Pith. sign in

REVIEW 4 major objections 5 minor 18 references

On the Performance of Differentially Private Optimization with Heavy-Tail Class Imbalance

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Under heavy-tail class imbalance, DP-GD underfits rare classes; DP-AdamBC, which subtracts DP noise from Adam's curvature estimate, lifts training accuracy on the least frequent classes by roughly 8% and 5% in synthetic and real-data…

desk verdict Plausible claim that DP-AdamBC helps rare classes under heavy-tail imbalance, but the 'crucial' role of bias correction is confounded by the tuned floor γ' and needs an ablation. read the letter →

arxiv 2507.10536 v1 pith:VZBY4UEX submitted 2025-07-14 cs.LG

Qiaoyue Tang , Alain Zhiyanov , Mathias Lécuyer This is my paper
classification cs.LG
keywords differentialprivacyheavy-tailclassimbalanceDP-AdamBCbiascorrectionAdamoptimizersecond-momentcurvatureestimationnext-tokenpredictionill-conditionedoptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks why differentially private training struggles when class labels follow a heavy-tail (Zipf-like) distribution, and whether the optimizer can fix it. It argues that DP-GD's updates inherit the class-frequency scaling of the loss: frequent classes receive large steps in high-curvature regions and rare classes receive tiny steps in flat regions, so rare classes are learned slowly or not at all. Adam can relieve this by normalizing with a curvature estimate, but the Gaussian noise added for DP biases Adam's second-moment estimate so heavily that DP-Adam behaves like DP-SGD. The paper's remedy is DP-AdamBC, which subtracts the known noise variance from the second moment before normalizing; in experiments this raises training accuracy on the least frequent classes by about 8% on a synthetic linear model and about 5% on real data with a CNN. The setting matters because next-token-prediction language models have exactly this heavy-tail label distribution, where private training is most difficult.

What carries the argument

The machinery is the DP-AdamBC update rule, which changes Adam's denominator from $\sqrt{\hat v_t}+\gamma$ to $\sqrt{\max(\hat v_t - (\sigma C/L)^2, \gamma')}$, subtracting the DP noise variance from the curvature estimate. It is powered by the scaling identities $g_t \approx (1-p)\pi_k \bar x_k$ and $H_t \approx p(1-p)\pi_k \bar H_k$ for class $k$, which hold when the model assigns a large probability $p$ to the correct class and show that the ill-conditioning is set by class frequency. Because the noise variance is identical in every coordinate, it disproportionately contaminates the small second moments of low-frequency classes; removing it is what lets the normalization shrink updates for frequent classes and magnify updates for rare classes, mimicking sign-descent behavior.

What would settle it

Track per-class gradient and Hessian norms during DP training on a heavy-tail dataset while starting from a deliberately low-confidence initialization (correct-class probability near $1/c$). If rare-class gradients do not scale with class frequency when confidence is low, or if DP-AdamBC's rare-class accuracy edge disappears in that regime, the ill-conditioning account fails.

Watch

Extended reading notes

Core claim

In a stylized linear model with Zipf-distributed labels, the paper shows that both the private gradient and the loss Hessian for class $k$ scale with the class frequency $\pi_k = n_k/n$, so DP-GD updates are too large for frequent classes and too small for rare classes under a single learning rate. Adam preconditions the gradient by the square root of the second moment of the gradient, a cheap proxy for curvature, but additive DP noise contributes a per-coordinate variance $(\sigma C/L)^2$ that dominates the second moment and makes the normalization class-frequency-blind. DP-AdamBC repairs the estimate by using $\max(\hat v_t - (\sigma C/L)^2, \gamma')$ in the denominator, restoring the curvature signal. The paper reports that this bias correction produces the best fit to the least frequent classes in controlled linear experiments (about 8% higher training accuracy than DP-GD on the rarest class group) and on Barcode MNIST with a CNN (about 5% higher on the rarest group), at a modest cost on the most frequent class. Clipping each sample's gradient before aggregation does not remove the ill-conditioning, because gradients within a class remain aligned and still accumulate in proportion to $\pi_k$.

Load-bearing premise

The whole argument depends on a stated assumption, adopted without verification: the model assigns a large output probability to the correct class, so gradients and Hessians scale linearly with class frequency; early in training or for rare classes the model has not learned, this can fail and the predicted benefit of curvature normalization may not hold.

