Smoothed Differential Privacy
Authors: Ao Liu
Yu-Xiang Wang
Lirong Xia
Venue: Accepted by TMLR ()

Abstract: Differential privacy (DP) is a widely-accepted and widely-applied notion of privacy based on worst-case analysis. Often, DP classifies most mechanisms without additive noise as non-private  (Dwork et al., 2014). Thus, additive noises are added to improve privacy (to achieve DP). However, in many real-world applications,  adding additive noise is undesirable (Bagdasaryan et al., 2019) and sometimes prohibited  (Liu et al., 2020).

In this paper, we propose a natural extension of DP following the worst average-case idea behind the celebrated smoothed analysis  (Spielman & Teng, May 2004). Our notion, smoothed DP, can effectively measure the privacy leakage of mechanisms without additive noises under realistic settings.  We prove that any discrete mechanism with sampling procedures is more private than what DP predicts, while many continuous mechanisms with sampling procedures are still non-private under smoothed DP. In addition, we prove several desirable properties of smoothed DP, including composition, robustness to post-processing, and distribution reduction. Based on those properties, we propose an efficient algorithm to calculate the privacy parameters for smoothed DP. Experimentally, we verify that, according to smoothed DP, the discrete sampling mechanisms are private in real-world elections, and some discrete neural networks can be private without adding any additive noise. We believe that these results contribute to the theoretical foundation of realistic privacy measures beyond worst-case analysis.

Published in Transactions on Machine Learning Research (12/2023)
Smoothed Differential Privacy
Ao Liu
aoliu.cs gmail.com
Core Machine Learning. Google
Yu-Xiang Wang
yuxiangw Beeiangg@@s.ussh..eee
Department of Computer Science, UC Santa Barbara
Lirong Xia
xialirong @ gmail.com
Computer Science Department, Rensseluer Polytechnic Institute
Reviewed on OpenReview: butps://operrriiineee/mmmmtttti-
Abstract
Differential privacy (DP) is widely- and widely-applied notion of privacy based worst- case analysis. Often, DP classifies most mechanisms without additive noise non-private (Dwork) et al. 2014). Thus, additive noises are added to improve privacy (to achieve DP). However, in many real-world applications, adding additive noise is undesirable (Bagdasaryan et al. 2019) and sometimes prohibited (Liu et al. 2020).
In this paper, we propose natural extension of DP following the worst average-case idea behind the celebrated smoothed analysis (Spielman & Teng 2004). Our notion, smoothed DP, effectively measure the privacy leakage of mechanisms without additive noises under realistic settings. We prove that any discrete mechanism with sampling procedures is more private than what DP predicts, while many continuous mechanisms with sampling procedures are still non-private under smoothed DP. In addition, we prove several desirable properties of smoothed DP, including composition, robustness post-pree post-processing, and distribution reduction. Based on those properties, we propose an efficient algorithm calculate the privacy parameters for smoothed DP. Experimentally, we verify that, according to smoothed DP, the discrete sampling mechanisms some discrete neural networks can be private without adding any additive noise. We believe that these results contribute to the theoretical foundation of realistic privacy measures beyond worst-case analysis.
private in real-world elections, and
1 Introduction
Differential privacy (DP), de facto measure of privacy in academia and industry, is often achieved by adding additive noises (e.g., Gaussian noise, Laplacian noise, and the discrete noise in exponential mechanism) to published information (Dwork et al. 2014). However, additive noises are procedurally or practically unacceptable many real-world applications. For example, presidential elections often require deterministic rule be used (Liu al. 2020). In such cases, though, sampling noise often exists, as shown in the following example.
Example 1 (Election with sampling noise). Due to COVID-19, many voters in the 2020 US presidential election chose to submit their votes by mail. Unfortunately, it was estimated that the US postal service might have lost up to 300,000 ,000 mail- ballots (0.2% of all votes) (oogage Ingraham 2020). For the purpose of illustration, suppose these votes are distributed uniformly random, and the histogram of votes is announced after the election day.
A critical public concern about elections is: should publishing the histogram of votes be viewed as a significant threat to privacy? Notice that with sampling noise such as in Example the (sampling) histogram mechanism can be viewed as randomized mechanism, formally called sampling cmmpling-historram histogram in this paper. The same question can be asked about publishing the winner under deterministic voting rule with sampling noise.

---

Published in Transactions on Machine Learning Research (12/2023)
The standard notion of DP (Definition 1 in Dwork et al., 2006a) measures the worst-case privacy leakage (see Section 2 for its formal definition and detailed discussions). At high level, DP considers the worst-case input and worst-case output of the (random) mechanisms, and ô are DP's privacy parameters to measure the privacy leakage in the worst- case described above. At a high level again, c is a werchanism-ddsiine--dee of privacy leakage", while å measures the probability that the threshold got exceeded. Thus, smaller 6, 6 represents stronger privacy guarantees. The usual requirements upon a private mechanism are c = O(1) and o(1/n) The requirement on ô is more strict than because measures the "failure probability".
threshold for the "acceptable amount
If we apply DP to answer this question, we would then conclude that publishing the histogram can poses a significant threat to privacy, as the privacy parameter d x 1 (See Section for the formal definition) in the following worst-case scenario: all except one vote are for the Republican candidate, and there is one vote for the Democratic candidate. Notice that å = 1 is much worse than the threshold for private mechanisms, = o(1/n), where n is the number of agents (voters). Moreover, using the adversary's utility as the measure of privacy loss (see Section for the formal definition), in this (worst) case, the privacy loss is large (# 1, see Section means the adversary can make accurate predictions about every agent's preferences.
2 for the formal definition of utility), which
However, DP does not tell us whether publishing the histogram poses a significant threat to privacy in general. In particular, the worst-case scenario described in the previous paragraph never happened even approximately in the modern history of US presidential elections. In fact, no candidates get more than 70% of the votes since 1 1920 (Leip 2023), when the progressive party dissolved.
It turns out that the privacy loss may not be as high as measured by DP, where the privacy loss is measured by the adversary's 's utility (ie., how accurately the adversary can infer/predict the votes, see Justification 3
100
5 or adversaries utility
in Section 2 for its formal definition). To see this, we assume 0.2% of
the votes were randomly lost in the presidential elections of each year
10:
since 1920 (in light of Example D]. Figure | presents the adversary's s utility under this assumption. It can be seen that the adversary's 's utility is very limited (at the order of 10-32 to 10-8, always smaller than the threshold of private mechanisms, 1/n).. In other words, the adversary cannot get much information from the published histogram of votes. Figure also plots the database-dependent privacy parameter (xr) (Definition 2 DP-like 8 parameter for specific database). One can see that ((x) is closely related to the adversary's 's utility and is also at the order of 10 10-32 to 10 Besides, we observe an interesting decreas- ing trend in the adversary's utility, which implies that the elections become more private in more recent years. This is primarily due to the growth of the voting population, which is exponentially related to the adversary's 's utility (Theorem B}. In Appendix A.2] we further show that the elections are still private when only 0.01% 101% of votes got lost.
10:20
adversanies' utility proposed 8(x) of DP
10:30 30
n=1
1920
1945
1970 Y Year
1995
2020
Figure 1: The privacy loss and adversaries' utility in US presidential elections. The smaller 8(x) is, the more private the election is. The smaller adversaries' utility is, the more private the election is.
As another example, for neural networks (NNs), even adding slight noise can lead to dramatic decreases in the prediction accuracy, especially when predicting underrepresented classes (Bagdasaryan et al. 2019). Sampling noises also widely exist in machine learning, for example, in the standard practice of gross-validation as well as in training (e.g., samhh-g when training NNs).
Note that in all the above examples, the sampling noise is an "intrinsic" part of the mechanism. In comparison, the only purpose of adding additive noises is to improve privacy (with the cost of reducing accuracy) in most scenarios. As shown in these examples, the worst-case privacy according to DP might be too loose to serve as a practical measure for evaluating and comparing mechanisms with sampling noise (while without additive noise) in real-world applications. This motivates us to ask the following question.
How can we measure privacy for mechanisms with sampling noise under realistic models?
The choice of model is critical and highly challenging. A model based on worst-case analysis (such as in DP) provides upper bounds on privacy loss, but as we have seen in Figure in some situations, such upper bounds are too loose
2

