Coordinatewise Gaussian Privatization

• Coordinatewise Gaussian privatization is a family of privacy mechanisms that applies independent Gaussian noise per coordinate, either in the original or transformed basis.
• It distinguishes between additive i.i.d., anisotropic, and transformed approaches to optimize noise allocation and minimize mean squared error under differential privacy constraints.
• Applications span high-dimensional estimation, linear recoverability, and federated learning, emphasizing the importance of preconditioning and basis transformations.

Coordinatewise Gaussian privatization denotes a family of privacy mechanisms in which Gaussian perturbation is applied separately across coordinates, either in the original basis or in a transformed basis. In the literature, the phrase covers several distinct constructions: additive i.i.d. Gaussian perturbation of each sensitive coordinate, diagonal but anisotropic Gaussian mechanisms with coordinate-specific variances, and basis-dependent schemes that become coordinatewise only after an orthogonal or singular-vector transformation. It also appears as a contrast class against more general multivariate Gaussian privatizers that use full linear mixing and correlated Gaussian noise. As a result, the term is best understood as a structured subclass within a broader landscape of Gaussian privacy mechanisms rather than as a single canonical method (Muthukrishnan et al., 2023, Nageswaran, 2023, Hayati et al., 2021, Bongole et al., 22 Jun 2026).

1. Coordinatewise structure and basis dependence

In its most literal form, coordinatewise Gaussian privatization releases

$$Z_i = a_i Y_i + \eta_i,\qquad \eta_i \sim \mathcal N(0,\sigma_i^2),$$

with independent perturbations across coordinates. This is the diagonal form explicitly identified as a special case of a broader multivariate Gaussian mechanism in the inference-privacy literature, where the general release takes the form

$Z = GY + V,$

with full matrix $G$ and full Gaussian covariance for $V$. In that broader setting, coordinatewise privatization corresponds to restricting both $G$ and $\operatorname{Cov}(V)$ to diagonal matrices, which the general theory does not impose (Hayati et al., 2021).

A second usage arises when the problem is diagonal only after a change of basis. For linear-function recoverability, the relevant coordinates are the singular directions of a matrix $A$, not necessarily the original coordinates of $X$. The optimal mechanism is diagonal in the singular basis, and it becomes genuinely coordinatewise in the original basis only when the singular directions coincide with coordinate axes, as in coordinate projection, diagonal scaling, or identity release (Nageswaran, 2023).

A third usage appears in interactive mutual-information privacy, where the sensitive object is itself a coordinate vector

$S=(W_1,\dots,W_d)\in\mathbb R^d$

and the privatization channel is

$$\widetilde Y_i = W_i + Z_i,\qquad Z_i \stackrel{\mathrm{i.i.d.}}{\sim}\mathcal N(0,\sigma^2).$$

Here the mechanism is explicitly coordinatewise in the original basis, with i.i.d. Gaussian perturbations and common variance $Z = GY + V,$0 (Bongole et al., 22 Jun 2026).

2. Differential privacy and diagonal Gaussian mechanisms

Under central differential privacy, the most direct formalization is the independent but non-identically distributed Gaussian mechanism

$Z = GY + V,$1

where

$Z = GY + V,$2

independently across coordinates. The paper on coordinate-wise disparity defines the sensitivity profile

$Z = GY + V,$3

and proves that the mechanism is $Z = GY + V,$4-DP if and only if

$Z = GY + V,$5

This is a necessary and sufficient condition, and it reduces to the standard exact Gaussian condition when all $Z = GY + V,$6 are equal (Muthukrishnan et al., 2023).

The same work solves the optimal variance-allocation problem under mean squared error. If $Z = GY + V,$7 is the largest value satisfying the exact privacy equation, then the MSE-optimal assignment is

$Z = GY + V,$8

Hence the optimal diagonal Gaussian mechanism allocates more variance to coordinates with larger sensitivity. Its total MSE is

$Z = GY + V,$9

whereas the i.i.d. Gaussian benchmark has MSE

$G$0

The improvement factor is

$G$1

so the diagonal anisotropic mechanism is always at least as good as the isotropic one under this criterion (Muthukrishnan et al., 2023).

