PaperlayerView exact revision on arXiv

Source-linked AI summary

PAC-Private Autoregressive Generation: Calibrating Noise to Ensemble Disagreement

Mina Mirzadehsarcheshmeh, Amir Keyvan Khandani

arXiv:2609.05676v1cs.LGcs.AI

TL;DR

API-served language models adapted on private text can leak it through generated outputs, and existing output privatization can lose utility over long horizons. This paper extends PAC privacy to autoregressive generation using disagreement-calibrated noise across overlapping worlds. On the evaluated setup, it retains more non-private headroom than PMixED at matched membership-inference bounds, while membership protection does not prevent canary reproduction.

  • Problem

    Private text can leak through generated continuations, while output privatization consumes privacy budget at each release and can reduce utility over long horizons.

    Source: §1 · pp. 1–2

  • Method

    The method trains adapters for overlapping worlds and calibrates per-token noise to posterior-weighted disagreement, with coupled sampling and an end-to-end privacy analysis.

    Source: §4 · p. 15, §8 · p. 35

  • Results

    At matched membership-inference bounds, PAC retains 98% of non-private headroom across 102 to 106 tokens, versus PMixED’s at most 56%, with no crossover.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Membership protection does not prevent memorized content from being emitted: the canary remains emittable when membership advantage is statistically indistinguishable from zero.

    Source: §6.4 · p. 30

    The evaluation covers one corpus, one base model, a 2,048-article universe, and one world collection.

    Source: §7 · p. 34

Abstract

from arXiv · show

Language models adapted on private text are often served through APIs, so privacy leakage occurs through generated outputs rather than exposed weights. Private prediction protects these releases. Methods such as PMixED incur privacy cost at each release and increasingly rely on the public model over long horizons. PAC privacy instead calibrates noise to output variability across possible secrets, adding less noise when predictions are stable. To our knowledge, PAC-private prediction has not previously been extended from classification to autoregressive generation. We construct $m=128$ overlapping worlds from the private corpus, with each record appearing in exactly $m/2$ worlds, and train one adapter per world over a frozen public model. The realized world is the secret. At each token, the public model defines a candidate set, the worlds vote, and their posterior-weighted disagreement determines the PAC noise; unanimity requires no calibration noise. We prove $I(S;Y_{1:T}) \leq I(S;H_T) \leq bT$. Our contributions are extending PAC privacy to autoregressive generation, handling adaptive self-generated contexts, and introducing coupled decoding that preserves privacy accounting while avoiding greedy degeneration. On WikiText-103 with GPT-2-small, we retain 74% of the fine-tuning gain at a per-token budget of $2^{-32}$, while membership-inference success is bounded by 51.08% after $10^6$ tokens; posterior-entropy estimates of leakage are roughly 17% of the charged budget. Inference privacy is not content protection: even when membership advantage on a memorized canary is indistinguishable from zero, the canary is emitted at the same rate. Against PMixED under matched membership-inference bounds on the same data universe and test set, we retain 98% of non-private headroom from $10^2$ to $10^6$ tokens, versus at most 56%, with no crossover.

1 Introduction

API-served language models adapted on private text can leak that text through generated continuations, while output privatization consumes budget as tokens are released. This paper extends PAC-private prediction to autoregressive generation, addressing self-generated contexts and sampled decoding.

1 Introduction

  • PAC privacy calibrates noise to output variability across possible secrets, so stable predictions require less noise than worst-case calibration.In this mechanism, posterior-weighted disagreement among worlds sets the noise, and unanimous votes require none.Source: §1 · p. 2
  • The analysis bounds information in the released stream by bT and addresses persistent secrets, self-generated queries, token releases, singular vote covariance, and coupled sampling.Released tokens leak no more information than the internal mechanism, and the proof treats shared public randomness in coupled decoding.Source: §1 · pp. 2–3
  • At matched membership-inference bounds, PAC retains 98% of non-private headroom across 102 to 106 tokens, versus PMixED’s at most 56%, with no crossover.The comparison uses identical data and is reported across the evaluated query horizons.Source: §1 · p. 3
  • At a per-token budget of 2−32, the mechanism retains at least 74% of the fine-tuning gain and bounds membership-inference success to 51.08% after 106 released tokens.Accuracy is flat across budgets from 2−4 to 2−32.Source: §1 · p. 3

2 Background

The background distinguishes membership inference from verbatim memorization and motivates private prediction and PAC privacy for adaptive, output-only language-model services, introducing mutual-information accounting and posterior tracking for repeated releases against a persistent secret. It also presents a prior-success lower bound and explains how per-step budgets and release horizons yield attack-success bounds transferable to mechanisms with the same composition guarantee.

