Interactive Differential Privacy

• Interactive differential privacy is a framework that ensures adaptive, online query responses maintain privacy through dynamic noise injection and careful privacy accounting.
• Mechanisms like the median mechanism and Sparse Vector Technique optimize the use of privacy budgets while accurately answering repeated queries.
• Recent advances explore the benefits of sequential and concurrent interactivity in improving statistical rates and practical system deployment.

Searching arXiv for recent and foundational papers on interactive differential privacy to ground the encyclopedia entry. Interactive differential privacy denotes differential privacy guarantees for protocols in which outputs are produced through interaction rather than a single release. In one formulation, an interactive differentially private mechanism is an algorithm that allows an analyst to adaptively ask queries about a sensitive dataset, and privacy is defined over the analyst’s full transcript or view: for adjacent datasets $x,x'$, every adversary $A$, and every measurable set $T$, $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$ (Vadhan et al., 2021). In local differential privacy, interaction means that each individual’s randomized response may depend not only on their own data $X_i$, but also on previously released sanitized messages $Z_1,\dots,Z_{i-1}$, yielding sequentially interactive or fully interactive protocols (Butucea et al., 2020, Joseph et al., 2019). The topic therefore spans adaptive query answering, local privacy protocols for estimation and testing, concurrent composition under adversarial interleaving, and system-level verification and deployment (0911.1813, Tschantz et al., 2011).

1. Formal models and problem formulations

A basic distinction is between non-interactive and interactive mechanisms. In the non-interactive setting, a mechanism is a one-shot randomized algorithm that takes a dataset and outputs a single result. In the interactive setting, queries arrive online, one by one, and an adversary may adaptively choose the next query based on previous answers. This distinction appears both in query-release systems for a centralized dataset and in local differential privacy, where each user privatizes their own datum before release (0911.1813, Butucea et al., 2020).

For repeated-query systems, the starting point is the standard differential privacy condition

$$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$

for neighboring datasets $D,D'$ differing in one record. The query sensitivity

$$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$

determines how much noise must be added. In frequent-query settings, every query answered with differential privacy consumes privacy budget, and the cost accumulates even if the same query is asked repeatedly; this can lead to privacy budget exhaustion and higher privacy leakage risk (Han et al., 2020).

In local differential privacy, the privacy constraint is imposed on each local randomization channel. One standard form is

$$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$

with $A$0. A channel is $A$1-sequentially interactive if it factorizes as

$A$2

and each conditional mechanism satisfies the same local privacy bound uniformly over previous sanitized outputs. This is a strict superset of non-interactive channels, which have product form $A$3 (Butucea et al., 2020).

A further distinction arises within local protocols. Sequentially interactive protocols may query users adaptively in sequence, but they cannot return to previously queried users. Fully interactive protocols may revisit users and query them multiple times adaptively. The separation between these models becomes central when interactivity is studied as a statistical resource rather than only as an implementation detail (Joseph et al., 2019).

2. Adaptive query answering and interactive mechanisms

A canonical interactive mechanism is the median mechanism for arbitrary predicate queries that arrive online. For a database $A$4 over a finite domain $A$5, predicate queries have the form $A$6 with

$A$7

The mechanism distinguishes between easy queries, whose answers are already essentially determined by previous hard-query answers, and hard queries, which still reveal genuinely new information. It maintains a set $A$8 of databases consistent with the hard-query answers seen so far; easy queries are answered by the median answer over $A$9, while hard queries are answered with Laplace noise and then shrink the candidate set. A central combinatorial fact is that among any set of $T$0 predicate queries, only

$T$1

of them are truly hard, yielding privacy cost polylogarithmic in $T$2 rather than linear in $T$3. Relative to fixed accuracy and privacy constraints, this mechanism can answer exponentially more queries than the Laplace mechanism, and the paper also gives an efficient implementation running in time polynomial in the number of queries, the database size, and the domain size (0911.1813).