Editorial extensions

If this is right

  • Under a fixed privacy budget and learning rate, DP-GD will underfit low-frequency classes, whereas DP-AdamBC reduces this bias: in the synthetic linear setting the rarest class group reached about 9.5% training accuracy with DP-AdamBC versus roughly 9 percentage points less for DP-GD.
  • The advantage is concentrated on rare classes; on the highest-frequency class DP-GD can reach 100% training accuracy where DP-AdamBC reaches about 87.5%, so the optimizer choice trades a little frequent-class accuracy for large rare-class gains.
  • Gradient clipping cannot fix the ill-conditioning by itself, because per-sample clipped gradients stay aligned within a class and sum proportionally to class frequency; curvature information must be estimated accurately instead.
  • The value of bias correction grows with the DP noise level: with a smaller noise multiplier ($\sigma=5$ rather than 10), plain DP-Adam approaches DP-AdamBC, whereas with large $\sigma$ or large clipping norm $C$, DP-Adam degrades toward DP-SGD behavior.
  • On real next-token prediction data (TinyPTB), the paper observes a similar but milder pattern, with DP-AdamBC highest for medium- and high-frequency tokens and all optimizers struggling equally on the rarest tokens.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension is to test DP-AdamBC in full DP fine-tuning of larger language models; the paper's TinyPTB results suggest pretrained representations mute the effect, so a randomly initialized head or a model without pretrained embeddings should show a larger rare-token gap if the class-frequency mechanism is correct.
  • The denominator $\max(\hat v_t - (\sigma C/L)^2, \gamma')$ suggests a practical rule beyond Adam: any DP optimizer that estimates a second moment from noisy gradients should subtract the known noise variance before using that moment for normalization or step-size adaptation.
  • One could falsify the mechanism by varying only the confidence assumption: train the linear model from a deliberately low-confidence initialization where the correct-class probability $p$ is small, and check whether the per-class gradient scaling and DP-AdamBC's rare-class advantage both disappear.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies differentially private optimization under heavy-tail class imbalance, a setting common in language modeling. Building on the linear-model analysis of Kunstner et al. [8], it argues that DP-GD is ill-conditioned for low-frequency classes because gradients and Hessians both scale with class frequency, while Adam-type methods that estimate curvature can mitigate this. The paper further argues that DP-Adam's second-moment estimate is dominated by DP noise variance, so the bias-corrected variant DP-AdamBC is crucial for recovering the curvature signal. Experiments on a synthetic linear model, Barcode MNIST, TinyPTB, and E2E show a consistent trend that DP-AdamBC improves training accuracy on rare classes, with headline gains of about 8% on the synthetic task and about 5% on Barcode MNIST. The theoretical discussion is heuristic and imports Assumption 1 from [8], and the empirical evaluation is based on single runs with tuned stability constants.

Significance. If the central claim holds, the paper identifies a practical and cheap algorithmic fix: under DP, using DP-AdamBC instead of DP-Adam can substantially improve training on rare classes in heavy-tail imbalanced data, which is directly relevant to private language modeling. The strengths are the controlled synthetic setup, the inclusion of several DP hyperparameter settings in Appendix C, and the fact that the empirical results are not fit to the theory. The main weaknesses are the absence of multiple seeds or error bars, the lack of an ablation for the numerical floor constant in DP-AdamBC, and the unverified reliance on Assumption 1 of [8]. These issues do not invalidate the trend, but they do mean the specific quantitative claims and the causal attribution to bias correction are not fully supported. The paper is a contribution to an incremental research line, but the evidence as presented is not yet at journal strength.

