Introduction

The population welfare attainable by assigning the better treatment in each stratum is a natural benchmark for a randomized trial. Reporting this benchmark requires estimating the larger of two conditional outcome means in every stratum and then averaging over the population. Treatment ties make this scalar target nonsmooth: a small change in a treatment contrast can change which arm supplies the maximum. When each participant reports through a confidential local channel, precision depends jointly on the number of strata, the participant count, the privacy budget, and the permitted interaction during collection.

This paper characterizes that dependence for a specified categorical trial model. Strata have public uniform probabilities, treatment is assigned fairly conditional on the stratum and both potential outcomes, observed outcomes satisfy consistency, and binary potential-outcome means belong to $[1/4,3/4]$ in every arm and stratum. Participant records are independent and identically distributed. Pure local differential privacy protects the complete observed record, including the realized stratum, assignment, and outcome. Each participant sends one message. Collection may use independent public randomness, participant-specific kernels, and standard-Borel message spaces; sequential collection additionally permits a participant’s message rule to depend on earlier releases.

Under these conditions, and conditional on the classical Bernstein absolute-approximation limit, we establish matching finite-resource bounds for two reporting criteria: minimax squared-error risk and minimax worst-law expected length of connected closed intervals with coverage at least $0.90$ at every law in the causal class. The bounds are uniform over arbitrary admissible treatment contrasts, including exact ties. An explicit noninteractive procedure attains both precision orders simultaneously, while the lower bounds apply to every admissible one-message sequentially interactive protocol.

The welfare target admits a useful decomposition. Write $d\ge 2$ for the stratum count. Let $V(P)$, the first-best population welfare under a causal law $P$, be the average of the larger arm mean across strata. Let $B(P)$, the baseline observed-outcome mean under fair assignment, and ${\tau }_j(P)$, the treatment contrast in stratum $j$, denote its two components. Then Proposition 1 gives $$V(P)=B(P)+\frac{1}{2d}\sum _{j=1}^d|{\tau }_j(P)|.$$ The baseline is a bounded-mean target. The average absolute contrast captures the gain from choosing the better arm separately in each stratum and supplies the nonsmooth component governing the dimension-dependent precision bounds.

To state the characterization, write $n\ge 2$ for the participant count and $0<\epsilon \le 1$ for the pure local privacy budget. Define $t=n{\epsilon }^2$, the effective private resource, and $L=\log (ed)$, the logarithmic dimension factor. The common squared-error scale is $$\rho (t,d)=\{\begin{array}{ll}\frac{d^2}{tL},& t\ge d^{2}L,\\ \min \left\{1,{\left[\frac{\log (e+d^{2}L/t)}{L}\right]}^2\right\},& 0<t<d^{2}L.\end{array}$$ For both noninteractive and sequentially interactive collection, minimax squared error is comparable to $\rho (t,d)$, and globally honest expected interval length is comparable to $\sqrt{\rho (t,d)}$, with universal comparison constants Theorem 1. Thus sequential adaptation improves either minimax criterion by at most a universal multiplicative factor within the declared protocol classes.

The evaluated rate gives precise resource implications. Its saturated range ends at $$t=\frac{d^2\log (ed)}{ed-e}.$$ Along any admissible sequence of resource tuples, estimation error vanishes and honest intervals shrink exactly when effective private resource diverges and $$\frac{\log (1+d^2/t)}{\log (ed)}⟶0.$$ Along sequences with diverging effective private resource, inverse-resource squared-error order and inverse-square-root-resource honest-length order are equivalent to eventual boundedness of dimension. When dimension diverges and $t/d^2$ stays in a fixed positive finite interval, squared error instead has order $[\log \log (ed)/\log (ed){]}^2$, with the corresponding unsquared order for honest length. The two-stratum result supplies a direct calibration across the entire resource range Theorem 2.

The construction combines separate private estimates of the baseline and the absolute-contrast component. A sign-vector message law supplies scaled coordinate observations whose means equal the treatment contrasts. Products over distinct participants give unbiased estimates of contrast powers, and elementary-symmetric recursions compute those moments. Resource-dependent polynomial approximation estimates absolute value; in the dense branch, an independent pilot selects polynomial estimation near zero and a signed evaluation mean for larger contrasts Algorithm 1. The analysis accounts explicitly for dependence among coordinates released in the same messages Lemma 1. For the converse, moment-matched coordinate priors create separated welfare values, while higher-order transcript contraction controls their distinguishability after history-dependent privatization Lemmas 3 and 4. The common approximation input is the Bernstein limit reported by Cai et al. (2011).

