Pith. sign in

REVIEW 3 major objections 5 minor 64 references

Managing Correlations in Data and Privacy Demand

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that the usual heterogeneous differential privacy framework can silently leak data whenever users' privacy choices are correlated with their data, and that the fix is to redefine neighboring datasets as add/remove operation

desk verdict A sound extension of heterogeneous DP that fixes a real gap—correlated data and privacy demand—but carries some rough edges in examples and reproducibility. read the letter →

arxiv 2509.02856 v1 pith:XY3LBADZ submitted 2025-09-02 cs.CR cs.LG

Syomantak Chaudhuri , Thomas A. Courtade This is my paper · ORCID
classification cs.CRcs.LG MSC 68P27
keywords differentialprivacyheterogeneouspersonalizeddata-privacycorrelationadd-removeneighborshypothesistestingmeanestimationlinearregression
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that heterogeneous differential privacy (HDP), as usually defined, gives no real privacy when the data a user shares is correlated with the privacy level that user demands. The reason is that HDP treats two datasets as neighbors only when one user's data changes while that user's privacy level stays fixed; under correlation, such neighbor pairs can be absent, so a dataset can be uniquely identifiable. The paper's fix, add-remove heterogeneous differential privacy (AHDP), makes neighboring datasets differ by adding or removing one (data, privacy demand) tuple, and certifies the mechanism only if the per-tuple privacy budget stays below the user's demanded $\epsilon$. This restores worst-case meaning: an adversary who knows the possible correlations still cannot distinguish the dataset from one that adds or removes a tuple, and the guarantee is expressed cleanly through hypothesis-testing bounds on adversarial power. A sympathetic reader would care because HDP is the framework used in personalized-privacy and data-auction work, where the independence assumption has been a convenience rather than a deliberate design.

What carries the argument

The load-bearing object is the (data, privacy demand) tuple and the correlation-support set $W \subseteq X \times \mathbb{R}_{\ge 0}$. AHDP defines privacy through the add-remove distance $d_\alpha(D,D') = \sum_{(x,\epsilon) \in W} \alpha(x,\epsilon) |h_D(x,\epsilon) - h_{D'}(x,\epsilon)|$; a mechanism is $W$-AHDP when $\alpha(x,\epsilon) \leq \epsilon$, meaning the effective privacy guarantee for a tuple never exceeds what the user demanded. This distance turns the set of possible tuples into a graph and makes adding or removing any tuple the primitive privacy event, so a high-privacy tuple ($\epsilon$ near 0) cannot silently be distinguished from an absent one. The universal mechanisms additionally use a bounded weighting functio

What would settle it

Run a membership-inference test on a correlated dataset with $W$ known to the adversary: for example, $W = \{(1,0),(0,\infty)\}$ with all users at $(1,0)$, and a standard HDP mechanism that outputs the privacy-demand vector. The paper predicts the adversary can recover the dataset (power near 1) under standard HDP, while a $W$-AHDP mechanism on the same output must make the two hypotheses $\{D_0\}$ and $\{D_0 + (1,0)\}$ statistically indistinguishable with power at most $1/(1+e^0)=1/2$; the same experiment with $W$ hidden should show the leak disappears.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that standard heterogeneous DP, defined with swap neighbors over data while holding each user's privacy level fixed, fails under data-privacy correlations, and that the right replacement is AHDP. In AHDP, datapoints are tuples $(x, \epsilon)$, the domain $W$ of possible tuples is the model of correlation, and the privacy guarantee is that for every pair of datasets, the log-ratio of output probabilities is bounded by a weighted add-remove distance. The framework then yields concrete guarantees: for any $W$-AHDP mechanism and an adversary who knows $W$ and observes part of the dataset, the maximum probability of recovering the hidden data is bounded by ex

Load-bearing premise

The negative result against the old HDP definition and the advertised guarantees of AHDP assume an adversary who knows the set of possible (data, privacy-demand) pairs; if the adversary does not know that set, publishing privacy demands does not obviously leak data, and the paper's threat-model bounds do not apply.