---

Published in Transactions on Machine Learning Research (12/2023)
to be informative in practice. This is similar to the runtime analysis of algorithm an algorithm with exponential worst-case runtime, such as the simplex algorithm, can be faster than some algorithms with polynomial runtime in practice. Average-case analysis is a natural choice of the model, but since "all models are wrong" (Box 1979). any privacy measure designed for a certain distribution over data may not work well for other distributions. Moreover, ideally, the new measure should satisfy the desirable properties that played a central role behind the success of DP, including composition and robustness to post-processing. These properties make easier for the mechanism designers to figure out the privacy level of mechanisms. Unfortunately, we are not aware of measure based on average-case analysis that has these properties.
We believe that the smoothed analysis (Spielman 2005 provides a promising framework for addressing this question. Smoothed analysis is an extension and combination of worst-case and average-case analyses that inherit the advantages of both. It measures the expected performance of algorithms under slight random perturbations of worst-case inputs. Compared with the average-case analysis, the assumptions of the smoothed analysis are much more natural. Compared with the worst-case analysis, the smoothed analysis can better describe the real-world performance of algorithms. For example, it successfully explained why the simplex algorithm faster than some polynomial algorithms in practice (Spiclman & Teng 2004).
Our Contributions. The main merit of this paper is a new notion of privacy for mechanisms with sampling noise (and without additive noises), called smoothed differential privacy (smoothed DP for short), which applies smoothed analysis to the privacy parameter ((x) (Definition 2 as a function of the database æ. In our model, the "ground truth" distribution of agents is from a set of distributions over data points, on top of which the nature adds random noises.
Formally, the "smoothed" (xx) is defined as
6 - max; ( [Z [8(z)))
where I ~ of = (TI, (T1,"..,,TT)))) ,T,) E II means that for every 1 S i S n, the i-th entry in the database independently follows the distribution Ty. We note that IT is a parameter for smoothed analysis, not for the mechanisms .M. Table compares the e and parameters of smoothed DP and DP. The sampling histogram algorithm refers to Algorithm 2 (in Section 5.1) ). which samples T = [n- n] data without replacement and outputs the histogram of the sampled data. Appendix A33 shows the detailed settings of Table We present a high-level comparison between smoothed DP and
other DP(-like) notions in Table 2 A more detailed comparison between DP, smoothed DP, and distributional DP can
be found in Table Section 3
Notions
measures
without additive noise
with additive noise (of level 1/c)
Smoothed DP
(e, OSDP)
exp ( ((n))
(this paper)
main message
private (under smoothed analysis)
private
DP (Definition
(c
(0.
(17 C, 0)
Dwork et al. 2006a main message
non-private (under worst-case analysis)
private (if is small)
Table 1: Compare DP and smoothed DP for our motivation example (US presidential election) with constant sampling
rate (e.g., = 1 0.2% in the example). The part in dspp is omitted for simplicity (see Theorem 3 for detailed
discussions). The (e, ŌSDP) for smoothed DP with additive noise is not shown in this table because it is already private without additive noise.
Notions
database x
output S
adjacent database x''
Smoothed DP
smoothed analysis
(Definition 3 this paper)
DP (Definition
Dook et al. 2006a)
worst-case analysis
Gaussian DP or fDP
worst-case analysis
DDogg et al. 2019
worst-case analysis
Rényi DP Mironov (017))
average-case analysis (weighted by Rényi divergence or Sabb-aassian divergence)
Concentrated DP
(unn & Steinke /2166 Dwork & Rothblum 2016
Bayesian DP TTrasteyn & Fallings 2020)
less informative adversary
Random DP (Hall et al.] 201T
worst-case analysis less informative
Distributional DP (Bassily et al.
2013
adversary
worst-case analysis
Table 2: The comparison between smoothed DP and other privacy notions.
3

---

Published in Transactions on Machine Learning Research (12/2023)
Theoretically, we prove that smoothed DP satisfies many desirable properties, including two properties also satisfied by the standard DP: robusiness to post- past-processing (Proposition | and composition (Proposition 5]. Besides, we prove two additional properties for smoothed DP, called pre-processing (Proposition ()) and distribution reduction (Proposition 7 Based on pre- pre-preeesiig and distribution reduction, we propose an efficient algorithm (Algorithm I to calculate the privacy parameters for smoothed DP. We further show that, under smoothed DP, many discrete mechanisms with small sampling noise (and without any other noise) are significantly more private than those guaranteed by DP. For example, the sampling-histogram mechanism in Example D has an exponentially small dspp (Theorem 3). which implies that the mechanism protects voters' privacy in elections- and this is in accordance with the observation on US election data in Figure | We also note that the sampling-histogran mechanism is widely used in machine learning (e.g., the SGD in quantized NNs). In comparison, smoothed DP implies a similar privacy level as the standard DP in many continuous mechanisms. We proved that smoothed DP and the standard DP have the same privacy level for the widely-used sampling-average mechanism when the inputs are continuous (Theorem
Experimentally, we numerically evaluate the privacy level of the sampling-histor histogram mechanism using US presidential election data. Simulation results show an exponentially small dSDP. which is in accordance with our Theorem 3 Our second experiment shows that one-step stochastic gradient descent (SGD) in quantized NNs (Banner et al. 2018 Hubara et al. 2017) also has an exponentially small ósDp. This result implies that SGD with gradient quantization can already be private in practice without adding any extra (additive) noise. In comparison, the standard DP notion always requires extra (additive) noise to make the network private at the cost of a significant reduction in accuracy.
Related Work and Discussions. There is large body of literature on the theory and practice of DP and its extensions. We believe that the smoothed DP introduced in this paper is novel. To the best of our knowledge, none of the literature has proposed any DP-like notions for the mechanism without additive noises. A notable exception is distributional DP [Bassily et al. 2013). which considers less informative adversary to provide privacy measure for deterministic mechanisms. However, since distribution DP does not require any randomness in the mechanism, its privacy guarantee is much weaker than other DP-like notions. Rényi DP (Mironov 2017). Gaussian DP Dong et al. 2019) and Concentrated
DP Bunn& & Steinke, 2016: Dwork & Rothblum 2016) target to provide tighter privacy bounds for the adaptive mechanisms. Those three notions generalized the (e, 6) measure of distance between distributions to other divergence measures. Bayesian DP (Triastcyn & Faltings| 2020) tries to provide an "affordable" measure of privacy that requires less additive noise than DP. With similar objectives, Bun and Steinke (Bun & Steinke| (019) add noises according to the average sensitivity instead of the worst-case sensitivity required by DP. However, additive noises are required in (Bun) & Steinke 2019) and (Triastcyn & Faltings| 2020). Random DP (Hall et al.) 2011) combines the high-level idea of distributional DP and Bayesian DP, which considers randomness in both the database x and its neighboring database x'.
Appendix A.4 discusses the related works in the field of smoothed analysis, quantized neural networks, etc.
2 Differential Privacy and Its Interpretations
In this paper, we use n to denote the number of records (entries) in a database x E 2 where X' denotes all possible values for a single entry. n also represents the number of agents when one agent (one individual) can only contribute one record. We say that two databases z, x' are neighboring (denoted as x ~ x²) if one database can be gotten by replacing no more than one record from the other database. In the motivating example (Example D. X {0, 1]. where 0 represents vote one candidate while 1 represents the vote to the other candidate. Database represents all voters' votes (a n-dimensional binary vector). A record represents a single dimension (e.g., the i-th dimension) of x. Two databases are considered to be neighboring if no more than one voter's 's vote is different.
Definition 1 (Differential privacy). Let M denote randomized algorithm and S be a subset of the image space of M. Throughout this paper, image space" represents the space for the image of the (randomized) mechanism. M is said to be (e, 5)diifferentially private for some e >> 0, > -, for any S and any pair of neighboring database x. x',
Pr[M(x) E S) S et Pr[M(z')ES)
(1)
Notice that the randomness comes from the mechanism M.
DP guarantees immunity to many kinds of attacks (e.g., linkage attacks (Nguyen et al. Sep.. 2013) and reconstruction attacks (Dwork et al. 2014)). Take reconstruction attacks for example, the adversary has access subset of the database (such information may come from public databases, social media, etc.). In an extreme situation, adversary
4

---

Published in Transactions on Machine Learning Research (12/2023)
knows all but one agent's records. To protect the data of every single agent, DP uses 8 = o(1/n) common requirement of private mechanisms (Dwork et al. 2014] 18). To meet this requirement, private mechanism (under DP notion) usually need to include additive noises (e.g, Gaussian noise, Laplacian noise, and the noise, which usually is discrete, in exponential mechanisms). Next, we recall two common interpreationn/jssffcctttoo on how DP helps protect privacy even in the extreme situation of reconstruction attacks. After that, we formally introduce the adversaries' utility in Figure and use it to justify DP.
Justification 1: DP prevents membership inference (Wasserman & Zhou Mar. 2010: Kairouz et al., 2015).
Assume that the adversary knows all entries except the i-th. Let denote the database with its i-th entry removed. With the information provided by the output Mz)), the adversary can infer the missing entry by testing the following two hypotheses:
No: The missing entry is X (or equivalently, the database x = ====
H1: The missing entry is X' (or equivalently, the database is x' = x- (X')).
Suppose that after observing the output of M, the adversary uses rejection region rule for hypothesis testing where Ho is rejected if and only if the output is in the rejection region S. For any fixed S, the decision rule be wrong in two possible ways, false positive (Type I error) and false negative (Type II error). Mathematically, the Type I error rate {1() = Pr[M(r) E S] while the Type II error rate Ex')') = Pz(M(z') & S] = Prr[M(z') E S). According to the definition of DP, for any pair of neighboring databases F, x', the adversary always has
e (x) + En(2') 2 1 11-00 5 and e" Eu((')) + E(() 2 6-
which implies that (1)) and (z() cannot be small at the same time. When e and 6 are both small, both & and E becomes close to 0.5 (the error rates of random guess), which means that the adversary cannot get much information from the output of M.
Justification 2: With high probability, M is insensitive to the change of one record (Guingona et al. 2023).
In more detail, (e, 0D-DP guarantees the distribution of M's output will not change significantly when replacing one record. According to Property (A) of Theorem 3,2 in Guingona et al. (2023), (c, 5DD implie
(x] = a)
Pra-M(x)
2 S
(x' al < 26 2 1 25 for any pair of neighboring databases x and x'_
(2)
The above inequality shows that the change of one record cannot make an output significantly more likely or significantly less likely (with at least 1 - 26 probability). Since x and x' only differ in one record, the above formula also guarantees that the adversary cannot learn too much information about any single record of the database through observing the output of M (Dwork et al., 2014 p. 25).
Justification 3: DP guarantees limited Bayesian adversary's utilities.
We consider the same adversary in Justification 1. Since the adversary has no information about the missing entry, he/she may assume a uniform prior distribution about the missing entry. To simplify notations, let X, E X denote the missing entry and let x denote the database x with X; removed. For any X, E X, the adversary's posterior distribution (after observing output a from mechanism MM) is
Pr [r x] Pr [r[x,[=_
P = -] Pr[X.]
Pr (r x-,]
Pr(a
Ex (PH(M(=-: Pr(X1))
U
Σx Pr(M((=;((X))
A Bayesian predictor predicts the missing entry X, through maximizing the posterior probability, For the adversary with uniform prior, when the output is a, the 0/1 loss of the Bayesian predictor is
(a, x = 0 max (Pr [x,a,, x I)) + 12. (1 max (Pr [Xila, x .1) =1 max (Pr [X+ a, x-.)
(1-max
Some differentially private mechanisms such as "stability-basee query release" appear to not require additive noise with high probability the local scnsitivity is 0 for the input database and for all other databases that differ by at most In( (n(1/8)/e data points (Thakurta & Smith [0013 Note that in our case (such as the motivating example), the local sensitivity is not 0. Also, the "staabliit-baacd"" methods still need randomization (though not adding noise).
"The adversary can any decision rule, and the rejection region rule is adopted just for example.
'Theorem 3.2 in Guingona et al. (2023) shows (c. 8)- implies (ln2)c, 2]c, 26) -robabiilistic DP, which is equivalent of probabilistic DP san found Deaiition in Machanavajjaala et al. 2008
The formal definition
5

