Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning

Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning Keiyu Nosakaa , Yamato Suetakea , Yuichi Takanob,c , Yukihiko Okadab,c , Akiko Yoshiseb,c,∗ a Graduate School of Science and Technology, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan b Institute of Systems and Information Engineering, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan c Center for Artificial Intelligence Research, Tsukuba Institute for Advanced Research (TIAR), University of Tsukuba, 1-1-1, Tennodai,

arXiv:2608.18749v1 [cs.LG] 19 Aug 2026

Tsukuba, 305-8577, Ibaraki, Japan

Abstract Geometric Data Perturbation (GDP) enables one-shot, privacy-preserving collaborative learning: each participant applies a distance-preserving transformation to its private data and uploads only the resulting representation to a central analyst. We study GDP under analyst–participant collusion, in which the analyst combines all uploaded representations with the private data and transformations disclosed by colluding participants to recover a non-colluding participant’s private data. Participant-specific independent transformations resist this attack but map participants’ data into incompatible representation spaces, degrading downstream model performance. Shared-anchor alignment from Data Collaboration (DC) analysis restores compatibility and improves utility, but we show that disclosing the DC anchor matrix enables exact recovery of non-colluding participants’ private data even in the presence of collusion. Adding noise directly to the private-data representations mitigates this vulnerability but substantially reduces utility. We therefore propose adding noise to the anchor representations instead. Each participant independently transforms its private data and the shared anchor matrix, perturbs only the resulting anchor representation, and uploads both representations in a single round. Using the noisy anchor representations, the analyst aligns the private-data representations by solving a Generalized Orthogonal Procrustes Problem. We characterize alignment and recovery errors, specialize a conservative sufficient condition for convergence of the alignment to our setting, and analyze three recovery attacks. Experiments on MNIST and CelebA show that, across the evaluated attacks and deployment settings, anchor noise achieves higher learning accuracy than private-data noise at comparable measured leakage, yielding a more favorable privacy–utility trade-off under the specified collusion model. Keywords: One-Shot Representation Sharing, Geometric Data Perturbation, Data Collaboration Analysis, Anchor Alignment, Analyst-Participant Collusion, Generalized Orthogonal Procrustes Problem, Privacy-Utility Trade-off

1. Introduction Pooling data across organizations can substantially improve predictive performance and robustness, especially when models must generalize across heterogeneous populations. Yet in many domains, raw data cannot simply be shared or centralized due to legal, contractual, operational, and governance constraints [1, 2, 3, 4, 5]. Privacypreserving collaborative learning (PPCL) offers one response to this barrier: it enables organizations to participate in joint model development while constraining what other organizations, or a central analyst, can learn about their records [6, 7, 8]. We focus on a PPCL regime that we call one-shot representation sharing (OSRS). In this regime, each participant (the data-holding organization) uploads an obfuscated data matrix—a locally computed intermediate representation of its records—to a central analyst, who then trains downstream models using the uploaded representations. This ∗ Corresponding author

Email addresses: s2430118@u.tsukuba.ac.jp (Keiyu Nosaka), s2620455@u.tsukuba.ac.jp (Yamato Suetake), ytakano@sk.tsukuba.ac.jp (Yuichi Takano), okayu@sk.tsukuba.ac.jp (Yukihiko Okada), yoshise@sk.tsukuba.ac.jp (Akiko Yoshise )

upload-once, train-centrally workflow is useful when multi-round coordination is impractical, for example, because participants have limited compute resources, connectivity is unreliable, or deployment environments impose strict communication constraints [9, 10]. Whereas standard iterative federated learning algorithms repeatedly exchange and aggregate model updates, such as parameters or gradients [11, 12, 13], OSRS communicates the representation itself and requires no subsequent optimization rounds with the participants. A central design question in one-shot representation sharing is how to obfuscate the uploaded representation so that it remains useful for downstream learning while limiting the risks of reconstruction or re-identification. A standard route to formal privacy guarantees is differential privacy (DP), often instantiated by adding calibrated noise to the released representation [14, 15, 16]. DP provides principled worst-case protection, and additive perturbation has long been used as a practical privacy mechanism in distributed analysis settings [15, 16, 17]. However, in high-dimensional regimes, the noise required for strong DP guarantees can substantially distort the geometric and statistical structure that downstream models exploit, leading to pronounced privacy-utility trade-offs [18, 19]. This limitation motivates the study of alternative perturbation families that can better preserve utility under explicit threat models, while recognizing that their privacy guarantees are typically heuristic and adversary-dependent. Among these, geometric data perturbation (GDP), which applies distance-preserving transformations, is particularly attractive because it can preserve statistical and geometric structure relevant to learning while remaining computationally lightweight [20, 21]. Their vulnerabilities, as well as corresponding countermeasures, have been studied extensively in privacy-preserving data mining [22, 23]. However, these analyses do not directly address the PPCL setting considered here, where multiple participants independently hold private datasets and upload perturbed representations to a central analyst for joint downstream training. We focus on the analyst-participant collusion setting: the central analyst combines all uploaded representations with the private data and transformations disclosed by some participant to infer information about another participant’s private data. The consequences of collusion depend critically on how transformation parameters are shared across participants. We consider two regimes. In common-transform GDP (C-GDP), all participants use the same transform, whereas in independent-transform GDP (I-GDP), each participant uses a separately generated transform [24]. Under C-GDP, a colluding participant can disclose the common transform to the analyst, enabling exact inversion of the other participants’ noiseless representations. Under I-GDP, disclosure of one participant’s transform does not directly expose the transforms of the other participants. This isolation comes at a practical cost. Although each transformation preserves within-participant geometry, representations produced under different transforms do not share a common coordinate system. Directly pooling them can therefore create incompatible feature-label relationships and degrade conventional downstream learning. This leads to the central design problem addressed in this paper: how can OSRS restore cross-participant comparability without disclosing alignment information that enables exact recovery of participant-specific transforms under analystparticipant collusion? Data Collaboration (DC) analysis provides a natural candidate for restoring comparability. It introduces a synthetic anchor matrix whose rows serve as common reference records. The same raw anchor matrix is shared among all participants but is withheld from the analyst. Each participant applies its own transformation to both its private data and the anchor matrix and sends the resulting representations to the analyst. Because the anchor representations correspond to the same underlying reference records, the analyst can use them to map the participant-specific private representations into a shared coordinate system [25, 26, 27, 28]. DC-style alignment, therefore, appears to combine the isolation of I-GDP with conventional pooled learning. We show, however, that noiseless anchor alignment turns the anchor representations into an exact transformrecovery channel. If a colluding participant discloses the raw anchor matrix to the analyst, the analyst can recover the non-colluding participants’ transformations from their anchor representations, provided the required rank and identifiability conditions hold. Because GDP transformations are invertible, recovering these transformations also enables exact inversion of the corresponding noiseless private representations. A natural approach is to add isotropic Gaussian noise to the private data representations [29]. We prove that, under matched GDP parameters and the stated alignment assumptions, this modification does not create a new final-output regime. Specifically, the aligned private-data outputs of C-GDP with private-data noise [21] and DC-style anchoraligned I-GDP with private-data noise [29] are equivalent in distribution and can be coupled to coincide exactly. Consequently, noiseless anchor alignment with private-data noise reproduces the output utility—the noise behavior of its matched C-GDP counterpart—rather than resolving the underlying dilemma of transformation sharing and 2

alignment. These findings suggest perturbing the alignment signal rather than the private-data signal. We therefore add isotropic Gaussian noise to the anchor representations while leaving the private-data representations unnoised. The resulting noisy multi-participant alignment can be formulated as a generalized orthogonal Procrustes problem (GOPP), allowing us to draw on established algorithms and theoretical results for GOPP estimation and convergence [30]. Anchor noise preserves the within-participant Euclidean geometry of each private-data upload while converting exact, known-anchor transformation recovery into a noisy estimation problem whose difficulty depends on the anchor matrix, the noise level, and the available observations. The mechanism is not intended to provide record-level DP; instead, it creates tunable, attack-dependent operating points between cross-participant alignment accuracy and resistance to the evaluated reconstruction attacks. On MNIST and CelebA datasets, we observe a more favorable measured privacyutility trade-off than with C-GDP using private-data noise and, by the preceding output-equivalence result, its matched anchor-aligned I-GDP counterpart under the attacks and experimental conditions evaluated in the analyst-participant collusion setting. Participant-count experiments further suggest that anchor alignment mitigates the degradation of utility caused by independently transformed representations as the number of participants increases [24]. Overall, anchor noise restores useful cross-participant comparability, retains participant-specific transformations, and replaces exact anchor-based inversion with noise-limited transformation estimation. Figure 1 summarizes the proposed participant–analyst workflow.

Figure 1: Overview of AA-I-GDP (anchor noise) pipeline. Each participant applies a participant-specific GDP mechanism to its private-data matrix and the shared anchor matrix, adds noise only to the resulting anchor representation, and uploads both representations. From the noisy anchor representations, the analyst estimates participant-specific alignment maps, maps the private-data representations into a shared coordinate system, and trains a downstream model.

1.1. Our Contributions We propose an anchor-alignment framework with anchor noise for one-shot representation sharing based on geometric perturbations. The framework addresses the central tension between common-transform geometric data perturbation (C-GDP), which preserves cross-participant comparability but is vulnerable to disclosure of the shared transformation, and independent-transform GDP (I-GDP), which limits this direct exposure but maps participant representations into incompatible coordinate systems [21, 24]. The central innovation is to apply additive perturbation to the anchor representations used for alignment rather than to the private-data representations. This design preserves the within-participant geometry of the private-data representations while replacing exact recovery of the known-anchor transformation with noisy estimation. The proposed framework leads to four main contributions: 1. Known-Anchor Vulnerability of Noiseless Alignment: We analyze DC-style anchor alignment in the analystparticipant collusion setting [25, 26, 27]. We show that when a colluding participant reveals the raw anchor matrix and the required rank and identifiability conditions hold, the analyst can exactly recover each noncolluding participant’s GDP transformation from its uploaded anchor representation. When the transformation is invertible, and the private-data upload contains no additional noise, this recovery enables direct inversion of the corresponding private representation. 2. Equivalence of Private-Data-Noise Constructions: We establish that adding isotropic Gaussian noise to the private-data representations does not create a distinct final-output regime. Under matched GDP parameters and 3

the stated alignment assumptions, the final aligned private-data outputs of C-GDP with private-data noise [21] and anchor-aligned I-GDP with private-data noise [29] are equivalent in distribution and can be coupled to coincide pathwise. This result concerns the aligned collaboration outputs rather than the complete protocol transcripts. 3. Alignment with Anchor Noise: To address this limitation, we move the isotropic Gaussian perturbation from the private-data representations to the anchor representations. We formulate the resulting multi-participant alignment problem as a Generalized Orthogonal Procrustes Problem (GOPP), connecting the proposed framework to established algorithms and theoretical results for GOPP estimation and convergence [30]. The resulting method retains participant-specific transformations, restores a common coordinate system, and leaves the private-data representations free of additive noise while converting exact known-anchor recovery into a noiselimited transformation-estimation problem. 4. Empirical Privacy-Utility Characterization in the Analyst-Participant Collusion Setting: We evaluate downstream utility and reconstruction leakage on MNIST and CelebA datasets in the analyst-participant collusion setting. Across both datasets, anchor noise yields a more favorable measured privacy-utility trade-off than private-data noise under the evaluated reconstruction attacks. For the CelebA dataset, the participant-count replay with p ∈ {2, 5, 10, 20, 50} shows that low anchor noise restores the natural utility ordering induced by the growing training set, whereas the unaligned I-GDP controls remain non-monotone in p. 1.2. Organization Section 2 introduces the notation, the OSRS protocol, the analyst-participant collusion threat model, and the GDP and anchor-aligned baselines used throughout the paper. Section 3 identifies the alignment–recovery tension in these baselines by establishing exact known-anchor recovery for noiseless alignment and the aligned-output equivalence of the private-data-noise constructions under the stated conditions. Section 4 develops Anchor-Aligned Independent Geometric Data Perturbation with anchor noise, formulates alignment as a Generalized Orthogonal Procrustes Problem, and analyzes alignment error, solver behavior, and reconstruction risk. Section 5 evaluates the resulting privacy-utility trade-offs on MNIST and CelebA datasets, including sensitivity to the number of participants. Section 6 concludes the paper by summarizing the theoretical and empirical findings, discussing their limitations, and outlining directions for future work. Proofs of the formal results are provided in the supplementary material.

2. Preliminaries This section fixes the notation, system model, and threat model, and restates the comparison mechanisms in a common notation. GDP and its additive-noise extension follow the geometric-perturbation literature [20, 21]; independent participant-specific transforms follow I-GDP [24]; generic anchor-based collaboration follows DC [25, 26]; the noiseless anchor-aligned I-GDP protocol and its reference-participant alignment procedure follow ODC [27]; and private-data noise in DC follows [29]. 2.1. Notations For a positive integer k, we write [k] := {1, 2, . . . , k}. We denote by R p×q the set of real p × q matrices. M ∈ R p×q means M is a real p×q matrix. (M)k,l denotes the row k, column l entry of the matrix M. 1m ∈ Rm is the all-ones vector. For a matrix M, M⊤ denotes the transpose, M† the Moore–Penrose pseudoinverse [31] (e.g., M† = (M⊤ M)−1 M⊤ when M has full column rank), ∥M∥F the Frobenius norm, and tr(M) the matrix trace. We denote the orthogonal ⊤ group in Rℓ by O(ℓ) := {O ∈ Rℓ×ℓ h : iO O = Iℓ }. For a matrix M, its (thin) singular value decomposition (SVD) is written as M = UΣV ⊤ . We write Mi for k vertically stacked matrices. Equivalently, i∈[k]

h

   M1    Mi :=  ...  . i∈[k]   Mk i

4

2.2. One-Shot Representation Sharing We study the one-shot representation sharing (OSRS) regime in the PPCL setting. Assume a total of p participants and let P B [p] denote the participant set. We assume a horizontal partition: all participants use the same ddimensional feature schema, and their ni -sample record sets are disjoint. For supervised tasks, participant i also holds a label vector Li ∈ Rni . We suppress these labels from most notations and assume that they are analyst-visible and included in the same one-shot message; the reconstruction target studied here is the feature matrix Xi ∈ Rni ×d . Definition 2.1 (One-Shot Representation Sharing). In the one-shot representation sharing regime, the global recordby-feature data matrix X ∈ Rn×d is partitioned by records across p participants: X h i X = Xi Xi ∈ Rni ×d , ni = n. (1) i∈P

i∈P

Participant i holds the private submatrix Xi . For any batch size m, participant i applies a local row-wise obfuscation mechanism Mi : Rm×d → Rm×h , which maps records to h-dimensional representations. Applying this mechanism to its local data yields Yi = Mi (Xi ) ∈ Rni ×h .

(2)

Each participant communicates with the analyst exactly once by uploading Yi and the target vector Li ∈ Rni . The analyst concatenates the uploaded representations as h i Y = Yi ∈ Rn×h , (3) i∈P

and uses Y for downstream analysis, such as model training. We specifically consider the analyst-participant collusion setting, defined as follows. Definition 2.2 (Analyst-Participant Collusion Setting). Consider a one-shot representation-sharing protocol with p ≥ 2 participants and a central analyst. Let c ∈ P denote the single colluding participant. In the analyst-participant collusion setting, the attacker comprises the central analyst and participant c. For each participant i, let Θi denote all participant-side state other than the private dataset Xi , including private randomness, perturbation parameters, secret keys, and other quantities used to instantiate the obfuscation mechanism. We assume that participant c discloses both Xc and Θc in full. The analyst observes all uploaded representations {Yi : i ∈ P}. Hence, the attacker’s view is ({Yi : i ∈ P}, (Xc , Θc )) . (4) Unless stated otherwise, the attacker also knows the public protocol specification, including the functional forms of the obfuscation mechanisms and any public parameters. The attacker does not directly know the private datasets or local secret states of the non-colluding participants, except through information inferred from the analyst’s transcript and from participant c’s private dataset and local secret state. The attacker’s objective is to recover, or infer sensitive information about, the private dataset Xi ∈ Rni ×d of a non-colluding target participant i ∈ P \ {c}. 2.3. Geometric Data Perturbation Geometric Data Perturbation (GDP) is a classical approach to privacy-preserving data mining in which a data owner releases a geometrically transformed version of its dataset for analysis [20, 21]. We adopt the following established orthogonal-translation variant. Definition 2.3 (Geometric Data Perturbation). For any batch size m, a Geometric Data Perturbation (GDP) mechanism is a row-wise obfuscation map M : Rm×d → Rm×d of the form M(S) = SO + 1m Ψ⊤ ,

S ∈ Rm×d .

(5)

Here, O ∈ O(d) is an orthogonal matrix, Ψ ∈ Rd is a translation vector, and 1m ∈ Rm is the all-ones vector. Thus, the same orthogonal transformation and translation are applied to every record. 5

The orthogonal term preserves pairwise Euclidean distances and hence the geometric structure used by downstream analyses. Although unnecessary for this preservation, the translation term obscures the fixed origin, and thus the weakly perturbed region around it, when combined with an unknown orthogonal transformation; it provides no protection on its own [21]. Classical GDP assumes a single data owner and therefore does not specify how to coordinate perturbation parameters in a multi-participant PPCL protocol. The most direct baseline is for all participants to use the same GDP parameters. We refer to this regime as Common-Transform Geometric Data Perturbation. Definition 2.4 (Common-Transform Geometric Data Perturbation). Common-Transform Geometric Data Perturbation (C-GDP) is a one-shot representation-sharing regime in which all participants use a shared GDP mechanism M : Rm×d → Rm×d with common perturbation parameters (O, Ψ) for any batch size m. Thus, each participant i ∈ P, holding private data Xi ∈ Rni ×d , uploads Yi = M(Xi ) = Xi O + 1ni Ψ⊤ ,

(6)

where O ∈ O(d) is shared across participants and Ψ ∈ Rd is the shared translation vector. Classical analyses of GDP include known-input, known-sample, and Independent Component Analysis (ICA)based attacks [21, 23]. We focus on the multi-participant threat model of Definition 2.2. Disclosure of shared C-GDP parameters creates an immediate exact inversion channel: Proposition 2.5 (Secret-State Vulnerability of C-GDP in the Analyst-Participant Collusion Setting). Suppose that the uploaded representations are generated by C-GDP: Yi = Xi O + 1ni Ψ⊤ ,

i ∈ P,

where O ∈ O(d) and Ψ ∈ Rd . Let c ∈ P be the colluding participant in the analyst-participant collusion setting. If the disclosed state Θc contains (O, Ψ), then the attacker reconstructs every non-colluding participant’s private dataset exactly as   Xi = Yi − 1ni Ψ⊤ O⊤ , i ∈ P \ {c}. Proofs. Proofs of all propositions, corollaries, lemmas, and theorems stated in the main manuscript are provided in the Supplementary Material. The analyst-participant collusion setting is closely related to known-input attacks in the classical single-dataowner data-mining setting, where the attacker observes a subset of original records together with their corresponding perturbed records. A simple countermeasure studied in the GDP literature is to superimpose random noise on the geometric perturbation [21]. In our multi-participant setting, this idea yields a regime in which all participants share the same geometric transformation parameters but add independent, participant-specific noise to their transformed records before uploading the resulting representations. We refer to this regime as C-GDP (private-data noise). Definition 2.6 (C-GDP (private-data noise)). C-GDP (private-data noise) uses the common GDP mechanism M with shared parameters (O, Ψ) and adds participant-specific additive noise to each private-data representation. Participant i ∈ P samples a noise matrix Wi ∈ Rni ×d from a chosen base distribution and uploads Yi = M(Xi ) + σWi = Xi O + 1ni Ψ⊤ + σWi .

(7)

The matrices W1 , . . . , W p are sampled independently across participants and independently of the common GDP parameters, and σ ≥ 0 is the private-data-noise scale. Setting σ = 0 recovers C-GDP. Under Definition 2.2, a colluder reveals the common parameters. For any non-colluding target i ∈ P \ {c}, direct inversion gives (Yi − 1ni Ψ⊤ )O⊤ = Xi + σWi O⊤ , so the additive noise, rather than the secrecy of the common transform, is the protection in this attack channel. Common choices for additive perturbation include Laplace and Gaussian noise [14, 18]. In this study, the entries of each Wi are i.i.d. N(0, 1), so σ is the standard deviation of each added noise entry. When a formal differential 6

privacy (DP) baseline is required, σ can be calibrated according to the sensitivity of the released representation, the neighboring relation, and the target privacy parameters [16, 17]. Gaussian perturbation alone should not be interpreted as a formal DP guarantee: DP additionally requires a specified neighboring relation, bounded sensitivity (typically enforced by clipping), and calibration to explicit privacy parameters [18]. Formal DP provides principled worst-case protection, while additive noise has long been used as a practical privacy mechanism in distributed analysis settings [15, 16, 17]. In C-GDP (private-data noise), additive noise can obscure the paired raw- perturbed observations available to a colluding analyst, thereby reducing the accuracy of transform recovery. However, this protection is obtained by directly distorting the uploaded representations. In highdimensional regimes, the noise required for strong DP guarantees can substantially disrupt the geometric and statistical structure exploited by downstream learners, leading to pronounced privacy–utility trade-offs [18, 19]. This motivates alternative perturbation families that more effectively preserve useful geometric structure in the analyst-participant collusion setting, while recognizing that their privacy guarantees are typically heuristic and adversary-dependent. Motivated by the vulnerability of C-GDP in the analyst-participant collusion setting and the utility cost of additive noise, another natural alternative is to assign each participant its own geometric perturbation sampled independently [6]. We refer to this regime as Independent-Transform Geometric Data Perturbation. Definition 2.7 (Independent-Transform Geometric Data Perturbation). Independent-Transform Geometric Data Perturbation (I-GDP) is a one-shot representation-sharing regime in which each participant uses a participant-specific GDP mechanism Mi : Rm×d → Rm×d with independently sampled perturbation parameters (Oi , Ψi ) for any batch size m. Specifically, for each participant i ∈ P holding private data Xi ∈ Rni ×d , the uploaded representation is Yi = Mi (Xi ) = Xi Oi + 1ni Ψ⊤i ,

(8)

where Oi ∈ O(d) is a participant-specific orthogonal transformation and Ψi ∈ Rd is a participant-specific translation vector. The parameter pairs (O1 , Ψ1 ), . . . , (O p , Ψ p ) are sampled independently across participants. I-GDP removes the shared-parameter attack channel: for i , j, knowledge of participant i’s transformation parameters does not directly enable inversion of participant j’s upload. Its limitation is therefore cross-participant comparability rather than within-participant geometry. Each transformation preserves the Euclidean geometry of its participant’s data up to a rigid transformation, but the concatenated participant blocks lie in unrelated coordinate systems. Conventional learners, which assume that each feature coordinate has a consistent meaning across samples, may therefore lose accuracy. Expressive neural networks may partially adapt to this mismatch [6], but they do not establish an explicit shared representation and may require additional model capacity. 2.4. Data Collaboration Style Anchor-Alignment Data Collaboration (DC) analysis is an anchor-based extension of one-shot representation sharing [10, 25, 27, 32]. In DC, participants share a synthetic anchor matrix (often randomly generated) and upload only its locally transformed representations to the analyst. Definition 2.8 (DC anchor setting). Participant i ∈ P holds Xi ∈ Rni ×d , and all participants have access to a common anchor matrix A ∈ Rr×d . The anchor matrix is a participant-side shared state: it is neither included in the honest protocol transcript nor revealed to the analyst. For any batch size m, participant i has a local obfuscation map Mi : Rm×d → Rm×h . Participant i applies the same map to its private-data matrix and the shared anchor matrix and uploads Yi = Mi (Xi ),

Bi = Mi ( A).

