Pith. sign in

REVIEW 3 major objections 5 minor 25 references

Rao Differential Privacy

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Rao differential privacy defines privacy as a true distance between densities and makes sequential budgets compose in quadrature rather than by addition.

desk verdict A genuinely new geometric definition of privacy, but the advertised advantages over existing DP don't survive contact with adaptive composition or the post-processing proof. read the letter →

arxiv 2508.17135 v1 pith:ZELPV4FU submitted 2025-08-23 stat.ML cs.CRcs.ITcs.LGmath.IT

Carlos Soto This is my paper · ORCID
classification stat.MLcs.CRcs.ITcs.LGmath.IT MSC 62B1068P27
keywords RaodifferentialprivacyFisher–Raodistanceinformationgeometrysequentialcompositionpost-processingLaplacemechanismGaussiangeneralized
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Most differential privacy definitions measure how different a mechanism is from itself on adjacent datasets using a divergence such as Kullback–Leibler or Rényi. This paper replaces that divergence with a true distance between probability densities—the Rao distance, the shortest path under the Fisher information metric. A mechanism is θ-Rao private when that distance never exceeds θ for any adjacent datasets. The payoff is a sequential composition rule in which two budgets θ₁, θ₂ combine to sqrt(θ₁²+θ₂²) rather than θ₁+θ₂, and a post-processing guarantee that transformations of private outputs do not consume extra budget. The paper also derives the same noise calibrations as pure DP for the Laplace and Gaussian mechanisms, so the more favorable accounting is obtained without changing the mechanism.

What carries the argument

The Rao distance is the geodesic distance on the statistical manifold of a parametric density family, computed from the Fisher information matrix as the Riemannian metric. The argument leans on two structural facts: first, on a product of two manifolds the distance decomposes by the Pythagorean theorem, so the distance between product densities is sqrt(d₁²+d₂²), which directly produces the composition result; second, the square-root transformation p↦√p sends densities to the positive orthant of a unit sphere, where Rao distance equals 2 arccos⟨√p₁,√p₂⟩, and since L2 inner products are contractive under transformations, post-processing cannot increase the distance.

What would settle it

Take any two adjacent datasets and run two mechanisms where the second mechanism's noise distribution is chosen after seeing the first mechanism's output; compute the Rao distance between the joint densities. If the distance can exceed sqrt(θ₁²+θ₂²) for the individual budgets, the sequential-composition result does not extend to adaptive queries; if it never does, Rao DP achieves the same adaptive guarantee as Gaussian DP.

Watch

Extended reading notes

Core claim

Rao differential privacy is the paper's proposed definition: a random mechanism f_D satisfies θ-Rao DP if, for every pair of adjacent datasets D∼D', the Rao distance d_R(f_D, f_D') is at most θ. The central claim is that this metric-based definition preserves the standard interpretation of DP—the mechanism is not too different when one record is replaced—while improving the way privacy budgets accumulate. For independent mechanisms, the distance between product densities is the Euclidean combination of the marginal distances, giving total budget sqrt(θ₁²+θ₂²). The paper proves post-processing immunity via the square-root embedding of densities into the positive orthant of a sphere, where the

Load-bearing premise

The improved composition rule is proven for independent mechanisms whose joint output is a product density, and the Rao distance itself requires the two densities to share the same support and satisfy the usual Fisher-information regularity conditions.

