{"id":"2ef39d1f-64fa-4c98-8e2a-e54750f983c6","arxiv_id":"2508.17135","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Rao differential privacy replaces divergence-based privacy with the Fisher-Rao distance and derives a square-root composition rule, but its post-processing proof is flawed.","lead":"The paper introduces Rao differential privacy, defining privacy through the Fisher-Rao distance between distributions rather than a divergence, and claims tighter composition of privacy budgets. The composition math is correct for independent queries, but the post-processing proof contains errors and the definition lacks an operational privacy guarantee.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Composition result only covers independent, non-adaptive mechanisms; adaptive composition—the standard setting—is unproved, and the post-processing proof relies on a false equality.","rationale":"The reader's verdict is REJECT, and my analysis supports that conclusion. The central claim is that Rao DP 'shares the interpretation of previous definitions of privacy while improving on sequential composition.' The improvement is the sqrt composition rule, but the proof in Section 3.1 explicitly considers product densities, which correspond to independent mechanisms. Standard DP composition is adaptive: the second mechanism can depend on the first output. Without a proof for adaptive composition, the claimed improvement is not established for the standard setting. This is the most load-bearing concern because, as the paper concedes (Corollary 4.5), the single-query guarantee is a reparameterization; composition is the only substantive new benefit. The post-processing proof is also invalid, further weakening the paper, but the composition gap alone is sufficient to reject the central claim as written. I agree with the reader's identified weakest assumption, though I would emphasize the composition gap over the post-processing proof. A concrete computational check on a simple adaptive sequence would settle whether the sqrt rule extends; if it fails, the paper's main contribution collapses.","tokens_in":11849,"tokens_out":3885,"duration_ms":46795,"concrete_test":"Recompute Lemma 3.2 for an adaptive two-query composition: let M1(D) = h1(D) + Lap(1) and M2(y1,D) = h2(D) + Lap(1/(1+|y1|)) (or any conditional noise scale). Numerically evaluate the Fisher-Rao distance between the joint densities f_D(y1,y2) and f_{D'}(y1,y2) for an adjacent pair with h1, h2 sensitivities 1, and compare with sqrt(2) for θ1=θ2=1. If the distance exceeds sqrt(2), the claimed composition rule fails in the adaptive setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's only substantive improvement over prior DP definitions is the sqrt composition law (Lemma 3.2). The proof derives the distance between product densities f1,D × f2,D, i.e., independent, non-adaptive mechanisms. Standard sequential composition in DP (Dwork et al., 2006; Dong et al., 2022) must also cover mechanisms where the second query's distribution depends on the first output. For such adaptive sequences, the joint density is a conditional product f1(y1|D) f2(y2|y1,D), not a product density, and the Fisher-Rao distance does not in general decompose via Pythagoras. The paper gives no argument for this case, so the 'improved composition' claim is not established for the setting that matters. Moreover, the post-processing proof (Appendix B) uses a false equality: ∫ φ(f(x;D)) + φ(f(x;D')) dx = ∫_{φ^{-1}(X)} f(x;D)+f(x;D') dx is not a valid push-forward identity for an arbitrary φ, and the final '≤ θ' does not follow. Thus two of the three advertised properties rest on missing or invalid arguments.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript introduces 'Rao differential privacy' (θ-Rao DP), in which a mechanism f_D is private if the Fisher-Rao distance between the densities f_D and f_D' is at most θ for all adjacent datasets D, D'. The paper claims that this definition shares the interpretation of divergence-based differential privacy while providing a square-root composition rule (Lemma 3.2) and post-processing immunity (Theorem 3.3). It derives privacy parameters for the Laplace, Gaussian, and generalized Gaussian mechanisms with fixed scale, and compares the composition rule with existing definitions, noting the same rule as Gaussian DP.","tokens_in":12129,"tokens_out":6807,"duration_ms":74944,"significance":"If the main claims were fully established, the paper would contribute a geometrically motivated privacy definition with an elegant composition identity for independent mechanisms and exact Fisher-Rao distance computations for common mechanisms. The square-root embedding that links the Rao distance to the L2 inner product is a natural and potentially useful tool, and the closed-form distance formulas for Laplace and generalized Gaussian mechanisms are valuable. However, the advertised improvements over existing DP are not currently supported: the composition result covers only independent, non-adaptive mechanisms, and the post-processing proof contains an invalid equality. The practical advance over Gaussian DP is also not clearly demonstrated, since