For anchor-based protocols, the analyst-participant collusion view in Definition 2.2 must also specify the status of the participant-side shared anchor matrix. We use the following extension throughout the analysis. Definition 2.9 (Analyst-Participant Collusion Setting under DC). Consider a DC protocol with participant set P and a central analyst. Let c ∈ P denote the colluding participant. In the analyst-participant collusion setting under DC, the attacker comprises the central analyst and participant c. 7

Algorithm 1: Generic Data Collaboration Analysis Input: Private data {Xi }i∈P ; participant-side shared anchor matrix A; participant-specific maps {Mi }i∈P . Output: Aligned collaboration matrix Z. foreach i ∈ P do Yi = Mi (Xi ) and Bi = Mi ( A) Upload (Yi , Bi ) to the analyst Construct {Ni }i∈P from {Bi }i∈P Z = [Ni (Yi )]i∈P by vertical stacking return Z For each participant i, let Θi denote the participant-specific local secret state, excluding the private dataset Xi and the shared anchor matrix A. The state Θi may include private parameters, randomness, or other participantside quantities used to instantiate the obfuscation mechanism Mi and not revealed in the protocol transcript. In the DC protocol, the analyst observes all uploaded private data and anchor representations, namely {(Yi , Bi ) : i ∈ P}. In addition, participant c reveals its private dataset and local secret state. Because participant c holds the shared anchor matrix A, we assume that it also reveals A to the analyst. Hence, the attacker’s view is ({(Yi , Bi ) : i ∈ P}, (Xc , Θc ), A) .

(9)

Unless stated otherwise, the attacker also knows the public protocol specification, including the functional forms of the obfuscation mechanisms and the alignment procedure. The attacker does not directly know the private datasets or local secret states of the non-colluding participants, except through information inferred from the analyst’s transcript, participant c’s private dataset and local secret state, and the shared anchor matrix. The attacker’s objective is to recover, or infer sensitive information about, the private dataset Xi ∈ Rni ×d of a non-colluding target participant i ∈ P \ {c}. Algorithm 1 summarizes the generic DC workflow. Its method-dependent step is the construction of row-sizepreserving alignment maps Ni : Rm×h → Rm×h , for any batch size m, from the uploaded anchor representations {Bi }i∈P . Although the analyst constructs these maps using only the anchor representations, their ability to align the private-data representations {Yi }i∈P depends on the common participant-specific map Mi applied to both matrices. We call the GDP-specific instantiation considered below, which applies independent GDP transformations and aligns the resulting representations following [27], Anchor-Aligned I-GDP (AA-I-GDP). 2.4.1. Anchor-Aligned Independent GDP Definition 2.10 (Obfuscation Mechanism for Anchor-Aligned Independent GDP). Anchor-Aligned Independent GDP (AA-I-GDP) uses an independently sampled GDP mechanism Mi (S) = SOi + 1m Ψ⊤i ,

S ∈ Rm×d .

This mechanism is defined for any batch size m. Each participant samples its pair (Oi , Ψi ) independently, where Oi ∈ O(d) and Ψi ∈ Rd . Under AA-I-GDP, participant i applies its local GDP mechanism Mi consistently to both its private data and the shared anchor matrix. Hence, participant i uploads Yi = Mi (Xi ) = Xi Oi + 1ni Ψ⊤i ,

(10)

Bi = Mi ( A) = AOi + 1r Ψ⊤i .

(11)

The analyst observes the uploaded matrices {Yi , Bi : i ∈ P}, but the raw anchor matrix A is not revealed during honest execution. The uploaded anchor representations serve as a common reference object: although each Bi is expressed in participant i’s private coordinate system, all anchor representations are generated from the same underlying matrix A with matched row correspondence. 8

Algorithm 2: AA-I-GDP Alignment Procedure Input: Private data Xi ∈ Rni ×d for each i ∈ P; participant-side shared anchor matrix A ∈ Rr×d ; reference participant s ∈ P. Output: Aligned collaboration matrix Z ∈ Rn×d . /* Participant-side obfuscation foreach i ∈ P do Privately sample GDP parameters Oi ∈ O(d) and Ψi ∈ Rd , independently across participants Yi = Xi Oi + 1ni Ψ⊤i Bi = AOi + 1r Ψ⊤i Upload the pair (Yi , Bi ) to the analyst

*/

/* Analyst-side alignment foreach i ∈ P do 1 bi = B⊤i 1r r Bi = Bi − 1r b⊤i

*/

Set R s = Id , define N s (T) = T, and set Z s = Y s foreach i ∈ P \ {s} do ⊤ Compute the SVD Bi B s = Ui Σi Vi⊤ ⊤ Ri = Ui Vi   Define Ni (T) = T − 1m b⊤i Ri + 1m b⊤s for T ∈ Rm×d Z i = Ni (Yi )    Z 1    Z =  ...  ∈ Rn×d   Zp return Z Algorithm 2 specializes the generic DC workflow to AA-I-GDP. The analyst first centers each anchor representation, eliminating its participant-specific offset. A reference participant is then selected to fix the otherwise arbitrary common coordinate system. For every other participant, the SVD solves an orthogonal Procrustes problem [33, 27] between its centered anchor representation and that of the reference participant, yielding the relative rotation between their coordinate systems. The resulting alignment map subtracts the participant’s anchor-representation mean, applies this relative rotation, and adds the reference participant’s anchor-representation mean. Applying the same map to the corresponding private-data representation places it in the reference coordinate system, after which the aligned representations are vertically stacked. The alignment maps Ni constructed from Bi as in Algorithm 2 can achieve exact DC alignment under the fullcolumn-rank condition: Definition 2.11 (Exact DC Alignment). Suppose h = d and the participant-specific maps Mi are deterministic. The alignment maps achieve exact DC alignment if, for every batch size m, every i, j ∈ P, and every S ∈ Rm×d , Ni (Mi (S)) = N j (M j (S)).

(12)

Proposition 2.12 (Exact Alignment of AA-I-GDP). Suppose that, for every participant i ∈ P, the uploaded anchor representation is generated by (13) Bi = AOi + 1r Ψ⊤i . Let a=

1 ⊤ A 1r , r

A = A − 1r a ⊤ . 9

Fix a reference participant s ∈ P, and let {Ni }i∈P be the alignment maps constructed by Algorithm 2. Assume that A has full column rank, which necessarily requires r ≥ d + 1. Then the alignment maps achieve exact DC alignment in the sense of Definition 2.11. In particular, for every participant i ∈ P, every batch size m, and every input matrix S ∈ Rm×d , Ni (Mi (S)) = M s (S) = SO s + 1m Ψ⊤s . (14) Consequently, for the private-data representations, the aligned collaboration matrix satisfies Z = XO s + 1n Ψ⊤s .

(15)

Equivalently, if participant s fixes the global rigid-coordinate gauge and C-GDP is coupled to AA-I-GDP by choosing its common parameters as (O, Ψ) = (O s , Ψ s ), then the C-GDP and aligned AA-I-GDP collaboration matrices are equal pathwise for every private dataset X. This is an equality of analyst-side collaboration outputs; the protocols’ complete transcripts remain different. Although AA-I-GDP exactly restores cross-participant geometric comparability, this direct anchor-based implementation introduces a significant vulnerability in the analyst-participant collusion setting. The vulnerability arises from the shared anchor matrix. We will discuss this further in Section 3. 2.4.2. Anchor-Aligned Independent GDP with Private-Data Noise Prior DC work places calibrated noise on private-data intermediate representations while retaining noiseless anchor representations for alignment [29]. We instantiate that placement with isotropic Gaussian noise and call the resulting comparison baseline AA-I-GDP (private-data noise). Definition 2.13 (AA-I-GDP (private-data noise)). AA-I-GDP (private-data noise) uses the same participant-specific GDP mechanism Mi for the private-data matrix and the shared anchor matrix, but adds noise only to the private-data representation. Participant i samples Wi ∈ Rni ×d independently across participants and independently of (Oi , Ψi ), with entries ind (Wi )kℓ ∼ N(0, 1), k ∈ [ni ], ℓ ∈ [d]. It then uploads Yi = Mi (Xi ) + σWi = Xi Oi + 1ni Ψ⊤i + σWi ,

(16)

Bi = Mi ( A) = AOi + 1r Ψ⊤i .

(17)

The scale σ ≥ 0 controls private-data noise, with σ = 0 recovering AA-I-GDP. Gaussian noise provides a formal DP guarantee only after neighboring datasets and sensitivity are defined and σ is calibrated to a target (ε, δ)-DP level; procedures for performing this calibration in DC have been studied in [29].

3. The Alignment–Recovery Tension in Existing Constructions Section 2 established the central tension among the comparison baselines. C-GDP preserves a common coordinate system for downstream learning, but disclosure of its shared perturbation parameters permits exact inversion of every participant’s upload. I-GDP removes this shared-secret channel by using participant-specific parameters, but it places participant blocks in incompatible coordinate systems. Plain AA-I-GDP appears to reconcile these properties: under the full-column-rank condition, Proposition 2.12 shows that anchor alignment restores a common analyst-side output that is pathwise equal to gauge-matched C-GDP. This section shows why that apparent resolution is incomplete in the analyst-participant collusion setting. The anchor representations that enable exact alignment also become an exact parameter-recovery channel when a colluding participant discloses the shared raw anchor matrix. Moreover, adding isotropic Gaussian noise only to the privatedata representations leaves this channel noiseless and yields the same analyst-side collaboration-output distribution as matched C-GDP with private-data noise. These results isolate the anchor representations as the remaining point at which reconstruction risk and cross-participant alignment interact.

10

Algorithm 3: Known-Anchor Attack against AA-I-GDP in the Analyst-Participant Collusion Setting p Input: Anchor matrix A revealed by the colluder; uploaded pairs {(Yi , Bi )}i=1 ; colluder index c ∈ P. b Output: Reconstructions { Xi : i ∈ P \ {c}}. 1 a = A⊤ 1r r A = A − 1r a ⊤ foreach i ∈ P \ {c} do 1 bi = B⊤i 1r r Bi = Bi − 1r b⊤i bi = A† Bi O b⊤ a bi = bi − O Ψ i   b⊤ bi = Yi − 1n Ψ b⊤ O X i

i

i

bi : i ∈ P \ {c}} return { X 3.1. Noiseless AA-I-GDP: Exact Alignment and Known-Anchor Recovery The exact alignment established by Proposition 2.12 relies on every participant transforming the same anchor matrix. During honest execution, the analyst observes only the uploaded representations {Bi }i∈P , not the shared anchor matrix A. In the DC analyst-participant collusion view of Definition 2.9, however, a colluding participant reveals A, so the analyst obtains the known-input pair ( A, Bi ) for every participant i. Centering removes the participant-specific translation, and full column rank of A makes Oi identifiable from Bi ; the anchor means then identify Ψi . Thus, the alignment channel also becomes a transform-recovery channel. Algorithm 3 makes the resulting attack explicit. It requires no raw records from a non-colluding target: after recovering the target’s GDP parameters, the analyst directly inverts the target’s private data upload. The following proposition establishes that the attack reconstructs every non-colluding participant’s private dataset exactly under the stated noiseless and full-column-rank conditions. Proposition 3.1 (Vulnerability of AA-I-GDP in the Analyst-Participant Collusion Setting). Suppose that the uploaded representations are generated exactly by AA-I-GDP. Thus, for each participant i ∈ P, Yi = Xi Oi + 1ni Ψ⊤i ,

(18)

Bi = AOi + 1r Ψ⊤i ,

(19)

where Oi ∈ O(d) and Ψi ∈ Rd are participant-specific GDP parameters. Let a=

1 ⊤ A 1r , r

A = A − 1r a ⊤ .

Assume that A has full column rank. Consider the analyst-participant collusion setting for DC in Definition 2.9, with colluding participant c ∈ P. Under this setting, the attacker observes the shared anchor matrix A, and Algorithm 3 outputs bi = Xi X for every non-colluding participant i ∈ P \ {c}. Taken together, Propositions 2.12 and 3.1 reveal the dual role of the noiseless anchor representations. Under the same rank condition, they are sufficient to align every participant into the reference coordinate system and, once the raw anchor matrix is disclosed, to recover every participant-specific GDP transformation. With reference participant s chosen as the global rigid-coordinate gauge and C-GDP coupled through (O, Ψ) = (O s , Ψ s ), the aligned AA-IGDP and C-GDP collaboration outputs are equal pathwise. This output equality does not extend to the complete protocol transcripts, because AA-I-GDP additionally releases participant-specific anchor representations. Plain AAI-GDP therefore resolves the coordinate mismatch of I-GDP methods but relocates the exact recovery channel in the analyst-participant collusion setting from the common C-GDP parameters to the shared anchor matrix. 11

3.2. Private-Data Noise: Unchanged Alignment and Output Equivalence A natural modification is to perturb the private-data representations while retaining noiseless anchor representations for alignment. This changes the records obtained after inversion but does not perturb the recovery of the participant-specific GDP transformations from ( A, Bi ). Under the full-column-rank condition of Proposition 2.12, the noiseless anchor representations still determine Ri = O⊤i O s ,

i ∈ P,

where R s = Id . Consequently, the signal component is aligned exactly as in plain AA-I-GDP, and the private-data noise enters the collaboration matrix only after an orthogonal transformation. Proposition 3.2 (Aligned Representation under AA-I-GDP (private-data noise)). Suppose that participant i ∈ P uploads Yi = Xi Oi + 1ni Ψ⊤i + σWi and the noiseless anchor representation Bi = AOi + 1r Ψ⊤i , where Oi ∈ O(d), Ψi ∈ Rd , and Wi ∈ Rni ×d . Assume that A has full column rank, and let Ni be the alignment maps constructed from the anchor representations as in Algorithm 2, with reference participant s ∈ P. Define e i = Wi O⊤i O s , W

i ∈ P.

Then e i. Ni (Yi ) = Xi O s + 1ni Ψ⊤s + σW Consequently, e Z = XO s + 1n Ψ⊤s + σW,

h i e = W ei W

i∈P

.

If the entries of W1 , . . . , W p are mutually independent standard Gaussian variables and the collection {Wi }i∈P is jointly e are mutually independent standard Gaussian independent of all GDP parameters {(Oi , Ψi )}i∈P , then the entries of W e variables. Moreover, W is independent of the GDP parameters. Proposition 3.2 shows that the signal is mapped exactly into the reference participant’s coordinate system. Because right multiplication by an orthogonal matrix preserves independent isotropic Gaussian noise, the aligned noise has the same distribution as the noise added under matched C-GDP with private-data noise. The resulting output-level equivalence is stated next. Corollary 3.3 (Collaboration-Output Equivalence under Private-Data Noise). Assume the Gaussian-noise conditions of Proposition 3.2. Fix the GDP parameters, let Z AA denote the aligned collaboration matrix produced by AA-IGDP (private-data noise), and let Z C denote the collaboration matrix produced by C-GDP (private-data noise) with common parameters (O, Ψ) = (O s , Ψ s ). d

Writing U = V to mean that random matrices U and V have the same distribution, the two collaboration matrices satisfy d Z AA = Z C . Moreover, for any fixed realization of the AA-I-GDP variables, consider the coupling in which the standard Gaussian noise block used by C-GDP for participant i is e i = Wi O⊤i O s . W Under this coupling, Z AA = Z C . 12

Corollary 3.3 distinguishes two forms of equivalence: equality in distribution under the stated Gaussian assumptions and realization-wise equality under the specified coupling. The same coupling also makes the compared reconstruction attacks return identical noisy records. For C-GDP, known-secret inversion gives   bC = Z C − 1ni Ψ⊤s O⊤s X i i e i O⊤s = Xi + σW = Xi + σWi O⊤i . For AA-I-GDP, the full-column-rank anchor matrix permits exact recovery of (Oi , Ψi ), after which known-anchor inversion gives   biAA = Yi − 1ni Ψ⊤i O⊤i X = Xi + σWi O⊤i . These identities concern the analyst-side collaboration outputs and the two stated reconstruction attacks, not the complete protocol transcripts or arbitrary attacks. Under the full-column-rank condition, the reference-participant gauge, and the stated isotropic-Gaussian coupling, AA-I-GDP with private-data noise yields neither a distinct collaborative output nor distinct reconstruction behavior against the compared attacks; it also releases participant-specific anchor representations. Adding noise only to the private-data channel, therefore, changes the recovered records through additive noise but does not weaken the noiseless anchor-recovery channel. 3.3. Research Question: Perturbing the Alignment Signal The preceding results isolate one unresolved design variable: the anchor representations. Under the full-columnrank condition, they provide the information required for exact alignment but, once disclosed, also identify every participant-specific transformation. Private-data noise leaves both properties unchanged. The same signal, therefore, governs alignment utility and known-anchor recovery. This observation suggests relocating the perturbation from the private-data representations Yi to the anchor representations Bi used for alignment. We therefore ask: Can noise added only to the anchor representations make known-anchor recovery inaccurate in the analyst-participant collusion setting while preserving cross-participant alignment accurate enough for downstream learning? Section 4 studies this question through AA-I-GDP with anchor noise. At zero anchor noise, the protocol reduces to plain AA-I-GDP; at positive noise, both transform recovery and cross-participant alignment become approximate. The resulting problem is to characterize whether useful attack-dependent privacy-utility operating points exist between these two effects.

4. Proposed Noisy Anchor Alignment Anchor-Aligned Independent-Transform GDP with Anchor Noise (AA-I-GDP (anchor noise)) is the construction proposed in this paper. It combines participant-specific GDP transformations with noisy anchor representations and Procrustes-based alignment. Relative to AA-I-GDP (private-data noise), the method moves additive noise from the private-data upload to the anchor upload: the private-data representations remain purely geometric perturbations, whereas the uploaded anchor representations are noisy. The same participant-specific GDP parameters are used for both representations, so the anchor representations still provide the necessary alignment information, although the resulting alignment is approximate rather than exact. The optimization ingredients used below are established: the GOPP and GPM solvers are taken from [30]. Our contribution is to formulate noisy multi-participant anchor alignment as a centered GOPP, derive the protocol-specific alignment and reconstruction consequences of its solution, and specialize the cited GPM guarantees to the centered orthonormal-anchor model.

13

4.1. Protocol and Anchor-Matrix Setup Definition 4.1 (AA-I-GDP (anchor noise)). Given a participant-side shared anchor matrix A ∈ Rr×d , AA-I-GDP (anchor noise) uses the same participant-specific GDP mechanism Mi for the private-data matrix and the shared anchor matrix, but adds noise only to the anchor representation. Participant i samples Wi ∈ Rr×d independently across participants and independently of (Oi , Ψi ), with entries ind

k ∈ [r], ℓ ∈ [d].

(Wi )kℓ ∼ N(0, 1), It then uploads

Yi = Mi (Xi ) = Xi Oi + 1ni Ψ⊤i ,

(20)

Bi = Mi ( A) + vWi = AOi + 1r Ψ⊤i + vWi .

(21)

The scale v ≥ 0 controls anchor noise, with v = 0 recovering AA-I-GDP. The preceding definition applies to a participant-side shared anchor matrix A. Let r ≥ d + 1. Before any release, the participants generate a single shared anchor matrix A ∈ Rr×d satisfying 1⊤r A = 0⊤d ,

A⊤ A = Id .

(22)

Thus, the anchor matrix is centered and has orthonormal columns. The first constraint fixes its centroid at the origin, while the second fixes its scale relative to the anchor-noise parameter v. One way to generate such a matrix is to center an i.i.d. standard Gaussian matrix and take the orthonormal factor of its sign-corrected thin QR factorization; the full construction is given in the supplementary material. The same realization of A is distributed to every participant and withheld from the analyst during honest execution. Neither A nor the randomness used to generate it is included in the honest protocol transcript. The honest analyst view therefore consists of {Yi , Bi : i ∈ P} and excludes the anchor matrix A. The uploaded anchor representations Bi provide a noisy common reference object: each Bi is generated from the same underlying anchor matrix and the same participant-specific GDP mechanism used to generate Yi , but is additionally perturbed by vWi . At v = 0, the GOPP is equivalent to the exact-alignment construction under Proposition 2.12; at v > 0, the anchor noise introduces alignment error. 4.2. Alignment via the Generalized Orthogonal Procrustes Problem For each participant i ∈ P, the analyst observes the uploaded anchor representation Bi , generated as Bi = AOi + 1r Ψ⊤i + vWi . Because the uploaded anchor representations Bi are noisy transformed versions of the same latent anchor configuration, the analyst estimates participant-specific alignment maps 1   Ni : Rm×d → Rm×d , Ni (T) = T − 1m τ⊤i Ri , valid for any batch size m. Here, τi ∈ Rd and Ri ∈ O(d) are the estimated translation and orthogonal alignment for participant i. The template C ∈ Rr×d , together with the alignment parameters, is estimated by solving p X

min

C, R1 ,...,R p , τ1 ,...,τ p

s.t.

