract is new, and the proofs are detailed and follow standard Hoeffding, Ville, Freedman, and zCDP composition arguments. I read through the main theorems and the appendices and found no fatal flaw. The empirical work is also refreshingly candid: the primary target never certifies, the secondary rarely does, and the paper explicitly retracts earlier overclaims. That is exactly how empirical negative results should be reported.

The main soft spot is the one the stress-test note flags, and I think it lands. Theorem 1's transfer to Q* depends on independently justified per-client total-variation bounds TV(P*_k, P_k) ≤ γ_k. In the experiments those γ_k are either zero or declared sensitivity values under a hand-constructed coupling. The paper itself admits no γ_k is justified by an external shift audit and that shifted deployment risk is not reported. So the deployment certificate has an unverified premise: if the real shift exceeds the declared γ_k, the bound can fail even though the frozen-population audit passes. This is not an internal inconsistency, but it means the headline guarantee is conditional on a quantity the paper does not supply. The HaluEval threshold grid is another honest soft spot: it is not fixed in advance, and the salvage via Proposition 14 gives only conditional validity on the frozen support. Also, the paper contains no proved private comparator; the capital heuristic is explicitly unproved, which limits the empirical comparison.

None of this sinks the paper. The central theorem is likely sound, the limitations section is more complete than most published papers' entire discussion, and the near-vacuous empirical power at registered targets is reported as a finding rather than hidden. The gap is between the theorem and its deployable form. A serious referee should push the authors to provide an external shift audit or an honest statement that deployment requires independently justified γ_k, and ideally a proved private baseline.

I would send this to peer review. It deserves referee time, and the authors are clearly capable of responding to it. I'd bring it to a reading group only if the group cares about privacy-preserving selective prediction; it is somewhat niche, but the honesty of the empirical report is worth studying in its own right.

Referee Report

2 major / 4 minor

Summary. The paper develops Fed-SRC, a score-agnostic certificate for federated, differentially private, adaptively monitored selective-risk control of retrieval-augmented generation. Clients release Gaussian-perturbed score/loss histograms, and the server uses record-indexed and variance-indexed martingales to bound, simultaneously over all registered thresholds and rounds, the target-risk contrast and the accepted mass. Theorem 1 (Appendix M) is the central claim: under a predictable-stream assumption and per-client total-variation bounds TV(P*_k, P_k) ≤ γ_k, with probability at least 1 − α_s − α_n the declared-mixture risk contrast and acceptance are bounded for every threshold and round, so transcript-measurable threshold selection and optional stopping need no further correction. A pathwise zCDP accountant (Theorem 3) composes the Gaussian releases. Empirically, the paper audits the machinery with 500 trials per core cell (no simultaneous-bound violations), reports that the registered targets r* = 0.10/0.20 mostly abstain, and reports positive HaluEval QA results at r* = 0.20 without privacy and a full-support C1 result at r* = 0.30. The paper is candid about limitations: event-level privacy only, high record reuse, an unproved capital heuristic, and, critically, that the deployment transfer radii γ_k are never externally justified.

Significance. If the results stand, the contribution is a carefully engineered and honestly evaluated combination of known statistical tools (Hoeffding, Ville, Freedman, Gaussian-martingale bounds, zCDP, total-variation transfer) into an event-level private federated anytime certificate. The strengths are real: the proofs are detailed and follow standard machinery; the artifact contract (checksummed manifest with a single regeneration entry point) is exemplary; and negative results are reported rather than hidden (registered targets abstain; held-out intervals are not certified; the capital heuristic is unproved). The paper does not claim a superior hallucination score and explicitly disclaims the earlier lift-centered claims. The main value is as a reference architecture and a cautionary empirical study of where such certificates are not operationally useful under privacy. Because the deployment guarantee is conditional on externally justified TV bounds that the paper does not supply, the transfer mechanism is validated as arithmetic but not as a deployment guarantee; this limits but does not destroy the contribution.

major comments (2)

