# PAC Privacy: Automatic Privacy Measurement and Control of Data Processing

arXiv: https://arxiv.org/abs/2210.03458 · HTML: https://mlsanity.com/paper/2210.03458/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Oct 2022.

## Built on by (most cited first, 19 of 19)

- [Bounding the Invertibility of Privacy-preserving Instance Encoding using Fisher Information](https://mlsanity.com/paper/2305.04146/) (2023)
- [A Split-and-Privatize Framework for Large Language Model Fine-Tuning](https://mlsanity.com/paper/2312.15603/) (2023)
- [Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGD](https://mlsanity.com/paper/2601.10237/) (2026)
- [CPSample: Classifier Protected Sampling for Guarding Training Data During Diffusion](https://mlsanity.com/paper/2409.07025/) (2024)
- [Enhancing Feature-Specific Data Protection via Bayesian Coordinate Differential Privacy](https://mlsanity.com/paper/2410.18404/) (2024)
- [PAC Privacy Preserving Diffusion Models](https://mlsanity.com/paper/2312.01201/) (2023)
- [Private Prediction via PAC Privacy](https://mlsanity.com/paper/2601.14033/) (2026)
- [PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantization](https://mlsanity.com/paper/2605.06505/) (2026)
- [PAC-Private Autoregressive Generation: Calibrating Noise to Ensemble Disagreement](https://mlsanity.com/paper/2609.05676/) (2026)
- [A Novel Review of Stability Techniques for Improved Privacy-Preserving Machine Learning](https://mlsanity.com/paper/2406.00073/) (2024)
- [Bayes-Nash Generative Privacy Against Membership Inference Attacks](https://mlsanity.com/paper/2410.07414/) (2024)
- [Disentangling data distribution for Federated Learning](https://mlsanity.com/paper/2410.12530/) (2024)
- [Private Linear Regression with Differential Privacy and PAC Privacy](https://mlsanity.com/paper/2412.02578/) (2024)
- [Sequential Auditing for f-Differential Privacy](https://mlsanity.com/paper/2602.06518/) (2026)
- [Privatar: Scalable Privacy-preserving Multi-user VR via Secure Offloading](https://mlsanity.com/paper/2604.17476/) (2026)
- [Bayesian Membership Privacy for Graph Neural Networks](https://mlsanity.com/paper/2606.04069/) (2026)
- [Spectrum-Aware Bounds on Invertibility for Privacy-Enhancing Instance Encoding](https://mlsanity.com/paper/2608.23382/) (2026)
- [Protecting Sensitive Data in Image Synthesis via PAC-Private Adaptation for Diffusion Models](https://mlsanity.com/paper/2610.04038/) (2026)
- [From Pixels to Privacy-Sensitive Features: An Information-Theoretic Framework for Reconstruction Bounds](https://mlsanity.com/paper/2610.13768/) (2026)

## Abstract (arXiv)

We propose and study a new privacy definition, termed Probably Approximately Correct (PAC) Privacy. PAC Privacy characterizes the information-theoretic hardness to recover sensitive data given arbitrary information disclosure/leakage during/after any processing. Unlike the classic cryptographic definition and Differential Privacy (DP), which consider the adversarial (input-independent) worst case, PAC Privacy is a simulatable metric that quantifies the instance-based impossibility of inference. A fully automatic analysis and proof generation framework is proposed: security parameters can be produced with arbitrarily high confidence via Monte-Carlo simulation for any black-box data processing oracle. This appealing automation property enables analysis of complicated data processing, where the worst-case proof in the classic privacy regime could be loose or even intractable. Moreover, we show that the produced PAC Privacy guarantees enjoy simple composition bounds and the automatic analysis framework can be implemented in an online fashion to analyze the composite PAC Privacy loss even under correlated randomness. On the utility side, the magnitude of (necessary) perturbation required in PAC Privacy is not lower bounded by Theta(√d) for a d-dimensional release but could be O(1) for many practical data processing tasks, which is in contrast to the input-independent worst-case information-theoretic lower bound. Example applications of PAC Privacy are included with comparisons to existing works.