Editorial extensions

If this is right

  • If AHDP is adopted, personalized-privacy mechanisms no longer need to assume data and privacy demand are independent; the same mechanism can be certified against any finite correlation support W.
  • Privacy demand itself must be treated as sensitive: mechanisms that merely publish epsilon values satisfy the old HDP definition but can be rejected by AHDP, since epsilon values correlate with data.
  • For any W-AHDP mechanism, an adversary with full knowledge of W, the mechanism, and part of the dataset has bounded identification power; for a single missing tuple the bound is 1/(1 + e^{-epsilon}) in the two-hypothesis model and 1/(1 + sum_{(x,epsilon) in W_o} e^{-epsilon}) in the one-tuple-hiding model.
  • Correlation-agnostic (universal) AHDP mechanisms exist: weighted linear queries with Laplace noise and the sampling mechanism, with simple implementations for sum, mean, frequency, and linear regression; no unbiased universal AHDP estimator exists for general linear statistics, but bias can be controlled, for example the asymptotic bias has a covariance term Cov(X, alpha(X,epsilon)) / E[alpha(X,ep
  • Basic sequential composition and post-processing hold for AHDP, so mechanisms can be built modularly and certified at the end.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's threat model assumes an adversary knows W, the support of possible (data, privacy-demand) pairs. If that knowledge is absent, publishing epsilon values is not automatically a data leak; the practical takeaway is that the public design of privacy menus must itself be treated as part of the privacy budget.
  • The same add-remove tuple perspective could be tested in a local-DP variant where users never reveal epsilon to the server, but the paper notes this makes it hard for the server to judge data quality; one could experiment with public sampling probabilities as a compromise.
  • The asymptotic bias formula suggests a concrete tuning rule: choose alpha(x,epsilon) to satisfy privacy while minimizing Cov(X, alpha(X,epsilon)) / E[alpha(X,epsilon)]; on a given dataset one can estimate this ratio and select among alpha functions by a bias-variance trade-off, which the experiments only begin to map.
  • A natural extension the authors leave implicit is to (epsilon,delta)-relaxations of AHDP and to use the hypothesis-testing power bounds as a membership-inference benchmark against real-world datasets, which they list as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies heterogeneous differential privacy (HDP) when a user's data and privacy demand may be correlated. It argues that the conventional HDP definition (Definition 2), which treats datasets as neighboring if a single user's data changes while their privacy level is fixed, fails to provide meaningful protection under such correlations (Section 2.4). The paper introduces Add-remove Heterogeneous Differential Privacy (AHDP, Definition 3), in which neighboring datasets differ by adding or removing a (data, privacy-demand) tuple, and the privacy loss is governed by a function alpha on the support W of such tuples. It proves composition and post-processing (Propositions 1--2), gives a hypothesis-testing characterization (Proposition 3), derives adversarial power bounds for AHDP and homogeneous DP (Propositions 4--7), and constructs universal AHDP mechanisms that do not require knowledge of W: the Sampling Mechanism (Section 5.1), linear-query mechanisms (Proposition 9), a mean-estimation mechanism (Proposition 10), and a linear-regression mechanism (Mechanism 1). Experiments on LLM-generated synthetic data compare these mechanisms for mean estimation, frequency estimation, and regression.

Significance. If correct, AHDP is a useful contribution: it moves the neighboring-dataset relation to the joint data--privacy tuple, preventing the privacy demand itself from acting as a covert data channel. The hypothesis-testing interpretation (Section 4) is a clean unifying tool, and the power bounds give concrete statements about adversarial inference. The existence of universal AHDP mechanisms is the strongest part of the paper; in particular, the Sampling Mechanism is proved in Appendix F and is correlation-agnostic in a practical sense. The paper also releases its synthetic datasets. The main technical gaps (the ill-defined Example 1, the unproved Proposition 10, and the degenerate count case in Proposition 9) are localized and fixable; they do not appear to invalidate the AHDP definition itself.