[Abstract and Section 7.1 / Table 4] The certificate's transfer to the declared deployment mixture Q* rests on per-client total-variation bounds TV(P*_k, P_k) ≤ γ_k that are nowhere externally justified. The theorem is explicitly conditional, but the abstract and Section 1 present the transfer as a contribution without flagging that the empirical audits (Tables 7 and 10) exercise only γ_k = 0 or hand-declared radii under a coupling constructed by the authors, and the Limitations concede that 'no γ_k is justified by an external shift audit and we do not report shifted deployment risk.' If a real deployment shift exceeds the declared γ_k, the inequality d_{Q*,j} ≤ dbar^M_{j,t} can fail even though the frozen-population audit passes. The paper should (i) state the conditionality of the Q* guarantee in the abstract and Section 3.2, (ii) label the transfer experiments as sensitivity analyses in the main text as the Limitations already do, and (iii) discuss a concrete route to justifying γ_k, such as a separate drift-audit sample yielding a confidence bound on TV, or an argument for why such bounds are obtainable in the intended deployments.
[Abstract / Section 7.1 / Table 4] The abstract's statement that on HaluEval question answering the certificate certifies 'with held-out risk below the target' overstates the evidence: the paper's own Section 7.1 says held-out risk below target 'is a point-estimate claim, not a certified bound,' and Table 4's exact 95% Clopper-Pearson intervals have upper endpoints (0.241 at ε = ∞, 0.204 at ε = 8 and ε = 4) above r* = 0.20 even in the non-private row. The abstract should say 'held-out point-estimate risk below the target,' and the main text should state at the first occurrence of the claim that the selective-risk bound is not certified on the held-out set.

minor comments (4)

[Section 7.1 / Table 4 / Proposition 14] The HaluEval guarantee is conditional on the frozen calibration support, as Proposition 14 explains; the Table 4 caption and the surrounding text should explicitly say 'conditional on the frozen calibration support' whenever the support-derived quantile grid is used, so that a reader cannot mistake it for a marginal guarantee.
[Equation (19)] The displayed definition of H_c(n; α) renders as '2⌈log2 n⌉', which appears to mean 2^{⌈log2 n⌉}; this should be aligned with the proof's b_r = sqrt(U_r x_r / 2) in Lemma 10 so that the boundary formula matches the epoch argument.
[Appendices F and G] The embedded provenance notes ('withdrawn,' 'superseded as a headline,' 'disabled block above is retained only as a provenance record') are unusual for a journal submission; superseded material should be moved to clearly marked supplementary text so that the main narrative is not interrupted.
[Table 13] The annotation 'the displayed 6.00 is 10^3 d' is confusing; writing d = 0.00600 with an explicit standard-form note would be clearer.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the certificate's derivation is a conditional mathematical theorem from stated assumptions; declared gamma_k are an unverified premise, not a fitted input.

full rationale

The paper's central claim, Theorem 1, is proved from Assumption 1 and the lemmas in Appendix I (Lemmas 4-6, 9-13): the sampling bounds are time-uniform Hoeffding/Freedman martingale events, the Gaussian bounds are variance-epoch martingale envelopes, and the mixture transfer is a total-variation inequality with eta_t defined in Eq. (8). No parameter is fitted from the data to make the bound hold; the bound is valid for any process satisfying the stated conditional laws, and the empirical audit is an explicit simulation of those assumptions ('each client is a frozen finite labeled population and Pk is its uniform law... exactly matching the predictable-stream conditions of Theorem 1'). The threshold-selection rule is covered by the same simultaneous event, so it is post-processing rather than a separate hypothesis test. Self-citations (Akter et al., 2025, 2026 for information lift) are not load-bearing: the paper explicitly disclaims a superior score and the lift score fails on RAGTruth, so the certificate's validity does not rest on those results. The unverified per-client TV radii gamma_k, which the Limitations admit are 'declared ourselves' with 'no gamma_k justified by an external shift audit', are a robustness/correctness limitation of the deployment premise, not a circular step in the derivation: the theorem is conditional on independently justified gamma_k, and the conditional derivation is self-contained. The near-universal abstention and negative-control violations are honestly reported empirical findings rather than renamed inputs. The paper therefore has no circularity score above zero.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

Fed-SRC's guarantee rests on no fitted numeric parameters; the certificate width uses only declared probability budgets, the pre-registered variance scale v0 (which does not affect validity), and the published threshold grid. The main axioms are the predictable fresh-record stream of Assumption 1, the per-client TV bounds gamma_k, standard martingale inequalities, standard zCDP composition, and the conditional-support argument for data-derived thresholds in HaluEval. There are no invented physical or statistical entities.