  2 C − Bi − 1r τ⊤i Ri

F

i=1

Ri ∈ O(d),

C ∈ Rr×d ,

(23) τi ∈ Rd ,

i = 1, . . . , p.

1 In AA-I-GDP, the alignment map included an additional common translation for theoretical completeness,

  ⊤ Ni (T) = T − 1m τ⊤ i Ri + 1m τ s . The common shift 1m τ⊤s translates all aligned embeddings by the same vector and therefore does not change their relative geometry. Since the collaboration coordinate system is arbitrary up to a common translation, we set τ s = 0 and omit this term throughout.

14

We refer to this problem as the generalized orthogonal Procrustes problem (GOPP) [30]: it jointly estimates the participant-specific rigid transformations that register all observed anchor matrices into a common coordinate system. The GOPP objective is invariant under a common change of origin and orientation in the collaboration coordinate system. The following proposition makes this ambiguity explicit. Proposition 4.2 (Global rigid-motion invariance of the GOPP). Suppose that   C⋆ , R⋆1 , . . . , R⋆p , τ⋆1 , . . . , τ⋆p is a minimizer of Problem (23). For any s ∈ Rd and Q ∈ O(d), define   e = C⋆ + 1r s⊤ Q, C and, for every i ∈ P,

ei = R⋆ Q, R i

e τi = τ⋆i − R⋆i s.

Then 

e R e1 , . . . , R e p ,e C, τ1 , . . . ,e τp



is also a minimizer of Problem (23) and attains the same objective value. Consequently, every minimizer belongs to an equivalence class generated by common translations and orthogonal transformations of the collaboration coordinate system. Therefore, without an external reference or a gauge-fixing constraint, the GOPP objective alone cannot yield a unique recovery of the participant-specific GDP parameters (Oi , Ψi ). Proposition 4.2 concerns the absolute origin and orientation of the collaboration coordinate system. It does not imply a loss of relative alignment: every aligned representation undergoes the same rigid transformation, which preserves pairwise Euclidean distances and the relative geometry used by downstream learning. We therefore select a convenient representative of this equivalence class by first centering the template and then eliminating the translation and template variables. Lemma 4.3 (Centering the GOPP template). Suppose that Bi ∈ Rr×d , i = 1, . . . , p, are observed, and define Φ(C, R1 , . . . , R p , τ1 , . . . , τ p ) :=

p X

  2 C − Bi − 1r τ⊤i Ri . F

i=1

Let F be the feasible set defined by C ∈ Rr×d , Ri ∈ O(d), and τi ∈ Rd for i = 1, . . . , p, and let o n F0 := (C, R1 , . . . , R p , τ1 , . . . , τ p ) ∈ F : 1⊤r C = 0⊤d . Then inf F Φ = inf F0 Φ. Hence, the GOPP may be restricted, without changing its optimal value, to templates with an average row of zero. Thus, for purposes of the optimal value and the relative geometry of the aligned representations, it suffices to restrict the GOPP to templates whose average row is zero. Indeed, whenever an unconstrained minimizer is obtained, the centering transformation used in the proof produces a centered minimizer with the same rotations, adjusted translations, and the same objective value. The corresponding aligned anchor representations are shifted only by a common translation. Hence, we may replace Problem (23) by the following centered-template GOPP. p X

min

C,R1 ,...,R p ,τ1 ,...,τ p

s.t.

  2 C − Bi − 1r τ⊤i Ri

F

i=1

Ri ∈ O(d),

r×d

C∈R

(24) 1⊤r C = 0⊤d ,

,

τi ∈ R , d

i = 1, . . . , p.

With the centered gauge fixed, the translation variables and the template can be eliminated in closed form. The following proposition collects this reduction and identifies the max-trace problem used by the GPM. 15

Proposition 4.4 (Reduction of the centered GOPP to max-trace form). Under the notation of Lemma 4.3, define 1 H := Ir − 1r 1⊤r , r

Bi := HBi ,

i = 1, . . . , p.

For fixed R1 , . . . , R p ∈ O(d), the unique minimizers over the translation variables and the centered template are τ⋆i =

1 ⊤ B 1r , r i

i = 1, . . . , p,

and

(25)

p

C⋆ =

1X Bi Ri . p i=1

(26)

Define the stacked rotation matrix and the block Gram matrix by h i R := Ri ∈ R pd×d , i∈P

and

⊤

Gi j := Bi B j ,

i, j = 1, . . . , p.

(27)

Then the rotation components of the centered GOPP minimizers are precisely the solutions of   tr R⊤ GR max R1 ,...,R p

s.t.

Ri ∈ O(d),

i = 1, . . . , p.

(28)

⋆ If VGOPP denotes the minimum of Φ over the centered feasible set F0 , and Vtr⋆ denotes the optimal value of Problem (28), then p X 2 1 ⋆ Bi F − Vtr⋆ . VGOPP (29) = p i=1

Conversely, if R⋆1 , . . . , R⋆p solve Problem (28), then Equations (25) and (26), evaluated at these rotations, produce a centered minimizer of the GOPP. Problem (28) is nonconvex and is generally difficult to solve globally. We use the spectral initialization and blockwise generalized power method of [30], specialized only in notation and dimensions to the present alignment problem. For a square matrix S ∈ Rd×d with singular value decomposition S = UΣV ⊤ , define the orthogonal polar projection Π(S) = UV ⊤ ∈ O(d). (30) If S is rank deficient, the nearest orthogonal factor may be nonunique; in that case, any choice obtained from a full singular value decomposition may be used. For a stacked matrix h i M = Mi ∈ R pd×d , Mi ∈ Rd×d , i∈P

define the blockwise polar projection by h i Π p (M) := Π(Mi )

i∈P

.

(31)

Because Problem (28) is nonconvex, we solve it using the spectral initialization and blockwise generalized power method of [30]. The top d eigenvectors of G are projected blockwise onto O(d) to initialize the rotations, which are then updated according to   R(t+1) = Π p GR(t) . (32) The iterations terminate when successive rotation estimates differ by at most ε in Frobenius norm or when T max iterations are reached. Complete pseudocode is provided in the supplementary material; satisfaction of the stopping criterion indicates numerical stabilization but does not certify global optimality. 16

Algorithm 4: AA-I-GDP with Anchor Noise Input: Private data Xi ∈ Rni ×d for each i ∈ P; anchor size r ≥ d + 1; anchor-noise scale v ≥ 0; GPM parameters T max and ε > 0. Output: Aligned collaboration matrix Z ∈ Rn×d . /* Participant-only Obfuscation Generate A satisfying (22) Distribute the same A to every participant and withhold it from the analyst foreach i ∈ P do Privately sample GDP parameters Oi ∈ O(d) and Ψi ∈ Rd , independently across participants Sample Wi ∈ Rr×d with independent standard Gaussian entries Yi = Mi (Xi ) = Xi Oi + 1ni Ψ⊤i Bi = Mi ( A) + vWi = AOi + 1r Ψ⊤i + vWi Upload (Yi , Bi ) to the analyst

*/

/* Analyst-side Alignment foreach i ∈ P do 1 bi = B⊤i 1r and Bi = Bi − 1r b⊤i r ⊤ Form G ∈ R pd×pd with blocks Gi j = Bi B j Obtain b R = [b Ri ]i∈P using the spectral-initialized GPM in (32) with (T max , ε) foreach i ∈ P do   Define Ni (T) = T − 1m b⊤i b Ri for T ∈ Rm×d Z i = Ni (Yi ) h i Z = Zi i∈P return Z

*/

For each participant, define the anchor mean bi :=

1 ⊤ B 1r ∈ Rd . r i

Using the resulting rotation estimates, AA-I-GDP (anchor noise) defines the anchor-derived alignment map   Ni (T) = T − 1m b⊤i b Ri , T ∈ Rm×d .

(33)

(34)

The analyst applies these maps to the uploaded private-data representations and forms the AA-I-GDP (anchor noise) collaboration matrix h i Z = Ni (Yi ) ∈ Rn×d . (35) i∈P

Algorithm 4 summarizes the complete honest-execution pipeline, combining the participant-only anchor-matrix setup and uploads with the analyst-side noisy-anchor alignment described above. 4.3. Alignment Error and Solver Guarantees By the participant-only anchor-matrix setup in (22), the anchor matrix is centered and has orthonormal columns. When v = 0, a zero-residual GOPP solution recovers a common effective rotation: there exists Q ∈ O(d) such that Oi b Ri = Q, Consequently, for every S ∈ Rm×d ,

i ∈ P.

Ni (Mi (S)) = SQ,

which is independent of the participant and therefore satisfies exact DC alignment. 17

(36)

(37)

When v > 0, define the average anchor-noise vector v ηi := Wi⊤ 1r . r

(38)

Because the anchor matrix is centered, the mean of participant i’s noisy anchor upload is b⊤i = Ψ⊤i + η⊤i .

(39)

Substitution into the alignment map gives   Ni (Mi (S)) = SOi + 1m Ψ⊤i − 1m b⊤i b Ri = SOi b Ri − 1m η⊤i b Ri .

(40)

Equation (40) shows that anchor noise affects the aligned representations in two distinct ways. The centered component vHWi perturbs the rotations estimated by the GOPP, whereas the mean component ηi produces a participantspecific residual translation. Exact alignment for every possible input would require both Oi b Ri = O j b Rj

(41)

η⊤i b Ri = η⊤j b Rj

(42)

and for every i, j ∈ P. The noisy GOPP controls only the first condition. Therefore, even exact recovery of the rotations would not generally restore exact alignment. The translation component admits an exact characterization independently of the GOPP rotation error. Proposition 4.5 (Residual Translation Under Gaussian Anchor Noise). Under the Gaussian anchor-noise model above, suppose that the matrices Wi , i ∈ P, are mutually independent and that the estimated rotations are computed exclusively from the centered anchor representations. Then ! v2 i ∈ P, (43) ηi ∼ N 0d , Id , r and the collection {ηi }i∈P is independent of the estimated rotations. Consequently, conditionally on the estimated rotations, the vectors b R⊤i ηi , i ∈ P, are independent and each follows

For every fixed pair i , j,

and hence

! v2 b R⊤i ηi ∼ N 0d , Id . r

(44)

! 2v2 b R⊤i ηi − b R⊤j η j ∼ N 0d , Id , r

(45)

 2 2dv2 R⊤j η j = E b R⊤i ηi − b . 2 r

(46)

Moreover, for every 0 < ζ < 1,

√ b R⊤i ηi − b R⊤j η j ≤ 2

 p 2v √ d + 2 log(1/ζ) √ r

(47)

with probability at least 1 − ζ. √ Thus, the root-mean-squared participant-to-participant translation disagreement is v 2d/r. Increasing the number of anchor rows reduces this component, whereas increasing the feature dimension or anchor-noise scale increases it. 18

We measure the rotational component of the alignment error by E := min max Oi b Ri − Q Q∈O(d) i∈P

F

.

(48)

After transposition and restriction to the centered row subspace, the centered anchor observations form an instance of the normalized Gaussian GOPP studied in [30]. The following statement is a protocol-specific specialization of [30, Theorems 3.2 and 3.3], not a new general GOPP convergence theorem. The displayed constants result from substituting the centered orthonormal-anchor dimensions into the sufficient conditions traced in the cited proofs. Theorem 4.6 (Specialization of the GPM Guarantee to a Centered Orthonormal Anchor Matrix). Let γ > 2, and initialize the GPM using the spectral estimator prescribed in [30]. An explicit conservative sufficient condition obtained from the proof of [30, Theorem 3.2] is √ p 1  . v≤ (49) √ √ p p 14336 d pd + r − 1 + 2γp log p Under this condition, with probability at least 1 − O(p−γ+2 ), the GPM converges linearly to a global maximizer of Problem (28), which is unique modulo a common orthogonal transformation. Moreover, the limiting rotations satisfy  √ √ p p v d pd + r − 1 + 2γp log p 6 . (50) E≤ √ 1 − 1/1024 p Proposition 4.5 quantifies the residual translation, whereas Theorem 4.6 controls GPM convergence and the rotational error E. Consequently, convergence to the global optimizer of the noisy GOPP does not imply exact DC alignment when v > 0. Empirical convergence reference. The theoretical condition in Equation (49) is sufficient but conservative. For normalized anchor matrices, the numerical experiments in [30, Section 4.2] identify an empirical transition near √ 1.89 p vPT := p . (51) √ p pd + r − 1 + 2 p log p Below this transition, the GPM typically reaches a certifiably global solution in the experiments of [30, Section 4.2]; above it, the probability of doing so decreases sharply. We use vPT as an empirical reference for interpreting the iteration counts, fixed-point residuals, and GOPP residuals reported in Section 5. Since our implementation does not compute the semidefinite dual certificate used in [30], these diagnostics do not independently certify global optimality. 4.4. Reconstruction Risk in the Analyst-Participant Collusion Setting We now depart from honest execution and analyze AA-I-GDP (anchor noise) in the analyst-participant collusion setting of Definition 2.9. Let c ∈ P denote the colluding participant. The analyst observes all uploaded private data and noisy anchor representations, {(Yi , Bi ) : i ∈ P}, while participant c reveals its private dataset and local secret state. Because the participant-only setup distributes the raw anchor matrix A to every participant, participant c also reveals it under Definition 2.9. Fix any non-colluding target i ∈ P \ {c}. For this target, the attacker has access to Yi = Xi Oi + 1ni Ψ⊤i ,

Bi = AOi + 1r Ψ⊤i + vWi ,

(52)

together with the raw anchor matrix A, but does not observe the target participant’s private data Xi or local secret state (Oi , Ψi , Wi ). The comparison with AA-I-GDP is immediate. In AA-I-GDP, revealing A gives the attacker a noiseless knowninput pair ( A, Bi ) for the fixed non-colluding target i ∈ P\{c}, and Proposition 3.1 shows that this is sufficient for exact reconstruction under the full-column-rank condition on the centered anchor matrix. In AA-I-GDP (anchor noise), the same disclosure gives the attacker only a noisy known-input pair because Bi = AOi + 1r Ψ⊤i + vWi . Thus, AA-IGDP (anchor noise) does not remove the anchor-based attack surface; rather, it turns the exact transform-recovery 19

attack against AA-I-GDP into a noisy transform-estimation problem. When v = 0, the known-anchor pair becomes noiseless, and AA-I-GDP (anchor noise) inherits the exact vulnerability of AA-I-GDP in the analyst-participant collusion setting. When v > 0, transform-recovery accuracy under the proposed protocol depends on v, r, and d. For a general nonnormalized anchor matrix, it additionally depends on the singular values of A, as quantified below; the normalization in (22) fixes this scale and conditioning. Define the anchor mean and the centered anchor matrix by a=

1 ⊤ A 1r , r

A = A − 1r a ⊤ .

(53)

Similarly, for the non-colluding target participant i ∈ P \ {c}, define 1 ⊤ B 1r , r i

Bi = Bi − 1r b⊤i .

(54)

v ηi = Wi⊤ 1r , r

W i = Hr Wi ,

(55)

Bi = AOi + vW i .

(56)

bi = Writing

we have bi = O⊤i a + Ψi + ηi ,

Equation (56) is the noisy known-anchor relation available in the analyst-participant collusion setting. The translation Ψi and anchor-noise mean ηi are not separately identifiable from Bi . The attacks below, therefore, center the observed anchor pair to estimate Oi and use the observed uploaded-anchor mean as a plug-in estimate for the translation. Moore–Penrose Estimator. The simplest attack ignores the orthogonality constraint on the target GDP parameter and solves the unconstrained least-squares problem bi ∈ arg min O

O∈Rd×d

Its minimum-Frobenius-norm solution is

2

Bi − AO F .

bi = A† Bi . O

(57)

(58)

This is the same pseudoinverse-based transform-recovery step used in the exact AA-I-GDP attack in the analystbi is not constrained participant collusion setting, now applied to noisy centered anchor representations. Because O to be orthogonal, or even invertible, the corresponding reconstruction uses the Moore–Penrose pseudoinverse. The attacker estimates the translation by  ⊤ bi a, bi = bi − O Ψ (59) and reconstructs

  ⊤   † bi . bi = Yi − 1ni Ψ bi X O

(60)

Orthogonal Procrustes Estimator. A structure-aware alternative enforces the structural constraint Oi ∈ O(d). It estimates the target orthogonal parameter by solving the orthogonal Procrustes problem [34] bi ∈ arg min Bi − AO 2 . O F O∈O(d)

If

⊤

A Bi = Ui Σi Vi⊤

(61)

(62)

is a singular value decomposition, then one minimizer is bi = Ui V ⊤ . O i

(63)

 ⊤ bi a bi = bi − O Ψ

(64)

The attacker then estimates the translation by

20

and reconstructs

  ⊤   ⊤ bi . bi = Yi − 1ni Ψ bi X O

(65)

Unlike the Moore-Penrose estimator, the orthogonal-Procrustes estimator is nonlinear in the anchor noise because it enforces the constraint O ∈ O(d). Thus, it does not admit the same simple, exact, unbiasedness, and variance calculation. Alignment Map Calibration Estimator. AA-I-GDP (anchor noise) also exposes information through the alignment rotations computed from the noisy anchor representations. In the noiseless exact-alignment regime, the rotations satisfy Oi b Ri = Q, i ∈ P, for some global orthogonal ambiguity Q ∈ O(d). This ambiguity is harmless for collaborative learning, but the colluding participant can calibrate it in the analyst-participant collusion setting. Specifically, the analyst knows b Rc , and participant c reveals Oc . The alignment-map calibration estimator, therefore, solves b ∈ arg min Oc b Q Rc − Q Q∈O(d)

2 F

.

(66)

Equivalently,   b = Π Oc b Q Rc = Oc b Rc ,

(67)

where Π is the orthogonal polar projection defined in (30). The target transform is then estimated by using the relation Oi b Ri ≈ Q: bi = Q bb O R⊤i . (68) Using the observed uploaded-anchor mean, the attacker estimates the translation by  ⊤ bi a bi = bi − O Ψ and reconstructs

  ⊤   ⊤ bi . bi = Yi − 1ni Ψ bi X O

(69)

(70)

This attack is included because alignment quality and reconstruction exposure in the analyst-participant collusion setting are not independent: more accurate alignment rotations may also provide more information about the participantspecific GDP transforms. The three estimators are feasible under the stated threat model but are not exhaustive. Their strongest-attack envelope is therefore a lower bound on leakage, not a privacy guarantee.

5. Experimental Evaluation This section evaluates the theoretical and methodological claims in the order that support our argument. We ask three questions: whether the exact collaboration-output and coupled-reconstruction relations in Section 3 are observed numerically; whether moving noise from private-data representations Yi to anchor representations Bi improves the measured privacy–utility frontier under the evaluated attacks; and how the proposed method behaves as the participant count changes. The first question is primarily a theory-and-implementation check, while the latter two characterize deployment-specific operating points rather than formal privacy guarantees. We use the MNIST dataset [35] as a controlled validation setting for the equivalence results and attack implementations, and the CelebA dataset [36] as the principal higher-dimensional privacy–utility evaluation. Image datasets are useful here because reconstruction leakage is directly interpretable through visual inspection and can also be quantified using independent image-recognition models. Dataset-specific preprocessing and partitioning are described in their respective subsections. All experiments were implemented in Python and executed on Google Colab Pro+ with a high-memory runtime and an NVIDIA A100 GPU. PyTorch and NumPy were used for numerical computation and model training; pandas for data management; scikit-learn and scikit-image for evaluation metrics; Pillow for image preprocessing; and Matplotlib for visualization. 21

5.1. Shared Experimental Scope and Dimensional Reduction Independent Component Analysis (ICA)-based reconstruction is a well-known threat to geometric data perturbation because square multiplicative transformations yield linear mixtures without reducing their dimensionality [20, 21]. Accordingly, non-square dimension-reducing transformations are commonly used in this literature, including in privacy-preserving collaborative learning [20, 37]. A detailed analysis and empirical evaluation of ICA-based attacks are outside the scope of this paper. Nevertheless, we apply a common rank-reducing transformation in every experiment because dimensionality reduction is standard in this literature and necessary to make learning from high-dimensional images computationally feasible. The transformation is fixed within each experiment, shared by all participants, and assumed to be known to the analyst and any attacker. Let F ∈ Rd×h , rank(F) = h < d, (71) denote the common linear projection matrix. Each participant forms ei = Xi F, X

e = XF ∈ Rn×h . X

(72)

The connection to the preceding theoretical analysis is given by the substitution (Xi , X, d)

←−

ei , X, e h). (X

(73)

Thus, all GDP and alignment operations in the experiments are performed in the projected space. b ei ∈ Rni ×h denote the attacker’s estimate of participant i’s projected data X ei . Because the common projection Let X matrix F is assumed known, the attacker reconstructs the corresponding original-space records as bi := b ei F† . X X If the projected data are recovered exactly, so that b ei = X ei , X then bi = X ei F† = Xi FF† . X Since h < d, the matrix FF† is the orthogonal projector onto the column space of F, and therefore Xi FF† generally differs from Xi . We use Xi FF† as the projection-only reconstruction control when evaluating image leakage. 5.2. MNIST Dataset: Equivalence and Controlled Validation 5.2.1. Settings We use the standard MNIST split. A fixed stratified subset of 10,000 images from the official 60,000-image training set is reserved for validation, and the remaining 50,000 images are used for training. The official 10,000image test set is not used during calibration or model selection and is reserved for final evaluation. Images are normalized to [0, 1], flattened into d = 784-dimensional row vectors, and allocated among p = 10 participants using one fixed stratified-IID partition. We use the analyst-participant collusion setting: one participant colludes with the analyst, and a distinct participant is the target of reconstruction. Every participant and compared method uses the same public, data-independent Gaussian projection [38], F ∈ R784×100 ,

iid

(F)kℓ ∼ N(0, 1),

ei = Xi F. X

The projected dimension is h = 100. The matrix F is generated once without accessing participant data or estimating a centering vector, and the same realization is fixed throughout the experiment. We compare the following six methods. For participant i, let Oi ∈ O(h) and Ψi ∈ Rh denote its independently generated GDP parameters, let A ∈ Rr×h denote the common anchor matrix, and let s ∈ P denote the fixed reference participant used for alignment. In each method containing additive noise, Wi has independent standard Gaussian 22

iid

entries, (Wi )kℓ ∼ N(0, 1), with dimensions specified below. In the matched comparisons, C-GDP uses the common parameters (O s , Ψ s ). Table 1 summarizes the private-data and anchor representations received by the analyst. A dash indicates that no anchor representation is uploaded. The participant-specific coordinate systems therefore remain unaligned under IGDP, whereas the analyst uses {Bi }i∈P to align the AA-I-GDP representations to the coordinate system of the reference participant s. For the private-data-noise methods, Wi ∈ Rni ×h and σ ≥ 0; for AA-I-GDP (anchor noise), Wi ∈ Rr×h and v ≥ 0. Table 1: Representations received by the analyst in the MNIST comparison. Method

Private-data upload Yi

Anchor upload Bi

C-GDP C-GDP (private-data noise) I-GDP AA-I-GDP AA-I-GDP (private-data noise) AA-I-GDP (anchor noise)

ei O s + 1n Ψ⊤s X i e Xi O s + 1ni Ψ⊤s + σWi ei Oi + 1n Ψ⊤ X i i ei Oi + 1n Ψ⊤ X i i ei Oi + 1n Ψ⊤ + σWi X i i ei Oi + 1n Ψ⊤ X i i

— — — AOi + 1r Ψ⊤ i AOi + 1r Ψ⊤ i AOi + 1r Ψ⊤ i + vWi

The common anchor matrix satisfies the participant-only setup in (22). It is generated independently of the participant data, shared among all participants but withheld from the analyst during honest execution, and fixed across all methods and noise draws. Specifically, we sample Ω ∈ R400×100 with independent standard Gaussian entries and compute the sign-corrected thin QR factorization H400 Ω = ARA ,

H400 = I400 −

1 1400 1⊤400 . 400

This construction gives A ∈ R400×100 satisfying 1⊤400 A = 0⊤100 ,

A⊤ A = I100 .

