SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Yangdi Jiang, Xiaotian Chang, Yi Liu, Lei Ding, Linglong Kong, Bei Jiang*
Department of Mathematical and Statistical Sciences
{yangdi, xchang4, yliu16, lding1, lkong, bei1}@ualberta.ca
We develop an advanced approach for extending Gaussian Differential Privacy (GDP) to general Riemannian manifolds. The concept of GDP stands out as a prominent privacy definition that strongly warrants extension to manifold settings, due to its central limit properties. By harnessing the power of the renowned Bishop-Gromov theorem in geometric analysis, we propose a Riemannian Gaussian distribution that integrates the Riemannian distance, allowing us to achieve GDP in Riemannian manifolds with bounded Ricci curvature. To the best of our knowledge, this work marks the first instance of extending the GDP framework to accommodate general Riemannian manifolds, encompassing curved spaces, and circumventing the reliance on tangent space summaries. We provide a simple algorithm to evaluate the privacy budget  $\mu$  on any one-dimensional manifold and introduce a versatile Markov Chain Monte Carlo (MCMC)-based algorithm to calculate  $\mu$  on any Riemannian manifold with constant curvature. Through simulations on one of the most prevalent manifolds in statistics, the unit sphere  $S^d$ , we demonstrate the superior utility of our Riemannian Gaussian mechanism in comparison to the previously proposed Riemannian Laplace mechanism for implementing GDP.
As technological advancements continue to accelerate, we are faced with the challenge of managing and understanding increasingly complex data. This data often resides in nonlinear manifolds, commonly found in various domains such as medical imaging [Pennec et al., 2019, Dryden, 2005, Dryden et al., 2009], signal processing [Barachant et al., 2010, Zanini et al., 2018], computer vision [Turaga and Srivastava, 2015, Turaga et al., 2008, Cheng and Vemuri, 2013], and geometric deep learning [Belkin et al., 2006, Niyogi, 2013]. These nonlinear manifolds are characterized by their distinct geometric properties, which can be utilized to extract valuable insights from the data.
As data complexity grows, so does the imperative to safeguard data privacy. Differential Privacy (DP) [Dwork et al., 2006b] has gained recognition as a prominent mathematical framework for quantifying privacy protection, and a number of privacy mechanisms [McSherry and Talwar, 2007, Barak et al., 2007, Wasserman and Zhou, 2010, Reimherr and Awan, 2019] have been devised with the aim of achieving DP. Conventional privacy mechanisms, while effective for dealing with linear data, encounter difficulties when handling complex non-linear data. In such cases, a common approach, referred to as the extrinsic approach, is to embed the non-linear data into the ambient Euclidean space, followed by the application of standard DP mechanisms. However, as exemplified in the work of Reimherr et al. [2021], the intrinsic properties of such non-linear data enable us to achieve better data utility while simultaneously preserving data privacy. Therefore, it is imperative that privacy mechanisms adapt to the complexity of non-linear data by employing tools from differential geometry to leverage the geometric structure within the data.
Related Work Reimherr et al. [2021] is the first to consider the general manifolds in the DP literature. It extends the Laplace mechanism for  $\varepsilon$ -DP from Euclidean spaces to Riemannian manifolds. Focusing on the task of privatizing Frechet mean, it demonstrates that better utility can be achieved when utilizing the underlying geometric structure within the data. Continuing its work, Soto et al. [2022] develops a K-norm gradient mechanism for  $\varepsilon$ -DP on Riemannian manifolds and shows that it outperforms the Laplace mechanism previously mentioned in the task of privatizing Frechet mean. Similarly, Utpala et al. [2023b] extends  $(\varepsilon, \delta)$ -DP and its Gaussian mechanism but only to one specific manifold, the space of symmetric positive definite matrices (SPDM). Equipping the space of SPDM with the log Euclidean metric, it becomes a geometrically flat space [Arsigny et al., 2007]. This allows them to simplify their approach and work with fewer complications, although at the expense of generality. In contrast to the task of releasing manifold-valued private summary, Han et al. [2022], Utpala et al. [2023a] focus on solving empirical risk minimization problems in a  $(\varepsilon, \delta)$ -DP compliant manner by privatizing the gradient which resides on the tangent bundle of Riemannian manifolds. Working on tangent spaces instead of the manifold itself, they could bypass many of the difficulties associated with working under Riemannian manifolds.