A complementary privacy-accounting perspective is provided by Gaussian Differential Privacy. For a scalar statistic $G$2 with sensitivity $G$3, the Gaussian mechanism

$G$4

is $G$5-GDP. GDP composes algebraically: $G$6 which makes separate coordinate releases naturally analyzable as compositions of scalar Gaussian mechanisms (Dong et al., 2019).

3. Modewise privatization under linear recoverability

A different, exact theory appears in Gaussian data privacy under linear function recoverability. There the data are

$G$7

the querier wants a linear function

$G$8

and the release $G$9 must satisfy the recoverability constraint

$V$0

Privacy is measured by

$V$1

and the optimal privacy value is characterized exactly as a piecewise function of the singular values $V$2 of $V$3. In particular,

$V$4

and once

$V$5

one can release something independent of $V$6, so

$V$7

The full tradeoff between these endpoints is piecewise affine (Nageswaran, 2023).

The optimal achievability scheme is diagonal in reduced singular coordinates: $V$8 with

$V$9

The mechanism therefore consists of linear attenuation plus independent additive Gaussian noise in each singular direction. Distortion is allocated first to the smallest singular values: the paper describes this as a thresholding or filling rule, rather than deriving a water-filling formula (Nageswaran, 2023).

When $G$0 is a coordinate-selection matrix extracting $G$1 coordinates, all nonzero singular values equal $G$2, and the theory becomes explicitly coordinatewise. Then

$G$3

and an optimal release is

$G$4

In this coordinate-aligned case the mechanism is genuinely coordinatewise and non-unique, because any allocation satisfying the budget constraint yields the same MMSE when $G$5 (Nageswaran, 2023).

4. Inference privacy versus coordinatewise independence

The synthesis paper on Gaussian mechanisms against statistical inference studies a more general setting with a private Gaussian vector $G$6, a disclosed/query vector $G$7, and a release mechanism

$G$8

Privacy is measured by the mutual information

$G$9

and utility is constrained through weighted distortion

$\operatorname{Cov}(V)$0

For jointly Gaussian variables,

$\operatorname{Cov}(V)$1

so privacy improvement corresponds to enlarging the posterior covariance $\operatorname{Cov}(V)$2 (Hayati et al., 2021).

The central point for coordinatewise Gaussian privatization is negative: the mechanism is not coordinatewise in the original basis. Both $\operatorname{Cov}(V)$3 and $\operatorname{Cov}(V)$4 are unconstrained matrices, and correlated Gaussian noise is explicitly allowed. The paper reformulates the design problem as a convex log-det semidefinite program over $\operatorname{Cov}(V)$5, $\operatorname{Cov}(V)$6, and an auxiliary matrix $\operatorname{Cov}(V)$7, thereby optimizing the linear transformation and the full Gaussian covariance rather than per-coordinate noise scales (Hayati et al., 2021).

The noise covariance can always be diagonalized after an orthogonal change of basis,

$\operatorname{Cov}(V)$8

so the additive noise becomes coordinatewise independent in rotated output coordinates. However, the paper does not prove that the jointly optimal pair $\operatorname{Cov}(V)$9 diagonalizes together with $A$0, $A$1, and $A$2. The transformed problem therefore remains coupled through the signal term and the distortion term. A common misconception is that every linear-Gaussian privacy mechanism is effectively coordinate-separable; the paper explicitly does not establish that conclusion (Hayati et al., 2021).

5. High-dimensional Gaussian estimation and the role of preconditioning

For private learning of general multivariate Gaussians, several papers argue that naive coordinatewise privatization is inadequate in the original basis. The core reason is that, for a general covariance matrix, coordinatewise means and variances do not determine the covariance, off-diagonal correlations matter for total variation distance, and sensitivity in the original coordinates can be dominated by poorly conditioned directions (Kamath et al., 2018).

