Single-Order RDP Privacy Regions

• The paper introduces single-order RDP privacy regions as optimal privacy-utility trade-offs characterized by bounding Rényi divergence at a fixed order.
• It reveals that these regions are convex, symmetric, and extremally achieved by two-point mechanisms, simplifying privacy comparisons.
• The work underpins efficient black-box conversions to f-DP and (ε,δ)-DP, impacting posterior sampling, subsampled Gaussian, and shuffle mechanism analyses.

A single-order RDP privacy region is the locus of optimal privacy-utility trade-offs determined by a mechanism’s Rényi Differential Privacy (RDP) guarantees at a fixed divergence order. It encodes the hypothesis-testing region—specifically, the attainable Type I and II error pairs—imposed by bounding RDP at a particular order and level. The theory of single-order RDP privacy regions provides both a geometric and an operational understanding of how moment-based privacy guarantees constrain statistical distinguishability, and establishes their role as the foundational building blocks in black-box conversions from RDP to more general hypothesis testing (e.g., $f$-DP) or classical $(\epsilon,\delta)$-DP frameworks.

1. Definition and Characterization of Single-Order RDP Privacy Regions

Let $\tau \geq 0.5$ denote the Rényi order and $\rho \geq 0$ the upper bound on the Rényi divergence. For every pair of adjacent databases, a mechanism is said to satisfy $(\tau, \rho)$-RDP if

$$D_\tau(P\,\|\,Q) \leq \rho \quad \text{and} \quad D_\tau(Q\,\|\,P) \leq \rho$$

where $P$ and $Q$ are the output distributions under neighboring datasets. In the context of hypothesis testing, for every possible rejection region $S$, one considers the induced Type I and II errors:

$\alpha = P(S), \qquad \beta = Q(S^c)$

The $(\epsilon,\delta)$0-order RDP privacy region $(\epsilon,\delta)$1 is

$(\epsilon,\delta)$2

The lower boundary of this region, parameterized by $(\epsilon,\delta)$3, is the trade-off function $(\epsilon,\delta)$4:

$(\epsilon,\delta)$5

For $(\epsilon,\delta)$6, explicit analytic constraints are given by:

$(\epsilon,\delta)$7

with analogous forms for $(\epsilon,\delta)$8 (KL-divergence) and $(\epsilon,\delta)$9 (inequalities reverse).

2. Geometric and Structural Properties

The privacy region $\tau \geq 0.5$0 is always convex and symmetric about the line $\tau \geq 0.5$1. The map $\tau \geq 0.5$2 is affine, and the Rényi divergence sublevel sets are convex in distribution space. Symmetry arises because the constraints are invariant under swapping the roles of $\tau \geq 0.5$3 and $\tau \geq 0.5$4. The fundamental result is that every boundary point of $\tau \geq 0.5$5 is realized by a two-point (randomized response) mechanism, highlighting the sufficiency of binary mechanisms for extremal trade-offs and simplifying the analysis of attainable regions (Riess et al., 4 Feb 2026).

3. Role in Black-box Conversions and Optimality

The intersection of single-order RDP privacy regions across all $\tau \geq 0.5$6, given an RDP profile $\tau \geq 0.5$7, yields the tightest hypothesis-testing guarantee (in the $\tau \geq 0.5$8-DP sense) derivable solely from RDP accountants. More precisely, the attainable region is

$\tau \geq 0.5$9

and the corresponding lower boundary is:

$\rho \geq 0$0

Any black-box method for converting RDP guarantees to $\rho \geq 0$1-DP (or $\rho \geq 0$2-DP) trade-offs cannot uniformly improve upon $\rho \geq 0$3. This optimality is universal and holds in the Blackwell sense (Riess et al., 4 Feb 2026). The result marks the mathematical limit of RDP-to-$\rho \geq 0$4-DP conversion without knowledge of the internal mechanism.

