Improved subsample-and-aggregate via the private modified winsorized mean

Dylan Spicker; Kelly Ramsay

REVIEW 4 major objections 5 minor 36 references

Improved subsample-and-aggregate via the private modified winsorized mean

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A new differentially private mean estimator is minimax optimal even under adversarial contamination, and it can serve as the subsample-and-aggregate aggregator without needing tight input bounds or thousands of subsamples.

desk verdict A practical, honest DP mean-estimation paper whose main theorem rests on a wrong Laplace tail bound — repairable, and the LM correction in the appendix is worth the read on its own. read the letter →

arxiv 2501.14095 v3 pith:AOF4477Z submitted 2025-01-23 stat.ME cs.LG

Kelly Ramsay , Dylan Spicker This is my paper · ORCID

classification stat.MEcs.LG

keywords differentialprivacymeanestimationsubsample-and-aggregatemodifiedwinsorizedadversarialcontaminationprivatequantileminimaxoptimalityheavy-taileddistributions

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper develops a univariate differentially private mean estimator, the private modified winsorized mean (PMW mean), for use as the aggregation step in subsample-and-aggregate. The method privately estimates extreme quantiles, clips the data to the estimated interval, and adds calibrated noise, so it needs neither tight input bounds on the statistics nor thousands of subsamples. The paper proves that, with probability at least $1-\delta$, the error of the PMW mean is bounded by $\sigma\sqrt{\log(((u-\ell)\beta/(\beta-1))\vee 1)/\delta)/n} + \sigma\sqrt{\eta} + \sigma/(\sqrt{n}\varepsilon_3)$, which attains the minimax rate for private mean estimation under only two moments and adversarial contamination, up to logarithmic factors. For subsample-and-aggregate the same bound becomes a finite-sample deviation bound in which the error is the bias of the subsampled statistic plus a privacy-and-contamination factor. The practical payoff is that private versions of almost any statistic can be built with small aggregator samples, as demonstrated on a longitudinal mixed-model analysis of healthcare workers' distress scores.

What carries the argument

The PMW mean is a private version of the clip-then-average winsorized mean. On one half of the data it privately estimates the extreme quantiles $\tilde{\xi}_\zeta$ and $\tilde{\xi}_{1-\zeta}$ using the unbounded private quantile algorithm, with clipping proportion $\zeta = 16\eta + \frac{112}{3n}\log(32(\frac{\beta(u-\ell)}{\beta-1}\vee 1)/\delta)$. The other half is projected onto $[\tilde{\xi}_\zeta,\tilde{\xi}_{1-\zeta}]$, and the sample mean is released with Laplace noise of scale $(\tilde{\xi}_{1-\zeta}-\tilde{\xi}_\zeta)/(n\varepsilon_3)$ (or Gaussian noise with $\sqrt{\rho_3}$). The proof is carried by sandwiching the private quantiles between nonprivate quantiles, $\xi_{\zeta/4}\le \hat{\xi}_{\zeta/2}\le \xi_{3\zeta/4}\le \xi_{5\zeta/4}\le \hat{\xi}_{3\zeta/2}\le \xi_{7\zeta/4}$ and the symmetric upper chain; Condition 3 guarantees the grid is fine enough for those sandwich inequalities to hold, after which a Bernstein bound on the clipped sum and Chebyshev tails on $\xi_{1-\zeta/4}-\xi_{\zeta/4}$ close the argument.

What would settle it

Take $F$ uniform on $[0,1]$ with $n$ large and $\eta=0$; the threshold $b_n$ in Condition 3 is $O(1/n)$, so choose $\beta = 1+n^{-1/2}$, set $\ell,u$ loosely around the support, run the PMW mean, and compare the empirical $(1-\delta)$ quantile of $|\hat{\mu}-\mu|$ with the right-hand side of Theorem 1 over many replicates. If the deviations stay below the bound even when Condition 3 is violated, the condition is not actually necessary; if they exceed it, the condition is what carries the result.

