Pith. sign in

REVIEW 4 major objections 6 minor 28 references

An Interactive Framework for Implementing Privacy-Preserving Federated Learning: Experiments on Large Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A fixed-minibatch privacy accountant can replace the standard variable-batch RDP method in federated fine-tuning of BERT, losing only 1.33% average accuracy at epsilon=10 while keeping memory use constant.

desk verdict A useful first application of fixed-minibatch DP accounting to federated fine-tuning, but the RDP baseline is likely miscalibrated and the headline accuracy gaps don't hold at equal privacy. read the letter →

arxiv 2502.08008 v2 pith:FAULOXVZ submitted 2025-02-11 cs.LG cs.CR

Kasra Ahmadi , Rouzbeh Behnia , Reza Ebrahimi , Mehran Mozaffari Kermani , Jeremiah Birrell , Jason Pacheco , Attila A Yavuz This is my paper · ORCID
classification cs.LGcs.CR
keywords differentialprivacyfederatedlearningfixed-sizeminibatchRényiprivacy-utilitytrade-offBERTfine-tuningGLUEbenchmarkpractitioner
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces FLIP, a framework that puts a human privacy practitioner in charge of choosing differential-privacy and federated-learning parameters before fine-tuning a large language model. Its main technical claim is that a fixed-minibatch privacy accountant, FSRDP, can replace the standard variable-batch RDP accountant during federated fine-tuning of BERT, holding memory usage constant across training rounds while losing only 1.33 percentage points of accuracy on average at $\epsilon = 10$ and 1.9 points at $\epsilon = 6$ relative to RDP. The experiments span three GLUE tasks and four data-partitioning policies with four clients, and show that data distribution and accountant choice interact with privacy level. If the claim holds, resource-limited devices can join private federated fine-tuning without out-of-memory failures and with only a small utility penalty.

What carries the argument

The machinery that carries the argument is the FSRDP privacy accountant, a method for computing Rényi differential privacy guarantees for DP-SGD when minibatches are drawn with a fixed size rather than by Poisson subsampling. The paper uses FSRDP to pre-compute the Gaussian noise standard deviation needed for a target privacy cost $(\epsilon, \delta)$, injects that noise into client-side clipped gradients via DP-SGD after each federated training round, and measures the resulting accuracy. The key property FSRDP supplies is constant memory usage across training iterations, which the paper contrasts with the variable-size minibatches of RDP that can cause out-of-memory failures on low-end devices. The comparison is made concrete by Table III, which lists the required noise for each accountant, dataset, and partitioning policy at $\epsilon = 6$ and $\epsilon = 10$.

What would settle it

An independent computation of FSRDP noise for the exact configurations in Table III should reproduce the reported standard deviations; if it yields lower noise for the same $(\epsilon, \delta)$, or if a membership-inference audit of the fine-tuned models indicates an effective epsilon larger than the target (10 or 6), then the claimed privacy-utility trade-off would collapse. Alternatively, a controlled comparison of FLIP with and without practitioner input would test the framework's second claim about the value of human expertise.

Watch

Extended reading notes

Core claim

The paper's central claim is that FLIP is the first privacy-preserving federated learning framework to adopt a fixed-minibatch differential privacy accountant, FSRDP, in place of the Poisson-subsampling-based RDP accountant, and that this substitution costs an average of 1.33% accuracy at $\epsilon = 10$ and 1.9% at $\epsilon = 6$ compared with the RDP baseline. A supporting claim is that a privacy practitioner who selects privacy cost, batch size, and data-partition strategy based on application needs can reduce the accuracy gap to the non-private model from as much as 5% down to about 2%. The paper also argues that when privacy guarantees must extend to the replace-one adjacency relation, RDP would require roughly double the noise in Table III while FSRDP's listed noise already covers both add-remove and replace-one adjacency, so the utility advantage of RDP disappears in that setting. These claims are supported by fine-tuning BERT on QQP, QNLI, and SST2 under IID, Linear, Square, and Exponential client data partitions.

