Pith. sign in

REVIEW 2 major objections 4 minor 54 references

General-Purpose $f$-DP Estimation and Auditing in a Black-Box Setting

T0 review · 2 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read With only black-box access, the full f-DP trade-off curve can be estimated uniformly and privacy violations detected with statistical guarantees.

desk verdict Genuinely useful fixed-pair f-DP estimation and auditing, but the mechanism-level claims outrun the theorems because worst-case neighbor selection is explicitly left to heuristics. read the letter →

arxiv 2502.07066 v2 pith:FS5WDJ7Z submitted 2025-02-10 cs.CR math.STstat.MEstat.TH

Önder Askin (1) , Holger Dette (1) , Martin Dunsche (1) , Tim Kutta (2) , Yun Lu (3) , Yu Wei (4) , Vassilis Zikas (4) ((1) Ruhr-University Bochum , (2) Aarhus University
show 2 more authors
(3) University of Victoria (4) Georgia Institute of Technology)
This is my paper · ORCID
classification cs.CRmath.STstat.MEstat.TH MSC 68P2762G0762H3062F03
keywords f-DifferentialPrivacyblack-boxauditingtrade-offcurveestimationkerneldensityk-nearestneighborsNeyman-PearsontestviolationdetectionDP-SGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that f-Differential Privacy—a refinement of differential privacy that measures privacy by a trade-off curve between the type-I and type-II errors of distinguishing two neighboring datasets—can be estimated and audited from black-box access alone, with no knowledge of the mechanism's internals. Its estimator returns the entire optimal trade-off curve and, under smoothness assumptions on the output densities, converges uniformly to it as the sample size grows. Its auditor checks a claimed privacy curve against the estimated mechanism behavior and limits false alarms to a user-chosen level gamma, while detecting true violations asymptotically. The practical payoff is that privacy claims of mechanisms such as DP-SGD can be checked in minutes on a standard computer without mechanism-specific assumptions. If correct, the paper supplies a general statistical route to validating f-DP whenever only output samples are available.

What carries the argument

The load-bearing object is the perturbed likelihood-ratio test (PLRT), a Neyman-Pearson test that rejects $H_0$ when $\hat q(X)/\hat p(X) > \eta + hU$, with $U$ uniform on $[-1/2,1/2]$. Randomizing the threshold removes the need to know the level sets where the true density ratio equals $\eta$, so the test can be driven by black-box kernel density estimates, while its trade-off curve approaches the optimal Neyman-Pearson curve as $h$ drops to zero. The companion object is the BayBox estimator, which converts a single threshold $\eta$ into a point $(\alpha(\eta), \beta(\eta))$ on the trade-off curve by recognizing that these error probabilities equal the Bayes risk of a classification problem between $Q$ and the mixture $[P]_\eta$ ($P$ with probability $1/\eta$ and an absorbing state otherwise), then approximating the optimal classifier with $k$-NN and forming a confidence box of width $\sqrt{\log(4/\gamma)/(2n)}$. The auditor combines the two: the PLRT locates the maximum vulnerability of a claimed curve, and BayBox decides whether the confidence box at that point lies above the claimed curve.

What would settle it

Run the estimator on the same mechanism with two different neighboring pairs that have very different output separations. If the trade-off curve estimated from the more separated pair falls below the curve from the less separated pair by more than the uniform error bound allowed by Theorem 4.2, then the procedure is estimating the chosen pair's trade-off curve rather than the mechanism's true f-DP parameter, and the worst-case-pair premise fails.

Watch

Extended reading notes

Core claim

The paper claims to construct the first general-purpose f-DP estimator and auditor for the mechanism black-box setting. For a mechanism M and a chosen neighboring pair D,D', let T be the optimal trade-off function between the output distributions P=M(D) and Q=M(D'). The estimator feeds kernel density estimates of P and Q into a perturbed likelihood-ratio test whose threshold is randomized by a small uniform noise hU, producing a curve $\widehat T_h$ that converges uniformly to T (Theorem 4.2) once h tends to zero slowly enough relative to the density-estimation error ($h_n/a_n \to \infty$). The auditor first uses this curve to locate the point where a claimed curve $T^{(0)}$ is most violated, then evaluates that point with the BayBox estimator, which expresses the type-I and type-II error pair as the Bayes risk of a mixture classification problem and approximates it by k-nearest neighbors. Under a correct claim, the auditor's confidence box lies above the claimed curve with probability at least $1-\gamma$; under a true violation and strict convexity of T, the auditor detects it with probability tending to one as the sample sizes grow (Theorem 5.2).

