{"id":"a2e0536b-b858-4c4a-a6d0-62bf1f2d5589","arxiv_id":"2501.18914","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Differentially private language models obey scaling laws in which compute-optimal models are roughly 10-50x smaller than non-private Chinchilla-optimal models, with large batch sizes and rapid saturation of compute.","lead":"The authors fit scaling laws that predict how much utility a differentially private language model gets from a given compute budget, privacy budget, and dataset size. The result is practical guidance: under DP, optimal models are far smaller and need much larger batch sizes than standard non-private training would suggest.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central quantitative claim rests on a physical-batch-size invariance that the authors' own Appendix C.3 shows is violated; predicted optimal B≈10^4–10^6 is far outside the B=1024 data and the unexplained effect is largest at the noise levels used for DP.","rationale":"The reader's conditional verdict is supported: the qualitative conclusions (DP shifts optimal models to much smaller sizes, compute benefits saturate, and batch size is the most important knob) are plausible and well-evidenced by a large, transparent experiment grid. The main quantitative claim, however, is precisely the one that requires extrapolating from B=1024 to the B=10^4–10^6 configurations that the scaling law recommends. For that claim to hold, L(M,T,σ̄) must be essentially independent of physical B at fixed σ̄. The authors themselves test this in Appendix C.3 and find a significant, unexplained dependence that is largest at high noise-batch ratios—the DP regime that motivates the paper. Because the effect is unexplained, no functional form is available to correct for it, and because the extrapolation target is orders of magnitude beyond the tested B range, interpolation-style confidence does not apply. The concrete test above is modest in cost relative to the original study and directly checks the constant-compute setting used in the workflow. If the test shows a deviation comparable to the 0.47 CE gap in Table 3, then the 'accurate' predictions are not currently supported, and the paper should be revised to either constrain its B range, add a batch-size correction term, or downgrade the quantitative claims to qualitative guidance. I therefore leave the reader's CONDITIONAL verdict unchanged rather than moving to reject: the methodology is a strong contribution, and the uncertainty is empirical, not logical.","tokens_in":42967,"tokens_out":7170,"duration_ms":68365,"concrete_test":"Run a constant-compute version of Appendix C.3: fix M=BertTiny, S=512, σ̄=0.515, and C≈1.8e18 FLOPs (the B=1024, T=128K budget). Train with B=8192 (T=16K) and B=32768 (T=4K), three seeds each, and compare the smoothed final loss to the paper's fitted L(M,T,σ̄) surface, which encodes the B=1024 assumption. If the measured losses at B=8192 or 32768 exceed the fitted-surface prediction by more than the seed noise (or by more than 0.1 CE), the physical-batch invariance fails in the constant-compute setting used to produce Figure 1 and Table 2. If the effect grows with B, the optimal batch-size recommendations shift and the headline quantitative claims need revision; if losses match, the extrapolation is supported at least at B=32768.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is the post-hoc batch-size extrapolation used to turn B=1024 measurements into predictions at B=10^4–10^6. The fitted surface L(M,T,σ̄) is built exclusively from runs with physical batch size 1024 (Section 3.2), and the workflow in Section 3.4 then queries this surface at large hypothetical B after computing σ̄ from the privacy accountant. This is valid only if loss at fixed σ̄ depends on B only through the accounting, i.e., if the B=1024 curves are representative of all B. Appendix C.3 tests this and rejects it: at σ̄=0.515, final training-set CE for BertTiny is 3.586 at B=128 versus 4.057 at B=8192 (Table 3); at larger noise, smaller physical batches achieve lower loss, and the authors write 'we do not have a good explanation for this behavior.' The predicted optimal batch sizes in Table 2 and Figure 1 are 10^4–10^6, two to three orders of magnitude beyond the tested range, so the unexplained effect is exactly the regime in which the headline predictions are made. The abstract's 'accurately' and the claim to predict optimal B for 'virtually any privacy and data budget' therefore go beyond what the data establish. A secondary but related gap is Appendix D: models calibrated to the same (ϵ,δ) differ substantially in measured MIA advantage when B is varied, so 'privacy' in the tradeoff is not held constant. The primary failure, however, is the unvalidated B invariance.