Online Differentially Private Conformal Prediction for Uncertainty Quantification
Authors: Qiangqiang Zhang
Ting Li
Xinwei Feng
Xiaodong Yan
Jinhan Xie
Venue: ICML 2025 poster (2025)
Keywords: Conformal Prediction
Differential Privacy
Online Learning
Primary area: general_machine_learning->everything_else

Abstract: Traditional conformal prediction faces significant challenges with the rise of streaming data and increasing concerns over privacy. In this paper, we introduce a novel online differentially private conformal prediction framework, designed to construct dynamic, model-free private prediction sets. Unlike existing approaches that either disregard privacy or require full access to the entire dataset, our proposed method ensures individual privacy with a one-pass algorithm, ideal for real-time, privacy-preserving decision-making. Theoretically, we establish guarantees for long-run coverage at the nominal confidence level. Moreover, we extend our method to conformal quantile regression, which is fully adaptive to heteroscedasticity. We validate the effectiveness and applicability of the proposed method through comprehensive simulations and real-world studies on the ELEC2 and PAMAP2 datasets.

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Qiangqiang Zhang
Ting Li
Xinwei Feng'
Xiaodong Yan Jinhan Xie
Abstract
Despite its broad applicability, the deployment of CP, partic- ularly in domains that involve high-stakes decision-making, presents two significant challenges that must be addressed: 1. Data Streaming and Concept Drift: Data received as continuous streams, accompanied by concept drift, the phenomenon where data distributions change over time, which can make traditional CP models, which rely on the exchangeability assumption, less effective. 2. Data Privacy Concerns: In domains such as healthcare and financial risk management, applying CP is often hampered by strin- gent privacy regulations. These sectors demand methods to provide accurate uncertainty quantification without compro- mising individual data privacy. Addressing these challenges is essential for the broader applicability of CP in scenarios, especially when critical decisions are at stake and both data privacy and dynamic data environments must be taken into account.
Traditional conformal prediction faces significant challenges with the rise of streaming data and increasing concerns over privacy. In this paper. we introduce a novel online differentially private conformal prediction framework, designed to con- struct dynamic, model-free private prediction sets. Unlike existing approaches that either disregard privacy require full access to the entire dataset, our proposed method ensures individual privacy with a one-pas: pae-pass algorithm, ideal for real-time, privacy-preserving decision-making. Theoreti- cally, we establish guarantees for long-run cover- age at the nominal confidence level. Moreover, we extend our method conformal quantile regres- sion, which is fully adaptive to heteroscedasticity. We validate the effectiveness and applicability of the proposed method through comprehensive sim- ulations and real-world studies on the ELEC2 and PAMAP2 datasets.
In this paper, we introduce the online differentially private conformal prediction (ODPCP) framework, which leverages any pre-trained predictive model construct dynamic dif- ferentially private prediction sets. Our framework integrates differential privacy mechanisms to ensure rigorous privacy protection while maintaining the reliability and adaptability of conformal prediction methods. In particular, we consider scenario in which a data stream ((X,, Ya) is gen- erated by a dynamic process, allowing the distribution of (X,, Ye) evolve over time, At each time step t, our goal is to construct dynamic differentially private prediction set for the target value Y, using previously observed data {(x,, Y,)) )<e, and the newly observed covariates X,. Our main contributions can be summarized as follows.
1. Introduction
Conformal prediction (CP) is a powerful framework for quantifying predictive uncertainty in machine learning mod- els. The fundamental principles of CP, meticulously detailed by Vovk et al. (2005), provided a rigorous basis for the con- struction of reliable prediction intervals, establishing CP as the cornerstone of uncertainty quantification. Building on these theoretical foundations, Balasubramaniaa et al. (2014) explored practical adaptations of CP, showcasing its effec- tiveness in diverse real-world applications and highlighting its potential to improve decision making in various domains.
Online differentially private conformal prediction framework: This paper presents a novel online differ- entially private conformal prediction framework that utilizes any pre-trained model to dynamically generate private prediction sets. In contrast to existing methods, our approach guarantees rigorous privacy protection without requiring access to the entire dataset, making it well-suited for real-time, hewacc-preserving decision- making in online manner.
"qqual contribution 'Zhongtai Securities Institute for Financial Studies, Shandong University, Jinan, China "School Statistics and Data Science, Shanghai University of Finance and Economics, Shanghai, China 'School of Mathematics and Statistics. Xi' an Jiaotong University, Xi' an. China "Yunnan Key Laboratory of Sta- tistical Modeling and Data Analysis, Yunnan University, Kunming, China. Correspondence to: Jinhan Xie <jinhanxie@ ynu.cdu.en>.
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
One-pass algorithm: Our proposed framework is

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
efficient one-pass algorithm that generates private prediction sets without the need to re-access histori- cal data, thereby significantly reducing both time and space complexity.
Differential Privacy (DP) has become a cornerstone in safeguarding privacy across variety of sectors, including healthcare, information management, and government ser- vices; see Dankar & El Emam (2013); Wang & Tsai (2022), Prominent companies such as Google (Frlingsson et al., 2014), Microsoft (Ding et al., 2017), and the US Census Bureau (Garfinkel, 2022; Abowd, 2018) have adopted DP techniques to ensure the protection of individual privacy in large-scale systems. With the increasing global focus on pri- vacy, the development of DP algorithms has expanded into diverse tasks, including, but not limited to, deep learning, demand learning, and transfer learning; see (Abadi et al., 2016; Bu et al., 2020; Chen et al., 2022; Ponomareva et al., 2023; Li et al., 2024). More recent advancements in the extension of DP can be found in works such as (Li et al., 2021; De et al., 2022; Nasr al., 2023; Yang et al., 2024; Olabim al., 2024).
Online differentially private conformal quantile pre- diction framework: We extend our framework to conformal quantile regression (CQR), addressing het- eroscedasticity by effectively managing data with vary- ing levels of volatility. This extension improves both the accuracy and reliability of predictions in scenarios where the variability of data changes over time.
The structure of this paper is as follows: Section 2 reviews related work in this field. Section 3 introduces some key properties of differential privacy. In Section 4, we present the proposed online differentially private conformal pre- diction framework. Section extends our framework to conformal quantile regression, addressing heteroscedastic- ity. Finally, in Section 6, we evaluate the performance of our method through some experiments, including simulations and two real-world case studies.
The intersection of CP and DP has led to the development of privacy-preserviig prediction sets. Early work, such as that by Angelopoulos et al. (2022). introduced algorithms that integrated the exponential mechanism (McSherry Talwar, 2007) within the CP framework, ensuring privacy by obtain- ing private quantiles of non-conformity scores. Similarly, Humbert et al. (2023) extended this concept to one-shot fed- erated learning, leveraging the exponential mechanism to guarantee privacy in federated settings. Plassier et al. (2023) took a different approach by adding noise to the gradient in order to derive private quantiles and generate DP predic- tion sets. While these approaches effectively ensure privacy, they are not directly applicable online learning environ- ments, where the need for real-time updates and continuous adaptation of prediction sets presents unique challenges.
2. Related Work
CP has been widely extended address numerous chal- lenges, such as data distribution shifts and violations of ex- changeability (Lei & Candès, 2021; Fannjiang et al., 2022; Barber et al., 2023; Plassier et al., 2024). Notably, Romano et al. (2019) and Kiyani et al. (2024) enhanced the reliability of prediction sets by optimizing the length of prediction in- tervals. Further developments in federated learning settings have been introduced by Lu et al. (2023) and Humbert et al. (2023), while Gasparin & Ramdas (2024a) and Gasparin & Ramdas (2024b) focused on conformal model aggregation, proposing novel strategies for efficiently merging uncer- tainty sets. Additional advancements in CP are discussed in works such as Bai et al. (2022), Liang et al. (2024), Xie et al. (2024), and Zecchin et al. (2024).
3. Preliminary
In this section, we present basic concepts and some useful properties of DP.
Definition 3.1 (Oworkk et al., 2006)). Let X' be the sample space for an individual data, a randomized algorithm A x + R. is (c, di-fifferentially private if and only if for every pair of adjacent datasets X X' C X and for any measurable event E S R, the inequality below holds:
In recent years, significant advancements have been made in adapting CP frameworks online settings, driven by the growing prevalence of data streams. Gibbs & Candes (2021) were pioneers in integrating online convex optimization tech- niques with CP frameworks. Building on this, subsequent work, such as Feldman et al. (2022); Bhatnagar et al. (2023), extended CP to support online environments, enabling real- time updates and adaptive prediction sets. For a more com- prehensive overview of the latest developments in online CP, see, for example, (Angelopoulos et al., 2024b; Gibbs & Candès, 2024; Angelopoulos et al., 2024a). However, these methods generally lack built-in pereecccreeeeiigggg mecha- nisms, leaving sensitive data susceptible to potential leakage and thereby limiting their applicability in privacy-sensitivy contexts.
Pr(A(X) E E) S PP(A(X') E E) +
where we say that two datasets X = {ox) and X' In are adjacent if and only if they differ by one indi- vidual datum and the probability measure Pr is induced by the randomness of A only. When 5 = 0, then M is called pure eDP.
Specifically, when the dataset contains only a single data point, i.c., [X| = 1, the mechanism guarantees (c. -local differential privacy (LDP). This setting considers each data
2

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
point as separate dataset, offering privacy protection the individual level.
Lemma 3.5. (Dwork al., 2014)
1. Laplace Mechanism: Let h(X) E Rd be statistic of the dataset X, with a finite l li-ensiitiv (1 The Laplace mechanism adds noise to the output of as follows:
Definition 3.2 ((Xiong al., 2020)). A randomized algo- rithm A X' + R satisfies (e, 8)-DDDDP if and only if for any pair of input individual values r, r E X' and for every measurable event E' S R, the following inequality holds:
M(X) ((X)((()))))) +w:
Pr(A(x) E B) Se e" Pr(A(x') E E) 6
where each component Ui......o of Rd is independently drawn from the Laplace distribution Laplace(O. (0, (1(h)/e) The output of this mechanism M satisfies e-DP.
When 0, this reduces to pure e-LDP.
This property ensures that our framework offers privacy protection at the individual level, safeguarding sensitive information even when the data consists of just obser- vation. Many fundamental algorithms can be rendered DP by adding noise, appropriately scaled according to the al- gorithm's 's sensitivity. The formal definition of sensitivity is provided as follows:
2. Gaussian Mechanism: Let (xX) E Rd represent statistic derived from the dataset X, with ee-seniitivity (h).). The Gaussian mechanism operates by adding noise to the ousput of h in the following manner:
M(X) = h(X) +w
Definition 3.3 (lp-sensitivity). Let X" + Rd be query mapping. For fixed positive scalar p. the Ep-sensitivity of h is defined by (h) supx.x' adjjeeentt [[b(X) ((X)))
where each component Wiy..., We of EEE Rd drawn independently from the distribution N 2(2g(h) /)) (og(1.)/))) The ouiput of this mechanism M satisfies (c, ()6)).P.
3. p-GDP: Let hXX) E Rd be statistic computed from the dataset X, with ez-sensitivity 42(h). The Gaussian Differential Privacy (GDP) mechanism applies noise to h according to the following:
Building upon the concept of sensitivity, we next introduce Gaussian Differential Privacy (GDP), a more recent formu- lation that captures privacy guarantees through hypothesis testing between adjacent datasets.
Definition 3.4 (DDogg et al., 2022)). Let X' be the sample space and let A xm + R. be a randomized algorithm. For all adjacent datasets X, XX' X²", we say that A satisfies p- Gaussian Differential Privacy (abbreviated as p-GDP) the trade-off function between A(X) and A(X') is pointwise lower bounded by that of (0, 1) and (1, 1), that
M(X) = h(X) +
where each component wi,... Wd of w E Rd is in- dependently sampled from N (0, (A2(h)/H))) The output of this mechanism M satisfies p-GDP.
After presenting the concept of differential privacy and its underlying mechanisms, we now proceed to outline key results that demonstrate how privacy guarantees are preserved across various operations.
T (AA(X) (a) 2 (a), Ya E [0,
For any two probability distributions P and Q on the same measurable space, the trade-off function ((P, (P.QQ Q): [0, 1]
[0, is defined
Lemma 3.6. (Dwork al., 2006; 2010)
Post-processing property: Let 2) be a measurable space, and let A X + Y be an (e,8)-DP. If J Z is a measurable function, then the composition f f also (e, 5)-DP.
T(P.Q)(a):= inf [3p as S a).
where Φ: R + J0, 1] is measurable rejection rule, and 0s and 3& denote the type and type II errors, respectively. This function quantifies the minimum type II error achievable under level-o type I error constraint.
Sequential composition: Suppose there are mechanisms A; X Y Y i -,....,,, where each mecha- nism satisfies (Ei, 8:)-P. Then the combined mechanism A X + YYK, which maps æ to (A,(2)...,AA())) sat- isfies (Eiz Ci, Ex_ 8.)-DP. E.
The Gaussian trade-off function G₁. is given by
11) (a) = tb ( a) -1)
where ((-) is the standard normal CDF and क --1(-) is its inverse.
Parallel composition: Let A₁ X + iori l,..., be mechanisms that each satisfy (E,, 6.)-D. If the datasets I F1.... Iy E X are disjoint, then the combined mech- anism : x + Y which maps (I1,..., 2x) to (A (x1....... Ac(xx)), satisfies (max, 6, max; 5.)-
The following are commonly used mechanisms that enable the design of our proposed privacy-preservin algorithm.
3