Load-bearing premise

The load-bearing premise is that the user-chosen neighboring datasets D and D' are the worst-case pair for the mechanism, since the paper fixes that pair and leaves dataset selection to heuristics; if another pair separates the output distributions more, the estimated curve overstates privacy and the auditor can miss violations on that other pair.

Editorial extensions

If this is right

  • For any mechanism whose output densities are smooth, the full f-DP trade-off curve can be reconstructed from samples to arbitrarily small uniform error, with no knowledge of noise distributions, gradients, or training procedure.
  • An audit that returns 'no violation' is reliable in the frequentist sense: with a correct claim, the chance of a false alarm is at most the chosen gamma, even at finite sample sizes.
  • A genuinely over-optimistic privacy claim is eventually detected: as the sample sizes grow, the auditor's violation-detection probability converges to one, provided the true trade-off curve is strictly convex.
  • The procedures apply to standard building blocks (Gaussian, Laplace, subsampled Gaussian) and to trained models such as DP-SGD, with reported runtimes of tens of seconds to about two minutes for full-curve estimation.
  • Because the auditor is mechanism-agnostic, it can serve as a general check on implementations whose claimed f-DP guarantee would otherwise be taken on faith.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: an automated search over neighboring datasets, rather than the fixed heuristic pair, would turn the estimator into a true worst-case certificate; the paper itself leaves dataset selection as the unresolved part of the estimation task.
  • Editorial inference: because BayBox only needs a classifier whose error can be bounded, any classifier with a risk bound could replace k-NN while preserving the finite-sample false-alarm control, at the price of a less transparent confidence region.
  • Editorial inference: running the estimator on several candidate neighboring pairs and taking the lower envelope of their trade-off curves would give a conservative mechanism-wide privacy bound, at increased sampling cost.
  • Editorial inference: for high-dimensional outputs such as deep-network predictions, the kernel-density step forces reliance on a hand-picked one-dimensional score; a theory for score selection that minimizes the gap between black-box and white-box audits would be a natural next step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes black-box procedures for estimating and auditing f-Differential Privacy. The estimator in Section 4 uses kernel density estimates of the output distributions P=M(D) and Q=M(D') to construct a perturbed likelihood ratio test, and Theorem 4.2 establishes uniform convergence of the resulting curve estimate to the trade-off function T of the fixed pair (P,Q). The auditor in Section 5 first locates a maximum-vulnerability threshold eta* via the KDE-based curve, then uses a k-NN classifier in the BayBox algorithm to build a confidence box around the corresponding trade-off point, and declares a violation if the box lies entirely below the claimed curve, with guarantees in Theorem 5.2. Experiments cover Gaussian, Laplace, subsampled Gaussian, DP-SGD, and a CIFAR-10 Opacus model.

Significance. The paper makes a useful methodological contribution to black-box privacy auditing. It is mechanism-agnostic, provides formal non-asymptotic confidence guarantees for a fixed neighboring pair, reports reproducible experiments with public code, and the perturbed likelihood ratio test is a clean way to avoid exact level-set knowledge. The connection between f-DP trade-off points and Bayes classification problems is also of independent interest. However, the significance of the central 'general-purpose f-DP estimation' claim is currently limited by the fixed-pair scope and by a parameterization inconsistency in the auditor; the mechanism-level f-DP statement is not yet supported.