For each private-data-noise protocol, we evaluate 200 observations over 0 ≤ σ ≤ 50; for AA-I-GDP (anchor noise), we evaluate 200 observations over 0 ≤ v ≤ 0.5. The deterministic endpoint and noiseless controls are retained separately and excluded from the spline fits, bootstrap resampling, and quantitative plots. Utility is evaluated in the honest setting, in which the analyst observes only the representations prescribed by each method: Yi for methods without anchor alignment and (Bi , Yi ) for the AA-I-GDP variants. The analyst receives neither private participant records nor attacker-side information. For the anchor-aligned methods, Bi is used only to align the uploaded data representations before training. We quantify utility by test accuracy on the standard ten-class MNIST digit-recognition task. Following the CNN architecture used in the I-GDP study [24], each h = 100-dimensional data representation is reshaped into a single-channel 10 × 10 array. This reshaping only arranges the projected features for convolution; the resulting array is not interpreted as a reconstructed image. To preserve the reference architecture, the array is symmetrically zero-padded by three entries on every side, producing a 16 × 16 input without introducing additional features or trainable parameters. The resulting architecture is summarized in Table 2. A separate classifier is trained from scratch for every method and noise realization using cross-entropy loss and Adam with learning rate 10−3 , batch size 256, and a maximum of 15 epochs. The checkpoint attaining the highest validation balanced accuracy is retained for final test evaluation. All fits use identical deterministic parameter initialization and minibatch-order seeds, but do not share learned weights. Consequently, differences in test accuracy reflect the perturbation method and noise realization rather than differences in initialization or training order. Privacy is evaluated in the analyst-participant collusion setting. Let c denote the colluding participant and i , c the reconstruction target. The analyst observes every upload; the public projection matrix F is known; and participant c discloses its projected records and its complete local secret state. For anchor-aligned methods, the colluder also reveals A. For C-GDP and C-GDP (private-data noise), the common parameters (O s , Ψ s ) are therefore known exactly, 23

Table 2: CNN architecture used to evaluate MNIST utility. Stage Reshape Zero padding Convolution 1 Max pooling 1 Convolution 2 Max pooling 2 Flatten Fully connected Output

Operation 100-dimensional row to one channel Three entries on every spatial boundary 10 valid 5 × 5 filters, stride 1, ReLU 2 × 2 pooling, stride 2 20 valid 5 × 5 filters, stride 1, ReLU 2 × 2 pooling, stride 2 Vectorization 20 → 50, ReLU 50 → 10

Output size 1 × 10 × 10 1 × 16 × 16 10 × 12 × 12 10 × 6 × 6 20 × 2 × 2 20 × 1 × 1 20 50 10 logits

and we use only the known-secret inversion  ei ,    C-GDP,  X b ⊤ ⊤ e X i = Y i − 1 ni Ψ s O s =  e ⊤  Xi + σWi O s , C-GDP (private-data noise).

(74)

I-GDP is retained solely as a utility baseline; attacks against I-GDP are outside the scope of this paper, so we do not assign it a reconstruction or leakage score. For AA-I-GDP and AA-I-GDP (private-data noise), disclosure of the centered orthonormal anchor matrix gives bi = and hence

1 ⊤ B 1r , r i

Bi = Bi − 1r b⊤i ,

bi = A⊤ Bi , O

 ei ,    AA-I-GDP,  X b ⊤ b⊤ e Xi = Yi − 1ni bi Oi =  e ⊤  Xi + σWi Oi , AA-I-GDP (private-data noise).

(75)

(76)

For AA-I-GDP (anchor noise), we evaluate the Moore–Penrose (MP), Orthogonal-Procrustes (OP), and alignmentmap-calibration (AM) estimators introduced in Subsection 4.4: MP    b ei = Yi − 1ni b⊤i A⊤ Bi † , X

OP     b ei = Yi − 1ni b⊤i Π A⊤ Bi ⊤ , X

AM    ⊤  b ei = Yi − 1ni b⊤i Π Oc b Rc b R⊤i . X

(77)

Each applicable reduced-space estimate is decoded as bi = b ei F† . X X

(78)

Privacy is assessed visually and via exact-source linkage by an independent auditor, trained once on clean 28 × 28 MNIST images and then frozen. For each reconstructed target image, a ten-way gallery contains its clean source image and nine distinct clean images with the same digit label. The auditor maps the reconstruction and all candidates to normalized 128-dimensional penultimate-layer embeddings, and selects the candidate with the largest cosine similarity. Exact-source linkage accuracy is the proportion of the 1,000 fixed queries for which the true source is selected. Because every candidate in a gallery has the same digit label, the analyst-visible target label does not distinguish the source candidates. Random guessing yields an accuracy of 0.10; higher accuracy indicates greater source-specific leakage and therefore weaker privacy. The auditor architecture is summarized in Table 3. The ten-class head is used only to train the auditor; privacy evaluation uses the frozen 128-dimensional embedding. 5.2.2. Results Figures 2 and 3 summarize privacy in the analyst-participant collusion setting. Figure 2 reports exact-source linkage accuracy for 200 observations per noisy protocol over 0 ≤ σ ≤ 50 for private-data noise and 0 ≤ v ≤ 0.5 for anchor noise. Each point is the proportion of 1,000 ten-way same-digit galleries in which the frozen auditor links a reconstructed query to its true clean source. Panel (a) shows the shared C-GDP known-secret and AA-I-GDP known-anchor private-data-noise trajectory, whose paired observations coincide exactly, while panel (b) overlays the MP, OP, and AM attacks against AA-I-GDP (anchor noise). Curves are descriptive fixed cubic regression-spline fits 24

Table 3: CNN architecture used to train the frozen MNIST linkage auditor. Stage Input Convolution 1 Convolution 2 Max pooling 1 Convolution 3 Max pooling 2 Flatten Embedding Training head

Operation Clean or reconstructed grayscale image 32 3 × 3 filters, padding 1, ReLU 64 3 × 3 filters, padding 1, ReLU 2 × 2 pooling, stride 2 64 3 × 3 filters, padding 1, ReLU 2 × 2 pooling, stride 2 Vectorization 3136 → 128, ReLU 128 → 10

Output size 1 × 28 × 28 32 × 28 × 28 64 × 28 × 28 64 × 14 × 14 64 × 14 × 14 64 × 7 × 7 3136 128 10 logits

with five equally spaced interior knots, and shaded regions are 95% pointwise percentile-bootstrap bands from 10,000 resamples. Dash-dotted horizontal lines indicate the corresponding noiseless controls, while the gray dotted 10% line indicates uniform guessing. Figure 3 provides corresponding qualitative examples; fixed-digit grids for digits 0–9 are provided in the supplementary material. The results support the predicted collaboration-output and reconstruction agreement under the stated coupling. The noiseless known-secret and known-anchor controls both attain 36.7% exact-source linkage, the projection-limited level after decoding through F† . All 200 paired private-data-noise observations also have identical noise scales and linkage values, so panel (a) displays them as one shared marker set and fitted curve. The shared fit decreases to 14.39% at σ = 20 and 11.11% at σ = 50; at the latter value, its 95% pointwise band is 10.46–11.84%. It therefore approaches, but does not cross, the 10% chance level within the calibrated range. The noiseless C-GDP and AA-I-GDP rows in Figure 3 likewise recover the projection-only control defined above, as predicted by Proposition 2.12. The different anchor representations remain part of the AA-I-GDP transcript. Among the three attacks against AA-I-GDP (anchor noise), OP is the strongest evaluated attack: its mean exactsource linkage is 20.44%, compared with 15.61% for MP and 16.01% for AM, and it attains the pointwise maximum in 187 of the 200 draws, including ties. At v = 0.15, the fitted linkage accuracies are 9.88%, 17.17%, and 11.01% for MP, OP, and AM, respectively. The OP fit then decreases to 14.04% at v = 0.20, 12.13% at v = 0.30, and 11.59% at v = 0.50. Its 95% pointwise band at v = 0.50 is 9.14–13.09%, which includes chance, although the fitted OP curve itself does not cross 10% within the evaluated range. MP and AM reach the chance region earlier, but those attacks are weaker; values below 10% are interpreted as finite-gallery variation rather than performance below random guessing. Figure 4 reports held-out test balanced accuracy for 200 observations per noisy protocol over 0 ≤ σ ≤ 50 for private-data noise and 0 ≤ v ≤ 0.5 for anchor noise. The curves are descriptive fixed cubic regression-spline fits with five equally spaced interior knots, and the shaded regions are 95% pointwise percentile-bootstrap bands from 10,000 resamples. These bands describe sensitivity to noise in the observations conditional on the fixed deployment, rather than uncertainty across alternative deployments. Horizontal lines denote random guessing, the noiseless CGDP/AA-I-GDP reference, and noiseless I-GDP. In panel (b), filled markers denote runs that reached the numerical GPM stopping criterion before 500 iterations, whereas open markers denote the returned iterate at the iteration limit. This diagnostic records numerical termination and does not, by itself, certify global optimality. The noiseless C-GDP and AA-I-GDP controls both attain 90.9641% balanced accuracy, compared with 56.3685% for I-GDP. Under private-data noise, the paired analyst-side data matrices produced by C-GDP and AA-I-GDP agree up to a maximum relative Frobenius discrepancy of 6.0 × 10−14 . Their separately trained classifiers consequently produce fitted curves that are numerically indistinguishable at the scale of the experiment: at σ = 5, the fitted accuracies are 82.0035% for C-GDP and 82.0022% for AA-I-GDP, and at σ = 10 they are 62.2566% and 62.2640%, respectively. The remaining fit-level differences arise from finite-precision computation and validation-checkpoint selection, rather than a substantive difference between the protocols. As σ increases, the additive private-data noise dominates the digit signal, and both methods approach the 10% random-guessing level. Their fits cross the I-GDP reference at approximately σ = 11.68 and attain 11.0668% and 10.9004%, respectively, at σ = 50. Panel (b) shows a different response to anchor noise. The fitted accuracy is 87.5476% at v = 0.05, 74.7281% at v = 0.10, 64.1547% at v = 0.15, and 60.4892% at v = 0.20, after which it remains near 59% over most of 0.3 ≤ v ≤ 0.5. Anchor noise does not directly corrupt the uploaded private-data matrices; instead, it progressively removes participant-specific transformation information from the estimated alignments. Over the evaluated range, 25

Exact-Source Linkage Accuracy (%)

(a) C-GDP / AA-I-GDP (private noise)

(b) AA-I-GDP (anchor noise)

40 35 30 25 20 15 10 5

0

10

20

30

Noise Scale σ

40

C-GDP / AA-I-GDP (private noise) 200 random noise draws AA-I-GDP (anchor noise): MP

50

0.0

0.1

AA-I-GDP (anchor noise): OP AA-I-GDP (anchor noise): AM 95% conditional band

0.2

0.3

Noise Scale v

0.4

0.5

Random guess (10%) C-GDP / AA-I-GDP

Figure 2: MNIST exact-source linkage in the analyst-participant collusion setting. Panel (a) shows the exactly coincident C-GDP and AA-I-GDP private-data-noise attacks over 0 ≤ σ ≤ 50 as one shared trajectory, while panel (b) overlays the MP, OP, and AM attacks against AA-I-GDP (anchor noise) over 0 ≤ v ≤ 0.5. Each series contains 200 observations, and each observation is evaluated on the same 1,000 fixed ten-way same-digit galleries. Curves are descriptive fixed cubic regression-spline fits, and shaded regions are 95% pointwise percentile-bootstrap bands from 10,000 resamples. Deterministic endpoint controls are excluded. Horizontal lines denote the noiseless controls and 10% random guessing.

the resulting utility therefore approaches the independently transformed I-GDP regime rather than random guessing, with the observed plateau lying close to the 56.3685% I-GDP reference. This is a finite-range empirical pattern rather than an asymptotic equality, because the residual translation error also increases with v and may further reduce utility outside the calibrated range. For p = 10, h = 100, and r = 400, substituting d ← h into Equation (51) gives the empirical phase-transition reference vPT = 0.0977 reported in [30, Section 4.2]. Of the 200 anchor-noise observations, 50 reached the numerical stopping criterion before 500 iterations, and 150 returned capped iterates. The transition is concentrated near v = 0.08: the largest noise level that reached the criterion is 0.0809, the smallest capped level is 0.0801, all 50 runs that reached the criterion lie below vPT , and no run above vPT reached it. The observed transition is therefore qualitatively consistent with the scale and direction of the cited empirical reference, although it occurs slightly earlier in this deployment. The experiments in [30, Section 4.2] concern solutions subsequently certified as globally optimal, whereas our implementation records only a step-based stopping criterion and does not compute the corresponding certificate; moreover, the sufficient condition in Equation (49) lies several orders of magnitude below the sampled nonzero range. The utility curve declines smoothly through both the observed stopping transition and vPT , attaining approximately 80.1% at v = 0.08 and 75.4% at v = 0.0975. Thus, the stopping transition characterizes solver behavior but does not appear as a discrete accuracy threshold: capped iterates remain useful, and the experiment does not isolate a causal effect of global convergence on utility because increasing v simultaneously worsens alignment and makes numerical convergence more difficult. Figure 5 fits utility directly as a function of exact-source linkage using 200 observations per displayed method. The private-data-noise trajectory reports C-GDP only because AA-I-GDP has exactly the same linkage values and a numerically indistinguishable utility curve under the matched construction; both utility series remain visible in Figure 4(a). I-GDP is shown only as a horizontal utility reference because attacks against I-GDP are outside the scope of this paper, and no reconstruction or leakage score is assigned to it. OP is displayed for anchor noise because it is the strongest of the three evaluated reconstruction attacks over most of the privacy transition. Relocating noise from the private-data representations to the anchor representations materially changes the lowleakage trade-off in Figure 5. At 12.4% exact-source linkage, the fitted balanced accuracy is 59.2% for anchor noise, 26

0

Original

1

2

3

4

5

6

7

8

9

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure 3: Representative MNIST reconstructions in the analyst-participant collusion setting. Columns correspond to digits 0–9 and use distinct source records. Within every noisy row, the leftmost reconstruction is the zero-noise control, and the remaining reconstructions are selected so that full-test exact-source linkage decreases from left to right, ending at an observed chance or chance-compatible value. Linkage percentages shown beneath the images are computed over the complete 1,000-query linkage evaluation and are not per-image probabilities. The noiseless C-GDP and AA-I-GDP attacks recover the projection-only control Xi FF† . Fixed-digit sweeps organized by the same exact-source criterion are provided in the supplementary material.

with a 95% pointwise band of 58.4–60.0%, compared with 15.1% and 13.9–16.4% for C-GDP private-data noise. At 20% linkage, the fitted accuracies are 68.2% and 58.5%, an anchor-noise advantage of 9.7 percentage points. At 30%, the estimates are 85.5% and 83.4%, and the pointwise bands overlap. Thus, anchor noise preserves materially greater utility in the privacy-relevant low-linkage region under the evaluated fixed deployment, while the difference narrows as leakage increases. This conclusion includes all returned solver outputs: 50 of the 200 anchor-noise runs reached the stopping criterion before 500 iterations, and 150 returned capped iterates. 5.3. CelebA Dataset: Main Privacy–Utility Evaluation 5.3.1. Settings Each CelebA image is center-cropped, bilinearly resized to 64 × 64 RGB, normalized to [0, 1], and flattened into a d = 12,288-dimensional row vector. We reserve exactly 10,000 images whose identities are disjoint from those of all participants as a public dimensional-reduction pool. An uncentered rank-400 truncated SVD is fitted to this pool, and the first h = 400 orthonormal right singular vectors form the common matrix F ∈ R12,288×400 , for which F⊤ F = I400 . ei = Xi F, and the resulting 400-dimensional rows are reshaped into single-channel 20 × 20 Every participant forms X arrays for downstream learning. The inverse used by every reconstruction attack is F† = F⊤ , so exact projected-space recovery produces the public-SVD reconstruction floor Xi FF⊤ . 27

MNIST Test Balanced Accuracy (%)

100

(a) Private-data noise

(b) Anchor noise

90 80 70 60 50 40 30 20 10 0

0

10

20

30

Private-Data Noise Scale σ

40

50

C-GDP (private noise) AA-I-GDP (private noise) 200 random noise draws

0.0

0.1

0.2

0.3

Anchor-Noise Scale v

AA-I-GDP (anchor noise) 95% conditional band Random guess (10%)

0.4

0.5

C-GDP AA-I-GDP I-GDP

Figure 4: MNIST utility under private data and anchor noise. Panel (a) reports separate C-GDP and AA-I-GDP private-data-noise observations over 0 ≤ σ ≤ 50, and panel (b) reports AA-I-GDP (anchor noise) over 0 ≤ v ≤ 0.5. Each noisy protocol contains 200 observations. Curves are descriptive fixed cubic regression-spline fits, and shaded regions are 95% pointwise percentile-bootstrap bands from 10,000 resamples. Deterministic endpoint controls are excluded. Filled anchor-noise markers met the GPM convergence criterion, while open markers reached the 500-iteration limit. Horizontal lines indicate random guessing, noiseless C-GDP/AA-I-GDP, and noiseless I-GDP.

100

Random guess (10% on either axis) C-GDP (private-data noise) AA-I-GDP (anchor noise), OP attack C-GDP / AA-I-GDP (no noise) I-GDP balanced accuracy

preferred: upper left

90

MNIST Test Balanced Accuracy (%)

80 70 60 50 40 30 20 10 0

5

10

15

20

25

30

Exact-Source Linkage Accuracy (%)

35

40

Figure 5: MNIST privacy–utility trade-off in the analyst-participant collusion setting. The horizontal axis shows exact-source linkage accuracy, and the vertical axis shows held-out test balanced accuracy, so the preferred region is the upper-left. Each faint marker pairs leakage and utility from one of 200 observations. The blue curve reports C-GDP (private-data noise), and the dashed orange curve reports AA-I-GDP (anchor noise) under the OP attack. Each curve is a fixed cubic regression spline of balanced accuracy on exact-source linkage with five equally spaced interior knots; shaded regions are 95% pointwise percentile-bootstrap bands from 10,000 paired resamples. The star is the noiseless C-GDP/AA-I-GDP benchmark, the dash-dotted horizontal line is I-GDP utility, and the dotted lines mark 10% random guessing. Filled OP markers met the GPM stopping criterion, while hollow markers reached the 500-iteration limit.

