Differentially Private E-values

• Differentially private e-values are nonnegative evidence measures that satisfy the condition E[under H0] ≤ 1 while ensuring the output mechanism maintains differential privacy.
• They are constructed using biased multiplicative noise (Gaussian or Laplace) to calibrate log-sensitivity and preserve the validity of hypothesis tests.
• Recent frameworks optimize private e-power and threshold calibration under pure-DP and GDP settings, enabling near-optimal performance compared to non-private methods.

Searching arXiv for the specified papers to ground the article in current sources. Differentially private e-values are nonnegative evidence measures whose release mechanism satisfies a differential privacy constraint while preserving the e-value validity condition $\mathbb{E}_{H_0}[E]\le 1$. In the recent literature, the topic has developed along three closely connected lines: a general method for converting arbitrary non-private e-values into private ones by biased multiplicative noise (Csillag et al., 21 Oct 2025); an optimal theory of private e-power for simple hypothesis testing under pure central $\varepsilon$-differential privacy (Jacobsen et al., 27 May 2026); and a Gaussian differential privacy framework with canonical multiplicative Gaussian perturbation, sharp threshold calibration, and multiple-testing procedures (Kuang et al., 28 May 2026). Closely related work on privacy auditing and operational interpretations of $\epsilon$ is conceptually adjacent, but it does not define formal e-values (Negoescu et al., 2023, Laud et al., 2019).

1. Conceptual scope and formal definitions

An e-value is a nonnegative random variable $E$ satisfying $\mathbb{E}_{H_0}[E]\le 1$. In the simple-testing formulation, the literature distinguishes between an e-variable, meaning the random variable itself, and an e-value, meaning a realized value; thresholding at $1/\alpha$ yields a level-$\alpha$ test by Markov’s inequality. A differentially private e-value adds a second requirement: the mechanism that outputs the e-value must satisfy a privacy guarantee with respect to neighboring datasets differing in one record. In the pure-DP testing framework, a random variable $E=M(X)$ is an $\varepsilon$-DP e-variable for $P$ if $\varepsilon$0 is $\varepsilon$1-DP and $\varepsilon$2; in the Gaussian-DP framework, the released quantity $\varepsilon$3 must simultaneously satisfy $\varepsilon$4 and $\varepsilon$5-GDP; and in the general RDP framework, the starting point is any valid non-private e-value $\varepsilon$6, which is then transformed into a private one (Csillag et al., 21 Oct 2025, Jacobsen et al., 27 May 2026, Kuang et al., 28 May 2026).

Framework	Privacy regime	Central object
(Csillag et al., 21 Oct 2025)	Rényi DP, with appendix results for $\varepsilon$7-DP and pure DP	General transformation $\varepsilon$8
(Jacobsen et al., 27 May 2026)	Pure central $\varepsilon$9-DP	Optimal e-power for testing $\epsilon$0 vs. $\epsilon$1
(Kuang et al., 28 May 2026)	$\epsilon$2-DP specialized to $\epsilon$3-GDP	Canonical multiplicative Gaussian privatization

This division of labor matters. The RDP paper is distribution-agnostic and mechanism-oriented; the pure-DP paper is decision-theoretic and asks what e-power is achievable under privacy; the GDP paper treats tradeoff-function privacy as the native language and uses it to derive exact threshold calibration and multiple-testing machinery. A plausible synthesis is that “differentially private e-values” is best understood as a family of constructions rather than a single canonical object.

2. General privatization by biased multiplicative noise

The general construction starts from a valid non-private e-value $\epsilon$4 and releases

$\epsilon$5

where $\epsilon$6 is independent noise. This multiplicative form preserves nonnegativity and is equivalent to adding noise to the log e-value: $\epsilon$7 Privacy is therefore calibrated through the log-sensitivity

$\epsilon$8

Validity is preserved because

$\epsilon$9

so under the null it is enough that $E$0. The paper proves that if $E$1 and $E$2 is not already differentially private, then a mechanism of this form must satisfy $E$3; the bias is therefore necessary rather than cosmetic (Csillag et al., 21 Oct 2025).

Two concrete RDP mechanisms are developed. The biased Gaussian mechanism takes

$E$4

which yields a valid e-value satisfying $E$5-Rényi differential privacy. The biased Laplace mechanism takes

$E$6

with

$E$7

and is valid provided $E$8. Appendix results also give a Gaussian mechanism for $E$9-DP and a Laplace mechanism for pure $\mathbb{E}_{H_0}[E]\le 1$0-DP (Csillag et al., 21 Oct 2025).

