differential privacy

This paper addresses privacy accounting for subsampling mechanisms—specifically Poisson and without-replacement sampling—in compositional settings under differential privacy (DP), identifying two prevalent misuses: (i) erroneously assuming the worst-case dataset for a single step suffices for adaptive composition analysis, and (ii) conflating the distinct privacy loss characteristics of the two sampling schemes. Method: We rigorously prove that privacy parameters for subsampled composition cannot be derived by naïvely composing single-step worst-case guarantees. Leveraging Rényi differential privacy and exact privacy loss distribution analysis, we develop a numerical accounting framework incorporating counterexample construction and tight theoretical bounds. Contribution/Results: We establish a decidable criterion for detecting and correcting such misuses, and demonstrate—under typical DP-SGD parameters—that ε values for Poisson and without-replacement sampling may differ by over an order of magnitude. Empirical evaluation confirms our framework prevents significant over- or under-estimation of privacy budgets, substantially improving the reliability of privacy guarantees.

This work addresses the composition of interactive differential privacy (DP) mechanisms under *adaptive selection of privacy-loss parameters* and *concurrent invocation*, including interleaved queries and dynamically instantiated mechanisms. To overcome the limitation of existing theory—which fails to model adaptive, concurrent adversarial interaction—the paper establishes, for the first time, that *privacy filters* and *privacy odometers*, originally designed for non-interactive settings, admit rigorous generalization to concurrent interactive settings. This result unifies and proves the robustness of $(varepsilon,delta)$-DP, $f$-DP, and fixed-order Rényi DP under concurrent composition: concurrency itself does not degrade privacy guarantees. The paper develops the first theoretical framework for concurrent interactive DP supporting fully adaptive privacy budget management, and releases an open-source, production-ready implementation—providing both foundational guarantees and practical engineering support for real-world private systems.

Balancing privacy preservation and model accuracy remains challenging in collaborative modeling among multiple data owners. Method: This paper proposes a novel framework that deeply integrates differential privacy (DP) with secure multi-party computation (MPC). It is the first to provably inject Laplacian noise directly within an MPC protocol—performing privacy-parameter perturbation under secret sharing during distributed gradient computation. This ensures strict ε-differential privacy guarantees while avoiding the accuracy degradation typically caused by global noise in conventional DP approaches. Contribution/Results: The method enables privacy-preserving joint training on highly sensitive data (e.g., genomic data) without exposing raw samples. It achieved first place in the iDASH 2021 Track III competition, significantly outperforming pure-DP baselines in accuracy. By unifying formal privacy guarantees with practical efficiency, this work establishes a new paradigm for privacy-enhancing technologies that simultaneously satisfies rigorous security requirements and real-world usability.

Differential privacy (DP) mechanisms are commonly reported at a single $(varepsilon,delta)$ point, obscuring substantial differences in actual privacy risk among mechanisms sharing identical $(varepsilon,delta)$ parameters—leading to systematic underestimation of risk. Method: We propose a unified quantification framework grounded in $Delta$-divergence, integrating f-differential privacy, Bayesian privacy interpretations, and Blackwell order theory for the first time to establish a decision-theoretically principled paradigm for comparing DP mechanisms. Contribution/Results: By rigorously characterizing worst-case privacy vulnerability disparities, we expose non-negligible excess risk in mainstream noise mechanisms used in DP-SGD. Our framework yields a verifiable, ordinal privacy strength assessment tool—enabling rigorous, theoretically grounded selection of privacy-preserving mechanisms.

Existing differential privacy (DP) synthetic data methods suffer substantial utility degradation when input data contain missing values. Method: This paper formally defines the DP synthetic data generation problem under missingness, characterizing how missingness mechanisms—Missing Completely at Random (MCAR), Missing at Random (MAR), and Missing Not at Random (MNAR)—propagate privacy loss and affect theoretical privacy bounds. Building on this analysis, we propose three adaptive synthesis strategies, each tailored to a specific missingness mechanism and privacy budget. Contribution/Results: Our key innovation is integrating missingness mechanism modeling directly into the DP synthetic data framework, enabling joint optimization of privacy protection and data utility. Evaluated on four real-world datasets with natural missingness, our approach achieves significant utility gains—improving downstream machine learning task accuracy by an average of 8.3%—while yielding tighter analytical privacy upper bounds compared to baseline methods.

This work addresses the challenge of precisely characterizing the overall privacy guarantee when composing mechanisms under multiple heterogeneous differential privacy (DP) constraints. The authors propose a general composition framework that, for the first time, enables an exact description of the resulting privacy region after composing an arbitrary number of mechanisms subject to diverse DP bounds. By constructing a binary hypothesis testing–based mixture model and integrating probabilistic mixing with f-DP approximation techniques, the framework yields an exact composition theorem for multiple DP constraints. Moreover, the approach naturally extends to the f-DP setting, significantly enhancing both the tightness and applicability of compositional privacy analysis.

Existing formal methods struggle to verify the privacy guarantees of modern differential privacy libraries that employ complex programming patterns such as higher-order functions, local state, and interactive algorithms. This work proposes a probabilistic higher-order separation logic that, for the first time, incorporates first-class support for privacy budgets within separation logic, treating them as composable resources to enable modular reasoning. Implemented in the Rocq proof assistant, the logic successfully verifies differential privacy programs featuring higher-order combinators, caching, and interactive mechanisms. Furthermore, the authors construct a formally verified library of mechanisms, including the online sparse vector technique and privacy filters inspired by OpenDP, thereby enabling end-to-end verification of client programs.

This study addresses the challenge of setting the privacy budget ε in differential privacy, which often lacks intuitive grounding and complicates the trade-off between privacy protection and data utility. The authors propose an interpretable method for calibrating ε by imposing a strict upper bound on an adversary’s posterior odds of inferring sensitive information, directly translating this constraint into a corresponding ε value. Grounded in differential privacy theory, Bayesian inference, and posterior odds analysis, the approach is empirically validated using case-control study data. Results demonstrate that the framework effectively maps real-world privacy requirements to concrete ε values, achieving rigorous privacy guarantees while preserving analytical accuracy, thereby significantly enhancing the practicality and operational feasibility of ε selection.

This work addresses the problem of efficiently generating synthetic data under differential privacy for a given family of queries. By parameterizing the problem with the treewidth of the query family’s associated graph, the authors establish—for the first time—that the problem is fixed-parameter tractable. They propose a unified dynamic programming framework that integrates linear programming duality-based separation, subsampled private multiplicative weights, and Gibbs sampling techniques. This approach achieves theoretically optimal error rates across the full parameter regime, significantly enhancing both the scalability and practical utility of differentially private synthetic data generation.

This study investigates whether natural privacy filters can always be implemented without loss in adaptively composed differentially private mechanisms. By integrating frameworks from differential privacy, Rényi differential privacy, and Gaussian differential privacy, and by introducing the notions of privacy profiles and order-theoretic characterizations of mechanism composition, the work establishes—for the first time—that natural privacy filters are not universally "free." Lossless filtering is achievable only when the family of mechanisms exhibits a well-behaved order structure under composition. This result delineates the precise applicability boundary of natural privacy filters and provides a theoretical foundation for constructing adaptive compositions of privacy-preserving mechanisms that are both efficient and rigorously secure.