{"id":"49afa87f-afc4-4d7f-bdd2-b24daf2a8072","arxiv_id":"2502.02410","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Structured subsampling in time series forecasting yields tight, sound event- and user-level DP-SGD guarantees, with leakage probability given by the product of top- and bottom-level sampling rates.","lead":"This paper works out the privacy math for training forecasting models with differential privacy, taking into account how forecast batches are actually built from contiguous subsequences of time series. It shows these structured batching choices support tight privacy guarantees, so forecasting models can be trained with strong formal privacy at useful accuracy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Appendix F.3's proof of Theorem 4.4 applies Lemma D.2 to an unnormalized common mixture, so the exact per-step bound lacks a valid derivation as written.","rationale":"The reader's weakest assumption, the no-hidden-state convention, is real but explicitly scoped in Appendix E and standard in DP-SGD accounting; it limits the guarantee without contradicting the paper's stated framework. The more load-bearing issue I found is internal to the proof of Theorem 4.4, the paper's central exact per-step privacy profile. In Lemma F.6, the application of advanced joint convexity is dimensionally wrong: the identical mixture is not normalized, and the term Ba″_F carries an extra ρr, so the equality used to move from the coupled mixture to the final MoG profile does not hold. This matters because Theorem 4.4's upper bound must hold for all neighboring datasets, while the lower bound in Theorem F.7 only certifies tightness on one constructed pair. I credit the paper with a plausible and likely correct theorem, extensive derivations, a matching lower bound, and a substantial empirical study; the numerical results and the λ=1 experiments would not be affected if the proof is repaired. But as written, the central exactness claim is not rigorously supported, which justifies keeping the reader's CONDITIONAL verdict and requiring a corrected derivation before practitioners rely on the profile. My disagreement with the reader is therefore partial: the no-hidden-state limitation is worth flagging, but the proof gap in Lemma F.6 is more directly load-bearing for the main theorem.","tokens_in":61008,"tokens_out":48738,"duration_ms":491074,"concrete_test":"Re-derive Lemma F.6 from Lemma D.2 with the common component normalized by 1−ρr, i.e. verify whether Hα(P_F||Q_F) = ρr H_{α′}(Ba′_F || (1−β)[((1−ρ)Ba+ρ(1−r)Ba′)/(1−ρr)] + β Ba″_F). Then repeat the optimization over Ba, Ba′, Ba′_F, Ba″_F under the induced-distance constraints and check whether the supremum is still bounded by Hα(MoG([0,2],[1−ρr,ρr],σ) || N(0,σ)). If the normalized derivation yields the same bound, the appendix formula is a repairable typo; if it yields an extra factor or a different β, compute a counterexample to the claimed profile and Theorem 4.4 needs revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central exactness claim, Theorem 4.4, depends on Lemma F.6 (Appendix F.3). After isolating the identical components (1−ρ)Ba + ρ(1−r)Ba′, the proof invokes advanced joint convexity (Lemma D.2) and writes Hα(P_F||Q_F) = ρr H_{α′}(Ba′_F || (1−β)[(1−ρ)Ba + ρ(1−r)Ba′] + βρr Ba″_F). Lemma D.2 requires the common component to be a probability distribution. The common mixture (1−ρ)Ba + ρ(1−r)Ba′ has total mass 1−ρr; normalized, it is P1 = [(1−ρ)Ba + ρ(1−r)Ba′]/(1−ρr). With p = ρr, the correct identity is Hα(P_F||Q_F) = ρr H_{α′}(Ba′_F || (1−β)P1 + β Ba″_F), with no extra factor ρr on Ba″_F. The appendix formula instead feeds an unnormalized subdistribution of mass (1−β)(1−ρr) + βρr into the hockey-stick divergence, so the equality is not valid. This step is the bridge from the six-component mixture to the MoG([0,2],[1−ρr,ρr],σ) profile, so Theorem 4.4's tight upper bound is not established by the written proof. The lower bound in Theorem F.7 proves tightness only for the constructed worst-case pair; it cannot supply the missing universal upper bound. The theorem may be true and fixable, but the central claim currently rests on a defective derivation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies privacy amplification in DP-SGD when training global forecasting models on batches constructed by top-level sampling of time series and bottom-level sampling of contiguous