---

Published in Transactions on Machine Learning Research (12/2023)
It's not hard to check that always-correct prediction has zero loss and any always- iinorrectt prediction has loss one. Then, we define the adjusted utility of adversary (in Bayesian prediction), which is the expectation of normalized version of fa.1 Mathematically, for a database z, we define the adjusted utility with threshold as follows,
max (Ba-Mia max {0, 10,1-53 - -- -o1((a))) ult, x = I X,
(3)
In short, m(t, xx)) is the worst-case expectation of 1 - la.1 while the contribution from predictors with loss larger than 1- t is omitted. Especially, when the threshold t 2 1/|2', an always correct predictor (lg-1 = 0) has utility and a random guess predictor (fa. = 1 1/(xx) has utility 0. For example, we let X' = {0. 1} and consider the coin-flipping mechanism McF with support X, which output X; with probability p and output
X; with probability p. When p 1, the entry X; is non-private because the adversary can directly learn it from the output of Mcr. Correspondingly. the adjusted utility of adversary is 1 for any threshold E (0, 1). When p 0.5, the mechanism gives an output uniformly at random from X' In this case, the output of M cannot provide any information to the adversary. Correspondingly, the adjusted utility of adversary is 0 for any threshold & E (0.5, 1). The following lemma, which is a direct corollary of Theorem D and Corollary 3 shows that the adjusted utility is upper bounded by the 5 parameter of DP. Note that Lemma] also matches the main message of Figure
Lemma Let mechanism M be (c, diffeeerrnlt private. Then, for the above- defined adjusted utility,
" cer 1I x-s) S 25.
e-
In other words, when both and 8 are small, the adversary cannot accurately predict the missing entry in database
3 Smoothed Differential Privacy
Recall that DP is based on the worst-case analysis over all possible databases. However, shown in Example and Figure [ the worst-case nature of DP sometimes leads to an overly pessimistic measure of privacy loss, which may bring unnecessary additive noise in the hope of improved privacy but at the cost of accuracy. For example, we assume a database with n binary records. DP considers the worst-case of x. Here, we focus on one of the worst-cases, x = (O..... 0, 1). whose worst-case neighboring database x' = (O..... ... 0).). From the adversaries' point of view, he/she knows all records in the database except the last one (the first n - 1 records). Under the above worst-case, the sampling-histogree
mechanism non-private because the adversary directly knows the missing entry if the last entry, "1", got sampled. However, the above worst-case might be very rare in some real-world applications (e.g., Example and the mechanism is actually private when the database is not extremely close to the worst (Figure I.] Motivated by this, we propose smoothed DP, which has similar privacy guarantees as DP, but is able to measure the privacy level of campling-based mechanisms (instead of classifying all of them as non-private). This section formally introduces smoothed DP, which applies the smoothed analysis to the database--epennden privacy profile d(x) and proves its desirable properties. Due to the space constraint, all proofs of this section can be found in Appendix
3.1 The database-dependden privacy profile
We first introduce the detabase-dependent privacy profile M,) (x), which measures the privacy leakage of mechanism M when its input is x. Here, we fix e and let ó be database- deeeedet,, which is opposite to data-dependent privacy loss (Papernot et al. 2018, Wang 2019) where is fixed and e is data-dependent. Here, we call privacy profile since a function of (aalle al. 2020).
Definition 2 (Database-dependeent privacy profile (x:) (work et al. 2006b)). Let M : 2 - A denote randomized mechanism. Given any database E x and any O, define the database-depente privacy profile
(x)) A max (0.
max (z,.M(z,z')). x':2'm
(d.m((',=)))
max oe aa
where de. (x, = maxs (Pr[(2)) E| (F(()(P()) and ">"" means neighboring.
In words, & Mxx) is the minimum 5 values, such that the (c. 8)-DP requirement on M (Inequality I holds for any neighboring pairs (x)) and (x) The definition of (()) guarantees the adversaries have the same prior

---

Published in Transactions on Machine Learning Research (12/2023)
knowledge DP. (z) considers the worst-case neighboring dataset x'' (technically, max which indicates that the adversaries know the whole database except one entry.
The next lemma reveals the connection between the adversary's 's utility u (defined in Justification 3 of Section and de, x') + de. (z', 2).
Lemma Given mechanism M: x - A and any puir of neighboring databases x = xt,
w ee e + ( < de.M(z, x') + de.M(x', x).
Lemma 2 shows that the adjusted utility is upper bounded by de.M. Especially, when | = 2, we provide both upper and lower bounds to the adjusted utility in Lemma of Appendix C.1 which means that d x") is a good measure for the privacy level of M when |x| = 2. The following corollary shows that (z))((z) upper bounds the adjusted utility of adversary. In other words, a small (x) guarantees that adversary cannot accurately predict the missing record in the database.
Corollary 3. Given mechanism M X" + A and any pair of neighboring databases x = x',
E u( 6e +1 :1.411nz
<2.6e.((r)
DP as the worst-case analysis of M (z). . In the next theorem, we show that the privacy measure based on the worst-case analysis of 6 is equivalent to the standard DP.
Theorem (DP in de, (xx)). Mechanism M X + is (e, ddifferrffrl private if and only if.
(6c.((1)) 8.
max xE
3.2 Formal definition of smoothed DP
Armed with the database-dependent privacy profile (x), we now formally define smoothed DP, where the worst- case "ground truth" distribution of every agent is allowed to be any distribution from a set of distributions II, on top of which Nature adds random noises to generate the database. We would like to note again that II is a parameter for smoothed analysis instead of the mechanisms M. The smoothed analysis only controls how the database x is generated. The adversaries of smoothed DP will have the same prior knowledge as the adversaries of DP.
Definition (Smoothed DP). Let be set of distributions over X. We say M X A is (e, 6, -mmotthe disserentially private if,
max (Ez-i (6,, (e))) 2..
where & ~ ने = (TI, "... TT)) means that the i-th entry in the database follows n. for every E (1,..., ,n...
The threat models of DP, smoothed DP, and distributional DP are shown in Table 3 able choose" means that he/she can select the worst-case, and does necessarily mean the adversary knows the information. In short, the adversary in smoothed DP is knowledgeable that in DP, but with less ability choose the database x. Compared with distributional DP, the adversary in smoothed DP has more information (prior knowledge) about the database. Appendix B rigidll shows that smoothed DP is stronger notion than distributional DP.
Note that the adversary "is
Ability to choose database
Ability to choose neighboring database x'
Ability to choose output S
Adversary's
Prior knowledge
Able to choose the worst-case database x Able to choose
DP
Whole database except
Able to choose worst-case diff(x.
Able to choose worst-case output S
entry (z m x')
Smoothed DP
Distributional DP
The distribution of of 'r data distributions from II
Table 3: The threat model of DP, smoothed DP, and distribution DP, where diff( æ²) represents the difference between x and x'. Under the setting and notation of Justification 3 of DP, diff(az x²) is X, while x O' x-
Like DP, smoothed DP bounds privacy leakage (in an arguably more realistic setting), via the following three justifica- tions that similar to the common justifications of DP in Section 2
7