Watch

Extended reading notes

Core claim

The central claim is that the PMW mean is minimax optimal, up to logarithmic factors, for differentially private estimation of the mean of a univariate distribution with finite variance, even when an arbitrary $\eta$-fraction of the sample is corrupted adversarially. Theorem 1 states that, whenever the clipping proportion is set to $\zeta = 16\eta + \frac{112}{3n}\log(32(\frac{\beta(u-\ell)}{\beta-1}\vee 1)/\delta)$ and Conditions 1-3 hold, $|\tilde{\mu}-\mu| \lesssim \sigma\sqrt{\frac{\log(4(u-\ell)\beta/((\beta-1)\delta))}{n}} + \sigma\sqrt{\eta} + \frac{\sigma}{\sqrt{n}\varepsilon_3}$, with probability at least $1-\delta$; the zCDP version replaces $\varepsilon_3$ with $\sqrt{\rho_3}$. This rate matches the known minimax lower bound for private mean estimation, and the proof introduces a zCDP variant of the unbounded private quantile algorithm together with concentration bounds for both versions. A corollary transfers the bound to subsample-and-aggregate: the private estimate of a statistic $T$ deviates from $T(F)$ by at most the bias of $T$ plus $\sigma_{T,k}$ times a term depending on the number of subsamples $m$, the contamination $\eta$, the privacy budget, and the quantile grid.

Load-bearing premise

The bound depends on Condition 3, which requires the private-quantile grid spacing $\beta$ to be finer than a threshold set by population quantiles of the uncontaminated distribution; a user cannot check this threshold from data, and choosing $\beta$ too large voids the theorem.

Editorial extensions

If this is right

With Conditions 1-3, the PMW mean's error is $O(\sigma\sqrt{\log(\cdot)/n} + \sigma\sqrt{\eta} + \sigma/(\sqrt{n}\varepsilon_3))$, matching the private minimax lower bound up to logarithmic factors, so the estimator cannot be improved uniformly on the same assumptions.
In subsample-and-aggregate, the total error is bounded by the bias of $T$ plus $\sigma_{T,k}$ times a privacy-and-contamination factor, so a statistic $T$ with variance $O(k^{-1})$ and small bias yields an overall $N^{-1/2}$ rate.
The optimal number of subsamples is not universal: it depends on $T$'s bias, and for a biased estimator such as a variance estimator one needs the subsample size $k$ to grow with $N$ so the bias stays negligible.
Under contamination, the aggregate error carries a $\sqrt{\eta}$ term, and the practical message is that the subsampled statistic $T$ itself should be robust with high probability; bounded global sensitivity is not the right requirement.
In the real-data mixed-model example, the PMW aggregator produced errors orders of magnitude smaller than those of existing private multivariate mean aggregators at aggregator sample sizes of roughly sixty observations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A testable consequence the authors do not pursue is that Condition 3 may be avoidable: on bounded-support distributions one can set $\beta$ beyond the stated threshold and check empirically whether the deviations still obey Theorem 1, which would indicate the grid condition is a proof device rather than a statistical necessity.
The subsample-and-aggregate analysis suggests a design rule for practitioners: choose the subsample size $k$ by balancing the bias of $T$ (which decreases as $k$ grows) against the privacy noise (which increases as the number of subsamples shrinks); an automatic, bias-estimated rule for $k$ would be a natural next step.
Because the aggregator uses private quantiles rather than supplied bounds, it can be paired with statistics that have unbounded global sensitivity but are robust with high probability, such as the median; the paper's Corollary 1 is stated for bounded $T$, but the robustness-in-high-probability discussion indicates the intended scope is broader.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version. The private modified winsorized mean is a practical, well-motivated addition to the DP mean-estimation toolkit, and the paper is unusually honest about where the theory stops and tuning heuristics begin. But Theorem 1 is not proven as written: the Laplace tail bound in Appendix C is wrong.

