REAEDP: Entropy-Calibrated Differentially Private Data Release with Formal Guarantees and Attack-Based Evaluation

Bo Ma; Jinsong Wu; Wei Qi Yan

cs.CRMar 14, 2026

REAEDP: Entropy-Calibrated Differentially Private Data Release with Formal Guarantees and Attack-Based Evaluation

Authors: Bo Ma, Jinsong Wu, Wei Qi Yan

Organizations: School of Mathematics and Computer Engineering, Auckland University of Technology, Auckland 1024 New Zealand · Resideo Technologies, Inc., Austin, TX 78759, USA · Department of Artificial Intelligence, Guilin University of Electronic Technology, Gui Lin, China · Department of Electrical Engineering, Universidad de Chile, Santiago, Chile

Abstract

Sensitive data release is vulnerable to output-side privacy threats such as membership inference, attribute inference, and record linkage. This creates a practical need for release mechanisms that provide formal privacy guarantees while preserving utility in measurable ways. We propose REAEDP, a differential privacy framework that combines entropy-calibrated histogram release, a synthetic-data release mechanism, and attack-based evaluation. On the theory side, we derive an explicit sensitivity bound for Shannon entropy, together with an extension to Rényi entropy, for adjacent histogram datasets, enabling calibrated differentially private release of histogram statistics. We further study a synthetic-data mechanism $\mathcal{F}$ with a privacy-test structure and show that it satisfies a formal differential privacy guarantee under the stated parameter conditions. On multiple public tabular datasets, the empirical entropy change remains below the theoretical bound in the tested regime, standard Laplace and Gaussian baselines exhibit comparable trends, and both membership-inference and linkage-style attack performance move toward random-guess behavior as the privacy parameter decreases. These results support REAEDP as a practically usable privacy-preserving release pipeline in the tested settings. Source code: https://github.com/mabo1215/REAEDP.git

Figures & tables

Work	Data	Formal DP	Synthetic	Entropy cal.	Attack eval.	Difference
Dwork et al. [ 9 , 5 ]	Queries, stats	$\varepsilon$ or $(\varepsilon,\delta)$	No (or separate)	No	No	Foundational; no entropy sensitivity or synthetic $\mathcal{F}$ .
Noisy-SGD [ 6 , 7 ]	Gradients, ML	$(\varepsilon,\delta)$ (composition)	No	No	Limited	DP learning; no histogram entropy or synthetic release.
DP histogram / Laplace [ 5 ]	Counts, histograms	$\varepsilon$ -DP	No	Sensitivity for counts only	No	No entropy sensitivity; we give $\Delta_{H}$ and calibration.
Kernel / RKHS DP (prior)	Function, kernel mean	Some $(\varepsilon,\delta)$	Varies	No	Rare	We give full mechanism $\mathcal{F}$ , algorithm, and MIA.
This work (REAEDP)	Histogram, tabular, RKHS	$(\varepsilon,\delta)$ (Theorems 3 , 4 )	Yes ( $\mathcal{F}$ )	Yes ( $\Delta_{H}$ , $\Delta_{H_{\alpha}}$ )	Yes (MIA, Fig. 7 )	Combines entropy-sensitive analysis, a synthetic-data mechanism under stated conditions, and empirical attack-based evaluation.

TABLE I: Structured comparison with prior work (Method, Data Type, Formal DP, Synthetic Release, Entropy Calibration, Attack Eval, Difference).

Symbol	Meaning
$D$ , $D^{\prime}$	Adjacent datasets. For Theorem 3 , adjacency means replacement (same size $n$ , differ in one record). For Theorem 4 , adjacency means add/remove: $D^{\prime}=D\cup\{d^{\prime}\}$ or $D=D^{\prime}\cup\{d^{\prime}\}$ .
$\mathcal{M}$ , $\mathcal{F}$	Randomized mechanism; $\mathcal{F}$ is our synthetic-data mechanism with range $\mathcal{U}$ .
$\varepsilon$ , $\delta$	Privacy parameters: $(\varepsilon,\delta)$ -DP means $\mathbb{P}\mathrm{r}\{\mathcal{M}(D)\in S\}\leq e^{\varepsilon}\mathbb{P}\mathrm{r}\{\mathcal{M}(D^{\prime})\in S\}+\delta$ .
$H(z)$ , $H_{\alpha}(z)$	Shannon entropy and Rényi entropy (order $\alpha$ ) of distribution $z$ .
$\Delta_{H}$	Sensitivity of $H$ : maximum $\|H(z)-H(z^{\prime})\|$ over adjacent histograms.
$n$ , $m$	$n$ = number of records in the dataset; $m$ = number of histogram bins.