major comments (2)
  1. [Section 3, Definition 3, Theorems 4.2 and 5.2] The paper's headline claims are stronger than the theorems. Definition 3 defines f-DP by quantifying over all neighboring datasets D,D', but Section 3 explicitly splits the problem into (1) selecting D,D' and (2) estimating/auditing the trade-off curve for that choice, states that the paper 'focuses on task (2)', and delegates task (1) to 'simple heuristics' from prior work. Theorem 4.2, Proposition 4.3, and Theorem 5.2 therefore concern only the fixed pair (P,Q)=(M(D),M(D')); no result in the paper quantifies over all neighboring pairs. The abstract's 'complete estimate of the f-DP trade-off curve' and an auditor that 'detects f-DP violations with statistical certainty' are thus not established at the mechanism level: for a non-worst-case pair the estimated curve lies above the true f-DP parameter, and a 'No Violation' output from Algorithm 2 certifies only the chosen pair. The claims should be qualified, or a worst-case selection guarantee or explicit assumption about representativeness should be added.
  2. [Sections 4.1 and 5.1, Eq. (3), Algorithm 1, Lemma B.2, and the proof of Theorem 5.2] The threshold eta is used inconsistently. In Eq. (3) the PLRT estimator computes alphahat_h(eta) = integral (1/h) integral_{qhat/phat>eta+x} phat, so alphahat_h(eta) converges to the Neyman-Pearson type-I error for the likelihood-ratio threshold eta on q/p. In Lemma B.2 and Theorem 5.1, however, the BayBox estimator's alpha(eta) is defined as Pr_{X~P}[p(X)/q(X) <= eta], which for continuous distributions is the Neyman-Pearson type-I error at threshold 1/eta rather than eta. Algorithm 2 passes the PLRT maximizer eta* (line 3) to BayBox unchanged (line 4), so the confidence box is constructed at a different point of the trade-off curve than the one selected by Proposition 4.3. The proof of Theorem 5.2 part 2 uses the set Psi defined through alpha(eta) and then applies Theorem 5.1 to alphatilde(eta*), which is only valid under one of the two parameterizations. This needs to be fixed, e.g., by passing 1/eta* to BayBox or by redefining the PLRT threshold consistently.
minor comments (4)
  1. [Appendix A] Appendix A states 'The proofs can be found in an extended arxiv version', but Appendix B contains detailed proofs of the main results; this sentence should be removed or updated.
  2. [Algorithm 1] Algorithm 1 does not specify the split between the k-NN training sample and the n evaluation samples; the experimental section mentions separate training and testing sizes, so the pseudocode should be aligned with the experiments and with the independence assumptions in Theorem 5.1.
  3. [Section 8] Section 8 says replacing the k-NN classifier 'does not affect the theoretical guarantees provided in Theorem 5.2'; this is only true for the false-positive control in part 1, whereas part 2 relies on the k-NN convergence bound and would need a new argument for a different classifier.
  4. [Abstract] The phrase 'statistical certainty' is stronger than the asymptotic statement liminf Pr=1 in Theorem 5.2 part 2; consider wording such as 'with probability tending to 1'.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the f-DP estimator and auditor are grounded in independent Neyman-Pearson and k-NN convergence theory; only a minor non-load-bearing self-citation to Eureka appears.

full rationale

The derivation chain is self-contained at the level of the fixed neighboring pair (D,D'). Theorem 4.2 proves uniform consistency of the KDE-based perturbed LR estimator \hat T_h to the true trade-off curve T under Assumptions 1-2; the result depends on h, bandwidth, and density-estimator convergence, none of which are fitted to the target curve. Proposition 4.3 follows directly from the uniform convergence and the definition of \hat\eta^*, not from a fitted value. The auditor (Theorem 5.2) uses Hoeffding's inequality and the k-NN risk bound (Theorem 2.2) to build a confidence box; the connection between Bayes optimal classification and the trade-off point is proved in Lemma B.2, so the BayBox construction does not reduce to the self-cited Eureka framework [34] by assumption. The only self-citation with overlapping authors (Eureka, Ref. [34]) supplies the mixture-distribution idea, but the f-DP-specific reduction is established in this paper, making it non-load-bearing. The acknowledged scope limitation in Section 3 -- 'we focus on task (2)... selection of D,D' has been studied in the black-box setting and can typically be guided by simple heuristics' -- means the estimated/audited curve is for a user-chosen neighboring pair, not the worst-case pair over all neighbors; this can overstate privacy and is a correctness/scope risk, but it is not an equation-level circularity. No fitted constant is renamed as a prediction, and no theorem imports a conclusion from the paper's own assumptions by construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No new entities are introduced; the method combines known components such as KDE, k-NN classifiers, Bayes classifiers, and Neyman-Pearson tests. The perturbed LR test is a new test but not an invented entity. The main uncharged input is the worst-case dataset assumption plus the standard nonparametric regularity conditions.