subsequences, followed by a context-forecast split. It derives privacy profiles, i.e., hockey-stick divergence bounds, for event- and user-level neighboring relations, and claims tight dominating pairs for the special case of one subsequence per sequence (lambda = 1), sound upper bounds for lambda > 1, and additional amplification via Gaussian context/forecast augmentation. The theoretical development is accompanied by experiments on traffic, electricity, and solar benchmarks with four deep learning architectures, plus ablation studies of the sampling trade-offs.","tokens_in":61298,"tokens_out":14868,"duration_ms":145156,"significance":"If the theorem statements are correct, the paper makes a solid contribution: it is the first to account for the two-level structure of forecasting batches in DP-SGD rather than treating batches as unstructured samples, and it provides a template for coupling-based analyses of structured subsampling. The paper is unusually complete, with detailed appendix proofs, explicit coupling constructions, lower bounds designed to coincide with the claimed upper bounds at lambda = 1, and a substantial empirical evaluation with multiple seeds and baselines. The main risk is that the exactness claims currently rest on a few proof steps that need repair; the conceptual framework and the stated formulas are nevertheless credible, and the empirical evaluation is useful independently of the tightness issue.","major_comments":[{"comment":"The equality obtained by applying Lemma D.2 is invalid as written. The common mixture (1 - rho) B_a + rho (1 - r) B_{a'} has total mass 1 - rho r and is not a probability distribution, but Lemma D.2 requires a normalized shared component P1 = Q1. After normalizing that component to P1 and setting p = rho r, the correct identity is H_alpha(P_F || Q_F) = rho r * H_{alpha'}(B_{a'_F} || (1 - beta) P1 + beta B_{a''_F}); the factor rho r in front of B_{a''_F} in the appendix must be removed. Since this step is the bridge to the claimed MoG profile, the upper bound in Theorem 4.4 is not established by the written proof. The stated weights ((1 - rho) + rho (1 - r), rho r) suggest the intended result is recoverable, but the derivation must be reworked and the subsequent optimization repeated with the normalized mixture.","section":"Appendix F.3, Lemma F.6"},{"comment":"The lower-bound constructions use x1 = [1, 0, ..., 0] and assert that the first element appears in LC + LF subsequences. For a window length LC + LF and an element at the beginning of the series, the number of start positions that include it is only LC + 1 when LF > 1, not LC + LF; the asserted maximum LC + LF applies to interior positions. Consequently, the lower bounds as written do not match r = (LC + LF) / (L - LF + 1). The proofs need to place the sensitive value at an interior position, for example at index LF, so that exactly LC + LF subsequences contain it. Without this change, the claimed tightness of Theorems 4.2 and 4.4 is not demonstrated.","section":"Appendix E.1.4 and Appendix F.4"},{"comment":"The lower-bound and tightness arguments assume that, for fixed model parameters, the per-sample gradient can be an arbitrary norm-bounded function g. For a concrete neural architecture, gradients satisfy additional structural constraints, so the lower bounds prove tightness against a superset of mechanisms rather than against DP-SGD with a specified architecture. The paper should state this qualification explicitly or restrict the word 'tight' to the mechanism class captured by the coupling analysis.","section":"Appendix E.1.4 and Appendix F.4"},{"comment":"The abstract and Section 4 present the guarantees as covering deep forecasting generally, but Appendix E states that all proofs and statements of tightness assume learning without hidden states. Stateful sequence models that carry hidden state across batches are outside the proved statement. Since this assumption is load-bearing for composing step-level guarantees into epoch- and run-level guarantees, it should be stated as a formal scope condition in the main text, not only in the appendix, and the main claims should be worded accordingly.","section":"Appendix E, preamble, and Section 4.5"}],"minor_comments":[{"comment":"The displayed identity after applying advanced joint convexity has N(mu^{(1)}_1) as the first argument; per Lemma D.2 it should be N(mu^{(1)}_2) = N(0). The subsequent