Pith. sign in

REVIEW 3 major objections 7 minor 83 references

Projecting noisy cosine scores back onto valid similarity geometry cuts privacy distortion from cubic to quadratic in gallery size.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 02:43 UTC pith:IWDIFPAR

load-bearing objection Solid central-model DP for cosine scores: real decision-level FR analysis and a clean Θ(n³)→O(n²) exact-projection Gram claim, with the usual theory–solver gap on AAP. the 3 major comments →

arxiv 2607.25041 v1 pith:IWDIFPAR submitted 2026-07-27 cs.IR cs.CRcs.CVcs.LG

ScoreShield: Differentially Private Release of Similarity Scores

Behrooz Razeghi , Parsa Rahimi This is my paper
classification cs.IR cs.CRcs.CVcs.LG
keywords differential privacycosine similarityGram matrixperturb-and-projectface recognitionretrieval-augmented generationmembership inferenceelliptope projection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Systems that return cosine similarity scores—face matchers, RAG retrievers, recommenders—can leak whether a person or document is in the gallery. Adding plain Gaussian noise for differential privacy works, but wastes budget on directions that cannot be real cosine scores, and the error grows badly as more scores are released. ScoreShield adds the calibrated noise, then projects onto the set of objects that actually look like cosine vectors or Gram matrices (bounded entries, unit diagonal, positive semidefinite). That projection is free for privacy and, for full pairwise Gram release, improves the leading squared-error scaling from cubic in the number of records to quadratic, with tighter bounds when the Gram is low-rank. The paper backs the claim with decision-level guarantees for verification (threshold recalibration, ROC stability) and experiments on face recognition, multi-hop RAG, image similarity, STS, and collaborative filtering.

Core claim

For one-shot central-model (ε,δ)-DP release of cosine similarity objects, a Gaussian perturb-then-project step onto the cosine feasibility set preserves privacy by post-processing and strictly improves utility geometry: under record-level replacement, exact Frobenius projection of a full cosine Gram improves expected squared Frobenius risk from Θ(n³) for naïve Gaussian noise to O(n²) at fixed privacy parameters, with sharper local O(n² r) bounds at rank-r Grams under local Gram-smoothness.

What carries the argument

ScoreShield: calibrate isotropic Gaussian noise to the global ℓ₂/Frobenius sensitivity of the chosen release (score vector or Gram), then Euclidean-project onto the cosine feasibility set—[−1,1]ⁿ for vectors, or the elliptope of PSD unit-diagonal matrices with entrywise bounds for Grams—so noise in infeasible directions is removed without spending more privacy budget.

Load-bearing premise

The strong risk improvement for Gram matrices is proved for the exact nearest feasible matrix, while the large-scale method actually used only guarantees a feasible matrix, not that nearest one.

What would settle it

On full pairwise Gram release under record-level adjacency, measure squared Frobenius error of the exact metric projection versus naïve Gaussian noise as gallery size n grows at fixed (ε,δ): the claimed improvement fails if empirical error still tracks Θ(n³) rather than O(n²), or if the practical alternating-projection output is far enough from the exact projection that the gain disappears downstream.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • APIs that already expose cosine scores can wrap releases with ScoreShield and keep formal (ε,δ)-DP without redesigning the encoder.
  • Face-verification operating points can be restored after privatization by a unique threshold shift that scales as Θ(σ²) in the small-noise regime, with ROC/AUC moving by at most O(σ).
  • One-shot private score vectors support DP top-k and thresholded retrieval for RAG by post-processing when only the scores (not private chunk text) are released.
  • Gram-only analytics—clustering, deduplication, neighborhood recommenders—can consume a private feasible cosine Gram with better noise scaling than entrywise Gaussian release.
  • Low-rank embedding collections gain a further local risk reduction under the paper’s Gram-smoothness condition.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If multi-query composition accountants are layered on top, ScoreShield’s one-shot vector primitive becomes a reusable retrieval building block rather than a full end-to-end DP-RAG system.
  • Closing the gap between exact metric projection and averaged alternating projection—either by proving comparable risk or by a scalable exact solver—would make the cubic-to-quadratic claim operational at the scales the experiments already reach.
  • The same perturb-then-project pattern may transfer to other constrained similarity objects (e.g., kernel matrices with fixed diagonal) wherever naïve noise violates known algebraic structure.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The manuscript proposes ScoreShield, a central-model (ε,δ)-DP mechanism for one-shot release of cosine similarity objects: a query-to-collection score vector (regime i) or the full pairwise cosine Gram matrix (regime ii). The mechanism adds Gaussian noise calibrated to the global sensitivity of the released statistic (Δ_query=2 for vectors; Δ_full=2√(2(n−1)) for Grams under record-level replacement) and then projects onto the cosine feasibility set (the box [−1,1]^n, or the elliptope with unit diagonal and bounded off-diagonal entries). Privacy follows from the Gaussian mechanism plus post-processing. Utility analysis gives global risk bounds via Gaussian complexity (GC(C_coll)=Θ(n^{3/2})) and local bounds via tangent-cone statistical dimension under a local Gram-smoothness assumption, yielding an improvement from Θ(n³) (naïve Gaussian) to O(n²) worst-case and O(n²r) rank-aware squared Frobenius risk for the exact metric projection. Additional results cover threshold recalibration (Θ(σ²) offset), ROC/AUC/EER stability at rate O(σ), and a feasible-region analysis for strict endpoint semantics. A scalable averaged alternating-projection (AAP) solver is proposed for large Gram matrices, with R-linear convergence to feasibility proved under bounded linear regularity; the authors state explicitly that the AAP limit is not in general the exact metric projection. Experiments cover face verification (LFW, IJB-B/C, etc.), RAG on FRAMES, semantic similarity (STS-B), image tasks (CIFAR,

