Report Noisy Max Mechanism

• The paper introduces Report Noisy Max, a mechanism that adds Laplace or exponential noise to select the highest query result while ensuring ε-differential privacy.
• It extends traditional methods by releasing the gap between the top two noisy scores, thereby enabling enhanced post-selection inference without additional privacy cost.
• The work also addresses secure finite-precision implementations to mitigate side-channel leakage, ensuring robust performance in practical differential privacy workflows.

Report Noisy Max is a canonical selection mechanism in differential privacy that enables the private selection of the index (or indices) of the largest among a set of sensitive queries by adding noise to each candidate score before taking the maximum. The mechanism, both in its Laplace and exponential noise instantiations, underpins numerous differentially private data analysis workflows. A key advancement is the “Noisy-Max-with-Gap” variant, which returns not only the maximizer index but also the noisy gap between the first and second place, enabling post-selection inference improvements at no additional privacy cost. Implementations increasingly focus on secure finite-precision arithmetic to prevent side-channel leakage from floating-point artifacts.

1. Classical Report Noisy Max: Mechanisms and Guarantees

Report Noisy Max is defined for $n$ real-valued queries $q_1(D), \dots, q_n(D)$ of global $\ell_1$-sensitivity $\Delta=1$ evaluated on a sensitive database $D$. The mechanism can be instantiated with either Laplace or exponential noise. In the Laplace version, to achieve pure $\varepsilon$-differential privacy for single-maximum selection, add i.i.d. noise $\eta_i \sim \mathrm{Lap}(2/\varepsilon)$ to each query result: $\tilde{q}_i = q_i(D) + \eta_i,$ then return $i^* = \arg\max_{i} \tilde{q}_i$ (Ding et al., 2019, Ding et al., 2020). In the exponential variant, use $\eta_i \sim \mathrm{Expo}(\varepsilon/(2\Delta))$, returning the argmax of noisy scores. The privacy analysis uses the “randomness alignment” framework, showing that at most one coordinate in the noise vector is shifted by the global sensitivity, bounding the privacy loss to $q_1(D), \dots, q_n(D)$0 per the DP definition.

The Report Noisy Max mechanism is closely related to the Exponential Mechanism: the probability of selection is proportional to $q_1(D), \dots, q_n(D)$1, yielding $q_1(D), \dots, q_n(D)$2 expected error in the selected score (Ding et al., 2021).

2. Free Gap Information: Mechanism and Privacy

The Noisy-Max-with-Gap variant (“Report Noisy Max with Gap”) outputs, in addition to the index $q_1(D), \dots, q_n(D)$3, the gap $q_1(D), \dots, q_n(D)$4 between the largest and second largest noisy queries. Formally:

1. For each $q_1(D), \dots, q_n(D)$5, draw $q_1(D), \dots, q_n(D)$6.
2. Compute $q_1(D), \dots, q_n(D)$7.
3. Let $q_1(D), \dots, q_n(D)$8, $q_1(D), \dots, q_n(D)$9.
4. Output $\ell_1$0.

A central finding is that releasing $\ell_1$1 does not incur extra privacy loss. This follows from the post-processing invariance of differential privacy—$\ell_1$2 is a deterministic function of the internal noise and output index, which by construction is $\ell_1$3-DP (Ding et al., 2019, Ding et al., 2020). A detailed randomness alignment shows only one coordinate of noise shifts by at most $\ell_1$4, maintaining the density ratio bound and DP guarantee.

This result generalizes: returning the gaps for the top $\ell_1$5 selections, i.e., the top-$\ell_1$6 indices and corresponding differences with $\ell_1$7-st, is also $\ell_1$8-DP with appropriate noise scaling ($\ell_1$9) (Ding et al., 2023).

