Differential Privacy Papers

@dppapers

🤖 new arXiv preprints mentioning "differential privacy" or "differentially private" in the title/abstract unrelated quantum/FL papers + updates from [Under construction.]

0 Following533 Followers1,533 Posts

Bluesky

Is this your profile?Claim it and dppapers.dirty.social is yours.Claim profile

Differential Privacy Papers@dppapers· 19d

Edit-Neighboring Data Streams and Privacy under Continual Observation Joel Daniel Andersson, Anamay Chaturvedi, Monika Henzinger, Roodabeh Safavi http://arxiv.org/abs/2607.20727

$Edit-Neighboring Data Streams and Privacy under Continual Observation Joel Daniel Andersson, Anamay Chaturvedi, Monika Henzinger, Roodabeh Safavi http://arxiv.org/abs/2607.20727 Differential privacy under Continual Observation (CO) quantifies the loss in privacy that occurs when outputs generated using a stream of sensitive input data are published in the online setting. In this paper, we consider a more stringent notion of privacy compared to prior work wherein an individual's participation may shift the entire stream by a time-step. We define a new notion of edit-neighboring streams that captures this scenario. Our findings are as follows. First, we prove that on a stream of length $T$, every additive-noise mechanism incurs error $\tildeΩ(\min\{T^{1/3}/\varepsilon^{2/3}, T\})$ when required to be $\varepsilon$-DP under CO for edit-neighboring streams. This includes state-of-the-art continual counters constructed via the factorization mechanism that in the standard neighboring setting incur only polylogarithmic additive error. Second, we construct the first mechanisms with polylogarithmic additive error for our more stringent notion of privacy. We show that we can recover the same additive error as in the standard notion of privacy albeit with worse constant coefficients for both arbitrary input streams and sparse streams. Third, we show that the notion of edit-neighboring streams inhabits a `sweet-spot' in terms of generality and additive error incurred. More precisely, we show that the even more general notion of prefix-sum neighboring streams---which arises naturally in reductions for problems under CO---must incur additive error scaling as $\tildeΩ(\min\{T^{1/3}/\varepsilon^{2/3}, T\})$ for any mechanism that is $\varepsilon$-DP under continual observation. Finally, we show empirically on synthetic data that when compared with prior work, our mechanism achieves a superior trade-off between the success probability of a simple distinguishing attack, and the$

Differential Privacy Papers@dppapers· 20d

Recovering Clinical Utility Under Differential Privacy: Empirical Validation of Adaptive Federated Aggregation on Heterogeneous Cardiovascular Datasets Rodrigo Tertulino, Laercio Alencar, Ricardo Almeida http://arxiv.org/abs/2607.19403

Differential Privacy Papers@dppapers· 20d

End-to-End Differential Privacy in Training Deep Neural Network Classifiers Huaiyuan Rao, Calvin Hawkins, Alexander Benvenuti, Matthew Hale http://arxiv.org/abs/2607.19580

$End-to-End Differential Privacy in Training Deep Neural Network Classifiers Huaiyuan Rao, Calvin Hawkins, Alexander Benvenuti, Matthew Hale http://arxiv.org/abs/2607.19580 Differentially private machine learning enables model training on sensitive data while ensuring that individual data is unlikely to be recoverable from the parameters of the resulting model. However, existing work often privatizes both training inputs and their labels, and these protections may be conservative when labels are public or can be safely made public. Therefore, in this work we propose a novel private training framework that instead privatizes training inputs while keeping labels public. We consider neural networks with softmax output layers, and thus the mapping from training inputs to the output of the softmax layer is a mapping onto the unit simplex. We randomize softmax outputs during training by applying the Dirichlet mechanism to enforce differential privacy for the training inputs, hence the ``end-to-end'' label. Because training data is reused across multiple training epochs, we use the notion of \Renyi differential privacy to formulate tight bounds on the strength of privacy provided by the Dirichlet mechanism across repeated uses. We show empirically that we attain new state-of-the-art accuracy when training from scratch on CIFAR10, MNIST, MedMNIST, FashionMNIST, and SVHN across all privacy budgets evaluated. Notably, when implementing $(ε, δ)$-differential privacy with $δ=10^{-5}$, we improve the prior state-of-the-art accuracy from $78.37\%$ to $88.17\%$ at $ε=4$ on CIFAR10, and our approach has $82.96\%$ accuracy even for $ε=1$, which significantly outperforms prior work.$