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
4. Online differentially private conformal prediction
To ensure privacy, we define the privatized subgradient:
9. 9: + Z,, Z, ~ ii.d. noise.
(4)
Recall that CP constructs prediction regions based on ex- changeable data {(,,, Y and a pre-trained model f. The fundamental idea behind CP is to quantify prediction uncertainty through non-conformity scores S(X,Y) Y) =
This mechanism ensures that each update step satisfies dif- ferential privacy. A conventional approach would apply stochastic gradient descent (SGD):
Yy(X,Y,, which capture the discrepancy between obser- vations and model predictions (e.g., residuals in regression tasks prediction confidence in classification tasks). By computing quantile threshold from the calibration set, CP generates prediction regions that ensure the desired coverage probability, formally expressed as:
d = 4 11-a Th:9t:
(5)
but this requires manual tuning of the learning rate T/t which becomes especially problematic in the presence of noise, as introduced by Gr- The noise can amplify instability, de- grade convergence speed, and complicate hyperparameter selection. To avoid these challenges, we draw inspiration from the coin-betting framework in parameter-free online convex optimization (Orabona & Pál, 2016; Cutkosky & Orabona, 2018; Podkopaev et al., 2024), which enables adaptive learning without manual tuning of step sizes.
P(Ynew E C(Xnew)) 21-a,
providing statistically valid characterization of model un- certainty, Here, a is the target nominal level, and (Xnew, Ynew) denotes the new observation.
Remark 4.1. Our framework incorporates various mech- anisms to ensure privacy protection. For instance, we can add noise to the gradients in the follow- ing ways: 1. Laplace mechanism: 2, Laplace(0, A (0L)))/Ee); 2. Gaussian mechanism: 2, ~ N(0, (8l)_))/)))) (og.))/)))1/11112 (og(1.25/)))); 3. PDGGDP Z, ((, (A2(861-))/11) From the above-perturbed formula in (4), we observe that each individual has the flexibility to customize its privacy budget. A special case happens when we use a uniform privacy budget without considering different privacy budgets for each individual. Throughout this paper, we refer to our algorithm as DP. Nonetheless, its implementation aligns with the principles of LDP, as privacy is enforced via local perturbation at each step rather than through a centralized mechanism.
However, when applied to data streams ((,,, Y)) the traditional CP framework faces several challenges. First, temporal distribution shifts undermine the exchangeability assumption, which is vital for maintaining valid coverage. Second, static calibration methods fail to adapt to the dy- namic nature of evolving data patterns. Third, the batch quantile computation required by CP becomes computation- ally expensive and impractical for real-time applications. In addition to these technical challenges, privacy concerns have become increasingly critical in modern applications such healthcare and finance.
To address these challenges, we propose the ODPCP frame- work. ODPCP dynamically constructs prediction sets that adapt to streaming data while ensuring formal differential privacy guarantees. In contrast to conventional methods, our framework enforces privacy by perturbing the quantile esti- mation process itself. Specifically, we estimate the (1 a)- quantile of non-conformity scores {S.] using subgradient- based updates, injecting noise into each subgradient to en- sure differential privacy.
This parameter-free and robust approach reformulates the learning process as repeated betting game. In this frame- work, a bettor wagers a fraction A of their current wealth W on an outcome G,, which may be adversarially se- lected. Starting from an initial endowment Wo > O, the cu- mulative wealth evolves as Wr Wo A,W;-1G. In our setup, integrate this framework with privatized quan- tile estimation, we define the feedback signal as q == -9. where 9. denotes the privatized subgradient. We then em- ploy the Krichevsky-Trofimg (KT) estimator (Krichevsky & Trofimov, 1981), which sets the betting fraction as A = Σ'= G/t = - Σ'= ge/t. The signed bet w/ := WW serves as the current estimate of the privatized (1 a)- quantile, denoted q! !a
At each time step 4, we estimate the (1 - qu--uuntile di al of the non con-oonfyryyty scores S, by minimizing the pinball loss:
(1) (1(9 2 5.) - -(1 (1)) (t) (1)
which has Lipschitz constant L = maxfa, 1 - a}. The corresponding subdifferential is:
1[S, S 9) -1 a), 9 St
In this setup, we introduce two crucial parameters: the cumu- lative wealth W, and the betting ratio Xe, both of which are adaptively adjusted to balance exploration and cxploitation throughout the process. Our proposed algorithm eliminates the need for manual hyperparameter tuning by automatically adjusting these two parameters, while also integrating DP
St)
(2)
( 1,a]. 1,a],
q = St
This yields a subgradient update:
ge dl1-a Si) g=
(3)
4

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Algorithm 1 Online private conformal prediction set
Algorithm 2 Online differentially private quantile
Input: Data (Xe, t = .. Prediction model
Input: Privacy budget parameter ct > 0; Miscoverage
f()); Privacy budget parameters 6, > 0; a E (0, 1); Constant с > 0; Si > 0
level a E (0, 1); St-1i
// Initialize parameters (only used the first call, i.e.,
for t = 2,3.... do
when t = 2)
Estimate the privatized quantile:
Initialize: Wo = 1, \1 = 0, 9 =0
0 < Algorithm 2(4 at c))
Compute 9t-1 E ali-a(g. St-1) 1=000 as per Equa-
Predict and compute the non-conformity score S,
tion (2)
S Yi).
Perturb the gradient: -t-1 = -h 2 where 2,-1 is the random noise according to different DP mechanisms Update Wi-1:
end for
Output:
Private prediction sets (x,,)) = (y = &
W (W,- -t- 11-1) Ve
Update de:
mechanisms. This design ensures both statistical validity and privacy protection of the quantile estimates, allowing the method to efficiently navigate the trade-off between ex- ploration and exploitation, while maintaining privacy guar- antees.
t-
1
d M-1 7 90-1
Update -
at-a = dx We
Save updated state: W de, 9 aa
To ensure stability in the learning process under the influ- ence of noise, we introduce constant as a lower bound for the parameter W,. This lower bound prevents W; from becoming too small or negative due to noise perturbations, which are particularly impactful during the early iterations. By enforcing this constraint, we facilitate a smooth initial- ization phase, mitigate the disruptive effects of noise, and ultimately support the reliable convergence of the algorithm.
function becomes DP. To assess the impact of this, we compare the algorithm's performance using both non- private and DP-trained base models. The corresponding results are reported in Appendix C.1.2 and Appendix C.2.3.
Theorem 4.4. After t updates, Algorithm 1 satis- fies maxigişı C--DP, (maxisjst() Cj, maxigj5t 5; DDP, or maxigiş: MD-GDP, depending on the privacy mechanism used, where 2 1.
Remark 4.2. We conduct a sensitivity analysis for the pro- posed framework regarding the constant c. As shown in Figure 1, we observe that, as c increases, the coverage rate stabilizes, while the interval length grows more rapidly. For smaller values of e, increasing e results in a moderate widening of the interval and an improvement in coverage, enhancing the practical effectiveness of the prediction set. However, for larger values of further increases in interval length yield diminishing returns in terms of coverage im- provement, and may even reduce the information content of the interval. Based on these findings, we recommend choosing within the range of 30 to 50, as this range strikes trade-off balance between improving coverage and main- taining the interval's informational value.
This theorem rigorously establishes the privacy guarantees of Algorithm 1 under different DP mechanisms. Our exper- imental results align well with the theoretical guarantees stated in Theorem 4.4, as demonstrated in Appendix C.2.6.
Theorem 4.5. Let the target miscoverage level be fixed at a E 1/2). Assume that the non-conformity scores are bounded, such that St E [0, for for all 1.2...., where D > 0 is finite constant. Then, the proposed procedure described in Algorithm satisfies the following long-run coverage guarantee:
We present the pseudocode of our proposed method in Al- gorithms 1-2. Algorithm/ computes the non-conformity scores, while Algorithm 2 dynamically updates the quantile estimates in a privacy-preservee gorithms ensure that the conformal prediction sets maintain valid coverage guarantees under differential privacy. The fi- nal output is a private prediction set C,(X.) that effectively balances privacy protection and predictive reliability.
lim T-000
1 T
Σ
I Ty ((xi)) (1 a) = 0. (6)
t=1
manner. Together, these al-
Theorem 4.5 establishes that the proposed method ensures valid long-run coverage guarantees, regardless of the under- lying predictive model and whether privacy constraints are present. However, privately trained models often suffer re- duced predictive accuracy due to injected noise. Additional results in Appendix C. 1.2 and Appendix C.2.3 show that
Remark 4.3. When the predictive model is trained with DP, the entire pipeline- from the data to the prediction set
5

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
We continue to compute It using d61-a St), preserving the iterative structure of the algorithm. This approach dy- namically adjusts the length of the prediction interval based on the behavior of the non non-conformity score S.. When St is less than / - there are two possible cases: If S, is negative, it indicates that the observed value Y, falls within the prediction interval C, If S, is positive, it suggests that Y, lies either to the left of 9a.. (Xx) or to the right of Lay (Xt), but the distance between Y, and the nearest end- point of the interval remains less than a2-aa In both cases, it follows that Y, E (x,). Consequently, the value of gr. will be positive, and the prediction interval will be moder- ately reduced. Conversely, when St exceeds q. al-a Y, lies outside the prediction interval, either to the left of go.. (X.) or to the right of qan. (X.). This implies that the distance between Y2 and the nearest endpoint exceeds qf - meaning Yi & (X,).. In this case, the value of 9, will be negative, and the algorithm will appropriately expand the interval width.
width
WARI
8.0
Crodae Muss
Cestage
Colecape
333
100
to to
Gaverape Mi
Figure 1. Sensitivity analysis of different values of e on the cover- age rale and interval length under the μ-GDP setting. The constant e is varied from to 200 in steps of 2. For clarity, the results presented here are based on the Setting dataset. The figures are arranged from left to right, corresponding to Case through Case 6. Each simulation is run for T 10,000 time steps.
This process allows our algorithm to adapt the length of the prediction interval in real-time, ensuring that it is both accu- rate and efficient. By dynamically adjusting the prediction set based on the behavior of S,, the algorithm maintains its reliability and convergence, even in the presence of evolv- ing data streams. This ensures that our method can provide correct predictions while simultaneously preserving privacy guarantees, making it suitable for applications in dynamic and privacy- environments. The details of this algo- rithm can be summarized in Algorithm in the Appendix.
such models typically yield larger non-conformity scores, leading to wider prediction intervals.
5. Online differentially private conformal quantile regression
In this section, we extend our framework to incorporate CQR (Romano et al., 2019), enabling our method to effec- tively address heteroscedasticity and improve its adaptability to varying data volatility.
6. Experiments
To begin, we recall the concept of the conditional distribu- tion function, F = x), which represents the probability that Y is less than or equal to a certain value y given that X = x. The corresponding a-th conditional quantile func- tion is denoted as (x). To construct the prediction set, we define two quantiles: Cg = a/2 and Otii 1 a/2, where (0, 1) represents the miscoverage level. The prediction
In this section, we present an empirical evaluation of our proposed method, comparing its performance with a non- private baseline (Podkopaev et al., 2024), referred to as "Original". This experimental setup consists of two com- ponents. First, we conduct simulations on synthetic data to evaluate the performance of the proposed method. Second, we assess the method's ''s effectiveness on real-world datasets.
interval is then given follows:
Notice that the main contribution of this paper is the de- velopment of privacy-preserve method based on the conformal prediction framework. Our focus is on how to incorporate privacy protection into the conformal prediction setting, rather than on designing training the private pre- dictor itself. Therefore, in the subsequent experiments, we do not treat the private predictor allowing us to isolate and highlight the core functionality of the proposed method. For conciseness, the main text focuses on the results obtained using the p-GDP mechanism (via Gaussian noise), while the results of using cDP with Laplace noise, as well as detailed experiments on setting I and the ELEC2 dataset, are provided in the Appendix.
C( = [Qon Jon (+)]
We estimate dow, (x) and aon (x) using quantile regression and the non-conforyy score here is defined as
S. = max (X.) Y,, Y. Jo (X.))
necessary condition,
for each time point f, which captures the discrepancy be- tween the observed target value and the predicted quantiles, reflecting how far the observation deviates from the expected range. Using this non-confornity score, the prediction in- terval for Yú at time t is constructed as:
(x,))) = [ at al "mn (X.) + 1b -9..
6

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
6.1. Simulations
Table I. Long- Run Coverage Σx= IYY, Cx.)) and the standard deviation (scaled by a factor of 1,000), are reported for the Setting 2 dataset with μ-GDP, averaged over 200 independent trials To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 100 data points excluded from the analysis. C represents cases and M represents methods.
We evaluate performance via the following two data genera- tion settings:
Setting 1: We generate N = 100 samples (X,, Yi),
Y = X B Et: 8
and consider two cases:
C/M
Original
J ==
F ==1 1
J = 0.5
1/CP
0.889 (0.29)
0.886 (5.3)
0.874 (10)
0.850 (19)
iid ~ (O) idd ~ 1);
1/CQR
0.890 (1.2)
0.895 (4.5)
0.895 (8.9)
0.895 (18)
Case 1: Xx
2/CP
0.888 (0.28)
0.886 (4.7)
0.874 (9.4)
0.841 (17)
Case 2: X2 iid (0, Σ), where Eng- = 0.5 1).
idd
2/CQR
0.891 (1.4)
0.895 (4.4)
0.895 (8.4)
0.896 (17)
Et
3/CP
0.889 (0.32)
0.887 (5.3)
0.874 (10)
0.846 (18)
3/CQR
0.892 (1.6)
0.897 (4.4)
0.897 (8.6)
0.898 (17)
Setting 2: Similar to Setting 1, where the coefficients ((1)
4/CP
0.888 (0.33)
0.886 (5.2)
0.872 (10)
0.834 (18)
change at /. = 2500 and / = 7500:
4/CQR
0.893 (1.5)
0.896 (4.4)
0.895 (8.3)
0.895 (17)
(112500)) (1,0.5,1,0,0)
S/CP 0.889 (0.37)
0.886 (5.3)
0.874 (10)
0.848 (18)
S/CQR
0.892 (1.7)
0.896 (4.2)
0.896 (8.2)
0.898 (17)
8 (5501 =
-1,0)
6/CP
0.888 (0.35)
0.886 (4.9)
0.874 (9.6)
0.839 (17)
((7501:10000) = 00,0,
6/CQR
0.891 (1.8)
0.895 (4.2)
0.895 (8.0)
0.895 (16)
We also consider the following cases:
coverage rates and appropriately scaled prediction interval lengths, underscoring their adaptability and effectiveness in tackling complex structures. These results highlight the ro- bustness of both algorithms in providing privacy-preservin reliable prediction intervals under challenging conditions.
Case 1: X2 iid ~ 15), Et id 100,
Case 2: X, lid (0, Σ), where Σng = 0.5li-51, udd NV 1);
~
iid ~ t(3); Case 3: X, ~ I(0,
iid
Figure 2 and Figure 14 illustrate that the trends of the pro- posed private algorithms closely mirror those of the Origi- nal algorithm. Specifically, when the privacy parameter μ is large (indicating weaker privacy protection), the perfor- mance of the private algorithms becomes nearly indistin- guishable from that of the Original algorithm, with coverage rates and prediction interval lengths aligning closely. This suggests that as the noise introduced by the privacy mecha- nism diminishes, its effect on the algorithm's 's performance becomes negligible. Even with stronger privacy protection (c.g., μ = 0.5), the private algorithms maintain a similar trend to the Original algorithm, albeit with greater variabil- ity in coverage and interval width, indicating that balance between privacy and prediction accuracy is being struck. Meanwhile, at changepoints, both the coverage rates and prediction interval lengths experience significant fluctua- tions, with coverage rates sharply decreasing and interval lengths expanding considerably. Despite these disruptions, both algorithms promptly stabilize, demonstrating their re- silience. As the value of μ decreases (indicating stronger pri- vacy protection), the coverage rates of our proposed method decrease, and the prediction interval lengths become larger, accompanied by more pronounced fluctuations. This un- derscores the growing effect of noise on the algorithm's stability as the level of privacy protection increases.
üdd Case 4: X, id (0, E), where Σnj = 0.5le-51, Ee t(3);
uid Case 5: X1 ~ NN(0, (5), & = =X Gr. where Ce ~
iid
N(0, 1);
Case 6: X, iid
~ (0, E), where Mn = 0.5li-J1, ez =
x2 Go where G. ~ 1).
ud
These cases are designed to systematically evaluate the ro-
bustness of our method along three key dimensions: (i)
covariate structure (independent vs. correlated designs), (ii) noise distribution (Gaussian, heavy-tailed, and heteroscedas- tic), and (ii) temporal dynamics (static vs. time-varying coefficients). Setting corresponds to a static environment with fixed regression coefficients, while Setting introduces changepoints to emulate dynamic, nonstationary conditions. This design ensures a comprehensive and realistic assess- ment of our method under wide range of practical scenar- ios.
As shown in Tables 1-2 and Figure 2 and Figure 14, both the proposed ODPCP method and ODPCQR demonstrate con- sistent and reliable performance across the six different sim- ulated scenarios. Specifically, both methods exhibit stable
In scenarios characterized by high noise and strong privacy
7

