Exponential-Wrapped Mechanisms: Differential Privacy on Hadamard Manifolds Made Practical
Authors: Yangdi Jiang
Xiaotian Chang
Lei Ding
Linglong Kong
Bei Jiang
Venue: ICLR 2026 Poster (2026)
Keywords: Differential Privacy
Riemannian Manifold
Hadamard manifolds
Fréchet mean
SPDM space
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: e propose fast, general mechanisms for differential privacy on Hadamard manifolds using exponential wrapping, achieving DP, ADP, GDP, and RDP without MCMC.

Abstract: We propose a general and computationally efficient framework for achieving differential privacy (DP) on Hadamard manifolds, which are complete and simply connected Riemannian manifolds with non-positive curvature. Leveraging the Cartan-Hadamard theorem, we introduce Exponential-Wrapped Laplace and Gaussian mechanisms that achieve $\epsilon$-DP, $(\epsilon, \delta)$-DP, Gaussian DP (GDP), and Rényi DP (RDP) without relying on computationally intensive MCMC sampling. Our methods operate entirely within the intrinsic geometry of the manifold, ensuring both theoretical soundness and practical scalability. We derive utility bounds for privatized Fréchet means and demonstrate superior utility and runtime performances on both synthetic data and real-world data in the space of symmetric positive definite matrices (SPDM) equipped with three different metrics. To our knowledge, this work constitutes the first unified extension of multiple DP notions to general Hadamard manifolds with practical and scalable implementations.

Published as a conference paper at ICLR 2026
INTONENTIAL-RRAPHEE MECHANISMS: DIFFEREN- TIAL PRIVACY ON HADAMARD MANIFOLDS MADE PRACTICAL
Yangdi Jiang', Xiaotian Chang', Lei Ding", Linglong Kong', Bei Jiang'
I NTU Singapore, {yangdi. .iiiiigingg.. xiaoti a changg futu. edu.
2 University of Manitoba, 1ei. wwwggemmnittoaaacmmmmmmmmm
3 University of Alberta, {1kong, beiljoualberta.ca
ABSTRACT
We propose general and computationally efficient framework for achieving dif- ferential privacy (DP) on Hadamard manifolds, which are complete and simply connected Riemannian manifolds with non-positive curvature. Leveraging the Bartan-Hadamard theorem, we introduce Exponential- Wrapped Laplace and Gaus- sian mechanisms that achieve e-DP, (e, 5DDP, Gaussian DP (GDP), and Rényi DP (RDP) without relying on computationally intensive MCMC sampling. Our meth- ods operate entirely within the intrinsic geometry of the manifold, ensuring both theoretical soundness and practical scalability. We derive utility bounds for priva- tized Fréchet means and demonstrate superior utility and runtime performances on both synthetic data and real-world data in the space of symmetric positive definite matrices (SPDM) and hyperbolic space. To our knowledge, this work constitutes the first unified extension of multiple DP notions to general Hadamard manifolds with practical and scalable implementations.
INTRODUCTION
Recent advances in AI and machine learning have spurred interest in analyzing complex data types, particularly those residing nonlinear manifolds. Among these, Hadamard manifolds, such as hyperbolic space and the space of symmetrie positive definite matrices (SPDM), play pivotal roles. Hyperbolic spaces provide efficient representations for hierarchical structures via hyperbolic embeddings (Nickel and Kiela 2017 Cetin et al.) 2023), enhancing both performance and interpretability in odels for tree-structured data (Sarkar 2011 Chamberlain et al. 2017 Ganea et al. 2018, [eng et al.) 2021). SPDM spaces are critical in medical imaging, especially for modelling water diffusion in diffusion tensor imaging (Basser et al. 1994 Le Bihan et al., (001). and have
found utility in shape analysis and computer vision tasks such as segmentation and motion tracking (Fillard et al. 20055 2007 Medioni et al. 2000) Brox al. 2006 Weickert and Brox 2002 Weickert and Hagen| 2005). The rising importance of manifold-structum
data, particularly in the biomedical domains, naturally raises privacy concerns, necessitating tailored privacy mechanisms that respect the underlying geometry.
Differential privacy (DP) (Dwork et al. 2006b) offers a rigorous mathematical framework for quantifying and preserving privacy. While many mechanisms have been developed for Euclidean data (McSherry and Talwar 2007 Barak al. 2007] Wasserman and Zhou 2010; Reimherr and data due to geometric incompatibility. These traditional methods typically operate extrinsically by embedding manifold data into Fuclidean space, which can distort geometric structure and result in substantial utility loss. As demonstrated in Reimherr et al. (2021), respecting the intrinsic geometry of the data leads to mechanisms that provide significantly better trade-offs between privacy and utility. This observation highlights the need for methods that are not only theoretically sound but also tailored to the geometric nature of nonlinear data through tools from Riemannian geometry.
Awan 2019), they often perform poorly on manifold-valie
The differential privacy framework was first extended to general Riemannian manifolds by Reimherr al. (2021), who introduced the Riemannian Laplace mechanism to achieve eDP.. Since then,

---

Published as a conference paper at ICLR 2026
various mechanisms have been proposed to ensure c-DP manifolds (Soto et al. 2022 He et al. 2025), with applications in mobile crowd sensing (Li et al. 2024) and federated learning (Huang et al. 2024). Han et al. (2024) further developed a differentially private Riemannian optimization framework by perturbing the Riemannian gradient in the tangent space. However, extensions of other privacy notions such as (e, 8)DD and Gaussian DP (GDP) remain limited. For example, Utpala ct al. (2023b) extended (s, 6DDP only to a single manifold, the SPDM space equipped with the Log-Euclidean metric, which renders the space flat (Arsigny al. 2007) and enables closed-form computations. However, this choice limits generality, as the framework does not extend to other manifolds, nor to the SPDM space under either the more geometrically faithful affine-invariant metric or the computationally faster and numerically more stable Jog-Cholesky metric. Similarly, [Jang et al. )023)) extended GDP to general manifolds, but their calibration algorithm restricted to constant-curvature spaces and entails high computational cost. Notably, the sampling procedures required by both the Riemannian Laplace and Gaussian mechanisms (Reimherr et al., 2021 Jiang ct al. 2023) depend on Markov Chain Monte Carlo (MCMC), which becomes computationally expensive in high-dimensional or geometrically complex spaces such as SPDM. These challenges underscore the need for broader extensions of differential privacy frameworks to general manifolds and the development of more computationally efficient mechanisms suited for practical applications.
We summarize our key contributions below:
Unified Extension of DP Notions: We introduce the first mechanisms extend (e, 6)-DP, Gaussian DP (GDP), and Rényi DP (RDP) to general Hadamard manifolds. Notably, this includes the first RDP mechanism applicable beyond Euclidean spaces.
Efficient and Scalable Implementation: Our proposed avoid computationally intensive MCMC procedures and instead rely on simple sampling from tangent space distributions followed by the exponential map, enabling efficient and scalable deployment.
Sroonential-raapeed mechanisms
Strong Empirical Performance: Through comprehensive simulations on SPDM manifolds under multiple metrics, as well as on hyperbolic space, together with real-data experiments on SPDM manifolds, we demonstrate that the proposed mechanisms consistently surpass traditional Riemannian approaches in utility while markedly reducing computational run- time. Notably, the Exponential- Wrapped Gaussian mechanism achieves substantial utility improvements in high-dimensional regimes with stringent privacy budgets.
This paper is organized as follows. Appendix B reviews key concepts from Riemannian geome-
try (Lee 2006 Petersen 2006 Pennec al. 2019: Said [022 Grigoryan 2009) and differential
privacy (Dwork and Roth 2014 Mironov] [017]] Dong et al. 2021 2022). Section 2 introduces
the apponential-Wrappar distribution and its calibration for achieving (c, 6)-DP, GDP, and RDP. Section [. addresses the release of differentially private Fréchet means and establishes theoretical utility guarantees for our mechanisms. Section 4 presents numerical simulations and real-world experiments, with additional details provided in Appendix 4.2) All proofs are given in Appendix A
DIFFERENTIAL PRIVACY ON HADAMARD RIEMANNIAN MANIFOLDS
2.1 EXPONENTIAL- SOANENNTIAL-RAPPEDD DISTRIBUTION
In measure- -hroorettteeetccc terms, the Exponential- -rronentil--raapped Probability is the push-forward of the tangent space probability via the exponential map. For manifold M with dimension d > wrapping a density around the manifold involves volume distortion. This occurs because the exponential map typically does not preserve the area between the Lebesgue measure on the tangent space and the reference measure on the manifold.
Let M be a manifold with the Riemannian volume measure v. Given μ., a probability distribution on T.M with probability density ht w.r.t the Lebesgue measure Ap on T,M, the corresponding Exponential- -rooential--rapped distribution is defined as the forward of μa by the exponential, A = Expp. μe, where the refers to the push- furw-f by Exp,. such that A(A) = μ (A)) for any A in the Borel o-algebra of M. Since we assume M is a Hadamard manifold, Log, is defined everywhere on M for any p M. If follows that the density g of A can be expressed from h and
2

