Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements.

The review comment to be evaluated is:

Strength: It studies an important problem of how to scale DP-SGD with hyper-parameter search. The paper provides a neat and simple relationship between the privacy budget and the other parameters, i.e., the noise multiplier, steps and the sampling rate. This relationship motivates a way of scaling the batchsize and the noise multiplier without affecting the privacy accountant.

Weakness:
1. There is no application of using TAN relation in language task, either pretraining or fine-tuning.

2. The reference needs to cover more. Especially, Yu et al. 2021 starts the fine-tuning large language models with differential privacy and low-rank reparametrization.
Yu et al. 2021 Large Scale Private Learning via Low-rank Reparametrization.

The evidence to be evaluated is:We consider a randomized mechanism \(\mathcal{M}\) that takes as input a dataset \(D\) and outputs a machine learning model \(\theta\sim\mathcal{M}(D)\).

DP-SGD (Abadi et al., 2016) is the most popular DP algorithm to train DNNs. It selects samples uniformly at random with probability \(q=B/N\) (Poisson sampling), clips per-sample gradients to a norm \(C\) (\(\text{clip}_{C}\)), aggregates them and adds (Gaussian) noise. With \(\theta\) the parameters of the DNN: \[g_{\text{noisy}}=\frac{1}{B}\sum_{i\in B}\text{clip}_{C}\left(\nabla_{\theta} \ell(\theta,(x_{i},y_{i}))\right)+\mathcal{N}\left(0,\frac{C^{2}\sigma^{2}}{B ^{2}}\right). \tag{2}\] The traditional privacy analysis of DP-SGD is obtained through Renyi DP.

Renyi DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with \[g_{\alpha}(\sigma,q):=D_{\alpha}((1-q)\mathcal{N}(0,\sigma^{2})+q\mathcal{N}( 1,\sigma^{2})\parallel\mathcal{N}(0,\sigma^{2})).\] Finally, a mechanism satisfying \((\alpha,d_{\alpha})\)-Renyi-DP also satisfies \((\tilde{\varepsilon},\delta)\)-DP (Mironov, 2017) for \(\tilde{\varepsilon}=d_{\alpha}+\frac{\log(1/\delta)}{\alpha-1}\). Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\] RDP is the traditional tool used to analyse DP-SGD, but other accounting tools have been proposed to obtain tighter bounds (Gopi et al., 2021). In this work, we use the accountant due to Balle et al. (2020), whose output is referred to as \(\varepsilon\), which is slightly smaller than \(\varepsilon_{\mathrm{RDP}}\).

Training ML models with DP-SGD typically incurs a loss of model utility, and recent work have shown that using very large batch sizes improves the privacy/utility trade-off (Anil et al., 2021; Li et al., 2021).

Computing per-sample gradients with mega batch sizes for a large number of steps and AugMul makes DP-SGD much more computationally intensive than non-private training, typically dozens of times. For instance, reproducing the previous SOTA on ImageNet of De et al. (2022) under \(\varepsilon=8\) necessitates a \(4\)-day run using \(32\) A100 GPUs, while the non-private SOTA can be reproduced in a few hours with the same hardware (Goyal et al., 2017).

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting. We then demonstrate how training with reference privacy parameters \((q_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)\) can be simulated with much lower computational resources using the same TAN with a smaller batch size. **Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\] We begin with a simple case to motivate our definition of TAN. We assume a one-dimensional model, where the gradients of all points are clipped to \(C\). Looking at Equation 2, in one batch, the expected signal from each sample is \(C/B\) with probability \(q=B/N\) and \(0\) otherwise. Therefore, the expected individual signal of each sample after \(S\) steps is \(SC/N\), and its squared norm is \(S^{2}C^{2}/N^{2}\).

The ratio \(\sigma/q\) is noted by Li et al. (2021) as the effective noise. The authors found that for a fixed budget \(\varepsilon\) and fixed \(S\), the effective noise decreases with \(B\). Our analysis goes further by analyzing how RDP accounting explains this dependency. Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\). On the contrary, when \(\sigma\) gets smaller, \(\varepsilon\) increases exponentially, creating a "Privacy Wall". We can shed light on this phenomenon by looking at the underlying RDP values.

Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics:

Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\). This drastically improves privacy accounting (Figure 2), and the per step signal-to-noise ratio \(\eta_{\mathrm{step}}\) remains constant. However, given that the number of steps \(S\) is fixed, each doubling of \(q\) doubles the computational cost.

We find that for triplets \((q,\sigma,S)\) for which \(q/\sigma=q_{\mathrm{ref}}/\sigma_{\mathrm{ref}}\) (keeping \(\eta_{\mathrm{step}}\) constant), the performance of the network (log) linearly decreases with the batch size. This is consistent with the (non-private) work of Smith et al. (2020), which shows that for a fixed number of steps, small batch sizes perform better in generalisation (i.e., test accuracy) than large batch sizes. The difference with our work is that we consider noisy updates and observe a (log) linear relationship between batch size and performance.

It also divides the computational cost by \(2\). This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

We go one step further and study training in the small batch size setting. We choose the optimal hyper-parameters (including architecture, optimizer, type of data augmentation) in this simulated setting, and finally launch one single run at the reference (large) batch size, with desired privacy guarantees.

We thus reduce the computational requirements by a factor of \(128\times\). Each hyper-parameter search in the ImageNet setup takes \(4\) days using \(32\) A-100 GPUs; we reduce it to less than a day on a single GPU.

We then study the impact of the dataset size on the privacy/utility trade-off. We also demonstrate how our low compute simulation framework can be used to detect performance bottlenecks when training with noisy updates: in our case, the importance of the order between activation and normalization in a WideResNet on CIFAR-10.

In Section 4.2.1, we use our simulated training with constant TAN to find optimal hyperparameters at low compute and improve performance for reference privacy parameters \((B_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)=(16384,2.5,72\mathrm{k})\). In Section 4.2.2, we find optimal privacy parameters at constant TAN by changing the number of steps \(S\), leading to a new state of the art on ImageNet for \(\varepsilon=8\) (Table 1).

We run a large hyper-parameter search and report the best hyper-parameters in Table 2 as well as the corresponding improvement for various batch sizes (at constant \(\eta_{\text{step}}\) and \(S\)).

We search over learning rates \(lr\in[1,2,4,8,12,16]\), momentum parameters \(\mu\in[0,0.1,0.5,0.9,1]\) and dampening factors \(d\in[0,0.1,0.5,0.9,1]\).

We have experimented with different architectures (ViTs, ResNets, NFResnets) and optimizers (DP-Adam, DP-AdamW, DP-SGD) (see Appendix B for details).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

Since performing this privacy parameter search is computationally intensive, we first simulate training using our scaling law at \(B=256\) (with the same \(\eta_{\mathrm{step}}\)) and display our results in Table 3.

Thus, we have shown how we can use TAN to perform optimal privacy parameter search while simulating each choice of optimal parameters at a much smaller cost.

We observe that the two simulated experiments with \(B=512\) represented by lighter colors in Figure 5 (\(2\) standard deviations around the means) have the same properties. However, each simulation is \(8\) times less computationally expensive. Therefore, using TAN through our scaling law can facilitate studying variants of the network architecture while reducing the computational costs.