What is actually new: combining Durfee's unbounded private quantile estimator with the Lugosi–Mendelson winsorized mean is a synthesis that was missing from the literature, and the zCDP version of the unbounded quantile algorithm plus Lemmas 2–3 are useful by-products. The correction to the Lugosi–Mendelson proof in Appendix G is legitimate and valuable on its own; the four-point counterexample does kill the inequality on pages 400–401 of that paper. Corollary 1's finite-sample subsample-and-aggregate bound gives the right qualitative takeaways: the optimal subsample size tracks the bias of T, and robustness of T matters for the contamination term.

The empirical work is a genuine strength. The K10 mixed-model analysis shows concretely that PRIME, the private Huber estimator, and Coinpress degrade badly when the aggregator sees only about 60 values, while the PMW mean holds together. That is the right kind of evidence for a tooling paper, and the simulation study is reasonably thorough.

Now the soft spots, in order of severity.

First, the main proof. Appendix C uses ‘Pr(Z1 ≥ 1) = e−n ≤ δ/4’ for a standard Laplace variable. That is not e−n; it is e−1/2, about 0.184, independent of n. The event {Z1 ≤ 1} does not hold with probability 1 − e−n. To control the additive noise term with probability at least 1 − δ/4 you need |Z1| ≤ log(4/δ), which turns the σ/(√n ε3) term into σ log(4/δ)/(√n ε3). The ‘up to logarithmic factors’ rate likely survives, and the error is clearly repairable, but the theorem as stated is not established.

Second, Condition 3's b_n depends on the unknown population quantiles ξ_{5ζ/4} and ξ_{3ζ/4}. A user cannot verify it from data, and for bounded-support distributions b_n = O(1/n), so the simulation default β = 1.001 can violate it. Remark 1 acknowledges this and offers heuristics, but it remains an applicability gap.

Third, the practical estimator — using all the data, clipping at C/n ∨ η, splitting the budget evenly — is explicitly outside the theory. That is the estimator a user would actually run. The paper states this plainly, which I respect, but the gap is real.

Net assessment: this deserves a serious referee. I would want Theorem 1 restated with a correct noise tail, a discussion of the extra log factor, and a clearer account of which conditions a user can actually check. The appendix correction alone justifies sending it out.

Referee Report

4 major / 5 minor

Summary. The paper proposes a univariate differentially private mean estimator, the private modified winsorized mean (PMW), which combines the non-private modified winsorized mean of Lugosi and Mendelson (2021) with the unbounded private quantile algorithm of Durfee (2024). The estimator is designed as an aggregator for subsample-and-aggregate, and the authors claim it is minimax optimal for distributions with two moments under adversarial contamination, for both pure and zero-concentrated differential privacy. They derive a finite-sample deviation bound (Theorem 1) and a subsample-and-aggregate corollary, provide a zCDP version of the quantile algorithm, correct an error in Lugosi and Mendelson's proof, and support the method with simulations and a real-data case study on linear mixed models. The central theoretical claim is that the PMW mean achieves the minimax rate for DP mean estimation up to logarithmic factors.

Significance. If the main result is repaired, this is a strong contribution to practical DP mean estimation and subsample-and-aggregate. The empirical evaluation is thorough, showing large improvements over existing multivariate methods in the case study, and the paper provides a useful correction to a known proof error. The extension of Durfee's unbounded quantile estimator to zCDP is also valuable. However, the main theorem's proof currently contains a false tail-bound claim and the formal conditions of the theorem are not checkable by a user; these issues need to be resolved before the result can be accepted as stated. The work is significant because it targets a practical gap: making subsample-and-aggregate work with weak input bounds and small aggregator sample sizes.

major comments (4)