---

Published as a conference paper at ICLR 2026
volume change term, dA ((1) dv (g) d Exp (Xp) du d Expps (2p)
dA
(1) Expps (Ap) (T)h(Togg)) (p(Log((4))
h h[Log 9)
dv
where (n(u) = (xpp,)) with DxExp, TyM + Tw M denote the differential of Exp, at u M.
The most attractive property of the Exponential Sypooential-Wrappeed Distribution is its straightforward sampling procedure. In order to sample from g. suffices to sample from h; if U1...... Un, are i.id. random Expp(U1) .... Xn.
variables on tangent space TpM following the density h, then X1 Exp, (Un) are i.i.d. random variables on M following the density g. For more detailed discussion on Exponential- Wrappeed Distribution, please refer to Chevallier et al. (0022).
2.2 EXPONENTIAL- BEEIIAAL--WAA WRAPPED LAPLACE MECHANISM
Definition 2.1 (Expoential-Wrappee Laplace Distribution). Let M be a Hadamard Riemannian manifold with measure v, we define a probability density function w.r. 1/ as
[o y Loggo 7l
g(v) J (Togpo v)
exp
We called this distribution an Exponential-Wrappel Laplace Distribution with footpoint po, center n and rate O. We denote it as F.W.(po, T)
The Bryooential-Wrapeee Laplace Distribution is the push-forward probability of the tangent space probability defined by the probability density h(u)) x exp( Logp, nl1/o). We present the following theorem to demonstrate how it can be used to achieve e-DP.
Denote D [X1, , X as the confidential dataset and D' X2..,,...., Xn.) its neigh- bouring dataset, where without loss of generality we assume they differ in the first record.
Theorem 2.1 (Exponential- Soaneentta--Wappeedd Wrapped Laplace Mechanism). Let M be Hadamard Riemannian manifold and f be .M-valued summary with sensitivity A The Exponential- -rrippddd Laplace mechanism, which output Y EWL(po, (D), A/E), satisfies s-DP.
Compared to the Riemannian Laplace mechanism proposed by Reimherr et al. (2021) J. the Exponential- Wrapped Laplace mechanism defined above offers two primary advantages. First, method only requires a rate of A A/e to achieve cDD across all Hadamard manifolds, homogeneous or not. This more efficient than the Riemannian Laplace mechanism, which necessitates a rate of 2A/e for non-homogeneous manifolds. Second, our approach is easier to implement and less computationally complex. The Riemannian Laplace mechanism relies on MCMC sampling, which is computationally intensive due to prolonged burn-in iterations and frequent recalculations of Riemannian distances. These computations escalate in cost with increasing manifold dimensionality. Even in SPDM space with the Rao-Fisher affine invariant metric, where efficient sampling techniques for the Riemannian Laplace Distribution exist (Hajri et al. 20166> - MCMC procedures remain necessary, and the choice of proposal distribution critically affects convergence. In contrast, sampling from the Exponential-Wrape h(u) & expf-llu- Log,.. nll/a} and 2) computing Expp, For more details the sampling procedure, see Appendix C.I
Laplace Distribution is straightforward: it involves 1) sampling from
Remark 1. Note that there is no restriction the choice of footpoint po in the Exponential- Exponential-rrapeel Wrapped Laplace mechanism. However, its selection can have an impact on the performance of the mechanism. F Furthermore, to be compliant with the differential privacy definition, the selection of the footpoint Po cannot be based on the private dataset D. For more discussion on the selection of footpoint, see Section 3.2
2.3 EXPONENTIAL- WREIIAAL--RRPPEIEEE GAUSSIAN MECHANISM
Beyond the Laplace mechanism, the Gaussian mechanism stands as one of the most prevalent tools in DP (work and Roth 2014 Balle and Wang 2018a). This section introduces the Exponential-
A summary f is said to have sensitivity of A < with respect to d(;, :), if we have d (f(D), (D)) (D')) s
A for any datasets D D'.
3

---

Published as a conference paper at ICLR 2026
Wrapped Gaussian mechanism, calibrated to achieve 8)-D), RDP, and GDP. Initially, will define the Exponential- -rrapped Gaussian Distribution as follows.
Definition 2.2 (Exponential-Wo Wrapped Gaussian Distribution). Let M be Hadamard Riemannian manifold with reference measure denoted by v, we define probability density function W.E. V/ as
Log V --oogpo nll?
g
exp
J (Log y)
20²
We called this distribution an Exponential- Wrapped Gaussian Distribution with footpoint po, center ?) and rate a > We denote it as F.W.(po, 7);
The Exponential- Wrapped Gaussian Distribution is defined the push-forward of the multivariate Gaussian distribution, characterized by a mean of Logp. and a covariance of o²I, on the tangent space M. We present the following theorem to demonstrate how it can used to achieve (c, ().D) Theorem 2.2. Let M be Hadamard Riemannian manifold and be an M-valued summary. Gaussian mechanism, which output Y ~ EWG(Go, f( o), satisfies (D if and only if the a satisfies following condition.
The Exponential-Wrappe
OE
Ap
(- -_EE_
A
4
e
S
(I)
Po
20
Apo
20
where Po D' Logoo (f(D)) - Log (f(D'))II
Theorem 2.2 shares similarities with the analytic Gaussian mechanism Balle and Wang (2018a).
Primary distinction lies in the use of Ap, rather than the standard sensitivity A in incquality (I. This substitution generally does not pose significant challenges; if Ap, proves difficult to compute, can be used instead in (1 as A 2 pu since Logpo is contraction for Hadamard manifolds.
Implementing the Exponential- -rapped Gaussian mechanism for (e, 8DP is straightforward. We follow a similar procedure as in Algorithm[ After determining the appropriate a numerically from inequality ([)-using method such that proposed in [Balee and Wang (2018a) one one can proceed by first sampling u from the tangent Gaussian distribution Niang (0, T The privatized summary is then computed Exppo (u Logpo (f(D))) For more details the sampling procedure, see Appendix C.22
Suppose M is the space of SPDM equipped with Log-Euclidean metric, the Exponential- -Wrapied Gaussian mechanism with footpoint po = reduces to the tangent Gaussian mechanism in Utpala al. (2023b). Hence, the Exponential-Wrappee tangent Gaussian mechanism, as our mechanism can be employed for any Hadamard manifold equipped with any Riemannian metric. This makes our aesoonnniil--rappeee Gaussian mechanism the first working mechanism to achieve (c, 5)-DP in SPDM under the non-Log- Euclidean metric.
Gaussian mechanism is generalization of the
Similar to how the Euclidean Gaussian Distribution can be used achieve GDP, we can calibrate the Exponential- Wrapped Gaussian Distribution to achieve GDP in the following manner.
Theorem 2.3 (Wrapped Gaussian Mechanism for GDP). Let M be a Hadamard Riemannian manifold and f be an M-valued summary with global sensitivity A. The Boaonential-Wrapper Gaussian mechanism, which outputs Y EWG(po. f(D). A/p), satisfies p-GDP.
Previously, Jiang al. 2023) introduced the Riemannian Gaussian mechanism achieve μ-GDP. However, our approach presents significant advantages in both calibration and sampling. Firstly, the Riemannian Gaussian mechanism requires the resolution of infinitely many integral inequalities to calibrate the rate for a given privacy budget μ.. The calibration algorithm provided by JTang et al. (2023) is only applicable to constant curvature spaces and computationally intensive, involving grid searches and MCMC techniques compute the integrals. In contrast, our method simplifies calibration to a straightforward calculation: = A/p. p. Secondly, like the Riemannian Laplace distri- bution, sampling from the Riemannian Gaussian distribution involves complex processes (detailed in section 2.2). Our sampling technique is considerably simpler, requiring only the sampling from a multivariate Gaussian distribution followed by computations using Exp,o and Log,, The complete algorithm is detailed in Algorithm
In similar fashion, we use the Saaponential-Wrappee Gaussian Distribution to achieve RDP.
4

---

Published as a conference paper at ICLR 2026
Algorithm Aypponeniial-rappeee Gaussian Mechanism for μ-GDP
Input: sensitivity A, privacy budget μa, query result f(D), footpoint po-
Output: privatized query result f f(D)
1: Sample ~ ~Nang (0, Iz)-
2: Compute Logpo (D) + ov with A/P and f(D) Exppo u.
3: Return: f(D).
Theorem 2.4 (Wrapped Gaussian Mechanism for Rényi DP). Ler M be a Hadamard Riemannian manifold and f be an M-valued summary with global sensirivity A. The Exponential- -ariadd Gaussian mechanism, which outputs Y ~ EWG(po. ((D), A/ 22/ aa), satisfies (a,, -DDP.
3 DIFFERENTIALLY PRIVATE FRÉCHET MEAN AND UTILITY GUARANTEE
3.1 DIFFERENTIALLY PRIVATE FRÉCHET MEAN
For comprehensive overview of the Fréchet mean in the context of DP, please refer to Reimherr et al. 22021). Consider set of data Ti..... In on the manifold M. The Euclidean sample mean can be generalized Riemannian manifolds as the sample Fréchet mean, defined as the minimizer of arg min Σi= d (ar, 2²,)² The properties
the -au-or-- distances to the data points, of Hadamard manifolds guarantee the existence and uniqueness of the Fréchet mean. To ensure the sensitivity of the sample Fréchet mean is finite, we need the following assumption:
Assumption 1. The data D By (mo) for some mo M,, r < co.
The assumption that data lies within a geodesic ball is standard in the field of DP and should not raise concerns (Reimherr al. 2021 Soto al. 2022). Consider two datasets D DD' M, and denote T and J as the two sample Fréchet means of and DD' respectively. Under Assumption we have (ā, x') S 2r/n.
3.2 UTILITY GUARANTEE
We now analyze the expected utility of our mechanisms in terms of the expected Riemannian distance to the sample Fréchet mean T.
Theorem 3.1. Let M be d-dimensional Hadamard manifold and assume assumption 7 hholds. Denote TEwL as sample drawn from an Exponential- Wrapped Laplace Distribution with footpoint Po- center E and rate 2r/(ne). žEWL is E-D and have
E d( 3) S od 2d(po. Z).
(2)
Similarly, denote žEwG as a sample drawn from an Exponential- -raapeed Gaussian Distribution footpoit po. center and rate 2r (n/() žEWG is μ-GDP and we have,
(- d d((o.
E Ed(īEwG. F) < 0
2 1/22
d/2-1
(-
d(po. σ)
2
2 I((d + 1)/2)
+ 2d(po, I),
r(d/2)
where L1/2 denote the Laguerre polynomials. If we impose the additional of Sec > for some K 5 O, we have,
sinh(VKr)
E Ed(sEwL, F)
VKr od,
(4)
sinh(VKr) 2 T (((d+))/2) l(d/2)
Ed(ZEwG. #) x)
(5)
Kr
where I' denotes the gamma function
S denotes the sectional curvature of M.
5

