Title: Differential Privacy for Euclidean Jordan Algebra with Applications to Private Symmetric Cone Programming
Venue: NeurIPS 2025
Accepted: yes
Keywords: differential privacy

euclidean jordan algebra

symmetric cone programming
Abstract: In this paper, we study differentially private mechanisms for functions whose outputs lie in a Euclidean Jordan algebra. Euclidean Jordan algebras capture many important mathematical structures and form the foundation of linear programming, second-order cone programming, and semidefinite programming. Our main contribution is a generic Gaussian mechanism for such functions, with sensitivity measured in $\ell_2$, $\ell_1$, and $\ell_\infty$ norms. Notably, this framework includes the important case where the function outputs are symmetric matrices, and sensitivity is measured in the Frobenius, nuclear, or spectral norm. We further derive private algorithms for solving symmetric cone programs under various settings, using a combination of the multiplicative weights update method and our generic Gaussian mechanism. As an application, we present differentially private algorithms for semidefinite programming, resolving a major open question posed by [Hsu, Roth, Roughgarden, and Ullman, ICALP 2014].


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies differentially private symmetric cone programming (SCP). Prior works used private multiplicative-weights for linear programs (LP). But optimization on richer cones such as Lorentz and PSD cones are still open. Because Gaussian mechanisms calibrated in  Euclidean norm either introduce dimension-dependent noise or break cone feasibility, no polynomial time algorithm with meaningful utility guarantees existed for constraint-private semidefinite programs (SDP), where a single individual’s data can alter an entire constraint. Using Euclidean Jordan algebras, this paper introduces a cone-aware Gaussian mechanism that matches operator-norm sensitivity and embeds into a rank-sensitive multiplicative-weights framework. \n\nThis gets us the first solver for private covering SDP that also extends to all symmetric cones defined in SCP. The main theorem (theorem 5.1 )guarantees approximate feasibility while violating only $s=\\mathcal{O}\\left(\\frac{r}{\\varepsilon}\\right)$ constraints, matching the linear-program rate when cone rank $r$ equals dimension. The mechanism therefore closes the open problem of high-sensitivity, constraint-private optimization beyond linear settings, extending differential privacy guarantees to symmetric cones while retaining polynomial runtime and tight accuracy.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: I haven't read the proof but this paper feels very solid. The contribution is mainly from the generic gaussian mechanism that removes the dimension dependence and unlocks the private SCP. I feel like this advancement could have broader implications, potentially benefiting areas like private learning, private sparse PCA, private robust mean/variance estimation, etc.\n\nWeaknesses: Many readers know SDP but not EJA, it would be better if the authors could explain the technical results using examples from Euclidean space.\n\nQUESTIONS:\n1. Could the cone-aware Gaussian mechanism be adapted for DP algorithms that currently rely on SDP, such as private sparse PCA or robust mean/variance estimation? What are some potential future works that could benefit from the generic gaussian mechanism and the private SCP?\n\n2. The high-sensitivity solver relies on an exponential-size $\\gamma$-net oracle. Can this be replaced by some random sampling, or sketching technique?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper provides differentially private SDP solving algorithms where the privacy guarantee is measured by the sensitivity to perturbation in nuclear, spectral or Frobenius norms of the output positive semidefinite matrix. The SDP solvers use multiplicative weights and solve the SDPs approximately in the sense that a fraction of the constraints may be violated. The techniques used to achieve these differentially private solvers are the design and analysis of MMW style algorithms so that DP guarantees can be reduced to ensuring that the oracle is implemented in a ‘privacy preserving’ manner. The private oracles are then implemented using a combination of Gaussian and exponential mechanisms for covariance matrices (some developed in the present work) and epsilon net arguments, that are described using the formalism of Euclidean Jordan Algebras, \n\nWhile there has been much work of DP for linear programs, there are not many references on DP for SDP solving. This paper takes important steps on DP mechanisms for SDPs and ‘approximately’ solves the DP for 4 different formulations for the closeness of databases. The algorithms do not seem to be optimal in all settings and possibly could be improved by future work.\n\nSTRENGTHS AND WEAKNESSES:\n- The paper uses a principled approach to developing differential private mechanisms for SDPs developing first a Gaussian mechanism. It then considering separately 4 different notions of database closeness that may arise and separately solving each using a tailored MMW type algorithm and Gaussian, exponential and \nEpsilon net type arguments. \n\n- It could be argued that the Jordan algebra is not really needed and results could be proved using more standard notation. However the use of Jordan algebras provides conceptual clarity for definitions of the Gaussian mechanism and in the construction of the gamma-net in one of the proposed mechanisms for covering SDPs. \n\n- A weakness is that the Gaussian mechanisms utilize the sensitivity parameter which may not be easy to compute or bound apriori in all cases. For the SDP case this parameter is a bound on change in spectral/Frobenius norm of the solution when a single constraint is added or perturbed. \n\n- Optimality of the noise added to achieve privacy is also a concern as the quality solution degrades with the extra noise added. Not much is said in the paper on whether this noise rate can be reduced or is optimal under some conditions. \n\nOverall assessment: Assessment: A good paper that carries out a detailed investigation of DP for SDPs in different settings using MMW type algorithms.