major comments (3)
  1. [Section 2.4, Example 1] The mechanism in Example 1 is not well-defined for the very dataset used to make the point. When all users have eps_i=0, we have ||eps||_1=0, so the term <eps,x>/||eps||_1 and the Laplace scale 1/||eps||_1 involve division by zero. The coupling also contains the tuple (0,∞), which requires arithmetic with infinity (e.g., ∞·0) that is not defined in the notation of Section 2.1. The subsequent deterministic example (outputting the privacy-demand vector) is a valid illustration of the failure, but Example 1 should be repaired or replaced, since it is presented as the primary demonstration of the central negative result.
  2. [Section 5.2, Proposition 10] The mean-estimation mechanism is asserted to be (α1+α2)-AHDP, but no proof is given. Appendix H proves the frequency-estimation mechanism, not Proposition 10, and the text does not reduce the claim to Proposition 9 or to composition. Since mean estimation is a headline application in the abstract and contributions, a proof (or a precise derivation) must be supplied.
  3. [Section 5.2, Proposition 9] The statement that count estimation 'immediately follows' by taking f(x)=1 is incorrect. For f≡1, l=h=1, so the Laplace scale h-l is zero and the proof divides by h-l; the proposed mechanism degenerates to the constant 1 and does not estimate the count. This should be corrected explicitly, for instance by excluding the degenerate f≡1 case or by using the Sampling Mechanism for count estimation.
minor comments (5)
  1. [Section 6, Figures 6, 8, 9] The experimental comparisons report only means or medians over trials. With 5000 trials in the first two experiments and 200 in the regression experiment, standard errors or confidence intervals should be reported; without them, claims such as 'SM, t=0.5 outperforms other methods' are not statistically substantiated.
  2. [Section 4.2, Proposition 6(B2)] In the statement of Proposition 6, part (B2) says 'P(M,H1)' but the converse construction is for a mechanism M''; the notation should be consistent (P(M'',H1)).
  3. [Section 5.2, Proposition 9] Typo in the proposition statement: 'is satisfies' should be 'satisfies'.
  4. [Section 1] There is a stray period in 'For example. In Acquisti and Grossklags [5]'.
  5. [Abstract / Data availability] The abstract says the synthetic datasets are released for future research, but no repository or URL is provided. Please include a data availability statement.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the central claims are supported by counterexamples, direct proofs, and external mechanisms re-proved in the appendices.

full rationale

The paper's negative result against standard HDP is an exhibited counterexample (the deterministic mechanism that outputs the privacy-demand vector satisfies Definition 2 yet leaks data when the adversary knows the correlation support W); it does not presuppose its conclusion. The AHDP framework's operational guarantees are derived from Definition 3 through Proposition 3 and the power bounds in Propositions 6-7, each with proofs in the appendices that rely only on the definition and standard hypothesis-testing manipulations. The universal AHDP mechanisms (Sampling Mechanism, linear-query mechanism, and regression mechanism) are proven AHDP directly for arbitrary W; the condition alpha(x,eps)<=eps is exactly the definition of W-AHDP, not a hidden restatement of the target result. Self-citations to Chaudhuri and Courtade appear only in related-work and background contexts and are not load-bearing. The Sampling Mechanism from Jorgensen et al. is re-proved in Appendix F rather than imported as an unexamined authority. No parameter is fitted and then renamed as a prediction; the empirical evaluation compares fixed mechanisms. Known limitations, such as the impossibility of unbiased universal AHDP estimation (Proposition 8), the asymptotic bias of mean estimation (Remark 3), and the threat-model dependence on the adversary knowing W, are explicitly disclosed and do not indicate circular reasoning. The unproved Proposition 10 is an expositional gap, not a circular step.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claim (standard HDP fails under correlations; AHDP provides a remedy) rests on modeling correlations as the support W and assuming the adversary knows W. The proposed mechanisms require no fitted constants, only the choice of a weight function alpha bounded by epsilon. No new physical or mathematical entities are introduced.

assumptions (4)
  • domain assumption W is a finite set
    Section 3: 'For simplicity, we shall assume that W is a finite set in the rest of this work.' The power bounds and the mechanisms rely on finite support for the tuple domain.
  • domain assumption The adversary knows the correlation set W and the mechanism M
    Section 2.4: 'Assume that an adversary ... is aware of the correlations between the data and privacy demand.' Section 4: threat models include 'adversary knows the mechanism M used.' This is standard for DP but load-bearing for the negative result against HDP.
  • standard math Standard hypothesis testing characterization of DP
    Proposition 3 is a known equivalence (Wasserman-Zhou, Kairouz-Oh-Viswanath); the paper proves it in Appendix B, but the result itself is standard.
  • domain assumption Domain bounds for mean and regression (X subset of [l,h], X subset of [-1,1]^d, Y subset of [-1,1])
    Used in Propositions 9, 10, and Mechanism 1 to bound sensitivities. Typical in DP literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Managing Correlations in Data and Privacy Demand." pith.science (2026). https://pith.science/paper/XY3LBADZ

