arXiv subjects

Ni Ding

Publications and source records attributed to Ni Ding.

At least 19 recordsLinked to original sources

arXiv2026

RS2AD-LiDAR: End-to-End Autonomous Driving LiDAR Data Generation from Roadside Sensor Observations

End-to-end autonomous driving solutions, which directly process multimodal sensory data and output fine-grained control commands, have gradually become a mainstream direction with the development of autonomous driving technology. However, current methods in this category rely on single-vehicle data collection for model training and optimization, which suffers from high acquisition and annotation costs, scarcity of valuable scenarios, and data silos. To address these challenges, we propose RS2AD-LiDAR, a novel framework for reconstructing and generating vehicle-mounted LiDAR data from roadside sensor observations. Since no public dataset currently provides highly overlapping perception coverage between roadside and vehicle-mounted LiDAR sensors, which is essential for studying roadside-to-vehicle data generation, we constructed a dedicated dataset named R2V-LiDAR which is used solely for evaluation in this work. Specifically, our method transforms roadside LiDAR point clouds into the vehicle-mounted LiDAR coordinate system, and synthesizes high-fidelity vehicle-mounted data via virtual LiDAR modeling and point cloud resampling techniques. To the best of our knowledge, this is the first approach to reconstruct vehicle-mounted LiDAR data from roadside sensor inputs. Extensive experimental comparisons demonstrate the semantic similarity between the generated data and real data. Furthermore, object detection experiments show that incorporating the generated data into real data for model training improves both Bird's Eye View (BEV) and 3D detection accuracy, thereby validating the effectiveness of the proposed method.

cs.CV↗

arXiv2026

$\alpha$-Wasserstein Mechanism for R\'{e}nyi Pufferfish Privacy

This paper introduces the $\alpha$-Wasserstein mechanism for achieving R\'{e}nyi Pufferfish Privacy using Laplace and Gaussian noise. By leveraging H\"{o}lder's inequality, we demonstrate that the scale parameter of the Laplace mechanism can be calibrated via an upper bound on the $W_\alpha$ metric to satisfy $(\alpha, \epsilon)$-R\'{e}nyi Pufferfish Privacy for $\alpha \in (1, \infty]$. We show that at the limit $\alpha = \infty$, this framework recovers the established $W_\infty$ mechanism for $\epsilon$-pufferfish privacy. This result is subsequently extended to the exponential mechanism. Furthermore, we propose a $W_\alpha$ mechanism for Gaussian noise for $\alpha \in (1, \infty)$, demonstrating that it generalizes existing results within the R\'enyi Differential Privacy framework. Experimental evaluations reveal that our $\alpha$-Wasserstein mechanism significantly reduces noise power compared to the conventional $W_\infty$-based approach, with the Gaussian mechanism providing superior utility over the Laplace mechanism. Notably, the mechanisms derived in this work achieve exact $(\alpha, \epsilon)$-R\'{e}nyi Pufferfish Privacy without requiring additional relaxations, such as $\delta$-approximations.

cs.CR↗

arXiv2026

R\'enyi Pufferfish Privacy with Gaussian-based Priors: From Single Gaussian to Mixture Model

R\'{e}nyi Pufferfish Privacy (RPP) provides a R\'{e}nyi divergence-based privacy framework for correlated data, but existing $\infty$-Wasserstein mechanisms are often conservative and sacrifice data utility. We study Gaussian mechanisms for RPP under Gaussian and Gaussian-mixture priors. For single Gaussian priors, we derive the exact R\'{e}nyi divergence after Gaussian perturbation, obtain a relaxed closed-form sufficient condition for $(\alpha,\epsilon)$-RPP, and characterize the monotonicity of the calibrated noise with respect to the privacy budget $\epsilon$ and the R\'{e}nyi order $\alpha$. To handle more general non-Gaussian and multimodal priors, we approximate secret-conditioned outputs with Gaussian mixture models and introduce an optimal-transport-based sufficient condition for RPP. Experiments on three UCI datasets with statistical (\textsc{RAW}, \textsc{MEAN}) and model-output (\textsc{BNN}, \textsc{GP}) queries show that our prior-aware mechanisms consistently require less noise than a recent RPP additive-noise baseline, achieving an average noise reduction of 48.9\%. These results show that our mechanisms can substantially improve the privacy-utility trade-off under RPP.