Editorial extensions

If this is right

  • For two independent mechanisms with budgets θ₁ and θ₂, the combined budget is sqrt(θ₁²+θ₂²), which is strictly less than θ₁+θ₂ for any positive budgets; this gives sequentially tighter accounting than pure, approximate, KL, or Rényi DP.
  • Any deterministic post-processing of a Rao-private output remains θ-Rao private, so a data curator can transform estimates without spending additional budget.
  • The Laplace and Gaussian mechanisms, with their standard calibrations, satisfy θ-Rao DP with θ equal to the corresponding pure-DP ϵ or GDP µ, so existing deployments need no noise change to carry a Rao budget.
  • The generalized Gaussian mechanism satisfies θ-Rao DP with a scale parameter that must grow with the shape parameter N by a closed-form factor, keeping the mechanism private while preserving its flexibility.
  • Because Rao DP and GDP share the same composition rule, the paper suggests the two definitions may be measuring the same underlying indistinguishability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The composition proof covers independent mechanisms whose joint output is a product density; extending the Pythagorean rule to adaptively chosen mechanisms—where the second query's distribution depends on the first output—is a natural next step that the paper does not address.
  • Defining privacy by a metric rather than a divergence suggests that privacy budgets from different families of mechanisms could be compared by their actual distance in density space; for example, one could ask which of a Laplace and a Gaussian mechanism of equal Rao budget is closer to the unperturbed mechanism.
  • Because the Rao distance requires common support and smooth parametric densities, a direct extension to discrete distributions or to mechanisms with data-dependent support would require either a discrete analogue of the Fisher–Rao metric or an alternative distance; this is an explicit direction the paper flags.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript introduces 'Rao differential privacy' (θ-Rao DP), in which a mechanism f_D is private if the Fisher-Rao distance between the densities f_D and f_D' is at most θ for all adjacent datasets D, D'. The paper claims that this definition shares the interpretation of divergence-based differential privacy while providing a square-root composition rule (Lemma 3.2) and post-processing immunity (Theorem 3.3). It derives privacy parameters for the Laplace, Gaussian, and generalized Gaussian mechanisms with fixed scale, and compares the composition rule with existing definitions, noting the same rule as Gaussian DP.

Significance. If the main claims were fully established, the paper would contribute a geometrically motivated privacy definition with an elegant composition identity for independent mechanisms and exact Fisher-Rao distance computations for common mechanisms. The square-root embedding that links the Rao distance to the L2 inner product is a natural and potentially useful tool, and the closed-form distance formulas for Laplace and generalized Gaussian mechanisms are valuable. However, the advertised improvements over existing DP are not currently supported: the composition result covers only independent, non-adaptive mechanisms, and the post-processing proof contains an invalid equality. The practical advance over Gaussian DP is also not clearly demonstrated, since the Gaussian mechanism has the same privacy parameter and composition rule under GDP.

major comments (3)
  1. [§3.1, Lemma 3.2] The composition proof considers product manifolds and product densities f1,D × f2,D. This is the independent, non-adaptive case. Standard sequential composition in DP (e.g., Dwork et al., 2006; Dong et al., 2022) must also cover adaptive mechanisms, where the second mechanism's distribution can depend on the first output and the joint density is a conditional product f1(y1|D) f2(y2|y1,D), not a product density. The Fisher-Rao distance of such conditional product densities does not in general decompose via the Pythagorean identity, and the paper provides no argument that the square-root rule extends. Thus the central claim that Rao DP 'improves on sequential composition' is not established for the standard setting; the proven result is strictly weaker than the advertised sequential composition.
  2. [Appendix B, proof of Theorem 3.3] The post-processing proof is invalid. The first displayed equality, ∫_X φ(f(x;D)) + φ(f(x;D')) dx = ∫_{φ^{-1}(X)} f(x;D) + f(x;D') dx, is not a correct change-of-variables identity for an arbitrary map φ. The density of a transformed random variable is not obtained by pointwise evaluation φ(f(x)) without a Jacobian (and for non-injective maps, a more careful treatment is needed). Consequently, the subsequent manipulations do not establish d_R(φ(f_D), φ(f_D')) ≤ d_R(f_D, f_D'). The proof also treats only deterministic φ, while the theorem states an arbitrary random function. The post-processing property may be salvageable through the known monotonicity of the Fisher-Rao distance under Markov kernels, but the proof in the manuscript is not correct.
  3. [§4.1, §4.3, and Definition 4.11] The density formulas for the Laplace and generalized Gaussian mechanisms are stated as (2σ)^{-1} exp{|x−μ|/σ} and (2σΓ(1/N)/N)^{-1} exp{|x−μ|^N/σ}. Both are missing the negative sign in the exponent; as written they are not probability densities. This is a typographical issue in the displayed formulas, but it affects the formal statements of the mechanisms and should be corrected.
minor comments (5)
  1. [Abstract] Typo: 'Due to the this calibration' should be 'Due to this calibration'.
  2. [§3.2] The statement 'We have that ∫ dx (√p)^2 = 1 we see this transformation embeds the densities onto a the positive orthant of a sphere' has a grammatical issue and should be rewritten for clarity.
  3. [Appendix B] The notation ∫_X and ∫_{φ^{-1}(X)} is used inconsistently; the proof would benefit from a clearer statement of the domain and the change-of-variables assumptions.
  4. [§C.1] The final sentence, 'We suspect that due to the similarity in both privacy budgets and composition that GDP and Rao DP are measuring the same thing,' is speculative and not supported by the preceding arguments; it should be removed or clearly labeled as conjecture.
  5. [§5] The discussion claims that divergence-based DP definitions 'suffer from inflated budget composition' because divergences are approximately square roots of distances. This heuristic is not developed and should be stated more carefully or omitted.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the Rao-DP budget and mechanism parameters follow from the stated Riemannian distance definition and external closed-form Fisher–Rao computations; the sole self-citation is contextual and not load-bearing.

