𝑓-Differential Privacy Filters: Validity and Approximate Solutions

Accounting for privacy loss under fully adaptive composition—where mechanism choice and privacy parameters may depend on the history of prior outputs—is a central challenge in differential privacy (DP). Here, privacy filters are stopping rules ensuring a prescribed global budget is not exceeded. A leading candidate for optimal filter design is 𝑓-DP, which characterizes the full extent of adversarial hypothesis testing and recovers (ε,δ)-DP through piece-wise linear trade-off functions, while enabling tight (ε,δ)-DP accounting in standard compositions via tensor products. Yet whether such filters can be correctly defined under 𝑓-DP remains unclear. We show that the natural 𝑓-DP filter—tracking path-wise accumulating tensor products and stopping when the prescribed curve is crossed—is fundamentally invalid, precluding the direct use of standard efficient numerical Fast-Fourier-Transform accounting in the fully adaptive setting. We characterize this failure, establishing necessary and sufficient conditions for the natural 𝑓-DP filter's validity. Furthermore, we prove a fully adaptive central limit theorem for 𝑓-DP, establishing Gaussian convergence of cumulative privacy losses under full adaptivity. As a demonstration, we construct a closed-form approximate GDP filter for subsampled Gaussian mechanisms that provably outperforms RDP-based accounting in asymptotic regimes ($q\ll 1$ and $q\approx 1$) without tracking the full trade-off function, demonstrating that the slack in RDP is not intrinsic to adaptive composition—though CLT-based approximations are known to be optimistic at realistic subsampling rates, a limitation that remains an open challenge.