REVIEW 1 major objections 4 minor 12 references
This paper claims that randomizing softmax outputs with the Dirichlet mechanism trains classifiers to the highest reported accuracy for input-private, label-public learning, while preserving the direction of the expected gradient.
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · deepseek-v4-flash
2026-08-01 12:21 UTC pith:CHRA3M6Y
load-bearing objection A genuinely new and strong empirical training scheme, but the printed RDP-to-DP conversion in Theorem 10 cannot certify the headline ε values; fix the theorem before citing. the 1 major comments →
End-to-End Differential Privacy in Training Deep Neural Network Classifiers
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central discovery is that the mapping induced by any neural network with a softmax head—inputs to softmax probabilities—has sensitivity bounded by the unit simplex regardless of architecture, and that randomizing these probabilities with the Dirichlet distribution enforces Rényi differential privacy. With fixed offset and scaling parameters α and r, one Dirichlet sample is (λ, λr^2ψ'(α−(λ−1)r))-RDP; combining this with Poisson subsampling and composing over T steps yields the paper's overall privacy bound. The same mechanism preserves the direction of the expected gradient: E[∇L(ρ(z), y)] = κ(z;r,α)∇L_CE(z), where κ(z;r,α)=r s_y(z)ψ'(r s_y(z)+α). Because backpropagation only sees the pri
What carries the argument
The Dirichlet mechanism is the load-bearing object: for an input x, it samples ρ from Dir(r·softmax(f_θ(x)) + α·1), a distribution over the unit simplex, and uses ρ in place of the softmax vector when computing the negative log-likelihood loss. The unit-simplex sensitivity bound (ℓ2^2 ≤2, ℓ∞ ≤1) sets the privacy scale independently of the network's internals; the RDP analysis of Poisson-subsampled repeated use turns that per-sample perturbation into an end-of-training privacy budget; and the attenuation identity κ(z;r,α)=r s_y(z)ψ'(r s_y(z)+α) connects the mechanism's parameters to optimization by showing the expected gradient is a rescaling of the clean gradient.
Load-bearing premise
The load-bearing premise is that the RDP-to-DP conversion formula printed in the paper is the one used to select r*; as printed that formula adds at least about 3.9 at δ=10^-5, so it cannot certify ε below about 3.9, and the ε=0.5–3 results in the tables have no certificate unless a different formula was actually used.
What would settle it
Recompute r* from the parameter-selection rule using Theorem 10's printed RDP-to-DP conversion for δ=10^-5. If the minimum over admissible λ of ε_o(λ, δ; r, T, q) stays above 1 for every r<α—equivalently, if no λ makes the printed bound certify ε≤1—then the reported ε=1 runs do not satisfy the privacy budget the paper claims.
If this is right
- Input-private training can be done without per-sample gradient clipping; the extra computation is roughly the cost of drawing one Dirichlet sample per class per example.
- The privacy-utility tradeoff improves with smaller Poisson sampling rates; the paper reports accuracy rising as the sampling rate falls from 0.04 to 0.001 under (4,10^-5)-DP.
- Because the expected gradient direction is preserved, learning rates can be rescaled through κ(z;r,α) to produce nearly matching accuracy across a wide range of α values.
- At ε=1 on CIFAR-10, the reported accuracy of 82.96% exceeds the accuracy of the closest prior input-private method at its weakest tested budget, which was about 79% at ε≈4.46.
- On DermaMNIST, private-input training stays within about five percentage points of the non-private baseline at ε=1, suggesting the method can preserve utility on medical images.
Where Pith is reading between the lines
- If the effective-learning-rate collapse observed with SGD across different α values generalizes to other optimizers and architectures, it offers a practical tuning rule: choose α large enough to control variance, then set γ using γ_eff = γκ(z;r,α) at a typical s_y value such as 0.9.
- The input-private, label-public setting composes naturally with label-DP mechanisms; combining the two would privatize both sides of the data at a fraction of DP-SGD's utility cost, though the paper does not test this combination.
- The small-ε results should be re-generated with a corrected RDP-to-DP conversion; if the printed formula is retained, the practical privacy-accuracy frontier may shift to larger ε values than the tables suggest.
- Because the noise variance scales with the number of classes rather than layer width, the method should be especially favorable on problems with few classes and large networks—a testable prediction for class-imbalanced or high-resolution few-class benchmarks.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a differentially private training framework for neural network classifiers in which training inputs are sensitive while labels are public. At each training step, softmax outputs are randomized with the Dirichlet mechanism, and the paper derives an RDP-based privacy guarantee under Poisson subsampling (Theorem 10), proves that the expected private gradient is a scalar multiple of the clean cross-entropy gradient (Theorem 11), and uses that result to calibrate learning rates. Experiments on CIFAR-10, MNIST, DermaMNIST, FashionMNIST, and SVHN report large improvements over prior work, e.g., 88.17% accuracy at ε=4 and 82.96% at ε=1 on CIFAR-10 with δ=10^-5.