free parameters (3)
  • perturbation width h = 0.1
    Introduced for the perturbed LR test; the consistency theorem requires h_n to go to 0 with h_n/a_n to infinity, but experiments fix h=0.1 without a sensitivity study or data-driven rule.
  • KDE bandwidth b = chosen by Sheather-Jones (data-dependent)
    Bandwidth for density estimators; the uniform convergence rate a_n in Assumption 2 depends on b, but no concrete rate is verified for the data-driven choice.
  • k-NN neighborhood size k = sqrt(n)
    Set by Theorem 2.2; this is theory-driven rather than fitted.
assumptions (5)
  • domain assumption Assumption 1: densities p,q are continuous and the level sets {q/p=eta} have positive probability for at most finitely many eta
    Used in Lemma 4.1 and Theorem 4.2 to make the perturbed LR test converge to the Neyman-Pearson test; excludes mechanisms with many density-ratio plateaus.
  • domain assumption Assumption 2: density estimators converge uniformly to p,q with rate a_n and h_n/a_n goes to infinity
    This imports uniform consistency of nonparametric density estimation as an unproved input; the paper does not establish the rate for the specific data-driven bandwidth used in experiments.
  • domain assumption Assumption 3: the optimal trade-off curve T is strictly convex
    Needed for part 2 of Theorem 5.2 to guarantee asymptotic detection of violations; the paper notes a partial relaxation but does not prove it.
  • ad hoc to paper The selected neighboring datasets D,D' are worst-case or representative for the mechanism's privacy
    The definition of f-DP requires a bound over all neighboring pairs, but the method only estimates the trade-off for one user-specified pair; Section 3 delegates selection to heuristics, so the true f-DP curve claim requires this unproven premise.
  • standard math Neyman-Pearson lemma and the k-NN risk convergence bound
    The auditor's confidence statements rely on Theorem 2.1 and Theorem 2.2, taken from the statistics literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of General-Purpose $f$-DP Estimation and Auditing in a Black-Box Setting." pith.science (2026). https://pith.science/paper/FS5WDJ7Z

@misc{pith2026250207066,
  author       = {Pith},
  title        = {Pith review of: General-Purpose $f$-DP Estimation and Auditing in a Black-Box Setting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FS5WDJ7Z}},
  note         = {Machine review of arXiv:2502.07066}
}
abstract

In this paper we propose new methods to statistically assess $f$-Differential Privacy ($f$-DP), a recent refinement of differential privacy (DP) that remedies certain weaknesses of standard DP (including tightness under algorithmic composition). A challenge when deploying differentially private mechanisms is that DP is hard to validate, especially in the black-box setting. This has led to numerous empirical methods for auditing standard DP, while $f$-DP remains less explored. We introduce new black-box methods for $f$-DP that, unlike existing approaches for this privacy notion, do not require prior knowledge of the investigated algorithm. Our procedure yields a complete estimate of the $f$-DP trade-off curve, with theoretical guarantees of convergence. Additionally, we propose an efficient auditing method that empirically detects $f$-DP violations with statistical certainty, merging techniques from non-parametric estimation and optimal classification theory. Through experiments on a range of DP mechanisms, we demonstrate the effectiveness of our estimation and auditing procedures.

Figures

Figures reproduced from arXiv: 2502.07066 by the authors.

