Poisson Private Representation (PPR)

• PPR is a stochastic coding method that converts a differentially private mechanism into a randomized index using a Poisson process and shared randomness.
• It preserves the exact conditional distribution of the original mechanism, ensuring that statistical properties and privacy guarantees (such as ε-DP) are maintained.
• The step-limited extension offers a practical trade-off by introducing finite runtime and controlled error for applications like distributed mean estimation and diffusion-based private compression.

Searching arXiv for the core PPR papers and closely related uses of the term. Poisson Private Representation (PPR) is a stochastic coding construction for compressing and simulating a differential privacy mechanism from shared randomness while retaining a formal privacy guarantee for the transmitted codeword. In the formulation introduced in "Universal Exact Compression of Differentially Private Mechanisms" (Liu et al., 2024), PPR converts a mechanism $P_{Z\mid X}$ into a random integer index $K$ such that the decoder-side reconstruction has exactly the same conditional law as the original mechanism. In the later step-limited extension used by DP-DiPP, exactness is relaxed to controlled total-variation error in exchange for finite, tunable runtime, which makes the construction usable inside diffusion-based compression pipelines (Flamich et al., 3 Jul 2026).

1. Formal construction

PPR is defined for a conditional distribution $P_{Z\mid X}$ together with a proposal distribution $Q$ satisfying $P_{Z\mid X}(\cdot\mid X)\ll Q$ almost surely. The encoder and decoder share an infinite iid sequence $Z_i\sim Q$ and a unit-rate Poisson process $(T_i)_i$. For fixed input $X=x$, writing $P:=P_{Z\mid X}(\cdot\mid x)$, the transformed arrival times are

$$\tilde T_i := T_i\cdot \left(\frac{dP}{dQ}(Z_i)\right)^{-1}.$$

Classical Poisson functional representation would select $K$0, but that deterministic choice is not private. PPR instead randomizes the index selection: for parameter $K$1,

$K$2

The decoder outputs the shared candidate indexed by $K$3. An equivalent implementation introduces iid $K$4 and uses

$K$5

where $K$6 (Liu et al., 2024).

The construction is called "Poisson" because it is built from a Poisson point process over proposal samples and arrival times, and it is called a "representation" because the communicated object is not the mechanism output itself but an index that, together with shared randomness, reproduces the mechanism. The 2026 diffusion-compression paper recasts the same idea as a stochastic code $K$7 satisfying exact simulation

$K$8

and identifies PPR as the coding primitive that makes the transmitted message itself privacy-preserving rather than merely the reconstructed output (Flamich et al., 3 Jul 2026).

2. Exactness, privacy, and coding efficiency

The defining property of exact PPR is distribution preservation: $K$9 equivalently,

$P_{Z\mid X}$0

This distinguishes PPR from approximate channel simulation schemes. Because the channel itself is preserved, statistical properties of the original mechanism are preserved as well. The 2024 paper emphasizes unbiasedness, Gaussianity, and exact summability or infinite divisibility of the noise as examples of properties retained under exact PPR (Liu et al., 2024).

The privacy point is subtler. In ordinary stochastic coding, the transmitted message is not generally a post-processing of the private release; the encoder message sits in the Markov chain

$P_{Z\mid X}$1

so naive compression of a private mechanism can destroy the original privacy certificate. PPR is designed precisely to avoid that failure mode. If $P_{Z\mid X}$2 is $P_{Z\mid X}$3-differentially private, then PPR with parameter $P_{Z\mid X}$4 is $P_{Z\mid X}$5-differentially private. If $P_{Z\mid X}$6 is $P_{Z\mid X}$7-DP, then PPR is $P_{Z\mid X}$8-DP. If $P_{Z\mid X}$9 satisfies metric privacy with parameter $Q$0, then PPR satisfies $Q$1-privacy. A tighter approximate-DP theorem is also proved, giving $Q$2-DP under an explicit condition relating $Q$3, $Q$4, and $Q$5 (Liu et al., 2024).

