Balloon Mean: Robust Private Mean Estimation

• Balloon Mean is a robust, differentially private estimator of a multivariate mean that iteratively adjusts its clipping region using Mahalanobis geometry.
• The estimator alternates between projecting data onto a dynamic Mahalanobis ball and privately expanding the ball to capture a target fraction of observations.
• It delivers computational efficiency and strong privacy guarantees under heavy-tailed and contamination models while relying on a few interpretable tuning parameters.

Searching arXiv for the primary paper and cited related work on differentially private mean estimation. Balloon mean is a computationally tractable, robust, differentially private estimator of a multivariate mean. It is designed for multivariate mean estimation under differential privacy when observations may be heavy-tailed, with only finite second moment assumed, and may also be contaminated by an adversary replacing an $\eta$-fraction of the sample. Its defining construction alternates between clipping or projection onto a Mahalanobis ball and privately enlarging that ball until it contains most of the data, so that the clipping region is repeatedly recentered and resized rather than fixed once at the outset. In the formulation studied in the paper, the method satisfies $\rho$-zero-concentrated differential privacy, depends on a small number of interpretable tuning parameters, and is analyzed under heavy-tailed and contaminated elliptical models (Ramsay, 10 Jun 2026).

1. Problem setting and conceptual motivation

The estimator is introduced for the problem of multivariate mean estimation under differential privacy in a regime where classical light-tail assumptions are not available. The uncontaminated sample is modeled as

$$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$

and the observed sample $X_1',\dots,X_n'$ differs from the uncontaminated sample in at most $\eta n$ coordinates. The model therefore combines an elliptical distributional assumption with adversarial contamination at the sample level. The paper assumes that $F$ is strictly increasing and has finite second moment,

$\int x^2\,dF < \infty,$

so the theory extends beyond subgaussian settings and beyond bounded fourth-moment assumptions (Ramsay, 10 Jun 2026).

The stated motivation is that existing private mean estimators often separate into two unsatisfactory classes. Standard clipping-based differentially private estimators are computationally simple, but are usually not designed to be robust to contamination or heavy tails in a statistically principled way. Robust private estimators can be statistically stronger, but often rely on convex relaxations, sum-of-squares, MCMC, or iterative optimization. Balloon mean is positioned as simultaneously targeting strong privacy, robustness to heavy tails and some adversarial contamination, and computational efficiency using linear algebra, clipping, and private threshold or count queries (Ramsay, 10 Jun 2026).

Its conceptual distinction from a standard clipped private mean is that the clipping region is not fixed. A standard estimator chooses a center and radius once, clips all points to that region, and adds noise. Balloon mean instead clips to a current Mahalanobis ball, computes a noisy mean of projections, then privately expands a new ball around the updated center until it contains a target fraction $\tau$ of the data, and repeats. This makes $\tau$ a robustness knob: smaller $\tau$ allows the procedure to ignore a larger tail or outlier fraction.

2. Geometric construction and iterative algorithm

The method uses Mahalanobis geometry determined by a covariance matrix $\rho$0, which is assumed known in the theory. The Mahalanobis norm is

$\rho$1

and the corresponding Mahalanobis ball of radius $\rho$2 centered at $\rho$3 is

$\rho$4

The clipping operator is the projection of a point onto that ball,

$\rho$5

Accordingly, points already inside the ellipsoid are left unchanged, whereas points outside are projected radially back to the boundary (Ramsay, 10 Jun 2026).

The algorithm takes as inputs the data $\rho$6, covariance $\rho$7, an initial center $\rho$8, an initial radius $\rho$9, a lower radius bound $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$0, a grid size $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$1, a number of iterations $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$2, target fractions $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$3, and privacy allocations

$$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$4

The total privacy budget is

$$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$5

Initialization requires $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$6 large enough so that

$$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$7

At iteration $$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$8, the mean update first projects all observations onto the current balloon,

$$X_1,\dots,X_n \sim \nu = \mathcal{EC}(\mu,\Sigma,F),$$9

then averages the projected points and adds Gaussian noise calibrated to the Mahalanobis sensitivity. Since changing one data point changes one projected point by at most $X_1',\dots,X_n'$0 in Mahalanobis norm, the paper gives

$X_1',\dots,X_n'$1

with

$X_1',\dots,X_n'$2

After this, the balloon update step recenters the ball at $X_1',\dots,X_n'$3 and privately chooses a new radius so that the new ball contains approximately a fraction $X_1',\dots,X_n'$4 of the data. The radii are searched on the geometric grid

$X_1',\dots,X_n'$5

using counts

$X_1',\dots,X_n'$6

The threshold and counts are privatized as

$X_1',\dots,X_n'$7

$X_1',\dots,X_n'$8

and the search stops at the first $X_1',\dots,X_n'$9 such that

$\eta n$0

The radius is then set to

$\eta n$1

The final estimate is $\eta n$2; there is no balloon update after the last mean step.

