Pith. sign in

REVIEW 3 major objections 3 minor 45 references

Balls-and-Bins Sampling for DP-SGD

T0 review · 3 major / 3 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper introduces Balls-and-Bins sampling for DP-SGD—each example lands in one uniformly random batch—and proves it keeps shuffle-like utility while matching or beating Poisson subsampling's privacy in practical regimes.

desk verdict A tight dominating pair for Balls-and-Bins DP-SGD is the real new result, and it is cleanly proven; the 'best-of-both' story is credible in single-epoch, common-parameter regimes, but the paper itself leaves the small-delta and multi-epoch gaps open. read the letter →

arxiv 2412.16802 v2 pith:POMY6D5J submitted 2024-12-21 cs.LG cs.CRcs.DSstat.ML

Lynn Chua , Badih Ghazi , Charlie Harrison , Ethan Leeman , Pritish Kamath , Ravi Kumar , Pasin Manurangsi , Amer Sinha
show 1 more author
Chiyuan Zhang
This is my paper · ORCID
classification cs.LGcs.CRcs.DSstat.ML
keywords differentialprivacyDP-SGDamplificationshufflingPoissonsubsamplinghockeystickdivergencedominatingpairsMonteCarloaccounting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Most differentially private training pipelines shuffle the data but report privacy as if they used Poisson subsampling, and recent work has shown that this gap can make the reported privacy much stronger than the real guarantee. This paper proposes Balls-and-Bins sampling, where each training example is assigned to exactly one uniformly random batch, an implementation as simple as shuffling that makes each batch's marginal distribution identical to Poisson subsampling. The central result is a tight privacy characterization: the privacy loss of the adaptive-batch linear-query mechanism under this sampler is exactly captured by the pair $(P_B, Q_B)$, which yields $\delta_B(\varepsilon) \le \delta_S(\varepsilon) \le \delta_D(\varepsilon)$ for all $\varepsilon>0$ and $\delta_B(\varepsilon) < \delta_P(\varepsilon)$ for sufficiently large $\varepsilon$. If the practical ordering holds as the Monte Carlo evidence suggests, practitioners can keep shuffle-like training and utility while claiming Poisson-grade privacy, without changing their DP-SGD code beyond the batch generator.

What carries the argument

The load-bearing object is the tightly dominating pair $(P_B, Q_B)$: a pair of distributions whose $e^\varepsilon$-hockey-stick divergence equals, at every $\varepsilon$, the worst-case privacy loss of the adaptive-batch linear-query mechanism under Balls-and-Bins sampling. The proof that this pair dominates the mechanism averages over all possible batch assignments using joint convexity of the hockey-stick divergence, and shows the pair is attained by a specific adjacent pair of datasets, giving tightness. This reduces privacy accounting for Balls-and-Bins to computing two divergences between Gaussian mixtures, which the paper then estimates with Monte Carlo methods built on importance sampling and a new order-statistics sampler.

What would settle it

Compute $\delta_B(\varepsilon)$ with a provably tight accountant---for instance the characteristic-function or privacy-loss-distribution method already used for Poisson---at the Figure 2 configurations where the Monte Carlo bounds were inconclusive, such as $T=4517$, $\sigma=0.3$, $\varepsilon$ near $10$ with $\delta_P \approx 10^{-8}$; if the exact $\delta_B$ exceeds $\delta_P$ there, the best-of-both claim fails in a practical regime.

Watch

Extended reading notes

Core claim

The paper's central discovery is Theorem 3.1: for Balls-and-Bins sampling, the adaptive-batch linear-query mechanism $\mathrm{ABLQ}_B$ is tightly characterized by the pair $P_B = \frac{1}{T}\sum_{t=1}^T \mathcal{N}(e_t, \sigma^2 I_T)$ and $Q_B = \mathcal{N}(0, \sigma^2 I_T)$, so $\delta_B(\varepsilon) = \max\{D_{e^\varepsilon}(P_B \| Q_B), D_{e^\varepsilon}(Q_B \| P_B)\}$. This tight pair lets the paper prove that Balls-and-Bins is never less private than shuffling or deterministic batching, and that in the large-$\varepsilon$ regime it is strictly more private than Poisson subsampling, which prior work had shown can be worse than even deterministic batching. It also provides the basis for a practical Monte Carlo accountant that combines importance sampling with order-statistics sampling to estimate these divergences for up to a million steps, and experiments on two large ad-prediction datasets show that DP-SGD with Balls-and-Bins matches shuffled DP-SGD's utility at the same noise multiplier.