Differential Privacy Papers@dppapers· 20d

Pure-DP Statistical Query Release at the Conjectured Square-Root Rate Jack Fitzsimons http://arxiv.org/abs/2607.20418

$Pure-DP Statistical Query Release at the Conjectured Square-Root Rate Jack Fitzsimons http://arxiv.org/abs/2607.20418 Nikolov and Ullman asked whether k statistical queries on a universe of size T can be released under pure differential privacy with expected worst-coordinate error at the square-root rate suggested by known lower bounds. We prove their conjectured upper bound. For every database size n and privacy parameter $\varepsilon>0$, there is an $\varepsilon$-differentially private mechanism with expected error $O(\min\{1,\sqrt{\log(2T)\log(2k)/(\varepsilon n)}\})$. This matches the lower-bound dependence in the standard high-dimensional regimes where those bounds apply; the shifted logarithms and outer minimum make the upper bound valid without additional parameter assumptions. The construction starts from a selection-only private multiplicative weights transcript, then replaces its probability mass function by a distance-penalized likelihood envelope. To prove that the modification preserves accuracy, a likelihood-level Maurey argument upper-bounds each Hamming-ball maximum by a small family of auxiliary PMW laws. Renyi moment bounds control nearby balls, a direct mixture bound controls distant balls, and grouping radii at the privacy scale prevents an additional $1/\varepsilon$ factor in the error. The mechanism is information-theoretic. A companion Lean 4 development machine-checks the finite construction, pure privacy after deterministic decoding, and the displayed all-regimes upper bound.$

Differential Privacy Papers@dppapers· 21d

Private Approximation of Graph Spectra and Cuts via Spectral Amplifiers Chenglin Fan, Jingcheng Liu, Pan Peng, Hangyu Xu, Zongrui Zou http://arxiv.org/abs/2607.18846

$Private Approximation of Graph Spectra and Cuts via Spectral Amplifiers Chenglin Fan, Jingcheng Liu, Pan Peng, Hangyu Xu, Zongrui Zou http://arxiv.org/abs/2607.18846 We study the problem of releasing a synthetic graph that approximates the sizes of all cuts of an input graph under edge-level differential privacy. If one insists on purely additive error, the optimal worst-case error is $\widetildeΘ(n^{3/2})$. If one allows a small multiplicative slack, an information-theoretic exponential-time mechanism achieves nearly linear additive error, but the best known polynomial-time algorithms have substantially larger error. We give a polynomial-time $(\varepsilon,δ)$-differentially private algorithm which, for every $n$-vertex unweighted graph $G$, outputs a non-negative weighted synthetic graph $\widetilde G$ such that, with high probability, every cut $S\subseteq V(G)$ satisfies \[ |w_G(S)-w_{\widetilde G}(S)| \le γw_G(S)+\widetilde O_{\varepsilon,δ,γ}(n^{13/12+o(1)}). \] This improves the previous polynomial-time worst-case bound $\widetilde O(n^{5/4+o(1)})$ of Aamand et al. (ICML 2025) for mixed multiplicative/additive private cut approximation. The main technical ingredient is a new set of private spectral primitives for bounded-degree graphs, one of them gives spectral error $\widetilde O_δ((nd)^{1/4}/\sqrt\varepsilon)$ in estimating the graph Laplacian for graphs of maximum degree $d$, being the first to beat the standard $\min\{2d,\widetilde O_δ(\sqrt{n}/\varepsilon)\}$ baseline in the high-degree regime. We further develop a primitive with a sharper error dependence on $n$ and $d$ for the downstream cut approximation. Combined with a new edge-sensitive terminal cut oracle with additive error $\widetilde O(n+(n^2M)^{1/3})$ on graphs with $M$ edges, this yields the final worst-case $\widetilde O(n^{13/12+o(1)})$ private cut-release error.$

Differential Privacy Papers@dppapers· 22d

Privacy Cost as Equity Input: A Group Fairness Criterion for Differentially Private Machine Learning Rakshit Naidu http://arxiv.org/abs/2607.16620

