Metraipolis › archive › dc_4e27583a01be

A Sharp Transition in Data Reconstruction under Differential Privacy — arXiv:2609.37344

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.37344
License (as archived): CC0-1.0
Archived: 2026-10-07T16:27:09.550Z
SHA-256 of the archived text: 0b2b48770e99d1cc5c325982fbb8dfa355417c7da7df5cdf9033d224e6e760c9
Stable URL of this page: https://metraipolis.com/documento/dc_4e27583a01be

How to cite

A Sharp Transition in Data Reconstruction under Differential Privacy — arXiv:2609.37344 — arXiv (en), https://arxiv.org/abs/2609.37344 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_4e27583a01be (Metraipolis archive dc_4e27583a01be, sha256 0b2b48770e99d1cc5c325982fbb8dfa355417c7da7df5cdf9033d224e6e760c9)

BibTeX

@misc{dc4e27583a01be,
  title = {A Sharp Transition in Data Reconstruction under Differential Privacy — arXiv:2609.37344},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.37344},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_4e27583a01be; sha256 0b2b48770e99d1cc5c325982fbb8dfa355417c7da7df5cdf9033d224e6e760c9},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.37344. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Data reconstruction attacks have empirically been successful in recovering training samples from learned models, raising privacy concerns and motivating defenses with guarantees that remain valid against future threats. While differential privacy (DP) provides formal protection, choosing the privacy budget remains a challenge: small budgets severely reduce utility, but it is hard to quantify how large the budget can be without allowing accurate reconstruction. In this work, we study informed attackers who aim to reconstruct a single $d$-dimensional training sample from a $\rho$-zero-concentrated DP model, knowing all other training data. Our main contribution is to establish a sharp transition at $\rho \asymp d$ for data reconstruction: on the one hand, we derive entropy-based lower bounds for any private mechanism and any attack, characterizing a set of target priors for which reconstruction is information-theoretically impossible for $\rho \ll d$; on the other hand, we analyze a simple attack on private linear regression with output perturbation, showing that reconstruction is practically feasible for $\rho \gg d$. Remarkably, the transition moves to $\rho \asymp s$ for data lying in an $s$-dimensional subspace, demonstrating that the privacy budget guaranteeing adequate protection must be assessed in terms of the effective dimension of the data. We validate our findings via experiments on synthetic data and natural images (CIFAR-10, ImageNet).

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-30 in cs.AI).
Categorie arXiv: Machine Learning (cs.LG) ; Artificial Intelligence (cs.AI); Machine Learning (stat.ML).
Pagina del lavoro: https://arxiv.org/abs/2609.37344 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T15:54:53.970Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-30?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).