@misc{pith2026250902856,
  author       = {Pith},
  title        = {Pith review of: Managing Correlations in Data and Privacy Demand},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XY3LBADZ}},
  note         = {Machine review of arXiv:2509.02856}
}
read the original abstract

Previous works in the differential privacy literature that allow users to choose their privacy levels typically operate under the heterogeneous differential privacy (HDP) framework with the simplifying assumption that user data and privacy levels are not correlated. Firstly, we demonstrate that the standard HDP framework falls short when user data and privacy demands are allowed to be correlated. Secondly, to address this shortcoming, we propose an alternate framework, Add-remove Heterogeneous Differential Privacy (AHDP), that jointly accounts for user data and privacy preference. We show that AHDP is robust to possible correlations between data and privacy. Thirdly, we formalize the guarantees of the proposed AHDP framework through an operational hypothesis testing perspective. The hypothesis testing setup may be of independent interest in analyzing other privacy frameworks as well. Fourthly, we show that there exists non-trivial AHDP mechanisms that notably do not require prior knowledge of the data-privacy correlations. We propose some such mechanisms and apply them to core statistical tasks such as mean estimation, frequency estimation, and linear regression. The proposed mechanisms are simple to implement with minimal assumptions and modeling requirements, making them attractive for real-world use. Finally, we empirically evaluate proposed AHDP mechanisms, highlighting their trade-offs using LLM-generated synthetic datasets, which we release for future research.

Figures

Figures reproduced from arXiv: 2509.02856 by the authors.

Figure 1
Figure 1. Central-DP: users send their true data, 𝑥, and privacy demand, 𝜖, to a central server. arXiv:2509.02856v1 [cs.CR] 2 Sep 2025 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Plot of the upper bound for the power for [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Plot of the upper bound for the power for [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Empirical distribution of the output of the mecha [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Scatter plot of LLM-generated dataset of weight (in [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 7
Figure 7. Figure 7: We obtain the relative frequencies for the education level [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 9
Figure 9. Figure 9: Median residual test error for the five methods as [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 7
Figure 7. Figure 7: Contingency table of LLM-generated dataset of ed [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Mean 𝑙∞ error of the five methods as the sample size is increased for histogram estimation. 2000 4000 6000 8000 10000 12000 14000 16000 18000 Number of samples 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 Median Residual Test Error α(z, ) = 1 − e− α(z, ) =  α(z, ) =  1+ SM t…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

64 extracted references · 55 canonical work pages

  1. [1]

    Aleksi Aaltonen, Cristina Alaimo, and Jannis Kallinikos. 2021. The Making of Data Commodities: Data Analytics as an Embedded Process. Journal of Management Information Systems (2021)

    work page 2021

  2. [2]

    John M. Abowd. 2018. The U.S. Census Bureau Adopts Differential Privacy. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Syomantak Chaudhuri and Thomas A. Courtade Discovery & Data Mining . Association for Computing Machinery

    work page 2018

  3. [3]

    Krishna Acharya, Franziska Boenisch, Rakshit Naidu, and Juba Ziani. 2024. Personalized Differential Privacy for Ridge Regression. arXiv preprint arXiv:2401.17127 (2024)

    arXiv 2024

  4. [4]

    Ackerman, Lorrie Faith Cranor, and Joseph Reagle

    Mark S. Ackerman, Lorrie Faith Cranor, and Joseph Reagle. 1999. Privacy in e-commerce: examining user scenarios and privacy preferences. In Proceedings of the 1st ACM Conference on Electronic Commerce (Denver, Colorado, USA) (EC ’99). Association for Computing Machinery, 1–8

    work page 1999

  5. [5]