full rationale

The paper's central derivations are not circular. Definition 3.1 introduces Rao DP as a bound on the Fisher–Rao distance, and Lemma 3.2's composition rule is a direct application of the standard product-manifold distance identity d_R(f1×f2, g1×g2)^2 = d_R(f1,g1)^2 + d_R(f2,g2)^2; this is a theorem about the product metric, not an assumption equivalent to the desired budget addition. The mechanism calibrations (Theorems 4.4, 4.8, 4.12) are computed from closed-form Fisher–Rao distances for equal-scale location families, using the information matrix and a cited external source (Miyamoto et al. 2024); the inequalities σ ≥ Δ/θ (and the generalized-Gaussian analogue) are derived, not fitted to the target. Corollary 4.5 explicitly acknowledges that for a single Laplace query Rao DP with θ=ε is a reparameterization of pure DP, so there is no disguised renaming. The only self-citation, Reimherr et al. (2021), appears once in a contextual remark ('recent advances on DP for Riemmanian manifold') and is not used to justify Rao DP, its composition, or its mechanism parameters; it is therefore not load-bearing. The post-processing proof in Appendix B contains an invalid push-forward equality and would not establish Theorem 3.3 as written, but this is a correctness defect, not a circular reduction of the conclusion into the premises. Accordingly, no step in the claimed derivation chain is equivalent to its inputs by construction.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper rests on standard information-geometry assumptions plus two domain assumptions that are not justified: that a small Rao distance is itself a meaningful privacy guarantee, and that composition can be modeled by independent product densities. The broken post-processing proof introduces an additional ad hoc assumption that is not proven.

assumptions (4)
  • standard math Regularity conditions for the Fisher information matrix (support independent of θ, interchanging derivative/integral, SPD metric)
    Appendix A; used to define the Rao distance, the core of Definition 3.1.
  • domain assumption The Fisher-Rao distance is a meaningful measure of privacy loss under adjacent datasets
    Definition 3.1 simply asserts d_R(f_D, f_D') ≤ θ is privacy; no conversion to an indistinguishability or hypothesis-testing bound is given.
  • domain assumption Sequential composition corresponds to product densities and the product-manifold Pythagorean theorem
    Section 3.1; holds only for independent, non-adaptive mechanisms, not the full sequential composition typically required in DP.
  • ad hoc to paper The square-root embedding and L2 inner product relate the Rao distance to post-processing contraction
    Appendix B proof of Theorem 3.3 uses this, but the proof's algebra is wrong.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rao Differential Privacy." pith.science (2026). https://pith.science/paper/ZELPV4FU

@misc{pith2026250817135,
  author       = {Pith},
  title        = {Pith review of: Rao Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZELPV4FU}},
  note         = {Machine review of arXiv:2508.17135}
}
read the original abstract

Differential privacy (DP) has recently emerged as a definition of privacy to release private estimates. DP calibrates noise to be on the order of an individuals contribution. Due to the this calibration a private estimate obscures any individual while preserving the utility of the estimate. Since the original definition, many alternate definitions have been proposed. These alternates have been proposed for various reasons including improvements on composition results, relaxations, and formalizations. Nevertheless, thus far nearly all definitions of privacy have used a divergence of densities as the basis of the definition. In this paper we take an information geometry perspective towards differential privacy. Specifically, rather than define privacy via a divergence, we define privacy via the Rao distance. We show that our proposed definition of privacy shares the interpretation of previous definitions of privacy while improving on sequential composition.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 21 canonical work pages

  1. [1]

    J. M. Abowd. The us census bureau adopts differential privacy. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pages 2867--2867, 2018

    work page 2018

  2. [2]

    Amari and H

    S.-i. Amari and H. Nagaoka. Methods of information geometry, volume 191. American Mathematical Soc., 2000

    work page 2000

  3. [3]