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a methodology for scaling laws of differentially private LLM training. It fixes the physical batch size B=1024 and models loss as a function of model size M, iterations T, and the noise-batch ratio \\bar{\\sigma} via a semi-parametric interpolated surface (Section 3.3). It then uses privacy accounting to convert compute, privacy, and data budgets into \\bar{\\sigma}, queries the fitted surface (Section 3.4), and reports compute-optimal M, B, and T. The main claims are that non-private compute allocation is far from optimal under DP, that optimal model sizes are much smaller under DP, that compute benefits saturate under fixed privacy/data budgets, and that the proposed configurations save 5x-100x compute while retaining comparable utility.","tokens_in":43347,"tokens_out":7562,"duration_ms":66798,"significance":"If validated, the paper would be a significant contribution: it is one of the first systematic studies of scaling laws for DP-pretrained language models, the experiment grid is large (6 model sizes, 18 noise-batch ratios, 3 learning rates), and the decoupling of privacy accounting from experimentation in Section 4.5 is a useful and domain-agnostic contribution. The paper is also unusually candid about its limitations, including Appendix C.3 and Appendix D, which strengthens confidence in the authors' reporting. However, the headline quantitative predictions hinge on a batch-size invariance assumption that the paper's own ablations show to be violated in the relevant regime, so the central quantitative claims need either additional validation or re-scoping.","major_comments":[{"comment":"The central quantitative predictions extrapolate from a single physical batch size B=1024, but the paper's own ablation rejects the required invariance. The fitted surface L(M,T,\\bar{\\sigma}) is constructed entirely from B=1024 runs (Section 3.2), and Section 3.4 then queries it at hypothetical B up to 10^6 after converting (\\epsilon,N,B,T) into \\bar{\\sigma}. Appendix C.3 finds that at a fixed noise-batch ratio, smaller physical batch sizes achieve lower loss than larger ones, with Table 3 reporting final training-set cross-entropy 3.586 at B=128 versus 4.057 at B=8192 for BertTiny; the authors state \"we do not have a good explanation for this behavior.\" Since the predicted optimal batches in Table 2 and Figure 1 are 10^4-10^6, one to three orders of magnitude outside the data, the headline predictions sit exactly in the regime where the assumption is known to fail. This needs either validation runs at larger B, an explicit correction or uncertainty model, or a re-scoping of the predictive claims.","section":"Section 3.2/3.4 and Appendices C.3-C.4"},{"comment":"No out-of-sample validation of the predicted compute-optimal configurations is reported. The optimal M, B, and T values are obtained by minimizing the interpolated surface L(M,T,\\bar{\\sigma}) fitted to the same runs that produce the claim (Sections 3.3-3.4), so statements such as \"we can accurately predict the optimal breakdown ... for virtually any privacy budget and dataset size\" are in-sample statements unless held-out configurations are actually trained. Figure 5 should clarify whether the compute-optimal curves are measured runs or fitted predictions; if they are measured, the paper should state explicitly which configurations were trained and how they were chosen.","section":"Section 4.4 and Figure 5"},{"comment":"The tradeoff claims implicitly treat configurations with the same (\\epsilon,\\delta) as having the same privacy, but Appendix D shows this is not the case. Figure 15 demonstrates that for fixed (\\epsilon,\\delta)=(8,10^{-8}), compute, and model size, varying the batch size changes measured MIA advantage substantially. Because the headline recommendations vary B over orders of magnitude (Table 2), the reported cross-entropy comparisons are not comparisons at constant privacy. The paper's recommendation to report excess vulnerability should be applied to the headline predictions, or the claims should be rephrased in terms of nominal (\\epsilon,\\delta).","section":"Appendix D"}],"minor_comments":[{"comment":"The reported learning-rate grid {2^-7, 2^-8, 2^-9} is inconsistent with Appendix C.4 and Figure 12, which use values such as 0.56, 0.57, 0.58, and 0.59; please harmonize these values.","section":"Section 3.2 and Appendices C.4/C.7"},{"comment":"The stated input range \"\\bar{\\sigma} \\in [0.523, 0.56]\" is inconsistent with the grid {2^{-6}, ..., 2^{-23}} in Section 3.2, and the stated upper model size \"784M\" is inconsistent with Table 1's \"778M\" for BertMega.","section":"Section 3.3"},{"comment":"The noise-batch ratio values 0.520, 0.515, and 0.510 appear to lie outside the main experiment grid; please clarify whether these are intended values or typesetting errors.","section":"Appendices C.3-C.4"},{"comment":"Quantities like \"1022 FLOPs\" and \"1019 FLOPs\" should be typeset as 10^22 and 10^19 to avoid ambiguity.","section":"Several figures and tables"},{"comment":"The discussion of example-level versus user-level DP is important for interpreting the data budget N, but the paragraph is dense; a short concrete example would improve clarity.","section":"Appendix B.2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look. This is the first bounded-compute scaling-law study for DP-pretrained language models, and the qualitative results are likely to hold up: DP makes smaller models compute-optimal, optimal batch sizes shift by orders of magnitude, compute gains saturate, and even epsilon=1000 behaves nothing like non-private training. The experiment grid is large—BERT Tiny through Mega, 18 noise-batch ratios, B=1024—and the decoupling of noise calibration from training is a smart way to make the study tractable. The authors are also unusually honest. Appendix A and C.3/C.4 lay out the batch-size assumption and test it, and Appendix D flags the MIA-advantage issue. Credit where due: Section 4.5, the privacy-accounting analysis, is independent, domain-agnostic, and useful on its own. The citation pattern looks fine, with Sander et al. credited properly.\n\nNow the soft spot. The quantitative core—'accurately predict optimal model size, batch size, iterations for virtually any privacy and data budget'—rests on the assumption that loss at fixed noise-batch ratio is independent of physical batch size. The fitted surface L(M,T,sigma) uses only B=1024 runs, then is queried at B=1e4 to 1e6. Appendix C.3 shows that at sigma 0.510-0.515, the DP-relevant range, smaller physical batch sizes achieve lower loss, an effect the authors say they cannot explain. At B=128 vs 8192 the gap is substantial (3.59 vs 4.06 CE on BertTiny). The authors argue B=2048 and 8192 look similar, so 1024 is a reasonable indicator for larger batch sizes, and the effect is weaker for larger models. That helps, but it does not establish the 1e4-1e6 range. The stress-test lands, with the caveat that the unexplained effect is largest at small physical batch sizes, so the quantitative error at large B may be modest—but it is still outside the tested range. The central quantitative predictions should have been validated by training at least a few configurations at the recommended batch sizes. As it stands, 'accurate' is too strong; 'plausible, with the qualitative trends well supported' is about right.\n\nSecond, the compute-optimal configurations are derived by minimizing a surface fitted to the same runs that generate the claims, so those are in-sample interpolations rather than independent forecasts. This is normal in the scaling-law literature, but it means the 5-100x savings numbers should be read as estimates from a model, not measured wins. Appendix D's point about same (epsilon,delta) not meaning same vulnerability is worth taking seriously: the privacy axis is not held fixed when batch size changes.\n\nWho this is for: people actually doing DP pretraining, and anyone who needs to know whether the Chinchilla recipe transfers to private training. It deserves a serious referee, and with code release plus a few validation runs it could be a strong paper. I would want those runs before trusting the batch-size recommendations.","headline":"A substantial and unusually candid empirical study of DP LM scaling, but the headline quantitative predictions extrapolate batch size across two to three untested orders of magnitude and need validation before being taken as accurate.","tokens_in":43928,"tokens_out":2723,"would_cite":true,"duration_ms":26900,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T07","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"Differentially private LLM training has its own scaling laws, and they say compute-optimal models are far smaller than standard scaling laws suggest.","keywords":["differential privacy","scaling laws","large language models","DP-SGD","compute-optimal training","noise-batch ratio","privacy-utility tradeoff","masked language modeling"],"falsifier":"Train a model at a physical batch size of about 65536 with the same noise-batch ratio and iteration count as a batch-size-1024 run, then compare the achieved