---

Published in Transactions on Machine Learning Research (12/2023)
Justification 1: Smoothed DP prevents membership inference. Mathematically, a (e, 6, I1) smoothed DP mechanism
M guarantees
max E [8i())] + max #EI1
E En(x') = x]) 2 1 -
FEl!"
max
E [En(z²) | = x1) +
max ( E
[i(()) 2 1 ò
FEIL
201
#Ell
The proof follows after bounding Type and Type errors when the input is x by 8e.M- That is, for fixed database x, it not hard to verify that
e & En(x') 2 1-
max (de,M(1,>))) and
x' =
e En(x') + ((())21 21
(dam(x')x))
max ahi ai
Then, by the definition (x),(x),, we have,
e E((r) + En(x') 2 (c, and et En(x') E((x 1
which means that &l and Eμ cannot be small the same time when the database is x. Then, justification can be gotten by applying smoothed analysis to both sides. It follows that the smoothed DP, which is smoothed analysis of 6e,M. can bound the smoothed Type I and Type II errors.
Justification 2: Smoothed DP mechanisms are insensitive to the change of one record with high probability. Mathematically, a (c, 6, -msooothe DP mechanism M guarantees
1 Pr[M(z) = a]
11)
max
E
Pr (-x)
<
Pr(M(x') = S 2e
2 1 25
FEIT"
2et
The proof is, again, done through analyzing 8 (x) More precisely, given any mechanism M, any E 14 and any pair of neighboring databases æ, x', we have
Pr[M(s)= =
Pra>M(u)
Pr(M(x') = S 26 11 1-11-5..00 26
2et
Then, justification follows by applying smoothed analysis to both sides of the above inequality.
As smoothed DP replaces the worst-case analysis with smoothed analysis, we also view o(1/n) as a requirement for private mechanisms for smoothed DP. In addition to the two justifications above,
Justification 3: Smoothed DP guarantees limited adversaries' utility in (Bayesian) predictions. Following similar reasoning as Justification 1, we know that the utility under realistic settings (or the smoothed utility) of the adversary cannot be larger than 26. Mathematically, an (c, 6, -mosshhh DP mechanism. M guarantees
(u(- 6e ( 26.
max
FEII"
At a high level, a small parameter of smoothed DP means the adversary cannot accurately predict the missing entry of database under realistic settings.
4 Properties of Smoothed DP
First, we present four properties of smoothed DP and discuss how they can help mechanism designers figure out the smoothed DP parameters of mechanisms. We first present the robustness to post-processing property, which says no function can make a mechanism less private without adding extra knowledge about the database. The post-processing property of smoothed DP can be used to upper bound the privacy level of many mechanisms, With it, we know private data preprocessing can guarantee the privacy of the whole mechanism. Then, the rest part of the mechanism does not need to consider privacy issues. The proof of all four properties of the smoothed DP can be found in Appendix D)
8

---

Published in Transactions on Machine Learning Research (12/2023)
Proposition 4 (Post-processing). Let M X" + be (c, 6, II) smoothhe DP mechanism. For any f + A' (which can also be randomized), f M : x - A' is also (e, 6, -m-smotthed DP.
Then, we introduce the composition theorem for the smoothed DP, which bounds the smoothed DP property of databases when two more mechanisms publish their outputs about the same database.
Proposition 5 (Composition). Let M, x + Ai be an (ei, 5ū, -mmoothed DP mechanism for any i E [k]] Define
MMg- x + II= A, as (z) = (MI) .. (M(()))))..M((())) Then, M[a is (E E/ 6,, II -mmoothed DP.
In practice, II might be hard to accurately characterize. The next proposition introduces the pre-processing property of smoothed DP, which says the distribution of data (II) can be replaced by the distribution of features (fII), defined as follows) if the features are extracted using any deterministic function(s). Note that this only replaces the smoothed analysis-related II and the mechanism remains unchanged. For example, in deep learning. the distribution of data can be replaced by the distribution of gradient which is usually much easier to estimate in real-world training processes.
More technically, the pre-processing property guarantees that any deterministic way of data preprocessing is not harmful to privacy. To simplify notation, we let f(x) be the distribution of f(X) where X ~ x. For any set of distributions 11 ( ... J. J. we let f(II) = (fI),, ... ( [Tm)).
Proposition 6 (Pre-processing for deterministic functions). Let f X - Xn be deterministic function and M: 8m + A be randomized mechanism. Then, M oof f X + A is 5, II) smoothhe DP if M is (c. (c,6, (IT)-
smoothed DP.
The following proposition shows that any two sets of distributions with the same convex hull have the same privacy level under smoothed DP. With this, the mechanism designers can ignore all inner points and only consider the convex hull's vertices when calculating the mechanisms' privacy level. Let CH(IT) denote the convex hull of IT.
Proposition 7 (Distribution reduction). Given any e, 6 E R., and any II, and Il such that CH([I,) = CHII))). a mechanism M is 5, I1) -smoothhe DP if and only if M is 5, mmm-smoothed DP.
We provide an example of how Proposition 7 helps calculate the privacy level. Assume the database has two possible types of data (i.e., m _ | = 2). We use π = (1, 1 - p) to represent the distribution over | such that the first type occurs with probability p and the second type occurs with probability 1 p.p Assuming the mechanism designer considers an infinite set of distribution IT = {p: 1 p) : E (0.2, 0. its easy to check that II's convex hull CH = {(p, p): E [0.2, ) and CHIII)'s 's set of vertices II. = { (p.. 1 p) : E (0.2, 0.8)) } = { {(0.2, 0.8), 00.8) Since II and II have the same convex hull, according to Proposition 7 the mechanism designer only needs to consider IT* (two distributions), instead of the infinite set IT.
Proposition 7 also provides an efficient way to calculate the (exact) ô parameter of smoothed DP for anonymous mechanisms. Here, "anonymous" means the mechanism treat each data in the database "equally". Formally, we say one mechanism is anonymous if its output distribution will not change under arbitrarily permuted order of data in the database. In other words, an anonymous mechanism's 's output distribution only depends on the histogram of data. One can see that most commonly-used algorithms in machine learning (e.g., SGD and AdaGrad) and voting (e.g., plurality, Borda, and Copeland) are anonymous. Also note that the commonly used noisy mechanisms (e.g., Laplacian, Gaussian, and Exponential) will keep the anonymity property of mechanisms.
Algorithm| I efffiiintly calculate the pri- vacy profile 8 of smoothed DP for anony- mous mechanisms. Again, we let II* denote the set of CH(IIY's vertices and
Algorithm 1: Calculate the (exact) privacy profile 5 for smoothed DP
Inputs: An anonymous mechanism M. parameter E R.,, size of database n, and set of distribution IT
Initializatio: Calculate 11* according to 11 and Q according to 11* (Same as DP) Calculate 6, for all histograms
let 8 A | denote the cardinality of II. @ denote the set of all histograms on IT* of n records. Here, we slightly abuse notation and use "for E Q" to repre- sent that each histogram visited exactly once in the corresponding for loop.
for मे E Q do
Calculate 85 A EN M(r)
end Output: &SDP(c) max, 8,
*Gradient is what the mechanism designers larget to privatize for deep neural networks. This is because one of the most serious privacy leakage in deep learning is the gradient residue on cloud GPUs (its VRAM can be visible to other cloud users, see Abadi et al. 2016). We call gradients as features here because it is calculated according to the data in the database.

---

Published in Transactions on Machine Learning Research (12/2023)
We say Step 3 in Algorithm is the "same as" DP because calculating the privacy profile 6 of DP for general mechanisms requires calculating 6c,M. We note calculating the exact privacy profile á of DP may not require calculating 6e.M for some mechanisms (e.g., additive noise mechanism). We will present similar result for smoothed DP in Theorem 3 of Section 5.1 Theorem presents the runtime of Algorithm | (calculate the privacy profile 6 of smoothed DP for any anonymous mechanisms), which only requires a polynomial extra time than DP in most cases.
Theorem 2 (Runtime of Algorithm D. Using the notations above, the complexity of calculating the privacy profile ō of smoothed DP for any anonymous mechanisms is O (n22m+f" + -llog (*) Cplpp. where & denotes the number of vertices in II and Cplpe represents the rumtime of Step 3 in Algorithm !
As to be shown in Section the application scenarios of Smoothed DP are those when m is not large. E could be treated as a constant if II's geometric shape is not extremely complicated. Thus, we believe the runtime of calculating the exact privacy profile ò only requires a polynomial extra time than DP in most cases.
5 Smoothed DP as a Measure of Privacy
This section uses smoothed DP to measure the privacy of some commonly-usee mechanisms, where the sampling noise is intrinsic and unavoidable (as opposed to additive noises such Gaussian Laplacian noises). Our analysis focuses on two widely-used algorithms where the intrinsic randomness comes from sampling without replacement, In addition, we compare the privacy levels of smoothed DP with DP. All missing proofs of this section can be found in Appendix E
5.1 Discrete mechanisms are more private than what DP predicts
In this subsection, study the smoothed DP property of (discrete) sampling- histooram mechanism (SHM), which is widely used as a pre-possessing step in many real-world applications like the training of NNs. As smoothed DP satisfies post-processing (Proposition 4 and pre-processing (Proposition 5). the smoothed DP property of SHM can upper bound the privacy level of many mechanisms (that uses SHM) in practice. Let X' denote a finite set and m å |X] denotes the cardinality of X. The histogram of a database æ E X (denoted as hist(x)) is an m-dimensional vector. The j-th component of hist(z) the number of j-th type of data in æ. It's easy check that hist(z) E {0, (0,-...0 ,n)m and [hiis( n.
SHM first sample T = [Ty n1] data from the database and then output the histogram of the T samples. Formally, we define the sampling- histogram mechanism in Algorithm [ Note that require all data in the database to be chosen from finite set X.
Algorithm 2: Sampling hhitoogam mechanism Mи
Inputs: finite set X, sampling rate rj E (0, 1), and a database {X,,-.. } where X, X for all i {1....,n) ,n]
Randomly sample T = [ n data from x without replacement. The sampled data are denoted by " .Yrr
Output: The histogram hist(X,,. X,r)
Smoothed DP of mechanisms based on SHM. The smoothed DP of SHM can be used to upper bound the smoothed DP of the following three groups of mechanismm//alorrinns.
The first group consists of deterministic voting rules, presented in the motivating example in Introduction. The sampling procedure in SHM mimics the votes that got lost.
The second group consists of machine learning algorithms based on randomly-sampled training data, such as cross- validation. The (random) selection of the training data corresponds to SHM. Notice that many training algorithms are essentially based on the histogram of the training data (instead of the ordering of data points). Therefore, overall the training procedure can be viewed as SHM plus post-processing function (the learning algorithm). Consequently, the smoothed DP of SHM can be used to upper bound the smoothed DP of such procedures.
The third group consists of SGD of NNs with gradient quantization (Zhu et al. 2020) Banner et al., 2018). where the gradients are rounded to 8-bit in order to accelerate the training and/or the inference of NNs. The smoothed DP of SHM can be used to bound the privacy leakage in each SGD step of the NN, where a batch (a subset of the training set) is firstly sampled and the gradient is the average of the gradients of the sampled data.
DP vs. Smoothed DP for SHM. We are ready to present the main theorem of this paper, which indicates that SHM is private under some mild assumptions. We say distribution n is f-strictly positive if there exists positive function
10

