A tenant's counsel asks what your released model's epsilon-4 privacy guarantee promises their organisation — what do you tell them?

## Why this lands on a lead's desk A privacy parameter is a technical number until somebody with legal standing asks what it promises **them**. At that point it becomes an assurance claim, and assurance claims have to be defensible by the artefacts you can produce. The uncomfortable fact is that the answer was determined by an accounting choice made before the training run and cannot be improved after the fact. ## What you can and cannot honestly say Start by locating the unit. A record-level run supports precisely this: an adversary holding the released checkpoint gains a bounded amount from the presence or absence of **one row**. From there, three statements follow, and all three belong in the answer: 1. **At row granularity, the bound holds as stated.** This is the real content and it should not be undersold. 2. **At organisation granularity, there is no meaningful bound.** Extending a per-record statement to a contributor with tens of thousands of rows requires chaining it that many times; the privacy parameter scales with the count and the additive failure term degrades exponentially in it, so the resulting statement permits everything. 'No meaningful bound at that granularity' is the accurate phrase — and it must be distinguished from 'your data has leaked', which has not been established and would need an empirical attack result to claim. 3. **Cohort-level properties were never in scope.** A fact that stays true after removing any single record — how the estate is configured in aggregate — is not constrained by a per-record mechanism at all, by construction. ## The move that is genuinely indefensible Repeating the parameter as though it were an organisational promise. It is checkable: the definition is public, the unit is a matter of record, and the group argument is arithmetic anyone can run. A claim that fails that check in a later dispute is worse than having made no claim. ## The decision to own Having said what the current release supports, a lead has to choose what the next one does. The options each carry a bill somebody funds: - **Re-account at tenant level.** Cap each tenant's contribution and define the neighbouring pair over that whole contribution. The parameter then means what counsel assumed. It costs the discarded rows above the cap and a heavier accuracy price, and that price lands hardest on the tenants who contributed most — often the ones paying most. - **Partition.** Per-tenant models remove the shared-artefact exposure entirely and give up cross-tenant generalisation, which for a detection product may be the whole value proposition. - **Narrow the claim and disclose the unit.** Keep the training regime and fix the documentation: state the unit next to the parameter, state the exclusion for cohort-level properties, and stop letting a bare number travel into commercial material. - **Restrict the release.** The exposure exists because a checkpoint leaves the trust boundary. Not shipping it, or shipping only a queried endpoint, is a control that does not depend on the parameter at all. ## What has to change in the paperwork either way The unit belongs beside the number everywhere the number appears — model card, security questionnaire, contract annex. A parameter quoted without its unit cannot be compared with anyone else's and cannot support any promise about a person or an organisation. It is also worth saying explicitly what the guarantee is a property **of**: the released artefact produced by that run. A different release is a different statement. ## The tone to take with counsel Counsel does not need the mathematics; they need to know which sentences they may sign. Give them three: what is bounded, at what unit, and what is explicitly out of scope. Offer the remediation options with their costs attached so the choice is made by whoever owns the budget rather than being smuggled into a technical footnote. A lead who converts a mathematical guarantee into a sentence a lawyer can defend has done the job; a lead who lets a number travel unqualified into a contract has created a liability out of good engineering.