riskcal.analysis

PLD (Privacy Loss Distribution)

Functions for computing risk metrics from Privacy Loss Distributions.

riskcal.analysis.get_beta_from_pld(pld, alpha=None, alphas=None)[source]

Compute false negative rate (FNR) for given false positive rate (FPR) from PLD.

Uses the direct method from Algorithm 1 (Kulynych et al., 2024) to compute the optimal trade-off between FNR (beta) and FPR (alpha).

Deprecated since version 1.2.0: Parameter ‘alphas’ is deprecated and will be removed in version 2.0.0. Use ‘alpha’ instead.

Parameters:

pld (PrivacyLossDistribution) – Privacy loss distribution from Google’s dp_accounting library.
alpha (float | ndarray) – False positive rate(s) in [0, 1]. Can be scalar or array.
alphas (float | ndarray) – (Deprecated) Use ‘alpha’ instead.

Returns:

False negative rate(s) corresponding to input alpha.

Return type:

float | ndarray

Example

>>> from dp_accounting.pld import privacy_loss_distribution as pld_module
>>> pld = pld_module.from_gaussian_mechanism(1.0)
>>> beta = get_beta_from_pld(pld, alpha=0.01)

References

Kulynych & Gomez et al. (2024), Algorithm 1. https://arxiv.org/abs/2407.02191

riskcal.analysis.get_advantage_from_pld(pld)[source]

Compute attack advantage from PLD.

Advantage is the maximum value of (TPR - FPR) achievable by any attacker, which equals delta at epsilon=0.

Parameters:: pld (PrivacyLossDistribution) – Privacy loss distribution from Google’s dp_accounting library.
Returns:: Maximum attack advantage.
Return type:: float

References

Kulynych & Gomez et al. (2024). https://arxiv.org/abs/2407.02191

riskcal.analysis.get_bayes_risk_from_pld(pld, prior)[source]

Compute Bayes Risk from PLD for given prior probability.

Bayes risk shows the maximum accuracy of an attack against privacy of a single record under a binary prior (e.g., accuracy of attribute inference).

Parameters:

pld – Privacy loss distribution from Google’s dp_accounting library.
prior – Prior probability (scalar or array). Probability that the sensitive attribute takes value 1.

Returns:

Bayes risk value(s). Float if prior is scalar, array if prior is array.

Example

>>> from dp_accounting.pld import privacy_loss_distribution as pld_module
>>> pld = pld_module.from_laplace_mechanism(1.0)
>>> risk = get_bayes_risk_from_pld(pld, prior=0.5)

References

Kulynych et al. (2025), Proposition D.1 / Eq. 35. https://arxiv.org/abs/2507.06969

GDP (Gaussian Differential Privacy)

Functions for computing risk metrics from Gaussian DP parameters.

riskcal.analysis.get_beta_from_gdp(mu, alpha)[source]

Compute FNR for FPR using the analytical formula for Gaussian DP.

Parameters:

mu (float) – Gaussian noise scale parameter (sigma).
alpha (float | ndarray) – False positive rate(s) in [0, 1].

Returns:

False negative rate(s) corresponding to input alpha.

Return type:

float | ndarray

References

Dong et al. (2019), Eq. 6. https://arxiv.org/abs/1905.02383

riskcal.analysis.get_advantage_from_gdp(mu)[source]

Compute attack advantage using analytical formula for Gaussian mechanism.

Parameters:: mu (float | ndarray) – Gaussian noise scale parameter (sigma). Can be scalar or array.
Returns:: Attack advantage value(s).
Return type:: float | ndarray

References

Dong et al. (2019), Corollary 2.13. https://arxiv.org/abs/1905.02383

riskcal.analysis.get_bayes_risk_from_gdp(mu, prior)[source]

Compute Bayes Risk for Gaussian mechanism using analytical formula.

Parameters:

mu – Gaussian noise scale parameter (sigma).
prior – Prior probability (scalar or array).

Returns:

Bayes risk value(s). Float if prior is scalar, array if prior is array.

References

Kulynych et al. (2025), Proposition D.1 / Eq. 35. https://arxiv.org/abs/2507.06969
Dong et al. (2019), Corollary 2.13. https://arxiv.org/abs/1905.02383

ADP (Approximate Differential Privacy)

Functions for computing risk metrics from (epsilon, delta)-DP parameters.

riskcal.analysis.get_beta_from_adp(epsilon, delta, alpha)[source]

Compute FNR for FPR from (epsilon, delta)-DP parameters.

Parameters:

epsilon (float) – Privacy parameter epsilon.
delta (float) – Privacy parameter delta.
alpha (float | ndarray) – False positive rate(s) in [0, 1].

Returns:

False negative rate(s) corresponding to input alpha.

Return type:

float | ndarray

Example

>>> import numpy as np
>>> np.round(get_beta_from_adp(1.0, 0.001, 0.8), 3)
0.073

References

Dong et al. (2019), Eq. 5. https://arxiv.org/abs/1905.02383

riskcal.analysis.get_advantage_from_adp(epsilon, delta)[source]

Compute attack advantage from (epsilon, delta)-DP parameters.

Parameters:

epsilon (float) – Privacy parameter epsilon.
delta (float) – Privacy parameter delta.

Returns:

Attack advantage.

Return type:

float

Example

>>> import numpy as np
>>> np.round(get_advantage_from_adp(0., 0.001), 3)
0.001

References

Dong et al. (2019). https://arxiv.org/abs/1905.02383

riskcal.analysis.get_epsilon_from_err_rates(delta, alpha, beta)[source]

Convert f-DP error rates (alpha, beta) to epsilon for (epsilon, delta)-DP.