---

Published in Transactions on Machine Learning Research (12/2023)
(n, m) such that (X) 2 f(n m.) for any X in the support of A set of distributions II is f-strictly positive if there exists a positive function f(n,, m)) such that every π E IT is f-strictly positive. The f-strictly positive assumption is often considered mild in elections Xia 2020) and discrete machine learning (Laird & Saull Apr. 1994) when f (m, n) = Q11). All following discussions in this section assume m to be a constant. Note that constants are omitted when analyzing asymptotic manner (e.g., . as multiple within Oc+), (-), or w()).
Theorem 3 (DP vs. Smoothed DP for Sampling Histogram Mechanism MH). For any MH, given an f-strictly positive set of distributions IT, a finite set X, and n, T E Z,,, we have:
(i) (Smoothed DP) Given any e 2 In T + where e a constant, Mu (s, expeexpp [-O(S(n, m)] m)- smoothed DP.
(i)) (Tightness of smoothed DP bound) For any e > 0, there does not exist 8 = exp ( (-w ([In ((m, n]] m)) nn) such
that MH is (e, 6, Il)-smoothed DP.
(iid) (DP) For any e 0, there does not exist 8 < n) such that Ma (c. 8)-DP.
This theorem says the privacy leakage is exponentially small under real-world application scenarios. In comparison, DP cares too much about the extremely rare cases and predicts constant privacy leakage. If f a constant function and m = (1), Property (it) indicates that the bound in (i) is tight. Also, note that our theorem allows T to be in the same order n. For example, when setting T' 95% X n and II be f-strictly positive for constant f. SHM is (3, (xp((-((n)). (I)))),IIIsooolll smoothhe DP, which is acceptable privacy threshold in many real-world applications (Liu et al. 2019). For example, iOS 10.1 requires S 6 and iOS 10.1.1 requires S 14 Tang et al. (217)) Appendix proves similar bounds for the SHM with replacement. The following remarks shows non-asymptotic version of Theorem i). which relates and 8 and provides a non-asymptotic privacy bound for SHM. To simplify notations, we let g(), c) (1 - - 1)²
Remark (Privacy bound for MH)). Given an f-strictly positive set of distributions 11, a finite set X, and n, T E.p. Mи is c, exp (- g(n.e) f(m, n) n) + exp (- f(m, n).,n))n......). n). 11) -mooothed DP for any >> In 1
5.2 Continuous mechanisms are similar to what DP predicts
In this section, we show that the sampling mechanisms with continuous support are still not privacy-preservnng under smoothed DP. The "gap" between discrete and continuous SHM comes from the fact that SHM becomes less private when X'| increases.
Algorithm 3: Continuous sampling-averan mechanism MA
Inputs: The number of samples T and a database
(X1,"'. X,) where X; [0, 1] for all E (1,...,) .n) Randomly sample T [n] n1] data from e without
replacement. The sampled data are denoted as X Xjr
Output: The average 2 = Σje(T) Xi,
Our result indicates that the neural networks without quantized parameters are not private without additive noise (e.g., Gaussian or Laplacian noise). We use the sumpling-average (Algorithm.) 3 algorithm as the standard algorithm for continuous mechanisms. Because sampling-average can be treated as SHM plus an average step, sampling-average is non-private also means SHM with continuous support is also non-private according to the post-processing property of smoothed DP.
Theorem 4 (Smoothed DP for continuous sampling-average). For any continuous campling-avereen mechanism MA. given any set of strictly positive distribution over [0, 1], any T, n E4 and any 2 there does not exist 8 n such that MA (c, 8, -mmoothee DP.
Theorem 4 does not contradict Property (i) of Theorem 3 because the continuous functions has m -> oc, which makes the upper bound of 5 parameter for smoothed DP m exp (f((nn n)] 0o.
Distribution strictly positive hy if px (x)) e any x support of n., where ps the PDF of
11

---

Published in Transactions on Machine Learning Research (12/2023)
6 Experiments
Smoothed DP in elections. We use a similar setting as the motivating example, where 0.2% of the votes are randomly lost. We numerically calculate the (exact) privacy profile ō of smoothed DP according to Algorithm| [ Here, the set of distributions 11 includes the distribution of all 57 congressional districts of the 2020 presidential election. Using the distribution reduction property of smoothed DP (Proposition 7p. we can remove all distributions in II except DC and NE-2 which are the vertices for the convex hull of II. Figure 2 (left) shows that the smoothed å parameter is exponentially small in n when 7, which matches our Theorem We find that 5 is also exponentially small when = 0.5,1 1 or 2, which indicates that the sampling-historran mechanism is also more private than DP's predictions for small e's. Appendix G.2 shows the experiments with different settings on II. All experiments of this paper are implemented in MATLAB 2021a and tested on a Windows 10 Desktop with an Intel Core i7-8700 CPU and 32GB RAM.
Elections (0.2% of votes got lost)
SGD with Quantized Gadients
10
10
10a
10" 10
= 1/a
DP
100
1/n
0.5
DP
10
6
0.5
2
=
10
3
4
5
100
150
200
250
n
x x10
n
Figure Left: DP and smoothed DP of 2020 US presidential election when 0.2% of votes got lost. Right: DP and smoothed DP of I-step SGD with 8-bit gradient quantization when the set of distributions II. In both plots, the vertical axes are in log- -cale and the pink dashed line presents the 8 parameter of DP with whatever (finite) e. The dot lines are the exponential fittings of smoothed à parameters. The left plot is an accurate calculation of 6. The shaded area shows the 99% confidence interval of the right plot.
SGD with 8-bit gradient quantization. According to the pre-processing property of smoothed DP, the smoothed DP of (discrete) sampling-average mechanism upper bounds the smoothed DP of SGD (for one step). In 8-bit neural networks for computer vision tasks, the gradient usually follows Gaussian distributions (Banner et al. 2018). We thus let the set of distributions IT = [N& (0, ) (0.2, 0.122)] where bu, o²) denotes the 8-bit quantized Gaussian distribution (See Appendix G for its formal definition). The standard variation, 0.12, is the same the standard variation of gradients in a R network trained on CIFAR-10 database (Banner al. 2018). We use the standard setting of batch size T vn. Figure 2 (right) shows that the smoothed ò parameter is exponentially small in n for the SGD with 8-bit gradient quantization. The probabilities are estimated through 10 independent trails. This result implies that the neural networks trained through quantized gradients can be private without adding additive noises. Also, see Appendix G.2 for the experiments under another three different settings on II.
7 Conclusions and Future Work
We propose a novel notion to measure the privacy leakage of mechanisms without additive noises under realistic settings. One promising next step is to apply our smoothed DP notion to the entire training process of quantized NNs. Is the quantized NN private without additive noise? If not, what level of additive noises needs to be added, and how should we add noises in an optimal way? More generally, we believe that our work has the potential of making many algorithms private without requiring too much additive noise.
6D refers Washington, D.C., and NE-2 refers Nebraska's 2nd congressional district.
12