cs.CR↗

arXiv2026

Noise Reduction for Pufferfish Privacy: A Practical Noise Calibration Method

This paper introduces a relaxed noise calibration method to enhance data utility while attaining pufferfish privacy. This work builds on the existing $1$-Wasserstein (Kantorovich) mechanism by alleviating the existing overly strict condition that leads to excessive noise, and proposes a practical mechanism design algorithm as a general solution. We prove that a strict noise reduction by our approach always exists compared to $1$-Wasserstein mechanism for all privacy budgets $\epsilon$ and prior beliefs, and the noise reduction (also represents improvement on data utility) gains increase significantly for low privacy budget situations--which are commonly seen in real-world deployments. We also analyze the variation and optimality of the noise reduction with different prior distributions. Moreover, all the properties of the noise reduction still exist in the worst-case $1$-Wasserstein mechanism we introduced, when the additive noise is largest. We further show that the worst-case $1$-Wasserstein mechanism is equivalent to the $\ell_1$-sensitivity method. Experimental results on three real-world datasets demonstrate $47\%$ to $87\%$ improvement in data utility.

cs.CR↗

arXiv2025

Multi-user Pufferfish Privacy

This paper studies how to achieve individual indistinguishability by pufferfish privacy in aggregated query to a multi-user system. It is assumed that each user reports realization of a random variable. We study how to calibrate Laplace noise, added to the query answer, to attain pufferfish privacy when user changes his/her reported data value, leaves the system and is replaced by another use with different randomness. Sufficient conditions are derived for all scenarios for attaining statistical indistinguishability on four sets of secret pairs. They are derived using the existing Kantorovich method (Wasserstain metric of order $1$). These results can be applied to attain indistinguishability when a certain class of users is added or removed from a tabular data. It is revealed that attaining indifference in individual's data is conditioned on the statistics of this user only. For binary (Bernoulli distributed) random variables, the derived sufficient conditions can be further relaxed to reduce the noise and improve data utility.

cs.CR↗

arXiv2025

$\alpha$-leakage Interpretation of R\'{e}nyi Capacity

For $\tilde{f}(t) = \exp(\frac{\alpha-1}{\alpha}t)$, this paper shows that the Sibson mutual information is an $\alpha$-leakage averaged over the adversary's $\tilde{f}$-mean relative information gain (on the secret) at elementary event of channel output $Y$ as well as the joint occurrence of elementary channel input $X$ and output $Y$. This interpretation is used to derive a sufficient condition that achieves a $\delta$-approximation of $\epsilon$-upper bounded $\alpha$-leakage. A $Y$-elementary $\alpha$-leakage is proposed, extending the existing pointwise maximal leakage to the overall R\'{e}nyi order range $\alpha \in [0,\infty)$. Maximizing this $Y$-elementary leakage over all attributes $U$ of channel input $X$ gives the R\'{e}nyi divergence. Further, the R\'{e}nyi capacity is interpreted as the maximal $\tilde{f}$-mean information leakage over both the adversary's malicious inference decision and the channel input $X$ (represents the adversary's prior belief). This suggests an alternating max-max implementation of the existing generalized Blahut-Arimoto method.

cs.IT↗

arXiv2025

Hierarchical Feature-level Reverse Propagation for Post-Training Neural Networks

End-to-end neural networks have become a dominant paradigm in autonomous driving, where reliable deployment requires controllable post-training adaptation and improved transparency of model updates. In this paper, we propose Feature-level Reverse Propagation for Post-Training (FR-PT), a hierarchical framework that provides explicit intermediate supervision for upstream modules by reconstructing label-conditioned features backward through frozen downstream networks. For the first time, we formulate feature reconstruction via the Computation Consistency Principle (CCP) and Minimum Deviation Principle (MDP), and develop efficient operator-specific reverse computation algorithms with MDP-centered Tikhonov regularization to handle numerically unstable inverse problems. Specifically, FR-PT incorporates circular convolution theorem-based solvers for scalable convolutional reconstruction, nearest embedding for constructing continuous output targets from categorical labels, and iterative reverse propagation for composite residual and Transformer-style blocks. Extensive experiments on image classification and autonomous driving tasks demonstrate effective and stable adaptation across diverse architectures. Among 85 post-training settings, FR-PT achieves statistically significant improvements over task-level baselines in 63 cases, while the matched backpropagation reference outperforms reconstruction-supervised configurations in only 4 cases. Additional efficiency, conditioning, and favorable-condition analyses characterize the reliability and limitations of reconstructed targets, while feature-response analyses further demonstrate their diagnostic value. Code is available at https://github.com/Dingni2000/FR-PT .

