Meeting Utility Constraints in Differential Privacy: A Privacy-Boosting Approach

Bo Jiang; Donghang Lu; Jian Du; Qiang Yan; Sagar Sharma; Wanrong Zhang

REVIEW 4 major objections 5 minor 33 references

Meeting Utility Constraints in Differential Privacy: A Privacy-Boosting Approach

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Reweighting a DP noise distribution can meet accuracy targets with less privacy loss.

desk verdict A useful utility-boosting idea, but the central PLD theorem is built on wrong probabilities—it computes misalignment weights and kernel PLD under the kernel measure, not the reweighted mechanism—so the claimed privacy guarantees are unsupported as written. read the letter →

arxiv 2412.10612 v1 pith:3JK4E3NV submitted 2024-12-13 cs.CR cs.DScs.ITmath.IT

Bo Jiang , Wanrong Zhang , Donghang Lu , Jian Du , Sagar Sharma , Qiang Yan This is my paper · ORCID

classification cs.CRcs.DScs.ITmath.IT

keywords differentialprivacyboostingutilityconstraintslossdistributionprofileRényinoise-addingmechanismslocal

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a privacy-boosting mechanism (PB-DP) that starts from any standard noise-adding DP mechanism, treats its density as a kernel, and reweights it so that outputs land in a preferred region S(Q(X)) with probability at least ρ. The reweighting adds probability mass inside the region and, crucially, leaves the tails of the distribution heavier, which reduces the information the output carries about the true answer. The authors derive the exact privacy loss distribution of the boosted mechanism as a weighted combination of shifted copies of the kernel's PLD, and from it obtain (ε, δ)-DP and RDP guarantees. Their experiments show that under the same utility constraint the boosted mechanism needs a smaller ε than the kernel mechanism alone, with the largest gains when query sensitivity is large relative to the true value. The framework is meant to let analysts specify accuracy first and still receive a privacy guarantee.

What carries the argument

The load-bearing object is the reweighted density fpb(y|Q(X)) = f_M(y)/(1 − p̄_S q) inside the preferred region and f_M(y)(1−q)/(1 − p̄_S q) outside, with boosting rate q chosen as a function of ρ and the kernel's tail mass. The argument then reduces the privacy analysis to three quantities: the loss L1 from the differing total masses of the preferred regions, the symmetric loss ±L2 from falling inside one preferred region but not the other, and the weights W1, W2, W3 computed as boundary integrals of the kernel density over the differences of the two intervals S(Q(X)) and S(Q(X′)). The PLD identity fΓ = W1 f'_Z(·−L2) + W2 f'_Z(·+L2) + W3 f'_Z(·) is what turns the boosted mechanism's accounting into a small weighted combination of the kernel's already-known account, which is also what makes composition tractable via convolution with a three-point Dirac mixture.

What would settle it

Run a PB-DP Gaussian mechanism with a preferred region that is the union of two disjoint intervals, compute the exact PLD by simulation for a pair of neighboring datasets, and compare it with the weighted formula in Theorem 1; any systematic deviation would show the interval restriction is load-bearing.

Watch

Extended reading notes

Core claim

The central claim is that any noise-adding DP mechanism can be reweighted into a PB-DP mechanism that satisfies Pr[M(X) ∈ S(Q(X))] ≥ ρ and, at the same time, has strictly smaller privacy loss than the kernel mechanism when both are required to meet the same utility constraint. Formally, Theorem 1 gives the privacy loss distribution of the boosted mechanism as fΓ(γ) = W1 f'_Z(γ − L2) + W2 f'_Z(γ + L2) + W3 f'_Z(γ), where f'_Z is the kernel PLD shifted by L1, L2 = −log(1−q) is the extra loss from the boosting step, and W1, W2, W3 are the probabilities that an output falls in the region where the two neighboring datasets' preferred regions disagree. Proposition 1 expresses the (ε, δ) privacy profile as the same weighted combination of shifted kernel privacy profiles, and Proposition 2 gives the RDP analogue. The authors state that for the three cases they study — relative error, fixed output range, and absolute error — the privacy loss of PB-DP is lower than that of the kernel mechanism under equal utility, and the gap grows as sensitivity grows relative to the answer.