Significance. The idea of applying the Dirichlet mechanism at the softmax layer and analyzing it under Poisson subsampling is novel and potentially valuable for the input-private/public-label setting. Theorem 11 is a clean, explicitly derived result with practical implications for learning-rate selection; the code is promised, and the empirical gains over Monir and Ghinita (2024) are noteworthy. However, the formal privacy guarantee as printed is invalid because of an incorrect RDP-to-DP conversion, and the advertised ε labels for the strongest privacy regimes are not currently supported. The significance of the empirical results can only be assessed after this accounting error is corrected.
major comments (1)
- [Lemma 13 / Theorem 10 / Eq. (1) / Table 7] The RDP-to-DP conversion is invalid. For δ=10^-5, C(λ)=[log(λ−1)−logδ+λlogλ]/(λ−1) is minimized at approximately 3.9 (λ≈13–20), so ε_o(λ,δ;r) > 3.9 before the T-term is even added. In particular, a (2,0)-RDP mechanism has identical output distributions and is (0,0)-DP, but the printed formula would certify it only at ε≈12.9 for δ=10^-5. Consequently Theorem 10 cannot certify any ε<3.9, Eq. (1) has no solution for the ε=0.5–3 rows of Table 7, and the ε=1 CIFAR-10 headline is unsupported. Replace Lemma 13 with the standard conversion (e.g., ε̂+log(1/δ)/(λ−1)) and recompute all r* values and reported ε labels.
minor comments (4)
- [Algorithm 1, line 7] Under Poisson sampling, the minibatch B_t can be empty, making the gradient expression 1/|B_t| undefined. Please specify a convention, e.g., skip the update when B_t is empty.
- [Section 3.2] The phrase "NLL 1 loss" appears to be a typo; it should be "NLL loss" or "NLL."
- [Theorem 10 / Table 7] Please report the λ that achieves h(r) and the resulting numerical value of ε_o for each r* in Table 7. Without this, the minimization behind Eq. (1) cannot be reproduced.
- [Figure 2] The left panel appears to use a logarithmic x-axis, but the axis label reads "Learning rate γ" without indicating log scale. Add an axis label such as "log γ" or explicitly annotate the log scale.
Circularity Check
No load-bearing circularity: Theorem 10 assembles external RDP results and Theorem 11 is derived in-paper; the printed RDP-to-DP conversion floor is a correctness issue, not a circular reduction.
full rationale
The paper's central derivation chain is not circular. Theorem 10 is built by composing external, independently published results: Mechanism 8 and Lemma 9 come from Ponnoprat (2023), Poisson subsampling amplification from Zhu and Wang (2019), RDP composition from Mironov (2017), and the RDP-to-DP conversion from Canonne et al. (2020). The authors do not cite their own prior work as load-bearing support, and no uniqueness theorem or ansatz is imported from a self-citation. Theorem 11 is derived in-paper from the exponential-family identities (Wainwright and Jordan 2008) and a dominated convergence argument; the attenuation factor κ(z;r,α) is computed, not fitted, and the gradient-direction claim follows from that computation. The calibration of r* in Eq. (1) via h(r) ≤ ε is a standard privacy-parameter selection step using the paper's own accountant; it is not a fitted parameter being relabeled as a prediction, and the reported accuracies are measured rather than derived from Theorem 10. The only notable concern is internal consistency, not circularity: with the printed Lemma 13, the conversion term [log(λ−1) − log δ + λ log λ]/(λ−1) is minimized at roughly 3.9 for δ=10⁻⁵, so the printed Theorem 10 cannot certify ε<3.9, while Table 7 reports r* values for ε=0.5–3. That points to a likely typo or the use of a different conversion formula in the experiments, and it undermines the formal certificate as stated, but it does not make the derivation equivalent to its inputs. Accordingly, the circularity score is minimal.
