SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\Phi_ {\mathrm {F o l d L} (\Delta_ {1}, b)} (x) = \left\{ \begin{array}{l l} \exp \left(- \Delta_ {1} / b\right) \sinh \left(\frac {x}{b}\right), & 0 \leq x <   \Delta_ {1} \\ 1 - \exp \left(- x / b\right) \cosh \left(\Delta_ {1} / b\right), & x \geq \Delta_ {1}, \end{array} \right.
$$
$$
\Phi_ {\mathrm {F o l d L} (\Delta_ {1}, b)} ^ {- 1} (x) = \left\{ \begin{array}{l l} b \log \left(x \exp \left(\Delta_ {1} / b\right) + \sqrt {x ^ {2} \exp \left(^ {2 \Delta_ {1} / b}\right) + 1}\right), & 0 \leq x \leq {} ^ {1} / 2 - {} ^ {1} / 2 \exp \left({-} ^ {2 \Delta_ {1} / b}\right) \\ b \log \left({\cosh (\Delta_ {1} / b)} / (1 - x)\right), & 1 > x \geq \left({^ {1} / 2 - {} ^ {1} / 2 \exp \left({-} ^ {2 \Delta_ {1} / b}\right)}\right). \end{array} \right.
$$
$j$  and  $j^{-1}$  then follow by substitution in the expressions for the trade-off functions from Definition 2 above:
$$
j (\alpha) = \Phi_ {\text {F o l d L} (\Delta_ {1}, b)} \left(\Psi_ {\text {E x p} (b)} ^ {- 1} (\alpha)\right) \text {a n d} j ^ {- 1} (\alpha) = \Psi_ {\text {E x p} (b)} \left(\Phi_ {\text {F o l d L} (\Delta_ {1}, b)} ^ {- 1} (\alpha)\right). \tag {30}
$$
$$
j _ {\mathrm {G M}} (\alpha) = \Phi_ {\chi_ {d} ^ {2} \left(\mu_ {2} ^ {2}, \sigma^ {2}\right)} \left(\Psi_ {\chi_ {d} ^ {2} (0, \sigma^ {2})} ^ {- 1} (\alpha)\right) a n d j _ {\mathrm {G M}} ^ {- 1} (\alpha) = \Psi_ {\chi_ {d} ^ {2} (0, \sigma^ {2})} \left(\Phi_ {\chi_ {d} ^ {2} \left(\mu_ {2} ^ {2}, \sigma^ {2}\right)} ^ {- 1} (\alpha)\right). \tag {4}
$$
Proof. The proof is similar to Theorem 1.  $j(\alpha)$  is the trade-off function corresponding to the test  $r: \mathcal{N}(0, \sigma^2)$ . vs.  $\mathcal{N}(\Delta_2, \sigma^2)$  and  $j^{-1}(\alpha)$  corresponds to the test  $r': \mathcal{N}(\Delta_2, \sigma^2)$  vs.  $r: \mathcal{N}(0, \sigma^2)$ . The Gaussian density is also symmetric, hence we can appeal to Lemma 4 and use the magnitude of  $\theta$  as the test statistic once more. In fact, we will use the squared magnitude for numerical reasons, which does not change the monotonicity behaviour of the test statistics.
For  $r$ , under  $\mathcal{H}_0$ , the test statistic  $\| \theta \| ^2$  follows a central chi-squared distribution with  $d$  degrees of freedom scaled by  $\sigma^2$ , i.e.  $\chi_d^2 (0,\sigma^2)$ . Under  $\mathcal{H}_1$ , the test statistic  $\| \theta \| ^2$  follows a noncentral chi-squared distribution with  $d$  degrees of freedom and noncentrality parameter  $\mu_2^2 = \Delta_2^2 /\sigma^2$ , i.e.  $\chi_d^2 (\mu_2^2,\sigma^2)$ . For  $r^\prime$ , the hypotheses and distributions are reversed. To construct the trade-off functions, we require the CDF  $\Phi$ , and iCDF  $\Phi^{-1}$ . From these, we can construct  $\Psi (x) = 1 - \Phi (x)$  and  $\Psi^{-1}(x) = \Phi^{-1}(1 - x)$  as above. For the central chi-squared distribution,  $\Phi$  has an analytic form, but  $\Phi^{-1}$  does not. For the non-central chi-squared distribution,  $\Phi$  is expressed in terms of the Marcum Q-function [36], while  $\Phi^{-1}$  once again has no analytic form. However, high-precision numerical implementations of all the aforementioned functions are widely available. We thus express  $j$  and  $j^{-1}$  in terms of these abstract functions and implement them numerically throughout. The concrete expressions follow directly from Definition 4. Moreover, for  $d = 1$ , a closed form is available for  $j$ , which is shown in the upcoming Corollary.
