Information-Theoretic Limits and One-Bit Estimation of Sparse Relation Matrices Under Personalized Local Differential Privacy and Byzantine Contamination

1. Introduction

Many information systems record a sparse set of relations for each holder: ratings connect users to items, learning events connect students to concepts, check-ins connect users to locations, and telemetry connects devices to event types. If $\Omega =\left[d_1\right]\times \left[d_2\right]$, holder i contributes $E_i\subseteq \Omega$, while the server seeks the population relation probability matrix $M=\mathbb{E}{A}_i$. Direct collection exposes a person’s behavioral support. Local differential privacy (LDP) avoids a trusted curator by randomizing before transmission [1,2], but three features make this setting different from a standard frequency oracle: one holder owns a set, privacy budgets can differ by identity, and compromised clients can emit strategically chosen valid reports.

An entrywise construction is not satisfactory. Perturbing all $p=d_1{d}_2$ entries spends communication proportional to p; reporting only active indices exposes the private support; and splitting one user-level budget over the active relations loses utility with $|E_i|$. Set-valued LDP and sparse estimation have therefore moved toward joint encodings [3,4,5]. Separately, personalized mechanisms show that replacing $\left\{{\epsilon }_i\right\}$ by one average can obscure the actual information carried by heterogeneous channels [6,7,8]. Neither line answers what remains identifiable when an adversary can occupy the most informative identities.

Response contamination is especially subtle under LDP. A forged output can look statistically ordinary because honest reports are already randomized; consequently, generic outlier removal has no reliable geometric signal. Existing work establishes that privacy and contamination can interact nonadditively [9,10], and attacks on frequency and key–value protocols demonstrate that syntactically valid outputs suffice to create large bias [11,12,13]. The relevant question is thus not only how much honest information survives, but how much signed influence corrupted channels retain after inversion.

We address this question for a globally sparse relation probability matrix. JPRS computes one signed score over the entire capped relation set and releases one personalized randomized bit. The server forms a global budget-weighted matrix moment and performs an exact sparse capped-simplex projection. The proof uses the fact that a Byzantine identity can choose only one scalar sign multiplying its public pair-sign vector; it cannot choose an independent attack for each reconstructed coordinate. This output-domain coupling yields a global robust bound and makes grouped medoid selection unnecessary for the core theorem.

The scope is deliberately precise. The rectangular indices retain the semantics and output layout of a relation table, whereas the statistical class uses only global support sparsity. The rates therefore depend on $p=d_1{d}_2$, not $d_1+d_2$; no low-rank, row-sparse, graph-spectral, or smooth two-way structure is claimed. This is stronger than perturbing entries independently because the local channel is set-joint, but it is not a low-rank matrix completion result.

Our contributions are:

• a formal separation of edge, bounded-set, and user-level personalized LDP under authenticated response-level Byzantine contamination;
• a cardinality-calibrated one-bit relation-set mechanism with an exact linear matrix moment and variance-optimal weighting within the unbiased linear class;
• trimmed-information and linear-leverage functionals, unrestricted identifiability lower bounds, and a global JPRS upper bound that match in the strong-privacy regime up to support-search logarithms on explicit regular budget classes;
• a reproducible evaluation with 30 frozen synthetic populations, three public datasets, optimized native-alphabet attacks, same-decoder baselines, projection ablation, paired confidence intervals, and an explicit theorem-regime audit.

2. Related Work

Locally private estimation began with randomized response [1] and now has sharp minimax characterizations [14,15,16]; broader foundations and applications are reviewed in [17,18]. Communication-efficient frequency oracles include RAPPOR, optimized local hashing, and Hadamard response [19,20,21]; recent work compares frequency estimators and develops high-dimensional sketches [22,23,24]. Sparse recovery supplies related projection ideas [25], although its observation model is not local privacy. Wang et al. [26] establish the $dk/\left(n{\epsilon }^2\right)$ minimax scale for locally private numerical vectors, while Zhou et al. [27] give communication-efficient user- and event-level bounds for sparse vector aggregation. Neither studies personalized budgets or Byzantine response replacement. The closest multiple-sample result, Ma et al. [5], likewise does not combine those two complications. Sampling one relation and applying a native frequency oracle remains an important baseline here because it isolates the value of retaining the whole set.

Personalized DP assigns user-specific budgets, but existing PLDP work primarily studies scalar, frequency, graph, or clustering tasks [6,7,8]. Set-valued LDP mechanisms [3,4] address multiple items per holder, yet do not characterize sparse matrix risk under a worst-case budget-dependent corrupted set. Robust statistics supplies median-of-means and filtering principles [28,29]; Byzantine-robust private learning studies different trust and output models [9,10,30,31,32,33]. Poisoning attacks on LDP frequency and key–value protocols [11,12,13] motivate valid-output attacks, but do not supply the present pair-domain sparse-mean upper and lower bounds.