This framework preserves several core e-value operations. If $\mathbb{E}_{H_0}[E]\le 1$1 and $\mathbb{E}_{H_0}[E]\le 1$2 are private e-values on independent datasets, then $\mathbb{E}_{H_0}[E]\le 1$3 is again a private e-value; $\mathbb{E}_{H_0}[E]\le 1$4 is a post-hoc-valid p-value by post-processing; and convex combinations preserve validity, with a stronger privacy statement for independent datasets than for dependent e-values on the same dataset. The exact growth-rate identity

$\mathbb{E}_{H_0}[E]\le 1$5

shows that the privacy penalty is additive on the normalized log scale. When $\mathbb{E}_{H_0}[E]\le 1$6, the Gaussian penalty is $\mathbb{E}_{H_0}[E]\le 1$7, which explains the paper’s asymptotic claim that private e-values are as powerful as their non-private counterparts (Csillag et al., 21 Oct 2025).

3. Optimal private e-power under pure central differential privacy

For simple hypothesis testing

$\mathbb{E}_{H_0}[E]\le 1$8

the pure-DP line of work formulates private e-values as an optimization problem. The performance criterion is e-power

$\mathbb{E}_{H_0}[E]\le 1$9

and the optimal normalized finite-$1/\alpha$0 rate is

$1/\alpha$1

Its asymptotic limit admits an exact variational characterization: $1/\alpha$2 This replaces the non-private rate $1/\alpha$3 by a privacy-constrained KL+TV expression and makes the privacy loss explicit as a geometric deformation of the classical likelihood-ratio solution (Jacobsen et al., 27 May 2026).

The optimizer is a clipped likelihood ratio. Writing $1/\alpha$4 for the density ratio, the optimal bounded non-private e-variable has the form

$1/\alpha$5

where the clipping interval is calibrated so that $1/\alpha$6 and the clipped ratio integrates to $1/\alpha$7 under $1/\alpha$8. This construction is equivalent to introducing an intermediate distribution $1/\alpha$9 whose density equals $\alpha$0 on a middle region and equals $\alpha$1 or $\alpha$2 on lower and upper clipping regions. The resulting e-power is exactly

$\alpha$3

Privacy therefore enforces a bounded dynamic range on evidence contributions; the raw likelihood ratio is generally infeasible because its log-sensitivity can be unbounded (Jacobsen et al., 27 May 2026).

A direct Laplace release of $\alpha$4 fails because exponentiation introduces positive bias. The paper instead uses the merged statistic

$\alpha$5

privatizes it as

$\alpha$6

and releases

$\alpha$7

For suitable computable $\alpha$8 and $\alpha$9, this yields an $E=M(X)$0-DP e-variable whose expected log-evidence satisfies

$E=M(X)$1

where $E=M(X)$2. Applied to the clipped likelihood-ratio statistic, this matches the optimal asymptotic rate up to a lower-order $E=M(X)$3 term (Jacobsen et al., 27 May 2026).

4. Gaussian differential privacy, canonical noise, and sharp calibration

The GDP framework starts from the tradeoff-function formulation of privacy. For neighboring datasets $E=M(X)$4, a mechanism is $E=M(X)$5-DP if its hypothesis-testing tradeoff function dominates $E=M(X)$6, and $E=M(X)$7-GDP is the specialization $E=M(X)$8, where

$E=M(X)$9

Within this framework, the relevant sensitivity is again log-sensitivity,

$\varepsilon$0

and privatization is multiplicative: $\varepsilon$1 Under the assumptions that the noise is independent, symmetric around its expectation, log-concave, multiplicative, and exactly exhausts the GDP budget, the paper proves that $\varepsilon$2 must be Gaussian: $\varepsilon$3 Validity requires

$\varepsilon$4

so the smallest feasible and power-optimal mean is

$\varepsilon$5

The canonical private e-value is therefore

$\varepsilon$6

which is simultaneously $\varepsilon$7-GDP and exactly e-valid (Kuang et al., 28 May 2026).

A central advance of this framework is threshold calibration. The universal Markov rule rejects when $\varepsilon$8, but this ignores the known Gaussian privatization law. The paper derives a globally sharp threshold $\varepsilon$9 such that

$P$0

for every valid e-value, with equality in the worst case: $P$1 where $P$2 solves

$P$3

Because $P$4, the calibrated rejection region is strictly larger than the standard private Markov region (Kuang et al., 28 May 2026).

The low-sensitivity asymptotics are unusually sharp. If $P$5 denotes the density of the non-private e-value under $P$6, then

$P$7

whereas the corresponding noise-induced cost satisfies

$P$8

Since $P$9 as $\varepsilon$00, the calibrated private test can exceed the non-private baseline $\varepsilon$01 in a low-sensitivity regime. The paper explicitly treats this as a threshold-calibration phenomenon, not as a universal claim that privacy helps testing (Kuang et al., 28 May 2026).