$Privacy Cost as Equity Input: A Group Fairness Criterion for Differentially Private Machine Learning Rakshit Naidu http://arxiv.org/abs/2607.16620 Differential privacy (DP) is increasingly deployed to limit membership inference risk in machine-learning systems. Prior work has shown that DP-SGD can widen accuracy disparities across demographic groups, but this framing treats fairness as a purely outcome-side concern. We argue that privacy cost, the information leakage borne by each group, is itself a form of harm, and adopt a compensatory-fairness framework in which a group that involuntarily bears greater privacy exposure is owed proportionally greater benefit from the system. From this principle we derive the \emph{Privacy-Cost Equity Ratio} (PCER), a group fairness metric defined as a group's positive prediction rate normalized by its per-group overfitting gap. By a standard membership inference bound, this overfitting gap upper-bounds each group's vulnerability to inference attacks, making PCER a conservative measure of benefit relative to exposure. PCER needs only per-group train and test accuracy (no shadow models), making it a practical post-hoc audit tool. We evaluate PCER alongside standard fairness metrics across six benchmark--attribute combinations spanning tabular and NLP domains, under DP-SGD at a range of privacy budgets, and validate the overfitting-gap proxy against a direct threshold membership-inference attack. The results reveal patterns that outcome-based metrics miss. On COMPAS, PCER uncovers a persistent double disadvantage: the protected group bears both greater privacy exposure and worse predictive outcomes, something demographic parity gap masks entirely. Sensitivity analysis shows very strong privacy guarantees collapse both groups' overfitting to a numerical floor, rendering exposure-based audits uninformative in that regime. Together, these findings show that fairness audits of privacy-preserving systems must account for who bears the$

Differential Privacy Papers@dppapers· 22d

Fast and Private Max-Sum Diversification Ron Zadicario, Tova Milo http://arxiv.org/abs/2607.17196

Differential Privacy Papers@dppapers· 22d

Optimal Domain-Aware Privacy Mechanisms for Synthetic Data Generation Sajani Vithana, Sangwon Jung, Haoyang Hu, Viveck R. Cadambe, Flavio P. Calmon, Haewon Jeong http://arxiv.org/abs/2607.18021

Differential Privacy Papers@dppapers· 22d

RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning Kwunhang Wong, Jichang Yang, Karl M. H. Lai, Hegan Chen, Songqi Wang, Wei Xuan, Ning Lin, Han Wang, Xiaojuan Qi, Zhongrui Wang http://arxiv.org/abs/2607.18169

Differential Privacy Papers@dppapers· 26d

Better Privacy Guarantees for Larger Groups JacK Fitzsimons http://arxiv.org/abs/2607.14406

$Better Privacy Guarantees for Larger Groups JacK Fitzsimons http://arxiv.org/abs/2607.14406 Pujol and Desfontaines asked whether a private histogram can allow more error on larger counts and use that slack to protect members of larger groups more strongly. We study this question for fixed disjoint groups under add-or-remove-one adjacency. The privacy budget $v(n)$ depends on the affected count, is nonincreasing, and must bound both Rényi-divergence directions at every order. This is the count-dependent form of zero-concentrated differential privacy (zCDP) studied here. The original strict relative-error condition is impossible at count zero. We therefore make the boundary tolerance explicit by requiring $\mathbb{E}\lvert\widehat{x}_i-x_i\rvert < r\max\{x_i,1\}$, without changing the requirement at any positive count. Our main result determines the best dependence on group size. For the upper bound, we directly specialize an existing shifted-transformation framework. The resulting shifted-log Gaussian mechanism has a certified budget $v(n)=O_r(n^{-2})$. Conversely, for every fixed $0<r<1$, any mechanism satisfying the same positive-count utility requirement and count-dependent zCDP must have $v(n)=Ω_r(n^{-2})$. Thus the inverse-square rate is optimal under the repaired formulation. A many-count information argument further places the leading coefficient in the large-count-then-small-error limit between $π/(4e^2)$ and $1/π$, a factor below three. At $r=1$, a data-independent release meets the repaired criterion with zero privacy loss.$

