Differential Privacy of Gaussian Process Posterior Sampling
Abstract
We study the privacy of releasing functional posterior sample paths from a Gaussian process (GP) when the entire training set including covariates and responses is private. Unlike standard differential-privacy (DP) mechanisms that inject external noise, posterior sampling is intrinsically random and we show that this randomness provides useful privacy guarantees. We derive Rényi-DP guarantees separating privacy leakage through the posterior mean from a distinct channel induced by the data-dependent posterior covariance. The analysis identifies effective ridge regularisation and covariance scale as the principal privacy-controlling quantities and yields sharper guarantees in several regimes of practical interest as well as extensions to repeated and adaptive releases. Membership inference attacks confirm the predicted dependence on regularisation, covariance scale and the number of released paths. Utility experiments on downstream posterior sampling tasks identify noisy observation regimes where privacy-compatible regularisation preserves useful samples. Finally we identify large-data asymptotic regime in which the privacy parameter and posterior mean-square risk vanish simultaneously, yielding privacy for free. Together, these results provide a comprehensive characterisation of privacy and utility of GP posterior sampling.
Related
- On Inherent Privacy of Posterior Sampling: A Unified Rényi-Divergence Framework
- Bounds on the Posterior-to-Prior Ratios for Inclusion Belief under Bounded Differential Privacy
- Optimal Conversion from Zero-Concentrated to Gaussian Differential Privacy
- Dirichlet Process Mixtures of Trees with Gaussian Process Splits: A Bayesian Nonparametric Framework with Posterior Contraction Rate
- Scale Analysis and Shape Selection for the Generalized Gaussian Mechanism under Approximate Differential Privacy
BibTeX
@misc{maciazek2026differential,
title = {{Differential Privacy of Gaussian Process Posterior Sampling}},
author = {Tomasz Maciazek},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2606.17995},
eprint = {2606.17995},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2606.17995},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Differential Privacy of Gaussian Process Posterior Sampling
AU - Tomasz Maciazek
PY - 2026
DA - 2026/09/14
PB - arXiv
DO - 10.48550/arxiv.2606.17995
UR - https://arxiv.org/abs/2606.17995
AB - We study the privacy of releasing functional posterior sample paths from a Gaussian process (GP) when the entire training set including covariates and responses is private. Unlike standard differential-privacy (DP) mechanisms that inject external noise, posterior sampling is intrinsically random and we show that this randomness provides useful privacy guarantees. We derive Rényi-DP guarantees separating privacy leakage through the posterior mean from a distinct channel induced by the data-dependent posterior covariance. The analysis identifies effective ridge regularisation and covariance scale as the principal privacy-controlling quantities and yields sharper guarantees in several regimes of practical interest as well as extensions to repeated and adaptive releases. Membership inference attacks confirm the predicted dependence on regularisation, covariance scale and the number of released paths. Utility experiments on downstream posterior sampling tasks identify noisy observation regimes where privacy-compatible regularisation preserves useful samples. Finally we identify large-data asymptotic regime in which the privacy parameter and posterior mean-square risk vanish simultaneously, yielding privacy for free. Together, these results provide a comprehensive characterisation of privacy and utility of GP posterior sampling.
ER -