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table Long-Run Width and standard deviation (scaled by 10)
Coverage =
are reported for the Setting 2 dataset with μ JDGDP, consistent with
Width
Table
C/M
Original
J4 ==
J =1
J. = 0.5
I/CP
5.18 (0.45)
5.23 (0.95)
5.46 (2.5)
7.69 (23)
Time
Time
I/CQR
5.11 (0.46)
5.18 (0.85)
5.25 (1.7)
5.90 (12)
2/CP
6.49 (0.60)
6.56 (1.1)
6.84 (3.1)
9.68 (33)
Coverage
2/CQR
6.39 (0.68)
6.48 (1.0)
6,55 (1.9)
7.24 (13)
Width
3/C
6.22 (0.60)
6.32 (1.4)
6.67 (3.8)
9.93 (40)
MCQR
6.22 (0.72)
6,33(1.3)
6.42 (2.4)
7.08 (10)
4/CP
7.45 (0.77)
7.53 (1.5)
7.88 (3.8)
11.48 (58)
Time
Tima
4/CQR
7.40 (0.79)
7,48 (1.3)
7.55 (2.4)
8.28 (27)
S/CP
5.81 (0.87)
(1.8)
6,21 (4.5)
8.95 (61)
Coverage
S/CQR
5.85 (1.1)
5.96 (1.6)
6.05 (2.8)
7.08 (10)
Width
6/CP
7.04 (0.87)
(1.9)
7.47 (4.6)
10.26 (30)
6/CQR
(1.1)
(1.6)
7.24 (2.9)
7.86 (9.8)
Time
Time
protection, the proposed ODPCQR demonstrates superior performance compared to ODPCP, exhibiting both higher coverage rates and shorter prediction intervals. This indi- cates that ODPCQR is more adaptable to changes in p. No- tably, the coverage rates of the proposed ODPCQR between the two changepoints slightly exceed the target coverage rate of 0.9. Furthermore, its coverage even surpasses that of the non-private algorithm. This improvement can be at- tributed the compensatory effect of the larger prediction intervals induced by the added noise, which helps to ensure better coverage. In conclusion, the simulation results affirm that both algorithms deliver consistent and reliable perfor- mance in the complex data environment of Setting 2. They exhibit remarkable adaptability and robustness, effectively handling a variety of challenging scenarios. These outcomes highlight the capacity of the proposed methods to maintain performance even under conditions of data variability and noise.
Original
u=2
u=1
p=0.5
CQR
CQR-
CQR-u=1
CQR-
Figure 2. Simulation results for Setting (Cases 1, 3, and 5, top to bottom) with μ-GDP: The mean prediction interval coverage and width our proposed algorithms and the Original algorithm computed over 200 independent trials. For stability, the first 200 time points are excluded from the analysis, and the displayed curves smoothed using rolling average with window size of 50 time points.
with data recorded from three inertial measurement units (IMUs) placed on the wrist, chest, and ankle, as well as heart rate (HR) monitoring data. For the analysis, we focus the heart rate data from subject 102 as the target response variable. Heart rate is a highly individualized physiological signal that reflects an individual' 's health status and activity levels, making it particularly sensitive and critical in health- related contexts. Consequently, safeguarding the privacy of such data is essential for real-world applications.
Moreover, our methods exhibit negligible sensitivity to the choice of initial parameters (A1, Wo), as demonstrated in Figure 16, where the coverage and interval width curves under different initializations are nearly indistinguishable. In addition, we compare our method with an offline private baseline-Privann Prediction Sets (DPCP) (Angelopoulos et al., 2022). As shown in Table 11. both methods achieve comparable coverage. However, ODPCP produces signifi- cantly narrower prediction sets, highlighting its efficiency in the online setting under privacy constraints.
We refer to our prediction strategy as adaptive lagged fea- ture regression (ALFR), where regression model is re- trained at each time step using recent history of lagged features to capture short-term temporal dependencies. In our implementation, we instantiate AL.RR using a third-order autoregressive (AR(3)) model, following the setup of An- gelopoulos et al. (2023). This design allows the model to adapt to ota-stationary physiological signals.
In terms of coverage, we observe that the rolling coverage of our proposed algorithm improves as the privacy protec- tion parameter μ decreases. Specifically, when μ = 1, the rolling coverage exhibits the highest volatility, while the ODPCP variant without privacy noise achieves minimal volatility and stabilizes around the target confidence level
6.2. PAMAP2 physical activity monitoring dataset
In this subsection, we assess the performance of the pro- posed method using the PAMAP2 physical activity moni- toring dataset (Reiss, 2012). This dataset includes measure- ments from subjects engaged in various physical activities,
8

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Rolling Coverage
150
Rolling Width
Heart Rate
160
140
Mea 2000 Time
Time
1060 4383
120
by han Amw
100
Longeun Coverage
Long-run Width
80
5000
10000 15000 20000 25000 30000 35000 40000
0.00
Time
Figure 4. The trend of heart rate variation
2009
2006
3000 Time
Time
understanding of the resulting prediction intervals for heart rate, we include a visualization in Figure 21. Additional classification results on the PAMAP2 dataset are provided in Appendix C.4 to further demonstrate the versatility of our method.
Original
Non-private
Jr 2
p 1
Figure 3. PAMAP2 dataset:
The upper panel displays the rolling coverage and rolling width, each averaged over rolling window of 200 time points. The lower panel shows the long-run cover- age, Σnn I(Y, (x.))) TT and the long-run interval width, both averaged over 200 repetitions. For stability, the first 2000 time points are excluded from the analysis. The displayed curves are smoothed using rolling average with window size of 50 time points. "Non-private" refers to the version of our proposed ODPCP algorithm without privacy noise.
7. Conclusion
In this paper, we introduced the online differentially private conformal prediction framework, which is designed to gen- erate dynamic, model-free private prediction sets while en- suring robust privacy guarantees. Our approach operates as one-pass algorithm, which eliminates the need for storing or re-accessing historical data, making it particularly well- suited for real-time, privacy-sensitee applications. More- over, we extended our framework to incorporate conformal quantile regression, enabling the construction of adaptive prediction intervals in heteroscedastic settings. To assess the effectiveness of our proposed framework, we conducted extensive experiments, including both simulations and real- world case studies using the ELEC2 and PAMAP2 datasets.
1 0.9. In contrast, the rolling coverage of the Original algorithm shows four distinct drops: the first two reduce coverage to approximately 0.3, while the subsequent two drops lower it to around 0.7. These fluctuations are closely associated with sudden changes in the data, as de- picted in Figure 4, where sharp shifts at corresponding time points lead the failure of the Original algorithm to adjust promptly, causing sharp decline in coverage. However, the magnitude of the latter two drops is notably smaller than the first two, as the algorithm becomes more stable over time and better accommodates abrupt changes in the data. In comparison, our proposed method incorporates a truncation parameter c, which helps to stabilize coverage during data shifts. In terms of long-rur -rm coverage, all methods eventually converge similar levels, indicating comparable steady- state performance.
The results showed that our method provides reliable predic- tion set coverage, while effectively preserving privacy, even in the face of data distribution shifts and evolving patterns over time.
Acknowledgements
We sincerely thank the anonymous reviewers and area chairs for their valuable feedback and constructive sug- gestions, which significantly improved the quality of this work. Qiangqiang Zhang and Xinwei Feng were sup- ported by the National Key R&D Program of China (No. 2023YFA 1008701) and the National Natural Science Foun- dation of China (Grant Nos. 12371148, 12326603, and 12431017). Ting Li's research was partially supported by the Shanghai Pujiang Programme (No. 24PJC030), CCF. DiDi GAIA Collaborative Research Funds and the Pro- gram for Innovative Research Team of Shanghai University of Finance and Economics. Xiaodong Yan was also sup- ported by the National Key R&D Program of China (No. 2023 1008701) and the National Natural Science Foun-
Regarding interval width, the Original algorithm outper- forms our proposed algorithm, with the rolling interval width exhibiting the highest stability, and the long-run inter- val width ultimately converging to the smallest value. On the PAMAP2 dataset, our algorithm follows a similar trend as observed in previous datasets: the perturbation intro- duced by the privacy mechanism significantly increases the volatility of the interval width, resulting in larger long-run interval width. This indicates that, while the privacy protec- tion mechanism enhances the stability of coverage, it comes at the cost of wider prediction intervals, thereby reducing the precision of the predictions. To provide a more intuitive

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
dation of China (No. 12371292). Jinhan Xie's research was funded by the National Key R&D Program of China (No. 102022YFA1003701),
Balasubramanian, V., Ho, S.-S., and Vovk, V. Conformal prediction for reliable machine learning: theory, adapta- tions and applications. Newnes, 2014.
Barber, R. E., Candes, E. J., Ramdas, A., and Tibshirani,
Impact Statement
J. Conformal prediction beyond exchangeability. The Annals of Statistics, 5 (1255816-845, 2023.
This paper presents a novel methodological framework that advances the field of machine learning, with a particular focus on antvacy-preserving prediction techniques. By ad- dressing key challenges in online private conformal predic- tion, this work contributes to the development of models that are not only more robust and interpretable but also pri- oritize privacy. The primary objective of this research to make significant strides machine learning a principled, responsible manner, ensuring that privacy considerations deeply integrated into predictive modeling. While the societal implications of this work are considerable, be- lieve these are inherently tied to the broader objective of promoting privacy and fairess in machine learning systems, and thus, do not need to be explicitly highlighted in this context.
Bhatnagar, A., Wang, H., Xiong, C., and Bai, Y. Improved
online conformal prediction via strongly adaptive online learning. In International Conference Machine Learn- ing. pp. 2337-2363. PMLR, 2023.
Bu, Z., Dong, J., Long, Q. and Su, W. Deep learning with gaussian differential privacy, Harvard data science review, 2020(23), 2020.
Chen, X., Simchi-Levi D., and Wang. Y. Privacy-preserving dynamic personalized pricing with demand learning. Management Science, 68(7):4878-4898, 2022.
Cutkosky, A. and Orabona, F. Black- reductions for parameter-fiee online learning in banach spaces. In Con- ference On Learning Theory, pp. 1493-1529, PMLR, 2018.
References
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Dankar, F. K. and El Emam, K. Practicing differential privacy health care: review. Trans. Data Priv. 6(1): 35 65- 2013.
De. S., Berrada, L., Hayes, J., Smith, S. L., and Balle, B. Un- locking high-accuracy differentially private image classi- fication through scale. arXiv preprint arXiv:2204. 1144.13650 13650, 2022.
Abowd, J. M. The us census bureau adopts differential privacy. In Proceedings of the 24th ACM SIGKDD In- ternational Conference Knowledge Discovery & Data Mining, pp. 2867-2867, 2018.
Ding, B., Kulkarni, J., and Yekhanin, S. Collecting telemetry data privately. Advances in Neural Information Process- ing Systems, 30, 2017.
Angelopoulos, A., Candes, E.,, and Tibshirani, R. Confor- mal pid control for time series prediction. Advances in neural information processing systems, 36:23047-23074 2023.
Dong, J., Roth, A., and Su, W. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84(1):3-37, 2022.
Angelopoulos, A., Candes, E.,, and Tibshirani, R. Confor- mal pid control for time series prediction. Advances in neural information processing systems, 36, 2024a.
Dwork, C., McSherry, F., Nissim, K., and Smith, A. Cal- ibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3, pp. 265-284. Springer, 2006.
Angelopoulos, A. N., Bates, S., Zmic, T., and Jordan, M. Private prediction sets. Harvard Data Science Review, (2), 2022.
Dwork, C., Rothblum, G. N., and Vadhan, S. Boosting and differential privacy. In 2010 IEEE 51st annual symposium on foundations of computer science, pp. 51-60. IEEE, 2010.
Angelopoulos, A. N., Barber, R. F., and Bates, S. Online conformal prediction with decaying step sizes. arXiv preprint arXiv:2402.01139, 2024b.
Bai, Y., Mei, S., Wang. H., Zhou, Y., and Xiong, C. Effi cient and differentiable conformal prediction with general function classes. arXiv preprint arXiv:2202.1 1091, 2022.
Dwork, C., Roth, A., et al. The algorithmic foundations of differential privacy. Foundations and Trends@ in Theo- retical Computer Science, 9(3-4)221 1-407, 2014.
10

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Brlingsson, Ú. Pihur, V., and Korolova, A. Rappor:
Li, X., Tramer, F,, Liang, P., and Hashimoto, T. Large lan- guage models be strong differentially private learners. arXiv preprint
Randomized aggregatable wewaacy-preseviing ordinal re- sponse. In Proceedings of the 2014 ACM SIGSAC Con- ference on Computer and Communications Security. pp. 1054-1067, 2014.
2021.
Liang, R., Zhu, W., and Barber, R. Conformal prediction after efficiency-orienteed model selection. arXiv preprint 2024.
Fannjiang, C., Bates, S., Angelopoulos, A. N., Listgarten, J., and Jordan, M. I. Conformal prediction under feedback covariate shift for biomolecular design. Proceedings of the National Academy of Sciences, (19(44)):22244561119 2022.
Lu, C., Yu, Y., Karimireddy, S. Jordan, M., and Raskar, Federated conformal predictors for distributed uncertainty quantification. In International Conference on Machine Learning, pp. 22942-22964. PMLR, 2023.
Feldman, S., Ringel, L.. Bates, S., and Romano, Y. Achiev- ing risk control in online learning settings. arXiv preprint arXiv:2205.09092 2022.
McSherry, F. and Talwar, K. Mechanism design via dif- ferential privacy. 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS007, pp. 94 103. IEEE, 2007.
Garfinkel, S. Differential privacy and the 2020 us census. 2022.
Nasr, M., Hayes, J., Steinke, T., Balle, B., Tramèr, F., Jagiel- ski. M., Carlini, N., and Terzis, A. Tight auditing of differentially private machine learning. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 1631- 1648, 2023.
Gasparin, M. and Ramdas, A. Conformal online model aggregation. arXiv preprint arXiv:2403. 2024a.
Gasparin, M. and Ramdas, A. Merging uncertainty sets via majority vote. arXiv preprini arXiv:2401.093377 2024b.
Olabim, M., Greenfield, A., and Barlow, A. A differen- tial privacy-based approach for mitigating data theft in ransomware attacks. Authorea Preprints, 2024.
Gibbs, I. and Candes, E. Adaptive conformal inference under distribution shift. Advances in Neural Information Processing Systems, 34: 54:1660-1672, 2021.
Orabona, F. and Pál, D. Coin betting and parameter-free on- line learning. Advances in Neural Information Processing Systems, 29, 2016.
Gibbs, I. and Candès, J. Conformal inference for online prediction with arbitrary distribution shifts. Journal of Machine Learning Research, 25(162):1-36 2024.
Plassier, V., Makni, M., Rubashevski,, A., Moulines, E., and Panov, M. Conformal prediction for federated uncertainty quantification under label shift. In International Confer- ence on Machine Learning, pp. 27907-27947. PMLR, 2023.
Harries, M. Splice-2 comparative evaluation: Electricity pricing. Technical report, University of New South Wales, School of Computer Science and Engineering, Sydney, 1999. Accessed: 09 January 2025.
Humbert, P., Le Bars, B., Bellet, A., and Arlot, S. One-shot federated conformal prediction. In International Confer- ence on Machine Learning, pp. 14153-14177. PMLR, 2023.
Plassier, V., Kotelevskii, N., Rubashevskii, A., Noskov, F,, Velikanov, M., Fishkov, A., Horvath, S., Takac, M., Moulines, E., and Panov, M. Efficient conformal predic- tion under data heterogeneity. In International Confer- ence on Artificial Intelligence and Statisties, pp. 4879 4887. PMLR, 2024.
Kiyani, S., Pappas, G. J., and Hassani, H. Length opti- mization conformal prediction. Advances in Neural Information Processing Systems, 9, 2024.
Podkopaev, A., Xu, D., and Lee, k.-c. Adaptive conformal inference by betting. arXiv preprint arXiv:2412.1931 19318. 2024.
Krichevsky, R. and Trofimov, The performance of univer- sal encoding. IEEE Transactions on Information Theory, 1992):199-207, 1981.
Ponomareva, N., Hazimeh, H., Kurakin, A., Xu, Z., Denison, C., McMahan, H. B., Vassilvitskii, S., Chien, S., and Thakurta, A. G. How to dp-fy ml: practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research, 77:1113-1200 2023.
Lei, L. and Candès, E. J. Conformal inference of counter- factuals and individual treatment effects. Journal of the Royal Statistical Society Series B: Statistical Methodol- ogy, 83(5):911 1-918, 2021.
Li, M., Tian, Y., Feng. Y., and Yu, Y. Federated trans- fer learning with differential privacy. arXiv preprint arXiv:2403. 11343, 2024.
Reiss, A. PAMAP2 Physical Activity Monitoring.
UCI Machine Learning Repository, 2012. DOI: http:///bb..rg/112244221CC

