PaperlayerView exact revision on arXiv

Source-linked AI summary

Soft Voting for Policy-Aware Private Data Synthesis

Yingge Hu, Gautham Ramesh Babu, Mostafa Milani

arXiv:2610.11285v1cs.CRcs.DB

TL;DR

Blowfish policies reduce noise only when a statistic varies less across protected edges, but hard nearest-candidate votes retain worst-case sensitivity at any protected boundary crossing. The paper introduces BF-Soft, whose sensitivity bound depends on policy reach and temperature, and evaluates it against hard voting. Under narrow numeric policies, BF-Soft reduces error at strong privacy budgets, while a public-data pilot predicts the gain without spending private budget.

  • Problem

    It is unclear when a sparse Blowfish policy can lower DP-synthesis noise: hard nearest-candidate votes retain worst-case sensitivity whenever a protected substitution crosses a decision boundary.

    Source: §1 · p. 1

  • Method

    BF-Soft replaces the hard vote with a temperature-smoothed response whose tight sensitivity bound depends on policy reach and temperature, not candidate count, and can be computed before synthesis.

    Source: §1 · p. 2, §7 · p. 12

  • Results

    At ε≈0.16–0.46 at δ=10^-5, BF-Soft reduces error relative to hard voting under narrow numeric policies; the public-data pilot predicts gain sign with 90.5% accuracy on Adult.

    Source: §1 · p. 2, §7 · p. 12

  • Takeaways & Limitations

    Policy-only reach can flag flat categorical or binary protections where little noise can be saved; a public-data pilot can guide temperature choice without private-budget spending.

    Source: §6.2.6 · p. 11

    The bounds cannot identify an optimal temperature because utility cost depends on private-data margins, the candidate trajectory, and the privacy budget; selecting directly on private data requires privacy accounting.

    Source: §5.5 · p. 8

Abstract

from arXiv · show

Blowfish privacy relaxes differential privacy (DP) by protecting only the attribute-value substitutions a data owner specifies as edges of a policy graph. A sparser policy can reduce the noise required by a mechanism, but only when the released statistic changes less across protected substitutions than across arbitrary DP neighbors. We study this question for evolutionary, nearest-neighbor DP synthesizers such as Private Evolution (PE) and its tabular instantiation Tab-PE, which score private records against a candidate population and release a noisy vote histogram. Their hard vote is constant inside each candidate's decision region and jumps at its boundary. Its policy-specific sensitivity therefore equals the full worst-case value whenever at least one protected substitution crosses a boundary, regardless of how short that substitution is. Because every round we examined contained such a substitution, the policy graph gave no reduction in noise. We propose BF-Soft, a temperature-smoothed soft vote whose response changes gradually with distance. Its sensitivity has a tight closed-form bound in the policy graph's reach and the temperature, independent of the number of candidates, and the bound can be computed once before synthesis. It also predicts from the policy alone when policy-aware smoothing cannot substantially reduce noise: protecting a flat categorical or binary attribute drives the reach to its maximum. On real and synthetic datasets under narrow numeric policies, BF-Soft reduces error relative to hard voting at strong privacy budgets, while the advantage reverses at weaker budgets. A public-data pilot predicts when soft voting is beneficial without spending private budget.

1 Introduction

Blowfish policies can reduce noise only when a released statistic responds less to protected substitutions than to arbitrary DP neighbors. This section explains why hard voting often cannot exploit that distinction and introduces BF-Soft, whose sensitivity reflects policy reach and temperature.