Figure 1 makes the missing intersection visible without treating any one ingredient as new in isolation. Table 1 then states the comparison at the level of assumptions, not only applications. “Sparse matrix” below means a globally sparse Cartesian table; low-rank geometry is outside our model.

3. Materials and Methods

3.1. Sparse Relational Observations

Let $\Omega =\left[d_1\right]\times \left[d_2\right]$, $p=d_1{d}_2$, and identify a relation set $E_i\subseteq \Omega$ with $A_i\in {\{0,1\}}^{d_1\times d_2}$. Each holder is capped at $\parallel A_i{\parallel }_0\le k$. Honest records are independent but need not be identically distributed:

$$A_i\sim P_i,{\mathbb{E}}_{P_i}{A}_i=M.$$

The common mean belongs to

$${\mathcal{M}}_{s,k}{=\{M\in [0,1]}^{d_1\times d_2}{:\parallel M\parallel }_0\le {s,\parallel M\parallel }_1\le k\},$$

and $P_i\in {\mathcal{P}}_k\left(M\right)$ denotes any capped record law with this mean. This distribution-free formulation includes fixed-cardinality, variable-size, long-tailed, block, hub, and latent-mixture populations. Frobenius loss is equivalently squared ${\ell }_2$ loss after a fixed bijection between $\Omega$ and $\left[p\right]$.

Remark 1

(Matrix scope). Only global support sparsity and the set cap enter the rates. The theorem depends on $d_1,d_2$ through $p=d_1{d}_2$; it does not exploit low rank, row/column sparsity, or a $d_1+d_2$ parameterization. The matrix notation preserves relation semantics and the reconstructed output layout, while the public sign operates on an encoded relation pair.

3.2. Three Privacy Units and Personalized Channels

Edge adjacency changes one relation; q-set adjacency changes at most q; user adjacency allows any two capped sets.

Definition 1

(Personalized user-level LDP). Conditional on every public seed, user i’s channel $Q_i$ satisfies

$$Q_i(B\mid A)\le e^{{\epsilon }_i}{Q}_i(B\mid A^{\prime })\mathrm{for}\mathrm{all}A,A^{\prime }\in {\mathcal{X}}_k$$

and measurable output events B. Edge and set privacy follow immediately; edge privacy alone composes by a factor at most $2k$ for user adjacency.

The protocol is noninteractive and each identity sends one report after its budget and authenticated identity are committed.

3.3. Response-Level Byzantine Contamination

An unknown set $\mathcal{B}$ of at most $m_{\alpha }=\lfloor \alpha n\rfloor$ identities is corrupted. It is fixed before the fresh public pair-sign seeds; corrupted report values may then depend on the public codebook and all honest reports. This permits coordinated adaptive valid-output attacks but excludes post-codebook identity compromise and Sybil creation. The minimax risk is

$$R^{★}=\underset{\Pi ,\widehat{M}}{inf}\underset{M\in {\mathcal{M}}_{s,k}}{sup}\underset{\{P_i\in {\mathcal{P}}_k\left(M\right)\}}{sup}\underset{{\mathcal{A}}_{\alpha }}{sup}\mathbb{E}{\parallel \widehat{M}-M\parallel }_F^2.$$

3.4. Information, Leverage, and Identifiability

Write ${\gamma }_i=tanh({\epsilon }_i/2)$, and let ${\gamma }_{\left(1\right)}\le \dots \le {\gamma }_{\left(n\right)}$. The worst-case honest squared information and corrupted linear leverage are

$$\begin{array}{cc}\hfill {\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}& ={\displaystyle \sum _{j=1}^{n-m_{\alpha }}}{\gamma }_{\left(j\right)}^2,\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill {\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}& =\underset{\left|\mathcal{B}\right|\le m_{\alpha }}{max}{\displaystyle \frac{{\sum }_{i\in \mathcal{B}}{\gamma }_i}{{\sum }_{i\notin \mathcal{B}}{\gamma }_i^2}}.\hfill \end{array}$$

(2)

They cannot be replaced by an arithmetic mean budget: an attacker may capture the largest budgets while estimation is supported by the remaining squared amplitudes. A third functional, ${\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}$, is the largest input separation whose personalized honest output laws have intersecting response- contamination neighborhoods; Supplementary Appendix C gives its finite overlap program.

Proposition 1

(Homogeneous specialization). If all ${\epsilon }_i=\epsilon$ and $\gamma =tanh(\epsilon /2)$, then

$${\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}=(n-m_{\alpha }){\gamma }^2,{\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}={\displaystyle \frac{m_{\alpha }}{(n-m_{\alpha })\gamma }}.$$

For $\epsilon \ll 1$, these scale as $n(1-\alpha ){\epsilon }^2$ and $\alpha /\left\{\right(1-\alpha \left)\epsilon \right\}$, respectively.

Complete adjacency relations, channel formalization, realizability, and the program defining ${\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}$ are given in Supplementary Appendices A–C.