28

We use one fixed identity-disjoint allocation with p = 10 participants and 100 identities per participant. Within each participant, 70 identities are assigned to training, 15 to validation, and 15 to testing; all images of an identity remain in its assigned split, and identities are disjoint across both participants and splits. Before forming the protocol data, one image from each selected identity is reserved exclusively as a clean privacy reference and is never included in the uploaded representations or downstream training. In the analyst-participant collusion setting, participant 1 (implementation index 0) colludes with the analyst, and participant 2 (implementation index 1) is the reconstruction target. The final linkage evaluation uses one protected query from each of the target participant’s 100 identities, covering the training, validation, and test identity splits. The MNIST results in Subsection 5.2, together with Proposition 2.12 and Corollary 3.3, show that noiseless AA-I-GDP and AA-I-GDP (private-data noise) do not provide distinct analyst-side collaboration-output baselines from their C-GDP counterparts under the stated full-rank, gauge, and coupling conditions. We therefore compare C-GDP, I-GDP, C-GDP (private-data noise), and AA-I-GDP (anchor noise). The common anchor matrix satisfies the participant-only setup in (22): a participant-side Gaussian matrix Ω ∈ R1600×400 is sampled once and centered and orthonormalized to obtain A, which is shared among all participants but withheld from the analyst during honest execution. Thus, 1⊤1600 A = 0⊤ and A⊤ A = I400 . Each noisy method is evaluated using 200 observations: 0 ≤ σ ≤ 3 for C-GDP (private-data noise) and 0 ≤ v ≤ 0.25 for AA-I-GDP (anchor noise). Utility is the held-out balanced accuracy for predicting the CelebA Smiling attribute in the honest setting, where the analyst receives only the method-appropriate representations. The 20 × 20 representation is processed by the same reference architecture used in Subsection 5.2. The checkpoint with the highest validation balanced accuracy is used once for test evaluation. Privacy is evaluated in the analyst-participant collusion setting after decoding every recovered projected representation with F† . C-GDP is evaluated by exact known-secret inversion, C-GDP (private-data noise) by its known-secret inversion, and AA-I-GDP (anchor noise) by the MP, OP, and AM attacks defined above. I-GDP is retained solely as a utility baseline; attacks against I-GDP are outside the scope of this paper, so we do not assign it a reconstruction or identity-linkage score. A frozen Inception-ResNet-v1 model [39], pretrained on VGGFace2 [40], maps each clean or reconstructed face to a normalized 512-dimensional embedding. Cross-image identity linkage matches each reconstructed query against a ten-way gallery containing a different reserved image of the same identity and nine reserved images of other identities. We generate ten deterministic galleries per identity, yielding 1,000 linkage episodes per attack; random guessing is 10%, and higher accuracy indicates greater identity leakage. 5.3.2. Results Figure 6 reports privacy, Figure 7 reports utility, and Figure 8 reports their joint relationship. Each noisy method contributes 200 observations over 0 ≤ σ ≤ 3 for private-data noise or 0 ≤ v ≤ 0.25 for anchor noise. The curves are descriptive fixed-cubic regression-spline fits with five equally spaced interior knots, and the shaded regions are 95% pointwise percentile bootstrap bands from 10,000 multinomial resamples of the 200 observations. Endpoint and equivalence controls are excluded from fitting and are not displayed as endpoint markers. Filled anchor-noise points met the recorded GPM convergence criterion, whereas open points returned the iterate at the 500-iteration limit. Figure 9 reports the solver diagnostics, and Figure 10 provides a qualitative comparison. Figure 6 shows 81.6% cross-image identity linkage for the no-noise C-GDP and AA-I-GDP controls. The privatedata-noise fit is 18.3% at σ = 1.5 and 9.9% at σ = 3, crossing the 10% level at approximately σ = 2.98. Anchor noise reaches the same level much earlier: the MP, alignment-map, and OP fits cross 10% at approximately v = 0.037, 0.039, and 0.059, respectively. OP therefore remains the most conservative evaluated anchor-noise attack around the privacy transition; fitted values slightly below 10% should be interpreted as finite-gallery variation around chance. Figure 7 shows that the noiseless C-GDP and v = 0 AA-I-GDP controls attain 86.37% and 86.22% balanced accuracy, respectively, while I-GDP attains 71.93%. The private-data-noise fit is 70.9% at σ = 1.5 and 59.6% at σ = 3, showing the additional utility cost required to bring private-noise identity linkage to chance. The anchor-noise fit decreases sharply near the origin and then remains near 70–72% over much of the remaining range. At the OP chance crossing v ≈ 0.0587, its fitted balanced accuracy is 73.6%, approximately 1.7 percentage points above I-GDP. Figure 8 shows that relocating noise from the private-data representations to the anchor representations materially changes the fitted trade-off. At 75% fitted balanced accuracy, C-GDP (private-data noise) retains 22.5% identity linkage, whereas AA-I-GDP (anchor noise) under OP retains 11.4%. At the 71.93% I-GDP utility reference, the corresponding fitted values are 19.2% and 8.6%, respectively. Conversely, at 10% fitted linkage, private-data noise 29

(a) C-GDP (private noise)

(b) AA-I-GDP (anchor noise)

Identity Linkage Accuracy (%)

100 90 80 70 60 50 40 30 20 10 0 0.0

0.5

1.0

1.5

Noise scale σ

2.0

C-GDP (private noise) 200 random noise draws AA-I-GDP (anchor noise): MP

2.5

3.0

0.00

0.05

AA-I-GDP (anchor noise): OP AA-I-GDP (anchor noise): AM 95% conditional band

0.10

0.15

Noise scale v

0.20

0.25

Random guess (10%) C-GDP AA-I-GDP

Figure 6: CelebA cross-image identity linkage in the analyst-participant collusion setting. Panel (a) reports C-GDP (private noise) under knownsecret inversion, whereas panel (b) compares AA-I-GDP (anchor noise) under the MP, OP, and AM attacks. Each noisy protocol contains 200 observations over 0 ≤ σ ≤ 3 or 0 ≤ v ≤ 0.25. Curves are fixed cubic regression-spline fits; shaded regions are 95% pointwise bands from 10,000 multinomial bootstrap resamples; the dotted 10% line denotes random guessing; and the dash-dotted lines give the corresponding no-noise controls. In panel (b), filled markers indicate runs for which the GPM satisfied its convergence criterion, whereas open markers indicate iterates returned at the 500-iteration limit.

retains only 59.7% balanced accuracy, compared with 73.6% for anchor noise. Thus, under the evaluated attacks and fixed deployment, anchor noise reaches chance-level identity linkage with substantially higher downstream utility. Figure 9 shows that the GPM met the 10−7 stopping criterion in 84 of the 200 anchor-noise runs and reached the 500-iteration limit in the remaining 116. The largest converged observation has v = 0.0395, and the smallest capped observation has v = 0.0390, indicating a narrow overlapping transition rather than a strict threshold. Median optimization time is 6.4 seconds for converged runs and 189.1 seconds for capped runs; the capped fixed-point residual has median 3.9 × 10−4 . All returned iterates remain in the privacy and utility analyses because they are outputs of the implemented protocol. Figure 10 visualizes representative reconstructions for 0 ≤ σ ≤ 1.5 and 0 ≤ v ≤ 0.25. Comparisons are made vertically within each column because each column uses a different source face; the left-to-right ordering reflects decreasing identity leakage rather than equal increments on a common noise scale. Within the displayed private-datanoise range, C-GDP retains recognizable facial structure and remains above chance, whereas the anchor-noise attacks reach chance-level linkage. Over the complete quantitative range 0 ≤ σ ≤ 3, private-data noise reaches approximately 10% linkage near σ = 3, but with fitted balanced accuracy reduced to about 59.7%, compared with 73.6% for anchor noise at its OP chance crossing. The supplementary material provides a separate reconstruction grid for each identity shown in Figure 10. 5.3.3. Descriptive Sensitivity to the Number of Participants We repeat the CelebA experiment with p ∈ {2, 5, 10, 20, 50} using nested prefixes of the same frozen 50-participant identity allocation, GDP-parameter bank, public SVD, and anchor matrix. Every participant retains 100 identities with the same 70/15/15 identity-level allocation for training, validation, and testing, while participant 1 remains the sole colluder and participant 2 remains the reconstruction target. For each participant count, AA-I-GDP (anchor noise) is evaluated using 100 draws with v ∼ Uniform(0, 0.1); the noise amplitudes and random seeds are paired across participant counts by draw index. Because the participant-level identity budget is fixed, the total training set size scales with p. This is therefore a growing-deployment sensitivity experiment rather than a fixed-sample estimate of the isolated causal effect of p. Moreover, the same value of v need not yield the same realized privacy level across 30

(a) C-GDP (private noise)

(b) AA-I-GDP (anchor noise)

Smiling Test Balanced Accuracy (%)

90 85 80 75 70 65 60 55 50 45 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 2.25 2.50 2.75 3.00

Noise Scale σ

C-GDP (private noise) 200 random noise draws AA-I-GDP (anchor noise)

0.00

0.05

95% conditional band Balanced random guess (50%) C-GDP

0.10

0.15

Noise Scale v

0.20

0.25

AA-I-GDP I-GDP

Figure 7: CelebA utility over the evaluated noise ranges. Panel (a) reports C-GDP (private-data noise) for 0 ≤ σ ≤ 3, and panel (b) reports AA-I-GDP (anchor noise) for 0 ≤ v ≤ 0.25. Each panel contains 200 observations. Curves are fixed cubic regression-spline fits, and shaded regions are 95% pointwise bands from 10,000 multinomial bootstrap resamples. Horizontal lines indicate balanced random guessing, noiseless C-GDP or AA-I-GDP, and noiseless I-GDP. Filled anchor-noise markers met the GPM convergence criterion; open markers reached the 500-iteration limit.

different participant counts, so we compare utility based on the observed identity-linkage accuracy rather than only against v. Figure 11 uses identity-linkage attack accuracy on the horizontal axis and balanced accuracy on the vertical axis, so the preferred region is the upper left. The protected query identities, episode count, and ten-way task are fixed across p, but the distractor identities are drawn from each active participant pool, and the total training-set size grows with p. The comparison is consequently descriptive rather than an exactly controlled estimate of the isolated effect of participant count. C-GDP is shown at its observed participant-specific leakage–utility coordinate, whereas I-GDP remains a horizontal utility reference because attacks against I-GDP are outside the scope of this paper, and no linkage score is assigned to it. In the low-noise regime, AA-I-GDP (anchor noise) follows the natural order of growing data. At v = 0.01, its fitted balanced accuracies for p = 2, 5, 10, 20, 50 are 73.67%, 80.04%, 83.40%, 85.40%, and 86.93%, respectively, while fitted linkage remains within the narrow range 52.20%–54.61%. The same ordering appears at matched privacy levels: at 50% fitted linkage, the corresponding utilities are 73.47%, 79.94%, 83.32%, 85.23%, and 86.70%, and at 20% linkage they are 69.61%, 76.64%, 80.14%, 81.03%, and 82.05%. Thus, when the anchor representations remain sufficiently informative for alignment, the additional participant data translates into higher downstream utility in the expected order. The I-GDP controls do not follow this data-size ordering: their balanced accuracies rank as p = 5 (69.85%), p = 10 (68.92%), p = 20 (65.93%), p = 2 (64.89%), and p = 50 (61.85%). This non-monotonicity is consistent with the fact that increasing p under I-GDP adds both observations and independently transformed participant blocks, so a conventional shared-coordinate learner need not benefit monotonically from the larger dataset. Low anchor noise restores enough comparability for the growing-data benefit to dominate. Near v = 0.1, however, every anchor-noise fit lies within 1.56 percentage points of its corresponding I-GDP reference, and the natural participant-count ordering disappears. This finite-range behavior supports the interpretation that increasing anchor noise progressively removes the utility benefit of alignment rather than directly corrupting every private-data representation. Because identity linkage is already near its 10% chance level in this regime, the trajectories compress near the left edge; observed or fitted values below 10% are not interpreted as privacy better than random guessing. For h = 400 and r = 1600, Equation (51) gives the empirical references vPT = 0.03785, 0.04676, 0.05297, 31

90

Smiling Test Balanced Accuracy (%)

85 80 75 70 65 60 55

Random guess (10% leakage) C-GDP private noise (200 observations) AA-I-GDP anchor noise: OP (200 observations) C-GDP (no noise) I-GDP balanced accuracy

50 45

0

10

20

30

40

50

60

70

Identity Linkage Accuracy (%)

80

90

100

Figure 8: CelebA privacy–utility trade-off in the analyst-participant collusion setting. The horizontal axis shows identity-linkage attack accuracy, and the vertical axis shows held-out Smiling balanced accuracy; the preferred region is the upper left. The blue trajectory reports C-GDP (privatedata noise) under known-secret inversion, and the dashed orange trajectory reports AA-I-GDP (anchor noise) under the OP attack. Each trajectory is fitted to 200 paired leakage-utility observations. The trajectories pair the noise-conditioned cubic-spline estimates, and the shaded envelopes combine the corresponding 95% pointwise bands from 10,000 multinomial bootstrap resamples. The star gives noiseless C-GDP, the dash-dotted horizontal line gives I-GDP utility, and the dotted vertical and horizontal lines indicate random guessing. 500-iteration cap (200 observations total)

Fixed-Point Residual

GPM Iterations

400 300 200

10−4

150

10−6 10−8

100

10−10

100 0 0.00

200

GPM Optimization Time (s)

Converged (200 observations total)

500

10−12

0.05

0.10

0.15

0.20

Anchor-Noise Scale v

0.25

0.00

0.05

0.10

0.15

0.20

Anchor-Noise Scale v

0.25

50 0 0.00

0.05

0.10

0.15

0.20

Anchor-Noise Scale v

0.25

Figure 9: GPM diagnostics for the 200 AA-I-GDP anchor-noise observations over 0 < v < 0.25. From left to right, the panels report the iteration count, the fixed-point residual, and the optimization time. Filled points are the 84 runs that met the convergence criterion; open points are the 116 runs that reached the 500-iteration limit.

0.05833, and 0.06383 for p = 2, 5, 10, 20, 50, respectively. Of the 100 draws at each participant count, 23, 26, 32, 34, and 40 meet the numerical GPM stopping criterion before the 500-iteration limit. The upward movement of the observed transition with p is consistent with the participant-count scaling of the empirical reference in [30, Section 4.2]. Nevertheless, every stopped run lies below its corresponding vPT , while 7, 12, 12, 19, and 15 sub-reference runs still reach the iteration cap. The empirical reference, therefore, tracks the transition scale but is optimistic for this deployment and is not a run-level convergence certificate. The utility trajectories remain smooth across the filled and open markers, so reaching the numerical stopping criterion does not appear as a discrete accuracy threshold.

32

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure 10: CelebA reconstructions in the analyst-participant collusion setting. Each column contains a distinct source face, paired vertically across all rows. Within each noisy-attack row, the first column is the zero-noise control, and the remaining reconstructions are ordered so that identitylinkage accuracy decreases from left to right. The displayed C-GDP private-data-noise row covers 0 ≤ σ ≤ 1.5, while the anchor-noise rows cover 0 ≤ v ≤ 0.25. The rightmost anchor-noise reconstructions are at the 10% chance level; the C-GDP private-noise row ends at the lowest leakage attained within its displayed range. The equations give the decoded reconstructions after application of F† .

Figure 11: CelebA participant-count sensitivity of the AA-I-GDP anchor-noise privacy–utility relationship. Curves for p ∈ {2, 5, 10, 20, 50} trace held-out Smiling balanced accuracy against OP cross-image identity-linkage accuracy. Each condition contains 100 draws with v ∼ Uniform(0, 0.1), paired across participant counts by draw index. Solid curves are fixed cubic regression-spline fits to linkage and utility as functions of v, and the shaded ribbons connect their 95% pointwise envelopes from 10,000 paired-draw bootstrap resamples. Low-opacity filled and open symbols denote draws for which the GPM met its stopping criterion and reached the 500-iteration cap, respectively. Stars denote C-GDP, participant-colored dashed horizontal lines denote I-GDP utility, and dotted lines mark the 10% linkage and 50% balanced-accuracy chance levels. Deterministic controls are excluded from fitting; noiseless AA-I-GDP is omitted.

33

6. Conclusion This paper studied geometric data perturbation for one-shot representation sharing in the analyst-participant collusion setting. C-GDP preserves comparability across participants but allows a colluding participant to expose every non-colluding upload by revealing the common perturbation parameters. I-GDP removes this shared secret but places participants in mutually misaligned coordinate systems, impairing centralized learning. Under the stated full-columnrank condition and reference-participant gauge, we showed that noiseless AA-I-GDP and the corresponding coupled C-GDP construction yield the same aligned outputs available to the analyst, even though their protocol transcripts differ. Their private-data-noise outputs are likewise equal in distribution and become pathwise equal under the stated noise coupling. Anchor alignment, therefore, restores cross-participant comparability but does not, by itself, resolve the vulnerability in the analyst-participant collusion setting. We consequently introduced anchor noise for Anchor-Aligned Independent Geometric Data Perturbation. The method perturbs the synthetic anchor representations used to estimate the alignment maps while leaving the uploaded private-data representations free of additive noise. We formulated the resulting alignment problem as a generalized orthogonal Procrustes problem, characterized its rotational and residual-translation errors, adapted existing GPM convergence results to the centered orthonormal-anchor setting, and analyzed the Moore–Penrose, orthogonalProcrustes, and alignment-map reconstruction attacks. Under the normalized anchor construction, these results identify the anchor-noise scale v, anchor size r, and representation dimension d as the principal quantities governing both alignment accuracy and known-anchor reconstruction. The experiments support the theoretical equivalence of the baseline constructions and show that relocating noise from the private-data representations to the anchor representations can materially improve the observed privacy- utility trade-off. At 12.4% exact-source linkage on the MNIST dataset, AA-I-GDP with anchor noise retains 59.2% balanced accuracy under the orthogonal-Procrustes attack, compared with 15.1% for C-GDP with private-data noise. On the CelebA dataset, anchor noise retains 73.6% balanced accuracy when fitted identity linkage reaches the 10% chance level, whereas private-data noise retains 59.7%. Across p ∈ {2, 5, 10, 20, 50}, AA-I-GDP with low anchor noise recovers the increasing-utility ordering associated with the growing training set, whereas I-GDP remains non-monotone in p; as v approaches 0.1, the anchor-noise fits move toward their corresponding I-GDP references and the natural ordering disappears. Within the evaluated ranges, increasing private-data noise drives utility toward random guessing, whereas increasing anchor noise progressively removes the utility benefit of alignment and moves performance toward the corresponding I-GDP reference. These conclusions remain specific to the evaluated attacks and deployments. Anchor noise does not eliminate the anchor attack surface, and the three evaluated reconstruction attacks do not exhaust the set of learned or adaptive attacks. Multi-colluder and malicious-participant strategies fall outside the analyst-participant collusion setting studied here. I-GDP is included as a utility reference but is not assigned a reconstruction-based leakage score. The empirical results use fixed data partitions, projections, anchor matrices, and training seeds and are limited to image tasks. Moreover, the participant-count experiment fixes the per-participant identity budget, so the total training-set size grows with p and the comparison does not isolate the causal effect of participant count. Some GPM runs also reach the iteration limit without a certificate of global optimality. The reported results should therefore be interpreted as an attack-dependent empirical privacy-utility advantage rather than a universal privacy guarantee. Several directions merit further study. First, the proposed framework can benefit from a formal privacy calibration, including record-level differential privacy formulations where appropriate, evaluation against stronger reconstruction attacks, and validation on non-image data and across independent deployments. Second, tighter convergence and estimation bounds, together with certified or more efficient GOPP solvers, would help distinguish the statistical effects of anchor noise from numerical optimization error. Third, the linear structure of GDP leaves a residual known-anchor recovery channel because participant-specific transformations can be estimated from anchor correspondences using tractable linear-algebraic methods, including the pseudoinverse and Orthogonal Procrustes estimators considered here. Extending the noisy-anchor framework to nonlinear obfuscation and alignment mappings could reduce the effectiveness of these linear estimators, although appropriately adapted nonlinear attacks would also need to be investigated. Kernel-based Target-Normalized Integration (KTI), which integrates intermediate representations produced through nonlinear dimensionality reduction, provides one possible foundation for such an extension [41]. Characterizing the resulting trade-off between known-anchor reconstruction risk and cross-participant alignment accuracy would clarify the settings in which noisy-anchor alignment can provide useful resistance to reconstruction while retaining the utility 34

of centrally trained models.

CRediT authorship contribution statement Keiyu Nosaka: Conceptualization, Methodology, Software, Validation, Investigation, Data curation, Writing – original draft, Visualization, Funding acquisition, Project administration. Yamato Suetake: Writing – review & editing, Software. Yuichi Takano: Writing – review & editing, Supervision. Yukihiko Okada: Writing – review & editing, Supervision. Akiko Yoshise: Writing – review & editing, Supervision, Funding acquisition.

Declaration of Competing Interest The authors declare that they have no known competing financial interests or personal relationships that could have influenced the work reported in this paper.

Declaration of Generative AI and AI-Assisted Technologies in the Writing Process During the preparation of this work, the authors used ChatGPT and Grammarly to enhance the manuscript’s readability and language. Following the use of these services, the authors thoroughly reviewed and edited the content and assume full responsibility for the final published article.

Data Availability The experiment code, Colab execution notebooks, processed result records, provenance information, and figuregeneration scripts supporting this study are publicly available in the project repository. The version used for this manuscript is archived at commit 20383a6. The original MNIST and CelebA datasets and pretrained model weights are not redistributed; they can be obtained from their respective providers and are downloaded or prepared by the supplied notebooks subject to the applicable access conditions and licenses.

Funding Sources This work was partially supported by the Japan Society for the Promotion of Science (JSPS) KAKENHI under Grant Numbers JP22K18866, JP23K26327, JP25KJ0701, and JP26K22555.

References [1] European Parliament and Council of the European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, see Article 5: principles including purpose limitation, data minimisation, and integrity/confidentiality (2016). URL https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 [2] OECD, OECD recommendation of the council on enhancing access to and sharing of data, OECD Legal Instruments (OECD/LEGAL/0463) (2021). URL https://legalinstruments.oecd.org/api/print?ids=668&lang=en [3] UK Government, Data sharing governance framework, GOV.UK (2022). URL https://www.gov.uk/government/publications/data-sharing-governance-framework/ data-sharing-governance-framework [4] W. G. van Panhuis, P. Paul, C. Emerson, J. Grefenstette, R. Wilder, A. J. Herbst, D. Heymann, D. S. Burke, A systematic review of barriers to data sharing in public health, BMC Public Health 14 (2014) 1144. doi:10.1186/1471-2458-14-1144. [5] Future of Privacy Forum, The playbook: Data sharing for research, Report (2022). URL https://fpf.org/wp-content/uploads/2022/12/FPF-Playbook-singles.pdf [6] L. Jiang, R. Tan, X. Lou, G. Lin, On lightweight privacy-preserving collaborative learning for internet-of-things objects, in: Proceedings of the ACM/IEEE International Conference on Internet of Things Design and Implementation (IoTDI), 2019, pp. 70–81. doi:10.1145/ 3302505.3310070. [7] B. Liu, Y. Jiang, F. Sha, R. Govindan, Cloud-enabled privacy-preserving collaborative learning for mobile sensing, in: Proceedings of the 10th ACM Conference on Embedded Network Sensor Systems (SenSys), ACM, 2012, pp. 57–70. doi:10.1145/2426656.2426663. [8] J. Shao, F. Wu, J. Zhang, Selective knowledge sharing for privacy-preserving federated distillation without a good teacher, Nature Communications 15 (2024) 349. doi:10.1038/s41467-023-44383-9. [9] K. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V. Ivanov, C. Kiddon, J. Konečný, S. Mazzocchi, H. B. McMahan, T. Van Overveldt, D. Petrou, D. Ramage, J. Roselander, Towards federated learning at scale: System design, in: Proceedings of Machine Learning and Systems, Vol. 1, 2019, pp. 374–388. URL https://proceedings.mlsys.org/paper_files/paper/2019/hash/7b770da633baf74895be22a8807f1a8f-Abstract. html [10] S. Sugawara, Y. Kawamata, A. Toyoda, T. Nakayama, Y. Okada, Single-round clustered federated learning via data collaboration analysis for non-IID data (2026). arXiv:2601.09304.