Another fundamental interactive tool is the Sparse Vector Technique (SVT). In the interactive setting, queries arrive one-by-one and are not all known in advance. SVT is useful because it lets the analyst keep testing incoming queries against a threshold while spending privacy budget mainly on the few queries that are positive. The basic mechanism perturbs the threshold $T$4 by Laplace noise $T$5, perturbs each query answer $T$6 by noise $T$7, compares $T$8 to $T$9, and stops after at most $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$0 positive answers. The authors’ correct variant uses threshold noise scale $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$1, query noise scale $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$2, and total privacy budget $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$3, proving $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$4-DP. A major contribution of the same work is a systematic demonstration that many published SVT variants are not private, due to errors such as refreshing threshold noise unnecessarily, outputting noisy query values instead of $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$5, omitting the cutoff $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$6, or using too little query noise. The paper also derives an optimal budget allocation rule

$$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$7

with $$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$8 in the monotonic-query setting, and argues that in the non-interactive top-$$\Pr[A\,M(x)\in T] \le e^\varepsilon \Pr[A\,M(x')\in T] + \delta$$9 selection setting the Exponential Mechanism is more accurate than SVT (Lyu et al., 2016).

A more recent systems-oriented mechanism addresses interactive or repeated queries through reuse of prior noisy outputs. The proposed blockchain-based differential privacy cost management system uses blockchain as a trusted, tamper-proof ledger to store metadata about past differentially private queries and their noisy outputs. The system stores and checks the query type, standard deviation $X_i$0 of the Gaussian noise used, noisy response, privacy cost, remaining privacy budget, and query ID. Its reuse workflow is comparison-based: it computes the required noise level for the new query, searches the blockchain for an existing record with the same query type and same standard deviation, returns the same previously released noisy result if found, and otherwise either fully reuses previous noise or adds only the extra noise needed to reach the desired privacy level. The demo is implemented as an interactive decentralized web application using Bootstrap, Ethereum, MetaMask, Web3.js, Truffle Suite, Provable, MongoDB, and Heroku. The reported finding is qualitative: leveraging blockchain to store and compare noisy outputs significantly decreases the total privacy cost accumulated, but the paper also states that the system is a demo or prototype and does not fully analyze optimal privacy accounting, formal utility guarantees, or the full security and performance overhead of blockchain storage (Han et al., 2020).

3. Statistical gains from sequential interaction under local privacy

A major line of work studies whether interaction changes minimax rates under local differential privacy. For estimating the quadratic functional

$X_i$1

with $X_i$2 in a Besov ball $X_i$3, the non-interactive and sequentially interactive minimax risks differ sharply. Up to logarithmic factors, the non-interactive rate is

$X_i$4

with elbow at $X_i$5, whereas the sequentially interactive rate is

$X_i$6

with elbow at $X_i$7. The interactive estimator uses a two-step scheme: the first half of the sample produces a rough private estimate $X_i$8, and the second half privatizes a transformed statistic based on the linear functional $X_i$9 through a binary randomized response mechanism. The paper emphasizes that this kind of improvement is not typical for many local DP estimation problems such as density estimation or linear functional estimation; here the nonlinear nature of $Z_1,\dots,Z_{i-1}$0 makes interaction fundamentally beneficial (Butucea et al., 2020).

The same phenomenon appears in goodness-of-fit testing for Hölder continuous densities under local differential privacy. For the testing problem $Z_1,\dots,Z_{i-1}$1 versus $Z_1,\dots,Z_{i-1}$2, the non-interactive minimax separation radius behaves, up to logarithmic factors and tail terms, like

$Z_1,\dots,Z_{i-1}$3

whereas the sequentially interactive radius improves to

$Z_1,\dots,Z_{i-1}$4

The non-interactive test uses privatized kernelized statistics and a tail test based on randomized response. The sequentially interactive procedure uses three blocks: the first estimates cell masses $Z_1,\dots,Z_{i-1}$5, the second uses the first block’s estimate to privatize later data adaptively, and the third performs the same tail test. The paper states that the second block is adapted to the estimated sign and magnitude of the discrepancy $Z_1,\dots,Z_{i-1}$6, which yields a better signal-to-noise balance (Dubois et al., 2021).