We now look at how collecting more data affects the tradeoff between privacy and utility. We show that doubling the data (from the same distribution) allows better performance with half the privacy budget. To this end, we train on portions of the CIFAR-10 training set (\(N=50\)k) and always report accuracies on the same test set. If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced. We further show that scaling batch size with noise level using TAN allows for ultra-efficient hyper-parameter search and demonstrate the power of this paradigm by establishing a new state of the art for DP training on Imagenet.

If available, one can use a similar public dataset (such as ImageNet) to choose hyper-parameters, and then perform only limited runs on the private dataset.

We believe that the important increase in the privacy budget \(\varepsilon\) as the noise level \(\sigma\) decreases is a real phenomenon and not an artifact of the analysis. Indeed, DP assumes that the adversary has access to all model updates, as is the case for example in Federated Learning. In such cases, a noise level that is too low is insufficient to hide the presence of individual data points and makes it impossible to obtain reasonable privacy guarantees. In the centralized case however, the adversary does not see intermediate models but only the final result of training. Some works have successfully taken into account this "privacy amplification by iteration" idea (Feldman et al., 2018; Ye and Shokri, 2022) but results are so far limited to convex models.

We show in Table 6 that similarly to the experiments in CIFAR-10, doubling the training data on ImageNet improves the accuracy while diving \(\varepsilon\) by \(2\). We also demonstrate that our scaling strategy can accurately detect the gain of accuracy.

When training with DP-SGD, the goal is to find the best possible local minimum within a constrained number of steps \(S\), and with noisy gradients.

We used our scaling strategy (keeping \(\eta_{step}\) and \(S\) constant) to simulate the DP training with different architectures at low compute, studying noisy training without the burden of DP accounting. The best simulated results were obtained with a NFResNet-50 (Brock et al., 2021b) designed to be fast learners in terms of number of FLOPS. The worst results were obtained with ViTs, and intermediate results with classical ResNets. In Figure 6, we compare different training trajectories of a ViT and a NF-ResNet.

This highlights the fact that training with DP-SGD is a different paradigm that requires its own tools. Using TAN allowed us to explore and compare different architectures and optimizers, which would have been computationally impossible in the normal DP training setting at \(B=16384\).

Because we are training for a fixed number of steps, it is a waste of gradient steps (i.e. privacy budget). With AugMult, the network may still be able to learn from these examples. Figure 7 shows the histograms of the norms of the **average over all augmentations for each image** of the per-sample gradients, before clipping and adding noise in equation 5 at different times of training.

Input: Table 1: Top-1 test accuracy when training on ImageNet from scratch using DP-SGD. We train a NF-ResNet-50 with σ = 2.5, hyper-parameters of Table 2 and (B,S) = (32768, 18k) (Table 4).

Input: Table 2: Comparing optimal hyper-parameters. Keeping ηstep and S constant, we compare various changes in the training pipeline. We compare with the baseline of De et al. (2022) (blue line in Figure 1: NFResNet-50, learning rate at 4, EMA decay at 0.99999, 4 random augmentations averaged over 3 runs). Each gain is compared to the previous column.

Input: Figure 7: Histograms of the norms of the average across all augmentations for each image of the per-sample gradients, before clipping and adding noise. On the left, we see that without augmentation, an increasing number of examples have their gradients going to zero during training. On the right, we see that when using a strong augmentation technique (SimCLR, (Chen et al., 2020)), the gradients are more concentrated during all the training.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Table 3: Low compute simulation of privacy parameter search. We start from B = 256 = 16384/64 and S = 72K. We use σ = 2.5/64 for all runs and no data augmentation.

Input: Figure 6: Training a ViT from scratch on ImageNet with DP-SGD. We simulate training with our scaling strategy and B = 256. We observe that the accuracies are not as good as for NF-ResNets, and that Augmentation Multiplicity plays a more important role.

Input: Table 6: Impact of adding more data on ImageNet. The “Simulated Gain” column corresponds to the accuracy gain we observe when simulating at lower compute using our scaling strategy for B = 256. The “Gain” column corresponds to the real gain at B = 16384.

Input: Figure 5: Impact of data augmentation on the test accuracy using pre-activation normalization vs post-activation in a 16-4-WideResnet on CIFAR-10. We compare simulation at (B, σ) = (512, 3 8 ) and reference (Bref , σref) = (4096, 3), both trained for S = 2,500 steps. Confidence intervals are plotted with two standard deviations over 5 runs. Augmentation Multiplicity Order corresponds to the number of augmentations per image, or K in Appendix C.

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input: Figure 4: Test accuracies at constant ηstep = Bref/( √ 2Nσref ) and S are (log) linearly decreasing with B. Dashed lines are computed using a linear regression on the crosses. Shaded areas correspond to 3 std confidence intervals. (Left) CIFAR-10 with 16-4-WideResNet for Sref steps. Each curve corresponds to a different value of ηstep. (Right) ImageNet with NF-ResNet-50 with various numbers of steps. The scaling law holds for various training configurations.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the evidence, the claim that they "decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements" appears to be well-stated. The paper demonstrates:
- Clear mathematical analysis connecting privacy budget to Total Amount of Noise (TAN)
- Empirical validation showing how varying batch size and noise levels while maintaining constant TAN enables efficient hyperparameter search
- Concrete computational gains (128x reduction) compared to standard approaches
- Practical improvements in accuracy while maintaining privacy guarantees
- Theoretical grounding through RDP analysis

The claim accurately reflects their key contribution without overstating the findings.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements.

The review comment to be evaluated is:

Major strengths:
1. The observation of the scaling law is new.
2. The results of hyperparameter tuning improve the state-of-the-art greatly.

Minor strengths:
1. This paper is easy to follow.
2. The visualization of the experimental results is good.
3. Figure 2 seems to deliver the same message as the linear part of Figure 3 (left) in (Li et al, 2021a), but the authors provide more explanations in Section 3.2.

Major weaknesses:
1. The privacy guarantee parameter $\varepsilon_{TAN}$ is an approximation of $\varepsilon_{RDP}$ and it is only a lower bound. For strict privacy guarantees, we need an upper bound.
2. There is no explanation for the reason for the scaling law.

Minor weaknesses:
Some of the statements in this paper are inconsistent with each other.
1. In the left figure of Figure 4, the legend shows that $\sigma_{ref}$ is constant for each line, but the caption says the $\eta_{step}$ is constant. I also wonder why the authors choose to fix different values in Figure 4 for CIFAR-10 and ImageNet. Is it because the results of CIFAR-10 do not look as linear as of ImageNet?
2. In Page 5, Choice of $\sigma$, the authors claimed that if $\sigma>4$, dividing it by 2 with halving q is likely to improve performance, but I cannot find experimental results supporting this.
3. In Page 7, the authors say that they decide not to use the gain from 'testing with augmentations' in Table 1 and Table 4. In Table 2, I guess the Total column is the sum of the other columns for B=128, ..., 1024. Therefore, the last row, B=16384, also has the AugTest (+0.8) in the Total result (6.7%). I guess in Table 4, the test ACC for B=16384, 36.9%, is derived by adding the total improvement 6.7% to the baseline 30.2%. Therefore, I am not sure if the authors forget to remove the improvement from AugTest.
4. In Page 9, in the last paragraph, the authors believe that the exponential increase in the privacy budget $\varepsilon$ as the noise level $\sigma$ decreases. I guess this is from Figure 2, but the x-axis for $\sigma$ is log-scale. Therefore, it is not easy to identify whether there is a linear or exponential relationship between $\varepsilon$ and $\sigma$.