---

Published as a conference paper at ICLR 2026
Observe that the footpoint Pu appears explicitly in the utility bounds equation 2 and equation S highlighting its direct impact on the utility of the mechanisms. To tighten these bounds, is desirable to minimize the distance d(po. Z). When the data well well-dispersed within ball B, (mp). the Fréchet mean typically lies near the center mg. making it a natural choice for the footpoint. However, prior knowledge suggests that the majority of the data concentrated in smaller region R C (mo), selecting the center of R as the footpoint may yield better utility. In the absence of such prior information, may be beneficial allocate portion the privacy budget to privately estimate suitable footpoint. See Appendix G for a concrete DP mechanism for selecting a data-dependent footpoint pu-
Furthermore, as the dimension d increases, the leading terms in the utility bounds dominate, reducing the relative influence of the footpoint, provided the data radius r Assumption | remains fixed. This implies that in high-dimensional settings, the influence of the footpoint on utility becomes relatively less significant. Indeed, this trend is reflected in our simulation results on the SPDM space equipped with the affine-invariant metric, as shown in Section 4
By contrast, the bounds in equation and equation iillustaae how the geometry the underlying manifold influences utility through curvature. The sectional curvature lower bound K acts regularizer: smaller values of correspond to geometries closer to flat and yield tighter utility bounds. In the limiting case of flat manifold, these bounds simplify to equalities:
E d(EEEL F) = od, E Ed("Ewc. = ov I((d + 1)/2)
T(d/2)
in which the footpoint no longer affects the utility. This phenomenon further confirmed in our simulations on SPDM spaces equipped with the Jog-Cholesky and Log-Euclidean metrics, as presented in Section
SIMULATION AND EXPERIMENT
We evaluate the performance of our Exponential-Wrape Wrapped mechanisms for releasing GDP-compliant Fréchet means. Experiments are conducted on the manifold of symmetric positive definite matrices (SPDM), standard space in medical imaging (Pennec al. 2019 Said et al. 2017: Hajri et al.) 2016). Appendix [B.3] reviews the geometry of SPDM under three metrics, while Appendix B.4 reviews the geometry of the hyperbolic space. Section 4.1 describes the simulation setup and presents results. Real-world experiments on the OCTMNIST dataset are provided in section 4.2
4.1 NUMERICAL SIMULATION
For the simulation study, focus releasing the GDP Fréchet mean on the SPDM spaces St under three different Riemannian metrics: the Log-Cholesky metric, the Log-Euclidean metric, and the invar-itt metriq and on Hyperbolic space HH., We compare the performance of our Exponential-Wrappee Gaussian (EWG) mechanism, described in Section 2.3 with the Riemannian Laplace (RL) mechanism proposed in Reimherr al. (202T). Riemannian Laplace mechanism that satisfies E DD can also be interpreted as satisfying μ GDGP, with the correspondence given by & = lo (1- Φ u/2) (u/)) (Liu et al. 2022).
For SPDM spaces S we generate samples T1..... Tn from the geodesic ball B, (I.) using the Wishart distribution as in Reimherr et al. (2021 Supplemental 1.2.1). The Fréchet mean F computed using formulas equation [aand equation for the Log-Cholesky and Log-Euclidean metrics, respectively, while the gradient descent procedure from Fletcher and Joshi (2004); Reimherr et al.) (202T) is used for the affine-invarian metric. To implement the RL mechanism, we follow the method of Reimherr et al. (202T): Hajri et al. (0116), using a burn-in in of 10,000 iterations to sample from the Riemannian Laplace distribution. For our EWG mechanism, we use the method described in Algorithm| and Appendix C..) sampling from the Exponential- Sroonettall-rappeed Gaussian distribution centred at the fixed footpoint Po I.n-
Throughout these simulations, we fix the sample size at n = 40 and the data radius at r = 1.5 to ensure constant sensitivity A. With A fixed, vary the privacy budget μ (0.1, 0.2, ... 0.7, 1.5, 2} and
Note that the manifold of SPDM is not inherently Hadamard; this property depends on the choice of Riemannian metric.

---

Published as a conference paper at ICLR 2026
Affine-Invariant d
Affine-Invariant; 10
Affine-Invariant; d 15
Riemannian distance
Riemannian distance
Riemannian distance
15
EWG RL
EWG
EWG RL
20
RL
10
10
2-
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
Euclidean;; =
Log-Euclidean; d 10
Log-Euclidean; d = 15
12.5
Riemannian distance
Riemannian distance
Riemannian distance
EWG
10.0
EWG
16
EWG
7.5
2.
5.0
1-
2.5
0.0
0.5
2.0
1.5
μ
μ
Cholehhlle, d =
Log-Chooee Cholesky,,, d 6
Log- Ch-ohhllkk,, = 15
Riemannian distance
Riemannian distance
Reeannnia distance
EWG
6
EWG
15
-WWG RL
RL
RL
3-
10
4
2-
2.
0-
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
Figure 1: Utility Comparison of EWG and RL Mechanisms across Three Metrics. Blue lines with triangular symbols show the Riemannian distances d(z,, a.dd.) and the red line with circular symbols represent the Riemannian distances d(z, .) Results are shown for the Log-Chin -hgo-Chleskyy (top), Nog-Euclidean (middle), and afffineinvvarann (bottom) metrics.
manifold dimension = mmm + 1)/2 E {3, 10. Let स.. and TewG denote the outputs of RL and EWG mechanisms, respectively. Figure shows the average Riemannian distances d(ž a (blue triangles) and d(E, -e (red circles), computed over 100 independent indicate standard errors around the sample means. Results are organized by metric: the top, middle, and bottom rows correspond the Shg-CChllsky, Log-Euclidenn and affine-invariant metrics, respectively.
Shaded regions
Across all three dimensions d (3, 10, 15} and wide range of privacy budgets μ [0.1, the EWG mechanism consistently outperforms the RL mechanism under the Log-Cholesky and Log-Euclidean metrics. Under the affine-invariam metric, the EWG mechanism shows degraded performance at moderate to high privacy budgets l E [0.7, 2] when d = 3. This degradation reflects the influence of curvature on utility: as the privacy budget increases and less noise injected, pronounced. However, for higher dimensions
the effect of footpoint misalignment becomes = 10, 15, the EWG mechanism outperforms the RL mechanism across nearly all privacy budgets. In high dimensions, utility is dominated by noise magnitude rather than footpoint alignment, leading to more stable performance.
Similarly, for hyperbolic space Ez, generate samples Ii...., Zn uniformly from the geodesic ball B, (p) with p = (1,0, OL...... 0), r = 1.5 and n 40 fixed throughout the simulation. Same as metric, the Fréchet mean E is computed using the
the SPDM space equipped with
7

---

Published as a conference paper at ICLR 2026
gradient descent procedure from Fletcher and Joshi (2004) Reimherr et al. 2021). To implement the RL mechanism, we follow the sampling method of Pennec et al. (2019). For our EWG mechanism, the method described in Algorithm I and Appendix C.4 sampling from the Exponential- Wrapped Gaussian distribution centred at the fixed footpoint po = (1,0, ... Th. results, shown in Figure 2 are much more consistent compared dimensions d E {3, 10, 15) and all privacy budget, the EWG mechanism consistently outperforms the RL mechanism, which is similar to the scenarios of Stt under log-Euclidean and Log-Chor Cho--hhlessy metrics. This suggests that in spaces with more regular, less exotic geometry, the influence of the footpoint on performance is reduced.
Sm with Affine-Invarian metric. Across all
Hyperbolic;
Hyperbalic;
Hyperbolic;
Riemannian distance
Riemannian distance
Riemannian distance
2.0-
EWG
EWG
EWG
RL
RL
RL
1.5-
2
1.0
1.
0.0
0-
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
Figure 2: Utility Comparison of EWG and RL Mechanisms on Hyperbolic space Hla. Blue lines with triangular symbols show the Riemannian distances d(z (gdp), and the red line with circular symbols represent the Riemannian distances d(a, -ddo
In addition to improved utility, the EWG mechanism offers a substantial computational advantage over the RL mechanism. As shown in Table L EWG requires significantly less runtime, often by several orders of magnitude, especially as the manifold dimension increases. This efficiency stems from its straightforward sampling procedure (see Section 2.3 and Algorithm [ contrast the RL mechanism's reliance on MCMC with a long burn-in, making EWG more scalable and practical for high-dimensional settings.
4.2 REAL-WORLD EXPERIMENT ON OCTMINST DATASET
In this section, compare EWG mechanism the Riemannian Laplace mechanism for releasing the GDP Fréchet mean on the real-world dataset OCTMINST. As one of the 12 standardized 2D datasets in the MedMNIST ST collection (Yang et al.) (023). OCTMINST consists of 28 28 greyscale images and is derived from Optical Coherence Tomography (OCT) medical imaging data. Following extract covariance descriptors from each image to represent them as points on the space of 5 x 5 SPDM. S5 equipped with the Log-Euclideaa metric. These descriptors serve as structured, manifold-valued features for comparison. The detailed covariance descriptor construction is given below.
prior work (Utpala al. 2023a Tuzel et al. 2006).
To perform tasks such classification on medical imaging datasets, it common practice to extract a covariance descriptor from each image, using it as representative feature of the image. Here, we follow similar approach as in Utpala et al. (2023a); Tuzel al.] (2006) to extract covariance descriptors. Let Z E h be an greyscale image of height and width w and T(x) denote the pixel intensity position and y with x = (z.,)). The covariance descriptor given by
1 - (o(T)( u) + mI
R.
S
XES
where (x) is defined as the following.
@I(x)
I'I(x)
PI(x))
[(x),
dx
By
Oxd
We set 17 = 10 to ensure the covariance descriptors are positive definite. follows that each covariance descriptor R. is element of S5 with d 5(5 1)/2 15.
8