Motivations Although the  $\varepsilon$ -differential privacy (DP) and its Laplace mechanism have been extended to general Riemannian manifolds in Reimherr et al. [2021], there are other variants of DP [Dwork et al., 2006a, Mironov, 2017, Bun and Steinke, 2016, Dong et al., 2022]. Each of them possesses unique advantages over the pure DP definition, and therefore their extensions should be considered as well. As one such variant, GDP offers superior composition and subsampling properties to that of  $\varepsilon$ -DP. Additionally, it's shown that all hypothesis testing-based privacy definitions converge to the guarantees of GDP in the limit of composition [Dong et al., 2022]. Furthermore, when the dimension of the privatized data approaches infinity, a large class of noise addition private mechanisms is shown to be asymptotically GDP [Dong et al., 2021]. These traits establish GDP as the focal privacy definition among different variants of DP definitions and therefore make it the most suitable option for generalizing to Riemannian manifolds.
Main Contributions With the goal of releasing manifold-valued statistical summary in a GDP-compliant manner, we extend the GDP framework to general Riemannian manifolds, establishing the ability to use Riemannian Gaussian distribution for achieving GDP on Riemannian manifolds. We then develop an analytical form to achieve  $\mu$ -GDP that covers all the one-dimensional cases. Furthermore, we propose a general MCMC-based algorithm to evaluate the privacy budget  $\mu$  on Riemannian manifolds with constant curvature. Lastly, we conduct numerical experiments to evaluate the utility of our Riemannian Gaussian mechanism by comparing it to the Riemannian Laplace mechanism. Our results conclusively demonstrate that to achieve GDP, our Gaussian mechanism exhibits superior utility compared to the Laplace mechanism.
2 Notation and Background
In this section, we first cover some basic concepts from Riemannian geometry. The materials covered can be found in standard Riemannian geometry texts such as Lee [2006], Petersen [2006], Pennec et al. [2019], Said [2021]. Then we review some definitions and results on DP and GDP, please refer to Dwork and Roth [2014], Dong et al. [2022, 2021] for more detail.
2.1 Riemannian Geometry
Throughout this paper we let  $\mathcal{M}$  denote a  $d$ -dimensional complete Riemannian manifold unless stated otherwise. A Riemannian metric  $g$  is a collection of scalar products  $\langle \cdot, \cdot \rangle_x$  on each tangent space  $T_x\mathcal{M}$  at points  $x$  of the manifold that varies smoothly from point to point. For each  $x$ , each such scalar product is a positive definite bilinear map  $\langle \cdot, \cdot \rangle_x: T_x\mathcal{M} \times T_x\mathcal{M} \to \mathbb{R}$ .
Equipped with a Riemannian metric  $g$ , it grants us the ability to define length and distance on  $\mathcal{M}$ . Consider a curve  $\gamma(t)$  on  $\mathcal{M}$ , the length of the curve is given by the integral
$$
L (\gamma) = \int \| \dot {\gamma} (t) \| _ {\gamma (t)} d t = \int \left(\langle \dot {\gamma} (t), \dot {\gamma} (t) \rangle_ {\gamma (t)}\right) ^ {\frac {1}{2}} d t
$$
where the  $\dot{\gamma} (t)$  is the velocity vector and norm  $\| \dot{\gamma} (t)\|$  is uniquely determined by the Riemannian metric  $g$ . Note we use  $\| \cdot \|$  to denote the  $l_{2}$  norm throughout this paper.
