{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:01:10Z","timestamp":1782975670904,"version":"3.54.5"},"reference-count":60,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001459","name":"Ministry of Education, Singapore","doi-asserted-by":"publisher","award":["MOE-000761-01"],"award-info":[{"award-number":["MOE-000761-01"]}],"id":[{"id":"10.13039\/501100001459","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00225","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"2230-2249","source":"Crossref","is-referenced-by-count":0,"title":["Auditing Apple's DifferentialPrivacy.framework: Implementation Bugs, Misconfigurations, and Practical Risks"],"prefix":"10.1109","author":[{"given":"Rishav","family":"Chourasia","sequence":"first","affiliation":[{"name":"Betterdata.ai,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ergute","family":"Bao","sequence":"additional","affiliation":[{"name":"Mohamed bin Zayed University of Artificial Intelligence,United Arab Emirates"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Uzair","family":"Javaid","sequence":"additional","affiliation":[{"name":"Betterdata.ai,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaokui","family":"Xiao","sequence":"additional","affiliation":[{"name":"National University of Singapore,Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Learning with privacy at scale","volume-title":"Apple Machine Learning Research","year":"2017"},{"key":"ref2","first-page":"2024","year":"2024","journal-title":"Scenes: Differential privacy"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.14778\/3685800.3685833"},{"key":"ref4","article-title":"Data for good: New tools to help health researchers track and combat covid-19","author":"Jin","year":"2020"},{"key":"ref5","article-title":"Collecting telemetry data privately","volume":"30","author":"Ding","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3226070"},{"key":"ref7","article-title":"WWDC 2016 Keynote","year":"2016b"},{"key":"ref8","article-title":"Differential privacy using a count mean sketch","author":"Bhowmick","year":"2018"},{"key":"ref9","article-title":"Privatized machine learning using generative adversarial networks","author":"Bhowmick","year":"2019"},{"key":"ref10","article-title":"Private federated learning with protection against reconstruction","author":"Bhowmick","year":"2024"},{"key":"ref11","article-title":"Distributed labeling for supervised learning","author":"Bhowmick","year":"2023"},{"key":"ref12","article-title":"Emoji frequency detection and deep link frequency","author":"Thakurta","year":"2017"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.12968\/prps.2007.1.82.38476"},{"key":"ref14","article-title":"Differential privacy for message text content mining","author":"Friedman","year":"2020"},{"key":"ref15","article-title":"Efficient implementation for differential privacy using cryptographic functions","author":"Sierra","year":"2019"},{"key":"ref16","year":"2025","journal-title":"Understanding aggregate trends for apple intelligence using differential privacy"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML59370.2024.00032"},{"key":"ref18","first-page":"3208","article-title":"Lossless compression of efficient private local randomizers","volume-title":"International Conference on Machine Learning","author":"Feldman","year":"2021"},{"key":"ref19","first-page":"6418","article-title":"Private frequency estimation via projective geometry","volume-title":"International Conference on Machine Learning","author":"Feldman","year":"2022"},{"key":"ref20","article-title":"Differential privacy, part 3: Extraordinary claims require extraordinary scrutiny","author":"Cyphers","year":"2017","journal-title":"Access Now"},{"key":"ref21","author":"Forum","year":"2016","journal-title":"Apple\u2019s emphasis on differential privacy"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560708"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382264"},{"key":"ref24","article-title":"Avoiding pitfalls for privacy accounting of subsampled mechanisms under composition","author":"Lebeda","year":"2024","journal-title":"arXiv preprint"},{"key":"ref25","article-title":"Debugging differential privacy: A case study for privacy auditing","author":"Tramer","year":"2022","journal-title":"arXiv preprint"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.14778\/3055330.3055331"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243818"},{"key":"ref28","first-page":"40624","article-title":"Bayesian estimation of differential privacy","volume-title":"International Conference on Machine Learning","author":"Zanella-Beguelin","year":"2023"},{"key":"ref29","first-page":"259","article-title":"Prio: Private, robust, and scalable computation of aggregate statistics","volume-title":"14th USENIX symposium on networked systems design and implementation (NSDI 17)","author":"Corrigan-Gibbs","year":"2017"},{"key":"ref30","first-page":"6975","article-title":"{PINE}: Efficient verification of a euclidean norm bound of a \\{Secret-Shared\\} vector","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Rothblum","year":"2024"},{"key":"ref31","first-page":"1376","article-title":"The composition theorem for differential privacy","volume-title":"International conference on machine learning","author":"Kairouz","year":"2015"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833672"},{"key":"ref33","article-title":"Precision-based attacks and interval refining: How to break, then fix, differential privacy on finite computers","author":"Haney","year":"2022","journal-title":"arXiv preprint"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616607"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ALLERTON.2018.8636068"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00081"},{"key":"ref37","article-title":"Privacy auditing with one (1) training run","volume":"36","author":"Steinke","year":"2024","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref38","article-title":"Auditing $f$\u2013differential privacy in one run","author":"Mahloujifar","year":"2024","journal-title":"arXiv preprint"},{"key":"ref39","first-page":"1631","article-title":"Tight auditing of differentially private machine learning","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Nasr","year":"2023"},{"key":"ref40","first-page":"501","article-title":"Pool inference attacks on local differential privacy: Quantifying the privacy guarantees of apple\u2019s count mean sketch in practice","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Gadotti","year":"2022"},{"key":"ref41","article-title":"Privacy loss in Apple\u2019s implementation of differential privacy on macOS 10.12","author":"Tang","year":"2017","journal-title":"arXiv preprint"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1561\/0400000042"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2746539.2746632"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"ref45","article-title":"Private federated statistics in an interactive setting","author":"McMillan","year":"2022","journal-title":"arXiv preprint"},{"key":"ref46","article-title":"On the privacy properties of variants on the Sparse Vector Technique","author":"Chen","year":"2015","journal-title":"arXiv preprint"},{"key":"ref47","article-title":"Verifiable Distributed Aggregation Functions","volume-title":"Internet Engineering Task Force, Internet-Draft draft-irtf-cfrg-vdaf-17","author":"Barnes","year":"2025"},{"key":"ref48","article-title":"Distributed Aggregation Protocol for Privacy Preserving Measurement","volume-title":"Internet Engineering Task Force, Internet-Draft draft-ietf-ppm-dap-16, Sep. 2025, work in Progress. [Online]","author":"Geoghegan"},{"key":"ref49","article-title":"Anonymous artifact for auditing apple\u2019s differentialprivacy.framework","volume-title":"anonymous research artifact containing recovered headers and supporting code","year":"2025"},{"key":"ref50","volume-title":"Secure noise generation","year":"2020"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690347"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3664490"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_14"},{"key":"ref54","volume-title":"Random number generation and Monte Carlo methods","author":"Gentle","year":"2003"},{"key":"ref55","article-title":"Task Binding and In-Band Provisioning for DAP","volume-title":"Internet Engineering Task Force, Internet-Draft draft-ietf-ppm-dap-taskprov-03, Sep. 2025, work in Progress. [Online]","author":"Wang"},{"key":"ref56","article-title":"Differential secrecy for distributed data and applications to robust differentially secure vector summation","author":"Talwar","year":"2022","journal-title":"arXiv preprint"},{"key":"ref57","first-page":"15676","article-title":"The discrete gaussian for differential privacy","volume":"33","author":"Canonne","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.689"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1198\/jasa.2009.tm08651"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1111\/rssb.12454"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573572.pdf?arnumber=11573572","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:28:04Z","timestamp":1782970084000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573572\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":60,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00225","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}