1 Introduction

  • A sparse policy reduces noise only when the released statistic responds less across its protected edges than across arbitrary DP neighbors.The section situates this question in evolutionary nearest-neighbor synthesis, where private records vote for candidates and the noisy histogram guides population updates.Source: §1 · p. 1
  • In every examined round, a protected edge crossed a hard-vote decision boundary, so the policy graph reduced no noise.A crossing shifts the vote by its full worst-case value regardless of substitution length.Source: §1 · p. 1
  • BF-Soft splits each record’s vote across candidates by a softmax of negative distance, making its response change gradually with substitution distance.Its policy-specific sensitivity is bounded by 2 tanh(r/2𝜏), where r is policy reach and 𝜏 is temperature; the tight bound is candidate-count independent and computable before synthesis.Source: §1 · p. 1
  • Protecting a flat categorical or binary attribute can make reach maximal, while higher temperature lowers sensitivity but weakens the evolutionary selection signal.Participation edges also impose a sensitivity floor, and the bounds do not determine an optimal temperature; the paper uses a public-data pilot to select it.Source: §1 · pp. 1–2
  • Under narrow numeric policies, BF-Soft reduces error at strong privacy budgets, but its advantage reverses beyond an approximate 𝜖≈0.16–0.46 crossover on UCI Adult and Bank at 𝛿=10−5.The crossover applies to the fixed temperatures studied.Source: §1 · p. 2
  • The evaluation covers UCI Adult, Bank, and synthetic XOR data, multiple privacy budgets and policies, and comparisons of noise savings, vote changes, and bound calibration.The introduction identifies these as evaluation contributions rather than reporting their detailed outcomes.Source: §1 · p. 2

2 Preliminaries

The preliminaries establish the privacy and synthesis setting: rounds use adaptive noisy releases, Blowfish policies restrict protected substitutions, and evolutionary synthesizers iteratively select candidate records using private votes.

2.1 Differential Privacy and zCDP

  • Bounded adjacency changes one record’s value, whereas unbounded adjacency adds or removes one; global sensitivity calibrates noise, and zCDP composes across adaptive rounds.The analysis conditions on each round’s candidate population before composing its privacy cost.Source: §2.1 · p. 2

2.2 Pufferfish and Blowfish Privacy

  • A Blowfish policy graph marks protected value substitutions, and its policy-specific sensitivity is the maximum change over policy-neighbor pairs.A policy reduces calibrated noise only when this sensitivity is strictly below global sensitivity; protection also extends along graph paths.Source: §2.2 · pp. 2–3
  • The experiments use threshold, block-partition, and complete graphs; graph reach is the greatest protected-edge distance and suffices for the soft-vote sensitivity bound.Threshold graphs protect nearby values, block-partition graphs protect within categories, and complete graphs protect every pair.Source: §2.2 · p. 3

2.3 Evolutionary, Nearest-Neighbor Synthesis

  • Private Evolution and Tab-PE evolve candidate records by having private records vote for nearest candidates, releasing a noisy histogram, then resampling and mutating.The analysis depends on the voting map rather than the distance, mutation rule, or number of rounds; the one-hot vote cannot vary gradually with policy closeness.Source: §2.3 · p. 3

3 Related Work

Related work spans evolutionary synthesis, policy-aware mechanisms, smoothed assignments, and metric relaxations of privacy. This paper’s distinction is to redesign the vote itself so that its response reflects protected substitution distance.

Evolutionary synthesis

  • PE and Tab-PE use one-hot nearest-neighbor votes, whose sensitivity jumps when a protected substitution crosses a decision boundary.WASP spreads votes by rank, but ranks remain piecewise constant; BF-Soft instead changes continuously with distance, and the approaches could in principle compose.Source: §3 · p. 3

Other DP synthesizers

  • Other synthesizer families target standard DP, and a utility comparison across paradigms under a common policy remains open.The paper isolates policy-aware voting within evolutionary synthesis rather than comparing policy-aware versions of competing synthesizers.Source: §3 · p. 3

Policy-aware mechanisms

  • Prior Blowfish mechanisms transform a fixed workload, whereas this work redesigns the adaptive voting map that determines the workload across synthesis rounds.The per-record vote histogram is a linear workload conditional on the current candidate population.Source: §3 · pp. 3–4