It follows that the distance between two points  $x, y \in \mathcal{M}$  is the infimum of the lengths of all piecewise smooth curves from  $x$  to  $y$ ,  $d(x, y) = \inf_{\gamma : \gamma(0) = x, \gamma(1) = y} L(\gamma)$ . In a similar fashion, we can introduce the notion of measure on  $\mathcal{M}$ . The Riemannian metric  $g$  induces a unique measure  $\nu$  on the Borel  $\sigma$ -algebra of  $\mathcal{M}$  such that in any chart  $U$ ,  $d\nu = \sqrt{\det g} d\lambda$  where  $g = (g_{ij})$  is the matrix of the Riemannian metric  $g$  in  $U$ , and  $\lambda$  is the Lebesgue measure in  $U$  [Grigoryan, 2009].
Given a point  $p \in \mathcal{M}$  and a tangent vector  $v \in T_p\mathcal{M}$ , there exists a unique geodesic  $\gamma_{(p,v)}(t)$  starting from  $p = \gamma_{(p,v)}(0)$  with tangent vector  $v = \dot{\gamma}_{(p,v)}(0)$  defined in a small neighborhood of zero. It can then be extended to  $\mathbb{R}$  since we assume  $\mathcal{M}$  is complete. This enables us to define the exponential map  $\exp_p: T_p\mathcal{M} \to \mathcal{M}$  as  $\exp_p(v) = \gamma_{(p,v)}(1)$ . For any  $p \in \mathcal{M}$ , there is a neighborhood  $V$  of the origin in  $T_p\mathcal{M}$  and a neighborhood  $U$  of  $p$  such that  $\exp_p|_V: V \to U$  is a diffeomorphism. Such  $U$  is called a normal neighborhood of  $p$ . Locally, the straight line crossing the origin in  $T_p\mathcal{M}$  transforms into a geodesic crossing through  $p$  on  $\mathcal{M}$  via this map. On the normal neighborhood  $U$ , the inverse of the exponential map can be defined and is denoted by  $\log_p$ . The injectivity radius at a point  $p \in \mathcal{M}$  is then defined as the maximal radius  $R$  such that  $B_p(R) \subset \mathcal{M}$  is a normal neighborhood of  $p$ , and the injectivity radius of  $\mathcal{M}$  is given by  $\mathrm{inj}_{\mathcal{M}} = \inf \{\mathrm{inj}_{\mathcal{M}}(p), p \in \mathcal{M}\}$ .
We start this section with the definition of  $(\varepsilon, \delta)$ -DP.
Definition 2.1 ([Dwork et al., 2006a]). A data-releasing mechanism  $M$  is said to be  $(\varepsilon, \delta)$ -differentially private with  $\varepsilon \geq 0, 0 \leq \delta \leq 1$ , if for any adjacent datasets, denoted as  $\mathcal{D} \simeq \mathcal{D}'$ , differing in only one record, we have  $\operatorname{Pr}(M(\mathcal{D}) \in A) \leq e^{\varepsilon} \operatorname{Pr}(M(\mathcal{D}') \in A) + \delta$  for any measurable set  $A$  in the range of  $M$ .
Differential privacy can be interpreted from the lens of statistical hypothesis testing [Wasserman and Zhou, 2010, Kairouz et al., 2017]. Given the outcome of a  $(\varepsilon, \delta)$ -DP mechanism and a pair of neighboring datasets  $\mathcal{D} \simeq \mathcal{D}'$ , consider the hypothesis testing problem with  $H_0$ : The underlying dataset is  $\mathcal{D}$  and  $H_1$ : The underlying dataset is  $\mathcal{D}'$ . The smaller the  $\varepsilon$  and  $\delta$  are, the harder this hypothesis testing will be. That is, it will be harder to detect the presence of one individual based on the outcome of the mechanism. More specifically,  $(\varepsilon, \delta)$ -DP tells us the power (that is, 1 - type II error) of any test at significance level  $\alpha \in [0, 1]$  is bounded above by  $e^{\varepsilon} \alpha + \delta$ . Using this hypothesis testing interpretation, we can extend  $(\varepsilon, \delta)$ -DP to the notion of Gaussian differential privacy.
