Privacy Profiles Under Tradeoff Composition
Authors: Paul Glasserman
Venue: Accepted by TMLR ()

Abstract: Privacy profiles and tradeoff functions are two frameworks for comparing differential privacy guarantees of alternative privacy mechanisms. We study connections between these frameworks. We show that the composition of tradeoff functions corresponds to a binary operation on privacy profiles we call their T-convolution. Composition of tradeoff functions characterizes group privacy guarantees, so the T-convolution provides a bridge for translating group privacy properties from one framework to the other. Composition of tradeoff functions has also been used to characterize mechanisms with log-concave additive noise; we derive a corresponding property based on privacy profiles. We also derive new bounds on privacy profiles for log-concave mechanisms based on new convexity properties. In developing these ideas, we characterize regular privacy profiles, which are privacy profiles for mutually absolutely continuous probability measures.

Published in Transactions on Machine Learning Research (01/2026)
Privacy Profiles under Tradeoff Composition
Paul Glasserman
Py200ccoumbia..ed edu
Columbia Business School
Columbia University
Reviewed on OpenReview: https:// openreveew. net/ forum? id= gRuk jXWauu
Abstract
Privacy profiles and tradeoff functions are two frameworks for comparing differential pri- vacy guarantees of alternative privacy mechanisms. We study connections between these frameworks. We show that the composition of tradeoff functions corresponds to a binary operation privacy profiles call their T-convolution. Composition of tradeoff functions characterizes group privacy guarantees, the T-convolution provides bridge for trans- lating group privacy properties from one framework to the other. Composition of tradeoff functions has also been used to characterize mechanisms with log-concave additive noise; we derive a corresponding property based on privacy profiles. We also derive new bounds on privacy profiles for log-concave mechanisms based on new convexily properties. In de- veloping these ideas, we characterize regular privacy profiles, which are privacy profiles for mutually absolutely continuous probability mcasures.
1 Introduction
Differential privacy (DP, introduced in Dwork et al. (2006b)) a widely used framework for quantifying the efficacy of mechanisms for protecting data privacy. The framework applies in particular to mechanisms that add noise to data, usually with the goal of balancing access data and privacy protection. DP seeks to ensure that an attacker is unlikely be able detect small differences between datasets that reveal individual values. In 5),P), the parameters and ó control mechanism's security by limiting relative and absolute differences in the probabilities of a mechanism's 's response when applied to close but distinct datasets.
Privacy profiles (introduced in Balle et al. (020)) and tradcoff functions (introduced in Dong et al. 2022) are tools for representing and analyzing DP privacy guarantees. A privacy profile takes one DP parameter (8) as function of the other (c) and can be viewed as menu of parameter combinations offered by a mechanism.
For fixed mechanism, requiring a more stringent (smaller) value of requires accepting a looser (larger) guarantec for 8. Comparing privacy profiles allows comparison of the parameter combinations offered by alternative mechanisms.
Tradeoff functions, in the sense of Dong et al. 2022)) are grounded in a hypothesis testing view of data privacy. Consider an attacker trying to determine whether a query response comes from one database or another. Think of the two databases as differing only in the value of single entry, whose privacy needs be protected. The attacker's mull and alternative hypotheses state that the source is one databasc or the other. In this setting, privacy protection means making the hypothesis test difficult for the attacker by making query responses from the two databases difficult to distinguish. Any privacy mechanism introduces type I and type II errors for the attacker; a tradcoff function determines the lowest probability of one error for each probability of the other. Indeed, the tradeoff function is closely related to the receiver operating characteristic of hypothesis lesting. The privacy guarantees of alternative mechanisms can be compared through their tradeoff functions.
The goal of this paper is develop novel connections between privacy profiles and tradeoff functions and to these connections derive bounds privacy guarantees. Dong et. al. (2022) show that tradeoff

---

Published in Transactions on Machine Learning Research (01/2026)
functions and (e, 8) guarantees are related through convex conjugation: Zhu et al. (2022) extend this to establish a bijection between privacy profiles and tradeoff' functions. We build on these connections.
Our main result introduces to the DP setting binary operation on privacy profiles we call the T-convolution. The T-convolution of a pair of privacy profiles yields another profile; we show that the resulting profile corresponds to the composition of the corresponding tradeoff functions. In other words, the T-convolution of privacy profiles corresponds to the composition of their tradeoff functions (which should not be confused with the composition of mechanisms). The composition of tradeoff functions is important because it characterizes group privacy guarantees implied by mechansim (as in Dong et al. (2022), Theorem 3); group privacy is concerned with preserving privacy between databasos that differ in a group of values, as opposed to just in an individual value. The T-convolution thus provides a bridge between privacy profiles and tradeoff functions that translates statements about group privacy in one framework into the other.
In developing these idcas, we introduce the notion of regular privacy profiles. We show that the privacy profile for a pair of probability measures regular if and only if the probability measures are mutually absolutely continuous. A failure of absolute continuity is a failure of privacy because it implies that some of mechanism's responses perfectly identify the source of the response. Zhu et al. (2022) characterize privacy profiles as convex functions satisfying some additional properties; we show that regular privacy profiles are characterized by two additional boundary conditions. We also show that the T-convolution of regular privacy profiles is regular. This is convenient because privacy protection argues for limiting consideration to mechanisms with regular profiles.
In addition to its significance for group privacy, tradeoff function composition is central to the notion of infinite divisibility introduced in Awan & Dong (2022). Awan & Dong (2022) use infinite divisibility to characterize additive noise mechanisms in which the noise has log-concave density, a family that includes
the Gaussian and Laplace densities. The T-voovolution provides corresponding notion of infinite divisibility of privacy profiles and thus a characterization of privacy profiles for additive log-concave noise.
In the last part of the paper, we study log-concave privacy profiles in greater depth. A log-concave profile has a sensitivity parameter y that reflects differences in true query responses (before noise is added) between databases. We show that the T-convolution of log-concave privacy profiles takes a particularly simple form it corresponds to the addition of sensitivity parameters. This leads to bounds on log-concave profiles.
We also study convexity properties of log-concave profiles with respect to the sensitivity parameter y. We show that a log-concave profile is sigmoidal, meaning that it is convex at small values of y and concave at larger values of y, with an explicitly identified inflection point. In the convex region, privacy loss accelerates as the sensitivity parameter increases; the opposite holds in the concave region. We also establish a relative convexity property, which we may paraphrase as saying that at a larger value of e, privacy loss (from increasing sensitivity y) accelerates more quickly.
We formulate most of our results on privacy profiles for a pair of probability measures. As in Kairouz et al. (2015), Su 2024], and Wasserman & Zhou (2010). this corresponds to a binary hypothesis test between two bases. More generally, through the nolion of a dominating pair of probability measures introduced by Zhu et al. (2022). the privacy profile for a mechanism applied to multiple databases can often be reduced to the privacy profile for a worst-case pair of mcasures, to which our results can then be applied.
Because we formulate most of our results in terms of generic probability measures, most of our results are not restricted to scalar mechanisms mechanisms of a particular form. We do limit ourselves to scalar mechanisms when we discuss additive noise and, in particular, bog-concave additive noise. These results could be extended to multidimensional noise with independent and identically distributed log-concave components through Theorem 9 of Vinterbo (2022)
Some of the ideas we use in this paper have counterparts in the financial mathematics literature. The starting point for this connection is the fact that the "hockey-stick divergence" that underpins privacy profiles has the form of a call option in the financial setting. The privacy profile for the Gaussian mechanism, first derived in Balle & Wang (2018), coincides with the Black & Scholes 1973) formula central to option pricing. What we call the T-convolution was introduced to the option pricing literature by Tehranchi (202)).
The characterization of symmetry for privacy profiles is closely related to the notion of put-call symmetry
2

---

Published in Transactions on Machine Learning Research (01/2026)
discussed in Carr & Lee )009). The connection between infinite divisibility of tradeoff functions and log- concave additive noise has a counterpart in the actuarial science literature (Cherny & Filipovié (2011)). We note these parallels where they are relevant, particularly in cases where the interpretation of similar properties across the two problem domains far from obvious.
To summarize, the paper's main contributions are the following:
We show that composition of tradeoff functions corresponds to the T-convolution of privacy profiles, thus linking properties of group privacy and log-concave mechanisms across the two frameworks.
We characterize the privacy profiles of mutually absolutely continuous probability measures regular privacy profiles, defined by two simple conditions, with counterparts for tradeoff functions. We also characterize symmetric privacy profiles.
We derive novel convexity properties for the privacy profiles of log- log-concave mechanisms, leading to new bounds.
Section 2 provides background on privacy profiles and tradeoff functions. Section 3 characterizes regular privacy profiles. Scction g defines the T-convolution and studies its propertics and its implications for group privacy and log-coneave mechanisms. Section presents new convexily properties for log-concave mechanisms. Section @ concludes, and most proofs are deferred to appendix.
2 Preliminaries: Privacy Profiles and Tradeoff Functions
We are given a collection X' of databases and a symmetric binary relation = for which we interpret a = x' to mean that x, e X are neighboring databases. For example, we might take x ~ x' to mean that æ and x' differ in one entry. A mechanism M is a randomized algorithm on X; for each x E X, M(x) variable vector representing the response returned by the mechanism when applied to x. We associate with x X' a probability measure P, with the interpretation that P(A) is the probability that M(x) A, for any (suitably measurable) set A. We express this M(x) ~ P.
random
Definition 1. [Dwork al,, | Dwork et al. (2006a)) The mechanism M on (X, satisfies (c, differenlial privacy (DP), for some and 8 -1 1, i/, for all measurable sels A,
Q(A) S P(A) + 5,
(1)
whenever (xx ~ P and Mxx') Q for some x, e X with = x'.
Balle et al. (2020) define a privacy profile (a privacy curve in Gopi al. (2021) for mechanism, based on which we introduce the following essentially equivalent definition.
Definition For any two probability measures P and Q on the same measurable space, the privacy profile ...Q : o0) [0, 1] is the function
kp.((K) sup(Q(A) KP(A)),
(2)
the supremam taken over measurable sets. The privacy profile for mechanism M is the supremum of (K) over all (P, Q) with M(x) ~ P and M(x') Q for some x, E with x ~ x'_
We will simplify ån.q to 8 when Q and P are fixed. To connect 2 to 1. take K = It will be convenient to consider all K 2 0, even though requiring 2 0 would limit us to K K21 1. Except where otherwise noted, we lake the privacy profile to be a function of K 2 0 rather than e.
Balle et al. (2020) use different but equivalent definition based on the following "hockey-stick divergence." As usual, we write Q < P if Q absolutely continuous with respect to P, and we write Q P P and Q mutually absolutely continuous. We write + for max (2, 0z.
3

