Relaxed-Privacy Model

• Relaxed-privacy model is a framework where privacy is intentionally weakened and parameterized through metrics like (ε, δ) to balance protection and utility.
• It applies controlled relaxations in settings such as differential privacy, private query answering, and text sanitization to maintain system functionality.
• The model relies on explicit quantitative methods, including Bayesian semantics and variational formulations, to manage privacy-utility tradeoffs.

A relaxed-privacy model denotes a formulation in which privacy is weakened, parameterized, or conditionally enforced so that utility, tractability, or system functionality can be preserved. In one foundational use, the relaxed-privacy model is $(\varepsilon,\delta)$-differential privacy, where output distributions on neighboring databases are multiplicatively close up to an additive slack $\delta$, and where the semantic meaning of this relaxation is given through Bayesian posterior closeness (0803.3946). In later work, the same phrase is also used for tunable privacy-utility tradeoffs in model serving, private query answering, text sanitization, local learning, and knowledge-based system analysis (Wang et al., 2020, Sánchez et al., 2017, Su et al., 2022, Rehms et al., 2024).

1. Differential privacy as the canonical relaxed-privacy model

In the classical formulation, databases are vectors $D \in \mathcal{D}^n$, and neighboring databases $D,D' \in \mathcal{D}^n$ differ in at most one entry. Pure differential privacy requires that for all neighboring databases and all subsets of outputs $S$,

$$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$

The relaxed-privacy model studied explicitly in the Bayesian semantics paper is $(\varepsilon,\delta)$-differential privacy: $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$ Because the condition is symmetric, the output distributions on neighboring databases are multiplicatively close by a factor $e^\varepsilon$ up to an additive slack $\delta$ (0803.3946).

The role of the two parameters is distinct. The parameter $\delta$0 controls multiplicative closeness and therefore the “normal” behavior of the mechanism. The parameter $\delta$1 allows a small probability of “bad” events: with probability at most $\delta$2, the output distribution may violate the multiplicative bound, possibly revealing more about a person’s data. Outside this $\delta$3-fraction of exceptional outcomes, privacy behaves like pure $\delta$4-differential privacy. The paper therefore treats $\delta$5-differential privacy as a relaxed-privacy model: slightly weaker than pure $\delta$6-DP, but often easier to achieve, especially with practical mechanisms such as Gaussian noise (0803.3946).

This formulation already fixes two enduring themes of later relaxed-privacy work. First, privacy is not abandoned; it is weakened in a controlled way. Second, the relaxation is explicit and quantitative rather than informal. In the differential privacy setting, that quantification is given directly by $\delta$7 and $\delta$8 (0803.3946).

2. Bayesian semantics and parameter translation

The central semantic interpretation is Bayesian. The adversary has a prior belief $\delta$9 on databases,

$D \in \mathcal{D}^n$0

After observing a transcript $D \in \mathcal{D}^n$1, the posterior under the real mechanism $D \in \mathcal{D}^n$2 is

$D \in \mathcal{D}^n$3

To formalize “whether or not my data is included,” the paper defines $D \in \mathcal{D}^n$4 by replacing the $D \in \mathcal{D}^n$5-th entry with a fixed default value $D \in \mathcal{D}^n$6, and defines the corresponding posterior

$D \in \mathcal{D}^n$7

Privacy is then evaluated through the statistical difference

$D \in \mathcal{D}^n$8

An algorithm is $D \in \mathcal{D}^n$9-semantically private if for all priors $D,D' \in \mathcal{D}^n$0, all transcripts $D,D' \in \mathcal{D}^n$1, and all individuals $D,D' \in \mathcal{D}^n$2,

$D,D' \in \mathcal{D}^n$3

This formulation makes “arbitrary side information” precise, because the prior $D,D' \in \mathcal{D}^n$4 is unrestricted (0803.3946).

For pure differential privacy, the paper proves an equivalence up to constants. For all $D,D' \in \mathcal{D}^n$5, $D,D' \in \mathcal{D}^n$6-differential privacy implies $D,D' \in \mathcal{D}^n$7-semantic privacy with

$D,D' \in \mathcal{D}^n$8

For $D,D' \in \mathcal{D}^n$9, $S$0-semantic privacy implies $S$1-differential privacy. This gives a formal version of the slogan that differential privacy protects against adversaries with arbitrary side information (0803.3946).

The relaxed case has an analogous semantic formulation. An algorithm is $S$2-semantically private if, for all priors $S$3, with probability at least $S$4 over $S$5, where $S$6, and for all individuals $S$7,

$S$8

The main theorem states that if

$S$9

then $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$0-differential privacy implies $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$1-semantic privacy on databases of size $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$2, where

$$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$3

The converse also holds up to constants: if $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$4 and $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$5, then $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$6-semantic privacy implies $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$7-differential privacy (0803.3946).