Let  $M(\mathcal{D}), M(\mathcal{D}^{\prime})$  denote the distributions of the outcome under  $H_0, H_1$  respectively. Let  $T(M(\mathcal{D}), M(\mathcal{D}^{\prime})) : [0,1] \to [0,1], \alpha \mapsto T(M(\mathcal{D}), M(\mathcal{D}^{\prime})) (\alpha)$  denote the optimal tradeoff between type I error and type II error. More specifically,  $T(M(\mathcal{D}), M(\mathcal{D}^{\prime})) (\alpha)$  is the smallest type II error when type I error equals  $\alpha$ .
Definition 2.2 ([Dong et al., 2022]). A mechanism  $M$  is said to satisfy  $\mu$ -Gaussian Differential Privacy ( $\mu$ -GDP) if  $T(M(\mathcal{D}), M(\mathcal{D}')) \geq G_{\mu}$  for all neighboring datasets  $\mathcal{D} \simeq \mathcal{D}'$  with  $G_{\mu} := T(N(0,1), N(\mu,1))$ .
Informally,  $\mu$ -GDP states that it's harder to distinguish  $\mathcal{D}$  from  $\mathcal{D}'$  than to distinguish between  $N(0,1)$  and  $N(\mu,1)$ . Similar to the case of  $(\varepsilon, \delta)$ -differential privacy, a smaller value of  $\mu$  provides stronger privacy guarantees. As a privacy definition,  $\mu$ -GDP enjoys several unique advantages over the  $(\varepsilon, \delta)$ -DP definition. Notably, it has a tight composition property that cannot be improved in general. More importantly, a crucial insight in Dong et al. [2022] is that the best way to evaluate the privacy of the composition of many "highly private" mechanisms is through  $\mu$ -GDP. More specifically, it gives a central limit theorem that states all hypothesis testing-based privacy definitions converge to the guarantees of  $\mu$ -GDP in the limit of composition. Furthermore, Dong et al. [2021] shows that a large class of noise addition mechanisms is asymptotic  $\mu$ -GDP when the dimension of the privatized data approaches infinity. These distinct characteristics position  $\mu$ -GDP as the focal privacy definition among different variants of DP definitions, and we will extend the  $\mu$ -GDP framework to general Riemannian manifolds in Section 3.
3 Gaussian Differential Privacy on General Riemannian Manifolds
Our primary objective in this study is to disclose a  $\mathcal{M}$ -valued statistical summary while preserving privacy in a GDP-compliant manner. To this end, we first extend the GDP definition to general
Riemannian manifolds. In Definition 2.2,  $\mu$ -GDP is defined through the optimal trade-off function  $T(M(\mathcal{D}), M(\mathcal{D}'))$ , which is challenging to work with on Riemannian manifolds. We successfully resolve this difficulty by expressing  $\mu$ -GDP as an infinite collection of  $(\varepsilon, \delta)$ -DP (Corollary 1 in Dong et al. [2022]). Since  $(\varepsilon, \delta)$ -DP is a well-defined notion on any measurable space [Wasserman and Zhou, 2010], it readily extends to any Riemannian manifold equipped with the Borel  $\sigma$ -algebra. Following this methodology, we define  $\mu$ -GDP on general Riemannian manifolds as follows.
Definition 3.1. A  $\mathcal{M}$ -valued data-releasing mechanism  $M$  is said to be  $\mu$ -GDP if it's  $(\varepsilon, \delta_{\mu}(\varepsilon))$ -DP for all  $\varepsilon \geq 0$ , where
$$
\delta_ {\mu} (\varepsilon) := \Phi \left(- \frac {\varepsilon}{\mu} + \frac {\mu}{2}\right) - \mathrm {e} ^ {\varepsilon} \Phi \left(- \frac {\varepsilon}{\mu} - \frac {\mu}{2}\right).
$$
and  $\Phi$  denotes the cumulative distribution function of the standard normal distribution.