Load-bearing premise

The practical claim that Balls-and-Bins is at least as private as Poisson in realistic regimes rests on Monte Carlo upper bounds that the paper's own Figure 2 shows become inconclusive once the target $\delta$ falls below roughly $10^{-7}$, and the paper concedes that a tight provable accounting for $\mathrm{ABLQ}_B$ remains open.

Editorial extensions

If this is right

  • For every $\varepsilon>0$, $\delta_B(\varepsilon) \le \delta_S(\varepsilon) \le \delta_D(\varepsilon)$; Balls-and-Bins is never less private than shuffling or deterministic batching at the same noise scale and step count.
  • For sufficiently large $\varepsilon$, $\delta_B(\varepsilon) < \delta_P(\varepsilon)$; in the high-$\varepsilon$ regime Balls-and-Bins is strictly more private than Poisson subsampling, reversing the gap that prior work found for shuffling.
  • Because each batch has the same marginal distribution as a Poisson batch, the per-step gradient estimates look Poisson-like, yet the sampler is implemented with a one-line change to a shuffle-based DP-SGD loop.
  • The Monte Carlo accountant with importance sampling and order-statistics sampling estimates $\delta_B(\varepsilon)$ for up to $T=10^6$ steps in minutes on commodity hardware, making privacy accounting feasible at production scale.
  • On the two large Criteo datasets used in the experiments, DP-SGD with Balls-and-Bins matches shuffled DP-SGD in AUC at the same noise multiplier, while the sampled privacy bounds lie below those of Poisson in the regimes shown.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the paper shows $(P_B,Q_B)$ and $(P_P,Q_P)$ are incomparable rather than one dominating the other, a defensible practical rule is to prefer Balls-and-Bins when the target $\varepsilon$ is large and to re-check with Monte Carlo when $\delta_P$ is very small; the paper itself stops short of stating such a selection rule.
  • Editorial inference: the order-statistics sampling estimator is presented as 'of independent interest beyond DP'; a concrete adjacent use is approximating sums of log-normal random variables via the Ben Slimane-type bounds the method generalizes, which the paper does not explore.
  • Editorial inference: multi-epoch training, the common real-world configuration, is only sketched in Appendix B.4; a natural next test is running the multi-epoch estimator (Algorithm 11) on the same Criteo setups to see whether $\delta_B$ stays below $\delta_P$ after several epochs, something the paper leaves untested.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper introduces the Balls-and-Bins batch generator B, in which each example is assigned independently to a uniformly random batch. Its main theoretical result, Theorem 3.1, identifies a tightly dominating pair (P_B, Q_B) = ((1/T) Σ_t N(e_t, σ²I_T), N(0, σ²I_T)) for the adaptive-batch linear-query mechanism ABLQ_B, and the proof via conditioning on the placements of non-differing examples plus joint convexity of hockey-stick divergence appears sound. Building on this, Proposition 3.3 shows δ_B ≤ δ_S ≤ δ_D, and Theorem 3.4 shows δ_B < δ_P for all sufficiently large ε, while Remark 3.5 and Appendix D establish that the privacy guarantees of ABLQ_B and ABLQ_P are incomparable in general. The paper also develops Monte Carlo estimation for δ_B using importance sampling and a new order-statistics sampling technique, and reports single-epoch DP-SGD utility experiments on two Criteo datasets showing that B and S have comparable AUC, with privacy upper bounds for B below δ_P in most tested regimes. The authors explicitly acknowledge in Section 6 that a tight provable accounting for ABLQ_B is open and that multi-epoch training is only sketched in Appendix B.4.