[Appendix C, proof of Theorem 1] The statement "Pr(Z1 ≥ 1) = e^{-n}" for a standard Laplace random variable is false; the correct probability is P(Z1 ≥ 1) = e^{-1}/2. Consequently, the event {Z1 ≤ 1} used to bound the additive noise term (Z1(ξ̃_{1−ζ} − ξ̃_ζ)/(nε3)) does not hold with probability 1 − δ/4. A correct tail bound gives |Z1| ≤ log(4/δ) with probability at least 1 − δ/4, which inserts an extra log(1/δ) factor into the final term of (1): the theorem is established only with σ log(4/δ)/(√n ε3) in place of σ/(√n ε3). Since the minimax claim depends on this noise term, Theorem 1 as stated is not proven.
[Condition 3 and Remark 1] Condition 3 requires β < 1 + b_n, where b_n is a function of unknown population quantiles ξ_{5ζ/4}, ξ_{3ζ/4}, ξ_{1−3ζ/4}, and ξ_{1−5ζ/4}. A data user cannot verify this condition from the sample, and the recommended practical choice β = 1.001 (Section 5) can violate it for bounded-support distributions, where the text states b_n = O(1/n). This makes the theorem an existence guarantee over unknown distributional parameters rather than a readily applicable bound; the discussion in Remark 1 does not resolve the user's inability to check the condition.
[Section 4] The practical estimator μ̃'_p used in all simulations and the real-data case study is not covered by the theory: it uses all data in both estimation steps, replaces ζ with C/n ∨ η, and employs the heuristic budget split ρ1=ρ2=ρ/4, ρ3=ρ/2, which the paper itself states is "not covered by the present theory." Since the paper's empirical claims are based on this estimator, a formal analysis of the practical variant—or at least a precise statement of the gap—is needed before the practical claims can be taken as supported by the theory.
[Appendix C, probability accounting] The union bound following equation (9) is inconsistent with the claimed confidence 1 − δ. The event A3 fails with probability δ/4, the Bernstein tail bound is invoked with p = δ/4 (giving failure δ/4), and the Laplace event fails with probability e^{−n} ≤ δ/4. These combine to success probability at most 1 − 3δ/4, not 1 − δ. The constants need to be rebalanced (for example, by using δ/8 for the first two events) to recover the claimed high-probability guarantee.

minor comments (5)

[Lemma 2] The second inequality of Lemma 2 states the exponent exp(−nt(ε1+ε2)), but the proof in Appendix E establishes exp(−nt(ε1∧ε2)) for both cases. Since the theorem uses the weaker exponent, this is only an overclaim in the lemma statement, but the statement should be corrected.
[Appendix E] There are small notational typos in the proof of Lemma 2, such as "tn(ε2 ∧ ε2)" and a missing factor in the union bound; these do not affect the final bound but should be cleaned up.
[Figure 2 and Table 3] The case study correctly notes that the private estimate of the winter effect has the opposite sign at ρ=1, but the figure and table would benefit from a more explicit visual or tabular flag for this discrepancy, as it is a key practical finding.
[Definitions and notation] The symbol ζ is used both as the theoretical clipping proportion and as a function of (n, η, δ, ℓ, u, β); this double use is confusing and it would be clearer to introduce a separate symbol for the function.
[Corollary 1] The statement of Corollary 1 requires ε1, ε2, ρ1, ρ2 > 3/56, but the zCDP version of the quantile algorithm uses Gaussian noise and the condition may need to be verified for ρ; consider clarifying the analogous condition for the zCDP case.

Circularity Check

0 steps flagged · score 1.0 of 10

No circularity: the PMW mean's bound derives from newly proven quantile concentration and external robust/lower-bound results, not from a fitted or self-referential input.