$$
j _ {\mathrm {G M}} (\alpha \mid d = 1) = \Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) - \mu_ {2}\right) - \Psi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) + \mu_ {2}\right). \qquad (5)
$$
Proof. For this proof, it helps to picture Definition 2 with the role of the test statistic played once again by  $\| \theta \| ^2$ . Thus,  $\alpha = \operatorname*{Pr}(\| \theta \|^{2} > c^{2}\mid \mathcal{H}_{0})$  and  $\beta = \operatorname*{Pr}(\| \theta \| ^2 < c^2\mid \mathcal{H}_1)$ . We can take the square of the critical value since the magnitude is always non-negative and we may choose the critical value arbitrarily; it will also simplify the computations below. Recall that  $d = 1$  because  $\theta$  is now a scalar.
From the proof to Theorem 2, we have:  $\alpha(c^2) = \Psi_{\chi_1^2(0,\sigma^2)}(c^2)$  and  $\beta(c^2) = \Phi_{\chi_1^2(\mu_2^2,\sigma^2)}(c^2)$ .  $\Psi_{\chi_1^2(0,\sigma^2)}$  admits an analytical form:
$$
\begin{array}{l} \Psi_ {\chi_ {1} ^ {2} \left(0, \sigma^ {2}\right)} \left(c ^ {2}\right) = 1 - \frac {\gamma \left(\frac {1}{2} , \frac {c ^ {2}}{2 \sigma^ {2}}\right)}{\Gamma \left(\frac {1}{2}\right)} = 1 - \frac {\sqrt {\pi} \operatorname {e r f} \left(\sqrt {\frac {c ^ {2}}{2 \sigma^ {2}}}\right)}{\sqrt {\pi}} = (31) \\ = \operatorname {e r f c} \left(\frac {c}{\sqrt {2} \sigma}\right), (32) \\ \end{array}
$$
where  $\gamma$  is the lower incomplete gamma function,  $\Gamma$  the gamma function and erf, erfc are the error function and complementary error function of the Gaussian distribution, respectively. We can now exploit the following pattern:
$$
\Psi_ {\mathcal {N} (0, 1)} (k) = \frac {1}{2} \operatorname {e r f c} \left(\frac {k}{\sqrt {2}}\right), \tag {33}
$$
so the term in Equation (31) can be written as  $2\Psi_{\mathcal{N}(0,1)}\left(\frac{c}{\sigma}\right)$ . Since  $\Psi_{\mathcal{N}(0,1)}$  is invertible, we have that  $c = \sigma \Psi_{\mathcal{N}(0,1)}^{-1}\left(\frac{\alpha}{2}\right)$ .
Similarly,  $\Phi_{\chi_1^2 (\mu_2^2,\sigma^2)}(c^2)$  admits a closed-form representation. Recall that  $\mu_2^2 = \Delta_2^2 /\sigma^2$
$$
\begin{array}{l} 1 - \mathrm {Q} _ {M \frac {1}{2}} \left(\sqrt {\frac {\Delta_ {2} ^ {2}}{\sigma^ {2}}}, \sqrt {\frac {c ^ {2}}{\sigma^ {2}}}\right) = (34) \\ = 1 - \mathrm {Q} _ {M \frac {1}{2}} \left(\frac {\Delta_ {2}}{\sigma}, \frac {c}{\sigma}\right), (35) \\ \end{array}
$$
where  $\mathrm{Q}_{M\frac{1}{2}}$  is the Marcum Q-function of order  $\frac{1}{2}$  [36].