4. Information-Theoretic Limits and Identifiability

Lemma 1

(Private contraction and contamination overlap). An ${\epsilon }_i$-LDP channel contracts total variation by at most ${\gamma }_i=tanh({\epsilon }_i/2)$. Moreover, two output laws $R_0,R_1$ have intersecting β-contamination neighborhoods iff

$$TV(R_0,R_1)\le {\displaystyle \frac{\beta }{1-\beta }}.$$

The first statement converts matrix separation into personalized testing information; the second converts a sufficiently small output separation into exact nonidentifiability.

Theorem 1

(Private sparse sampling lower bound). Suppose $p\ge 2s$, $0\le \alpha <1/2$, ${max}_i{\epsilon }_i\le 1$, and $1\le \overline{k}:=min(k,s)$. A universal $c>0$ satisfies

$$R^{★}\ge c\left[\overline{k}\wedge {\displaystyle \frac{\overline{k}s}{{\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}}}\right].$$

(3)

Proof 

(Proof roadmap). Start from the user-level Assouad lower bound for signed k-sparse vectors, then encode each signed coordinate as a pair of binary relation coordinates. The encoding preserves the record cap and transfers squared loss within a factor two. Personalized contraction replaces the homogeneous information by the sum of honest ${\gamma }_i^2$; allowing the attacker to remove the largest $m_{\alpha }$ amplitudes yields ${\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}$. The complete reduction is in Supplementary Appendix D. □

Theorem 2

(Contamination indistinguishability). There exists a personalized radius ${\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}\in [0,1/2]$ such that

$$R^{★}\ge {\displaystyle \frac{\overline{k}{\left({\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}\right)}^2}{16}}{\left(1-4e^{-m_{\alpha }/6}\right)}_{+}.$$

(4)

For homogeneous budgets,

$${\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}=min\left\{{\displaystyle \frac{1}{2}},{\displaystyle \frac{m_{\alpha }}{(2n-m_{\alpha })\gamma }}\right\}.$$

If $2m_{\alpha }\ge n$, then $R^{★}\ge \overline{k}/4$ for every privacy vector.

Proof roadmap

Construct two sparse means separated in k directions. Private contraction places their honest transcript laws within the overlap threshold of Lemma 1; the adversary then chooses contaminating laws that make the observed transcripts identical. The majority case follows by swapping two candidate honest sets. See Supplementary Appendix C. □

Corollary 1

(Necessary identifiability conditions). Up to constants and the finite-$m_{\alpha }$ factor,

$$R^{★}\gtrsim \left[\overline{k}\wedge \left\{{\displaystyle \frac{\overline{k}s}{{\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}}}\vee \overline{k}{\left({\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}\right)}^2\right\}\right].$$

For homogeneous strong privacy, consistent recovery requires

$$n(1-\alpha ){\epsilon }^2\gg \overline{k}s,\alpha =o\left(\epsilon \right).$$

(5)

The contamination lower bound is unrestricted in the privacy budgets. The sampling bound is unrestricted over channels and honest laws but is stated in the strong-privacy regime ${max}_i{\epsilon }_i\le 1$; no arbitrary-budget sampling claim is made.

5. Joint Personalized Relation Sketch

Encode each relation pair by a public bijection $\iota :\Omega \to \left[p\right]$. For identity i, a public finite-wise independent hash generates $R_i\left(e\right)\in \{-1,1\}$; signs are independent across identities and jointly independent on every set of at most $k+2s+1$ queried pairs. A counter-based hash evaluates a sign without storing a length-p vector.

For $m\ge 1$, let

$$a_m=m^{-1}\mathbb{E}\left|{\displaystyle \sum _{j=1}^m}{\xi }_j\right|,{\kappa }_k=\underset{m\le k}{min}\sqrt{k}{a}_m,c_k\left(m\right)={\displaystyle \frac{{\kappa }_k}{\sqrt{k}{a}_m}},$$

where $2^{-1/2}\le {\kappa }_k\le 1$. Given $A_i$, compute

$${\theta }_i\left(A_i\right)=c_k(\parallel A_i{\parallel }_0){sgn}_0\left(\sum _{e\in E_i}{R}_i\left(e\right)\right)$$

where ${sgn}_0$ uses an independent fair sign when its argument is zero (and the score is 0 for an empty set). Then send one bit

$$Pr(Y_i=y\mid A_i,U)={\displaystyle \frac{1+y{\gamma }_i{\theta }_i\left(A_i\right)}{2}}.$$

(6)

Algorithm 1: local JPRS randomizer.

1.

Evaluate $R_i\left(e\right)$ only for the at most k pairs in $E_i$.

2.

Form the cardinality-calibrated set score ${\theta }_i\left(A_i\right)$.

3.

Draw $Y_i\in \{-1,1\}$ from Eq. (6) and release only $Y_i$.

The private payload is one bit and local work is $O\left(k\right)$. The score is a single joint function of the complete set, not an entrywise composition.

