Pith. sign in

REVIEW 6 major objections 7 minor 12 references

FERRET: Private Deep Learning Faster And Better Than DPSGD

T0 review · 6 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FERRET claims that a Bernoulli-masked one-bit sign update achieves mutual-information differential privacy with zero additive noise and, empirically, beats DPSGD on perplexity and speed.

desk verdict Novel MI-DP mechanism with a strong empirical study, but the headline privacy comparison is apples-to-oranges and the proof of Lemma 2 is wrong as written. read the letter →

arxiv 2506.05416 v1 pith:LSV5ZJHW submitted 2025-06-04 cs.CR cs.AIcs.LG

David Zagardo This is my paper
classification cs.CRcs.AIcs.LG
keywords mutual-informationdifferentialprivacysignSGDgradientcompressionBernoullimaskingmembershipinferenceattacklargelanguagemodelsprivacy-utilitytradeoffnoise-free
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that the privacy-utility-efficiency trilemma in private deep learning can be resolved by randomizing whether a 1-bit gradient sign is released, rather than by adding calibrated Gaussian noise. It introduces FERRET, which partitions parameters into groups, projects each group's gradient onto a public random unit vector, and transmits only the sign of that projection—and only when a Bernoulli mask fires. The theoretical claim is that each fired group leaks at most $\ln 2$ nats, so after subsampling the total leakage is $\varepsilon = G T s p \ln 2$ with no noise. Empirically, on five language models from 137M to 1.8B parameters, FERRET-MAX and FERRET-EIGHTH beat DPSGD on test perplexity at every budget and epoch count, keep membership-inference AUC near chance, and use 19-33% of DPSGD's wall-clock time. A careful reader should care because, if the bound holds, private fine-tuning need not trade away utility or compute.

What carries the argument

The load-bearing object is the random-projection sign release: for each group, draw a public unit vector $u$ uniformly from the sphere, compute $\sigma = \operatorname{sign}(\langle g, u\rangle)$, and release $\Delta = \sigma C u$ only when a Bernoulli variable $Z \sim \mathrm{Bern}(p)$ fires. Lemma 1 is the engine: for any fixed nonzero gradient, $\Pr[\langle g,u\rangle > 0] = 1/2$ by symmetry, so the released bit has entropy exactly $\ln 2$, and conditioning on $u$ cannot increase the information about a record. Lemma 2 multiplies this by the subsampling rate $s$, and summing over $G$ groups and $T$ steps gives the linear budget $\varepsilon = G T s p \ln 2$. Lemma 3 shows the per-update leakage stays at $\ln 2$ regardless of how many parameter tensors a group contains, so grouping changes only the number of groups and hence the ceiling $\varepsilon_{\max} = G T s \ln 2$.

What would settle it

Run a strong membership-inference or canary-extraction evaluation on FERRET-MAX at $\varepsilon = 2$ after five epochs; if any model yields ROC AUC clearly above about 0.55, the claimed bound is not what provides the observed protection. Alternatively, measure the empirical sign distribution for a fixed nonzero gradient and a fixed random direction and check whether $\Pr[\sigma = +1]$ departs measurably from $1/2$, which would directly contradict Lemma 1.

Watch

Extended reading notes

Core claim

The central claim is that a group-sign release with a Bernoulli mask is $\varepsilon$-MI-DP with $\varepsilon = G T s p \ln 2$ nats, where $G$ groups are trained for $T$ steps, each mini-batch is sampled at rate $s$, and $p$ is the firing probability. Since the sign of a random projection of any nonzero vector is exactly uniform on $\{-1,+1\}$, its entropy is $\ln 2$; the mechanism collapses continuous gradients into a ternary alphabet $\{-1, 0, +1\}$, which makes average-case mutual information finite. The paper further claims that this average-case guarantee translates to strong empirical privacy: membership-inference ROC AUC stays near 0.51 for FERRET-MAX and FERRET-EIGHTH across five LLMs, while DPSGD sits near 0.51 and non-private training ranges from 0.76 to 0.99. On utility, at $\varepsilon = 0.5$ and five epochs FERRET-EIGHTH reaches 3.98 perplexity versus DPSGD's 11.61, within 23% of non-private training, and FERRET-MAX uses only 19-24% of DPSGD's training time. The paper also reports that FERRET was the only method tested that could fine-tune a 3.8B-parameter model on a single 40GB GPU.

Load-bearing premise

The guarantee is only average-case mutual-information differential privacy; under the worst-case $(\varepsilon,\delta)$-DP definition, the noise-free mechanism has infinite Rényi divergence because neighboring datasets produce disjoint observed outputs.