    Alessandro Acquisti and Jens Grossklags. 2005. Privacy and rationality in indi- vidual decision making. IEEE security & privacy 3, 1 (2005), 26–33

    work page 2005

  6. [6]

    Mohammad Alaggan, Sébastien Gambs, and Anne-Marie Kermarrec. 2017. Het- erogeneous Differential Privacy. Journal of Privacy and Confidentiality (2017)

    work page 2017

  7. [7]

    Cristina Alaimo and Jannis Kallinikos. 2017. Computing the everyday: Social media as data platforms. The Information Society (2017)

    work page 2017

  8. [8]

    Maryam Aliakbarpour, Syomantak Chaudhuri, Thomas Courtade, Alireza Fal- lah, and Michael Jordan. 2025. Enhancing Feature-Specific Data Protection via Bayesian Coordinate Differential Privacy. In The 28th International Conference on Artificial Intelligence and Statistics

    work page 2025

Show all 64 references
  1. [9]

    Noga Alon, Raef Bassily, and Shay Moran. 2019. Limits of private learning with access to public data. Advances in neural information processing systems (2019)

    2019

  2. [10]

    Mário S Alvim, Miguel E Andrés, Konstantinos Chatzikokolakis, Pierpaolo Degano, and Catuscia Palamidessi. 2012. Differential privacy: on the trade- off between utility and information leakage. In Formal Aspects of Security and Trust: 8th International Workshop, FAST 2011, Leuv...

    2012

  3. [11]

    Ehsan Amid, Arun Ganesh, Rajiv Mathews, Swaroop Ramaswamy, Shuang Song, Thomas Steinke, Vinith M Suriyakumar, Om Thakkar, and Abhradeep Thakurta

  4. [12]

    Ameya Anjarlekar, Rasoul Etesami, and R Srikant. 2023. Striking a Balance: An Optimal Mechanism Design for Heterogenous Differentially Private Data Acquisition for Logistic Regression. arXiv preprint arXiv:2309.10340 (2023)

    2023 arXiv

  5. [13]

    Apple. 2017. Learning with Privacy at Scale Differential. https://api. semanticscholar.org/CorpusID:43986173

    2017

  6. [14]

    Shahab Asoodeh, Fady Alajaji, and Tamás Linder. 2014. Notes on information- theoretic privacy. In 2014 52nd Annual Allerton Conference on Communication, Control, and Computing (Allerton). IEEE, 1272–1278

    2014

  7. [15]

    Raef Bassily, Albert Cheu, Shay Moran, Aleksandar Nikolov, Jonathan Ullman, and Steven Wu. 2020. Private query release assisted by public data. In Interna- tional Conference on Machine Learning . PMLR

    2020

  8. [16]

    Raef Bassily, Shay Moran, and Anupama Nandi. 2020. Learning from mixtures of private and public populations. Advances in Neural Information Processing Systems (2020)

    2020

  9. [17]

    Alex Bie, Gautam Kamath, and Vikrant Singhal. 2022. Private Estimation with Public Data. In Advances in Neural Information Processing Systems

    2022

  10. [18]

    CA. 2018. California Consumer Privacy Act (CCPA). Office of the Attorney General, California Department of Justice (2018)

    2018

  11. [19]

    Syomantak Chaudhuri and Thomas Courtade. 2023. Mean Estimation Under Heterogeneous Privacy: Some Privacy Can Be Free. In 2023 IEEE International Symposium on Information Theory (ISIT)

    2023

  12. [20]

    Courtade

    Syomantak Chaudhuri and Thomas A. Courtade. 2024. Empirical Mean and Frequency Estimation Under Heterogeneous Privacy: A Worst-Case Analysis. arXiv:2407.11274 [cs.LG] https://arxiv.org/abs/2407.11274

    2024 arXiv

  13. [21]

    Courtade

    Syomantak Chaudhuri, Konstantin Miagkov, and Thomas A. Courtade. 2025. Mean Estimation Under Heterogeneous Privacy Demands. IEEE Transactions on Information Theory 71, 2 (2025), 1362–1375. doi:10.1109/TIT.2024.3511498

    2025

  14. [22]