Theorem 3

(Privacy and calibrated moment). The channel satisfies user-level ${\epsilon }_i$-LDP conditional on every public seed, and

$$\mathbb{E}\left[{\theta }_i\left(A_i\right)R_i\left(e\right)\right]={\displaystyle \frac{{\kappa }_k}{\sqrt{k}}}{M}_e.$$

(7)

Consequently, for any honest set J, $D_J={\sum }_{i\in J}{\gamma }_i^2$,

$${\tilde{M}}_J\left(e\right)={\displaystyle \frac{\sqrt{k}}{{\kappa }_k{D}_J}}\sum _{i\in J}{\gamma }_i{Y}_i{R}_i\left(e\right)$$

is unbiased and has coordinate variance at most $2k/D_J$.

Proof roadmap

The output likelihood ratio is bounded by $(1+{\gamma }_i)/(1-{\gamma }_i)=e^{{\epsilon }_i}$. Exchangeability of the active Rademacher signs and the definition of $c_k\left(m\right)$ give the exact first moment; weighted Cauchy–Schwarz gives the variance-optimal heterogeneous inversion. See Supplementary Appendix E. No row–column factor is required for the theorem; the pair-safe sign is used precisely to avoid unsupported claims of low-rank matrix geometry. □

6. Budget-Aware Byzantine-Robust Decoding

Malformed packets are first projected deterministically to $\{-1,1\}$. Put $D={\sum }_{i=1}^n{\gamma }_i^2$ and form the observable global sketch

$$V\left(e\right)={\displaystyle \frac{\sqrt{k}}{{\kappa }_{k}D}}{\displaystyle \sum _{i=1}^n}{\gamma }_i{\overline{Y}}_i{R}_i\left(e\right).$$

(8)

Let ${\mathcal{P}}_{s,k}$ denote exact Euclidean projection onto ${\mathcal{M}}_{s,k}$, implemented by retaining the top s clipped coordinates and projecting them onto $\{x\in {[0,1]}^s:\parallel x{\parallel }_1\le k\}$.

Figure 2. Core JPRS data flow. The attacker may adapt a legal bit to the fresh public codebook, but each identity still supplies only one scalar sign. Grouped medoid and pooling controls are optional branches and are not part of the main upper-bound algorithm.

Figure 2. Core JPRS data flow. The attacker may adapt a legal bit to the fresh public codebook, but each identity still supplies only one scalar sign. Grouped medoid and pooling controls are optional branches and are not part of the main upper-bound algorithm.

• Algorithm 2: global JPRS decoder.

  1.

  Sanitize every received packet to ${\overline{Y}}_i\in \{-1,1\}$.

  2.

  Accumulate the budget-weighted pair sketch in Eq. (8).

  3.

  Return $\widehat{M}={\mathcal{P}}_{s,k}\left(V\right)$.

• The global denominator is public and includes every committed identity; no attacker-dependent honest-set denominator is used.

For $q\le 2s$, define

$$T_q\left(\delta \right)=qlog(9ep/q)+log(8/\delta ),{\gamma }_{max}=\underset{i}{max}{\gamma }_i.$$

The upper-bound regularity condition is

$$k\le s,{\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}\ge C_0{\gamma }_{max}^2{T}_{2s}\left(\delta \right),$$

(9)

and the corrupted identity set is fixed before the fresh pair-sign codebook. Unlike the sampling lower bound, the decoder theorem does not require ${max}_i{\epsilon }_i\le 1$.

Theorem 4

(Global robust JPRS recovery). Suppose Eq. (9) holds and $\alpha <1/2$. Uniformly over the model and adaptive valid-output attacks, Algorithm 2 satisfies with probability at least $1-\delta$,

$$\parallel \widehat{M}{-M\parallel }_F^2\le Ck\left[{\displaystyle \frac{slog(9ep/s)+log(8/\delta )}{{\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}}}+{\left({\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}\right)}^2\right].$$

(10)

Proof roadmap

Replace forged reports by independent honest ghost bits. The resulting global sketch is unbiased and concentrates uniformly on every $2s$-coordinate comparison set. Conditional on the public codebook, a sparse random-matrix operator bound is uniform over all adaptive Byzantine sign choices; its linear term is ${\sum }_{i\in \mathcal{B}}{\gamma }_i$, while the mixed term is absorbed by Eq. (9). Exact feasible projection converts the sparse directional event to Frobenius loss. Supplementary Appendix E gives the full net argument and all event allocations. □

Corollary 2

(Expected risk). For $\delta =n^{-2}$,

$$\mathcal{R}\left({\Pi }_{\mathrm{JPRS}}\right)\le C\left[\overline{k}\wedge k\left\{{\displaystyle \frac{slog\left(9epn\right)}{{\mathsf{I}}_{\mathrm{eff}}^{\left(\alpha \right)}}}+{\left({\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}\right)}^2\right\}\right]+{\displaystyle \frac{2\overline{k}}{n^2}}.$$

(11)

The leverage–radius compatibility used for a matching statement is interpretable rather than tautological.

