A model trained to bound a record-level adversary clears your privacy bar but is much worse for your smallest cohorts — do you ship it?

## What the decision actually is The guarantee bounds what an adversary reading the released model can learn about whether any one record was in the training set. That protection is real and it is paid for in accuracy — accuracy taken disproportionately from the rare classes and small cohorts, because per-example capping and calibrated noise remove exactly the individual influence that a thinly supported pattern depends on. So the question on the table is not 'is the model good enough'. It is **who funds the guarantee, and did they agree to**. A lead is expected to name that, not to route around it. ## The options, and what each really costs **Ship as-is.** Legitimate when the affected cohorts are genuinely peripheral to the product's purpose and the degradation is disclosed. It stops being legitimate the moment the cohort carrying the loss is a stated reason the system exists — a clinical dictation system that has become materially worse on rare drug names and unusual surnames has degraded on the cases where an error is most consequential. **Weaken the privacy parameter.** This genuinely buys tail accuracy back, and it is the option people reach for first. The thing to say before choosing it: the records in the tail are the most distinctly fitted, hence the easiest for a membership attack to identify, so relaxing the bound reduces protection most for the same people it helps. You are moving a cost around inside one group, not removing it. Whether that trade is acceptable depends on what membership *means* for those records — for a clinical corpus, membership can be a diagnosis. **Fund more data behind the cohort.** The only move that improves utility and exposure together, because a pattern backed by more records both survives the noise and stops being individually identifiable. It is a collection or licensing programme with a lead time, and it is the answer that requires somebody to spend money, which is why it usually does not survive the meeting unless a principal insists. **Withhold the feature for those cohorts.** Unglamorous and frequently right. Serving a group a model you know is degraded, without telling them, is the option that looks like doing nothing and is actually the worst one. ## What to also decide, whichever option wins - **Change the release gate.** If the gate is an aggregate accuracy floor, this outcome will recur silently on every retrain. A per-slice floor, on slices fixed in advance with their supporting counts, is the durable fix. - **Fix the reporting standard.** Any privacy claim leaving your organisation carries per-slice utility beside the guarantee. That costs nothing and removes the failure mode permanently. - **Say who is not covered.** The bound is stated over one neighbouring record; a person who contributed many records is covered only much more weakly. Where the tail cohorts are also heavy contributors, both halves of the story land on the same people. ## What a weak answer looks like Accepting a two-point aggregate as the cost; treating the disparity as a fairness ticket to be handed off rather than a consequence of a decision you made; assuming the privacy parameter can be tuned until everyone is fine; or shipping and hoping nobody slices the evaluation set. The strong answer names the group paying, prices at least two alternatives, and commits to a gate that will catch it next time without anyone having to notice.