Title: Online Locally Differentially Private Conformal Prediction via Binary Inquiries
Venue: NeurIPS 2025
Accepted: yes
Keywords: Conformal Prediction

Local Differential Privacy

Online Learning

Pinball Loss
Abstract: We propose an online conformal prediction framework under local differential privacy to address the emerging challenge of privacy-preserving uncertainty quantification in streaming data environments. Our method constructs dynamic, model-free prediction sets based on randomized binary inquiries, ensuring rigorous privacy protection without requiring access to raw data. Importantly, the proposed algorithm can be conducted in a one-pass online manner, leading to high computational efficiency and minimal storage requirements with $\mathcal{O}(1)$ space complexity, making it particularly suitable for real-time applications. The proposed framework is also broadly applicable to both regression and classification tasks, adapting flexibly to diverse predictive settings. We establish theoretical guarantees for long-run coverage at a target confidence level, ensuring statistical reliability under strict privacy constraints. Extensive empirical evaluations on both simulated and real-world datasets demonstrate that the proposed method delivers accurate, stable, and privacy-preserving predictions across a range of dynamic environments.

Online Locally Differentially Private Conformal Prediction via Binary Inquiries

Abstract

We propose an online conformal prediction framework under local differential privacy to address the emerging challenge of privacy-preserving uncertainty quantification in streaming data environments. Our method constructs dynamic, model-free prediction sets based on randomized binary inquiries, ensuring rigorous privacy protection without requiring access to raw data. Importantly, the proposed algorithm can be conducted in a one-pass online manner, leading to high computational efficiency and minimal storage requirements with O (1) space complexity, making it particularly suitable for real-time applications. The proposed framework is also broadly applicable to both regression and classification tasks, adapting flexibly to diverse predictive settings. We establish theoretical guarantees for long-run coverage at a target confidence level, ensuring statistical reliability under strict privacy constraints. Extensive empirical evaluations on both simulated and realworld datasets demonstrate that the proposed method delivers accurate, stable, and privacy-preserving predictions across a range of dynamic environments.

1 Introduction

Modern decision-making systems are increasingly deployed in streaming environments such as real-time bidding, health monitoring, and algorithmic trading, where data distributions evolve over time. In these dynamic settings, reliable uncertainty quantification is essential for ensuring trustworthy predictions and maintaining robustness under distributional shift. Conformal prediction (CP) [Vovk et al., 2005] provides a powerful, distribution-free framework for constructing prediction sets with formal finite-sample coverage guarantees. However, traditional CP methods rely on the assumption of exchangeability among calibration samples, an assumption that is often violated in online environments, where data distributions are non-stationary (e.g., due to changing user behavior during a pandemic). To address the limitations posed by distributional shifts and exchangeability violations, numerous extensions to CP have been proposed [Tibshirani et al., 2019, Lei and Candès, 2021, Fannjiang et al., 2022, Barber et al., 2023, Plassier et al., 2024], incorporating techniques such as weighted quantiles, adaptive calibration, and distributional adjustment.

Among the earliest attempts to bring CP into an online setting, Gibbs and Candes [2021] proposed a method based on online convex optimization that adaptively adjusts prediction thresholds using perinstance coverage feedback. While this approach marked an important step toward online uncertainty quantification, it assumes access to true outcome labels at every time step to verify coverage, an assumption that is incompatible with privacy requirements in potentially sensitive user data such

as patient records in healthcare or physiological signals from wearable devices. Moreover, the algorithm requires pre-specified learning rates, which may result in unstable prediction intervals that are either empty or unbounded in practice. Subsequent efforts have sought to mitigate these limitations by proposing more stable and adaptive procedures [Zaffran et al., 2022, Angelopoulos et al., 2023, Bhatnagar et al., 2023] . More recent work [Podkopaev et al., 2024, Ge et al., 2024, Angelopoulos et al., 2024, Gibbs and Candès, 2024] continues to advance online conformal prediction methodologies to better accommodate the challenges of non-stationary, real-time data streams.

Despite these important developments, existing approaches generally lack built-in privacy protection, leaving them vulnerable to information leakage in privacy-sensitive applications. As demonstrated by Angelopoulos et al. [2022], the conformal calibration step itself can leak private information unless explicitly privatized. This highlights the need for a principled framework that integrates uncertainty quantification with rigorous, end-to-end privacy guarantees. Differential Privacy (DP) [Dwork et al., 2006b,a], one of the most widely used frameworks for privacy-preserving data analysis, provides a rigorous mathematical definition that guarantees the output of a computation does not reveal sensitive information about any individual in the dataset. Due to its strong theoretical guarantees and practical utility, DP has seen widespread adoption across a variety of domains, including healthcare, wearable sensors, and public sector services [Dankar and El Emam, 2013, Li et al., 2022, Drechsler, 2023]. Recent research has focused extensively on the central differential privacy (CDP) model, which assumes the existence of a trusted server that can securely collect, store, and process raw user data. This framework has demonstrated effectiveness in a variety of applications, such as deep learning, federated learning, and synthetic data generation [Abadi et al., 2016, Adnan et al., 2022, Ponomareva et al., 2023, Olabim et al., 2024].

Unfortunately, the aforementioned methods based on the CDP model inherently depend on the assumption of trust in the central curator, making it vulnerable to technical breaches, insider misuse, and potential privacy violations if the central server is compromised. In contrast, the local differential privacy (LDP) model eliminates the need for a trusted aggregator by requiring that each user privatize their data at the source, before any transmission to a server or analyst [Kasiviswanathan et al., 2011, Duchi et al., 2018, He et al., 2023, Duchi and Ruan, 2024]. Owing to its strong privacy guarantees, LDP has been widely adopted in practice by major technology companies such as Google [Erlingsson et al., 2014, Song et al., 2021], Apple [Tang et al., 2017], and Meta [Yousefpour et al., 2021]. Despite its practical importance, the literature on CP under rigorous privacy guarantees remains relatively limited, even in offline settings. For example, Angelopoulos et al. [2022] proposed a method for constructing conformal prediction sets under CDP, but their approach is limited to static calibration datasets and centralized computation. Recent efforts have attempted to extend privacy guarantees to federated and decentralized frameworks. Humbert et al. [2023] applied the exponential mechanism within a federated learning paradigm to perform private quantile estimation across distributed clients. Similarly, Plassier et al. [2023] introduced noise into gradient updates to derive private prediction sets. Although these methods effectively enforce privacy during downstream processing, they fail to address a critical vulnerability in dynamic environments: the risk of exposure at the time of data acquisition. This highlights a critical gap in the existing literature, the lack of dynamic, modelfree methods for constructing prediction sets under LDP that enable real-time, privacy-preserving decision-making.

The goal of this paper is to address the critical challenge outlined above. Specifically, we introduce an online CP framework under LDP constraints, a unified approach for distribution-free, privacypreserving uncertainty quantification in streaming data environments. The overall flowchart of the proposed framework is illustrated in Figure 1. Our main contributions are summarized as follows:

We propose a trusted-curator-free algorithm that operates fully online in a single-pass, under the one-shot interaction model , where each user is inquired exactly once. The algorithm leverages locally privatized binary feedback to ensure stringent privacy guarantees without direct access to raw user data. By design, it is both computationally and memory efficient, achieving constant time and space complexity ( O (1) per instance), making it particularly well-suited for dynamic environments in both regression and classification tasks.

Our framework is model-agnostic , supporting arbitrary black-box prediction models, including those trained under DP. In contrast to most existing methods, our approach provides the flexibility to construct fully end-to-end privacy-preserving pipelines when the underlying predictive model trained online is itself private.

From a theoretical perspective, we provide a rigorous analysis of the algorithm's LDP guarantees and show that these extend to the entire prediction pipeline when the pre-trained model is also DP, thereby achieving full end-to-end privacy protection . In addition, we establish that the algorithm achieves long-run coverage guarantees at the nominal target level, regardless of the underlying predictive model.

BinaryInquiry

RandomizedResponse

One-by-one

UserA

ProduceForecast

Aggregate

UpdatePrivateQuantile

UserB

andCompute

forNextRound

NonconformityScores(Locally)

OutputPrivateSet

2 Preliminaries

2.1 Differential privacy

In this subsection, we review the basic concepts and some useful properties of CDP and LDP.

Definition 2.1 (CDP, Dwork et al. [2006b]) . Let X be the sample space for an individual data, a randomized algorithm M : X n →R is ( ϵ, δ ) -DP if and only if for every pair of adjacent datasets X , X ′ ⊂ X n and for any measurable event E ⊆ R , the inequality below holds:

When δ = 0 , then M is called pure ϵ -DP.