cs.CV↗

arXiv2025

$\alpha$-GAN by R\'{e}nyi Cross Entropy

This paper proposes $\alpha$-GAN, a generative adversarial network using R\'{e}nyi measures. The value function is formulated, by R\'{e}nyi cross entropy, as an expected certainty measure incurred by the discriminator's soft decision as to where the sample is from, true population or the generator. The discriminator tries to maximize the R\'{e}nyi certainty about sample source, while the generator wants to reduce it by injecting fake samples. This forms a min-max problem with the solution parameterized by the R\'{e}nyi order $\alpha$. This $\alpha$-GAN reduces to vanilla GAN at $\alpha = 1$, where the value function is exactly the binary cross entropy. The optimization of $\alpha$-GAN is over probability (vector) space. It is shown that the gradient is exponentially enlarged when R\'{e}nyi order is in the range $\alpha \in (0,1)$. This makes convergence faster, which is verified by experimental results. A discussion shows that choosing $\alpha \in (0,1)$ may be able to solve some common problems, e.g., vanishing gradient. A following observation reveals that this range has not been fully explored in the existing R\'{e}nyi version GANs.

cs.LG↗

arXiv2024

$α$-leakage by Rényi Divergence and Sibson Mutual Information

For $\tilde{f}(t) = \exp(\frac{α-1}αt)$, this paper proposes a $\tilde{f}$-mean information gain measure. Rényi divergence is shown to be the maximum $\tilde{f}$-mean information gain incurred at each elementary event $y$ of channel output $Y$ and Sibson mutual information is the $\tilde{f}$-mean of this $Y$-elementary information gain. Both are proposed as $α$-leakage measures, indicating the most information an adversary can obtain on sensitive data. It is shown that the existing $α$-leakage by Arimoto mutual information can be expressed as $\tilde{f}$-mean measures by a scaled probability. Further, Sibson mutual information is interpreted as the maximum $\tilde{f}$-mean information gain over all estimation decisions applied to channel output.

cs.IT↗

arXiv2024

Approximation of Pufferfish Privacy for Gaussian Priors

This paper studies how to approximate pufferfish privacy when the adversary's prior belief of the published data is Gaussian distributed. Using Monge's optimal transport plan, we show that $(ε, δ)$-pufferfish privacy is attained if the additive Laplace noise is calibrated to the differences in mean and variance of the Gaussian distributions conditioned on every discriminative secret pair. A typical application is the private release of the summation (or average) query, for which sufficient conditions are derived for approximating $ε$-statistical indistinguishability in individual's sensitive data. The result is then extended to arbitrary prior beliefs trained by Gaussian mixture models (GMMs): calibrating Laplace noise to a convex combination of differences in mean and variance between Gaussian components attains $(ε,δ)$-pufferfish privacy.

cs.IT↗

arXiv2024

A Cross Entropy Interpretation of R{é}nyi Entropy for $α$-leakage

This paper proposes an $α$-leakage measure for $α\in[0,\infty)$ by a cross entropy interpretation of R{é}nyi entropy. While Rényi entropy was originally defined as an $f$-mean for $f(t) = \exp((1-α)t)$, we reveal that it is also a $\tilde{f}$-mean cross entropy measure for $\tilde{f}(t) = \exp(\frac{1-α}αt)$. Minimizing this Rényi cross-entropy gives Rényi entropy, by which the prior and posterior uncertainty measures are defined corresponding to the adversary's knowledge gain on sensitive attribute before and after data release, respectively. The $α$-leakage is proposed as the difference between $\tilde{f}$-mean prior and posterior uncertainty measures, which is exactly the Arimoto mutual information. This not only extends the existing $α$-leakage from $α\in [1,\infty)$ to the overall R{é}nyi order range $α\in [0,\infty)$ in a well-founded way with $α=0$ referring to nonstochastic leakage, but also reveals that the existing maximal leakage is a $\tilde{f}$-mean of an elementary $α$-leakage for all $α\in [0,\infty)$, which generalizes the existing pointwise maximal leakage.