By the way, there are duplicate references (Li et al, 2021a and 2021b).

The evidence to be evaluated is:We consider a randomized mechanism \(\mathcal{M}\) that takes as input a dataset \(D\) and outputs a machine learning model \(\theta\sim\mathcal{M}(D)\).

DP-SGD (Abadi et al., 2016) is the most popular DP algorithm to train DNNs. It selects samples uniformly at random with probability \(q=B/N\) (Poisson sampling), clips per-sample gradients to a norm \(C\) (\(\text{clip}_{C}\)), aggregates them and adds (Gaussian) noise. With \(\theta\) the parameters of the DNN: \[g_{\text{noisy}}=\frac{1}{B}\sum_{i\in B}\text{clip}_{C}\left(\nabla_{\theta} \ell(\theta,(x_{i},y_{i}))\right)+\mathcal{N}\left(0,\frac{C^{2}\sigma^{2}}{B ^{2}}\right). \tag{2}\] The traditional privacy analysis of DP-SGD is obtained through Renyi DP.

Renyi DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with \[g_{\alpha}(\sigma,q):=D_{\alpha}((1-q)\mathcal{N}(0,\sigma^{2})+q\mathcal{N}( 1,\sigma^{2})\parallel\mathcal{N}(0,\sigma^{2})).\] Finally, a mechanism satisfying \((\alpha,d_{\alpha})\)-Renyi-DP also satisfies \((\tilde{\varepsilon},\delta)\)-DP (Mironov, 2017) for \(\tilde{\varepsilon}=d_{\alpha}+\frac{\log(1/\delta)}{\alpha-1}\). Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\] RDP is the traditional tool used to analyse DP-SGD, but other accounting tools have been proposed to obtain tighter bounds (Gopi et al., 2021). In this work, we use the accountant due to Balle et al. (2020), whose output is referred to as \(\varepsilon\), which is slightly smaller than \(\varepsilon_{\mathrm{RDP}}\).

Training ML models with DP-SGD typically incurs a loss of model utility, and recent work have shown that using very large batch sizes improves the privacy/utility trade-off (Anil et al., 2021; Li et al., 2021).

Computing per-sample gradients with mega batch sizes for a large number of steps and AugMul makes DP-SGD much more computationally intensive than non-private training, typically dozens of times. For instance, reproducing the previous SOTA on ImageNet of De et al. (2022) under \(\varepsilon=8\) necessitates a \(4\)-day run using \(32\) A100 GPUs, while the non-private SOTA can be reproduced in a few hours with the same hardware (Goyal et al., 2017).

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting. We then demonstrate how training with reference privacy parameters \((q_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)\) can be simulated with much lower computational resources using the same TAN with a smaller batch size. **Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\] We begin with a simple case to motivate our definition of TAN. We assume a one-dimensional model, where the gradients of all points are clipped to \(C\). Looking at Equation 2, in one batch, the expected signal from each sample is \(C/B\) with probability \(q=B/N\) and \(0\) otherwise. Therefore, the expected individual signal of each sample after \(S\) steps is \(SC/N\), and its squared norm is \(S^{2}C^{2}/N^{2}\).

The ratio \(\sigma/q\) is noted by Li et al. (2021) as the effective noise. The authors found that for a fixed budget \(\varepsilon\) and fixed \(S\), the effective noise decreases with \(B\). Our analysis goes further by analyzing how RDP accounting explains this dependency. Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\). On the contrary, when \(\sigma\) gets smaller, \(\varepsilon\) increases exponentially, creating a "Privacy Wall". We can shed light on this phenomenon by looking at the underlying RDP values.

Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics:

Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\). This drastically improves privacy accounting (Figure 2), and the per step signal-to-noise ratio \(\eta_{\mathrm{step}}\) remains constant. However, given that the number of steps \(S\) is fixed, each doubling of \(q\) doubles the computational cost.

We find that for triplets \((q,\sigma,S)\) for which \(q/\sigma=q_{\mathrm{ref}}/\sigma_{\mathrm{ref}}\) (keeping \(\eta_{\mathrm{step}}\) constant), the performance of the network (log) linearly decreases with the batch size. This is consistent with the (non-private) work of Smith et al. (2020), which shows that for a fixed number of steps, small batch sizes perform better in generalisation (i.e., test accuracy) than large batch sizes. The difference with our work is that we consider noisy updates and observe a (log) linear relationship between batch size and performance.

It also divides the computational cost by \(2\). This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

We go one step further and study training in the small batch size setting. We choose the optimal hyper-parameters (including architecture, optimizer, type of data augmentation) in this simulated setting, and finally launch one single run at the reference (large) batch size, with desired privacy guarantees.

We thus reduce the computational requirements by a factor of \(128\times\). Each hyper-parameter search in the ImageNet setup takes \(4\) days using \(32\) A-100 GPUs; we reduce it to less than a day on a single GPU.

We then study the impact of the dataset size on the privacy/utility trade-off. We also demonstrate how our low compute simulation framework can be used to detect performance bottlenecks when training with noisy updates: in our case, the importance of the order between activation and normalization in a WideResNet on CIFAR-10.

In Section 4.2.1, we use our simulated training with constant TAN to find optimal hyperparameters at low compute and improve performance for reference privacy parameters \((B_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)=(16384,2.5,72\mathrm{k})\). In Section 4.2.2, we find optimal privacy parameters at constant TAN by changing the number of steps \(S\), leading to a new state of the art on ImageNet for \(\varepsilon=8\) (Table 1).

We run a large hyper-parameter search and report the best hyper-parameters in Table 2 as well as the corresponding improvement for various batch sizes (at constant \(\eta_{\text{step}}\) and \(S\)).

We search over learning rates \(lr\in[1,2,4,8,12,16]\), momentum parameters \(\mu\in[0,0.1,0.5,0.9,1]\) and dampening factors \(d\in[0,0.1,0.5,0.9,1]\).

We have experimented with different architectures (ViTs, ResNets, NFResnets) and optimizers (DP-Adam, DP-AdamW, DP-SGD) (see Appendix B for details).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

Since performing this privacy parameter search is computationally intensive, we first simulate training using our scaling law at \(B=256\) (with the same \(\eta_{\mathrm{step}}\)) and display our results in Table 3.

Thus, we have shown how we can use TAN to perform optimal privacy parameter search while simulating each choice of optimal parameters at a much smaller cost.

We observe that the two simulated experiments with \(B=512\) represented by lighter colors in Figure 5 (\(2\) standard deviations around the means) have the same properties. However, each simulation is \(8\) times less computationally expensive. Therefore, using TAN through our scaling law can facilitate studying variants of the network architecture while reducing the computational costs.

We now look at how collecting more data affects the tradeoff between privacy and utility. We show that doubling the data (from the same distribution) allows better performance with half the privacy budget. To this end, we train on portions of the CIFAR-10 training set (\(N=50\)k) and always report accuracies on the same test set. If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced. We further show that scaling batch size with noise level using TAN allows for ultra-efficient hyper-parameter search and demonstrate the power of this paradigm by establishing a new state of the art for DP training on Imagenet.