2.1 Threat Model and What Leaks

  • Membership inference asks whether a record was in training, whereas memorization is verbatim emission; a membership guarantee alone does not prevent emitting a memorized string.Reconstruction targets recovery of training records [2], while model extraction targets model functionality [29]; membership inference is a directly measurable participation test [24].Source: §2.1 · p. 4

2.2 Differential Privacy and Its Limits for Language Models

  • Differential privacy offers worst-case protection and composition, but DP-SGD relies on clipped per-example gradients, adds computational cost, and privatizes weights rather than exposed outputs.Tight sensitivity for generic non-convex training is unavailable, and parameter-efficient private fine-tuning reduces cost without resolving the deployment threat-model mismatch.Source: §2.2 · pp. 4–5

2.3 Private Prediction

  • Private prediction privatizes outputs rather than model weights, but each generated token spends budget and becomes context for the next adaptive query.PATE [21] uses ensemble agreement for cheaper aggregation; SubMix [14] mixes ensemble and public-model predictions, while PMixED [12] projects expert distributions toward a public model and tracks per-token RDP cost.Source: §2.3 · pp. 5–6

2.4 PAC Privacy

  • PAC privacy bounds inference through mutual information under an assumed secret distribution, and calibrates noise to output covariance rather than worst-case sensitivity.The Gaussian covariance bound is generally an upper bound, tight only for Gaussian outputs with independent Gaussian noise [38]; prior PAC work also studied generative-image privacy, not persistent-secret adaptive release composition.Source: §2.4 · pp. 6–8

2.5 Preliminaries

  • Gaussian noise calibrated to output covariance can meet a mutual-information budget, with noise scaling to output variation rather than ambient dimension.For a finite secret space, covariance can be computed by evaluating the mechanism on its inputs; the membership-inference setup assigns each record prior membership probability 1/2.Source: §2.5 · pp. 9–10

2.4 PAC Privacy

  • Zhu et al. track the adversary’s posterior and calibrate each adaptive release to it, enabling linear mutual-information composition for one persistent secret.Earlier PAC composition either required non-adaptive queries, resampled the secret, or accumulated quadratically in the number of releases. PAC’s Gaussian covariance surrogate can also overestimate mutual information for non-Gaussian outputs [38].Source: §2.4 · pp. 7–8, §2.5 · pp. 9–10

2.5 Preliminaries

  • For persistent-secret interactions, the curator tracks the posterior after each release; mutual information then accumulates linearly by the chain rule.The maintained belief equals the true posterior, and expected belief refinement is bounded by the sum of per-step budgets.Source: §2.5 · p. 10
  • The optimal prior success rate is at least 1/m for any criterion where correctly identifying the secret counts as success.Source: §2.5 · p. 10
  • Combining Theorems 3 and 1 yields attack-success bounds from the per-step budget, horizon, and prior; Zhu et al. tabulate bounds that apply unchanged to mechanisms with the same composition guarantee.For this method, the horizon is interpreted as the number of released tokens.Source: §2.5 · p. 10

3 PAC-Private Autoregressive Generation

PAC-private autoregressive generation protects a token stream by calibrating noise to disagreement among possible private worlds. It combines a persistent-world threat model, per-token posterior updates, and coupled sampling to support adaptive generation.

3.1 Threat Model and Secret

  • The guarantee targets an informed adaptive adversary who knows the candidate worlds but not the one persistent world realized for the entire interaction.The private corpus is assigned to 128 overlapping worlds, with each record appearing in 64; the realized world is the secret.Source: §3 · p. 10, §3.1 · p. 12

3.3 Per-Token Mechanism

  • At each token, the public model defines the candidate set, and posterior-weighted disagreement among world votes determines the calibration noise.When all worlds agree, the covariance is zero and no calibration noise is required; the curator updates the posterior and releases only a token.Source: §3 · p. 11, Figure 1 · p. 11, §3.3 · p. 13