Proposition 2

(A sufficient regular-budget class). Fix $\alpha \le {\alpha }_0<1/2$. If $0<{\gamma }_{min}\le {\gamma }_i\le C_{\gamma }{\gamma }_{min}$ for all identities, then constants depending only on ${\alpha }_0,C_{\gamma }$ satisfy

$${\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}\asymp {\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}\asymp min\{1,\alpha /{\gamma }_{min}\}.$$

Consequently the minimax lower and JPRS upper bounds match up to $log\left(epn\right)$ on this class. Homogeneous budgets are the case $C_{\gamma }=1$.

In the homogeneous strong-privacy regime the upper rate becomes

$$k\left[{\displaystyle \frac{slog\left(epn\right)}{n(1-\alpha ){\epsilon }^2}}+{\left\{{\displaystyle \frac{\alpha }{(1-\alpha )\epsilon }}\right\}}^2\right]\wedge k,$$

so the sufficient boundary matches Corollary 1 up to support search.

6.1. Computation and Scope

The exact server evaluates one length-p vector in $O\left(np\right)$ signed operations and $O\left(p\right)$ memory; local work and private payload are $O\left(k\right)$ and one bit. We do not claim sublinear exact decoding. Grouped medoid and central-pooling reconstructions are retained only as optional empirical operating points and deterministic stability results in the supplement; they do not improve the proved minimax rate under the fixed-before-codebook threat model. Matching is restricted to regular budget classes, $k\le s$, strong privacy for the sampling lower bound, and pre-codebook identity corruption. Arbitrary heterogeneous-budget matching, post-codebook compromise, Sybil attacks, low-rank structure, and sublinear decoding remain open.

7. Experimental Results

7.1. Protocol, Frozen Datasets, and Comparators

All numerical claims are regenerated from one immutable CSV with an explicit failure column and a unique configuration–method key. Ten paired seeds are used for smaller controlled grids and five for high-information, theorem-aligned, frozen-synthetic, and real-data grids.

For exact rate diagnostics, choose $S\subseteq \Omega$ uniformly with $\left|S\right|=s$ and draw each record as a uniform k-subset, so

$$M\left(e\right)=k/s(e\in S),M\left(e\right)=0(e\notin S).$$

(12)

Defaults are $d_1=d_2=64,s=128,k=8,n=16,000$; the high-information sample-size sweep uses $n\in \{16,32,64,128,256\}$ thousand and nominal scale ${\epsilon }_0=2$. Because the public cap is ${\epsilon }_i\le 2$, ${\epsilon }_0$ is not mislabeled as a realized mean: H1 at ${\epsilon }_0=2$ has realized mean $1.75$ and range $[1.5,2]$. Every result row stores ${\epsilon }_0$, the realized mean, minimum, and maximum. A separate audit uses homogeneous H0 budgets $\epsilon \in \{0.25,0.5,0.75,1\}$, exactly inside the sampling theorem’s strong-privacy regime.

To test misspecification, 30 downloadable frozen populations cover six scenarios and five seeds. Every population has $n=16,000$, the same ambient domain and nominal sparsity, and an exact stored population target.

Table 2. Frozen synthetic benchmark; statistics show one representative seed.

Scenario	Generating feature	Mean |Ei|	Target nnz	Top-10 mass
Flat	Uniform weights; random support	8.00	128	0.662
Zipf	Zipf weights (exponent 1.2)	8.00	128	4.274
Community	Four diagonal bipartite blocks	8.00	128	0.657
Hub-tail	80/20 mass on hub/tail halves	8.00	128	1.029
User mixture	70/30 latent holder mixture	8.00	128	0.858
Variable |Ei|	Zipf weights; truncated-Poisson |Ei|	3.99	128	1.516

Table 2. Frozen synthetic benchmark; statistics show one representative seed.

Scenario	Generating feature	Mean |Ei|	Target nnz	Top-10 mass
Flat	Uniform weights; random support	8.00	128	0.662
Zipf	Zipf weights (exponent 1.2)	8.00	128	4.274
Community	Four diagonal bipartite blocks	8.00	128	0.657
Hub-tail	80/20 mass on hub/tail halves	8.00	128	1.029
User mixture	70/30 latent holder mixture	8.00	128	0.858
Variable |Ei|	Zipf weights; truncated-Poisson |Ei|	3.99	128	1.516

The real benchmarks are MovieLens 1M [34], Foursquare NYC–Tokyo [35], and Gowalla [36]. Duplicate holder relations are removed, a public top-frequency dictionary maps the tail to one other column, and public min-hash caps every holder at $k=8$. Both $d_2=512,s=128$ and a compact $d_2=128,s=32$ resolution are evaluated and content-hashed in the audited working copy.

Table 3. Executed real-data stress configurations. Approximation tail is $\parallel M_{\mathrm{pop}}-M_{\mathrm{pop}}^{\left(s\right)}{\parallel }_F^2$.