---

Published as a conference paper at ICLR 2026
Equipping Sg with the Log- Eug-lucideean metric, we have
(T), I) < va ( [log())), (og 255² + +n)]
(6)
by following similar computation in Utpala et al. (2023a), we did not normalize the pixel value/intensity I to be between 0 and 1. Based on ( the data must reside in B, where r is determined by the righthand side of (6) and thus the sensitivity for computing Fréchet mean is then A = supz"s' d(z,0') S 2r/n.
Utpala al. (2223a). Note that, different from the experiment
We compute covariance descriptor for each image in the dataset, then calculate the sample Fréchet mean I under the Log- Log-Euclidean metric. We then release GDP version jedp us- ing both the Exponential-Wrapped Gaussian (EWG) mechanism and Riemannian Laplace (RL) mechanism (Reimherr et al. 2021), each calibrated to the same privacy budget / 00.1, 0.7, 1, 1.5, 5, 2j. For EWG, we fix the footpoint at pa = I3 and apply Algorithm For RL, follow the MCMC-based sampling procedure with 10,000 burn-in steps.
There are four different classes in the OCTMNIST dataset, labelled from to 3. We compare the utility between our EWG mechanism and RL mechanism in each of the four classes. Denote and EWG the output of the Riemannian Laplace mechanism and Exponential Wrapped Laplace mechanism respectively, the plots in Figure display the average Riemannian distances d(ž, (t.G)
(in red with circular symbols) and (T, ggdp) (in blue with triangular symbols) across 100 Monte Carlo replications for each class. Shaded regions indicate standard errors around the sample means. Similarly to the numerical simulation, our EWG mechanism achieves better utility across different privacy budgets. These results confirm that EWG provides practical scalability and strong utility guarantees for differentially private inference on real-world manifold-valuee data.
Class 0; 15
Class 1; = 15
Class 2; d 15
Class 3; 15
1.5
Riemannian distance
Riemannian distance
Riemannian distance
Rlemannian distance
0.3
RL
0.3
0.2
1.0
0.1
0.5
0.5
0.1
0.01
0.0
0.5
1.0
1.5
1.0
2.0
0.5
1.0
2.0
1.0
1.5
Figure 3: Utility Comparison of EWG and RL Mechanisms for Class 0 to 3 in the OCTMNIST data under Log- Bog-Euclidean metric. Blue lines with triangular symbols show the Riemannian distances sddp) d( RL ), and the red line with circular symbols represent the Riemannian distances d(F. ggde))
CONCLUSION AND FUTURE DIRECTIONS
We introduced Soooeeniial-rappeer Caappeeaappaaee Laplace and Gaussian mechanisms for achieving differential pri- vacy on Hadamard manifolds. These mechanisms support multiple privacy notions- (c. oDP Rényi DP, and Gaussian and operate entirely within the intrinsic geometry of the manifold. Crucially, they avoid MCMC sampling by leveraging efficient push-forward sampling via the exponential map. Theoretically, we derived utility bounds for both mechanisms that capture the impact of curvature, dimension, and footpoint alignment on the privatized Fréchet mean. Empirically, we showed that the Exponential -raapedd Gaussian mechanism consistently outperforms the Riemannian Laplace mechanism on flat manifolds and performs competitively curved manifolds, with substantial improvements in runtime.
Several avenues for future work remain. First, determining an optimal or data-adaptive choice of footpoint Po could improve utility in non-constant curvature settings. In particular, strategies for privately selecting Po are worth exploring. Second, extending our framework to manifolds with non-negative curvature, such as spheres, is a natural direction. Finally, we aim to extend approach beyond Fréchet mean estimation to more complex tasks such as principal geodesic analysis (Huckemann et al. 2010 Fletcher et al. 2003 Zhang and Fletcher 2013) and regression on manifolds (Cheng and Wu
2013)

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was initiated during the first author's PhD studies the University of Alberta and further revised/finalized during postdoctoral appointment at Nanyang Technological University. The first author gratefully acknowledges support from the Alberta Innovates scholarship.
REFERENCES
Vincent Arsigny, Pierre Fillard, Xavier Pennec, and Nicholas Ayache. Geometric means in novel vector space structure symmetric positive-definite matrices. SIAM Journal on Matrix Analysis and Applications, 29(1))328-33 12788-37,220 2007. doi: 10. 1077037706667999.
Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference Machine Learning,
8a.
Borja Balle and Yu-Xiang Wang. Improving the Gaussian mechanism for differential privacy: Analyt- ical calibration and optimal denoising. Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 394-403. PMLR, 10-15 2018b.
Boaz Barak, Kamalika Chaudhuri, Cynthia Dwork, Satyen Kale, Frank McSherry, and Kunal Talwar. Privacy, accuracy, and consistency too: A holistic solution to contingency table release. In Proceedings of the Twenty-Sine Sixth ACM SIGMOD-SIGACTS SISAAA-TTIIIIRTTTTT Symposium on Principles of Database Systems, PODS '07, page 273-282, New York, NY, USA, 2007. Association for Computing Machinery. ISBN 9781595936851. doi: 10. 10.1145/1265530.1 1265569.
Peter Basser, James Mattiello, and Denis LeBihan. Mr diffusion tensor spectroscopy and imaging. Biophysical journal, (6(1):259-261 1994.
Rabi Bhattacharya and Vie Patrangenaru. Large sample theory of intrinsic and extrinsic sample means manifolds. The Annals of Statistics, 31(1):1 29, 2003, doi:
Thomas Brox, Joachim Weickert, Bernhard Burgeth, and Pavel Mrázek. Nonlinear structure tensors. Image and Vision Computing, 24(1):41-55, 2006.
Edoardo Cetin, Benjamin Paul Chamberlain, Michael M. Bronstein, and Jonathan J Hunt. Hy- perbolic deep reinforcement learning. In The Eleventh International Conference on Learning Representations, 2023.
Benjamin Paul Chamberlain, James Clough, and Mare Peter Deisenroth. Neural embeddings of graphs in hyperbolic space. arXiv preprint
2017.
Ming-Yen Yen Cheng and Hau-Tieng Wu. Local linear regression on manifolds and its geometric interpretation. Journal of the American Statistical Association, 108(504): 1221-1444,,,1144,, 2013.
Emmanuel Chevallier, Didong Li, Yulong Lu, and David Dunson. Exponential distributions on symmetric spaces. SIAM Journal on Mathematics of Data Science, 4(4):1347-1368 2022.
Scunghyuk Cho, Juyong Lee, Jaesik Park, and Dongwoo Kim. A rotated hyperbolic wrapped normal distribution for hierarchical representation learning. Advances in Neural Information Processing Systems, 35:17831- 2022.
Jinshuo Dong, Weijie Su, and Linjun Zhang. A central limit theorem for differentially private query answering. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 14759-14770. Curran Associates, Inc., 2021.
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3-37, 2022.
Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9:21 1-407, aug 2014, ISSN 1551-305X. doi: 10. /04000040000042..
10

---

Published as a conference paper at ICLR 2026
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Proceedings of the 24th Annual International Conference The Theory and Applications of Cryptographic Techniques, EUROCRYPT page 486-503, Berlin, Heidelberg, 2006a. Springer-Verlag. Verlag. ISBN 3540345469, doi: 10.1007/ 11761679_29
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Shai Halevi and Tal Rabin, editors, Theory of Cryptography, pages 265-284, Berlin, Heidelberg. 2006b. Springer Berlin Heidelberg.
Charles Fefferman, Sergei Ivanov, Yaroslav Kurylev, Matti Lassas, and Hariharan Narayanan. Re- construction and interpolation of manifolds. i: The geometric whitney problem. Found. Comput. doi: 100007//12008-19-099993933
Math., 20(5):1035- 111935-113,, 133, October 2020. ISSN 1615-3375.
Pierre Fillard, Vincent Arsigny, Xavier Pennec, Paul M Thompson, and Nicholas Ayache. Extrap- olation of sparse tensor fields: Application to the modeling of brain variability. In Information Processing in Medical Imaging: 19th International Conference, IPMI 2005, Glenwood Springs.
CO, USA, July 10-15, 2005. Proceedings 19, pages 27-38. Springer, 2005.
Pierre Fillard, Vincent Arsigny, Xavier Pennec, Kiralee M Hayashi, Paul M Thompson, and Nicholas Ayache. Measuring brain variability by extrapolating sparse tensor fields measured on sulcal lines. Neuroimage, 34(2):639 650, 2007.
P. Thomas Fletcher and Sarang Joshi. Principal geodesic analysis symmetric spaces: Statistics of diffusion tensors. In Milan Sonka, Ioannis A. Kakadiaris, and Jan Kybic, editors, Computer Vision and Mathematical Methods in Medical and Biomedical Image Analysis, pages 87-98, Berlin, Heidelherg, 2004. Springer Berlin Heidelberg. ISBN 978-3-540-278166
P.T. Fletcher, Conglin Lu, and S. Joshi. Statistics of shape via principal geodesic analysis on lie groups. In 2003 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2003. Proceedings., volume pages 1-1, 2003. doi: 10. 10.1109//VP 2003. 12000.1211444
Octavian Ganea, Gary Bécigneul, and Thomas Hofmann. Hyperbolic neural networks. Advances in neural information processing systems, 31, 2018
Alexander Grigoryan. Heat kernel and analysis on manifolds. American Mathematical Soc., 2009.
Hatem Hajri, Ioana Ilea, Salem Said, Lionel Bombrun, and Yannick Berthoumieu. Riemannian laplace distribution on the space of symmetric positive definite matrices. Entropy, 18(3), 2016. ISSN 1099-4300. doi: 10.3390/e1803300 8030098.
Andi Han, Bamdev Mishra, Pratik Jawanpuria, and Junbin Gao. Differentially private riemannian optimization. Mach. Learn., 1 113(3):1133-1161 February 2024. ISSN 0885-6125, doi: 10.1007/
Peilin He, Liou Tang, M Amin Rahimian, and James Joshi. Conformal-dp- Differential privacy on riemannian manifolds via conformal transformation. arXiv preprint arXiv:2504.2094) 2025.
Zhenwei Huang, Wen Huang. Pratik Jawanpuria, and Bamdev Mishra. Federated learning on riemannian manifolds with diffcrential privacy. arXiv preprint arXiv:2404. 10029, 2024.
Stephan Huckemann, Thomas Hotz, and Axel Munk. Intrinsic shape analysis: Geodesic pea for riemannian manifolds modulo isometric lie group actions. Statistica Sinica, 20(1):1-58, 2010. ISSN 10170405, 19968507.
Yangdi Jiang, Xiaotian Chang, Yi Liu, Lei Ding, Linglong Kong, and Bei Jiang. Gaussian differ- ential privacy on riemannian manifolds. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023. New Orleans, LA, USA, December 10- 16, 2023, 2023.
Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. IEEE Transactions on Information Theory, 63(6):4037-400 4049, 2017. doi: 10. 109/TIT. 2017.2685505.
11