3.2 Worlds as LoRA Adapters

  • Each of 128 worlds is represented by a LoRA adapter over a frozen public GPT-2-small base, making joint serving evaluation practical.The adapters share a base model and use the same training pipeline on their assigned subsets.Source: §3.2 · p. 12

3.4 The Token Interface

  • The released-token stream leaks no more information about the secret than the curator’s internal history, which is bounded by bT.The query for each next step depends on the previously released tokens.Source: §3.4 · pp. 14–15

3.5 Coupled Gumbel Decoding

  • Shared-randomness Gumbel decoding preserves cross-world coupling while giving each world its own temperature-τ, support-restricted marginal sample.The fresh public coins are drawn after the query is fixed and do not add privacy leakage.Source: §3.5 · p. 15

4 Privacy Analysis

The analysis establishes a token-stream privacy bound despite autoregressive feedback, singular vote covariance, and coupled randomness. It also specifies the assumptions behind the guarantee and how posterior-entropy measurements estimate its internal-history leakage target.

4.2 Token-Only Release

  • The internal history includes the public coins, while each released token is a deterministic function of that history.This data-processing relationship makes the token-only adversary a special case of the history-adaptive analysis.Source: §4.1 · p. 16, §4.2 · p. 17

4.1 Setting and Main Guarantee

  • I(S;Y1:T) ≤ I(S;HT) ≤ bT, so released tokens are bounded by the internal-history privacy budget across T steps.The result covers token-adaptive querying under the stated public-coin conditions and applies to either decoder.Source: §4.1 · p. 16, §4.2 · p. 17

4.3 Singular Covariance Calibration

  • Because one-hot vote covariance is singular, calibration and posterior updating operate on its active subspace using a pseudoinverse.Under unanimity, covariance and calibration noise are zero, and the step leaks nothing.Source: §4.3 · p. 17

4.4 Sequential Composition

  • Autoregressive feedback composes linearly because each released token is charged when produced, and the next query’s dependence on it is permitted adaptivity.The accounting horizon counts released tokens, and realized generation length can differ from nominal length.Source: §4.4 · p. 18

4.5 Coupled Decoding

  • Coupled decoding preserves the accounting when public coins satisfy the stated conditions and the vote map is deterministic conditional on those coins.The method excludes coins seeded from the world index or other quantities depending on the secret beyond the prior history.Source: §4.5 · pp. 18–19

4.6 Posterior Entropy and Mutual Information

  • Posterior-entropy estimates target I(S;HT), the same internal-history quantity bounded by the theorem and upper-bounding token-channel leakage.The identity is exact, but its expectation is estimated over finitely many sessions; coin randomness adds sampling variance without shifting the target.Source: §4.6 · pp. 19–20

5 Experimental Setup

Section 5 specifies the world construction, evaluation regimes, utility and privacy measures, baselines, and serving cost. Its protocol separates teacher-forced utility from autoregressive attack evaluation and persistent-secret composition.

5.1 Models, Data, and World Construction

  • Each world is a LoRA adapter [15] over a frozen public GPT-2-small base, and training is identical across worlds: same optimizer, learning rate, and fixed epoch count, without early stopping.PAC construction experiments use Collection A (construction seed 101), while PMixED uses a different partition of the same universe. With τ = 1.0 throughout, per-world votes are bitwise reproducible under fixed coins.Source: §5.1 · pp. 20–21

5.2 Evaluation Protocol

  • Evaluation separates teacher-forced utility, greedy autoregressive attack tests, and persistent-secret sessions used for composition and direct mutual-information estimates.Each session serves 64 queries against one secret, releasing 64 tokens per query; lengths are reported as realized, and uncertainty is estimated across sequences or sessions as appropriate.Source: §5.2 · pp. 21–22

5.3 Utility Metrics

  • Teacher-forced next-token accuracy is primary; generated-text perplexity is descriptive because mechanism likelihood can be zero outside the voted set.Generated-text perplexity is scored under a fixed reference language model, not the mechanism's token-release distribution.Source: §5.3 · p. 22

5.4 Privacy Metrics and Attacks

  • Membership is declared when posterior mass on worlds containing a record exceeds one half, while the posterior mode identifies the realized world.Privacy bounds use priors 1/2 for record membership and 1/m for world identification; leakage is estimated from session posterior entropy, and the canary experiment forces memorization at inference to measure membership advantage.Source: §5.4 · pp. 22–23