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Romano, Y., Patterson, E., and Candes, E. Conformalized quantile regression. Advances in Neural Information Processing Systems, 32, 2019.
Vovk, V., Gammerman, A., and Shafer, G. Algorithmic Learning Random World. Springer US, 2005. ISBN 5780387001524.
Wang, Y.-R. and Tsai, Y.C. The protection data sharing for privacy in financial vision. Applied Sciences, 12(15):
7408, 2022.
Xie, R., Barber, R., and Candes, E. Boosted conformal prediction intervals. Advances in Neural Information Processing Systems,
2024.
Xiong, X., Liu, S., Li, D., Cai, Z., and Niu, X. A compre- hensive survey on local differential privacy. Security and Communication Networks, 2020(1 (1:882933,, 2020.
Yang, M., Guo, T., Zhu, T., Tjuawinata, I., Zhao, J., and Lam, K.-Y. Local differential privacy and its applica- tions: A comprehensive survey. Computer Standards & Interfaces, 89:103827, 2024.
Zecchin, M., Park, S., Simeone, O., and Hellström, F. Gen- eralization and informativeness of conformal prediction. In 2024 IEEE International Symposium on Information Theory (ISIT), pp. 244-249. IEEE, 2024.
12

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Appendix
A. Algorithm of online differentially private conformal quantile
We extend our framework incorporate Conformal Quantile Regression. The algorithm generates valid conformal quantile regression sets (x,),) that simultaneously guarantee differential privacy and coverage probability.
Algorithm 3 Online differentially private conformal quantile regression set
1: Input: Data (X,, Yi),
1,2,... Prediction models dau. (-) and Qau (-); Privacy budget parameters et 0; (0, 1);
Constant c 0; Si
2: for t = 2, 3....... do
3: Estimate the privatized quantile:
4: ii-a + Algorithm 2( S,
5: Predict and compute the non-conformity score:
6: S. = max (4om (X,) Y, Y, - aan (X.))
end for
8: Output: Private prediction sets:
(x(X,) (Xi) -0-a 9on (Xe) + gt-a1
B. Proofs
Proof of Theorem 4.4. For the sake of simplicity, we demonstrate that Algorithm 1 satisfies maxis/sr DD- when using the Laplace mechanism. A similar argument holds for other DP mechanisms.
To make the argument more intuitive, we rewrite the update rule in Algorithm 2
t d
1 1 -W (g: a) V vc).
1-a
t+t 1+ 31)
9++1
where the privatized gradient is given by
g: =0, n= + Zz, 2, ~ Laplace (. (1(0110))
Ct
For / = 2, the initial estimate -1-0 is deterministic, and thus the output -3- is -DP by the standard Laplace mechanism and the post-processing property in Lemma 3.6. Since Algorithm I accesses the private quantile estimates only through Algorithm 2, its output constitutes a proc-psocsssing of differentially private computations. Hence, the prediction set C2 (X2) also -D.
For t 3, since the update depends only on the disjoint data point S₂ and the previous output 0 1-a which is already private. By the parallel composition property in Lemma 3.6, the overall mechanism remains max/cı, --P. Applying the same argument inductively yields that Algorithm is maxigist DDP over / update steps.
Proof of Theorem 4.5. 1. For simplicity, we prove this theorem in the context of μ-GDP, noting that similar arguments can be extended to other mechanisms.In In long-term iterations, the wealth process W,, inspired by the Kelly criterion, exhibits a growth trend to asymptotic infinity even in adversarial environments. Consequently, there exists a time T after which the practical constraint of naturally vanishes, leaving the optimization process governed by the adaptive mechanism(Orabon
13

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
& Pál, 2016; Cutkosky & Orabona, 2018). For theoretical simplicity, omit in analysis. Observe that 2, follows normal distribution, i.e., 2; N 0, A2(h) for i 2 1. Under the assumption that the nonconformity scores are bounded, specifically, S - D for all i = ...,..., the following statements hold:
(a) Suppose that for some 2 1, the predicted radius -/-a exceeds the upper bound D, i.e., 0:-a > D. Given that q. - = X W and the wealth is nonnegative (W;-1 2 0), it follows that X > O. Moreover, the corresponding
(sub)gradient is given by
9: = -==--112 & c(x))) = a I[S, > 9 - = a,
and the perturbed gradient is
9: a Zz.
If 0: < 0, then,
W w - -xgii) > W.-
It known that,
1
A+1
9.
i+1
At this stage, it unclear whether A, is greater or smaller than \441, making impossible determine the relationship between 4.41 and a.-a. If 9. 0, then, conversely,
W; Wi- Argis) < W.-
We thus obtain:
A+1 i+1
i+) 9..
At this point, we can infer that A441 < Xo which implies that a:F > - resulting in:
d A411 W. < -!
Consequently, since a > 0, the probability that ğ > O exceeds 2- As a result, the overall trend is decreasing, which implies that the predicted radius eventually stabilizes and remains bounded by D.
(b) Suppose that for some i Z 1, we have q!- 2 0 but 7 < 0. This implies that there must exist some k such that 1itk > 0. Indeed, since 8; 2 0, it follows that A 2 O, whereas d implies that \;+1 < Thus, we conclude:
0 > A411 i+1 i 9
which implies that 9. > 0. Given that S 2 0. it follows that:
9.+1 9+11 a 11$ > ( =
aa-1
91-1 = a - 1++ +2411
Consequently, we derive:
i+1 1
1
A1t2 =
Ait1
2 i+20i+1
0i+1
it 2
i+1
i
i+1
i+1 A;
i 2 lit1
i+2
i+2
i+ 1
1
Ai
(gr + ((41)
i i+2
i+2
i A
1
(2a - 1 1 2, + Z or
A
(2a - 2+ 2,+ Z(41).
i 2
i i+2 2
1 it 2
i+2
In cither case, we obtain,
9i + Di+1 = 2a < and
9: + 9++1 2a O.
14

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
assuming a < 0.5 mild condition. Thus, A generally exhibits an increasing trend. We conclude that there exists some such that
Actk= > 0,
and hence,
d4th > 0.
Since for any 1, W,- = 1 Σi= 0
Q-agg 9i 2 0, Hence,
- 9: S 1.
Therefore.
9:4
a
Σ
(g) + 2,)4; a 119: a- > D) + Σ
(g + 2,)4 -a 114. - E [0, D]}
i=1
1=1
(9 + 2,)4!
1/61 < 0}
1=1
111: > D} + Σ 9:94
1-a
1(g 1611- E [),
9:g;
i=1
gill 1-a, -10
1--aa 0)
Zz0
1-a 1( > D}
E [0, DI} +
3
1(9 1 < <0}.
We know if -"> >>>> D, then we have that gi > 0, and if -!-- < 0, then 9i - < 0. Hence,
9:9;
9:4
11
E [0, +
Σ
Z 1-a a
1(0
D}
i=1
1
+
-10
DI3 Σ
Z 1[9. 1 0}
t
2 D +
Zi0;
i=1
We have shown that D 5t
Ei=1
2,0 l-a < Er -
9; S 1, and hence,
} S Dt+
4 a
< max
1, Dt + Σ Zig! -a
Σ
Z
1-a
+1.
Next, we bound the distance between the consecutive predicted radii. Note that:
Σ 0i
1-a
1 - > 9:9!
La
t t+1 1
iml l
15

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Ei=
0i
t-1
Ei=1 9i
9i9
-
+
--9
t+1
++1
i=1
Di
1
Σ
1-1
-a
1
Σ
1-1
9:9.
)
1-a
Ei=1 91
t+1
t +
t+
t
46
1
-9t + g1
t-1
9.9
9c
Σ
f
91
1+1
Thus,
1
4+1
4:
11-0
al-a
qi
9t
gil
1
+ ge
0i
t+1
1
1-1
9++1
q:
a
- 4:
al-a - 9t - 2, + 96
9:9;
t+1
+ 9:
11 a
Σ
+ 9:4
11- 1-a
Σ Zi
iml
iml
+ 2 1-g1- 1-a
2, + Z 1a
Σ
i=1
1=1
It then follows that:
21-a|
1
a-a
9t + 91
9:0
+ +cchh Σ 91
++1
1
+
Z. + gelh
2, + Z.1
2, + Z
9i
1+1 1
i=1
Combining this with the fact that $1 = 0 E [0, D]. the result from step 1, and (7), we obtain:
1
D + 1++1+00 D(t D+1+ + Σ Z 1-a
+ 1 + Dt
t 1
1
Z, grll 1 Σ
Z, +
Z.
1-a
Zi + Z 11-a
g1
1+1
1
1
2D +
1
[2 +
9t
2,
+
Z
2,
t+1
t
[-1
+
Z
91
+
Σ
1=1
i=1
we can directly apply the Cauchy- inequality to absolute values and squares, namely:
Z -a
<
Σ
z
Σ Ca) -az²
i=
16

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Thus,
1-1 + ((-1))1))
{=)))
1
< <2D +1+
Z
+
+DE
Σ
Z
+ D
2
21
D
2
gi
(
i=1
1=1
S 3D +1+
1
Z + D
Σ
2,
+ D
28
Σ
1
2
+
D
2 Σ
gi
+ (
| 1ml
)
t ++1
We analyze the asymptotic behavior of each term as + 00.
i. Constant term: The term 3D + 1 is independent of t and remains constant.
ii. The term 1 12el:
Since 2,- ~ N 00, ( (Aa(ha) )
we have
(2(h) 2
B|| Z,
14
Thus, the expectation of this term
1
B1|Z|| = 0 (1+1)
[+1
1+1
which vanishes as / + 0o.
ii.. The term r+1
DDD Σi= Z :
Notice that the expectation satisfies
E 2 = o(v])
Thus, we obtain
DO(V))= = 0 ( (Dvi
t+1
(++1)
As + co, this term vanishes at a rate of O(D/VI).
iv. The term + D 2, Ei= 2,
Using the Cauchy-Schwarz inequality:
27
1
E
B|Z EE
Σ Z,
-0 (Vi).
Thus, the term becomes
1 Do (Vi) =0 =0 (47)
The term + D Ze Σi= |:
Given [gil S for all i, we have Ei= 9i = Ot). Then:
E
Z Fi
<< <E|2211 O(t) = Ott).
i=l
17

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Thus,
1
vi. The term 4 1) (E 2²)²
By Jensen's 's inequality and Σ 2
(
(
Xi-1;
M1
t-1
Σ 2?
= -((V)
i=1
yielding
O(L))
t+1
Combining all terms:
D
+ ( ( + +0(D)
< 3D +1+0
+0
t+1
Vt
As oo, all vanishing terms disappear, leaving:
l0! - = ODD).
Thus, lg: | asymptotically remains bounded by O(D). Thus, as co, the growth rate of lá! stabilizes at the order
of OD), indicating that |g!-"| remains bounded.
3. Assume that the long-term coverage guarantee fails, i.e., there exists k >> such that:
lim sup T+000
T Σ L[Y & Cx(X,)) a 2 k.
From the definition of g: a I(Y & ((x.)) and Ô: = 9t + Zz, we have:
T
1
Σ
T( (((x)) =a
1
9t.
T
T
[=1
Substituting this into the coverage failure condition:
lim sup
1
gt
2
lim sup T
1
Σ
gt
2 k.
T-400
T
T
Since 9. 9t + Zr, we can write:
T
T
T
1
1
91
Z
T
T
T
1=1
1=1
t=1
By the Law of Large Numbers for zero-mean noise (E[2,) = 0, Var Z.) < x)):
Σ
Z, -
almost surely as T - co.
T
Thus, the coverage failure implies:
T
1
lim sup T-200
Σ
Zk.
T
[=l
18

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
and then
1
.-
AT+1WT
Σ 9t
Wr.
If E 00 2 k infinitely often, then for such T:
T
T ++1 R Wr.
(T+1
From the wealth bound Wr 2
1 KVT
exp
T (1
;:) )
(Orabona & Pál, 2016):
KVT
(x22) (-=²==0) =0
Tk²
@T+1
K 11) exp
exp
VT
This implies 107791 T this theorem.
oo, contradicting the boundedness of & derived earlier. We have completed the proof of
C. Additional experiments
C.1. Simulation results Setting
In this subsection, we provide simulation results for Setting 1.
C.I.I. SENSITIVITY ANALYSIS RESULTS c
In Figure 5, analyze the variations in coverage and interval length for different values of e with μ-GDP. These findings in agreement with the results presented in the main text.
Width
Width
6.4
6.2
6.2
6.0
6.0
5.8
5.8
5.6
5.6
5.4
5.4
200
200
0.89
0.89
0.88
150
0.88
150
Coverage 0.85
0.87
100
Coverage 0.85
0.87
100
0.86
50
C
0.86
50
C
Figure simulate the coverage rate and interval length for different values under the p-GDP setting. The value of ranges from to 200 with interval of 2. The results are based on the Setting dataset. From left to right, the figures correspond to Case and Case 2. For each case, we set the step length to 10000.
In Figure 6, we analyze the variations coverage and coverage length for different values of with cDD.. Compared to the results obtained with the μ-GDP, both exhibit nearly identical trends.
19