cs.IT↗

arXiv2023

On the Lift, Related Privacy Measures, and Applications to Privacy-Utility Tradeoffs

This paper investigates lift, the likelihood ratio between the posterior and prior belief about sensitive features in a dataset. Maximum and minimum lifts over sensitive features quantify the adversary's knowledge gain and should be bounded to protect privacy. We demonstrate that max and min lifts have a distinct range of values and probability of appearance in the dataset, referred to as \emph{lift asymmetry}. We propose asymmetric local information privacy (ALIP) as a compatible privacy notion with lift asymmetry, where different bounds can be applied to min and max lifts. We use ALIP in the watchdog and optimal random response (ORR) mechanisms, the main methods to achieve lift-based privacy. It is shown that ALIP enhances utility in these methods compared to existing local information privacy, which ensures the same (symmetric) bounds on both max and min lifts. We propose subset merging for the watchdog mechanism to improve data utility and subset random response for the ORR to reduce complexity. We then investigate the related lift-based measures, including $\ell_1$-norm, $χ^2$-privacy criterion, and $α$-lift. We reveal that they can only restrict max-lift, resulting in significant min-lift leakage. To overcome this problem, we propose corresponding lift-inverse measures to restrict the min-lift. We apply these lift-based and lift-inverse measures in the watchdog mechanism. We show that they can be considered as relaxations of ALIP, where a higher utility can be achieved by bounding only average max and min lifts.

cs.IT↗

arXiv2022

Asymmetric Local Information Privacy and the Watchdog Mechanism

This paper proposes a novel watchdog privatization scheme by generalizing local information privacy (LIP) to enhance data utility. To protect the sensitive features $S$ correlated with some useful data $X$, LIP restricts the lift, the ratio of the posterior belief to the prior on $S$ after and before accessing $X$. For each $x$, both maximum and minimum lift over sensitive features are measures of the privacy risk of publishing this symbol and should be restricted for the privacy-preserving purpose. Previous works enforce the same bound for both max-lift and min-lift. However, empirical observations show that the min-lift is usually much smaller than the max-lift. In this work, we generalize the LIP definition to consider the unequal values of max and min lift, i.e., considering different bounds for max-lift and min-lift. This new definition is applied to the watchdog privacy mechanism. We demonstrate that the utility is enhanced under a given privacy constraint on local differential privacy. At the same time, the resulting max-lift is lower and, therefore, tightly restricts other privacy leakages, e.g., mutual information, maximal leakage, and $α$-leakage.

cs.IT↗

arXiv2022

Kantorovich Mechanism for Pufferfish Privacy

Pufferfish privacy achieves $ε$-indistinguishability over a set of secret pairs in the disclosed data. This paper studies how to attain $ε$-pufferfish privacy by exponential mechanism, an additive noise scheme that generalizes the Laplace noise. It is shown that the disclosed data is $ε$-pufferfish private if the noise is calibrated to the sensitivity of the Kantorovich optimal transport plan. Such a plan can be obtained directly from the data statistics conditioned on the secret, the prior knowledge of the system. The sufficient condition is further relaxed to reduce the noise power. It is also proved that the Gaussian mechanism based on the Kantorovich approach attains the $δ$-approximation of $ε$-pufferfish privacy.

cs.CR↗

arXiv2021

Enhancing Utility in the Watchdog Privacy Mechanism

This paper is concerned with enhancing data utility in the privacy watchdog method for attaining information-theoretic privacy. For a specific privacy constraint, the watchdog method filters out the high-risk data symbols through applying a uniform data regulation scheme, e.g., merging all high-risk symbols together. While this method entirely trades the symbols resolution off for privacy, we show that the data utility can be greatly improved by partitioning the high-risk symbols set and individually privatizing each subset. We further propose an agglomerative merging algorithm that finds a suitable partition of high-risk symbols: it starts with a singleton high-risk symbol, which is iteratively fused with others until the resulting subsets are private.~Numerical simulations demonstrate the efficacy of this algorithm in privately achieving higher utilities in the watchdog scheme.

