Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper studies the asymptotic properties of privacy profiles and propose an efficient method for GDP algorithms to reduce the set of possible optimal privacy measurement. As an application to the main result, all pure-DP algorithms are also GDP.
strengths_and_weaknesses: Disclaimer: I was unable to read through the proof, but the results seems plausible. My comments are based on first 9 pages.

Strengths:
-- The paper presents analytic methods to deal with Gaussian DP, the one parameter privacy definition that captures entirety of approx-DP.
-- Gives an algorithm to find \mu with privacy profiles.


Weakness:
-- I found motivation of the paper and results a little bit difficult to understand. 
-- There are couple of places where it is mentioned: nontrivial (\eps,\delta)-DP algorithm must be (0,\delta)-DP for some \delta <1. I really do not get this statement. Why is this true? 
-- Which key lemma are the authors referring to on line 194.
-- I would suggest having the algorithm for finding \mu in the main 9 pages. It is very interesting algorithm.
questions: N/AN/
limitations: N/A
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors in this paper extend the study of Gaussian differential privacy, an intuitive, single parameter privacy guarantee that exactly captures the privacy of the Gaussian mechanism. The authors introduce head and tail GDP, and provide conditions under which algorithms with given privacy curves/profiles satisfy these modes of GDP. The authors then show that algorithms, such as the Laplace mechanism, that satisfy pure DP also satisfy Gaussian DP. They demonstrate computationally that, by casting these algorithms under GDP, one can obtain tighter composition results than basic or advanced composition would permit.
strengths_and_weaknesses: Strengths: Gaussian differential privacy is a simple and important concept for characterizing private algorithms. The authors demonstrate that, by furthering the study of GDP, one can obtain improved composition results for commonly used private algorithms. The authors also give computational techniques for characterizing the head GDP of algorithms, making the work practical. The work is original as it is the first to cast purely differentially private algorithms as GDP algorithms --- an approach that yields tighter composition results.

Weaknesses: Many of the algorithms considered in this work can have their exact privacy curve efficiently approximated using Fourier-based methods. While the results surrounding GDP offer improvements over baselines such as advanced composition, converting pure DP to GDP is still lossy. Since the paper contains many technical results, it may also be helpful to either provide sketches or explain intuitions to the reader.

questions: Nothing additional.
limitations: The authors say that the limitations are given as preconditions of theorems. It would helpful to the reader to also have the limitations separately addressed in conclusion, for instance, as this could motivate future work. For instance, one limitation is that the conversion to GDP is inherently lossy, and thus for many composition problems Fourier-based accounts can actually outperform the results in this paper, approximating the true privacy profile/curve to arbitrary precision.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: Gaussian DP is known as an exact privacy accountant with hypothesis-testing-based interpretation.
The paper studies a significant problem --- converting algorithms developed under other DP accountants into the GDP framework.
Specifically, 
1. The authors study the connection between GDP and the privacy profile, and use the asymptotic properties of privacy profiles to identify the GDP property.

2. For non-GDP algorithms, the authors propose the ``clip and rectify'' procedure to convert these algorithms into a mu-GDP algorithm. 
strengths_and_weaknesses: Limitations: Though the conversion to GDP is solid, 
the paper lacks empirical comparison or theoretical evidence to demonstrate that such conversion is tight. Other DP accountants might provide tighter privacy characterization if the conversion is loose.


Comments:

1. ``we show that all epsilon-DP algorithms are also GDP'' might be overclaimed. [13] has shown that the trade-off function of epsilon-DP will be lower bounded by the randomized response mechanism, which satisfies GDP. 

2. The section 5.2 (handling composition with GDP) is not the contribution of this paper. It will be better to move it to the preliminary/related work section. 

questions: Theorem3.3 is about the asymptotic property. It only provides a lower bound of GDP, but the derived GDP may not be as tight as the original privacy profile. It would be more interesting if the authors could plot both the original privacy profile and the converted GDP in a trade-off figure and compare the two curves.
limitations: Yes, they have addressed it.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This work shows the relationship between the common DP and GDP metric in privacy. GDP's good interpretability makes it clear than traditional DP with privacy profiles. The work follows the equivalence of GDP and DP with function $\delta_{\epsilon}$ and specifies the function characteristics to bridge DP and GDP. Besides the identification of DP to GDP, a  GDPT method is proposed to clearly show the relationship between DP and GDP in combination with head and tail analysis. The GDPT can also be that can be easily estimated supported by the theoretical analysis in the work. Finally, the authors show some applications in privacy compositions with the understanding of the GDP and DP.
strengths_and_weaknesses: Pros:
1. The work gives a powerful tool to bridge GDP and DP. It clearly reveals the relationship and provides a better understanding of GDP, which can make traditional DP more interpretable through GDP.
2. The good organization of the paper makes the readers easy to understand the proposed structure and corollaries.

Cons:
1. The practical application of DP to GDP is not clear. Can the proposed mechanisms help us to design a better privacy mechanism? Or how to quantify the interpretability?  How to show more effectiveness for GDP compared with DP?
2. The technical challenges/novelty should be stated clearly. The work is based on Theorem 3.1 a lot but the it is from [Dong et al. 2021].

questions: Some questions:
1. How is the cost/utility of GDP compared with other mechanisms? Some theoretical/magnitude results can be provided if possible.
2. Can GDPT help us design a new privacy mechanism with lower cost/ utility?
3. For the other algorithm with the privacy profile tail larger than $e^{-\delta^2}$, can we measure it with GDP approximately?
4. How is the proposed framework related to the privacy loss random variable? According to GDPT, $\mu$ gives a uniform description for the structure of the output's measurable space. The distribution/ the moments of privacy loss random variable might provide the detailed description, which may help the specification of the tail of GDPT. 
5. Can Theorem 2.1 be stronger in dependence on actual algorithms? It may make the following analysis more concise.
6. In Theorem 4.3, is $x_i\in[0,\epsilon_h]$ or not?

Some suggestions:
1. Some detailed settings for the experiments should be shown. (Like dataset,or other settings)
2. It is better to restate the subsampling process to make it friendly to readers.
3. Some intuitive examples/ figures can be provided to show the tail larger than $e^{-\delta^2}$ can not be $\mu-$GDP.
limitations: The authors should mention some limitations for heavy tails and head $\epsilon_h$ choices in the main context more clearly.
review_title: null

Meta-review: metareview: This paper expands our understanding of a recent variant of differential privacy, called Gaussian differential privacy, and studies its relationship with the standard definition. The reviewers all agree that the results are both important and interesting, and support accepting the paper.
confidence: Certain
Decision: Accept