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Width
Width
9
9
8
7
7
6
6
0.90
200
0.90
200
0.85
150
0.85
150
Coverage ge 0.70
0. 80
100
Coverage rage 0.70 0
0. 8.80
100
0.75
50
C
0.75
50
C
0
Figure 6. We simulate the coverage rate and interval length for different values of under the e-DP setting, The value of ranges from 1 200 with interval of 2. The results based the Setting dataset. From left right, the figures correspond Case and Case 2. For each case, we set the step length & to 10000.
Table Long-run run coverage Ei 1(Y, e C(()))) the Setting dataset, averaged over independent trials with Gaussian noise, using both non- non-privann privaai and private base models. The first 50 data points are omitted to reduce the impact of carly-stage instability.
Case
Base Model
Original
μ 2
/
0.5
SGD
0.890
0.887
0.876
0.866
LDPSGD
0.890
0.888
0.875
0.857
SGD LDPSGD
0.890
0.887
0.876
0.866
0.890
0.888
0.874
0.856
C.1.2. ADDITIONAL SIMULATION RESULTS FOR THE PRIVATELY TRAINED MODEL
We apply SGD and LDPSGD as the non-private and private base models, respectively, within the ODPCP framework, and present the corresponding results.
report the experimental results of ODPCP under the μ-GDP mechanism, using both non non-private and private base models. The results show that the injected noise in LDPSGD leads to larger non-conformity scores compared to SGD, resulting in wider prediction intervals. Nevertheless, the coverage rate remains nearly unaffected.
In Table 3, Table 4, and Figure
In Table 5, Table 6, and Figure 8, we report the experimental results of ODPCP under the eDD mechanism. The results are nearly identical to those under GDG.P. However, due to the larger magnitude of Laplace noise, the overall fluctuations in coverage and interval width are slightly greater than those observed with Gaussian noise.
C.1.3. COMPARISON BETWEEN ODPCP AND ODPCQR
In Table 7, Table 8, and Figure 9, we present the experimental results of ODPCP and ODPCQR under the μ-GDP noise mechanism. Regarding coverage, unlike Setting 2, neither algorithm experiences sharp decline due to the absence of changepoints, instead maintaining coverage levels around 1 = 0.9 with minor fluctuations. In terms of interval length, both algorithms initially exhibit larger fluctuations but stabilize over time, demonstrating strong performance with stable and consistent prediction intervals the later stages.
In Table 9, Table 10, and Figure 10, we present the experimental results of ODPCP and ODPCQR under the cDP noise
20

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table Long-run width for the Setting dataset, averaged over 200 independent trials with Gaussian noise, using hoth non-private and private base models. The first 50 data points are omitted to reduce the impact of early-stage instability.
Case
Base Model
Original
2
Jr
0.5
SGD
3.23
3.26
3.42
4.93
LDPSGD
5.05
5.16
5.43
7.90
SGD
3.23
3.26
3.42
4.92
LDPSGD
4.93
5.03
5.29
7.69
Table Long-run coverage Σi=, I(V; & (x.)) for the Setting dataset, averaged over 200 independent trials with Laplace noise, using both non-private and private base models. The first 100 data points omitted reduce the impact of early-stage instability.
Case
Base Model
Original
2
1
= 0.5
SGD
0.890
0.884
0.869
0.866
LDPSGD
0.890
0.884
0.859
0,852
2
SGD
0.890
0.885
0.869
0.866
LDPSGD
0,890
0.884
0.859
0.853
mechanism. Since Laplace noise has a heavier tail distribution compared to Gaussian noise, the resulting perturbations are more substantial, leading slightly more pronounced fluctuations in coverage. Similarly, in terms of interval length, the fluctuations more noticeable under Laplace noise, yet the model still exhibits relatively high level of convergence.
C.2. Additional simulation results for Setting
Here, we present additional simulation results for Setting 2.
C.2.1. SENSITIVITY ANALYSIS RESULTS FOR e
In Figure 11 we analyze the variations in coverage and interval length for different values of These findings are in agreement with the results presented the main text.
C.2.2. COMPARISON BETWEEN ODPCP AND DPCP
DPCP is an offline approach for constructing prediction sets under differential privacy, requiring access to the full calibration dataset. However, due its static model, it is not suitable for streaming data or distribution shifts, such as changepoints. As shown in Table 11, while DPCP achieves slightly higher coverage, method (ODPCP) consistently yields narrower prediction intervals, particularly under strong privacy constraints. This highlights the favorable privacy-efficiency trade-off offered by ODPCP in the online setting.
C.2.3. ADDITIONAL SIMULATION RESULTS FOR THE PRIVATELY TRAINED MODEL
We apply SGD and LDPSGD as the non-private and private base models, respectively, within the ODPCP framework, and present corresponding results.
Table 12, Table 13, and Figure 12 present the simulation results for Setting with G-GDP, reporting the coverage rate and interval length for the ODPCP algorithm under six different scenarios. These results are based differentially private and non-private base models.
The experimental findings indicate that the injected noise in LDPSGD leads to larger non-conformity scores compared to SGD, resulting in wider prediction intervals. Nevertheless, the coverage rate remains nearly unaffected.
Table 14, Table 15 and Figure 13 present the simulation results for Setting with DP, showing the coverage rate and
21

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
0.9
25
Coverage
0.8
20
Width
0.7
15
0.5
10
0.4
5
0.3
0
2000
4000
6000
8000
10000
0
2000
4000
6000
8000
10000
Time
Time
1.0
30
0.9
Coverage
0.8
25
Width
0.7
20
0.6
15
0.5
10
0.4
5
0.3
2000
6000
8000
10000
2000
4000
6000
10000
Time
Time
SGD-Original LDPSGD-Origins
SGD-U=2
5GD+/=
SGD-
LDPSGD-W=2
LDPSGD-W=1
LDP5GD-1=0055
Figure 7. Simulation results for Setting with G-GDP, The mean prediction interval coverage and width of our proposed algorithms, along with the Original version, evaluated over 200 independent trials across cases, using both non-privee non-private and private base models. To ensure stability, the first 200 time points are excluded from the analysis, and the displayed curves are smoothed using rolling average with a window of
interval length for the ODPCP algorithm under six different scenarios, using both non-private and private base models. The results nearly identical to those under μ-GDP. However, due to the larger magnitude of Laplace noise, the overall fluctuations in coverage and interval width are slightly greater than those observed with Gaussian noise.
C.2.4. COMPARISON BETWEEN ODPCP AND ODPCQR
Figure 14 presents the complementary results for Cases 4, and 6, which, together with Figure 2 (Cases 1, 3, and 5), constitute the complete results of Setting 2 under the μ-GDP mechanism. Table Table 17 and Figure 15 present the simulation results for Setting with DP. Compared to the results with Gaussian noise, the Laplace noise results exhibit greater fluctuations in coverage rate and interval length. However, in vertical comparison, the results nearly identical to those with Gaussian noise, and we will not elaborate further; please refer to the main text.
C.2.5. ROBUSTNESS TO INTTIALIZATION
We evaluate the sensitivity of our method to the choice of initialization parameters (A,, Wo). As shown in Figure 16, the performance remains virtually unchanged across wide range of initialization settings. This confirms that the algorithm is highly robust and does not rely on careful tuning of initial values.
22

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table Long-run width for the Setting dataset, averaged 200 independent trials with I Laplace noise, using both non-private and private base models. The first 100 data points are omitted to reduce the impact of strly-stage instability.
Case
Base Model
Original
c
c=
c c=]
== 0.5
SGD
3.22
3.30
3.80
7.65
LDPSGD
5.05
5.22
5.93
12.43
2
SGD
3.22
3.30
3.80
7.71
LDPSGD
4.93
5.09
5.80
12.30
Table 7. Long- Run Coverage Ei= 1(Y, E (X.))/ and the standard deviation (scaled by factor of 1,000), are reported for the Setting dataset with Gaussian noise, averaged over independent trials To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 100 data points are excluded from the analysis.
Case
Method
Original
# = 2
μ 0.5
CP
0.890(0.26)
0.888 (5.1)
0.877(10)
0.867 (19)
CQR
0.900 (1.7)
0.900(4.7)
0.900(9.3)
0.899(19)
2
CP
0.890 (0.27)
0.888(5.2)
0.877 (10)
0.867(19)
CQR
0.900 (2.0)
0.900(4.6)
0.899(9.2)
0.899(14)
C.2.6. EFFECT OF DYNAMIC PRIVACY BUDGET ALLOCATION
As shown in Table 18, the random allocation of per-step privacy budgets (Ft (0,5, 2.0)) yields nearly identical long-run coverage and interval width to the fixed high-budget (/4 = 2.0) across all synthetic settings. This indicates that the maximum value of μr effectively dominates the resulting predictive uncertainty. In parallel, Figure 17 illustrates the asymptotic stability of ODPCP under increasing time horizons (T = 10 to 10") across three configurations. The random-j trajectory closely follows the fixed-high-p baseline, further confirming that long-run behavior is determined by max; Pt, in alignment with Theorem 4.4.
C.3. FIEC2 results
We evaluate the performance of our proposed algorithm using the ELEC2 dataset (Harries, 1999), which records electricity demand and pricing in the state of New South Wales, Australia, from May 1996 to December 1998. For this analysis, we focus exclusively on NSWdemand, which represents electricity demand in New South Wales. This variable is a critical indicator of market dynamics, directly reflecting fluctuations in electricity demand over time. Electricity demand data is inherently sensitive, it captures both market trends and individual user behavior. In particular, large-scale historical demand data can be exploited to infer user behavior or predict future market trends, raising potential privacy concerns related to both commercial interests and personal privacy.
To mitigate these privacy risks, we apply our proposed method to this dataset. This ensures that individual or market-level information cannot be inferred, either directly or indirectly, during the data analysis process. In particular, we consider an autoregressive model of order (AR(3)) to model the electricity demand data. A rolling window of size 200 is employed to compute dynamic coverage rates and prediction interval widths at each time step. The level of privacy protection is controlled by the parameter μ., and we evaluate the model under two privacy budgets μ 1, 2. The results reported in Figure 18.
In terms of coverage, our proposed algorithm, compared to its Original algorithm, exhibits greater volatility in both long-run and rolling coverage as the level of privacy protection increases. Specifically, under different privacy protection parameters (μ = 1),), the rolling coverage fluctuates around the target confidence level of - a = 0.9, with more pronounced variations than the Original algorithm. This effect is especially noticeable for μ = where the introduction of stronger
23

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
30
0.9
25
Coverage
0.8
Width
0.7
20
0.5
10
0.4
0.3
2000
4000
6000
8000
10000
2000
4000
6000
8000
10000
Time
Time
1.0
30
0.9
25
Coverage
0.8
Width
20
0.7
0.6
15
0.5
10
0.4
5
0.3
2000
4000
6000
8000
10000
2000
8000
10000
Time
Time
SGD-Original Origina
SGD-r=2
SGD-s=1
SGD-E=0.5
LDPSGD-c=2
LDPSGD-c=1
LDPSGD-c=0.5
Figure 8. Simulation results for Setting 1 with c-DP. The mean prediction interval coverage and width of our proposed algorithms, along with the Original algorithm, are evaluated over independent trials across two cases, using both non-private and private base models. To ensure stability, the first 500 time points are excluded from the analysis, and the displayed curves are smoothed using rolling average with a window size of 50.
privacy protection leads to increased random perturbations, resulting in more significant fluctuations in coverage. Hence, higher levels of privacy protection tend to destabilize the coverage. For long-run coverage, as the time steps increase, the coverage volatility of the Original algorithm gradually decreases and stabilizes around the target confidence level. In contrast, our proposed algorithm with privacy protection shows greater volatility in the early stages, particularly for f 1. However, this volatility decreases over time, with the coverage eventually converging to stable value, albeit slower rate than Original algorithm.
With respect to the interval width, the rolling interval width of our proposed algorithm exhibits more significant fluctuations in the early stages but stabilizes as time progresses, eventually oscillating around the interval width of the Original algorithm. In terms long-run interval width, all methods converge to stable values. However, the introduced noise due to privacy protection alters the final stable width. Specifically, when the privacy protection parameter μ smaller (e.g., p 1), the long-run interval width is noticeably larger than under other settings, with its Original version achieving the smallest interval width. This suggests that the noise perturbation introduced by the privacy protection mechanism results in more conservative prediction interval, reducing the precision of the interval and thus its effectiveness in capturing the true values.
Figure 19 presents the results for the EIEC2 dataset under Laplace noise. The width and coverage exhibit larger fluctuations compared to Gaussian noise, with the results oscillating around those of the Original version. As the time step t increases, stability improves and fluctuations decrease, a trend that more pronounced in the rolling width.
24

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table Long-Rur Width, and the Standard Deviation (Scaled by 10), reported for the Setting dataset with Gaussian noise, averaged over 200 independent trials. To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 100 data points are excluded from the analysis.
Case
Method
Original
11= 2
μ =
/1 0.5
1
CP
3.22(0.27)
3.25(0.57)
3.42(1.7)
4.87 (15)
CQR
3.31(0.34)
3.33(0.55)
3.39(1.2)
4.00 (12)
2
CP
3.22(0.27)
3.26(0.56)
3,42 (1.7)
5.18 (42)
CQR
3.31(0.32)
3.33 (0.52)
3.39(1.0)
4.00 (23)
Table 9. LLong-nguu Run Coverage Et= D(Y C(X))) and the standard deviation (scaled by factor of 1,000) are reported for the Setting dataset with Laplace noise. To minimize impact of early-stage noise and initial instability of the algorithm, first data points excluded from the analysis.
Case
Method
Original
E ==>
6 0.5
CP
0.890 (0.27)
0.884 (6.9)
0.868 (13)
0.865(25)
CQR
0.900 (1.7)
0.900(6.3)
0.800 (12)
0.899(25)
CP
0.890 (0.27)
0.884 (7.2)
0.868 (14)
0.866(27)
CQR
0.900 (2.00)
0.900 (6.7)
0.900(13)
0.899(27)
C.4. Additional PAMAP2 results
We evaluate ODPCP activity classification using the PAMAP2 dataset, categorizing activities into three classes (resting, light, vigorous) based on heart rate and sensor data. An XGBoost model provides predictions, with ODPCP generating private prediction sets at each time step Figure 20 shows ODPCP's broad applicability to discrete prediction problems, maintaining strong empirical coverage and adaptive behavior under privacy constraints. Figure 22 presents the results for the PAMAP2 Physical Activity Monitoring Dataset under Laplace noise. The width and coverage exhibit larger fluctuations compared Gaussian noise. However, as the algorithm progresses, the fluctuations decrease, demonstrating good convergence. Despite these fluctuations, the overall performance remains outstanding.
25

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
20
Coverage
0.8
Width
15
0.6
10
0.5
0.4
5
0.3
0
2000
4000
6000
8000
10000
0
2000
4000
6000
8000
10000
Time
Time
1.0
20
0.9
Coverage
0.8
Width
15
0.7
0.6
10
0.5
0.4
5
0.3
8000
2000
4000
6000
10000
Time
Time
Original CQR
μ=
p=1
μ=0.5
CQR-H=2
CQR-H=1
CQR-
Figure 9. Simulation results for Setting 1 with μ-GDP: The mean prediction interval coverage and width of our proposed algorithms. along with those of Original algorithm, are evaluated over 200 independent trials across two cases. For stability, the first 200 time points are excluded from the analysis, and the displayed curves smoothed using rolling average with window size of 50 time points.
Table 10. Long-Run Run Width and the Standard Deviation (Scaled 10) reported for the Setting I dataset with Laplace noise. To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 100 data points are excluded from the analysis.
Case
Method
Original
E
E 0.5
1
CP
3.22(0.28)
3.30(0.86)
3.79(4.8)
7.6 (48)
CQR
3.31(0.34)
3.34(0.75)
3.51(3.7)
5.21
2
CP
3.22(0.27)
3.30(0.84)
3.82(4.6)
9.4(149)
CQR
3.31(0.32)
3.35(0.75)
3.51(2.9)
6.36(111)
26