the Gaussian mechanism has the same privacy parameter and composition rule under GDP.","major_comments":[{"comment":"The composition proof considers product manifolds and product densities f1,D × f2,D. This is the independent, non-adaptive case. Standard sequential composition in DP (e.g., Dwork et al., 2006; Dong et al., 2022) must also cover adaptive mechanisms, where the second mechanism's distribution can depend on the first output and the joint density is a conditional product f1(y1|D) f2(y2|y1,D), not a product density. The Fisher-Rao distance of such conditional product densities does not in general decompose via the Pythagorean identity, and the paper provides no argument that the square-root rule extends. Thus the central claim that Rao DP 'improves on sequential composition' is not established for the standard setting; the proven result is strictly weaker than the advertised sequential composition.","section":"§3.1, Lemma 3.2"},{"comment":"The post-processing proof is invalid. The first displayed equality, ∫_X φ(f(x;D)) + φ(f(x;D')) dx = ∫_{φ^{-1}(X)} f(x;D) + f(x;D') dx, is not a correct change-of-variables identity for an arbitrary map φ. The density of a transformed random variable is not obtained by pointwise evaluation φ(f(x)) without a Jacobian (and for non-injective maps, a more careful treatment is needed). Consequently, the subsequent manipulations do not establish d_R(φ(f_D), φ(f_D')) ≤ d_R(f_D, f_D'). The proof also treats only deterministic φ, while the theorem states an arbitrary random function. The post-processing property may be salvageable through the known monotonicity of the Fisher-Rao distance under Markov kernels, but the proof in the manuscript is not correct.","section":"Appendix B, proof of Theorem 3.3"},{"comment":"The density formulas for the Laplace and generalized Gaussian mechanisms are stated as (2σ)^{-1} exp{|x−μ|/σ} and (2σΓ(1/N)/N)^{-1} exp{|x−μ|^N/σ}. Both are missing the negative sign in the exponent; as written they are not probability densities. This is a typographical issue in the displayed formulas, but it affects the formal statements of the mechanisms and should be corrected.","section":"§4.1, §4.3, and Definition 4.11"}],"minor_comments":[{"comment":"Typo: 'Due to the this calibration' should be 'Due to this calibration'.","section":"Abstract"},{"comment":"The statement 'We have that ∫ dx (√p)^2 = 1 we see this transformation embeds the densities onto a the positive orthant of a sphere' has a grammatical issue and should be rewritten for clarity.","section":"§3.2"},{"comment":"The notation ∫_X and ∫_{φ^{-1}(X)} is used inconsistently; the proof would benefit from a clearer statement of the domain and the change-of-variables assumptions.","section":"Appendix B"},{"comment":"The final sentence, 'We suspect that due to the similarity in both privacy budgets and composition that GDP and Rao DP are measuring the same thing,' is speculative and not supported by the preceding arguments; it should be removed or clearly labeled as conjecture.","section":"§C.1"},{"comment":"The discussion claims that divergence-based DP definitions 'suffer from inflated budget composition' because divergences are approximately square roots of distances. This heuristic is not developed and should be stated more carefully or omitted.","section":"§5"}],"recommendation":"reject","confidential_remarks":"The paper is not ready for publication in its current form. The two advertised foundational properties—improved sequential composition and post-processing immunity—are not established: composition is proven only for independent non-adaptive mechanisms, and the post-processing proof contains a false equality. These are load-bearing for the paper's central claim. A future version that narrows the composition claim to the independent case and supplies a correct post-processing argument (e.g., via monotonicity of the Fisher-Rao metric under Markov kernels) might be reconsidered, but as it stands the manuscript's main contributions are not supported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nWhat you should know: Rao DP is a real, new way to formulate privacy--via Fisher-Rao distance between mechanism densities--but the paper's two advertised selling points, tighter composition and post-processing immunity, are not established as written. The single-query results are honest but derivative, and the composition rule matches GDP.\n\nWhat's genuinely new: framing DP with a metric rather than a divergence. The Fisher information computations for Laplace, Gaussian, and generalized Gaussian appear correct. The paper explicitly concedes that for one query the Laplace mechanism just recovers epsilon-DP (Corollary 4.5), which is honest. The geometric motivation is clear and the writing is straightforward.\n\nSoft spots, in order:\n\n1. The composition lemma (Lemma 3.2) only covers independent, non-adaptive mechanisms: it computes the Rao distance between product densities. Standard sequential composition in DP must handle adaptive queries, where the second mechanism's distribution depends on the first output. The joint density is then a conditional product, not a product density, and the Pythagorean decomposition fails. The paper gives no argument for that case. So the headline claim \"improving on sequential composition\" is unproven in the setting that matters.