These results complement statistical treatment choice and policy learning, which evaluate treatment rules through welfare and regret (Manski, 2004; Kitagawa et al., 2018; Athey et al., 2021). Here precision is evaluated for the scalar population optimum under the declared randomized-trial model. Optimal-value inference supplies closely related estimand comparisons: Luedtke et al. (2016) develop inference accommodating possibly nonunique optimal strategies under their conditions, and Whitehouse et al. (2026) establish asymptotic inference through controlled smoothing. Our characterization evaluates finite-resource minimax precision and global connected-interval honesty over the categorical causal class.

Methodologically, the paper implements the polynomial-approximation and moment-matching approach of Cai et al. (2011) through private participant messages. It also complements local-private functional estimation for positive power sums (Butucea et al., 2021) and quadratic density functionals (Butucea et al., 2023). The resulting interaction comparison concerns the average magnitude of signed treatment contrasts, with its kink at equality of the arm means.

A further consequence isolates the statistical component of the welfare problem. The signed record induces a paired law with equal total mass in each pair, and its total-variation distance from the public uniform reference equals one half of the average absolute contrast. On a symmetric causal family, the protocol correspondence preserves both collection classes and the joint seed-transcript law Proposition 1. Conditional on the same cited Bernstein absolute-approximation limit, we obtain matching estimation and honest-length bounds on the paired family Theorem 3; embedding that family in the full simplex yields the corresponding lower bounds for arbitrary laws on the same alphabet Theorem 4.

The paper proceeds from related work to the trial model, privacy requirements, and reporting criteria. It then presents the welfare construction and uniform precision bounds, followed by the total-variation consequences, welfare interpretation, and limitations and future work. The appendices develop approximation and private-moment bounds, sequential contraction and decision lower bounds, a guide to the main proofs and verification scope, and proofs of the main results.

Related work

Welfare and optimal-value inference.

The estimand is the population welfare attained by choosing the better treatment in each stratum. It corresponds to the unrestricted binary first-best benchmark in Cerulli (2026). Statistical treatment choice and policy learning evaluate data-dependent treatment rules through their welfare and regret (Manski, 2004; Kitagawa et al., 2018; Athey et al., 2021). Here the decision criterion concerns precision in estimating the scalar population optimum. For the randomized binary trial with public categorical strata studied here, the causal model combines uniform stratum probabilities, fair assignment, consistency, and interior arm means, with independent participant records Definition 2 and Assumption 5. The welfare decomposition in Proposition 1 connects this optimum to the baseline outcome mean and the average absolute treatment contrast. Exact equality of the arm means is therefore part of the parameter space over which precision is evaluated.

Optimal-value inference has developed several approaches to the resulting nonsmoothness. Luedtke et al. (2016) characterize pathwise differentiability and construct asymptotic inference for a possibly non-unique optimal treatment strategy, including inference at exceptional laws under their stated conditions. Softmax smoothing yields asymptotic inference under controlled behavior of treatment gaps near zero, suitable smoothing sequences, and nuisance-estimation conditions (Whitehouse et al., 2026). For optimal welfare gains integrated against a known target density, Chen et al. (2025) obtain asymptotic normality under smooth regression functions, overlap, a bounded target-to-training density ratio, a regular zero level set, and the specified uniform first-stage convergence rate. Feng et al. (2026) develop differentiability results for sorting operators and asymptotic inference for allocation values under their level-set regularity and estimation conditions. Adaptive smoothing and efficiency results in Xu et al. (2026) accommodate nonregularity under the stated overlap, moment, margin, nuisance-rate, bandwidth, and homoscedasticity conditions. These contributions establish condition-specific asymptotic guarantees, with several explicitly accommodating treatment ties. Our comparison concerns finite-resource precision uniformly over the declared categorical causal class, including exact ties, and connected confidence intervals with coverage at least $0.90$ at every law Definitions 6 and 7.

Nonsmooth estimation and private moments.