Significance. If the results hold, the paper makes a useful contribution at the intersection of DP and similarity-based systems: it gives a clean, post-processing-compatible mechanism with (i) closed-form sensitivities for two practically motivated adjacencies, (ii) Gaussian-complexity and tangent-cone risk bounds that quantify the benefit of feasibility enforcement, (iii) decision-level utility guarantees (flip probability, threshold recalibration with Θ(σ²) offset, O(σ) ROC/AUC/EER/partial-AUC stability) that go beyond the norm-only guarantees of prior perturb-and-project work, and (iv) a scalable projection algorithm with a convergence proof. The empirical breadth (seven FR benchmarks, FRAMES multi-hop RAG, STS-B, CIFAR/Pets, MovieLens) and the availability of code strengthen the submission. The paper is also commendably explicit about its own caveats: the rank-aware bounds are labeled conditional on local Gram-smoothness, the attacker-reconstruction formulas are labeled pre-projection benchmarks, and the DP-RAG privacy scope (public corpus) is disclosed. The main limitation on significance as deployed is that the strongest utility guarantee attaches to an exact SDP projection that is not the

major comments (3)
  1. [§3.2, Eqs. (12)–(17); App. F.5, J.5] The headline risk improvement (O(n^2) vs Θ(n^3) under record-level adjacency) is proved only for the exact Frobenius metric projection onto C_coll (Eq. (12)–(17), App. F.5), while the mechanism actually deployed at scale is the AAP solver (Algorithm 3), which the paper itself states is 'not, in general, the exact Frobenius metric projection' (Contribution 3, §3.2, App. J.5). The only evidence bridging the two is the statement in §4.2 that 'in the small-n cases where both projectors are run, AAP gives comparable downstream utility.' This is load-bearing: the abstract and Contribution 1 present the n-scaling improvement as the paper's central quantitative result, yet no error bound connects the AAP output to the exact projection, so the O(n^2) guarantee does not formally transfer to the released object in the large-scale experiments (STS-B, MovieLens-100K, Pets). A concrete fix within scop
  2. [Algorithm 3, line 2; App. J.5] Algorithm 3, line 2, specifies the output as 'Ŝ ∈ C_coll with (ε,δ)–DP guarantee s.t. ∥Ŝ − proj_Ccoll(S+W)∥_F ≤ τ'. This guarantee is not established anywhere and appears to contradict the paper's own statement (Contribution 3; App. J.5) that the AAP limit is not in general the exact metric projection. What App. J.5 proves is R-linear convergence to feasibility under bounded linear regularity, i.e., distance to the intersection C_coll goes to zero — not proximity to the constrained minimizer proj_Ccoll(S′). As written, the algorithm specification overclaims. Please either correct the output specification to a feasibility-residual guarantee (e.g., max{r_psd, r_box} ≤ τ, matching the stopping test at line 25) or add a proof of the stated approximation bound. This matters because Algorithm 3 is the object practitioners would implement.
  3. [§1 Main Contributions, item 1; App. F.5; Lemma C.25 / Remark C.26] The Θ(n³) naïve baseline is exact (Eq. (13)–(14)), but the ScoreShield improvement is an upper bound: the global bound E∥Ŝ−S∥²_F = O(n²√log(2/δ)/ε) (Eq. (17)) has no matching lower bound, and the rank-aware bound (Eq. in App. F.5, 'Local Risk Bound') is conditional on the local Gram-smoothness assumption T_S(E_n)=T_man(S), which Remark C.26 shows fails at singular boundary points (e.g., rank-1 S=vv⊤, where T_man={0} but T_S(E_n) is nontrivial). The figures handle this honestly via the pointwise-minimum curve, but the abstract/Main-Contribution phrasing 'improves the n-dependence of squared Frobenius risk from Θ(n³) to O(n²)' invites the reading that O(n²) is the achieved risk order, when strictly it is the best proved upper bound under a conditional assumption for the low-rank case. Please (i) state explicitly in the abstract/contribution that these are upper-bound comparisons, (ii) quan
minor comments (7)
  1. [§4.1, Table 2] DP-RAG experiments (§4.1, Table 2): the DP guarantee covers only the released score vector because the corpus is public Wikipedia text; several DP rows show negative gains vs. the no-context baseline (e.g., −6.92 at ε=1). This caveat and the negative results deserve explicit discussion in the main-text Limitations section, since a reader skimming §4 could over-generalize to private corpora.
  2. [§3.1–3.2, App. F.4, F.6] The 'Adversary Gain' subsections (§3.1, §3.2, App. F.4/F.6) repeatedly emphasize that the leverage-score formulas are 'no-clipping Gaussian benchmarks' and not guarantees post-projection. Consider consolidating this caveat once and stating the precise status (benchmark vs. bound) of each displayed equation in a small table; the current repetition is easy to misread as a guarantee.
  3. [§2, Lemma 2.6] Calibration constant: c_{ε,δ} := 2 log(2/δ)/ε² is a valid but slightly nonstandard sufficient condition for the Gaussian mechanism; since the paper already cites analytic Gaussian calibration (Theorem C.12), note in the main text that the classical 2 ln(1.25/δ)/ε² constant or the analytic calibration could be substituted, changing only constants.
  4. [Algorithm 3] Algorithm 3, lines 15–17 and 32–33: the Frobenius-ball radial projection, the µI diagonal shift, and the D^{−1}ŜD^{−1} renormalization are post-hoc repairs not covered by the convergence analysis in App. J.5. Please state whether the proved convergence applies to the algorithm with or without these steps, and confirm the final output is exactly in C_coll (unit diagonal to machine precision after renormalization).
  5. [App. A; References; App. K] Typos/grammar: App. A 'this problem not directly treated in prior work' (missing 'is'); 'Choose of adjacency' (should be 'Choice'); reference [21] 'KRASNOSEL'SKII MA' formatting. App. K table of contents skips from K.4 to K.6 (no K.5).
  6. [Figure 2] Figure 2: the right panel is dense (10 curves); the caption does not define (R)/(O) adjacency abbreviations, and the distinction between 'Global upper bound' and 'Rank aware upper bound (conditional)' should be marked in the main text where the figure is first referenced (§1).
  7. [Figure 2; App. F.7] Notation: σ is used both as the Gaussian standard-deviation parameter and, in App. F.7, inside normalized quantities MSE/c_{ε,δ}; since the global bound is linear in σ rather than σ², the normalized figures retain a c_{ε,δ}^{−1/2} factor — this is noted in App. F.7 but should be flagged in the Figure 2 caption (main text) as well.