Differential Privacy Papers@dppapers· 26d

The Adversarial Robustness of Sketching and Streaming Algorithms David P. Woodruff, Samson Zhou http://arxiv.org/abs/2607.14432

Differential Privacy Papers@dppapers· 26d

Auditing Fairness-Privacy Trade-offs: Subpopulation-Level Effects of Fairness-Enhancing Algorithms Umid Suleymanov, Ilhama Novruzova, Khalid Mammadov, Natavan Hasanova, Murat Kantarcioglu http://arxiv.org/abs/2607.14607

Differential Privacy Papers@dppapers· 26d

Is External Database Protection Static in Retrieval-Augmented Generation? Rethinking Privacy Preservation under Dynamic Queries Gang Zhang, Mingyu Tian, Xukun Luan, Yuanchi Ma, Jinyan Liu http://arxiv.org/abs/2607.14811

Differential Privacy Papers@dppapers· 27d

Privacy Preserving Recommender Systems Balancing Personalization with Privacy Ranjeet K Jha, Venkata Suresh Gummadilli http://arxiv.org/abs/2607.13328

$Privacy Preserving Recommender Systems Balancing Personalization with Privacy Ranjeet K Jha, Venkata Suresh Gummadilli http://arxiv.org/abs/2607.13328 Personalized recommendation systems are central to modern e-commerce and retail platforms, but they typically rely on centralized storage of detailed user interaction data, creating significant privacy and regulatory challenges. With increasing requirements from regulations such as GDPR, CCPA, and CPRA, organizations must develop recommendation systems that preserve user privacy without substantially degrading recommendation quality. This work presents and evaluates a privacy-preserving recommendation framework that combines federated learning, differential privacy, cohort-level modeling, and privacy-aware intelligent agents. The framework keeps raw user data decentralized while introducing mathematically bounded noise to model updates. Experiments were conducted on synthetic retail datasets that emulate customer clickstream and purchase behavior. Recommendation quality was evaluated using Click-Through Rate (CTR), Precision@K, Recall@K, and Normalized Discounted Cumulative Gain (NDCG@K) across multiple differential privacy budgets. We evaluate matrix factorization, neural collaborative filtering, and GRU4Rec under varying privacy constraints and analyze the trade-off between privacy and utility. An interactive Streamlit dashboard was developed to visualize recommendation performance, ranking stability, privacy-utility trade-offs, and fairness metrics. Results show that the proposed framework maintains competitive recommendation quality at moderate privacy budgets (approximately $ε\approx 5$), demonstrating that strong privacy guarantees can be achieved with limited impact on recommendation effectiveness. This work provides a practical framework for deploying privacy-preserving recommendation systems that balance personalization, regulatory compliance, and business objectives, offering a scalable approach for$

Differential Privacy Papers@dppapers· 27d

ReBound: Reuse-Aware Privacy For Interactive Decision Support Nada Lahjouji, Shufan Zhang, Xi He, Sharad Mehrotra http://arxiv.org/abs/2607.13441

Differential Privacy Papers@dppapers· 27d

PriEval-Protect: A Unified Framework for Privacy Evaluation and Protection in Healthcare Systems Ilef Chebil, Asma El Hadj, Souheib Yousfi, Aroua Hedhili, Layth Sliman http://arxiv.org/abs/2607.13754

Differential Privacy Papers@dppapers· 27d

Plausible Deniability Guarantees for Whistleblowers Leo Richter, Matt J. Kusner http://arxiv.org/abs/2607.13928

$Plausible Deniability Guarantees for Whistleblowers Leo Richter, Matt J. Kusner http://arxiv.org/abs/2607.13928 Whistleblowers are a key safeguard against organizational wrongdoing, but the threat of retaliation deters reporting. Existing whistleblower-protection proposals lack formal privacy guarantees, and existing differential privacy mechanisms do not directly target the natural threat model -- one in which the audited organization itself observes auditor selection decisions and uses them to identify reporters. We formalize protection against a strong-adversary threat model as per-report $(0, δ)$-differential privacy on the transcript of audit selections. Within this framework we prove that a natural approach -- randomized response applied at the selection step -- can never outperform uniform random auditing by more than $δ$ at any horizon. We then give a generic mechanism that reduces private auditing to private continual counting: any $(0, δ)$-DP continual counter plugs in by post-processing, and the audit transcript inherits the same per-report guarantee. Instantiating the reduction with a recent work in continual counting yields per-report $(0, δ)$-DP with noise scaling as $O(\sqrt{\log T})$ across a horizon of $T$ audit decisions. A utility theorem shows that the selection error vanishes whenever the noisy report gap between the most-reported organization and the runner-up grows faster than $\sqrt{\log T}$. Simulations show a substantial improvement over randomized response.$