---

Published in Transactions on Machine Learning Research (01/2026)
Definition 3. For probability measures P and Q the same measurable space with Q < P, and any K 2 0,
( dP - K )
Hx(QIP) =Pp Ep
(3)
define the privacy profilc of mechanism M to be the supremum of Hx (Q[P) over all P ~ M(x) and Q ~ ((x') for neighboring databases x, x'. The definitions are essentially equivalent because if Q & P, then (K) = Hx P); ; see Theorem 1 of Balle et al. (2020) and references there, particularly
Balle et al. (0200]
Proposition 2 of Barthe Olmedo (003
If Q fails be absolutely continuous with respect to P. then the calculation of the divergence Hx Hx(Q|P) involves additional term consistent with general properties of divergence measures. As explained in Ali & Silvey (1966), pp.133-134, there is set A, with P(A) 1, such that Q < P when Q and P are restricted to A, and for which Q(49) is largest, where A is the complement of A. Informally, A is the set of outcomes that are possible under Q but not under P. (See Ali & Silvey (1666), p.133, for a precise definition; our set A is their set N.) Then 3 generalizes to
(400
[QQ AP (ap-k) K)
+ 14 + Q(A))
Hx(Q|P)= = Ep EPp
(4)
If, for example, we take K 0, then 4 yields Hx = + Q(49) = consistent with what we
get from 2 even when Q * P. From now on, we take (K) = =Hx(Q[P)) with the understanding that
H (Q) P) takes the form in 44 when Q fails to be absolutely continuous with respect to P.
2022) and modified in Awan & Dong 2022]. (The following definition corrects a minor typo in Awan & Dong (2022) also noted in Awan
We turn next to the definition of tradeoff functions as introduced in Dong et al.
& Ramasethu (2024).)
Definition 4. For any two probability mensures P and Q on the same measurable space, the tradeoff function
T(P.)): [0, 1] + [0.1] is the function
T(P,Q)(a) = inf(1 - Eold] Ep(d] S $1-a) a),
(5)
the infimum taken over all measurable rejection rules (i.e., random variables & with 0 11)
Suppose M(x) P and M(x') Q. Think of é as a function of the mechanism's output used by an adversary to infer whether the mechanism was applied to database x or x'. The adversary's decision rule is to infer with probability & that the true database is x' and otherwise. The tradeoff function traces the optimal type II error over such rules at cach value of one minus the type I error. The original definition in Dong et al. 2022 is
Ta(a) = T(1 - a).
(6)
Proposition 1 of Dong et al. 2022) shows that To [0. + [0 is a tradeoff function (in their original definition) if and only if T, is continuous, convex, and decreasing, with (x) < 1 - xx for all x E [0, 1). (Here and throughout, we use "increasing" and "decreasing" in their weak sense and insert "strictly" where the strict sense is intended.) Thus, under the definition of Awan & Dong (2022) T [0. 1] -> jo, 1] is a tradcoff function if and only if
T is continuous, convex, and increasing, with T(x) S x, for all x e [0, 1].
(7)
Zhu et al. (2022) derive a related characterization of hockey-stick divergences and thus, implicitly, of privacy profiles through the set of functions 5 : R4 + [0. 1] satisfying
is convex, decreasing, with 6(0) and 8(K) > (1-K)+, for all K 2 0.
(8)
Note that the condition 5(0)= = requires the representation in 4
if i * P.
What we call . sometimes called &q. Our notational preference anticipates the connection between privacy profiles
and traedfff functions in Section 4.1 With our notation, ów.q linked the tradeoff function for (P,Q) rather than (Q. P).
4

---

Published in Transactions on Machine Learning Research (01/2026)
3 Regular Privacy Profiles
3.1 Definition and Conditions for Regularity
A failure of absolute continuity is a failure of privacy: if (a) can return values that are impossible under M("",, then observing such a value allows an adversary to definitively distinguish between the two databases. We are therefore interested characterizing privacy profiles őn:q of mutually absolutely continuous proba- bility measures. In other words, of all the functions 8 satisfying the conditions in ( how can we distinguish the ones that are privacy profiles for some mutually absolutely continuous probabilily measures? We will call these regular privacy profiles. Besides being of independent interest, will need this characterization for later results.
As a bounded and decreasing function, 8(K) has a limit as K - 0o which we denote by 8(0o). As a convex function, any ò satisfying has at least a right-derivative 8'(K) at all K 2 0. (For this and other properties of convex functions, see Appendix A This holds even if the likelihood ratio dQ/dP is discrcte-valued. (It will follow from the representation in Lemma 1 below, that if the likelihood ratio discrete-valued, then (K) is piecewise constant, 8 (()) is piecewise linear.)
Definition 5. A function d: R++ + [0. 1] satisfying (8) is regular if it also satisfies d'()) -1 and 8(co) 0.
Zhu et al. 2022). Lemma 9, implies that function ē is the privacy profile for a pair of probability measures
if and only if it satisfies 8. We extend their result as follows:
Proposition 1. A function 5 is the privacy profile of a pair of mutually absolutely continuous probability measures if and only if it is regular.
The interpretation of this result will be as follows: the condition (0),(()) = -1 ensures that dQ/dl does not have mass at zero, and the condition (ro)(x)) ensures that dQ/ /PP does not have mass at infinity.
In developing this connection, the proof of the proposition uses the following lemmaa, which characterizes the distribution of likelihood ratio through regular privacy profile. By extracting the distribution of the likelihood ratio from a privacy profile, we can determine hhether the profile is compatible with a mutually absolutely continuous pair of probability measures: the likelihood ratio should be strictly positive and finite.
Lemma 1. Suppose 8 is a regular privacy profile, and define G(x) = 1+)' x 2 O. Then G is a cumulative distribution on R,, with G(0) = 0. If the random variable L has distribution G under probobility measure
P, then
= f P(L > dx =
| 00
- -
(1- dr = 5(K),
2 0.
(9)
K
As a consequence of this result (see the proof in Appendix
Bl, we have that if P Q, then, for all x E I,
55x== = =1 ) 1))0)p(()) =: Gp.(());
dQ dP Sx
P
(10)
in particular, the privacy profile εp. determines the distribution Gr.q of the likelihood ratio dQ/dP.
The random variable - log(dQ/dP)) is often called the privacy loss random variable, so the privacy loss distribution (under P) is Gr.q(e the privacy loss distribution used by Dwork & Rothblum (016)) Sommer et al. (2099) Koskela al. (2020) and Gopi et al. (002)), among many others.
(p-o(==)). Thus, Lemma also connects privacy profiles with
We illustrate Lemma and Proposition with examples.
Example: (Gaussian mechanism). Consider a mechanism that adds a standard normal random variable Z to a query response. Consider two databases with query values yo and yo + y, y >> Let P and Q be the probability measures associated with the query responses No + Z and yo + y + Z. follows from Theorem 8 of Balle & Wang (2018) that the privacy profile ōn.Q is given by
8(K) = +
log K
+
y
KΦ
log K
y 2
(11)
y
2
5

---

Published in Transactions on Machine Learning Research (01/2026)
where 4 is the standard normal cumulative distribution function. The measures satisfy P is easily seen to be regular. The odf G introduced in Lemma | evaluates to
Q, and
11
1 1+8 = + log x
y 3/ = P ((022-9122)) 2
dQ dp S x
(12)
which confirms that 1+8' is indeed the edf of the likelihood ratio. This analysis extends to multiple databases if we take y to be the largest difference in query responses across all pairs of databases, called the sensitivity of the query. If we replace Z with aZ. for some > 0, then y in (11) becomes y/a, which amounts to change of units. We will refer to as the sensitivity parameter (or the scaled sensitivity parameter) for
the mechanism. (The expression in [1 coincides with the Black & Scholes (1973) formula for the price of a call option with a strike price of K and an interest rate of zero. In that setting is the total volatility
to expiration. In both settings, 11 arises as the expectation of the function x + (x - K)+ applicd to a lognormal random variable.)
Example: (Randomized response). Balle et al. (2020) consider mechanism acting on {0, 13. The mech- anism flips cach bit with probability 1 P: p [/2,,), and leaves it unchanged with probability p. Let P and Q be the probability measures on {0, 1} describing the distribution of the mechanism applied to 0 and 1, respectively, so P(O) = Q(1) = and P(1) = Q(0) = 1- Balle et al. (2020) derive the corresponding privacy profile
5(c²) = Ip - e' (1 - -p)p e e 0.
Writing == e and hight-differentizee with respect to K at K yields 8'(K = 0) p1
which would appear to violate regularity, despite the fact that P <> Q The apparent contradiction is resolved by noting that when we extend 6(K) to all K E xo) (rather than just K 2 1), following the same argument as in Balle et al. (020),, we get
5(K) [11-
- p) - Kp]+ + + pp- -
(13)
and 8'(0) -p = -1,
1, as required for regularity. Thus, this example illustrates a general point: checking the regularity condition at = requires defining the privacy profile on [0, oo), even though differential privacy is usually concerned only with K 2 1 (i.e., 6 <2 0).
Dominating pair of distributions. Zhu et al. 2022) call (Q, P) tightly dominating pair of distributions for mechanism M if, for all K 2 0,
sup Hx (M) ==zz'
(14)
Proposition 8 of Zhu et al. (0022) states that a tightly dominating pair always exists. We can add to this property that if M(x) dominating pair with P E> Q exists. The proof is as follows. Every ( is regular. The properties
< M(x'), for all x ~ x' in a finite collection of databases, then a tightly
characterizing regular privacy profiles are preserved by taking the maximum over a finite set of profiles, 5(K)- max MM(()) (K)
(K) is a regular privacy profile. As in the proof of Proposition 1 G(K) 1 1- (K) defines the edf of dQ/dP under P; any pair of distributions for which dQ/dP has distribution G provides tightly dominating pair. For example, one may take P to be uniform on (0. 1) and then define Q to have the edf (-) on (0, 1). (This recovers the construction in Zhu et al. (2022).) This is just one of many possible constructions. The more fundamental quantity is G, the distribution of the likelihood ratio for any tightly dominating pair.
3.2 Symmetric Privacy Profiles
The definition in (14 is symmetric in x and a', which suggests that we should consider suitably symmetric privacy profiles. A natural requirement for symmetry of a privacy profile ōp,Q the condition ôp.Q = dq. But if we are given a function 8 satisfying the profile conditions (8) but not specifically tiod to a pair (P. Q), what does it mean for 8 to be symmetric? This question answered through the transformation
8(K)= =1 K K5(1KK) K X20 0,
(15)
6

