Pith. sign in

REVIEW 4 major objections 6 minor 25 references

Efficient Differentially Private Fine-Tuning of LLMs via Reinforcement Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read RLDP claims that the privacy-utility trade-off of differentially private LLM fine-tuning can be softened by a reinforcement-learning controller that adaptively sets per-adapter clipping radii and Gaussian noise while preserving the formal…

desk verdict Novel and empirically broad RL-for-DP fine-tuning paper whose advertised (ε,δ) guarantee is not supported by its own privacy appendix. read the letter →

arxiv 2507.22565 v1 pith:2R4SERMQ submitted 2025-07-30 cs.LG cs.AIcs.CL

Afshin Khadangi , Amir Sartipi , Igor Tchappi , Ramin Bahmani , Gilbert Fridgen This is my paper
classification cs.LGcs.AIcs.CL
keywords differentialprivacyDP-SGDreinforcementlearningsoftactor-criticLLMfine-tuningLoRAprivacy-utilitytrade-offadaptiveclipping
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that differentially private fine-tuning of large language models is better treated as a closed-loop control problem than as a fixed recipe: instead of hard-coding global clipping and noise hyperparameters, a reinforcement-learning agent observes the training dynamics and continuously adjusts per-LoRA-adapter clipping thresholds and the global Gaussian noise multiplier. The agent, a soft actor-critic hyper-policy trained online, learns to spend the privacy budget on the parameters and phases where it helps most. Across more than 1,600 ablation runs on GPT2-small, Llama-1B, Llama-3B, and Mistral-7B, the paper reports a 1.3-30.5% perplexity reduction (mean 5.4%) and a 5.6% average downstream utility gain under the same $(\varepsilon,\delta)$ DP contract, reaching each baseline's final utility after 13-43% of the optimizer steps. It also reports equal or lower success for membership-inference and canary-extraction attacks. If this holds, practitioners could get more accurate private models for the same privacy budget and much less compute.

What carries the argument

The load-bearing object is the SAC hyper-policy acting on a twelve-statistic state vector and producing $(n+1)$-dimensional actions, where $n$ is the number of LoRA adapter pairs: per-adapter log-clip updates plus a global log-noise update. The reward is the log of one plus the ratio of utility improvement to privacy-cost increment, clamped below to avoid extreme values, and the Gaussian-DP accountant records the cumulative privacy loss per step with the actual parameters used. LoRA adapters, low-rank update matrices attached to attention projections, shrink the trainable parameter surface and define the granularity at which pairwise clipping is applied. The mechanism that carries the argument is the learned curriculum: early in training the controller widens clip radii and raises noise to preserve gradients during bootstrap, then tightens radii and decays noise as the ledger approaches exhaustion.

What would settle it

Take one training run and treat the released state statistics—per-sample gradient norms, quartiles, Fisher moments, and micro-batch perplexity—as part of the mechanism's output; compute their exact sensitivity and add the corresponding privacy cost to the accountant. If the cumulative $\epsilon$ exceeds the target for any adjacent pair, the claim that RLDP honors the same $(\varepsilon,\delta)$ contract is refuted without even probing attacks.

Watch

Extended reading notes

Core claim

RLDP's central claim is that DP-SGD's clip radius $C$ and noise multiplier $\sigma$ need not be static, global constants; they can be the actions of an online reinforcement-learning policy that reads a rich state of training statistics and maximizes a reward that trades incremental utility against incremental privacy cost. The framework defines the DP fine-tuning loop as an MDP whose state stacks gradient-norm quartiles, gradient dispersion, Fisher-information moments, skewness, kurtosis, a perplexity-based utility proxy, and the accumulated privacy ledger; the action is a vector of per-adapter log-clip adjustments plus a global log-noise adjustment. A soft actor-critic policy is trained concurrently with the language model, and the Gaussian-DP accountant is updated per step with the actual parameters used. The paper's experimental conclusion is a clean sweep: in all 40 model-budget settings RLDP matches or beats the best of seven baselines in held-out perplexity, with the largest gains at the tightest privacy budgets, and a Gaussian accountant verifies the reported $(\varepsilon,\delta)$ contract.