Dataset	Raw events	Holders	Used n	Domain	Approx. tail
MovieLens 1M	1,000,209	6,040	6,040	5 × 512	0.0189
Foursquare NYC-Tokyo	801,131	2,293	2,293	2 × 512	0.0102
Gowalla	6,442,890	107,092	32,000	7 × 512	0.0004

Table 3. Executed real-data stress configurations. Approximation tail is $\parallel M_{\mathrm{pop}}-M_{\mathrm{pop}}^{\left(s\right)}{\parallel }_F^2$.

Dataset	Raw events	Holders	Used n	Domain	Approx. tail
MovieLens 1M	1,000,209	6,040	6,040	5 × 512	0.0189
Foursquare NYC-Tokyo	801,131	2,293	2,293	2 × 512	0.0102
Gowalla	6,442,890	107,092	32,000	7 × 512	0.0004

The primary method is JPRS-Global. JPRS-Medoid and JPRS-Pooled are optional decoder controls. Padded relation sampling is paired with Hadamard response (P-RS-HR), optimized local hashing (P-RS-OLH), and generalized randomized response (P-RS-GRR). HR and OLH additionally receive the same grouped sparse-medoid decoder, so mechanism and aggregation effects are not confounded. For every corrupted OLH identity, the attacker exhaustively scores all legal hash buckets and chooses a maximizer of the same true-to- false-support objective used against the one-bit mechanisms.

Within each seed, methods share holders, budgets, corrupted identities, and attack objective. Metrics are squared Frobenius loss $E_s$, full-target loss, and Precision/Recall/F1 at s. Synthetic aggregate error bars treat the six scenarios as the sampling units after averaging their five paired seeds; a paired scenario-level table reports 95% confidence intervals and Holm-adjusted tests. Runtime and private payload are measured, whereas peak memory and local-device wall time are not. When global and medoid branches are computed from one mechanism call, the recorded time is the shared family wall-clock; it is not interpreted as a standalone decoder-speed comparison.

7.2. Controlled Scaling Outside the Strong-Privacy Theorem

The high-information sweep uses nominal ${\epsilon }_0=2$ and H1 budgets, hence ${max}_i{\epsilon }_i=2>1$. We retain it as a finite-sample stress diagnostic, not as direct validation of the strong-privacy lower bound. Clean and attacked curves use the same group count whenever a medoid decoder is compared. The global JPRS curve tests the sampling trend predicted by the new core upper bound; medoid curves quantify the variance cost of optional robust selection. Over $n=16,000$ to $256,000$, JPRS-Global decreases from $0.712$ to $0.016$ squared loss; a log–log fit over these five points has slope $-1.65$ ($R^2=0.97$). At $n=128,000$, increasing contamination from $\alpha =0$ to $0.10$ raises its loss from $0.077$ to $0.514$. The medoid’s paired increment is smaller ($0.265$ versus $0.437$), but its attacked absolute loss remains larger ($0.902$). Thus an increment alone must not be read as absolute robustness.

Table 4. Controlled high-information robustness at $n=\mathrm{128,000}$ and nominal ${\epsilon }_0=2$. The paired increment compares identical seeds.

Method	Clean Es	Attacked Es	Δadv	F1@s	Time (s)
JPRS-Global	0.077 ± 0.011	0.514 ± 0.008	0.437 ± 0.014	0.316 ± 0.014	6.107
JPRS-Medoid	0.637 ± 0.032	0.902 ± 0.029	0.265 ± 0.048	0.119 ± 0.023	6.107
P-RS-HR	0.529 ± 0.033	1.020 ± 0.012	0.491 ± 0.038	0.014 ± 0.013	15.386
P-RS-HR-Medoid	0.969 ± 0.021	1.096 ± 0.021	0.127 ± 0.002	0.036 ± 0.015	15.386

Table 4. Controlled high-information robustness at $n=\mathrm{128,000}$ and nominal ${\epsilon }_0=2$. The paired increment compares identical seeds.

Method	Clean Es	Attacked Es	Δadv	F1@s	Time (s)
JPRS-Global	0.077 ± 0.011	0.514 ± 0.008	0.437 ± 0.014	0.316 ± 0.014	6.107
JPRS-Medoid	0.637 ± 0.032	0.902 ± 0.029	0.265 ± 0.048	0.119 ± 0.023	6.107
P-RS-HR	0.529 ± 0.033	1.020 ± 0.012	0.491 ± 0.038	0.014 ± 0.013	15.386
P-RS-HR-Medoid	0.969 ± 0.021	1.096 ± 0.021	0.127 ± 0.002	0.036 ± 0.015	15.386

Figure 3. Controlled high-information diagnostics (five paired seeds). Panel (a) is clean sample-size scaling; panel (b) is paired excess loss under increasing response contamination. These configurations are intentionally reported as stress tests because their largest budgets exceed one.