derivation uses the correct form, so this appears to be a typographical error, but it should be corrected.","section":"Appendix E.1.3, Lemma E.7"},{"comment":"The notation in Theorem 4.5 and Theorem G.1 uses means [0, 2]^T and p2 = rho * r * TVD(N(0, sigma_F), N(1, sigma_F)); it would help to state explicitly that the noise scales sigma_C and sigma_F are already normalized by the bound v, since the definition of (w, v)-neighboring in Definition 3.7 uses a general v.","section":"Section 4.3 and Appendix G"},{"comment":"The minimum-length discussion says the first element appears in LC + LF subsequences when L - LF + 1 >= LC + LF; as noted in the major comment, this is only true for interior elements. The formula for the maximum in Appendix I.1 should use the position-dependent count or state the interior-position assumption.","section":"Appendix I.1"}],"recommendation":"major_revision","confidential_remarks":"The proof defect in Appendix F.3 is likely local and repairable, and the first-element count in the lower-bound constructions is also fixable by moving the sensitive value to an interior position. If these corrections are made, the paper's central claim would be substantially supported. I would not reject on these grounds; the conceptual contribution and empirical evaluation are real. The editor may wish to ask the authors to clarify, in the main text, the mechanism class for which the 'tight' claim is intended."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper is worth your time, and the reader's report is fair, but I want to flag a concrete proof gap that the stress-test note found and that checks out on inspection. In Appendix F.3, Lemma F.6 is the bridge from the six-component mixture to the claimed MoG profile for Theorem 4.4. The proof invokes advanced joint convexity (Lemma D.2) after isolating the common component (1−ρ)Ba + ρ(1−r)Ba′. That mixture has total mass 1−ρr, not 1. Lemma D.2 requires the common component to be a probability distribution. The correct normalization introduces a factor 1/(1−ρr), and the second argument of the resulting hockey-stick divergence should be (1−β)P1 + βBa″_F, not the unnormalized expression in the appendix. As written, the equality does not hold. The lower bound in Theorem F.7 proves tightness only for a constructed pair, so it cannot supply the missing universal upper bound. Theorem 4.4 may be true—my guess is it is, and the fix is probably straightforward—but the derivation as printed is defective.\n\nThat said, the paper does real work. The reduction of contiguous-subsequence sampling to group substitution, the two-level privacy profile for bi-level sampling, and the context–forecast augmentation result are new and useful. For λ=1 the upper and lower bounds coincide at α=1 by construction, the proofs are unusually complete for a preprint, and the experimental section compares against meaningful baselines. The authors also flag the hidden-state limitation honestly, which is the standard DP-SGD accounting convention anyway.\n\nOther soft spots are minor: no code is shipped, and the abstract's claim that standard DP-SGD guarantees are \"incompatible\" with forecasting is overstated—they are simply pessimistic or miscalibrated for this batching. Some tables in the appendix have typo-level inconsistencies (e.g., duplicated standard deviations on solar). None of this undercuts the value.\n\nWho is this for? People working on DP for sequential data and anyone who wants tight event-level accounting for DP-SGD with structured batches. If the normalization bug is fixed, this becomes a very solid paper. My recommendation: engage with it seriously, but do not take Theorem 4.4's tight upper bound at face value until the appendix is corrected. A serious referee should ask for that fix before relying on the exact per-step profile.","headline":"The paper's central bi-level subsampling analysis is valuable, but Appendix F.3 contains a genuine normalization error that leaves Theorem 4.4's tight upper bound unproven as written.","tokens_in":61869,"tokens_out":3664,"would_cite":true,"duration_ms":34270,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P27","62M10"],"pacs":[],"model":"deepseek-v4-flash","headline":"The per-step privacy of DP-SGD under forecasting batching is characterized exactly by a two-component Gaussian-mixture profile.","keywords":["differential privacy","DP-SGD","time series