Communication efficiency is analyzed through the index $Q$6. The information-theoretic lower bound is

$Q$7

PPR achieves

$Q$8

and with the canonical choice $Q$9,

$P_{Z\mid X}(\cdot\mid X)\ll Q$0

After prefix-free integer coding, Huffman coding yields at most

$P_{Z\mid X}(\cdot\mid X)\ll Q$1

bits, so the scheme is within a logarithmic gap of the lower bound. This is the basis for the paper’s description of PPR as a universal exact compressor for DP mechanisms (Liu et al., 2024).

3. Step-limited PPR and finite-runtime approximation

Exact PPR is not primarily limited by communication; it is limited by runtime. The 2024 paper gives an exact terminating algorithm, but its encoding runtime scales as

$P_{Z\mid X}(\cdot\mid X)\ll Q$2

and the 2026 extension observes that the expected runtime is at least

$P_{Z\mid X}(\cdot\mid X)\ll Q$3

which can be extremely large or even infinite for diffusion-model conditionals with unbounded density ratios (Liu et al., 2024, Flamich et al., 3 Jul 2026).

To address that obstacle, the 2026 paper introduces step-limited PPR. With $P_{Z\mid X}(\cdot\mid X)\ll Q$4, coding distribution $P_{Z\mid X}(\cdot\mid X)\ll Q$5, density ratio

$P_{Z\mid X}(\cdot\mid X)\ll Q$6

shared randomness $P_{Z\mid X}(\cdot\mid X)\ll Q$7, and private encoder randomness $P_{Z\mid X}(\cdot\mid X)\ll Q$8, the step-limited index is

$P_{Z\mid X}(\cdot\mid X)\ll Q$9

The encoder sends $Z_i\sim Q$0, and the decoder returns $Z_i\sim Q$1. This truncates the infinite search to the first $Z_i\sim Q$2 Poisson points and yields finite, controllable runtime (Flamich et al., 3 Jul 2026).

The main theorem of the extension has three components. First, if the encoded mechanism is pure $Z_i\sim Q$3-LDP, then $Z_i\sim Q$4 is $Z_i\sim Q$5-LDP. Second, the expected codelength obeys the same form of upper bound as exact PPR. Third, if $Z_i\sim Q$6 denotes the decoded step-limited distribution, then choosing

$Z_i\sim Q$7

guarantees

$Z_i\sim Q$8

The comparison theorem

$Z_i\sim Q$9

makes the approximation error directly interpretable as the tail probability of the exact PPR index. This converts PPR from an exact but potentially impractical stochastic code into an approximate code with explicit privacy, codelength, and total-variation guarantees (Flamich et al., 3 Jul 2026).

4. Applications

The first major application is communication-efficient private inference. In distributed mean estimation, PPR can exactly compress local randomizers such as $(T_i)_i$0 and the Gaussian mechanism. Because the reconstructed output is exactly distributed as the original mechanism, the estimator inherits the same MSE and the same central-DP accounting as the underlying mechanism, while the communicated representation additionally satisfies a local-DP guarantee. The 2024 paper uses this to derive new communication-accuracy-central-DP-local-DP trade-offs, and empirically reports that PPR consistently achieves smaller MSE than the coordinate subsampled Gaussian mechanism in its experimental regime (Liu et al., 2024).

The second major application is diffusion-based private compression. The 2026 paper argues that naive stochastic compression of a private mechanism can destroy privacy because the codeword is not a post-processing of the mechanism output. DP-DiPP therefore uses step-limited PPR as the compression layer. Each reverse denoising step is treated as a privacy mechanism, but because Gaussian denoising channels are not pure $(T_i)_i$1-LDP and exact PPR is problematic when target and proposal are Gaussians with the same variance but different means, the paper replaces Gaussian targets and proposals by moment-matched Laplace distributions and then encodes those channels with step-limited PPR (Flamich et al., 3 Jul 2026).

