alphaFeedback

WorksMathematics

On the Order of Privacy and Smoothing in Functional Mean Estimation

AI contributions
Not recorded for this paper
View details
Ancillary data
1 code link
View

Abstract

Differential privacy (DP) is a leading framework for privacy protection, yet privacy mechanisms tailored to functional data analysis (FDA) remain relatively underexplored. For functional mean estimation, we investigate a fundamental question regarding the ordering of privatization and estimation by comparing two canonical pipelines: Fit-Then-Protect (FTP), which smooths trajectories before privatization, and Protect-Then-Fit (PTF), which privatizes observations at discrete time points before smoothing. When data are observed without error, we prove that FTP achieves strictly smaller mean squared error than PTF asymptotically (as the sample size increases) under the same μμ-Gaussian differential privacy (μμ-GDP) budget in both finite-dimensional Hilbert spaces and infinite-dimensional reproducing kernel Hilbert spaces (RKHS). Simulation studies support our theory and explore settings with observation error and fitting constraints, demonstrating that FTP outperforms PTF under small observation noise, whereas PTF can become preferable in high-noise settings. In addition to this comparison, we establish a novel GDP guarantee for Gaussian perturbations taking values in a Banach space, extending existing results beyond the RKHS setting.

Introduction

Differential privacy (DP) provides a rigorous framework for protecting individual-level information while balancing data usability. By carefully calibrating the noise added to the released summaries, DP obscures the contribution of any particular individual. Since Dwork et al. [11] formalized DP, it has become a central paradigm in privacy-preserving data

© Haotian Chen, Yu-Wei Chen, Qifan Song and Jordan Awan.

License: CC-BY 4.0, see https://creativecommons.org/licenses/by/4.0/. analysis, stimulating extensive research in statistics, machine learning, and related fields. Despite this progress, much of the classical DP literature has focused on database queries, finite-dimensional statistical summaries, and conventional machine-learning tasks [27, 7, 10]. Extending DP to more complex data objects raises additional theoretical and methodological challenges, particularly when the data exhibit infinite-dimensional structure and complex dependence over continuous domains.

These challenges are particularly relevant in functional data analysis (FDA), where the basic unit of interest is a function or curve, potentially infinite-dimensional, but typically observed only at finitely many discrete points. Classical examples include growth curves, wearable sensor data, and other densely or continuously recorded signals [26, 22, 1]. Instead of treating observations at different time points independently, FDA models each subject’s data as a smooth function, allowing statistical procedures to exploit the within-curve correlation and geometric structure inherent in functional observations. Over the past several decades, FDA has become an important area of modern statistics with applications across biology, medicine, engineering, and environmental science [13, 15].

As functional data become increasingly prevalent, protecting the privacy of function-valued information has become an important challenge. In many applications, the object of interest is itself a function—for example, a mean trajectory, a regression function, or an estimated individual curve—which may reveal sensitive information about individuals. While classical DP mechanisms are primarily designed for finite-dimensional statistics, extending privacy guarantees to infinite-dimensional function spaces is substantially more challenging, requiring both suitable notions of sensitivity and carefully constructed noise processes. These challenges naturally raise the question of how DP should be formulated and implemented for function-valued outputs. Previous work has built (ϵ,δ)(\epsilon, \delta)-DP for functionals in different function spaces [14, 19], while recent work extends this to the Gaussian differential privacy (GDP) framework under reproducing kernel Hilbert spaces (RKHS) [21].

Another fundamental question arises regarding when and where privacy should be enforced, given privacy mechanisms for functional outputs are available. For a functional estimation problem, privacy can be incorporated in at least two natural ways. One may first smooth the functional trajectories and then privatize the resulting estimates, or alternatively privatize the data first and subsequently perform the estimation using the protected observations. We refer to these two strategies as Fit-Then-Protect (FTP) and Protect-Then-Fit (PTF), respectively. Although both procedures can be calibrated to have the same privacy guarantee, they exploit the functional structure of the data in fundamentally different ways, and little is known about when one ordering is superior.

Contributions: In this paper, we study how the ordering of privacy protection and functional estimation affects the statistical accuracy in functional mean estimation. We first establish a sufficient condition under which Gaussian perturbations of function-valued summaries in general Banach spaces satisfy a prescribed GDP guarantee, extending existing results beyond the RKHS setting. We then compare the FTP and PTF pipelines under a common GDP budget. When functional observations are measured without error, we prove that FTP achieves strictly smaller estimation error than PTF asymptotically as the sample size increases, in both finite-dimensional Hilbert spaces equipped with the norm induced by L2[0,1]L^2[0,1] inner product and reproducing kernel Hilbert spaces (RKHSs). Numerical experiments support these theoretical findings and further investigate the impact of observation noise, showing that FTP performs better when observation noise is small, whereas PTF may be preferable when observation noise is large. We also examine how estimation constraints and the GDP privacy parameter μ\mu affect the accuracy of the private estimators.