---

Published in Transactions on Machine Learning Research (01/2026)
where, before, 8(0)) should be interpreted as the limit of the decreasing, nonnegative function 8(-) at co.
We will call privacy profile symmetric if d = 8. The transformation (15) combines two transformations that are used in the option pricing literature: K - K ariscs in put-call symmetry, and - 1 K + arises in put-call parily; see, e.g., Carr & Lee (2009). The combination of the two turns one hockey-stick divergence (call option) into another. In our setting, this transformation has the following properties, which justify our definition of symmetry.
Proposition 2.
With the operation in 15
(i) dQ.r = 8r.q.
(ii If is a privacy profile, then is 8, and å = 8.
(tii) ò is regulor, then so is 8.
Property (i) also follows from Lemma 46 of Zhu et al. (2022). Property (iii) will be useful in verifying regularity. As we show in the proof of the proposition,
(00==11< + 8(00) = O.
(16)
In other words, the operation in 15 interchanges the two conditions for regularity, so we can verify one boundary condition for 5 by verifying the opposite boundary condition for 8. This property makes sense in light of part (i) of the proposition because ruling out a mass at zero (or infinity) for dQ/dP is equivalent to ruling out a mass at infinity (or zero) for dP/dQ.
4 Composition and Convolution
Dong al. [2022] show that group privacy can be characterized through the composition of tradeoff func- tions. Tradcoff composition is also used in Awan & Dong (2022) to define "infinite divisibility," " which characterizes the important class of additive log-concave noise mechanisms, which includes the Laplace and Gaussian mechanisms, among many others. The main result of this section (Theorem 1 establishes a correspondence between composition of tradeoff functions and a binary operation on privacy profiles.
4.1 Linking Tradeoff Functions and Privacy Profiles
We first recall a link between tradeoff functions and privacy profiles introduced in Dong al. (2022) Proposition through convex conjugacy. For function g IR R, the convex conjugate g" R IR. is defined by setting
(²( sup g(x)).
(17)
For g defined on a subinterval of IR, the supremum taken over that subinterval; equivalently, one may extend g all of by setting g(x) oo outside its domain. (See Appendix A for additional background.) Translating Proposition 6 of Dong et al. (2022) and Lemma 20 of Zhu et al. (2022) to setting yiclds the following:
Lemma
Let T be the tradeoff function and 8 the privacy profile for (P,Q). Then
8(K) = K + (K), K20,
(18)
and
T(a)=1+58( 1), 05a$1.
(19)
Proof. Lemma 20 of Zhu (2022) says that 8(K) 1 + ( K), for all K 0, with 8 the privacy profile for (P,Q) and T, the tradeoff function (under the definition in 0 for the same (P, Q); we include proof

---

Published in Transactions on Machine Learning Research (01/2026)
of this result in Lemma 10 of Appendix
C
Using the definition of the convex conjugate To get
Ty(K)
sup {-Ka -To(a}} 05051
- K + sup {K(1 -a) -T(aa)
05
K + sup {Ka To(1 a)}
05a51
K sup {Ka T(a))
USas1
= T
so 18 follows. For 19
we use the fact (see Appendix that T = T. Thus,
T(a)= = (a)
sup facK - (K)}
KER
sup facK - (6(K) + - -]]
KER
1 sup {(a 1)K 8(K))
KER
1 (a 1).
In light of Lemina 2 for privacy profile we let
Ta(a) = - 1), 05asl,
(20)
denote the tradeoff function associated with 8, and for tradeoff function T we let
5r(K) = 1011---0 (K), K 120 0,
(21)
denote the privacy profile associated with T. These operations are inverses of each other. For example, if we map - To - ôr,, we get the original å because
8T
1 (K)
1 K + supfaK TT(a))
1 1+ 1)K [1+ 5 - 1)]}
sup(aK - 8' (a))
8 (K) 8(K).
(22)
The last step follows from the fact the privacy profile functions convex, continuous, and finite. (See Appendix A
These connections allow us to characterize regular privacy profiles through their associated tradeoff functions:
Proposition 3. A privacy profile is regular if and only if Ts satisfies Ts(1) 1 and Ts(a)) 0, for all 0.
Figure I illustrates Proposition 3 The privacy profile on the right fails to be regular because 8'(0) > -1 and 8( (000 0. (Either property alone would violate regularity.) The associated tradooff function Tç on the left violates the corresponding conditions because is flat in an interval to the right of a 0 and it fails reach 1 at = 1.
8

---

Published in Transactions on Machine Learning Research (01/2026)
08
Trodoef funston Tea
0.7
06
Preacy
63
0.4
0.8
05
15
Figure 1: On the left, the tradeoff function T(a) () p (0, stays zero for (0,p) and has maximum value of 1 p < 1. On the right, the corresponding privacy profile 8(K) max - (1 p) Kp therefore has 80(0) = 11 + -1 and 8(co)= = > 0, so it fails both conditions for regularity.
4.2 The T-Convolution of Privacy Profiles
We now introduce an operation on privacy profiles we call the T-convolution, in reference to Tchranchi (2020,, who introduced the operation for option prices and derived several properties we apply here. We will see that the T-convolution of privacy profiles corresponds to the composition of tradeoff functions, so the "T" is suggestive this sense as well.
Definition 6. For privacy profiles ō1, 82, the T-connolution is given by
6 52(K) = inf (1) + (KKn))) K K20, 120
(23)
with the convention that 0 62(K/// 0.
Before developing the conncction with tradcoff functions, we record some propertics of this operation on privacy profiles, analogous to properties in Tehranchi (2020) for option prices. Recall the definition of in 15p.
Lemma 3. For the transformation in 15 we have ó 82 = 82 81.
Lemma 4. (1) If 82, 82 are privacy profile functions, then so is 8n * 82. (Hi If 82 and 82 are regular, then is 8 82. (iii) In either case, for each K > 0, the infimuum over 1) is allained in [0, K +1..
Our interest in this operation stems from the next result, which shows that composition of tradcoff functions corresponds to T-convolution of privacy profiles. Tehranchi (2020) derives corresponding result. for option prices and notes related result in Borwein & Vanderwerfii (2010). In the following, denotes ordinary function composition: Tj T2(a) = (TT))) Recall the definition of T3 in (0)).
Theorem 1. For ang privacy profile functions 8,, 82,
To, To, T T88088-
9

---

Published in Transactions on Machine Learning Research (01/2026)
Proof. Applying 20
twice and then simplifying, get
To. Ta)(a)
1 (a)) 1)
1 1+ 55 1)] 1)
= 1+ 06 - 1))
1 1+ 5 ((a 1)K- - 62(
K20
= 1 + supfn sup {(a - 1)K 52(K) 61(1)
n20
K20
= + sup sup - 1)K -2)(K) 61(1)
K20n20
1 + sup sup (a 1)K' - n82(k'/n /n) 61(1)
K' K'20n20
1 sup {(a - 1)K" inf (102 (K' /n) + (1))
K'
920
= + sup {(a - 1)K" - 61 {2()
K'20
1+ (ő1 62)"(a 1)
= (a).
The composition of tradeoff functions Tj T2 is central to determining group privacy (as in Section 2.5 of Dong et al. )202)) and to the notion of infinite divisibility in Awan & Dong 2022), which characterizes additive mechanisms with log-concave noise, topies which we return in Sections and 4.4 Theorem
shows that composition of tradeoff functions corresponds to T-convolution of privacy profiles.
We should emphasize that Theorem 1 refers to the composition of tradeoff functions and not to the compo- sition of mechanisms. Dong et al. (2022). Section 3, and Gopi et al. (2021), Section 2, discuss operations on tradeoff functions and privacy curves that correspond to composition of mechanisms.
For lixed K, computation of (23) reduces to a one-dinensional convex minimization problem and can thus be carried out fairly efficientl,, at least if and 82 are easy to evaluate. We do not know of fast way calculate (33 for all K. In some cases, it can be evaluated explicitly, as we now illustrate.
Example: (Gaussian mechanism). The Gaussian privacy profile [1 implicitly depends on the sensitivily parameter To illustrate the effect of the T-convolution, make this dependence explicit and write 11 as 8(K, y). For any 31, y22 2 O, we now have
8(K, v1) 5(K, U2) = 8(K, y2),
(24)
so T-convolution corresponds to addition of sensitivity parameters the Gaussian mechanism. We will revisit this identity as consequence of more general result for log-concave additive noise mechanisms in Section 4.4 When translated to tradeoff functions through Theorem [ this result recovers Theorem 3 of Dong et al. (2022), which shows that composition of Gaussian tradeoff functions corresponds to addition of sensitivily parameters. For the operation in (24,, the minimizing v) is given by
n = www.//ntttaie (ww
Example: (Randomized response). Suppose the privacy profiles 8, have the form in 13 with parameters Pi, i 1,2. We can write these profiles in the equivalent form
8c(K) max 1 K,p; K(1 pc),0). i= 1,2,
which yields
81 + (K/r)/)) max (1 17,11 -1(11 Pp)) + max(n) 1 K,P29 K(1 p2),
(25)
10

---

Published in Transactions on Machine Learning Research (01/2026)
For each K 2 O, this is a piecewise linear function of 17 with break points contained in the set
(Kpz/(1 - (2). pi)ppp) p2)/pp.pi/11111111..11
On each 1y interval on which 51 (1))) ())(K/n) is linear, its minimum is attained at endpoint of the interval. In minimizing (25) over 7) it therefore suffices to consider y values in the breakpoints. In other words, 61 d2 (K) is the minimum of 25 over the four v break points. The result can be written in the form
51 62 (K) max K, - - 1-14--1-11 11--2)),pp -P19K/p..0).
with q 110-Pi)(1-110 PL. More generally, it is easy to see that if ò1 and 82 are piecewise linear, then so is 6, e 62. Even if we are ultimately interested in ó1 (K) for K 2 1, the calculation requires that ö, and d2 be defined for all K 2 O. (See the discussion leading to (1).) This example also helps emphasize that the T-convolution of privacy profiles corresponds the composition of tradeoff functions and not the composition of mechanisms. The composition of mechanisms in this setting leaves a bit unchanged with probability p P1P2 + (1 p1)(1 P2), and the resulting privacy profile has the form in 113 with this p.
We can informally think of d as a measure of "distance" between probability measures P and R. Measures that are "closer" together in this sense are harder to distinguish and thus provide better privacy guarantees. From this perspective, the next result, proves a kind of triangle inequality, comparing the distance between P and to their respective distances from a third measure Q. In the usual triangle inequality we get equality when two sides are perfectly aligned; an analogous condition yiclds equality in the current setting.
Proposition 4. Suppose P <
R. Then (i)
8Q. òP.Q 2 Óp.R.
(26)
and (ii) equality holds in 26 if dQ/ dR p(dP/dQ) for some increasing funclion p RR+ + R4.
If we convert 266 to tradeoff functions, get TQ, R o TP.Q Tp,R. Lemma 7 in Dong et al. 2022 is similar but does not include the equality in part (ii) of the proposition.
Example: (Gaussian mechanism) Consider the mechanism that returns X = 2, 2 ~ N(0, 1), when the true value is y. Let yps yqs and yr be the true values for P, Q, and R. Then,
dQ dR
= clu, u-)- -2112
dP = cvu -o--v,1x-1 -13
dQ
dQ/dR is an increasing function of dP/dQ if yr < My Dp yr V4 Up In either of these cases, we get equality in (26). Theorem 3 of Dong et al. (2022) is a related result for tradeoff functions.
Example: (Beta mechanism). The equality attained by the Gaussian mechanism is a special case of a more general property for log-concave distributions, to which we return in Scction 4.4. To illustrate that Proposition iii does not rely on this property we consider a mechanism that returns = UL/v when the true value is y > O, with U uniform on (0, 1), which gives the response beta. distribution. For this mechanism,
W1- dQ Ya X
dP 3p Pサr-ve
dR
Yr
dQ
y4
Here, too, dQ/dR R is an increasing function of dP/dQ if yr < Uq < Up or > Vo > even though the density of the response = U1/v can be either log-concave (y 2 1) or log-convex (0 y < 1).
Remark 1. For part (ii) of Proposition 4 we could alternatively require that dQ/dR and dP/dQ be increasing functions of common random variable. This condition implies (through Theorem 2 of Dhaene et al. (2002)) that (dR/dQ, dd)d)) have the joint distribution of (G (U), - U)), which is the key property used in the proof. In either formulation, the condition is very strong; assumes, in effect, that the same realization of the randomness in mechanism is used for two separate queries. This will lead to a worst-case bound for group privacy in the next section.
11