Metric relaxations

  • Metric DP, Lipschitz privacy, and geo-indistinguishability also relax privacy by application-specific closeness; Ball-DP uses a fixed-radius restriction for convex empirical risk minimization.The cited work distinguishes these settings from policy-aware voting for synthesis.Source: §3 · p. 4

Smoothed assignment rules

  • Generic softmax sensitivity bounds can scale with the square root of candidate count, while exploiting common-shift invariance yields a tight reach-and-temperature bound independent of that count.The result combines the oscillation of the perturbed logits with a total-variation inequality [5].Source: §3 · p. 4

4 Policy-Aware Evolutionary Synthesis

The section makes policy awareness a change to the per-record vote and/or its sensitivity calibration, leaving the evolutionary loop intact. BF-Soft uses a graded response with a bound independent of the candidate population.

4.1 Generalizing the Vote

  • The framework separates simplex-valued per-record responses from aggregation, private release, resampling, and mutation, allowing the vote and its calibration to change without altering the rest of synthesis.Source: §4.1 · p. 4

4.3 Hard and Soft Votes

  • Under the same policy graph, soft voting changes previously zero-cost edges by 0.06–0.09 and boundary-crossing edges by about 1.2, versus the hard vote’s full √2 ≈ 1.41 change.The soft vote pays a little everywhere to avoid the maximum change anywhere.Source: Figure 1 · p. 4, §4.3 · p. 5

4.2 Blowfish-Compatible Voting

  • Hard keeps the original vote and calibrates to policy-specific sensitivity, while BF-Soft also redesigns the response to make protected substitutions induce smaller vote changes.Source: §4.2 · p. 4

4.3 Hard and Soft Votes

  • Hard sensitivity is √2 whenever any protected edge crosses a Voronoi boundary and 0 otherwise; every checked experimental round had a crossing, so the policy graph reduced no noise.Source: §4.3 · p. 4
  • BF-Soft replaces the one-hot assignment with a temperature-smoothed vote whose response varies continuously with candidate distances.Source: §4.3 · p. 5
  • Its bound decreases as policy reach shrinks or temperature grows, is independent of candidate count and realized population, and can be computed before synthesis.Source: §4.3 · p. 5, §4.4 · p. 6
  • Under Gower’s flat categorical term, protecting a categorical or binary attribute contributes its full weight to reach; increasing temperature also trades lower sensitivity for a weaker selection signal.Source: §4.3 · p. 5

4.4 Instantiation and Calibration Cost

  • Exact soft sensitivity requires searching policy edges that can grow exponentially with attribute count, whereas the reach-based BF-Soft bound takes constant time and needs no candidate-population inspection.Both hard and soft voting cost O(m) per record.Source: §4.4 · p. 6

5 Sensitivity of Hard and Soft Votes

For per-round linear vote queries, policy sensitivity is determined by protected edges: hard voting jumps at boundaries, while BF-Soft bounds change by policy reach and temperature. Temperature trades sensitivity against the evolutionary signal, and participation or maximal-distance edges can limit reductions.

5.1 Linear Queries

  • At a fixed round, hard and soft votes are linear queries conditional on the candidate population and temperature; the analysis gives per-round sensitivity statements.The policy is fixed before the mechanism runs, and the rounds compose adaptively.Source: §5.1 · p. 6

5.2 A Sensitivity Identity

  • For linear queries, policy sensitivity reduces to a maximum over policy edges, and extra attributes raise reach only when their weighted reach exceeds the current maximum.On Adult, age (θ=7) has reach 0.0192 and hours.per.week (θ=8) 0.0163; together reach remains 0.0192, while binary income raises it to 0.2.Source: §5.2 · p. 6

5.3 Hard-Vote Sensitivity: A Step Function

  • Hard-vote sensitivity is 0 if no protected edge crosses a nearest-candidate boundary and √2 otherwise, independent of crossing-edge length.The crossing structure depends on the current candidate population and can therefore change between rounds.Source: §5.3 · pp. 6–7