35

[11] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, B. Agüera y Arcas, Communication-efficient learning of deep networks from decentralized data, in: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), Vol. 54 of Proceedings of Machine Learning Research, PMLR, 2017, pp. 1273–1282. URL https://proceedings.mlr.press/v54/mcmahan17a.html [12] T. Li, A. K. Sahu, A. Talwalkar, V. Smith, Federated learning: Challenges, methods, and future directions, IEEE Signal Processing Magazine 37 (3) (2020) 50–60. doi:10.1109/MSP.2020.2975749. [13] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings, et al., Advances and open problems in federated learning, Foundations and Trends in Machine Learning 14 (1–2) (2021) 1–210. doi:10.1561/ 2200000083. [14] C. Dwork, F. McSherry, K. Nissim, A. D. Smith, Calibrating noise to sensitivity in private data analysis, in: S. Halevi, T. Rabin (Eds.), Theory of Cryptography (TCC 2006), Vol. 3876 of Lecture Notes in Computer Science, Springer, 2006, pp. 265–284. doi:10.1007/11681878_14. [15] C. Dwork, Differential privacy: A survey of results, in: Theory and Applications of Models of Computation (TAMC), Vol. 4978 of Lecture Notes in Computer Science, Springer, 2008, pp. 1–19. doi:10.1007/978-3-540-79228-4_1. [16] C. Dwork, A. Roth, The algorithmic foundations of differential privacy, Foundations and Trends in Theoretical Computer Science 9 (3–4) (2014) 211–407. doi:10.1561/0400000042. [17] A. P. Sanil, A. F. Karr, X. Lin, J. P. Reiter, Privacy preserving regression modelling via distributed computation, in: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), ACM, 2004, pp. 677–682. doi:10.1145/ 1014052.1014139. [18] B. Balle, Y.-X. Wang, Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising, in: Proceedings of the 35th International Conference on Machine Learning (ICML), Vol. 80 of Proceedings of Machine Learning Research, PMLR, 2018, pp. 394–403. URL https://proceedings.mlr.press/v80/balle18a.html [19] R. Xu, N. Baracaldo, J. Joshi, Privacy-preserving machine learning: Methods, challenges and directions (2021). arXiv:2108.04417. [20] K. Liu, H. Kargupta, J. Ryan, Random projection-based multiplicative data perturbation for privacy preserving distributed data mining, IEEE Transactions on Knowledge and Data Engineering 18 (1) (2006) 92–106. doi:10.1109/TKDE.2006.14. [21] K. Chen, L. Liu, Geometric data perturbation for privacy preserving outsourced data mining, Knowledge and Information Systems 29 (3) (2011) 657–695. doi:10.1007/s10115-010-0362-4. [22] K. Liu, C. Giannella, H. Kargupta, An attacker’s view of distance preserving maps for privacy preserving data mining, in: Proceedings of the 10th European Conference on Principles and Practice of Knowledge Discovery in Databases (PKDD), Vol. 4213 of Lecture Notes in Computer Science, Springer, 2006, pp. 297–308. [23] C. R. Giannella, K. Liu, H. Kargupta, Breaching euclidean distance-preserving data perturbation using few known inputs, Data & Knowledge Engineering 83 (2013) 93–110. doi:10.1016/j.datak.2012.10.004. [24] L. Jiang, R. Tan, X. Lou, G. Lin, On lightweight privacy-preserving collaborative learning for internet of things by independent random projections (2020). arXiv:2012.07626. [25] A. Imakura, T. Sakurai, Data collaboration analysis framework using centralization of individual intermediate representations for distributed data sets, ASCE-ASME Journal of Risk and Uncertainty in Engineering Systems, Part A: Civil Engineering 6 (2) (2020) 04020018. [26] A. Imakura, A. Bogdanova, T. Yamazoe, K. Omote, T. Sakurai, Accuracy and privacy evaluations of collaborative data analysis, The Second AAAI Workshop on Privacy-Preserving Artificial Intelligence (PPAI-21) (2021). URL https://ppai21.github.io/files/12-paper.pdf [27] K. Nosaka, Y. Suetake, Y. Takano, A. Yoshise, Data collaboration analysis with orthonormal basis selection and alignment, Computers and Electrical Engineering 135 (2026) 111192. doi:10.1016/j.compeleceng.2026.111192. [28] Y. Kawakami, Y. Takano, A. Imakura, New solutions based on the generalized eigenvalue problem for the data collaboration analysis, Information Sciences 723 (2026) 122642. doi:https://doi.org/10.1016/j.ins.2025.122642. [29] H. Yamashiro, K. Omote, A. Imakura, T. Sakurai, Toward the application of differential privacy to data collaboration, IEEE Access 12 (2024) 63292–63301. doi:10.1109/ACCESS.2024.3396146. [30] S. Ling, Near-optimal bounds for the generalized orthogonal procrustes problem via generalized power method, Applied and Computational Harmonic Analysis 66 (2023) 62–100. doi:10.1016/j.acha.2023.04.008. [31] R. Penrose, A generalized inverse for matrices, Proceedings of the Cambridge Philosophical Society 51 (3) (1955) 406–413. doi:10.1017/ S0305004100030401. [32] A. Imakura, T. Sakurai, Y. Okada, T. Fujii, T. Sakamoto, H. Abe, Non-readily identifiable data collaboration analysis for multiple datasets including personal information, Information Fusion 98 (2023) 101826. doi:10.1016/j.inffus.2023.101826. [33] J. M. F. Ten Berge, Orthogonal procrustes rotation for two or more matrices, Psychometrika 42 (2) (1977) 267–276. doi:10.1007/ BF02294053. [34] P. H. Schönemann, A generalized solution of the orthogonal procrustes problem, Psychometrika 31 (1) (1966) 1–10. doi:10.1007/ BF02289451. [35] Y. LeCun, L. Bottou, Y. Bengio, P. Haffner, Gradient-based learning applied to document recognition, Proceedings of the IEEE 86 (11) (1998) 2278–2324. doi:10.1109/5.726791. [36] Z. Liu, P. Luo, X. Wang, X. Tang, Deep learning face attributes in the wild, in: Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2015, pp. 3730–3738. doi:10.1109/ICCV.2015.425. [37] L. Lyu, X. He, Y. W. Law, M. Palaniswami, Privacy-preserving collaborative deep learning with application to human activity recognition, in: Proceedings of the 2017 ACM on Conference on Information and Knowledge Management, ACM, 2017, pp. 1219–1228. doi:10.1145/ 3132847.3132990. [38] S. S. Vempala, The Random Projection Method, Vol. 65 of DIMACS Series in Discrete Mathematics and Theoretical Computer Science, American Mathematical Society, 2005. [39] C. Szegedy, S. Ioffe, V. Vanhoucke, A. A. Alemi, Inception-v4, inception-resnet and the impact of residual connections on learning, in: Proceedings of the Thirty-First AAAI Conference on Artificial Intelligence, 2017, pp. 4278–4284. doi:10.1609/aaai.v31i1.11231. [40] Q. Cao, L. Shen, W. Xie, O. M. Parkhi, A. Zisserman, VGGFace2: A dataset for recognising faces across pose and age, in: 2018 13th IEEE International Conference on Automatic Face & Gesture Recognition, 2018, pp. 67–74. doi:10.1109/FG.2018.00020. [41] Y. Suetake, Y. Kawakami, S. Ikeda, Y. Takano, Nonlinear data integration via kernel methods for data collaboration analysis (2026). arXiv: 2605.27219. URL https://arxiv.org/abs/2605.27219

36

Supplementary Material for Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning Keiyu Nosakaa , Yamato Suetakea , Yuichi Takanob,c , Yukihiko Okadab,c , Akiko Yoshiseb,c,∗ a Graduate School of Science and Technology, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan b Institute of Systems and Information Engineering, University of Tsukuba, 1-1-1, Tennodai, Tsukuba, 305-8573, Ibaraki, Japan c Center for Artificial Intelligence Research, Tsukuba Institute for Advanced Research (TIAR), University of Tsukuba, 1-1-1, Tennodai,

Tsukuba, 305-8577, Ibaraki, Japan

Abstract This supplementary material provides the complete proofs of the results stated in the main manuscript, together with additional solver diagnostics and reconstruction examples.

Notation Throughout this supplement, P := {1, . . . , p} denotes the participant index set, and i ∈ P denotes a generic participant. In an analyst-participant collusion argument, an arbitrary non-colluding reconstruction target is explicitly restricted as i ∈ P \ {c}, while c ∈ P denotes the colluding participant. When used, s ∈ P denotes the reference participant selected to fix the alignment coordinate system; this role does not designate the colluder. For a positive integer k, we write [k] := {1, 2, . . . , k}. We denote by R p×q the set of real p × q matrices. M ∈ R p×q means M is a real p×q matrix. (M)k,l denotes the row k, column l entry of the matrix M. 1m ∈ Rm is the all-ones vector. For a matrix M, M⊤ denotes the transpose, M† the Moore–Penrose pseudoinverse [1] (e.g., M† = (M⊤ M)−1 M⊤ when M has full column rank), ∥M∥F the Frobenius norm, and tr(M) the matrix trace. We denote the orthogonal group h i in Rℓ by O(ℓ) := {O ∈ Rℓ×ℓ : O⊤ O = Iℓ }. For a matrix M, its (thin) SVD is written as M = UΣV ⊤ . We write Mi i∈[k] for k vertically stacked matrices. Equivalently,

h

   M1    Mi :=  ...  . i∈[k]   Mk i

Definition 2.1 (One-Shot Representation Sharing). In the one-shot representation sharing regime, the global recordby-feature data matrix X ∈ Rn×d is partitioned by records across p participants: X h i Xi ∈ Rni ×d , ni = n. (S.1) X = Xi i∈P

i∈P

Participant i holds the private submatrix Xi . For any batch size m, participant i applies a local row-wise obfuscation mechanism Mi : Rm×d → Rm×h , ∗ Corresponding author

Email addresses: s2430118@u.tsukuba.ac.jp (Keiyu Nosaka), s2620455@u.tsukuba.ac.jp (Yamato Suetake), ytakano@sk.tsukuba.ac.jp (Yuichi Takano), okayu@sk.tsukuba.ac.jp (Yukihiko Okada), yoshise@sk.tsukuba.ac.jp (Akiko Yoshise )

which maps records to h-dimensional representations. Applying this mechanism to its local data yields Yi = Mi (Xi ) ∈ Rni ×h .

(S.2)

Each participant communicates with the analyst exactly once by uploading Yi and the target vector Li ∈ Rni . The analyst concatenates the uploaded representations as h i Y = Yi ∈ Rn×h , (S.3) i∈P

and uses Y for downstream analysis, such as model training. Definition 2.2 (Analyst-Participant Collusion Setting). Consider a one-shot representation-sharing protocol with p ≥ 2 participants and a central analyst. Let c ∈ P denote the single colluding participant. In the analyst-participant collusion setting, the attacker comprises the central analyst and participant c. For each participant i, let Θi denote all participant-side state other than the private dataset Xi , including private randomness, perturbation parameters, secret keys, and other quantities used to instantiate the obfuscation mechanism. We assume that participant c discloses both Xc and Θc in full. The analyst observes all uploaded representations {Yi : i ∈ P}. Hence, the attacker’s view is ({Yi : i ∈ P}, (Xc , Θc )) . (S.4) Unless stated otherwise, the attacker also knows the public protocol specification, including the functional forms of the obfuscation mechanisms and any public parameters. The attacker does not directly know the private datasets or local secret states of the non-colluding participants, except through information inferred from the analyst’s transcript and from participant c’s private dataset and local secret state. The attacker’s objective is to recover, or infer sensitive information about, the private dataset Xi ∈ Rni ×d of a non-colluding target participant i ∈ P \ {c}. Definition 2.3 (Geometric Data Perturbation). For any batch size m, a Geometric Data Perturbation (GDP) mechanism is a row-wise obfuscation map M : Rm×d → Rm×d of the form M(S) = SO + 1m Ψ⊤ ,

S ∈ Rm×d .

(S.5)

Here, O ∈ O(d) is an orthogonal matrix, Ψ ∈ Rd is a translation vector, and 1m ∈ Rm is the all-ones vector. Thus, the same orthogonal transformation and translation are applied to every record. Definition 2.4 (Common-Transform Geometric Data Perturbation). Common-Transform Geometric Data Perturbation (C-GDP) is a one-shot representation-sharing regime in which all participants use a shared GDP mechanism M : Rm×d → Rm×d with common perturbation parameters (O, Ψ) for any batch size m. Thus, each participant i ∈ P, holding private data Xi ∈ Rni ×d , uploads Yi = M(Xi ) = Xi O + 1ni Ψ⊤ ,

(S.6)

where O ∈ O(d) is shared across participants and Ψ ∈ Rd is the shared translation vector. S.1. Proposition 2.5: Secret-State Vulnerability of C-GDP in the Analyst-Participant Collusion Setting Proposition 2.5 (Secret-State Vulnerability of C-GDP in the Analyst-Participant Collusion Setting). Suppose that the uploaded representations are generated by C-GDP: Yi = Xi O + 1ni Ψ⊤ ,

i ∈ P,

where O ∈ O(d) and Ψ ∈ Rd are common to all participants. Let c ∈ P be the colluding participant in the analystparticipant collusion setting. If the disclosed state Θc contains (O, Ψ), then the attacker reconstructs every noncolluding participant’s private dataset exactly as   Xi = Yi − 1ni Ψ⊤ O⊤ , i ∈ P \ {c}. S2

Proof. Participant c discloses (O, Ψ), so the attacker knows the common perturbation parameters and observes every uploaded representation. Fix any non-colluding participant i ∈ P \ {c}. Then     Yi − 1ni Ψ⊤ O⊤ = Xi O + 1ni Ψ⊤ − 1ni Ψ⊤ O⊤ = Xi OO⊤ = Xi , where the final equality follows from OO⊤ = Id . Since i was arbitrary, the attacker reconstructs every non-colluding participant’s private dataset exactly. Definition 2.6 (C-GDP (private-data noise)). C-GDP (private-data noise) uses the common GDP mechanism M with shared parameters (O, Ψ) and adds participant-specific additive noise to each private-data representation. Participant i ∈ P samples a noise matrix Wi ∈ Rni ×d from a chosen base distribution and uploads Yi = M(Xi ) + σWi = Xi O + 1ni Ψ⊤ + σWi .

(S.7)

The matrices W1 , . . . , W p are sampled independently across participants and independently of the common GDP parameters, and σ ≥ 0 is the private-data-noise scale. Setting σ = 0 recovers C-GDP. In the analyst-participant collusion setting of Definition 2.2, participant c reveals the common parameters. For each non-colluding participant i ∈ P \ {c}, direct inversion gives (Yi − 1ni Ψ⊤ )O⊤ = Xi + σWi O⊤ , so the additive noise, rather than the secrecy of the common transform, is the protection in this attack channel. Common choices for additive perturbation include Laplace and Gaussian noise [2, 3]. In this study, the entries of each Wi are i.i.d. N(0, 1), so σ is the standard deviation of each added noise entry. When a formal differential privacy (DP) baseline is required, σ can be calibrated according to the sensitivity of the released representation, the neighboring relation, and the target privacy parameters [4, 5]. Gaussian perturbation alone should not be interpreted as a formal DP guarantee: DP additionally requires a specified neighboring relation, bounded sensitivity (typically enforced by clipping), and calibration to explicit privacy parameters [3]. Definition 2.8 (DC anchor setting). Participant i ∈ P holds Xi ∈ Rni ×d , and all participants have access to a common anchor matrix A ∈ Rr×d . The anchor matrix is a participant-side shared state: it is not included in the honest protocol transcript and is not revealed to the analyst. For any batch size m, participant i has a local obfuscation map Mi : Rm×d → Rm×h . Participant i applies the same map to its private-data matrix and the shared anchor matrix and uploads Yi = Mi (Xi ),

Bi = Mi ( A).

Definition 2.9 (Analyst-Participant Collusion Setting under DC). Consider a DC protocol with participant set P and a central analyst. Let c ∈ P denote the single colluding participant. In the analyst-participant collusion setting under DC, the attacker comprises the central analyst and participant c. For each participant i, let Θi denote the participant-specific local secret state, excluding the private dataset Xi and the shared anchor matrix A. The anchor matrix is listed separately below because it is a common participantside state rather than a participant-specific state. The state Θi may include private parameters, randomness, or other participant-side quantities used to instantiate the obfuscation mechanism Mi and not revealed in the protocol transcript. In the DC protocol, the analyst observes all uploaded private-data and anchor representations, namely {(Yi , Bi ) : i ∈ P}. In addition, participant c reveals its private dataset and local secret state. Because participant c holds the shared anchor matrix A, we assume that it also reveals A to the analyst. Hence, the attacker’s view is ({(Yi , Bi ) : i ∈ P}, (Xc , Θc ), A) . S3

(S.8)

Algorithm 2: AA-I-GDP Alignment Procedure Input: Private data Xi ∈ Rni ×d for each i ∈ P; participant-side shared anchor matrix A ∈ Rr×d ; reference participant s ∈ P. Output: Aligned collaboration matrix Z ∈ Rn×d . /* Participant-side obfuscation foreach i ∈ P do Privately sample GDP parameters Oi ∈ O(d) and Ψi ∈ Rd , independently across participants Yi = Xi Oi + 1ni Ψ⊤i Bi = AOi + 1r Ψ⊤i Upload the pair (Yi , Bi ) to the analyst

*/

/* Analyst-side alignment foreach i ∈ P do 1 bi = B⊤i 1r r Bi = Bi − 1r b⊤i

*/

Set R s = Id , define N s (T) = T, and set Z s = Y s foreach i ∈ P \ {s} do ⊤ Compute the SVD Bi B s = Ui Σi Vi⊤ ⊤ Ri = Ui Vi   Define Ni (T) = T − 1m b⊤i Ri + 1m b⊤s for T ∈ Rm×d Z i = Ni (Yi )    Z 1    Z =  ...  ∈ Rn×d   Zp return Z

Unless stated otherwise, the attacker also knows the public protocol specification, including the functional forms of the obfuscation mechanisms and the alignment procedure. The attacker does not directly know the private datasets or local secret states of the non-colluding participants, except through information inferred from the analyst’s transcript, participant c’s private dataset and local secret state, and the shared anchor matrix. The attacker’s objective is to recover, or infer sensitive information about, the private dataset Xi ∈ Rni ×d of a non-colluding target participant i ∈ P \ {c}. Definition 2.10 (Obfuscation Mechanism for Anchor-Aligned Independent GDP). Anchor-Aligned Independent GDP (AA-I-GDP) uses an independently sampled GDP mechanism Mi (S) = SOi + 1m Ψ⊤i ,

S ∈ Rm×d .

This mechanism is defined for any batch size m. Each participant samples its pair (Oi , Ψi ) independently, where Oi ∈ O(d) and Ψi ∈ Rd . S.2. Proposition 2.12: Exact Alignment of AA-I-GDP Definition 2.11 (Exact DC Alignment). Suppose h = d and the participant-specific maps Mi are deterministic. The alignment maps achieve exact DC alignment if, for every batch size m, every i, j ∈ P, and every S ∈ Rm×d , Ni (Mi (S)) = N j (M j (S)). S4

(S.9)

Proposition 2.12 (Exact Alignment of AA-I-GDP). Suppose that, for every participant i ∈ P, the uploaded anchor representation is generated by Bi = AOi + 1r Ψ⊤i . (S.10) Let

1 ⊤ A 1r , A = A − 1r a ⊤ . r Fix a reference participant s ∈ P, and let {Ni }i∈P be the alignment maps constructed by Algorithm 2. Assume that A has full column rank, which necessarily requires r ≥ d + 1. Then the alignment maps achieve exact DC alignment in the sense of Definition 2.11. In particular, for every participant i ∈ P, every batch size m, and every input matrix S ∈ Rm×d , Ni (Mi (S)) = M s (S) = SO s + 1m Ψ⊤s . (S.11) a=

Consequently, for the private-data uploads, the aligned collaboration matrix satisfies Z = XO s + 1n Ψ⊤s .

(S.12)

Equivalently, if participant s fixes the global rigid-coordinate gauge and C-GDP is coupled to AA-I-GDP by choosing its common parameters as (O, Ψ) = (O s , Ψ s ), then the C-GDP and aligned AA-I-GDP collaboration matrices are equal pathwise for every private dataset X. This is an equality of analyst-side collaboration outputs; the protocols’ complete transcripts remain different. The proof uses the following two auxiliary lemmas. Lemma S.1. Suppose that the uploaded anchor representation of participant i is generated by Bi = AOi + 1r Ψ⊤i . Let a=

1 ⊤ A 1r , r

(S.13)

A = A − 1r a ⊤ ,

and let bi and Bi be defined as in Algorithm 2. Then bi = O⊤i a + Ψi ,

Bi = AOi .

(S.14)

Proof. By the definition of bi and the expression for Bi , 1 ⊤ B 1r r i  1 ⊤ ⊤ = Oi A + Ψi 1⊤r 1r r ! ⊤ 1 ⊤ A 1r + Ψi = Oi r

bi =

(S.15)

= O⊤i a + Ψi . Equivalently, b⊤i = a⊤ Oi + Ψ⊤i . Therefore, Bi = Bi − 1r b⊤i   = AOi + 1r Ψ⊤i − 1r a⊤ Oi + Ψ⊤i   = A − 1r a⊤ Oi = AOi .

S5

(S.16)

Lemma S.2. Suppose that the uploaded anchor representation of participant i is generated by Bi = AOi + 1r Ψ⊤i .

