Privacy certificates show when private data supports released statements
PrivCert: Certifying Statement Support under Differential Privacy
Cryptography and SecurityMachine Learning
Summary
Protecting individual data privacy is important, but it doesn't always show whether statements made from private data are truly backed by strong evidence. The authors present PrivCert, a way to provide privacy while also issuing certificates that verify how well statements are supported by the private dataset. Their method avoids releasing unsupported claims by making explicit tests on the data before sharing any statements. They test this approach on various tasks and show it reduces unreliable information compared to other private text generation methods.
What this means in practice
- •For data science teams: Produce data reports that explicitly certify which insights are strongly supported by private datasets to improve trust in released summaries.
- •For privacy engineers: Implement privacy-preserving certificates in text-generation systems to reduce unsupported or misleading claims while maintaining formal privacy guarantees.
Authors
Tsubasa Takahashi, Takumi Hiraoka
Abstract
Differentially private (DP) text generation can protect individual records, but privacy alone does not specify what evidence a released statement carries about the underlying data. We identify this as an evidence gap: a private report may contain plausible claims without indicating whether they are strongly supported by the private dataset. We introduce PrivCert, a framework for privacy-preserving reporting that makes statement support explicit through privacy-preserving certificates and emit-or-abstain decisions. As a canonical instantiation, PrivCert-PF (Proposal-and-Filter) separates data-independent candidate discovery from private support certification, emitting only statements whose support passes a private evidence test. We provide theoretical grounding for this framework by characterizing the limits of implicit evidence under DP, deriving a sharp privacy--honesty frontier for single-statement certification, and establishing a worst-case cost for fine-grained multi-statement certification. Experiments on synthetic tasks and TAB, WildChat, and Yelp show that explicit certification maintains low unsupported emission, while free-text DP baselines frequently produce low-support claims under the same declared support semantics. We further show that the PrivCert contract can be realized with histogram, sparse-vector, and Gaussian mechanisms, and use DP synthetic data to illustrate an important boundary: support in a private proxy does not automatically certify support in the original data. Together, these results position privacy-preserving reporting as an evidence-design problem: not only how to generate private text, but what a private report can substantiate about its underlying data.