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
30
0.9
25
Coverage
0.8
Width
20
0.7
0.6
15
0.5
10
0.4
5
0.3
2000
4000
6000
8000
10000
2000
4000
6000
8000
10000
Time
Time
1.0
30
0.9
25
Coverage
0.8
Width
20
0.7
0.8
15
0.5
10
0.4
5
0.3
2000
4000
6000
8000
10000
2000
4000
6000
8000
10000
Time
Time
Original CQR
E=2
E=1
E=0.5
CQR-E=2
CQR-E=1
CQR-E=0.5
Figure 10. Simulation results for Setting with cDDP: The mean prediction interval coverage and width for proposed algorithms, along with the Original algorithm, are evaluated over 200 independent trials across two cases. To ensure stability, the first 500 time points excluded from the analysis, and the displayed curves smoothed using rolling average with window size of 50 time points.
27

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Width
Width
Width
12
11
8
10
9
0.90
Coverage 0.70
0.85
0.80
50
100
150
0.90
0.85
Coverage 0.70
0.80
0.75
50
100
150
200
0.9
Coverage
80 0.75 0.70
150
200
Width
Width
12
10
11
9
8
7
0.90
0.85 0.85 Coverage 0.70
7.75
150 200
Coverage 0.70
0.85
0.80
100
150
200
0.90
Coverage
0.85
0.80
0.75
150 200
Figure 11. We simulate the coverage rate and interval length for different values of under the e-DP setting. The value of ranges from I with interval 2. Here, we present the results for Setting dataset. From left right, the figures correspond to the data settings, Case to Case 6. The step length is set to 10000 for all cases.
Table Comparison between ODPCP (our method) DPCP (Angelopoulos et al., 2022) under Setting across six simulation cases. Both methods target nominal coverage level of 90% (a 0.1). The total sample size is N 10,000.
2
Case
Method
Coverage
Width
Coverage
Width
ODPCP
0.885
3.65
0.868
4.20
1
DPCP
0.905
5.58
0.911
5.68
ODPCP
0.885
3.70
0.868
4.26
2
DPCP
0.906
7.16
0.911
7.28
ODPCP 0.885
5.04
0.863
5.81
3
DPCP
0.906
6.66
0.911
6.80
ODPCP
0.885
5.11
0.864
5.89
4
DPCP
0.906
8.03
0.912
8.24
ODPCP
0.884
4.50
0.869
4.96
5
DPCP
0.907
6.31
0.912
6.49
ODPCP
0.884
4.59
0.869
5.04
6
DPCP
0.903
7.69
0.908
7.89
28

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table Long-run coverage Σi= 1(,, E C.(X.))TT for Setting 2 dataset, averaged over independent trials with μ-GDP, using both non-private and private base models. The first. 50 data points are omitted to reduce the impact of early-stage instability.
Case
Base Model
Original
/ 2
Jr
0.5
SGD
0.890
0.888
0.876
0.865
LDPSGD
0.890
0.888
0.874
0.854
2
SGD
0.890
0.888
0.876
0,865
LDPSGD
0.890
0.888
0.875
0.855
3
SGD
0.890
0.888
0.875
0.860
LDPSGD
0.890
0.887
0.871
0.846
4
SGD 0.890
0.888
0.875
0.860
LDPSGD
0.890
0.887
0.871
0.847
5
SGD 0.890
0.887
0.876
0.864
LDPSGD
0.890
0.888
0.874
0.854
6
SGD
0.890
0.887
0.876
0.865
LDPSGD
0.890
0.888
0.874
0.855
Table 13. Long-run width for the Setting dataset, averaged over 200 independent trials with μ-GDP, using both non-private and private base models. The first 50 data points are omitted to reduce the impact of early carly-stage instability.
Case
Base Model
Original
f
2
1
0.5
SGD
3.57
3.61
3.78
5.43
LDPSGD
5.42
5.54
5.83
8.46
SGD
3.62
3.66
3.85
5,50
LDPSGD
5.35
5.45
5.74
8.28
3
SGD
4.89
4.97
5.26
7.67
LDPSGD
6.65
6.72
7.09
10.2
4
SGD
4.95
5.04
5.33
7.75
LDPSGD
6.58
6.65
7.01
10.0
SGD
4.42
4.46
4.58
6.24
LDPSGD
5.97
6.11
6.44
9.15
6
SGD
4.51
4.55
4.66
6.33
LDPSGD
5.90
6.04
6.35
8.98
29

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
1.0
0.0
wy
Coverag
Coverage
0.7
0.7
0.6
0.8
0.8
0.3
2000
4000
5003
5000
15008
03
2003
4000
8020
8020
10200
03
2000
4000
5003
8000
10000
Time
Time
Time
20
Width
Width
20
15
10
10
100
2000
0030
5000
10200
2000
4000
6000
10020
2000
4003
0000
2003
90000
Time
Time
Time
1.0
1.0
Coverag
Coverage
Coverage
0.7
0.7
0.7
0.6
0.4
0.3
2000
A000
6003
3000
0.
2003
4100
8000
10000
0.3
5003
8000
10000
Time
Time
Time
30
25
Width
Width
00
Width
20
15
10
0000
5000
4000
10000
2000
90000
Time
Time
Time
SGD-Original LDPSGD-Original
SGD-u=2 LDPSGD-U=2
SGD-w/1
SGD-//00.5
LDPSGD-W=1
LDPSGD-J=0.5
Figure 12. Simulation results for Setting 2 with y-GDP: The mean prediction interval coverage and width our proposed algorithms, along with the Original algorithm, evaluated over 200 independent trials across six cases (from left to right), using both non-private and private base models. To ensure stability, the first 200 time points are excluded from the analysis, and the displayed curves are smoothed using rolling average with window size of 50.
30

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table 14. Long-Run Coverage Et= 1[2 E (x))) for the Setting dataset, averaged over 200 independent trials with Laplace noise, using both non-private and private base models. To reduce the excessive disturbance caused by early noise and algorithm instability, the first 100 data points are omitted, without affecting the convergence results.
Case
Base Model
Original
c
6 0.5
SGD
0.891
0.885
0.868
0.864
LDPSGD
0.890
0.884
0.858
0.849
SGD
0.891
0.885
0.868
0.864
LDPSGD
0.890
0.884
0.859
0.851
SGD
0.890
0.885
0.863
0.859
LDPSGD
0.890
0.883
0.851
0.840
SGD
0.890
0.885
0.864
0.860
LDPSGD
0.890
0.883
0.851
0.841
5
SGD 0.890
0.884
0.869
0.864
LDPSGD
0.890
0.883
0.858
0.848
6
SGD
0.890
0.884
0.869
0.863
LDPSGD
0.890
0.884
0.859
0,850
Table 15. Long-Run Width for the Setting 2 dataset, averaged 200 independent trials with Laplace noise, using both non-private and private base models. To reduce the excessive disturbance caused by early noise and algorithm instability, the first 100 data points are omitted, without affecting the convergence results.
Case
Base Model
Original
0.5
SGD
3,56
3.65
4.20
8.30
LDPSGD
5.42
5.59
6.34
13.1
2
SGD
3.61
3.70
4.26
8.43
LDPSGD
5.35
5.52
6.27
13.0
3
SGD
4.88
5.04
5.81
11.7
LDPSGD
6.66
6.76
7.80
17.3
4
SGD
4.95
5.11
5.89
12.0
LDPSGD
6.59
6.70
7.73
17.0
5
SGD
4.42
4.50
4.96
9.41
LDPSGD
5.97
6.18
6.93
14.0
6
SGD
4.51
4.59
5.04
9.55
LDPSGD
5.90
6.11
6.84
14.0
31

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
1.0
0.9
0.9
0.9
Coverage
Coverage
Coverage
0.6
0.6
0.6
0.5
2000
4000
0009
8000
10000
0.3
2003
4000
6080
8030
10100
0.3
2000
4008
5000
8000
10000
Time
Time
Time
30
Width
Width
20
Width
2003
4003
6008
8008
10000
2000
4000
0000
8000
10000
2800
4000
6003
5003
50000
Time
Time
Time
1.0
1.0
1.0
Coverage
Coverage
Coverag
0.7
0.7
0.8
0.3
2000
4010
0003
8000
10000
0.3
2000
4200
8000
8030
10000
2000
4006
8000
8000
10000
Time
Time
Time
Width
Width
Width
18
10
10000
4000
10000
2000
0002
50000
Time
Time
Time
SGD-Original LDPSGD Orrginal
SGD-E=2
SGD-s=1
SGD-E=0.5
LDPSGD-c=2
LDPSGD-c=1
LDPSGD-c=0.5
Figure 13. Simulation results for Setting 2 with c-DP; The mean prediction interval coverage and width of our proposed algorithms, along with the Original algorithm, evaluated over 200 independent trials across six cases (from left to right), using both con-private and private base models. To ensure stability, the first 500 time points are excluded from the analysis, and the displayed curves are smoothed using rolling average with window size of 50 time points.
32

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
0.9
Coverage
0.8
Width
15
0.7
Wmmm
0.6
10
M
0.5
0.4
5
0.3
2000
4000
6000
8000
10000
0
2000
4000
6000
8000
10000
Time
Time
1.0
20.0
0.9
17.5
wwmm
Coverage
0.8
15.0
Width
Whal Wynn M LMPA bn
0.7
12.5
0.6
10.0
0.5
7.5
0.4
0.3
2000
4000
6000
8000
10000
2000
4000
6000
8000
10000
Time
Time
25
0.9
20
Coverage
Width
0.7
15
0.6
mmM
10
0.5
0.4
2000
4000
6000
8000
10000
Time
2000
4000
6000
8000
10000
Time
Original CQR
μ=2
μ=1
μ=0.5
CQR-H=2
CQR-u=1
CQR-u=0.5
Figure 14. Simulation results for Setting 2 (Cases 2, 4, and 6, top to bottom) with G-GDP: The mean prediction interval coverage and width of our proposed algorithms the Original algorithm are computed over 200 independent trials. For stability, first 200 time points are excluded from the analysis, and the displayed curves smoothed using rolling average with window size of 50 time points.
33

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Table 16. Long-Run Run Coverage >i=1 1(Y; C(())) and the standard deviation (scaled by factor of 1, 1,000) reported for the Setting 2 dataset with Laplace noise. To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 50 data points excluded from the analysis.
Case
Method
Original
= 2
6 1
é = 0.5
1
CP
0.889 (0.29)
0.883 (6.9)
0.857 (13)
0.845 (25)
CQR
0.890 (1.2)
0.895 (6.2)
0.895 (13)
0.894 (25)
2
CP
0.888 (0.28)
0.882 (7.0)
0.851 (13)
0.836 (25)
CQR
0.891 (1.4)
0.895 (6.4)
0.895 (12)
0.894 (25)
3
CP
0.889 (0.31)
0.884 (8.7)
0.853 (16)
0.845 (24)
CQR
0.892 (1.6)
0.897 (6.9)
0.897 (14)
0.898 (28)
4
CP
0.889 (0.26)
0.883 (8.7)
0.848 (16)
0.833 (29)
CQR
0.893 (1.5)
0.896 (5.6)
0.896 (11)
0.896 (22)
5
CP
0.889 (0.36)
0.883 (7.0)
0.856 (13)
0.844 (25)
CQR
0.892 (1.7)
0.896 (5.6)
0.896 (12)
0.895 (23)
6
CP
0.889 (0.35)
0.882 (7.0)
0.851 (12)
0.834 (24)
CQR
0.891 (1.8)
0.895 (5.8)
0.896 (10)
0.897 (20)
Table 17. Long-Run Width and the Standard Deviation (Scaled by 10) reported for the Setting 2 dataset with Laplace noise. To minimize the impact of early-stage noise and the initial instability of the algorithm, the first 100 data points are excluded from the analysis.
Case
Method
Original
2
0.5
1
CP
5.19 (0.37)
5.31 (1.2)
6.13 (8.9)
12.4 (83)
CQR
5.11 (0.46)
5.21 (1.0)
5.48 (6.3)
7.48 (38)
2
CP
6.49 (0.65)
6.63 (1.8)
7.60 (10)
15.3 (104)
CQR
6.39 (0.68)
6.49 (1.5)
6.77 (6.5)
8.91 (39)
3
CP
6.21 (0.62)
6.41 (2.5)
7.41 (11)
14.8 (84)
CQR
6.22 (0.72)
6.34 (1.8)
6.58 (5.0)
8.61 (37)
4
CP
7.46 (0.80)
7.67 (2.8)
8.84 (13)
21.8 (379)
CQR
7.40 (0.79)
7.52 (1.6)
7.69 (3.6)
11.8 (184)
5
CP
5.79 (0.97)
5.96 (2.5)
6.85 (10)
13.5 (87)
CQR
5.85 (1.1)
5.97 (2.0)
6.27 (6.9)
8.46 (41)
6
CP
7.05 (1.1)
7.23 (2.9)
8.24 (12)
16.5 (119)
CQR
7.04 (1.1)
7.19 (2.3)
7.48 (6.8)
9.44 (34)
34

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
0.9
0.9
0.9
Coverade
0.8
0.8
Coverage
0.6
0.6
0.6
0.5
2000
4000
5003
8000
10000
03
2000
4300
6000
8000
10000
2000
4008
5000
8000
10000
Time
Time
Time
400
00
Width
Width
Width
30
10
10
2003
4003
6005
5005
10000
2000
4000
8300
9000
10010
2000
6008
5003
5008
50000
Time
Time
Time
1.0
1.0
0.9
0.9
0.9
Coverage
Coverage
Coverage
0.6
0.6
0.8
0.5
2000
4030
0000
8000
10000
0.3
2003
4300
0000
8030
10000
0.3
2000
4002
5003 8000
1000D
Time
Time
Time
15
103
Width
80
Width
Width
63
30
20
2000
4030
6800
5003
10000
2000
4000
0000
8000
10000
2800
4008
5003
5008
50000
Time
Time
Time
Original CQR
E=2
E=1
E=0.
CQR-E=2
CQR-E=1
CQR-E=0.5
Figure 15. Simulation results for Sctting 2 with e-DP: The mean prediction interval coverage and width for our proposed algorithms, along with the Original algorithm, are computed over 200 independent trials across cases (from left right), using both non-private and private base models. To ensure stability, the first 500 time points are excluded from the analysis, and the displayed curves are smoothed using a rolling average with a window size of 50 time points.
35

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
0.9
Coverage
0.8
Width
0.7
0.5
(0,1,5)
(0.3,30)
0.4
(0,6,00)
Threshok==03
0.3
0
2000
4000
6000
8000
10000
0
2000
4000
6000
8000
10000
Time
Time
Figure 16. Effect of initialization (Aa, Wo) coverage and interval width time horizon of J0.vves under different
initialization settings almost completely overlap, indicating high robustness to initialization.
Table 18. Long-run coverage and width under three privacy noise settings: fixed 0.5, fixed 2.0, and randomly sampled Iu ~ Uniform(0.5, 2.0). Results are averaged over 200 runs with 7 20,000.
Case
Metrie 2
[0.5, 2]
μ1 0.5
Coverage
0.895
0.887
0.872
Width
3.32
3.39
4.35
Coverage 0.894
0.886
0.870
Width 3.33
3.40
4.35
3
Coverage 0.894
0.885
0.860
Width 4.69
4.82
6.01
4
Coverage 0.894
0.886
0.861
Width
4.72
4.84
6.13
5
Coverage Width 4.29
0.894
0.886
0.870
4.31
5.02
Coverage Width
0.894
0.884
0.869
4.30
4.32
4.92
Random [0.5.2]
Flxad
Long-Run Wilth
Fixed p=0.5
8.85
Long-Buu
y (0.5.] Fixed P
Figure 17. Asymptotic behavior of coverage and width under three privacy settings: fixed μ = 0.5, fixed = 2.0, and randomly sampled I (0.5,,2 2.0). Results show that the long-run performance under random / closely follows that of fixed μ 2.0, indicating that the maximum Me largely determines the privacy-utility trade-off.
36

