Additional response regarding the minor points
> The neighbourhood relation is inconsistent: Section 2.1 describes substitute neighbourhood, while Section 2.2 describes add/remove neighbourhood.
Thank you for pointing this out! Our analyses are independent of the choice of the neighborhood relation, and our experiments are done with the add-remove relation. We will remove the substitution relation in Section 2.1 paragraph “Setup and notation”, mention that we use the add-remove relation in our experiments in Section 2.1, paragraph “DP-SGD”. Moreover, in Section 2.2 we will emphasize that our results are not tied to the add/remove relation.
> TPR does not necessarily need to be high for a MIA to be a relevant threat. For example, if TPR = 1% at FPR = 0.01%, the attack can very accurately identify the presence of a small number of individuals, which violates the privacy of those individuals.
This is a great point! Ultimately, defining acceptable thresholds on TPR/FPR, as we mention in the Concluding Remarks, is an open problem. We note that acceptable thresholds can be made in a context and application specific manner. For example, from the computer security literature (see, e.g., [Wang, 2018](https://arxiv.org/abs/1802.05409)), we know that if the prior probability of membership is lower than the attack’s FPR, then the majority of the attack's positive predictions will be incorrect, even if TPR is 100% (Wang 2018, p.2; formally, prior-aware positive predictive value, ppv = P(member | attack predicts 'member') can be low even if TPR = P(attack predicts 'member' | member) is high, as it depends on the base rate P(member) and is more significantly influenced by FPR than TPR). Our framework fits nicely with this literature. If in a particular context we have a guess for the adversary’s prior probability, this can be used to inform an acceptable TPR/FPR thresholds.
We will expand the short discussion in the Concluding Remarks on this limitation as follows:
“We leave open the question on how to choose the target FPR $\alpha^\star$, e.g., whether standard significance levels in sciences such as $\alpha^\star = 0.05$ are compatible with data protection regulation, **as well as what are the acceptable attack TPR levels for a given FPR**. Future work is needed to develop concrete guidance on the choice of target FPR **and TPR** informed by legal and practical constraints.”
> The results in Figure 1 could have uncertainty estimates.
Thank you for the suggestion. In the new experimental demonstration on private histogram release, described in the [general response](https://openreview.net/forum?id=hOcsUrOY0D¬eId=4H6Ec2IhLz), we added uncertainty regions for utility measurements done over 100 mechanism runs with different random seeds.
> Restating the theorems before their proofs and having the proofs in the same order as the main text would make the proofs much easier to read.
We will implement this in the final version!
---
> Are $P$ and $Q$ the correct way around in Eq. (1)? They seem to be the other way around in Gopi et al. [2021].
$P$ and $Q$ are the correct way in Gopi et al. We will fix this in the final version.
> Are the image classification results in Figure 1 comparable between standard and attack risk calibrations, since you had to use RDP due to data augmentations with the standard accountant?
Thank you for raising this point. We indeed agree that this comparison is somewhat unfair. We now reanalyzed the training pipeline from Tramer & Boneh, 2021 using Doroshenko et al. accounting so that the methods are exactly comparable. We provide the updated figure in the PDF attached in the [general response](https://openreview.net/forum?id=hOcsUrOY0D¬eId=4H6Ec2IhLz). Indeed, the TPR values obtained with standard calibration and tight accounting are somewhat lower than with RDP accounting, especially in the small $\alpha$ regime, but the general trend remains: attack-aware calibration significantly increases task accuracy at the same risk level.
> What type of subsampling and which neighbourhood relation did you use in the DP-SGD experiments?
We use the add-remove relationship in our experiments, as it is standard with modern accountants. We use Poisson sampling. The batch size in the experimental details is supposed to mean the _expected batch size._ To avoid confusion, we will clearly specify the neighborhood relation and write in the format “subsampling rate $p = 0.003801$ (corresponding to the expected batch size of 256)”.
> Line 97: the domain and range of epsilon_omega are the wrong way around. Line 164: should this have $\alpha^\star$ instead of $\alpha$? Should the support of $Y$ in line 666 be $\\{y_1, …, y_{l+1}\\}$ instead of $\\{x_1, …, x_{l+1}\\}$? Line 649: $\phi$ outputs the probability that the sample came from $Q$. I don't think Algorithm 1, line 2 works with $\alpha = 1$, the strict inequality is never satisfied. Though this should be easy to fix.
That’s right, thank you so much for spotting these! We will fix them.