---

Published as a conference paper at ICLR 2026
Denis Le Bihan, CrannFFrançoi Mangin, Cyril Poupon, Chris A Clark, Sabina Pappata, Nicolas Molko, and Hughes Chabriat. Diffusion tensor imaging: concepts and applications. Journal of Magnetic Resonance Imaging: An Official Journal of the International Society for Magnetic Resonance in Medicine, 13(4):334-546, 2001.
John M Lee. Riemannian manifolds: an introduction to curvature. Springer Science & Business Media, 2006.
Chengxin Li, Saiqin Long, Haolin Liu, Youngjune Choi, Hiroo Sekiya, and Zhetao Li. Enhanc- ing sparse mobile crowdsensing with manifold optimization and differential privacy. IEEE Transactions on Information Forensies and Security, 19:6070-6083, 2024. doi: 10.1109/TIFS. 2024.3407668.
Zhenhua Lin. Riemannian geometry of symmetric positive definite matrices via cholesky decom- position. SIAM Journal on Matrix Analysis and Applications, 40(4):1353-1370, 2019. doi:
10.1137/18M12210044
Yi Liu, Ke Sun, Bei Jiang, and Linglong Kong, Identification, amplification and measurement: bridge to gaussian differential privacy, In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors, Advances Neural Information Processing Systems, 2022.
Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. Proceedings Annual IEEE Symposium on Foundations of Computer Science, FOCS, pages 94-103, 11 2007. doi: ST009FFCCS2007..66
Gérard Medioni, Mi-Suen Lee, and Chi- Chi-Keung Tang. A computational framework for segmentation and grouping. Elsevier, 2000.
Iyy Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263-275. IRFE, 2017.
Yoshihiro Nagano, Shoichiro Yamaguchi, Yasuhiro Fujita, and Masanori Koyama. A wrapped normal distribution on hyperbolic space for gradient-based learning. In International conference on machine learning, pages 4693-4702. PMLR, 2019.
Maximillian Nickel and Douwe Kiela. Poincaré embeddings for learning hierarchical representations. Advances in neural information processing systems, 30, 2017.
Wei Peng, Tuomas Varanka, Abdelrahman Mostafa, Henglin Shi, and Guoying Zhao. Hyperbolic deep neural networks: A survey. IEEE Transactions pattern analysis and machine intelligence, 44(12):10033-10044 2021.
Xavier Pennec, Stefan Sommer, and Tom Fletcher. Riemannian geometric statistics in medical image analysis. Academic Press, 2019.
Peter Petersen.
Riemannian geometry. Springer, 3rd edition, 2006.
Matthew Reimherr and Jordan Awan. Kng:
The k-norm gradient mechanism. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Bue, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
Matthew Reimherr, Karthik Bharath, and Carlos Soto. Differential privacy over riemannian manifolds.
In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 12292-12303. Curran
Associates, Inc., 2021.
Salem Said. Statistical models and probabilistic methods on riemannian manifolds, 2021.
Salem Said, Lionel Bombrun, Yannick Berthoumieu, and Jonathan Manton. Riemannian gaus- sian distributions on the space of symmetric positive definite matrices. IEEE Transactions Information Theory, 63(4):2153-217)) 2017. doi: 10.1109/T.2217725533333
Rik Sarkar. Low distortion delaunay embedding of trees in hyperbolic plane. In International symposium graph drawing, pages 355-366. Springer, 2011 1.
12

---

Published as a conference paper at ICLR 2026
Armin Schwartzman. Random ellipsoids and false discovery rates: Statistics for diffusion tensor imaging data. Stanford University. 2006.
Armin Schwartzman, Lognormal distributions and geometric averages of symmetric positive definite matrices. International Statistical Review, 84(3):4564486 2016. doi: https://doi.org/10.. I/insr. 12113.
Kiyoshi Shiga. Hadamard manifolds. Geometry of Geodesics and Related Topics, 3:239-282, 1984.
Carlos Soto, Karthik Bharath, Matthew Reimherr, and Aleksandra Slavković. Shape and structure preserving differential privacy. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 24693- 24705. Curran Associates, Inc., 2022.
Oncel Tuzel, Fatih Porikli, and Peter Meer. Region covariance: A fast descriptor for detection and classification. In Ales Leonardis, Horst Bischof, and Axel Pinz, editors, Computer Vision ECCV 2006, pages 589-600, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg. ISBN 978-3-540-33835-2.
Saiteja Utpala, Andi Han, Pratik Jawanpuria, and Bamdev Mishra. Improved differentially private riemannian optimization: Fast sampling and variance reduction. Transactions Machine Learning Research, 2023a. ISSN 2835-8856.
Saiteja Utpala, Praneeth Vepakomma, and Nina Miolane. Differentially private fréchet mean on the manifold of symmetric positive definite (SPD) matrices with log-euclidean metric. Transactions on Machine Learning Research, 2023b. ISSN 2835-8856.
Larry Wasserman and Shuheng Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association, 105(489):375-333 -399, 2010. ISSN 01621459.
Joachim Weickert and Thomas Brox. Diffusion and regularization of vector-and matrixvalued. Inverse Problems, Image Analysis, and Medical Imaging: AMS Special Session on Interaction of Inverse Problems and Image Analysis, January 10-13 13, 2001, New Orleans, Louisiana. 313:251, 2002.
Joachim Weickert and Hans Hagen. Visualization and processing of tensor fields. Springer Science & Business Media, 2005.
Jiancheng Vang. Rui Shi, Donglai Wei, Zequan Liu, Lin Zhao, Bilian Ke, Hanspeter Pfister, and Bingbing Ni. Medmnist v2-a large-scale lightweight benchmark for 2d and 3d biomedical image classification. Scientific Data, 10(1):41, 2023.
Miaomiao Zhang and Tom Fletcher. Probabilistic principal geodesic analysis. In C.J. Burges, L. Bot- tou, M. Welling, 7. Ghahramani, and K.Q. Weinberger, editors, Advances in Neural Information Processing Systems, volume 26. Curran Associates, Inc., 2013.
A PROOFS
A.1 PROOF OF THEOREM 2.1
Proof.
Denote the Exponential-Wrappel Laplace mechanism as M and its density as gn correspond-
ing to ((D and d2 corresponding to J(D"). ). To show PP(((D) E S) S <PP(M(D') e S) for all measurable set S, it's sufficient to show that,
g1(y)
< e
(2(v)
13

---

Published as a conference paper at ICLR 2026
Denote 7/1 f(D) and n/2 f(D'), simplify the ratio on the left-hand side,
Logyn (v) Log (m
91 (v)
Jo p (1))
exp
(2)
Loggo (w)- Loo (m2)
Joo (L08pg (w)) exp
exp
Logpo (v) - Logpo (122)
Logpo (v) Logpo (m))
& exp
Logpo (m)
Logpo (1231l
triangle inequality
d(m 12) }. Log, is contraction for Hadamard manifold
< exp
A
< exp
S Se, for
A.2 PROOF OF THBOREM 2.2
Proof. Let Ipo.n.o denote the Exponential- -arapped Gaussian Distribution with footpoint Po- center 1) and rate σ. From Balle and Wang (018a), our Exponential-Wragee Gaussain mechanism satisfies (e, DDP if and only if,
sup / Ipo.m (v) du(y) e- Spo.na (0 (V) dv(y) S 8, DzD
where
{y Spo.n (W)/ (v) e J. = S(D) and 1/2 = S(D'). We have
9po.n:.o (3)
9po. (1)
[[] Logpo (v) -Logoo (722)11 Log (y) Logpo (m))l²
exp
22
exp
[-2 (Logpo (v) -Logpo (m)) Logpo (12) Logpo (m)) + Loggo (12) 20
Loggo (m) )1]
Denote
Apo.m.na = Logpo (12) - Logpo (m)) ) It follows that,
A 2
A (Logpo (v) Logpo (11) Logpo (122 Logpo (m)) S -
Apply change variable with u = Logno y. we have
sup / D=D' A'
N(u Logpo (m)) 0 dA(u) e [ N(u Logpo (12), 021) dA(u)
where À is the Lebegue measure on the tangent space M M and
2
A' ='= (u Log Logpu (72) Logpo (m1) -02
follows that,
[ Nu Logp. (m)), dd(u) = = (- OE
+
po.mi-7 -22
Apomm.
2s
Take a similar approach for the second integral, have
{ N( Loggo (12), o2I) dd(u) =
Po-91-712
Po-mm.mp
25
14

---

Published as a conference paper at ICLR 2026
Finally, we have
(--20
ge
Ap
(
Ap
+
S 6,
Po
2x
Ao
where
po
suDD po.min needed.
A.3 PROOF OF THEOREM
Proof. Using definition B.3 we need show the following,
/
9po.m. (v) du(y) of S, (po.m.ol) de(y) s 5g(e)
AA
0, sup D=D'
where y denotes the density of the Exponential-Wrappe Gaussian Distribution. From the proof in A.2. we have
/ (po.ns.00) dy(y)
sup D=
Ipo.m. . (v) du(y) e²
A
+
Ao
E
08
A Po
20
Apo
20
Thus, the equality in holds if and only if a = App/U.
Since Logpo is a contraction for any
Po E . (for Hadamard manifold M), we have 2 Ap and o = A/μ achieves μ-GDP as well.
A.4 PROOF OF THEOREM 2.4
Proof. Let M denote the Exponential- -Wrapied Gaussian mechanism, have
Da (M((D))IM((D))
- log
Jpn (Log (v)) (v2 V
-
Logp, y Logp, ne nel2) dv(y)
exp
Log,, y Loggo 771
20
202
1
a(l a(l-a) aa) a) 20²
log exp
Logpo 171
Logpo n2ll
completing the squares
0
Logp, 7/1
-Logp, 12112
2
d(m )22 Logpo is contraction for Hadamard manifolds
202
A
202
A
E, for V2E/a'
A.5 PROOF OF THEOREM 3.1
First, we will show the proof for bounds in (2) and
Lemma 1. Let M be a d-dimensional Hadamard manifold.
1. Denote as a sample drawn from an Exponential- Wrappedd Laplace Distribution with footpoint Po, center 1) and rate o, then have,
Ed(y, v) S ad 2| Loggo n/|-
15

---

Published as a conference paper at ICLR 2026
2. Denote y sample drawn from Exponential Wrapped Gaussian Distribution with footpoint Po, center 1i and rate a, then we have
Sroonentall-rappped
d(po.n) E Ed(y, n) S VV 1/12 1 (- (-
dkpo:n)²)
1) 5 [((d 1)/2)
T(d/2) + +2| Logpo n|1-
Proof. For Seponential-Wrapped Laplace Distribution, denote
-exp/
| dA(x),
C(a) = exp
then have
Ed(y,
=/ d(y, 11)
C(o)-1 exp
Loggn y Logm nl!
du(v)
Joo (T.0gg y)
f (().Po)
C(o)-1
|| Logpo Loggo nlll du(u) + d(po. 1), triangle inequality
Jno (Lugpo 5)
exp
a
/ Logno vll Jon (Logpo y)
C(a)-1
Loggo V/ - Logpo nll / du(u) + d(po, 1)
exp
-f ||u + Logpo 7/l
||u||
exp
dd(u)) + d(po. m) Log y - Logp,
C(o)
1
/ [|ullexp (- (-leul) dd(u)= 2d(po. n), triangle inequality
$ C(a)
=(0 / pdp exp(-r)dr)
-1 y 0², exp(-r) dr + 2d(po, 7), spherical coordinates
Ju
=ad 2d(po.
Similarly, for the Exponential-Wrapper Gaussian distribution, we have,
Ed(y.")
= =faky d(y. 1) (V2nO) exp Jpo (Logpo v)
Log y Log n112 de(y)
=
20
Ed(y, po) + (1).
Note that since (Log,, v)/a ~ N (Log n. I), ((w.po)) follows a noncentral chi distribution and have a mean of
d/2-1 (- d(po, 1)
(_d(pn,
1/2
2
where L1/2 denote the Laguerre polynomials. Thus, we have
Ed(y. n)
(- dllpo 1)) + d(po. n)-
4/2-1 11/2
<a
2
16