forecasting","privacy amplification","subsampling","event-level privacy","user-level privacy","data augmentation"],"falsifier":"For a small dataset small enough to enumerate every batch (for instance three series of length five, context length two, forecast length two, one subsequence per series), compute the exact hockey-stick divergence between the output distributions of a worst-case neighboring pair and compare it with the Theorem 4.4 profile; any gap beyond floating-point error would refute the claimed exactness. Alternatively, track the sequence of states of a recurrent model trained under the paper's batching and test whether the composed profile still dominates the empirical divergence once hidden state is carried across batches.","tokens_in":60793,"feed_emoji":"🔒","tokens_out":9845,"duration_ms":103275,"temperature":0.7,"pith_summary":"Standard differential privacy for deep learning assumes that batches are sampled from a flat, unstructured dataset. Forecasting batches are built by first sampling time series, then contiguous subsequences, then splitting each subsequence into a context window and a ground-truth forecast. The paper shows that each of these structured choices changes the privacy analysis, and it derives exact per-step and per-epoch privacy profiles for DP-SGD adapted to forecasting. The bounds are strong enough to train four common forecasting architectures with event-level epsilon as low as 0.25-0.5 while still beating non-private classical baselines. If the derivation is correct, deep forecasting no longer needs black-box DP-SGD accounting that either over- or under-estimates privacy.","feed_headline":"Structured batching gives exact privacy accounting for DP forecasting","feed_subtitle":"Tight per-step privacy bounds let deep forecasters train at epsilon below one with sound guarantees.","key_machinery":"The load-bearing object is the privacy profile $H(\\alpha)=\\sup_{x\\simeq_E x'}H_\\alpha(\\mathcal{M}_x\\|\\mathcal{M}_{x'})$, the hockey-stick divergence between output distributions of one training step or epoch. The paper evaluates this profile by representing the batching randomness as a two-component mixture of Gaussians: the no-leakage component has weight $1-\\rho r$ and the leakage component has weight $\\rho r$, against a pure Gaussian baseline. Coupling-based subsampling analysis supplies the bounds: a joint coupling of the two batch-sampling distributions controls the divergence, advanced joint convexity collapses identical mixture components, and maximal couplings formalize the chance that Gaussian augmentation 'samples the same value' after a sensitive element changes. The resulting dominating pairs feed privacy-loss-distribution accounting to produce final $(\\varepsilon,\\delta)$ guarantees.","core_discovery":"The paper's central claim is that the privacy of one differentially private training step under forecasting batching can be characterized exactly, not merely bounded. For top-level sampling of series without replacement and bottom-level sampling of one contiguous subsequence per series, the per-step privacy profile is $H(\\alpha)=H_\\alpha(\\mathrm{MoG}([0,2],[1-\\rho r,\\rho r],\\sigma)\\,\\|\\,N(0,\\sigma))$ for $\\alpha\\ge 1$, where $\\rho$ is the probability that the modified series is in the batch, $r=(L_C+L_F)/(L-L_F+1)$ is the probability that a sampled subsequence contains the sensitive element, and the reversed profile is used for $0\\le\\alpha<1$. Deterministic iteration over series yields the analogous epoch-level profile with $\\rho=1$. Gaussian augmentation of the context or forecast window further multiplies the leakage weight $\\rho r$ by the total variation distance between the noise-smoothed old and new values. The paper concludes that these profiles are tight, sound, and directly usable for event- and user-level privacy accounting, with the privacy guarantee derived from the sampling probabilities rather than fitted to observed leakage.","pith_inferences":["In our reading, the total-variation factor in the augmentation bound is not specific to Gaussian noise; any additive noise family for which the smoothed old and new values can be coupled should yield the same multiplicative form in the leakage weight.","The no-hidden-state caveat points to the natural next step: composing the paper's per-step profiles with amplification-by-iteration style analysis would be needed to cover recurrent