Significance. The tightly dominating pair in Theorem 3.1 is a clean and checkable theoretical contribution: it gives an exact privacy characterization for a sampler whose per-example positions are independent and whose implementation is close to shuffling. The proof is elegant and, as far as I can check, correct. The order-statistics sampling technique is likely to be of independent interest for Monte Carlo privacy accounting of high-dimensional mechanisms, and the paper ships reproducible accounting code. The Monte Carlo upper bounds are valid as stated. However, the headline claim that Balls-and-Bins enjoys 'similar-or-better privacy amplification compared to Poisson subsampling in practical regimes' is not fully established: Theorem 3.4 is asymptotic, the Monte Carlo bounds are inconclusive at δ_P < 1e-7, and multi-epoch DP-SGD is not experimentally validated. The central theory is sound, but the applied 'best-of-both' claim needs additional support or more careful scoping.

major comments (3)
  1. [Section 5, Figure 2; Section 6] The abstract's claim of 'similar-or-better privacy amplification as compared to Poisson subsampling in practical regimes' is not established for δ_P < 1e-7. The Monte Carlo upper confidence bounds in Figure 2 are valid, but the text concedes that they are not tight enough to separate δ_B from δ_P exactly in this region, and the authors state only 'We believe δ_B(ε) < δ_P(ε) even in this regime.' Since Theorem 3.4 proves δ_B < δ_P only for all sufficiently large ε and gives no quantitative threshold ε0, the paper does not currently prove the headline claim in the low-δ regime. I would like either a non-asymptotic analytical bound covering the practical δ region (for example by incorporating the Feldman-Shenfeld decomposition cited in the Discussion) or a revised claim in the abstract that limits 'similar-or-better' to the regimes where the Monte Carlo bounds are conclusive.
  2. [Appendix B.4] Multi-epoch privacy accounting is only sketched. Algorithm 11 uses naive Monte Carlo, the text explicitly says 'Importance sampling is not directly applicable,' and no privacy or utility experiments are given for k > 1. Because multi-epoch training is standard in DP-SGD deployments, the paper's framing of Balls-and-Bins as a drop-in replacement for shuffling is not validated beyond a single epoch. If the contribution is intended to be single-epoch, this limitation should be stated prominently in the introduction or abstract; if multiple epochs are claimed, the appendix needs supporting experiments or at least a discussion of how the order-statistics technique degrades with k.
  3. [Remark 3.5 and Appendix D] The formal comparison between ABLQ_B and ABLQ_P is weaker than the text sometimes suggests. Theorem 3.4 proves only that δ_B(ε) < δ_P(ε) for all sufficiently large ε, while Remark 3.5 and Theorem D.1 show that the two pairs are incomparable and Appendix D explicitly leaves open whether δ_B(ε) > δ_P(ε) for any ε ≥ 0. The paper should state this precision whenever it claims 'no less private than Poisson' or 'similar-or-better privacy amplification,' rather than relying on the asymptotic theorem alone.
minor comments (3)
  1. [Section 4, Algorithm 6; Appendix B] The phrase 'cumulative density function' should be 'cumulative distribution function' (or CDF) for consistency with standard terminology.
  2. [Algorithm 3] In the pseudocode for the Balls-and-Bins sampler, the inner loop reuses the variable name t for both the outer batch index and the randomly chosen batch; this is confusing. Rename the chosen index (e.g., t_i) so the pseudocode is unambiguous.
  3. [Section 5 and Appendix C] The utility experiments are limited to two Criteo datasets, a single epoch, and three runs per setting, and the training code is not released (only the accounting code is). The paper would be clearer if the utility claim were explicitly scoped to these settings rather than stated as a general property of the sampler.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the Balls-and-Bins dominating pair is derived from first principles and the Poisson/shuffle comparisons rely on prior published theorems and validated Monte Carlo bounds, not on fitted inputs or self-referential construction.