major comments (4)
  1. [§3, Algorithm 2] The central causal claim that DP-AdamBC's bias correction is 'crucial' is confounded by the numerical floor gamma-prime in the denominator. In Algorithm 2, the update divides by sqrt(max(v_hat_t - (sigma*C/L)^2, gamma-prime)); when the true signal E[g_t^2] is at or below the DP noise variance (sigma*C/L)^2, the denominator is exactly gamma-prime, so the update is controlled by the tuned constant rather than by unbiased curvature. The paper states in §3 that numerical stability constants are tuned separately for DP-Adam and DP-AdamBC, but it does not report the tuned values or run an ablation. Without an ablation that varies gamma-prime while holding the bias-correction term fixed (or vice versa), the reported ≈8% and ≈5% rare-class gains cannot be attributed to bias removal. I request an ablation reporting the tuned gamma and gamma-prime for each method, DP-AdamBC with gamma-prime matched to DP-Adam's gamma, and a version with a standard small gamma-prime.
  2. [§3, Appendix B] All quantitative claims are based on a single run per configuration. No seeds, error bars, or confidence intervals are reported, and hyperparameters are selected as those with the lowest overall training loss on the same data used for evaluation. Given that the headline figures concern rare classes with as few as 5–10 samples, the differences could plausibly lie within run-to-run variation. The paper should report multiple seeds (at least for the synthetic and Barcode MNIST experiments), or explicitly quantify the variance and show that the ordering of optimizers is stable. Without this, the abstract's precise figures (≈8%, ≈5%) are not fully supported.
  3. [§2] The theoretical argument imports Assumption 1 of Kunstner et al. [8] without verification in the private setting. The assumption that the model assigns a large output probability p to the correct class is unlikely to hold early in training, for rare classes, or after clipping, and the derivation of the scaling of gradients and Hessians with class frequency pi_k depends on it. The analysis also takes expectations only over the DP noise z_t, not over the optimization trajectory or data subsampling. As a concrete check, the authors could measure p for low-frequency classes during DP training or test whether the predicted rank ordering of optimizers is robust when Assumption 1 is violated. If the empirical result holds regardless, the paper should say so and relegate the theory to a heuristic.
  4. [Abstract, Appendix B] The abstract's claim of '≈5% increase in training accuracy ... on ... real data' is supported by only one of the three real datasets. In Barcode MNIST, DP-AdamBC reaches 11.5% vs 6.6% for DP-GD on the lowest-frequency group, but the TinyPTB results (Figures 5–6) show no clear advantage for DP-AdamBC on the lowest-frequency tokens, and the E2E results (Figure 7) report only training loss, not accuracy. The paper should either restrict the claim to Barcode MNIST or provide accuracy numbers and a consistent definition of the reported percentage gain across all datasets.
minor comments (5)
  1. [Title page] There are several typos in the author affiliation block, including 'V ancouver' and 'T raining' in the workshop name; these should be corrected.
  2. [Figures 3, 5, 7] The captions for Figures 3(a), 5(a), and 7(a) all describe the plot as 'The class distribution of the synthetic dataset', but these figures show Barcode MNIST, TinyPTB, and E2E, which are not synthetic. The captions should be corrected.
  3. [Figures 2–11] The axis labels use 'Epsilon' and 'Step'; the paper should use the standard notation epsilon and 'steps' for consistency, and should define what privacy accountant is used to compute epsilon.
  4. [§3] The description of the synthetic class sizes is unclear: 'm groups of classes with class sizes equals c = 2^{m+1} − 1' does not match the histogram in Figure 2(a), which shows sizes 8, 128, 256, 512, and 1024. A precise table of the class-size groups would be helpful.
  5. [General] No code or repository link is provided. Making the code available would substantially improve reproducibility, especially because the hyperparameter tuning procedure and the exact DP accountant details are not fully specified.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the DP-AdamBC advantage is supported by new experiments and an algebraic bias-variance identity; the only self-citation is minor, and the unablated floor gamma-prime is a confound, not a circular step.

full rationale

The paper's central claim that DP-AdamBC improves learning of low-frequency classes under DP is not a fitted input renamed as a prediction. Section 2 derives the bias-variance identity E[ev_t] = E[g_t^2] + Var[z_t] from the DP noise model and the scaling relations imported from Kunstner et al. [8], and then reasons about how subtracting Var[z_t] restores curvature information; this is algebraic and does not use the experimental results as inputs. The empirical claims in Section 3 and Appendix B come from new synthetic and real-data experiments, so the reported ~8% and ~5% rare-class accuracy gains are measured rather than forced by construction. The main same-author dependency is [14], which supplies the DP-AdamBC algorithm and the observation that DP noise variance often dominates the second moment; the present paper restates that identity and combines it with new analysis and experiments, so the self-citation is not load-bearing. A genuine weakness, although not a circularity, is that the denominator floor gamma-prime in Algorithm 2 is tuned separately for DP-Adam and DP-AdamBC, and the paper provides no ablation isolating whether the rare-class gains arise from bias removal or from a small gamma-prime producing large normalized steps when the signal is at or below the noise floor; this is an identification and correctness concern, not a definitional reduction. Overall, the derivation chain is self-contained enough to warrant a low score on the circularity scale.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper's central argument adds no new free parameters beyond standard optimizer hyperparameters tuned per configuration. It relies on two imported modeling assumptions: the large-correct-logit scaling of [8] and the noise-variance decomposition of [14]. No new entities are introduced.