Substituting the expression for  $c$  from above, we obtain:
$$
\begin{array}{l} 1 - \mathrm {Q} _ {M \frac {1}{2}} \left(\frac {\Delta_ {2}}{\sigma}, \frac {\sigma \Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} \left(\frac {\alpha}{2}\right)}{\sigma}\right) = (36) \\ = 1 - \mathrm {Q} _ {M \frac {1}{2}} \left(\frac {\Delta_ {2}}{\sigma}, \Psi_ {\mathcal {N} (0, 1)} ^ {- 1} \left(\frac {\alpha}{2}\right)\right). (37) \\ \end{array}
$$
The Marcum Q-function of order  $\frac{1}{2}$  also admits a closed form:
$$
\mathrm {Q} _ {M \frac {1}{2}} (a, b) = \frac {1}{2} \left(\operatorname {e r f c} \left(\frac {b - a}{\sqrt {2}}\right) + \operatorname {e r f c} \left(\frac {b + a}{\sqrt {2}}\right)\right). \tag {38}
$$
Using the pattern  $\frac{1}{2}\operatorname{erfc}\left(\frac{k}{\sqrt{2}}\right) = \Psi_{\mathcal{N}(0,1)}(k)$  as above, we rewrite Equation (38) as:
$$
\mathrm {Q} _ {M \frac {1}{2}} (a, b) = \Psi_ {\mathcal {N} (0, 1)} (b - a) + \Psi_ {\mathcal {N} (0, 1)} (a + b). \tag {39}
$$
Finally, we substitute the arguments from Equation 37 and obtain:
$$
\begin{array}{l} 1 - \left(\Psi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) - \frac {\Delta_ {2}}{\sigma}\right) + \Psi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) + \frac {\Delta_ {2}}{\sigma}\right)\right) = (40) \\ = \Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) - \mu_ {2}\right) - \Psi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha / 2) + \mu_ {2}\right), (41) \\ \end{array}
$$
which is the desired form and completes the proof.
Proof. Let  $\pmb{\theta}_a, \pmb{\theta}_b \in \mathbb{R}^d$  be uncorrelated mechanism outputs on two independent queries. Since  $\mathcal{A}^{\mathrm{SO}}$  passively observes both outputs before testing, the test statistic becomes:
$$
\Lambda (\boldsymbol {\theta}) _ {c} = \left\| \boldsymbol {\theta} _ {c} \right\| _ {2} ^ {2} = \left\| \frac {1}{2} \left(\boldsymbol {\theta} _ {a} + \boldsymbol {\theta} _ {b}\right) \right\| _ {2} ^ {2} \leqslant c ^ {2}. \tag {42}
$$
Of note, the reason why the mean of the observations is the correct choice here follows from Lemma 5, as the MLE of the mean of a normal distribution for  $>1$  observation is the sample average. By the additive properties of isotropic Gaussian noise, the distributions of the observations thus are:
$$
\mathcal {H} _ {0}: \boldsymbol {\theta} _ {c} \sim \mathcal {N} \left(\mathbf {0}, \frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4} \mathbf {I} ^ {d}\right) \quad \text {v s}. \tag {43}
$$
$$
\mathcal {H} _ {1}: \boldsymbol {\theta} _ {c} \sim \mathcal {N} \left(\frac {\Delta_ {2 a} + \Delta_ {2 b}}{2}, \frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4} \mathbf {I} ^ {d}\right). \tag {44}
$$
Under  $\mathcal{H}_0$ , the test statistic is thus distributed as:
$$
\chi_ {d} ^ {2} \left(0, \frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4}\right) \tag {45}
$$
while under  $\mathcal{H}_1$  it is distributed as:
$$
\chi_ {d} ^ {2} \left(\frac {\left(\frac {\Delta_ {2 a} + \Delta_ {2 b}}{2}\right) ^ {2}}{\frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4}}, \frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4}\right) = \chi_ {d} ^ {2} \left(\frac {\left(\Delta_ {2 a} + \Delta_ {2 b}\right) ^ {2}}{\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}, \frac {\sigma_ {a} ^ {2} + \sigma_ {b} ^ {2}}{4}\right). \tag {46}
$$
From here, the proof continues identically to the proof to Theorem 2 above, from which the claim follows. The generalisation to  $>2$  compositions follows inductively. In particular, for  $N$  homogeneous compositions (i.e. with identical sensitivity  $\Delta_2$  and noise variance  $\sigma^2$ ), the test statistic under  $\mathcal{H}_0$  is distributed as:
$$
\chi_ {d} ^ {2} \left(0, \frac {\sigma^ {2}}{N}\right) \tag {47}
$$
$$
\chi_ {d} ^ {2} \left(\frac {N \Delta_ {2} ^ {2}}{\sigma^ {2}}, \frac {\sigma^ {2}}{N}\right), \tag {48}
$$
which follows directly from the above. We will use this property in the following proof.