(S.17)

Let

1 ⊤ A = A − 1r a ⊤ , A 1r , r and let bi and Bi be defined as in Algorithm 2. Assume A has full column rank. Since rank( A) ≤ r −1, this assumption requires r ≥ d + 1. Fix a participant i ∈ P and a reference participant s ∈ P. Let a=

⊤

Bi B s = Ui Σi Vi⊤

(S.18)

be a full singular value decomposition as used in Algorithm 2, and define Ri = Ui Vi⊤ . Then Ri = O⊤i O s .

(S.19)

Proof. By Lemma S.1, the centered uploaded anchor representations satisfy Bi = AOi , Then

B s = AO s .

⊤

(S.20)

⊤

Bi B s = O⊤i A AO s . ⊤

(S.21) ⊤ Hence O⊤s A AO s is also symmetric positive

Since A has full column rank, A A is symmetric positive definite. definite. Therefore,    ⊤ ⊤ Hi = O⊤i A AO s = O⊤i O s O⊤s A AO s ⊤

(S.22)

⊤

is the polar decomposition of Bi B s , because O⊤i O s is orthogonal and O⊤s A AO s is symmetric positive definite. Since ⊤ ⊤ Bi B s is nonsingular, its polar factor is unique. On the other hand, if Bi B s = Ui Σi Vi⊤ is the SVD, then its polar factor is Ui Vi⊤ . Thus, Ui Vi⊤ = O⊤i O s . (S.23) By the definition Ri = Ui Vi⊤ , we obtain

Ri = O⊤i O s .

(S.24)

Proof. For the reference participant s, Algorithm 2 defines N s as the identity map, so N s (M s (S)) = M s (S). Now fix any participant i ∈ P \ {s}. By Lemma S.1, we have b⊤i = a⊤ Oi + Ψ⊤i and b⊤s = a⊤ O s + Ψ⊤s . By Lemma S.2, the SVD-based alignment matrix satisfies Ri = O⊤i O s . Therefore, for any S ∈ Rm×d ,   Ni (Mi (S)) = SOi + 1m Ψ⊤i − 1m b⊤i Ri + 1m b⊤s     = SOi − 1m a⊤ Oi O⊤i O s + 1m a⊤ O s + Ψ⊤s   (S.25) = S − 1m a⊤ O s + 1m a⊤ O s + 1m Ψ⊤s = SO s + 1m Ψ⊤s = M s (S). Thus, for every i ∈ P, the aligned representation Ni (Mi (S)) equals the same reference representation M s (S). Hence, for all i, j ∈ P, Ni (Mi (S)) = N j (M j (S)), (S.26) which is exact DC alignment. Finally, applying the identity above to S = Xi for each participant and concatenating the aligned private-data representations gives h i h i Z = Ni (Yi ) = Xi O s + 1ni Ψ⊤s = XO s + 1n Ψ⊤s . (S.27) i∈P

i∈P

Under the coupling (O, Ψ) = (O s , Ψ s ), C-GDP produces the same collaboration matrix for every X, establishing the stated pathwise equivalence. This completes the proof. S6

Algorithm 3: Known-Anchor Attack against AA-I-GDP in the Analyst-Participant Collusion Setting p Input: Anchor matrix A revealed by the colluder; uploaded pairs {(Yi , Bi )}i=1 ; colluder index c ∈ P. b Output: Reconstructions { Xi : i ∈ P \ {c}}. 1 a = A⊤ 1r r A = A − 1r a ⊤ foreach i ∈ P \ {c} do 1 bi = B⊤i 1r r Bi = Bi − 1r b⊤i bi = A† Bi O b⊤ a bi = bi − O Ψ i   b⊤ bi = Yi − 1n Ψ b⊤ O X i

i

i

bi : i ∈ P \ {c}} return { X

Definition 2.13 (AA-I-GDP (private-data noise)). AA-I-GDP (private-data noise) uses the same participant-specific GDP mechanism Mi for the private-data matrix and the shared anchor matrix, but adds noise only to the private-data representation. Participant i samples Wi ∈ Rni ×d independently across participants and independently of (Oi , Ψi ), with entries ind (Wi )kℓ ∼ N(0, 1), k ∈ [ni ], ℓ ∈ [d]. It then uploads Yi = Mi (Xi ) + σWi = Xi Oi + 1ni Ψ⊤i + σWi ,

(S.28)

Bi = Mi ( A) = AOi + 1r Ψ⊤i .

(S.29)

The scale σ ≥ 0 controls private-data noise, with σ = 0 recovering AA-I-GDP. Gaussian noise provides a formal DP guarantee only after neighboring datasets and sensitivity are defined and σ is calibrated to a target (ε, δ)-DP level; procedures for performing this calibration in DC have been studied in [6]. S.3. Proposition 3.1: Vulnerability of AA-I-GDP in the Analyst-Participant Collusion Setting Proposition 3.1 (Vulnerability of AA-I-GDP in the Analyst-Participant Collusion Setting). Suppose that the uploaded representations are generated exactly by AA-I-GDP. Thus, for each participant i ∈ P, Yi = Xi Oi + 1ni Ψ⊤i ,

(S.30)

Bi = AOi + 1r Ψ⊤i ,

(S.31)

where Oi ∈ O(d) and Ψi ∈ Rd are participant-specific GDP parameters. Let a=

1 ⊤ A 1r , r

A = A − 1r a ⊤ .

Assume that A has full column rank. Consider the analyst-participant collusion setting for DC in Definition 2.9, with colluding participant c ∈ P. Under this setting, the attacker observes the shared anchor matrix A, and Algorithm 3 outputs bi = Xi X for every non-colluding participant i ∈ P \ {c}.

S7

Proof. Fix an arbitrary non-colluding participant i ∈ P \ {c}. From the anchor-upload relation, 1 ⊤ B 1r r i  1 ⊤ ⊤ Oi A + Ψi 1⊤r 1r = r = O⊤i a + Ψi .

bi =

Consequently, Bi = Bi − 1r b⊤i   = AOi + 1r Ψ⊤i − 1r a⊤ Oi + Ψ⊤i = AOi . †

Since A has full column rank, A A = Id , and hence bi = A† Bi = A† AOi = Oi . O It follows that b⊤ a = O⊤ a + Ψi − O⊤ a = Ψi . bi = bi − O Ψ i i i Therefore,   b⊤ bi = Yi − 1ni Ψ b⊤i O X i   ⊤ = Xi Oi + 1ni Ψi − 1ni Ψ⊤i O⊤i = Xi Oi O⊤i = Xi . Since i was arbitrary, the reconstruction is exact for every non-colluding participant. S.4. Proposition 3.2: Aligned Representation under AA-I-GDP (private-data noise) Proposition 3.2 (Aligned Representation under AA-I-GDP (private-data noise)). Suppose that participant i ∈ P uploads Yi = Xi Oi + 1ni Ψ⊤i + σWi and the noiseless anchor representation Bi = AOi + 1r Ψ⊤i , where Oi ∈ O(d), Ψi ∈ Rd , and Wi ∈ Rni ×d . Assume that A has full column rank, and let Ni be the alignment maps constructed from the anchor representations as in Algorithm 2, with reference participant s ∈ P. Define e i = Wi O⊤i O s , W

i ∈ P.

Then e i. Ni (Yi ) = Xi O s + 1ni Ψ⊤s + σW Consequently, e Z = XO s + 1n Ψ⊤s + σW,

h i e = W ei W

i∈P

.

If the entries of W1 , . . . , W p are mutually independent standard Gaussian variables and the collection {Wi }i∈P is jointly e are mutually independent standard independent of all participant-specific GDP parameters, then the entries of W e Gaussian variables. Moreover, W is independent of the GDP parameters.

S8

Proof. Let a=

1 ⊤ A 1r , r

A = A − 1r a ⊤ .

Use bi , Bi , Ri , and Ni as constructed in Algorithm 2. Centering the anchor representations gives Bi = AOi .

b⊤i = a⊤ Oi + Ψ⊤i , For each i , s,

⊤

⊤

Bi B s = O⊤i A AO s . ⊤

Since A has full column rank, A A is positive definite. Hence,    ⊤ ⊤ O⊤i A AO s = O⊤i O s O⊤s A AO s ⊤

is the polar decomposition of Bi B s . Its orthogonal polar factor is therefore unique and satisfies Ri = O⊤i O s . For i , s,

  Ni (Yi ) = Xi Oi + 1ni Ψ⊤i + σWi − 1ni b⊤i Ri + 1ni b⊤s     = Xi Oi − 1ni a⊤ Oi + σWi O⊤i O s + 1ni a⊤ O s + Ψ⊤s = Xi O s + 1ni Ψ⊤s + σWi O⊤i O s e i. = Xi O s + 1ni Ψ⊤s + σW

For the reference participant, N s is the identity and e s = W s O⊤s O s = W s . W Therefore, e s, N s (Y s ) = X s O s + 1ns Ψ⊤s + σW so the claimed formula holds for every i ∈ P. Vertical stacking gives e Z = XO s + 1n Ψ⊤s + σW. It remains to establish the Gaussian claim. Condition on all GDP parameters. For each participant, O⊤i O s is then a fixed orthogonal matrix. Each row of Wi has distribution N(0, Id ), so rotational invariance gives wO⊤i O s ∼ N(0, Id ) for every row w of Wi . Conditional independence is preserved across rows and participants because the original e are mutually noise entries are mutually independent. Thus, conditional on the GDP parameters, the entries of W independent standard Gaussian variables. This conditional joint distribution is the same for every realization of the e is independent of GDP parameters. It follows that the same product-Gaussian law holds unconditionally and that W the GDP parameters. S.5. Corollary 3.3: Collaboration-Output Equivalence under Private-Data Noise Corollary 3.3 (Collaboration-Output Equivalence under Private-Data Noise). Assume the Gaussian-noise conditions of Proposition 3.2. Fix the GDP parameters, let Z AA denote the aligned collaboration matrix produced by AA-IGDP (private-data noise), and let Z C denote the collaboration matrix produced by C-GDP (private-data noise) with common parameters (O, Ψ) = (O s , Ψ s ). S9

d

Writing U = V to mean that random matrices U and V have the same distribution, the two collaboration matrices satisfy d Z AA = Z C . Moreover, for any fixed realization of the AA-I-GDP variables, consider the coupling in which the standard Gaussian noise block used by C-GDP for participant i is e i = Wi O⊤i O s . W Under this coupling, Z AA = Z C . Proof. Let

h i W C = WiC

i∈P

denote the stacked standard Gaussian matrix used by C-GDP, independent of the common GDP parameters. For the matched parameters (O, Ψ) = (O s , Ψ s ), Z C = XO s + 1n Ψ⊤s + σW C . Proposition 3.2 gives e Z AA = XO s + 1n Ψ⊤s + σW, e has the same product-standard-Gaussian distribution as W C and is independent of the GDP parameters. where W Therefore, conditional on the fixed GDP parameters, d

Z AA = Z C . For the realization-wise statement, couple the protocols by setting e i = Wi O⊤i O s , WiC = W

i ∈ P.

Then, for every participant, Z Ci = Xi O s + 1ni Ψ⊤s + σWiC ei = Xi O s + 1ni Ψ⊤s + σW = Ni (Yi ) = Z AA i . Vertical stacking yields Z AA = Z C , as claimed. Definition 4.1 (AA-I-GDP (anchor noise)). Given a participant-side shared anchor matrix A ∈ Rr×d , AA-I-GDP (anchor noise) uses the same participant-specific GDP mechanism Mi for the private-data matrix and the shared anchor matrix, but adds noise only to the anchor representation. Participant i samples Wi ∈ Rr×d independently across participants and independently of (Oi , Ψi ), with entries ind

(Wi )kℓ ∼ N(0, 1),

k ∈ [r], ℓ ∈ [d].

It then uploads Yi = Mi (Xi ) = Xi Oi + 1ni Ψ⊤i ,

(S.32)

Bi = Mi ( A) + vWi = AOi + 1r Ψ⊤i + vWi .

(S.33)

The scale v ≥ 0 controls anchor noise, with v = 0 recovering AA-I-GDP. S10

The preceding definition applies to a participant-side shared anchor matrix A. Let r ≥ d + 1. Before any release, the participants generate a single shared anchor matrix A ∈ Rr×d satisfying 1⊤r A = 0⊤d ,

A⊤ A = Id .

(S.34)

Thus, the anchor matrix is centered and has orthonormal columns. The first constraint fixes its centroid at the origin, while the second fixes its scale relative to the anchor-noise parameter v. To construct such a matrix, define 1 Hr = Ir − 1r 1⊤r , r sample a participant-side Gaussian matrix Ω ∈ Rr×d with independent standard normal entries, and compute the sign-corrected thin QR factorization Hr Ω = ARA , where RA ∈ Rd×d is upper triangular with positive diagonal. The factorization is well defined almost surely and produces a matrix satisfying (S.34). The same realization of A is distributed to every participant and withheld from the analyst during honest execution. Neither A nor the randomness used to generate it is included in the honest protocol transcript. S.6. Proposition 4.2: Global rigid-motion invariance of the GOPP The generalized orthogonal Procrustes problem used in this result is p X

min

C, R1 ,...,R p , τ1 ,...,τ p

s.t.

  2 C − Bi − 1r τ⊤i Ri

F

i=1

C ∈ Rr×d ,

Ri ∈ O(d),

(S.35) τi ∈ Rd ,

i = 1, . . . , p.

Proposition 4.2 (Global rigid-motion invariance of the GOPP). Suppose that   C⋆ , R⋆1 , . . . , R⋆p , τ⋆1 , . . . , τ⋆p is a minimizer of Problem (S.35). For any s ∈ Rd and Q ∈ O(d), define   e = C⋆ + 1r s⊤ Q, C and, for every i ∈ P,

ei = R⋆ Q, R i

e τi = τ⋆i − R⋆i s.

Then 

e R e1 , . . . , R e p ,e C, τ1 , . . . ,e τp



is also a minimizer of Problem (S.35) and attains the same objective value. Consequently, every minimizer belongs to an equivalence class generated by common translations and orthogonal transformations of the collaboration coordinate system. Therefore, without an external reference or a gauge-fixing constraint, the GOPP objective alone cannot yield a unique recovery of the participant-specific GDP parameters (Oi , Ψi ). e R ei , and e Proof. Fix s ∈ Rd and Q ∈ O(d), and define C, τi as in the proposition. Since R⋆i ∈ O(d) and Q ∈ O(d), ei = R⋆ Q ∈ O(d), R i so the transformed tuple is feasible. For every i ∈ P,   e − Bi − 1re ei C τ⊤i R     ⊤  = C⋆ + 1r s⊤ Q − Bi − 1r τ⋆i − R⋆i s R⋆i Q h   i = C⋆ − Bi − 1r τ⋆⊤ R⋆i Q. i S11

Because Q is orthogonal, right multiplication by Q preserves the Frobenius norm. Hence,     e − Bi − 1re ei = C⋆ − Bi − 1r τ⋆⊤ R⋆ . C τ⊤i R i i F

F

Summing the squared identities over i ∈ P shows that the transformed tuple has the same objective value as the original minimizer. Since it is feasible, it is also a minimizer of Problem (S.35). Because s and Q are arbitrary, the GOPP objective cannot distinguish collaboration coordinate systems related by these common rigid transformations, proving the stated non-identifiability. S.7. Lemma 4.3: Centering the GOPP template Lemma 4.3 (Centering the GOPP template). Suppose that Bi ∈ Rr×d , i = 1, . . . , p, are observed, and define p X   2 Φ(C, R1 , . . . , R p , τ1 , . . . , τ p ) := C − Bi − 1r τ⊤i Ri . F

i=1

Let F be the feasible set defined by C ∈ Rr×d , Ri ∈ O(d), and τi ∈ Rd for i = 1, . . . , p, and let n o F0 := (C, R1 , . . . , R p , τ1 , . . . , τ p ) ∈ F : 1⊤r C = 0⊤d . Then inf F Φ = inf F0 Φ. Hence, the GOPP may be restricted, without changing its optimal value, to templates whose average row is zero. Proof. Since F0 ⊆ F , we have

inf Φ ≤ inf Φ. F

F0

It remains to prove the reverse inequality. Fix (C, R1 , . . . , R p , τ1 , . . . , τ p ) ∈ F . d

Let c ∈ R be arbitrary and define C := C − 1r c⊤ ,

τi := τi + Ri c,

i = 1, . . . , p.

For each i, the corresponding residual satisfies     C − Bi − 1r τ⊤i Ri = C − 1r c⊤ − Bi − 1r (τi + Ri c)⊤ Ri   = C − 1r c⊤ − Bi − 1r τ⊤i − 1r c⊤ R⊤i Ri = C − 1r c⊤ − Bi Ri + 1r τ⊤i Ri + 1r c⊤ R⊤i Ri = C − Bi Ri + 1r τ⊤i Ri   = C − Bi − 1r τ⊤i Ri , where we used R⊤i Ri = Id . Hence the objective value is unchanged by the transformation C 7→ C − 1r c⊤ , Now choose

τi 7→ τi + Ri c.

1 ⊤ C 1r . r   1⊤r C = 1⊤r C − 1r c⊤ = 1⊤r C − rc⊤ = 0⊤d . c=

Then

Thus, the transformed point belongs to F0 and has the same objective value as the original point. Therefore, every value attained over F is also attained over F0 , and so inf Φ ≤ inf Φ. F0

F

Combining the two inequalities gives inf Φ = inf Φ. F

F0

S12

S.8. Proposition 4.4: Reduction of the centered GOPP to max-trace form Proposition 4.4 (Reduction of the centered GOPP to max-trace form). Under the notation of Lemma 4.3, define 1 H := Ir − 1r 1⊤r , r

Bi := HBi ,

i = 1, . . . , p.

For fixed R1 , . . . , R p ∈ O(d), the unique minimizers over the translation variables and the centered template are τ⋆i =

1 ⊤ B 1r , r i

i = 1, . . . , p,

and

(S.36)

p

1X C = Bi Ri . p i=1 ⋆

(S.37)

Define the stacked rotation matrix and the block Gram matrix by h i R := Ri ∈ R pd×d , i∈P

and

⊤

Gi j := Bi B j ,

i, j = 1, . . . , p.

(S.38)

Then the rotation components of the centered GOPP minimizers are precisely the solutions of   tr R⊤ GR max R1 ,...,R p

Ri ∈ O(d),

s.t.

i = 1, . . . , p.

(S.39)

⋆ denotes the minimum of Φ over the centered feasible set F0 , and Vtr⋆ denotes the optimal value of ProbIf VGOPP lem (S.39), then p X 2 1 ⋆ VGOPP = (S.40) Bi F − Vtr⋆ . p i=1

Conversely, if R⋆1 , . . . , R⋆p solve Problem (S.39), then Equations (S.36) and (S.37), evaluated at these rotations, produce a centered minimizer of the GOPP. The proposition follows from the next three auxiliary lemmas. Lemma S.3 (Eliminating translations). For any C ∈ Rr×d satisfying 1⊤r C = 0⊤d and any R1 , . . . , R p ∈ O(d), min Φ(C, R1 , . . . , R p , τ1 , . . . , τ p )

τ1 ,...,τ p

=

p X

2

C − Bi Ri F .

i=1

The minimizers are unique and are given by τ⋆i =

1 ⊤ B 1r , r i

i = 1, . . . , p.

Proof. We first record a simple columnwise least-squares calculation. For any M ∈ Rr×d , the unique minimizer of 2

min M − 1r τ⊤ F τ∈Rd

is (τ⋆ )⊤ = (1⊤r 1r )−1 1⊤r M = S13

1 ⊤ 1 M, r r

or equivalently 1 ⊤ M 1r . r

τ⋆ = The corresponding minimized residual is

! 1 ⊤ M − 1r (τ ) = Ir − 1r 1r M = H M. r ⋆ ⊤

Now fix any C ∈ Rr×d ,

1⊤r C = 0⊤d ,

i = 1, . . . , p.

Ri ∈ O(d),

For each i, right multiplication by R⊤i preserves the Frobenius norm. Hence   h   i 2 2 C − Bi − 1r τ⊤i Ri = C − Bi − 1r τ⊤i Ri R⊤i F

F

2

= CR⊤i − Bi + 1r τ⊤i F 2

= Bi − CR⊤i − 1r τ⊤i F . Applying the preceding least-squares fact with Mi := Bi − CR⊤i gives ⊤ 1 ⊤ 1 Mi 1r = Bi − CR⊤i 1r . r r ⊤ ⊤ ⊤ Since 1r C = 0d , we have C 1r = 0d . Therefore τ⋆i =

τ⋆i =

1 ⊤ B 1r . r i

The minimized value of the i-th term is     2 2 min C − Bi − 1r τ⊤i Ri = H Bi − CR⊤i

τi ∈Rd

F

F

= = =

2 HBi − HCR⊤i F 2 HBi − CR⊤i F



 2 HBi − CR⊤i Ri

F

= ∥HBi Ri − C∥2F = ∥C − HBi Ri ∥2F . Here we used HC = C, which follows from 1⊤r C = 0⊤d , and R⊤i Ri = Id . Since τ1 , . . . , τ p appear separately in the objective, the minimization over translations separates across i. Thus, for every feasible (C, R1 , . . . , R p ), p X   2 min C − Bi − 1r τ⊤i Ri τ1 ,...,τ p

i=1 p X

=

F

∥C − HBi Ri ∥2F .

i=1

This establishes both the reduced objective and the uniqueness of the translations.