---

Published as a conference paper at ICLR 2026
However, this upper bound is hard to interpret. We will also derive less tight upper bound but with better interpretability as follows.
Ed(y,n)
=| d(y.n) n) (V2TT)- exp
Logno y/ - Logpo n/1? de(s))
Jpo (T08po y)
2r²
$/ |/u + Loggo all
||u112 dd(u)) d(po:: 1),
exp
Logpo y LOgpo ?I
(V2TT)d
2a
|uu||
(-llul?) 20
(- |1u11?
-
exp
dd(u)) + 2d(po. 7), triangle inequality
(v 2
[( + 1)/2)
+ +2d(pa, m),, since |uu||
=0 2
Xd.
T(d/2)
Bounds 2 and (3 follows from Lemma D directly. Now, we prove the bounds in 4 and (
Proof. Under the assumption that |eecy| < for some 2 0, then by Rauch comparison
theorem (Fefferman et al. 2020 Page 1082). we have
sin(v (vV)
sinh( (ah(V)Kr)
|10o (x) - logno (x')l s d(x,x') s
|10gpo (I) - -log (2') )ll
KKr
VKr
for any x' E (P))))
It follows that sin(v (anVK)) VKr
1o%po (v) logpo (1)ll S d(y, 1) < sinh(VKr)
|| logg, (v)
-lopp (1))l1+
VKr
for any n. y E (po)).
Under Assumption [ we have 17 E B, (po). For y E (po)).. we want project y back into B, (po). Note that this is no privacy leakage during this step, the projection only depends on po and which requires no privacy protection. Denote y as the projection of y back into B, (Pn), defined as
(T-E
y² = =xxppo
[oopo yll
log #)
Immediately, we have log 8² log 17 S 10gpa y
log,o 1/1. After the projection, we have,
Ed(n,y) / Br(Po)
/
d(n. v) dP(v)
d(n. v" dP())
MMB.(Po)
sinh(vKr)
logpo (11) log,o (v)l)P(())
B,(p)
VKr
+ I
sinh(vKr)
|1188po (1) - -oogpo (1 I| dF(v)
VKr
Kr)
llog,o (1)) - -log cP())
B.(po)
VKr
+ / (MB.((p))
sinh(VKr)
|OB (1) - -0o8p (1)l dF(x)
VKr
sinh( Kr)
|118 (n) - -logpo dP())
VKr
sinh(
Kr)
Ell log (n) logg (v)ll-
/ Kr
17

---

Published as a conference paper at ICLR 2026
Note that from the proof for Lemma 1 we have
[|| Topp (v) - 10% (1)] = od,
for Laplace mechanism,
[B]| logoo (y) - logpo (n)ll=ov2 [(dd 1)/2)
for Gaussian mechanism.
T(d/2)
The result follows.
B BACKGROUND MATERIALS
RIEMANNIAN GROMETRY
Let M be d-dimensional Riemannian manifold endowed with Riemannian metric g, which assigns to each point E . a smoothly varying inner product () on the tangent space T.M. This inner product induces norm ||u||p (v, 1/2 enabling the measurement of geometric quantities such as angles, lengths, and distances. For a smooth curve 7t) on M, the length is given by
L(7) = ()(())) dt / ((()),4(t))< dt.
Curves that locally minimize length are called geodesies, and they play central role in defining intrinsic geometry. Riemannian manifold is said be geodesically complete if every geodesic can be extended to the entire real line R; we assume this property holds throughout. Based on the definition of length, the distance between any two points p, 9 E M defined as the infimum of the lengths over all piecewise smooth curves joining them:
inf d(p, q) =P)==) L(7).
In local coordinates, the metric g is represented by a positive definite matrix = (gt)), and the Lebesgue measure is denoted by X. The metric tensor induces natural volume measure the Borel o-algebrr of M. given in coordinates by dv det gi dx. This Riemannian volume measure will serve as the default reference measure for integration and probability throughout the paper.
Geodesic completeness ensures that the Riemannian exponential map is globally defined. Given point p E M and tangent vector E T,M, the geodesic o) (4) satisfying 7p..) (0) = and (p.o (0) = v exists for all t E R, and defines the Riemannian exponential map via Exp,, (v) = Np.cc (1). Around each point p, there exists a neighbourhood C Tr.M and U C CM such that the restriction Exp,lv V U diffeomorphism. Its inverse, the Riemannian logarithmic map, is denoted by Logp - T,.M and satisfies Log, (g) = v whenever g = Fxp,, (v). In such normal neighbourhoods, the Riemannian distance can be expressed in closed form as d(p, q) [[og, (q)llp- reducing the computation of distances to norms in the tangent space.
The primary focus of this paper on Hadamard manifolds. which are simply connected complete Riemannian manifolds of non non-positive curvature. It is named after the famous Cartan-Hadaman theorem which states that for any d-dimensional Hadamard manifold M, it is differomorphic to Rd and more precisely, at any point p E M, the exponential mapping Exp,, TyM - M is diffeomorphism and thus Log, is defined everywhere on M. This property enables us to develop the Boponential-Wrappee mechanisms in Sections 2.2 and 2.3 Another important property of the Hadamard manifold is that Logp is a contraction for any E M. That is, Logp 91 Logp 12lpp S d(g1.9) q2) for any p, 91. 92 E MM, For more technical details on Hadamard manifolds, please refer to Petersen (006);; Shiga (1984).
B.2 DIFFERENTIAL PRIVACY
Differential privacy (DP) principled framework for quantifying privacy guarantees in data analysis.
Definition B.1 ( (worrk et al. 2006a)). A data-relle nata-releasing mechanism M is said to be (e, 6)P with 2 0, 0 < 8 < I. for any adjacent datasets. denoted D D'' differing in only record, have (D) E A) < Pr (M (D') e A) + ö for any measurable set A in the range of M. For 8 0, M is said to be e-DP.
18

---

Published as a conference paper at ICLR 2026
Since (c, 6)-DP is well-defined concept on any measurable space (Wasserman and Zhou, 2010). can be readily extended to any Riemannian manifold equipped with the Borel o-algebra. One relaxation of e- e-DP is the Rényi DP, which is based on Rényi divergence. It shares many important properties with e-DP while allowing tighter analysis of composite heterogeneous mechanisms.
Definition B.2 ((Mironov 2017 A mechanism M is said to have s-Rényi Differential Privacy (RDP) of order a. or (...E)-DD for short, if Da (M (D) (D')) S for all neighbouring datasets D ~ D', where the Rényi divergence of a finite order a # 1 defined as
P(x)
(P(l)) a- log B
Q(z))
and Renyi divergence at orders 1, oo are defined by continuity.
Another way of extending the differential privacy definition is through the viewpoint of the statistical hypothesis testing (Wasserman and Zhou, 2010 Kairouz et al.) 2017). In the context of hypothesis testing, we define Ho: the underlying dataset is D and H1: the underlying dataset is D'. As the values of e and 6 decrease, the task of conducting this hypothesis testing becomes more difficult. This means that detecting the presence of an individual based on the outcome of the mechanism becomes increasingly challenging. With this interpretation in mind, we can extend (c, differeeniaa privacy to Gaussian differential privacy (GDP).
Denote the outcome distribution under Ho and H1 as M(D) and MD'), respectively. We introduce the optimal trade-off function between type I and type II errors as follows,
T (M(D), M (D')) [0, 1] - [0. 1], a a T M (D')) (a),
where T (M) M (D")) (a) the smallest type II error when type error equals a. centres around this optimal trade-off function and is defined as follows.
Definition B.3 ((Dong et al. Privacy (D-GDP) (TMMMD M (D)) 2 Gp for all neighbouring datasets D ~ D' with G₁2 ((N N(,, 1))-
2022 mechanism M is said to satisfy p-Gaussian Differrntial
However, the involvement of the optimal trade-off function T(M(D), M(D)) makes Definition B.3 difficult to work with on Riemannian manifolds. To make this definition more tractable, we adapt the equivalent characterization from Jiang et al. (2023), which is based on Dong et al. 2022 Corollary 1).
Definition B.4 (Gaussian Differential Privacy (Dong et al. 2022 Jiang et al. 2023)) ). A M-valued
data-releasing mechanism M is said to be y-GDP if it's (E, ( DD for all s 0. where
5x(=) = +
E
11
e
----))
f
2
with & denotes the cumulative distribution, fustitbttion.uucction of the standard normal distribution.
B.3 SPDM SPACE
Let St denote the manifold of m x m real symmetric positive-definite matrices, with tangent space at each point identified with Sm. the space of m X m symmetric matrices. The affine-ivarriant (Rao-Fisher) Riemannian metric endows S+ m with non-positive sectional curvature and desirable invariance properties, but introduces substantial analytical and computational complexity. In contrast, the Log- -uccldeidd and Log- Cholesky metrics induce flat Riemannian geometries on S each derived from bi-invariant Lie group structure: the former using the matrix logarithm, and the latter the Cholesky decomposition. The Log-Euclidean metric defines distances via the Frobenius norm by applying the matrix logarithm Log, [[Log(p) Log(4)]] F. allowing closed-form expressions for geodesics and Fréchet means. The Jog-Cholesky metric offers similarly explicit formulas while providing improved numerical stability and computational efficiency.
Consider the data XI,..., X, E St Under the Log-Euclidean metric, the sample Fréchet mean has the following closed-for form expression.
Log( X.) }.
I = Exp
Σ i=1
(8)
19