If available, one can use a similar public dataset (such as ImageNet) to choose hyper-parameters, and then perform only limited runs on the private dataset.

We believe that the important increase in the privacy budget \(\varepsilon\) as the noise level \(\sigma\) decreases is a real phenomenon and not an artifact of the analysis. Indeed, DP assumes that the adversary has access to all model updates, as is the case for example in Federated Learning. In such cases, a noise level that is too low is insufficient to hide the presence of individual data points and makes it impossible to obtain reasonable privacy guarantees. In the centralized case however, the adversary does not see intermediate models but only the final result of training. Some works have successfully taken into account this "privacy amplification by iteration" idea (Feldman et al., 2018; Ye and Shokri, 2022) but results are so far limited to convex models.

We show in Table 6 that similarly to the experiments in CIFAR-10, doubling the training data on ImageNet improves the accuracy while diving \(\varepsilon\) by \(2\). We also demonstrate that our scaling strategy can accurately detect the gain of accuracy.

When training with DP-SGD, the goal is to find the best possible local minimum within a constrained number of steps \(S\), and with noisy gradients.

We used our scaling strategy (keeping \(\eta_{step}\) and \(S\) constant) to simulate the DP training with different architectures at low compute, studying noisy training without the burden of DP accounting. The best simulated results were obtained with a NFResNet-50 (Brock et al., 2021b) designed to be fast learners in terms of number of FLOPS. The worst results were obtained with ViTs, and intermediate results with classical ResNets. In Figure 6, we compare different training trajectories of a ViT and a NF-ResNet.

This highlights the fact that training with DP-SGD is a different paradigm that requires its own tools. Using TAN allowed us to explore and compare different architectures and optimizers, which would have been computationally impossible in the normal DP training setting at \(B=16384\).

Because we are training for a fixed number of steps, it is a waste of gradient steps (i.e. privacy budget). With AugMult, the network may still be able to learn from these examples. Figure 7 shows the histograms of the norms of the **average over all augmentations for each image** of the per-sample gradients, before clipping and adding noise in equation 5 at different times of training.

Input: Table 1: Top-1 test accuracy when training on ImageNet from scratch using DP-SGD. We train a NF-ResNet-50 with σ = 2.5, hyper-parameters of Table 2 and (B,S) = (32768, 18k) (Table 4).

Input: Table 2: Comparing optimal hyper-parameters. Keeping ηstep and S constant, we compare various changes in the training pipeline. We compare with the baseline of De et al. (2022) (blue line in Figure 1: NFResNet-50, learning rate at 4, EMA decay at 0.99999, 4 random augmentations averaged over 3 runs). Each gain is compared to the previous column.

Input: Figure 7: Histograms of the norms of the average across all augmentations for each image of the per-sample gradients, before clipping and adding noise. On the left, we see that without augmentation, an increasing number of examples have their gradients going to zero during training. On the right, we see that when using a strong augmentation technique (SimCLR, (Chen et al., 2020)), the gradients are more concentrated during all the training.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Table 3: Low compute simulation of privacy parameter search. We start from B = 256 = 16384/64 and S = 72K. We use σ = 2.5/64 for all runs and no data augmentation.

Input: Figure 6: Training a ViT from scratch on ImageNet with DP-SGD. We simulate training with our scaling strategy and B = 256. We observe that the accuracies are not as good as for NF-ResNets, and that Augmentation Multiplicity plays a more important role.

Input: Table 6: Impact of adding more data on ImageNet. The “Simulated Gain” column corresponds to the accuracy gain we observe when simulating at lower compute using our scaling strategy for B = 256. The “Gain” column corresponds to the real gain at B = 16384.

Input: Figure 5: Impact of data augmentation on the test accuracy using pre-activation normalization vs post-activation in a 16-4-WideResnet on CIFAR-10. We compare simulation at (B, σ) = (512, 3 8 ) and reference (Bref , σref) = (4096, 3), both trained for S = 2,500 steps. Confidence intervals are plotted with two standard deviations over 5 runs. Augmentation Multiplicity Order corresponds to the number of augmentations per image, or K in Appendix C.

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input: Figure 4: Test accuracies at constant ηstep = Bref/( √ 2Nσref ) and S are (log) linearly decreasing with B. Dashed lines are computed using a linear regression on the crosses. Shaded areas correspond to 3 std confidence intervals. (Left) CIFAR-10 with 16-4-WideResNet for Sref steps. Each curve corresponds to a different value of ηstep. (Right) ImageNet with NF-ResNet-50 with various numbers of steps. The scaling law holds for various training configurations.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the evidence, the claim "we decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements" is well-supported by the extensive mathematical analysis and experimental results presented. The authors:
- Introduce TAN (Total Amount of Noise) and demonstrate its relationship to RDP accounting
- Show how training with reference privacy parameters can be simulated with lower computational resources
- Validate their approach through extensive experiments on CIFAR-10 and ImageNet
- Achieve significant computational savings (128x reduction) while maintaining accuracy
- Provide theoretical foundations and practical guidelines for efficient private training

The claim accurately reflects the contributions without overstating them.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

In this work, we decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements.

The review comment to be evaluated is:

Strengths:
1) Integrating the constraints of DP-SGD with optimization theory, in order to reliably predict good hyper-parameter choices, is one of the most important problems that needs to be solved in order to make differentially private deep learning practical. I'm pleased to see the authors tackle this difficult and important problem.
2) The metric proposed by the authors is intuitive and it appears to provide some helpful intuition.
3) The authors achieve strong performance when training from scratch on ImageNet with DP-SGD.

Weaknesses:
1) If TAN were an accurate measure of optimizability, then we should expect the train accuracy to be roughly constant at fixed TAN. However in practice, the authors find in figure 1 that the test accuracy decays log-linearly at fixed TAN as the batch size rises. I feel that the current paper is quite confusing because this discrepancy is not explicitly stated anywhere. I'd encourage the authors to make this explicit, and to explore in more detail why this discrepancy arises (eg comparing test vs train performance).

2) As discussed above, Figure 1 shows that TAN over-estimates the performance of large batch sizes. It would be nice to also see a figure at fixed batch size, sweeping the number of steps S, to see whether TAN under/over-estimates the performance of small/large step budgets.

3) As a minor point, note that on some truly sensitive data we cannot train non-private models (even internally). It would be good to acknowledge that the hyper-parameter transfer process described here cannot be used in these cases.

4) For many of the experiments, key hyper-parameters are lifted from prior work (eg step budget, target batch size). Is it not possible to directly infer good settings for these hyper-parameters using the TAN framework?

5) The paper essentially only considers ImageNet (with some very limited experiments on CIFAR-10). Since very few groups have run experiments at this scale it is not clear how challenging the baseline from De et al. is in practice.

The evidence to be evaluated is:We consider a randomized mechanism \(\mathcal{M}\) that takes as input a dataset \(D\) and outputs a machine learning model \(\theta\sim\mathcal{M}(D)\).