Figure 3. Controlled high-information diagnostics (five paired seeds). Panel (a) is clean sample-size scaling; panel (b) is paired excess loss under increasing response contamination. These configurations are intentionally reported as stress tests because their largest budgets exceed one.

7.3. Theorem-Aligned Strong-Privacy Audit

Figure 4 removes the strongest theory–experiment mismatch in the earlier design: every audit run uses homogeneous H0 budgets with ${max}_i{\epsilon }_i\le 1$. Clean panels vary n at $\epsilon =0.75$ and $\epsilon \in [0.25,1]$ at $n=128,000$; a separate panel pairs each clean trial with its $\alpha =0.10$ attacked counterpart. Native global and same-payload medoid decoders are shown for JPRS, Hadamard response, and OLH. Thus a lower attack increment for a medoid can be attributed to aggregation, while a difference between JPRS-Global and the other global decoders reflects the local mechanism and inversion.

For clean JPRS-Global runs with $n\ge 32,000$, the fitted log–log slope is $-0.63$ ($R^2=0.94$). The negative slope is consistent with improving information, but its distance from idealized $n^{-1}$ squared-risk scaling shows that this finite range is not fully asymptotic. At $n=128,000,\epsilon =0.75$, JPRS-Global has the smallest clean and attacked absolute losses ($0.461$ and $0.995$). Its paired attack increment is $0.534$ (95% CI $[0.484,0.583]$); JPRS-Medoid reduces that increment to $0.137$ but starts at twice the clean loss ($0.923$). The HR and OLH medoid intervals include zero, yet both attacked absolute losses exceed that of JPRS-Global. These observations support an efficiency–increment trade-off, not a claim that one decoder dominates every robustness metric.

Table 5. Paired theorem-regime audit at $n=\mathrm{128,000}$, $\epsilon =0.75$, and $\alpha \in \{0,0.10\}$; means and standard deviations use five seeds.

Method	Clean Es	Attacked Es	Paired Δadv (95% CI)
JPRS-Global	0.461 ± 0.035	0.995 ± 0.008	0.534 [0.484, 0.583]
JPRS-Medoid	0.923 ± 0.035	1.059 ± 0.025	0.137 [0.088, 0.186]
P-RS-HR	0.847 ± 0.029	1.119 ± 0.020	0.272 [0.225, 0.319]
P-RS-HR-Medoid	1.402 ± 0.106	1.426 ± 0.076	0.023 [-0.131, 0.178]
P-RS-OLH	0.850 ± 0.028	1.154 ± 0.023	0.304 [0.257, 0.351]
P-RS-OLH-Medoid	1.276 ± 0.069	1.395 ± 0.096	0.120 [-0.013, 0.253]

Table 5. Paired theorem-regime audit at $n=\mathrm{128,000}$, $\epsilon =0.75$, and $\alpha \in \{0,0.10\}$; means and standard deviations use five seeds.

Method	Clean Es	Attacked Es	Paired Δadv (95% CI)
JPRS-Global	0.461 ± 0.035	0.995 ± 0.008	0.534 [0.484, 0.583]
JPRS-Medoid	0.923 ± 0.035	1.059 ± 0.025	0.137 [0.088, 0.186]
P-RS-HR	0.847 ± 0.029	1.119 ± 0.020	0.272 [0.225, 0.319]
P-RS-HR-Medoid	1.402 ± 0.106	1.426 ± 0.076	0.023 [-0.131, 0.178]
P-RS-OLH	0.850 ± 0.028	1.154 ± 0.023	0.304 [0.257, 0.351]
P-RS-OLH-Medoid	1.276 ± 0.069	1.395 ± 0.096	0.120 [-0.013, 0.253]

7.4. Distributional Synthetic Benchmark

Figure 5 reports the union of a privacy sweep at $\alpha =0.10$ and a contamination sweep at nominal ${\epsilon }_0=1$. Each error bar first averages the five paired seeds within a scenario and then treats the six scenario means as independent units. Table 6 reports the endpoint and Table 7 reports conservative scenario-level paired inference. The heat map prevents an aggregate average from hiding distribution-specific reversals. We therefore report operating points rather than a universal-winner claim: squared loss, support F1, and attack increment need not rank mechanisms identically.

At nominal ${\epsilon }_0=2,\alpha =0.10$, JPRS-Global has mean loss $0.819$, 23.3% below the best non-JPRS comparator, P-RS-OLH ($1.068$), and the highest mean F1 ($0.115$). It ranks first in loss in all six scenarios. Scenario-level paired differences favor JPRS-Global against each of the five displayed comparators; all Holm-adjusted p-values are $0.029$, although the inference has only six scenario units. At nominal ${\epsilon }_0=1$, its contamination increment $0.231$ is not the smallest: the HR-medoid control has increment $0.049$, again alongside substantially higher endpoint loss.