Interactive local privacy has also been shown to improve nonparametric spectral density estimation for a centered stationary Gaussian time series. For estimating a covariance coefficient $Z_1,\dots,Z_{i-1}$7, the proposed two-stage interactive mechanism first privatizes truncated raw data with Laplace noise and then forms products $Z_1,\dots,Z_{i-1}$8 using previously released private values $Z_1,\dots,Z_{i-1}$9. Under $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$0, the resulting risk bound is

$$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$1

while the paper proves the non-interactive lower bound

$$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$2

For pointwise spectral density estimation, the pointwise rates depend on $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$3 instead of $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$4. The paper stresses that this is especially relevant for correlated time series, where past privatized data contain information about the dependence structure and can be leveraged by a sequentially interactive mechanism (Butucea et al., 1 Apr 2025).

4. Limits of interaction and model-dependent separations

Interactive differential privacy does not yield uniform improvements across all problems or all notions of interaction. A central result in local privacy is that the gap between fully interactive and sequentially interactive protocols is controlled by compositionality. A protocol is $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$5-compositionally private if, for every user $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$6, with probability $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$7 over the transcript,

$$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$8

If a protocol is fully interactive and $$\Pr[Y(D)\in S] \le e^\epsilon \Pr[Y(D')\in S] + \delta$$9-compositional, then it can be transformed into a sequentially interactive protocol with sample complexity $D,D'$0. The paper gives the explicit bounds

$D,D'$1

and, with high probability,

$D,D'$2

The reduction is also tight up to polylogarithmic factors: there exists a family of problems such that, for every $D,D'$3, there is a fully interactive $D,D'$4-compositional protocol solving the problem, while no sequentially interactive protocol can solve the problem without at least a $D,D'$5 factor more examples (Joseph et al., 2019).

The same paper shows that for a broad class of compound hypothesis testing problems, a simple noninteractive test is optimal among the class of all possibly fully interactive tests. In simple hypothesis testing between $D,D'$6 and $D,D'$7, the folklore noninteractive local test succeeds with

$D,D'$8

samples, and this scaling is proved optimal even among fully interactive tests. The compound version extends this noninteractive optimality to convex and compact hypothesis classes separated in total variation (Joseph et al., 2019).

These results align with a more specific observation from quadratic-functional estimation: interaction is statistically valuable for some nonlinear estimation tasks, but such gains are not typical for many local DP estimation problems such as density estimation or linear functional estimation (Butucea et al., 2020). A plausible implication is that the relevance of interaction is highly task-dependent: the presence of nonlinear structure, dependence structure, or non-compositional reuse opportunities is what makes interaction materially useful.

5. Concurrent composition and adaptive privacy accounting

Interactive differential privacy raises a distinct composition question: what happens when several interactive mechanisms are used concurrently and an adversary can arbitrarily interleave queries across them? In the basic concurrent composition model, the adversary may query $D,D'$9, then $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$0, then return to $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$1, with each query depending on responses from all mechanisms. For pure differential privacy, if interactive mechanisms $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$2 are each $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$3-DP, then their concurrent composition is

$$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$4

The proof reduces any pure interactive $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$5-DP mechanism to randomized response: $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$6 For approximate DP, the same paper proves the weaker bound

$$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$7

and explicitly leaves the gap to optimal non-interactive composition as an open problem (Vadhan et al., 2021).