The 2018 zCDP work on privately learning high-dimensional distributions makes this point explicitly. It notes that coordinatewise privatization works naturally only when the covariance is diagonal, whereas for a general Gaussian one should first privately find a transformation $A$3 such that

$A$4

This recursive private preconditioning step turns the problem into an approximately isotropic one, after which coordinatewise mean estimation and simpler private covariance estimation become effective (Kamath et al., 2018).

The 2021 paper on unbounded Gaussians generalizes the same philosophy to arbitrary Gaussian distributions without prior parameter bounds. Its main preconditioner theorem states that, for $A$5 of rank $A$6, a polynomial-time $A$7-DP algorithm outputs $A$8 such that

$A$9

The method is spectral rather than coordinatewise: it privately estimates eigenvalues, recovers eigenspaces, and applies subspace-dependent rescaling. Only after this transformed-coordinate step do clipped empirical statistics plus Gaussian perturbation become well behaved (Kamath et al., 2021).

The 2022 robust-and-optimal paper reaches a closely related conclusion from a different angle. In its approximate-DP covariance release, it argues that entrywise Gaussian noise can completely destroy the eigenstructure and thus lead to arbitrarily large total variation error. Instead, it uses a covariance-aware Gaussian sampling mechanism, releasing the empirical covariance of samples drawn from a stabilized Gaussian estimate. In its pure-DP algorithm, recursive private preconditioning again produces a matrix $X$0 such that

$X$1

Taken together, these results indicate that high-dimensional Gaussian privatization is generally geometry-aware and matrix-coupled; coordinatewise treatment becomes principled only after private whitening or preconditioning (Alabi et al., 2022).

6. Interactive, personalized, and federated extensions

In interactive statistical decision making with mutual-information privacy, coordinatewise Gaussian privatization is treated as a special private channel class. The sensitive object is

$X$2

the mechanism is

$X$3

and feasible procedures must satisfy

$X$4

For this class the paper derives a general minimax-quantile lower-bound template in which privacy appears through the variance-inflation factor

$X$5

In Gaussian mean estimation, for example,

$X$6

and the lower bound becomes

$X$7

The paper’s interpretation is that privacy acts as Gaussian variance inflation in high-confidence lower bounds (Bongole et al., 22 Jun 2026).

Personalized differential privacy introduces another axis of heterogeneity. The 2026 scalar Gaussian mean-estimation paper studies

$X$8

with per-record privacy budgets $X$9. Its estimator is not an additive Gaussian mechanism; instead it is a clip-then-estimate procedure combining a private range estimator, clipping, saturated privacy-budget weights, and Laplace noise. The lower bound has the form

$S=(W_1,\dots,W_d)\in\mathbb R^d$0

matched up to logarithmic factors. A plausible implication is that this scalar construction can serve as a building block for coordinatewise multivariate procedures, but the paper itself analyzes only the one-dimensional case (Dong et al., 22 Jan 2026).

A different boundary case is vertical federated learning with client-wise missingness. The Gaussian-copula framework in that setting is a conceptual rather than direct match to coordinatewise Gaussian privatization. Dependence is modeled through a latent Gaussian copula

$S=(W_1,\dots,W_d)\in\mathbb R^d$1

but privacy is enforced through randomized response on pairwise ranks and Laplace-noised Bernstein marginal estimation, not by additive Gaussian noise on each coordinate. The method is nevertheless coordinate-structured: marginals are privatized separately, dependence is reconstructed pairwise, and synthetic data are generated coordinatewise from privatized marginals and a Gaussian latent dependence model (Tang et al., 25 Nov 2025).

Coordinatewise Gaussian privatization is therefore a precise technique in some settings, an exact optimal mechanism in some coordinate-aligned Gaussian problems, and only a restricted special case in others. The literature consistently distinguishes between three regimes: diagonal Gaussian perturbation with per-coordinate control, transformed-coordinate diagonalization in singular or rotated bases, and fully multivariate Gaussian privatization with essential cross-coordinate coupling.