Differential Privacy Papers@dppapers· 29d

Differentially Private Consistent Release of Counting Queries Borzoo Rassouli, Morteza Varasteh http://arxiv.org/abs/2607.10952

$Differentially Private Consistent Release of Counting Queries Borzoo Rassouli, Morteza Varasteh http://arxiv.org/abs/2607.10952 We study the problem of releasing counting-query outputs through a stochastic mechanism that is both consistent and $(ε,δ)$-differentially private. Consistency requires the released value to lie within the feasible range of the query, while utility is measured by the worst-case probability of error. We first derive a closed-form expression for the minimum achievable error probability and obtain an explicit optimal mechanism. By exploiting the active differential privacy constraints satisfied by this mechanism, we then characterize the entire class of optimal mechanisms via a propagation argument, identifying the structural properties shared by all optimizers. We next extend the framework to the setting in which the privacy mechanism is cascaded with an arbitrary fixed stochastic transformation representing a predetermined portion of the communication medium between the source and the destination. We first establish necessary and sufficient conditions under which this partial fixation of the medium incurs no loss in utility. We then derive upper and lower bounds on the optimal achievable performance based on convex mixing and spectral perturbation. Finally, we apply the theory to (M)-ary phase-shift keying (PSK) transmission over an additive white Gaussian noise (AWGN) channel and show that uncoded transmission is effectively optimal in the high-privacy regime.$

Differential Privacy Papers@dppapers· 29d

Privacy-Aware Collaborative and Distributed Bayesian Optimization Aditya Rane, Sathwik Yamana, Paritosh Ramanan, Srikanthan Ramesh, Akash Deep http://arxiv.org/abs/2607.11600

Differential Privacy Papers@dppapers· Jul 13

Improved Error Bounds for Pure Differentially Private Continual Counting via Matrix Factorization Pavel Arkhipov, Nikita P. Kalinin http://arxiv.org/abs/2607.08963

$Improved Error Bounds for Pure Differentially Private Continual Counting via Matrix Factorization Pavel Arkhipov, Nikita P. Kalinin http://arxiv.org/abs/2607.08963 Continual counting under pure differential privacy is one of the simplest and most well-studied problems in the continual observation model. Nevertheless, an asymptotic gap remains between the best known upper and lower bounds for maximum squared error and mean squared error: the upper bound is $O(ε^{-2}\log^3 n)$, while the lower bound is $Ω(ε^{-2}\log^2 n)$, for both error metrics. The best known constant in the upper bound is achieved by the $k$-ary tree mechanism with the subtraction trick, due to Andersson, Pagh, Steiner, and Torkamani (FORC 2025). In this work, we improve the leading constant in the maximum squared error and the mean squared error. Our approach uses a general matrix factorization mechanism, yielding an improved bound for pure-DP continual counting that does not rely on a tree-based construction. The mechanism starts from a good-quality low-dimensional factorization, obtained via gradient-based optimization, and gives an explicit matrix construction that lifts this factorization to arbitrarily large dimensions, further improving its error guarantees. We offer an efficient algorithmic implementation of our mechanism. On the lower-bound side, we prove an $Ω(ε^{-2}\log^3 n)$ lower bound for the class of factorizations whose matrices have entries in $\{0,1\}$, matching the upper-bound asymptotics for this class. This class includes the binary tree mechanism and $k$-ary tree mechanisms without the subtraction trick. Extending this lower bound to arbitrary matrix factorizations, and beyond the matrix mechanism altogether, remains an open problem.$