full rationale

The derivation chain is not circular. The estimator is defined as a clipped mean at private quantiles (Definition 2), and the upper bound in Theorem 1 is obtained by (i) proving concentration of the private quantiles in Lemmas 2-3 from the algorithm's own noise variables, (ii) adapting the Lugosi-Mendelson robust clipped-mean argument, with an error in that argument identified and corrected in Appendix G, and (iii) controlling the Laplace noise term via Chebyshev/quantile-range bounds. The lower bound is cited from external work (Kamath et al. 2020; Lugosi and Mendelson 2019). No equation in the proof reduces to the definition of the estimator or to a fitted parameter. The self-citations to Ramsay and Diaz-Rodriguez (2024) (unbounded quantile consistency) and Ramsay and Spicker (2023) (robust median discussion) are motivational or illustrative and are not premises of Theorem 1 or Corollary 1; the quantile concentration used in the proof is established inside the paper. Condition 3 is a nontrivial assumption involving unknown quantiles and is acknowledged in Remark 1 as a practical heuristic, but an uncheckable assumption is an applicability gap, not an input-output equivalence. The proof of Theorem 1 does contain a separate mathematical error: it states 'Pr(Z1 ≥ 1) = e−n ≤ δ/4' for a standard Laplace variable Z1, whereas the correct value is e^{-1}/2 ≈ 0.184, independent of n. Controlling the noise at level 1−δ/4 requires |Z1| ≤ log(4/δ), which would add a log(1/δ) factor to the third term. This is a correctness issue in the proof, not a circularity, so it does not raise the circularity score.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central result depends on standard probability, the finite-variance contamination model (Condition 1), and two user-facing conditions on ℓ,u,β (Conditions 2-3) that involve unknown population quantiles. The practical variant introduces additional user parameters (C, η, budget split). No new entities are postulated.

free parameters (5)

G, clipping parameter (theory: ζ, practice: C/n ∨ η) = C between 1 and 100 in simulations; C=1 in application
Controls the winsorization fraction; in theory ζ is set as 16η + (112/3) log(...)/n, in practice the user chooses C and η.
η (assumed contamination level) = 0 or 0.3 in simulations; 0 in application
User input; determines clipping and the contamination term σ√η.
β (quantile grid size) = 1.001 in practice
Controls granularity of private quantile search; Condition 3 imposes an upper bound depending on unknown quantile gaps.
ℓ, u (lower/upper bounds for quantile search) = ℓ=-50, u=50 in simulations; ℓ=-40√6, u=40√6 in application
Must contain the extreme quantiles of interest; loose bounds suffice but enter the log term and Condition 2.
ρ1, ρ2, ρ3 (privacy budget split) = ρ/4, ρ/4, ρ/2
User choice; experiments show limited sensitivity except at very small n.

assumptions (5)

domain assumption Condition 1: i.i.d. sample with finite variance and at most 2ηn corrupted points
Defines the statistical model for the mean estimation problem.
domain assumption Condition 2: ℓ ≤ ξ_{5ζ/4} and u ≥ ξ_{1−5ζ/4}
The user-supplied bounds must bracket the population quantiles at the clipping level, which depends on the unknown distribution.
domain assumption Condition 3: β < 1 + b_n with b_n defined via quantile gaps
Grid coarseness bounded by a distribution-dependent quantity; not verifiable from data alone.
standard math Durfee's unbounded quantile algorithm provides (ε1+ε2)-DP
Used as the private quantile oracle; cited from Durfee 2024.
standard math Chebyshev and Bernstein inequalities
Used throughout the proof of Theorem 1.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Improved subsample-and-aggregate via the private modified winsorized mean." pith.science (2026). https://pith.science/paper/AOF4477Z

@misc{pith2026250114095,
  author       = {Pith},
  title        = {Pith review of: Improved subsample-and-aggregate via the private modified winsorized mean},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AOF4477Z}},
  note         = {Machine review of arXiv:2501.14095}
}

read the original abstract

We develop a univariate, differentially private mean estimator, called the private modified winsorized mean, designed to be used as the aggregator in subsample-and-aggregate. We demonstrate, via real data analysis, that common differentially private multivariate mean estimators may not perform well as the aggregator, even in large datasets, motivating our developments.We show that the modified winsorized mean is minimax optimal for several, large classes of distributions, even under adversarial contamination. We also demonstrate that, empirically, the private modified winsorized mean performs well compared to other private mean estimates. We consider the modified winsorized mean as the aggregator in subsample-and-aggregate, deriving a finite sample deviations bound for a subsample-and-aggregate estimate generated with the new aggregator. This result yields two important insights: (i) the optimal choice of subsamples depends on the bias of the estimator computed on the subsamples, and (ii) the rate of convergence of the subsample-and-aggregate estimator depends on the robustness of the estimator computed on the subsamples.