Figure 1
Figure 1. MSE defined in (11) to empirically validate Theorem 4.2 for varying sample sizes n1 and over 1000 simulation runs each. Estimation The first goal of this work is estimation of the optimal trade-off curve T. In our experiments, we want to illustrate the uniform convergence of the estimator Tˆ h to the optimal curve T, derived in Theorem 4.2. There￾fore, we consider increasing sample sizes n1 to study the decreasing e… view at source ↗
Figure 2
Figure 2. Estimation of the Gaussian Trade-off curve [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Estimation of the DP-SGD Trade-off curve [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Auditing a correct Mechanism: Claimed curve T (0) = TGauss (a,b,c) and T (0) = TSGD (d,e,f). We depict the critical vertical line (obtained with step 3 in Algorithm 2) with intercept (αˆ(ηˆ ∗ ), ˆβ(ηˆ ∗ )), the k-NN point estimator ● (α˜(ηˆ ∗ ), ˜β(ηˆ ∗ )) and the conf…
Figure 5
Figure 5. Figure 5: Auditing a faulty Mechanism: Claimed Curve T (0) = TGauss (a,b,c) with µ = 0.5 and T (0) = TSGD (d,e,f) with τ = 5. Both mechanisms assume stronger privacy (µ = 0.5 < 1 and τ = 5 < 10). We depict the critical vertical line (obtained with step 3 in Algorithm 2) with int…
Figure 8
Figure 8. Figure 8: Comparison of theoretical ε and empirical lower bound for δ = 0.001. accurate models, on the other hand, allow for tighter esti￾mates an better auditing, as already highlighted in [38]. 7 Related Work In this section, we provide a more detailed overview of related work…
Figure 7
Figure 7. Figure 7: Algorithm 2 based on 1,000 models using the KL. T (0) is a gaussian trade-off curve with µ = 0.15. Decision: "Violation". theoretical ε. Interpretation of results: In [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 9
Figure 9. Figure 9: Estimation of the Laplace Trade-off curve [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Estimation of the Subsampling Trade-off curve [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: Empirical coverage probabilities for frequen￾tist and Bayesian intervals based on 105 simulation runs. B.4 Additional simulations We present some results that complement the main find￾ings in our experiment section. We use the same setup as described in our experiment…
Figure 12
Figure 12. Figure 12: Auditing a faulty Mechanism: Claimed Curve T (0) = TGauss with µ = 0.2, but in reality µ = 1. For (a),(b),(c) we consider n1 = 104 , and for (d),(e),(f) we have considered various sample sizes for the KDEs, respectively. Throughout the simulations we keep n2 = 104 fix…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 50 canonical work pages

  1. [1]

    ABOWD, J. M. The U.S. census bureau adopts differential pri- vacy. InKDD’18(2018), ACM, p. 2867

    work page 2018

  2. [2]

    ALTMAN, N. S. An introduction to kernel and nearest-neighbor nonparametric regression.The American Statistician 46, 3 (1992), 175–185

    work page 1992

  3. [3]

    ANNAMALAI, M. S. M. S., BALLE, B., CRISTOFARO, E. D., ANDHAYES, J. To shuffle or not to shuffle: Auditing DP-SGD with shuffling.arXiv:2411.10614(2024)

    arXiv 2024

  4. [4]

    ANNAMALAI, M. S. M. S.,ANDCRISTOFARO, E. D. Nearly tight black-box auditing of differentially private machine learn- ing. InAdvances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems, NeurIPS(2024)

    work page 2024

  5. [5]

    what do you want from theory alone?

    ANNAMALAI, M. S. M. S., GANEV, G.,ANDCRISTOFARO, E. D. "what do you want from theory alone?" experimenting with tight auditing of differentially private synthetic data generation. In33rd USENIX Security Symposium(2024)

    work page 2024

  6. [6]

    Statistical quantification of differential privacy: A local approach

    ASKIN, Ö., KUTTA, T.,ANDDETTE, H. Statistical quantification of differential privacy: A local approach. InSP’22(2022)

    work page 2022

  7. [7]

    Advanced probabilistic couplings for differen- tial privacy

    BARTHE, G., FONG, N., GABOARDI, M., GRÉGOIRE, B., HSU, J.,ANDSTRUB, P. Advanced probabilistic couplings for differen- tial privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS)(2016)

    work page 2016

  8. [8]

    BARTHE, G., GABOARDI, M., ARIAS, E. J. G., HSU, J., KUNZ, C.,ANDSTRUB, P. Proving differential privacy in hoare logic. InIEEE 27th Computer Security Foundations Symposium (CSF) (2014)

    work page 2014

Show all 54 references
  1. [9]

    BARTHE, G., GABOARDI, M., ARIAS, E. J. G., HSU, J., ROTH, A.,ANDSTRUB, P. Higher-order approximate relational refine- ment types for mechanism design and differential privacy. In Proceedings of the 42nd Annual ACM SIGPLAN-SIGACT Sympo- sium on Principles of Programming Languag...