Load-bearing premise

The load-bearing premise is that the FSRDP accountant's pre-computed noise scales truly deliver the claimed $(\epsilon, \delta)$-differential privacy for the multi-round federated DP-SGD procedure under the add-remove adjacency relation, since the paper takes those noise values from reference [11] and does not independently verify them.

Editorial extensions

If this is right

  • Federated fine-tuning can be run with a fixed minibatch size and constant memory footprint, allowing phones and other low-end clients to participate without out-of-memory failures.
  • The average accuracy reduction of 1.33% at $\epsilon = 10$ and 1.9% at $\epsilon = 6$ relative to RDP is small enough that fixed-minibatch accounting is a practical drop-in replacement for many applications.
  • Data partitioning matters: with FSRDP at $\epsilon = 6$ and large datasets, IID partitions achieve the best accuracy, while with RDP, exponential partitions are best; practitioners need to know their data distribution to set parameters.
  • If a deployment requires protection under both add-remove and replace-one adjacency, FSRDP's pre-computed noise works as-is, whereas RDP would need roughly twice the noise, negating its accuracy advantage.
  • The privacy practitioner's parameter choices can reduce the gap to non-private accuracy from about 5% to about 2%, so interactive parameter tuning has measurable value in private federated fine-tuning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper never directly tests whether a human privacy practitioner outperforms a fixed heuristic; a natural experiment would compare FLIP to an automated rule that selects the same parameters from data-distribution statistics.
  • Because the memory-stability claim is demonstrated in a simulated single-GPU setting, a test on actual mobile hardware is needed to confirm that constant memory usage prevents real out-of-memory failures.
  • The reported accuracy decline in later training rounds under FSRDP suggests that an adaptive noise schedule could recover some utility loss; the paper mentions this possibility but does not evaluate it.
  • Combining Table III with the discussion in reference [11] implies that FSRDP becomes strictly preferable to RDP when both add-remove and replace-one adjacency must be satisfied, since FSRDP's noise does not change while RDP's would double.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes FLIP, an interactive framework for privacy-preserving federated learning that introduces a human privacy practitioner to select DP and FL parameters and adopts the FSRDP accountant to support fixed-size minibatches with constant memory usage. The authors fine-tune BERT-base (109M parameters) on three GLUE tasks (QQP, QNLI, SST2) with four clients and four data-partitioning policies, comparing non-private training, RDP, and FSRDP at epsilon=10 and epsilon=6. They report maximum accuracies over five federated rounds and noise-scale tables, and claim average accuracy reductions of 1.33% (epsilon=10) and 1.9% (epsilon=6) for FSRDP relative to RDP, with stable memory usage.

Significance. If the results are valid, the paper provides a useful empirical study of a practical deployment concern: variable-size minibatches in DP-SGD can cause memory instability on resource-constrained federated clients. The open-source implementation, the coverage of multiple datasets and partition policies, and the explicit comparison between two accountants are commendable. However, the central quantitative claim—that FSRDP achieves nearly the same accuracy as RDP at the same privacy level—depends on a valid RDP baseline, which the manuscript does not establish because the RDP runs appear to use fixed-size minibatches rather than the Poisson subsampling assumed by the RDP accountant. The human-practitioner component, a headline contribution, is not empirically evaluated. The paper's value is therefore conditional on a substantial revision that addresses the baseline validity and measurement rigor.