    Kah Meng Chong and Amizah Malip. 2024. May the privacy be with us: Correlated differential privacy in location data for ITS. Computer networks 241 (2024), 110214

    2024

  15. [23]

    Rachel Cummings, Hadi Elzayn, Emmanouil Pountourakis, Vasilis Gkatzelis, and Juba Ziani. 2023. Optimal data acquisition with privacy-aware agents. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . IEEE, 210–224

    2023

  16. [24]

    Luciano da F. Costa. 2021. An Introduction to Multisets. arXiv:2110.12902 [math.GM] https://arxiv.org/abs/2110.12902

    2021 arXiv

  17. [25]

    Damien Desfontaines. 2020. A list of real-world uses of differential privacy. https://desfontain.es/blog/real-world-differential-privacy.html. Accessed: 2024- 05-22

    2020

  18. [26]

    Damien Desfontaines. 2020. The privacy loss random variable. https://desfontain. es/blog/privacy-loss-random-variable.html. Ted is writing things (personal blog)

    2020

  19. [27]

    Damien Desfontaines and Balázs Pejó. 2019. Sok: differential privacies. arXiv preprint arXiv:1906.01337 (2019)

    2019 arXiv

  20. [28]

    Jinshuo Dong, Aaron Roth, and Weijie J Su. 2022. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology) 84, 1 (2022), 3–37

    2022

  21. [29]

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. 2006. Our data, ourselves: Privacy via distributed noise generation. In Annual international conference on the theory and applications of cryptographic techniques. Springer

    2006

  22. [30]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating noise to sensitivity in private data analysis. In Theory of cryptography conference. Springer

    2006

  23. [31]

    Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    2014

  24. [32]

    Úlfar Erlingsson, Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. 2019. Amplification by shuffling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithm...

    2019

  25. [33]

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. 2014. RAPPOR: Ran- domized Aggregatable Privacy-Preserving Ordinal Response. In Proceedings of the 21st ACM Conference on Computer and Communications Security . Scottsdale, Arizona

    2014

  26. [34]

    EU. 2016. Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Reg...

    2016

  27. [35]

    Alireza Fallah, Michael I Jordan, Ali Makhdoumi, and Azarakhsh Malekian. 2024. On Three-Layer Data Markets. arXiv preprint arXiv:2402.09697 (2024)

    2024

  28. [36]

    Alireza Fallah, Ali Makhdoumi, Azarakhsh Malekian, and Asuman Ozdaglar

  29. [37]

    Cecilia Ferrando, Jennifer Gillenwater, and Alex Kulesza. 2021. Combining Public and Private Data. In NeurIPS 2021 Workshop Privacy in Machine Learning

    2021

  30. [38]

    Arpita Ghosh and Aaron Roth. 2011. Selling privacy at auction. In Proceedings of the 12th ACM conference on Electronic commerce . 199–208

    2011

  31. [39]

    arXiv preprint arXiv:2201.03968 (2022)

    Optimal and Differentially Private Data Acquisition: Central and Local Mechanisms. arXiv preprint arXiv:2201.03968 (2022)

    2022 arXiv

  32. [40]

    Zach Jorgensen, Ting Yu, and Graham Cormode. 2015. Conservative or liberal? Personalized differential privacy. In 2015 IEEE 31St international conference on data engineering

    2015

  33. [41]

    Peter Kairouz, Monica Ribero Diaz, Keith Rush, and Abhradeep Thakurta. 2021. (Nearly) Dimension Independent Private ERM with AdaGrad Rates via Publicly Estimated Subspaces. In Conference on Learning Theory . PMLR

    2021

  34. [42]

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276 (2024)

    2024 arXiv

  35. [43]

    Justin Kang, Kannan Ramchandran, and Ramtin Pedarsani. 2023. The Fair Value of Data Under Heterogeneous Privacy Constraints in Federated Learning. In International Workshop on Federated Learning in the Age of Foundation Models in Conjunction with NeurIPS 2023

    2023

  36. [44]

    Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhod- nikova, and Adam Smith. 2011. What can we learn privately? SIAM J. Comput. (2011)

    2011

  37. [45]

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2015. The Composition Theorem for Differential Privacy. In Proceedings of the 32nd International Con- ference on Machine Learning (Proceedings of Machine Learning Research, Vol. 37) , Francis Bach and David Blei (Eds.). PMLR, Li...

