Output Differential Privacy (ODP)

• Output Differential Privacy (ODP) refines traditional differential privacy by quantifying privacy loss specific to each output cell, providing a posteriori guarantees.
• ODP tracks the consumed privacy budget based on observed outcomes, improving the privacy-utility trade-off in mechanisms like sparse vector techniques and early stopping.
• ODP extends to function-valued outputs and quantum settings, offering practical applications from kernel-based estimators to privacy-preserving quantum noise analysis.

Output Differential Privacy (ODP) is a refined privacy framework that captures the dependence of privacy loss on the specific output of a randomized mechanism, in contrast to traditional (ε, δ)-differential privacy (DP), which quantifies privacy leakage uniformly over all possible outputs. ODP enables output-specific privacy accounting, yielding a posteriori (ex post) guarantees that can provide substantially improved privacy-utility trade-offs, particularly in applications involving iterative, adaptive, or early-stopping mechanisms (Hartmann et al., 2022). The ODP paradigm generalizes naturally to function-valued outputs (Hall et al., 2012) and has been extended to quantum information settings (Hirche et al., 2022).

1. Mathematical Formulation of Output Differential Privacy

Let $M\colon\mathcal D\to\mathcal O$ be a randomized mechanism over a database domain $\mathcal D$ and an output space $\mathcal O$. Output Differential Privacy distributes the privacy guarantee across a partition of the output space.

Definition (ODP): Given a countable partition $\mathcal P = \{P_k\}_{k \in \mathcal K}$ of $\mathcal O$, an assignment $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$, and $\delta \ge 0$, $M$ is $(\mathcal P,\mathcal E,\delta)$-ODP if: $$\forall x \sim x', \forall S \subseteq \mathcal O:\ \Pr[M(x)\in S] \le \delta + \sum_{k\in \mathcal K} e^{\mathcal E(P_k)}\,\Pr[M(x') \in S \cap P_k]$$ Whenever $\mathcal D$0 lands in cell $\mathcal D$1, $\mathcal D$2 quantifies the actual privacy loss incurred (Hartmann et al., 2022). If $\mathcal D$3, ODP specializes to standard $\mathcal D$4-DP.

Two foundational equivalences hold:

• DP ⇒ trivial ODP: Any $\mathcal D$5-DP mechanism is $\mathcal D$6-ODP for all partitions $\mathcal D$7.
• ODP ⇒ DP: If $\mathcal D$8 is $\mathcal D$9-ODP, then $\mathcal O$0 is $\mathcal O$1-DP.

2. A Posteriori Privacy Analysis and Composition

ODP provides a principled framework for a posteriori privacy accounting: after producing an output in a specific cell $\mathcal O$2, only $\mathcal O$3 privacy cost is consumed in that execution. This facilitates ex post privacy guarantees sharper than the worst-case budget.

Composition Mechanism: In sequential algorithms, each DP mechanism $\mathcal O$4 is equipped with a (possibly non-uniform) ODP partition $\mathcal O$5. The ODP composition process tracks the running privacy budget $\mathcal O$6 by subtracting only the $\mathcal O$7 corresponding to the observed output (Hartmann et al., 2022). The following holds:

• For any sequence of $\mathcal O$8 mechanisms and any adversary, the entire process satisfies $\mathcal O$9-DP, where $\mathcal P = \{P_k\}_{k \in \mathcal K}$0 and $\mathcal P = \{P_k\}_{k \in \mathcal K}$1 are the total budgets.

In practical terms, when outputs such as $\mathcal P = \{P_k\}_{k \in \mathcal K}$2 ('no answer') are observed (as in Propose-Test-Release or early stopping in iterative algorithms), the consumed privacy budget can be much less than the maximum possible, allowing subsequent mechanisms to benefit from the saved budget.

3. ODP in Classical Mechanisms: Instantiations and Utility

ODP is especially advantageous in DP mechanisms with variable-length outputs, aborts, or significant output heterogeneity. Canonical examples:

• Sparse Vector Technique (SVT): Using ODP, an allocation where $\mathcal P = \{P_k\}_{k \in \mathcal K}$3 is charged for negatives and $\mathcal P = \{P_k\}_{k \in \mathcal K}$4 per positive gives an exact ex post accounting: for $\mathcal P = \{P_k\}_{k \in \mathcal K}$5 positives, unspent budget can be redirected or used to reduce noise in subsequent releases.
• Propose-Test-Release (PTR): When the mechanism returns $\mathcal P = \{P_k\}_{k \in \mathcal K}$6, only the privacy loss for the test is charged, not the full round-trip.
• Iterative Early-Termination: For learning and optimization loops halted early based on privatized criteria, the ODP partition aligns with possible stopping patterns, yielding tight a posteriori $\mathcal P = \{P_k\}_{k \in \mathcal K}$7 bounds.
• ML with Utility-Based Early Stopping: Training a model under DP and releasing parameters only if a privatized validation error passes a threshold saves privacy cost whenever the release is aborted, permitting reduced noise in further queries (Hartmann et al., 2022).