This definition enforces privacy at the output level and assumes the existence of a trusted curator with access to the raw dataset. While such an assumption simplifies algorithm design, it does not eliminate the need for trust or mitigate the risks of internal data exposure. To address this limitation, LDP is given as follows, which shifts the privacy mechanism to the user side, requiring that data be randomized before collection, thereby removing the need for any trusted data aggregator. The formal definition of LDP is given below.

Definition 2.2 (LDP, Xiong et al. [2020]) . A randomized algorithm M : X → R satisfies ( ϵ, δ ) -LDP if and only if, for any pair of input individual values x, x ′ ∈ X , and for every measurable event E ⊆ R , we have

When δ = 0 , this reduces to pure ϵ -LDP.

LDP ensures privacy at the individual level by requiring each user to randomize their data locally before sending it to the data collector. LDP supports different interaction models depending on how users communicate with the server. In this paper, we adopt the one-shot interactive LDP setting [Cheu et al., 2019, Liu et al., 2023], wherein each user applies a local randomizer exactly once and transmits privatized feedback to the server. This design substantially reduces communication overhead while providing rigorous privacy protection. Specifically, our algorithm assumes that each user is inquired only once, and the server updates its internal state solely based on the privatized responses it receives.

We now proceed to present several key properties of LDP that characterize how privacy guarantees are preserved under sequences of operations.

Lemma 2.3. [Xiong et al., 2020]

Sequential Composition : Suppose n mechanisms { M 1 , . . . , M n } satisfy ϵ i -LDP, respectively, and are sequentially applied to the private data. Then, the combined mechanism formed by ( M 1 , . . . , M n ) in some order satisfies ( ∑ n i =1 ϵ i ) -LDP.

Parallel Composition : Suppose n mechanisms { M 1 , . . . , M n } satisfy ϵ i -LDP for i = 1 , 2 , . . . , n , respectively, and are computed on a disjoint subset of the private data. Then, a mechanism formed by ( M 1 ( D 1 ) , . . . , M n ( D n )) satisfies max( ϵ i ) -LDP.

Postprocessing Property : If mechanism M 1 satisfies ϵ -LDP, then for any mechanism M 2 , even if M 2 does not satisfy LDP, the composition M 2 ( M 1 ( · )) also satisfies ϵ -LDP.

2.2 Problem formulation

In this paper, we consider an online learning framework in which data arrive sequentially as { ( X t , Y t ) } t ≥ 1 , with X t ∈ X ⊂ R d and Y t ∈ Y ⊂ R . Classical online CP [Gibbs and Candes, 2021, Angelopoulos et al., 2023, Gibbs and Candès, 2024, Podkopaev et al., 2024] assumes the existence of a bounded non-conformity score function S t : X×Y → [0 , D ] at each time t , where the score S t = S t ( X t , Y t ) quantifies the discrepancy between the model's prediction and the observed outcome. A common example in regression task is the absolute residual score, S t ( X t , Y t ) = | Y t -ˆ f t ( X t ) | , where ˆ f t : X → R is the predictive model trained in an online manner. The primary goal is to construct a prediction set ˆ C t at each time t such that the long-run empirical coverage converges to a pre-specified nominal level 1 -α . Formally, we aim to satisfy:

where the prediction set is given by: ˆ C t = { y ∈ Y : S t ( x, y ) ≤ q t } , and the threshold q t is iteratively updated via q t +1 = q t + η t ( I ( Y t / ∈ ˆ C t ( X t )) -α ) , with η t denoting the step size. This update rule is interpreted as an online (sub)gradient descent algorithm on the quantile pinball loss:

While these methods achieve distribution-free coverage guarantees, they typically require access to accurate feedback indicating whether the true outcome Y t lies within the prediction set ˆ C t . In privacysensitive settings, this feedback can inadvertently disclose personal or confidential information, and users may be unwilling or unable to provide truthful responses. Additionally, the underlying predictive model ˆ f t may itself be vulnerable to privacy attacks. This limitation highlights the need for a privacy-preserving online CP framework that mitigates information leakage while maintaining reliable online calibration.

3 Algorithm and main results

In this section, we systematically present our method for constructing online privacy-preserving CP sets using binary inquiries. As outlined in (2), each subgradient ∂ℓ 1 -α ( q t , S t ) is purely determined by the binary indicator variable representing whether the non-conformity score S t is less than or equal to the current quantile estimate q t . This inherent binary structure enables us to implement a local randomization mechanism via randomized response, which directly supports LDP constraints. Motivated by this, we carefully design the binary inquiry presented to the user to adjust the stochastic gradient descent process via subgradient without violating privacy conditions. This leads to a modified update rule in which the deterministic subgradient is replaced with a privatized binary response, drawn from a locally randomized mechanism. Specifically, upon receiving the privatized binary feedback L = LRBR( S t , q t , r ) , as defined in Algorithm 1, where r ∈ (0 , 1] is the probability of a truthful response, the subgradient g t is updated according to:

This formulation modulates the strength of privacy protection in the update step according to the response rate r : a smaller value of r corresponds to stronger privacy protection, as it increases the amount of randomization in the binary feedback mechanism. Notably, in the special case where r = 1 , the mechanism reduces to the non-DP setting, and the update g t degenerates to the standard subgradient ∂ℓ 1 -α ( q t , S t ) , recovering the standard deterministic subgradient update without any privacy protection [Podkopaev et al., 2024]. The complete procedure is summarized in Algorithm 1.

Algorithm 1: Locally Randomized Binary Response (LRBR)

In Algorithm 1, generating the random bit v prior to the conditional branch may appear redundant; however, this design is intentional to prevent side-channel attacks, such as inferring the true value based on variations in response timing [Coppens et al., 2009, Lawson, 2009].

To enable private, adaptive quantile estimation in an online setting, we adopt a coin betting-based online convex optimization framework [Orabona and Pal, 2016, Cutkosky and Orabona, 2018, Podkopaev et al., 2024]. This parameter-free and robust method reformulates the learning process as a repeated betting game framework, providing regret guarantees even in adversarial environments. Within this framework, a gambler sequentially bets a fraction λ t ∈ [ -1 , 1] of their current wealth W t -1 on an outcome c t ∈ [ -1 , 1] , which may be adversarially chosen as in [Orabona and Pal, 2016]. Starting from an initial endowment W 0 > 0 , the cumulative wealth evolves according to: W t = W 0 + ∑ t i =1 λ i W i -1 c i . To adaptively adjust λ t based on sequential feedback, we use the Krichevsky-Trofimov (KT) estimator [Krichevsky and Trofimov, 1981], which sets: λ t = ∑ t -1 i =1 c i /t . To integrate this with our privatized quantile estimation, we define the feedback as c t := -g t , where g t is the privatized subgradient in equation (3). The signed bet w t := λ t W t -1 is then interpreted as the current privatized estimate of the (1 -α ) -quantile, denoted as q t . This feedback is used to update the coin betting procedure at each step. The resulting design enables the algorithm to adaptively refine its quantile estimate based on privatized, binary feedback while maintaining rigorous LDP guarantees. We summarize the proposed procedure for the regression task in Algorithm 2. The corresponding extension to classification tasks is presented in Section 4.

In our framework, the predicted value ˆ Y t will be transmitted to the curator in order to construct the prediction interval ˆ C t = [ ˆ Y t -q t , ˆ Y t + q t ] . As such intervals inherently disclose the quantile threshold q t , inquiring the user based on this value does not introduce additional privacy risk. Importantly, q t is updated via the above proposed mechanism that satisfies LDP, thereby ensuring rigorous individuallevel privacy protection, even when q t is externally observable. Specifically, q t is estimated via binary inquiries, which provide several practical advantages. Each inquiry conveys only a single bit of information, substantially reducing communication overhead and improving transmission efficiency. In contrast to open-ended inquiries, binary inquiries are more intuitive and cognitively accessible, thereby enhancing user comprehension and response fidelity [Brown et al., 1996]. Beyond communication efficiency, our framework facilitates fully online computation, eliminating the need to store or re-access historical data. As a result, it significantly reduces memory and computational demands, making our method particularly well-suited for streaming applications [Lee et al., 2022].

In online learning, regret quantifies the cumulative difference between the learner's performance and that of a fixed comparator. Formally, let { q t } T t =1 denote the sequence of decisions made by the algorithm. The regret with respect to a fixed comparator q ⋆ ∈ R is given by:

We provide the regret bound as follows in Corollary 3.1:

Algorithm 2: Binary Private Online Conformal Prediction

Corollary 3.1. Let { q t } T t =1 ⊆ R denote the sequence of decisions produced by the proposed algorithm. Under the coin betting framework with the KT potential, the cumulative regret with respect to any fixed comparator q ⋆ ∈ R satisfies the following bound:

where C > 0 is a universal constant, and e denotes the base of the natural logarithm.