The practical guidance is equally explicit. Meaningful semantic guarantees arise when

$$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$8

If $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S].$$9 is significantly smaller than $(\varepsilon,\delta)$0, then $(\varepsilon,\delta)$1 and $(\varepsilon,\delta)$2 remain small. If $(\varepsilon,\delta)$3 is larger, the guarantees degrade. The same paper also notes a limitation: a stronger “reality-oblivious” semantic definition, where the guarantee must hold for any database and arbitrary priors, cannot be achieved by $(\varepsilon,\delta)$4-differential privacy in general (0803.3946).

3. Other relaxations within the differential privacy family

The Bayesian semantics paper also establishes an important boundary: not all relaxations preserve the intended meaning of privacy. A statistical-difference-based relaxation of the form

$(\varepsilon,\delta)$5

can allow useful data release only when $(\varepsilon,\delta)$6, yet a mechanism that chooses a random index $(\varepsilon,\delta)$7 and outputs $(\varepsilon,\delta)$8 satisfies this condition with $(\varepsilon,\delta)$9 while directly revealing some individual’s data. The multiplicative structure of $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$0-DP is therefore special in preserving semantic guarantees (0803.3946).

One later variant, individual differential privacy, argues that standard DP is stricter than required by the intuitive participation guarantee because it requires indistinguishability between any pair of neighboring datasets. Individual differential privacy instead requires indistinguishability between the actual dataset and its neighboring datasets. It offers “the same privacy guarantees as standard differential privacy to individuals (even though not to groups of individuals),” and it allows the data controller to adjust distortion to the actual dataset by calibrating to local sensitivity rather than global sensitivity or smooth sensitivity (Soria-Comas et al., 2016).

Another variant addresses temporal relaxation. In gradual release of sensitive data, an $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$1-private response $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$2 is first published, privacy is later relaxed to $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$3, and a more accurate response $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$4 is released while the joint response $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$5 preserves $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$6-differential privacy. The paper proves that there exists a composite mechanism with no loss in accuracy relative to releasing once at $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$7, and describes the outputs by a lazy Markov stochastic process with closed-form expression (Koufogiannis et al., 2015).

A different axis of relaxation is heterogeneity across users. In heterogeneous DP for mean estimation, each user has a personal privacy level $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$8. In the two-group case, the minimax risk exhibits a saturation phenomenon: after a certain point, further relaxing one group’s privacy while keeping the other group’s privacy fixed does not improve the performance of the minimax optimal mean estimator. The paper concludes that the central server can offer a certain degree of privacy without any sacrifice in performance (Chaudhuri et al., 2023).

These variants suggest that “relaxation” inside the DP family can mean at least three different operations: weakening pure $$\Pr[A(D) \in S] \le e^\varepsilon \Pr[A(D') \in S] + \delta.$$9-DP to $e^\varepsilon$0-DP, replacing global indistinguishability by actual-dataset indistinguishability, or allowing privacy budgets to vary across time or across users. The shared pattern is that the guarantee remains explicit and quantitative.

4. Information-theoretic and variational formulations

Outside the classical DP setting, the phrase “relaxed-privacy model” often denotes an explicit privacy-utility tradeoff optimized by information-theoretic or variational means. In model privacy, “information laundering” defines a learned model as a kernel $e^\varepsilon$1, treats the authentic private model as $e^\varepsilon$2, and constructs a public model

$e^\varepsilon$3

with an input kernel $e^\varepsilon$4 and an output kernel $e^\varepsilon$5. The tradeoff objective is

$e^\varepsilon$6

This formulation does not force mutual information to be zero; it penalizes leakage while preserving utility, so privacy is controlled by the weights $e^\varepsilon$7. The paper derives optimal kernels and proposes iterative algorithms such as OIL and OIL-Y (Wang et al., 2020).

A closely related use appears in the privacy funnel literature. The privacy funnel minimizes $e^\varepsilon$8 subject to $e^\varepsilon$9, and the relaxed variant replaces the non-convex objective by an upper bound obtained through Jensen’s inequality. With auxiliary variables $\delta$0, the relaxed objective is

$\delta$1

The resulting model is proved equivalent to the original privacy funnel in optimal solutions and optimal values, and the paper develops an Alternating Expectation Minimization algorithm with closed-form iterations and convergence guarantees through descent estimation and Pinsker’s inequality (Chen et al., 2024).

In private query answering, “relaxed marginal consistency” is an instructive contrast. The privacy guarantee remains standard $\delta$2-DP, but the reconstruction step relaxes global consistency constraints. Instead of estimating marginals over the exact marginal polytope $\delta$3, the method solves

$\delta$4

where $\delta$5 is a local polytope defined by a region graph and only local consistency is enforced. This improves scalability or accuracy with no privacy cost because it is pure post-processing of DP measurements (McKenna et al., 2021).