free parameters (4)
  • Learning rate eta = tuned per optimizer over half powers (1e-2, 5e-2, 1e-3, ...)
    The comparison selects the best learning rate per optimizer in Section 3, so the relative ranking could depend on this tuning protocol.
  • Adam numerical stability constants gamma and gamma' = not reported
    No explicit values or ranges given; tuned in Section 3 and Appendix B. Different stabilizers can change the rare-class results.
  • DP noise multiplier sigma = 10 (synthetic main), 1 or 10 (real)
    Results are shown for sigma=10 in Figure 2; Appendix C shows sigma=5 changes the gap between DP-Adam and DP-AdamBC. The claim is sensitive to noise level.
  • Clipping norm C = 1 (synthetic main), tuned over {0.1, 1, 10} (real)
    Appendix C shows C=10 yields similar trends, but the exact accuracy differences depend on C.
assumptions (4)
  • domain assumption The model assigns a large output probability p to the correct class (Assumption 1 of [8]).
    Invoked in Section 2 to derive g_t approximately (1-p) pi_k xbar_k and H_t approximately p(1-p) pi_k Hbar_k, which drive the whole scaling argument.
  • domain assumption DP-Adam second moment satisfies E[v_t] approximately E[g_t^2] + Var[z_t], with Var[z_t] approximately (sigma C/L)^2 dominating in high privacy regimes (from [14]).
    Used in Section 2 to argue DP-Adam fails to rescale by curvature, and subtracting Var[z_t] restores the estimate.
  • domain assumption The softmax linear model with Zipf-distributed labels and inputs independent of labels captures the relevant optimization difficulty.
    The stylized model in Section 2 makes the class-frequency scaling exact; transfer to real data is asserted, not proven.
  • domain assumption For clipped gradients, per-sample clipping preserves the class-frequency dependence of the aggregated gradient.
    Supported only by cosine-similarity measurements in Figure 1 and a heuristic decomposition in Section 2; no formal proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Performance of Differentially Private Optimization with Heavy-Tail Class Imbalance." pith.science (2026). https://pith.science/paper/VZBY4UEX

@misc{pith2026250710536,
  author       = {Pith},
  title        = {Pith review of: On the Performance of Differentially Private Optimization with Heavy-Tail Class Imbalance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VZBY4UEX}},
  note         = {Machine review of arXiv:2507.10536}
}
abstract

In this work, we analyze the optimization behaviour of common private learning optimization algorithms under heavy-tail class imbalanced distribution. We show that, in a stylized model, optimizing with Gradient Descent with differential privacy (DP-GD) suffers when learning low-frequency classes, whereas optimization algorithms that estimate second-order information do not. In particular, DP-AdamBC that removes the DP bias from estimating loss curvature is a crucial component to avoid the ill-condition caused by heavy-tail class imbalance, and empirically fits the data better with $\approx8\%$ and $\approx5\%$ increase in training accuracy when learning the least frequent classes on both controlled experiments and real data respectively.

Figures

Figures reproduced from arXiv: 2507.10536 by the authors.

