Bounds on the Posterior-to-Prior Ratios for Inclusion Belief under Bounded Differential Privacy

• URL: http://arxiv.org/abs/2608.30473v1
• Date: Mon, 31 Aug 2026 09:01:06 GMT
• Title: Bounds on the Posterior-to-Prior Ratios for Inclusion Belief under Bounded Differential Privacy
• Abstract summary: We study how much an adversary's belief about an individual's inclusion in a dataset can change after observing a protected release.<n>These findings suggest that the inferential privacy guarantees provided by differentially private mechanisms may be substantially stronger in practice.
• Score: 0.09799637101641147
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Differential privacy has become the standard for generating privacy-protected data releases. However, differential privacy does not translate intuitively to disclosure risk. In particular, it remains unclear how much an adversary's belief about an individual's inclusion in a dataset can change after observing a protected release. To address this question, we derive upper and lower bounds on the posterior-to-prior ratios of inclusion beliefs under bounded probabilistic and approximate differential privacy. By assuming a worst-case adversary with all-but-one auxiliary information, i.e., knowledge of all except for one of the participants in a dataset, we obtain bounds that apply to any adversary. Because these bounds may fail with non-zero probability, we study the corresponding failure probability for the Gaussian mechanism. We derive a theoretical upper limit on this probability and compare it with Monte Carlo estimates across a wide range of parameter settings. The observed failure rate is several orders of magnitude smaller than its theoretical upper limit, indicating that the latter is highly conservative. These findings suggest that the inferential privacy guarantees provided by differentially private mechanisms may be substantially stronger in practice than what is implied by the theoretical upper limit.

Related papers

• Predictability as a Fine-Grained Measure for Privacy [4.861418621297099]
  We introduce privacy via predictability, a fine-grained framework that explicitly incorporates the attacker's core knowledge.<n> predictability provides a finer-grained privacy metric tailored to specific sensitive information and specific attacker models.<n>Our approach is complementary to Differential privacy (DP) and can be used alongside DP to provide fine-grained privacy control.
  arXiv  Detail & Related papers  (2026-06-18T17:55:31Z)
• Parallel Composition for Statistical Privacy [0.0]
  A privacy mechanism is proposed that is based on subsampling and randomly partitioning the database to bound the dependency among queries.<n>These bounds show that in realistic application scenarios taking the entropy of distributions into account yields improvements of privacy and precision guarantees.
  arXiv  Detail & Related papers  (2026-02-10T10:13:44Z)
• Differentially Private Random Feature Model [47.35176457481132]
  We produce a differentially private random feature model for privacy-preserving kernel machines.<n>We show that our method preserves privacy and derive a generalization error bound for the method.
  arXiv  Detail & Related papers  (2024-12-06T05:31:08Z)
• From Mean to Extreme: Formal Differential Privacy Bounds on the Success of Real-World Data Reconstruction Attacks [54.25638567385662]
  Differential Privacy in machine learning is often interpreted as guarantees against membership inference.<n> translating DP budgets into quantitative protection against the more damaging threat of data reconstruction remains a challenging open problem.<n>This paper bridges the critical gap by deriving the first formal privacy bounds tailored to the mechanics of demonstrated "from-scratch" attacks.
  arXiv  Detail & Related papers  (2024-02-20T09:52:30Z)
• Optimal Private Discrete Distribution Estimation with One-bit Communication [63.413106413939836]
  We consider a private discrete distribution estimation problem with one-bit communication constraint. We characterize the first-orders of the worst-case trade-off under the one-bit communication constraint. These results demonstrate the optimal dependence of the privacy-utility trade-off under the one-bit communication constraint.
  arXiv  Detail & Related papers  (2023-10-17T05:21:19Z)
• Improving the Variance of Differentially Private Randomized Experiments through Clustering [16.166525280886578]
  We propose a new differentially private mechanism, "Cluster-DP"<n>We demonstrate that selecting higher-quality clusters, according to a quality metric we introduce, can decrease the variance penalty without compromising privacy guarantees.
  arXiv  Detail & Related papers  (2023-08-02T05:51:57Z)
• On the Query Complexity of Training Data Reconstruction in Private Learning [0.0]
  We analyze the number of queries that a whitebox adversary needs to make to a private learner in order to reconstruct its training data. For $(epsilon, delta)$ DP learners with training data drawn from any arbitrary compact metric space, we provide the emphfirst known lower bounds on the adversary's query complexity.
  arXiv  Detail & Related papers  (2023-03-29T00:49:38Z)
• Summary Statistic Privacy in Data Sharing [23.50797952699759]
  We study a setting where a data holder wishes to share data with a receiver, without revealing certain summary statistics of the data distribution. We propose summary statistic privacy, a metric for quantifying the privacy risk of such a mechanism. We show that the proposed quantization mechanisms achieve better privacy-distortion tradeoffs than alternative privacy mechanisms.
  arXiv  Detail & Related papers  (2023-03-03T15:29:19Z)
• Analyzing Privacy Leakage in Machine Learning via Multiple Hypothesis Testing: A Lesson From Fano [83.5933307263932]
  We study data reconstruction attacks for discrete data and analyze it under the framework of hypothesis testing. We show that if the underlying private data takes values from a set of size $M$, then the target privacy parameter $epsilon$ can be $O(log M)$ before the adversary gains significant inferential power.
  arXiv  Detail & Related papers  (2022-10-24T23:50:12Z)
• Generalised Likelihood Ratio Testing Adversaries through the Differential Privacy Lens [69.10072367807095]
  Differential Privacy (DP) provides tight upper bounds on the capabilities of optimal adversaries. We relax the assumption of a Neyman--Pearson (NPO) adversary to a Generalized Likelihood Test (GLRT) adversary. This mild relaxation leads to improved privacy guarantees.
  arXiv  Detail & Related papers  (2022-10-24T08:24:10Z)
• On the Statistical Complexity of Estimation and Testing under Privacy Constraints [17.04261371990489]
  We show how to characterize the power of a statistical test under differential privacy in a plug-and-play fashion. We show that maintaining privacy results in a noticeable reduction in performance only when the level of privacy protection is very high. Finally, we demonstrate that the DP-SGLD algorithm, a private convex solver, can be employed for maximum likelihood estimation with a high degree of confidence.
  arXiv  Detail & Related papers  (2022-10-05T12:55:53Z)
• Individual Privacy Accounting for Differentially Private Stochastic Gradient Descent [69.14164921515949]
  We characterize privacy guarantees for individual examples when releasing models trained by DP-SGD. We find that most examples enjoy stronger privacy guarantees than the worst-case bound. This implies groups that are underserved in terms of model utility simultaneously experience weaker privacy guarantees.
  arXiv  Detail & Related papers  (2022-06-06T13:49:37Z)
• Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning [43.6041475698327]
  Differentially private (DP) machine learning allows us to train models on private data while limiting data leakage. In this paper, we evaluate the importance of the adversary capabilities allowed in the privacy analysis of DP training algorithms.
  arXiv  Detail & Related papers  (2021-01-11T18:47:11Z)
• On Lower Bounds for Standard and Robust Gaussian Process Bandit Optimization [55.937424268654645]
  We consider algorithm-independent lower bounds for the problem of black-box optimization of functions having a bounded norm. We provide a novel proof technique for deriving lower bounds on the regret, with benefits including simplicity, versatility, and an improved dependence on the error probability.
  arXiv  Detail & Related papers  (2020-08-20T03:48:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.