Theorem 3 (Blessing of dimensionality in the RTM). Consider a GM on a function with sensitivity  $\Delta_{2}$  and noise variance  $\sigma^2\mathbf{I}^d$  such that  $\Delta_2 / \sigma \ll 1$ . Let  $\mu_{2} = \Delta_{2} / \sigma$ . As  $d$  and/or as the number of non-adaptive compositions  $N$  increase,  $j_{\mathrm{GM}}$  and  $j_{\mathrm{GM}}^{-1}$  tend to the common form:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\frac {\Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} (\alpha)}{\sqrt {\frac {2 N \mu_ {2} ^ {2}}{d} + 1}} - \frac {\sqrt {2} N \mu_ {2} ^ {2}}{2 d \sqrt {\frac {2 N \mu_ {2} ^ {2}}{d} + 1}}\right) \approx \Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - N \sqrt {\frac {\mu_ {2}}{2 d}}\right). \qquad (7)
$$
Proof. To prove the claim, we will appeal to the central limit theorem (CLT). We will use the facts that the mean of the central chi-squared distribution with  $d$  degrees of freedom is  $d$  and its variance is  $2d$ . The noncentral chi-squared distribution with  $d$  degrees of freedom and noncentrality  $\kappa$  has mean  $d + \kappa$  and variance  $2d + 4\kappa$ . Under the CLT, as  $N \to \infty$  and/or as  $d \to \infty$ , we thus have convergence in distribution as follows. Letting  $\frac{\sigma^2}{N} = \delta$  (compare Equations (47) and (48)):
$$
\chi_ {d} ^ {2} (0, \delta) \rightarrow \mathcal {N} (\delta d, 2 \delta^ {2} d) \text {a n d} \tag {49}
$$
$$
\chi_ {d} ^ {2} (\kappa , \delta) \rightarrow \mathcal {N} \left(\delta (d + \kappa), \delta^ {2} (2 d + 4 \kappa)\right). \tag {50}
$$
We now proceed as in the proofs above and consider the test statistic under the null and alternative hypotheses and a critical value  $c$ . We have:
$$
\alpha (c) = \Psi_ {\mathcal {N} (0, 1)} \left(\frac {c - \delta d}{\delta \sqrt {2 d}}\right) \Rightarrow c = \Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) \delta \sqrt {2 d} + \delta d \tag {51}
$$
$$
\beta (c) = \Phi_ {\mathcal {N} (0, 1)} \left(\frac {c - \delta (d + \kappa)}{\delta \sqrt {2 d + 4 \kappa}}\right). \tag {52}
$$
For the trade-off function, we substitute to obtain:
$$
\begin{array}{l} \Phi_ {\mathcal {N} (0, 1)} \left(\frac {\Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} (\alpha) \delta \sqrt {2 d} + \delta d - \delta d - \delta \kappa}{\delta \sqrt {2 d + 4 \kappa}}\right) = (53) \\ = \Phi_ {\mathcal {N} (0, 1)} \left(\frac {\Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} (\alpha) \sqrt {2 d} - \kappa}{\delta \sqrt {2 d + 4 \kappa}}\right) = (54) \\ = \Phi_ {\mathcal {N} (0, 1)} \left(\frac {\Psi_ {\mathcal {N} (0 , 1)} ^ {- 1} (\alpha) - \sqrt {\frac {d}{2}} \frac {\kappa}{d}}{\sqrt {1 + \frac {2 \kappa}{d}}}\right). (55) \\ \end{array}
$$
Substituting  $\kappa \gets N\Delta_2^2 /\sigma^2$  (i.e. the degrees of freedom, compare Equation (48)) and separating the terms, we obtain:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\frac {1}{\sqrt {\frac {2 \Delta_ {2} ^ {2} N}{d \sigma^ {2}} + 1}} \Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - \frac {\sqrt {2} \Delta_ {2} ^ {2} N}{2 d \sigma^ {2} \sqrt {\frac {2 \Delta_ {2} ^ {2} N}{d \sigma^ {2}} + 1}}\right). \tag {56}
$$
Letting  $\mu_{2} = \Delta_{2} / \sigma$ , we obtain the form of the LHS of Equation (7).