DP-SGD (Abadi et al., 2016) is the most popular DP algorithm to train DNNs. It selects samples uniformly at random with probability \(q=B/N\) (Poisson sampling), clips per-sample gradients to a norm \(C\) (\(\text{clip}_{C}\)), aggregates them and adds (Gaussian) noise. With \(\theta\) the parameters of the DNN: \[g_{\text{noisy}}=\frac{1}{B}\sum_{i\in B}\text{clip}_{C}\left(\nabla_{\theta} \ell(\theta,(x_{i},y_{i}))\right)+\mathcal{N}\left(0,\frac{C^{2}\sigma^{2}}{B ^{2}}\right). \tag{2}\] The traditional privacy analysis of DP-SGD is obtained through Renyi DP.

Renyi DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with \[g_{\alpha}(\sigma,q):=D_{\alpha}((1-q)\mathcal{N}(0,\sigma^{2})+q\mathcal{N}( 1,\sigma^{2})\parallel\mathcal{N}(0,\sigma^{2})).\] Finally, a mechanism satisfying \((\alpha,d_{\alpha})\)-Renyi-DP also satisfies \((\tilde{\varepsilon},\delta)\)-DP (Mironov, 2017) for \(\tilde{\varepsilon}=d_{\alpha}+\frac{\log(1/\delta)}{\alpha-1}\). Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\] RDP is the traditional tool used to analyse DP-SGD, but other accounting tools have been proposed to obtain tighter bounds (Gopi et al., 2021). In this work, we use the accountant due to Balle et al. (2020), whose output is referred to as \(\varepsilon\), which is slightly smaller than \(\varepsilon_{\mathrm{RDP}}\).

Training ML models with DP-SGD typically incurs a loss of model utility, and recent work have shown that using very large batch sizes improves the privacy/utility trade-off (Anil et al., 2021; Li et al., 2021).

Computing per-sample gradients with mega batch sizes for a large number of steps and AugMul makes DP-SGD much more computationally intensive than non-private training, typically dozens of times. For instance, reproducing the previous SOTA on ImageNet of De et al. (2022) under \(\varepsilon=8\) necessitates a \(4\)-day run using \(32\) A100 GPUs, while the non-private SOTA can be reproduced in a few hours with the same hardware (Goyal et al., 2017).

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting. We then demonstrate how training with reference privacy parameters \((q_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)\) can be simulated with much lower computational resources using the same TAN with a smaller batch size. **Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\] We begin with a simple case to motivate our definition of TAN. We assume a one-dimensional model, where the gradients of all points are clipped to \(C\). Looking at Equation 2, in one batch, the expected signal from each sample is \(C/B\) with probability \(q=B/N\) and \(0\) otherwise. Therefore, the expected individual signal of each sample after \(S\) steps is \(SC/N\), and its squared norm is \(S^{2}C^{2}/N^{2}\).

The ratio \(\sigma/q\) is noted by Li et al. (2021) as the effective noise. The authors found that for a fixed budget \(\varepsilon\) and fixed \(S\), the effective noise decreases with \(B\). Our analysis goes further by analyzing how RDP accounting explains this dependency. Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\). On the contrary, when \(\sigma\) gets smaller, \(\varepsilon\) increases exponentially, creating a "Privacy Wall". We can shed light on this phenomenon by looking at the underlying RDP values.

Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics:

Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\). This drastically improves privacy accounting (Figure 2), and the per step signal-to-noise ratio \(\eta_{\mathrm{step}}\) remains constant. However, given that the number of steps \(S\) is fixed, each doubling of \(q\) doubles the computational cost.

We find that for triplets \((q,\sigma,S)\) for which \(q/\sigma=q_{\mathrm{ref}}/\sigma_{\mathrm{ref}}\) (keeping \(\eta_{\mathrm{step}}\) constant), the performance of the network (log) linearly decreases with the batch size. This is consistent with the (non-private) work of Smith et al. (2020), which shows that for a fixed number of steps, small batch sizes perform better in generalisation (i.e., test accuracy) than large batch sizes. The difference with our work is that we consider noisy updates and observe a (log) linear relationship between batch size and performance.

It also divides the computational cost by \(2\). This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

We go one step further and study training in the small batch size setting. We choose the optimal hyper-parameters (including architecture, optimizer, type of data augmentation) in this simulated setting, and finally launch one single run at the reference (large) batch size, with desired privacy guarantees.

We thus reduce the computational requirements by a factor of \(128\times\). Each hyper-parameter search in the ImageNet setup takes \(4\) days using \(32\) A-100 GPUs; we reduce it to less than a day on a single GPU.

We then study the impact of the dataset size on the privacy/utility trade-off. We also demonstrate how our low compute simulation framework can be used to detect performance bottlenecks when training with noisy updates: in our case, the importance of the order between activation and normalization in a WideResNet on CIFAR-10.

In Section 4.2.1, we use our simulated training with constant TAN to find optimal hyperparameters at low compute and improve performance for reference privacy parameters \((B_{\mathrm{ref}},\sigma_{\mathrm{ref}},S)=(16384,2.5,72\mathrm{k})\). In Section 4.2.2, we find optimal privacy parameters at constant TAN by changing the number of steps \(S\), leading to a new state of the art on ImageNet for \(\varepsilon=8\) (Table 1).

We run a large hyper-parameter search and report the best hyper-parameters in Table 2 as well as the corresponding improvement for various batch sizes (at constant \(\eta_{\text{step}}\) and \(S\)).

We search over learning rates \(lr\in[1,2,4,8,12,16]\), momentum parameters \(\mu\in[0,0.1,0.5,0.9,1]\) and dampening factors \(d\in[0,0.1,0.5,0.9,1]\).

We have experimented with different architectures (ViTs, ResNets, NFResnets) and optimizers (DP-Adam, DP-AdamW, DP-SGD) (see Appendix B for details).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

Since performing this privacy parameter search is computationally intensive, we first simulate training using our scaling law at \(B=256\) (with the same \(\eta_{\mathrm{step}}\)) and display our results in Table 3.

Thus, we have shown how we can use TAN to perform optimal privacy parameter search while simulating each choice of optimal parameters at a much smaller cost.

We observe that the two simulated experiments with \(B=512\) represented by lighter colors in Figure 5 (\(2\) standard deviations around the means) have the same properties. However, each simulation is \(8\) times less computationally expensive. Therefore, using TAN through our scaling law can facilitate studying variants of the network architecture while reducing the computational costs.

We now look at how collecting more data affects the tradeoff between privacy and utility. We show that doubling the data (from the same distribution) allows better performance with half the privacy budget. To this end, we train on portions of the CIFAR-10 training set (\(N=50\)k) and always report accuracies on the same test set. If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced. We further show that scaling batch size with noise level using TAN allows for ultra-efficient hyper-parameter search and demonstrate the power of this paradigm by establishing a new state of the art for DP training on Imagenet.

If available, one can use a similar public dataset (such as ImageNet) to choose hyper-parameters, and then perform only limited runs on the private dataset.

We believe that the important increase in the privacy budget \(\varepsilon\) as the noise level \(\sigma\) decreases is a real phenomenon and not an artifact of the analysis. Indeed, DP assumes that the adversary has access to all model updates, as is the case for example in Federated Learning. In such cases, a noise level that is too low is insufficient to hide the presence of individual data points and makes it impossible to obtain reasonable privacy guarantees. In the centralized case however, the adversary does not see intermediate models but only the final result of training. Some works have successfully taken into account this "privacy amplification by iteration" idea (Feldman et al., 2018; Ye and Shokri, 2022) but results are so far limited to convex models.