Corollary 3.1 establishes a sublinear cumulative regret bound within the coin betting framework. Specifically, the regret bound of order O ( √ T ln T ) ensures that the cumulative loss incurred by the algorithm relative to any fixed comparator q ⋆ grows sublinearly over time. Consequently, the average per-round regret asymptotically converges to zero as T →∞ .

Theorem 3.2. Algorithm 1 is an ( ϵ, 0) -randomizer with ϵ = log ((1 + r ) / (1 -r )) .

Proof. With probability r , the user returns a truthful binary response indicating whether S t < q t ; otherwise, a fair coin is flipped. This randomized mechanism masks the true response, and the privacy level ϵ is determined by the worst-case distinguishability between outputs for different true answers. A full derivation is deferred to Appendix C.2.

Theorem 3.3. Algorithm 2 satisfies (max 1 ≤ j ≤ t ϵ j , 0) -LDP, where t ≥ 1 .

Proof. By parallel composition and the post-processing property, the guarantee holds. A detailed argument is deferred to Appendix C.3.

Theorems 3.2 and 3.3 establish that the proposed algorithms satisfy rigorous LDP guarantees. The proposed algorithms ensure that individual-level privacy is preserved at every iteration, without the need to store or re-access raw data, thereby enabling both privacy protection and memory efficiency in streaming environments.

Although our algorithm satisfies LDP at the user level, an adversary could still exploit vulnerabilities in the underlying predictive model to infer sensitive information. To address this concern, we establish a rigorous form of privacy protection: when the predictive model is dynamically trained under LDP constraints, our framework also ensures end-to-end privacy guarantees across the entire prediction pipeline.

Theorem 3.4. Suppose the predictive model satisfies (max 1 ≤ j ≤ t ε j , max 1 ≤ j ≤ t δ j ) -LDP. The entire pipeline, mapping private individual data to the final prediction interval ˆ C t inherits LDP guarantees. Then, Algorithm 2 ensures (max 1 ≤ j ≤ t ( ϵ j + ε j ) , max 1 ≤ j ≤ t δ j ) -LDP, where t ≥ 1 .

Proof. By additionally applying the sequential composition property, the theorem follows. The complete proof is deferred to Appendix C.4.

We illustrate this process in Figure 13, which empirically validates the consistency between our simulation results and the theoretical guarantee established in Theorem 3.4.

Theorem 3.5. Let the target miscoverage level α ∈ (0 , 1 / 2) be fixed, and let r ∈ (0 , 1] denote the probability of a truthful response. Suppose that the non-conformity scores are bounded, such that S t ∈ [0 , D ] for all t = 1 , 2 , . . . , where D > 0 is a finite constant. Then, the proposed procedure described in Algorithm 2 satisfies the following long-run coverage guarantee:

Proof. Although each feedback bit is randomized, its expectation coincides with the true subgradient:

Hence, the update rule drives q t toward the (1 -α ) quantile in expectation. By boundedness of the scores and stability of the coin-betting update, the prediction sets converge to the desired long-run coverage. A complete derivation is provided in Appendix C.5.

Theorem 3.5 establishes that the proposed method achieves valid long-run coverage guarantees that are independent of the underlying predictive model, regardless of whether the model is dynamically trained with or without privacy constraints. However, because q t is defined as the (1 -α ) -quantile of the non-conformity scores, models trained under LDP often exhibit decreased predictive accuracy due to the injected noise. This typically results in larger non-conformity scores and consequently wider prediction intervals. To illustrate this effect, we include a representative experiment using the privately trained predictive model(PTM) from Abadi et al. [2016], dynamically trained under LDP constraints; see Figure 12.

4 Extension to classification tasks

In this section, we extend our framework from regression to multi-class classification problems, where the response variable takes values in a finite label set Y . Unlike regression, where prediction intervals are centered around scalar estimates, classification requires constructing prediction sets containing likely class labels. This shift necessitates adapting both the definition of non-conformity scores and the structure of the prediction region. Given a probabilistic classifier ˆ f : R d → [0 , 1] |Y| , we define the non-conformity score for a candidate label y ∈ Y as

where ˆ p y ( X ) denotes the predicted probability assigned to class y , typically computed via softmax over the model's logits. Intuitively, this score captures the model's uncertainty about the correctness of label y : smaller scores correspond to more confident predictions. At each time step t , the prediction set is constructed by including all labels whose non-conformity scores fall below a dynamic quantile threshold:

The threshold q t , analogous to the conformal quantile used in the regression setting, is updated sequentially based on privatized binary feedback. To ensure privacy, we adopt the same binary inquiry strategy as in Section 3. Specifically, the non-conformity score for the true label, S t = S ˆ f ( X t , Y t ) , is compared against the current threshold q t and the result of this comparison is encoded as a binary signal, which is privatized using a local binary randomized mechanism. The privatized feedback is then used to compute a subgradient g t (as defined in Equation (3)), and the sign-reversed quantity c t := -g t is passed to the coin-betting algorithm to update q t in an efficient and privacy-preserving manner. The complete procedure for the classification task is summarized in Algorithm 3.

5 Experiments

We evaluate the finite-sample performance of the proposed estimator by comparing it with two baselines: DPCP [Angelopoulos et al., 2022], an offline private conformal method, and DtACI [Gibbs and Candès, 2024], an online adaptive method using expert aggregation. For ease of interpretation, the privacy parameter is set to ϵ = 0 . 5 , 1 , 2 , 3 , with the corresponding values of r provided in Table 4. We define the miscoverage level as α = 0 . 1 .

Example 5.1 ( Regression on Synthetic Data). In this example, we evaluate the proposed method on the regression task using synthetic data. We generate data similar to Barber et al. [2023] via x t ∼ N (0 , I 5 ) and y t = x ⊤ t β t + ε t for t = 1 , . . . , 10 , 000 , where β t ∈ R 5 and ε t is from a normal distribution and independent of x t . We consider four cases. (A) Abrupt shifts with homoskedastic errors ; (B) Abrupt shifts with heteroskedastic errors ; (C) Smooth shifts with homoskedastic errors ; (D) No shifts with homoskedastic errors The sample size is set to 10,000. Long-run coverage and interval width are evaluated over these data points and averaged across 200 simulation runs. See Appendix B.1 for data generation.

Table 1 reports coverage and interval width for both methods across four cases at the 90% confidence level. In drifting environments that are closer to real-world data streams, the proposed method achieves slightly lower but comparable coverage to DPCP, while producing substantially narrower intervals. Specifically, DPCP's widths more than double in Cases A and B and increase by over 40% in Case C. This is expected, as DPCP operates in a fixed-sample offline setting and constructs conservative intervals without adapting to distributional shifts. In contrast, our online method updates intervals in real time, allowing for more efficient and adaptive inference. In the static setting without distributional shifts, as in Case D, DPCP's higher coverage becomes more favorable. For DtACI, which is designed for online settings without privacy constraints, we compare it under the noprivacy scenario. The proposed method again yields shorter intervals while maintaining comparable performance, with slightly lower coverage.

We compare the computational efficiency of the three methods. Table 2 shows that DtACI, with six experts, requires approximately 100 times more computation time due to its complex update rules, and DPCP requires approximately 10 times.

The left panel of Figure 2 shows instant coverage, instant width, long-run coverage, and long-run width for DtACI with initialization values α 1 ∈ { 0 . 1 , 0 . 9 } , and for the proposed method under varying privacy levels. DPCP is omitted as it is an offline method. All methods exhibit coverage oscillations around the target level of 1 -α , with noticeable drops at change points but rapid recovery

thereafter. Lower ϵ values result in slightly larger fluctuations. Initially, smaller ϵ values lead to lower long-run coverage, but all methods eventually converge to the target level. A similar pattern is observed for instant width and long-run width. The results also show that DtACI is sensitive to initialization and requires each expert to adjust predictions based on interval coverage, leading to frequent feedback requests. As the number of experts increases, this can cause user fatigue and raise privacy concerns, limiting its use in privacy-sensitive settings. In contrast, the right panel of Figure 2 shows that the proposed method is robust to initialization, demonstrating consistent performance across different settings. Results for Case B in Figure 4, Case C in Figure 5, and Case D in Figure 6 of the Appendix exhibit similar patterns.