Load-bearing premise

The entire privacy analysis assumes that every preferred region S(Q(X)) is a single interval, so that only its two endpoints matter; if a utility constraint defines a non-interval region, the PLD formula and the (ε, δ) and RDP bounds derived from it do not apply.

Editorial extensions

If this is right

For a fixed utility constraint (ρ, S(·)), PB-DP achieves a smaller ε than the kernel mechanism alone, and the advantage grows as the query sensitivity-to-answer ratio grows.
The (ε, δ) privacy profile and RDP guarantee are expressible as explicit weighted combinations of the kernel's shifted profiles, so existing accounting tools (e.g., FFT or characteristic-function accountants) extend to PB-DP.
In the fixed-region case, PB-DP widens the feasible (ε, δ) region compared with truncated or bounded mechanisms because q ≤ 1 gives soft rather than hard boundaries.
Under T-fold homogeneous composition, the PLD is the convolution of the kernel PLD with a three-point discrete distribution, giving an O(T²) accounting algorithm.
The local-model variant (PB-GRR) yields unbiased frequency estimators for both categories and individual values, with a tunable tradeoff controlled by ϵ0.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The interval restriction is not stated as a hypothesis: if a utility region is the union of disjoint intervals, the boundary-integral weights W1, W2 and the PLD theorem do not follow; a natural test is to simulate such a case and compare with Theorem 1.
Nothing in the mechanism requires the kernel to be Gaussian or Laplace; the same reweighting and PLD identity should transfer to discrete kernels such as discrete Gaussian, which would make the framework applicable to federated or local settings with discrete domains.
The boosting approach inverts the usual DP workflow: instead of choosing ε and accepting whatever error results, the analyst fixes an accuracy target and the framework returns the smallest ε; this suggests a practical product design where privacy budgets are reported after accuracy constraints are met, provided the interval assumption holds.
Because the framework deliberately retains heavier tails, it will generally be a poor fit for pure (ε,0)-DP, a limitation the paper itself notes; an interesting question is whether a mixture of boostings with different q could trade off tail mass against worst-case ε.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here is what you should know before reading: the paper tries hard to solve a real problem—designing DP mechanisms that meet utility constraints with less privacy loss by reweighting the noise density. The special cases (relative error, fixed support, local GRR) are genuine extensions of the authors' prior budget-recycling work, and the local with unbiased estimators is a concrete, likely correct contribution. Credit where due: the paper is well-written, the motivation is practical, and the experiments are extensive.

The soft spot is structural. Theorem 1 expresses the PLD of the reweighted mechanism as a mixture of shifted kernel PLDs with weights W1, W2, W3 that are integrals of the kernel density fM(X) over boundary intervals. But the released output is drawn from the reweighted density fpb, not from fM. The misalignment-event probabilities under fpb differ from W1 and W2 by factors involving q and the normalizer. More importantly, Z, the kernel privacy loss, is a deterministic function of the output y; conditional on falling in a misalignment region, Z is not distributed as the unconditional fZ. For a Gaussian kernel, Z is monotone in y, so the conditional PLD on the lower misalignment interval is stochastically smaller than on the upper one. Replacing both with fZ changes the privacy profile and can understate delta. The convolution representation in Section 3.3 is therefore invalid—the boosting loss and the kernel loss are correlated through y, not independent.

There are also internal inconsistencies: Eq. (6) assigns W1 to the upper boundary interval, while Appendix B assigns it to the lower boundary interval for the same event; Proposition 6 sets W1 = W2 using a single interval, which does not follow from the earlier definitions. Appendix D's tail-based derivation of approximate DP is not a valid privacy-profile argument. Any one of these would require a correction; together they sink the central claim, and every experimental epsilon inherits the flawed accounting.

My take: the mechanism is salvageable in principle, but the PLD derivation needs to be redone under the actual reweighted measure, using conditional kernel PLDs, and the experiments rerun. That is real work. The local GRR part may stand independently.