5.4 A Tight Soft-Vote Sensitivity Bound

  • BF-Soft has a tight reach-and-temperature sensitivity bound independent of candidate count, and a two-candidate construction shows the bound is attainable.For more than two candidates, the construction approaches the same bound as the remaining candidates’ softmax mass tends to zero.Source: §5.4 · p. 7

5.5 Temperature and the Evolutionary Signal

  • Increasing temperature lowers sensitivity but flattens candidate votes; the bounds cannot choose an optimal temperature because utility cost depends on private margins, candidate trajectory, and privacy budget.At a fixed positive temperature, the noiseless soft histogram can differ from the hard histogram, and the two methods can select toward different populations.Source: §5.5 · p. 8

5.6 Floors on Sensitivity

  • Participation edges and maximal-distance categorical edges impose sensitivity floors; the analysis assumes bounded replacement adjacency and unconstrained I_Q and gives per-round, not convergence, guarantees.A flat categorical block with two or more distinct values and a binary attribute can include a maximal-distance protected pair.Source: §5.6 · p. 8

6 Experiments

The experiments compare hard voting with BF-Soft across fixed-temperature and temperature-sweep evaluations, policy variants, public-pilot selection, and sensitivity calibration. BF-Soft’s error advantage depends on privacy budget and policy reach, while its analytical bound stays above measured sensitivity and is substantially cheaper to compute.

6.1 Setup

  • Adult, Bank, and XOR-3 use 512-record releases over eight rounds; the default narrow numeric policies give q=0.31 for Adult age at τ=0.03, matching Hard’s noise at roughly 10× its privacy budget.Adult and Bank contain 26,048 and 27,126 private training records; XOR-3 has 12,000 records.Source: §6.1 · pp. 8–9

6.2.1 Soft voting helps at strong privacy and reverses at weak pri-

  • Across fixed temperatures, larger τ saves more noise, with q values of 0.56, 0.31, and 0.16 on Adult, 0.51, 0.28, and 0.14 on Bank, and 0.83, 0.53, and 0.29 on XOR-3.The comparisons cover 17 budgets and three temperatures; the table caption identifies interpolated crossing budgets and corresponding ε values but provides no cell values here.Source: §6.2.1 · p. 9, Table 4 · p. 9

6.2.2 Temperature sweeps and the source of the gain.

  • At ρ=10^-4, best-tested mean error falls from 0.696 to 0.427 on Adult and 0.976 to 0.730 on Bank; at ρ=3×10^-3, reductions are 9.9% and 7.2%.Across all nine dataset–budget panels, the lowest sampled BF-Soft mean occurs at an interior τ∈[0.002, 0.05] and is below Hard; these best-of-sweep results are optimistic.Source: Figure 3 · p. 9, §6.2.2 · p. 9

6.2.3 Noise savings versus smoothing cost.

  • On Adult and Bank, smoothing cost is positive at every budget, while noise-reduction benefit shrinks as ρ grows, producing the crossover; equal noise ratios can still yield different errors.On XOR-3, both effects are small, and the noise benefit first rises then falls; the decomposition does not isolate clipping.Source: Figure 4 · p. 10, §6.2.3 · p. 10

6.2.4 Selecting τ without private data

  • The scaled public pilot predicts the sign of mean gain in 190 of 210 Adult settings (90.5%), versus 134 (63.8%) without scaling.Its contour tracks the target more closely at the two smaller budgets than at 3×10^-3; performance on independently collected or shifted public data is untested.Source: Figure 5 · p. 11, §6.2.4 · p. 11

6.2.5 Which policies preserve the gain.

  • On Adult, age-only protection reduces paired error by 33.6% at ρ=10^-4, while policies including workclass or income do not; on Bank, numeric-threshold policies retain gains that added categorical attributes reduce.On Adult, protecting all five columns gives −12.0% and is not significant after Holm adjustment; on Bank, all-five-column results likewise do not survive adjustment.Source: §6.2.5 · p. 11, Figure 6 · p. 12