loss to the loss predicted by the fitted surface; a difference larger than the interpolation error would falsify the post-hoc accounting pipeline. A partial falsification already appears in the paper: Figures 7 and 8 show small physical batches beating large ones at equal noise-batch ratio, which is inconsistent with the independence assumption.","tokens_in":42767,"feed_emoji":"🔒","tokens_out":8440,"duration_ms":69672,"temperature":0.7,"pith_summary":"This paper argues that the scaling laws that guide ordinary language-model training do not transfer to differentially private (DP) training, and it supplies a replacement. By training BERT-sized models from 4.5M to 778M parameters with DP-Adam across a grid of noise levels and iteration counts, the authors fit a function that predicts validation cross-entropy from model size, iterations, and the noise-batch ratio, and then use privacy accounting to convert any compute, privacy, and data budget into recommended model size, batch size, and iteration count. The fitted laws say that DP-optimal models are roughly an order of magnitude smaller than non-private compute-optimal models, that the token-to-model ratio rises from the usual 20 to thousands or more, and that the compute allocation prescribed by non-private scaling laws is far from optimal even at very large privacy budgets. If correct, the laws let practitioners choose training configurations that save 5x to 100x compute at fixed privacy and utility.","feed_headline":"Private LLM training: far smaller models, up to 100x compute savings","feed_subtitle":"New scaling laws for DP-SGD map compute, privacy, and data budgets to optimal model size, batch size, and iterations.","key_machinery":"The load-bearing object is the noise-batch ratio $\\bar{\\sigma}$, the standard deviation of Gaussian noise added to the averaged minibatch gradient, which the paper treats as the primary determinant of DP training dynamics. Experiments fix the physical batch size at 1024 and vary $\\bar{\\sigma}$ over 18 values; a semi-parametric fit, using isotonic regression to enforce monotonicity and extrapolating each training curve with $L = E + A/T^{\\alpha}$, yields a log-space interpolated surface $L(M, T, \\bar{\\sigma})$. Post-hoc privacy accounting then converts any $(\\epsilon, N, C)$ budget into the $\\bar{\\sigma}$ a configuration would incur, so the same fitted surface answers which model size, batch size, and iteration count are optimal under a given budget.","core_discovery":"The central claim is that under DP-SGD the compute-optimal allocation among model size, batch size, and iterations is governed by scaling laws that are qualitatively different from the non-private ones, and that these private laws are accurately captured by a fitted function $L(M, T, \\bar{\\sigma})$. The paper states it directly: the compute allocation predicted by non-private scaling laws is far from optimal under DP even for huge privacy budgets, while the paper can accurately predict the optimal breakdown of compute into model size, batch size, and iterations for virtually any privacy and data budget. It also finds that the optimal model size is typically at least an order of magnitude smaller with DP, that increased compute can saturate so that little loss reduction remains unless the privacy budget or dataset size also grows, and that compute-efficient DP configurations save 5x to 100x compute compared to natural DP baselines.","pith_inferences":["If the batch-size independence assumption fails in the direction the paper's Appendix C.3 suggests (smaller physical batches beat larger ones at equal noise-batch ratio), then the predicted optimal batch sizes are optimistic: real large-batch runs would land at higher loss than the fitted surface predicts, so the advertised compute savings could shrink in the very large-batch regime.","The same post-hoc accounting plus a fitted loss surface could be carried over to fine-tuning or to alternative DP mechanisms, with the qualitative findings (smaller models, higher token-to-model ratios, compute saturation) likely persisting even if the exact constants do not.","The Section 4.5 accounting analysis is mechanism-agnostic and suggests a cheap decision rule: when compute and privacy budgets are both tight, increase them together rather than separately, because doubling either alone yields diminishing returns in noise reduction.","A direct testable extension: run a single large-batch DP training at the recommended compute-optimal configuration and check whether the achieved loss matches the fitted surface within the reported error, which would validate or refute the post-hoc accounting