For you: if you work on DP accounting, this is worth a skim for the instructive error. I would not cite it in current form. Should a venue send it to review? Yes—this is a substantial paper with a real idea, and the error, while load-bearing, is subtle enough to warrant careful referee attention. The paper should be rejected as written, but not desk-rejected.

Referee Report

4 major / 5 minor

Summary. The paper proposes a Privacy-Boosting DP (PB-DP) framework: given a kernel differential-privacy mechanism with density f_M and a utility constraint Pr[M(X) in S(Q(X))] >= rho, it reweights the density to boost probability mass inside a preferred region (Eq. (2)), then characterizes the privacy loss distribution (PLD) of the reweighted mechanism. The central result is Theorem 1, which expresses the PB-DP PLD as W1 f'_Z(gamma - L2) + W2 f'_Z(gamma + L2) + W3 f'_Z(gamma), with W1,W2 defined in Eq. (6) and f'_Z a shifted version of the kernel PLD. From this theorem the paper derives (epsilon,delta)-DP and RDP privacy profiles, a composition accountant, an optimal-parameter search, three continuous case studies, and a local-DP frequency-estimation extension. The paper reports experiments showing that PB-DP achieves lower epsilon than the kernel mechanism under the same utility constraints.

Significance. If the central PLD theorem were correct, the framework would be a practically motivated contribution: it addresses utility-first DP design, works with a broad class of additive-noise kernels, gives closed-form weight formulas for relative-error, fixed-region, and absolute-error constraints, provides composition accounting, and includes a local-model extension with unbiased frequency estimators. The high-sensitivity regime chosen for the experiments is also well motivated. However, the central privacy analysis is not valid as written: the PLD formula in Theorem 1 uses unconditional kernel-mechanism quantities and mis-specified event weights, and the derived privacy profiles and experimental epsilons therefore do not establish the claimed guarantees. The contribution, as presented, is unsupported by its main derivation.

major comments (4)

[Section 3.2, Theorem 1 and Eq. (6); Appendix B] The weights W1 and W2 are assigned inconsistently between Theorem 1 and Appendix B. In Eq. (6), W1 is the integral over the upper boundary interval [min{tau_u,tau'_u}, max{tau_u,tau'_u}] and W2 is the integral over the lower boundary interval [min{tau_l,tau'_l}, max{tau_l,tau'_l}]. In Appendix B, for the neighboring direction Q(X') = Q(X) + Delta_f, W1 is instead the lower-interval integral int_{tau'_l}^{tau_l} f_M(X)(y)dy and W2 is the upper-interval integral int_{tau'_u}^{tau_u} f_M(X)(y)dy; for the opposite direction the assignments are again reversed relative to Eq. (6). Since the two events contribute +L2 and -L2 respectively, this ambiguity is not cosmetic: the PLD formula changes depending on which convention is used, and the theorem as stated does not have well-defined weights.
[Section 3.2, Theorem 1] The PLD formula replaces the conditional privacy-loss distributions of the actual mechanism with the unconditional kernel PLD f'_Z. Under PB-DP the released output y is drawn from the reweighted density f_pb, not from the kernel density f_M, and the privacy loss is Gamma(y) = Z(y) + L1 + c(y), where Z(y) = log(f_M(X)(y)/f_M(X')(y)) and c(y) is +L2, -L2, or 0 depending on whether y lies in S(X)\S(X'), S(X')\S(X), or elsewhere. Because Z(y) and c(y) are deterministic functions of the same y, they are dependent. The theorem instead multiplies the unconditional f'_Z by the kernel-mechanism probabilities W1 and W2. Concretely, the probability of the event S(X)\S(X') under the actual mechanism is W1/(1 - \bar p_{S(X)} q), not W1, and the conditional distribution of Z given that event is not the unconditional kernel PLD f'_Z; for a Gaussian or Laplace kernel Z is monotone in y, so Z on the lower misalignment interval is stochastically different from Z on the upper interval. Thus Theorem 1 is not a valid characterization of the PB-DP privacy loss. Propositions 1, 2, and 3, Remark 4, and every privacy-loss number reported in Section 5 inherit this error. This is the load-bearing step of the paper and cannot be treated as a local typo.
[Section 3.2, Eqs. (5)-(6)] The PLD derivation assumes that each preferred region S(Q(X)) is an interval fully described by tau_l = inf S and tau_u = sup S. The framework is introduced for a general preferred region S(Q(X)) in Eq. (1), and no interval-restriction condition is stated as a hypothesis of Theorem 1. For non-interval preferred regions, or for regions whose overlap structure is not captured by the two boundary intervals in Eq. (6), the integrals W1 and W2 do not represent the misalignment probabilities, so the theorem and all derived privacy profiles do not apply to the general utility constraints claimed in the paper.
[Section 3.3, Algorithm 1] The composition accounting algorithm is dimensionally inconsistent as written. In lines 8-13, V is populated with multinomial probabilities u assigned to shift positions e1 - e2, so V is a probability array. In line 15, the algorithm computes delta'^T_Z(epsilon - V[i - T]), subtracting a probability from epsilon, whereas Proposition 3 requires a shift of (i - T) L2 in the privacy-loss argument. Additionally, the loop range for i allows out-of-bounds access to V. As written, Algorithm 1 does not implement the composition bound in Proposition 3, and the composition experiments in Section 5.4 are therefore not supported by the stated procedure.