InstantCoverage/Width

Long-runCoverage/Width

InstantCoverage/width

Long-run Coverage / width

1.0

1.0

0.9

0.9

0.8

0.8

0.7

0.6

0.5

0.5

A

0.4

0.4

Case

7.0

6.5

6.0

6.0

5.5

4.0

5.0

4.5

3.0

4.0

2.0

3.5

2000

4000

Time

6000

8000

100000

2000

4000

Time

6000

0008

10000

3.0

0

2000

4000

Time

6000

8000

100000

2000

4000

Time

6000

8000

10000

DtACI(α= 0.1)

DtACI(α=0.9)

Proposed(Non-private)

Proposed(ε=3)

Proposed(ε= 1)

Proposed(ε =0.5)

(1, 0)

一

(2, 0.2)

(5, 0.3)

(10, 0.5)

.

Example 5.2 ( Classification on synthetic data). We also conduct a classification study using synthetic data, encompassing three distribution shift scenarios plus one no shift environment. The findings are generally similar to those in the regression setting. To save space, we relegate the detailed results to Appendix B.2.

Example 5.3 ( Regression on Real Data). We use the ELEC2 dataset [Harries et al., 1999]. As shown in Figure 11 of the Appendix, lower ϵ values lead to slightly larger fluctuations in coverage. Nevertheless, the long-run coverage stabilizes around 1 -α within the first quarter of the data stream for all methods. Similar patterns are observed in the width and long-run width. Further details are provided in Appendix B.3.

Example 5.4 ( Classification on Real Data). We assess the classification performance of our method using the real WISDM dataset [Kwapisz et al., 2011], a benchmark for smartphone-based activity recognition. We focus on two representative users - User 10 and User 14 - who completed 5 and 4 activity types, respectively, forming two independent tasks. For each task, we construct a time-indexed data stream and implement the model ˆ f t using XGBoost. Rolling coverage is calculated using a sliding window of 200 points to capture short-term fluctuations, while long-run coverage reflects the cumulative average over all time steps. Set size [Angelopoulos et al., 2022] indicates the number of classes included in the prediction set, representing model uncertainty. Lower values at a given coverage level indicate better performance.

Figure 3 shows the results for both users under varying privacy settings of DtACI and the proposed method. Patterns are generally consistent with the simulation studies. With stronger privacy ( ϵ → 1 ), rolling coverage shows increased variability due to amplified noise. Long-run coverage initially decreases but gradually converges to the target level. For set size, lower ϵ values slightly increase the occurrence of larger sets, indicating increased uncertainty. However, small and medium-sized sets remain dominant overall. DtACI is also sensitive to the initial setting of α 1 , initially deviating more but ultimately aligning with the non-private and low-noise settings.

User14-SetSizeDistribution

16000

RollingCoverage

Long-runCoverage

1.0

14000

12000

0.8

Count

10000

0.7

8000

6000

0.6

4000

2000

5000 10000 1500020000250003000035000

Time

。

5000 100001500020000250003000035000

Time

0

DtACI(α = 0.1) DtACI(α = 0.9)Non-private

Method

= 3

RollingCoverage

Long-runCoverage

1.0

User10-SetSizeDistribution

SZ0

10000

0.7

8000

Count

0.6

6000

4000

0.4

0

50001000015000200002500030000

Time

。

50001000015000200002500030000

Time

2000

DtACI(α = 0.1)

Proposed(Non-private)

Proposed(ε=2)

0

DtACI(α = 0.1)DtACI(α = 0.9) Non-private

= 3

= 2

= 1

DtACI(α =0.9)

Proposed(ε=3)

Proposed(ε=1)

Method

6 Conclusion and Limitations

This paper proposes a novel and practical framework for online conformal prediction under LDP. By combining randomized binary feedback with a coin-betting update scheme, the method enables one-pass, model-free prediction set construction with formal privacy guarantees. It supports both regression and classification, and operates efficiently in streaming settings with constant memory. Despite its strengths, several limitations remain. First, Theorem 3.5 provides only asymptotic coverage guarantees; deriving non-asymptotic bounds under LDP is an important direction for future work. Second, our approach employs standard nonconformity scores, which are broadly applicable but may yield conservative prediction sets. Incorporating ideas from recent methods such as CPGen [Bai et al., 2022], which learn data-adaptive scores via constrained ERM, could lead to more efficient prediction sets while preserving valid coverage. Another promising direction is to extend our framework to multivariate private online conformal prediction, building on recent advances such as [Xu et al., 2024] and [Braun et al., 2025]. Such extensions would broaden the applicability of private online conformal prediction to high-dimensional and structured data streams.

References

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pages 308-318, 2016.

Mohammed Adnan, Shivam Kalra, Jesse C Cresswell, Graham W Taylor, and Hamid R Tizhoosh. Federated learning and differential privacy for medical image analysis. Scientific reports , 12(1): 1953, 2022.

Anastasios Angelopoulos, Emmanuel Candes, and Ryan J Tibshirani. Conformal pid control for time series prediction. In Advances in Neural Information Processing Systems , volume 36, pages 23047-23074, 2023.

Anastasios Nikolas Angelopoulos, Stephen Bates, Tijana Zrnic, and Michael I Jordan. Private prediction sets. Harvard Data Science Review , 4(2), 2022.

Anastasios Nikolas Angelopoulos, Rina Barber, and Stephen Bates. Online conformal prediction with decaying step sizes. In Proceedings of the 41st International Conference on Machine Learning , volume 235 of Proceedings of Machine Learning Research , pages 1616-1630. PMLR, 21-27 Jul 2024.

Yu Bai, Song Mei, Huan Wang, Yingbo Zhou, and Caiming Xiong. Efficient and differentiable conformal prediction with general function classes. arXiv preprint arXiv:2202.11091 , 2022.

Rina Foygel Barber, Emmanuel J Candes, Aaditya Ramdas, and Ryan J Tibshirani. Conformal prediction beyond exchangeability. The Annals of Statistics , 51(2):816-845, 2023.

Aadyot Bhatnagar, Huan Wang, Caiming Xiong, and Yu Bai. Improved online conformal prediction via strongly adaptive online learning. In Proceedings of the 40th International Conference on Machine Learning , volume 202 of Proceedings of Machine Learning Research , pages 2337-2363. PMLR, 23-29 Jul 2023.

Sacha Braun, Eugène Berta, Michael I Jordan, and Francis Bach. Multivariate conformal prediction via conformalized gaussian scoring. arXiv preprint arXiv:2507.20941 , 2025.

Thomas C Brown, Patricia A Champ, Richard C Bishop, and Daniel W McCollum. Which response format reveals the truth about donations to a public good? Land Economics , pages 152-166, 1996.

Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev. Distributed differential privacy via shuffling. In Advances in Cryptology-EUROCRYPT 2019: 38th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Darmstadt, Germany, May 19-23, 2019, Proceedings, Part I 38 , pages 375-403. Springer, 2019.

Bart Coppens, Ingrid Verbauwhede, Koen De Bosschere, and Bjorn De Sutter. Practical mitigations for timing-based side-channel attacks on modern x86 processors. In 2009 30th IEEE symposium on security and privacy , pages 45-60. IEEE, 2009.

Ashok Cutkosky and Francesco Orabona. Black-box reductions for parameter-free online learning in banach spaces. In Proceedings of the 31st Conference On Learning Theory , volume 75 of Proceedings of Machine Learning Research , pages 1493-1529. PMLR, 06-09 Jul 2018.

Fida Kamal Dankar and Khaled El Emam. Practicing differential privacy in health care: A review. Trans. Data Priv. , 6(1):35-67, 2013.

Jörg Drechsler. Differential privacy for government agencies-are we there yet? Journal of the American Statistical Association , 118(541):761-773, 2023.

John C Duchi and Feng Ruan. The right complexity measure in locally private estimation: It is not the fisher information. The Annals of Statistics , 52(1):1-51, 2024.

John C Duchi, Michael I Jordan, and Martin J Wainwright. Minimax optimal procedures for locally private estimation. Journal of the American Statistical Association , 113(521):182-201, 2018.

Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Advances in cryptology-EUROCRYPT 2006: 24th annual international conference on the theory and applications of cryptographic techniques, st. Petersburg, Russia, May 28-June 1, 2006. proceedings 25 , pages 486-503. Springer, 2006a.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pages 265-284. Springer, 2006b.

Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. Rappor: Randomized aggregatable privacypreserving ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security , pages 1054-1067, 2014.

Clara Fannjiang, Stephen Bates, Anastasios N Angelopoulos, Jennifer Listgarten, and Michael I Jordan. Conformal prediction under feedback covariate shift for biomolecular design. Proceedings of the National Academy of Sciences , 119(43):e2204569119, 2022.

Haosen Ge, Hamsa Bastani, and Osbert Bastani. Stochastic online conformal prediction with semi-bandit feedback. arXiv preprint arXiv:2405.13268 , 2024.