Polynomial approximation and moment matching provide the closest statistical precedents. Cai et al. (2011) combine a composite-testing lower-bound inequality with Gaussian absolute-mean estimation using polynomial approximation, unbiased Hermite-polynomial estimates, and a hybrid construction. For independent unit-variance Gaussian observations with a fixed coordinate bound, their minimax mean-squared error is asymptotic to ${\beta }_{\ast }^2{M}^2[\log \log d/\log d{]}^2$. The same squared log-log over log form appears here when effective private resource $t=n{\epsilon }^2$ is proportional to $d^2$, although private transcripts replace Gaussian coordinates and the present result is uniform over the full resource domain. In the discrete sampling model, Jiao et al. (2018) obtain worst-reference mean-squared error of order $S/(n\log n)$ for raw-sample $L_1$-distance estimation under their large-alphabet comparability conditions. That setting observes categorical draws directly; the present paired problem estimates a population distance from locally private original-record messages.

The present construction implements this approximation strategy through participant-level private messages. Products over distinct participants furnish unbiased estimates of contrast powers Definition 14. Their use in polynomial estimation requires bounds that account for dependence among coordinates released in the same messages Lemmas 1 and 2. On the lower-bound side, moment-matched priors are compared through the distribution of the entire private transcript. The sequential contraction result controls their distinguishability when each participant’s release can depend on preceding messages Lemma 3. Thus the approximation comparison is attached to two features of the observation model: attainable moments arise from distinct-person private products, and the converse applies after history-dependent privatization.

Confidentiality and sequential interaction.

Under pure local differential privacy, the target functional and the permitted interaction jointly determine statistical precision. For positive power sums with exponent $\gamma >1$, Butucea et al. (2021) give sequential mean-squared error bounded at order $t^{-((\gamma -1)\wedge 1)}$, with matching $t^{-1}$ converses for $\gamma \ge 2$. For integrated squared densities over their bounded Besov classes, Butucea et al. (2023) obtain noninteractive power $t^{-8s/(4s+3)}$ and sequential power $t^{-4s/(2s+1)}$, up to their stated logarithmic factors; their parametric upper regimes begin at $s>3/4$ and $s>1/2$, respectively. The functional here averages absolute signed contrasts, whose kink occurs at equality of the treatment means. Conditional on the cited, unformalized Bernstein absolute-approximation limit, the matching noninteractive construction and adaptive sequential converse establish the same minimax rates in both protocol classes for the specified causal and paired models Theorems 1 and 3. The extra work is to control dependence among private coordinate moments and to contract higher-order, moment-matched transcript mixtures uniformly over adaptive histories and resources.

Average treatment effects provide a complementary causal comparison. Ohnishi et al. (2025) give an order-$t^{-1}$ known-propensity estimator based on a bounded inverse-probability score, a matching private minimax comparison, and asymptotic intervals. Their average treatment effect is a signed mean contrast; optimal welfare incorporates the average magnitude of the stratum-specific contrasts. The confidentiality condition here protects the complete observed record, including stratum membership, assignment, and outcome Assumption 7.

The interval criterion also connects to honest-confidence theory. Low (1997) studies expected-length limits under uniform coverage, Cai et al. (2004) develops modulus-based expected-length theory for linear functionals, and Armstrong et al. (2020) constructs bias-aware nonparametric intervals. Here honesty is finite-sample and global over the declared nonlinear causal or paired model, performance is worst-law expected connected length, and the upper interval is obtained from the uniform squared-error construction. The lower bound is interval-specific: connectedness forces a single reported set to span separated target neighborhoods when private transcript mixtures are difficult to distinguish.

Public randomness also matters for private identity testing: Acharya et al. (2019) and Acharya et al. (2021) establish its benefits for distinguishing a reference distribution from separated alternatives. Our paired-model criterion estimates the numerical distance from the public uniform reference and assesses globally honest connected intervals for that distance Definition 16. A further comparison concerns empirical distribution sketches. Cormode et al. (2025) provide sketch accuracy guarantees and approximate item-level local privacy for empirical distribution shifts in the federated setting. The present population criteria use pure privacy for each complete participant record and allow public randomness within the admissible sequential protocols.

Conditional on the cited, unformalized Bernstein absolute-approximation limit, the contribution is the joint finite-resource characterization, up to universal constants, of minimax squared error and minimax worst-law expected length of globally honest connected intervals for the specified causal and paired signed models. Noninteractive procedures attain these bounds, while the converses cover every admissible one-message sequentially interactive protocol Theorems 1 and 3. Under the same premise, embedding the paired family in the full probability simplex also yields the corresponding full-simplex estimation and honest-length lower bounds Theorem 4.