---

Published in Transactions on Machine Learning Research (12/2023)
Acknowledgments
We thank the anonymous reviewers for their helpful comments. Lirong Xia acknowledges NSF #1453542, #2007994, #2106983, and a gift fund from Google. Yu-Xiang Wang's work on this project was partially supported by NSF Award #2048091.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. Proceedings of 2016 ACM SIGSAC conference on computer and communications security, pp. 308-318, 2016.
Dan Alistarh, Demjan Grubic, Jerry Z Li, Ryota Tomioka, and Milan Vojnovic. QSGD: communication--fficcee sgd via gradient quantization and encoding. In Proc. Int. Conf. on Neural Inf. Process. Syst. pp. 1707-1718, 2017.
Sajid Anwar, Kyuycon Hwang, and Wonyong Sung. Fixed point optimization of deep convolutional neural networks for object recognition. In Proc. Int. Conf. on Acoust., Speech Signal Process., pp. 1131-1135, 2015.
Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. Proc. Int. Conf. on Neurul Inf. Process. Syst., pp. 15479-15488, 2019.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy profiles and amplification by subsampling. J. of Privacy and Confidentiality, 10(1), 2020.
Wolfgang Balzer, Masamobu Takahashi, Jun Ohta, and Kazuo Kyuma. Weight quantization in holtzmann machines. Neural Netw., 4 (3):405-409, Jan. 1991.
Ron Banner, Ita Hubara, Elad Hoffer. Daniel Soudry. Scalable methods for 8-bit training of neural networks. In Proc. Int. Conf. Neural Inf. Process. Syst., pp. 5151-5159, 2018.
Raef Bassily, Adam Groce, Jonathan Katz, and Adam Smith. Soupled-worlde privacy: Exploiting adversarial uncertainty in statistical data privacy. In Proc. Annu. Symp. on Found. of Comput. Sci., pp. 439 439-448, 2013.
Dorothea Baumeister, Tobias Hogrebe, and Jörg Rothe. Towards reality: Smoothed analysis in comput. social choice. In Proc. Int. Conf. Auton. Agents & Multiagent Syst., pp. 1691-1695, 2020.
Arnad Berlioz. Arik Friedman. Mohamed Ali Kaafar, Roksana Boreli, and Shlomo Berkovsky. Applying differential privacy to matrix factorization. In Proceedings of the 9th ACM Conference on Recommender Systems, pp. 107-114, 2015.
Aditya Bhaskara, Moses Charikar, Ankur Moitra, and Aravindan Vijayaraghvvan Smoothed analysis of tensor decompositions. In Proc. Annu. ACM Symp. on Theory of Comput., pp. 594-603, 2014.
Avrim Blum and John Dunagan. Smoothed Analysis of the Perceptron Algorithm for Lineur Programming. Pittsburgh, PA, USA: Carnegie Mellon University, 2002.
Jacob Bogage Christopher Ingraham. USPS ballot problems unlikely to change outcomes competitive states. The Washington Post, 2020. URL http::/wwwwwwwaaigggoopottotooos //0/a// htt///allot-clection -lection-problemss usps/ Accessed: Mar. 28, 2023.
George EP Box. Robustness the Strotegy of Scientific Model Building. Amsterdam, Netherlands: Elsevier, 1979.
Tobias Brunsch, Kamiel Cornelissn, Bodo Manthey, and Heiko Röglin. Smoothed analysis of belief propagation for minimum-cost flow and matching. In Proc. Int. Workshop Algorithms and Comput.. pp. 182-193, 2013.
Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Proc. Theory of Cryptogr. Conf-, pp. 635-658, 2016.
Mark Bun and Thomas Steinke. Average-case averages: private algorithms for smooth sensitivity and mean estimation. In Proc. Int. Conf. on Neural Inf. Process. Syst., pp. 181-191, 2019.
Matthieu Courbariaux, Yoshua Bengio, and dean-Pierre David. Binaryconnect: training deep neural networks with binary weights during propagations. In Proc. Int. Conf. Neural Inf. Process. Syst., pp. 3123 3131, 2015.
Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. arXiv:1905.02390 2019.
13

---

Published in Transactions on Machine Learning Research (12/2023)
Yuqing Du, Sheng Yang, and Kaibin Huang. Hligh-dimensional stochastic gradient quantization for communication--fficcnnn edge learning. IEEE Trans. on Signal Process. 68:2128-2142, Mar. 2020.
Cynthia Dwork and Guy N Rothblum. Concentrated differential privacy. arXiv: 010.00873,.. 2016.
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, llya Mironaw, and Moni Naor. Our data, ourselves: Privacy via distrihuted noise generation. In Proc. Annu, Int. Conf. on the Theory and Appl. of Cryptographic Techn., pp. 486-503, 2006a.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryplogruphy Conference. TCC 2006, New York, NY. USA, March 4-7, 2006. Proceedings 3. pp. 265-284. Springer, 2006b.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Found. and Trends Theor. Comput. Sci., (3-4):211-400) 2014.
Emile Fiesler, Amar Choudry, and H John Caulfield. Weight discretization paradigm for optical neural networks. In Proc. Opt. Interconnections & Netw., volume 1281, pp. 164-173, 1990.
Vincent Guingona, Alexei Kolesnikov, Julianne Nierwinski, and Avery Schweitzer. Comparing approximate and probabilistic differential privacy parameters. Inf. Proc. Lett., 182:106380, 2023. URL https:/wwwww.scccooooccccc.ooocs
S002001902300023
Yunhui Guo. A survey on methods and theories of quantized neural networks. arXiv:1808.04753: 2018.
Nika Haghtalab, Tim Roughgarden, and Abhishek Shetty. Smoothed analysis of online and differentially private learning. In Proc. Int. Conf. on Neural Inf. Process. Syst. pp. 9209- 9215, 2020.
Rob Hall, Alessandro Rinaldo, and Larry Wasserman. Random differential privacy. arXiv:1112.2680, 2011.
Avinatan Hassidim, Haim Kaplan, Yishay Mansour, Yossi Matias, and Stemmer. Adversarially robust streaming algorithms via differential privacy. Journal of the ACM. 1914) 2022.
Ity Hubara, Matthieu Courbariaux, Daniel Soudry. Ran El- Yaniy, and Yoshua Bengio. Binarized neural networks. In Proc. Int. Conf. on Neural Inf. Process. Syst., pp. 4122, 2016.
Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran EI- Yaniv, and Yoshua Bengio. Quantized neural networks: Training neural networks with low precision weights and activations. The J. of Mach. Learn. Res., 18(1):6869-688) 2017.
Zhanglong Ji, Zachary C Lipton, and Charles Elkan. Differential privacy and machine learning: a survey and review. arXiv preprint arXiv:1412.7508 2014.
Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In Proc. Int. Conf. on Mach. Learn., pp. 1376-1385, 2015.
Adam Tauman Kalai, Alex Samorodnitsky, and Shang-Hua Teng. Learning and smoothed analysis. In 2009 50th Annu. IEEE Symp. on Found. of Comput. Sci., pp. 395 994-404, 2009.
Minje Kim and Paris Smaragdis. Bitwise neural networks. arXiv:1601.0607 06071, 2016
David G Kirkpatrick and Raimund Seidel. The ultimate planar convex hull algorithm? SIAM J. Comput., 15(1):287-299, 1986.
Philip Laird and Ronald Saul. Discrete sequence prediction and its applications. Mach. Learn., 15(1):43-68, Apr. 1994.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. Proc. Symp. on Secur. and Privacy (SP), pp. 656-672, 2019.
Dave Leip. Dave leip's 's atlas the us presidential elections, 2023, URL http://s///ascccctioaaaa..ro///p Accessed: Mar. 28, 2023.
Zhechen Li, Ao Liu, Lirong Xia, Yongzhi Cao, and Hanpin Wang. Diffcrentially private condorcet voting. In Proceedings of the AAAI Conference Artificial Intelligence, volume 37, pp. 3755-5763. 2023.
Darryl Lin, Sachin Talathi and Sreekanth Annapureddy. Fixed point quantization of deep convolutional networks. In Proc. Int. Conf. on Mach, Learn., pp. 2849-2858, 2016.
Xiaofan Lin, Cong Zhao, and Wei Pan. Towards accurate binary convolutional neural network. In Proc. Int. Conf. on Neural Inf. Process. Syst., pp. 344-352, 2017.
14