Related Work: Previous work on differential privacy for function-valued objects has primarily focused on extending classical privacy mechanisms from finite-dimensional vectors to infinite-dimensional function spaces. Hall et al. [14] proposed one of the earliest Gaussian process perturbation mechanisms for releasing functional summaries while satisfying (ϵ,δ)(\epsilon,\delta)-DP in RKHS. Building upon this framework, Mirshani et al. [19] established a general theory of Gaussian perturbation mechanisms in Banach spaces and characterized sufficient conditions under which function-valued summaries satisfy (ϵ,δ)(\epsilon,\delta)-DP. Complementary work studied the limitations of elliptical perturbations in infinite-dimensional settings [23] and extended the exponential mechanism to functional summaries, including functional principal component analysis [3]. More recently, Räisä et al. [21] established GDP guarantees for a Gaussian-process-based functional mechanism in RKHS. Beyond general privacy mechanisms, Xue et al. [28] studied private distributed FDA and established minimax results for functional mean and varying-coefficient estimation.

Another line of research investigates the role of dependence and structural information in privacy mechanisms. Cao et al. [5] analyzed privacy leakage under temporal correlations in continuous data release, while other work has developed correlated-noise mechanisms to preserve time-series structure and mitigate vulnerabilities of independent perturbations [25, 18]. More broadly, geometry-aware and structured mechanisms have been shown to achieve near-optimal or improved utility over conventional independent perturbations in finite-dimensional settings, including mechanisms for vector- and matrix-valued queries, private learning [20, 6, 2, 8].

Organization: The remainder of this paper is organized as follows. Section 2 reviews the necessary background on functional data analysis and differential privacy. Section 3 formulates the problem of differentially private functional mean estimation and introduces the Fit-Then-Protect (FTP) and Protect-Then-Fit (PTF) strategies. Section 4 establishes a Gaussian differential privacy mechanism for function-valued summaries and develops theoretical comparisons between the two strategies. Section 5 presents simulation studies evaluating their empirical performance under different function spaces in various settings. Section 6 concludes the paper with a discussion of potential extensions. Proofs, technical details, as well as supplementary simulation results are in the appendix. The source code used to implement the simulation study and data analysis is available at https://github.com/Hao-tian-Chen/DP-FDA.

Background

In this section, we review the necessary background for FDA and DP. In Section 2.1, we give the notation and definition for some common function spaces in FDA, such as Banach spaces and reproducing kernel Hilbert spaces (RKHS), define the Gaussian random element in a separable Banach space, and introduce the corresponding Cameron–Martin space and discuss its relationship with RKHS. In Section 2.2, we first define μ\mu-GDP, then introduce the definition of sensitivity and the Gaussian mechanisms to ensure μ\mu-GDP, and elaborate on the GDP properties for composition and post-processing.

Functional Data Analysis

Let (B,∥⋅∥B)(\mathbb{B}, \|\cdot\|_{\mathbb{B}}) be a real separable Banach space equipped with its Borel σ\sigma-algebra. A linear mapping l:B→Rl:\mathbb{B}\to\mathbb{R} is a continuous linear functional if it is bounded, that is, sup⁡∥h∥B≤1∣l(h)∣<∞\sup_{\|h\|_{\mathbb{B}}\leq1}|l(h)|<\infty. The collection of all such continuous linear functionals forms the topological dual space of B\mathbb{B}, denoted by B∗\mathbb{B}^{*}. Equipped with the dual norm defined by ∥l∥B∗=sup⁡∥h∥B≤1∣l(h)∣\|l\|_{\mathbb{B}^{*}}=\sup_{\|h\|_{\mathbb{B}}\leq1}|l(h)|, the dual space B∗\mathbb{B}^{*} is itself a Banach space [12 Proposition 1.29].

A B\mathbb{B}-valued random element ZZ is called Gaussian if l(Z)l(Z) is a normally distributed real random variable for every l∈B∗l\in\mathbb{B}^{*} [17]. We write Z∼NB(m,C)Z\sim\mathcal{N}_{\mathbb{B}}(m,C), where m∈Bm\in\mathbb{B} is its mean, characterized by E[l(Z)]=l(m)\mathbb{E}[l(Z)]=l(m), l∈B∗l\in\mathbb{B}^{*}, and C:B∗→BC:\mathbb{B}^{*}\to\mathbb{B} is its covariance operator, defined by

Cl=E[l(Z−m)(Z−m)],l∈B∗.Cl=\mathbb{E}[l(Z-m)(Z-m)],\qquad l\in\mathbb{B}^{*}.