To obtain the RHS of Equation (7), we further massage Equation (55). Concretely, we let  $\kappa /d\coloneqq \zeta$  and Taylor expand the equation around  $\zeta = 0$  to obtain:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - \zeta \left(\sqrt {\frac {d}{2}} + \Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha)\right) + \mathcal {O} \left(\zeta^ {2}\right)\right). \tag {57}
$$
When  $d$  is large,  $\mathcal{O}(\zeta^2)$  vanishes and  $\sqrt{\frac{d}{2}}$  dominates the term in the parentheses, yielding:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - \zeta \sqrt {\frac {d}{2}}\right). \tag {58}
$$
Finally, recursively substituting  $\zeta \gets {}^{\kappa} / d$  and  $\kappa \gets N\Delta_2^2 /\sigma^2$ , we get:
$$
\Phi_ {\mathcal {N} (0, 1)} \left(\Psi_ {\mathcal {N} (0, 1)} ^ {- 1} (\alpha) - \frac {N \Delta_ {2} ^ {2}}{\sigma^ {2}} \sqrt {\frac {1}{2 d}}\right). \tag {59}
$$
Letting  $\Delta_2^2 /\sigma^2 = \mu_2^2$ , we obtain the RHS of Equation (7). The fact that the two trade-off functions become symmetrical follows this equation's functional form, which corresponds to the trade-off function between two Gaussians with the same variance, i.e.  $f_{\mathrm{GM}}$ .
Proof. Of note, this fact was first observed in [7] and also proved in [22]. We provide a more concise proof here for the purpose of self-containedness. Let  $\Phi$ ,  $\Psi$  and their inverses be defined for  $A$  and  $B$  as above. By Definition 2, we have:
$$
T (A, B) (\alpha) = \Phi_ {B} \left(\Psi_ {A} ^ {- 1} (\alpha)\right), \tag {60}
$$
where  $T$  is a generic trade-off function, in our case  $j$  or  $j^{-1}$ . We want to show that for a mixture of distributions  $A$  and  $B$ , with mixture coefficient  $p \in (0, 1)$ :
$$
T (A, (1 - p) A + p B) (\alpha) = p T (A, B) (\alpha) + (1 - p) (1 - \alpha). \tag {61}
$$
Define the CDF of the mixture distribution  $C$  as  $\Phi_C = (1 - p)\Phi_A + p\Phi_B$ . Now, we have:
$$
\begin{array}{l} T (A, C) (\alpha) = \Phi_ {C} \left(\Psi_ {A} ^ {- 1} (\alpha)\right) = \\ = (1 - p) \Phi_ {A} \left(\Psi_ {A} ^ {- 1} (\alpha)\right) + p \Phi_ {B} \left(\Psi_ {A} ^ {- 1} (\alpha)\right) = \\ = (1 - p) \Phi_ {A} \left(\Phi_ {A} ^ {- 1} (1 - \alpha)\right) + p \Phi_ {B} \left(\Psi_ {A} ^ {- 1} (\alpha)\right) = \\ = (1 - p) (1 - \alpha) + p T (A, B). \\ \end{array}
$$
The inverse  $T^{-1}$  is not always easy to construct and, in practice, is usually computed numerically. We have thus shown that we can construct the trade-off functions of a sub-sampled mechanism directly from the trade-off functions of the original mechanism, even if none of them has an analytical form.