Randomized trials, local privacy, and welfare

Throughout, $n\ge 2$ denotes the participant count and $d\ge 2$ the stratum count. Stratum indices range over $[d]=\{1,\dots ,d\}$, and participant indices range from $1$ to $n$. Generic positive numerical constants are denoted by $c$ and $C_0$; their values may differ across comparisons. For a finite vector, the ${\ell }_1$ norm is the sum of its absolute coordinates. The notation $\asymp$ denotes comparison within fixed positive multiplicative constants, with its sequence convention specified in Definition 8. We first describe the trial population and welfare target, then the private observation scheme and the statistical criteria.

Trial population and welfare

Each participant has a stratum, a treatment assignment, an observed outcome, and two potential outcomes. We first state the public uniform-stratum condition; the complete record space and observed-record marginal are collected explicitly below.

Thus the stratum $X$, assignment $A$, and observed outcome $Y$ form the observed record $O$ in the alphabet $\mathcal{O}$. The potential outcomes $Y^0$ and $Y^1$ enter the full-data law, while $Y_A^{\mathrm{pot}}$ denotes the outcome selected by assignment. The observed-record distribution is $P_O$, as defined in Definition 1.

For laws assigning positive probability to every stratum, define the arm-specific conditional mean ${\mu }_{aj}(P)$ and treatment contrast ${\tau }_j(P)$ by $${\mu }_{aj}(P)={\mathbb{E}}_P[Y^a\mid X=j],{\tau }_j(P)={\mu }_{1j}(P)-{\mu }_{0j}(P),\tau (P)=({\tau }_1(P),\dots ,{\tau }_d(P)).$$ Here the arm index $a\in \{0,1\}$ distinguishes control from treatment, and $j\in [d]$ indexes the stratum. A cellwise treatment rule selects an arm in each stratum. Under uniform strata, its first-best population welfare is obtained by choosing the arm with the larger conditional mean. We write the first-best value $V(P)$ and the observed-outcome baseline $B(P)$ as $$V(P)=\frac{1}{d}\sum _{j=1}^d\max \{{\mu }_{0j}(P),{\mu }_{1j}(P)\},B(P)={\mathbb{E}}_P[Y].$$ This target evaluates the welfare attainable by an optimal stratum-specific treatment choice.

The remaining single-participant restrictions specify randomized assignment, the relation between observed and potential outcomes, and the admissible conditional means.

Uniform categorical sampling fixes the stratum probabilities at a public reference distribution, specializing the multinomial sampling framework used for distributional functionals (Jiao et al., 2018). Equal population weights make each cell’s contribution to welfare explicit, while the realized participant stratum remains part of the private record.

Known randomized treatment assignment is maintained here in its fair-assignment form (Ohnishi et al., 2025). Conditioning on both potential outcomes ensures that assignment supplies experimental variation within each stratum and gives the two arms equal weight in the baseline mean.

Potential-outcome consistency connects the recorded response to the outcome under the assigned arm, giving the observed data their treatment-welfare interpretation (Luedtke et al., 2016). Together with fair assignment, it identifies each conditional arm mean from the corresponding observed treatment group.

Fixed interior Bernoulli means strengthen the bounded-outcome framework for optimal treatment value (Luedtke et al., 2016). The maintained interval keeps every arm mean away from the outcome boundaries, places treatment contrasts in $[-1/2,1/2]$, and places first-best welfare in $[1/4,3/4]$.

We now define the complete record space before collecting the four single-participant restrictions into the causal class.

The causal class ${\mathcal{V}}_d$ in Definition 2 leaves the dependence between the two potential outcomes unrestricted subject to these conditions. Under this class, fair assignment and consistency give $$B(P)=\frac{1}{2d}\sum _{j=1}^d({\mu }_{0j}(P)+{\mu }_{1j}(P)).$$ For a contrast vector, let the average absolute contrast $F(\theta )$ be defined by $$F(\theta )=\frac{1}{d}\sum _{j=1}^d|{\theta }_j|.$$ The identity $\max \{u,v\}=(u+v+|u-v|)/2$ then yields $$V(P)=B(P)+\frac{1}{2}F(\tau (P)).$$ The baseline records welfare under fair assignment; the absolute-contrast component records the gain from selecting the better arm separately in each stratum.