A Gaussian random element ZZ is called centered if m=0m=0. In this case, we write Z∼NB(0,C)Z\sim\mathcal{N}_{\mathbb{B}}(0,C), and its covariance operator is given by Cl=E[l(Z)Z]Cl=\mathbb{E}[l(Z)Z], l∈B∗l\in\mathbb{B}^{*}. Unless otherwise stated, we consider centered Gaussian random elements throughout the remainder of this work.

Cameron–Martin Space. Let Z∼NB(0,C)Z\sim\mathcal{N}_{\mathbb{B}}(0,C), and equip the range C(B∗)⊂BC(\mathbb{B}^{*})\subset\mathbb{B} with the inner product

⟨Cl,Cg⟩:=l(Cg)=E[l(Z)g(Z)],l,g∈B∗.\langle Cl,Cg\rangle:=l(Cg)=\mathbb{E}[l(Z)g(Z)],\qquad l,g\in\mathbb{B}^{*}.

The Cameron–Martin (CM) space HC\mathcal{H}_{C} is defined as the completion of C(B∗)C(\mathbb{B}^{*}) under its induced norm, denoted by ∥⋅∥HC\|\cdot\|_{\mathcal{H}_{C}}, and is canonically identified with a continuously embedded Hilbert subspace of B\mathbb{B}. The laws of Z+hZ+h and ZZ are mutually absolutely continuous if h∈HCh\in\mathcal{H}_{C}, meaning that they assign probability zero to exactly the same measurable sets. If h∉HCh\notin\mathcal{H}_{C}, the laws are mutually singular, meaning that there exists a measurable set to which one law assigns probability one and the other assigns probability zero. Thus, the CM space describes the admissible shifts of the Gaussian law, while B\mathbb{B} contains its sample paths [24].

Example 1 (Finite-Dimensional Hilbert Space). Let ϕ1,…,ϕm\phi_{1},\ldots,\phi_{m} be continuous real-valued functions on [0,1][0,1] satisfying

⟨ϕj,ϕk⟩L2[0,1]=∫01ϕj(t)ϕk(t) dt=δjk,δjk={1,j=k,0,j≠k.\langle\phi_{j},\phi_{k}\rangle_{L^{2}[0,1]}=\int_{0}^{1}\phi_{j}(t)\phi_{k}(t)\,\mathrm{d}t=\delta_{jk},\qquad \delta_{jk}= \begin{cases} 1, & j=k,\\ 0, & j\ne k. \end{cases}

Define Hm=span⁡{ϕ1,…,ϕm}\mathcal{H}_m = \operatorname{span}\{\phi_1,\ldots,\phi_m\} with L2[0,1]L^2[0,1] inner product. Write ϕ(t)=(ϕ1(t),…,ϕm(t))T\phi(t) = (\phi_1(t),\ldots,\phi_m(t))^{\mathsf{T}}. Every f∈Hmf \in\mathcal{H}_m has a unique representation f(t)=θTϕ(t)f(t) = \theta^{\mathsf{T}}\phi(t), and for g(t)=ηTϕ(t)g(t) = \eta^{\mathsf{T}}\phi(t), we have ⟨f,g⟩Hm=θTη\langle f,g\rangle_{\mathcal{H}_m} = \theta^{\mathsf{T}}\eta, ∥f∥Hm=∥θ∥2\|f\|_{\mathcal{H}_m} = \|\theta\|_2. Take B=Hm\mathbb{B} = \mathcal{H}_m and define the centered Gaussian random element as

Zm(t)=∑k=1mξkϕk(t),ξ1,…,ξm∼iidN(0,1).Z_m(t) = \sum_{k=1}^{m}\xi_k\phi_k(t), \qquad\xi_1,\ldots,\xi_m \mathrel{\overset{\mathrm{iid}}{\sim}} N(0,1).

Its CM space is Hm\mathcal{H}_m with exactly the above inner product. In particular, adding σZm\sigma Z_m to any element in Hm\mathcal{H}_m is equivalent to adding N(0,σ2Im)N(0,\sigma^2 I_m) noise to its corresponding orthonormal coefficient vector. The corresponding covariance operator CmC_m for ZmZ_m is given in the proof of Corollary 7.