Figures

Figures reproduced from arXiv: 2501.14095 by the authors.

**Figure 1.** The empirical log MSE of µ˜p, µ˜, with η = 0 and η = 0.3, compared to the estimator of Bun and Steinke (2019), Bun, with t = 0.1, compared across a variety of different population distributions (Gaussian, mixture of Gaussians, Skewed, Heavy-Tailed, and a Contaminated Gaussian) and different privacy budgets (ρ) [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗

**Figure 2.** Actual mean values, non-private estimated mean values and private estimated [PITH_FULL_IMAGE:figures/full_fig_p015_2.png] view at source ↗

**Figure 3.** The empirical log MSE of all estimators, compared across a variety of different population distributions (Mixture of Gaussians, Skewed, Heavy-Tailed, and a Contaminated Gaussian) at ρ = 0.1. I.3 Results comparing estimators Below are the empirical mean squared errors of each private estimator, for each of the simulation scenarios. I.4 Results comparing the parameters ρ and C Below are the empirical mean squared erro… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: The empirical log MSE of all estimators, compared across a variety of different population distributions (Mixture of Gaussians, Skewed, Heavy-Tailed, and a Contaminated Gaussian) at ρ = 0.5 [PITH_FULL_IMAGE:figures/full_fig_p038_4.png]

**Figure 5.** Figure 5: The empirical log MSE of all estimators, compared across a variety of different population distributions (Mixture of Gaussians, Skewed, Heavy-Tailed, and a Contaminated Gaussian) at ρ = 1 [PITH_FULL_IMAGE:figures/full_fig_p039_5.png]

**Figure 6.** Figure 6: The empirical log MSE of all estimators, compared across a variety of different privacy budgets for the Gaussian distribution [PITH_FULL_IMAGE:figures/full_fig_p039_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 26 canonical work pages

[1]

Amin, K., Joseph, M., Ribero, M., and Vassilvitskii, S. (2022). Easy differentially private linear regression. arXiv preprint arXiv:2208.07353

arXiv 2022
[2]

and Brunel, V.-E

Avella-Medina, M. and Brunel, V.-E. (2019). Differentially private sub- Gaussian location estimators. arXiv e-prints . arXiv:1906.11923

arXiv 2019
[3]

Bassily, R., Thakkar, O., and Thakurta, A. (2018). Model-agnostic private learning via stability. arXiv preprint arXiv:1803.05101

arXiv 2018
[4]

Biswas, S., Dong, Y., Kamath, G., and Ullman, J. (2020). CoinPress : Practical private mean and covariance estimation. Advances in Neural Information Processing Systems , 33:14475--14485

work page 2020
[5]

Brown, G., Gaboardi, M., Smith, A., Ullman, J., and Zakynthinou, L. (2021). Covariance-aware private mean estimation without private covariance estimation. Advances in Neural Information Processing Systems , 34:7950--7964

work page 2021
[6]

Brown, G., Hopkins, S., and Smith, A. (2023). Fast, sample-efficient, affine-invariant private mean and covariance estimation for subgaussian distributions. In Neu, G. and Rosasco, L., editors, Proceedings of Thirty Sixth Conference on Learning Theory , volume 195 of Proceedings of Machine Learning Research , pages 5578--5579. PMLR

work page 2023
[7]