---

Published in Transactions on Machine Learning Research (01/2026)
4.3 Group Privacy
The symmetrie neighboring relation x = x' on collection of databases X' usually means that the databases a and x' differ in at most one entry. Group privacy extends this notion to databases that may differ in up to m entries. More precisely, write =m x' if x = 21, 21 = 22, .... Im-1 = x', for some databases fm....,mm-1 E X. Group privacy is concerned with how privacy guarantees for = extend to mm
Let M be a mechanism on X with privacy profile o; i.e., Marr (K) S 8(K), for all x x'. As we take = to be symmetric, is natural to assume that ō is symmetric. Write 8mm for the m-fold T-convolution of 8 with itself: 8*1 = 6, and 8mm (=(m=1) 6, for symmetry of 8 implies symmetry of 8mm The next result shows that the privacy profile 5 extends to the group privacy profile 8Th. Proposition 5. If (K) S 6(K), for all x = x', then ()))) S 80m
2....... It follows immediately from Lemma 3 that
for all x =m x'.
Proof. First suppose m 2, and suppose To x = x2. Write P. for the distribution of (a.). Then 6p,, 6, 0, 1. But then Proposition 4 implies that Sp,,Ps S P. P. I 8. Because this holds for any zo = 22, the proposition holds for m = 2. The extension to m 3, 3,4,... follows by induction. J
As special case of Proposition we recover the bound of Vadhan 2017). Temma 7.2.2, rephrased in terms of privacy profiles: if M has privacy profile 6(K) with respect to then it has privacy profile
- 8(k)
5m (K) = K1/m
(27)
with respect to =m. In light of Proposition it suffices to show that 8Tm < 8m This bound holds with equality at = 1. To proceed by induction, suppose the bound holds at m. Then
gm(m1)) (kmmt))
8mm (km+1))
8 8m (km+1)
8(K) + K6m ))
taking K in 23
S 8(K) + K km
K-1 5(K), applying 27
km-1
K-1 5(K).
Replacing K with K 11(m++1) now shows that (7) holds at m + 1.
As discussed in Balle et al. (2020), the group privacy bound in (27 can often be improved in specific cases. However, we can use Proposition to show that for any privacy profile 5 there a mechanism under which the bound in Proposition 5 becomes tight. More preciscly, start with a probability mcasure Po and a random variable L having cdl 1 + 8'(-) under Po- Suppose 8 is symmetric and regular; in particular, L > 0 and [P,[4]] 1. Suppose further that C, [L"] oc, 2...., m, and let c1 1. Define P., 1,..., m, by setting d.P./dPo = I,' I//C,, i I...., m. Interpret P. as the distribution of the response of mechanism applied to database i, and suppose consecutively indexed databases are neighbors. Then the group privacy profile for the mechanism is Pr...... which, by repeated application of Proposition fii) is equal to 8mm. This worst-case bound is attained when all the likelihood ratios dP.//PP, /PP are increasing functions of the same random variable, in this case L.
Whereas Proposition 4 and the inequality 5mm S 6m provide upper bounds on T-convolutions, also have the following simple lower bound. A corresponding result is provided by Tehranchi (2020) by different argument.
Lemma 5. For any privacy profiles 61, 82, we have on 82 max(61, 82).
Proof. Let (K) = K1+ As (K) 2 da, we have on (K) 2 81 dy({)) (nf + (1 K)+}. We know that (-) is decreasing with 84 (y) 2 -1, for all n,, whereas (1) K)+ is increasing with slope for
12

---

Published in Transactions on Machine Learning Research (01/2026)
77 K, so the infirumm is attained at 17 K, where it equals 51 (K). Thus, ó1 0 2 81. A similar argument shows that 61
82 2 82-
Lemma 5 confirms that the group privacy profile bound 80m is always at least as large as the privacy profle for neighboring databases, as it must be.
4.4 Additive Noise and Log-Concaviig
We now restrict attention to mechanisms that return Y = y 2 when the true query response for a database is y E R. (We can think of the query value y as normalized relative to a reference value of zero and thus refer to y as a sensitivity parameter, as in our discussion the Gaussian mechanism. The results that follow depend only on differences in query values.) For the additive noise Z we assume
Z has a density f supported on all of R.
(28)
This condition could be weakened, but the assumption of full support ensures that responses for different values of y are mutually absolutely continuous. Let Pg denote the distribution of the response Y when the true value is yi this response has density ʃ(- - y). Let
dP, dPo
) = En [ (()))) K }
- +
8(K,9) Er
K
f(Y)
Then also, for any a e R.
dP dPaty
) Ep, ( - K
k) )] 5(K, v),
Ep.
K
(29)
dPr
J(V - x)
by a change of variables. In other words, the privacy profile Pp,.P. depends the true values and y/ only through their difference y y- y/. The following result is analogous to Theorem 1.1 of Tehranchi (2020).
Proposition 6. For an addilive noise mechanism salisfying
28 for any K1, K₂ >> 0 and any yn U2 E R,
8(K, 91 + y22 S 6(K 01) +
(30)
Proof. Using 29 and then 26 we get, for any K, 1 > 0,
8(K, 91 + V2) = 8p. Pur +uz (K) S 6p P
Sp, (K) S 6p 6p (K) + nop.. (K/n).
(31)
Taking K = K2 K2 and n = K1 yiclds 30
Proposition 7. If log f is concave, then, for any Ur 1/2 > 0, and any K 2 0,
8(K,01 81 + v2) = 16(-.9) vn) ((,82))(KK
(32)
Proof. Using 29 we have
8(K, y1) Eppy ( ( 11 -122 v2)
-1
8(K,y2) -Epo )
( 122) f(Y)
x) )
f(Y - y2)
For log- ca-cooccee f, a likelihood ratio of the form f(Y -y-2)/f(X-- with y > 0, is an increasing function of Y (sce, e.g., Lehmann (9866), p.509). Thus, part (ii) of Proposition 4 inequality in 31 becomes an equality.
applies (sce Remark 1 the first
Proposition 7 extends the identity 24 from the Gaussian mechanism to log-concave additive noise, showing that the T-convolution becomes additive in the sensitivity parameter in this setting. A related result for tradeoff functions appears in Proposition 9 of Dong et al. 2022), and a corresponding result for option prices in Theorem 3.8 of Tehranchi 2020).
Following Awan & Dong 2002), call a family of tradcoff functions (T,t t E [0, oo)) infinitely divisible if it satisfies the following properties:
13

---

Published in Transactions on Machine Learning Research (01/2026)
(a'). o T. Tits: for all 8, 0;
(b'). for all >> 0, T. is nontrivial, meaning that 0 < (x))) < for some (0,
(c)) as 8 10, (x) - To(x) = x, for all E [0.
(We have added the lower bound in (b') to the conditions in Awan Dong (022) to exclude T, 0.) Awan & Dong (0022) call tradeoff function infinitely divisible if it is element of such family, We
similarly introduce the following definition for privacy profiles, replacing tradeoff composition in (a') with
T-convolution in (a).
Definition 7. A family of privacy profiles {ór, 2 0} is infinitely divisible if it satisfies the following properties:
(a) 0 8, = 8eto, for all 8, 20; 0;
(b) for all 0, da satisfies << 8,(1 < < <;
(c) as 8,(K) + 50 (K) (1 K)+, for all K E [0, oo].
In (b), convexity implies (see Appendix A (1) < 1 11+ (1) because 50( = 1, so the main requirement is that this inequality be strict. In (c), as before, 8(x0) = lim 6(K) = inf inf ((K). For the following, recall that we defined Ta(a) = 8 10-11 1) 19
Lemma 6. The privacy profiles {ōc. E [0, oc)} are infinitely divisible if and only if the tradeoff functions (Ta, [0, oo)} are infonitely divisible.
characterizes the tradeoff functions of log-concave mechanisms as elements of infinitely divisible families. (A precise statement of their result relies on the notion a canonical noise distribution.) Through the equivalence in Lemma 6 their result extends a characterization through privacy profiles.
Theorem 3.3 of Awan & Dong 2022
5 Convexity Properties of Privacy Profiles for Log-Concave Additive Noise
This section establishos two properties of the shape of privacy profiles for log-concave additive noisc. Theo- rem shows that they are sigmoidal the sensitivity parameter y, meaning that they are convex for small values of y and concave for larger values. Theorem 3 Jestablishes a relative convexity property, showing that, in precise sense, 8(K,y) v) is more convex in y at larger values of K. Convexity in y reflects accelerating privacy loss.
5.1 Sigmoidal Property
Dong et al. 2021 show that the tradeoff functions for mechanisms of the form q(x) +oZ (where g(x) the true query value for database x)) are pointwise increasing (more private) if is log-coneave. By applying
Lemma 5 (32 we get corresponding result. for privacy profiles, which is special case of Lemma 18 of
Vinterbo 2022)
Proposition 8. For con-cen additive noise, 8(K,y) is increasing in y > O, for all K 2 0.
Increasing y corresponds to increasing the difference in query values between databases or decreasing the scaling of the additive noise, both of which reduce privacy, as reflected in the reduction in 8.
We turn next. to second-order properties of 5(K,y) in y- (Convexity in K is automatic.) Convexity in y indicates an accelerating loss of privacy y increases, whereas concavity indicates slowing rate of loss. For the rest of this section, we impose the following conditions on the additive noise density f.
For all TR, f(z) =e-0(e) -d(),, where s is even, 4/ (z) 0, for all 0, and (/((2) 0, for all E R. (33)
14