major comments (4)
  1. [Section 2.3, Section 4.1, Table III] The RDP baseline does not appear to satisfy the privacy guarantee attributed to it. Section 2.3 states that RDP's privacy amplification relies on subsampling, which in standard implementations (e.g., Opacus) is Poisson subsampling and produces random-size minibatches. Section 4.1, however, reports a fixed batch size of 550 and describes noise scaled by the standard deviation divided by 550, with no mention of a Poisson sampler. If the RDP runs used fixed-size minibatches without replacement, then the noise values in Table III for RDP are too low for the stated epsilon under the add-remove adjacency relation, and the actual privacy cost is larger than the nominal epsilon=6 or 10. Consequently, the reported average accuracy reductions of 1.33% and 1.9% are not measured at equal privacy. Please either run the RDP baseline with true Poisson subsampling, or use a fixed-size-valid accountant (e.g., Wang et al. or FSRDP) for the baseline, and recompute the comparison.
  2. [Section 4.2, Table I, Abstract] The accuracy results are reported as single numbers without error bars or multiple seeds. The differences between RDP and FSRDP are often one to two percentage points, which may be within run-to-run variability for fine-tuning BERT on these tasks. Moreover, the abstract's average accuracy reductions (1.33% for epsilon=10 and 1.9% for epsilon=6) do not match the values computed from Table I: a simple average of the 12 RDP-vs-FSRDP differences gives about 1.4% and 2.0% respectively. Please report means and standard deviations over at least three seeds, and correct the abstract numbers to match the reported tables.
  3. [Abstract, Section 4.1, Figure 1] The paper claims in the abstract and elsewhere to have 'achieved stable memory usage,' but no memory measurements are reported in the experiments. Figure 1, which illustrates the memory-stability property, appears to be taken from the FSRDP paper [11] without explicit attribution in the caption, and the current experiments do not measure memory consumption during federated training. Please either add empirical memory measurements in the FL setting or temper the claim to state that FSRDP offers a constant-memory property by design, as established in [11], rather than as a result demonstrated here.
  4. [Section 3.3, Section 4] The framework's key novelty—the integration of a human privacy practitioner—is not empirically validated. Section 3.3 describes the practitioner's role in choosing epsilon, batch size, and accountant, but Section 4 contains no experimental comparison between FLIP with and without practitioner input. The experiments only vary partition policies and accountants, which are pre-defined configurations rather than interactive human decisions. Please add an ablation that quantifies the effect of the practitioner's involvement, or explicitly reframe this component as a design proposal that is not evaluated in the current study.
minor comments (6)
  1. [Section 2, first paragraph] There is a typo in the opening sentence: 'we reivew We examine' should be corrected to a single clean sentence such as 'We examine three key areas of the literature.'
  2. [Section 1.1] The phrase 'fine-tuneing' should be 'fine-tuning'.
  3. [Section 4.1] The noise injection description is ambiguous: 'scaled by the standard deviation divided by the batch size (550)' should clarify the exact DP-SGD formula used, including whether the clipping norm C appears in the numerator and whether noise is added to the summed or averaged gradient.
  4. [References] In Section 2.3, the citation 'RDP [12], [21]' incorrectly groups Abadi et al. [21] with the RDP definition; RDP should be attributed solely to Mironov [12], while [21] is the DP-SGD paper.
  5. [Title and Abstract] BERT-base has 109 million parameters and is often not considered a 'large language model' in the current literature; consider using 'pre-trained transformer' or providing a justification for the terminology.
  6. [Section 4.1] The paper says it uses 'the GLUE dataset' but only evaluates three of its tasks (QQP, QNLI, SST2); please state explicitly 'three GLUE tasks' to avoid overgeneralization.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported accuracy reductions are measured from training runs, not constructed from FSRDP's own accounting equations.

full rationale

The central quantitative claims, such as 'an average accuracy reduction of 1.33% for epsilon=10 and 1.9% for epsilon=6,' are computed from the measured accuracies in Table I, which are genuine experimental outcomes of fine-tuning BERT on GLUE under the RDP and FSRDP noise schedules. The paper does not fit FSRDP's noise scales to the accuracy numbers, nor does it define accuracy in terms of privacy cost. FSRDP's noise values and fixed-memory property are imported from the self-cited prior work [11], but that work is a parameter-free mathematical result about fixed-size subsampling RDP bounds, not an empirical fit to the present experiments; the self-citation is therefore supporting evidence, not a definitional reduction. The author overlap with [11] is real, but the cited theorem's stated assumptions do not include the present paper's fitted values, so this is not a circular load-bearing chain. The remaining concern that the RDP baseline may have been run with fixed-size batches while RDP's amplification analysis assumes Poisson subsampling is a correctness or experimental-design issue, not a circularity of the derivation chain. No equation in the paper equates the claimed prediction to its input by construction, so the appropriate score is 0.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entity. Its free parameters are standard DP-SGD hyperparameters chosen by hand, and its axioms center on the correctness of the self-cited FSRDP accountant and standard FL assumptions. The 'privacy practitioner' is a conceptual role, not an invented entity with independent evidence requirements.

