Metraipolis › archive › dc_7cb3fdcc4353

Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images — arXiv:2608.17147

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.17147
License (as archived): CC0-1.0
Archived: 2026-10-18T14:49:03.586Z
SHA-256 of the archived text: b5e428c762a7dc2ecbe3e57a8ecc883ab22b864756a5fa81a62d22d9b80208e8
Stable URL of this page: https://metraipolis.com/documento/dc_7cb3fdcc4353

How to cite

Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images — arXiv:2608.17147 — arXiv (en), https://arxiv.org/abs/2608.17147 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7cb3fdcc4353 (Metraipolis archive dc_7cb3fdcc4353, sha256 b5e428c762a7dc2ecbe3e57a8ecc883ab22b864756a5fa81a62d22d9b80208e8)

BibTeX

@misc{dc7cb3fdcc4353,
  title = {Picture the Epsilon: Pursuing Identity-Level Privacy Guarantees for Images — arXiv:2608.17147},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.17147},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7cb3fdcc4353; sha256 b5e428c762a7dc2ecbe3e57a8ecc883ab22b864756a5fa81a62d22d9b80208e8},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.17147. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Several methods for auditing privacy in embedding spaces report a number called "epsilon." The common name is misleading: one number may be a heuristic score, another may come from a valid population inequality but ignore sampling uncertainty, and a third may be a confidence bound. This paper asks when such a number is evidence about differential privacy. We study four approaches based on Gaussian calibration, marginal kernel-density ratios, maximum mean discrepancy (MMD), and classifier hypothesis tests. The first two are modeling diagnostics. The MMD and classifier approaches use valid population lower bounds, but only the classifier approach is given a separate test set and a finite-sample confidence calculation. To see how these distinctions matter, we build a synthetic benchmark in which the true privacy value is known. It includes pure-DP Laplace mechanisms, approximate-DP Gaussian mechanisms, an exact privacy null, two identity geometries, and three sample sizes. At the null, the Gaussian and kernel-density diagnostics remain large. A direct conversion of an empirical ROC curve often returns infinity even though the AUC is near chance and no threshold separates the samples perfectly. The MMD value increases as the distributions become easier to distinguish, but the sample estimate is small relative to the known reference and is not a lower confidence bound. By contrast, a classifier chosen on development data and evaluated on untouched test data gives simultaneous lower confidence bounds under the stated iid model. We also apply the methods to FaceFusion and InstantID. That case study shows how the methods behave on face data but does not calibrate them because the generators have no known privacy value. The main lesson is that an epsilon-like number is meaningful only together with its assumptions and its finite-sample interpretation.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-19 in cs.LG).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2608.17147 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-18T14:47:59.450Z dalla pagina https://arxiv.org/catchup/cs.LG/2026-08-19?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).