{"id":"0c108253-66bc-43d6-a6a9-21e1e00b27eb","arxiv_id":"2607.04004","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"low","formal_verification":"none","parameter_count":2,"one_line_summary":"Agencies can set the DP privacy budget ε by specifying an odds-risk profile on posterior-to-posterior disclosure odds ratios and taking ε_min = (1/2) log of the tightest allowed multiplicative increase.","lead":"The paper gives a way to pick the differential-privacy budget ε by first stating how much an adversary’s posterior odds of learning a sensitive fact may rise, then converting those odds bounds into ε. Practitioners who find ε hard to interpret can instead work with odds-risk profiles that map more directly to disclosure risk.","discovery_kind":"extension","skeptic_critique":{"model":"grok-4.5","headline":"Assumption (7) is load-bearing for the R10-to-ε conversion; the bound fails when the adversary’s distribution over the rest of the sample depends on the target.","rationale":"The reader correctly isolates assumption (7) as the weakest link. Under that assumption the algebra is sound: the 2ε factor is the ordinary price of an attribute change under unbounded DP, the reduction to ε_min=(1/2)log(min B) follows at once from eq. 16, and Appendix A’s global bound on the single P2P risk is consistent. No deeper inconsistency appears. The concern is therefore one of scope (when the independence model is realistic) rather than internal correctness, which is already reflected in the CONDITIONAL verdict. A small finite-population calculation would quantify the degradation when (7) is dropped, but would not change the methodological contribution under the stated model.","tokens_in":12505,"tokens_out":593,"duration_ms":42122,"concrete_test":"In a toy population of N=20 binary records with known total sum S=5, draw SRS of size n=5, release Laplace-noised sample sum at ε=0.5, and for an adversary who knows S compute the exact posterior odds ratio R10 for a held-out target under the true sampling distribution. Check whether max(R10/P10) exceeds exp(1)≈2.7; if it does, the claimed guarantee fails under realistic dependence.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest claim equates R10 to the mechanism likelihood ratio times P10 (eq. 12) and then applies the exp(±2ε) envelope from the paraphrased Lemma 1. Both steps require assumption (7): P_M[Y_{-i}|I_i=1,Y_i=y]=P_M[Y_{-i}|I_i=0]. When this fails (fixed-size sampling, known population totals, or dependent records) the weights on the neighboring databases differ across the conditioning events Yi∈S versus Yi∉S, so the ratio of the resulting mixtures need not stay inside exp(±2ε). Consequently ε_min=(1/2)log min B may not enforce the agency’s desired profile R10≤B(P10)P10. The paper’s own case-control illustration already uses a fixed-number design that induces (weak) dependence, so the assumption is mildly violated in the running example.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper develops a method for choosing the pure-DP privacy budget ε by having an agency specify an odds risk profile B(P10) that upper-bounds the multiplicative inflation of an adversary’s posterior odds ratio R10 of learning that a target’s sensitive value lies in a disclosure set S, relative to the adversary’s prior odds ratio P10. Under an independence assumption on the rest of the sample (eq. 7) together with rational-adversary conditions (8)–(9), the authors show that any ε-DP release satisfies exp(-2ε)P10 ≤ R10 ≤ exp(2ε)P10; consequently the agency may safely release with ε_min = min_P10 (1/2)log B(P10). The approach is illustrated on a case-control design for Crohn’s disease, yielding a concrete recommendation near ε ≈ 0.35 for an example profile.","tokens_in":12770,"tokens_out":1231,"duration_ms":21423,"significance":"If the modeling assumptions hold, the framework supplies a transparent, practitioner-facing translation of ε into posterior-to-posterior odds ratios—the disclosure-risk measure advocated by Jarmin et al. (2023). It cleanly extends the posterior-to-prior risk-profile idea of Kazan & Reiter (2024) and the P2P analysis of Kifer et al. (2022) by introducing an explicit, agency-chosen function B that can be communicated to study participants. The derivation itself is parameter-free once B is fixed, and the case-control numbers give an immediately usable illustration. These features make the paper a useful contribution to the still-open problem of setting ε in applied DP releases.","major_comments":[{"comment":"Section 3, displayed equation (7) and the subsequent derivation of (12): the independence assumption P_M[Y_{-i}|I_i=1,Y_i=y]=P_M[Y_{-i}|I_i=0] is load-bearing for equating R10 to the mechanism likelihood ratio times P10 and therefore for the conversion ε_P10=(1/2)log B(P10) in (16). When the assumption fails (fixed-size sampling, known population totals, or dependent records) the mixture weights differ across the events Y_i∈S versus Y_i∉S, so the ratio of posteriors need not remain inside the exp(±2ε) envelope. The paper’s own case-control illustration (Section 4) uses a fixed total sample size 2n+1=1095 with a randomly chosen final case/control; this design induces precisely the weak dependence that violates (7). The authors should either (i) supply a quantitative sensitivity analysis showing that the violation is negligible for n≈500, (ii) replace the illustration with a design that sa","section":"Section 3, eqs. (7)–(16) and Section 4"},{"comment":"Section 4, paragraph beginning “According to the sampling design…”: the authors set q_i=0.5 by design and q_i^{(0)}=π≈0.00125, producing P10≈800, then invoke the profile B of (13) to obtain ε_800≈0.805. Because the same fixed-size design already violates the independence assumption used to justify the exp(±2ε) envelope, it is unclear whether the numerical recommendation ε_min≈0.347 actually enforces R10≤B(P10)P10 for the adversaries under consideration. A short Monte-Carlo check of the realized R10 under the true sampling distribution would resolve the issue.","section":"Section 4"}],"minor_comments":[{"comment":"Figure 1 caption and surrounding text: the piecewise definition of B(P10) in (13) is clear, but the figure itself is never described in the body; a one-sentence pointer (“the solid line in Figure 1”) would help readers locate the example profile.","section":"Section 3"},{"comment":"Page 8, after (16): the claim that the formulas “apply for any ε-DP algorithm and any function of D_obs” is true for the upper bound, yet the multivariate remark that follows (“use the selected ε_min as the total privacy budget”) deserves a short citation to the composition theorem so that non-specialists understand why the same ε can be spent across several statistics.","section":"Section 3"},{"comment":"Appendix A: the global bound exp(±2ε) on the single P2P risk R_i is derived without (7); a cross-reference from the main text noting that this bound remains available when independence fails would strengthen the practical guidance.","section":"Appendix A"},{"comment":"References: the arXiv identifier for Kifer et al. (2022) is given, but the published venue (if any) is omitted; likewise the full page range for Kazan & Reiter (2024) would aid readers.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a natural and useful sequel to the authors’ own Kazan & Reiter (NeurIPS 2024) paper; the incremental novelty relative to that work and to Kifer et al. is modest but still sufficient for a methods journal. The assumption-(7) gap is real yet easily repairable, so I expect a clean revision."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"This is a short, clean methods note that gives agencies a concrete way to turn an odds-risk profile into a pure-DP budget. The new piece is the construction itself: define B(P10) as the maximum tolerable multiplicative increase in the posterior odds ratio R10, then take ε_min = min (1/2) log B(P10). That is the direct P2P counterpart of the posterior-to-prior profiles in Kazan & Reiter (2024), and it is useful for people who prefer the Jarmin et al. framing.\n\nThe algebra is solid under the three modeling assumptions they state. From pure DP plus the rational-adversary conditions they get the exp(±2ε) envelope on the likelihood ratio, multiply by the prior odds P10, and invert. Equation (16) follows immediately. The case-control illustration is transparent: with their example B they land at ε ≈ 0.35, which is the kind of number a steward can actually discuss. Citations are appropriate; they correctly locate themselves relative to Kifer et al. and Lee & Clifton.\n\nThe soft spot is assumption (7)—adversary beliefs about the rest of the sample do not depend on the target’s presence or value. That factorization is load-bearing for equating R10 to the mechanism ratio times P10. It is mild in large independent samples and is already flagged by the authors, but it is violated (weakly) by the fixed-size case-control design they use as the running example. The global bound in the appendix still holds without (7), so the paper is not empty if the assumption fails; the profile-to-ε conversion just loses its guarantee. The hand-chosen B is also free, but that is intentional: it is an agency preference, not a fitted parameter.