Similarly, we extend the notion of sensitivity to Riemannian manifolds as well.
Definition 3.2 (Reimherr et al. [2021]). A summary  $f$  is said to have a global sensitivity of  $\Delta < \infty$ , with respect to  $d(\cdot, \cdot)$ , if we have  $d(f(\mathcal{D}), f(\mathcal{D}')) \leq \Delta$  for any two datasets  $\mathcal{D} \simeq \mathcal{D}'$ .
Following the extension of  $\mu$ -GDP to Riemannian manifolds, it is crucial to develop a private mechanism that is compliant with  $\mu$ -GDP. Given that the Gaussian distribution satisfies  $\mu$ -GDP on Euclidean space [Dong et al., 2022], we hypothesize that an analogous extension of the Gaussian distribution into Riemannian manifolds would yield similar adherence to  $\mu$ -GDP (e.g., [Reimherr et al., 2021] for extending Laplace distribution to satisfy  $\varepsilon$ -DP on Riemannian manifolds). We introduce the Riemannian Gaussian distribution in the following definition.
Definition 3.3 (Section 2.5 in Pennec et al. [2019]). Let  $(\mathcal{M},g)$  be a Riemannian manifold such that
$$
Z (\eta , \sigma) = \int_ {\mathcal {M}} \exp \left\{- \frac {d (y , \eta) ^ {2}}{2 \sigma^ {2}} \right\} d \nu (y) <   \infty .
$$
We define a probability density function w.r.t  $d\nu$  as
$$
p _ {\eta , \sigma} (y) = \frac {1}{Z (\eta , \sigma)} \exp \left\{- \frac {d (y , \eta) ^ {2}}{2 \sigma^ {2}} \right\}. \tag {1}
$$
We call this distribution a Riemannian Gaussian distribution with footprint  $\eta$  and rate  $\sigma$  and denote it by  $Y\sim N_{\mathcal{M}}(\eta ,\sigma^2)$
The necessity for  $Z(\eta, \sigma)$  to be finite is generally of little concern, as it has been shown to be so in any compact manifolds [Chakraborty and Vemuri, 2019] or any Hadamard manifolds<sup>1</sup>—with lower-bounded sectional curvature [Said, 2021]. The distribution we introduce has been established to maximize entropy given the first two moments [Pennec et al., 2019, Pennec, 2006], and has already found applications in a variety of scenarios [Zhang and Fletcher, 2013, Hauberg, 2018, Said et al., 2017, Cheng and Vemuri, 2013, Zanini et al., 2018, Chakraborty and Vemuri, 2019]. When  $\mathcal{M} = \mathbb{R}^d$ , the Riemannian Gaussian distribution reduces to the multivariate Gaussian distribution with a mean of  $\eta$  and a variance of  $\sigma^2\mathbf{I}$ .
However, it is critical to highlight that this extension is not the only possible method for integrating the Gaussian distribution into Riemannian manifolds. Other approaches are available, such as the heat kernel diffusion process articulated by Grigoryan [2009], or the exponential-wrapped Gaussian introduced by Chevallier et al. [2022]. For an in-depth exploration of sampling from the Riemannian Gaussian distribution defined above, we refer readers to Section 4.1.
Furthermore, the subsequent theorem underscores the ability of the Riemannian Gaussian distribution, as defined herein, to meet the requirements of Gaussian Differential Privacy.
Theorem 3.1. Let  $\mathcal{M}$  be a Riemannian manifold with lower bounded Ricci curvature and  $f$  be a  $\mathcal{M}$ -valued summary with global sensitivity  $\Delta$ . The Riemannian Gaussian distribution with footprint  $f(\mathcal{D})$  and rate  $\sigma$  satisfies  $\mu$ -GDP for some  $\mu > 0$ .