cs.IT↗

arXiv2021

Measuring Information Leakage in Non-stochastic Brute-Force Guessing

This paper proposes an operational measure of non-stochastic information leakage to formalize privacy against a brute-force guessing adversary. The information is measured by non-probabilistic uncertainty of uncertain variables, the non-stochastic counterparts of random variables. For $X$ that is related to released data $Y$, the non-stochastic brute-force leakage is measured by the complexity of exhaustively checking all the possibilities of the private attribute $U$ of $X$ by an adversary. The complexity refers to the number of trials to successfully guess $U$. Maximizing this leakage over all possible private attributes $U$ gives rise to the maximal (i.e., worst-case) non-stochastic brute-force guessing leakage. This is proved to be fully determined by the minimal non-stochastic uncertainty of $X$ given $Y$, which also determines the worst-case attribute $U$ indicating the highest privacy risk if $Y$ is disclosed. The maximal non-stochastic brute-force guessing leakage is shown to be proportional to the non-stochastic identifiability of $X$ given $Y$ and upper bounds the existing maximin information. The latter quantifies the information leakage when an adversary must perfectly guess $U$ in one-shot via $Y$. Experiments are used to demonstrate the tradeoff between the maximal non-stochastic brute-force guessing leakage and the data utility (measured by the maximum quantization error) and to illustrate the relationship between maximin information and stochastic one-shot maximal leakage.

cs.IT↗

arXiv2021

Measuring Information Leakage in Non-stochastic Brute-Force Guessing

We propose an operational measure of information leakage in a non-stochastic setting to formalize privacy against a brute-force guessing adversary. We use uncertain variables, non-probabilistic counterparts of random variables, to construct a guessing framework in which an adversary is interested in determining private information based on uncertain reports. We consider brute-force trial-and-error guessing in which an adversary can potentially check all the possibilities of the private information that are compatible with the available outputs to find the actual private realization. The ratio of the worst-case number of guesses for the adversary in the presence of the output and in the absence of it captures the reduction in the adversary's guessing complexity and is thus used as a measure of private information leakage. We investigate the relationship between the newly-developed measure of information leakage with the existing non-stochastic maximin information and stochastic maximal leakage that are shown arise in one-shot guessing.

cs.IT↗

arXiv2021

A Linear Reduction Method for Local Differential Privacy and Log-lift

This paper considers the problem of publishing data $X$ while protecting correlated sensitive information $S$. We propose a linear method to generate the sanitized data $Y$ with the same alphabet $\mathcal{Y} = \mathcal{X}$ that attains local differential privacy (LDP) and log-lift at the same time. It is revealed that both LDP and log-lift are inversely proportional to the statistical distance between conditional probability $P_{Y|S}(x|s)$ and marginal probability $P_{Y}(x)$: the closer the two probabilities are, the more private $Y$ is. Specifying $P_{Y|S}(x|s)$ that linearly reduces this distance $|P_{Y|S}(x|s) - P_Y(x)| = (1-α)|P_{X|S}(x|s) - P_X(x)|,\forall s,x$ for some $α\in (0,1]$, we study the problem of how to generate $Y$ from the original data $S$ and $X$. The Markov randomization/sanitization scheme $P_{Y|X}(x|x') = P_{Y|S,X}(x|s,x')$ is obtained by solving linear equations. The optimal non-Markov sanitization, the transition probability $P_{Y|S,X}(x|s,x')$ that depends on $S$, can be determined by maximizing the data utility subject to linear equality constraints. We compute the solution for two linear utility function: the expected distance and total variance distance. It is shown that the non-Markov randomization significantly improves data utility and the marginal probability $P_X(x)$ remains the same after the linear sanitization method: $P_Y(x) = P_X(x), \forall x \in \mathcal{X}$.

cs.IT↗