Editorial extensions

If this is right

  • A target budget $\varepsilon \in [0.1, 2]$ is met exactly by choosing $p^* = \varepsilon/(G T s \ln 2)$, with no additive noise, because leakage is linear in the firing probability.
  • At $\varepsilon = 0.5$ and five epochs, FERRET-EIGHTH reaches 3.98 perplexity versus 11.61 for DPSGD, within 23% of non-private training.
  • Stricter budgets make FERRET faster, not slower: $\varepsilon = 0.1$ uses only 19-33% of DPSGD's time and about 34% of non-private training time.
  • Membership-inference AUC stays near 0.51 for FERRET-MAX and FERRET-EIGHTH, matching DPSGD, while the coarser FERRET-2 rises to about 0.55.
  • Privacy applies at group granularity regardless of the number of tensors per group: each fired group leaks at most $\ln 2$ nats.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: because the guarantee is average-case MI-DP rather than worst-case $(\varepsilon,\delta)$-DP, deployments facing adaptive worst-case adversaries should treat FERRET's headline $\varepsilon$ as a different currency from DPSGD's, and would need the Gaussian micro-dither of Appendix B to obtain a standard RDP certificate.
  • My inference: the formula predicts dimension-free per-group leakage, so scaling to larger models at the same $G, T, s, p$ should not change the privacy bound; this is testable by training a 7B+ model and checking membership-inference AUC.
  • My inference: the claimed regularization benefit over non-private training at five epochs may partly reflect different learning-rate schedules, so a matched-compute comparison with identical hyperparameter sweeps would isolate the contribution of masking.
  • My inference: the same on/off sign-release idea could transfer to federated learning, where each client's masked sign update would inherit the same $\ln 2$ per-fire bound and turn communication efficiency into a privacy lever.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 7 minor

Summary. The paper proposes FERRET, a 1-bit sign-based gradient compression mechanism with Bernoulli masking and public random unit projections, and derives a mutual-information differential privacy (MI-DP) guarantee of ε = G·T·s·p·ln 2 nats with no additive noise. The authors evaluate three group granularities on five LLMs (137M–1.8B) against DPSGD and non-private baselines, reporting large perplexity gains over DPSGD, MIA AUC near chance for the fine-grained variants, and 3–5× training-time speedups. The central theoretical claim is that each fired group leaks at most ln 2 nats and that subsampling multiplies this by s; the central empirical claim is that FERRET is faster and has better utility than DPSGD at the same numerical ε.

Significance. The mechanism is conceptually interesting: replacing continuous gradients with a discrete sign-plus-silence alphabet gives a finite, explicit privacy bound without additive noise, and the per-update entropy bound (Lemma 1) is correct. The paper is also honest about the non-DP nature of the release in Appendix B, and the experiments cover multiple models, epochs, and privacy budgets rather than a single configuration. The main significance is conditional: if the MI-DP bound were rigorously established and the comparison with DPSGD were reframed as an MI-DP-versus-DP comparison, the paper would offer a useful addition to the compressed-and-private optimization literature. As written, however, the central proof has an algebraic error and the headline privacy comparisons conflate two different privacy definitions, so the significance is not yet realized.

