Research map / Federated learning and privacy / Differential privacy

Setting $\varepsilon$ is not the Issue in Differential Privacy

NeurIPS 2025 · Federated learning and privacy › Differential privacy · approach: Private data analysis frameworks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Position paper arguing that difficulty in setting the differential privacy budget epsilon is not a fundamental flaw of DP, and that the community should avoid discouraging DP adoption or pursuing small epsilon at the expense of weaker trust models.

Problem

Setting the privacy budget epsilon in differential privacy is often portrayed as an open problem and major barrier to adoption, which may push practitioners toward unsafe alternative privacy methods or dubious trust settings.

Approach

Argues that the difficulty of interpreting epsilon stems from the intrinsic difficulty of estimating privacy risk in context, not from DP's definition; any sound privacy risk estimation method should be expressible within the DP framework or justify why it cannot. Also argues that small-epsilon pursuit (e.g., public pretraining, label DP, centralized vs local accounting) can game the metric (Goodh

Key results

• Argues that for randomized response with K=3790 emoji, a 75% chance of truthful answer corresponds to epsilon ~ 9.33, illustrating that large epsilon can still be meaningful in high dimensions.
• Notes that under centralized Gaussian aggregation, a local budget epsilon per participant corresponds to roughly epsilon/sqrt(n) centrally, so reported budgets can change order of magnitude by accounting choice alone.
• Shows conversions from RDP, GDP to (epsilon, delta)-DP as a common reporting format.

Surprising findings

• Randomized response with epsilon=log(3) returns an incorrect answer 99.92% of the time for K=3790 emoji, yet a large epsilon of ~9.33 is needed for 75% truthful response, illustrating that large epsilon can still be meaningful in high dimensions.
• Large epsilon values can still correspond to meaningful protection in high dimensions, so dismissing large-budget algorithms may be premature.

Limitations

• Argument is qualitative and largely conceptual; no new experiments or formal results on budget interpretation.
• Some claims (e.g., link between conjunction fallacy and privacy budget) are explicitly conjectural and untested.

Experimental setup

Builds on: differential privacy Rényi differential privacy Gaussian differential privacy f-differential privacy contextual integrity

Closest papers by meaning

• Prior-itizing Privacy: A Bayesian Approach to Setting the Privacy Budget in Differential Privacy (NeurIPS 2024 · similarity 0.91)
• Beyond the Calibration Point: Mechanism Comparison in Differential Privacy (ICML 2024 · similarity 0.90)
• Attack-Aware Noise Calibration for Differential Privacy (NeurIPS 2024 · similarity 0.88)
• Auditing Private Prediction (ICML 2024 · similarity 0.87)
• Provable Privacy with Non-Private Pre-Processing (ICML 2024 · similarity 0.87)
• The Limits of Differential Privacy in Online Learning (NeurIPS 2024 · similarity 0.87)