Figure 1
Figure 1. The pairwise cosine similarity between (520 randomly sampled) per-sample gradient at different training steps. The gradients are more aligned within the same class with higher cosine similarity values and less aligned across classes with lower values. 3. Experiments on Linear Model with Synthetic Data To examine the claims above, we generate synthetic data that exhibit heavy-tail class imbalance which has m groups o… view at source ↗
Figure 2
Figure 2. Results from synthetic dataset with linear model with C = 1, σ = 10. Subplots are ordered left to right, top to bottom (a)–(l). (a) The class distribution of the synthetic dataset. (b) The mean training loss from averaging all samples. (c)-(f) The mean training loss separated by averaging samples with the same label frequency. (g) The mean training accuracy from averaging all samples. (h)-(l) The mean training accur… view at source ↗
Figure 3
Figure 3. Results from Barcode MNIST with CNN. (a) The class distribution of the synthetic dataset. (b) The mean training loss from averaging all samples. (c)-(f) The mean training loss separated by averaging samples with the same label frequency. Appendix C. Experiments with Varying DP Hyperparameters We examine the empirical performance on the linear model with synthetic data setup when changing DP hyperparameters C and σ … view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Results from Barcode MNIST with CNN. (a) The mean training accuracy from averaging all samples. (b)-(f) The mean training accuracy separated by averaging samples with the same label frequency. 0 2500 5000 7500 10000 Class index (sorted) 0 10000 20000 30000 # samples # …
Figure 5
Figure 5. Figure 5: Results from TinyPTB with finetuned Transformer head. (a) The class distribution of the synthetic dataset. (b) The mean training loss from averaging all samples. (c)-(f) The mean training loss separated by averaging samples with the same label frequency. 12 [PITH_FULL…
Figure 6
Figure 6. Figure 6: Results from TinyPTB with finetuned Transformer head. (a) The mean training accuracy from averaging all samples. (b)-(f) The mean training accuracy separated by averaging samples with the same label frequency. 0 500 1000 Class index (sorted) 10 5000 10000 28000 # sampl…
Figure 7
Figure 7. Figure 7: Results from finetuning E2E dataset with with C = 1, σ = 0.6. (a) The heavy-tail token frequency distribution. (b) The mean training loss from all samples. (c)-(e) The mean training loss separated by high, medium and low token frequency groups. 13 [PITH_FULL_IMAGE:fig…
Figure 8
Figure 8. Figure 8: Results from synthetic dataset with linear model with C = 10, σ = 10. (a) The class distribution of the synthetic dataset. (b) The mean training loss from averaging all sam￾ples. (c)-(f) The mean training loss separated by averaging samples with the same label frequenc…
Figure 9
Figure 9. Figure 9: Results from synthetic dataset with linear model with C = 10, σ = 10. (a) The mean training accuracy from averaging all samples. (b)-(f) The mean training accuracy separated by averaging samples with the same label frequency. 0 100 200 Class index (sorted) 8 128 256 51…
Figure 10
Figure 10. Figure 10: Results from synthetic dataset with linear model with C = 1, σ = 5. (a) The class distribution of the synthetic dataset. (b) The mean training loss from averaging all samples. (c)-(f) The mean training loss separated by averaging samples with the same label frequency.…
Figure 11
Figure 11. Figure 11: Results from synthetic dataset with linear model with C = 1, σ = 5. (a) The mean train￾ing accuracy from averaging all samples. (b)-(f) The mean training accuracy separated by averaging samples with the same label frequency. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

18 extracted references · 5 canonical work pages

  1. [8]

    Heavy- tailed class imbalance and why adam outperforms gradient descent on language models, 2024

    Frederik Kunstner, Robin Yadav, Alan Milligan, Mark Schmidt, and Alberto Bietti. Heavy- tailed class imbalance and why adam outperforms gradient descent on language models, 2024. URL https://arxiv.org/abs/2402.19449

    arXiv 2024

  2. [14]

    DP-AdamBC: Your DP-Adam Is Actually DP-SGD (Unless You Apply Bias Correction)

    Qiaoyue Tang, Frederick Shpilevskiy, and Mathias Lécuyer. Dp-adambc: Your dp-adam is actually dp-sgd (unless you apply bias correction), 2023. URL https://arxiv.org/ abs/2312.14334

    work page Pith review arXiv 2023

  3. [1]

    Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

    Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , CCS’16. ACM, October 2016. doi: 10. 1145/2976749.2978318. URL http://dx.doi.org/10.1145/2976749.2978318

    arXiv 2016

  4. [2]

    Scalable sec- ond order optimization for deep learning, 2021

    Rohan Anil, Vineet Gupta, Tomer Koren, Kevin Regan, and Yoram Singer. Scalable sec- ond order optimization for deep learning, 2021. URL https://arxiv.org/abs/2002. 09018

    work page 2021

  5. [3]

    Extracting training data from large language models, 2021

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models, 2021. URL https://arxiv.org/abs/2012.07805

    arXiv 2021

  6. [4]