\n\n2. The post-processing proof (Appendix B) contains a false equality: the integral of phi(f(x;D)) + phi(f(x;D')) over x is not equal to the integral of f over phi^{-1}(X); that is not a valid push-forward for arbitrary phi. The concluding bound does not follow as written. This might be repairable, but as it stands the theorem is unsupported.\n\n3. The novelty is thinner than the abstract suggests. The paper already notes the single-query guarantees reduce to a reparameterization, and the square-root composition law is the same as GDP's (Table 1, Section C.1). So the net new content is a geometric interpretation and a generalized Gaussian parameter; not nothing, but not a new privacy regime.\n\nMinor: the paper claims \"most, if not all\" previous definitions use divergences, then admits GDP doesn't. That is a framing slip.\n\nWho this is for: someone working on information geometry and DP might find the distance-based framing worth a look, but the results do not yet justify building on them.\n\nRecommendation: send to peer review. The flaws are specific and the authors should be given the chance to fix them; the definition deserves expert scrutiny, and a serious referee can pin down whether adaptive composition is even possible under this distance.","headline":"A genuinely new geometric definition of privacy, but the advertised advantages over existing DP don't survive contact with adaptive composition or the post-processing proof.","tokens_in":12537,"tokens_out":1758,"would_cite":false,"duration_ms":18133,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62B10","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"Rao differential privacy defines privacy as a true distance between densities and makes sequential budgets compose in quadrature rather than by addition.","keywords":["Rao differential privacy","Fisher–Rao distance","information geometry","sequential composition","post-processing","Laplace mechanism","Gaussian mechanism","generalized Gaussian mechanism"],"falsifier":"Take any two adjacent datasets and run two mechanisms where the second mechanism's noise distribution is chosen after seeing the first mechanism's output; compute the Rao distance between the joint densities. If the distance can exceed sqrt(θ₁²+θ₂²) for the individual budgets, the sequential-composition result does not extend to adaptive queries; if it never does, Rao DP achieves the same adaptive guarantee as Gaussian DP.","tokens_in":11778,"feed_emoji":"🔒","tokens_out":9222,"duration_ms":102386,"temperature":0.7,"pith_summary":"Most differential privacy definitions measure how different a mechanism is from itself on adjacent datasets using a divergence such as Kullback–Leibler or Rényi. This paper replaces that divergence with a true distance between probability densities—the Rao distance, the shortest path under the Fisher information metric. A mechanism is θ-Rao private when that distance never exceeds θ for any adjacent datasets. The payoff is a sequential composition rule in which two budgets θ₁, θ₂ combine to sqrt(θ₁²+θ₂²) rather than θ₁+θ₂, and a post-processing guarantee that transformations of private outputs do not consume extra budget. The paper also derives the same noise calibrations as pure DP for the Laplace and Gaussian mechanisms, so the more favorable accounting is obtained without changing the mechanism.","feed_headline":"Multi-query privacy budgets shrink from sums to square roots","feed_subtitle":"Rao differential privacy measures mechanism change as a distance, tightening the total budget for multiple queries.","key_machinery":"The Rao distance is the geodesic distance on the statistical manifold of a parametric density family, computed from the Fisher information matrix as the Riemannian metric. The argument leans on two structural facts: first, on a product of two manifolds the distance decomposes by the Pythagorean theorem, so the distance between product densities is sqrt(d₁²+d₂²), which directly produces the composition result; second, the square-root transformation p↦√p sends densities to the positive orthant of a unit sphere, where Rao distance equals 2 arccos⟨√p₁,√p₂⟩, and since L2 inner products are contractive under transformations, post-processing cannot increase the distance.","core_discovery":"Rao differential privacy is the paper's proposed definition: a random mechanism f_D satisfies θ-Rao DP if, for every pair of adjacent datasets D∼D', the Rao distance d_R(f_D, f_D') is at most θ. The central claim is that this metric-based definition preserves the standard interpretation of DP—the mechanism is not too different when one record is replaced—while improving the way privacy budgets accumulate. For independent mechanisms, the distance between product densities is the Euclidean combination of the marginal distances, giving total budget sqrt(θ₁²+θ₂²). The paper proves post-processing immunity via the square-root embedding of densities into the positive orthant of a sphere, where the","pith_inferences":["The