\n\nThis is for statistical disclosure control people and applied DP practitioners who already release statistics and want an interpretable knob. It does not open new theory, but it is honest, short, and usable. I would send it to peer review; a referee can ask them to stress the scope of (7) more prominently and to give a couple of default profiles. Worth engaging if you work on ε selection or risk communication.","headline":"Clean, usable P2P odds-profile recipe for pure-DP ε that is a direct analogue of Kazan & Reiter (2024); algebra holds under the stated assumptions, with the usual independence caveat.","tokens_in":13416,"tokens_out":584,"would_cite":true,"duration_ms":5582,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62A01","68P27"],"pacs":[],"model":"grok-4.5","headline":"An agency can set the differential-privacy budget ε by declaring how much any adversary’s posterior odds of learning a sensitive fact may grow, then taking the smallest ε that meets that bound for every possible prior odds.","keywords":["differential privacy","privacy budget","posterior-to-posterior risk","odds risk profile","case-control study","disclosure risk"],"falsifier":"Construct a small finite population with known population totals or dependent records, run a pure ε-DP mechanism, and check whether an adversary whose beliefs violate independence can still force the realized R10 above B(P10)·P10 for the ε chosen by the formula; if so the guarantee collapses.","tokens_in":13363,"feed_emoji":"🔒","tokens_out":817,"duration_ms":6354,"temperature":0.7,"pith_summary":"Choosing the privacy budget ε in differential privacy is hard because the number itself is hard to interpret and because smaller ε also hurts accuracy. This paper gives agencies a concrete way to choose it. First the agency writes down an “odds risk profile”: for every possible prior odds ratio an adversary might hold, it states the largest multiplicative increase in posterior odds of learning a sensitive attribute that it is willing to tolerate. Under a standard rational-adversary model the paper then proves that any ε-DP release multiplies those odds by at most exp(2ε). Consequently the agency simply takes ε equal to half the log of the smallest allowed multiplier in its profile. The resulting ε is guaranteed to keep every adversary’s posterior-to-posterior odds ratio inside the declared tolerance. The method is illustrated on a case-control study of Crohn’s disease, where a simple piecewise profile yields ε ≈ 0.35.","feed_headline":"Set ε by how much an adversary’s odds may grow","feed_subtitle":"Agencies declare a risk profile; the math returns the smallest safe privacy budget.","key_machinery":"The posterior-to-posterior odds ratio R10 = R1,i / R0,i. It equals the product of the DP likelihood ratio (bounded by exp(±2ε)) and the adversary’s prior odds ratio P10; the risk profile B(P10) then converts the inequality R10 ≤ B(P10)·P10 into an explicit upper bound on ε.","core_discovery":"Under the paper’s adversary model any pure ε-DP release multiplies an adversary’s prior odds ratio P10 by a factor lying between exp(-2ε) and exp(2ε). Therefore an agency that requires the posterior odds ratio R10 never to exceed B(P10)·P10 for a chosen function B can safely release data with ε_min = min over P10 of (1/2) log B(P10). That single number simultaneously satisfies the entire odds-risk profile.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["Set ε from bounds on adversary posterior odds","Convert odds-risk limits into a safe privacy budget","ε fixed by how far prior odds may stretch","Agencies map odds profiles to minimal ε-DP","Bound odds growth to choose the privacy budget"],"cache_read_input_tokens":128,"weakest_assumption_plain":"The adversary’s beliefs about everyone else in the sample are assumed independent of whether the target person is present and of that person’s value; if this fails the link between R10 and the DP likelihood ratio no longer holds.","fun_headline_variants_meta":{"raw":{"variants":["Set ε from bounds on adversary posterior odds","Convert odds-risk limits into a safe privacy budget","ε fixed by how far prior odds may stretch","Agencies map odds profiles to minimal ε-DP","Bound odds growth to choose the privacy budget"]},"model":"grok-4.5","effort":"low","cost_usd":0.005714,"raw_usage":{"total_tokens":1505,"prompt_tokens":733,"num_sources_used":0,"completion_tokens":73,"cost_in_usd_ticks":57140000,"prompt_tokens_details":{"text_tokens":733,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":699,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":733,"tokens_out":73,"duration_ms":5357,"temperature":1.0,"reasoning_tokens":699,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T22:22:18.430483+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Construct a small finite population with known population totals or dependent records, run a pure ε-DP mechanism, and check whether an adversary whose beliefs violate independence can still force the realized R10 above B(P10)·P10 for the ε chosen by the formula; if so the guarantee collapses.","supporting_citations":[],"review_version":1}