Optimal partition selection with Rényi differential privacy

2026-03-10

AI Summary

This work addresses the open problem of maximizing the number of useful releases under differential privacy constraints when users submit multiple partitions. We propose the first optimal mechanism for this partition selection problem that satisfies δ-approximate (α, ε)-Rényi differential privacy, generalizing the optimal algorithm from the single-partition setting. Furthermore, we design a non-additive noise mechanism tailored for L²-bounded weighted partitions. Theoretical analysis reveals an inherent utility gap between additive and non-additive mechanisms. Our approach is plug-and-play compatible with state-of-the-art algorithms such as PolicyGaussian and MAD2R, consistently improving utility in both parallel and sequential adaptive settings. Additionally, we prove that jointly releasing selected partitions along with their frequencies incurs an unavoidable privacy cost.

Technology Category

• Machine Learning: Privacy
• Search and Optimization: Mixed Discrete/Continuous Search
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Security and Privacy: Privacy-enhancing technologies
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

A common problem in private data analysis is the partition selection problem, where each user holds a set of partitions (e.g. keys in a GROUP BY operation) from a possibly unbounded set. The challenge here is in maximizing the set of released partitions while respecting a differential privacy constraint. Previous work [Desfontaines et al., PoPETS 2022] presented an optimal $(\varepsilon, δ)$-DP algorithm when each user submits only a single partition. We generalize this approach to find the optimal algorithm under $δ$-approximate $(α, \varepsilon)$-Rényi differential privacy (RDP), which allows much tighter analysis under composition. Motivated by the non-existence of a general optimality result in the case where users submit multiple partitions each, we present an extension of our optimal algorithm tuned for $L^2$ bounded weighted partition selection which can be used as a drop-in improvement over the Gaussian mechanism any time the partition frequency is not also needed. We show that our primitive can be easily plugged into state of the art partition selection algorithms (PolicyGaussian from [Gopi et al., ICML 2020] and MAD2R from [Chen et al., ICML 2025]), improving performance both for parallel and sequential adaptive algorithms. Finally, we show that there is an inherent cost to algorithms which do support releasing the frequency as well as the partitions. Specifically, we formulate a basic notion of optimal approximate RDP algorithm for partition selection using additive noise, and show that there is a numerical separation between additive and non-additive noise mechanisms for this problem.

Problem

• partition selection
• Rényi differential privacy
• differential privacy
• additive noise
• privacy-preserving data analysis

Innovation

• Rényi differential privacy
• partition selection
• optimal mechanism
• additive noise
• L2-bounded weighted selection