minor comments (5)

[Appendix B title] Appendix B is titled 'PLD of a BR-DP mechanism', but the mechanism is called PB-DP throughout the rest of the paper; this appears to be a leftover from the authors' earlier budget-recycling work [14] and should be corrected.
[Section 3.1, Eq. (3)] Equation (3) can produce negative values of q when rho <= p_S(Q(X)); the text states that q becomes 0 in that case, but the formula itself does not include the required max(0, .) or domain restriction.
[Section 3.3, Remark 1 and Algorithm 1] Remark 1 claims the computational complexity of Algorithm 1 is O(T^2), but the algorithm's nested loops over e1 and e2 together with the loop over 2T+2 values give O(T^2) iterations; the complexity statement is acceptable, but the pseudocode's V update and indexing should be corrected to match the stated complexity.
[Section 5.3, Fig. 5(b) caption] The caption text 'low high sensitivity' in the description of Figure 5(b) appears to be a typo; the intended meaning is likely 'low and high sensitivity'.
[Appendix D] Appendix D derives a bound q = 1 - e^{(epsilon - epsilon_0)/2} from the inequality Gamma <= Z + 2 log(1/(1-q)), which is inconsistent with the more precise +L2/-L2 structure of Theorem 1 and is not connected to any result used in the main text; this appendix should either be reconciled with the main PLD analysis or removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the privacy analysis is a direct calculation from the reweighted density, and the only self-citation is descriptive, not load-bearing.

full rationale

The derivation chain is self-contained. The PB-DP density in Eq. (2) is a direct reweighting of the kernel density; q in Eq. (3) is solved from the utility constraint Pr[M(X) in S(Q(X))] >= rho, not from the privacy target. Theorem 1 derives the PLD by partitioning the output space into S(Q(X)) intersect S(Q(X')), the two misalignment sets, and the complement, and expressing the PLD as a weighted combination of shifted kernel PLDs. Proposition 1 applies the standard privacy-profile integral to Theorem 1; Proposition 2 uses the standard RDP moment of that PLD; Theorem 2 and Proposition 3 are T-fold convolutions. No parameter is fitted to the claimed privacy numbers and then reported as a prediction; the only optimized quantity (epsilon0) is obtained by a search over Proposition 1 or Proposition 2 for a fixed delta or alpha, and the resulting epsilon is compared against an independent Gaussian benchmark. The related-work self-citation [14] (budget recycling) is descriptive and not load-bearing: no theorem from [14] is imported to justify Theorem 1 or its corollaries, and the appendices contain self-contained proofs. Concerns that Theorem 1 mis-specifies the PLD by treating the kernel loss as independent of the boosting event are correctness or soundness objections, not circularity: the formula is not equal to its input by construction. Hence no circular step is identified.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The main design parameters are the boosting rate q and the kernel privacy parameter epsilon_0, both tuned to the utility constraint. The analysis also assumes interval-shaped preferred regions and additive shift-invariant kernel noise, which are not guaranteed by the framework's stated generality. No new physical or mathematical entities are invented.

