The Flawed Quest for Gaussian Privacy

The ongoing struggle to balance privacy and utility in Gaussian data releases has hit a significant snag. Of the 1,536 Gaussian covariances tested, not a single one offered both moderate utility and privacy against adaptive retrieval attacks. This revelation underscores the persistent challenge in safeguarding hidden states from prying eyes.

Unpacking the Fisher-Ball Lower Bound

Researchers have established a Fisher-ball lower bound, demonstrating that any full-rank Gaussian release with constant Fisher utility will inevitably have a direction where the Mahalanobis signal grows linearly with hidden width. This finding effectively rules out the possibility of universal Gaussian safety and aligns with the observed empirical gap in privacy-utility trade-offs.

Enter the diagonal inverse-Fisher release, denoted as Σ^★_diag(𝒦). This mechanism stands out as the unique minimax-optimal diagonal approach at a first-order KL budget 𝒦. It's the only release that keeps the worst-attacker top-1 success rate below 0.001 across a 32 model-layer grid. Yet, it precariously teeters on the edge of privacy and utility rather than comfortably bridging the two.

Mechanisms Under Fire

Another mechanism, the generalized-eigen approach, initially promises a 13-fold Pareto reduction under Euclidean retrieval. However, it crumbles, revealing a 100% top-1 success rate for adaptive Mahalanobis attackers. Meanwhile, a full-trajectory sequence inverter manages to recover 94% of clean GPT-2 prefixes, but draws a blank under Σ_diag's scrutiny.

Even a split-memory transformer crafted from scratch reveals the complexities of this domain, achieving G_Mahscores between 20 and 33 at 90 million parameters. Impressively, it maintains a 6 to 24-fold advantage over comparable GPT baselines, ranging from 30 million to 1 billion parameters, under a pre-set language-modeling loss penalty. Pretrained models can reach only 9.3, highlighting the struggle of legacy approaches.

A Call for Co-Design

These results force a re-evaluation of hidden-state release strategies. Instead of solely focusing on mechanism design within the Gaussian class, there's a pressing need to consider architecture or release co-design. Why continue down a path that consistently falls short? The AI-AI Venn diagram is getting thicker, and with it, so does the urgency to rethink how we protect sensitive inferences.

If agents have wallets, who holds the keys? As we push forward, it becomes critically important to develop solutions that don't just patch over vulnerabilities but fundamentally reconsider the way privacy and utility are intertwined.