---

Published in Transactions on Machine Learning Research (12/2023)
Ao Liu and Lirong Xia. The semi-random likelihood of doctrinal paradoxes. In Proc. AAAI Conf. Artif. Intell., pp. pp. 5124-5132, 2022.
Liu, Lirong Xia, Andrew Duchowski, Reynold Bailey, Kenneth Holmqvist, and Eakta Jain, Differential privacy for eye-tracking data. In Proc. of the 11th ACM Symp. on Eye Trucking Res. & Appl. pp. 1-10, 2019.
Ao Liu, Yun Lu, Lirong Xia, and Vassilis Zikas. How private are commonly-used voting rules? In Proc. Conf. on Uncertainty in Artif. Intell., pp. 629 638, 2020.
Ao Liu, Sijia Liu, Abhishek Bhandwaldar, Chuang Gan, Lirong Xia, and Qi Cheng Li. Interpretation maps with guaranteed robustness, May 24 2022a. US Patent 11,341,598,
Ao Liu, Sijia Liu, Bo Wu, Lirong Xia, Qi Cheng Li, and Chuang Gan. Certifiably robust interpretation, March 3 2022b. US Patent App. 17/005,144.
Ashwin Machanavajlhala, Daniel Kifer, John Abowd, Johannes Gehrke, and Lars Vilhuber. Privacy: Theory meets practice on the map. In IEEE 24th Int. Conf. on Data Eng.. pp. 277-286, IEEE, 2008.
Bodo Mamthey and Heiko Röglin. Worst-case and smoothed analysis of k-means clustering with bregman divergences. In Proc. Int. Symp. on Algorithms and Comput. pp. 1024-1033, 2009.
Michele Marchesi, Gianni Orlandi, Francesco Piazza, and Aurelio Uncini, Fast neural networks without multipliers. IEEE Trans. on Neural Netw,, 4(1):53-63 62, Jan. 1993.
Ilya Mironov. Rényi differential privacy. In Proc. Comput. Secur. Found. Symp.. pp. 263-275, 2017.
Asit Mishra, Eriko Nurvitadhi, Jeffrey Cook, and Debbie Marr. WRPN: Wide reduced-preccision networks. In Pruc. Int. Conf. on Learn, Representations, pp. 1-11, 2018.
Hiep H Nguyen, Jong Kim, and Yoonho Kim. Differential privacy in practice. J. of Comput. Sei. & Engineering, 7(3)177- 186, Sep. 2013.
Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. Smooth sensitivity and sampling in private data analysis. Proc. Annu. ACM Symp. Theory of Comput., pp. 75-84, 2007.
Nicolas Papernot, Shuang Song, Tlya Mironov, Ananth Raghunathan, Kunal Talwar, and Ulfar Erlingsson. Scalable private learning with pate. In Proc. Int. Conf. on Learn. Representations, pp. -1,1, 2018.
Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. Xnor-net: Imagenet classification using binary convolutional neural networks. In Proc. Eur. Conf. on Comput. Vision, pp. 525 542. 2016.
Anand D Sarwate and Kamalika Chaudhuri. Signal processing and machine learning with differential privacy: Algorithms and challenges for continuous data. IEEE signal processing magazine, 30(5):8-994, 2013.
Frank Scide, Hao Fu, Jasha Droppo, Gang Li, and Dong Yu. 1-bit stochastic gradient descent and its application to data-parallel distributed training of speech dnns. In Proc, Annu. Conf. of the Int. Speech Commun. Assoc., pp. 1058-1062, 2014.
Hyejia Shin, Sungwook Kim, Junbum Shin, and Xiaokui Xiao. Privacy enhanced matrix factorization for recommendation with local diffcrential privacy. IEEE Transactions Knowledge and Data Engineering, 30(9):1770-1788 2018.
Steven W Smith. The scientist and engineer's guide to digital signal processing, 1997.
Daniel A Spiclman. The smoothed analysis of algorithms. In Proc. Int. Symp. on Fundam. of Comput. Theory, 17 17-18, 2005.
Daniel Spielman and Shang Hua Teng. Smoothed analysis of algorithms: Why the simplex algorithm usually takes polynomial time. J. of the ACM, 51(3)388-463, 2004.
Chuan Zhang Tang and Hon Keung Kwan. Multilayer feedforward neural networks with single powers-of-two weights. IEEE Trans. on Signal Process., (1)22:724-277 Aug. 1993.
Jun Tang, Aleksandra Korolova, Xiaolong Bai. Xueqiang Wang, and Xiaofeng Wang. Privacy loss in apple's implementation of differential privacy on macos 10.12. arXiv preprint 17X.0:1709.02553, 2017.
Abhradeep Guha Thakurta and Adam Smith. Differentially private feature selection via stability arguments, and the robustness of the lasso. In Proc. Conf on Learn. Theory, pp. 819-850, 2013.
15

---

Published in Transactions on Machine Learning Research (12/2023)
Aleksei Triastcyn and Boi Faltings. Bayesian differential privacy for machine learning. In Proc. Int. Conf. Mach. Learn., pp. 9583-9592, 2020.
Vincent Vanhoucke, Andrew Senior, and Mark Z Mao. Improving the speed of neural networks on cpus. In Proc. Deep Learn. & Unsupervised Feature Learn. NIPS Workshop, pp. 2011.
Wenjie Wang. Pengfei Tang, Jian Lou, Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 1102-1112, 2021.
Xiong. Certified robustness to word substitution attack with differential privacy.
Yu-Xin Yu-Xiang Wang. Per-instance differential privacy. J. Privacy and Confidentiality. 9(1), 2019.
Larry Wasserman and Shuheng Zhou. A statistical framework for diffcrential privacy. J. of the Amer. Statistical Assoc., 105(489): 375-389, Mar. 2010.
Lirong Xia. smoothed possibility social choice. Proc. Int. Conf. on Neural Inf. Process. Syst. pp. 11044-11055, 2020.
Lirong Xia. How likely are large elections tied? Proc. ACM Conf. on Econ. Comput., pp. 884-885, 2021.
Aojun Zhou, Anbang Yao, Yiwen Guo, Lin Xu, and Yurong Chen. Incremental network quantization: Towards lossless cans with low-precision weights. arXiv:1702.03044 00000.0044..... 2017.
Feng Zhu, Ruihao Gong, Fengwei Yu, Xianglong Liu, Yanfei Wang, Zhelong Li, Xiuqi Yang, and Junjie Yan. Towards unified int8 training for convolutional ncural network. In Proc. the IEEE/CVF Conf. on Comput. Vision & Pattern Recognit. pp. 1969-1979, 2020.
16


