Post-Processing Immunity

If a mechanism M satisfies (ε, δ)-differential privacy, then for any arbitrary function f (which may be randomized and independent of the original data), the composition f ∘ M also satisfies (ε, δ)-differential privacy.

• The function f can be any computation: aggregation, visualization, machine learning, or even adversarial analysis
• No post-processing step can create new privacy violations from an already-private output
• This holds even if f is computationally unbounded

An adversary with unlimited computational power and arbitrary auxiliary information cannot increase the privacy loss of a differentially private output through any transformation.

• Even if the adversary knows the exact post-processing algorithm
• Even if the adversary applies machine learning models to the output
• The guarantee is information-theoretic, not computational

This property enables safe data release pipelines where raw sensitive data is first processed by a differentially private mechanism, and the resulting sanitized output can be freely analyzed, visualized, and shared.

• Data curators can publish DP-protected statistics without restricting downstream use
• Third-party analysts can apply arbitrary transformations without coordination
• Enables modular privacy architectures: privatize once, use anywhere

Post-processing immunity is distinct from composition theorems. Composition governs how privacy loss accumulates when multiple mechanisms access the raw data. Post-processing immunity applies when a single mechanism's output is transformed.

• Composition: M₁(D) + M₂(D) → ε₁ + ε₂ privacy loss
• Post-processing: f(M(D)) → still only ε privacy loss
• This distinction is critical for privacy budget accounting

Post-processing immunity does not protect against:

• Re-querying the original dataset through new mechanisms, which consumes additional privacy budget
• Side-channel leakage from the implementation (timing, memory access patterns)
• Auxiliary information attacks where the adversary combines the DP output with external knowledge about specific individuals

The guarantee applies strictly to the mathematical output, not the operational context.

The proof follows directly from the data processing inequality in information theory. For any neighboring datasets D and D', and any event S in the output space of f:

• Pr[f(M(D)) ∈ S] = Pr[M(D) ∈ f⁻¹(S)]
• By DP guarantee: Pr[M(D) ∈ f⁻¹(S)] ≤ e^ε · Pr[M(D') ∈ f⁻¹(S)] + δ
• Therefore: Pr[f(M(D)) ∈ S] ≤ e^ε · Pr[f(M(D')) ∈ S] + δ

The transformation f simply reshapes the output space without accessing the raw data.

The formal rulebook for privacy budget spending. It quantifies how the total privacy loss accumulates when multiple differentially private mechanisms are applied to the same dataset.

• Sequential Composition: The epsilons and deltas simply add up.
• Advanced Composition: Tighter bounds for (ε, δ)-DP mechanisms under repeated queries.
• Post-processing immunity is critical here because it guarantees that any analysis performed on a composed output does not further degrade the accumulated guarantee.

A finite, quantifiable resource representing the total allowable privacy loss (ε) across all queries to a sensitive dataset.

• Acts as a global cap on information leakage.
• Each differentially private analysis consumes a portion of this budget.
• Post-processing immunity ensures that once an output is released under a specific budget cost, no downstream computation can retroactively increase that cost or violate the cap.

Artificially generated data produced by a differentially private algorithm. It preserves the statistical properties of the original sensitive dataset while providing a formal privacy guarantee.

• Once generated, this synthetic data can be used for arbitrary exploratory analysis, model training, and sharing.
• The entire utility of this approach hinges on post-processing immunity: analysts can run any query on the synthetic data without ever touching the raw data or consuming additional privacy budget.

An empirical audit where an adversary attempts to determine if a specific record was included in a model's training dataset.

• Serves as a key metric for measuring actual privacy leakage.
• A differentially private mechanism with a strong post-processing immunity guarantee ensures that no matter how an adversary analyzes the model's outputs, their ability to infer membership is strictly bounded by the original epsilon (ε) parameter.

A technique where randomly selecting a subset of data before applying a differentially private mechanism provides a stronger privacy guarantee than applying the mechanism to the full dataset.

• The randomness of the subsampling step amplifies the overall privacy loss bound.
• Post-processing immunity ensures that this amplified guarantee remains intact even if an attacker knows the subsampling procedure and performs complex post-hoc analyses on the aggregated results.

A privacy definition based on the Rényi divergence that provides tighter composition bounds than standard (ε, δ)-DP.

• Essential for accurate privacy accounting in iterative algorithms like DP-SGD.
• RDP naturally supports post-processing immunity: any function applied to an RDP-satisfying output does not increase the Rényi divergence, making it a robust foundation for complex, multi-stage private data pipelines.