6.2.6 The calibration bound holds and is cheap.

  • Every measured BF-Soft sensitivity lies below the analytical bound, and at τ≥20 both fall below 1% of 2; the bound costs about 2×10^-4 ms versus 211 ms for Hard and 1.48 s for BF-Soft.The bound is conservative on tested populations, and its cost remains unchanged on product domains while exact calibration searches combinations of unprotected values.Source: §6.2.6 · p. 11, Figure 7 · p. 12

7 Conclusion and Future Work

The conclusion characterizes when policy-aware sensitivity helps and presents BF-Soft as a distance-sensitive alternative to hard voting. Its benefits depend on policy reach and privacy budget, while temperature selection and several extensions remain unresolved.

7 Conclusion and Future Work

  • BF-Soft gives a closed-form sensitivity bound in policy reach and temperature, independent of candidate count, and identifies policies where smoothing cannot substantially reduce noise.Participation edges and maximal-distance protected attributes impose floors on the reach-dependent reduction.Source: §7 · p. 12
  • A Blowfish policy reduces noise only when the released statistic responds to the distances encoded by the policy; hard voting does not, whereas soft voting does.The hard vote reaches its worst-case sensitivity at the first protected boundary crossing.Source: §7 · p. 12
  • Increasing temperature lowers sensitivity but weakens candidate discrimination, and the bounds do not identify an optimal value.A public-pilot regret guarantee and convergence analysis for BF-Soft under ResampleMutate are identified as future work.Source: §7 · p. 12
  • The beneficial region for BF-Soft shifts with policy reach and privacy budget, and a public-data pilot predicts gain sign on the original Adult grid with 90.5% accuracy.The pilot does so without spending private budget.Source: §7 · p. 12
  • The analysis covers linear queries under bounded, unconstrained adjacency, and experiments find strongest policy-induced noise reductions under narrow numeric policies.The public pilot is validated only when pilot and target share a distribution.Source: §7 · p. 12

Artifacts

The paper makes its implementation, experiment scripts, datasets, and extended version publicly available.

Artifacts

  • The repository provides the Tab-PE, Hard, and BF-Soft implementation, policy specifications, reach computation, synthetic XOR generator, and scripts to reproduce experiments and figures.It also includes environment and dependency details and commands for each experiment.Source: Artifacts · p. 13
  • Adult and Bank datasets, preprocessing scripts, and the private-data and public-pilot training/validation splits are available through the repository and UCI repository.Source: Artifacts · p. 13
  • The extended paper, including appendices and full proofs, is available at.Source: Artifacts · p. 13

A Extended Related-Work Differentiation

The appendix distinguishes distance-sensitive smoothing from related rank-based, radius-restricted, and generic softmax approaches. It also clarifies how PE’s post-hoc thresholding interacts with soft voting.

A Extended Related-Work Differentiation

  • WASP [38] shares votes by candidate rank, but its rank-based weights remain piecewise constant; distance-based softmax instead bounds vote changes according to substitution distance.The two approaches could be combined, according to the paper.Source: A Extended Related-Work Differentiation · pp. 13–14
  • Ball-DP [23] restricts neighbor substitutions by radius for convex empirical risk minimization, whereas this work analyzes per-record vote changes in evolutionary synthesis.The sensitivity target in the paper is the response of a fixed record-level vote, conditional on the candidate population.Source: A Extended Related-Work Differentiation · p. 14
  • Generic softmax bounds control arbitrary logit perturbations, while the policy-substitution analysis uses softmax’s invariance to common logit shifts to bound relative changes.The policy-specific bound has no dependence on the number of candidates and is tight, attained with two candidates and approachable with larger populations.Source: A Extended Related-Work Differentiation · p. 14
  • PrivCI changes which statistics a marginal-based synthesizer measures under standard DP, while BF-Soft changes how evolutionary votes respond to policy-protected substitutions.The paper describes these directions as orthogonal and potentially combinable.Source: A Extended Related-Work Differentiation · p. 14