free parameters (5)
  • Clipping norm C = 3
    Chosen by hand for all experiments; no sensitivity analysis is provided, and it directly affects the noise magnitude in DP-SGD.
  • Batch size = 550
    Set by the authors to fit within memory; not tuned, and it determines the noise scaling factor in the experiment.
  • Learning rate = 2e-5
    Standard for BERT fine-tuning, chosen without exploration in the DP setting.
  • Number of rounds = 5
    A small fixed number; the paper notes accuracy may decline in later rounds, but no analysis of convergence is given.
  • Number of clients = 4
    A small homogeneous client count; scaling behavior is not studied.
assumptions (3)
  • domain assumption FSRDP accountant correctly computes the privacy loss (epsilon, delta) for fixed-size minibatches under add-remove adjacency.
    The paper relies on the self-cited FSRDP paper [11] for noise levels and the memory-stability property, without independent verification in this work.
  • domain assumption DP-SGD noise addition per client round composes to the claimed overall privacy guarantee in the federated setting.
    The framework adds noise on the client side and assumes the accountant's composition holds across rounds and clients.
  • domain assumption FedAvg convergence applies to the fine-tuning of BERT with the chosen hyperparameters.
    The paper assumes that 5 rounds of FedAvg on 4 clients with batch size 550 yields a meaningful model for comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An Interactive Framework for Implementing Privacy-Preserving Federated Learning: Experiments on Large Language Models." pith.science (2026). https://pith.science/paper/FAULOXVZ

@misc{pith2026250208008,
  author       = {Pith},
  title        = {Pith review of: An Interactive Framework for Implementing Privacy-Preserving Federated Learning: Experiments on Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FAULOXVZ}},
  note         = {Machine review of arXiv:2502.08008}
}
abstract

Federated learning (FL) enhances privacy by keeping user data on local devices. However, emerging attacks have demonstrated that the updates shared by users during training can reveal significant information about their data. This has greatly thwart the adoption of FL methods for training robust AI models in sensitive applications. Differential Privacy (DP) is considered the gold standard for safeguarding user data. However, DP guarantees are highly conservative, providing worst-case privacy guarantees. This can result in overestimating privacy needs, which may compromise the model's accuracy. Additionally, interpretations of these privacy guarantees have proven to be challenging in different contexts. This is further exacerbated when other factors, such as the number of training iterations, data distribution, and specific application requirements, can add further complexity to this problem. In this work, we proposed a framework that integrates a human entity as a privacy practitioner to determine an optimal trade-off between the model's privacy and utility. Our framework is the first to address the variable memory requirement of existing DP methods in FL settings, where resource-limited devices (e.g., cell phones) can participate. To support such settings, we adopt a recent DP method with fixed memory usage to ensure scalable private FL. We evaluated our proposed framework by fine-tuning a BERT-based LLM model using the GLUE dataset (a common approach in literature), leveraging the new accountant, and employing diverse data partitioning strategies to mimic real-world conditions. As a result, we achieved stable memory usage, with an average accuracy reduction of 1.33% for $\epsilon = 10$ and 1.9% for $\epsilon = 6$, when compared to the state-of-the-art DP accountant which does not support fixed memory usage.

Figures

Figures reproduced from arXiv: 2502.08008 by the authors.

Figure 1
Figure 1. Comparison of FSRDP and RDP accountant memory usage with a batch size of 120 and a dataset size of 50,000 per training epoch [11]. Differentially Private Stochastic Gradient Descent (DP￾SGD) [21] ensures differential privacy by introducing noise during the training process of machine learning models. DP￾SGD modifies the standard mini-batch SGD algorithm by adding two additional steps: • Gradient Clipping: For each p… view at source ↗
Figure 2
Figure 2. The data flow architecture for the proposed framework [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. QQP Accuracy Across 5 Rounds with ϵ = 10 [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: QNLI Accuracy Across 5 Rounds with ϵ = 10 4.3. Discussion Our research is the first in FL-DP to highlight the critical role of federated learning and differential privacy parame￾ters, as well as their combined effect on model privacy and utility. FLIP integrates a huma…
Figure 5
Figure 5. Figure 5: SST2 Accuracy Across 5 Rounds with ϵ = 10 privacy cost, data distribution, and client selection strategies affect model performance. FLIP is also the first privacy￾preserving framework to address the memory constraints of mobile devices in an FL setting by employing a …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 22 canonical work pages