TABLE II: Notation and symbols used in the paper (method and proofs).

Dataset	Type	Source / where to find more
y_amazon-google-large ( $y$ )	Tabular, numeric	UCI [ 10 ] ; time series, $\sim$ 3M rows.
house-prices-train (SalePrice), home-credit, tabular-fe, etc.	Tabular, numeric	Kaggle [ 12 ] ; multi-dataset validation (Table S3 ).
Synthetic (Chi-square process)	Stochastic process	Generated (50 paths, 80 steps).
Synthetic $64\times 64$ image	Image	Supplementary appendix (Appendices J–L).
$n\in\{50,\ldots,5000\}$ (entropy bound)	Scalar $n$	Used only to plot Theorem 3 bound.

TABLE III: Datasets used in the experiments.

Fig. 1: Privacy test pass rate vs. $\gamma$ for several $k$ ( $t=2$ ).

Panel of Figure 5 — Fig. 2: Wiener kernel: original vs. private mean for $\rho=10^{-6}$ , $0.001$ , $0.1$ (left to right).

Fig. 3: Entropy sensitivity bound $\Delta_{H}$ vs. dataset size $n$ , illustrating the decrease of the theoretical bound used for calibrated histogram release.

Fig. 4: Empirical $\widehat{\Delta H}$ vs. theoretical bound (Theorem 3 ): mean and maximum over adjacent pairs. The ratio remains below 1 in the tested regime, indicating that the empirical entropy sensitivity stays below the theoretical bound.

Fig. 5: Baseline comparison: entropy error and count MAE vs. $\varepsilon$ (Laplace, Gaussian, DP synthetic (Laplace), DP synthetic (Gaussian)); $\Delta_{H}$ bound shown.

Fig. 6: Ablation: entropy error vs. number of bins $m$ ( $\varepsilon=1$ ); $\Delta_{H}$ bound.

Fig. 7: MIA accuracy (with 95% CI), MIA AUC, and linkage-style accuracy vs. $\varepsilon$ ; random guess = 0.5.

Dataset	$n$	bins	$\varepsilon$	$H_{\mathrm{orig}}$	$H_{\mathrm{noisy}}$	$\Delta_{H}$ bound
y_amazon-google-large	100000	30	1.0	3.0279	3.0286	0.00037

TABLE IV: Real-data experiment: one run (dataset,

n

, bins,

\varepsilon

H_{\mathrm{orig}}

H_{\mathrm{noisy}}

\Delta_{H}

bound).

Fig. 8: Real-data: histogram of $y$ (left: original vs. $\varepsilon$ -DP counts; right: $H_{\mathrm{orig}}$ vs. $H_{\mathrm{noisy}}$ ).

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

$\alpha$	0.5	1.5	2	3	5	10
$C_{\alpha}$	2.89	8.66	5.77	4.33	3.61	3.21

Appendix

TABLE S1: Varying

\alpha

: sensitivity constant

C_{\alpha}

such that

\Delta_{H_{\alpha}}\leq C_{\alpha}/n

Fig. S1: PSNR and MAE vs. $\varepsilon$ (Laplace and Gaussian).

Fig. S2: PSNR, MAE, and SSIM at $\varepsilon=0.5,1.0,2.0$ (Laplace vs. Gaussian).

Figure	Data	Experimental role
1	Pass rate vs. $\gamma$ ; curves for $k\in\{10,20,30,50\}$	Theorem 4 (mechanism $\mathcal{F}$ is $(\varepsilon,\delta)$ -DP); privacy test.
2	Original vs. private RKHS mean; $\rho=10^{-6},0.001,0.1$	Wiener kernel mechanism; $\rho$ utility–privacy tradeoff.
S1	PSNR, MAE vs. $\varepsilon$ ; Laplace & Gaussian	$(\varepsilon,\delta)$ -DP utility–privacy tradeoff.
3	$\Delta_{H}$ bound vs. $n$	Theorem 3 (entropy sensitivity).
S2	PSNR, MAE, SSIM at $\varepsilon=0.5,1,2$	Laplace vs. Gaussian.
8	Histogram & entropy (Table IV )	Theorem 3 ; Laplace histogram release.