Axiom & Free-Parameter Ledger
free parameters (6)
- α (Dirichlet offset parameter) =
3.0 (all experiments)
- r* (Dirichlet scaling parameter) =
0.136–0.964 depending on dataset and ε (Table 7)
- q (Poisson sampling rate) =
0.005 CIFAR-10; 0.01 DermaMNIST; 0.0042 MNIST/FashionMNIST; 0.0034 SVHN
- T (number of training steps) =
20,000 CIFAR-10; 6,006 DermaMNIST; 9,600 MNIST/FashionMNIST; 11,722 SVHN
- γ (learning rate) =
0.1 except 0.05 DermaMNIST; 0.001 with Adam in Appendix G
- s̄_y = 0.9 (representative true-class probability) =
0.9
axioms (7)
- domain assumption Lemma 9 (Ponnoprat 2023): Dirichlet mechanism on the simplex is (λ, λ r² ψ′(α−(λ−1)r))-RDP for λ ∈ [1, 1+α/r)
- domain assumption Zhu & Wang (2019) Theorem 5: Poisson-subsampled RDP amplification bound, including the printed factor-3 form for j≥3 terms
- domain assumption Lemma 13 (Canonne et al. 2020): RDP-to-DP conversion ε = ε̂ + [log(λ−1) − log δ + λ log λ]/(λ−1)
- standard math Lemma 12 (Mironov 2017): adaptive composition of RDP guarantees
- standard math Exponential-family identities (Wainwright & Jordan Prop 3.1): E[log p_j] = ψ(η_j)−ψ(τ), Cov = δ_ij ψ′(η_j)−ψ′(τ)
- standard math Dominated Convergence interchange in Theorem 11 (integrability of the dominating function for α>0)
- standard math Lemma 7: worst-case simplex sensitivity Δ₂² ≤ 2, Δ∞ ≤ 1
Cite this review
Pith. "Pith review of End-to-End Differential Privacy in Training Deep Neural Network Classifiers." pith.science (2026). https://pith.science/paper/CHRA3M6Y
@misc{pith2026260719580,
author = {Pith},
title = {Pith review of: End-to-End Differential Privacy in Training Deep Neural Network Classifiers},
year = {2026},
howpublished = {\url{https://pith.science/paper/CHRA3M6Y}},
note = {Machine review of arXiv:2607.19580}
}
read the original abstract
Differentially private machine learning enables model training on sensitive data while ensuring that individual data is unlikely to be recoverable from the parameters of the resulting model. However, existing work often privatizes both training inputs and their labels, and these protections may be conservative when labels are public or can be safely made public. Therefore, in this work we propose a novel private training framework that instead privatizes training inputs while keeping labels public. We consider neural networks with softmax output layers, and thus the mapping from training inputs to the output of the softmax layer is a mapping onto the unit simplex. We randomize softmax outputs during training by applying the Dirichlet mechanism to enforce differential privacy for the training inputs, hence the ``end-to-end'' label. Because training data is reused across multiple training epochs, we use the notion of \Renyi differential privacy to formulate tight bounds on the strength of privacy provided by the Dirichlet mechanism across repeated uses. We show empirically that we attain new state-of-the-art accuracy when training from scratch on CIFAR10, MNIST, MedMNIST, FashionMNIST, and SVHN across all privacy budgets evaluated. Notably, when implementing $(\epsilon, \delta)$-differential privacy with $\delta=10^{-5}$, we improve the prior state-of-the-art accuracy from $78.37\%$ to $88.17\%$ at $\epsilon=4$ on CIFAR10, and our approach has $82.96\%$ accuracy even for $\epsilon=1$, which significantly outperforms prior work.
Figures
Reference graph
Works this paper leans on
-
[1]
Abadi, A
M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC con- ference on computer and communications security, pages 308–318,
2016
-
[10]
H. Xue, B. Liu, M. Ding, T. Zhu, D. Ye, L. Song, and W. Zhou. Dp-image: Differential privacy for image data in feature space.arXiv preprint arXiv:2103.07073,
-
[12]
S. Zagoruyko and N. Komodakis. Wide residual networks.arXiv preprint arXiv:1605.07146,
-
[2008]
X. Wang, Y. Peng, L. Lu, Z. Lu, M. Bagheri, and R. M. Summers. Chestx-ray8: Hospital- scale chest x-ray database and benchmarks on weakly-supervised classification and local- ization of common thorax diseases. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 2097–2106,
2097
-
[2014]
D. P. Kingma and J. Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980,
-
[2015]
Ganju, Q
K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. InProceed- ings of the 2018 ACM SIGSAC conference on computer and communications security, pages 619–633,
2018
-
[2016]
F. A. H¨ olzl, D. Rueckert, and G. Kaissis. Bridging the gap: Differentially private equivariant deep learning for medical image analysis.arXiv preprint arXiv:2209.04338,
-
[2017]
I. Mironov, K. Talwar, and L. Zhang. R´ enyi differential privacy of the sampled gaussian mechanism.arXiv preprint arXiv:1908.10530,
Pith/arXiv arXiv 1908
-
[2019]
31 Rao, Hawkins, Benvenuti and Hale H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.arXiv preprint arXiv:1708.07747,
-
[2021]
S. De, L. Berrada, J. Hayes, S. L. Smith, and B. Balle. Unlocking high-accuracy differentially private image classification through scale.arXiv preprint arXiv:2204.13650,
-
[2023]
A. Yousefpour, I. Shilov, A. Sablayrolles, D. Testuggine, K. Prasad, M. Malek, J. Nguyen, S. Ghosh, A. Bharadwaj, J. Zhao, G. Cormode, and I. Mironov. Opacus: User-friendly differential privacy library in PyTorch.arXiv preprint arXiv:2109.12298,
-
[2024]
Netzer, T
30 End-to-End Differential Privacy in Training Deep Neural Network Classifiers Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng. Reading digits in natural images with unsupervised feature learning. InNIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011,
2011
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.