Research map / Federated learning and privacy / Differential privacy

𝑓-Differential Privacy Filters: Validity and Approximate Solutions

NeurIPS 2026 · Federated learning and privacy › Differential privacy · approach: Private data analysis frameworks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows the natural f-DP filter (stop when tensor product of realized trade-off functions crosses budget) is invalid under fully adaptive composition, gives validity conditions via Blackwell chains, proves a fully adaptive f-DP CLT, and builds a closed-form approximate GDP filter for subsampled Gaussian mechanisms in q→0 and q→1 regimes.

Problem

Privacy filters for f-DP under fully adaptive composition: whether the natural tensor-product-based f-DP filter is valid, and how to get tight approximate filters beyond RDP.

Approach

Shows the natural f-DP filter fails because adaptive products of trade-off functions can fall below per-branch standard products; characterizes validity via Blackwell chains of the future trade-off families; proves a martingale-based fully adaptive CLT giving Gaussian (GDP) approximations, instantiated as a closed-form approximate GDP filter for subsampled Gaussian mechanisms.

Key results

• Natural f-DP filter is invalid for fully adaptive subsampled Gaussian compositions; counterexample with q=0.5 and budget constructed from crossing trade-off functions (calibration point gamma0 ≈ 0.971).
• Monte Carlo simulation gives empirical CLT error Delta ≈ 0.0125 at q=0.1, with Delta decreasing to 0.0048 at q=0.95 and 0.0032 at q=0.01 (Table reports Delta values across q).
• Approximate GDP filter yields Delta=O(sqrt(q̄)) as q̄→0 and Delta=O(ln σ̄/σ̄) as σ̄→∞, asymptotically tighter than single-order RDP filter in these regimes.

Surprising findings

• The natural f-DP filter, which is the obvious extension of tensor-product composition, is invalid even when each branch passes the budget check.
• At realistic subsampling rates (q=0.1) the sqrt(2B)-GDP CLT approximation underestimates privacy loss.

Limitations

• CLT-based approximate GDP filter is optimistic at moderate subsampling rates and only valid asymptotically (q small or near 1).
• Approximation error Delta is not tracked with an explicit universal constant.
• Validation is limited to Monte Carlo simulation of DP-SGD-like compositions.

Experimental setup

Metrics: Berry-Esseen-type CDF discrepancy Delta GDP parameter mu (sqrt(2B))

Baselines: (1,B)-RDP filter fully adaptive RDP accounting natural f-DP filter

Builds on: Rényi DP filters GDP filter (Whitehouse et al.) f-DP composition (Dong et al.) martingale Berry-Esseen theorem

Closest papers by meaning

• Beyond the Calibration Point: Mechanism Comparison in Differential Privacy (ICML 2024 · similarity 0.90)
• Revisiting Differentially Private ReLU Regression (NeurIPS 2024 · similarity 0.89)
• Purifying Approximate Differential Privacy with Randomized Post-processing (NeurIPS 2025 · similarity 0.89)
• The Limits of Differential Privacy in Online Learning (NeurIPS 2024 · similarity 0.89)
• Shifted Interpolation for Differential Privacy (ICML 2024 · similarity 0.88)
• A Unified Framework for Adversary-Aware Differential Privacy Bounds (NeurIPS 2026 · similarity 0.88)