free parameters (2)

boosting rate q = computed from Eq (3) using rho and p_S
q is chosen by the designer to enforce the utility confidence rho, and it appears in every privacy loss formula.
kernel DP parameter epsilon_0 = chosen via ternary search in Algorithm 2
epsilon_0 is searched to minimize the total privacy loss, and the reported privacy improvements depend on this search.

assumptions (4)

domain assumption The preferred region S(Q(X)) is an interval described by its infimum and supremum.
Theorem 1 and Eq (6) compute W1 and W2 as single integrals over boundary intervals; this fails for unions of intervals or non-contiguous sets.
domain assumption The kernel DP mechanism is an additive noise mechanism with a known privacy loss distribution f_Z.
The PLD derivation and all three case studies rely on shift-invariant additive noise such as Gaussian or Laplace.
domain assumption For data-dependent regions, the worst-case neighboring pair is at the extremes, such as Q(X)=0 and Q(X')=Delta_Q for relative error.
Proposition 4 and Appendix F use this extreme pair to bound L1, W1, and W2, but it is not proven for arbitrary utility regions.
standard math The standard privacy profile formula maps the PLD to (epsilon,delta)-DP.
Definition 4 is standard, but Appendix D incorrectly treats a tail bound Pr[Z >= epsilon_0] <= delta as equivalent to the privacy profile.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Meeting Utility Constraints in Differential Privacy: A Privacy-Boosting Approach." pith.science (2026). https://pith.science/paper/3JK4E3NV

@misc{pith2026241210612,
  author       = {Pith},
  title        = {Pith review of: Meeting Utility Constraints in Differential Privacy: A Privacy-Boosting Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3JK4E3NV}},
  note         = {Machine review of arXiv:2412.10612}
}

abstract

Data engineering often requires accuracy (utility) constraints on results, posing significant challenges in designing differentially private (DP) mechanisms, particularly under stringent privacy parameter $\epsilon$. In this paper, we propose a privacy-boosting framework that is compatible with most noise-adding DP mechanisms. Our framework enhances the likelihood of outputs falling within a preferred subset of the support to meet utility requirements while enlarging the overall variance to reduce privacy leakage. We characterize the privacy loss distribution of our framework and present the privacy profile formulation for $(\epsilon,\delta)$-DP and R\'enyi DP (RDP) guarantees. We study special cases involving data-dependent and data-independent utility formulations. Through extensive experiments, we demonstrate that our framework achieves lower privacy loss than standard DP mechanisms under utility constraints. Notably, our approach is particularly effective in reducing privacy loss with large query sensitivity relative to the true answer, offering a more practical and flexible approach to designing differentially private mechanisms that meet specific utility constraints.

Figures

Figures reproduced from arXiv: 2412.10612 by the authors.

**Figure 1.** Illustration of privacy boosting mechanisms for the three special cases studied in this paper. We take one dimensional Gaussian kernel as an [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗

**Figure 2.** Boosted privacy comparison with fixed ρ, among mechanisms with relative error guarantee, mechanism with fixed output region, and mechanism with absolute error guarantee. Each mechanism shown in figure (a) and (b) achieves (ϵ, δ)-DP, and in figure (c) and (d) achieves (α, ϵ)-RDP. The preferred output regions for different mechanisms are aligned to be the same. Specifically, (a), (c) corresponds to a high sensitivity … view at source ↗

**Figure 3.** Boosted privacy comparison with fixed inf S(Q(X)), among mechanisms with relative error guarantee, mechanism with fixed output region, and mechanism with absolute error guarantee. Each mechanism shown in figure (a) and (b) achieves (ϵ, δ)-DP, and in figure (c) and (d) achieves (α, ϵ)-RDP. The preferred output regions for different mechanisms are aligned to be the same. Specifically, (a), (c) corresponds to a high se… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Runtime comparison between Gaussian-DP and PB-DP with [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: Comparison of the feasibility in the privacy profile for bounded Gaussian DP and PB-GDP with a fixed preferred region: (a) Compares bounded [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Comparison of T-fold non-adaptive composed leakages among different mechanisms when each mechanism achieves a ρ = 0.9 with inf S(Q(X)) = 10, ∆f = 3. (a) compares post-composition leakage measured by (ϵ, δ)-DP, (b) compares post-composition measured by (α, ϵ)- RDP. Erro…