full rationale

The central object, Theorem 3.1, is not assumed: the pair (PB, QB) is constructed explicitly and proved to tightly dominate ABLQ_B by conditioning on the placement of the non-differing examples and applying joint convexity, with the lower bound exhibited by an explicit adjacent pair. The privacy curves delta_B(epsilon) are then defined as hockey-stick divergences of this pair and estimated by Monte Carlo with Chernoff-Hoeffding upper bounds and a separate lower bound; these estimates are not fitted to the quantities they are used to compare. The comparison to Poisson uses the independently published, parameter-free dominating pair of Koskela et al. and Zhu et al. (Propositions 2.4-2.5), and the asymptotic comparison uses Chua et al. (2024a, Theorem 4.2) for delta_D < delta_P at large epsilon; while that citation is self-referential in authorship, it is a prior theorem with stated assumptions that do not include the target result, so it is independent support rather than a circular premise. The paper's own Discussion explicitly flags the open problem of tight provable accounting and the inconclusive low-delta regime, which are epistemic limitations, not reductions of the derivation to its inputs. No equation used as a prediction is equivalent by construction to a fitted quantity or to a self-citation chain.

Assumptions & free parameters 1 free parameters · 6 assumptions · 0 invented entities

The theoretical derivation introduces no fitted parameters. The hand-picked order-statistics index sets affect only the tightness of Monte Carlo bounds. The paper relies on standard DP definitions, the ABLQ abstraction, prior dominating-pair results, and one prior result from the same group (Chua et al. 2024a), which is a published, independent result.

free parameters (1)
  • Order-statistics index sets for Monte Carlo accounting = e.g., (1,2,...,500,510,...,19900) with 739 orders for T=36133; 590 orders for T=4517
    Hand-chosen in Appendix C to balance runtime and tightness of the upper bound on the privacy loss; they do not affect validity of the bound, only its looseness.
assumptions (6)
  • domain assumption Zeroing-out adjacency defines adjacent datasets (Definition 2.1).
    The privacy guarantees and dominating pairs are stated for this variant of DP, standard in the DP-SGD literature and in Kairouz et al. (2021), Chua et al. (2024a).
  • domain assumption ABLQ mechanism (Algorithm 2) is a valid upper-bound model for DP-SGD privacy.
    DP-SGDG is post-processing of ABLQG; the paper invokes Annamalai (2024) to argue the release of intermediate queries does not weaken the privacy analysis for Poisson, but no analogous tightness is proven for Balls-and-Bins.
  • standard math Joint convexity of hockey stick divergence (Proposition 3.2).
    Used in the proof of Theorem 3.1 to average over assignments of the other examples; cited from Chua et al. (2024a, Lemma B.1).
  • standard math Known tightly dominating pairs for ABLQ_D and ABLQ_P (Propositions 2.4, 2.5).
    Borrowed from Balle and Wang (2018) and Koskela et al. (2020)/Zhu et al. (2022); used as the external baseline for Poisson and deterministic privacy.
  • domain assumption Chua et al. (2024a, Theorem 4.2): delta_D(eps) < delta_P(eps) for all sufficiently large eps.
    Prior result from the same research group is used to prove Theorem 3.4; the paper does not re-derive it. This is a self-citation, but it is a published ICML 2024 result, not circular.
  • domain assumption Clipping norm normalized to 1 and query outputs in the unit ball.
    The dominating-pair derivation assumes psi_t(x) takes values in the unit ball; for DP-SGD this holds after dividing by the clipping norm C.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Balls-and-Bins Sampling for DP-SGD." pith.science (2026). https://pith.science/paper/POMY6D5J

@misc{pith2026241216802,
  author       = {Pith},
  title        = {Pith review of: Balls-and-Bins Sampling for DP-SGD},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/POMY6D5J}},
  note         = {Machine review of arXiv:2412.16802}
}
read the original abstract

We introduce the Balls-and-Bins sampling for differentially private (DP) optimization methods such as DP-SGD. While it has been common practice to use some form of shuffling in DP-SGD implementations, privacy accounting algorithms have typically assumed that Poisson subsampling is used instead. Recent work by Chua et al. (ICML 2024), however, pointed out that shuffling based DP-SGD can have a much larger privacy cost in practical regimes of parameters. In this work we show that the Balls-and-Bins sampling achieves the "best-of-both" samplers, namely, the implementation of Balls-and-Bins sampling is similar to that of Shuffling and models trained using DP-SGD with Balls-and-Bins sampling achieve utility comparable to those trained using DP-SGD with Shuffling at the same noise multiplier, and yet, Balls-and-Bins sampling enjoys similar-or-better privacy amplification as compared to Poisson subsampling in practical regimes.