---

Published in Transactions on Machine Learning Research (01/2026)
These conditions are stronger than strictly necessary, but they simplify several arguments. The condition 1/" >> O makes / (strictly) log-concave. A log-concave density is unimodal (see, e-g., Lehmann (1886), p.509);
the assumption that & is even and strictly increasing for 2 < 0 puts the mode of f at zero. The assumption that & (and therefore f) is even makes the additive noise symmetric, which is typical the examples commonly considered.
Define the likelihood ratio
A(2,0) = f(= u))/((),
(34)
and the inverse function
t(K, v) supf2 A(2,)) v) s K}.
(35)
Strict convexity of &b on R4+ implies that A(:.)) is strictly increasing, for all y > 0; it increases toward
K Kmax (y) lim A(z,y), #100
which may be infinite. It follows from (33 that f(z - y) is increasing in y, for y, and therefore that A(z.y) y) is increasing in y, for all > y, and therefore that Kmax(y) is increasing in y. Because f is even,
A(v/2,0) = f(-v/2)/ff(// =
Thus, for any y > 0, M(:3)) maps 1u/2, oo) onto [1, maxx())) and M(,y) has a well-defined inverse f(:3) [1, K (max(m)))))))))))) + 1y/2, 00),
= K, 1 km)
(36)
For K > K max(()) take t(K (K,y) ) oc, as 355 Equation 136 may be valid for K < 1, but we limit our discussion K 2 1, which corresponds to c 2 in the usual paramcterization of (c, diffcrential privacy.
The inverse likelihood ratio t(K,y) y) leads to explicit expression for the privacy profile for the additive noise mechanism with noise density f. As in Lemma 1 of Vinterbo 2022), we have
8(K,y) = Fly t(K,g)) ((F())(,,y)).
(37)
where F is the odf for the density f. This in turn leads to an expression for the derivative of the privacy profile with respect to the sensitivity parameter y. We write 0, and 0x for partial derivatives with respect to and K.
Lemma 7. We have
0) f(((K,))) - y) = Kf(t(K,))).
(38)
We can now characterize the regions of convexity and concavity of the privacy profile with respect to the sensitivity parameter y; these are the intervals which -,,(K,,) are increasing and decreasing, respectively.
Theorem 2. For K > 1, let ya the unique solution to K = f(0)/f(y) Then 8(K,,) is convex on y0)
and concave on
Example: (Gaussian mechanism.) The standard Gaussian density satisfies 33 In this case, we have Kmax(1) = 00, t(K,y) = log K/y + y/2, and the equation K = f(0) is solved by y" = V2 K. As a fuuction of y, the privacy profile 11] is convex on (0, 2og K) and concave on (v2 log K, oo). The left panel of Figure g plots 6(K, y), for K = 2. The circled point the inflection point y", where the profile switches from convex to concave.
Recalling 32
may express Theorem 2 as saying that the difference in profiles
[6 M/) 5(., (K) 5(K, y1)
is increasing in 1/2 for 91 < 91 + 82 v", and decreasing in y2, for of <n 91 + y2.
15

---

Published in Transactions on Machine Learning Research (01/2026)
0.9
0.9
Gaussan priccy proflle K-2
0.7
0.7
Gaussian privacy profie
0.5
0.6
0.3
0.3
1
13
2,5
0.2
0.6 Gaussian privacy profie with K-1
parameter
Figure 2: Left: The Gaussian privacy profile 8(2,y) y) is convex for small and concave for large y, the transition occurring at the circled point y". Right: 8(2, y) convex when plotted against 8(1,
5.2 Relative Convexity
We have seen that log-concave privacy profiles 8(K, y) are sigmoidal in y and neither globally convex nor globally concave. We will now show that under widely applicable additional condition, log-concave privacy profiles enjoy a relative convexity property: for 1 S K1 K2, this means that ((2,, o 6((K,, is convex,
where o(K,-)-1 denotes the inverse with respect to the second argument. (Recall from Proposition S that 8(K, v) is increasing in y.) When this holds, we say that 8(K2, is convez with respect to 5(K1. This property says that the higher-K K profile is "more convex" than the lower-K profile. Graphically, it means that a plot of the curve y + (8(K1,)) v/, 8(K2, v)) is convex, even though the plot (y, 6(K, y)) not. This is illustrated in the right panel of Figure 2 which shows that v) becomes convex when plotted against 8(1, y).
Relative convexity leads to bounds on privacy loss, which discuss after the following result. As in & log ʃ.
33
Theorem 3. Suppose
w" (=))) is decreasing in >> 0.
(39)
Then for 1 < K2 K2, 5(K2,)) is conver with respect to )(K1;)), (Vo, oo), for all yo > 0 with K Kmax K2.
If Kmax (v) = 00 for all > 0, then the conclusion holds for any yo 0.
We will prove the theorem by proving that condition (40) in the following lemma holds. The lemma specializes Theorem 1 of Cargo (1965 to our setting. Recall that 8(K, y) increasing in y.
Lemma 8. If
(g5(K),8) 2,0(K1,9) then 6(K2,)) is convex with respect to 8(K1,)), on (yo. oo).
is increasing in y, >> y0.
(40)
From
38
we get
0,0(K2.8) Kef(t(K2, v)) (,6(K1.8) Kif(t(K1,))) f(t(K1.8) -y)
((t(K2.v)-9) y)
(41)
so it will suffice to show that the rightmost expression in is increasing in for K₂ > K1.
We can interpret relative convexity as saying that the privacy loss at K2 accelerates relative to the privacy loss K1, as y increases. In particular, with 1 S Ki K2, and < y1 < y2, Proposition 2.6 of Rajba
16

---

Published in Transactions on Machine Learning Research (01/2026)
on I
Distribution
(2)
a/" / decreasing
Normal
2² /2
Subbotin
|=|"
Logistic
2 2 log(11++00) log
Sym-Gamma
1 - log([=|
a
>
0
a>o
0
> 0
Table 1: Examples of log-concave noise distributions satisfying (39)
201 4b and
41
yield
KaJ(1(K2,
8(K,, y2) - 8(K2, 31)
(8(K) y2) 6K1, 91)).
(tf(t(K1,
Recall than an increase in the sensitivity parameter y entails a loss of privacy, which reflected an increase in the privacy profile. The inequality bounds the privacy loss at higher value of K (a higher value of with K == e relative to the privacy loss at lower value of K.
In the case of the Gaussian additive noise, at K = [1] simplifies to 0(L,y) 20(1/2) - 1. If we apply Theorem with Ki 1 and K₂ = K > 1, we get the following consequence. Suppose the sensitivily
parameters 0 < y2 < satisfy
(222/2) - (2)1 2ya/2) - (222/2);
(42)
then
8(K, 12) 6(K, v1) S 8(K, vv) ((KK))))
(43)
If (( were convex, then (43 would hold whenever the increment y/3 1/2 exceeds the increment y/ V1 Theorem 3 tells us that the required spacing of the increments is instead determined by 42) For sensitivity
parameters satisfying
(42,, the privacy loss increments satisfy 43 A version of 43
appears in
Glasserman Pirjol 2023 in the context of option pricing.
Table shows examples of log-concave noise distributions and the parameter ranges in which they satisfy the conditions of this section. The first three are also studied in Vinterbo (2022). The last example is a symmetrized gamma. distribution. The gamma density proportional to 2 R4 is log-concave for 0, in which case is also the mode. The function (z (== is therefore decreasing for = > 0. Combining it with its mirror image for z < 0 yields a symmetric log-concave function on R that can be normalized to a probability density. We omit some normalization constants Table because they do not affect the conditions on v).
The Subbotin distribution with requiring strict log-concavity and excluding this case; for the Laplace distribution, v" = 0. The privacy profile for the Laplace distribution takes the form (sce Theorem 3 of Balle et al. (2020) 5(K, y) = (1-vKe (1-VKe--/3) m/2/t If we take > log K₂ > log Ki 2 0 and check for relative convexity we get 2(,,, 1 5(Ki,
the Laplace distribution. By requiring r in Table [ we are
+ log(K2/ K1), which is linear in y. The notion of relative convexity thus degenerates in this setting neither function 8(K,,)) :), i = 2, is more convex than the other.
6 Concluding Remarks
This paper contributes to the characterization of privacy mechanisms by establishing connections between privacy profiles and tradeoff functions, two frameworks for describing differential privacy. Our main result shows that the composition of tradeoff functions corresponds to the T-convolution of privacy profiles. These operations are relevant because the composition of tradeoff functions characterizes group privacy and log- concave mechanisms, which include the Gaussian and Laplace mechanisms. This paper also characterizes regular privacy profiles, which are privacy profiles for mutually absolutely continuous probability measures. Regularity determined by two boundary conditions, which also translate to simple conditions on tradcoff functions. We also derive new convexity properties for log-concave mechanisms, which provide new bounds their privacy profiles. Some of these results exploit analogies between privacy profiles and option pricing.
17

---

Published in Transactions on Machine Learning Research (01/2026)
A Background Results
This appendix provides some background technical results, primarily concerning propertics of convex fune- tions. These properties are used throughout the paper because privacy profiles 8(-) are convex functions on o0,, and tradeoff functions T(-) are convex functions on [0
Let I IR be an open interval and suppose f + R is convex. Denote by f4 and f' the right- and left-derivatives of f. The following summarizes results from Theorem 2.1.2 and Corollary 2.1.3 of Borwein & Vanderwerff 2010
(i) f4 (a) and f- (x) exist and are finite at every a E 1;
(ii) f4 and f" increasing functions on
(iii) (x) $ (v) < [w),,, for x < with x, y E 1;
(iv) if (L)) X < l' (xr), then fwv) 2 (xx A(y x), for all y E.
(v) for any k,y E I,
n f(v) f(x) / (=( = (" (4)
(44)
The closed interval [f- (x), (2)) used in (iv) is the subdifferential of f at x, denoted by 0f(x).
To lighten notation, throughout this paper we write 8' for the right-derivalive of As an application of (iv),
with f 8, f4 8', x L, y = we have 8(0) 2 5(1) (1), and thus 8(1) S + 8'(1,, property used
following Definition 7 Similarly, 8(x) 5(0) x (x), property used in the proof of Proposition P
Part (v) does not appear explicitly in Borwein & Vanderwerl (201)), but their Theorem 2.1.2(() implies (v).
As in
17 for function g R + R, the convex conjugate g" R + R is defined by setting
g²( = sup(yz- - g(z)).
zER
If the domain of is subinterval of R, the supremum is taken over that subinterval. In particular,
(1) sup 8(K)}, T*()) sup {ya - T(a)}. oc(0.1]
K20
The conjugate of the conjugate is denoted by g"" Proposition 4.4.2 of Borwein & Vanderwerff (2010) gives general conditions under which g 9. The following sufficient condition, which follows from their result, is adequate for our purposes because it applies to both privacy profiles and tradeoff functions:
(vi) if g is finite, convex, and continuous on an interval [a, b] or co), then g"* = g on that interval.
Thus, 8** = 8 and T**
We also use the following consequence of Proposition 4.4.5 of Borwein & Vanderwerfi 2010 which relates the subdiffernntials (defined above) of g and g". This property is used in the proof of Proposition 3
(vii) g is finite, convex, and continuous on an interval [a, bj or [a, oo), then for any in that interval, 0g(x:) if and only if x 0g" (u).
Thr proof of Lemma requires moving back and forth between convergence of a sequence of privacy profiles and convergence a sequence of tradcoff functions. This in turn requires interchanging limits and convex conjugation. Theorem 1.3 of Komuro (1989) gives conditions permitting this interchange. It implics the following sufficient condition in particular:
18