major comments (6)
  1. [§5.1, Lemma 2 / Eq. (11)] The proof of Lemma 2 is not valid as written. The first equality I(Y;Xi|X−i)=I(Y;Xi,Si|X−i) omits the term I(Y;Si|Xi,X−i), which need not vanish: the output can depend on whether record i was sampled even after conditioning on Xi. Consequently Eq. (11) and conclusion (10) do not follow from the displayed algebra. Since Eq. (8) is derived by applying Lemma 2 to the per-group sign release, the central privacy formula currently lacks a correct proof. The desired inequality may be recoverable by a different chain-rule argument under the conditional independence Y⊥Xi | (Si=0, X−i), but the manuscript must supply that argument rather than the incorrect equality.
  2. [§6.2, §6.5, Abstract] The headline comparison 'FERRET with ε=0.5 is 2.9× better PPL than DPSGD with ε=0.5' compares an ε-MI-DP guarantee (average-case, in nats) with an (ε,δ)-DP guarantee (worst-case likelihood ratios). Appendix B shows that the undithered FERRET release has infinite Rényi divergence between neighbouring datasets, so it is not (ε,δ)-DP. A small MI-DP ε does not imply a small worst-case DP ε, and average-case mutual information can be small even when a specific record leaks strongly. The paper should either add a Gaussian dither and report a common DP guarantee, or explicitly state that the utility/efficiency comparison is between a formal MI-DP method and a DP method at numerically equal but semantically different ε values, and remove all claims of matching or beating DPSGD's privacy.
  3. [§8, Limitations] The ordering 'ϵ-DP ⪰ MI-DP ⪰ (ε,δ)-DP' is not a sound basis for claiming that FERRET provides stronger privacy than DPSGD. MI-DP is an average-case constraint and is generally weaker than pure DP (pure DP implies MI-DP, not conversely), and it is not comparable to (ε,δ)-DP in the simple chain stated. The sentence 'This lays the groundwork to make the case that FERRET actually provides stronger privacy guarantees than traditional DPSGD' is unsupported and should be replaced by a precise statement of the known implications between MI-DP and DP, or deleted.
  4. [§6.5 / Table 5] The claim in §6.5 and the abstract that 'across all settings, FERRET-MAX/EIGHTH beat DPSGD's perplexity' is contradicted by Table 5 for one epoch: at ε=1.0, FERRET-MAX is 6.56 vs DPSGD 6.37; at ε=2.0, FERRET-MAX is 14.58 vs DPSGD 5.94, and FERRET-EIGHTH is also worse than DPSGD at ε=1.0 and ε=2.0 for one epoch. The utility advantage is substantial for 3–5 epochs, but the 'across all settings' claim is false as stated and should be corrected with epoch-specific comparisons.
  5. [§6.3 / Table 2] The empirical privacy evaluation uses only MIA ROC-AUC. Since MI-DP is an average-case guarantee, a mean AUC near 0.5 does not rule out high leakage for outlier records, and MIA AUC is not a measure of ε. Statements such as 'FERRET-MAX matches or exceeds DPSGD's privacy protection' based on AUC differences of 0.507–0.513 versus 0.509 overstate what the experiment shows. The paper should add a limitations discussion and, if possible, report per-record attack confidence or a worst-case metric in addition to average AUC.
  6. [§6.2 / Appendix C] The DPSGD comparison uses FastDP defaults (automatic clipping, MixOpt, all-layer clipping) and required a PyTorch downgrade to 2.1.0 to restore utility, while the Non-DP baseline was tuned after observing that FERRET outperformed it. This asymmetry confounds the utility and efficiency comparison. The manuscript should either tune all baselines on comparable budgets or explicitly state that the comparisons are against default-configured DPSGD and a tuned Non-DP baseline, and temper the conclusion of 'better than DPSGD' accordingly.
minor comments (7)
  1. [Throughout] There are numerous typographical errors, including 'emprical', 'amplfication', 'R elease', and 'T ake-away'; a careful proofread is needed.
  2. [Eq. (8)] The privacy budget in Eq. (8) is in nats; the paper should use a distinct symbol such as ε_MI and state the units explicitly to avoid confusion with the dimensionless ε of DPSGD.
  3. [Table 3] Table 3 lists FERRET-HALF and FERRET-QUARTER with no corresponding experimental results; clarify whether these rows are extrapolated from Eq. (13) rather than measured.
  4. [Table 5] Several cells contain divergent perplexity values (e.g., 89449.92 and 428515.02); reporting means over divergent runs is misleading, and the paper should also report medians or exclude identifiable divergences.
  5. [§6.3] Differences between AUC values such as 0.507 and 0.509 are within one or two standard deviations; the text should not describe these as demonstrating that one method has better privacy than the other.
  6. [Appendix C] The detailed version-conflict tables are not central to the privacy or utility claims and could be moved to supplementary material or summarized in one sentence.
  7. [Contributions] Contribution 2 says 'exact MI-DP bound', but the bound is conservative and the proof of Lemma 2 is invalid as written; the wording should be 'an explicit upper bound' pending a corrected proof.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the MI-DP bound follows from the entropy of a fair sign bit, and p* is the inverse of the derived linear formula, not a fitted prediction.