Load-bearing premise

The load-bearing premise is that the SAC controller's state is a post-processing of the DP-SGD output; however, the state vector is built from raw per-sample gradient norms and clean micro-batch perplexity that are released without added noise, so if those exact statistics are not themselves protected by the DP mechanism, the claimed $(\varepsilon,\delta)$ contract is not established.

Editorial extensions

If this is right

  • If RLDP is right, a fixed $(\varepsilon,\delta)$ budget buys more utility than any static or global clipping schedule among the tested baselines; the typical fine-tune improves by about 5% perplexity at no measured privacy cost.
  • The reported 71% average reduction in optimizer steps means private fine-tuning can be run several times faster and with less energy on the same hardware; the paper quantifies about 135 minutes saved per Mistral-7B run.
  • The controller's learned two-phase schedule implies that adaptive, budget-aware noise and clip schedules are a viable way to spend DP budget, not merely a tuning nuisance.
  • Empirical attack results, if reproducible, would mean the utility gain does not come with extra memorization; membership-inference AUC and canary Jaccard similarities stay at or below baseline levels.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to replace the perplexity utility proxy in the reward with a task-specific metric; if the learned curriculum changes substantially, the controller is optimizing the proxy rather than the deployment objective.
  • Distilling the learned schedule into a fixed, offline rule would let a practitioner capture most of the gain without running an RL controller during fine-tuning; the paper's traces of clip and noise versus step provide the data to test this.
  • The same closed-loop formulation is a natural candidate for full-parameter fine-tuning or federated DP training, where per-client or per-layer privacy decisions could be made by a similar policy, although the action-space dimension would be much larger.
  • The paper trains only on one pseudo-clinical Diabetes corpus; whether the reported gains transfer to code, multilingual, or long-context data is untested and can be checked by reproducing the same sweep on another domain.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes RLDP, a framework that casts differentially private fine-tuning of LLMs as a closed-loop control problem. A soft actor-critic (SAC) hyper-policy is trained online and continuously adjusts per-adapter LoRA gradient clipping thresholds and the global Gaussian noise multiplier. The paper claims that across more than 1,600 ablations on GPT2-small, Llama-1B, Llama-3B, and Mistral-7B, RLDP reduces perplexity by 1.3-30.5% (mean 5.4%), matches or beats baseline final utility in 13-43% of the gradient-update budget, and does so under the same (epsilon, delta)-DP contract as seven baselines. Appendix B provides a formal privacy proof via a Gaussian-DP accountant, RDP composition, and a post-processing argument for the SAC controller.

Significance. If the central claim were supported, the paper would be significant: learning to adapt clipping and noise online could improve the utility and sample efficiency of DP fine-tuning without weakening the formal privacy guarantee. The empirical effort is also substantial, with four model families, multiple privacy budgets, reported membership-inference and canary-extraction audits, and promised code and logs. These strengths do not compensate for the unsupported privacy guarantee, however, because every utility and efficiency claim is framed as holding under the same (epsilon, delta)-DP contract as the baselines. The formal guarantee is load-bearing, and the proof as written does not establish it.

