Privacy Central Limit Theorem

• Privacy Central Limit Theorem is a framework that defines the asymptotic trade-offs between privacy and accuracy in differential privacy, using universal limits like Gaussian Differential Privacy.
• Empirical evidence shows add-noise mechanisms converge to predicted ROC curves, with finite-sample errors diminishing at an O(n⁻¹ᐟ²) rate in high dimensions.
• The theorem establishes constant-sharp optimality of the Gaussian mechanism and delineates regime transitions to Poisson or non-Gaussian limits, especially in shuffle models.

The Privacy Central Limit Theorem (PCLT) characterizes the asymptotic privacy-accuracy trade-offs of differentially private mechanisms, revealing universal limiting behaviors of privacy guarantees and optimality of noise mechanisms, particularly in high-dimensional or large-sample regimes. First established in the context of differentially private query answering and later extended to the shuffle model of privacy, the PCLT provides rigorous limit theorems—often in the Gaussian, Poisson, or compound-Poisson universality classes—for the privacy trade-off curves, quantified by the receiver-operating-characteristic (ROC) or “trade-off” function. This theory formalizes when the mechanisms’ privacy properties, under suitable conditions, become tightly described by Gaussian Differential Privacy (GDP) or non-Gaussian analogues, and proves constant-sharp optimality for the Gaussian mechanism in the appropriate regime (Dong et al., 2021, Shvets, 10 Mar 2026).

1. Gaussian Differential Privacy and Trade-off Functions

Classical $(\epsilon,\delta)$-differential privacy (DP) guarantees are reinterpreted via hypothesis testing: for a mechanism $M$ and neighboring datasets $D, D'$, the ROC or trade-off function $T[M(D), M(D')](\alpha)$ specifies the minimal type-II error for tests at level $\alpha$. Gaussian Differential Privacy (GDP) replaces the generic $(\epsilon,\delta)$ ROC curve with $G_\mu$, the ROC for distinguishing two $N(0,1)$ and $N(\mu,1)$ distributions, yielding a privacy parameter $\mu$. A mechanism is said to achieve $\mu$-GDP if for all neighbors, its trade-off function dominates $G_\mu$, which is equivalent to being at least as private as adding $N(0,1/\mu^2)$ noise to any unit-sensitivity query (Dong et al., 2021).

2. High-Dimensional CLT Regime for Add-Noise Mechanisms

Consider add-noise mechanisms for a query $f: D \to \mathbb{R}^n$ with $\ell_2$-sensitivity $1$, of form $M(D) = f(D) + tX$, where $X$ has a smooth, log-concave density $p(x) \propto \exp\{-\phi(x)\}$ with normalized Fisher information $I_\phi = \mathrm{Id}$. The Privacy CLT establishes that if $\phi$ satisfies mild regularity—specifically, (D1) the log-likelihood increment along a random direction concentrates to a linear form, and (D2) the gradient norm concentrates to $\sqrt{n}$—then as $n \to \infty$, for almost every sensitivity-1 direction, the ROC curve $T[M(D), M(D')]$ converges uniformly to $G_1$. Moment-generating bounds (Berry–Esseen/Edgeworth-type theorems for log-concave projections) yield finite-$n$ errors of $O(n^{-1/2})$ (Dong et al., 2021). Distributions of the form $\exp(-\|x\|_p^\alpha)$ satisfy these conditions.

3. Uncertainty Principle and Constant-Sharp Optimality

A central result derived from the multivariate Cramér–Rao inequality is an "uncertainty principle" for privacy mechanisms: for add-noise mechanisms viewed as $\mu$-GDP, the product $\mu^2 \cdot \mathrm{Err}(M)$ of privacy parameter squared and $\ell_2$-loss is at least the dimension $n$, i.e., $\mu^2 \cdot \mathrm{Err}(M) \geq n$ (where $\mathrm{Err}(M) = \mathbb{E}[\|tX\|_2^2]$). Equality is obtained precisely for the spherical Gaussian mechanism. No heavy-tailed or sharper noise from the family $\exp(-\|x\|_p^\alpha)$ can surpass this bound for loss-privacy trade-off in high dimensions, establishing constant-sharp optimality of the Gaussian mechanism within the GDP regime (Dong et al., 2021).

4. Non-Gaussian Limiting Regimes in the Shuffle Model

The PCLT extends beyond the add-noise regime to shuffle models of privacy, where privacy amplification and non-Gaussian effects arise. Depending on the scaling of the per-user local privacy parameter $\varepsilon_0(n)$ and collection size $n$, three limiting regimes obtain (Shvets, 10 Mar 2026):

Regime	Limiting Experiment Type	Privacy Curve Limit
Sub-critical	Gaussian/GDP: $$(\mathcal{N}(0, \sigma^2), \mathcal{N}(\mu, \sigma^2))$$	Uniform convergence to GDP
Critical	-- Poisson-shift for canonical pairs; <br>-- Skellam-shift for proportional compositions; <br>-- Multivariate compound-Poisson for finite alphabets	Pointwise/series-form Poisson/Skellam curve with explicit TV bounds
Super-critical	No privacy: total variation $\to 1$	Trivial trade-off $(\delta\to1)$

In the critical regime, explicit formulas are provided for the limiting privacy curves (e.g., Poisson/Skellam/compound-Poisson), with total variation convergence at $O(n^{-1})$ rates. The phase diagram is governed by $a_n = e^{\varepsilon_0(n)}/n$ and the proportion $\pi$ of composition; all limiting experiments are in Le Cam distance (Shvets, 10 Mar 2026).

5. Numerical Evidence and Empirical Convergence

Empirical results corroborate rapid convergence of empirical ROC curves to the predicted limits. For $n \gtrsim 30$, ROC curves for $\ell_1$-norm (Laplace-type), $\ell_2$-norm (Gaussian), and truncated-Laplace noises converge quickly to $G_1$, with Kolmogorov–Smirnov distances shrinking as $n$ grows, confirming the CLT phenomenon and validating GDP as the correct asymptotic privacy measure (Dong et al., 2021). In the shuffle model, explicit bounds confirm convergence of finite-sample privacy curves to the series-form Poisson/Skellam limits, justifying regime-based phase diagrams (Shvets, 10 Mar 2026).

6. Consequences and Scope of the Privacy Central Limit Theorem

The PCLT unifies the understanding of asymptotic privacy-accuracy tradeoffs under various mechanism models, replacing the multitude of potential privacy curves with universal limiting shapes—GDP in the Gaussian regime, and Poissonian/Skellam/compound-Poisson in universality-breaking regimes. The constant-sharp optimality of the Gaussian mechanism, the explicit lower bounds from Cramér–Rao, and the rigorous convergence of privacy-tradeoff curves under high-dimensional or large-sample scaling enable both principled privacy mechanism design and sharp lower bounds in practical deployments. These results also clarify the boundaries where privacy guarantees change universality class, identifying conditions where no non-Gaussian mechanism can outperform Gaussian noise for privacy-utility trade-off, and specifying where new (Poisson-type) phenomena emerge when classical Lindeberg conditions fail (Dong et al., 2021, Shvets, 10 Mar 2026).