---

Published in Transactions on Machine Learning Research (01/2026)
(vii) Suppose the functions g and In: 2 are finite and convex interval I and that gn) g(2) for all E T. If 7 - [0, 1}, then ghd (v) + g" (v), for all y E IR, and if T= [0, 00), then (v) - 9 (V). for all < 0.
The two cases for the interval apply to tradeoff functions and privacy profiles, respectively, allowing us to formulate the following result, based on the mappings (18) and (19) between privacy profiles and tradeoff functions.
Lemma 9. If (K) - 8(K), for all K 2 0, then To (a) To(a), for all a (0, (n T(a), for all [0, 11, then őr, (K) + 8r(K) for all K 2 0.
Proof. If 8n (K) 8(K), for all K > 0, then (v) (v), for all y < O, and then, through 19 (a) + Ta) for all < 1. The second claim works similarly.
B Omitted Proofs from Section 3
Proof of Lemmal 1 Convexity of 8 implies that (the right-derivatinn 8' increasing (see Appendix A), so G increasing, with G()) = 1 + (0) = Because is decreasing, dx(x I 0, for all æ 2 0, so G(xx) 1. A convex function is equal to the integral of its right-derivative (sce (44) ), so, for any K K'
8(K) - 5(K') = -(K)) = -- (1(x) da f K"
K
-- dr.
1 G(v))
Letting K" + 5o, we get (by regularity) 8(K)) + and therefore
5(K) 1/= 11- [1-G(z)) dx.
000
In particular, G(x) - 1 as x - cc. Thus, G is a cumulative distribution function. If L has distribution G under P. then the first equality (9) follows from integration by parts.
Proof of Proposition 1 For the "if" direction, let 8 a regular privacy profile. Let the random variable L have distribution G under some probability measure P, with = + 8', as Lemma 1 Then P(L 0) = G(0)= 0, and
E = 1 G(x)) 8(0) 1.
Thus, L is posilive and has unit expectation under P. We may therefore define probability measure Q by setting Q(A) = Ep [], for measurable A. In other words, dQ/dP = L, and because L is strictly positive and finite, P Q. Moreover, by Lemma
dQ dP
m - Ep((L- (oo((-KKttt =))]=
Ep
K
(45)
so is indeed the privacy profile for mutually absolutely continuous probability measures P and Q. To prove the "only if" claim, suppose Q < P. Then Ep[dQ/dP] = 1, and the dominated convergence theorem implies
dQ dP
dQ
x) )' = 0,
lim 6(K)= = lim Ep K 4200
k)
Ep
lim K dP
K koo
confirming that 5(oc) = 0. From the representation
d
dQ
dP -)= - - -
-/a P(dQ/dP x) dr,
Ep
we get 8'(0) P(dQ///P> 0). Tf P P then P(dQ/dP= = 0) = 80)) -1
19

---

Published in Transactions on Machine Learning Research (01/2026)
Proof of Proposition
(1) Using 15
and ( we get
(K)
= 1- K (1/K)
K + sup(KQ(A)) - P(A)}
1 K + suppK(( Q((A)) (1-
= (up(P(A) KQ(A)) = kQ.P(K).
A
(ii) We will verify that 8 satisfies the properties in S in the order they appear there. By Boyd & Vanden- berghe (2004), p.89, if 8(K) is convex then so is (L)L/K). To show that å is decreasing, we need to show (taking right-derivatives)
= = 8(1/K) (1/KK)KK 50
(46)
for K > 0. Convexity of 8 implics (sce Appendix A that ((x) 8(0) (x)) At x 1/K, this yields
-8(0) ((()/))))))))))) ( (K)) S 0, and recalling that 50) 1 yields (46). At K 0, we have 8(0) 1. Finally, have
8(K) = 1 K (K(1/K) 2 1 K K(1 --
K (K 1)+
KYT.
The fact that 8 = 8 is immediate from 15
(iii) It remains to show that and 8 share the properties in Proposition 1 From (Ō(K) 8(0)) K - 8(1KK) see that 80(0) -1 < ō(00) = 0. Similarly,
80(0) = -1 + 8(00)= = O.
Thus, if either profile is regular, then so is the other.
C Omitted Proofs from Section 4
The following result stated as Lemma 20 Zhu et al. (0022) as a consoquence of Proposition 6 of Dong et al. (2022). For completeness, we provide a proof without the symmetry condition in Proposition of Dong et al. (2022)-
Lemma 10. For pair of probubilily measures (P,Q), let 5 be the privacy proflle and let To be the tradeoff function under the definition in 6). Then 8(K) = 1 + T- for all K 2 O.
Proof. Recall the hypothesis testing interpretation of To which says that To(a) is the smallest type II error probability among tests with type I error probability a, with P the distribution under the mull hypothesis and Q the distribution under the alternative. For any measurable set A, the test with rejection set A has type error probability == P(A) and type II error probability
Q(A) 2 Ta(a). Thus, recalling 2
8(K)= = sup - KP(4)) < supf1 - To(a) - Ka} = + supf -apf-Kea Ka To(a)) = = 1 1 (-K-).
(47)
To prove the reverse incquality, we recall that the Neyman-Pearsee lemma (as in Lchmann 1986 says that for all a there exist constants k > 0, c E [0, 1], and a test
pp.74-75)
1, dQ/ dQ/dP= dP > k;
c. dQ /Q dP k;
(48)
dQ < k.
such that [p[Ø]] = a and Ta(a)= = - Eo(ø]. (o)]
In (48). we allow the possibility that dQ/dP = oo, but consider first the case Q < P. Note that (x - KY+ 2
u(x K), for all u E [0, 1]. As takes values in [o, 1], we therefore have
8(K) = Ep Ep((d//de
K)+] - 2 Ep[(dQ/dP)o) KEP
Eglø] KE
1 TT((a) Ka.
20

---

Published in Transactions on Machine Learning Research (01/2026)
As this holds for all a, we have
8(K) 2 1 + sup( - Ka To(a)) =1 ((-K)-
(49)
Without the assumption that Q < P, we have the more general representation in (4), which yields ö(K) Ep((dQ/PP - 1)+ + Q(49), with P(A)= = 1. Since P(A*) 0, we have @ on A"; an optimal test always rejects P on A Thus, Ep[(dQ/dP)e)
+ Q(49) = Boløl. and Ep A = Eplø] = a, so
8(K) = Er((dQ/dP -)+1A|+ 2 Ep (dQ + Q(49) KEp[1Ad) = To(a) Ka,
and we again get 49 Combining
and 49
proves the lemma.
We briefly discuss how this result for ordered pair of probability measures (P, () relates to the symmetric
result for mechansims in Proposition 6 of Dong et al. (0022 The argument in Lemma can be reformulated to say that (P, Q) satisfies (e, 6)-DP 11 if and only if (a) 2 1 - 5- Ka, with K = e (and o(K) is then the smallest for which this holds). To make this a symmetric condition we would apply it as well to To
which, as discussed Dong et al. )022), is the tradeoff function for the pair (Q, P). But, taking inverses of both sides, the condition To (a)
8 Ka equivalent to To(a) 2 (1/K) tradeoff functions are nonnegative, we can write the combined conditions (P.Q) and (Q, as
aa. Recalling that
To(a) 2 fe,((a) = max - a,
a)}-
(50)
This is the condition in Proposition 3 of Dong et al. 2022), based on extending the argument in Theorem 2.4
of Wasserman & Zhou 2010)) Condition (50) is the symmetrized version of the condition (a 2 Kaa.
Proof of Proposition From 20
we get (1(1) 8
supx (-)K)) 1 8(0o) ) so (1(
+ 8(00)= = 0. The condition
o(K
K)+ in (8) implies that 6'(0) 2 1, for regularity is suffices to
show that (0) < -. Through
21 this is equivalent to (0) < 0, where T denotes the right-derivative
of T Thus, we have
80(0) -1
+ T (0) < 0
+ #b > 0 such that b E (Tg
< 16 > 0 such that 0 E (b)
+ 1b > 0 such that Ta(a) 2 (b),,, for all a E [0,1]
(b) > Ts(0) - for all be (0, 1].
The second equivalence holds because the right-derivative is the largest element of the subdifferential 0T; (0).
as discussed in Appendix A The third stop uses the inverse relation between the subdifferentials of convex
conjugates noted in item (vii) of Appendix A For the fourth step, v E @Ta(b) means that Ts(a) > Ts (b) + v(a - b), for all a, (by item (iv) of Appendix A and this becomes (a 2 (b(b) when 0. The last step
holds because T3 attains its minimum value zero at zero.
Proof of Lemma
We have
8 (2(K) = 1 K + K(8 (L)()) = 1 K + K inf (1) + ()2(L/1K)),
720
and also
82 ((K)
inf (82(1') + (K/T()))
22
inf (1 - + 76 + 7/ /// (K//))6
1/20
= 1 1- + inf (o
7'20
1- K K inf (2)2((6/)))++)((00))
720
where the last step follows from setting " 1/ K.
21

---

Published in Transactions on Machine Learning Research (01/2026)
Proof of Lemma 4 (i) We verify that ò1 82 satisfies the properties in ( For each 77, 51(1) n)²((Kn)) is
decreasing in K so the same holds for the infinum over 1). For any 1) 2 0,
(1) + (K/n) (1 (1-1)* -)+ (711 K/n)+ 2 (1 n) + (n K)* 2 (1-K)t,
with 0- (1- - K/0)+ 0, so 61 (K) 2 (1 - K)), and o 52) =
It remains to show convexity. By Boyd & Vandenberghe (2004), p.89, the function (n + 17²2 (K/n) inherits convexty from 52. Then (1, K) 51 + 52 (K/n) is also convex. By Boyd & Vandenberghe (2004) pp.87 88, taking the infimumm over v preserves convexily, so òi 82 is convex.
(ii) Now suppose 81 and 82 are regular. We verify that ò1 82 satisfies the two properties in Definition For any > 0,
S 81 (2(K) - (1 + (K/m))
Because 82 is regular, 82(K/n) + 0 as K - xi, 80
0 x ह1 (20) S (1)))
and since this holds for all 1j > 0, and 61 is regular, we conclude that that ó1 62()0) 0.
To complete the proof, we need to show that (61 62) 1. In light of (16). it suffices to show 81 (00) = O. By Lemma this condition is equivalent to 82 (00) = O. By Proposition ii). both & and 8, are regular, and we have already shown that this implies that 82 _00) 0.
(iii) For any K > 0, + 8(n) + no(K/n) is convex on oo), so it either attains minimum value or it decreases montonically in But 8(1) + (o((K))) 2 ro((/n) 2 nn(1 - K K/n)+ = (1) K)+, which exceeds 8(0) = for 7 2 K +1. The minimum over 7) must therefore be attained in [0, K + 1].
Proof of Proposition have
(i) For any 1 >> 0, recalling the representation of regular privacy profiles in 45 we
dR dQ
+
dQ
+
(Q,)(1) + n0p.((k/1)) = EQ
11
+ Ep
1) dP
K
dR
(1= K dp
+7
EQ
11
+ B.Q
dQ
dQ
dR
K dP
dQ d
+1
EQ
(51)
dQ
(RR dQ dQ dP
-1 Ep
dRR
) =dP,R((K).
Ep
K K)
K
dP
where the inequality 51 follows from x= + y+ > (a + y)+ (ii) Kt 0, ōq (r:)(0)= = = (0).
For K > O, we will show that equality holds in (51) for suitable choice of n, Write GQ.R(z) = + 8 r2 (x) for the distribution of dR/dQ under Q (as in (100,, and write Gq.p for the distribution of dP/dQ under Q. For any edf G, define the inverse
(w) 2 0: : 2 u).
If dQ/dR is an increasing function of dP/dQ, then dR/dQ a decrcasing function of dP/dQ, and (dR/dQ, dP/dQ) have (by Theorem 2 of Dhaene et al. (2002) the joint distribution of (G (U), Golp(1 U)), with U uniformly distributed on (0, T). Let чΙK inf : GQ.n(a) 2 1 Go Gx (x)]K)] By Lemma GQ,R(I) t 1 and 1 - Gq,((x/K) & O, t oo, лкк < sc. Since GQ,((z) $ 0 and 1 (Z. t 1, x J O, we have πи > O. Moreover, the definition of nK implics that
Gqn((ik) 2 1 GGr((TK/K) and GQ,R(nk-) S -G.r(Tk/K-). K-).
22