S14

Lemma S.4 (Eliminating the template). For fixed R1 , . . . , R p ∈ O(d), the unique minimizer of p X

2

C − Bi Ri F

i=1 r×d

over C ∈ R

satisfying 1⊤r C = 0⊤d is

p

1X C = Bi Ri . p i=1 ⋆

The corresponding minimized value is 2 p 1 X Bi F − Bi Ri . p i=1

p X

2

i=1

F

Proof. Fix R1 , . . . , R p ∈ O(d). From the definition of H, 1 1⊤r H = 1⊤r − 1⊤r 1r 1⊤r = 1⊤r − 1⊤r = 0⊤r . r Thus, for each i, 1⊤r Bi Ri = 1⊤r HBi Ri = 0⊤r Bi Ri = 0⊤d . Hence each Bi Ri has zero average row. Since the centering constraint is linear, the average of these matrices is also centered across rows. Define p X b := 1 C Bi Ri . p i=1 Then

p

b= 1⊤r C

1X ⊤ 1 Bi Ri = 0⊤d . p i=1 r

b is feasible for the constraint 1⊤r C = 0⊤ . For any feasible C, we have Thus C d p X

2

C − Bi Ri F =

p X

b + (C b − Bi Ri ) (C − C)

i=1

i=1

b2 + = p∥C − C∥ F

p X

F

b − Bi Ri C

i=1

because the cross term vanishes:

2

2 F

,

* p X  + b b C − Bi Ri 2 C − C, = 0, i=1

since

p X 

F

p X  b− b − Bi Ri = pC Bi Ri = 0. C i=1

i=1

b which proves (S.37). It remains to compute the reduced objective. Hence the objective is minimized uniquely at C = C, Pp ⋆ Using i=1 Bi Ri = pC , expanding the squared norms yields min

C∈Rr×d ⊤ 1⊤ r C=0d

p X

2

C − Bi Ri F =

i=1

p X

2

Bi Ri − C⋆ F

i=1

=

p X

2

Bi Ri F − p∥C⋆ ∥2F

i=1

=

p X i=1

S15

2

Bi F −

2 p 1 X Bi Ri . p i=1 F

This proves the stated template update and reduced objective. Lemma S.5 (Max-trace identity). For any R1 , . . . , R p ∈ O(d), let h i R = Ri . i∈P

With G defined by Equation (S.38), p X

2

  = tr R⊤ GR .

Bi Ri

i=1

F

Proof. Let

h i R = Ri

i∈P

Then

.

 ⊤   X  X      Bi Ri = tr  Bi Ri   B j R j  i∈P i∈P j∈P F  XX  ⊤ ⊤ = tr Ri Bi B j R j 2

X

i∈P j∈P

XX   = tr R⊤i Gi j R j i∈P j∈P

  = tr R⊤ GR . This proves the identity. Proof of Proposition 4.4. Lemma S.3 gives the unique translation updates in Equation (S.36) and reduces the centered GOPP objective to an optimization over the centered template and rotations. Lemma S.4 then gives the unique template update in Equation (S.37) and shows that, for fixed rotations, the minimized objective equals p X i=1

2 p 1 X Bi F − Bi Ri . p i=1 2

F

By Lemma S.5, the squared norm in the second term is tr(R⊤ GR). The first term is independent of the rotations, and −1/p < 0; hence minimizing the centered GOPP is equivalent, for the rotation variables, to solving Problem (S.39). The same identity gives Equation (S.40). Every centered GOPP minimizer must therefore have rotations that solve Problem (S.39) and must use the unique translation and template updates above. Conversely, any maximizer R⋆1 , . . . , R⋆p of Problem (S.39), augmented with ⋆ those updates, attains VGOPP and is consequently a centered GOPP minimizer. Problem (S.39) is nonconvex and is generally difficult to solve globally. We use the spectral initialization and blockwise generalized power method of [7], specialized only in notation and dimensions to the present alignment problem. For a square matrix S ∈ Rd×d with singular value decomposition S = UΣV ⊤ , define the orthogonal polar projection Π(S) = UV ⊤ ∈ O(d). (S.41) If S is rank deficient, the nearest orthogonal factor may be nonunique; in that case, any choice obtained from a full singular value decomposition may be used. For a stacked matrix h i M = Mi ∈ R pd×d , Mi ∈ Rd×d , i∈P

define the blockwise polar projection by h i Π p (M) := Π(Mi )

i∈P

S16

.

(S.42)

Algorithm 4: GPM alignment routine specialized from [7] Input: Block Gram matrix G ∈ R pd×pd ; maximum iterations T max ; tolerance ε > 0. Output: Estimated stacked rotation b R ∈ R pd×d , with block rows b Ri ∈ O(d), i = 1, . . . , p. Compute the top d eigenvectors of G and stack them as U ∈ R pd×d Initialize R(0) = Π p (U) Set T out = T max for t = 0, . . . , T max − 1 do Compute M(t) = GR(t) Update R(t+1) = Π p (M(t) ) if ∥R(t+1) − R(t) ∥F ≤ ε then T out = t + 1 break Set b R = R(Tout ) , where

h i b R= b Ri

i∈P

return b R

S.9. Proposition 4.5: Residual Translation Under Gaussian Anchor Noise Under the anchor-noise model in Definition 4.1, define the average anchor-noise vector v ηi := Wi⊤ 1r . r

(S.43)

For this result, let 1 H = Ir − 1r 1⊤r . r Proposition 4.5 (Residual Translation Under Gaussian Anchor Noise). Under the Gaussian anchor-noise model above, suppose that the matrices Wi , i ∈ P, are mutually independent and that the estimated rotations are computed exclusively from the centered anchor uploads. Then ! v2 ηi ∼ N 0d , Id , i ∈ P, (S.44) r and the collection {ηi }i∈P is independent of the estimated rotations. Consequently, conditionally on the estimated rotations, the vectors b R⊤i ηi , i ∈ P, are independent and each follows

For every fixed pair i , j,

! v2 ⊤ b Ri ηi ∼ N 0d , Id . r

(S.45)

! 2v2 b R⊤i ηi − b R⊤j η j ∼ N 0d , Id , r

(S.46)

S17

and hence

 2 2dv2 = R⊤i ηi − b R⊤j η j E b . 2 r

Moreover, for every 0 < ζ < 1, b R⊤i ηi − b R⊤j η j

√  p 2v √ ≤ √ d + 2 log(1/ζ) 2 r

(S.47)

(S.48)

with probability at least 1 − ζ. Proof. For each coordinate k ∈ {1, . . . , d}, ηi,k is v times the average of r independent standard Gaussian variables. Distinct coordinates are formed from distinct columns of Wi and are therefore independent. Hence, ! v2 ηi ∼ N 0d , Id . r The vector ηi and the centered matrix HWi are jointly Gaussian. For coordinates k, ℓ ∈ {1, . . . , d} and a row index a ∈ {1, . . . , r}, 
v  Cov ηi,k , (HWi )aℓ = δkℓ 1⊤r H a r = 0, because 1⊤r H = 0⊤r . Thus ηi and HWi are independent. Mutual independence of the participant noise matrices implies that the collection {ηi }i∈P is independent of {HWi }i∈P , and hence of the estimated rotations. Conditionally on the estimated rotations, orthogonal invariance gives ! ! v2 ⊤ b v2 b R⊤i ηi ∼ N 0d , b Ri Ri = N 0d , Id . r r The transformed vectors remain conditionally independent. Hence, for every fixed i , j, their difference is Gaussian with covariance 2v2 Id /r, proving Equation (S.46). Taking the trace of this covariance gives Equation (S.47). Finally, write √ 2v b R⊤i ηi − b R⊤j η j = √ g, g ∼ N(0d , Id ). r The standard Gaussian norm concentration inequality gives   √ p Pr ∥ g∥2 > d + 2 log(1/ζ) ≤ ζ, which proves the stated tail bound. We measure the rotational component of the alignment error by E := min max Oi b Ri − Q Q∈O(d) i∈P

F

.

(S.49)

After transposition and restriction to the centered row subspace, the centered anchor observations form an instance of the normalized Gaussian GOPP studied in [7]. The following statement is a protocol-specific specialization of [7, Theorems 3.2 and 3.3], not a new general GOPP convergence theorem. The displayed constants result from substituting the centered orthonormal-anchor dimensions into the sufficient conditions traced in the cited proofs. S.10. Theorem 4.6: Specialization of the GPM Guarantee to a Centered Orthonormal Anchor Matrix Theorem 4.6 (Specialization of the GPM Guarantee to a Centered Orthonormal Anchor Matrix). Let γ > 2, and apply the spectral initializer and GPM prescribed in [7] to Problem (S.39). An explicit conservative sufficient condition obtained from the proof of [7, Theorem 3.2] is √ p 1 . (S.50) v≤ √ √ p p 14336 d pd + r − 1 + 2γp log p S18

Under this condition, with probability at least 1 − O(p−γ+2 ), the GPM converges linearly to a global maximizer h i b R= b ∈ R pd×d Ri i∈P

of Problem (S.39). Every global maximizer is of the form b RQ for some Q ∈ O(d), and b Rb R⊤ is the unique optimizer of the associated semidefinite relaxation. Moreover, the limiting rotations satisfy  √ √ p p pd + r − 1 + 2γp log p v d 6 . (S.51) E≤ √ 1 − 1/1024 p Proof of the specialization. Let U⊥ ∈ Rr×(r−1) have orthonormal columns spanning 1⊥r . Then U⊥⊤ U⊥ = Ir−1 ,

H = U⊥ U⊥⊤ .

For each i ∈ P, define the restricted centered observation, signal matrix, and noise matrix by ⊤

DL,i := Bi U⊥ ,

AL := A⊤ U⊥ ,

WL,i := Wi⊤ U⊥ .

Centering removes the translation component of the anchor upload, and hence DL,i = O⊤i AL + vWL,i .

(S.52)

Because the entries of Wi are jointly Gaussian and U⊥ has orthonormal columns, WL,i has independent standard Gaussian entries. Independence of the noise matrices across participants is also preserved. Equation (S.52) is therefore the Gaussian observation model studied in [7], with signal matrix AL and planted rotations O⊤i . Vertically stack the restricted observations as h i DL := DL,i ∈ R pd×(r−1) . i∈P

The (i, j) block of its Gram matrix satisfies 

DL D⊤L

 ij

= DL,i D⊤L, j ⊤

= Bi U⊥ U⊥⊤ B j ⊤

= Bi HB j ⊤

= Bi B j = Gi j .

(S.53)

The fourth equality follows because HB j = B j . Consequently, DL D⊤L = G.

(S.54)

For the stacked rotation matrix R, Equation (S.54) gives   D E tr R⊤ GR = G, RR⊤ D E = DL D⊤L , RR⊤ 2

= D⊤L R F .

(S.55)

Together with the identical block constraints Ri ∈ O(d), Equation (S.55) shows that Problem (S.39) is exactly the nonconvex program in [7, Equation (2.4)]. In particular, the matrix denoted by D in [7] corresponds to DL , while its block Gram matrix C = D D⊤ corresponds exactly to G. No rescaling of the objective is required. S19

The remaining correspondence with the notation of [7] is nL = p,

mL = r − 1,

dL = d,

σL = v.

Moreover, the centered orthonormal-anchor conditions imply AL A⊤L = A⊤ U⊥ U⊥⊤ A = A⊤ H A = A⊤ A = Id . Thus, σmin ( AL ) = ∥ AL ∥ = 1,

κ = 1.

In the spectral-initialization argument of [7, Section 5.5], ϵ is the prescribed tolerance that places the spectral initializer and its leave-one-out counterparts inside the local convergence neighborhood. It is fixed by √ 1 1 . ϵ= equivalently ϵ d= √ , 2 2 32κ 32κ d The proof first controls the distance from the spectral initializer to the planted solution. The constant 112κ2 results from applying the polar-projection perturbation bound to the blockwise singular-vector estimate, and Equation (5.40) of [7] gives the sufficient condition √ √ nL ϵ d σmin ( AL )  . σL ≤ √ p √ √ 2 112κ d nL d + mL + 2γnL log nL The subsequent leave-one-out argument must also control the distance between the full spectral initializer and each auxiliary initializer. In [7, Section 5.5], Lemma 5.14 contributes the factor 56κ in the leave-one-out singular-vector bound, while Lemma 5.5 contributes 8κ when that bound is transferred through the polar projection. Their product √ gives 448κ2 , and requiring the resulting distance to be at most ϵ d yields the stronger condition √ √ nL ϵ d σmin ( AL )  . σL ≤ √ p √ √ 2 448κ d nL d + mL + 2γnL log nL Because 448 > √ 112, the leave-one-out condition implies the first condition and is therefore the active restriction. Substituting ϵ d = 1/(32κ2 ) gives the prefactor σmin ( AL ) . 14336κ4 In the present specialization, σmin ( AL ) = κ = 1. Substituting nL = p, mL = r − 1, and σL = v therefore yields Equation (S.50). The blockwise estimate established in the proof of [7, Theorem 3.3] has the explicit leading factor 6κ2 . (1 − ϵ 2 d)∥ AL ∥ Here, 1 , 1024 which gives the factor 6/(1 − 1/1024). Since the planted rotations in the specialized instance are O⊤i , orthogonal invariance of the Frobenius norm gives κ = ∥ AL ∥ = 1,

Ri − O⊤i Q min max b

Q∈O(d) i∈P

ϵ2d =

F

= min max Oi b Ri − Q Q∈O(d) i∈P

F

= E. The specialized blockwise estimate is therefore Equation (S.51). The convergence, global-optimality, global-maximizerorbit, semidefinite-relaxation, and probability conclusions follow from [7, Theorem 3.2], while the blockwise estimation bound follows from [7, Theorem 3.3]. S20

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.1: MNIST digit 0: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S.11. Additional MNIST Reconstruction Examples The following panels complement the mixed-digit reconstruction panel in the main manuscript by holding the digit class fixed. Each column uses a distinct source record of the stated digit and is paired vertically across all rows. Within every noisy row, the leftmost reconstruction is the zero-noise control, and the remaining saved reconstructions are ordered by decreasing full-test exact-source linkage, ending at an observed chance or chance-compatible value. Percentages beneath the reconstructions are computed over the complete 1,000-query linkage evaluation; they are not per-digit or per-image probabilities. The panels are qualitative, while all reported privacy values are computed over the complete target test set. S.12. Identity-Specific CelebA Reconstruction Examples The following figures complement the mixed-identity CelebA reconstruction figure in the main manuscript by holding the source identity fixed. Figure S.11 uses the identity displayed in the first column of the mixed figure, Figure S.12 uses the identity in its second column, and so forth. All ten columns within each supplementary figure therefore show the same source face. The original and noiseless C-GDP rows repeat their fixed reference images, whereas each noisy row follows the same leakage-ordered sequence of completed protocol realizations used in the main figure: the first column is the zero-noise control, and cross-image identity-linkage accuracy decreases from left to right. The percentages printed beneath the reconstructions are the saved draw-level linkage accuracies evaluated S21

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.2: MNIST digit 1: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S22

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.3: MNIST digit 2: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S23

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.4: MNIST digit 3: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S24

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.5: MNIST digit 4: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S25

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.6: MNIST digit 5: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S26

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.7: MNIST digit 6: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S27

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.8: MNIST digit 7: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S28

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.9: MNIST digit 8: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S29

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

AA-I-GDP known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ , ̂ Xĵ = Xj̃ F † = Xj FF †

36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7% 36.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψ𝘛s )O𝘛s = Xj̃ + σWj O𝘛s , Xĵ = Xj FF † + σWj O𝘛s F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (private-data noise) known-anchor inversion ̂

Xj̃ = (Yj − 1nj b𝘛j )(A𝘛 Bj )𝘛 = Xj̃ + σWj O𝘛j , Xĵ = Xj FF † + σWj O𝘛j F †

36.7% 34.8% 30.6% 27.6% 25.0% 21.6% 19.3% 15.9% 13.0% 10.0%

AA-I-GDP (anchor noise) MP attack MP ̂

𝘛 𝘛 † Xj̃ = (YMP j − 1nj bj )(A Bj ) , MP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.8% 31.1% 28.2% 25.2% 21.6% 18.6% 16.0% 13.0% 10.0%

AA-I-GDP (anchor noise) OP attack OP ̂

𝘛 𝘛 𝘛 Xj̃ = (YOP j − 1nj bj )[Π(A Bj )] , OP ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF †

36.7% 33.6% 30.8% 27.9% 24.8% 22.0% 18.9% 15.9% 13.0%

9.9%

AA-I-GDP (anchor noise) AM attack AM ̂

𝘛 ̂ ̂ 𝘛 Xj̃ = (YAM j − 1nj bj )[Π(Oc Rc )Rj ] , AM ̂ Xĵ = Xj̃ F † ⟶ v → 0 Xj FF † 𝘛

36.7% 33.5% 30.8% 27.9% 24.8% 21.9% 18.9% 16.0% 13.0% 10.0%

Figure S.10: MNIST digit 9: original images and reconstructions ordered from left to right by decreasing full-test exact-source linkage.

S30

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.11: CelebA displayed identity 1: original image and reconstructions across the leakage-ordered attack settings.

over the complete privacy test set, rather than scores computed from the single displayed face. The rightmost AAI-GDP (anchor noise) reconstructions reach the approximately 10% chance level; the rightmost C-GDP (private-data noise) reconstruction is the lowest-leakage realization attained within its calibrated range. References [1] R. Penrose, A generalized inverse for matrices, Proceedings of the Cambridge Philosophical Society 51 (3) (1955) 406–413. doi:10.1017/S0305004100030401. [2] C. Dwork, F. McSherry, K. Nissim, A. D. Smith, Calibrating noise to sensitivity in private data analysis, in: S. Halevi, T. Rabin (Eds.), Theory of Cryptography (TCC 2006), Vol. 3876 of Lecture Notes in Computer Science, Springer, 2006, pp. 265–284. doi:10.1007/11681878_14. [3] B. Balle, Y.-X. Wang, Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising, in: Proceedings of the 35th International Conference on Machine Learning (ICML), Vol. 80 of Proceedings of Machine Learning Research, PMLR, 2018, pp. 394–403. URL https://proceedings.mlr.press/v80/balle18a.html [4] C. Dwork, A. Roth, The algorithmic foundations of differential privacy, Foundations and Trends in Theoretical Computer Science 9 (3–4) (2014) 211–407. doi:10.1561/0400000042. [5] A. P. Sanil, A. F. Karr, X. Lin, J. P. Reiter, Privacy preserving regression modelling via distributed computation, in: Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), ACM, 2004, pp. 677–682. doi:10.1145/1014052.1014139. [6] H. Yamashiro, K. Omote, A. Imakura, T. Sakurai, Toward the application of differential privacy to data collaboration, IEEE Access 12 (2024) 63292–63301. doi:10.1109/ACCESS.2024.3396146. S31

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.12: CelebA displayed identity 2: original image and reconstructions across the leakage-ordered attack settings.

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP = X F , v → 0 : X j j j → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP OP † OP Xj = Xj F , v → 0 : Xj → Xj FF †

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ AM † AM Xj = XAM → Xj FF † j F , v → 0 : Xj

Figure S.13: CelebA displayed identity 3: original image and reconstructions across the leakage-ordered attack settings.

S32

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.14: CelebA displayed identity 4: original image and reconstructions across the leakage-ordered attack settings.

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP = X F , v → 0 : X j j j → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP OP † OP Xj = Xj F , v → 0 : Xj → Xj FF †

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ AM † AM Xj = XAM → Xj FF † j F , v → 0 : Xj

Figure S.15: CelebA displayed identity 5: original image and reconstructions across the leakage-ordered attack settings.

S33

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.16: CelebA displayed identity 6: original image and reconstructions across the leakage-ordered attack settings.

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP = X F , v → 0 : X j j j → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP OP † OP Xj = Xj F , v → 0 : Xj → Xj FF †

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ AM † AM Xj = XAM → Xj FF † j F , v → 0 : Xj

Figure S.17: CelebA displayed identity 7: original image and reconstructions across the leakage-ordered attack settings.

S34

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.18: CelebA displayed identity 8: original image and reconstructions across the leakage-ordered attack settings.

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP = X F , v → 0 : X j j j → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP OP † OP Xj = Xj F , v → 0 : Xj → Xj FF †

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ AM † AM Xj = XAM → Xj FF † j F , v → 0 : Xj

Figure S.19: CelebA displayed identity 9: original image and reconstructions across the leakage-ordered attack settings.

S35

Original

Xj C-GDP known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ Xĵ = Xj̃ F † = Xj FF †

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

81.6%

73.4%

68.3%

58.6%

51.5%

44.7%

36.7%

30.0%

22.9%

15.4%

81.6%

72.8%

67.8%

61.4%

38.3%

35.5%

30.0%

27.6%

18.3%

9.9%

81.6%

76.5%

72.3%

48.4%

42.2%

42.0%

26.6%

25.6%

17.9%

10.0%

81.6%

74.8%

67.6%

66.3%

34.6%

33.6%

28.0%

24.4%

19.3%

9.7%

C-GDP (private-data noise) known-secret inversion ̂

Xj̃ = (Yj − 1nj Ψs⊤ )Os⊤ = Xj̃ + σWj Os⊤ Xĵ = Xj FF † + σWj Os⊤ F †

AA-I-GDP (anchor noise) MP attack ̂

̃ ⊤ ⊤ † XMP j = (Yj − 1nj bj )(A Bj ) ̂̃ ̂ ̂ MP † MP † XMP j = Xj F , v → 0 : Xj → Xj FF

AA-I-GDP (anchor noise) OP attack ̂

̃ ⊤ ⊤ ⊤ XOP j = (Yj − 1nj bj )[Π(A Bj )] ̂̃ ̂ ̂ OP † OP XOP = X F , v → 0 : X → Xj FF † j j j

AA-I-GDP (anchor noise) alignment-map attack ̂

̃ XAM = (Yj − 1nj bj⊤ )[Π(Oc Rĉ )Rj⊤̂ ] ⊤ j ̂̃ ̂ ̂ † AM XAM = XAM → Xj FF † j j F , v → 0 : Xj

Figure S.20: CelebA displayed identity 10: original image and reconstructions across the leakage-ordered attack settings.

[7] S. Ling, Near-optimal bounds for the generalized orthogonal procrustes problem via generalized power method, Applied and Computational Harmonic Analysis 66 (2023) 62–100. doi:10.1016/j.acha.2023.04.008.

S36

Related documents

• Geometric Data Perturbation with Noisy-Anchor Alignment for Privacy-Preserving Collaborative Learning#1156448
• A Privacy Preserving System for Movie Recommendations Using Federated Learning#177330
• Volley Revolver: A Novel Matrix-Encoding Method for Privacy-Preserving Neural Networks (Inference)#144166
• Differentially Private Approximation of the John Ellipsoid#1116937
• Bayesian Adversarial Privacy#986828