Definition 1 (Reproducing Kernel Hilbert Space). Let T\mathcal{T} be an index set and let K:T×T→RK:\mathcal{T}\times\mathcal{T}\to\mathbb{R} be a symmetric positive semidefinite kernel. The reproducing kernel Hilbert space (RKHS) associated with KK, denoted by HK\mathcal{H}_K, is the completion of span⁡{K(t,⋅):t∈T}\operatorname{span}\{K(t,\cdot):t\in\mathcal{T}\} with inner product

⟨∑jajK(sj,⋅),∑kbkK(tk,⋅)⟩HK=∑j,kajbkK(sj,tk),\left\langle\sum_j a_j K(s_j,\cdot),\sum_k b_k K(t_k,\cdot)\right\rangle_{\mathcal{H}_K} = \sum_{j,k} a_jb_kK(s_j,t_k),

where zero-norm elements are identified.

The completion is naturally identified with a Hilbert space of functions on T\mathcal{T} through the reproducing property f(t)=⟨f,K(t,⋅)⟩HKf(t) = \langle f,K(t,\cdot)\rangle_{\mathcal{H}_K}, t∈Tt\in\mathcal{T}. In particular, by the Cauchy–Schwarz inequality, ∣f(t)∣≤∥f∥HKK(t,t)|f(t)| \le\|f\|_{\mathcal{H}_K}\sqrt{K(t,t)}. Consequently, if ∥f∥HK≤B\|f\|_{\mathcal{H}_K} \le B, then ∣f(t)∣≤BK(t,t)|f(t)| \le B\sqrt{K(t,t)}. This bound provides a direct connection between the RKHS norm and the pointwise sensitivity of function-valued statistics.

Example 2 (RKHS and Gaussian Process). Let KK be a continuous symmetric positive semidefinite kernel on [0,1]2[0,1]^2. A centered Gaussian process with covariance kernel KK, denoted by ZK∼GP⁡(0,K)Z_K \sim\operatorname{GP}(0,K), is a collection of real-valued random variables {ZK(t):t∈[0,1]}\{Z_K(t):t\in[0,1]\} such that, for every finite collection t1,…,tTt_1,\ldots,t_T, (ZK(t1),…,ZK(tT))T∼N(0,KT)(Z_K(t_1),\ldots,Z_K(t_T))^{\mathsf{T}} \sim N(0,K_T), where KT=[K(tj,tk)]j,k=1TK_T = [K(t_j,t_k)]_{j,k=1}^{T}. In particular, E[ZK(s)ZK(t)]=K(s,t)\mathbb{E}[Z_K(s)Z_K(t)] = K(s,t). Assume that ZKZ_K admits a continuous version. Then ZKZ_K can be viewed as a Gaussian random element in B=C[0,1]\mathbb{B} = C[0,1], equipped with its supremum norm ∥f∥∞=sup⁡t∈[0,1]∣f(t)∣\|f\|_\infty= \sup_{t\in[0,1]}|f(t)| and Borel σ\sigma-algebra. The CM space HCK\mathcal{H}_{C_K} corresponding to ZKZ_K coincides with the RKHS HK\mathcal{H}_K associated with KK; in particular, they have the same inner product and norm.