The following definition collects the four single-participant restrictions. Sampling is specified separately through the iid condition above, with observed sample $\mathbf{O}=(O_1,\dots ,O_n)$.

Independent identically distributed one-record participants provide the standard sampling structure for local-private minimax analysis (Duchi et al., 2018). Every participant contributes one draw from the same trial population, and the collection protocol acts on these separate records.

Private collection and statistical criteria

Fix the privacy budget $0<\epsilon \le 1$. Collection may use a shared public seed $R$ taking values in a standard-Borel seed space $\mathcal{R}$, with probability law $\lambda$. Participant $i$ sends one message in a standard-Borel message space ${\mathcal{Z}}_i$. The analyst also has a uniform randomizer $U$ for randomized statistical decisions. We first state the independence condition on public and analyst randomness.

The history space ${\mathcal{H}}_i$ in Definition 3 contains the messages preceding participant $i$. A history $\eta$ and a seed realization $r$ therefore index the participant’s conditional message distribution $Q_i(\cdot \mid o,\eta ,r)$, where $o$ denotes an observed-record input. Sequential collection generates $$Z_i\mid \mathbf{O},R,Z_1,\dots ,Z_{i-1}\sim Q_i(\cdot \mid O_i,(Z_1,\dots ,Z_{i-1}),R).$$ The private transcript is the message vector $\mathbf{Z}=(Z_1,\dots ,Z_n)$; the analyst observes this vector and the public seed. The next condition imposes privacy on every history-indexed message kernel.

Independent public coins and independent randomized decision rules allow coordination and randomized analysis within the observation scheme (Acharya et al., 2019). The product conditional law makes their joint distribution the same for every observed sample.

Privacy compares the message distributions induced by any two complete observed records, including their strata, assignments, and outcomes. Let $o^{\prime }$ denote the second record and $E$ a measurable message event. The following definition makes the history domain used in that inequality explicit.

Pure sequential local differential privacy controls the change in each participant’s message distribution when the complete input record changes (Duchi et al., 2018). Requiring the bound at every seed and history applies the same protection to every conditional collection rule, including histories that arise under other population laws.

The sequential class permits later collection rules to depend on earlier messages. Its noninteractive subclass imposes a further condition, with ${\eta }^{\prime }$ denoting a second history.

Noninteractive channels use rules fixed independently of the preceding messages, while permitting participant-specific rules and shared public coins (Acharya et al., 2019). Thus coordination through the independent seed remains available within this subclass.

We collect these requirements into two protocol classes, both of which give each participant one message.

The one-message sequential class ${\mathfrak{Q}}_{\mathrm{SI}}(n,d,\epsilon )$ in Definition 4 allows the conditional message distribution to respond to earlier releases. The next definition restricts this dependence.

The noninteractive class ${\mathfrak{Q}}_{\mathrm{NI}}(n,d,\epsilon )$ in Definition 5 is contained in the sequential class. Let the class index $\mathcal{C}\in \{\mathrm{NI},\mathrm{SI}\}$ select the admissible protocol class ${\mathfrak{Q}}_{\mathcal{C}}(n,d,\epsilon )$. A welfare estimate $T(\mathbf{Z},R,U)$ is a Borel real-valued function of the messages, public seed, and analyst randomizer. Expectations and probabilities below include participant sampling, message generation, and the independent randomizers. Our precision criterion optimizes over both the collection protocol and the estimate.

The minimax squared-error risk ${\mathfrak{R}}_{\mathcal{C}}(n,d,\epsilon )$ in Definition 6 measures the best worst-law precision available within the selected protocol class. Its population supremum permits arbitrary treatment-effect patterns satisfying the causal restrictions.

For inference, a welfare interval $I(\mathbf{Z},R,U)$ is connected and closed, with ordered Borel endpoints in the welfare range $[1/4,3/4]$. Its length is the upper endpoint minus the lower endpoint. Global honesty requires coverage of at least $0.90$ at every law in the causal class; the corresponding criterion minimizes worst-law expected length.

The honest-length criterion ${\mathfrak{H}}_{\mathcal{C}}(n,d,\epsilon )$ in Definition 7 couples interval precision to uniform coverage over the same population class used for squared-error risk. Connectedness makes the reported uncertainty a single welfare range, and the endpoint restriction respects the range implied by the interior means.