Comparison with Composition Theorems: Unlike standard or advanced composition, which apply uniform worst-case bounds or asymptotic improvements (e.g., $\mathcal P = \{P_k\}_{k \in \mathcal K}$8 growth for $\mathcal P = \{P_k\}_{k \in \mathcal K}$9 mechanisms), ODP tracks realized privacy loss per run, yielding strictly tighter accounting in non-asymptotic or moderate-scale settings.

4. ODP for Functions and Infinite-Dimensional Outputs

In function-valued output settings, such as the release of estimated functions, ODP is operationalized via mechanisms providing $\mathcal O$0-DP guarantees with respect to cylinder events of function evaluations. The key approach is to add a Gaussian process $\mathcal O$1 calibrated to the global sensitivity $\mathcal O$2 in the reproducing kernel Hilbert space (RKHS) norm:

$\mathcal O$3

with $\mathcal O$4.

For any finite evaluation tuple $\mathcal O$5, the privatized function evaluated at these points is distributed as

$\mathcal O$6

Applications include kernel density estimation and regularized empirical risk minimizers (e.g., kernel SVMs), achieving optimal minimax statistical rates while providing function-valued ODP (Hall et al., 2012).

5. Quantum Output Differential Privacy

In quantum settings, ODP is characterized in terms of output-state divergences. For a quantum channel $\mathcal O$7, (ε, δ)-differential privacy holds if for every pair of neighboring states $\mathcal O$8 and for every POVM element $\mathcal O$9,

$\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$0

This is equivalently expressed using the quantum hockey-stick divergence: $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$1 with ODP holding iff $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$2 (Hirche et al., 2022). In quantum noisy circuits, this facilitates tracking the contraction of distinguishability under layered noise and enables output-state-based DP analysis, bypassing the need to consider all measurement post-processings separately.

6. Limitations, Open Questions, and Extensions

ODP offers significant practical improvements but introduces technical and conceptual challenges:

• Optimality and Computation: Computing the tightest a posteriori $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$3 in complex iterative settings is $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$4-hard in general; there is ongoing investigation into efficient approximations and tractable special cases.
• Advanced Composition: While simple composition theorems extend naturally to ODP, establishing non-linear 'root-$\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$5' advanced composition analogues for ODP remains open (Hartmann et al., 2022).
• Measurability in Infinite/Continuous Output Spaces: Extending ODP to uncountable partitions necessitates careful handling of analytic and measurability issues, resolved in certain formalizations for countable cases.
• Lower Bounds and Function Spaces: In function-valued cases, sharp lower bounds on necessary noise for $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$6 remain open, and interactions with data-dependent bandwidth selection in nonparametric statistics require additional mechanisms (e.g., the exponential mechanism) (Hall et al., 2012).

7. Impact and Ongoing Research Directions

ODP establishes a flexible unification for output-centric privacy analysis across the spectrum of mechanisms, from classical simple algorithms (SVT, PTR) to function-space estimators and quantum channels. Empirical evidence demonstrates improved privacy-utility outcomes in moderate-scale compositions, with the ability to outpace even advanced composition for small $\mathcal E:\mathcal P \to \mathbb R_{\ge 0}$7 or high-probability aborts (Hartmann et al., 2022).

Recent work extends ODP's optimization perspective using distributionally robust optimization for DP mechanism design, enabling explicit noise mechanisms with certified optimality gaps (Selvi et al., 2023). Research in quantum ODP elucidates the interplay between algorithmic noise and intrinsic quantum noise, establishing windows for privacy in near-term noisy hardware (Hirche et al., 2022).

Open research areas include efficiently computable advanced ODP composition, formal ODP for continuous outputs, and ODP in multi-party or federated contexts, as well as applications in high-dimensional learning and privacy-preserving quantum algorithms.