References

  1. [1]Nihan Acar-Denizli and Pedro Delicado. Functional data analysis for wearable sensor data: a systematic review. AstA Advances in Statistical Analysis, 109(3):591–631, 2025.
  2. [2]Jordan Awan and Aleksandra Slavković. Structure and sensitivity in differential privacy: Comparing K-norm mechanisms. Journal of the American Statistical Association, 116 (534):935–954, 2021.arxiv.org/abs/1801.09236
  3. [3]Jordan Awan, Ana Kenney, Matthew Reimherr, and Aleksandra Slavković. Benefits and pitfalls of the exponential mechanism with applications to Hilbert spaces and functional PCA. In Proceedings of the 36th International Conference on Machine Learning, pages 374–384, 2019.arxiv.org/abs/1901.10864
  4. [4]Heinz H. Bauschke and Patrick L. Combettes. Convexity and notions of nonexpansiveness. In Convex Analysis and Monotone Operator Theory in Hilbert Spaces, pages 69–89. Springer, Cham, 2017.DOI
  5. [5]Yang Cao, Masatoshi Yoshikawa, Yonghui Xiao, and Li Xiong. Quantifying differential privacy in continuous data release under temporal correlations. IEEE Transactions on Knowledge and Data Engineering, 31(7):1281–1295, 2019.
  6. [6]Thee Chanyaswad, Alex Dytso, H. Vincent Poor, and Prateek Mittal. MVG mechanism: Differential privacy under matrix-valued query. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 230–246, 2018.DOI
  7. [7]Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
  8. [8]Christopher A. Choquette-Choo, Krishnamurthy Dvijotham, Krishna Pillutla, Arun Ganesh, Thomas Steinke, and Abhradeep Guha Thakurta. Correlated noise provably beats independent noise for differentially private learning. In International Conference on Learning Representations, 2024.
  9. [9]Jinshuo Dong, Aaron Roth, and Weijie J. Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology, 84(1):3–37, 2022.arxiv.org/abs/1905.02383
  10. [10]Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3-4):211–487, 2014.
  11. [11]Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography, pages 265–284, 2006.
  12. [12]Marián Fabian, Petr Habala, Petr Hájek, Vicente Montesinos, and Václav Zizler. Banach space theory: The basis for linear and nonlinear analysis. CMS Books in Mathematics. Springer, 2011.
  13. [13]Frédéric Ferraty and Philippe Vieu. Nonparametric functional data analysis: theory and practice. Springer Series in Statistics. Springer, New York, 2006.DOI
  14. [14]Rob Hall, Alessandro Rinaldo, and Larry Wasserman. Differential privacy for functions and functional data. Journal of Machine Learning Research, 14(21):703–727, 2013.arxiv.org/abs/1203.2570
  15. [15]Piotr Kokoszka and Matthew Reimherr. Introduction to functional data analysis. CRC Press, 2017.DOI
  16. [16]Beatrice Laurent and Pascal Massart. Adaptive estimation of a quadratic functional by model selection. The Annals of Statistics, 28(5):1302–1338, 2000.
  17. [17]Michel Ledoux and Michel Talagrand. Probability in Banach spaces: isoperimetry and processes, volume 23. Springer, 1991.DOI
  18. [18]Tucker McElroy, Anindya Roy, and Gaurab Hore. FLIP: A utility preserving privacy mechanism for time series. Journal of Machine Learning Research, 24(111):1–29, 2023.arxiv.org/abs/2207.07721
  19. [19]Ardalan Mirshani, Matthew Reimherr, and Aleksandra Slavković. Formal privacy for functional data with Gaussian perturbations. In Proceedings of the 36th International Conference on Machine Learning, volume 97, pages 4595–4604, 2019.
  20. [20]Aleksandar Nikolov, Kunal Talwar, and Li Zhang. The geometry of differential privacy: The sparse and approximate cases. In Proceedings of the 45th Annual ACM Symposium on Theory of Computing, pages 351–360, 2013.
  21. [21]Ossi Räisä, Stratis Markou, Matthew Ashman, Wessel P. Bruinsma, Marlon Tobaben, Antti Honkela, and Richard E. Turner. Noise-aware differentially private regression via meta-learning. In Advances in Neural Information Processing Systems, volume 37, pages 63873–63907, 2024.arxiv.org/abs/2406.08569
  22. [22]James O. Ramsay and Bernard W. Silverman. Functional data analysis. Springer Series in Statistics. Springer, New York, 2 edition, 2005.
  23. [23]Matthew Reimherr and Jordan Awan. Elliptical perturbations for differential privacy. In Advances in Neural Information Processing Systems, volume 32, 2019.arxiv.org/abs/1905.09420
  24. [24]A. W. van Der Vaart and J. H. van Zanten. Reproducing kernel Hilbert spaces of Gaussian priors. IMS Collections, 3:200–222, 2008.
  25. [25]Hao Wang and Zhengquan Xu. CTS-DP: Publishing correlated time-series data via differential privacy. Knowledge-Based Systems, 122:167–179, 2017.DOI
  26. [26]Jane-Ling Wang, Jeng-Min Chiou, and Hans-Georg Müller. Functional data analysis. Annual Review of Statistics and Its Application, 3:257–295, 2016.
  27. [27]Larry Wasserman and Shuheng Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association, 105(489):375–389, 2010.arxiv.org/abs/0811.2501
  28. [28]Gengyu Xue, Zhenhua Lin, and Yi Yu. Optimal estimation in private distributed functional data analysis. Journal of the American Statistical Association, 0(ja):1–86, 2026.arxiv.org/abs/2412.06582
  29. [29]Fang Yao, Hans-Georg Müller, and Jane-Ling Wang. Functional data analysis for sparse longitudinal data. Journal of the American Statistical Association, 100(470):577–590, 2005.DOI

Paper details

vlnc:W_ggv7av33
v1 · latestHistory (1)

published · Fresh — added to the Hub within the last 30 days

added ·

Usage

views · 0

downloads · 0

A view counts once per browser per day, a download each time the PDF is requested.

CC BY 4.0

Original source

  • Mathematics

Not recorded for this paper · View statement →

Looking for related papers…
Contents