Bun, M., Kamath, G., Steinke, T., and Wu, S. Z. (2019). Private hypothesis selection. Advances in Neural Information Processing Systems , 32

work page 2019
[8]

and Steinke, T

Bun, M. and Steinke, T. (2016). Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds , page 635–658. Springer Berlin Heidelberg

work page 2016

Show all 36 references

[9]

and Steinke, T

Bun, M. and Steinke, T. (2019). Average-case averages: Private algorithms for smooth sensitivity and mean estimation. Advances in Neural Information Processing Systems , 32

2019
[10]

T., Wang, Y., and Zhang, L

Cai, T. T., Wang, Y., and Zhang, L. (2021). The cost of privacy: Optimal rates of convergence for parameter estimation with differential privacy . The Annals of Statistics , 49(5):2825 -- 2850

2021
[11]

I., Yang, X., Zakynthinou, L., and Zhivotovskiy, N

Dagan, Y., Jordan, M. I., Yang, X., Zakynthinou, L., and Zhivotovskiy, N. (2024). Dimension-free private mean estimation for anisotropic distributions

2024
[12]

Duchi , J., Haque , S., and Kuditipudi , R. (2023). A Fast Algorithm for Adaptive Private Mean Estimation . arXiv e-prints , page arXiv:2301.07078

2023 arXiv
[13]

Durfee, D. (2024). Unbounded differentially private quantile and maximum estimation. Advances in Neural Information Processing Systems , 36

2024
[14]

and Lei, J

Dwork, C. and Lei, J. (2009). Differential privacy and robust statistics . Proceedings of the 41st annual ACM symposium on theory of computing - STOC '09 , page 371

2009
[15]

Dwork, C., McSherry, F., Nissim, K., and Smith, A. (2006). Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography Conference , pages 265--284

2006
[16]

and Roth, A

Dwork, C. and Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9(3--4):211--407

2014
[17]

Esfandiari, H., Mirrokni, V., and Narayanan, S. (2022). Tight and robust private mean estimation with few users

2022
[18]

and Duchi , J

Foygel Barber , R. and Duchi , J. C. (2014). Privacy and statistical risk: F ormalisms and minimax bounds . arXiv e-prints . arXiv:1412.4451

2014 arXiv
[19]

L., Ramsay, K., Maunder, R., Bondy, S

Gutmanis, I., Coleman, B. L., Ramsay, K., Maunder, R., Bondy, S. J., CCS Working Group , and McGeer, A. (2024). Psychological distress among healthcare providers during the COVID-19 pandemic: patterns over time. BMC Health Serv. Res. , 24(1):1214

2024
[20]

B., Kamath, G., and Majid, M

Hopkins, S. B., Kamath, G., and Majid, M. (2022). Efficient mean estimation with pure differential privacy via a sum-of-squares exponential mechanism. In Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing , pages 1406--1417

2022
[21]

Huber, P. J. (1981). Robust Statistics . Wiley & Sons, New York

1981
[22]

Jordon, J., Yoon, J., and van der Schaar, M. (2019). Differentially private bagging: Improved utility and cheaper privacy than subsample-and-aggregate. Advances in Neural Information Processing Systems , 32

2019
[23]

Kamath , G., Li , J., Singhal , V., and Ullman , J. (2018). Privately learning high-dimensional distributions. arXiv e-prints . arXiv:1805.00216

2018 arXiv
[24]

Kamath, G., Singhal, V., and Ullman, J. (2020). Private mean estimation of heavy-tailed distributions. In Conference on Learning Theory , pages 2204--2235. PMLR

2020
[25]

and Vadhan , S

Karwa , V. and Vadhan , S. (2017). Finite sample differentially private confidence intervals. arXiv e-prints . arXiv:1711.03908

2017 arXiv
[26]

Liu , X., Kong , W., Kakade , S., and Oh , S. (2021a). Robust and differentially private mean estimation. arXiv e-prints . arXiv:2102.09159

2021 arXiv
[27]