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
0.20
Rolling Coverage
Rolling Width
0.8
0.15
0.10
0.5
0.05
0.3
19000
20000
40000
10000
20000
30000
40000
Time
Time
Long-run Coverage
0.94
Long-run Width
0.18
0.92
0.16
0.88
0.14
0.56
0.12
0.84
0.10
0.08
0.50
10000
20000
30000
40000
20000
25000
30000
35000
45000
Time
Time
Original
Non-private
μ=2
4= 1
Figure EIEC2 dataset with μ-GDP: The upper panel illustrates the rolling coverage and rolling interval width, each averaged over a rolling window of 200 time points. For lower panel, present the long-run coverage, defined as ΣT I(Y: E (X.))) and the long-run interval width, both averaged over 200 repetitions. For stability, the first 2000 time points are excluded from the amalysis. For improved clarity and mitigate fluctuations, the displayed curves are smoothed using rolling average with window size of 50 time points.
37

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Rolling Coverage
Rolling Width
19090
20000
30009
40000
10000
20000
30000
40000
Time
Time
0.30
Long-run -un Coverage
0.94
Long-run Width
0.92
0.25
0.90
0.20
0.88
0.56
0.15
0.10
0.82
0.50
20000
25000
30000
35000
40000
45000
Time
Time
Original
Non-private
E=2
8=1
Figure EIEC2 Results with ThDP.The first row shows the rolling coverage and rolling width, averaged over rolling window of 200 time points. The second row displays the long-run coverage Σ.n T(Y, Cx(X)) and the long-run interval width, averaged over 200 repetitions. For stability, the first 2000 time points are excluded from the analysis. The displayed are smoothed by taking rolling average with a window of 50 time points.
38

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
1.0
0.9
Rolling Coverage
0.8
0.7
original
0.6
ODPCP without noise
2.0
0.5
u 1.0
Target Coverage (1 a.)
0.4
0
1000
2000
3000
4000
5000
6000
Time
Figure 20. Multi-class classification experiment on subject 103 from the PAMAP2 dataset with rolling window size of 200.
180
Actual Heart Rate
160
Prediction Interval (15%)
Heart Rate
140
120
100
80
60
0k
5k
10k
15k
20k Time
25k
30k
35k
40k
Figure improve visualization, we expanded each prediction interval by #5 % both ends (relative original length), under the setting of y 1. Only intervals that originally covered the true value are shown.
39

---

Online Differentially Private Conformal Prediction for Uncertainty Quantification
Rolling Coverage
Rolling Width
0.5
0.4
0.6
0.2
0.4
0.1
Dark
5000
10000
15000
20000
25000
30000
35000
40000
5000
10000
15000
20000
25000
30000
35000
40000
Time
Time
0.175
Long-rum -uu Coverage
Long-run Width
0.150
0.92
0.125
0.90
0.88
0.100
0.56
0.075
0.050
0.82
0.025
0.50
20000
25000
30000
35000
40000
Time
Time
Original
Non-private
E=2
==1
Figure 22. PAMAP2 with c-DP.The first row shows the rolling coverage and rolling width, averaged over rolling window of 200 time points. The second row displays the long-run coverage Σi- T(Y; E C.(X.))TT and the long-run interval width, averaged over 200 repetitions. For stability, the first 2000 time points excluded from the analysis. The displayed curves are smoothed by taking rolling average with window of 50 time points.
40