major comments (4)
  1. [§2.4 / Algorithm 1 / Appendix B.6] The post-processing argument in Corollary B.12 assumes the SAC controller observes only the noised gradients G-hat_t and the accountant ledger (epsilon_t, delta_t). In the actual algorithm, the state vector s_t assembled at Algorithm 1 step 18 (and detailed in §2.4) contains raw per-sample joint gradient norms nu_i^(b) (Eq. 4), micro-batch perplexity/loss (Eq. 9), Fisher moments, skewness, and kurtosis, all computed from the private batch before noise is added. These raw statistics are not outputs of the Gaussian mechanism, so Theorem B.11 does not cover the controller's access to them. Because the controller uses s_t to choose the clip radii C_{i,t+1} and noise multiplier sigma_{t+1} that determine all subsequent released updates, the mechanism is adaptive with data-dependent privacy parameters; a valid proof would have to sanitize s_t under its own privacy budget or analyze the action-dependent mechanism as an adaptive composition, and neither is present. The claim that RLDP honors the same (epsilon, delta) contract as the baselines is therefore unsupported.
  2. [§2.3, Eq. (6) and Appendix B.2] Lemma B.2 states that the aggregated clipped gradient has l2-sensitivity Delta_2 = 2C_i, and Lemma B.4 requires Gaussian noise with standard deviation sigma times Delta_2, i.e., 2 sigma C_i per coordinate. However, Eq. (6) adds noise N(0, sigma^2 C_i^2 I), whose per-coordinate standard deviation is sigma C_i. Under the stated sensitivity bound the added noise is too small by a factor of two. If the intended sensitivity is C_i, as is standard under Poisson add/remove adjacency, then Lemma B.2 is incorrect. Either way, the proof does not establish that the noise in Eq. (6) yields the privacy loss reported by the accountant.
  3. [§2.3, Eq. (7) and Theorem B.13] The GDP accountant formula in Eq. (7), epsilon_t(delta) = F^{-1}_{N(0,1)}( q sqrt(t) (e^{1/sigma} - 1), delta ), is not the standard GDP accountant of Dong et al.; the correct expression involves e^{1/sigma^2} and a non-centrality parameter of the form mu = q sqrt(t)(e^{1/sigma^2} - 1). As written, the formula cannot produce a valid (epsilon, delta) conversion. Moreover, applying a single CLT-style formula with total step count t and the current sigma is not justified when sigma_t and C_{i,t} vary over time; the accountant would need to compose per-step RDP costs. Thus the enforcement of the total budget in Theorem B.13 step 4 is not supported.
  4. [Appendix B.5, Theorem B.5] The proof of Poisson subsampling amplification uses the inequality p_not, p_plus <= p_prime, where p_not and p_plus are conditional probabilities of the output set and p_prime is the unconditional probability under the neighboring dataset D'. This inequality is false in general: for q = 1/2, p_not = 1, p_plus = 0 gives p_prime = 1/2, so p_not > p_prime. The amplification bound for a base mechanism with delta_0 > 0 therefore needs a correct proof or a citation rather than the argument given. Since the per-step privacy cost in the composition depends on this lemma, the appendix's chain from Lemma B.6 to Theorem B.13 is not sound.
minor comments (6)
  1. [Abstract vs. Table 3] The abstract states that RLDP reaches each baseline's final utility after 13-43% of the gradient-update budget, but Table 3 reports a maximum of 36%; please align the numbers.
  2. [§4.4 vs. Eq. (10)] Section 4.4 reports median clip radii of about 2.6 and 5.4 for GPT2 at epsilon = 0.5, which contradicts Eq. (10) and Algorithm 1 line 21 that cap C_i at 1.0; please clarify whether Figures 5-8 plot the actual clamp radius or some other quantity.
  3. [Tables 4-9] Tables 4-9 use the labels RLDPH and RLDPL without defining them in the main text; please define these variants.
  4. [Eq. (4)] Equation (4) contains a malformed radical/arrow expression; please clean up the notation.
  5. [Table 9] Table 9's Jaccard4 values are scaled by 1e-7, but this scaling is stated only in the table title; please state it in the caption as well.
  6. [§4.3] Section 4.3 says '160 model-budget-seed runs,' but 4 models x 5 budgets x 3 seeds equals 120; please reconcile the count.

Circularity Check

1 steps flagged · score 6.0 of 10

RLDP's privacy proof is self-definitional: the post-processing corollary defines the SAC controller as seeing only noised gradients and the ledger, while the actual state consumes raw per-sample gradient norms and micro-batch loss.

  1. self definitional [§2.4 State space S; Appendix B.6 Corollary B.12; Theorem B.13 step 3]
    "At DP stept we construct st ∈ S = Rds by concatenating twelve statistical summaries of the most recent micro-batch ... 1. Gradient-norm quartiles ... computed over the per-sample joint norms ν(b)i of Eq. 4. ... 5. Batch loss ℓt (cross-entropy before DP noise). [Corollary B.12] Suppose the SAC controller’s normalization, encoding, action sampling, and updates ... are computed by a function ft( ˆG1:t, ϵ1:t, δ1:t, r) 7→ {C j t+1, σt+1}, where r is public randomness."