5. Sequential inference, multiple testing, and applications

The sequential theory under pure $\varepsilon$02-DP centers on e-processes. A sequence $\varepsilon$03 is an $\varepsilon$04-DP e-process if it is generated by an $\varepsilon$05-DP mechanism on the infinite data stream and remains an e-process after privatization. The main lower bound states that for any bounded stopping time $\varepsilon$06,

$\varepsilon$07

and hence any sequential level-$\varepsilon$08 test with power $\varepsilon$09 must satisfy

$\varepsilon$10

The constructive side uses a batch schedule $\varepsilon$11 and privatized multiplicative updates, yielding an $\varepsilon$12-DP e-process that matches the universal lower bound up to an arbitrarily small multiplicative factor after a startup phase. In Bernoulli experiments, this private e-process required fewer samples than DP-SPRT across the tested privacy levels and alternatives (Jacobsen et al., 27 May 2026).

The GDP multiple-testing framework uses a two-part extractor. Selection is performed by a Report Noisy Max step on

$\varepsilon$13

with

$\varepsilon$14

followed by Gaussian multiplicative release of the selected value,

$\varepsilon$15

Iterating this step produces the recursive GDP $\varepsilon$16-Peeling Algorithm, which concentrates privacy budget on the top $\varepsilon$17 hypotheses. By GDP composition, allocating $\varepsilon$18 per peeling step yields overall $\varepsilon$19-GDP. Each output coordinate is either zero or a valid private e-value, so applying e-BH to the output vector controls FDR at level $\varepsilon$20. The paper also gives an adaptive private choice of $\varepsilon$21 using privatized margins $\varepsilon$22 on a geometric grid (Kuang et al., 28 May 2026).

Applications in the general RDP framework illustrate how these constructions interact with domain-specific e-values. For private healthcare inference, the method is applied to mean-betting e-values of the form

$\varepsilon$23

producing private confidence intervals after discretizing $\varepsilon$24 and lower-bounding each cellwise e-value by a local Lipschitz correction. For online risk monitoring, batchwise privatized e-values are multiplied across time, preserving anytime-validity under the private optional continuation property. For conformal e-prediction, the exchangeability e-value

$\varepsilon$25

has sensitivity bound

$\varepsilon$26

which decays as $\varepsilon$27 and makes privacy comparatively inexpensive asymptotically. In these experiments, biased Gaussian perturbation was broadly applicable, while biased Laplace perturbation sometimes performed better but was often unavailable when its feasibility condition failed (Csillag et al., 21 Oct 2025).

6. Neighboring concepts, misconceptions, and open problems

A recurrent misconception is to conflate any privacy-related scalar beginning with “$\varepsilon$28” or “epsilon-like” with a formal e-value. The metric $\varepsilon$29 from privacy auditing is not an e-value in the statistical sense. It is defined from ROC operating points of a threshold membership inference attack against a fixed trained model instance and takes the form

$\varepsilon$30

The paper explicitly states that $\varepsilon$31 is an attack-derived, DP-inspired lower bound on empirical privacy loss, not an e-value: it has no null expectation guarantee of the form $\varepsilon$32, no martingale or test-supermartingale structure, no sequential validity, and no multiplicative betting interpretation (Negoescu et al., 2023).

A second neighboring line interprets the differential privacy parameter $\varepsilon$33 in terms of inferential gain rather than e-values. In the metric-DP framework for guessing sensitive attributes, privacy is translated into a cap on additive posterior improvement,

$\varepsilon$34

using Bayes’ rule and the DP likelihood-ratio bound

$\varepsilon$35

This is operationally close to evidence control, but it is not an e-value theory and does not produce safe tests, e-processes, or multiplicative evidence measures (Laud et al., 2019).

The present theory also has explicit limitations. The pure-DP optimal-rate results are for simple-vs-simple testing under pure central $\varepsilon$36-DP; approximate $\varepsilon$37-DP is left open, and exact implementation of the clipped-likelihood-ratio optimizer may be computationally difficult in high dimension. The sequential lower bound is stated for bounded stopping times, and the nearly optimal e-process has startup latency because frequent early releases are noise-dominated (Jacobsen et al., 27 May 2026). The GDP optimality theorem assumes symmetry, log-concavity, and exact budget exhaustion, and the optimality question under the weaker condition $\varepsilon$38 is left open; the net power gain over the non-private baseline holds in a low-sensitivity regime and is not a universal dominance theorem (Kuang et al., 28 May 2026). The general RDP framework requires a usable bound on $\varepsilon$39, the biased Laplace mechanism is only available when $\varepsilon$40, and confidence-interval constructions over infinite parameter families require discretization and local Lipschitz control (Csillag et al., 21 Oct 2025).

Taken together, these results establish a coherent modern picture. Differentially private e-values are not merely private releases of preexisting evidence statistics. They are mechanisms designed so that privacy acts on the log evidence while validity survives on the original scale, either through biased multiplicative perturbation, clipped-likelihood-ratio geometry, or Gaussian tradeoff calibration. The main technical themes—bounded log-sensitivity, multiplicative shrinkage, exact null-expectation control, and privacy-aware evidence accumulation—now form the core of the subject (Csillag et al., 21 Oct 2025, Jacobsen et al., 27 May 2026, Kuang et al., 28 May 2026).