Reviews:
[{"review_id": "GB2sPinsBl", "reviewer": "Reviewer_5Xme", "summary": "The submitted paper presents an online differentially private conformal prediction (ODPCP) framework that generates private prediction sets in real time using pre-trained models. The key idea is to compute differentially private quantile thresholds in a one-pass online manner without re-accessing historical data, thereby enabling real-time decision-making with coverage guarantees. To enhance robustness under heteroscedasticity, the framework is further extended to incorporate conformal quantile regression (ODPCQR). Theoretical results guarantee long-run average coverage approaching the target level 1−\\alpha, and detailed proofs are provided in the appendix. The experimental evaluation is performed on two real-world regression tasks using the PAMAP2 (physical activity monitoring) and ELEC2 (electricity) datasets, as well as synthetic simulations. Overall, the experiments indicate that ODPCP and ODPCQR maintain reasonable coverage and convergence behavior under different privacy levels, although performance fluctuations become more pronounced with stronger privacy constraints.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable suggestions. We address each point below\n- **Finite sample converge rates.** Theorem 4.5 shows that ODPCP achieves the desired long-run coverage. Although it does not provide explicit finite-sample convergence rates, our empirical results indicate rapid convergence in practice, with strong coverage even in early rounds, making the method well-suited for real-world streaming applications. We agree that formal convergence bounds would be valuable and highlight this as an important direction for future work.\n\n- **LDP.** Although our paper briefly mentioned local differential privacy (LDP), we acknowledge the need for a more formal definition. We will add the following definition of $(\\varepsilon, \\delta)$-LDP and its implications.\n    - (Xiong et al., 2020) A randomized algorithm $A: \\mathcal{X} \\rightarrow \\mathcal{R}$ satisfies $(\\varepsilon, \\delta)$-LDP if and only if any pair of input individual values $x, x' \\in \\mathcal{X}$, for every measurable event $E \\subseteq \\mathcal{R}$:\n$$\n\\Pr[A(x) \\in E] \\leq e^{\\varepsilon} \\cdot \\Pr[A(x') \\in E] + \\delta.\n$$\nWhen $\\delta = 0$, this reduces to pure LDP.\n\n   - Unlike global differential privacy that requires a trusted curator, LDP enforces privacy at the individual level—each user randomizes their data locally before sharing it, providing protection against the data collector itself.\n\n- **Experiments.** We strengthen our experimental results with additional analyses from multiple perspectives, which we will include in the final version using the extra page.\n    - **Classification tasks.** We evaluate ODPCP on activity classification using the PAMAP2 dataset, categorizing activities into three classes (resting, light, vigorous) based on heart rate and sensor data. An XGBoost model provides predictions, with ODPCP generating private prediction sets at each time step $t$.  Figure 4 (available [anonymously here](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing)) shows ODPCP’s broad applicability to discrete prediction problems, maintaining strong empirical coverage and adaptive behavior under privacy constraints. \n   - **Reproducing results using random seeds.** While Setting 1 used fixed random seeds for reproducibility, the similarity between Cases 1-2 reflects their analogous data-generating processes and our method's robustness.  Additional experiments in [Table 4](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing)  confirm this stability, showing nearly identical results without seed fixing.\n  - **Privacy budget allocation.** Our framework supports time-varying privacy parameters $\\mu_t$, enabling adaptive privacy control for each individual.  Consistent with privacy composition, the overall privacy-utility trade-off is typically governed by $\\max_t \\mu_t$. We evaluated privacy budget allocation’s impact through two complementary experiments.  \n     - (1) In [Table 3](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) campares random-budget setting $\\mu_t \\sim \\text{Uniform}(0.5, 2.0)$ with fixed $\\mu = 2.0$ across all synthetic cases.  The coverage results are consistently close, demonstrating that random allocation preserves long-run performance.  \n     - (2) [Figure 5](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing)  demonstrates ODPCP's empirical stability across sample sizes (10k–100k) under dynamic per-step privacy allocations.\n\n- **Generalization to other data types.** Our method is model-agnostic. ODPCP's key innovation is Algorithm 2's private quantile update, which operates independently of model architecture or data type. This enables ODPCP to be applied to high-dimensional data (sensor streams, text, images) with some appropriate predictive model.\n    - **Computational Efficiency.** The quantile update is lightweight and efficient, with computational costs dominated by the base model $\\hat{f}_t(\\cdot)$.\n   - **privacy–coverage trade-offs.** They are determined by the base model's prediction quality, while our update maintains computational stability across diverse tasks.\n\n- **Comparisons with online methods.** Our work is specifically focused on online private conformal prediction methods for streaming settings, where existing approaches (ACI, DtACI) lack rigorous privacy guarantees. Direct comparisons are limited by differing objectives.\n    - We supplemented our experiments with a comparison against an offline private method—Private Prediction Sets (DPCP; Angelopoulos et al., 2021). As shown in [Table 1](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing), both methods achieve similar coverage.  However, ODPCP produces significantly narrower prediction sets, highlighting its efficiency in the online setting with privacy. \n\n- **Notation issues.** We will enhance the paper's clarity through explicit notation definitions,  and full consistency review.", "claims_and_evidence": "Main Claims:\n\n(1) The paper claims that ODPCP provides a novel online, one-pass differentially private conformal prediction framework applicable to decision-making in real time.\n(2) It asserts that the method generates private prediction sets without re-accessing historical data, which is especially useful for streaming data.\n(3) The authors further claim that the framework extends to handle heteroscedasticity via conformal quantile regression (ODPCQR).\n\nEvidence:\n(1) The paper supports these claims with rigorous theoretical analysis and proofs (e.g., Theorem 4.5 guarantees that the long-run empirical coverage converges to 1-\\alpha).\n(2) However, while the theoretical foundations are sound, the experimental evidence is based solely on regression tasks (using PAMAP2 and ELEC2) and synthetic simulations, with no experiments on classification tasks. This limits the empirical support for claims of broad applicability across task types.\n(3) Additionally, some synthetic simulation settings show little variation, which raises questions about the method's sensitivity to different data conditions.", "methods_and_evaluation_criteria": "The proposed ODPCP framework is motivated by the need for online privacy-preserving prediction. By designing a one-pass update mechanism for computing differentially private quantiles, the method avoids expensive batch quantile computation. The extension to conformal quantile regression (ODPCQR) is aimed at addressing heteroscedasticity, further enhancing the method's robustness.\n\nThe evaluation uses real-world time series datasets (PAMAP2 and ELEC2) and synthetic data to assess performance in terms of coverage and interval width. While these benchmarks are appropriate for regression tasks, the paper does not include any experiments on classification tasks—even though the framework is claimed to be applicable to both.", "theoretical_claims": "I reviewed the proofs for Theorem 4.4 (privacy guarantee) and Theorem 4.5 (long-run coverage guarantee). The proofs are generally correct and employ standard differential privacy techniques (e.g., Gaussian mechanism and composition via disjoint data updates) and online learning analysis. While Theorem 4.5 guarantees asymptotically that the long-run empirical coverage, it does not provide an explicit finite-sample convergence rate. This lack of a quantified rate is concerning, which could impact performance before convergence is achieved.\n\nNotation issues:\n(1) The paper frequently uses symbols such as \\hat{C}, s, and S_t without clear definitions, which can impede understanding \n(2) There is an indexing inconsistency in Algorithm 2 (the algorithm description suggests one starting index while the update steps seem to be shifted). This should be clarified.\n(3) Additionally, the use of the “∨” operator (denoting maximum) is standard, but the paper does not explicitly define it.", "experimental_designs_or_analyses": "The experiments are clear in describing the evaluation on PAMAP2 and ELEC2 datasets, focusing on regression tasks. However, the experimental scope is limited:\n(1) Only regression tasks are evaluated, even though the paper claims broader applicability.\n(2) Synthetic simulation settings (Settings 1 and 2) show very similar outcomes across cases; in several tables, results are identical across different cases, suggesting either a fixed seed or limited sensitivity of the method to varying conditions.\n(3) The comparisons are primarily against non-streaming baselines, whereas a comparison with online or semi-bandit streaming methods (which are available in related literature) would better contextualize ODPCP's advantages in a true streaming scenario.\n\nThe paper allows for per-step privacy parameters \\epsilon_t, yet the experiments report only global values (e.g., \\mu = 0.5, 1, 2). It remains unclear how the privacy budget is allocated across the full sequence of online updates, which is critical given that each step consumes part of the overall privacy budget.", "relation_to_broader_scientific_literature": "The paper extends established ideas in conformal prediction and differential privacy to an online setting. It builds upon prior work in batch conformal prediction as well as recent online methods (e.g., those based on semi-bandit feedback) but distinguishes itself by providing a one-pass update mechanism that preserves privacy without re-accessing historical data.\n\nHowever, the experimental section does not fully engage with the literature on online or streaming conformal prediction methods. Incorporating comparisons with these approaches would strengthen the paper’s positioning.", "essential_references_not_discussed": "Although the paper cites many key works, it could benefit from a more explicit discussion of differences between local and global differential privacy, especially since it uses the term “LDP” without clear definitions or distinctions. Additionally, comparisons with recent streaming conformal prediction methods such as [*] would provide better context for the paper’s contributions.\n\n[*] Ge, H., Bastani, H. and Bastani, O., 2024. Stochastic Online Conformal Prediction with Semi-Bandit Feedback. arXiv preprint arXiv:2405.13268.", "other_strengths_and_weaknesses": "Strengths:\n(1) Novel one-pass online DP conformal prediction framework that avoids re-accessing historical data.\n(2) Rigorous theoretical analysis with proofs establishing long-run coverage guarantees.\n(3) Extension to conformal quantile regression (ODPCQR) to handle heteroscedasticity.\n\nWeaknesses:\n(1) While Theorem 4.5 guarantees asymptotically that the long-run empirical coverage, it does not provide an explicit finite-sample convergence rate. This lack of a quantified rate is concerning, which could impact performance before convergence is achieved.\n(2) The experimental evaluation is limited to regression tasks on only two real-world datasets and synthetic data; classification tasks and comparisons with other streaming methods are absent.\n(3) The discussion on privacy budget allocation over the online sequence is unclear.", "other_comments_or_suggestions": "(1) The paper uses many symbols and operators without explicit definitions, which may confuse readers.\n(2) There are indexing inconsistencies in Algorithm 2 that require clarification.\n(3) The use of “LDP” is ambiguous due to the lack of definitions distinguishing it from global DP", "questions_for_authors": "(1) Your framework allows for per-step privacy parameters. Could you elaborate on how the overall privacy budget is allocated across the full sequence of updates, and how this affects performance in long-run scenarios?\n\n(2) Have you considered including experiments on classification tasks or comparing your method with other online or streaming conformal prediction methods? This would help demonstrate the advantages of ODPCP in true streaming settings.\n\n(3) Some synthetic simulation results (especially in Setting 1) show almost identical outcomes across different cases. Were these experiments conducted with fixed seeds, or does the method inherently exhibit low sensitivity to these conditions?\n\n(4) While your experiments focus on regression tasks using PAMAP2 and ELEC2, how do you expect your method to perform on other data domains (e.g., high-dimensional sensor data, text, images), particularly regarding computational efficiency and privacy-coverage trade-offs?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XA6qt7KKGH", "reviewer": "Reviewer_99Kc", "summary": "In this paper, the authors propose a method for returning private conformal prediction sets in an online framework. They theoretically prove that their method guarantees long-term coverage control at a nominal confidence level while returning a private set. Finally, they empirically evaluate the method on synthetic and real data sets.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable suggestions. We address each point below.\n\n- **Definition of μ-GDP.** We will revise the paper to include a formal definition of μ-GDP(Dong et al., 2022). \n\n- **Clarification of Line 150.** We will revise Line 150 to include the private quantile online update rule and clarify its connection to the private subgradient used in the quantile update. Specifically, the private subgradient is computed as:\n$$\n{\\hat g} _ t + {\\mathcal{Z}} _ t, \\quad \\text{where } g _ t = \\mathbf{1} \\lbrace S _ t \\leq { {\\hat q}^ {1-\\alpha}} _ t  \\rbrace - (1-\\alpha).\n$$\nThe quantile estimate is then updated via:\n$$\n\\hat{q}^{1 - \\alpha}  _ {t+1}= \\left( \\frac{t}{t + 1} \\lambda _ t - \\frac{1}{t + 1} \\hat{g} _ t \\right) \\cdot \\max\\left \\lbrace W_{t - 1} - \\hat{g} _ t \\hat{q}^{1 - \\alpha} _ t\\, c \\right \\rbrace.\n$$\nThis enables adaptive updates of $\\hat{q}_{t+1}^{1 - \\alpha}$ via real-time feedback $\\hat{g}_t$, while preserving privacy. The update is learning-rate-free and matches Algorithm 2.\n- **Clarification of Line 191.** We will clarify the connection to Algorithm 2's update rules in the revision, which govern our online quantile adjustment via:\n   - Update of internal ``wealth'': $W_t = \\max\\lbrace W_{t-1} - \\hat{g}_t \\cdot \\hat{q}_t^{1 - \\alpha} \\, c \\rbrace$.\n   - Update of running average: $\\lambda_{t+1} = \\frac{t}{t+1} \\lambda_t - \\frac{1}{t+1} \\hat{g}_t$.\n   - Quantile update:  $\\hat{q}^{1 - \\alpha} _ {t+1} = \\lambda_{t+1} \\cdot W_t$\n   - These update rules, derived from coin-betting potentials, enable adaptive, learning-rate-free quantile updates.  \n\n- **Figure readability.** Updated figures will appear in the main paper for improved clarity. See  [Figure 1](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) for the revised version.\n\n- **Clarification of Line 596.** We will add the following comments to support these claims. The Kelly-inspired wealth process $W_t$ demonstrates stable long-term growth and can diverge to infinity under mild conditions, even in adversarial settings [Orabona and Pál, 2016]. Consequently, beyond some time $T$, the lower bound $c$ becomes inactive, leaving updates entirely driven by adaptive coin-betting dynamics [Cutkosky and Orabona, 2019].\n\n- **Hyperparameters adjustment in line 191**. We adapt coin betting [Cutkosky and Orabona, 2018] to more complex online private conformal prediction problems by using noise-perturbed subgradients and introducing a transient lower bound $c$. This yields learning-rate-free updates supporting one-pass processing, DP guarantees, and adaptive calibration.\n\n- **Static and dynamic regrets.** Our work focuses on coverage guarantees under DP, not regret. While conformal prediction evaluates performance through coverage and interval size, investigating regret-based metrics for private conformal prediction remains an interesting direction for future work.\n\n- **Clarifications of Section 5.** You are right!   Section 5 extends our method to conformal quantile regression (CQR), using quantile regression-derived scores to create prediction sets robust to heteroscedastic and heavy-tailed data.\n\n- **Comparisons with ACI or AtACI**. Our work is specifically aimed at private conformal prediction methods for online settings, where existing approaches (ACI, DtACI) lack privacy guarantees. While direct comparison with non-private methods is limited by differing objectives, we benchmark against: (1) Original online baselines (quantifying privacy-utility tradeoffs) and (2) Offline DP-CP [Angelopoulos et al., 2021]. As  [Table 1](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) shows, our method achieves comparable coverage with 30-50% narrower prediction sets, demonstrating superior online efficiency under privacy constraints.\n\n- **Explanations on cases in the synthetic section.** Due to space constraints, we omitted detailed justifications but will add them using the extra page. Our synthetic cases evaluate methods across (i) covariate dependence, (ii) noise structure, and (iii) temporal dynamics. Setting 1 examines static environments (fixed coefficients), while Setting 2 tests dynamic scenarios with changepoints, ensuring comprehensive evaluation under practical conditions.\n\n- **Initialization of $W_0$, $\\lambda_1$.** We conduct sensitivity analysis to initialization parameters $W_0$ and $\\lambda_1$​ by taking multiple values. [Figure 2 ](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) shows stable coverage across configurations, demonstrating algorithm robustness to starting values.\n\n- **CP interval for Figure 4**. We'll add CP intervals. Please refer to the updated [Figure 3](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing).\n- **$\\mu=0$**.We use $\\mu=0$ to denote the no-noise case and will revise this notation for clarity.\n\n- **Notations.** We will correct all typos, formatting issues, and ambiguous expressions.", "claims_and_evidence": "Yes, the claims made in the paper are well supported.", "methods_and_evaluation_criteria": "Yes, the evaluation makes sense even if the propose algorithm is only compare to another one. \nPerhaps a comparison with ACI or DtACI should be added (but it is really minor).", "theoretical_claims": "Yes, the theoretical claims seems to be ok.", "experimental_designs_or_analyses": "Yes, the design of the experiments is good.", "relation_to_broader_scientific_literature": "Yes, related work is well discussed", "essential_references_not_discussed": "No, I think the bibliography is good.", "other_strengths_and_weaknesses": "1\\ This is a very interesting problem.\n\n2\\ The code is provided. I think this is a real plus.\n\n3\\ See section \"Questions\"", "other_comments_or_suggestions": "1\\ $\\mu$-GDP is never defined.\n\n2\\ Line 150 right column (rc) \"At each time step t.. is estimated by optimizing the pinball loss...\" This sentence is not clear. Furthermore, I think that an equation with the update rule should be given in the paper (and not just in Appendix B)\n\n3\\ Paragraph Line 191 left column is not very clear. It might be preferable to make it more formal with mathematical equations.\n\n4\\ The figures are way to small, we can barely see which curves correspond to which methods.\n\n5\\ Line 596: \"Consequently, there exists a time T after which the practical constraint of c naturally vanishes, leaving the optimization process governed by the adaptive mechanism\". A citation proving this point should be added.\n\nMinor:\n\n1\\ Line 54 rc: \"Online differntially\"\n\n2\\ Line 66 rc: \"Early work, such as that by Romano et al. (2019)\"  not the good citation.\n\n3\\ Line 102: $X$ is in bold.\n\n4\\ sometimes it's $\\epsilon$ and sometimes it's $\\varepsilon$.\n\n5\\ Line 383 rc: \"adaptive lagged feature regression\" add a reference.\n\n6\\ Line 416 \"the rolling coverage of the our proposed\"", "questions_for_authors": "1\\ Paragraph Line 191 left column: Is the automatic adjustment of hyperparameters a contribution of the paper or simply an application of previous articles in online coin-betting dynamic?\n\n2\\ In the online CP literature, the static or dynamical regret is often controlled. Why not study it in this paper?\n\n3\\ I do not understand the relevance of Section 5. This is just the algorithm with a particular score, isn't it?\n\n4\\ Why not compare your algorithm to ACI or DtACI for instance? \n\n5\\ In the synthetic section, many cases are presented, but never explained. Why did you choose these particular cases? \n\n6\\ In general, the ACI algorithm is very dependent on its initialization. Is this the case here with $W_0$ and $\\lambda_1$?\n\n7\\ In figure 4, I think that the resulting CP interval should be added.\n\n8\\ I do not understand the $\\mu = 0$ in the real data as $0$-DGP seems to be undefined (Lemma 3.3). Can you elaborate on this?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "k5aCJoPPSg", "reviewer": "Reviewer_Qza5", "summary": "This paper proposes a framework for differentially private conformal prediction in an online setting.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable suggestions. We address each point below. \n\n- **Privacy Guarantees of Theorem 4.4**. Our core contribution is Algorithm 2's online private quantile construction, which enables Algorithm 1 to generate online private prediction sets via DP's post-processing property. While we focused theoretical analysis on Algorithm 2's privacy guarantees (which automatically extend to Algorithm 1), we will explicitly state Algorithm 1's privacy guarantees in Theorem 4.4.\n   - **Theorem 4.4 (Revised).** Algorithm 1 satisfies $\\max_{1 \\leq j \\leq t} \\epsilon_j$-DP, $(\\max_{1 \\leq j \\leq t} \\epsilon_j, \\max_{1 \\leq j \\leq t} \\delta_j)$-DP, or $\\max_{1 \\leq j \\leq t} \\mu_j$-GDP, depending on the mechanism used, where $t \\geq 1$.\n   - In line with composition-based privacy intuition, the privacy-utility trade-off is governed by $\\max_t \\mu_t$. Our additional experiments with time-varying $\\mu_t$ in Table 3 and Figure 5 through the [link](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) shows that long-run performance depends on the maximum privacy parameter.\n\n- **Definition 3.1 applying to an online setting.** While Definition 3.1 provides a general DP framework, our method specifically enforces LDP at each step by controlling plausible deniability for any two individual values- a special case of Definition 3.1. Unlike global DP, which requires a trusted curator, LDP operates at the individual level: users randomize their data locally before sharing, ensuring protection even from the data collector. We will formally define LDP in the revision for clarity.\n\n- **Comparison with a private baseline.** To the best of our knowledge, our work is the first to construct online DP conformal prediction sets in the streaming setting. To provide a meaningful baseline, we compare our method with the *Private Prediction Sets* method proposed by Angelopoulos et al. (2021), an approach for constructing prediction sets under DP in the offline setting with access to the full calibration dataset.  It cannot handle streaming data or distribution shifts, especially changepoints, due to its static model.  [Table 1](https://drive.google.com/file/d/1aBxCivdxzrSrqEMYtPrN6CJdfvyrZaNR/view?usp=sharing) shows that while Private Prediction Sets achieve slightly higher coverage, our method (ODPCP) yields narrower prediction intervals, especially under strong privacy constraints.  This demonstrates that ODPCP offers a favorable privacy–efficiency trade-off in the online setting.\n\n- **Contributions and Relation to the literature.** Our work tackles the critical yet underexplored challenge of private uncertainty quantification in streaming environments. We will add the following comment in the revision.\n   - Unlike existing private conformal methods—such as the offline approach of Angelopoulos et al. (2021) or the federated solution of Plassier et al. (2023)—our method is specifically designed for online applications, advancing both privacy-preserving prediction and real-time uncertainty quantification.\n   - The core technical innovation addresses a fundamental tension: maintaining valid coverage under privacy constraints while processing data in a single pass. Unlike batch methods, our privatized quantile estimation must balance noise injection with statistical efficiency without future data access. We provide theoretical guarantees of long-run nominal coverage despite these constraints.\n\n- **Nonconformity score at time step $t$**: In Algorithm 1, nonconformity scores $S_t$ are computed and used in a strict one-pass manner to ensure streaming compatibility. At each time step $t$, the score $S_t = \\mathcal{S}(X_t, Y_t)$ is computed for the current observation $(X_t, Y_t)$ and used once at $t+1$ to update the private quantile estimate $\\hat{q}_{t+1}^{1-\\alpha}$ via Algorithm 2. For instance, $S_1$ (initialized arbitrarily) updates $\\hat{q}_2^{1-\\alpha}$, while $S_2$ updates $\\hat{q}_3^{1-\\alpha}$, and so forth. Crucially, each $S_t$ is discarded immediately after use, avoiding storage of historical scores and guaranteeing memory-efficient operation in online settings. This design allows streaming without accessing past observations.\n\n- **An example of privately trained models.** Our framework is model-agnostic, and it provides online private prediction sets regardless of whether the base model was trained with DP-SGD or standard SGD. This intentional decoupling focuses privacy guarantees on the conformalization step. We have included empirical comparisons (Figures 7-8, 12-13 in the Appendix) showing stable coverage rates across both training approaches and wider intervals with DP-SGD models, reflecting their inherent prediction uncertainty (via higher $S_t$ scores). These findings confirm our method's robustness to the base model's privacy status. \n\n- **Presentation**. We will add missing algorithm input parameters and fix typos, ambiguous expressions, and formatting issues(see Table 2 in the link).", "claims_and_evidence": "Yes -- claims are supported by evidence.", "methods_and_evaluation_criteria": "The proposed methods are reasonable.", "theoretical_claims": "1. Theorem 4.4 is supposed to be the privacy guarantee for Algorithm 2, but I wondered if it was intended to be the privacy guarantee for Algorithm 1. If Theorem 4.4 is indeed for Algorithm 2, then I feel like it would be important to include a privacy analysis for the end-to-end process of Algorithm 1. If Theorem 4.4 is for Algorithm 1, then the $t^{th}$ iteration of Algorithm 1 invokes $t$ DP algorithms i.e. the overall privacy cost would be $\\max_{1 \\leq j \\leq t}$ $j\\epsilon_{j}$ rather than $\\max_{1 \\leq j \\leq t}$ $\\epsilon_{j}$. (Also Theorem 4.4 gives a privacy guarantee based on $\\delta_j$ or $\\mu_j$, neither of which appear as input to Algorithms 1 and 2.) So something is a little fishy but it’s unclear to me whether this is due to superficial typos or deeper issues.\n\n2. Definition 3.1 is for a fixed-size dataset and it’s not immediately clear to me how it would apply to an online setting with streaming data. In this case it feels like it might be natural to define a notion of neighboring data sequences or maybe to apply local DP for a single datapoint, but I didn’t see anything like this formalized in the paper.", "experimental_designs_or_analyses": "The empirical evaluation only compares the proposed private methods with non-private baselines. It would be helpful to also see a private baseline.", "relation_to_broader_scientific_literature": "While there is a related work section, I didn't really feel that it does a good job explaining how the previous work is related to the methods proposed in the paper.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "I didn't feel that the related work section contextualized the paper's contributions, and so it was difficult for me to evaluate the novelty of the paper. My understanding is that the paper incorporates differential privacy into online conformal prediction (i.e. the novelty comes from the DP and not the conformal prediction), but if so it is kind of disappointing that the DP techniques are very basic and textbook.\n\nI also felt the paper could use some polishing, particularly for the presentation of the main algorithms.", "other_comments_or_suggestions": "- $c$ isn't given as an input parameter in Algorithm 2, nor are $\\delta_t$ and $\\mu_j$ in Algorithms 1 and 2;\n- \"differntially\" --> \"differentially\" around line 52, second column of page 1.\n\n\nIn terms of presentation of the experimental results, I found Tables 1 and 2 to be cramped and difficult to read. I think that giving the results a little more space and breathing room would help make the table more informative and visually appealing, and to improve the flow I’d also recommend reversing the order of the $\\mu$’s so that the table would read (left to right) non-private —> low privacy ($\\mu = 2$) —> medium privacy ($\\mu = 1$) to high privacy ($\\mu = 0.5$).", "questions_for_authors": "1. For Algorithm 1, is the non-conformity score computed for only the current $t$ or for the current $t$ as well as all previous $t$?\n\n2. Is Theorem 4.4 intended to be the privacy guarantee for Algorithm 1, rather than Algorithm 2?\n\n3. Motivation-wise, would it be possible to give an example where the pre-trained model does not require privacy protection, but the prediction sets do require it?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: After consideration of the author rebuttals, all reviewers feel that this work deserves to accepted. In preparing the final version, the authors should be sure to follow through on their promised changes, which will significantly improve the paper. In particular: giving more context on LDP, adding new experimental results, making figures larger/easier to read, clarifying the implications of Theorem 4.4, and generally fixing typos and improving notational consistency.
Decision: Accept (poster)