**Figure 7.** Figure 7: Accuracy comparison with real data “Adult Income” between value frequency estimation and category frequency estimation with optimal [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 23 canonical work pages

[1]

Calibrating noise to sensitivity in private data analysis,

C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography: Third Theory of Cryptography Conference, 2006, pp. 265–284

work page 2006
[2]

Accuracy first: Selecting a differential privacy level for accuracy constrained erm,

K. Ligett, S. Neel, A. Roth, B. Waggoner, and S. Z. Wu, “Accuracy first: Selecting a differential privacy level for accuracy constrained erm,” Advances in Neural Information Processing Systems, vol. 30, 2017

work page 2017
[3]

Brownian noise reduction: Maximizing privacy subject to accuracy constraints,

J. Whitehouse, A. Ramdas, S. Z. Wu, and R. M. Rogers, “Brownian noise reduction: Maximizing privacy subject to accuracy constraints,” Advances in Neural Information Processing Systems, vol. 35, pp. 11 217–11 228, 2022

work page 2022
[4]

Ireduct: Differential privacy with reduced relative errors,

X. Xiao, G. Bender, M. Hay, and J. Gehrke, “Ireduct: Differential privacy with reduced relative errors,” in Proceedings of the 2011 ACM SIGMOD International Conference on Management of Data, ser. SIGMOD ’11, New York, NY , USA, 2011, p. 229–240

work page 2011
[5]

Truncated lapla- cian mechanism for approximate differential privacy,

Q. Geng, W. Ding, R. Guo, and S. Kumar, “Truncated lapla- cian mechanism for approximate differential privacy,” ArXiv, vol. abs/1810.00877, 2018

arXiv 2018
[6]

Differential privacy via a truncated and normalized laplace mechanism,

W. Croft, J.-R. Sack, and W. Shi, “Differential privacy via a truncated and normalized laplace mechanism,” Journal of Computer Science and Technology, vol. 37, no. 2, pp. 369–388, 2022

work page 2022
[7]

The bounded laplace mechanism in differential privacy,

N. Holohan, S. Antonatos, S. Braghin, and P. Mac Aonghusa, “The bounded laplace mechanism in differential privacy,” arXiv preprint arXiv:1808.10410, 2018

arXiv 2018
[8]

Canonical noise distributions and private hypothesis tests,

J. Awan and S. Vadhan, “Canonical noise distributions and private hypothesis tests,” The Annals of Statistics, vol. 51, no. 2, pp. 547– 572, 2023

work page 2023

Show all 33 references

[9]

Gaussian Differential Privacy,

J. Dong, A. Roth, and W. J. Su, “Gaussian Differential Privacy,” Journal of the Royal Statistical Society Series B: Statistical Methodology, vol. 84, no. 1, pp. 3–37, 02 2022. [Online]. Available: https://doi.org/10.1111/rssb.12454

2022 doi
[10]

Log-concave and multivariate canonical noise distributions for differential privacy,

J. Awan and J. Dong, “Log-concave and multivariate canonical noise distributions for differential privacy,”Advances in Neural Information Processing Systems, vol. 35, pp. 34 229–34 240, 2022

2022
[11]

The optimal noise-adding mechanism in differential privacy,

Q. Geng and P. Viswanath, “The optimal noise-adding mechanism in differential privacy,” IEEE Transactions on Information Theory, vol. 62, no. 2, pp. 925–951, 2015

2015
[12]

The staircase mech- anism in differential privacy,

Q. Geng, P. Kairouz, S. Oh, and P. Viswanath, “The staircase mech- anism in differential privacy,” IEEE Journal of Selected Topics in Signal Processing, vol. 9, no. 7, pp. 1176–1184, 2015