Liu , X., Kong , W., and Oh , S. (2021b). Differential privacy and robust statistics in high dimensions . arXiv e-prints . arXiv:2111.06578

2021 arXiv
[28]

and Mendelson, S

Lugosi, G. and Mendelson, S. (2019). Mean estimation and regression under heavy-tailed distributions: A survey. Foundations of Computational Mathematics , 19(5):1145–1190

2019
[29]

and Mendelson, S

Lugosi, G. and Mendelson, S. (2021). Robust multivariate mean estimation: The optimality of trimmed mean . The Annals of Statistics , 49(1):393 -- 410

2021
[30]

Nissim, K., Raskhodnikova, S., and Smith, A. (2007). Smooth sensitivity and sampling in private data analysis. In Proceedings of the Thirty-Ninth Annual ACM Symposium on Theory of Computing , STOC '07, page 75–84, New York, NY, USA. Association for Computing Machinery

2007
[31]

Papernot, N., Abadi, M., Erlingsson, U., Goodfellow, I., and Talwar, K. (2016). Semi-supervised knowledge transfer for deep learning from private training data. arXiv preprint arXiv:1610.05755

2016 arXiv
[32]

and Diaz-Rodriguez, J

Ramsay, K. and Diaz-Rodriguez, J. (2024). Differentially private boxplots

2024
[33]

and Spicker , D

Ramsay , K. and Spicker , D. (2023). Differentially private projection-depth-based medians . arXiv e-prints , page arXiv:2312.07792

2023 arXiv
[34]

Smith, A. (2011). Privacy-preserving statistical estimation with optimal convergence rates. In Proceedings of the forty-third annual ACM symposium on Theory of computing , pages 813--822

2011
[35]

Tsfadia, E., Cohen, E., Kaplan, H., Mansour, Y., and Stemmer, U. (2022). Friendlycore: Practical differentially private aggregation. In International Conference on Machine Learning , pages 21828--21863. PMLR

2022
[36]

Yu, M., Ren, Z., and Zhou, W.-X. (2024). Gaussian differentially private robust mean estimation and inference . Bernoulli , 30(4):3059 -- 3088

2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Amin, K., Joseph, M., Ribero, M., and Vassilvitskii, S. (2022). Easy differentially private linear regression. arXiv preprint arXiv:2208.07353

arXiv 2022

[2] [2]

and Brunel, V.-E

Avella-Medina, M. and Brunel, V.-E. (2019). Differentially private sub- Gaussian location estimators. arXiv e-prints . arXiv:1906.11923

arXiv 2019

[3] [3]

Bassily, R., Thakkar, O., and Thakurta, A. (2018). Model-agnostic private learning via stability. arXiv preprint arXiv:1803.05101

arXiv 2018

[4] [4]

Biswas, S., Dong, Y., Kamath, G., and Ullman, J. (2020). CoinPress : Practical private mean and covariance estimation. Advances in Neural Information Processing Systems , 33:14475--14485

work page 2020

[5] [5]

Brown, G., Gaboardi, M., Smith, A., Ullman, J., and Zakynthinou, L. (2021). Covariance-aware private mean estimation without private covariance estimation. Advances in Neural Information Processing Systems , 34:7950--7964

work page 2021

[6] [6]

Brown, G., Hopkins, S., and Smith, A. (2023). Fast, sample-efficient, affine-invariant private mean and covariance estimation for subgaussian distributions. In Neu, G. and Rosasco, L., editors, Proceedings of Thirty Sixth Conference on Learning Theory , volume 195 of Proceedings of Machine Learning Research , pages 5578--5579. PMLR

work page 2023

[7] [7]

Bun, M., Kamath, G., Steinke, T., and Wu, S. Z. (2019). Private hypothesis selection. Advances in Neural Information Processing Systems , 32

work page 2019

[8] [8]

and Steinke, T

Bun, M. and Steinke, T. (2016). Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds , page 635–658. Springer Berlin Heidelberg

work page 2016