and state-space forecasters with carried hidden state.","The paper's setup maps directly onto sentence-level private language modeling, treating documents as series, sentences as sensitive events, and teacher-forced ground truth as forecast windows; the formulas here are already in the right form for that transfer."],"forward_implications":["With one subsequence per series, a sensitive element appears in at most one per-sequence gradient per step, so the multiple-leakage effect that makes black-box DP-SGD accounting optimistic is eliminated.","Top-level sampling without replacement gives stronger composed privacy than deterministic iteration over series, even though each training step must be composed separately.","Sampling one subsequence per series is the optimal choice: composing many short, more private steps beats composing fewer steps with more subsequences per series.","Gaussian context or forecast augmentation multiplies the leakage probability by a total-variation factor, giving an independent knob for trading utility against privacy.","The same profiles extend to $w$-event and $w$-user privacy by replacing $L_C+L_F$ with $L_C+L_F+w-1$ or $w(L_C+L_F)$, respectively."],"supporting_citations":[{"why":"Supplies the coupling-based subsampling analysis and advanced joint convexity that the proofs use at every level of sampling.","marker":"Balle et al. (2018)"},{"why":"Provides conditional couplings and dominating-pair results for group privacy that are extended to contiguous-subsequence subsampling.","marker":"Schuchardt et al. (2024)"},{"why":"Defines dominating pairs and privacy profiles used to state and compose the per-step guarantees.","marker":"Zhu et al. (2022)"},{"why":"Defines DP-SGD and moments accounting; the algorithm whose black-box guarantees are shown to be incompatible with forecasting batching.","marker":"Abadi et al. (2016)"},{"why":"Connect-the-dots quantization turns the exact privacy profiles into sound numerical $(\\varepsilon,\\delta)$ guarantees.","marker":"Doroshenko et al. (2022)"},{"why":"Defines the w-event-level neighboring relation used for the time-series privacy units.","marker":"Kellaris et al. (2014)"},{"why":"Privacy-loss-distribution convolution is used to compose per-step profiles across training steps.","marker":"Sommer et al. (2019)"}],"fun_headline_variants":["Exact per-step privacy bounds for structured DP forecasting batches","Structured subsampling gives exact DP-SGD privacy accounting","Tight per-step privacy profiles for deep DP forecasting","Exact privacy amplification for structured time-series batching","Exact DP-SGD accounting for forecasting with structured batches"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantees assume training without hidden states: each training step releases only the clipped, noised gradient, and the next step depends only on the updated parameters, so stateful models that carry hidden state across batches are explicitly not covered.","fun_headline_variants_meta":{"raw":{"variants":["Exact per-step privacy bounds for structured DP forecasting batches","Structured subsampling gives exact DP-SGD privacy accounting","Tight per-step privacy profiles for deep DP forecasting","Exact privacy amplification for structured time-series batching","Exact DP-SGD accounting for forecasting with structured batches"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000507,"raw_usage":{"total_tokens":2491,"prompt_tokens":984,"completion_tokens":1507,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":1428}},"tokens_in":600,"tokens_out":1507,"duration_ms":12830,"temperature":1.0,"reasoning_tokens":1428,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T12:14:37.186703+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a small dataset small enough to enumerate every batch (for instance three series of length five, context length two, forecast length two, one subsequence per series), compute the exact hockey-stick divergence between the output distributions of a worst-case neighboring pair and compare it with the Theorem 4.4 profile; any gap beyond floating-point error would refute the claimed exactness. Alternatively, track the sequence of states of a recurrent model trained under the paper's batching and test whether the composed profile still dominates the empirical divergence once hidden state is carried across batches.","supporting_citations":[],"review_version":1}