    2015 doi

  2. [10]

    Proving differential privacy via probabilistic couplings

    BARTHE, G., GABOARDI, M., GRÉGOIRE, B., HSU, J.,AND STRUB, P. Proving differential privacy via probabilistic couplings. InProceedings of the 31st Annual ACM/IEEE Symposium on Logic in Computer Science (LICS)(2016)

    2016

  3. [11]

    BARTHE, G., KÖPF, B., OLMEDO, F.,ANDBÉGUELIN, S. Z. Probabilistic relational reasoning for differential privacy. InPro- ceedings of the 39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL)(2012)

    2012

  4. [12]

    Dp-finder: Finding differential privacy violations by sampling and optimization

    BICHSEL, B., GEHR, T., DRACHSLER-COHEN, D., TSANKOV, P.,ANDVECHEV, M. Dp-finder: Finding differential privacy violations by sampling and optimization. InCCS’18(2018)

    2018

  5. [13]

    BICHSEL, B., STEFFEN, S., BOGUNOVIC, I.,ANDVECHEV, M. T. Dp-sniper: Black-box discovery of differential privacy violations using classifiers. InSP’21(2021)

    2021

  6. [14]

    Prentice Hall, 2001

    BICKEL, P.,ANDDOKSUM, K.Mathematical Statistics: Basic Ideas and Selected Topics. Prentice Hall, 2001

    2001

  7. [15]

    Membership inference attacks from first prin- ciples

    CARLINI, N., CHIEN, S., NASR, M., SONG, S., TERZIS, A., ANDTRAMÈR, F. Membership inference attacks from first prin- ciples. In43rd IEEE Symposium on Security and Privacy, (SP) (2022)

    2022

  8. [16]

    P., VISWANATHAN, M.,AND BHUSAL, B

    CHADHA, R., SISTLA, A. P., VISWANATHAN, M.,AND BHUSAL, B. Deciding differential privacy of online algorithms with multiple variables. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS) (2023)

    2023

  9. [17]

    31 ofStochastic Modelling and Applied Probability

    DEVROYE, L., GYÖRFI, L.,ANDLUGOSI, G.A Probabilistic Theory of Pattern Recognition, vol. 31 ofStochastic Modelling and Applied Probability. Springer, 1996

    1996

  10. [18]

    Detecting violations of differential privacy

    DING, Z., WANG, Y., WANG, G., ZHANG, D.,ANDKIFER, D. Detecting violations of differential privacy. InCCS’18(2018)

    2018

  11. [19]

    DONG, J., ROTH, A.,ANDSU, W. J. Gaussian differential pri- vacy.Journal of the Royal Statistical Society Series B: Statistical Methodology 84(2022)

    2022

  12. [20]

    Differential privacy

    DWORK, C. Differential privacy. InAutomata, Languages and Programming, 33rd International Colloquium (ICALP)(2006), Lecture Notes in Computer Science, Springer

    2006

  13. [21]

    RAPPOR: randomized aggregatable privacy-preserving ordinal response

    ERLINGSSON, Ú., PIHUR, V.,ANDKOROLOVA, A. RAPPOR: randomized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS)(2014)

    2014

  14. [22]

    On the (im)possibility of estimating var- ious notions of differential privacy

    GORLA, D., JALOUZOT, L., GRANESE, F., PALAMIDESSI, C., ANDPIANTANIDA, P. On the (im)possibility of estimating var- ious notions of differential privacy. InProceedings of the 24th Italian Conference on Theoretical Computer Science (ICTCS 2023)(Palermo, Italy, 2023), vol. 3587 o...

    2023

  15. [23]

    R., MILLMAN, K

    HARRIS, C. R., MILLMAN, K. J.,VAN DERWALT, S. J., GOM- MERS, R., VIRTANEN, P., COURNAPEAU, D., WIESER, E., TAY- LOR, J., BERG, S., SMITH, N. J., KERN, R., PICUS, M., HOYER, S.,VANKERKWIJK, M. H., BRETT, M., HALDANE, A., FER- NÁNDEZ DELRÍO, J., WIEBE, M., PETERSON, P., GÉRARD- ...

    2020

  16. [24]

    M.,ANDLEV- ACHER, K

    HOLOHAN, N., BRAGHIN, S., AONGHUSA, P. M.,ANDLEV- ACHER, K. Diffprivlib: The ibm differential privacy library, 2019

    2019

  17. [25]

    R.,ANDOPREA, A

    JAGIELSKI, M., ULLMAN, J. R.,ANDOPREA, A. Auditing differentially private machine learning: How private is private sgd? InAdvances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, v...