Isaac Gibbs and Emmanuel Candes. Adaptive conformal inference under distribution shift. In Advances in Neural Information Processing Systems , volume 34, pages 1660-1672, 2021.

Isaac Gibbs and Emmanuel J Candès. Conformal inference for online prediction with arbitrary distribution shifts. Journal of Machine Learning Research , 25(162):1-36, 2024.

Harries, University of New South Wales. School of Computer Science, and Engineering. Splice-2 Comparative Evaluation: Electricity Pricing . PANDORA electronic collection. University of New South Wales, School of Computer Science and Engineering, 1999.

Zaobo He, Lintao Wang, and Zhipeng Cai. Clustered federated learning with adaptive local differential privacy on heterogeneous iot data. IEEE Internet of Things Journal , 11(1):137-146, 2023.

Pierre Humbert, Batiste Le Bars, Aurélien Bellet, and Sylvain Arlot. One-shot federated conformal prediction. In Proceedings of the 40th International Conference on Machine Learning , volume 202 of Proceedings of Machine Learning Research , pages 14153-14177. PMLR, 23-29 Jul 2023.

Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. What can we learn privately? SIAM Journal on Computing , 40(3):793-826, 2011.

Raphail Krichevsky and Victor Trofimov. The performance of universal encoding. IEEE Transactions on Information Theory , 27(2):199-207, 1981.

Jennifer R Kwapisz, Gary M Weiss, and Samuel A Moore. Activity recognition using cell phone accelerometers. ACM SigKDD Explorations Newsletter , 12(2):74-82, 2011.

Nate Lawson. Side-channel attacks on cryptographic software. IEEE Security & Privacy , 7(6):65-68, 2009.

Sokbae Lee, Yuan Liao, Myung Hwan Seo, and Youngki Shin. Fast and robust online inference with stochastic gradient descent via random scaling. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 36, pages 7381-7389, 2022.

Lihua Lei and Emmanuel J Candès. Conformal inference of counterfactuals and individual treatment effects. Journal of the Royal Statistical Society Series B: Statistical Methodology , 83(5):911-938, 2021.

Zhangbing Li, Baichuan Wang, Jinsheng Li, Yi Hua, and Shaobo Zhang. Local differential privacy protection for wearable device data. Plos one , 17(8):e0272766, 2022.

Yi Liu, Qirui Hu, Lei Ding, and Linglong Kong. Online local differential private quantile inference via self-normalization. In Proceedings of the 40th International Conference on Machine Learning , volume 202 of Proceedings of Machine Learning Research , pages 21698-21714. PMLR, 23-29 Jul 2023.

Merumu Olabim, Amir Greenfield, and Arjun Barlow. A differential privacy-based approach for mitigating data theft in ransomware attacks. Authorea Preprints , 2024.

Francesco Orabona and David Pal. Coin betting and parameter-free online learning. In Advances in Neural Information Processing Systems , volume 29, 2016.

Vincent Plassier, Mehdi Makni, Aleksandr Rubashevskii, Eric Moulines, and Maxim Panov. Conformal prediction for federated uncertainty quantification under label shift. In Proceedings of the 40th International Conference on Machine Learning , volume 202 of Proceedings of Machine Learning Research , pages 27907-27947. PMLR, 23-29 Jul 2023.

Vincent Plassier, Nikita Kotelevskii, Aleksandr Rubashevskii, Fedor Noskov, Maksim Velikanov, Alexander Fishkov, Samuel Horvath, Martin Takac, Eric Moulines, and Maxim Panov. Efficient conformal prediction under data heterogeneity. In Proceedings of The 27th International Conference on Artificial Intelligence and Statistics , volume 238 of Proceedings of Machine Learning Research , pages 4879-4887. PMLR, 02-04 May 2024.

Aleksandr Podkopaev, Dong Xu, and Kuang-Chih Lee. Adaptive conformal inference by betting. In Proceedings of the 41st International Conference on Machine Learning , volume 235 of Proceedings of Machine Learning Research , pages 40886-40907. PMLR, 21-27 Jul 2024.

Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. How to dp-fy ml: A practical guide to machine learning with differential privacy. Journal of Artificial Intelligence Research , 77:1113-1201, 2023.

Shuang Song, Thomas Steinke, Om Thakkar, and Abhradeep Thakurta. Evading the curse of dimensionality in unconstrained private glms. In Proceedings of The 24th International Conference on Artificial Intelligence and Statistics , volume 130 of Proceedings of Machine Learning Research , pages 2638-2646. PMLR, 13-15 Apr 2021.

Jun Tang, Aleksandra Korolova, Xiaolong Bai, Xueqiang Wang, and Xiaofeng Wang. Privacy loss in apple's implementation of differential privacy on macos 10.12. arXiv preprint arXiv:1709.02753 , 2017.

Ryan J Tibshirani, Rina Foygel Barber, Emmanuel Candes, and Aaditya Ramdas. Conformal prediction under covariate shift. In Advances in Neural Information Processing Systems , volume 32, 2019.

Vovk, A. Gammerman, and G. Shafer. Algorithmic Learning in a Random World . Springer US, 2005. ISBN 9780387001524.

Xingxing Xiong, Shubo Liu, Dan Li, Zhaohui Cai, and Xiaoguang Niu. A comprehensive survey on local differential privacy. Security and Communication Networks , 2020(1):8829523, 2020.

Chen Xu, Hanyang Jiang, and Yao Xie. Conformal prediction for multi-dimensional time series by ellipsoidal sets. In Proceedings of the 41st International Conference on Machine Learning , volume 235 of Proceedings of Machine Learning Research , pages 55076-55099. PMLR, 21-27 Jul 2024.

Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, et al. Opacus: User-friendly differential privacy library in pytorch. arXiv preprint arXiv:2109.12298 , 2021.

Margaux Zaffran, Olivier Feron, Yannig Goude, Julie Josse, and Aymeric Dieuleveut. Adaptive conformal predictions for time series. In Proceedings of the 39th International Conference on Machine Learning , volume 162 of Proceedings of Machine Learning Research , pages 25834-25866. PMLR, 17-23 Jul 2022.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer:[Yes]

Justification: The abstract and introduction clearly state the main claims, including the development of an online LDP-based conformal prediction framework (Section 3) and its extension to classification tasks (Section 4). Section 3 introduces the proposed method within a regression setting, providing theoretical guarantees for privacy, regret, and long-run coverage, with complete proofs in the Appendix. Experimental validation in Section 5 further supports these claims, with additional results included in the appendix.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations of the proposed framework are discussed in Section 6.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: Theoretical results, including privacy guarantees, regret analysis, and long-run coverage, are presented in Section 3 with complete assumptions stated. Detailed proofs are provided in the Appendix C.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The experimental procedures, including data sources (WISDM, Elec2), data preprocessing steps, and evaluation metrics, are fully detailed in Section 5 and Appendix B.1, B.2, and B.3. Algorithmic procedures and parameter configurations are clearly specified in Algorithms 1, 2, and 3, ensuring comprehensive reproducibility of all reported results.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The implementation code and detailed instructions for reproducing the experimental results will be provided in the Supplemental Material submitted alongside the paper. The datasets used (WISDM [Kwapisz et al., 2011], Elec2 [Harries et al., 1999]) are publicly accessible and well-documented in the cited references, making them easy to locate and access.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: All training and testing details are fully specified in Section 5 and Appendix B.1, B.2, and B.3. Detailed parameter settings and experimental procedures are also provided in the supplemental material to ensure reproducibility.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: The statistical significance of the experimental results is assessed through coverage rates (1 α ) and interval widths, as shown in multiple figures (e.g., Figures 2, 4, 5). The 0.9 coverage line is clearly marked to illustrate the target coverage level. Additionally, Tables 1 and 3 provide comprehensive comparisons of coverage rates and interval lengths across different methods.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The experiments were conducted on a laptop equipped with 16GB RAM and an AMD Ryzen 9 7940HX processor with Radeon Graphics. The runtime comparison between the proposed method and DtACI is provided in Table 2, ensuring a consistent hardware configuration for fair comparison and reproducibility.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The research strictly adheres to the NeurIPS Code of Ethics, as the study is based on publicly available datasets (WISDM [Kwapisz et al., 2011], Elec2 [Harries et al., 1999]) and does not involve any sensitive or personally identifiable information. All data usage and analysis are conducted in compliance with data usage guidelines and ethical standards.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer:[Yes]

Justification: Both potential positive and negative societal impacts of the proposed method are discussed in Section 1.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The study does not release any new datasets, models, or assets that pose potential risks for misuse. All experiments are conducted using publicly available datasets without sensitive or potentially harmful content.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have properly mentioned and cited all assets used in this paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper proposes a new algorithm for online private conformal prediction, but no new assets such as datasets, models, or code repositories are released. All experimental implementations are based on existing publicly available datasets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: This study does not involve crowdsourcing or research with human subjects, as all experiments were conducted using synthetic data and publicly available datasets without human participation.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer:[NA]