\n\nQUESTIONS:\n-Random matrix theory may be a source of additional improvements on the DP guarantees for SDP solvers. RMT answers questions on the precise change in the spectrum when the entries of the matrix are perturbed by adding additive noise, as in the Gaussian mechanism proposed here. \n\n- Besides the SDP case, are there any straightforward generalizations to private mechanisms for second order cone programming? Also, can the more recent existing LP results be recovered easily from the Jordan algebra framework? \n\n- Line 260: Why is an l-infty estimate for the norm of a Gaussian element a major open question?\n\nLIMITATIONS:\nDiscussed in paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a theoretical framework for applying differential privacy (DP) in more complex algebraic spaces using the framework of Euclidean Jordan Algebras (EJA). From a DP perspective, the Gaussian mechanism can be applied when there exists an isometry from the EJA to $\\mathbb{R}^k$ by adding Gaussian noise in $\\mathbb{R}^k$ and inverting the isometry. The claimed benefit of the more general framework is a unified approach to a variety of problems, including semidefinite programming problems. \n\nOf note is that this paper is a purely theoretical/algorithmic contribution and does not rely on experimental evidence. I think this is fine, but I wish to forestall criticisms from others about the lack of experiments: it is a reasonable choice by the authors' choice to not do an empirical study.\n\nSTRENGTHS AND WEAKNESSES:\nFor the author's benefit, in the language of journal submissions this is to me a \"reject with recommendation to resubmit\": the technical results are sound but the presentation is not reflective of the actual contribution.\n\n**Strengths:**\n\n* The EJA framework is a nice general frame for thinking about DP methods in non-vector settings.\n* While using the multiplicative weights (MWU) approach is by now \"classic\", the authors do a nice job of looking at its instantiation in an important class of problems.\n\n**Weaknesses:**\n\nThe main weakness of the paper (to me) is that the authors saddle themselves with the baggage of differential privacy and accounting for completely unnecessary reasons: understanding SCPs with noisy oracles is, in and of itself, an interesting problem. This has led to a manuscript which obscures, rather than highlights, the main technical contribution. Differential privacy is simply an *application* or *example* of what is really going on. There could be other reasons why the oracle is noisy/approximate.\n\n* It is hard to identify new conceptual ideas on privacy side from the EJA formulation given the requirement of an isomorphism to Euclidean space.\n* Far too much space in the main manuscript is devoted to a rehash of DP, making the contribution to symmetric cone programming a bit telegraphic.\n\nI am recommending reject based on the manuscript presented for review. This is not a judgment on the merits of the results but rather on whether the paper is a good contribution to the literature.\n\nQUESTIONS:\nI can appreciate that the authors are in a bind when writing this paper. Will a NeurIPS reviewer know what an EJA is? Will they know what DP is? Will they have seen SCPs? Will they know only a subset? Therefore they have opted to submit a manuscript which is dominated by basic definitions. I am writing this review as someone who has familiarity (at varying levels) for all 3 (more on DP, textbook-level on the SCPs and JAs).\n\nThis paper is basically about noisy SCPs: the noise is Gaussian (no other distributions are investigated). This makes the differential privacy interpretation almost \"window-dressing\" around the actually interesting part of the paper.\n\n**Issue 1: What is the actual DP contribution?** By the author's own admission, \"the utility guarantee for the generic Gaussian mechanism follows from the isometry property of $\\phi$\" so why is the privacy story so important?\n\n* If we can assume there is an isometry $\\phi \\colon \\mathcal{J} \\to \\mathbb{R}^k$ why not just work with $\\mathbb{R}^k$ if the mechanism is effectively $\\phi^{-1}( f(D) + z )$? That seems to be the workhorse of the privacy guarantees: since we are working with $\\ell_2$-sensitivity the sensitivity bound is preserved by the isometry so there's basically no difference from thinking of a mechanism $g \\colon \\mathcal{D} \\to \\mathbb{R}^k$ and using post-processing invariance to apply $\\phi^{-1}$. That would avoid the need to rebuild any differential privacy definition \"from scratch.\" Am I missing something deeper here? \n* The setting of $\\sigma$ in terms of $\\epsilon$ and $\\delta$ is \"old fashioned\" and does not hold for all $\\epsilon$: see Balle and Wang (ICML 2019). \n* In general, working with $(\\epsilon,\\delta)$ and advanced composition is far behind with respect to the privacy accounting literature: just look in [Google Scholar for \"privacy accounting\"](https://scholar.google.com/scholar?hl=en&q=privacy+accounting). Why use the \"advanced composition\" and not modern methods like the moments accountant, RDP, etc.? These have been around for well over 5 years.\n* From a purely motivational standpoint, what applications for which privacy is important does the EJA framework \"unlock\" with respect to prior work?\n\n**Issue 2: Is the main technical contribution in showing that MWU can be extended to symmetric cone programming?** The paper really gets going in Section 5 and beyond, where they delve into some interesting issues around using MWU in SCPs.\n\n* Spending more time in the actual paper on covering SDPs and noisy optimization (or noisy oracles) would broaden the scope of the paper.\n* Is there a way to exploit the specific structure of this problem setting to improving over the \"generic\" utility guarantees from the exponential mechanism?\n* What is the justification for the dual oracle? That is, why should such an oracle exist (the argument that it is useful to have one is there in the paper already).\n* Is the unit-norm solution requirement in Theorem C.12 without loss of generality? It seems not.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