B PE’s Post-Hoc Threshold 𝐻

  • PE’s threshold H removes low-count entries after noise is added, so it does not change sensitivity or the privacy claim.The threshold is post-processing applied after the noisy histogram is produced.Source: B PE’s Post-Hoc Threshold 𝐻 · pp. 14–15
  • A threshold tuned for sparse hard-vote histograms may remove legitimate soft-vote mass, especially at large temperature, but retuning is left unanalyzed.At small temperature, soft voting approaches hard voting and recovers the original thresholding behavior.Source: B PE’s Post-Hoc Threshold 𝐻 · p. 15

C Algorithmic Comparison

This appendix compares adjacency assumptions, exact Hard calibration, and the costs of analytical calibration. Its main practical distinction is between potentially large graph searches and the constant-time BF-Soft bound.

C Algorithmic Comparison

  • Under add/remove adjacency a vote appears or disappears, while public constraints can require multiple aligned record changes and yield coarse triangle-inequality bounds.The main analysis and experiments use bounded, unconstrained replacement adjacency.Source: C Algorithmic Comparison · p. 15
  • One protected boundary crossing certifies Hard sensitivity 2, while certifying zero requires checking every protected edge for each changing candidate population.Source: C Algorithmic Comparison · p. 15
  • Per-attribute policy edges expand across combinations of other attributes, so the record-level graph can grow exponentially; the analytical BF-Soft bound avoids enumerating it.After weighted per-attribute reaches are obtained, the record-level reach is their maximum and the sensitivity bound is evaluated in constant time.Source: C Algorithmic Comparison · p. 15
  • Voting has the same O(m) asymptotic cost for Tab-PE, Hard, and BF-Soft, while BF-Soft computes its reach-and-temperature bound once and Hard may require a round-dependent graph search.The cited calibration-cost experiment does not measure end-to-end synthesis time.Source: C Algorithmic Comparison · p. 15

D Distances for Categorical Attributes

Categorical distance choices determine whether protected substitutions have graded reach or contribute their full attribute weight. The appendix also states how record-level reach and hard-vote sensitivity follow from the policy graph.

D Distances for Categorical Attributes

  • A two-level hierarchy for Bank job halves sibling-only reach from 0.2 to 0.1, still above the 0.017 reach of a narrow age threshold.Tree-path distance supplies graded substitutions, but shallow hierarchies need not yield small reach.Source: D Distances for Categorical Attributes · p. 15
  • A binary attribute has no distance-based gradation, while Gower’s default categorical term gives every distinct-value mismatch the same full attribute weight.A metric with multiple nonzero distances permits gradation without changing the soft-vote bound.Source: D Distances for Categorical Attributes · p. 15

E.1 Proofs for Section 5.2

  • Record-level analytical calibration depends on the largest weighted per-attribute reach, although exact soft-vote sensitivity can depend on the candidate population.Exact hard-vote sensitivity instead depends on whether current assignments cross a policy edge.Source: §E.1 · p. 16

E.2 Proof for Section 5.3

  • The hard-vote sensitivity is 2 when any protected edge crosses nearest-neighbor assignments, and zero when none does.Source: §E.2 · p. 16

E.3 Proofs for Section 5.4

The proof establishes a soft-vote sensitivity bound that does not grow with the candidate count, and shows that the bound is tight. It also relates the probability-distribution argument to a Hilbert-projective-metric result.