Parameters:

delta (float) – Target delta parameter for (epsilon, delta)-DP.
alpha (float) – False positive rate (FPR) from f-DP.
beta (float) – False negative rate (FNR) from f-DP.

Returns:

Epsilon value corresponding to the error rates.

Return type:

float

Example

>>> import numpy as np
>>> np.round(get_epsilon_from_err_rates(0.001, 0.001, 0.8), 3)
5.293

References

Dong et al. (2019). https://arxiv.org/abs/1905.02383

RDP (Renyi Differential Privacy)

Functions for computing risk metrics from Renyi DP parameters.

riskcal.analysis.get_beta_from_rdp(epsilon, alpha, order, linear_search_step=0.001, max_bisection_steps=50, tol=1e-07)[source]

Compute FNR for FPR from Renyi DP parameters.

Uses the optimal conversion from a single RDP guarantee to a tradeoff function (Riess et al., 2026). Accepts scalar or array FPR values.

Parameters:

epsilon (float) – Renyi divergence parameter (privacy budget).
alpha (float | ndarray) – False positive rate(s) (FPR) in [0, 1]. Scalar or array.
order (float) – Order of Renyi divergence (alpha in Renyi DP literature).
linear_search_step (float) – Unused. Kept for backward compatibility.
max_bisection_steps (int) – Unused. Kept for backward compatibility.
tol (float) – Numerical tolerance for bisection convergence.

Returns:

False negative rate (FNR) corresponding to input alpha.

Return type:

float | ndarray

References

Zhu et al. (2022), Appendix F.1. https://arxiv.org/abs/2106.08567
Riess et al. (2026). https://arxiv.org/abs/2602.04562

zCDP (Zero-Concentrated Differential Privacy)

Functions for computing risk metrics from zCDP parameters.

riskcal.analysis.get_beta_from_zcdp(rho, alpha, tol=1e-09, min_order=1.0, max_order=1024.0, grid_size=1000)[source]

Compute FNR for FPR from zCDP parameter rho.

Zero-Concentrated Differential Privacy (zCDP) is characterized by a single parameter rho. This function computes the optimal trade-off between false negative rate (beta) and false positive rate (alpha) by optimizing over Renyi divergence orders.

Parameters:

rho (float) – Zero-concentrated differential privacy parameter.
alpha (float | ndarray) – False positive rate(s) in [0, 1]. Can be scalar or array.
tol (float) – Tolerance for numerical convergence and avoiding log(0).
max_order (float) – Maximum Renyi DP order to consider.

Returns:

False negative rate(s) corresponding to input alpha. Returns float if alpha is scalar, array if alpha is array.

Return type:

float | ndarray

Example

>>> import numpy as np
>>> # Single alpha value
>>> beta = get_beta_from_zcdp(rho=0.5, alpha=0.1)
>>> np.round(beta, 3)
0.517
>>> # Multiple alpha values
>>> betas = get_beta_from_zcdp(rho=0.5, alpha=np.array([0.1, 0.2, 0.3]))
>>> np.round(betas, 3)
array([0.517, 0.34, 0.232])

References

Bun & Steinke (2016). https://arxiv.org/abs/1605.02065
Zhu et al. (2022), Appendix F.1. https://arxiv.org/abs/2106.08567
Riess et al. (2026). https://arxiv.org/abs/2602.04562

riskcal.analysis.get_advantage_from_zcdp(rho, tol=1e-09, min_order=1.0, max_order=1024.0, grid_size=1000)[source]

Compute attack advantage from zCDP parameter rho.

Advantage is the maximum value of (TPR - FPR) achievable by any attacker. This function optimizes over all possible threshold choices to find the maximum advantage.

Parameters:

rho (float) – Zero-concentrated differential privacy parameter.
tol (float) – Tolerance for numerical convergence and avoiding log(0).
min_order (float) – Minimum Renyi DP order to consider.
max_order (float) – Maximum Renyi DP order to consider.
grid_size (int) – Number of orders to evaluate in the grid search.

Returns:

Maximum attack advantage.

Return type:

float

Example

>>> import numpy as np
>>> adv = get_advantage_from_zcdp(rho=0.5)
>>> np.round(adv, 3)
0.47

References

Bun & Steinke (2016). https://arxiv.org/abs/1605.02065

Internal utilities

riskcal.analysis.pld_to_plrvs(pld)[source]

Convert PLD to internal PLRVs representation.

Converts a Google dp_accounting Privacy Loss Distribution object into the PLRVs (Privacy Loss Random Variables) format used internally.

Parameters:: pld (PrivacyLossDistribution) – Privacy loss distribution from Google’s dp_accounting library.
Returns:: PLRVs object containing the privacy loss random variables.
Return type:: PLRVs

Note

This is an internal conversion function. Most users should use the higher-level get_beta_from_pld(), get_advantage_from_pld(), etc.

class riskcal.analysis.PLRVs(y0, pmf_Y, infinity_mass_Y, x0, pmf_X, minus_infinity_mass_X, is_symmetric)[source]

Bases: object

Privacy loss random variables.

y0: int

pmf_Y: ndarray

infinity_mass_Y: float

x0: int

pmf_X: ndarray

minus_infinity_mass_X: float

is_symmetric: bool

__init__(y0, pmf_Y, infinity_mass_Y, x0, pmf_X, minus_infinity_mass_X, is_symmetric)