Justification: This study does not involve human subjects or crowdsourcing data collection, and therefore no IRB approval or equivalent ethical review was required.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: The core methods and experimental framework of this research do not involve the use of Large Language Models (LLMs). The proposed methodology is based solely on online LDP mechanisms and adaptive quantile updates, without utilizing LLMs as components in any theoretical or empirical development.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

Appendix

A Algorithm for classification under binary private online conformal prediction

Algorithm 3: Binary Private Online Conformal Prediction (Classification)

B Additional Results

B.1 Regression Setting

Data generation for regression. Similar to Barber et al. [2023], we generate data via x t ∼ N (0 , I 5 ) and y t = x ⊤ t β t + ε t for t = 1 , . . . , 10 , 000 , where β t ∈ R 5 and ε t is a Gaussian noise. We consider the following four scenarios:

Abrupt regime shifts. We define three fixed coefficient vectors:

and assign β t = β ( j ) for three consecutive segments of t . Under this setting, we consider two noise variants: Case (A) uses homoskedastic noise ε t ∼ N (0 , 1) , and Case (B) uses heteroskedastic noise ε t = x 2 t, 1 · η t with η t ∼ N (0 , 1) .

Smooth concept drift. We let β t evolve linearly over time:

where β start = (1 , 2 , 1 , 0 , 0) and β end = (0 , 0 , 1 , 2 , 1) . The noise is homoskedastic with ε t ∼ N (0 , 1) , denoted as Case (C) .

Fixed environment. We keep the coefficient vector fixed throughout the whole stream:

with homoskedastic noise ε t ∼ N (0 , 1) . This is denoted as Case (D) .

Figures 4-5 present the simulation results for Case B and Case C, respectively. The general characteristics of the proposed method are consistent with those observed in Case A, though some differences arise due to the distinct data generation settings. In Case B, the heteroskedastic noise structure leads to more pronounced fluctuations and wider intervals compared to Case A. Conversely, in Case C and Case D, the absence of abrupt regime shifts results in relatively stable coverage and interval width throughout the data stream.

Instant Coverage / width

Long-run Coverage / width

1.0

0.9

Coverage

0.8

0.7

0.6

0.5

B

0.4

Case

Interval Length

8.0

6.0

4.0

2.0

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1=0.1)

DtACI(α1=0.9)

Proposed(Non-private)

Proposed(ε = 3)

Proposed(ε=1)

Proposed(ε=0.5)

InstantCoverage/Width

Long-runCoverage/width

1.0

0.9

Coverage

0.8

0.7

0.6

0.5

C

0.4

Case

Interval Length

5.0

4.0

3.0

2.0

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1=0.1)

DtACI(α1=0.9)

Proposed(Non-private)

Proposed(ε=3)

Proposed(ε= 1)

Proposed(ε=0.5)

B.2 Classification Setting

Data generation for classification. We evaluate our method under four scenarios, each generating a data stream { ( x t , y t ) } T t =1 , where x t ∼ N (0 , I p ) and y t ∈ { 0 , . . . , K -1 } is drawn from the softmax

InstantCoverage/width

Long-run Coverage / width

1.0

0.9

Coverage

0.8

0.7

0.6

0.5

D

0.4

Case

Interval Length

5.0

4.0

3.0

2.0

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α = 0.1)

DtACI(α1 = 0.9)

Proposed(Non-private)

Proposed(ε=3)

Proposed(ε=1)

Proposed(ε=0.5)

model:

For each scenario, the coefficient vectors β ( k ) t evolve linearly over time as:

Smooth Drift (Case 1) In this setting, we consider K = 3 classes and p = 3 features. Classes 0 and 1 drift symmetrically along the first feature, while class 2 remains fixed. The coefficient vectors are defined as follows:

Amplified Drift (Case 2) This setting is a variant of the Smooth Drift scenario but with doubled drift magnitude. The number of classes and features remains the same ( K = 3 , p = 3 ). The coefficient vectors are defined as:

Class Emergence (Case 3) This setting introduces a new class that gradually emerges by activating a specific feature, while the other classes remain fixed. Here, we consider K = 4 classes and p = 5 features. The coefficient vectors are defined as:

No Drift (Case 4) As a control setting, we consider no drift: all classes remain fixed ( K = 3 , p = 3 ):

Figure 7 shows the coverage and set size of the prediction sets for the outcome labels. For a fixed coverage level, a smaller set size indicates higher efficiency. The observed patterns align closely with those in the regression setting. For DtACI, initialization is particularly sensitive. When the initial α 1 is set equal to the target miscoverage level α = 0 . 1 , the initial prediction sets are relatively large and

maintain coverage around 0.9 throughout. In contrast, when α 1 = 0 . 9 , the smaller initial sets result in lower initial coverage. For the proposed method, coverage fluctuates around 1 -α , with slightly larger fluctuations under smaller ϵ values. For long-run coverage, smaller ϵ values initially result in lower coverage and set size due to the added noise from randomized responses. Nevertheless, all methods eventually converge to the nominal coverage level. Given the data configuration, where the coefficient vectors β (0) t and β (1) t initially move closer together and then diverge, the set size first increases and then decreases.

Figures 8 and 9 present the results for Case 2 and Case 3, respectively. In terms of instant coverage and long-run coverage, the patterns across Cases 1, 2, and 3 are generally consistent. Regarding set size and long-run set size, the trend in Case 2 is similar to that in Case 1, with set size initially increasing and then decreasing due to class overlap during the drift process. In contrast, Case 3 exhibits a consistently decreasing trend in set size, gradually stabilizing over time as the class distributions remain more separable, allowing the prediction sets to contract and stabilize. Figure 10 shows the results for Case 4. Under the No Drift scenario, compared with Case 1, the set sizes of all three methods decrease and their coverage remains stable overall, which is as expected. As summarized in Table 3, the results are similar to those in the regression setting: DPCP achieves higher coverage at the cost of larger set sizes. However, we emphasize that DPCP is an offline method and cannot be deployed in an online environment.

B.3 Elec2

For the purpose of evaluating the proposed method, we utilize the Elec2 dataset, which provides a comprehensive record of electricity demand in New South Wales, Australia [Harries et al., 1999]. The dataset, compiled by the University of New South Wales, is well-suited for forecasting applications and has been widely employed in prior studies for time-series prediction tasks. We employ AR(3) to serve as the base forecasting model and aim to construct confidence intervals for the electricity demand. Rolling coverage refers to the short-term coverage calculation over a sliding window of recent data points, capturing immediate fluctuations and reflecting the model's localized response to data variability. In contrast, long-run coverage accumulates coverage over the entire data stream, providing a comprehensive view of overall performance stability.

As shown in Figure 11, rolling coverage and long-run coverage are generally stable, with coverage oscillating around the target level of 1 -α and no noticeable drops. In the proposed method, higher privacy protection ( ϵ = 1 ) results in slightly increased fluctuations in rolling coverage, while the long-run coverage is initially lower but quickly converges to match other settings.

InstantCoverage/SetSize

Long-run Coverage / Set Size

1.0

0.9

@0.8

0.6

0.5

1

0.4

Case

2.4

2.1

1.8

s

1.5

s

1.2

0.9

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1 = 0.1)

DtACI(α1=0.9)

Proposed(Non-private)

Proposed(ε =3)

Proposed(ε = 1)

Proposed(ε = 0.5)

InstantCoverage/SetSize

Long-run Coverage/SetSize

1.0

0.9

@0.8

0.6

0.5

2

0.4

Case

2.1

1.8

1.5

s

S

1.2

0.9

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1=0.1)

DtACI(α1 = 0.9)

Proposed(Non-private)

Proposed(ε = 3)

Proposed(ε=1)

Proposed(ε=0.5)

Regarding width, all methods exhibit fluctuations, capturing inherent data variability. Long-run width, however, remains relatively stable, gradually decreasing over time, suggesting that the algorithm becomes more stable as it accumulates more calibration data.

B.4 Comparison of PTMs and Non-Private Models

In this section, we investigate the impact of model privatization on interval width and coverage by comparing privately trained models and non-private models under Case A; see Figure 12. While the long-run coverage remains unaffected, privately trained models typically exhibit lower predictive accuracy than non-private models, leading to higher non-conformity scores S t and consequently wider prediction intervals.