Subsequent work significantly generalizes this picture. One line proves optimal concurrent composition theorems for approximate DP, Rényi DP, zero-concentrated DP, and truncated concentrated DP, with the main message that the adversary gains no advantage by interleaving its queries to independently running mechanisms. For Rényi DP, if each $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$8 is $$\Delta Q = \max_{neighboring\ D,D'} \|Q(D)-Q(D')\|_2$$9-RDP, then

$$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$0

For approximate DP, the concurrent guarantee matches the optimal sequential composition theorem. Another line proves the more general statement that any composition theorem that holds for non-interactive mechanisms also holds for concurrent composition of interactive mechanisms whenever privacy is measured in the hypothesis-testing framework of $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$1-DP. In that framework, $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$2-DP corresponds to the trade-off function

$$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$3

and every interactive $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$4-DP mechanism can be simulated by interactive post-processing of a non-interactive $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$5-DP mechanism (Lyu, 2022, Vadhan et al., 2022).

The adaptive-accounting layer extends these results further. In a more general model, the adversary may interleave queries to existing interactive mechanisms, create new ones on the fly, and choose the privacy-loss parameter of each new mechanism adaptively based on the history so far. The main theorem states that every valid privacy filter and odometer for noninteractive mechanisms extends to the concurrent composition of interactive mechanisms if privacy loss is measured using $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$6-DP, $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$7-DP, or Rényi DP of fixed order. For RDP, the filter and odometer take the especially simple form

$$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$8

An important operational detail is that in the interactive odometer or filter setting, the privacy budget is paid at the launch of each new interactive mechanism, not at each query to an already-running mechanism (Haney et al., 2023).

6. Verification, systems, and unresolved issues

Interactive differential privacy has also been formalized at the system level as differential noninterference. One probabilistic automaton model represents an interactive system as a probabilistic labeled transition system $$\sup_{A}\sup_{x,x':\,d_0(x,x')=1}\frac{Q(A\mid x)}{Q(A\mid x')}\le e^\alpha,$$9 with input partition $A$00, output partition $A$01, and examiner-observable actions

$A$02

The interactive privacy condition compares observable trace prefixes under input sequences differing by insertion of one data point. If inputs differ by $A$03 data points, the privacy loss scales to $A$04. The main proof method is an $A$05-unwinding family, a relation family indexed by remaining privacy budget, together with an approximate lifting condition between successor distributions. A refinement theorem shows that replacing an abstract hidden transition by a subroutine automaton preserving the same terminal-state distribution does not change observable behavior. In the PINQ-like example, bounded memory causes extra leakage, so the privacy loss becomes $A$06 rather than $A$07 (Tschantz et al., 2011).

This verification perspective complements deployment-oriented work. The adaptive-accounting results explicitly connect to OpenDP and Tumult Analytics, where interactive mechanisms are core abstractions. OpenDP uses queryables, represented as interactive state machines; an odometer is a queryable that can be asked for current privacy loss, and a filter is a queryable that refuses further queries if budget would be exceeded. Tumult restricts interleaving queries across queryables to avoid concurrent composition. The theoretical results suggest that these restrictions are unnecessary for privacy, and the stated practical benefits include less code complexity, better auditability, more exploratory workflows, the ability to interleave queries across multiple analyses, and support for parallel composition without forcing users to artificially serialize their code (Haney et al., 2023).

Several caveats remain important. The blockchain-based repeated-query system is presented as a demo or prototype, not a fully quantified theoretical system; it does not fully analyze optimal privacy accounting under reuse, formal utility guarantees, full security and performance overhead of blockchain storage, or the exact quantification of privacy reduction. The formal-verification framework is sound but not complete, applies only to a restricted class of relation families, assumes finite state space, and does not synthesize candidate relations automatically (Han et al., 2020, Tschantz et al., 2011). More broadly, the literature shows both that interactivity can be strictly beneficial and that it can be “free” under concurrent composition. These are distinct claims: the first concerns statistical or operational power, while the second concerns privacy accounting under composition. The current body of work suggests that interactive differential privacy is best understood not as a single technique, but as a family of models and mechanisms whose significance depends on whether the objective is adaptive query answering, locally private inference, concurrent composition, or verifiable system design.