Figures

Figures reproduced from arXiv: 2412.16802 by the authors.

Figure 1
Figure 1. AUC values for 1 epoch of training with the Criteo Display Ads pCTR dataset (top) and the Criteo [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. Bounds on δP , δS , and δB are plotted for various values of ε for different (expected) batch size and σ. These mean and upper confidence bounds for δB were obtained using order statistics sampling (specific orders and sample complexity specified in Appendix C) [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Upper confidence bounds on δB(ε) against various values of ε for two settings of T and σ, with and without importance sampling. Additionally, lower bounds on δB(ε) are included. Estimating Deε (PB ∥ QB). Recall that in this case, we wish to estimate Ex∼P1|Eε max{0, 1−e ε−LPB ∥ QB (x) } where P1 = N (e1, σ2 I) and Eε := {x : max{x1 −1, maxt>1 xt} ≥ Cε} for Cε = 1 2 +σ 2 ·  ε − log  1 + e 1/σ2 −1 T . The choice of… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Upper confidence bounds on δB(ε) against various values of ε for two settings of T and σ, with and without order statistics sampling for roughly the same running time complexity. Since order statistics sampling offers a significant speed up, it affords a larger sample …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 34 canonical work pages

  1. [1]

    Goodfellow, H

    Mart \' n Abadi, Andy Chu, Ian J. Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In CCS, pages 308--318, 2016

    work page 2016

  2. [2]

    Large-scale differentially private BERT

    Rohan Anil, Badih Ghazi, Vineet Gupta, Ravi Kumar, and Pasin Manurangsi. Large-scale differentially private BERT . In EMNLP (Findings), 2022

    work page 2022

  3. [3]

    It's our loss: No privacy amplification for hidden state DP-SGD with non-convex loss

    Meenatchi Sundaram Muthu Selva Annamalai. It's our loss: No privacy amplification for hidden state DP-SGD with non-convex loss. In AISec, pages 24--30, 2024

    work page 2024

  4. [4]

    To shuffle or not to shuffle: Auditing DP-SGD with shuffling

    Meenatchi Sundaram Muthu Selva Annamalai, Borja Balle, Emiliano De Cristofaro, and Jamie Hayes. To shuffle or not to shuffle: Auditing DP-SGD with shuffling. CoRR, abs/2411.10614, 2024

    arXiv 2024

  5. [5]

    Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising

    Borja Balle and Yu - Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In ICML, 2018

    work page 2018

  6. [6]

    Privacy amplification via random check-ins

    Borja Balle, Peter Kairouz, Brendan McMahan, Om Thakkar, and Abhradeep Guha Thakurta. Privacy amplification via random check-ins. In NeurIPS, pages 4623--4634, 2020

    work page 2020

  7. [7]

    JAX - P rivacy: Algorithms for privacy-preserving machine learning in JAX , 2022

    Borja Balle, Leonard Berrada, Soham De, Sahra Ghalebikesabi, Jamie Hayes, Aneesh Pappu, Samuel L Smith, and Robert Stanforth. JAX - P rivacy: Algorithms for privacy-preserving machine learning in JAX , 2022. URL http://github.com/google-deepmind/jax_privacy

    work page 2022

  8. [8]

    Towards efficient and scalable training of differentially private deep learning

    Sebastian Rodriguez Beltran, Marlon Tobaben, Joonas J\"alk\"o, Niki Loppi, and Antti Honkela. Towards efficient and scalable training of differentially private deep learning. In NeurIPS, 2024

    work page 2024

Show all 45 references
  1. [9]

    Ben Slimane

    S. Ben Slimane. Bounds on the distribution of a sum of independent lognormal random variables. IEEE Trans. Comm., 49 0 (6): 0 975--978, 2001

    2001

  2. [10]

    JAX : composable transformations of P ython+ N um P y programs, 2018

    James Bradbury, Roy Frostig, Peter Hawkins, Matthew James Johnson, Chris Leary, Dougal Maclaurin, George Necula, Adam Paszke, Jake Vander P las, Skye Wanderman- M ilne, and Qiao Zhang. JAX : composable transformations of P ython+ N um P y programs, 2018. URL http://github.com/...