    2020

  18. [26]

    Uniform convergence rates for kernel density esti- mation

    JIANG, H. Uniform convergence rates for kernel density esti- mation. InProceedings of the 34th International Conference on Machine Learning (ICML)(2017)

    2017

  19. [27]

    Fix prng key reuse in differential privacy example,

    JOHNSON, M. Fix prng key reuse in differential privacy example,

  20. [28]

    R package version 1.2.18

    KLAUS, B.,ANDSTRIMMER, K.fdrtool: Estimation of (Local) False Discovery Rates and Higher Criticism, 2024. R package version 1.2.18

    2024

  21. [29]

    Dp-auditorium: A large-scale library for auditing differential privacy

    KONG, W., MUÑOZMEDINA, A., RIBERO, M.,ANDSYED, U. Dp-auditorium: A large-scale library for auditing differential privacy. InIEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024(2024), IEEE, pp. 110– 126

    2024

  22. [30]

    Auditing differential privacy guarantees using density estimation.arXiv preprint 2406.04827v3(2024)

    KOSKELA, A.,ANDMOHAMMADI, J. Auditing differential privacy guarantees using density estimation.arXiv preprint 2406.04827v3(2024)

    2024

  23. [31]

    Lower bounds for rényi differential privacy in a black-box setting

    KUTTA, T., ASKIN, Ö.,ANDDUNSCHE, M. Lower bounds for rényi differential privacy in a black-box setting. InIEEE Symposium on Security and Privacy, SP, San Francisco, CA, USA, May 19-23(2024)

    2024

  24. [32]

    Minimax optimal estimation of ap- proximate differential privacy on neighboring databases

    LIU, X.,ANDOH, S. Minimax optimal estimation of ap- proximate differential privacy on neighboring databases. In NeurIPS’19(2019)

    2019

  25. [33]

    I.,ANDVECHEV, M

    LOKNA, J., PARADIS, A., DIMITROV, D. I.,ANDVECHEV, M. T. Group and attack: Auditing differential privacy. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Commu- nications Security (CCS)(2023)

    2023

  26. [34]

    Eureka: A general framework for black-box differential privacy estimators

    LU, Y., MAGDON-ISMAIL, M., WEI, Y.,ANDZIKAS, V. Eureka: A general framework for black-box differential privacy estimators. InSP’24(2024)

    2024

  27. [35]

    Understanding the sparse vector technique for differential privacy.Proceedings of the VLDB Endowment 10, 6 (2017)

    LYU, M., SU, D.,ANDLI, N. Understanding the sparse vector technique for differential privacy.Proceedings of the VLDB Endowment 10, 6 (2017)

    2017

  28. [36]

    Au- diting f -differential privacy in one run.arXiv preprint arXiv:2410.22235(2024)

    MAHLOUJIFAR, S., MELIS, L.,ANDCHAUDHURI, K. Au- diting f -differential privacy in one run.arXiv preprint arXiv:2410.22235(2024)

    2024 arXiv

  29. [37]

    On significance of the least significant bits for differential privacy

    MIRONOV, I. On significance of the least significant bits for differential privacy. Inthe ACM Conference on Computer and Communications Security (CCS)(2012)

    2012

  30. [38]

    Tight auditing of differentially private machine learning

    NASR, M., HAYES, J., STEINKE, T., BALLE, B., TRAMÈR, F., JAGIELSKI, M., CARLINI, N.,ANDTERZIS, A. Tight auditing of differentially private machine learning. In32nd USENIX Security Symposium (USENIX Security 23)(2023)

    2023

  31. [39]

    NEYMAN, J.,ANDPEARSON, E. S. Ix. on the problem of the most efficient tests of statistical hypotheses.Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character 231, 694-706 (1933), 289–337

    1933

  32. [40]

    Scikit-learn: Machine learning in python.Journal of machine learning research 12, Oct (2011), 2825–2830

    PEDREGOSA, F., VAROQUAUX, G., GRAMFORT, A., MICHEL, V., THIRION, B., GRISEL, O., BLONDEL, M., PRETTENHOFER, P., WEISS, R., DUBOURG, V.,ET AL. Scikit-learn: Machine learning in python.Journal of machine learning research 12, Oct (2011), 2825–2830

    2011

  33. [41]

    W.Multivariate Density Estimation: Theory, Prac- tice, and Visualization, 2nd ed

    SCOTT, D. W.Multivariate Density Estimation: Theory, Prac- tice, and Visualization, 2nd ed. Wiley Series in Probability and Statistics. Wiley, 2015

    2015

  34. [42]