5.5 Baselines

  • Public, full-data, and noiseless baselines separate the adaptation/subsampling gap from calibration-noise cost; PMixED is tested on a disjoint partition at matched bounds.Both methods use the official WikiText-103 test split, disjoint from their training data.Source: §5.5 · p. 23

5.6 Computational Cost

  • 1.3 × 10^5 fewer operations: restricting calibration to candidates and distinct votes reduces per-release work from 3.35 × 10^9 to 2.59 × 10^4.The batched 128-world forward pass takes 29.71 ms per token, while the mechanism adds 0.223 ms; batching makes serving 5.0× slower than one non-private pass and 25.5× cheaper than sequential world evaluation.Source: §5.6 · p. 24

6 Results

Across the evaluated settings, PAC retains utility under tight privacy budgets, while unanimity and decoding choices shape its behavior. Against PMixED at matched membership-inference bounds, PAC-Gumbel preserves more of its non-private headroom throughout the tested horizons.

6.1 Ensemble Stability and Utility

  • At k = 200, all 128 worlds agree on the greedy vote at 83.4% of held-out positions, but the public support retains only 88.5% of world probability mass on average.Argmax coverage matters for greedy decoding; retained probability mass is the relevant coverage measure for sampling.Source: §6.1 · pp. 24–25
  • At b = 2^-32, PAC retains 74.3% of the fine-tuning gain under greedy decoding and 84.4% under coupled Gumbel.At this budget, the reported bound on membership-inference success is below 51.08% after 10^6 released tokens.Source: §6.1 · p. 25, Table 4 · p. 25
  • Accuracy changes little across budgets even as flips on disagreeing positions rise from 26% to 52%; unanimous positions remain unflipped.The reported noise cost is within one standard error for both decoders, and 83.9% of diagnostic positions are unanimous.Source: §6.1 · p. 25, Figure 2 · p. 26

6.2 Privacy Under Autoregressive Composition

  • Record-level membership inference stays near chance for b ≤ 2^-8, while empirical world identification is indistinguishable from its 1/128 prior at b ≤ 2^-12.Across the greedy sweep, no statistically significant violation of the provable bound was observed.Source: §6.2 · p. 26, Table 6 · p. 27
  • Measured leakage is 17.0–18.8% of charged leakage across 15 persistent-secret session cells, while leakage still accumulates and remains under bound.The estimate is for internal history, which upper-bounds released-token leakage; the proposed link to dissent fraction is consistent but not demonstrated.Source: §6.2 · p. 27

6.3 Generation Quality and Decoding

  • At T = 256, coupled Gumbel brings rep-3 to 0.053 and 0.050, near human text at 0.047, while PAC-greedy matches GPT-2’s repetition.Coupled decoding leaves privacy accounting unchanged; greedy degeneration is attributed to the decoder, not privatization.Source: §6.3 · pp. 28–29, Figure 3 · p. 28

6.4 Canary Stress Tests

  • With calibration at b = 2^-16, forced-memorization membership advantage is statistically indistinguishable from zero, yet the canary is emitted at similar rates for members and non-members.The reported emission rates are 48.9–51.3% for member worlds and 50.6–51.2% for non-member worlds.Source: §6.4 · pp. 29–30, Table 9 · p. 30

6.5 Comparison with PMixED

  • 98% of PAC-Gumbel’s non-private headroom survives at every horizon from 10^2 to 10^6, versus at most 55.7 ± 0.3% for PMixED, with no crossover.The comparison uses a matched membership-inference bound and each method’s selected configuration’s own non-private ceiling.Source: Figure 4 · p. 32, §6.5 · p. 32, Table 11 · p. 33

7 Discussion and Limitations

Measured leakage is about 17% of the charged budget, but reclaiming that headroom would require a new accounting rule and composition argument. The evaluation is limited to one corpus, base model, article universe, and world collection, and inference protection does not guarantee content protection.