---

Published in Transactions on Machine Learning Research (01/2026)
As in Tehranchi 2020
Theorem 2.16, this implies that
{u: (u:GQ.((u) 7k} S {u: GQ - u) 2 nk/K)
and
{u: (u:Gqr G2r((1 - u) > n K} C {u: GQ,n(") (w) S nk}
i.e,,
dR/dQ `e = dP/db dQ 1e /
and
dP/dQ > πк KK + dR/dQ S дк-
Thus, (dR/dQ- - ]л)[ - (dP/dQQ) 2 0. But ry 2 0 implies xt + y = (xr + y)+, so equality holds 51..
Proof of Lemma 0 We divide the proof into three parts based on the three conditions in Definition 7
Equivalence of (d') and (a): This follows directly from Theorem and (22)
Equivalence of (8) and (b): If (b) holds, let 1 + (1) E (0, Then, applying 20 get
(a) = 1 + sup ((a - 1)K - 6(K) = 1 sup (1) 8(K)) K20
K20
The convexity of 8 implies that the supremum is attained at K
To(a) = 1 + (1() - 5(1) = a 5(1) E (0, a),
and thus (b') holds. Conversely, suppose (b') holds. Then 0- < T(a*) < ax for some a² E (0, 1). We will show that 8(1) > 0, 1+ 8(1) > 8(1), and (1) < 0, in that order. Applying 18 to evaluate 8(1) yields
6(1) sup (a T(a)) a- -((a") 0 0.11
verifying that 6(1) > 0. Again using 18 we have
8(1+h) + h)
= - h sup(a(1 +h) T(a))
h (1+h) -((a")
6(1) + (a" -1)h.
Letting h 1 O, we get 81(1) 2 a- 1, and then + (11 2 a' > a" T(aa) = 8(1), as required for (b).
Finally, regularity implies 6(20) 0, so 8(1) > 0 entails 8((1) <0.
Equivalence of (c) and (c): For a E (0, 1), we have
(a) = + sup ((a - 1)K - (1 - K))}
K20
sup + min (0, 1 - -K}} = a; K20
i.e. Top = To. Suppose (c) holds. Then Lemma 9 implies that Ts, (x) - TT, (z) = x, for all x E [0, 1). (All
tradcoff functions have T(0)= 0, so we automatically have Ts, (0) + (T))))) At r = 1, we have
To. (1) = =1 sup (K 0 - ((K)) = - 1- (0o) + 1, K20
where the last step applies (c) at oc. Conversely, (c') holds, then with T To. by using 19 to evaluate 8 we get
6(K) 1 K sup {a(K 1)} (1 K)* (0)).. aE(o.1]
Lemma g yields 8, (K) + 80(K), for all K oo). Also, (00) 1 + inf x supae slp (la- (.(1) 0; thus, 6, (00) (00))
23

---

Published in Transactions on Machine Learning Research (01/2026)
D Omitted Proofs from Section 5
Proof of Lemma 7 Differentiability of f implics differentiability of A and then differentiability of for K e
[1, Kmax(y)) (y)),
0, where (36) holds. We may therefore differentiate (37 with respect to y to get
u)) [(w-1(K,))) - ([(-(((,,))0,. f(t(K,y) - y) [f(t(K.8) -y) - (f
((((K,))-D KS(((K,)),
where the second equality uses the fact that f is even, and the third and fourth equalities use the identity
f(t(K, v) v) (f(((()))))
(52)
implied by 136
Proof of Theorem Rewriting 52 as f(t(K,)) 9) v)/f(t(K,)) K and differentiating this ratio with
respect to yields
f'(((Kv)) v)(0,((K,0) 1]s(((K,))) v)) - ((((K)))) ())0 = O.
(53)
So
['((K))) -9) ((((K)))) ((((K v) - y) [(t((, v) f(t(K,))) f(t(K, v)
))((K,u)
For log-concave f, fx))f(() is decreasing, so the term square brackets is positive. follows that
0, 20 ('(:(K, v) v) 2.
By f'(x) for <00 and f'(z) for => so
f(((K,y) 9) 20 t(K,)) y.
From the monotonicity of the likelihood ratio in 34
t(K, v) S y + ((t(K.g).)) S A(y.0) K S f(0)/(()) +92
Thus, ((Ky)) decreasing on (0,
y+) and increasing (y*, 0o). Because is decreasing on R4+, it follows
that ((((K,)) y)) is increasing (0, y²" and decreasing (y", oo). In light of 38 0,5(K, is increasing v0, and decreasing on (y" oo).
The proof of Theorem 3 relies two lemmas.
Lemma 11. The partial derivatives of satisfy (,t(KK v)f((((((()))))))) v) KOxt(K,y))(((KK v) v), for O and K E [1, Km)(y)).
Proof. We can rearrange 53 and apply
52 to get
(((t(K,)) -y) 0,t(K, y) = f'(t(K, v) - f(((Ktt)))
(54)
strict log-concavity of f (i.e., 4² > 0) ensures that the denominator is not zero. Similarly, differentiating the identity f(t(K,)) v) - y) = K ((t(K)))) with respect to K yields
f(t(K, K)/K 0kt(K,y) f'(t(K,)) v) - 9) K (((((())) f(t(K,y) - 9) - K ((t(t, y))
f(t(K,v) v))
(55)
Combining 54
and 55
yields the result.
24

---

Published in Transactions on Machine Learning Research (01/2026)
Lemma 12. For y 0 and K [1, (v)) t(K, v) is convex in y.
Proof. We will show that 0yt(K, y) is increasing in y, for y > 0 and K E [1, (y)) We will abbreviate [(K, y) to L, particularly when it appears as the argument of another function. Divide top and bottom of 54 by f(t v) K ftt) to get
ft (ftyy)f((t-o 1) 0yt(K, l(t - (ll-y)/((--- -) -1(1)/((10)
which we can write as
4 (t
(' y)
0,t(K, = -t²(tt - y) (t) 1' - 9) (t)
(56)
This is increasing in y iff the recriprocal is decreasing in yi ie, iff
(1)
increasing in y.
tt y)
Differentiation shows that this holds if the numerator of the derivative is nonnegative; i.e.,
""())0,t)a'' y) (tt)" w)( 2 0.
which holds if
W'(' (1- - -1000000000000000000000000-00110 4) 20
Using
56]_
may write this condition
2t(t - y)
(t) - 4) - (t) v) 10(t - v) (t)) + ('())""(t y) 2 O.
This condition will hold for t and y linked through t t(K, y) holds for all 2, > 0, meaning that
(1 - y)
(=) y) -' (=)))) y)] (0(z (2) + (x y) 2 0.
This condition holds if (recall that v is increasing bocause vb convex, so 4/(2 v) < (2))))
[+ (z))')) y) (=())) v)] (z v) + (e' v) ('())] y) 0o,
which holds if which holds if
(=)))(((z - y) (2 - v) - (z)x - 4) 00
2² y) (>)² [ y)}²
(2)
which follows from 139
g suffices to show that the right side of 441 is increasing in y, or, oquivalently that its logarithm is increasing y. For S K1 < K2 S Kmax(y)) we have
Proof of Theorem 3 In light Lemma
f 0x log (((((()))))) v) dK
log [((K2,, y) y) log ((((1,))) - v)
[ K2 ('(((Ky)) -1) Dxt(KK dK JK. f(t(K,y) -1)
R 0r1(K, y) dk,
Ki
where the last step uses Lemma Lemma 12 implies that the integrand is increasing in y and therefore that the integral is increasing in y-
11
25

---

Published in Transactions on Machine Learning Research (01/2026)
References
Syed Mumtaz Ali and Samuel D. Silvey, A general class of coefficients of divergence of one distribution from another. Journal of the Royal Statistical Society: Series B (Methodological) 28(1): 28(1):13,-142, 1966.
Jordan Awan and Jinshuo Dong. Log-coucave and multivariate canonical noise distributions for differential privacy. Advances in Neural Information Processing Systems, 0894429--44244 2022.
Jordan Awan and Aishwarya Ramasethu. Oplimizing noise for I-differential privacy via anti-concentratioon and stochastic dominance. Journal of Machine Learning Research, 25(351):1-32 2024.
Borja Balle and Yu-Xiang Wang- Improving the Gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference on Machine Learning, pp. 394-403. PMLR, 2018.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy profiees and amplification by subsampling. Journal of Privacy and Confidentialily, 10(1), 2020.
Gilles Barthe and Federico Olmedo. Beyond differential privacy: Composition theorems and relational logic for f-divergences between probabilistie programs. In International Colloquium on Automata, Languages, and Progrumamnng, pp. 49 60. Springer, 2013.
Fischer Black and Myron Scholes. The pricing of options and corporate liabilitics. Journal of Political Economy, (3):6637 654, 1973.
Jonathan M Borwein and Jon D Vanderwerff. Conver Functions: Constructions, Chamatteiaations and Countereramples. Cambridge University Press, 2010.
Stephen P Boyd and Lieven Vandenberghe. Convex Optimization. Cambridge University Press, 2004.
Gerald Thomas Cargo. Comparable means and generalized convexity. Journal of Mathematical Analysis and Applications, 12(3):387 382-399, 1965.
Peter Carr and Roger Lee. Put-call symmetry: Extensions and applications. Mathematical Finance, 19(4): 523 560, 2009.
Alexander Cherny and Damir Filipović. Concave distortion semigroups. arXie preprint arXiv:1104.0500 2011.
J. Dhaene, M. Denuit, M.J. Goovaerts, R. Kaas, and D. Vyncke. The concept comonotonicity in actuarial science and finance: theory. Insurance: Mathematics and Economics, 31(1):3-3 33, 2002.
Jinshuo Dong, Weijie Su, and Linjum Zhang, A central limit theorem for differentially private query answer- ing. Advances in Neural Information Processing Systems, 34:14759-14770, 2021.
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3-37, 2022.
Cynthia Dwork and Guy N Rothblum. Concentrated differential privacy. ar preprint or arXis:1603.0189, 2016.
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Nya Mironov, and Moni Naor. Our data, our- selves: Privacy via distributed noise generation. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 486 503. Springer, 2006a.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to scnsitivity in private data analysis. In Theory of Cryplography Conference, pp. 265 284. Springer, 2006b.
Paul Glasserman and Dan Pirjol. Total positivity and relative convexity of option prices. Frontiers of Mathematical Finance, 2(1):1 2023.
26