Circularity Check

0 steps flagged

No significant circularity: privacy and risk bounds are derived from sensitivity, Gaussian calibration, and convex-set geometry against external benchmarks.

full rationale

ScoreShield’s load-bearing claims do not reduce to their inputs by construction. Privacy follows from the standard Gaussian mechanism calibrated to explicit ℓ₂/Frobenius sensitivities (Δ_query=2; Δ_full=2√[2(n−1)]) plus the post-processing lemma; these are textbook DP facts, not self-defined. Frobenius risk improvements (naïve Θ(n³)→ exact-projection O(n²) under record-level adjacency, with conditional rank-aware O(n² r c_{ε,δ}) bounds) are obtained from Gaussian complexity of the elliptope/box and tangent-cone statistical dimension—external convex-geometry tools applied to a fixed feasible set C_coll / C_query, not fitted targets renamed as predictions. Decision-level FR results (flip probability, threshold recalibration Δτ=Θ(σ²), ROC/AUC O(σ) stability) are analytic consequences of Gaussian convolution and Lipschitz CDFs. Experiments report standard external metrics (TAR@FPR, RAG accuracy, AUC, Spearman, RMSE) on public benchmarks. The paper’s own caveat that AAP is not the exact metric projection is a scope gap, not circular reasoning. No self-citation chain, uniqueness import, or fitted-input-as-prediction pattern is load-bearing.

Axiom & Free-Parameter Ledger

4 free parameters · 7 axioms · 2 invented entities

The central DP and risk claims rest on standard DP composition/post-processing, Gaussian mechanism calibration, unit-norm cosine geometry, record-level (or optional Δ_G) adjacency, and convex projection inequalities. No new physical entities. Free parameters are privacy knobs and solver tolerances chosen for experiments, not fitted constants that define the theorem statements.

free parameters (4)
  • ε, δ (privacy budget) = swept on grids (e.g. FR ε∈{20,35,70,100}, RAG ε∈{1,10})
    User-chosen privacy parameters that set noise scale σ² = c_{ε,δ} Δ²; theorems are parametric in these values.
  • AAP tolerance τ / max iterations T
    Practical Gram solver stopping criteria; affect feasibility residual and thus experimental utility, not the exact-projection theorems.
  • Δ_G (output-space Gram adjacency radius) = Θ(1) in (O) comparisons; Δ=2 used in some displayed panels
    Optional alternative adjacency radius; when not dominating record-level replacement it encodes a different threat model and must be chosen/calibrated.
  • Verification/RAG thresholds τ and top-k = task-specific (e.g. FMR α=10^{-2}, RAG τ∈{0.25,0.35})
    Operating-point choices for downstream utility; recalibration theory treats them as selected targets, experiments pick task-specific values.
axioms (7)
  • standard math Gaussian mechanism with σ² ≥ 2 log(2/δ) Δ²/ε² yields (ε,δ)-DP; post-processing preserves DP
    Lemma 2.6–2.8 / App. C.3; foundation of all privacy claims.
  • domain assumption Embeddings are ℓ2-normalized so cosine scores lie in [-1,1] and Grams are correlation matrices (PSD, unit diagonal)
    Setup §2; defines feasible sets C_query and C_coll used by projection.
  • domain assumption Record-level replacement adjacency: neighboring datasets differ in at most one record/embedding row
    Def. 2.1; drives Δ_query=2 and Δ_full=Θ(√n).
  • domain assumption One-shot non-interactive release in the trusted-curator model; no multi-query composition in the main guarantees
    Threat model §2 and Limitations §6; multi-query accounting is explicitly out of scope.
  • standard math Exact Frobenius metric projection is firmly non-expansive / does not increase distance to the true feasible point
    Lemma 2.14 / C.27; used to argue projection cannot worsen squared error vs noisy input and underpins risk comparisons.
  • ad hoc to paper Local Gram-smoothness T_S(E_n)=T_man(S) for rank-aware statistical-dimension bounds
    Lemma C.25 and Remark C.26; conditional assumption required for O(n² r) local Gram bounds; may fail at singular boundary points.
  • domain assumption Bounded linear regularity of K_+^n and C_unit^n for R-linear AAP convergence to feasibility
    Contribution 3 / App. J.5; needed for practical solver guarantees, distinct from exact-projection risk.
invented entities (2)
  • ScoreShield (perturb-then-project cosine score release mechanism) independent evidence
    purpose: Name the end-to-end DP wrapper: Gaussian perturbation of score vectors/Grams plus projection onto cosine feasibility sets.
    Engineering/mechanism construct, not a new physical entity; instantiated with standard DP and convex projection tools.
  • Cosine-Gram feasible set C_coll (elliptope with explicit entry bounds) independent evidence
    purpose: Feasibility target for valid pairwise cosine releases.
    Standard correlation-matrix/elliptope geometry specialized to the release object; Lemma C.22 notes entry bounds are implied by PSD+unit diagonal.