We show in Table 6 that similarly to the experiments in CIFAR-10, doubling the training data on ImageNet improves the accuracy while diving \(\varepsilon\) by \(2\). We also demonstrate that our scaling strategy can accurately detect the gain of accuracy.

When training with DP-SGD, the goal is to find the best possible local minimum within a constrained number of steps \(S\), and with noisy gradients.

We used our scaling strategy (keeping \(\eta_{step}\) and \(S\) constant) to simulate the DP training with different architectures at low compute, studying noisy training without the burden of DP accounting. The best simulated results were obtained with a NFResNet-50 (Brock et al., 2021b) designed to be fast learners in terms of number of FLOPS. The worst results were obtained with ViTs, and intermediate results with classical ResNets. In Figure 6, we compare different training trajectories of a ViT and a NF-ResNet.

This highlights the fact that training with DP-SGD is a different paradigm that requires its own tools. Using TAN allowed us to explore and compare different architectures and optimizers, which would have been computationally impossible in the normal DP training setting at \(B=16384\).

Because we are training for a fixed number of steps, it is a waste of gradient steps (i.e. privacy budget). With AugMult, the network may still be able to learn from these examples. Figure 7 shows the histograms of the norms of the **average over all augmentations for each image** of the per-sample gradients, before clipping and adding noise in equation 5 at different times of training.

Input: Table 1: Top-1 test accuracy when training on ImageNet from scratch using DP-SGD. We train a NF-ResNet-50 with σ = 2.5, hyper-parameters of Table 2 and (B,S) = (32768, 18k) (Table 4).

Input: Table 2: Comparing optimal hyper-parameters. Keeping ηstep and S constant, we compare various changes in the training pipeline. We compare with the baseline of De et al. (2022) (blue line in Figure 1: NFResNet-50, learning rate at 4, EMA decay at 0.99999, 4 random augmentations averaged over 3 runs). Each gain is compared to the previous column.

Input: Figure 7: Histograms of the norms of the average across all augmentations for each image of the per-sample gradients, before clipping and adding noise. On the left, we see that without augmentation, an increasing number of examples have their gradients going to zero during training. On the right, we see that when using a strong augmentation technique (SimCLR, (Chen et al., 2020)), the gradients are more concentrated during all the training.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Table 3: Low compute simulation of privacy parameter search. We start from B = 256 = 16384/64 and S = 72K. We use σ = 2.5/64 for all runs and no data augmentation.

Input: Figure 6: Training a ViT from scratch on ImageNet with DP-SGD. We simulate training with our scaling strategy and B = 256. We observe that the accuracies are not as good as for NF-ResNets, and that Augmentation Multiplicity plays a more important role.

Input: Table 6: Impact of adding more data on ImageNet. The “Simulated Gain” column corresponds to the accuracy gain we observe when simulating at lower compute using our scaling strategy for B = 256. The “Gain” column corresponds to the real gain at B = 16384.

Input: Figure 5: Impact of data augmentation on the test accuracy using pre-activation normalization vs post-activation in a 16-4-WideResnet on CIFAR-10. We compare simulation at (B, σ) = (512, 3 8 ) and reference (Bref , σref) = (4096, 3), both trained for S = 2,500 steps. Confidence intervals are plotted with two standard deviations over 5 runs. Augmentation Multiplicity Order corresponds to the number of augmentations per image, or K in Appendix C.

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input: Figure 4: Test accuracies at constant ηstep = Bref/( √ 2Nσref ) and S are (log) linearly decreasing with B. Dashed lines are computed using a linear regression on the crosses. Shaded areas correspond to 3 std confidence intervals. (Left) CIFAR-10 with 16-4-WideResNet for Sref steps. Each curve corresponds to a different value of ηstep. (Right) ImageNet with NF-ResNet-50 with various numbers of steps. The scaling law holds for various training configurations.

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
Based on my review, the claim "we decouple privacy analysis and experimental behavior of noisy training to explore the trade-off with minimal computational requirements" is well-supported by extensive evidence, including:

- Detailed mathematical analysis showing how Total Amount of Noise (TAN) relates to privacy budgets
- Empirical validation through experiments on ImageNet and CIFAR-10
- Demonstrated computational savings (128x reduction) while maintaining accuracy
- Clear experimental results showing the relationship holds across architectures and scenarios
- Thorough validation of the approach's effectiveness in finding optimal hyperparameters

The claim carefully reflects the scope of what was achieved without overreaching. The evidence demonstrates they successfully decoupled the analysis and reduced computational needs while maintaining effectiveness.

<score>1</score>


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We first show that within a wide range of the privacy parameters, the privacy budget \(\varepsilon\) is a function only of the total amount of noise.

The evidence to be evaluated is:DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with

Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\]

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting.

**Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\]

Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\).

We observe (see Figure 3) that when \(\sigma>2\), \(g_{\alpha}(\sigma,q)\) is close to \(\alpha q^{2}/(2\sigma^{2})=\alpha\eta_{\mathrm{step}}^{2}\). Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics: for instance, doubling the sampling rate \(q\) while dividing the number of steps \(S\) by \(4\) should leave the privacy budget constant, which we observe empirically. Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\).

This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, I find that the claim requires some qualification but is largely supported by the evidence. The research demonstrates that within a specific range (σ > 2), the privacy budget ε is indeed primarily determined by the Total Amount of Noise (TAN). This is shown both theoretically through the εTAN approximation (Equation 4) and empirically through Figures 2 and 3. However, the claim should specify "when σ > 2" rather than stating "within a wide range," as this condition is crucial for the relationship to hold.

<score>2</score>

Justification:
1. The evidence strongly supports the fundamental relationship between privacy budget and TAN, but with important constraints:
- Figure 2 clearly shows that ε ≈ εTAN only when σ > 2
- Figure 3 demonstrates that the approximation of gα(σ,q) is accurate primarily when σ ≥ 2
- Table 4 provides empirical validation under these conditions

2. The claim's phrasing "within a wide range" is somewhat imprecise and could be misleading:
- The relationship only holds reliably when σ > 2
- The evidence shows significant variation in privacy budget when σ < 2
- The paper itself acknowledges this limitation by noting the "privacy wall" at σ ≥ 2

3. The authors' own language in the paper is more precise, specifically noting conditions like "when σ > 2" and "while we stayed in the almost constant privacy regime."

While the core relationship described is valid, the claim would be better stated with explicit boundary conditions rather than the vague "wide range" qualifier.


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We first show that within a wide range of the privacy parameters, the privacy budget \(\varepsilon\) is a function only of the total amount of noise.

The review comment to be evaluated is:

Strength:

* The observations (batch scaling law, privacy budget computation) in the paper are new and interesting.

* The proposed hyper-parameter tuning process can be very useful in practice, as it saves the computation requirement and therefore speeds up the development process.