---

Published in Transactions on Machine Learning Research (01/2026)
Sivakanth Gopi, Yin Tat Lee, and Lukas Wutschitz. Numerical composition of differential privacy. Advances Wn Neural Information Processing Systems, 34:1 14:11631-11642, 2021.
Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In International Conference Machine Learning, pp. 1376-1385. PMLR, 2015.
Naoto Komuro. On basic properties of convex functions and convex integrands. Hokkaido Mathemalical Journal, 18(1):1-30 30, 1989.
Antti Koskela, Joonas Jälkö, and Antti Honkela. Computing tight differential privacy guarantees using ffi. In International Conference on Artificial Intelligence and Statistics, pp. 2560 2569. PMLR, 2020.
E.L. Lehmann. Testing Statistical Hypotheses. Second Edition, Springer Texts in Statistics. Springer, 1986.
Teresa Rajba. On some relative convexities. Journal of Mathematical Analysis and Applications, 411(2): 876 886, 2014.
David M Sommer, Sebastian Meiser, and Esfandiar Mohammadi. Privacy loss classes: The central limit theorem in differential privacy. Proceedings on Privacy Enhancing Technologies, 2:245-269, 2019.
Weijie J Su. A statistical viewpoint on differential privacy: Hypothesis testing, representation and Blackwell's theorem, 2024. URL https://arxiv. hts//bbb/24999/ 095558
Michael R Tehranchi. 24(1):1-38. 2020.
Sack-Ssholes inequality: Applications and generalisations. Finance and Stochastics,
Salil Vadhan. The complexity of differential privacy. In Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich, pp. 347-450. Springer, 2017.
Staal A Vinterbo. Differential privacy for symmetric log-concave mechanisms. In International Conference Artificial Intelligence and Statistics, pp. 6270-6291. PMLR, 2022.
Larry Wasserman and Shuheng Zhou. statistical framework for differential privacy. Journal of the American Statistical Association,
2010.
Yuqing Zhu, Jinshuo Dong, and Yu-Xiang Wang, Optimal accounting of differential privacy via characteristic function. In International Conference on Artificial Intelligence and Statistics, pp. 4782-4817. PMLR, 2022.
27


Reviews:
[{"review_id": "mM9I9QIyOt", "reviewer": "Reviewer_NdCd", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper connects two key notions used to characterize the differential privacy of mechanisms: the privacy profile (Definition 2) characterized by the function $\\delta_{Q, P}$ and tradeoff functions (Definition 4) characterized by $T(P, Q)(\\alpha)$. The paper focuses mainly on mutually absolutely continuous random variables (because otherwise we'd probably have large $\\delta$) and defines the notion of a \"regular\" function $\\delta$ (Defn. 5) and show that a function $\\delta$ is regular if and only if it is the privacy profile of a pair of mutually absolutely continuous random variables (Proposition 1). Given a regular function $\\delta$, we can further say that it corresponds a symmetric privacy profile (one for whom $\\delta_{P, Q} = \\delta_{Q, P}$ for $P, Q$ mutually absolutely continuous random variables) if it satisfies $\\delta = \\hat{\\delta}$ for $\\hat{\\delta}$ defined by Equation (19). Proposition 2 then shows this $\\hat{\\delta}$ behaves as expected: when $\\delta = \\hat{\\delta}$ then $\\delta_{P, Q} = \\delta_{Q, P}$. Building towards the main result of the paper, Lemma 2 shows a 1-to-1 connection between tradeoff functions and privacy profiles for the same pair $P, Q$ obtained through the convex conjugate. This allows us the authors to characterize regular privacy profiles in terms of their tradeoff functions (Proposition 3). Theorem 1 shows that the composition of tradeoff functions corresponds to the \"T-convolution\" of privacy profiles defined in Defn. 6. The composition of tradeoff functions shows up in many places in DP and thus connecting it to what happens to the corresponding privacy profiles is a good contribution. An example of one such place is group privacy, where datasets can differ by $m$ points rather than $1$ (or whatever the original number of points they differ by in the equivalence relation). Section 4.3 shows that if $\\delta$ bounds privacy for neighboring databases, then the group privacy profile is lower bounded by the $m$-fold T-convolution $\\delta^{\\bullet m}$, and Lemma 5 implies $\\delta^{\\bullet m}$ is at least as large as the original privacy profile, as expected. The paper recovers known group privacy bounds (e.g., Vadhan-type scaling) and connects them to the T-convolution.  The rest of the paper derives some more properties of the privacy profiles of log-concave additive noise mechanisms, with the main result showing that for such profiles the T-convolution corresponds to adding sensitivity parameters (which is tight in the case of e.g. Gaussians).  Overall, while this paper does not introduce any new mechanisms or algorithms, it helps to uncover some deep connections between privacy profiles and tradeoff functions and allows for easier navigation of existing literature using either of these two notions to characterize DP.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The proofs look correct and the definitions introduced are well-motivated (primarily by the resulting connections). The connection shown between tradeoff functions and privacy profiles is clear and has several practical implications (shown in Sections 4.3 and 4.4). The results shown in Sections 4.3 and 4.4 are also shown to be essentially tight: for group privacy, the paper gives a construction showing the $\\delta^{\\bullet m}$ bound can be attained in a worst-case sense, and for log-concave additive noise mechanisms the sensitivity-additivity statement is tight for standard examples (e.g., Gaussian). This answers the question of whether we can use the T-convolution to obtain tight results essentially positively, though it also suggests we should not expect the T-convolution alone to systematically improve upon existing bounds in more specific cases.", "audience_yn": "Yes", "audience_explanation": "Yes, this paper connects privacy profiles / privacy curves and tradeoff functions in a way that is useful to studying and understanding group privacy and additive-noise mechanism. This connection is very useful for making sense of a literature that often uses one or the other. The paper gives a clean algebraic bridge (the T-convolution) that lets results transfer between the profile and tradeoff frameworks, plus some new structural properties for log-concave mechanisms. While the T-convolution is not a novel contribution of this paper (coming from [1]), its application to differential privacy seems to be. \n\n[1] Michael R Tehranchi. A black–scholes inequality: applications and generalisations. Finance and Stochastics,\n24(1):1–38, 2020.", "requested_changes": "I have no requested changes and recommend the paper for acceptance as it is.", "broader_impact_concerns": "N/A.", "additional_comments": "I apologize for the very long delay in submitting my review.", "extra_scores": {}, "extra_text": {}}, {"review_id": "EM9P6mnuYi", "reviewer": "Reviewer_AM2J", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper focuses on privacy profiles and tradeoff functions, two frameworks to analyze differential privacy mechanisms and comparing their privacy guarantees. The authors begin by discussing the connection between privacy profiles and tradeoff functions. Subsequently, they introduce the notion of regular privacy profiles and some related theoretical results. This discussion sets the stage for the description of T-convolution of privacy profiles, which is shown to correspond to the composition of tradeoff functions. This is clearly distinguished from composition of privacy mechanisms. The authors conclude their work by analyzing the convexity properties of privacy profiles for log-concave additive noise, with examples such as the noise added in the Gaussian mechanism.\n\nThe central ideas and theoretical results presented in this paper constitute key contributions to the space of differential privacy. In particular, the introduction of T-convolution, and its correspondence to the composition of tradeoff functions is itself a noteworthy contribution to this space. I also appreciate the authors’ thoroughness and rigor in proving the various propositions, lemmas and theorems delineated in this work.\n\nHowever, this rigor comes at the expense of clarity. I oft found it a struggle to keep track of the “bigger picture” in each section as the authors sought to prove each result right after stating it. In other instances, there are entire paragraphs filled with mathematical expressions that are hard to follow. All of these detract from the readability of the paper, and distract the reader from the key results in this work. In a similar vein, there are references made to theoretical results from many references in the proofs; a restatement or summary of some of these key results would also improve the readability of the manuscript.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The authors are thorough and rigorous in proving all the theoretical results included in the manuscript, sometimes at the expense of clarity. While I was unable to check all the proofs, the ones that I did appeared to be valid.", "audience_yn": "Yes", "audience_explanation": "The authors have been very thorough and rigorous in proving all the theoretical results included in this paper, building upon results from existing literature. Specifically, the introduction of the binary operation of T-convolution of two privacy profiles and its equivalence to the composition of the respective tradeoff functions serves as an advances a hitherto unseen perspective on privacy mechanisms. The subsequent discussion of its applications to the convexity of log-concave additive noise may also be valuable to readers working in the space of differential privacy.", "requested_changes": "**Critical changes:**\n\n1.\tI strongly urge that the authors only retain the proofs of only the key results in the main paper, and instead focusing on guiding the reader towards the key findings/intuitions of the paper, such as the implications of T-convolution and its presentation as a composition of the respective tradeoff functions. The other proofs can be moved to the appendix.\n2.\tWhere possible, please restate or summarize the key results from existing literature, especially if used in the proofs. This may be done in the appendix.\n\n**Suggested changes:**\n\n1.\tPage 3: “convient”  “convenient”\n2.\tPage 3: “with respect P”  “with respect to P”\n3.\tThere is a paragraph on page 16 preceding Section 5, that is full of mathematical expressions. There may be a less dense and clearer way of presenting this information.", "broader_impact_concerns": "I do not have any broader impact concerns with this work.", "additional_comments": "**Questions:**\n\n1.\tWhat is the purpose of the discussion included in the last paragraph preceding Section 3.2? Does this have any implications for any of the subsequent results? If not, this could be removed as it seems to suggest that the idea of “dominating a pair of distributions” is problematic.\n2.\tHow did you arrive at the first expression in the proof of (23)?", "extra_scores": {}, "extra_text": {}}, {"review_id": "mIUrnKgZL4", "reviewer": "Reviewer_NdRK", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work studies the connections between the two frameworks used for comparing differential privacy guarantees.\nStarting from the definition of T-convolution, the authors establish the closure and composition properties of privacy profiles and show, through convex conjugacy with tradeoff functions, several claims can be made; some of them correspond to the existing research results and some are new.\nAlso, the authors propose the concept of regularity for privacy profiles and connect them to tradeoff functions as well.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper is well-written; the math seems rigorous and correct.", "audience_yn": "Yes", "audience_explanation": "The established connection with T-convolution, regularity etc. is elegant.\nIf I raise one thing, the manuscript is not self-contained.  So for readers who are not familiar with several related field may find it difficult to grasp the claims clearly.", "requested_changes": "Only some minor corrections:\n1. Better to add definition of ( )^+ just in case\n2. (15) and (29); do they take y as input or not; need to be consistent\n3. In page 14; typo “worst-case bound in” → “worst-case bound is”\n4. Better not to refer to something in appendix in the main text.", "broader_impact_concerns": "N/A", "additional_comments": "I recommend acceptance after revising the minor parts mentioned above.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)