pith-pipeline@v1.2.0-grok45-kimik3 · 76120 in / 4148 out tokens · 69985 ms · 2026-07-31T02:43:38.517282+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of ScoreShield: Differentially Private Release of Similarity Scores." pith.science (2026). https://pith.science/paper/IWDIFPAR

@misc{pith2026260725041,
  author       = {Pith},
  title        = {Pith review of: ScoreShield: Differentially Private Release of Similarity Scores},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IWDIFPAR}},
  note         = {Machine review of arXiv:2607.25041}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

A growing number of applications, such as biometrics and retrieval-augmented generation (RAG), rely on cosine similarity scores computed between vector embeddings of text, images, or audio. These systems return similarity scores through their APIs for ranking and verification. However, such releases can leak information about individual records and enable membership inference attacks. While differential privacy (DP) provides a principled metric for quantifying attack risks, na\"ive application of DP mechanisms---such as adding i.i.d. Gaussian noise to vector entries---leads to excessive distortion (i.e., low utility) at a given privacy constraint that scales poorly with the number of released scores. We propose \textsc{ScoreShield}, a perturb-then-project mechanism that adds Gaussian noise calibrated to global sensitivity of the chosen score release regime and then projects the result onto the feasibility set of valid cosine objects. \textsc{ScoreShield} satisfies $(\varepsilon,\delta)$-DP for releasing similarity score vectors and Gram matrices. We provide utility guarantees for the exact Frobenius metric projection used in the risk analysis, and prove convergence to feasibility for the practical averaged alternating-projection solver used for large-scale Gram releases. For full pairwise cosine Gram release under record-level replacement adjacency, the exact-projection bound improves the $n$-dependence of squared Frobenius risk from $\Theta(n^3)$ for the na\"ive Gaussian baseline to $\mathcal{O}(n^2)$ for fixed privacy parameters, with sharper local bounds at low-rank Grams. We evaluate the mechanism across RAG, face recognition, semantic retrieval, image similarity, and recommender-system tasks.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

83 extracted references · 5 linked inside Pith

  1. [1]

    SemDeDup: Data-efficient learning at web-scale through semantic deduplication

    Amro Kamal Mohamed Abbas, Kushal Tirumala, Daniel Simig, Surya Ganguli, and Ari S Morcos. SemDeDup: Data-efficient learning at web-scale through semantic deduplication. InICLR 2023 Workshop on Mathematical and Empirical Understanding of Foundation Models, 2023

    2023

  2. [2]

    Is my data in your retrieval database? membership inference attacks against retrieval augmented generation

    Maya Anderson, Guy Amit, and Abigail Goldsteen. Is my data in your retrieval database? membership inference attacks against retrieval augmented generation. InInternational Conference on Information Systems Security and Privacy, volume 2, pp. 474–485. Science and Technology Publications, Lda, 2025

    2025

  3. [3]

    Cryptomask: Privacy-preserving face recognition

    Jianli Bai, Xiaowu Zhang, Xiangfu Song, Hang Shao, Qifan Wang, Shujie Cui, and Giovanni Russello. Cryptomask: Privacy-preserving face recognition. InInternational Conference on Information and Communications Security, pp. 333–350. Springer, 2023

    2023

  4. [6]

    Safeguarding privacy of retrieval data against membership inference attacks: Is this query too close to home?arXiv preprint arXiv:2505.22061, 2025

    Yujin Choi, Youngjoo Park, Junyoung Byun, Jaewook Lee, and Jinseong Park. Safeguarding privacy of retrieval data against membership inference attacks: Is this query too close to home?arXiv preprint arXiv:2505.22061, 2025

    arXiv 2025

  5. [7]

    Total recall: Automatic query expansion with a generative feature model for object retrieval

    Ondrej Chum, James Philbin, Josef Sivic, Michael Isard, and Andrew Zisserman. Total recall: Automatic query expansion with a generative feature model for object retrieval. In2007 IEEE 11th international conference on computer vision, pp. 1–8. IEEE, 2007

    2007

  6. [9]

    Arcface: Additive angular margin loss for deep face recognition

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4690–4699, 2019

    2019

  7. [10]

    The algorithmic foundations of differential privacy.Foundations and trends® in theoretical computer science, 9(3–4):211–407, 2014

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy.Foundations and trends® in theoretical computer science, 9(3–4):211–407, 2014

    2014

  8. [11]

    On the vulnerability of face verification systems to hill-climbing attacks.Pattern Recognition, 43(3):1027–1038, 2010

    Javier Galbally, Chris McCool, Julian Fierrez, Sebastien Marcel, and Javier Ortega-Garcia. On the vulnerability of face verification systems to hill-climbing attacks.Pattern Recognition, 43(3):1027–1038, 2010

    2010

  9. [15]

    Billion-scale similarity search with gpus.IEEE Transactions on Big Data, 7(3):535–547, 2019

    Jeff Johnson, Matthijs Douze, and Hervé Jégou. Billion-scale similarity search with gpus.IEEE Transactions on Big Data, 7(3):535–547, 2019. 15 arXiv preprint, ScoreShield

    2019

  10. [16]

    Privacy via the johnson- lindenstrauss transform.Journal of Privacy and Confidentiality, 5(1):39–71, 2013

    Krishnaram Kenthapadi, Aleksandra Korolova, Ilya Mironov, and Nina Mishra. Privacy via the johnson- lindenstrauss transform.Journal of Privacy and Confidentiality, 5(1):39–71, 2013

    2013

  11. [18]

    Retrieval-augmented generation for knowledge-intensive nlp tasks.Advances in neural information processing systems, 33:9459–9474, 2020

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge-intensive nlp tasks.Advances in neural information processing systems, 33:9459–9474, 2020

    2020

  12. [19]

    Budgetleak: Membership inference attacks on rag systems via the generation budget side channel.arXiv preprint arXiv:2511.12043, 2025