2015
[13]

Optimal data-independent noise for differential privacy,

J. Soria-Comas and J. Domingo-Ferrer, “Optimal data-independent noise for differential privacy,” Information Sciences, vol. 250, pp. 200–214, 2013

2013
[14]

Budget recycling differential privacy,

B. Jiang, J. Du, S. Shamar, and Q. Yan, “Budget recycling differential privacy,” arXiv preprint arXiv:2403.11445, 2024

2024 arXiv
[15]

Smooth sensitivity and sampling in private data analysis,

K. Nissim, S. Raskhodnikova, and A. Smith, “Smooth sensitivity and sampling in private data analysis,” in Proceedings of the thirty-ninth annual ACM symposium on Theory of computing, 2007, pp. 75–84

2007
[16]

Our data, ourselves: Privacy via distributed noise generation,

C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, and M. Naor, “Our data, ourselves: Privacy via distributed noise generation,” in Annual international conference on the theory and applications of cryptographic techniques. Springer, 2006, pp. 486–503

2006
[17]

Boosting and differential privacy,

C. Dwork, G. N. Rothblum, and S. Vadhan, “Boosting and differential privacy,” in 2010 IEEE 51st Annual Symposium on Foundations of Computer Science. IEEE, 2010, pp. 51–60

2010
[18]

The composition theorem for differential privacy,

P. Kairouz, S. Oh, and P. Viswanath, “The composition theorem for differential privacy,” in International conference on machine learning. PMLR, 2015, pp. 1376–1385

2015
[19]

The complexity of computing the opti- mal composition of differential privacy,

J. Murtagh and S. Vadhan, “The complexity of computing the opti- mal composition of differential privacy,” in Theory of Cryptography Conference. Springer, 2016, pp. 157–175

2016
[20]

R ´enyi differential privacy,

I. Mironov, “R ´enyi differential privacy,” in 2017 IEEE 30th computer security foundations symposium (CSF). IEEE, 2017, pp. 263–275

2017
[21]

Concentrated differential privacy,

C. Dwork and G. N. Rothblum, “Concentrated differential privacy,” arXiv preprint arXiv:1603.01887, 2016

2016 arXiv
[22]

Concentrated differential privacy: Simplifi- cations, extensions, and lower bounds,

M. Bun and T. Steinke, “Concentrated differential privacy: Simplifi- cations, extensions, and lower bounds,” in Theory of Cryptography Conference. Springer, 2016, pp. 635–658

2016
[23]

Privacy loss classes: The central limit theorem in differential privacy,

D. Sommer, S. Meiser, and E. Mohammadi, “Privacy loss classes: The central limit theorem in differential privacy,” Cryptology ePrint Archive, Paper 2018/820, 2018

2018
[24]

Privacy amplification by subsampling: Tight analyses via couplings and divergences,

B. Balle, G. Barthe, and M. Gaboardi, “Privacy amplification by subsampling: Tight analyses via couplings and divergences,” CoRR, vol. abs/1807.01647, 2018

2018 arXiv
[25]

Computing tight differential privacy guarantees using fft,

A. Koskela, J. J ¨alk¨o, and A. Honkela, “Computing tight differential privacy guarantees using fft,” in International Conference on Artificial Intelligence and Statistics, 2019

2019
[26]

Tight approximate differential privacy for discrete-valued mechanisms using fft,

A. Koskela, J. J ¨alk¨o, L. Prediger, and A. Honkela, “Tight approximate differential privacy for discrete-valued mechanisms using fft,” ArXiv, vol. abs/2006.07134, 2020

2006 arXiv
[27]

Optimal accounting of differential privacy via characteristic function,

Y . Zhu, J. Dong, and Y .-X. Wang, “Optimal accounting of differential privacy via characteristic function,” in International Conference on Artificial Intelligence and Statistics, 2021

2021
[28]

Becker and R

B. Becker and R. Kohavi, “Adult,” UCI Machine Learning Repository, 1996, DOI: https://doi.org/10.24432/C5XW20

1996 doi
[29]

