probability convolution

This work addresses the challenge of dynamically satisfying varying differential privacy (DP) requirements during inference without retraining models. To this end, it proposes two training-free post-processing methods—random selection and linear combination—that generate new models meeting arbitrary target DP parameters by fusing pre-trained models representing different privacy-utility trade-offs. As the first systematic study to leverage model fusion for adaptively fulfilling arbitrary DP guarantees, the paper provides rigorous theoretical analysis grounded in Rényi differential privacy and privacy loss distributions. It further proves that linear combination strictly dominates random selection in terms of the privacy-utility trade-off. Empirical evaluations on both synthetic and real-world datasets validate the effectiveness and practicality of the proposed approaches.

In the moderate-to-low privacy regime (i.e., small $(\varepsilon, \delta)$), existing Gaussian mechanisms are significantly suboptimal due to excessive noise injection. This work proposes a hybrid Gaussian noise mechanism that constructs a convex combination of multiple Gaussian distributions with identical variances but distinct means, adaptively tuning both the means and mixing weights using sensitivity information. It presents the first systematic construction and analysis of a Gaussian mixture-based perturbation scheme satisfying $(\varepsilon, \delta)$-differential privacy. The authors derive tight variance conditions and an efficient algorithm that substantially reduce both L1 and L2 utility loss in the low-privacy regime, markedly narrowing the performance gap with the theoretically optimal mechanism and achieving near-optimal accuracy.

Differential privacy (DP) lacks intuitive interpretability from the perspective of statistical disclosure risk, hindering practitioners’ understanding and trustworthy deployment. Method: This work establishes, for the first time, a rigorous theoretical linkage between DP parameters (ε, δ) and quantifiable disclosure risk. By integrating statistical inference theory, privacy analysis, and risk modeling, we derive tight upper bounds on an adversary’s worst-case success probability in inferring sensitive attributes under DP. Contribution/Results: The framework endows ε and δ with concrete, risk-based semantics—interpreting them as guarantees on bounded inference risk. It further provides a risk-accumulation interpretation of composition theorems, enabling principled, scenario-aware selection and validation of privacy parameters. Our results significantly enhance the interpretability and credibility of DP, offering both theoretical foundations and actionable guidelines for privacy engineering practice.

The Gaussian mechanism satisfies only approximate differential privacy, failing to guarantee strict pure differential privacy. Method: This paper proposes a novel noise-adding mechanism based on the symmetric α-stable (SaS) distribution, the first to achieve convolutional closure under pure ε-differential privacy and thus enable provably private summation queries. Contribution/Results: We derive an analytical relationship among the privacy budget ε, the stability parameter α, and the scale parameter; prove that, for any fixed ε, the proposed mechanism yields strictly lower expected error than the Gaussian mechanism; and demonstrate that tuning α ∈ (0,2] enables flexible trade-offs between privacy strength and utility. Empirical evaluation confirms its superior privacy–utility Pareto frontier. This work establishes a new paradigm for designing pure differential privacy mechanisms.

This work addresses the challenge of privacy parameter computation in differentially private (DP) machine learning under the joint effects of stochastic minibatching and cross-iteration correlated noise—specifically, matrix mechanisms. We propose the first near-exact privacy amplification analysis framework applicable to arbitrary lower-triangular nonnegative correlation matrices. Methodologically, we integrate Monte Carlo privacy accounting with lower-triangular noise modeling, enabling the first tight privacy bound estimation for general correlated noise structures. Our framework supports joint optimization of the correlation matrix under privacy amplification constraints and introduces a practical “ball-and-bin” minibatching mechanism as a robust alternative to Poisson sampling. Experiments demonstrate that our approach achieves lower root-mean-square error (RMSE) than state-of-the-art methods on prefix-sum tasks and significantly improves the privacy–utility trade-off in deep learning tasks.

This work addresses the challenge of precisely characterizing the overall privacy guarantee when composing mechanisms under multiple heterogeneous differential privacy (DP) constraints. The authors propose a general composition framework that, for the first time, enables an exact description of the resulting privacy region after composing an arbitrary number of mechanisms subject to diverse DP bounds. By constructing a binary hypothesis testing–based mixture model and integrating probabilistic mixing with f-DP approximation techniques, the framework yields an exact composition theorem for multiple DP constraints. Moreover, the approach naturally extends to the f-DP setting, significantly enhancing both the tightness and applicability of compositional privacy analysis.

This work addresses the challenge non-technical users face in understanding the trade-off between privacy loss parameters and the reliability of statistical inference in differential privacy. By reframing the privacy–utility trade-off within a hypothesis testing framework, the paper introduces the concept of “relative disclosure risk,” which directly links privacy loss parameters to the validity of statistical inference. Through theoretical analysis of how differentially private mechanisms affect the significance of hypothesis tests, the study quantifies the uncertainty introduced by randomization and its effectiveness in mitigating membership inference attacks. The resulting insights yield an actionable guideline for non-expert users to select appropriate privacy mechanisms, thereby promoting transparent deployment and principled configuration of differential privacy in practical applications.

This work addresses the challenge that conventional differential privacy mechanisms struggle to simultaneously preserve privacy and enforce hard linear invariants—such as aggregate statistical constraints—due to difficulties in managing noise correlations. The authors propose a novel differential privacy mechanism grounded in the principle of maximum entropy, which injects correlated noise while strictly satisfying given linear constraints. The resulting aggregates obey these constraints with probability one or with exponentially high probability, and the privacy guarantee is rigorously re-established under this constrained setting. This approach constitutes the first mechanism that jointly achieves linear invariance and high-entropy noise, partially resolves an open theoretical problem concerning the null space of correlation matrices, and extends sampling techniques for constrained Gaussian mixture models. It thereby provides a general, provably secure framework for constrained statistical data release.

Traditional differential privacy relies on overly conservative worst-case assumptions about adversary knowledge, which often fail to reflect real-world privacy risks. This work investigates the composition of multiple queries under a statistical privacy framework, leveraging subsampling and random partitioning of the database to limit inter-query dependencies. Without imposing additional constraints on the database, the study establishes, for the first time, an upper bound on statistical privacy against adversaries with limited prior knowledge. By integrating information-theoretic entropy modeling, the approach enables joint analysis of privacy and utility. Under identical privacy budgets and utility loss, the proposed method supports significantly more queries than existing techniques, thereby substantially enhancing both practicality and accuracy of the privacy mechanism.

This study addresses the challenge of balancing privacy preservation and data utility in synthetic data generation. The authors propose a range-restricted privacy mechanism that formalizes data owners’ prior knowledge about sensitive value domains into two probabilistic adjustment strategies, applying protection only to truly sensitive subsets. By integrating range constraints and belief modeling within a risk-weighted pseudo-posterior framework, the method achieves localized amplification of differential privacy guarantees. Experimental results demonstrate that, compared to conventional pseudo-posterior mechanisms under asymptotic differential privacy, the proposed approach significantly enhances privacy protection in sensitive regions while effectively preserving the overall utility of the generated synthetic data.