3. Statistical model, quantile radii, and tuning parameters

The elliptical model is written as

$\eta n$3

where $\eta n$4 is uniform on the unit sphere and $\eta n$5 is a nonnegative radial variable. This makes the Mahalanobis geometry natural: the bulk of the uncontaminated sample is described through ellipsoidal level sets induced by $\eta n$6. The observed sample differs from the clean sample in at most $\eta n$7 positions, with $\eta n$8, and the replacements may be arbitrary and may depend on the clean sample, which is a Huber-style contamination-at-the-sample-level model (Ramsay, 10 Jun 2026).

A key population quantity is the quantile radius

$\eta n$9

the smallest radius such that the ball centered at $F$0 captures at least $F$1 of the population mass. The balloon update is meant to approximate such bulk-covering radii privately and iteratively, even when the current center is not yet accurate.

The theory imposes several initialization and grid conditions. It requires

$F$2

for some universal constant

$F$3

It also requires a sufficiently fine grid,

$F$4

where $F$5 is defined through gaps between population quantile radii, as well as

$F$6

These conditions are used to ensure that the private balloon update can identify a radius close to the desired population quantile radius.

The main theorem uses a specific tuning rule

$F$7

The paper writes $F$8. In practical terms, the interpretation emphasized in the paper is simpler than the formal expression: choosing smaller $F$9 increases robustness because the algorithm can focus on the bulk of the sample rather than attempting to include all observations.

4. Privacy accounting, computational complexity, and finite-sample guarantees

The privacy framework is zero-concentrated differential privacy. A mechanism is $\int x^2\,dF < \infty,$0-zCDP if for all $\int x^2\,dF < \infty,$1,

$\int x^2\,dF < \infty,$2

for all adjacent datasets $\int x^2\,dF < \infty,$3. The Gaussian mechanism invoked in the paper states that if $\int x^2\,dF < \infty,$4 is the global $\int x^2\,dF < \infty,$5-sensitivity of $\int x^2\,dF < \infty,$6, then

$\int x^2\,dF < \infty,$7

is $\int x^2\,dF < \infty,$8-zCDP. By composition over the mean-update and balloon-update steps, balloon mean satisfies the total privacy budget

$\int x^2\,dF < \infty,$9

Proposition 1 states that the balloon mean satisfies $\tau$0-zero concentrated differential privacy and can be computed in

$\tau$1

time; under the recommended settings $\tau$2 and $\tau$3, this reduces to

$\tau$4

The computational claim is central to the method’s positioning: the estimator is meant to avoid heavy optimization machinery while preserving robust-private behavior (Ramsay, 10 Jun 2026).

The main theorem gives a finite-sample high-probability error bound under the heavy-tailed contaminated elliptical model. With $\tau$5, $\tau$6, and sufficient per-balloon privacy $\tau$7, there exist universal constants $\tau$8 such that if $\tau$9 and

$\tau$0

then with probability at least $\tau$1,

$\tau$2

is controlled by a bound whose dependence is described in the paper through a privacy term roughly

$\tau$3

a contamination term stated as scaling as $\tau$4 inside the outer square-root structure, and a logarithmic factor involving

$\tau$5

Two interpretations are emphasized. First, when $\tau$6, the method achieves the minimax-optimal rate up to logarithmic factors in the heavy-tailed setting, provided

$\tau$7

is at most polynomial in $\tau$8. Second, when $\tau$9, the contamination contribution scales as $\tau$0, which the paper identifies as suboptimal by a factor $\tau$1 relative to existing lower bounds for adversarial contamination.