Locally differentially pri- vate protocols for frequency estimation,

T. Wang, J. Blocki, N. Li, and S. Jha, “Locally differentially pri- vate protocols for frequency estimation,” in 26th USENIX Security Symposium (USENIX Security 17). Vancouver, BC: USENIX Association, Aug. 2017, pp. 729–745

2017
[30]

Rappor: Randomized aggregatable privacy-preserving ordinal response,

´Ulfar Erlingsson, V . Pihur, and A. Korolova, “Rappor: Randomized aggregatable privacy-preserving ordinal response,” in Proceedings of the 21st ACM CCS, 2014

2014
[31]

Learning with privacy at scale,

D. P. Team, “Learning with privacy at scale,” 2017. Appendix A. Validation of the noise distriution Proof. Next, we show the proposed distribution is valid: Obviously, 0 ≤ (1 − q) ≤ 1, 0 ≤ 1 − ¯pS(Q(X))q ≤ 1. On the other hand: Z ∞ −∞ fMpb (y)dy = Z y∈S(Q(X)) fM(y) 1 − ¯pS(Q(X...

2017
[32]

The proposed approach provides a creative solution to this issue by adapting the noise distribution based on desired constraints on the query output utility

The paper addresses the long-known issue of de- creased query output utility under DP mechanisms. The proposed approach provides a creative solution to this issue by adapting the noise distribution based on desired constraints on the query output utility
[33]

The authors’ approach is tech- nically novel and provides increased output utility compared to SOTA without the need for relaxation of the DP guarantees

The proposed framework provides a significant step forward for the field. The authors’ approach is tech- nically novel and provides increased output utility compared to SOTA without the need for relaxation of the DP guarantees

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Calibrating noise to sensitivity in private data analysis,

C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography: Third Theory of Cryptography Conference, 2006, pp. 265–284

work page 2006

[2] [2]

Accuracy first: Selecting a differential privacy level for accuracy constrained erm,

K. Ligett, S. Neel, A. Roth, B. Waggoner, and S. Z. Wu, “Accuracy first: Selecting a differential privacy level for accuracy constrained erm,” Advances in Neural Information Processing Systems, vol. 30, 2017

work page 2017

[3] [3]

Brownian noise reduction: Maximizing privacy subject to accuracy constraints,

J. Whitehouse, A. Ramdas, S. Z. Wu, and R. M. Rogers, “Brownian noise reduction: Maximizing privacy subject to accuracy constraints,” Advances in Neural Information Processing Systems, vol. 35, pp. 11 217–11 228, 2022

work page 2022

[4] [4]

Ireduct: Differential privacy with reduced relative errors,

X. Xiao, G. Bender, M. Hay, and J. Gehrke, “Ireduct: Differential privacy with reduced relative errors,” in Proceedings of the 2011 ACM SIGMOD International Conference on Management of Data, ser. SIGMOD ’11, New York, NY , USA, 2011, p. 229–240

work page 2011

[5] [5]

Truncated lapla- cian mechanism for approximate differential privacy,

Q. Geng, W. Ding, R. Guo, and S. Kumar, “Truncated lapla- cian mechanism for approximate differential privacy,” ArXiv, vol. abs/1810.00877, 2018

arXiv 2018

[6] [6]

Differential privacy via a truncated and normalized laplace mechanism,

W. Croft, J.-R. Sack, and W. Shi, “Differential privacy via a truncated and normalized laplace mechanism,” Journal of Computer Science and Technology, vol. 37, no. 2, pp. 369–388, 2022

work page 2022

[7] [7]

The bounded laplace mechanism in differential privacy,

N. Holohan, S. Antonatos, S. Braghin, and P. Mac Aonghusa, “The bounded laplace mechanism in differential privacy,” arXiv preprint arXiv:1808.10410, 2018

arXiv 2018

[8] [8]

Canonical noise distributions and private hypothesis tests,

J. Awan and S. Vadhan, “Canonical noise distributions and private hypothesis tests,” The Annals of Statistics, vol. 51, no. 2, pp. 547– 572, 2023

work page 2023