Differential Privacy Papers@dppapers· Jul 10

Equivariant Quantum Clustering with Differential Privacy: Parameter-Efficient Privacy-Preserving Analysis Across Heterogeneous Sensitive Datasets B. M. Taslimul Haq, Md Arifur Rahman, Tawfiq Al Islam Foysal, Abdullah Al Noman, Abir Ahmed http://arxiv.org/abs/2607.08092

Differential Privacy Papers@dppapers· Jul 10

Workload-Preserving Differentially Private Synthetic Data for Causal Inference via Maximum-Entropy Calibration Amir Asiaee, Kaveh Aryan http://arxiv.org/abs/2607.08122

Differential Privacy Papers@dppapers· Jul 10

EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy Wenxiu Ding, Muzhi Liu, Zheng Yan, Mingjun Wang, Yifan Zhao, Qiao Liu http://arxiv.org/abs/2607.08659

$EdgeRefine: Privacy-Utility Balance for Graphs via Jaccard Sampling under Edge Differential Privacy Wenxiu Ding, Muzhi Liu, Zheng Yan, Mingjun Wang, Yifan Zhao, Qiao Liu http://arxiv.org/abs/2607.08659 Graph Neural Networks (GNNs) have shown considerable success in learning from graph-structured data, but their use in privacy-sensitive areas remains difficult because graph structure can leak sensitive link information. To satisfy edge-level differential privacy, a common approach is to inject noise into all elements of the graph's adjacency matrix, thereby obfuscating the existence of any single edge. However, stronger privacy requires more noise, and excessive noise reduces utility, making the privacy-utility balance a major barrier to practical privacy-preserving graph learning. To address this issue, we propose EdgeRefine, a local differential privacy framework that improves this trade-off through adaptive edge refinement. EdgeRefine first estimates edge-existence probabilities using Jaccard similarity and ranks edges for noisy edge removal. To ensure the sparsity and reliability of the final graph, it uses the privacy budget $ε$ to determine the ratio of true to false edges, samples them separately based on this probability ranking, and controls the total number of edges with a separate sampling rate $k$. Extensive experiments show that EdgeRefine achieves accuracy comparable to the noise-free baseline and substantially outperforms other privacy-preserving methods across datasets and GNN architectures. Under privacy budget $ε= 2.5$, EdgeRefine improves node classification accuracy over state-of-the-art baselines by 17.8\% on ACM under GAT and 19.7\% on Cora under GCN. In graph classification, it achieves an average accuracy degradation of around 5\% compared to the noise-free baseline. Under graph reconstruction attacks, EdgeRefine maintains relative absolute error levels above 1 across all privacy budgets, averaging 1.962 on Cora and 1.472 on AMAP, indicat$

Differential Privacy Papers@dppapers· Jul 9

Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies Barkha Rani http://arxiv.org/abs/2607.06815

$Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies Barkha Rani http://arxiv.org/abs/2607.06815 Autonomous negotiation agents are increasingly deployed in high-stakes settings such as insurance and procurement. While cryptographic techniques protect explicitly disclosed constraint values, they fail to address a subtler threat: behavioral privacy leakage, where an adversary infers private constraints from observable negotiation dynamics such as concession trajectories, timing, and convergence patterns. This paper investigates behavioral differential privacy in multi-round negotiation protocols. We design an adaptive stochastic negotiation policy that jointly guarantees $(\varepsilon, δ)$-differential privacy, almost-sure convergence of the offer sequence (reaching agreement when the counterparty's reservation value permits), and high negotiation utility. Evaluated on 3,000 synthetic bilateral negotiations, our mechanism reduces adversarial inference accuracy by 43-50% while maintaining a negotiation success rate and utility above 90%, demonstrating that strong privacy guarantees can be achieved without significant loss of performance.$

Differential Privacy Papers@dppapers· Jul 9

Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data Vinícius Gabriel Angelozzi, Héber H. Arcolezi http://arxiv.org/abs/2607.07471

Differential Privacy Papers@dppapers· Jul 8

Differentially Private Natural Gradient Descent Pan Li, Kai Chen, Shuai Chang, Shengzhi Zhang, Peizhuo Lv, Jinwen He http://arxiv.org/abs/2607.05866