pipeline."],"forward_implications":["Compute-optimal DP configurations predicted by these laws save roughly 5x to 100x compute compared to typical DP baselines at matched privacy and utility.","The optimal model size under DP is typically 10x to 50x smaller than the non-private compute-optimal size, so billion-parameter DP pretraining requires very large data and privacy budgets or a different mechanism.","For fixed privacy and data budgets, increasing compute eventually yields little loss reduction; the critical compute budget grows with both the privacy budget and the data budget.","The token-to-model ratio in DP-optimal configurations ranges from about 1000 to 100000, compared with the usual 20 in non-private training, meaning DP prefers over-training small models.","The privacy-accounting analysis implies that doubling privacy or compute alone gives diminishing returns, while increasing them together gives consistent noise reduction."],"supporting_citations":[{"why":"Supplies the non-private compute-optimal scaling-law baseline that the paper extends and compares against, including the 20x token-to-model ratio and the parametric loss form $L = E + A/T^{\\alpha}$.","marker":"Hoffmann et al. 2022"},{"why":"Provides the power-law scaling framework and the 6*M*B*S*T FLOPs approximation used to define the compute budget.","marker":"Kaplan et al. 2020"},{"why":"Defines DP-SGD, the mechanism whose per-example clipping, noise addition, and privacy accounting the entire study builds on.","marker":"Abadi et al. 2016"},{"why":"Justifies treating the noise-batch ratio as the dominant source of gradient variance and the main proxy for DP training dynamics.","marker":"Ponomareva et al. 2023"},{"why":"Motivates large-batch DP training and supplies the normalized per-example clipping used in all experiments.","marker":"De et al. 2022"},{"why":"The closest prior scaling-law study of DP training; the paper notes it observed the same surprising small-batch advantage that threatens the batch-size independence assumption.","marker":"Sander et al. 2023"}],"fun_headline_variants":["DP scaling laws: smaller models, 100x compute savings","Under DP, optimal LLMs are 10x smaller, saving up to 100x compute","New DP scaling laws: 100x compute savings with smaller models","DP training: compute-optimal models are 10x smaller, save 100x compute","Scaling laws for DP LLMs: optimal configs cut compute by up to 100x"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"For a fixed noise-batch ratio, the loss curve does not depend on the physical batch size, so measurements at batch size 1024 can predict behavior at batch sizes up to $10^4$ or $10^6$; the paper's own ablations show this is not fully true in the moderate-to-high noise regime.","fun_headline_variants_meta":{"raw":{"variants":["DP scaling laws: smaller models, 100x compute savings","Under DP, optimal LLMs are 10x smaller, saving up to 100x compute","New DP scaling laws: 100x compute savings with smaller models","DP training: compute-optimal models are 10x smaller, save 100x compute","Scaling laws for DP LLMs: optimal configs cut compute by up to 100x"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001099,"raw_usage":{"total_tokens":4534,"prompt_tokens":840,"completion_tokens":3694,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":456,"completion_tokens_details":{"reasoning_tokens":3601}},"tokens_in":456,"tokens_out":3694,"duration_ms":26266,"temperature":1.0,"reasoning_tokens":3601,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T21:57:43.687037+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a model at a physical batch size of about 65536 with the same noise-batch ratio and iteration count as a batch-size-1024 run, then compare the achieved loss to the loss predicted by the fitted surface; a difference larger than the interpolation error would falsify the post-hoc accounting pipeline. A partial falsification already appears in the paper: Figures 7 and 8 show small physical batches beating large ones at equal noise-batch ratio, which is inconsistent with the independence assumption.","supporting_citations":[{"cited_title":"B., Vassilvitskii, S., Chien, S., and Thakurta, A","cited_arxiv_id":null,"evidence_quote":"Justifies treating the noise-batch ratio as the dominant source of gradient variance and the main proxy for DP training dynamics."},{"cited_title":"TAN without a burn: Scaling laws of DP-SGD","cited_arxiv_id":null,"evidence_quote":"The closest prior scaling-law study of DP training; the paper notes it observed the same surprising small-batch advantage that threatens the batch-size independence assumption."}],"review_version":1}