3. Statistical Utility and Post-Processing Improvements

The core utility innovation of free gap reporting is that the released gap can be combined with subsequent noisy measurements of the selected queries to yield substantially lower mean-squared error (MSE) in count estimation tasks. Standard pipelines divide the privacy budget: half is used for private selection, half for new noisy measurements of $\Delta=1$0 via Laplace mechanisms. With Noisy-Max-with-Gap, both $\Delta=1$1 and the runner-up $\Delta=1$2 can be estimated via the noisy gap, as the noise of both selected queries is known. The two estimates—direct measurement and inference from the gap—are independent and unbiased, so they can be linearly combined (via BLUE weights) to reduce variance:

$\Delta=1$3

for Laplace noise in the $\Delta=1$4 case (asymptotically 50% reduction), and up to 66% for exponential/gap distributions or larger $\Delta=1$5 (Ding et al., 2020). Experimental evaluations on datasets (BMS-POS, Kosarak, T40I10D100K) confirm MSE reductions near this theoretical optimum.

4. Connections to Other Mechanisms and Structural Equivalence

The Report Noisy Max mechanism with exponential noise is mathematically equivalent to the “permute-and-flip” mechanism and the Exponential Mechanism. Exact distributional equivalence is established by constructing intermediate algorithms (e.g., flipping, truncation, coupling arguments) that demonstrate stepwise identity between the random processes in each (Ding et al., 2021). Thus, not only do these mechanisms yield identical selection distributions, but all privacy and utility guarantees are shared.

This equivalence provides theoretical sharpness: with probability $\Delta=1$6, the chosen item’s score is within $\Delta=1$7 of the true maximum, and the expected additive error is $\Delta=1$8.

5. Finite-Precision and Secure Implementations

Accurate implementation of the Noisy-Max-with-Gap mechanism in finite-precision environments requires avoidance of floating-point vulnerabilities that can leak sensitive information via side-channels. Attacks against standard floating-point-based inverse transform samplers for Laplace mechanisms have demonstrated loss of privacy due to mantissa nonuniformities (“Mironov’s attack”) (Ding et al., 2023). Secure implementations address this by:

• Rounding all inputs to integer multiples of a user-specified resolution $\Delta=1$9.
• Generating noise via exact discrete samplers (discrete Laplace, two-sided geometric distributions).
• Performing all computations, including tie-breaking and gap calculation, in integer or rational arithmetic.
• Recursively refining noise and tie-breaking at progressively finer resolutions until ties are resolved.

This design ensures that, distributionally, the output of the secure discrete mechanism matches the ideal continuous process with post-processed rounding, and hence strict differential privacy is preserved even in adversarial environments.

6. Practical Considerations and Parameter Recommendations

Practical deployments should follow these guidelines for the secure and efficient report noisy max with gap:

• Use $D$0 (for typical $D$1, e.g., $D$2) for input and output rounding granularity (Ding et al., 2023).
• For top-$D$3 selection, add $D$4 (or equivalent discrete noise) to each score.
• Refine ties with tie‐refinement factor $D$5 (e.g., $D$6), which ensures rapid tie resolution in $D$7 steps.
• Early pruning to restrict refinement steps to only those in the top-$D$8 candidate set accelerates computation.
• Geometric samplers can be implemented with a small expected number ($D$9 7–9) of uniform/Bernoulli calls per item, enabling practical execution for $\varepsilon$0 in sub-millisecond times (in compiled languages).

Downstream, free gaps support improved confidence intervals and budget reallocation: by quantifying the separation between the highest and second-highest noisy scores, users can decide whether further privacy budget spending is warranted (Ding et al., 2019, Ding et al., 2020).

7. Numerical Example

Let $\varepsilon$1, and $\varepsilon$2. Draw i.i.d. $\varepsilon$3 (say, $\varepsilon$4). Compute noisy scores $\varepsilon$5; the maximizer is index $\varepsilon$6 and the gap $\varepsilon$7. If an independent subsequent Laplace(2) measurement of $\varepsilon$8 yields $\varepsilon$9, BLUE combination of the two gives an estimate substantially closer to $\eta_i \sim \mathrm{Lap}(2/\varepsilon)$0, cutting MSE by $\eta_i \sim \mathrm{Lap}(2/\varepsilon)$1 with no additional privacy cost (Ding et al., 2020).

---

Key references: (Ding et al., 2019, Ding et al., 2020, Ding et al., 2021, Ding et al., 2023).