4. Computational Aspects and Applications

Single-order privacy regions reduce the process of privacy accounting to computing explicit trade-off curves $\rho \geq 0$5, which are then combined pointwise over $\rho \geq 0$6. This avoids complex variational calculus or loose union bounds. In practical privacy analysis workflows, the procedure is:

1. Evaluate (numerically or analytically) $\rho \geq 0$7 for a grid of $\rho \geq 0$8 values.
2. Take the pointwise maximum to obtain $\rho \geq 0$9.
3. For $(\tau, \rho)$0-DP conversion, many standard envelopes admit closed-form or efficient numerical evaluation (Mironov, 2017, Koskela et al., 2024).

This approach directly underpins privacy analysis in mechanisms such as:

• Posterior sampling in Bayesian models, where the impact of the prior and data sensitivity is fully described by the single-order privacy region (Geumlek et al., 2017).
• Subsampled mechanisms and analytical moments accountants for mechanisms such as the Subsampled Gaussian Mechanism (Wang et al., 2018, Mironov et al., 2019).
• Shuffle models, where the privacy region informs both the privacy amplification attained under shuffling and the comparison to the central model (Liew et al., 2022).

5. Examples: Mechanisms and Single-Order Curves

In exponential-family posterior sampling, the achievable $(\tau, \rho)$1 points trace out a curve with vertical asymptotes determined by the prior; as the prior strengthens, the privacy region broadens and $(\tau, \rho)$2 decreases. In the sampled Gaussian mechanism, the region is approximately linear: $(\tau, \rho)$3 for small sampling rate $(\tau, \rho)$4 and large scale $(\tau, \rho)$5 (Mironov et al., 2019). For shuffle mechanisms, single-order regions show a strict gain over the standard central Gaussian mechanism, with the RDP curve lying well below the corresponding non-shuffled bound (Liew et al., 2022).

6. Theoretical and Practical Implications

The geometric structure of single-order RDP privacy regions explains why two-point mechanisms are extremal and why cumulant-based summaries (as in moments accountants) are sufficient for privacy composition (Riess et al., 4 Feb 2026). For practitioners, these regions provide both auditing tools (e.g., verifying claims of $(\tau, \rho)$6-DP or $(\tau, \rho)$7-DP) and a pathway to arbitrarily tight numerical evaluation across complex mechanism compositions (Koskela et al., 2024).

Furthermore, the explicit region characterizes the tradeoff between privacy cost and robustness with respect to higher-order moments, facilitating informed choices along the privacy-utility frontier for specific application requirements.

7. Extensions and Future Directions

Recent developments explore:

• Generalization to hypothesis testing beyond binary decisions and to $(\tau, \rho)$8-DP with arbitrary trade-off functions.
• Direct profile accounting in large-scale and adaptive mechanisms (e.g., private selection, hyperparameter tuning), where single-order profiles enable substantial improvement over traditional RDP accounting by avoiding conversion-induced slack (Koskela et al., 2024).
• Adaptive privacy accounting for parallel or data-dependent mechanisms, leveraging the modularity of single-order regions.

A plausible implication is that future mechanism designs may further exploit the modularity and tightness of single-order privacy regions, particularly in interactive or federated settings where compositions and privacy amplification effects are subtle and intricate.

---

References

• "Optimal conversion from Rényi Differential Privacy to $(\tau, \rho)$9-Differential Privacy" (Riess et al., 4 Feb 2026)
• "Subsampled Rényi Differential Privacy and Analytical Moments Accountant" (Wang et al., 2018)
• "Rényi Differential Privacy Mechanisms for Posterior Sampling" (Geumlek et al., 2017)
• "Privacy Profiles for Private Selection" (Koskela et al., 2024)
• "Shuffle Gaussian Mechanism for Differential Privacy" (Liew et al., 2022)
• "Rényi Differential Privacy of the Sampled Gaussian Mechanism" (Mironov et al., 2019)
• "Renyi Differential Privacy" (Mironov, 2017)