7.3 Experimental details
Deep learning with DP-SGD CIFAR-10 was trained from scratch using the ResNet-9 architecture from [37] and a subset of the techniques presented in [38] (2 augmentations per draw but no expo
nential moving average on the weights) to  $(1, 10^{-5})$ -DP. We used a sampling rate of  $4096 / 50000$ , a noise scale of 10.5 and trained for 1000 steps in total. For SNLI, we fine-tuned the final 3 layers of a  $105\mathrm{M}$ -parameter pre-trained BERT Transformer [39] to  $(1, 1.8 \cdot 10^{-6})$ -DP using a sampling rate of  $4096 / 549361$ , a noise scale of 1.15 and 405 steps. For ImageNet, we fine-tuned the final 12 layers of a ResNet-18 architecture pre-trained on Places365 following the exact hyperparameters from [40] to  $(10, 10^{-6})$ -DP. For DP accounting, we used the Renyi-DP accountant from the Google Differential Privacy library, whereas for accounting for privacy loss in the RTM, we computed the product distributions of the test statistics as described in [7], Definition 3.1. ff. using direct numerical integration to 50 digits of precision using the mpmath library. To determine the noise scale for training the models under the RTM, we adapted the technique described in [41]. In brief, we determined the upper and lower noise scale values for which the RTM trade-off functions ( $\lambda$ -functions) optimally "sandwich" the  $f$ -DP trade-off function and then chose the more pessimistic of the two noise scales to train the model, keeping all other hyperparameters constant. As a point of comparison, if (hypothetically) one would convert the RTM noise scales to the DPTM in terms of  $\varepsilon$ , this would result in  $\varepsilon$ -values of  $\approx 6, 2.5$  and 19 at the same  $\delta$  for CIFAR-10, SNLI and ImageNet, respectively. We remark that this conversion does not imply that these models satisfy DP for these  $\varepsilon$ -values, just that a hypothetical  $(\varepsilon, \delta)$ -analogue of  $\lambda$ -DR would achieve these  $\varepsilon$ -values. The true worst-case  $(\varepsilon, \delta)$ -DP guarantees remain the same in both cases. The experiments were performed on a GPU cluster using NVidia RTX A6000 GPUs and required a total of 212 GPU hours. At the carbon efficiency assumed above, the computation of these experiments caused approximately  $27.5\mathrm{kg}$  of  $\mathrm{CO}_{2}$  equivalent emissions. All emission computations were computed as described in [42].
7.4 Ethics statement
Our study focuses on the relaxation of the differential privacy (DP) threat model and provides formal bounds on membership hypothesis testing error rates. We acknowledge that our work has positive and potential negative ethical implications, and we strive to address these concerns as thoroughly as possible.
Positive implications of our study include the following:
1. Improved privacy guarantees and higher utility in machine learning models, which may encourage privacy sceptics to adopt DP.
2. Acknowledging that the standard DP threat model may not always be applicable in practice and providing a more realistic alternative.
3. Enhancing our understanding of privacy dynamics in systems by introducing relaxations incrementally, which can demonstrate how privacy guarantees improve as the adversary's power decreases.
4. Providing formal bounds, which offer a more rigorous understanding of the sub-optimal adversary's membership inference capabilities in the relaxed threat model.
Despite these positive implications, we recognise potential drawbacks and have identified mitigations for each:
1. Our guarantees may not hold if the assumptions of the relaxed threat model are violated. To mitigate this, the relaxed threat model guarantee should only be reported alongside the full DP guarantee, which holds in the worst case.
2. If stakeholders or users misunderstand the circumstances under which the relaxed threat model's guarantees break down, they may come away with a false sense of security. To address this, we ensure a comprehensive understanding of the threat model through formal characterisation and clear communication of the exact guarantees provided by the mechanism in the relaxed threat model, and the situations in which they don't hold, e.g. post-processing.