A further information-theoretic formulation studies the tradeoff between privacy and attack detectability in query systems with additive noise. Privacy is measured by

$\delta$6

where $\delta$7 is the Fisher information matrix of the noise, while security against additive bias injection is measured by

$\delta$8

For scalar queries, the product $\delta$9 equals a constant, so increasing privacy necessarily weakens security and vice versa. The paper also derives the analogous dependence under differential privacy, where security for the Laplace mechanism is quadratic in $\delta$00 (Farokhi et al., 2020).

5. Domain-specific and system-level formulations

Several works instantiate relaxed privacy at the level of documents, online services, system models, or learning protocols. In text sanitization, the model $\delta$01-sanitization generalizes strict $\delta$02-sanitization by allowing controlled semantic disclosure. For every sensitive concept $\delta$03, a generalization $\delta$04 sets the disclosure threshold, and a sanitized document must satisfy

$\delta$05

for every surviving term $\delta$06 and group of terms $\delta$07. The result is a semantic, configurable privacy model in which more abstract $\delta$08 yields stronger protection and lower utility, while more specific $\delta$09 preserves more semantics (Sánchez et al., 2017).

In personalized online services, 3PS uses shared proxy identities to deliver personalization while protecting plausible deniability. The privacy condition is

$\delta$10

and proxy selection minimizes topic-distribution mismatch subject to that deniability constraint. Utility loss is measured by

$\delta$11

In the reported experiments, proxy selection accuracy reaches 98% averaged over all datasets and topics after 3 steps, while deniability improves through topic diversity and noise injection (Aonghusa et al., 2018).

For complex systems, a model-oriented reasoning framework treats privacy as a question of “which entity can learn what?” The model has three components—$\delta$12 for knowledge, $\delta$13 for flows, and $\delta$14 for normative rules—and supports uncertainty through fuzzy knowledge sets with membership values

$\delta$15

Relaxed privacy is then expressed through thresholds such as

$\delta$16

or through conditional normative rules that tolerate certain leaks only in encrypted, pseudonymized, or aggregated form (Rehms et al., 2024).

In non-interactive local privacy, a different system-level relaxation allows public unlabeled data. PAC learning halfspaces in strict NLDP faces exponential sample complexity barriers, but the relaxed model provides the server with public unlabeled samples drawn from the same marginal distribution $\delta$17. Under anti-concentration or mixture-distribution assumptions, the paper gives two approaches—one based on the Massart noise model and one based on self-supervised learning—with private and public sample complexities that are linear in the dimension and polynomial in the other parameters (Su et al., 2022).

6. Selective protection and empirical risk calibration

A more asymmetric use of the term appears in selective-protection models. “Privacy for the Protected (Only)” partitions the population into a targeted subpopulation $\delta$18 and a protected subpopulation $\delta$19, and defines protected differential privacy by requiring DP-like indistinguishability only under rewiring of edges incident to a single vertex $\delta$20. The model explicitly offers no guarantees about the status bit or the incident edges of members of $\delta$21. Algorithms such as $\delta$22 preserve privacy for $\delta$23 while allowing effective discovery of $\delta$24, and the total privacy cost scales with the number of targeted connected components recovered rather than with the total number of examined vertices (Kearns et al., 2015).

In privacy-preserving machine learning without formal DP guarantees, center-based relaxed learning addresses membership inference by reducing the gap between the model’s data-memorizing ability and generalization ability. The training objective combines an improved relaxed classification loss with a relaxed center loss,

$\delta$25

so that member and non-member prediction distributions remain as close as possible. The paper emphasizes that this is a relaxed privacy effect rather than a certified DP guarantee: attack AUC is reduced while model generalizability is preserved, often with minimal or no loss (Fang et al., 2024).

A related empirical perspective calibrates privacy by membership-inference success rather than by $\delta$26 alone. In differentially private machine learning, the paper uses LiRA attack success rate $\delta$27 as a practical privacy indicator and defines

$\delta$28

It then uses SHAP or LIME to identify privacy-sensitive features and solves a masking problem

$\delta$29

so that a masked dataset can be trained with a larger theoretical $\delta$30 while maintaining approximately equivalent practical privacy protection, measured by comparable $\delta$31 values (Gu et al., 2024).

Across these selective and empirical formulations, a common pattern emerges. Relaxation can mean asymmetric guarantees across subpopulations, operational rather than formal privacy metrics, or data-dependent transformations that preserve a target attack success rate. This suggests that the modern use of “relaxed-privacy model” is not confined to one formalism. It names a family of constructions in which some privacy loss is tolerated, bounded, or reparameterized in order to retain semantics, personalization, learnability, scalability, or attack resilience, while the precise relaxation is made explicit by the governing equations and threat model.