<sup>1</sup>A Hadamard manifold is a Riemannian manifold that is complete and simply connected and has everywhere non-positive sectional curvature.
While Theorem 3.1 confirms the potential of the Riemannian Gaussian distribution to achieve GDP, it leaves the relationship between the privacy budget  $(\mu)$  and the rate  $(\sigma)$  undefined. The subsequence theorem establishes such a connection:
Theorem 3.2 (Riemannian Gaussian Mechanism). Let  $\mathcal{M}$  be a Riemannian manifold with lower bounded Ricci curvature and  $f$  be a  $\mathcal{M}$ -valued summary with global sensitivity  $\Delta$ . The Riemannian Gaussian distribution with footprint  $f(D)$  and rate  $\sigma > 0$  is  $\mu$ -GDP if and only if  $\mu$  satisfies the following condition,  $\forall \varepsilon \geq 0$ ,
$$
\sup  _ {\mathcal {D} \simeq \mathcal {D} ^ {\prime}} \int_ {A} p _ {\eta_ {1}, \sigma} (y) d \nu (y) - e ^ {\varepsilon} \int_ {A} p _ {\eta_ {2}, \sigma} (y) d \nu (y) \leq \delta_ {\mu} (\varepsilon) \tag {2}
$$
where  $A\coloneqq \{y\in \mathcal{M}:p_{\eta_1,\sigma}(y) / p_{\eta_2,\sigma}(y)\geq e^{\varepsilon}\}$  and  $\eta_1\coloneqq f(\mathcal{D}),\eta_2\coloneqq f(\mathcal{D}').$
Given the rate  $\sigma$ , Theorem 3.2 provides us a way of computing the privacy budget  $\mu$  through the inequality (2). When  $\mathcal{M} = \mathbb{R}^d$ , the set  $A$  enjoys a tractable form,  $A = \{y \in \mathbb{R}^d : \langle y - \eta_2, \eta_1 - \eta_2 \rangle \geq \frac{1}{2} (2\sigma^2 \varepsilon / \| \eta_1 - \eta_2 \| + \| \eta_1 - \eta_2 \|)\}$ , and the inequality (2) then reduces to,
$$
\sup _ {D \simeq D ^ {\prime}} \Phi \left(- \frac {\sigma \varepsilon}{\| \eta_ {1} - \eta_ {2} \|} + \frac {\| \eta_ {1} - \eta_ {2} \|}{2 \sigma}\right) - e ^ {\varepsilon} \Phi \left(- \frac {\sigma \varepsilon}{\| \eta_ {1} - \eta_ {2} \|} + \frac {\| \eta_ {1} - \eta_ {2} \|}{2 \sigma}\right) \leq \delta_ {\mu} (\varepsilon)
$$
where the equality holds if and only if  $\sigma = \Delta/\mu$ , which reduces to the Gaussian mechanism on Euclidean spaces in Dong et al. [2022]. It's worth pointing out that on  $\mathbb{R}^d$ , the Pythagorean theorem allows us to reduce the integrals to one-dimensional integrals resulting in a simple solution for any dimension  $d$ . Unfortunately, the lack of Pythagorean theorem on non-Euclidean spaces makes it difficult to evaluate the integrals on manifolds of dimensions greater than one. It's known that any smooth, connected one-dimensional manifold is diffeomorphic either to the unit circle  $S^1$  or to some interval of  $\mathbb{R}$  [Milnor and Weaver, 1997]. Therefore, we encompass all one-dimensional cases by presenting the following result on  $S^1$ .