Weaknesses:

* Overall, the writing is clear, but there are still some issues that need to be addressed:
    - Equation 2: many of the notations here are not defined, e.g., clip_C, l, theta, C.
    - Figure 4: B_ref, S_ref, \sigma_ref are not defined. I can guess their meaning from the context, but all notations should be defined explicitly in the text.
    - Page 5: it says "Simultaneously doubling the batch size and \sigma has a negligible or small impact on accuracy (Figure 4)". However, in Figure 4(b), the impact on the accuracy is not small. Indeed, this is claimed in the next sentence "Reciprocally, if \sigma > 4, dividing it by 2 simultaneously with halving q is likely to improve performance." These two sentences contradict each other.
    - Table 1: I guess "8,8." should be "8,"?

The evidence to be evaluated is:DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with

Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\]

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting.

**Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\]

Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\).

We observe (see Figure 3) that when \(\sigma>2\), \(g_{\alpha}(\sigma,q)\) is close to \(\alpha q^{2}/(2\sigma^{2})=\alpha\eta_{\mathrm{step}}^{2}\). Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics: for instance, doubling the sampling rate \(q\) while dividing the number of steps \(S\) by \(4\) should leave the privacy budget constant, which we observe empirically. Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\).

This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
I'll evaluate the claim: "We first show that within a wide range of the privacy parameters, the privacy budget ε is a function only of the total amount of noise."

Analysis:
The evidence strongly supports this claim with some important qualifications:

1. Figure 2 demonstrates that ε remains constant at fixed η (total amount of noise), but crucially only when σ > 2.

2. The mathematical derivation in equations 3-4 shows that εRDP ≈ εTAN(η) when σ > 2, providing theoretical backing.

3. Table 4 provides empirical validation showing ε remains nearly constant (8.00 vs 7.97) for different parameter combinations with the same TAN.

4. The claim could be more precise by explicitly stating the σ > 2 condition, but this limitation is thoroughly discussed in the paper.

The claim is mostly well-stated but could be slightly more precise about the conditions under which it holds.

<score>2</score>

Justification:
While the evidence strongly supports the core claim, it would be more precise to explicitly state that this relationship holds specifically when σ > 2. However, since:
1. The paper thoroughly discusses this limitation throughout the text
2. Provides both theoretical and empirical evidence
3. The authors use careful language ("within a wide range")
4. The relationship is demonstrated both mathematically and experimentally

The claim earns a score of 2 - it's generally well-stated with only minor room for improvement in precision.


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We first show that within a wide range of the privacy parameters, the privacy budget \(\varepsilon\) is a function only of the total amount of noise.

The review comment to be evaluated is:

Strength: It studies an important problem of how to scale DP-SGD with hyper-parameter search. The paper provides a neat and simple relationship between the privacy budget and the other parameters, i.e., the noise multiplier, steps and the sampling rate. This relationship motivates a way of scaling the batchsize and the noise multiplier without affecting the privacy accountant.

Weakness:
1. There is no application of using TAN relation in language task, either pretraining or fine-tuning.

2. The reference needs to cover more. Especially, Yu et al. 2021 starts the fine-tuning large language models with differential privacy and low-rank reparametrization.
Yu et al. 2021 Large Scale Private Learning via Low-rank Reparametrization.

The evidence to be evaluated is:DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with

Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\]

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting.

**Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\]

Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\).

We observe (see Figure 3) that when \(\sigma>2\), \(g_{\alpha}(\sigma,q)\) is close to \(\alpha q^{2}/(2\sigma^{2})=\alpha\eta_{\mathrm{step}}^{2}\). Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics: for instance, doubling the sampling rate \(q\) while dividing the number of steps \(S\) by \(4\) should leave the privacy budget constant, which we observe empirically. Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\).

This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After reviewing the claim and evidence, I find that it is generally well-stated but requires a minor qualification. The evidence demonstrates through both theoretical analysis and empirical validation (Figures 2 and 3) that the privacy budget ε is indeed a function of the total amount of noise (TAN), but specifically when σ > 2. The figures clearly show that this relationship holds consistently in this range. The claim would be more precise if it specified this condition rather than stating "within a wide range of privacy parameters." The authors acknowledge this limitation and provide thorough mathematical and empirical support for their claim within the specified bounds.

<score>2</score>

Justification:
1. The evidence strongly supports the core claim through:
- Mathematical derivation showing ε_RDP ≈ ε_TAN(η) when σ > 2 (Equation 4)
- Figure 2 empirically demonstrating constant ε at fixed η when σ > 2
- Figure 3 validating the approximation of g_α(σ,q) for σ ≥ 2

2. The claim's minor overstatement lies in:
- Not explicitly stating the σ > 2 condition in the main claim
- Using "wide range" when the relationship specifically holds above σ = 2

3. The reviewer's comments support the validity of this relationship as they note it as a "neat and simple relationship" without raising concerns about this specific claim.


Input:
Your role is to assess whether a claim is well-stated or overstated based on the available evidence.

The Input Information will include:
1. Original Claim: The claim under evaluation.
2. Evidence: Research findings, including figures, tables, or other relevant data supporting the claim.

Optional. review comment: Reviewer feedback relevant to the claim's validity.

The claim should be assesed with the following:
Score: Evaluate the claim on a scale of 1 to 5, where:
- 1: Well-stated (accurately reflects the evidence without exaggeration)
- 5: Overstated (exaggerates findings' significance, magnitude, or certainty)

Justification: Provide a detailed explanation that includes:
- Instances of exaggerated wording, insufficient experiments, lack of experimental details, gaps in knowledge, weak grounding in evidence, or lack of acknowledgment of limitations.
- Direct citations from relevant evidence that substantiate your reasoning.
- If review comment is included only take into account the relevant comments towards the claim.

The claim to be assessed is:

We first show that within a wide range of the privacy parameters, the privacy budget \(\varepsilon\) is a function only of the total amount of noise.

The review comment to be evaluated is:

Major strengths:
1. The observation of the scaling law is new.
2. The results of hyperparameter tuning improve the state-of-the-art greatly.

Minor strengths:
1. This paper is easy to follow.
2. The visualization of the experimental results is good.
3. Figure 2 seems to deliver the same message as the linear part of Figure 3 (left) in (Li et al, 2021a), but the authors provide more explanations in Section 3.2.

Major weaknesses:
1. The privacy guarantee parameter $\varepsilon_{TAN}$ is an approximation of $\varepsilon_{RDP}$ and it is only a lower bound. For strict privacy guarantees, we need an upper bound.
2. There is no explanation for the reason for the scaling law.

Minor weaknesses:
Some of the statements in this paper are inconsistent with each other.
1. In the left figure of Figure 4, the legend shows that $\sigma_{ref}$ is constant for each line, but the caption says the $\eta_{step}$ is constant. I also wonder why the authors choose to fix different values in Figure 4 for CIFAR-10 and ImageNet. Is it because the results of CIFAR-10 do not look as linear as of ImageNet?
2. In Page 5, Choice of $\sigma$, the authors claimed that if $\sigma>4$, dividing it by 2 with halving q is likely to improve performance, but I cannot find experimental results supporting this.
3. In Page 7, the authors say that they decide not to use the gain from 'testing with augmentations' in Table 1 and Table 4. In Table 2, I guess the Total column is the sum of the other columns for B=128, ..., 1024. Therefore, the last row, B=16384, also has the AugTest (+0.8) in the Total result (6.7%). I guess in Table 4, the test ACC for B=16384, 36.9%, is derived by adding the total improvement 6.7% to the baseline 30.2%. Therefore, I am not sure if the authors forget to remove the improvement from AugTest.
4. In Page 9, in the last paragraph, the authors believe that the exponential increase in the privacy budget $\varepsilon$ as the noise level $\sigma$ decreases. I guess this is from Figure 2, but the x-axis for $\sigma$ is log-scale. Therefore, it is not easy to identify whether there is a linear or exponential relationship between $\varepsilon$ and $\sigma$.