    2018

  3. [11]

    Choquette - Choo, Arun Ganesh, Saminul Haque, Thomas Steinke, and Abhradeep Thakurta

    Christopher A. Choquette - Choo, Arun Ganesh, Saminul Haque, Thomas Steinke, and Abhradeep Thakurta. Near exact privacy amplification for matrix mechanisms. In ICLR, 2025

    2025

  4. [12]

    How private are DP-SGD implementations? In ICML, 2024 a

    Lynn Chua, Badih Ghazi, Pritish Kamath, Ravi Kumar, Pasin Manurangsi, Amer Sinha, and Chiyuan Zhang. How private are DP-SGD implementations? In ICML, 2024 a

    2024

  5. [13]

    Scalable DP-SGD : Shuffling vs

    Lynn Chua, Badih Ghazi, Pritish Kamath, Ravi Kumar, Pasin Manurangsi, Amer Sinha, and Chiyuan Zhang. Scalable DP-SGD : Shuffling vs. P oisson subsampling. In NeurIPS, 2024 b

    2024

  6. [14]

    Order Statistics

    Herbert A David and Haikady N Nagaraja. Order Statistics. John Wiley & Sons, 2004

    2004

  7. [15]

    Smith, and Borja Balle

    Soham De, Leonard Berrada, Jamie Hayes, Samuel L. Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale. CoRR, abs/2204.13650, 2022

    2022 arXiv

  8. [16]

    Mapreduce: Simplified data processing on large clusters

    Jeffrey Dean and Sanjay Ghemawat. Mapreduce: Simplified data processing on large clusters. In OSDI, pages 137--150, 2004

    2004

  9. [17]

    A list of real-world uses of differential privacy

    Damien Desfontaines. A list of real-world uses of differential privacy. https://desfontain.es/blog/real-world-differential-privacy.html, Oct 2021. Ted is writing things (personal blog)

    2021

  10. [18]

    Differentially private diffusion models

    Tim Dockhorn, Tianshi Cao, Arash Vahdat, and Karsten Kreis. Differentially private diffusion models. TMLR, 2023

    2023

  11. [19]

    Rothblum

    Cynthia Dwork and Guy N. Rothblum. Concentrated differential privacy. CoRR, abs/1603.01887, 2016

    2016 arXiv

  12. [20]

    Privacy amplification by random allocation

    Vitaly Feldman and Moshe Shenfeld. Privacy amplification by random allocation. CoRR, abs/2502.08202, 2025

    2025

  13. [21]

    D P A ccounting L ibrary, 2020

    Google's DP Library. D P A ccounting L ibrary, 2020. URL https://github.com/google/differential-privacy/tree/main/python/dp_accounting

    2020

  14. [22]

    Exploring the limits of differentially private deep learning with group-wise clipping

    Jiyan He, Xuechen Li, Da Yu, Huishuai Zhang, Janardhan Kulkarni, Yin Tat Lee, Arturs Backurs, Nenghai Yu, and Jiang Bian. Exploring the limits of differentially private deep learning with group-wise clipping. In ICLR, 2023

    2023

  15. [23]

    Probability inequalities for sums of bounded random variables

    Wassily Hoeffding. Probability inequalities for sums of bounded random variables. J. ASA, 58 0 (301): 0 13--30, 1963

    1963

  16. [24]

    DP-NMT : Scalable differentially-private machine translation

    Timour Igamberdiev, Doan Nam Long Vu, Felix K \"u nnecke, Zhuo Yu, Jannik Holmer, and Ivan Habernal. DP-NMT : Scalable differentially-private machine translation. In EACL (Demonstrations), pages 94--105, 2024

    2024

  17. [25]

    Display advertising challenge, 2014

    Olivier Chapelle Jean-Baptiste Tien, joycenv. Display advertising challenge, 2014. URL https://kaggle.com/competitions/criteo-display-ad-challenge

    2014

  18. [26]

    The composition theorem for differential privacy

    Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In ICML, pages 1376--1385, 2015

    2015

  19. [27]