Corollary 3.2.1 (Riemannian Gaussian Mechanism on  $S^1$ ). Let  $f$  be a  $S^1$ -valued summary with global sensitivity  $\Delta$ . The Riemannian Gaussian distribution  $N_{\mathcal{M}}(f(\mathcal{D}), \sigma^2)$  is  $\mu$ -GDP if and only if  $\mu$  satisfies the following condition,  $\forall \varepsilon \in [0, \pi \Delta/(2\sigma^2)], h(\sigma, \varepsilon, \Delta) \leq \delta_\mu(\varepsilon)$  where
$$
\begin{array}{l} h (\sigma , \varepsilon , \Delta) = \frac {1}{C (\sigma)} \left[ \Phi \left(- \frac {\sigma \varepsilon}{\Delta} + \frac {\Delta}{2 \sigma}\right) - e ^ {\varepsilon} \Phi \left(- \frac {\sigma \varepsilon}{\Delta} - \frac {\Delta}{2 \sigma}\right) \right] \\ - \frac {1}{C (\sigma)} \left[ \Phi \left(\frac {\sigma \varepsilon}{\Delta} + \frac {\Delta}{2 \sigma} - \frac {\pi}{\sigma}\right) - e ^ {\varepsilon} \Phi \left(\frac {\sigma \varepsilon}{\Delta} - \frac {\Delta}{2 \sigma} + \frac {\pi}{\sigma} \mathbf {1} _ {\varepsilon \leq \frac {\Delta^ {2}}{2 \sigma^ {2}}} - \frac {\pi}{\sigma} \mathbf {1} _ {\varepsilon > \frac {\Delta^ {2}}{2 \sigma^ {2}}}\right) \right] \\ - e ^ {\varepsilon} \mathbf {1} _ {\varepsilon \leq \frac {\Delta^ {2}}{2 \sigma^ {2}}} \\ \end{array}
$$
with  $C(\sigma) = \Phi (\pi /\sigma) - \Phi (-\pi /\sigma)$
In summary, Corollary 3.2.1 provides us the analytical form for the integrals in (2). By specifying the rate  $\sigma$  and sensitivity  $\Delta$ , it becomes feasible to compute the privacy budget  $\mu$ , which is the smallest  $\mu$  such that  $h(\sigma, \varepsilon, \Delta) \leq \delta_{\mu}(\varepsilon)$  for all  $\varepsilon \in [0, \pi \Delta / (2\sigma^2)]$ . The systematic procedure is summarized in Algorithm 1. It is important to emphasize that the result in Corollary 3.2.1 together with the existing Euclidean space result covers all one-dimensional cases, and for manifolds with dimension  $d > 1$ , we will tackle it in Section 4.
4 Numerical Approach
In Section 3, we demonstrate that our proposed Riemannian Gaussian distribution can be used to achieve GDP in Theorem 3.1 and 3.2. Furthermore, we document our method in Algorithm 1 to compute the privacy budget  $\mu$  in  $S^1$ . This and already existing Euclidean results encompass all the one-dimensional Riemannian manifolds. However, for general Riemannian manifolds of dimension
Algorithm 1 Computing  $\mu$  on  $S^1$
Input: Sensitivity  $\Delta \in (0,\pi ]$  , rate  $\sigma$  , number of  $\varepsilon$  used  $n_{\varepsilon}$
Output:  $\mu$
1: Set  $\varepsilon_{\mathrm{max}} = \pi \Delta /(2\sigma^2)$
2: for each  $\varepsilon$  in  $\{k, 2k, \dots, n_{\varepsilon} k\}$  where  $k = \varepsilon_{\max} / n_{\varepsilon} \mathbf{d}\mathbf{o}$
3: Compute  $l_{\varepsilon} = h(\sigma, \varepsilon, \Delta)$  as in Corollary 3.2.1 and  $\mu_{\varepsilon}$  through  $l_{\varepsilon} = \delta_{\mu}(\varepsilon)$ .
4: end for
5: Compute  $\mu = \max_{\varepsilon}\mu_{\varepsilon}$
6: Return:  $\mu$ .
$d > 1$ , the integrals in inequality (2) are difficult to compute (see Section 3 for more explanation). One of the central difficulties is the dependence of the normalizing constant  $Z(\eta, \sigma)$  on the footprint  $\eta$  makes the expression of  $A$  intractable. To avoid this dependence, we introduce the concept of homogeneous Riemannian manifolds.