  1. [11]

    Differentially pri- vate stochastic gradient descent with fixed-size minibatches: Tighter RDP guarantees with or without replacement,

    J. Birrell, M. Ebrahimi, R. Behnia, and J. Pacheco, “Differentially pri- vate stochastic gradient descent with fixed-size minibatches: Tighter RDP guarantees with or without replacement,” in The Thirty-eighth Annual Conference on Neural Information Processing Systems , 2024

    work page 2024

  2. [1]

    When moe meets llms: Parameter efficient fine-tuning for multi-task medical applications,

    Q. Liu, X. Wu, X. Zhao, Y . Zhu, D. Xu, F. Tian, and Y . Zheng, “When moe meets llms: Parameter efficient fine-tuning for multi-task medical applications,” in Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval , pp. 1104–1114, 2024

    work page 2024

  3. [2]

    Reconstructing training data with informed adversaries,

    B. Balle, G. Cherubin, and J. Hayes, “Reconstructing training data with informed adversaries,” in 2022 IEEE Symposium on Security and Privacy (SP) , pp. 1138–1156, IEEE, 2022

    work page 2022

  4. [3]

    Bounding training data reconstruction in dp-sgd,

    J. Hayes, B. Balle, and S. Mahloujifar, “Bounding training data reconstruction in dp-sgd,” Advances in Neural Information Processing Systems, vol. 36, 2024

    work page 2024

  5. [4]

    Machine learning with membership privacy using adversarial regularization,

    M. Nasr, R. Shokri, and A. Houmansadr, “Machine learning with membership privacy using adversarial regularization,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communica- tions security, pp. 634–646, 2018

    work page 2018

  6. [5]

    Privacy risk in machine learning: Analyzing the connection to overfitting,

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st computer security foundations symposium (CSF) , pp. 268– 282, IEEE, 2018

    work page 2018

  7. [6]

    The secret sharer: Evaluating and testing unintended memorization in neural networks,

    N. Carlini, C. Liu, ´U. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural networks,” in 28th USENIX security symposium (USENIX security 19), pp. 267–284, 2019

    work page 2019

  8. [7]

    Ex- tracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, et al. , “Ex- tracting training data from large language models,” in 30th USENIX Security Symposium (USENIX Security 21) , pp. 2633–2650, 2021

    work page 2021

Show all 28 references
  1. [8]

    Calibrating noise to sensitivity in private data analysis,

    C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating noise to sensitivity in private data analysis,” in Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pp. 265–284, Springer, 2006

    2006

  2. [9]

    Limits of computa- tional differential privacy in the client/server setting,

    A. Groce, J. Katz, and A. Yerukhimovich, “Limits of computa- tional differential privacy in the client/server setting,” in Theory of Cryptography: 8th Theory of Cryptography Conference, TCC 2011, Providence, RI, USA, March 28-30, 2011. Proceedings 8 , pp. 417– 431, Springer, 2011

    2011

  3. [10]

    Applied federated learning: Improving google keyboard query suggestions,

    T. Yang, G. Andrew, H. Eichner, H. Sun, W. Li, N. Kong, D. Ramage, and F. Beaufays, “Applied federated learning: Improving google keyboard query suggestions,” arXiv preprint arXiv:1812.02903, 2018

    2018 arXiv

  4. [12]

    R ´enyi differential privacy,

    I. Mironov, “R ´enyi differential privacy,” in 2017 IEEE 30th computer security foundations symposium (CSF) , pp. 263–275, IEEE, 2017

    2017

  5. [13]

    Client selection in federated learning: Principles, challenges, and opportunities,