assumptions (5)

domain assumption Assumption 1: client identities, batch sizes, noise scales, and monitored prefixes are predictable, and each record is drawn fresh from its declared client law with independent Gaussian noise.
Every theorem is conditional on this fresh, non-anticipating stream model; real federated data are fixed finite sets, so the guarantee concerns a resampling process rather than directly the stored records.
domain assumption Per-client total-variation bounds TV(P*_k, P_k) <= gamma_k are available and independently justified.
The transfer to the declared deployment mixture Q* in Lemma 6 and Theorem 1 is only as strong as these bounds; the experiments declare their own gamma_k and perform no external shift audit.
standard math Exponential martingale inequalities (Hoeffding, Ville, Freedman) and Gaussian maximal inequalities hold as stated.
Used in Lemmas 4, 5, 10, 11, 12, and 13; these are standard results, not re-derived and not machine-checked in the paper.
standard math zCDP composition and the zCDP-to-(epsilon,delta)-DP conversion (Bun and Steinke) apply to the adaptive transcript with a deterministic pathwise filter.
Theorem 3 relies on this composition; the paper provides an iterated-conditioning argument but no formal proof assistant artifact.
domain assumption For HaluEval, the quantile-threshold grid is a deterministic label-free function of the frozen calibration support, making the guarantee conditional on that support.
Proposition 14 patches the deviation from the fixed-in-advance grid requirement; the resulting guarantee is conditional, not marginal over the calibration support.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits." pith.science (2026). https://pith.science/paper/6IIE3ZJ7

@misc{pith2026260807913,
  author       = {Pith},
  title        = {Pith review of: Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6IIE3ZJ7}},
  note         = {Machine review of arXiv:2608.07913}
}

read the original abstract

Selective-risk certificates promise that accepted outputs meet a declared error target. We develop Fed-SRC, a score-agnostic certificate for federated, differentially private, adaptively monitored retrieval-augmented generation. Clients release only Gaussian-perturbed score and loss histograms. Record-indexed and noise-variance-indexed martingales jointly bound target-risk contrast and accepted mass over all registered thresholds and rounds, permitting predictable recruitment, dropout, threshold selection, and optional stopping. A range-one total-variation term transfers the calibration mixture to a declared deployment mixture. The contribution is this private, federated, anytime combination, rather than the contrast statistic or acceptance floor individually. Empirically, no simultaneous-bound violation occurs in any evaluated cell, privacy level, or policy. Operational power depends on the score and population: the primary target r*=0.10 never certifies, and on RAGTruth the secondary target r*=0.20 never certifies either, whereas on HaluEval question answering it certifies in all 200 non-private trials, with held-out risk below the target. Naively privatized non-private certificates violate their bounds in 146 to 198 of 200 trials. As an exploratory comparison, we also evaluate a private betting-capital heuristic for which we do not establish e-process validity. This heuristic stops certifying at epsilon <= 4, where Fed-SRC still certifies. Certification nevertheless consumes roughly 30 times more stream events than unique calibration items.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 9 canonical work pages

[1]

draws each requested event independently with replacement from the empirical law supported onP k

work page
[2]

lift is ineffective

The bound is attained when the added record hasℓ= 1. Theorem 3(Transcript privacy).For each message, Equation(15)isρ k,t-zCDP with ρk,t = 1 σ2 k,t .(31) For any calibration record i and admissible tran- script path τ, let Iτ (i) be the releases to which that record contributes. If a deterministic privacy filter enforces the pathwise bound ρtr = sup τ sup ...

work page 2014
[3]

executes the preregistered monitor- ing/recruitment policy and selects one threshold or always abstains

work page
[4]

Anastasios N

Learn then test: Calibrating predictive algo- rithms to achieve risk control.The Annals of Applied Statistics, 19(2). Anastasios N. Angelopoulos, Stephen Bates, Adam Fisch, Lihua Lei, and Tal Schuster. 2024. Conformal risk control. InThe Twelfth International Conference on Learning Representations. Borja Balle and Yu-Xiang Wang. 2018. Improving the Gaussi...

arXiv 2024
[5]

Pierre Humbert, Batiste Le Bars, Aurélien Bellet, and Sylvain Arlot

Anytime-valid conformal risk control.arXiv preprint arXiv:2602.04364. Pierre Humbert, Batiste Le Bars, Aurélien Bellet, and Sylvain Arlot. 2023. One-shot federated confor- mal prediction. InProceedings of the 40th Inter- national Conference on Machine Learning, pages 14153–14177. Ben Jacobsen, Tomas Gonzalez, Gavin Brown, Kassem Fawaz, and Aaditya Ramdas....

arXiv 2023
[6]

InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 19052–19075

SConU: Selective conformal uncertainty in large language models. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 19052–19075. Ian Waudby-Smith, Steven Wu, and Aaditya Ramdas

work page
[9]

eZj,t +h t +g j,t Nt # [0,1] ,(53) LA j,t =

All pri- vacy equations remain valid after replacing √ 2by 2 √ 2, equivalently multiplying each ρk,t by four for fixed σk,t. The paper uses add/remove adjacency throughout. I.2 Proof of Theorem 3 Proof. The Gaussian mechanism with query sen- sitivity ∆2 and isotropic noise variance σ2 is ∆2 2/(2σ2)-zCDP (Bun and Steinke, 2016). Lemma 2 gives∆ 2 2 ≤2, so r...