Where the headroom is

  • About 17% of the charged budget is measured leakage, a gap of roughly 5.8× that cannot be reclaimed safely without a new accounting rule and composition argument.Charging realized votes could also let an adversary who predicts public coins influence the charge.Source: §7 · p. 34

Adaptive temperature

  • Adaptive temperature rules based on adversary-known information are admissible but unevaluated, and increasing temperature can make outputs stop reflecting the private models.The authors do not claim that changing temperature monotonically reduces leakage.Source: §7 · p. 34

What the guarantee does not cover

  • Inference protection bounds information about the secret, not reproduction: memorized canaries remain emitted at essentially the same rate under both membership hypotheses.Public-support restriction blocks only off-support emission; a deployment needing content guarantees requires a separate mechanism.Source: §7 · p. 34

Limitations

  • The evaluation uses one corpus, GPT-2-small, a 2,048-article universe, and one world collection, so it cannot separate effects of the m/2 construction from that partition.Absolute numbers should not be compared with the original PMixED paper; the head-to-head uses a matched reimplementation.Source: §7 · p. 34
  • The empirical attacks use the curator’s posterior, making them an upper envelope for token-only attackers, while finite-session estimates of I(S;H_T) have sampling uncertainty.The internal-history accounting also has unquantified slack relative to released tokens.Source: §7 · p. 34

Future work

  • The proposed next steps are a second corpus and domain, an entropy-charging odometer, and distillation from PAC-private tokens into a publishable model.The second corpus and domain would address the single-dataset limitation most directly.Source: §7 · pp. 34–35

8 Conclusion

The conclusion presents PAC-private autoregressive generation as a first extension of PAC-private prediction, with analysis covering the token interface, self-generated queries, singular vote covariance, and coupled decoding. Experiments show utility and membership-inference results, while cautioning that inference privacy does not prevent memorized content from being emitted.

8 Conclusion

  • The paper introduces PAC-private autoregressive prediction and establishes that the token interface, self-generated queries, singular vote covariance, and coupled sampling decoder fit its posterior-aware composition framework.The framework is analyzed in Section 4.Source: §8 · p. 35
  • Against PMixED at matched membership-inference bounds, PAC retained 98% of non-private headroom at every tested query volume, with no crossover.The comparison uses the same data universe and test set.Source: §8 · p. 35
  • At a per-token budget, the mechanism retains at least 74% of the fine-tuning gain while bounding membership-inference success below 51.08%.Accuracy stays flat across a 2^8 range of budgets; most positions are unanimous, and added flips on dissenting positions are close to accuracy-neutral.Source: §8 · p. 35
  • Posterior-entropy estimates put leakage at roughly 17% of the charged privacy budget.The enumerable m-world construction makes direct leakage estimation possible.Source: §8 · p. 35
  • Low membership-inference advantage does not prevent a memorized canary from remaining emittable, even when its measured advantage is statistically indistinguishable from zero.The conclusion also warns that repetitive or degenerate decoding can make measured leakage appear artificially small because those outputs tend to elicit ensemble agreement.Source: §8 · p. 35

A.1 Proof of Theorem 4

The proof bounds information in the released token stream by information in the internal history, then bounds the latter by bT. It does so by controlling each step's information contribution for the persistent secret.

A.1 Proof of Theorem 4

  • Public randomness and the mechanism's internal vector add no information about S conditional on the prior history.The proof uses I(S; U_t | H_{t−1}) = 0 and the conditional independence M_t ⊥ S | H_{t−1}.Source: §A.1 · p. 39
  • The calibrated internal release contributes at most b information per step, so summing across T steps gives the total bound.The calibration remains valid despite vote covariance rank at most a_t − 1.Source: §A.1 · p. 39
  • The token stream satisfies I(S; Y_1:T) ≤ I(S; H_T), and the internal history satisfies I(S; H_T) ≤ bT.The first inequality follows from the token-output lemma; summing the per-step bounds yields the second.Source: §A.1 · p. 39

A.2 Proof of Lemma 3

The lemma proof handles vote covariance on the simplex's lower-dimensional subspace and shows how the calibrated Gaussian release updates the posterior. If all worlds agree, the release is constant across worlds and the step costs no information.

A.2 Proof of Lemma 3

  • Because votes are simplex vertices, their differences lie in the sum-zero subspace, making the covariance rank at most a_t − 1.The covariance annihilates the all-ones vector, so calibration takes place on its range.Source: §A.2 · p. 39
  • A component of the calibrated vector constant across posterior-supported secrets is independent of S and contributes no mutual information.The proof separates this constant component from the part receiving calibrated noise.Source: §A.2 · p. 39
  • On the covariance range, the calibrated release has a nondegenerate Gaussian law, whose density gives the Bayes posterior update.The normalization cancels across secrets because the pseudo-determinant of the covariance does not depend on S.Source: §A.2 · pp. 39–40
  • When the candidate set has one token, the posterior vote is a point mass, covariance and noise are zero, and the step is free.The output is constant across worlds, so it carries no information about S.Source: §A.2 · p. 40

A.3 Proof of Proposition 3

The proposition establishes that public coins and the calibrated vote map do not add information about the secret beyond the existing history. The calibrated release costs at most b per step, and its likelihood updates the exact posterior.