7.5. Public Relation Datasets

Figure 6 and Table 8 use the exact stored population mean after the declared dictionary, deduplication, and public min-hash preprocessing. They measure recovery of that processed relation table, not causal recommendation quality. The finest public domain is deliberately difficult: splitting the same number of observations over more candidate relations reduces both estimation and top-s support recovery. NonPrivate-TopS is an approximation/sampling reference and is not a privacy comparator.

At nominal ${\epsilon }_0=2$ and $\alpha =0.10$, JPRS-Global attains squared losses $0.788$, $1.093$, and $0.300$ on MovieLens, Foursquare, and Gowalla, respectively. Relative to the next-best private loss on each dataset, these are reductions of $7.9\%$, $14.9\%$, and $17.9\%$. Support recovery is more qualified: JPRS-Global has the highest private F1 on MovieLens and Foursquare (tied with JPRS-Pooled on MovieLens), whereas JPRS-Medoid is higher on Gowalla ($0.077$ versus $0.058$). Hence the empirical claim concerns matrix loss, not uniform support-ranking dominance.

7.6. Supplementary Diagnostics and Ablation Decision

We retain ablations only when they isolate a claimed component. Removing the final feasible projection tests the exact step used by the upper-bound proof; changing the group count concerns only the optional medoid decoder. Additional budget profiles, random/targeted/optimized attacks, public-domain resolution, structural stress, runtime/payload measurements, and all per-scenario values are placed in Supplementary Appendix G to keep the main article focused. The complete configuration and failure manifest remain in the reproducibility archive. Across the six frozen scenarios, deleting the projection inflates squared loss by $26.6\times$ to $48.1\times$. This large and consistent degradation justifies retaining the projection ablation; the group-count sweep is kept in the supplement because it diagnoses only an optional decoder.

8. Discussion

8.1. What the Theory Establishes

Two different budget summaries are unavoidable. Squared channel amplitudes govern honest testing information, whereas a valid forged bit enters linearly after channel inversion. Trimming the former and maximizing the latter over the same corruption budget explains why an arithmetic mean privacy budget is not sufficient. The indistinguishability radius adds a separate statement: even infinite computation cannot recover two targets whose personalized contamination neighborhoods intersect.

The global decoder sharpens the conclusion. Under fixed-before-codebook identity corruption, the random pair signs couple all coordinates affected by one forged bit. A uniform operator-norm event controls every adaptive legal sign simultaneously, so splitting users into groups is not needed for the rate. This aligns the estimator with its finite-sample behavior and removes an avoidable factor G from the sampling term. Medoid aggregation remains a legitimate operational choice when a practitioner values a smaller observed attack increment enough to accept higher clean variance, but it is not advertised as theoretically superior in the current threat model.

8.2. What the Matrix Formulation Does Not Establish

The method jointly privatizes relation sets and reconstructs a rectangular table, but the proof sees an encoded Cartesian alphabet of size $p=d_1{d}_2$. Consequently, the present paper should not be read as low-rank matrix completion, graphon estimation, or recovery with a $d_1+d_2$ sample complexity. Incorporating row/column sharing, low rank, or graph smoothness without destroying user-level LDP and valid-output robustness is a separate problem.

8.3. Threats to Validity and Open Problems

The lower sampling bound assumes ${max}_i{\epsilon }_i\le 1$; unrestricted large- budget matching is open. The strongest matching statement also requires a bounded-ratio budget class, while arbitrary heterogeneous vectors may leave a gap between ${\mathsf{L}}_{\mathrm{eff}}^{\left(\alpha \right)}$ and ${\varrho }_{\mathrm{ind}}^{\left(\alpha \right)}$. Identities are authenticated and fixed before the fresh public codebook; post-codebook compromise and Sybil creation would invalidate the signed-output argument. Exact decoding scans all p relations. Real-data targets depend on public preprocessing, and five seeds or six synthetic scenarios cannot establish universal empirical dominance. Finally, the experiments simulate the reporting layer; device energy, peak memory, network loss, and end-to-end deployment latency are not measured.

These limitations suggest four concrete directions: low-rank or row/column- structured pair sketches, sublinear candidate generation with a privacy-safe public dictionary, protocols robust to post-codebook compromise, and adaptive decoders that estimate unknown sparsity and contamination without requiring a known upper bound on $\alpha$.

9. Conclusions

We developed a one-bit, user-level personalized local mechanism for globally sparse relation probability matrices under Byzantine response replacement. The theory separates trimmed honest information, corrupted linear leverage, and exact contamination nonidentifiability. A global weighted sketch followed by feasible sparse projection attains the resulting rate up to unknown- support logarithms on regular budget classes. The revised experiments use theorem-aligned privacy budgets, optimized native-output attacks, same-decoder frequency-oracle controls, heterogeneous synthetic populations, three public datasets, and paired inference. Together, the results support a precise claim: joint set encoding can provide an efficient sparse relation estimator under a clearly delimited response threat model; they do not imply low-rank matrix recovery or universal empirical superiority.