The signed experiment

The welfare decomposition separates a population mean from an absolute-value functional of treatment contrasts. To connect the latter to a finite-alphabet experiment, define the signed treatment-outcome statistic $S$ by $$S=(2A-1)(2Y-1).$$ The signed input consists of the stratum and this sign, taking values in the paired alphabet ${\mathcal{A}}_d=[d]\times \{-1,1\}$. For a contrast parameter $\theta \in [-1/2,1/2{]}^d$, define the paired law $P_{\theta }$ and the uniform reference law ${\mathsf{U}}_{2d}$ by $$P_{\theta }(j,s)=\frac{1+s{\theta }_j}{2d},{\mathsf{U}}_{2d}(j,s)=\frac{1}{2d}.$$ Here $s\in \{-1,1\}$ is the sign coordinate. Total variation on this finite alphabet is one half the sum of the absolute differences in probability masses, so $$\mathrm{TV}(P_{\theta },{\mathsf{U}}_{2d})=\frac{1}{2d}\sum _{j=1}^d|{\theta }_j|=\frac{1}{2}F(\theta ).$$ These definitions connect the absolute-contrast welfare component to distance from a public reference distribution.

A symmetric causal family embeds every allowed contrast vector into the trial model while keeping the baseline fixed. Its construction specifies the dependence of the potential outcomes as well as their means.

The symmetric law $G_{\theta }$ in Definition 9 pairs arm means equally around $1/2$. The following result states its membership in the causal class and establishes an exact correspondence between private signed observations and private trial records. The correspondence preserves both collection classes and the joint law of the public seed and messages.

Proposition 1 identifies the absolute-contrast component with total variation from the uniform reference for every law in the causal class. On the symmetric family, the baseline equals $1/2$, so variation in welfare is precisely variation in this distance. The assignment bit is fair conditional on the signed input, and the observed outcome is determined by that input and the assignment. Averaging over the assignment therefore reproduces the private transcript of any admissible trial-record protocol on this family. Conversely, a signed-input protocol can be applied to trial records by computing the sign locally. These transformations preserve full-record privacy and history dependence, allowing estimation procedures and decision lower bounds for the signed experiment to inform welfare analysis in both collection classes.

The absolute value also explains the statistical focus on small treatment contrasts. Selecting the better arm contributes $|{\tau }_j(P)|/2$ beyond the cell’s fair-assignment mean, and this contribution changes slope at a zero contrast. The signed experiment retains the entire contrast vector in its input probabilities, while the target aggregates coordinate magnitudes. Thus the welfare problem combines estimation of the linear baseline with estimation of this nonlinear aggregate.

Resource scales and paired procedures

To state the finite-resource comparisons uniformly across sample sizes, dimensions, and privacy budgets, we use the effective resource $t=n{\epsilon }^2$ and the logarithmic dimension factor $L=\log (ed)$. The following definition records the sequence conventions used later for the paired minimax values; the paired model and decision criteria are introduced immediately afterward.

The squared-error scale $r_{\mathcal{C}}(n,d,\epsilon )$ and length scale $h_{\mathcal{C}}(n,d,\epsilon )$ in Definition 8 use the same resource function for both collection classes. The defined resource conclusions distinguish a saturated range, an intermediate range, and a dense range, and express consistency and inverse-resource comparisons along arbitrary admissible sequences. They provide the notation for the statistical comparisons made in Theorems 1 and 3.

We also specify the attainment guarantees for the paired experiment. Its input family ${\mathcal{P}}_d^{\mathrm{pair}}$ consists of the paired signed laws, and its target $D_{\mathrm{TV}}(P_{\theta })$ is their total-variation distance from the uniform reference, as defined in Definition 15. The paired-input protocol class ${\mathfrak{K}}_{\mathcal{C}}(n,d,\epsilon )$ uses the same public randomness, message histories, and one-message privacy requirement on the paired alphabet; its full definition is in Definition 16. A paired protocol $\mathsf{K}$ generates the private message vector ${\mathbf{Z}}^{\mathsf{K}}$. The estimate $\hat{D}$ and interval $J_{\mathrm{TV}}$ target the numerical distance. The next definition packages the finite-message attainment properties that the subsequent results establish.