E.3 Proofs for Section 5.4

  • The probability-distribution inequality used in the proof specializes a Hilbert-projective-metric bound by Cohen and Fausti [5].Source: §E.3 · p. 16
  • The soft-vote histogram’s policy-specific sensitivity has a bound independent of the number of candidates.For threshold policies, the corollary specializes the bound to policy reach and temperature.Source: §E.3 · p. 17
  • For every positive temperature, threshold, and candidate count of at least two, a finite-domain construction attains the bound, exactly for two candidates and arbitrarily closely for larger counts.The proof adds distant candidates to approach the two-candidate case.Source: §E.3 · pp. 16–17

E.4 Proof of Proposition 5.7

These appendix sections detail the proof scope, policy choices, protocols, and supporting experiments. They report that narrow numeric policies retain strong-privacy gains, while broader categorical or binary reach erodes noise savings.

E.4 Proof of Proposition 5.7

  • Proposition 5.7 concerns one vote at a fixed candidate population and neither characterizes evolutionary dynamics nor implies synthesizer convergence.The corresponding soft-voting convergence analysis is left for future work.Source: §E.4 · p. 18

F.1 Policy Rationale

  • The policy examples use narrow numeric thresholds, flat blocks for Adult workclass, and a hierarchy for Bank job; protecting either binary label gives its attribute full reach.The job hierarchy protects within-group substitutions at θ=2 and all job-category pairs at θ=4.Source: §F.1 · p. 18

F.2 Protocol and Reporting

  • The protocol uses paired runs and pointwise 95% t intervals; interpolated fixed-temperature crossing budgets are descriptive estimates, not directly observed crossings.Retrospectively selected sweep-best results are descriptive and are not corrected for parameter selection.Source: §F.2 · p. 19, §F.3 · p. 19

F.4 Matched Noise Ratios

  • At equal noise ratios, soft-vote curves differed as reach and temperature varied, so q alone did not determine fidelity.The matched settings protected different substitution ranges, rather than comparing identical policies.Source: §F.4 · p. 19

F.5 Temperature Sweeps on Adult and XOR-3

  • For XOR-3 at ρ=3 × 10−3, the best tested temperature was τ=0.023; at ρ=10−4, the best tested setting improved absolute error by 0.0022.Source: §F.5 · p. 19

F.6 Temperature–Reach Interaction on XOR-3

  • On XOR-3, the largest measured mean gains were 39.8%, 40.4%, and 19.9% at ρ=0.03, 0.18, and 1; selected settings saved essentially no noise.At those settings, q≈1, so the observed improvement instead came from soft voting’s effect on selection.Source: §F.6 · p. 19

F.7 Public-Pilot Forecasts

  • The public-data pilot’s forecast agreed most closely with the observed target boundary at the two smaller privacy budgets, but its samples came from the target’s benchmark distribution.The evidence tests matched data generation, not robustness to shifted or independently collected public data.Source: §F.7 · p. 20

F.8 Broader Policies

  • Under the broadest tested policies, adding attributes with larger categorical or binary reach raises noise ratios and reduces noise savings; pilot-selected gains do not survive Holm correction and remain exploratory.The experiments cover five modeled columns, not every column in the source datasets.Source: §F.8 · p. 21

F.9 Private Training Size

With XOR-3’s privacy budget and one-step protection of X1 fixed, BF-Soft’s relative error reduction first increased and then reversed as private training size grew. Hard improved faster over the tested sizes.

F.9 Private Training Size

  • BF-Soft’s relative error reduction was 22.83% at n=12,000, 37.37% at n=48,000, and −89.18% at n=100,000.Source: §F.9 · p. 21
  • From n=12,000 to n=100,000, Hard’s mean error fell from 0.389 to 0.118, while BF-Soft’s fell from 0.297 to 0.214.Both methods improved, but Hard improved faster.Source: §F.9 · p. 21
  • The experiment fixes the privacy budget and one-step protection of X1; larger n acts like a weaker-noise regime, a trend not established for every policy or workload.The histogram noise scale does not grow proportionally with n, so it shrinks relative to the empirical histogram.Source: §F.9 · p. 21

Related papers

Loading 2610.11285v1…