Appendix

TABLE S2: Supplementary figures and their experimental role (data shown and connection to the theory).

Fig. S3: Additional experiment (see text).

Dataset (column)	$n$	bins	$\varepsilon$	$H_{\mathrm{orig}}$	$H_{\mathrm{noisy}}$	$\Delta_{H}$ bound
y_amazon-google-large ( $y$ )	100000	30	1.0	3.0279	3.0286	0.00037
house-prices-train (SalePrice)	1460	30	1.0	3.4873	3.5155	0.01676
home-credit-application-train (AMT_INCOME_TOTAL)	100000	30	1.0	0.0004	0.0034	0.00037
tabular-feature-engineering ( $y_{1}$ )	10000	30	1.0	4.6645	4.6640	0.00300
r_diff_train ( $y_{1}$ )	10000	30	1.0	0.0237	0.0459	0.00300
pow_train ( $y_{1}$ )	10000	30	1.0	4.7066	4.7065	0.00300

Appendix

TABLE S3: Multi-dataset real-data validation: same entropy+DP pipeline on seven datasets (

\varepsilon=1

, 30 bins;

n

capped at 100k where applicable).

Panel of Figure 19 — Fig. S4: Multi-dataset validation: histogram and entropy (original vs. $\varepsilon$ -DP) on four representative public datasets. Same mechanism and Theorem 3 bound; full table in Table S3 .

Differentially Private Synthetic Data Generation

See all 21 papers

Noise-Calibrated Inference from Differentially Private Sufficient Statistics in Exponential Families
Mar 2, 2026Amir Asiaee, Samhita PalExponential Family Differential Privacy
Department of Biostatistics, Vanderbilt University Medical Center, Nashville, TN, USA
Subgroup Membership Inference Audits of Differentially Private Synthetic Text
Sep 9, 2026Yidan Sun, Viktor Schlegel, Srinivasan Nandakumar +2Privacy Auditing Membership Inference Attacks
Imperial College London, Imperial Global Singapore · Nanyang Technological University, Singapore · Imperial College London, United Kingdom
ScoreShield: Differentially Private Release of Similarity Scores
Jul 27, 2026Behrooz Razeghi, Parsa RahimiPrivacy-Preserving ML Differential Privacy
School of Engineering and Applied Sciences, Harvard University · School of Engineering, École Polytechnique Fédérale de Lausanne (EPFL)

Mar 2, 2026J/K move · Enter open · S save

Noise-Calibrated Inference from Differentially Private Sufficient Statistics in Exponential Families

Amir Asiaee, Samhita Pal

Department of Biostatistics, Vanderbilt University Medical Center, Nashville, TN, USA

Exponential Family Differential Privacy Confidence Region Estimation

Open paper AskPDF arXiv

Many differentially private (DP) data release systems either output DP synthetic data and leave analysts to perform inference as usual, which can lead to severe miscalibration, or output a DP point estimate without a principled way to do uncertainty quantification. This paper develops a clean and tractable middle ground for exponential families: release only DP sufficient statistics, then perform noise-calibrated likelihood-based inference and optional parametric synthetic data generation as post-processing. Our contributions are: (1) a general recipe for approximate-DP release of clipped sufficient statistics under the Gaussian mechanism; (2) asymptotic normality, explicit variance inflation, and valid Wald-style confidence intervals for the plug-in DP MLE; (3) a noise-aware likelihood correction that is first-order equivalent to the plug-in but supports bootstrap-based intervals; and (4) a matching minimax lower bound showing the privacy distortion rate is unavoidable. The resulting theory yields concrete design rules and a practical pipeline for releasing DP synthetic data with principled uncertainty quantification, validated on three exponential families and real census data.

Abstract

Differentially Private Synthetic Data Generation

Explore similar work

Noise-Calibrated Inference from Differentially Private Sufficient Statistics in Exponential Families

Subgroup Membership Inference Audits of Differentially Private Synthetic Text

ScoreShield: Differentially Private Release of Similarity Scores