    The theorem's DP claim is reduced to the assumption that the controller only post-processes DP outputs (Ĝ, ε, δ). But the real controller state st is assembled from raw private statistics—per-sample joint norms ν_i^(b) (Eq. 4), micro-batch PPL/loss (Eq. 9), and Fisher moments—computed before Gaussian noise. These are neither outputs of M nor accounted for by the Gaussian mechanism, so Corollary B.12's post-processing conclusion does not apply to Algorithm 1. The proof therefore establishes DP for a controller-by-definition that sees only noised gradients, not for the RLDP algorithm that actually runs, making the 'zero extra privacy cost' step true by construction rather than by analysis.

full rationale

The utility and efficiency claims are not circular: RLDP is evaluated on a held-out split against seven external baselines under identical data splits and accountant settings, and the speed-up metric is computed from measured crossing points rather than from fitted parameters. There is no load-bearing self-citation chain; the appendix proofs are internally presented. The circularity is confined to the privacy guarantee. Corollary B.12 and Theorem B.13 define the SAC controller as a post-processing function of only the noised gradients and the accountant ledger, then conclude that adaptation consumes no extra privacy budget. Algorithm 1 step 12 and §2.4 instead feed raw per-sample gradient norms, micro-batch loss/perplexity, and Fisher moments into the controller's state. These raw statistics are not outputs of the Gaussian mechanism, so the post-processing conclusion is assumed by definition rather than derived for the algorithm that actually runs. An additional correctness gap—Lemma B.2 bounding sensitivity by 2C while Eq. (6) adds noise with standard deviation σC_i—is an internal inconsistency rather than a circular reduction, so it is not counted as a separate circular step. Because the central 'same (ε,δ)-DP contract' claim rests on this self-definitional proof step, the score is 6; the empirical utility comparisons themselves remain independent of this flaw.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The central claim rests on the privacy accountant and the post-processing argument. The ledger shows that several assumptions are internally inconsistent (sensitivity 2C vs sigma C noise, n-factor drop) or false (state as post-processing), which is why the formal DP guarantee fails.

free parameters (5)
  • Initial per-adapter clip threshold C_i = 0.1
    Hand-chosen in section 3.1; determines initial sensitivity of the per-adapter clipping mechanism.
  • SAC entropy temperature alpha = 0.04
    Fixed by hand in section 3.1; controls exploration-exploitation balance of the hyper-policy.
  • RL decision interval T_RL and per-epsilon SAC batch size B_SAC = T_RL=112 or 96; B_SAC selected per epsilon in section 4.5
    Chosen by grid search over validation performance; the headline results use the selected configurations.
  • Reward lower bound R_max = unspecified
    Used in Eq. (20) but never given a numeric value in the manuscript.
  • Base noise multiplier sigma_0 = found by binary search per budget
    Calibrated so the GDP accountant reaches the target epsilon under the assumed sensitivity; the calibration is only valid if the accountant's sensitivity model is correct.
assumptions (6)
  • standard math Gaussian mechanism with sensitivity Delta and noise N(0, sigma^2 Delta^2 I) gives RDP rho = alpha / (2 sigma^2)
    Invoked in Lemma B.6 and used throughout the accountant; standard only when the noise covariance matches the stated sensitivity.
  • standard math Poisson subsampling amplifies the base Gaussian mechanism as in Lemma B.7
    Standard subsampled RDP bound, but requires the base mechanism's sensitivity and noise to be correctly specified.
  • domain assumption The GDP accountant formula Eq. (7) remains valid when sigma and C_i change per step
    Eq. (7) is derived for a constant sigma over t steps; the paper updates it with actual per-step parameters, but heterogeneous noise requires different composition.
  • domain assumption The full gradient's L2 sensitivity is bounded by each C_i with no n-factor for the number of adapters
    Theorem B.10 composes T steps with per-step RDP rho_1 without the n-adapter multiplier that B.7 Step 2 derives; this understates privacy loss.
  • ad hoc to paper The SAC controller's state is a post-processing of DP outputs (noised gradients and ledger)
    Appendix B.6 Corollary B.12 asserts this, but sections 2.4 and Algorithm 1 include raw per-sample gradient norms and micro-batch perplexity in the state, so the premise is false.
  • domain assumption Add/remove adjacency is the intended neighboring relation for DP-SGD
    Definition B.1 says datasets differ in exactly one record, usually replacement, but the accountant and the sensitivity derivation require add/remove adjacency; the paper never disambiguates.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Differentially Private Fine-Tuning of LLMs via Reinforcement Learning." pith.science (2026). https://pith.science/paper/2R4SERMQ