$Differentially Private Natural Gradient Descent Pan Li, Kai Chen, Shuai Chang, Shengzhi Zhang, Peizhuo Lv, Jinwen He http://arxiv.org/abs/2607.05866 Under a fixed privacy budget, the utility of differentially private (DP) training is ultimately determined by its optimization efficiency. Standard first-order DP optimizers such as DP-SGD rely solely on local gradients and ignore the underlying loss curvature. This geometric blindness causes severe zigzagging in ill-conditioned landscapes, squandering precious privacy budgets on inefficient iterations. Practitioners are thus trapped in a bind: either stop training prematurely or inject massive per-step noise, both of which critically compromise final model utility. Natural Gradient Descent (NGD) resolves this by preconditioning gradients with curvature, aligning updates with the loss geometry and extracting more efficient signal from every noisy step, offering a principled pathway to break the privacy-utility bottleneck. Despite its theoretical appeal, directly integrating NGD with DP introduces fundamental challenges: curvature estimation itself consumes prohibitive privacy budgets, isotropic DP operations conflict with the anisotropic scaling of NGD, and the inverse curvature catastrophically amplify parameter updates in flat directions, causing training instability. We propose DP-NGD, a practical framework that systematically addresses these obstacles by decoupling curvature estimation from private data, reconciling isotropic DP constraints with anisotropic second-order optimization via a whitened-space mechanism, and dynamically clamping the curvature to stabilize training. Extensive experiments on standard benchmarks demonstrate that DP-NGD achieves state-of-the-art accuracy, breaking through the utility ceilings of first-order baselines while delivering up to a $10\times$ convergence speedup under the same privacy budget.$

Differential Privacy Papers@dppapers· Jul 8

Quantum Probabilistic Local Differential Privacy: Structural Properties and Sample Complexity Bounds Xian Shi http://arxiv.org/abs/2607.06307

Differential Privacy Papers@dppapers· Jul 8

Dithered Gaussian Mechanism for Randomness-Efficient Differential Privacy Nikita P. Kalinin, Rasmus Pagh http://arxiv.org/abs/2607.06320

Differential Privacy Papers@dppapers· Jul 8

Differentially private quantum sensor networks Daniel J. Spencer, Kaiyan Shi, Emil T. Khabiboulline, Gorjan Alagic, Alexey V. Gorshkov http://arxiv.org/abs/2607.06521

$Differentially private quantum sensor networks Daniel J. Spencer, Kaiyan Shi, Emil T. Khabiboulline, Gorjan Alagic, Alexey V. Gorshkov http://arxiv.org/abs/2607.06521 Quantum sensing is a promising technology capable of demonstrating clear advantage over comparable classical techniques for precise measurement. One application of quantum sensing is in function estimation, which can be done using a network of entangled quantum sensors, allowing for measurements with greater optimal sensitivity than unentangled sensing protocols. In cases where quantum sensor networks will be used to measure data that should remain private (e.g., biomedical data), it is imperative that these protocols include a privacy mechanism to hide sensitive information. In this work, we show that entangled sensor networks are vulnerable to certain privacy-violating attacks. To mitigate these attacks, we introduce secure sensing protocols endowed with differential privacy. We reconcile differential privacy with retaining Heisenberg-limited scaling, and introduce several protocols achieving varying balances between the two. We show that our main protocol, an $n$-node network sensing protocol that injects noise directly into the sensing Hamiltonian, exhibits a tradeoff between the desirable $O(1/n^2)$ Heisenberg scaling of the mean-squared error of the function estimate and the level of privacy attainable. Under assumptions on the network (a common source of randomness and a constant fraction of honest parties), we show that this protocol is locally implementable and achieves $(O(1), δ)$-differential privacy for arbitrarily small $δ$ while retaining Heisenberg scaling of the mean-squared error. We prove that our protocols are resilient to attacks by broad classes of classical and quantum adversaries, and find advantages in the privacy-utility tradeoff when using quantum techniques.$

Differential Privacy Papers@dppapers· Jul 7

Scalable Differentially Private Data Compression via Diffusion and Stochastic Codes Gergely Flamich, Oykü Sıla Güner, Yanxiao Liu, Deniz Gündüz http://arxiv.org/abs/2607.03392