Reviews:
[{"review_id": "6lFOjg4FXH", "reviewer": "Reviewer_zUmC", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n\nThe examination of privacy guarantees against a realistic adversary is well-motivated and is believed to hold interest for readers of TMLR. Differentially private mechanisms are designed to protect the privacy of a dataset against adversaries who, hypothetically, have knowledge of the entire dataset except for a single bit of information. While these defenses are robust against side-channel attacks, it is conservative to assume that such an all-knowing adversary exists in real-world situations. Investigating a realistic adversary and devising defenses to counter such adversaries is a promising avenue of exploration.\n\nExploring the privacy implications of subsampling is captivating. Subsampling can potentially conceal specific types of information from the original dataset. Understanding what subsampling can and cannot conceal may aid in advancing the development of privacy mechanisms. In this context, the authors effectively present some extent of privacy guarantee through the sampling-histogram mechanism.\n\nBeyond ensuring smooth differential privacy, the authors have validated the tightness of the privacy parameter ensured by the sampling-histogram mechanism. Even though this tightness is demonstrated specifically when both $m$ and $f(m,n)$ are of a constant order, such parameter settings are plausible in realistic scenarios. Through this tightness analysis, the authors have successfully delineated the privacy guarantees offered by the sampling-histogram mechanism.\n\n### Weaknesses\n\nOne of the primary shortcomings of the manuscript is its unsubstantiated claim regarding realistic models. Although the authors contend that they have elucidated a method for measuring privacy within \"realistic models,\" they provide no definitive evidence to support the assertion that the proposed smooth differential privacy is secure against realistic adversaries. Notably, smooth differential privacy provides security only against adversaries of lesser potency than does the original differential privacy. This is because smooth differential privacy does not intrinsically guarantee differential privacy. While differential privacy assures security against the strongest adversaries, smooth differential privacy lacks this assurance. This discrepancy leads to concerns that some realistic adversaries might circumvent the protections offered by smooth differential privacy. Hence, providing the threat model, including adversaries' abilities, under which smooth differential privacy can guarantee privacy is crucial. Such clarity is vital for verifying the claims of privacy protection in realistic models.\n\nTo illustrate their point, the authors present in Figure 1 a comparison between the privacy profiles of original differential privacy and smooth differential privacy in the context of US presidential elections. They suggest that the proposed privacy measure correlates exponentially with the adversary's utility. However, the adversary's utility appears to have been selectively chosen by the authors to align with the privacy profile of smooth differential privacy. The correlation shown in Figure 1 does not inherently validate the practicality of smooth differential privacy.\n\nThe sampling histogram mechanism might satisfy traditional differential privacy, provided that all datasets conform to $f$-strict positivity. To encapsulate the privacy assurances offered by subsampling, the original differential privacy appears adequate. Therefore, the introduction of a novel—yet unsubstantiated—privacy concept, namely smooth differential privacy, is questionable.\n\nSmooth differential privacy agrees with standard differential privacy when $\\Pi$ is the set of all distributions, as this set includes one supported on a specific dataset. It is self-evident that the privacy profile of smooth differential privacy is equivalent to or lesser than that of differential privacy. Therefore, the rationale behind comparing smooth differential privacy with standard differential privacy, as presented in Section 6, is unclear to me.\n\nMoreover, the manuscript is permeated with linguistic inaccuracies, significantly detracting from its overall quality.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a novel concept in differential privacy, termed smooth differential privacy. Unlike differential privacy, smooth differential privacy stipulates that the expected privacy profile must remain bounded across all given data distributions. The authors illuminate a reduction property of smooth differential privacy, indicating that the vertices of the convex hull of data distributions determine its satisfaction. To illustrate the practical application of smooth differential privacy, a sampling-histogram mechanism is presented. This mechanism generates a histogram from a uniformly random subsample of a defined size. It is demonstrated that this mechanism adheres to smooth differential privacy when it meets the f-strictly positive condition. The authors also observe that the privacy profile derived from this is most effective under specific conditions. The study also reveals that subsampling-based mechanisms fall short of achieving standard differential privacy with discrete-valued data and smooth differential privacy with continuous-valued data. Experimental results emphasize the superior privacy profile of the proposed mechanism, particularly when tested with elections and 1-step quantized SGD.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "(Major) Please elucidate the threat model, inclusive of adversaries' capabilities, under which smooth differential privacy can assure privacy.\n\n(Major) Should the authors show the adversary's utility depicted in Figure 1 as reasonable, it is requisite to elucidate its reasonableness within the main text.\n\n(Major) It is essential to articulate the necessity of employing smooth differential privacy. To appraise the privacy protection that subsampling furnishes, the original differential privacy seems sufficient.\n\n(Major) It is imperative to significantly enhance the manuscript by rectifying linguistic inaccuracies.\n\n(Major) Although the authors assert that pre-processing is a distinctive characteristic of smooth differential privacy, a similar characteristic may hold in original differential privacy as well.\n\n(Minor) Table 2 presents an unfair comparison. The term \"smoothed analysis\" should be replaced with \"less informative adversary.\"\n\n(Minor) It is necessary to elucidate why the selections of π illustrated in the experiments render reasonable privacy protection.\n\n(Minor) I find Justifications 1 and 2 to be untenable as $\\delta(x)$ can take a large value under smooth differential privacy.\n\n(Minor) The manuscript could be further enhanced by introducing a discussion on integrating the subsampling-based mechanism with anonymization algorithms, including those aimed at k-anonymity. An anonymized dataset may invariably fulfill f-strict positivity.", "broader_impact_concerns": "I have not found any concerns regarding border impact.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "mWQGl9IRXj", "reviewer": "Reviewer_m9fG", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n1. The paper introduces the notion of smoothed DP following the worst average-case idea behind the smoothed analysis. The proposed notion can be used to measure the privacy leakage of some types of non-noising mechanisms (e.g., mechanisms based on SHM including ML algorithms based on randomly sampling training data and deterministic voting rules), which is very interesting. \n\n2. Some basic properties of smoothed DP (especially pre-processing property) are introduced. Based on these, the authors used smoothed DP to measure the privacy of some commonly used mechanisms, where sampling noise is unavoidable. \n\n3. Experiments support the findings and the results of the paper.\n\nWeakness\n\n1. Smoothed DP can only address some specific problems or scenarios, such as mechanisms with sampling noise. While DP, RDP or GDP are more general.\n\n2. The running time of calculating the exact privacy profile $\\delta$ for smoothed DP might be very large (Theorem 2 shows that the running time is $O(n^{2m+\\ell*-3}+\\ell \\log(\\ell*)) + Cpl_{DP}$). \n\nOverall, the paper is well-written and the idea is novel and interesting.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes a novel extension notion of DP, named smoothed differential privacy, to measure the privacy leakage of mechanisms without adding additional noises that do not satisfy DP. By noting that the worst-case privacy according to DP might be too loose to serve as a practical measure for evaluating and comparing mechanisms with sampling noise (while without additive noise) in real-world applications (e.g. election with sampling noise), the smoothed DP with basic properties (e.g., post-processing and composition properties)  is introduced. Further, an algorithm used to calculate the privacy parameters for smoothed DP is proposed.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Could the author give some explanation or insights when introducing the definition of smoothed DP in Section 3.2? For example, I was confused as to why the set of distribution $\\Pi$ was introduced. Does this come from smoothed analysis? The original DP holds for any $x$ and $x’$, while the smoothed DP seems to restrict the distribution of $x$ to a small set? \n\n2. Theorem 3 (i) shows that when $\\epsilon \\ge \\ln(1/1-\\eta) +c$,  $M_H$ satisfies a certain level smoothed DP. Does this imply that $M_H$ is nearly non-private even under the notion of smoothed DP if the sampling rate $\\eta$ tends to 1 or the constant $c$ is very large?  In addition, could the authors give some explanation or a discussion about the constant $c$? \nAlso, in line 299, the authors state that SHM is $(3,\\exp(-\\Theta(n)),\\Pi)$-smoothed DP, it seems that $c$ and $m$ are ignored? \n\nMinor comments\n\n1. The notion $\\Theta(\\cdot)$ and $\\omega(\\cdot)$ are not introduced.\n\n2. In line 251, “The application” should be “the application”. In line 80, “pre-prpcessing” should be “pre-processing”.", "broader_impact_concerns": "no", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "FgaESdcUvQ", "reviewer": "Reviewer_zTAA", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\nThe paper proposes a framework that can be seen as more realistic, as it does not use the pessimistic estimates of standard differential privacy.  The paper has both theoretical results as well as an experimental study, thus elucidating the proposed framework in both interesting ways.\n\n**Weaknesses**\n\nIn my opinion this paper assumes basic knowledge of differential privacy from the reader and is not an entirely stand-alone paper. I, for one, am not really familiar with differential privacy and I am not confident about my understanding in various cases.  However, let me come to some concrete issues that the paper has, which I believe are issues even if the reader knows differential privacy.\n\n- Differential privacy is defined in page 4 but some intuitive notion of what it actually is would help the reader a lot in the beginning to understand the existing framework (differential privacy), the proposed framework (smoothed differential privacy), and appreciate better the work of the authors.\n\n- Instead the authors discuss in the first sentence methods of how DP can be achieved, as well as have some forward referencing the makes it hard to follow what kind of message the authors are trying to convey. For example, in line 33 the privacy parameter $\\delta$ is mentioned, but no intuition given as to what $\\delta$ really measures. We only understand as readers that smaller values of $\\delta$ are more desirable, but essentially this is it.\n\n- The paragraph to the left of Figure 1 needs rewriting to convey better meaning. \n\n- The caption of Figure 1 is referencing some equation from the appendix as an explanation.  This needs to change somehow and convey meaning in a caption of a figure without asking from a reader that has just started reading a paper to leave everything on the side and move to the appendix in order to understand something from what should be an \"explanatory\" figure.\n\n- Also, since we are in figure 1, discussing a bit about adversaries utility in the main text would be nice. In my opinion this is another example that a few meaningful paragraphs of what differential privacy really is, are missing from the introduction of the text.\n\n- While the authors give an example in the introduction, I think the example is only half-successful. It would be nice to have an example with actual histograms and discussion on the manipulation that can be done by an adversary and how information can leak from the database. The way the paper is written it is impossible to understand how something like that can be done.\n\n- Also, I appreciate a lot Tables 1 and 2 that the authors have tried to compile and make it clearer for their work to be understandable. However, again, I think because some high-level discussion is missing from the introduction about DP, it is not really possible to appreciate fully what the authors present. In addition, as a person reading about a topic (DP) that I knew almost nothing beforehand, I find the use of lowercase $x$ to represent some database to be odd. \n\n- In lines 117-118 you try to describe databases and records. I think spending two-three lines and giving an actual example of what you mean it would be nice.  Is it is the case that the record is a single number (or category)?  Is it a vector?  If it can be a vector (which would make more sense for a record), then you can argue a bit more about the nature of $\\mathcal{X}$. Then, you could also give an example of neighboring databases $x$ and $x'$ and explain how much of a difference is allowed between two different records.\n\n- Line 172: Theorem statement precedes the definition of the framework of the authors.\n\n- I have a hard time following the argument the authors are trying to make in lines 215-216. Is there any real-world case where one does not use the actual data of a dataset, but rather the gradients for, I suppose, some particular training iteration for some custom artificial neural network architecture?\n\n- The discussion in the experiments needs some more text. Do the authors discuss the right-hand side of Figure 2? Along these lines, in both subfigures, the graph corresponding to $\\epsilon = 0.5$ is above the yellow line, which, if I understand correctly (from what is mentioned in the introduction), we would like these graphs to be below the yellow line.  Nevertheless, the authors claim that $\\delta$ is exponentially small even if it is above that yellow line.  Some clarification would be in order (I think).\n\n- Overall the authors are allowed to use 12 pages for the main text of the paper and in this case they use 10 pages plus a few more lines. The paper can improve a lot by adding discussion as mentioned above, or by adding a few sentences in other parts where the authors ask from the readers to read the appendix (e.g., caption of Figure 1, or in line 115 where they refer the readers for reading part of the related work in the appendix).\n\n\n\n**References**\n\nI would prefer to see a reference being cited for the claim in line 65 (comparison of simplex with other polynomial methods). \n\n\n**Some Typos**\n\nWithout referring to a specific line, I think that in most of the cases where the authors use \"noises\" I would actually use the term \"noise\".\n\nLine 20: mechansim -> mechanism\nLine 49 (second paragraph, line 4): sampling -> Sampling (capitalize)\nLine 121: What do you mean by \"image space\"? Shouldn't this be defined somewhere?\nLine 162: opposites to -> contrasts", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper is proposing a variant of differential privacy (DP), where instead of using worst-case estimates, one can use a \"smoothed\" version of differential privacy. This allows the authors to argue about privacy leakage in a more realistic sense.  \n\nAlong these lines the authors prove that any discrete mechanism with sampling procedures is more private that what standard differential privacy predicts. Furthermore, the authors prove that many continuous mechanisms with sampling procedures are still non-private under smoothed differential privacy.  \n\nIn addition, the authors prove some desirable properties of smoothed differential privacy, such as composition, robustness to post-processing, and distribution reduction.  Based on these properties the authors are able to propose an algorithm for efficient computation of the privacy parameters of smoothed differential privacy. Ultimately the authors evaluate experimentally the proposed framework of smoothed differential privacy and conclude that discrete sampling mechanisms are private in real-world elections as well as some artificial neural networks can be private without adding additive noise.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see the weaknesses mentioned above.  I think this paper needs a major revision before it can be accepted.", "broader_impact_concerns": "I am really not familiar with the field, but the authors could potentially devote a small paragraph and discuss broader impacts at the end of the paper.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper introduces the concept of smoothed DP, a method designed to measure privacy leakage in mechanisms without additive noises under practical conditions effectively. The authors rigorously establish and demonstrate various properties of smoothed DP. Additionally, they present an efficient algorithm for computing the privacy parameters associated with smoothed DP and validate it through experiments.

The authors have diligently incorporated the reviewers' feedback, resulting in a revised manuscript. Two reviewers endorse its acceptance.  Although one reviewer expresses lingering concerns about the paper's claims, they acknowledge the paper's motivation in addressing privacy guarantees against realistic adversaries, which will engage readers of TMLR. The theoretical analysis presented is also appreciated.

Considering the comprehensive responses from the authors and the reviewers' recommendations, I recommend accepting the paper.
Decision: Accept (poster)