    Hao Li, Jiajun He, Guangshuo Wang, Dengguo Feng, Zheng Li, and Min Zhang. Budgetleak: Membership inference attacks on rag systems via the generation budget side channel.arXiv preprint arXiv:2511.12043, 2025

    arXiv 2025

  13. [20]

    Generating is believing: Membership inference attacks against retrieval-augmented generation

    Yuying Li, Gaoyang Liu, Chen Wang, and Yang Yang. Generating is believing: Membership inference attacks against retrieval-augmented generation. InICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1–5. IEEE, 2025

    2025

  14. [22]

    Hill-climbing attacks on multibiometrics recognition systems.IEEE Transactions on Information Forensics and Security, 10(5):900–915, 2014

    Emanuele Maiorana, Gabriel Emile Hine, and Patrizio Campisi. Hill-climbing attacks on multibiometrics recognition systems.IEEE Transactions on Information Forensics and Security, 10(5):900–915, 2014

    2014

  15. [25]

    A survey on bias and fairness in machine learning.ACM computing surveys (CSUR), 54(6):1–35, 2021

    Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey on bias and fairness in machine learning.ACM computing surveys (CSUR), 54(6):1–35, 2021

    2021

  16. [26]

    Magface: A universal representation for face recognition and quality assessment

    Qiang Meng, Shichao Zhao, Zhida Huang, and Feng Zhou. Magface: A universal representation for face recognition and quality assessment. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 14225–14234, 2021

    2021

  17. [28]

    MTEB: Massive text embedding benchmark

    Niklas Muennighoff, Nouamane Tazi, Loïc Magne, and Nils Reimers. MTEB: Massive text embedding benchmark. InProceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, pp. 2014–2037, 2023

    2014

  18. [29]

    Riddle me this! stealthy membership inference for retrieval-augmented generation

    Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, and Amir Houmansadr. Riddle me this! stealthy membership inference for retrieval-augmented generation. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pp. 1245–1259, 2025

    2025

  19. [30]

    On spectral clustering: Analysis and an algorithm.Advances in neural information processing systems, 14, 2001

    Andrew Ng, Michael Jordan, and Yair Weiss. On spectral clustering: Analysis and an algorithm.Advances in neural information processing systems, 14, 2001

    2001

  20. [31]

    Deepface-emd: Re-ranking using patch-wise earth mover’s distance improves out-of- distribution face identification

    Hai Phan and Anh Nguyen. Deepface-emd: Re-ranking using patch-wise earth mover’s distance improves out-of- distribution face identification. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20259–20269, 2022

    2022

  21. [32]

    Sentence-bert: Sentence embeddings using siamese BERT-networks

    Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese BERT-networks. In Proceedings of EMNLP-IJCNLP, 2019

    2019

  22. [33]

    Normalized cuts and image segmentation.IEEE Transactions on pattern analysis and machine intelligence, 22(8):888–905, 2000

    Jianbo Shi and Jitendra Malik. Normalized cuts and image segmentation.IEEE Transactions on pattern analysis and machine intelligence, 22(8):888–905, 2000

    2000

  23. [34]

    FairDeDup: Detecting and mitigating vision-language fairness disparities in semantic dataset deduplication

    Eric Slyman, Stefan Lee, Scott Cohen, and Kushal Kafle. FairDeDup: Detecting and mitigating vision-language fairness disparities in semantic dataset deduplication. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13905–13916, 2024

    2024

  24. [35]

    Iarpa janus benchmark-b face dataset

    Cameron Whitelam, Emma Taborsky, Austin Blanton, Brianna Maze, Jocelyn Adams, Tim Miller, Nathan Kalka, Anil K Jain, James A Duncan, Kristen Allen, et al. Iarpa janus benchmark-b face dataset. Inproceedings of the IEEE conference on computer vision and pattern recognition workshops, pp. 90–98, 2017. 16 arXiv preprint, ScoreShield

    2017

  25. [38]

    Face clustering via graph convolutional networks with confidence edges

    Yang Wu, Zhiwei Ge, Yuhao Luo, Lin Liu, and Sulong Xu. Face clustering via graph convolutional networks with confidence edges. InProceedings of the IEEE/CVF International Conference on Computer Vision, pp. 20990–20999, 2023

    2023

  26. [40]

    an old dog performs new tricks

    Zhun Zhong, Liang Zheng, Donglin Cao, and Shaozi Li. Re-ranking person re-identification with k-reciprocal encoding. InProceedings of the IEEE conference on computer vision and pattern recognition, pp. 1318–1327, 2017. 17 arXiv preprint, ScoreShield Appendix Contents A Extended Introduction: Differentially Private Deep Face Recognition 19 B Extended Relat...

    2017

  27. [41]

    Retrieval-stage privatization(IDs/ranks/thresholds/scores): the mechanism releases a DP version of the retrieval outcome (e.g., a DP top-k set, a DP threshold, or a DP score signal), and subsequent steps are treated as post-processingof that released retrieval signal.3

  28. [42]

    the corpus

    Generation-stage privatization(DP decoding / private prediction): the system uses a DP mechanism during token generation (often via prompting an LLM on multiple documents and aggregating with a DP rule), so that the final text output satisfies DP w.r.t. the corpus

  29. [43]

    Beyond per-question privacy

    One-time dataset privatization(DP synthetic corpus): the corpus is privatized once into a DP proxy dataset, enabling unlimited downstream (non-private) retrieval and generation by post-processing. These design points target different release goals and are therefore not generally interchangeable. That is privatizing a retrieval signal is often sufficient w...