---

Published as a conference paper at ICLR 2026
where Exp and Log denote the matrix exponential and logarithm maps.
Under the Log-Cholesky metric, the sample Fréchet mean has the following expression,
I = x (
(9)
where
L + Exp ( LLLgD((La)
(10)
with I, being the cholesky decomposition of X; such that L. X,, |- returning the strictly lower triangular matrix, and (D)) returning the diagonal matrix. Refer to Arsigny et al. (007): Lin
(2019) for more details.
Although these metrics forgo affine invariance, their flatness simplifies analysis and makes them particularly suitable for statistical inference and privacy-presenee follow, we compare all three metrics, with particular emphasis on the Log-Euclidean and Log- Cholesky approaches due their practical advantages. For more details on SPDM spaces and these metrics, refer to Arsigny et al. (2007); Lin (2019); Said et al. (2017); Reimherr et al. (2021).
tasks. In the simulations that
B.4 HYPERBOLIC SPACE
Hyperbolic space is a space constant negative curvature. Here, we will focus on the Lorentz model Hi,, also referred the hyperboloid model, of hyperbolic space. For the Lorentz model H,, each point is identified with æ E Rd++1 such that (ar, x) = -1 with the Lorentz inner product defined as follows.
(a, v) To
Tzyt-
The distance between two points x, y E HIa is then defined as,
dz (I, 3) arccosh(-(2. v)
The tangent space H.H each point E Hi is identified {u (u, 0}. The exponential map exp,, has the following closed-form expression,
exp, (u) = cosh([|u[|z))= > + sinb([|u[[z)) ||ull
u
with ||u|le = (u, L. Similarly, the logarithm map has the following expression,
arccosh(a)
log, (v) Va² ax))
with a (x,, v) T. For more details on the Lorentz model, see Nagano et (2019) Cho al. (022
C SAMPLING FROM EXPONENTIAL-WRANN WRAPPED DISTRIBUTION
C.I EXPONENTIAL- EXPONENIIAL-RRAPED LAPLACE DISTRIBUTION
The EWI. Distribution is the push-forward probability of the tangent space probability defined by the probability density h(u) x exp(-lles logpo nl//a.. The sampling procedure for the EWL
Distribution is straightforward:
Sampling from u ~ h(()) x exp log nl1/o}.
2. Computing expp, u.
Note that the sampling step u ~ h(u)) needs some clarification. We want to emphasize that || within step is the 12-norm but rather the norm induced by the Riemannian metric 9p. Note that the tangent space M. equipped with dp can be identified with Rd equipped with the Fuclidean metric
20

---

Published as a conference paper at ICLR 2026
as follows. Let fei.... fd) be orthogonal basis w.r.t. Ip TnM, then any point E T can be identified with point vr IR via the following map,
d
4p T.M + Rd
aie + (p(1) (ai..... ad),
(11)
Denote this map as 4p M + Rd. and note that ip is isometry for any p M as,
(1 v2) 1p(21) (v(22) (x
where ( denote the euclidean inner product here. Putting it together, we have the following sampling procedure,
Sampling from u h(u) x exp{- 'ao (logpo 1 122
2. Computing exPpo (' (u)).
C.2 EXPONENTIAL WRAPPED GAUSSIAN DISTRIBUTION
Implementing the EWG mechanism for (e, 6)- is straightforward. We follow similar procedure as in Algorithm T After determining the appropriate a numerically from inequality (I -
using
method such as that proposed Balle and Wang 2018b
one can proceed by
1. first sampling from the multivariate Gaussian distribution N(0,
2. The privatized summary is then computed as
exppo (mv (u) + 'po Dogpo (J(D)))
Suppose M is the space of SPDM equipped with log-Euclidean metric, the EWG mechanism with footpoint Po I reduces to the tangent Gaussian mechanism in [Upala et al. (2023b). Hence, the EWG mechanism is generalization of the tangent Gaussian mechanism, as our mechanism can be employed for any Hadamard manifold equipped with any Riemannian metric. This makes our EWG mechanism the first working mechanism to achieve (c, DDP SPDM under the non-log- Euclidean metric.
The implementation of the EWG mechanism for 4-GDP is similar.
C.3 SAMPLING FROM EWG ON SPDM SPACE
Here, we discuss how to sample from the EWG distribution SPDM space equipped with the three different metrics. All the sampling procedures are summarized in Algorithm
ii) Affine-Invarial metric We note that the Riemannian metric gp on SpSt is defined
( Y) = trrce(p-1xP--ly)
Due to the affine invariant property of the Affine-Invariant metric, we have,
gp(X. IT... 1P-1/2 ( p021:/xpp-.,pp-22ppppp
1 1/2pp1111/ 1/2)
-PP11/2Xp-12
where (,,-) denotes the Frobenius inner product. Note P-1/2 E Sm. the space of m m symmetric matrices, we can map them into mmmm++1)22 via the function veed Sm -> mm++)/1) which is defined as
(W) T v2 oT
where diag(W)) / is an m-dimensional vector containing the diagonal entries of W and offdiag(Y) is an m(m - 1) dimenninnsi vector containing the off-diagonal entries of W copied from below the diagonal columnwise (or above the diagonal row-wise). The inclusion of the factor /2 for the off diagonal entries ensure that,
XXY)r veod(X) veod(Y),
21

---

Published as a conference paper at ICLR 2026
for any X,Y Y E Sm- See Schwartzman (2006) 2016) for more details on this vectorization operator. follows that the map up defined as
tp Tp + Rmim+11/2 X + vecd(P-1/2xp
(12)
an isometry. Thus, sample from EWG with footpoint po. center v,, and rate >> under the Affine-Invarian metric can be summarized as follows.
1. Map the center to pm(m+1)/2 via logpo and in as lpo llogpo (n)]-
2. Sample (Nro [o La)).
3. Map u back to .M via '70 and expp, as exppo (m
(ii) Log- Log-Euclidean metric For both Log-Euce Euclidean and Jog-Cholesky metric, we fix the footpoint to be Im as the footpoint will have no impact on the result due to vanishing curvature and Im simplifies the computation a bit. We note that under the Log-Euclidean metric, we have,
Imm (x, = (race(XY) = (X, Y)
Thus, follows similar argument in the Affine-invariant case and note that veed is isometry between Ti,, St. and pm(m+1)/2, we can sample from EWG with footpoint po. center 7), and rate a > under the Log-Eucldiean metric can be summarized as follow.
1. Map the center 7 to Rm(m+1)/2 via Log and veed vocd[Togg()))
2. Sample o(veed[Log(T)),0_L)))
3. Map u back to .M via veed and Exp as Exp { (veed "reed
Note that Exp and Log denote the matrix exponential and logarithm, respectively.
(iii) Eueliduli metric
We note the following relation,
Lo8gm
veed
S+
C+
R mm)++))/2
where
1. L denotes the space of upper triangular matrices,
2. L+ denotes the space of upper triangular matrices with postive diagonal entries, decomposition,
3. L denotes the
4. log is defined as,
lo (K)
K [7] + (DL)
5. and the operator veed is defined follow,
vecd(X) (diag(X) offdiag(()))) for E.
Once again, we have (X, Y) F = x veed(Y) for any X, Y E C, and thus veed is a isometry between L and 1m)mm+1/2 1)/2, Combine with fact that logi,, L is a isometry between St and L, we have
veed logr of
is a isometry between St and (m)(m-1)/22 1)/2 Thus, to sample from EWG with footpoint po. center and rate under the Log-Chold -hgCChhlesky metric can be summarized as follow.
1. Map the center y to Rm((+11/22 as
veed log1,. L(r))
2. Sample
N veed log ((nn),
3. Map u back to M as
veed logr.. L 3 (u).
22

---

Published as a conference paper at ICLR 2026
Algorithm 2 Generate GDP Fréchet mean SPDM space
Input: Data radius r, privacy budget 14, private data XI...., X,, S Riemannian Metric footpoint Po for Affine-Ivvatie Invarannv metric.
Output: Privatized Fréchet mean FEWG S
1: Sample v (N(0, Ia)
with d = m(m + 1)/2.
2: if p.. then
3: Compute sample Fréchet mean F using equation 8 :gdp 4: Compute FWG Exp (Log(æ) + veed reed-(oor) (ov) with 2ro/u.
5: else if pاc then
6: Compute sample Fréchet mean F using equation 9
Compute I, = expr.. (log... a (x) + veed (ov)) with a = 2r0/
7:
8: Compute "EWGG T.I.T.
9:
else if A then
10: Compute sample Fréchet mean F using Gradient Descent algorithm.
11: Compute FWG = exppo po { (4pu llog, (#) + +ov} where 'yu is defined in equation 12
:gdp
end if
13:
Return: sgdp
"EWG-
C.4 SAMPLING FROM EWG ON HYPERBOLIC SPACE
To sample from EWG with footpoint Po, center and rate a >> 0 on Hg, we modifies the approach described in Cho (2022). which is stated below:
1. Map the center 7 to Tpo H logpo (1))
2. Sample ,N(0,, Ia) and parallel transport the vector [0, u] to the tangent space T Hld.
i PT c po (10, u]).
3. Map ī + log (n) back to H. via exponential map,
exp pm (u + log (n)).
D COMPUTATION TIME COMPARISON
EWG
Compute time (sec)
6
RL
4-
2
0
10
20
30
m
Figure 4: Computation time comparison of EWG and RL Mechanisms under the affine-ivvrriant metric. The blue line with triangular symbols represents the RL mechanism, while the red line with circular symbols represents the EWG mechanism. The RL mechanism is implemented with burn-in size of 10,000.
23

---

Published as a conference paper at ICLR 2026
Table 1: Computation time (seconds) comparison between RL and EWG mechanisms under the affine-invariant metric. The RL mechanism is implemented with burn-in size of 10,000. Results from 10 Monte Carlo replications.
mechanism
EWG
RL
size m
mean
SD
mean
SD
2
0.00248
0.00252
1.01774
0.05029
5
0.00160
0.00022
1.33547
0.07959
7
0.00166
0.00011
1.61042
0.08033
10
0.00204
0.00032
2.03352
0.10878
13
0.00241
0.00018
2.48609
0.09874
17
0.00329
0.00083
3.50102
0.29508
20
0.00402
0.00067
4.20360
O. 0.13551
23
0.00460
0.00065
5.00708
0.12180
27
0.00761
0.00509
6.05043
0.10942
30
0.00709
0.00074
6.85141
0.10098
E SIMULATION WITH VARYING SAMPLE SIZES
Supplemental to the results we have in Section we examine the effect of sample size n on performance. Here, repeat the same simulation for Hyperbolic space but fix the privacy budget j at 0.1 while varying the sample size E 10, 20..... 100. The results are provided in Figure 5
.
As the sample size only factors into the result via the computation of the sensitivity. The sensitivity for the sample Fréchet mean under Hadamard manifolds takes the form of A 2r/n and the rate parameter of the noises injected takes the form of = A/P μ 2r/(nu). Thus, one would expect and j to have the same effect on the result. Indeed. this is what is observed in Figure 5 which mirrors what we observed in Figure 2
Hyperbolic: d=3; mu=0.1
Hyperbolic; d=10; mu=0.1
Hyperbolic; d=15; mu=0.1
20
Riemannian distance
Riemannian distance
Rlemannian distance
EWG
EWG
EWG
RL
12
RL
15-
RL
10
4
100
25
75
100
Figure 5: Utility Comparison of EWG and RL Mechanisms on Hyperbolic space HTg. Blue lines with triangular symbols show the Riemannian distances d(z, &dd)), and the red line with circular symbols represent the Riemannian distances d(T, .ddp
F EXPERIMENT WITH VARYING FOOTPOINTS
Supplemental to the results have in Section 4 examine the effect of footpoint performance. Here, we repeat the same simulation for Hyperbolic space but we randomly select a point within BP,)(Po) the footpoint for each simulation. The results provided in Figure 6
Compare to the result in Figure 2 we observed the performance of EWG mechanism under randomly selected footpoint is slightly worser but still outperform the RI. mechanism.
24

