Coarsening at random for differential privacy: analyst-side identifiability under privacy mechanisms

Differential privacy (DP) releases a statistic only after a curator perturbs it with calibrated noise. An analyst who then performs statistical inference from the release faces a recovery problem: the population functional is latent, the release is a noised view of it. This is an instance of the masked-data identifiability problem from reliability statistics. The DP mechanism is the coarsening, the true query value q(D) and the functional theta behind it are the latent cause, the released noised statistic indexes a kernel-weighted candidate set, and a non-private release is a singleton candidate set that restores identifiability. The coarsening-at-random conditions C1, C2, C3 partition DP mechanisms. Data-independent mechanisms (Laplace, Gaussian) satisfy the symmetry condition C2 and admit clean analyst-side inference; data-dependent mechanisms (sparse vector, propose-test-release) violate C2 and break analyst-identifiability of some functionals. We establish: (i) a glass-ceiling theorem on non-identifiability without mechanism knowledge; (ii) an anchor theorem identifying the kernel from a singleton release; (iii) a release-consistency theorem explaining why a mechanism-aware fit reproduces the observed release in expectation even when theta is biased; (iv) a compositional identifiability calculus for k-fold adaptive composition. A base-R simulation confirms release consistency to optimization tolerance, separates the kernel-irrelevance of the point estimate from the kernel-dependence of the Wald interval, and exhibits the C2 failure of a sparse-vector-style adaptive mechanism. Most DP theory is curator-side; this paper supplies the analyst-side identifiability theory, in a vocabulary shared with sibling applications (reliability, scRNA-seq, spatial transcriptomics, weak supervision, EHR phenotyping).