  30. [44]

    no match

    For verification (1:1) a single scoreSij is compared with a thresholdτ to decide amatchvsnon-match. For closed-set identification (1:N) the probe isknownto correspond to one of the n enrolled identities. Writing the noisy probe as qi =e i +z(for some unknown index i), wherezis nuisance noise, the backend must compare it with every gallery item, i.e., cons...

  31. [45]

    Thus fori̸=j,|S ij|=|⟨e i,ej⟩|≤∥e i∥2∥ej∥2 = 1

    Because diag(S) =1, we have∥ei∥2 = 1for alli. Thus fori̸=j,|S ij|=|⟨e i,ej⟩|≤∥e i∥2∥ej∥2 = 1. Lemma C.23(Gaussian Complexity ofCcoll).Let En := {S∈S n :S ⪰ 0,diag (S) =1}. There exist universal constants0<c≤C <∞such that cn 3/2 ≤GC(E n)≤Cn 3/2.(45) Equivalently,GC(C coll) = Θ(n3/2). Proof. By Lemma C.20, withG= (W+W ⊤)/2, GC(En) = E [ supS∈En⟨G, S⟩ ] , wh...

    2000

  32. [46]

    >” (Remark G.13). BecauseW has a continuous density,Pr[S +W =τ] = 0for every τ <1, so the strict “>

    Applying dominated convergence to Eq. 220 gives lim t↓0 1 t2 E projC(s+tσz)−x 2 2 =σ 2 E∥projK(z)∥2 2 =σ 2δ(K).(222) The boundδ(K)≤n follows from∥projK(z)∥2≤∥ z∥2 and E∥z∥2 2 =n. The inequalities GW(K)2≤δ (K)≤ GW(K)2 + 1are the standard relationship between statistical dimension and squared Gaussian width for closed convex cones. Corollary G.9(Piecewi...

    2023

  33. [47]

    2.Transition regime(35≤ε<70): utility improves rapidly with either increasingεor relaxingδ

    Small-budget regime(ε≤ 30): utility is strongly degraded, and the IJB@10−6 operating points are often infeasible. 2.Transition regime(35≤ε<70): utility improves rapidly with either increasingεor relaxingδ

  34. [48]

    Retrieval-document

    Near-saturation regime(ε≥ 70): performance is close to the clean baseline, with diminishing gains from further increases inε. Thus, for moderateδ, the practical knee of the privacy–utility trade-off occurs aroundε≈ 70in these experiments. If the operating point can be relaxed from10−6 to10−5 or10−4, useful accuracy extends to smallerε. 85 arXiv preprint, ...

    2000

  35. [49]

    This serves as the non-private reference

    Non-private(S): construct the cosine Gram fromℓ2-normalized embeddings, or from the task-specific construction noted below. This serves as the non-private reference

  36. [50]

    The resulting matrix need not be positive semidefinite, need not have unit diagonal, and may have entries outside[−1,1]

    Noisy(S ′): apply the Gaussian mechanism toSwith scale σ = σ(ε,δ, ∆)calibrated for the adopted adjacency model, and enforce symmetry byS′← 1 2(S′ +S′⊤). The resulting matrix need not be positive semidefinite, need not have unit diagonal, and may have entries outside[−1,1]

  37. [51]

    In the large-scale experiments, this step is implemented by AAP over the PSD cone, the unit-diagonal affine set, and the entrywise box[−1,1]

    ScoreShield(ˆS): apply a deterministic post-processing map to the noisy matrix to enforce the cosine- Gram constraints. In the large-scale experiments, this step is implemented by AAP over the PSD cone, the unit-diagonal affine set, and the entrywise box[−1,1]. The ‘Noisy’ variant is not reported for every benchmark. Stability of graph-based methods.From ...

    2048

  38. [52]

    Springer, 2007

    Robert J Adler and Jonathan E Taylor.Random fields and geometry. Springer, 2007

    2007

  39. [53]

    On opial’s lemma.arXiv preprint arXiv:2503.22004, 2025

    Aleksandr Arakcheev and Heinz H Bauschke. On opial’s lemma.arXiv preprint arXiv:2503.22004, 2025

    Pith/arXiv arXiv 2025

  40. [54]

    Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising

    Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. InInternational conference on machine learning, pp. 394–403. PMLR, 2018

    2018

  41. [55]

    The area above the ordinal dominance graph and the area below the receiver operating characteristic graph.Journal of mathematical psychology, 12(4):387–415, 1975

    Donald Bamber. The area above the ordinal dominance graph and the area below the receiver operating characteristic graph.Journal of mathematical psychology, 12(4):387–415, 1975

    1975

  42. [56]

    Dykstra’ s alternating projection algorithm for two sets.Journal of Approximation Theory, 79(3):418–443, 1994

    Heinz H Bauschke and Jonathan M Borwein. Dykstra’ s alternating projection algorithm for two sets.Journal of Approximation Theory, 79(3):418–443, 1994

    1994

  43. [57]

    On projection algorithms for solving convex feasibility problems

    Heinz H Bauschke and Jonathan M Borwein. On projection algorithms for solving convex feasibility problems. SIAM review, 38(3):367–426, 1996

    1996

  44. [58]

    Correction to: convex analysis and monotone operator theory in hilbert spaces

    Heinz H Bauschke and Patrick L Combettes. Correction to: convex analysis and monotone operator theory in hilbert spaces. InConvex analysis and monotone operator theory in Hilbert spaces, pp. C1–C4. Springer, 2020

    2020

  45. [59]

    Strong conical hull intersection property, bounded linear regularity, jameson’s property (g), and error bounds in convex optimization.Mathematical Programming, 86(1): 135–160, 1999

    Heinz H Bauschke, Jonathan M Borwein, and Wu Li. Strong conical hull intersection property, bounded linear regularity, jameson’s property (g), and error bounds in convex optimization.Mathematical Programming, 86(1): 135–160, 1999

    1999

  46. [60]