Within DP-DiPP, PPR upgrades each compressed denoising step to a code-level guarantee of $(T_i)_i$2-LDP per pixel, and sequential composition yields

$(T_i)_i$3

The paper also interprets original non-private DiffC as the $(T_i)_i$4 limit, which maximizes compression efficiency but provides no privacy guarantee. Empirically, on privatized image classification on CIFAR-10, DP-DiPP achieves comparable privacy guarantees and utility using about $(T_i)_i$5–$(T_i)_i$6 of the bits of the privatize-then-compress baseline, i.e. $(T_i)_i$7 better compression. The same study reports that moving from Gaussian DiffC to the private Laplace-$(T_i)_i$8 variant produces only a negligible utility drop while roughly doubling the bitrate, matching the paper’s KL-based analysis (Flamich et al., 3 Jul 2026).

5. Terminological disambiguation

The acronym PPR is overloaded, and the Poisson-privacy meaning is not the only established use. In "Differentially Private Graph Learning via Sensitivity-Bounded Personalized PageRank" (Epasto et al., 2022), PPR means Personalized PageRank rather than Poisson Private Representation. That paper studies bounded-sensitivity graph diffusion and downstream private ranking, node classification, and embedding, and it explicitly states that its contribution is not a new object called "Private Representation (PPR)" but a method for privatizing Personalized PageRank itself (Epasto et al., 2022).

PPR should also be distinguished from Poisson-space representation theorems in stochastic analysis. "Poisson imbedding meets the Clark-Ocone formula" develops what it calls the Pseudo-Clark-Ocone representation

$(T_i)_i$9

with a pathwise predictable integrand against the uncompensated Poisson measure. That paper is directly relevant only if "representation" is meant in the sense of a Poisson functional representation formula; it explicitly does not provide any notion of "private" representation in the privacy or cryptographic sense (Hillairet et al., 2024). Likewise, the earlier Clark-Ocone paper on Poisson processes proves the compensated representation

$X=x$0

again in the sense of martingale representation rather than privacy-preserving coding (Last et al., 2010).

A further, unrelated use of "Poisson" and "representation" occurs in noncommutative geometry. "Noncommutative Poisson structures, derived representation schemes and Calabi-Yau algebras" studies Poisson brackets on cyclic homology and their induced Poisson structures on representation schemes. This is representation-theoretic geometry rather than stochastic coding or differential privacy (Berest et al., 2012). The shared vocabulary can obscure the fact that Poisson Private Representation, in the modern DP literature, denotes a channel-simulation code built from Poisson-process randomness rather than a Poisson bracket, a PageRank vector, or a Clark-Ocone-type formula.

6. Limitations and outlook

The principal limitation of exact PPR is runtime. The 2024 paper stresses that although communication is near-optimal, runtime can be high because the index $X=x$1 may be exponentially large in the mutual information, and exact general channel simulation is hard even without privacy. The method also requires shared randomness or a shared seed and a proposal distribution $X=x$2 dominating the target conditionals (Liu et al., 2024).

Step-limited PPR alleviates but does not eliminate the computational burden. The 2026 extension is explicit that even though the approximation theorem improves over the dependence on $X=x$3, the runtime still has to be

$X=x$4

which can remain prohibitively expensive for practical privacy mechanisms. The theorem is also restricted to pure $X=x$5-LDP mechanisms; the diffusion application therefore works around Gaussian channels by replacing them with moment-matched Laplace mechanisms rather than giving a direct PPR theorem for Gaussian or $X=x$6-LDP channels (Flamich et al., 3 Jul 2026).

These limitations suggest a precise research direction rather than a conceptual weakness. PPR is most compelling when exact or near-exact simulation matters, when preservation of the original mechanism’s law is itself valuable, and when the mechanism can be factorized into low-divergence components so that coding becomes tractable. This suggests why PPR appears naturally in distributed mean estimation and in diffusion path decompositions: both settings create strong incentives to preserve the original randomizer exactly or almost exactly while transmitting much less information than the raw privatized output.