    Adaptive subgradient methods for online learning and stochastic optimization

    John Duchi, Elad Hazan, and Yoram Singer. Adaptive subgradient methods for online learning and stochastic optimization. Journal of Machine Learning Research, 12(61):2121–2159, 2011. URL http://jmlr.org/papers/v12/duchi11a.html

    work page 2011

  7. [5]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. URL https://arxiv.org/abs/2106.09685

    arXiv 2021

  8. [6]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2017. URL https://arxiv.org/abs/1412.6980

    arXiv 2017

Show all 18 references
  1. [7]

    Noise is not the main factor behind the gap between sgd and adam on transformers, but sign descent might be, 2023

    Frederik Kunstner, Jacques Chen, Jonathan Wilder Lavington, and Mark Schmidt. Noise is not the main factor behind the gap between sgd and adam on transformers, but sign descent might be, 2023. URL https://arxiv.org/abs/2304.13960

    2023 arXiv

  2. [9]

    Understanding the difficulty of training transformers, 2023

    Liyuan Liu, Xiaodong Liu, Jianfeng Gao, Weizhu Chen, and Jiawei Han. Understanding the difficulty of training transformers, 2023. URL https://arxiv.org/abs/2004.08249

    2023 arXiv

  3. [10]

    Optimizing neural networks with kronecker-factored approx- imate curvature, 2020

    James Martens and Roger Grosse. Optimizing neural networks with kronecker-factored approx- imate curvature, 2020. URL https://arxiv.org/abs/1503.05671. 7 ON THE PERFORMANCE OF DIFFERENTIALLY PRIVATE OPTIMIZATION WITH HEAVY-TAIL CLASS IMBALANCE

    2020 arXiv

  4. [11]

    Memorization in nlp fine-tuning methods, 2022

    Fatemehsadat Mireshghallah, Archit Uniyal, Tianhao Wang, David Evans, and Taylor Berg- Kirkpatrick. Memorization in nlp fine-tuning methods, 2022. URL https://arxiv.org/ abs/2205.12506

    2022 arXiv

  5. [12]

    The e2e dataset: New challenges for end-to-end generation, 2017

    Jekaterina Novikova, Ondˇrej Dušek, and Verena Rieser. The e2e dataset: New challenges for end-to-end generation, 2017. URL https://arxiv.org/abs/1706.09254

    2017 arXiv

  6. [13]

    Does fine-tuning gpt-3 with the openai api leak personally-identifiable information?, 2024

    Albert Yu Sun, Eliott Zemour, Arushi Saxena, Udith Vaidyanathan, Eric Lin, Christian Lau, and Vaikkunth Mugunthan. Does fine-tuning gpt-3 with the openai api leak personally-identifiable information?, 2024. URL https://arxiv.org/abs/2307.16382

    2024 arXiv

  7. [15]

    Two sides of one coin: the limits of untuned sgd and the power of adaptive methods, 2023

    Junchi Yang, Xiang Li, Ilyas Fatkhullin, and Niao He. Two sides of one coin: the limits of untuned sgd and the power of adaptive methods, 2023. URL https://arxiv.org/abs/ 2305.12475

    2023 arXiv

  8. [16]

    Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang

    Da Yu, Saurabh Naik, Arturs Backurs, Sivakanth Gopi, Huseyin A. Inan, Gautam Kamath, Janardhan Kulkarni, Yin Tat Lee, Andre Manoel, Lukas Wutschitz, Sergey Yekhanin, and Huishuai Zhang. Differentially private fine-tuning of language models, 2022. URL https: //arxiv.org/abs/2110.06500

    2022 arXiv

  9. [17]

    Why are adaptive methods good for attention models?, 2020

    Jingzhao Zhang, Sai Praneeth Karimireddy, Andreas Veit, Seungyeon Kim, Sashank J Reddi, Sanjiv Kumar, and Suvrit Sra. Why are adaptive methods good for attention models?, 2020. URL https://arxiv.org/abs/1912.03194. 8 ON THE PERFORMANCE OF DIFFERENTIALLY PRIVATE OPTIMIZATION WI...

    2020 arXiv

  10. [18]

    Figure 8 and 9 show the results with the same σ = 10 and with a larger clipping threshold of C = 10. Figure 10 and 11 shows the results with the same C = 10 and with a smaller privacy 11 ON THE PERFORMANCE OF DIFFERENTIALLY PRIVATE OPTIMIZATION WITH HEAVY-TAIL CLASS IMBALANCE ...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.