The attainment properties in Definition 12 require a finite sign-vector message from each participant and place both decisions on the paired target’s natural range. They combine squared-error control, global coverage, and expected connected-interval length under a common protocol. A more explicit specification selects its polynomial estimate from public resource parameters. In that construction, the privacy attenuation $\delta$ determines the scaled-message magnitude $b$, and the block size $m$ separates pilot information from evaluation information.

The construction in Definition 11 fixes collection independently of histories and uses resource-dependent branches for the statistical decision. Its scaled messages $W^{\mathrm{pil}}$ and $W^{\mathrm{ev}}$ support pilot averages and distinct-person moments ${\mathsf{U}}_{vj}$. In the dense, large-dimension branch, the pilot selects between a polynomial estimate near zero and a signed evaluation mean away from zero. The other branches use an absolute empirical mean, a constant, or a polynomial across the full contrast range, according to the displayed resource conditions. This deliberately conservative construction serves as an explicit uniform rate-attainment witness. The concrete guarantees are the three uniform decision bounds specified in the definition; their establishment is part of Theorem 3.

Finally, the paired minimax squared-error criterion ${\mathfrak{R}}_{\mathcal{C}}^{\mathrm{TV}}$ and honest-length criterion ${\mathfrak{H}}_{\mathcal{C}}^{\mathrm{TV}}$ are defined in Definition 16. The next definition records the sequence comparisons for these values that accompany the finite-resource bounds. It keeps the quantifiers explicit when dimension and privacy vary with sample size.

The comparisons collected in Definition 10 distinguish vanishing estimation error, shrinking honest intervals, and inverse-resource squared error. Their uniform resource-domain formulation also specifies the dimension-dependent scale when effective resource is proportional to $d^2$. Together with the exact signed-experiment correspondence in Proposition 1, these definitions provide the population, observation, and decision framework for the welfare and total-variation results.

Minimax precision and an attaining private procedure

The signed-experiment correspondence in Proposition 1 separates optimal welfare into the baseline outcome mean and one half of the average absolute treatment contrast: $$V(P)=B(P)+\frac{1}{2}F(\tau (P)).$$ This decomposition suggests collecting separate private messages for the two components. Estimating the baseline is a bounded-mean problem; estimating the absolute-contrast component requires accounting for the behavior of absolute value near treatment ties. The procedure below combines private mean estimation with polynomial approximation and selects its statistical decision using the public sample size, dimension, and privacy budget.

Private messages and the welfare procedure

We first specify the sign-vector message law and the distinct-person moments used to estimate polynomials of the treatment contrasts. Under the scaled-message convention, the privacy attenuation is $\delta =\tanh (\epsilon /2)$, the message magnitude is $b=d/\delta$, and a sign-vector coordinate is scaled as $W_{ij}=b{Z}_{ij}$. The following message law places the record-dependent information in the participant’s realized stratum while drawing the remaining coordinates as fair signs.

The message law $Q^{\mathrm{vec}}$ in Definition 13 protects the full observed record: its likelihood ratio across any two records is bounded by $(1+\delta )/(1-\delta )=e^{\epsilon }$. Uniform strata and fair assignment make the scaled coordinate mean equal to the corresponding treatment contrast. Products formed from distinct participants therefore supply unbiased estimates of powers of that contrast. The next definition collects these products into symmetric averages.

At moment degree $k$, the distinct-person construction in Definition 14 uses independence across participants to estimate ${\tau }_j(P{)}^k$. To compute all moments through a selected degree $D$, initialize $E_0=1$ and $E_v=0$ for $1\le v\le D$. For each observation $W_{ij}$, update in descending order $$E_v\leftarrow E_v+W_{ij}{E}_{v-1}(v=\min \{D,i\},\dots ,1),$$ and then set ${\mathsf{U}}_{vj}=E_v/\left(\genfrac{}{}{0ex}{}{m}{v}\right)$. This costs $O(mD)$ arithmetic operations per coordinate and avoids enumerating participant subsets. It is the classical symmetric-statistic structure of Hoeffding (1948), applied here to scaled private messages.

The complete procedure uses disjoint baseline, pilot, and evaluation blocks. Binary messages estimate the baseline; the pilot determines which treatment contrasts are close to zero; and evaluation messages supply both coordinate means and polynomial moments. All message laws are fixed before collection. Items 1–7 and 9 below specify collection and the reported estimate and interval. Item 8 records converse tuning packaged in the same verified declaration; it is an analytical choice and is not an operation performed by participants or the analyst.