InstantCoverage/SetSize

Long-run Coverage / Set Size

1.0

0.9

80°

0.6

0.5

3

0.4

Case

2.0

1.8

Size

1.6

Set

1.4

1.2

1.0

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1 = 0.1)

DtACI(α1 = 0.9)

Proposed(Non-private)

Proposed(ε = 3)

Proposed(ε = 1)

Proposed(ε = 0.5)

InstantCoverage/SetSize

Long-run Coverage/ SetSize

1.0

0.9

800

0.5

4

0.4

Case

2.0

1.8

SetSize

1.6

1.4

1.2

1.0

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

DtACI(α1 = 0.1)

DtACI(α1 = 0.9)

Proposed(Non-private)

Proposed(ε=3)

Proposed(ε=1)

Proposed(ε=0.5)

B.5 Simulation of privacy allocation under parallel composition

We further investigate the impact of varying privacy budgets. The results in Figure 13, obtained under Case A, are consistent with the theoretical guarantees established in Theorems 3.3 and 3.4. Specifically, we observe that the performance under randomly drawn ϵ t ∈ [0 . 5 , 3] is similar to that under the fixed value ϵ = 3 . This is expected because the theoretical privacy bound depends on max t ϵ t , which, in the random case, is very likely to be close to the upper bound of 3.

RollingCoverage/Width

Long-run Coverage/width

1.0

0.9

Coverage

0.8

0.7

0.6

0.5

Elec2

0.4

0.12

Set Size

0.10

0.08

0.06

0

10000

20000

30000

40000

0

10000

20000

30000

40000

Time

Time

DtACI(α1 = 0.1)

DtACI(α1 = 0.9)

Proposed(Non-private)

Proposed(ε=3)

Proposed(ε=2)

Proposed(ε=1)

InstantCoverage/width

Long-runCoverage/width

1.0

0.9

0.7

0.6

0.5

0.4

Interval Length

10

8

6

4

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

Non-private

Proposed(ε=2)

Proposed(ε=1)

PTM,Non-private

Proposed(PTM，ε=2)

C Proof

C.1 Proof of Corollary 3.1

The stated regret bound is derived by applying the Krichevsky-Trofimov (KT) potential within the coin betting framework. In our setting, the LRBR mechanism produces privatized feedback signals g t that are uniformly bounded in magnitude, i.e., | g t | ≤ 1 . Crucially, the coin betting framework does not require the feedback signals to be exact subgradients; it only necessitates boundedness. Therefore, the general regret bound established in Orabona and Pal [2016] remains applicable, and directly implies the result stated in Corollary 3.1.

Instant Coverage / width

Long-run Coverage / width

1.0

0.9

0.7

0.6

0.5

0.4

Interval Length

10

8

6

4

2

0

2000

4000

6000

8000

10000

0

2000

4000

6000

8000

10000

Time

Time

Proposed(ε=3)

Proposed(etE[0.5,3])

Proposed(ε=0.5)

Proposed(PTM,ε=3)

Proposed(PTM，εtE[0.5,3])

Proposed(PTM,ε=0.5)

C.2 Proof of Theorem 3.2

Algorithm 1 investigates the relationship between the inquiry value q and the user's binary response, controlled by the response rate r . Let the true label be defined as I ( q > S ) ∈ { 0 , 1 } , where S is the non-conformity score. Due to local randomization, the output does not necessarily match the ground truth. The conditional probability of outputting '1' given that the truth is '1' is

which occurs either when the user responds deterministically with u = 1 (with probability r ), or when the individual is randomized ( u = 0 ) and v = 1 (with probability (1 -r ) / 2 ). Similarly, the probability of outputting '1' given that the truth is '0' is

which corresponds to the randomized case where u = 0 and v = 1 .

This yields the following likelihood ratio:

We have completed the proof of this theorem.

C.3 Proof of Theorem 3.3

At the first iteration, Algorithm 2 is inquired via Algorithm 1 using response rate r 1 , which induces an ( ϵ 1 , 0) -local randomizer. By the post-processing property in Lemma 2.3, the output of the first iteration in Algorithm 2 remains ( ϵ 1 , 0) -LDP. At the second iteration, the algorithm takes as input the privatized outputs from the first iteration, along with a new response obtained using rate r 2 , which corresponds to an ( ϵ 2 , 0) -local randomizer. Since the responses originate from disjoint individuals and each individual is inquired only once, the parallel composition in Lemma 2.3 ensures that the and symmetrically,

second iteration satisfies (max { ϵ 1 , ϵ 2 } , 0) -LDP. Using the same argument repeatedly, we conclude that after t iterations, the entire Algorithm 2 satisfies (max 1 ≤ j ≤ t ϵ j , 0) -LDP, as each iteration involves a disjoint individual and only post-processed privatized outputs are used. We have completed the proof of this theorem.

C.4 Proof of Theorem 3.4

Notice that the first iteration is required to train a predictive model that satisfies ( ε 1 , δ 1 ) -LDP, and is simultaneously inquired using Algorithm 1 with response rate r 1 , inducing an ( ϵ 1 , 0) -local randomizer. By the post-processing property and sequential composition stated in Lemma 2.3, the output of the first iteration in Algorithm 2 preserves ( ϵ 1 + ε 1 , δ 1 ) -LDP. Using the same arguments as in the proof of Theorem 3.3, after t iterations, the entire procedure remains (max 1 ≤ j ≤ t ( ϵ j + ε j ) , max 1 ≤ j ≤ t δ j ) -LDP via post-processing, sequential composition, and parallel composition in Lemma 2.3. The proof of this theorem is completed.

C.5 Proof of Theorem 3.5

To simplify the notation, we define the constant c as

Step 1. The feedback term g t is defined as

The LRBR mechanism generates L via the sampling steps u ∼ Bernoulli ( r ) and v ∼ Bernoulli (0 . 5) . Thus, the probabilities for L = 1 and L = 0 are given by

The expectation of the feedback term is E [ g t ] = (1 -c ) · P ( L = 1)+( -c ) · P ( L = 0) , which expands to E [ g t ] = r · I { q t > S t } +0 . 5(1 -r ) -c. Substituting the definition of c from (5), the expression simplifies to

The cumulative sum of expectations over T steps is therefore ∑ T t =1 E [ g t ] = ∑ T t =1 r · ( I { q t > S t } -(1 -α )) . Rewriting the above using the coverage indicator I { Y t ∈ ˆ C t } = I { q t > S t } , we obtain

Since r > 0 is a constant, our objective reduces to proving

which is equivalent to establishing

Step 2. We assume that the nonconformity scores satisfy S t ∈ [0 , D ] for all t = 1 , 2 , 3 , . . . . (a). Suppose that for some t ≥ 1 , the predicted radius q t exceeds the upper bound D , i.e., q t > D . Given that q t = λ t · W t -1 and the wealth is nonnegative ( W t -1 ≥ 0 ), it follows that λ t > 0 . The probability that L = 1 is 0 . 5(1 + r ) > 0 . 5 . When L = 1 , we have g t = 1 -c > 0 , which implies W t = W t -1 (1 -λ t g t ) < W t -1 and λ t +1 = t t +1 λ t -1 t +1 g t < λ t . Consequently, q t +1 = λ t +1 W t < q t , indicating a reduction in the predicted radius. The mechanism introduces

a persistent downward tendency when q t > D , and the radius eventually returns to the admissible range. This prevents unbounded growth.

(b). Suppose that for some t ≥ 1 , we have q t ≥ 0 but q t +1 < 0 . This implies that there must exist some k such that q t + k > 0 . Indeed, since q t ≥ 0 , it follows that λ t ≥ 0 , while q t +1 < 0 implies λ t +1 < 0 . Hence,

which gives g t > 0 . Given that S t +1 ≥ 0 , the probability that L = 0 is 0 . 5(1 + r ) > 0 . 5 , and when L = 0 , we have g t +1 = -c < 0 . Consequently,

When α < 0 . 5 , we have g t + g t +1 = 1 -2 c < 0 , which implies λ t +2 > 0 . Therefore, there exists some k ≥ 2 such that λ t + k > 0 , and hence q t + k > 0 . This shows that temporary excursions into the negative region are corrected by the update rule, ensuring that the radius remains nonnegative in the long run. Next, consider the update rule:

so the increment is

According to [Orabona and Pal, 2016, Podkopaev et al., 2024], we have the bound

so the absolute increment satisfies:

Combining this with q 1 = 0 ∈ [0 , D ] and the analysis in (a) and (b), we conclude that | q t | ≤ 3 D +1 , i.e., the update sequence is uniformly bounded.