    J.,ANDJONES, M

    SHEATHER, S. J.,ANDJONES, M. C. A reliable data-based bandwidth selection method for kernel density estimation.Jour- nal of the Royal Statistical Society. Series B (Methodological) 53, 3 (1991), 683–690

    1991

  35. [43]

    Privacy auditing with one (1) training run

    STEINKE, T., NASR, M.,ANDJAGIELSKI, M. Privacy auditing with one (1) training run. InAdvances in Neural Information Pro- cessing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023(2023)

    2023

  36. [44]

    C., KAYNAR, D

    TSCHANTZ, M. C., KAYNAR, D. K.,ANDDATTA, A. For- mal verification of differential privacy for interactive systems (extended abstract). InTwenty-seventh Conference on the Mathe- matical Foundations of Programming Semantics (MFPS)(2011), Electronic Notes in Theoretical Computer Science

    2011

  37. [45]

    W.,ANDWELLNER, J

    VAN DERVAART, A. W.,ANDWELLNER, J. A.Weak Conver- gence and Empirical Processes. With Applications to Statistics. Springer Series in Statistics., New York, 1996

    1996

  38. [46]

    E., HABERLAND, M., REDDY, T., COURNAPEAU, D., BUROVSKI, E., PETERSON, P., WECKESSER, W., BRIGHT, J.,VAN DERWALT, S

    VIRTANEN, P., GOMMERS, R., OLIPHANT, T. E., HABERLAND, M., REDDY, T., COURNAPEAU, D., BUROVSKI, E., PETERSON, P., WECKESSER, W., BRIGHT, J.,VAN DERWALT, S. J., BRETT, M., WILSON, J., MILLMAN, K. J., MAYOROV, N., NELSON, A. R. J., JONES, E., KERN, R., LARSON, E., CAREY, C. J., ...

    2020

  39. [47]

    R package version 2.23-26

    WAND, M.KernSmooth: Functions for Kernel Smoothing Sup- porting Wand & Jones (1995), 2025. R package version 2.23-26

    1995

  40. [48]

    Checkdp: An automated and integrated approach for proving differential privacy or finding precise counterexamples

    WANG, Y., DING, Z., KIFER, D.,ANDZHANG, D. Checkdp: An automated and integrated approach for proving differential privacy or finding precise counterexamples. InCCS’20(2020)

    2020

  41. [49]

    Proving differential privacy with shadow execution

    WANG, Y., DING, Z., WANG, G., KIFER, D.,ANDZHANG, D. Proving differential privacy with shadow execution. InProceed- ings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI)(2019)

    2019

  42. [50]

    Opacus: User-friendly differ- ential privacy library in pytorch.arXiv preprint arXiv:2109.12298 (2021)

    YOUSEFPOUR, A., SHILOV, I., SABLAYROLLES, A., TESTUG- GINE, D., PRASAD, K., MALEK, M., NGUYEN, J., GHOSH, S., BHARADWAJ, A., ZHAO, J.,ET AL. Opacus: User-friendly differ- ential privacy library in pytorch.arXiv preprint arXiv:2109.12298 (2021)

    2021 arXiv

  43. [51]

    Bayesian estimation of differential privacy

    ZANELLA-BÉGUELIN, S., WUTSCHITZ, L., TOPLE, S., SALEM, A., RÜHLE, V., PAVERD, A., NASERI, M., KÖPF, B.,AND JONES, D. Bayesian estimation of differential privacy. InPro- ceedings of the 40th International Conference on Machine Learn- ing (ICML)(2023)

    2023

  44. [52]

    Violation

    ZHANG, D.,ANDKIFER, D. Lightdp: towards automating differ- ential privacy proofs. InProceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages (POPL) (2017). A Appendix The appendix is dedicated to the technical details of our results. The proofs can ...

    2017

  45. [54]

    | ˜α(η)−α(η) | > s 1 2n ln 4 γ # =Pr

    and we can define the type-I-error α of the Neyman- Pearson test as α= Z p·I{q/p>η}. In this case, we want to show that Z x∈[−h/2,h/2] 1 h Z ˆq/ˆp>η+x ˆp = Z Z x∈[−h/2,h/2] ˆp1 h I{ˆq/ˆp>η+x}=: Z ˆg → Z q/p>η p= Z p·I{q/p>η}=: Z g. Here we have defined the functions g,ˆgin the...

  46. [2023]

    GitHub Pull Request #3646, [Accessed 08-Jan-2024]

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.