    Practical and private (deep) learning without sampling or shuffling

    Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shuffling. In ICML, pages 5213--5225, 2021

    2021

  20. [28]

    Computing tight differential privacy guarantees using FFT

    Antti Koskela, Joonas J \"a lk \"o , and Antti Honkela. Computing tight differential privacy guarantees using FFT . In AISTATS, pages 2560--2569, 2020

    2020

  21. [29]

    Heikkil \" a , and Antti Honkela

    Antti Koskela, Mikko A. Heikkil \" a , and Antti Honkela. Numerical accounting in the shuffle model of differential privacy. TMLR, 2023, 2023

    2023

  22. [30]

    Avoiding pitfalls for privacy accounting of subsampled mechanisms under composition

    Christian Janos Lebeda, Matthew Regehr, and Gautam Kamath. Avoiding pitfalls for privacy accounting of subsampled mechanisms under composition. CoRR, abs/2405.20769, 2024

    2024 arXiv

  23. [31]

    A simple method for generating gamma variables

    George Marsaglia and Wai Wan Tsang. A simple method for generating gamma variables. ACM Trans. Math. Softw., 26 0 (3): 0 363–372, 2000

    2000

  24. [32]

    Private online prefix sums via optimal matrix factorizations

    Brendan McMahan, Keith Rush, and Abhradeep Guha Thakurta. Private online prefix sums via optimal matrix factorizations. CoRR, abs/2202.08312, 2022

    2022 arXiv

  25. [33]

    A fast algorithm to optimally compose privacy guarantees of differentially private ( DP ) mechanisms to arbitrary accuracy., 2021

    Microsoft. A fast algorithm to optimally compose privacy guarantees of differentially private ( DP ) mechanisms to arbitrary accuracy., 2021. URL https://github.com/microsoft/prv_accountant

    2021

  26. [34]

    R \' e nyi differential privacy

    Ilya Mironov. R \' e nyi differential privacy. In CSF, pages 263--275, 2017

    2017

  27. [35]

    Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta

    Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, H. Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradeep Guha Thakurta. How to dp-fy ML: A practical guide to machine learning with differential privacy. J. AIR, 77: 0 1113--1201, 2023

    2023

  28. [36]

    Code for computing tight guarantees for differential privacy., 2020

    Lukas Prediger and Antti Koskela. Code for computing tight guarantees for differential privacy., 2020. URL https://github.com/DPBayes/PLD-Accountant

    2020

  29. [37]

    Reacting to variations in product demand: An application for conversion rate (CR) prediction in sponsored search

    Marcelo Tallis and Pranjul Yadav. Reacting to variations in product demand: An application for conversion rate (CR) prediction in sponsored search. CoRR, abs/1806.08211, 2018

    2018 arXiv

  30. [38]

    Private fine-tuning of large language models with zeroth-order optimization

    Xinyu Tang, Ashwinee Panda, Milad Nasr, Saeed Mahloujifar, and Prateek Mittal. Private fine-tuning of large language models with zeroth-order optimization. CoRR, abs/2401.04343, 2024

    2024 arXiv

  31. [39]

    URL https://www.tensorflow.org/responsible_ai/privacy/api_docs/python/tf_privacy

    Tensorflow Privacy, 2024. URL https://www.tensorflow.org/responsible_ai/privacy/api_docs/python/tf_privacy

    2024

  32. [40]

    A randomized approach to tight privacy accounting

    Jiachen (Tianhao) Wang, Saeed Mahloujifar, Tong Wu, Ruoxi Jia, and Prateek Mittal. A randomized approach to tight privacy accounting. In NeurIPS, pages 33856--33893, 2023

    2023

  33. [41]

    Opacus: User-friendly differential privacy library in PyTorch

    Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Testuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov. Opacus: User-friendly differential privacy library in PyTorch . CoRR, abs/2109.12298, 2021

    2021 arXiv

  34. [42]

    Optimal accounting of differential privacy via characteristic function

    Yuqing Zhu, Jinshuo Dong, and Yu - Xiang Wang. Optimal accounting of differential privacy via characteristic function. In AISTATS, pages 4782--4817, 2022

    2022

  35. [43]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  36. [44]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  37. [45]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.