    The johnson-lindenstrauss transform itself preserves differential privacy

    Jeremiah Blocki, Avrim Blum, Anupam Datta, and Or Sheffet. The johnson-lindenstrauss transform itself preserves differential privacy. In2012 IEEE 53rd Annual Symposium on Foundations of Computer Science, pp. 410–419. IEEE, 2012

    2012

  47. [61]

    A method for finding projections onto the intersection of convex sets in hilbert spaces

    James P Boyle and Richard L Dykstra. A method for finding projections onto the intersection of convex sets in hilbert spaces. InAdvances in Order Restricted Statistical Inference: Proceedings of the Symposium on Order Restricted Statistical Inference held in Iowa City, Iowa, September 11–13, 1985, pp. 28–47. Springer, 1986

    1985

  48. [62]

    SemEval-2017 task 1: Semantic textual similarity multilingual and cross-lingual focused evaluation

    Daniel Cer, Mona Diab, Eneko Agirre, Iñigo Lopez-Gazpio, and Lucia Specia. SemEval-2017 task 1: Semantic textual similarity multilingual and cross-lingual focused evaluation. InProceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017), pp. 1–14, 2017

    2017

  49. [63]

    Privacy preserving face recognition utilizing differential privacy.Computers & Security, 97, 2020

    Mahawaga Arachchige Pathum Chamikara, Peter Bertok, Ibrahim Khalil, Dongxi Liu, and Seyit Camtepe. Privacy preserving face recognition utilizing differential privacy.Computers & Security, 97, 2020

    2020

  50. [64]

    Talagrand meets talagrand: Upper and lower bounds on expected soft maxima of gaussian processes with finite index sets.arXiv preprint arXiv:2502.06709, 2025

    Yifeng Chu and Maxim Raginsky. Talagrand meets talagrand: Upper and lower bounds on expected soft maxima of gaussian processes with finite index sets.arXiv preprint arXiv:2502.06709, 2025

    arXiv 2025

  51. [65]

    Perturb-and- project: differentially private similarities and marginals

    Vincent Cohen-Addad, Tommaso d’Orsi, Alessandro Epasto, Vahab Mirrokni, and Peilin Zhong. Perturb-and- project: differentially private similarities and marginals. InProceedings of the 41st International Conference on Machine Learning, pp. 9161–9179, 2024

    2024

  52. [66]

    Partial auc estimation and regression.Biometrics, 59(3):614–623, 2003

    Lori E Dodd and Margaret S Pepe. Partial auc estimation and regression.Biometrics, 59(3):614–623, 2003

    2003

  53. [67]

    Differentially private covariance revisited.Advances in Neural Information Processing Systems, 35:850–861, 2022

    Wei Dong, Yuting Liang, and Ke Yi. Differentially private covariance revisited.Advances in Neural Information Processing Systems, 35:850–861, 2022

    2022

  54. [68]

    An algorithm for restricted least squares regression.Journal of the American Statistical Association, 78(384):837–842, 1983

    Richard L Dykstra. An algorithm for restricted least squares regression.Journal of the American Statistical Association, 78(384):837–842, 1983

    1983

  55. [69]

    An iterative procedure for obtaining i-projections onto the intersection of convex sets.The annals of Probability, pp

    Richard L Dykstra. An iterative procedure for obtaining i-projections onto the intersection of convex sets.The annals of Probability, pp. 975–984, 1985

    1985

  56. [70]

    Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, Louis Rouillard, Thomas Mesnard, Geoffrey Cideron, Jean bastien Grill, Sabela Ramos, Edouard Yvinec, Michelle Casbon, Etienne Pot, Ivo Penchev, Gaël Liu, Francesco Visin, Kathleen Kenealy, Lucas Bey...

    Pith/arXiv arXiv 2025

  57. [71]

    Rag with differential privacy

    Nicolas Grislain. Rag with differential privacy. In2025 IEEE Conference on Artificial Intelligence (CAI), pp. 847–852. IEEE, 2025

    2025

  58. [72]

    The movielens datasets: History and context.ACM transactions on interactive intelligent systems (TIIS), 5(4):1–19, 2015

    F Maxwell Harper and Joseph A Konstan. The movielens datasets: History and context.ACM transactions on interactive intelligent systems (TIIS), 5(4):1–19, 2015

    2015

  59. [73]

    Privacy-preserving face recognition with learnable privacy budgets in frequency domain

    Jiazhen Ji, Huan Wang, Yuge Huang, Jiaxiang Wu, Xingkun Xu, Shouhong Ding, ShengChuan Zhang, Liujuan Cao, and Rongrong Ji. Privacy-preserving face recognition with learnable privacy budgets in frequency domain. InEuropean Conference on Computer Vision, pp. 475–491. Springer, 2022

    2022

  60. [74]

    Less is more: Revisiting the gaussian mechanism for differential privacy

    Tianxi Ji and Pan Li. Less is more: Revisiting the gaussian mechanism for differential privacy. In33rd USENIX Security Symposium (USENIX Security 24), pp. 937–954, 2024

    2024

  61. [75]

    Privacy-preserving retrieval-augmented generation with differential privacy.arXiv preprint arXiv:2412.04697, 2024

    Tatsuki Koga, Ruihan Wu, Zhiyuan Zhang, and Kamalika Chaudhuri. Privacy-preserving retrieval-augmented generation with differential privacy.arXiv preprint arXiv:2412.04697, 2024

    arXiv 2024

  62. [76]

    Fact, fetch, and reason: A unified evaluation of retrieval-augmented generation

    Satyapriya Krishna, Kalpesh Krishna, Anhad Mohananey, Steven Schwarcz, Adam Stambler, Shyam Upadhyay, and Manaal Faruqui. Fact, fetch, and reason: A unified evaluation of retrieval-augmented generation. InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies ...