full rationale

The derivation chain is self-contained. Lemma 1 (Sec. 5.1) bounds each fired group's mutual information by H(sign(⟨g,u⟩)) = ln 2 nats directly from the uniformity of the sign of a random unit-vector projection; it does not assume the conclusion and depends only on the data-independent choice of u. Lemma 2 applies subsampling amplification, and Eq. (8) sums G·T·s·p·ln 2 by the chain rule. The firing probability p* (Theorem 1, Sec. 5.2) is the inverse of this linear bound for a user-chosen target ε, so no parameter is fitted to the perplexity or membership-inference results; those results are external validations, not inputs to the bound. Appendix B transparently documents that Rényi divergence is infinite without a Gaussian dither, an honest statement of scope rather than a circular move. The main caveat is definitional, not circular: FERRET's ε-MI-DP budget and DPSGD's (ε,δ)-DP budget (Secs. 6.2, 8) are different privacy quantities, so head-to-head 'ε = 0.5' comparisons are not apples-to-apples; this is a correctness/interpretation risk. A separate mathematical concern (also not circularity) is that Lemma 2's proof drops the I(Y; Si | X−i) term when expanding I(Y; Xi, Si | X−i), so the subsampling-amplification step appears under-proved. Neither issue makes the derivation equivalent to its inputs by construction.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central privacy derivation relies on a symmetry argument, a subsampling amplification step, and the acceptance of MI-DP as a privacy metric. The paper introduces no new physical or formal entities. The proof of Lemma 2 is algebraically incomplete as written; the s-factor amplification is therefore an axiom of the current version rather than a fully verified derivation.

free parameters (1)
  • Clipping/update magnitude C = 1.0
    Set to 1.0 for all experiments; controls step size of fired updates and is part of the utility/efficiency tradeoff, though the privacy bound does not depend on it.
assumptions (4)
  • standard math For any nonzero vector g and u uniform on the unit sphere, sign(<g,u>) is uniform on {+1,-1} (Lemma 1).
    Used to bound per-update MI by ln2; the symmetry argument is correct.
  • domain assumption Subsampling with rate s multiplies the MI-DP budget by s (Lemma 2).
    This is the key amplification step behind epsilon=GTsp ln2. The paper's proof drops a nonnegative mutual-information term I(Y; S | X_-i), so the statement is assumed rather than established by the given derivation.
  • domain assumption Mutual-information DP is an acceptable notion of privacy for the claimed guarantees.
    FERRET is not (epsilon,delta)-DP (Appendix B), so all privacy claims depend on accepting average-case MI bounds as meaningful.
  • domain assumption The adversary may know the public directions u_t,g and the entire released transcript, including the silence pattern.
    The mechanism's analysis includes u in the released update, so this is a deliberate modeling choice, not a hidden assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FERRET: Private Deep Learning Faster And Better Than DPSGD." pith.science (2026). https://pith.science/paper/LSV5ZJHW

@misc{pith2026250605416,
  author       = {Pith},
  title        = {Pith review of: FERRET: Private Deep Learning Faster And Better Than DPSGD},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LSV5ZJHW}},
  note         = {Machine review of arXiv:2506.05416}
}
read the original abstract

We revisit 1-bit gradient compression through the lens of mutual-information differential privacy (MI-DP). Building on signSGD, we propose FERRET--Fast and Effective Restricted Release for Ethical Training--which transmits at most one sign bit per parameter group with Bernoulli masking. Theory: We prove each fired group leaks at most ln 2 nats; after subsampling with rate s, the total privacy loss of G groups trained for T steps with firing probability p is epsilon = G * T * s * p * ln 2. Thus FERRET achieves MI-DP for epsilon in [0.1, 2] without additive noise. Practice: We evaluate three granularities--FERRET-MAX (finest), FERRET-EIGHTH (medium), and FERRET-2 (coarsest)--on five LLMs (137M-1.8B parameters) against DPSGD and Non-DP baselines. All methods trained for 1, 3, and 5 epochs. Utility: Across all settings, FERRET-MAX/EIGHTH beat DPSGD's perplexity. At epsilon=0.5, 5 epochs: FERRET-EIGHTH achieves 3.98 perplexity vs DPSGD's 11.61 (2.9x better), within 23% of Non-DP (3.25). Privacy: MI-AUC stays at chance for FERRET-MAX/EIGHTH (~0.51), matching DPSGD vs Non-DP's 0.76-0.99. FERRET-2 shows higher leakage (~0.55) due to lower headroom. Efficiency: Stricter budgets fire fewer signs, so FERRET uses 19-33% of DPSGD's training time and only 34-36% of Non-DP training time. Take-away: Sign-based MI-DP gets closer to achieving all three qualities of the privacy, utility, performance trilemma: FERRET trains up to 5x faster, achieves 3x lower perplexity compared to DPSGD and 1.2x greater than Non-DP, all while providing formal, mathematically provable privacy guarantees using zero additive noise. The results also show that, in certain instances, masked 1-bit updates can match non-private training utility while safeguarding data.

Figures

Figures reproduced from arXiv: 2506.05416 by the authors.

