[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83784-en":3,"doc-seo-83784-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83784,4398048950312,"Violet","https://ap-avatar.wpscdn.com/avatar/400002538284de19e3c?_k=1778320343897328908",8,"Research & Report","Ball Differential Privacy How to Mitigate Data Reconstruction with Less Noise","Vector embeddings of raw records do not reliably preserve privacy because attackers can reconstruct training records from released models, even simple convex classifiers. Differential privacy offers principled protection, but its noise is calibrated to worst-case indistinguishability across arbitrary single-record changes, which can be far larger than needed for reconstruction resistance. This work introduces Ball-DP, restricting (ε,δ)-indistinguishability to single-record substitutions within a radius r in embedding space to reduce noise while retaining meaningful reconstruction robustness.","arXiv :2607 .04209v 1 [ cs .CR] 5 Jul 2026  \nBall Differential Privacy  \nHow to Mitigate Data Reconstruction with Less Noise  \nJoseph Margaryan and Nirupam Gupta  \nDepartment of Computer Science, University of Copenhagen  \nCopenhagen, Denmark  \n[josephmargaryan@gmail.com](josephmargaryan@gmail.com), [nigu@di.ku.dk](nigu@di.ku.dk)  \nAbstract  \nVector embeddings of raw records, while not human-readable, do not preserve privacy of records: an adversary can reconstruct training records from a released model even when that model is a simple convex classifier. Differential privacy (DP) is the principled defense, but its noise is calibrated to the worst-case indistinguishability; hiding arbitrary single-record substitutions, including those far outside the set of plausible alternatives relevant to a reconstruction adversary. The result is noise far larger than what reconstruction robustness requires, degrading accuracy without a corresponding security benefit.  \nWe propose Ball-DP: enforcing (ε,δ) indistinguishability over single-record substitutions restricted to a ball of radius r as per a distance metric d in the embedding space. A deployment facing only local reconstruction threat can choose a small r, thereby reduce noise and recover accuracy. The radius makes the scope of the privacy claim explicit against reconstruction attacks; standard DP is recovered when r covers the entire admissible record domain. We provide noise calibrations for regularized convex learning problems for Ball-DP, and derive the corresponding reconstruction-robustness certificates (named Ball-ReRo)– upper-bound on an attacker’s reconstruction success. By deriving the optimal finite-prior MAP reconstruction attack, we present empirical auditing of Ball-ReRo certificates for seven benchmark learning tasks. Our experiments show that calibrating noise to Ball-DP yields improvement in utility, considerably exceeding the dilution of reconstruction robustness in high privacy regimes, i.e., when ε is small.  \n1 Introduction  \nModern machine learning systems rarely operate directly on raw data. Instead, representationlearning pipelines commonly map text, images, or other types of user records to vector embeddings that can be reused by downstream task-specific classifying heads (Bengio et al., 2013; Devlin et al. , 2019; Reimers and Gurevych, 2019; Radford et al., 2021) . This representation layer creates a false sense of privacy. Embeddings may not be human-readable, yet a model trained on them can reveal information about the training records. In the informed-adversary model, for example, an attacker knowing all but one training record can identify or reconstruct training records from a released model, even if the release is a simple convex model rather than a memorizing neural network Balleet al. (2022) .  \nPrivacy-preserving AI requires guarantees that remain meaningful even against strong adversaries with side information. Differential privacy (DP) provides such a guarantee by requiring the released model to look nearly the same under arbitrary changes to a single training record (Cummings et al. , 2024a) . The parameters (ε,δ) control the strength of this indistinguishability requirement, with smaller values giving stronger protection. A common implementation is output perturbation: train  \nthe model, then add enough noise to mask the effect of any single record (Chaudhuri et al., 2011) . This worst-case calibration is simple and broadly applicable, but it can require substantial noise and therefore reduce accuracy when strong privacy is desired.  \nDP is naturally aligned with membership inference attacks (MIA), which ask whether a particular record was used to train the model: by making the released model nearly indistinguishable under any single-record changes, DP limits what an attacker can infer about involvement of specific record. However, participation is not always the sensitive fact of interest (Hayes et al., 2023; Cummings et al., 2024b) . In many s","cbCaittMOKmUcOg6","https://ap.wps.com/l/cbCaittMOKmUcOg6","pdf",976950,1,44,"English","en",105,"# Abstract\n# Introduction\n## Representation learning and privacy risk\n## Differential privacy and reconstruction attacks\n## Ball-DP and the local privacy radius","[{\"question\":\"What privacy problem does the paper target in embedding-based machine learning systems?\",\"answer\":\"It targets training-record reconstruction risk from released models built on vector embeddings, where an informed adversary can recover or narrow down hidden training records even from simple convex classifiers.\"},{\"question\":\"Why can standard differential privacy hurt model accuracy in this setting?\",\"answer\":\"Standard DP calibrates noise for worst-case indistinguishability under arbitrary single-record substitutions, including changes far outside the plausible alternatives relevant to reconstruction, leading to excessive noise and degraded accuracy.\"},{\"question\":\"How does Ball-DP differ from standard differential privacy?\",\"answer\":\"Ball-DP enforces (ε,δ)-indistinguishability only for single-record substitutions restricted to a metric ball of radius r in embedding space, making the privacy scope explicit and allowing smaller r to reduce noise under local reconstruction threats.\"}]",1784190381,111,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"ball-differential-privacy-how-to-mitigate-data-reconstruction-with-less-noise","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/ball-differential-privacy-how-to-mitigate-data-reconstruction-with-less-noise/83784/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What privacy problem does the paper target in embedding-based machine learning systems?","Question",{"text":74,"@type":75},"It targets training-record reconstruction risk from released models built on vector embeddings, where an informed adversary can recover or narrow down hidden training records even from simple convex classifiers.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"Why can standard differential privacy hurt model accuracy in this setting?",{"text":79,"@type":75},"Standard DP calibrates noise for worst-case indistinguishability under arbitrary single-record substitutions, including changes far outside the plausible alternatives relevant to reconstruction, leading to excessive noise and degraded accuracy.",{"name":81,"@type":72,"acceptedAnswer":82},"How does Ball-DP differ from standard differential privacy?",{"text":83,"@type":75},"Ball-DP enforces (ε,δ)-indistinguishability only for single-record substitutions restricted to a metric ball of radius r in embedding space, making the privacy scope explicit and allowing smaller r to reduce noise under local reconstruction threats.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":105,"slug":137},19,"General","general"]