5. Relation to prior differentially private estimators

The paper explicitly situates balloon mean relative to earlier private mean estimators. Its closest algorithmic relatives are methods that combine clipping with private averaging, but the geometry and update schedule differ in consequential ways (Ramsay, 10 Jun 2026).

Relative to COINPRESS, the similarity is that both use noisy means of clipped data. The stated difference is that COINPRESS uses pre-fixed shrinking radii, whereas balloon mean uses private adaptive radii chosen by repeatedly blowing up a ball until it contains most of the data. This makes balloon mean more adaptive and explicitly oriented toward robustness.

Relative to the instance-optimal mean method of Huang et al., the common feature is private selection of a clipping radius from the data. The distinction is that the instance-optimal method privately selects a clipping radius once from preprocessed norms and then computes a single clipped mean, whereas balloon mean is inherently iterative, repeatedly recentering and recomputing the clipping region. The paper also distinguishes the objectives: the instance-optimal approach focuses on empirical mean release, whereas balloon mean emphasizes robustness and statistical guarantees under heavy-tailed and contaminated elliptical models.

Relative to private Huber $\tau$2-estimation, the difference is methodological. Private Huber approaches achieve robustness through private optimization of a Huber loss, while balloon mean avoids robust loss minimization entirely and instead uses geometric localization via clipping and balloon expansion. More broadly, the paper contrasts balloon mean with computationally heavy robust-private approaches based on sum-of-squares, convex relaxations, or MCMC. The stated trade-off is explicit: balloon mean gains computational simplicity and strong privacy, is optimal up to logarithmic factors for heavy-tailed mean estimation, but is not contamination-optimal under fully adversarial outliers.

6. Empirical behavior, practical interpretation, and limitations

The empirical study varies the principal tuning parameters: the initial center $\tau$3, the initial radius $\tau$4, the grid size $\tau$5, the number of iterations $\tau$6, the target fractions $\tau$7, and $\tau$8-schedules across iterations. One main study uses

$\tau$9

Two variants are emphasized: a high-$\rho$00 version, described as less robust, and a low-$\rho$01 version, described as more robust. The reported findings are low sensitivity to $\rho$02; error stabilization around $\rho$03 in low dimensions and $\rho$04 in high dimensions; better performance from smaller $\rho$05 in high dimensions and under contamination or heavy tails; and frequent gains from decreasing $\rho$06-schedules in contaminated settings (Ramsay, 10 Jun 2026).

The simulations consider four distributions: Gaussian, contaminated Gaussian with $\rho$07 adversarial-style contamination, multivariate $\rho$08, and a banana-shaped non-Gaussian distribution. Performance is measured by Mahalanobis error relative to the true mean. Baselines include the non-private sample mean, the high-$\rho$09 and low-$\rho$10 balloon mean variants, COINPRESS, a private Huber $\rho$11-estimator, and the instance-optimal mean. The main empirical conclusion is that the low-$\rho$12 balloon mean is the most robust variant: it is substantially better under contamination and heavy tails, while remaining similar to the high-$\rho$13 variant in the clean Gaussian case. The paper further reports that balloon mean is especially strong in higher dimensions, in stronger privacy regimes with smaller $\rho$14, and in contaminated or heavy-tailed settings.

The practical intuition offered by the paper is to expand a trusted ellipsoid around the current estimate until it covers the bulk of the data, then average only after clipping to that region. Re-centering after each clipped private mean helps correct an imperfect center; Mahalanobis geometry respects covariance structure and anisotropy; and choosing a target fraction $\rho$15 allows the method to focus on the bulk while leaving extreme observations outside. This suggests particular relevance when covariance structure matters, heavy tails are plausible, some contamination is expected, strong privacy is required, and a practical alternative to complex optimization pipelines is preferred.

Several caveats delimit the current theory. The covariance $\rho$16 is assumed known in the theory, although the paper notes that in practice one may replace it by a robust private covariance estimate. The contamination dependence is suboptimal under fully adversarial contamination. The theorem’s constants for $\rho$17 are described as conservative and mainly a guide. Finally, the formal guarantees are developed under an elliptical model, even though the empirical study includes a banana-shaped non-Gaussian distribution. These limitations locate balloon mean as a method with strong privacy and tractable robustness properties, particularly compelling in the heavy-tailed finite-variance setting, but with clearly stated gaps between current guarantees and the hardest adversarial contamination regime (Ramsay, 10 Jun 2026).