@misc{pith2026250722565,
  author       = {Pith},
  title        = {Pith review of: Efficient Differentially Private Fine-Tuning of LLMs via Reinforcement Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2R4SERMQ}},
  note         = {Machine review of arXiv:2507.22565}
}
abstract

The tension between data privacy and model utility has become the defining bottleneck for the practical deployment of large language models (LLMs) trained on sensitive corpora including healthcare. Differentially private stochastic gradient descent (DP-SGD) guarantees formal privacy, yet it does so at a pronounced cost: gradients are forcibly clipped and perturbed with noise, degrading sample efficiency and final accuracy. Numerous variants have been proposed to soften this trade-off, but they all share a handicap: their control knobs are hard-coded, global, and oblivious to the evolving optimization landscape. Consequently, practitioners are forced either to over-spend privacy budget in pursuit of utility, or to accept mediocre models in order to stay within privacy constraints. We present RLDP, the first framework to cast DP optimization itself as a closed-loop control problem amenable to modern deep reinforcement learning (RL). RLDP continuously senses rich statistics of the learning dynamics and acts by selecting fine-grained per parameter gradient-clipping thresholds as well as the magnitude of injected Gaussian noise. A soft actor-critic (SAC) hyper-policy is trained online during language model fine-tuning; it learns, from scratch, how to allocate the privacy budget where it matters and when it matters. Across more than 1,600 ablation experiments on GPT2-small, Llama-1B, Llama-3B, and Mistral-7B, RLDP delivers perplexity reductions of 1.3-30.5% (mean 5.4%) and an average 5.6% downstream utility gain. RLDP reaches each baseline's final utility after only 13-43% of the gradient-update budget (mean speed-up 71%), all while honoring the same ($\epsilon$, $\delta$)-DP contract and exhibiting equal or lower susceptibility to membership-inference and canary-extraction attacks.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 11 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308--318, 2016

    2016

  3. [3]

    Differentially private learning with adaptive clipping

    Galen Andrew, Om Thakkar, Brendan McMahan, and Swaroop Ramaswamy. Differentially private learning with adaptive clipping. Advances in Neural Information Processing Systems, 34: 0 17455--17466, 2021

    2021

  4. [4]

    Automatic clipping: Differentially private deep learning made easier and stronger

    Zhiqi Bu, Yu-Xiang Wang, Sheng Zha, and George Karypis. Automatic clipping: Differentially private deep learning made easier and stronger. Advances in Neural Information Processing Systems, 36: 0 41727--41764, 2023

    work page 2023

  5. [5]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897--1914. IEEE, 2022

    work page 2022

  6. [6]

    Albert q

    Devendra Singh Chaplot. Albert q. jiang, alexandre sablayrolles, arthur mensch, chris bamford, devendra singh chaplot, diego de las casas, florian bressand, gianna lengyel, guillaume lample, lucile saulnier, l \'e lio renard lavaud, marie-anne lachaux, pierre stock, teven le scao, thibaut lavril, thomas wang, timoth \'e e lacroix, william el sayed. arXiv ...

    arXiv

  7. [7]

    Multi-step reinforcement learning: A unifying algorithm

    Kristopher De Asis, J Hernandez-Garcia, G Holland, and Richard Sutton. Multi-step reinforcement learning: A unifying algorithm. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018

    work page 2018

  8. [8]

    Gaussian differential privacy

    Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84 0 (1): 0 3--37, 2022

    work page 2022

Show all 25 references
  1. [9]