    Atkinson and A

    C. Atkinson and A. F. Mitchell. Rao's distance measure. Sankhy \=a : The Indian Journal of Statistics, Series A , pages 345--365, 1981

    work page 1981

  4. [4]

    N. Ay, J. Jost, H. V \^a n L \^e , and L. Schwachh \"o fer. Information geometry, volume 64. Springer, 2017

    work page 2017

  5. [5]

    R. F. Barber and J. C. Duchi. Privacy and statistical risk: Formalisms and minimax bounds. arXiv preprint arXiv:1412.4451, 2014

    arXiv 2014

  6. [6]

    Bun and T

    M. Bun and T. Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of cryptography conference, pages 635--658. Springer, 2016

    work page 2016

  7. [7]

    S. I. Costa, S. A. Santos, and J. E. Strapasson. Fisher information distance: A geometrical reading. Discrete Applied Mathematics, 197: 0 59--69, 2015

    work page 2015

  8. [8]

    Cuff and L

    P. Cuff and L. Yu. Differential privacy as a mutual information constraint. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 43--54, 2016

    work page 2016

Show all 25 references
  1. [9]

    Desfontaines and B

    D. Desfontaines and B. Pej \'o . Sok: differential privacies. arXiv preprint arXiv:1906.01337, 2019

    1906 arXiv

  2. [10]

    M. P. Do Carmo. Riemannian geometry, volume 2. Springer, 1992

    1992

  3. [11]

    J. Dong, A. Roth, and W. J. Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84 0 (1): 0 3--37, 2022

    2022

  4. [12]

    Drechsler

    J. Drechsler. Differential privacy for government agencies—are we there yet? Journal of the American Statistical Association, 118 0 (541): 0 761--773, 2023

    2023

  5. [13]

    Dwork and G

    C. Dwork and G. N. Rothblum. Concentrated differential privacy. arXiv preprint arXiv:1603.01887, 2016

    2016 arXiv

  6. [14]

    Dwork, K

    C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, and M. Naor. Our data, ourselves: Privacy via distributed noise generation. In Advances in cryptology-EUROCRYPT 2006: 24th annual international conference on the theory and applications of cryptographic techniques, st. Petersbu...

    2006

  7. [15]

    Dwork, F

    C. Dwork, F. McSherry, K. Nissim, and A. Smith. Calibrating noise to sensitivity in private data analysis. In Theory of cryptography conference, pages 265--284. Springer, 2006 b

    2006

  8. [16]

    R. A. Fisher. On the mathematical foundations of theoretical statistics. Philosophical transactions of the Royal Society of London. Series A, containing papers of a mathematical or physical character, 222 0 (594-604): 0 309--368, 1922

    1922

  9. [17]

    J. M. Lee. Introduction to Riemannian manifolds, volume 2. Springer, 2018

    2018

  10. [18]

    F. Liu. Generalized gaussian mechanism for differential privacy. IEEE Transactions on Knowledge and Data Engineering, 31 0 (4): 0 747--756, 2018

    2018

  11. [19]

    I. Mironov. R \'e nyi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263--275. IEEE, 2017

    2017

  12. [20]

    H. K. Miyamoto, F. C. Meneghetti, J. Pinele, and S. I. Costa. On closed-form expressions for the fisher--rao distance. Information Geometry, 7 0 (2): 0 311--354, 2024

    2024

  13. [21]

    F. Nielsen. A simple approximation method for the fisher--rao distance between multivariate normal distributions. Entropy, 25 0 (4): 0 654, 2023

    2023

  14. [22]

    Pinele, J

    J. Pinele, J. E. Strapasson, and S. I. Costa. The fisher--rao distance between multivariate normal distributions: Special cases, bounds and applications. Entropy, 22 0 (4): 0 404, 2020

    2020

  15. [23]

    C. R. Rao et al. Information and the accuracy attainable in the estimation of statistical parameters. Bull. Calcutta Math. Soc, 37 0 (3): 0 81--91, 1945

    1945

  16. [24]

    Reimherr, K

    M. Reimherr, K. Bharath, and C. Soto. Differential privacy over riemannian manifolds. Advances in Neural Information Processing Systems, 34: 0 12292--12303, 2021

    2021

  17. [25]

    Wasserman and S

    L. Wasserman and S. Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association, 105 0 (489): 0 375--389, 2010

    2010

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.