comments: SUMMARY:
This paper introduces differential privacy mechanisms for functions with outputs in Euclidean Jordan algebras (EJAs) and applies them to symmetric cone programming (SCP). The main contributions are: (1) a generic Gaussian mechanism for EJAs with $l_1, l_2$, and $l_{\infty}$ sensitivity, and (2) private algorithms for SCP under various sensitivity settings using multiplicative weights updates.

STRENGTHS AND WEAKNESSES:
## Strengths
- The paper extends differential privacy beyond vector spaces to the more general setting of Euclidean Jordan algebras, which is mathematically non-trivial.
- It addresses the longstanding question of private semidefinite programming posed by Hsu et al. (2014).
- The paper covers multiple sensitivity notions, including high/low sensitivity for constraints, scalars, and objectives.

## Weaknesses
While the theoretical contributions are mathematically sound, the paper lacks empirical evidence demonstrating actual performance of DP mechanisms on real-world symmetric cone programming instances.

QUESTIONS:
A weakness of this work is the absence of experimental validation. if possible, Could the authors provide empirical evaluation on some synthetic and real-world symmetric cone programming instances? For example, Medina et al. (2020) demonstrated their private optimization algorithm's effectiveness through experiments showing utility-privacy tradeoffs and comparing against baselines. 

[1] Medina, Andrés Muñoz, Umar Syed, Sergei Vassilvitskii, and Ellen Vitercik. "Private optimization without constraint violations." arXiv preprint arXiv:2007.01181 (2020).

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-16