    2015

  38. [46]

    Hong Ping Li, Haibo Hu, and Jianliang Xu. 2012. Nearby friend alert: Location anonymity in mobile geosocial networks. IEEE Pervasive Computing 12, 4 (2012), 62–70

    2012

  39. [47]

    Terrance Liu, Giuseppe Vietri, Thomas Steinke, Jonathan Ullman, and Steven Wu

  40. [48]

    Alex Kulesza, Ananda Theertha Suresh, and Yuyan Wang. 2024. Mean estimation in the add-remove model of differential privacy. arXiv:2312.06658 [cs.DS] https: //arxiv.org/abs/2312.06658

    2024 arXiv

  41. [49]

    Frank McSherry and Kunal Talwar. 2007. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS’07). IEEE

    2007

  42. [50]

    Anupama Nandi and Raef Bassily. 2020. Privately answering classification queries in the agnostic pac model. In Algorithmic Learning Theory. PMLR

    2020

  43. [51]

    R Kelley Pace and Ronald Barry. 1997. Sparse spatial autoregressions. Statistics & Probability Letters 33, 3 (1997), 291–297

    1997

  44. [52]

    Mary L McHugh. 2013. The chi-square test of independence. Biochemia medica 23, 2 (2013), 143–149

    2013

  45. [53]

    Diptangshu Sen, Jingyan Wang, and Juba Ziani. 2024. Equilibria of Data Mar- ketplaces with Privacy-Aware Sellers under Endogenous Privacy Costs. arXiv preprint arXiv:2402.08826 (2024)

    2024

  46. [54]

    Florian Tramèr, Gautam Kamath, and Nicholas Carlini. 2022. Position: Consider- ations for Differentially Private Learning with Large-Scale Public Pretraining. In Forty-first International Conference on Machine Learning . Managing Correlations in Data and Privacy Demand

    2022

  47. [55]

    Di Wang, Huangyu Zhang, Marco Gaboardi, and Jinhui Xu. 2021. Estimating smooth glm in non-interactive local differential privacy model with public unla- beled data. In Algorithmic Learning Theory. PMLR

    2021

  48. [56]

    Shashi Raj Pandey, Pierre Pinson, and Petar Popovski. 2023. Privacy-Aware Data Acquisition under Data Similarity in Regression Markets. arXiv preprint arXiv:2312.02611 (2023)

    2023 arXiv

  49. [57]

    Dayong Ye, Sheng Shen, Tianqing Zhu, Bo Liu, and Wanlei Zhou. 2022. One parameter defense—defending against data inference attacks via differential privacy. IEEE Transactions on Information Forensics and Security 17 (2022), 1466– 1480

    2022

  50. [58]

    Jun Zhang, Zhenjie Zhang, Xiaokui Xiao, Yin Yang, and Marianne Winslett

  51. [59]

    Tao Zhang, Tianqing Zhu, Renping Liu, and Wanlei Zhou. 2022. Correlated data in differential privacy: definition and analysis. Concurrency and Computation: Practice and Experience 34, 16 (2022), e6015. A Multisets: Notations A multiset 𝐷 containing elements fromX is represente...

    2022

  52. [60]

    Larry Wasserman and Shuheng Zhou. 2010. A statistical framework for differen- tial privacy. J. Amer. Statist. Assoc. 105, 489 (2010), 375–389

    2010

  53. [2011]

    Springer, 39–54

    Revised Selected Papers 8 . Springer, 39–54

  54. [2012]

    Proceedings of the VLDB Endowment 5, 11 (2012)

    Functional Mechanism: Regression Analysis under Differential Privacy. Proceedings of the VLDB Endowment 5, 11 (2012)

    2012

  55. [2021]

    In International Conference on Machine Learning

    Leveraging public data for practical private query release. In International Conference on Machine Learning . PMLR

  56. [2022]

    In Interna- tional Conference on Machine Learning

    Public data-assisted mirror descent for private model training. In Interna- tional Conference on Machine Learning . PMLR

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.