work page 2016
[11]

releases the registered noised histograms and updates only from realized messages

work page

Show all 14 references

[13]

enumerates every record in everyPk to calculate exacta Q⋆,bj,d Q⋆,bj, andR Q⋆,bj; and
[14]

Risk (cal.)

records unconditional failure, firing, stopping round, and the complete certificate tuple. Sampling without replacement is not substituted into this audit. Official held-out evaluation is sep- arate and does not define the theorem-coverage event. The privacy neighbor is one dr...

2024
[2023]

anytime,

Nonparametric extensions of randomized re- sponse for private confidence sets. InProceedings of the 40th International Conference on Machine Learn- ing, pages 36748–36789. Justin Whitehouse, Aaditya Ramdas, Ryan Rogers, and Steven Wu. 2023. Fully-adaptive composition in differ...

2023 arXiv
[2024]

Sanjeda Akter, Ibne Farabi Shihab, and Anuj Sharma

Mitigating LLM hallucinations via conformal abstention.arXiv preprint arXiv:2405.01563. Sanjeda Akter, Ibne Farabi Shihab, and Anuj Sharma

arXiv
[2025]

Sanjeda Akter, Ibne Farabi Shihab, and Anuj Sharma

Selective risk certification for LLM out- puts via information-lift statistics: PAC-Bayes, ro- bustness, and skeleton design.arXiv preprint arXiv:2509.12527. Sanjeda Akter, Ibne Farabi Shihab, and Anuj Sharma
[2026]

arXiv preprint arXiv:2510.06478

Anytime-valid answer sufficiency certificates for LLM generation via sequential information lift. arXiv preprint arXiv:2510.06478. Version 2. Anastasios N. Angelopoulos, Stephen Bates, Em- manuel J. Candès, Michael I. Jordan, and Lihua Lei

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

draws each requested event independently with replacement from the empirical law supported onP k

work page

[2] [2]

lift is ineffective

The bound is attained when the added record hasℓ= 1. Theorem 3(Transcript privacy).For each message, Equation(15)isρ k,t-zCDP with ρk,t = 1 σ2 k,t .(31) For any calibration record i and admissible tran- script path τ, let Iτ (i) be the releases to which that record contributes. If a deterministic privacy filter enforces the pathwise bound ρtr = sup τ sup ...

work page 2014

[3] [3]

executes the preregistered monitor- ing/recruitment policy and selects one threshold or always abstains

work page

[4] [4]

Anastasios N

Learn then test: Calibrating predictive algo- rithms to achieve risk control.The Annals of Applied Statistics, 19(2). Anastasios N. Angelopoulos, Stephen Bates, Adam Fisch, Lihua Lei, and Tal Schuster. 2024. Conformal risk control. InThe Twelfth International Conference on Learning Representations. Borja Balle and Yu-Xiang Wang. 2018. Improving the Gaussi...

arXiv 2024

[5] [5]

Pierre Humbert, Batiste Le Bars, Aurélien Bellet, and Sylvain Arlot

Anytime-valid conformal risk control.arXiv preprint arXiv:2602.04364. Pierre Humbert, Batiste Le Bars, Aurélien Bellet, and Sylvain Arlot. 2023. One-shot federated confor- mal prediction. InProceedings of the 40th Inter- national Conference on Machine Learning, pages 14153–14177. Ben Jacobsen, Tomas Gonzalez, Gavin Brown, Kassem Fawaz, and Aaditya Ramdas....

arXiv 2023

[6] [6]

InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 19052–19075

SConU: Selective conformal uncertainty in large language models. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 19052–19075. Ian Waudby-Smith, Steven Wu, and Aaditya Ramdas

work page

[7] [9]

eZj,t +h t +g j,t Nt # [0,1] ,(53) LA j,t =

All pri- vacy equations remain valid after replacing √ 2by 2 √ 2, equivalently multiplying each ρk,t by four for fixed σk,t. The paper uses add/remove adjacency throughout. I.2 Proof of Theorem 3 Proof. The Gaussian mechanism with query sen- sitivity ∆2 and isotropic noise variance σ2 is ∆2 2/(2σ2)-zCDP (Bun and Steinke, 2016). Lemma 2 gives∆ 2 2 ≤2, so r...

work page 2016

[8] [11]

releases the registered noised histograms and updates only from realized messages

work page