    L. Fu, H. Zhang, G. Gao, M. Zhang, and X. Liu, “Client selection in federated learning: Principles, challenges, and opportunities,” IEEE Internet of Things Journal , 2023

    2023

  6. [14]

    Vehicle selection and resource optimization for federated learning in vehicular edge computing,

    H. Xiao, J. Zhao, Q. Pei, J. Feng, L. Liu, and W. Shi, “Vehicle selection and resource optimization for federated learning in vehicular edge computing,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 8, pp. 11073–11087, 2021

    2021

  7. [15]

    GLUE: A multi-task benchmark and analysis platform for natural language understanding,

    A. Wang, A. Singh, J. Michael, F. Hill, O. Levy, and S. R. Bowman, “GLUE: A multi-task benchmark and analysis platform for natural language understanding,” in International Conference on Learning Representations, 2019

    2019

  8. [16]

    Ew- tune: A framework for privately fine-tuning large language models with differential privacy,

    R. Behnia, M. R. Ebrahimi, J. Pacheco, and B. Padmanabhan, “Ew- tune: A framework for privately fine-tuning large language models with differential privacy,” in 2022 IEEE International Conference on Data Mining Workshops (ICDMW) , pp. 560–566, IEEE, 2022

    2022

  9. [17]

    Differentially private fine-tuning of language models,

    D. Yu, S. Naik, A. Backurs, S. Gopi, H. A. Inan, G. Kamath, J. Kulka- rni, Y . T. Lee, A. Manoel, L. Wutschitz, et al., “Differentially private fine-tuning of language models,” arXiv preprint arXiv:2110.06500 , 2021

    2021 arXiv

  10. [18]

    Bert: Pre- training of deep bidirectional transformers for language understand- ing,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre- training of deep bidirectional transformers for language understand- ing,” arXiv preprint arXiv:1810.04805 , 2018

    2018 arXiv

  11. [19]

    Communication-efficient learning of deep networks from decentral- ized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” in Artificial intelligence and statistics , pp. 1273–1282, PMLR, 2017

    2017

  12. [20]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Roth, et al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

    2014

  13. [21]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security , pp. 308–318, 2016

    2016

  14. [22]

    Concentrated differential privacy,

    C. Dwork and G. N. Rothblum, “Concentrated differential privacy,” arXiv preprint arXiv:1603.01887 , 2016

    2016 arXiv

  15. [23]

    https://opacus.ai/docs/introduction, Last accessed on 2025-1-8

    opacus, 2025. https://opacus.ai/docs/introduction, Last accessed on 2025-1-8

    2025

  16. [24]

    Privacy amplification by sub- sampling: Tight analyses via couplings and divergences,

    B. Balle, G. Barthe, and M. Gaboardi, “Privacy amplification by sub- sampling: Tight analyses via couplings and divergences,” Advances in neural information processing systems , vol. 31, 2018

    2018

  17. [25]

    Subsampled r´enyi differential privacy and analytical moments accountant,

    Y .-X. Wang, B. Balle, and S. P. Kasiviswanathan, “Subsampled r´enyi differential privacy and analytical moments accountant,” in The 22nd international conference on artificial intelligence and statistics , pp. 1226–1235, PMLR, 2019

    2019

  18. [26]

    Bayesian differential privacy for ma- chine learning,

    A. Triastcyn and B. Faltings, “Bayesian differential privacy for ma- chine learning,” in Proceedings of the 37th International Conference on Machine Learning , vol. 119 of Proceedings of Machine Learning Research, pp. 9583–9592, PMLR, 2020

    2020

  19. [27]

    Superglue: A multi-task benchmark and analysis platform for natural language understanding,

    A. Wang, Y . Pruksachatkun, N. Nangia, A. Singh, J. Michael, F. Hill, O. Levy, and S. R. Bowman, “Superglue: A multi-task benchmark and analysis platform for natural language understanding,” Advances in Neural Information Processing Systems , vol. 32, pp. 3261–3275, 2019

    2019

  20. [28]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proceedings of the 2013 conference on empirical methods in natural language processing , pp. 1631–1642, 2013

    2013

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.