Step 3. We begin by asserting the following statement:

We proceed by contradiction. Suppose the above does not hold. That is, there exists a constant ε > 0 such that

According to the KT framework, the update of q t +1 depends on the cumulative feedback up to time t ,

For some index T ′ , we can lower bound the update as

We now invoke the KT framework's lower bound on the wealth process W t [Orabona and Pal, 2016]:

Substituting into the previous inequality yields

This implies that for any T , there exists T ′ > T such that the above inequality holds. Since the exponential term exp ( T ′ ε 2 4 ) grows exponentially as T ′ →∞ , it follows that the sequence | q T ′ +1 | becomes unbounded as T ′ →∞ . This contradicts the assumption that | q T ′ +1 | is bounded. Thus, the initial assumption is false, and the convergence stated in (6) is established.

Step 4. We now prove that

This completes the proof.

by invoking the Dominated Convergence Theorem (DCT). From (6), we have already shown the result

By construction, g t ∈ { 1 -c, -c } , hence

Choose the constant random variable Y ≡ 1 . Since E [ Y ] = 1 < ∞ , and (7) gives the domination | A T | ≤ Y . Combining (6) and (7) with DCT yields

Since the sum in A T is finite, expectation and summation commute: E [ A T ] = 1 T ∑ T t =1 E [ g t ] . It then follows that

Since the absolute value is applied to the cumulative sum rather than each individual term, we obtain

Thus, the convergence of the expected feedback sequence establishes the desired convergence of the coverage error as

D Conversion table

Peer reviews:
comments: SUMMARY:
This paper studies the problem of privacy protection of online conformal prediction or uncertainty quantification. In the continuous streaming setting, this work proposes a method to make reliable predictions while maintaining privacy of every user by using randomized response (local DP) to answer the question. The algorithm runs in one-pass and has low space complexity and high computational complexity. The method is then applied to both regression and classification tasks. The proposed method is also model agnostic. The paper also gives theoretical guarantees as well as empirical evaluations of the method to demonstrate its feasibility.

STRENGTHS AND WEAKNESSES:
Strengths:
The paper quality is pretty good, it provides a good introduction to the topic and a clear problem description. The work studies an important problem of privacy in the online setting. To my knowledge, there is no work prior to this which studies this particular setup. Privacy is an important concern in the live decision-making systems. I believe the work is significant and original, despite the simplicity of the methods used.

Weaknesses:
The proofs are all in the appendix, which is a downside of the work. I propose that some intuition of the proofs are added to the main text of the paper to have completeness. The experiments could be better explained. Also, the figures should say what the y-axis is representing.

QUESTIONS:
I have no questions.

LIMITATIONS:
The authors did address the limitations of the work in the appendix. This would be better in the main text of the paper.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-15

comments: SUMMARY:
This paper propose an online conformal prediction procedure under local differential privacy. Theoretical guarantee and experiments results are provided to demonstrate the proformance of the proposed method.

STRENGTHS AND WEAKNESSES:
Strengths:
- The paper proposes an intuitive way to address the  challenge of privacy-preserving uncertainty quantification in online scenario. The problem is interesting, and the motivation is well-supported through relevant literature and illustrative examples.

Weaknesses:
- The intuitive idea behind Algorithm 2 could be illustrated more clearly.

QUESTIONS:
1. In line 151, interprete the statement about "This  binary structure naturally aligns with 152 a local randomization mechanism, which is crucial for satisfying LDP constraints".
2. In line 175, why can $\omega_t$ be interpreted as an estimate of the $(1 - \alpha)$-quantile? Could you provide a more intuitive explanation of lines 9–11 in Algorithm 2?
3. Is there a trade-off between privacy constraints and prediction coverage? Why does DtACI produce wider intervals compared to the proposed method and DPCP?
4. Theorem 3.5 presents an asymptotic long-run coverage guarantee. Is it possible to provide a more explicit bound to better understand the convergence rate?
5. Regarding the experimental results, the proposed method consistently exhibits undercoverage in Table 1 and Figure 2. How can this result be explained?

------------------

I have updated the score.

LIMITATIONS:
Yes, limitations are discussed in Appendix B.
TITLE: Official Review
CLARITY: 2
IMPACT: 2
ORIGINALITY: 3
DATE: 2025-06-23

comments: SUMMARY:
The authors introduce an online conformal prediction framework with local differential privacy in streaming data. Their method uses randomized binary queries and generates model-free prediction sets. The framework applies to regression and classification tasks with theoretical guarantees. Experimental validation on synthetic and real-world datasets confirms the method's accuracy.

STRENGTHS AND WEAKNESSES:
The paper demonstrates good writing quality and presents an intriguing local online framework for privacy-preserving settings. However, the framework appears constrained to one-dimensional learning problems due to its reliance on quantiles $(q_t)$. 

The evaluation would benefit from broader comparisons with existing methods beyond the binary inquiry approach. The theoretical contribution could be strengthened by more clearly articulating the specific theoretical challenges addressed and demonstrating why this solution outperforms alternatives. Given the one-dimensional nature of the problem, gradient descent may not be the most appropriate benchmark, comparison with Newton methods would be more relevant.

QUESTIONS:
1. Does the framework apply only to one-dimensional problems? Equation 2 references gradients while quantiles operate in one dimension. Similarly, Algorithm 2 (line 10) describes a "gradient update" that appears to be a derivative update.

2. How do alternative methods perform under local differential privacy constraints? What are their respective performance and utility trade-offs?

3. What specific utility advantages does the proposed method offer over existing approaches?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces an online conformal prediction (CP) method that produces locally differentially private quantiles. Based on randomized binary inquiries, the method is computationally efficient and enables to dynamically construct distribution-free prediction sets that maintain privacy. Furthermore, the authors demonstrate that the long-run empirical coverage (eq. 1) converges to a pre-specified nominal level $1−\\alpha$ and that the cumulative regret is controlled (Corollary 3.1). Finally, on several experiments, they illustrate the efficiency of their method.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n\n1\\ The paper is very well-written and easy to follow.  Furthermore, the problem is well-motivated.\n\n2\\ The method is well-explained, clever, and simple in a positive manner.\n\n3\\ The subject is of particular interest to the CP community.\n\n###  Weaknesses\n\nOverall, to me, there are not many drawbacks to this paper. However, here are a few:\n\n1\\ The bound on the regret in Corollary 3.1 does not depend on $r_t$ (the privacy).\n\n2\\ The tables in the experiments do not include standard deviations.\n    \n3\\ In line 271, it is stated that \"The proposed method achieves slightly lower but comparable coverage to DPCP, while producing substantially narrower intervals.\" This is an interesting remark, but to properly compare the sets, they should be compared when they have the same size or coverage.\n    \n4\\ There is no \"Conclusion and Limitations\" section.\n\nTypos: Line 98: \"of of\"\n\nQUESTIONS:\n1\\ In Algorithm 2, the value of $r_t$​ depends on time. What is a practical application where we would want to modify the degree of privacy over time?\n    \n2\\ What is the purpose of Section 4, \"Extension to Classification Tasks\"? It seems to be just a modification of the score function.\n\n3\\ In the experiments, Table 1 shows that coverages of the sets returned by the proposed method are lower than 0.9, even if the number of points is huge (10,000). Is there an explanation for this?\n\n4\\ Furthermore, in Table 1, we see that when $\\epsilon$ increases, the coverage decreases for the proposed method, which is the opposite of what is observed for DPCP and seems more natural. Can you elaborate on this?\n\n5\\ Do you think it could be possible to see the impact of the privacy in the regret bound in Corollary 3.1?\n\n6\\ (Minor) When there is no privacy, is DPCP exactly equal to the standard split method?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

comments: SUMMARY:
The paper studies the problem of local-DP (LDP) streaming bit information for conformal prediction (getting value within an interval with % probability guarantees). The paper:
- propose the new algorithm using the known coin betting technique + randomized coin (for DP)
- show the regret and experiments for this new algorithm

STRENGTHS AND WEAKNESSES:
(+) new settings of online (one-pass) + local DP + one-bit
(+) complete theory
(+) many datasets tried
(-) Analysis is mostly off-the-shelf: applying the same known technique to a slightly different algorithm. The novelty is more on settings it applies to rather than advancing any theory or new ideas to work elsewhere.
(-) Unclear / possibly missing comparison in experiment results I want to ask, see below.

QUESTIONS:
1. DPCP is offline / central DP method. Will this be an apple-to-apple comparison? I feel a setting where distribution is not shifted (i.e. learning the confidence quickly) should be added because it's offline? 
2. In the baseline for non-private you used DtACI. Can you explain why not Podkopaev et al?
3. Can you comment how your paper compares to Penso et al. 2025 – “Privacy-Preserving Conformal Prediction under Local DP.” and Zhang et al. 2025 – “Online Differentially Private Conformal Prediction for Uncertainty Quantification.” ?

LIMITATIONS:
N/A
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-07-01