composition proof covers independent mechanisms whose joint output is a product density; extending the Pythagorean rule to adaptively chosen mechanisms—where the second query's distribution depends on the first output—is a natural next step that the paper does not address.","Defining privacy by a metric rather than a divergence suggests that privacy budgets from different families of mechanisms could be compared by their actual distance in density space; for example, one could ask which of a Laplace and a Gaussian mechanism of equal Rao budget is closer to the unperturbed mechanism.","Because the Rao distance requires common support and smooth parametric densities, a direct extension to discrete distributions or to mechanisms with data-dependent support would require either a discrete analogue of the Fisher–Rao metric or an alternative distance; this is an explicit direction the paper flags."],"forward_implications":["For two independent mechanisms with budgets θ₁ and θ₂, the combined budget is sqrt(θ₁²+θ₂²), which is strictly less than θ₁+θ₂ for any positive budgets; this gives sequentially tighter accounting than pure, approximate, KL, or Rényi DP.","Any deterministic post-processing of a Rao-private output remains θ-Rao private, so a data curator can transform estimates without spending additional budget.","The Laplace and Gaussian mechanisms, with their standard calibrations, satisfy θ-Rao DP with θ equal to the corresponding pure-DP ϵ or GDP µ, so existing deployments need no noise change to carry a Rao budget.","The generalized Gaussian mechanism satisfies θ-Rao DP with a scale parameter that must grow with the shape parameter N by a closed-form factor, keeping the mechanism private while preserving its flexibility.","Because Rao DP and GDP share the same composition rule, the paper suggests the two definitions may be measuring the same underlying indistinguishability."],"supporting_citations":[{"why":"Introduces the information metric and distance that the paper adopts as its privacy measure.","marker":"Rao et al. [1945]"},{"why":"Defines pure differential privacy and the Laplace mechanism, the baseline definition and the first mechanism the paper reanalyzes.","marker":"Dwork et al. [2006b]"},{"why":"Defines approximate DP and the Gaussian mechanism, the second cornerstone mechanism compared under Rao DP.","marker":"Dwork et al. [2006a]"},{"why":"Supplies the zCDP definition and its composition, which appears in the comparison table.","marker":"Bun and Steinke [2016]"},{"why":"Defines Rényi DP and the link between pure DP and the Rényi divergence used for comparison.","marker":"Mironov [2017]"},{"why":"Defines Gaussian differential privacy, which shares Rao DP's Pythagorean composition and is the main comparison for the Gaussian mechanism.","marker":"Dong et al. [2022]"},{"why":"Provides the closed-form Fisher–Rao distances used to derive the privacy parameters for Laplace, Gaussian, and generalized Gaussian mechanisms.","marker":"Miyamoto et al. [2024]"},{"why":"Supplies the square-root transformation and spherical geometry used in the post-processing proof.","marker":"Amari and Nagaoka [2000]"},{"why":"Defines the generalized Gaussian mechanism whose privacy parameter is derived in the paper.","marker":"Liu [2018]"}],"fun_headline_variants":["Rao distance makes privacy budgets add in squares","Budgets shrink: Rao DP uses root-sum-square composition","Privacy via geometry: Rao DP tightens multi-query budgets","From divergence to distance: privacy budgets get smaller","Rao DP: Euclidean privacy budgets for tighter composition"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The improved composition rule is proven for independent mechanisms whose joint output is a product density, and the Rao distance itself requires the two densities to share the same support and satisfy the usual Fisher-information regularity conditions.","fun_headline_variants_meta":{"raw":{"variants":["Rao distance makes privacy budgets add in squares","Budgets shrink: Rao DP uses root-sum-square composition","Privacy via geometry: Rao DP tightens multi-query budgets","From divergence to distance: privacy budgets get smaller","Rao DP: Euclidean privacy budgets for tighter composition"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000311,"raw_usage":{"total_tokens":1560,"prompt_tokens":647,"completion_tokens":913,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":391,"completion_tokens_details":{"reasoning_tokens":836}},"tokens_in":391,"tokens_out":913,"duration_ms":10900,"temperature":1.0,"reasoning_tokens":836,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T16:59:10.137608+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take any two adjacent datasets and run two mechanisms where the second mechanism's noise distribution is chosen after seeing the first mechanism's output; compute the Rao distance between the joint densities. If the distance can exceed sqrt(θ₁²+θ₂²) for the individual budgets, the sequential-composition result does not extend to adaptive queries; if it never does, Rao DP achieves the same adaptive guarantee as Gaussian DP.","supporting_citations":[],"review_version":1}