    The algorithmic foundations of differential privacy

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9 0 (3--4): 0 211--407, 2014

    2014

  2. [10]

    Geoclip: Geometry-aware clipping for differentially private sgd

    Atefeh Gilani, Naima Tasnim, Lalitha Sankar, and Oliver Kosut. Geoclip: Geometry-aware clipping for differentially private sgd. arXiv preprint arXiv:2506.06549, 2025

    2025

  3. [11]

    The llama 3 herd of models

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  4. [12]

    Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor

    Tuomas Haarnoja, Aurick Zhou, Pieter Abbeel, and Sergey Levine. Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor. In International conference on machine learning, pages 1861--1870. Pmlr, 2018

    2018

  5. [13]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1 0 (2): 0 3, 2022

    2022

  6. [14]

    Large language models can be strong differentially private learners

    Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. arXiv preprint arXiv:2110.05679, 2021

    2021 arXiv

  7. [15]

    Wind power forecasting considering data privacy protection: A federated deep reinforcement learning approach

    Yang Li, Ruinong Wang, Yuanzheng Li, Meng Zhang, and Chao Long. Wind power forecasting considering data privacy protection: A federated deep reinforcement learning approach. Applied Energy, 329: 0 120291, 2023

    2023

  8. [16]

    Differentially private low-rank adaptation of large language model using federated learning

    Xiao-Yang Liu, Rongyi Zhu, Daochen Zha, Jiechao Gao, Shan Zhong, Matt White, and Meikang Qiu. Differentially private low-rank adaptation of large language model using federated learning. ACM Transactions on Management Information Systems, 16 0 (2): 0 1--24, 2025

    2025

  9. [17]

    R \'e nyi differential privacy

    Ilya Mironov. R \'e nyi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263--275. IEEE, 2017

    2017

  10. [18]

    Scalable private learning with pate

    Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and \'U lfar Erlingsson. Scalable private learning with pate. arXiv preprint arXiv:1802.08908, 2018

    2018 arXiv

  11. [19]

    Adaclip: Adaptive clipping for private sgd

    Venkatadheeraj Pichapati, Ananda Theertha Suresh, Felix X Yu, Sashank J Reddi, and Sanjiv Kumar. Adaclip: Adaptive clipping for private sgd. arXiv preprint arXiv:1908.07643, 2019

    1908 arXiv

  12. [20]

    Efficient hyperparameter optimization for differentially private deep learning

    Aman Priyanshu, Rakshit Naidu, Fatemehsadat Mireshghallah, and Mohammad Malekzadeh. Efficient hyperparameter optimization for differentially private deep learning. arXiv preprint arXiv:2108.03888, 2021

    2021 arXiv

  13. [21]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1 0 (8): 0 9, 2019

    2019

  14. [22]

    Dc-sgd: Differentially private sgd with dynamic clipping through gradient norm distribution estimation

    Chengkun Wei, Weixian Li, Gong Chen, and Wenzhi Chen. Dc-sgd: Differentially private sgd with dynamic clipping through gradient norm distribution estimation. IEEE Transactions on Information Forensics and Security, 2025

    2025

  15. [23]

    Differentially private learning with per-sample adaptive clipping

    Tianyu Xia, Shuheng Shen, Su Yao, Xinyi Fu, Ke Xu, Xiaolong Xu, and Xing Fu. Differentially private learning with per-sample adaptive clipping. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 10444--10452, 2023

    2023

  16. [24]

    A concurrent federated reinforcement learning for iot resources allocation with local differential privacy

    Wei Zhou, Tianqing Zhu, Dayong Ye, Wei Ren, and Kim-Kwang Raymond Choo. A concurrent federated reinforcement learning for iot resources allocation with local differential privacy. IEEE Internet of Things Journal, 11 0 (4): 0 6537--6550, 2023

    2023

  17. [25]

    Poission subsampled r \'e nyi differential privacy

    Yuqing Zhu and Yu-Xiang Wang. Poission subsampled r \'e nyi differential privacy. In International Conference on Machine Learning, pages 7634--7642. PMLR, 2019

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.