Figure 1
Figure 1. ROC curves for TinyLlama-1.1B: (left) ε = 2.0, (right) Non-private (ε = ∞) FERRET-MAX demonstrates exceptional empirical privacy protection, achieving AUC scores as low as 0.507 at ε = 1.0—marginally better than DPSGD’s consistent 0.509. Across all settings, FERRET-MAX (0.507-0.513) matches or exceeds DPSGD’s privacy protection, validating that our 8 [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. FERRET Privacy Showcase: Average of all models and all epsilon values at 3 epochs. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. FERRET Perplexity Showcase: Average of all models at 0.5 epsilon at 5 epochs. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Ferret Efficiency Showcase: Average of all models at 0.1 epsilon at 5 epochs. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: At σ= 10−2 convergence merely slows initially and eventually achieves a lower median loss, suggesting a mild regularization effect. Only for σ≳10−1 does optimization deteriorate sharply. Outlook for deep learning (future work). Large-scale models operate with gradient …
Figure 5
Figure 5. Figure 5: Impact of Gaussian dither on a toy linear-regression task: median MSE and inter-quartile [PITH_FULL_IMAGE:figures/full_fig_p026_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

12 extracted references · 12 canonical work pages

  1. [1]

    Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

    Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , CCS ’16, pages 308–318. ACM, 2016

    work page 2016

  2. [2]

    Li, Ryota Tomioka, and Milan Vojnovi´ c

    Dan Alistarh, Demjan Grubi´ c, Jerry Z. Li, Ryota Tomioka, and Milan Vojnovi´ c. Qsgd: Communication-efficient sgd via gradient quantization and encoding. In Advances in Neu- ral Information Processing Systems , volume 30 of NeurIPS, pages 1709–1720, 2017

    work page 2017

  3. [3]

    Signsgd: Compressed optimisation for non-convex problems

    Jeremy Bernstein, Yu-Xiang Wang, Kamyar Azizzadenesheli, and Animashree Anandkumar. Signsgd: Compressed optimisation for non-convex problems. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning , vol- ume 80 of Proceedings of Machine Learning Research, pages 560–569. PMLR, 2018

    work page 2018

  4. [4]

    signsgd with majority vote is communication efficient and fault tolerant

    Jeremy Bernstein, Jiawei Zhao, Kamyar Azizzadenesheli, and Anima Anandkumar. signsgd with majority vote is communication efficient and fault tolerant. In International Conference on Learning Representations (ICLR) 2019, Poster Track , 2019

    work page 2019

  5. [5]

    Differentially private optimization on large model at small cost

    Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Differentially private optimization on large model at small cost. In International Conference on Machine Learning , pages 3192–

    work page

  6. [6]

    Differential privacy as a mutual information constraint

    Paul Cuff and Lanqing Yu. Differential privacy as a mutual information constraint. In Pro- ceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , CCS ’16, pages 43–54. ACM, 2016

    work page 2016

  7. [7]

    The Algorithmic Foundations of Differential Privacy , vol- ume 9 of Foundations and Trends® in Theoretical Computer Science

    Cynthia Dwork and Aaron Roth. The Algorithmic Foundations of Differential Privacy , vol- ume 9 of Foundations and Trends® in Theoretical Computer Science . Now Publishers, 2014

    work page 2014

  8. [8]

    Stich, and Martin Jaggi

    Sai Praneeth Karimireddy, Quentin Rebjock, Sebastian U. Stich, and Martin Jaggi. Error feedback fixes signsgd and other gradient compression schemes. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 3252–3261. PMLR, 2019

    work page 2019

Show all 12 references
  1. [9]

    Sign-full random projections

    Ping Li. Sign-full random projections. In Proceedings of the 33rd AAAI Conference on Artificial Intelligence, AAAI-19, pages 4205–4212. AAAI Press, 2019

    2019

  2. [10]

    Openorca: An open dataset of gpt augmented flan reasoning traces

    Wing Lian, Bleys Goodson, Eugene Pentland, Austin Cook, Chanvichet Vong, and ”Teknium”. Openorca: An open dataset of gpt augmented flan reasoning traces. https://huggingface. co/datasets/Open-Orca/OpenOrca, 2023

    2023

  3. [11]

    Dp-signsgd: When efficiency meets privacy and robustness

    Lingjuan Lyu. Dp-signsgd: When efficiency meets privacy and robustness. In Proceedings of the 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 3070–3074. IEEE, 2021

    2021

  4. [12]

    disjoint-support

    Ilya Mironov. R´ enyi differential privacy. In Proceedings of the 30th IEEE Computer Security Foundations Symposium (CSF), pages 263–275. IEEE, Aug 2017. 18 10 Appendix A Table 8: Average Test Perplexity (PPL) Across Models (Mean [Min, Max], N=5) Method ε= 0.1 ε= 0.5 ε= 1.0 ε=...

    2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.