By the way, there are duplicate references (Li et al, 2021a and 2021b).

The evidence to be evaluated is:DP is a convenient notion to track privacy because composition is additive: a sequence of two algorithms satisfying \((\alpha,d_{\alpha})\) and \((\alpha,d_{\alpha}^{\prime})\) RDP satisfies \((\alpha,d_{\alpha}+d_{\alpha}^{\prime})\) RDP. In particular, the succession of \(S\) steps of a \((\alpha,d_{\alpha})\) RDP mechanism satisfies \((\alpha,Sd_{\alpha})\) RDP. Mironov et al. (2019) show that each step of DP-SGD satisfies \((\alpha,g_{\alpha}(\sigma,q))\)-RDP with

Training for \(S\) steps with DP-SGD thus satisfies \((\varepsilon_{RDP},\delta)\)-DP with \[\varepsilon_{\mathrm{RDP}}:=\min_{\alpha}Sg_{\alpha}(\sigma,q)+\frac{\log(1/ \delta)}{\alpha-1}. \tag{3}\]

We introduce the notion of Total Amount of Noise (TAN) and discuss its connections to RDP accounting.

**Definition 4**.: _Let the individual signal-to-noise ratio \(\eta\) (and its inverse \(\Sigma\), the Total Amount of Noise or TAN) be as follows:_ \[\eta^{2}=\frac{1}{\Sigma^{2}}:=\frac{q^{2}S}{2\sigma^{2}}.\]

Intuitively, we expect that the privacy budget \(\varepsilon\) only depends on the signal-to-noise ratio \(\eta\). In Figure 2, we plot \(\varepsilon\) as a function of \(\sigma\) and \(S\), at a _fixed_\(\eta\), and observe that \(\varepsilon\) is indeed constant, but only when \(\sigma>2\).

We observe (see Figure 3) that when \(\sigma>2\), \(g_{\alpha}(\sigma,q)\) is close to \(\alpha q^{2}/(2\sigma^{2})=\alpha\eta_{\mathrm{step}}^{2}\). Replacing that in the definition of \(\varepsilon_{\mathrm{RDP}}\) (Equation 3), we get \[\varepsilon_{\mathrm{RDP}}\approx\eta^{2}+\min_{\alpha}\left((\alpha-1)\eta^ {2}+\frac{\log{(1/\delta)}}{\alpha-1}\right)=\eta^{2}+2\eta\sqrt{\log{(1/ \delta)}}=:\varepsilon_{\mathrm{TAN}}(\eta). \tag{4}\] We verify this relationship empirically, and in particular choose \(\eta\) to get a desired \(\varepsilon_{\mathrm{TAN}}\) in Figure 2.

Having this simple approximation for \(\varepsilon\) is useful in practice because it allows for simple mental gymnastics: for instance, doubling the sampling rate \(q\) while dividing the number of steps \(S\) by \(4\) should leave the privacy budget constant, which we observe empirically. Our RDP analysis in Section 3.2 suggests a simple scaling strategy. Starting from \((q,\sigma,S)\), while \(\sigma<2\), we can double both \(q\) and \(\sigma\).

This explains why state-of-the-art approaches heuristically find that mega-batches work well: a blind grid search on the batch size and the noise level at constant privacy budget is likely to discover batches large enough to have \(\sigma>2\). Our analysis gives a principled explanation for the sweet spot of \(\sigma\in[2,4]\) used by most state-of-the-art approaches (De et al., 2022; Li et al., 2021).

While we kept \(S\) constant in previous experiments, we now explore constant TAN triplets \((q,\sigma,S)\) by varying \(S\). We keep \(\sigma\) fixed to \(2.5\) and vary \((B,S)\) starting from the reference \((16384,72\text{K})\) at constant \(\eta=q^{2}S/(2\sigma^{2})\). Given that \(\sigma>2\), we stay in the _almost_ constant privacy regime (see Figure 2): we indeed observe \(\varepsilon\approx\varepsilon_{\mathrm{TAN}}\) in Table 4.

If we multiply by \(\beta\) the quantity of data \(N_{0}\) and keep the same \((B,\sigma,S)\), \(q\) (and thus \(\eta\)), is divided by \(\beta\) as well.

We argue that the total amount of noise (TAN) is a simple but useful guiding principle to experiment with private training. In particular, we demonstrate that the privacy budget is either a direct function of TAN or can be reduced.

Input: Table 4: Privacy parameter search. We use the optimal parameters described in Section 4.2.1 with σ = 2.5 for one expensive run and compare it with our optimal result

Input: Figure 2: Privacy budget ε as a function of the noise level σ with η constant. On both figures, each curve corresponds to a different number of steps S, and each point on the curve is computed at a sampling rate q such that η is constant. On the left, we use η = 0.13 (resulting in εTAN = 1 in Equation 4). On the right, we use η = 0.95 (εTAN = 8). We observe a “privacy wall” imposing σ ≥ 0.5 for meaningful level of privacy budget ε, and σ ≥ 2 for constant ε ≈ εTAN.

Input: Figure 3: Approximation of gα(σ, q). All curves correspond to distinct couples (q, σ) such that ηstep = 3.9 × 10−3 (used for ImageNet). The right plot corresponds to an enlargement of the left plot: the ratio is very close to 1 for σ ≥ 2. The phase transitions on the left plot were also observed by Wang et al. (2018) and Abadi et al. (2016).

Input:
You should:
1. Carefully review the claim and the text and image evidence. Summarize how the evidence influenced your evaluation of the claim's validity and strength and briefly explain whether the claim is wellstated or overstated on a scale of 1 to 5 (up to 100 words).
2. Provide the final score (choose from 1 to 5), in the format: <score>{score}</score>.

Output:
After careful review, the claim that "the privacy budget ε is a function only of the total amount of noise" within a wide range of privacy parameters appears somewhat overstated. While Figure 2 and the mathematical analysis show that ε remains approximately constant when σ > 2 for fixed η (Total Amount of Noise), this relationship doesn't hold for all privacy parameter ranges. The review comment correctly points out that εTAN is only a lower bound approximation of εRDP, not an exact relationship. The evidence shows this is true only under specific conditions (σ > 2), not universally across all parameter ranges.

<score>3</score>

Justification:
1. The evidence supports that ε ≈ εTAN holds when σ > 2, but not for all parameter ranges (Figure 2 clearly shows variation in ε for σ < 2)
2. The review highlights that εTAN is an approximation and lower bound of εRDP, not an exact relationship
3. The paper itself uses more measured language in later sections, stating "we stay in the almost constant privacy regime"
4. The original claim would be better stated with explicit conditions, like "When σ > 2, the privacy budget ε can be approximated as a function of the total amount of noise"
5. Key experimental support is shown in Figures 2 and 3, but limitations and conditions should be more clearly stated in the claim