    2025

  63. [77]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto,

  64. [78]

    Qwen3-vl-embedding and qwen3-vl-reranker: A unified framework for state-of-the-art multimodal retrieval and ranking.arXiv preprint arXiv:2601.04720, 2026

    Mingxin Li, Yanzhao Zhang, Dingkun Long, Chen Keqin, Sibo Song, Shuai Bai, Zhibo Yang, Pengjun Xie, An Yang, Dayiheng Liu, Jingren Zhou, and Junyang Lin. Qwen3-vl-embedding and qwen3-vl-reranker: A unified framework for state-of-the-art multimodal retrieval and ranking.arXiv preprint arXiv:2601.04720, 2026

    Pith/arXiv arXiv 2026

  65. [79]

    Two comments on the method of successive approximations.Usp

    KRASNOSEL’SKII MA. Two comments on the method of successive approximations.Usp. Math. Nauk, 10: 123–127, 1955

    1955

  66. [80]

    Mean value methods in iteration.Proceedings of the American Mathematical Society, 4(3): 506–510, 1953

    W Robert Mann. Mean value methods in iteration.Proceedings of the American Mathematical Society, 4(3): 506–510, 1953

    1953

  67. [81]

    Iarpa janus benchmark-c: Face dataset and protocol

    Brianna Maze, Jocelyn Adams, James A Duncan, Nathan Kalka, Tim Miller, Charles Otto, Anil K Jain, W Tyler Niggel, Janet Anderson, Jordan Cheney, et al. Iarpa janus benchmark-c: Face dataset and protocol. In2018 international conference on biometrics (ICB), pp. 158–165. IEEE, 2018

    2018

  68. [82]

    Décomposition orthogonale d’un espace hilbertien selon deux cônes mutuellement polaires

    Jean Jacques Moreau. Décomposition orthogonale d’un espace hilbertien selon deux cônes mutuellement polaires. Comptes rendus hebdomadaires des séances de l’Académie des sciences, 255:238–240, 1962. 119 arXiv preprint, ScoreShield

    1962

  69. [83]

    Differentially private synthetic text generation for retrieval-augmented generation (rag).arXiv preprint arXiv:2510.06719, 2025

    Junki Mori, Kazuya Kakizaki, Taiki Miyagawa, and Jun Sakuma. Differentially private synthetic text generation for retrieval-augmented generation (rag).arXiv preprint arXiv:2510.06719, 2025

    Pith/arXiv arXiv 2025

  70. [84]

    Roc and auc with a binary predictor: a potentially misleading metric.Journal of classification, 37(3):696–708, 2020

    John Muschelli III. Roc and auc with a binary predictor: a potentially misleading metric.Journal of classification, 37(3):696–708, 2020

    2020

  71. [85]

    Weak convergence of the sequence of successive approximations for nonexpansive mappings

    Zdzisław Opial. Weak convergence of the sequence of successive approximations for nonexpansive mappings. Bulletin of the American Mathematical Society, 73(4):591–597, 1967

    1967

  72. [86]

    Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel HAZIZA, Francisco Massa, Alaaeldin El-Nouby, Mido Assran, Nicolas Ballas, Wojciech Galuba, Russell Howes, Po-Yao Huang, Shang-Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Herve Jegou, Julien Mairal, Patrick Lab...

    2024

  73. [87]

    Cats and dogs

    Omkar M Parkhi, Andrea Vedaldi, Andrew Zisserman, and CV Jawahar. Cats and dogs. In2012 IEEE conference on computer vision and pattern recognition, pp. 3498–3505. IEEE, 2012

    2012

  74. [88]

    Principles of mathematical analysis.3rd ed., 1976

    Walter Rudin. Principles of mathematical analysis.3rd ed., 1976

    1976

  75. [89]

    Sudakov-type minoration for gaussian chaos processes.Israel Journal of Mathematics, 79(2): 207–224, 1992

    Michel Talagrand. Sudakov-type minoration for gaussian chaos processes.Israel Journal of Mathematics, 79(2): 207–224, 1992

    1992

  76. [90]

    Nearly optimal private lasso.Advances in Neural Information Processing Systems, 28, 2015

    Kunal Talwar, Abhradeep Guha Thakurta, and Li Zhang. Nearly optimal private lasso.Advances in Neural Information Processing Systems, 28, 2015

    2015

  77. [91]

    Embeddinggemma: Powerful and lightweight text representations.arXiv preprint arXiv:2509.20354, 2025

    Henrique Schechter Vera, Sahil Dua, Biao Zhang, Daniel Salz, Ryan Mullins, Sindhu Raghuram Panyam, Sara Smoot, Iftekhar Naim, Joe Zou, Feiyang Chen, et al. Embeddinggemma: Powerful and lightweight text representations.arXiv preprint arXiv:2509.20354, 2025. Model: google/embeddinggemma-300M

    Pith/arXiv arXiv 2025

  78. [92]

    On rings of operators

    John Von Neumann. On rings of operators. reduction theory.Annals of Mathematics, 50(2):401–485, 1949

    1949

  79. [93]

    Beyond per-question privacy: Multi-query differential privacy for rag systems

    Ruihan Wu, Erchi Wang, and Yu-Xiang Wang. Beyond per-question privacy: Multi-query differential privacy for rag systems. InNeurIPS 2025 Workshop: Reliable ML from Unreliable Data, 2025

    2025

  80. [94]

    Private-rag: Answering multiple queries with llms while keeping your data private.arXiv preprint arXiv:2511.07637, 2025

    Ruihan Wu, Erchi Wang, Zhiyuan Zhang, and Yu-Xiang Wang. Private-rag: Answering multiple queries with llms while keeping your data private.arXiv preprint arXiv:2511.07637, 2025

    arXiv 2025

Showing first 80 references.