A.3 Proof of Proposition 3

  • Because public coins are realized before calibration, the vote map is fixed given the history and coins, allowing the noise bound of b to apply.Its conditional output covariance is the covariance used to calibrate the noise.Source: §A.3 · p. 40
  • The public coins and vote map contribute zero conditional information about S given the previous history.This follows from the stated conditions, without requiring independence between the coins and query.Source: §A.3 · p. 40
  • The release likelihood updates the prior posterior to the exact posterior conditioned on the new history.The conditioning variables used for the likelihood are components of that history.Source: §A.3 · p. 40

A.4 Coins: verification and scope

Public, history-derived coins satisfy the stated conditions for applying the privacy results, including when an adversary predicts the coins. The guarantee excludes coins that depend on the secret beyond the history and does not cover entropy-based charges that an adversary could steer.

A.4 Coins: verification and scope

  • For public measurable coins derived from the query and prior history, the paper verifies conditions (C1)–(C3), so Proposition 3 and Theorem 4 apply.The coins are determined before calibration and recoverable from the recorded history.Source: §A.4 · p. 40
  • Even if an adversary predicts the coins and searches prompts for favorable votes, the per-step bound holds for every realized pair.The bound is conditional on the realized pair, which is the operational content of instance-based calibration.Source: §A.4 · p. 40
  • Coins depending on the realized world or its step-t logits violate (C1); dependence on the query itself is not prohibited.The restriction is dependence on the secret beyond the history.Source: §A.4 · p. 40
  • If per-step charges depend on the realized vote distribution, predictable coins could steer the charge; the paper's fixed budget b avoids this issue.The caveat applies to variants such as charging vote entropy; all reported results use fixed per-token b.Source: §A.4 · p. 40

A.5 Why the bound cannot be routed through R1:T alone

Under coupled decoding, released tokens depend on both the internal vector and the shared coins that determine the candidate set. The proof therefore bounds information about the joint history rather than routing the bound through the internal vectors alone.

A.5 Why the bound cannot be routed through R1:T alone

  • Because the candidate set depends on shared coins, a released token is not a function of R_t alone, so S → R_1:T → Y_1:T is not a Markov chain.The data-processing inequality cannot be applied in that form.Source: §A.5 · p. 40
  • Conditioning on the coins restores a deterministic map, but the resulting conditional mutual information is not bounded by its unconditional counterpart.The paper gives I(S; Y_1:T) ≤ I(S; Y_1:T | U_1:T) ≤ I(S; R_1:T | U_1:T).Source: §A.5 · p. 41
  • Since I(S; U_1:T) = 0, the proof instead bounds the information in the joint history (R_1:T, U_1:T), which includes the relevant conditional quantity.Under greedy decoding, U_t is null and the two routes coincide.Source: §A.5 · p. 41

A.6 Matched-Comparison Values

The section reports PMixED's selected accounting settings across two privacy targets and long horizons. Its selected shard counts, subsampling rates, public-model query shares, and Rényi orders vary across operating conventions.

A.6 Matched-Comparison Values

  • N = 32 is selected at every operating point but one; the exception is the generous ε = 2, T = 10^2 setting, which selects N = 16.N = 32 has the lowest ensemble ceiling of the three, but the reported amplification from more shards outweighs the quality lost by further corpus splitting.Source: §A.6 · p. 41
  • At T = 10^6, selected subsampling rates are 5 × 10^-4 under the rigorous convention and 5 × 10^-3 under the generous convention.The selected rate falls monotonically with the horizon.Source: §A.6 · p. 41
  • At T = 10^6, the public model alone answers 98% of queries under the rigorous convention and 85% under the generous convention.The passage links these shares to the selected subsampling rates at that horizon.Source: §A.6 · p. 41
  • The generous reading always selects α = 2, while the rigorous reading selects α ∈ {8, . . . , 64}.The passage attributes the higher orders in the rigorous reading to making the tight conversion pay.Source: §A.6 · p. 41
Loading 2609.05676v1…