---

Published as a conference paper at ICLR 2026
Hyperbolii;
Hyperbolic;
Hyperbolic; 15
2.5
Riemannian distance
Riemannian distance
Riemannian distance
EWG RL
EWG
EWG RL
RL
2
1-
0.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
Figure 6: Utility Comparison of EWG and RL Mechanisms on Hyperbolic space Hlg. Blue lines with triangular symbols show the Riemannian distances d( a...)) and the red line with circular symbols represent the Riemannian distances d(z, agdp
G SELECTING A DATA-DEPENDENT FOOTPOINT
Mentioned in 3.2 if there is no prior knowledge, might be worthwhile to spend part of the privacy budget select data-dependent footpoint Po- In the context of outputting sample fréchet mean, a natural candidate to use would be the extrinsic sample fréchet mean Eg, see [Bhattacharya and Patrangenaru (2003) Section 3) for details. The extrinsic frechet mean Fg is obtained by
1. Embedding the manifold M into ambient Euclidean space via the embedding j :M IR: j( ((x))....((()))
2. Compute the Euclidean mean of j(Xi),
(((,,) as j(x)
3. Project the mean j(x) back to j(M) via the projection P: P(j(x))
4. Lastly, map back to .M by reverse the embedding: Ee = j
To obtain a differentially private version of Tg, we can simply inject the Euclidean Gaussian noise
into j(x) to obtain j(x) adp via the Gaussian mechanism for GDP on Euclidean space. follows that
F = j -
is differential private by the post-processing property.
Note that this approach could extend to other M-statistics as long there exists Euclidean counterpart, which often the case in manifolds.
H COMPUTING RESOURCES
For simulations section 4.1 refer to simulation iimmllationnaaussiinn and spd. functi ions. for the affine invariant metric, s simula www.llaioonguussiio on.gaussian.ee. and spd_functi ons_le. for Log-Euclidean metric, and simulationn.aussiann... R and spd.functions.. for Log-Euclidean metric. Similarly,
and hyperbolic functions R are used for generating the results for hyperbolic space.
GDP-plot. R, GDP peootteeplot... R and GDP.lc.plot. R for generating the result plots in Figure I while as GDP.hyperbolic .lot. are for generating the result plots in Figure
For the computation time comparison, refer to GDP time plot.R.
timettiiitttmtt and
For the experiments OCTMNIST dataset in Section 4.2 refer to octmn sttddata...... for generat- ing covariance descriptors, octmnis wtw.uussstussss. inssssian an. R for simulation on the covariance descriptors, and cctmnist_GDD pplot. R for generating the result plots in Figure
The simulations were performed using R on a PC with 12th Gen Intel Core i5-1KK CPU with 32 GB of RAM running Windows 1.. Computation times for EWG and RL. mechanisms given in Table and Figure
25


Reviews:
[{"review_id": "qPDw71WJgI", "reviewer": "Reviewer_w921", "summary": "The paper introduces Exponential wrapped mechanism for DP on Hadamard manifolds. As these manifolds admit a global exponential map and Lipschitz log map, the Exponential wrapped mechanism draws noise in a Euclidean tangent space and push it forward to the manifolds via Exp. This allows efficient sampling Laplace, and Gaussian noise without MCMC.  They provide utility bounds and some simulation results.", "questions": "Can you provide a concrete DP mechanism for p_0 selection?", "limitations": "", "rating": 4, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The observation of using exponential map on Hadamard manifolds give us a clean geometry-aware DP mechanisms, and avoid MCMC burden.\n- The paper also provide results beyond pure DP (approximate DP, GDP, and RDP)", "weaknesses": "- The utility guarantees are weak on curved manifolds.  The bound for Frechet mean contains a error term that depends on the footprint $d(p_0, \\bar{x})$ which does not go to zero with the number of data $n$ unless $p_0 = \\bar{x}$.  Though the paper suggests privately estimating $p_0$, it does not provide a concrete DP procedure for selecting $p_0$.  \n\n\nMinor comment: \n- the definition of exponential wrapped mechanism can be clearer.  Is $\\eta$ in definition 1 the original output $f(D)$?\n- Should be footpoint or footprint?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UBAg6L0KuW", "reviewer": "Reviewer_bvfn", "summary": "In this paper the authors focus on wrapped distributions (distributions defined on tangent spaces and pushed onto the manifold via the exponential map) for Hadamard manifolds to achieve differential privacy.  The authors propose two mechanisms and show how they achieve a variety of DP definitions over many example manifolds. The insight of this paper in Theorem 3.1 shows how designation of the footprint of the mechanism directly effects the statistical utility.", "questions": "I am having a difficult time understanding the second half of Theorem 3.1. First, does $|Sec_{\\mathcal{M}}|$ refer to the determinant or norm of the sectional curvature? The added confusion here is that $K\\geq 0$ but this paper is about Hadamard manifolds which have non positive curvature.\n(The footnote is poorly placed, at first read the 2 looked like a power and hence $K^2$. Further the footnote itself uses $m$ rather than $\\mathcal{M}$)\nThis is further confusing in line 284 where $K$ is referred to as an upper bound. Perhaps we should have $K\\leq0$?\n\nI am not convinced Line 138 is correct \"our method only requires a rate of... across all manifolds.\" It seems the theory is limited to Hadamard manifolds, which clearly is not ALL manifolds.\n\nThe sampling section in the appendix should have exp as the second step not log, correct?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The authors are thorough on manifolds and SOTA definitions of privacy.\nThe authors focus on: \n-two mechanisms (Laplace and Gaussian) \n-SPDM manifold under three metrics (affine-invariant, log-Euclidean, Log-Cholesky) \n-Hyperbolic space manifold\n-three definitions of privacy ( $\\epsilon,\\delta$-DP, Gaussian DP, and Renyi DP).\n\nFurther the authors implement their methodology under varying dimension sizes.", "weaknesses": "A weakness is the lack of focus on varying sample sizes. While I understand that for a fixed sample size one can see how the dimension effects utility (Fig 1.) and hence, in a sense, verifies Theorem 3.1, some experiments on what happens as n increases would be useful.\n\nTheorem 3.1 also needs to be reworked. See questions below.\n\nThere are some typos here and there which should be fixed. For instance, many of the citation styles are incorrect in the opening paragraph.\n\nSometimes $p_0$ is called the footPOINT other times footPRINT. This is one example, but other notations are inconsistent", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9iDvy8ozUK", "reviewer": "Reviewer_Lgao", "summary": "The authors present a framework for achieving differential privacy with a summary taking values over Hadamard Manifolds (complete, connected Riemannian manifold with non-positive sectional curvature).  The authors achieve this by introducing the \"exponential wrapped mechanism\", which sanitizes the statistic on a tangent plane before mapping back to the manifold.  They demonstrate that this mechanism can be used to achieve basically any popular notion of DP (pure, approximate, gaussian, and renyi).  The authors provide an interesting theoretical analysis, bounding the noise injected for privacy.  In the case that the sectional curvature is bounded, they show that the noise scales like (1/n) which matches the results for Euclidean geometry.", "questions": "See weaknesses.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The results are timely as machine learning on manifolds and with privacy are both active fields.  The framework presented by the authors is fairly complete and the mathematical results are interesting.  Extensive numerical work is presented to highlight the strengths of the approach (both in terms of accuracy and computation).", "weaknesses": "The major weakness of the method is that a footpoint is required to implement the methodology and this footpoint is currently not data driven (for privacy reasons).  This is reasonable for a new method and acknowledged by the authors, but the paper suffers from not having any simulations showing how sensitive their mechanism is to the choice of footpoint (even in the appendix would suffice).  \n\nThe other weakness is the limit to non-positive curvature.  Though this is fairly common given how different manifolds are with non-positive and non-negative curvature.\n\nI don't view either of these weaknesses as fatal, though the first one would be fairly easy to address.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sHO861ugOz", "reviewer": "Reviewer_G5je", "summary": "The paper introduces \"Exponential-Wrapped\" mechanisms for achieving differential privacy on curved geometric spaces (Hadamard manifolds) like hyperbolic space and symmetric positive definite matrices used in medical imaging. Instead of using slow MCMC sampling like existing methods, they simply sample from distributions in flat tangent space and map them to the manifold using the exponential map. This approach is computationally efficient, works for multiple types of differential privacy (ε-DP, GDP, RDP), and achieves better utility-privacy tradeoffs than previous Riemannian privacy methods. They demonstrate strong performance on both synthetic and real-world data, particularly for high-dimensional medical imaging applications.", "questions": "NA", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) The paper tackles differential privacy for manifold-valued medical data (diffusion tensor imaging, OCT scans) where traditional Euclidean methods fail due to geometric incompatibility. This is increasingly important as healthcare AI systems require both geometric fidelity for accuracy and rigorous privacy guarantees for patient data protection.\n\n2) The EWG mechanism achieves runtime improvements of several orders of magnitude over existing MCMC-based methods, with the speedup increasing in higher dimensions. This makes differential privacy practically feasible for real-world medical imaging applications where previous methods were computationally prohibitive, especially in high-dimensional SPDM spaces.\n\n3) Comprehensive experiments span synthetic data on three different SPDM metrics and hyperbolic space, plus real-world OCTMNIST medical imaging data. The EWG mechanism consistently demonstrates superior utility across 100 Monte Carlo replications, multiple dimensions (d ∈ {3, 10, 15}), and wide privacy budget ranges, with particularly strong performance in high-dimensional regimes where it matters most.", "weaknesses": "1) Performance degrades on affine-invariant metric at low dimensions (d=3) with high privacy budgets due to footpoint misalignment; paper acknowledges this but provides no principled solution for choosing footpoint $p_{0}$\n\n2) Only tests mean estimation; no evaluation on other statistical tasks like principal geodesic analysis or regression despite these being mentioned as important applications", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)