Repository navigation
DP: fix Laplace calibration (F4) and label post-training mechanisms experimental (F5) #279
Description
Summary
Three open items remain from our DP mechanism review (PR #89) and its follow-up fixes (#90, #109, #119). None of them has a GitHub issue yet; two are tracked only in Developer/BACK_LOG.md (BL-23, BL-24).
DP is off by default on DevNet, and our public docs avoid claiming formal differential privacy. The goal here is that, when a model owner turns DP on, every mechanism we offer either carries an honest guarantee or is clearly labelled as not having one.
The three items
F4 / BL-24: Laplace noise is sized against an L2 clip.
post_training_laplace multiplies laplace_scale by the L2 clipping_norm (cache_model_0/services/client.py, require_laplace_scale(params) * clipping_norm), but the Laplace mechanism is calibrated against L1 sensitivity. For model weights, the gap can be up to √d (d = number of parameters), so this mechanism cannot carry any ε today. The docs already note it as an open question (Documentation/technical/services/clients.md).
F5: the post-training mechanisms bound no sensitivity at all.
Both post_training_gaussian and post_training_laplace clip absolute trained weights rather than per-client updates, so they bound nothing an attacker cares about. The review recommends labelling both as experimental baselines with no formal guarantee, and treating update_gaussian as the path forward. Today only the per_layer clip scope is labelled experimental in the docs.
BL-23: the default clip may be destructive on real models.
Since #109, clip_scope: global bounds the whole model's combined L2 norm, but cache_model_0/manifest.json still uses clipping_norm: 1.0, chosen under the old per-layer scope. Tests use synthetic tensors only, so nobody has checked whether this default badly degrades the reference model's real trained weights.
Ways to help
Track A: honest labelling (newcomer-friendly, no DP expertise needed)
- Emit a clear warning when
post_training_gaussianorpost_training_laplaceis selected (log message or manifest-validation warning): experimental, no formal privacy guarantee. - Update
Documentation/technical/services/clients.mdto match. - Add a test in
tests/test_cache_client_dp.pycovering the warning.
Track B: specialist recommendation for F4 (DP expertise wanted)
- Is the mismatch as described, and how large is it in practice for typical model sizes?
- Which resolution would you recommend?
- an
update_laplacemechanism: L1-clip the per-client update and add calibrated Laplace noise, mirroringupdate_gaussian; - keep
post_training_laplaceonly as a labelled experimental baseline (Track A); - remove the Laplace option entirely.
- an
- Given F5, is there any reason to keep weight-level mechanisms at all?
A written recommendation in a comment is a valuable contribution on its own; a PR is even better.
Track C: verify the default clip (ML / Python, moderate)
Run apply_dp_mechanism / clip_state_dict against cache_model_0's actual trained weights under the current default. Report how much the clip changes them and the effect on accuracy, then propose a better clipping_norm if 1.0 is destructive. Ideally add a test using real weights.
Longer-term context
Privacy accounting and DP-SGD (review finding F6) are the bigger roadmap items, described in Developer/issues/DifferentialPrivacy.md. They're out of scope here, but proposals are welcome as separate issues.
cc @tudorcebere : we'd especially value your view on Track B, given your background in privacy-preserving ML. No obligation, of course.
Activity
abrahamnash commentedon Oct 26, 2026
The last part of this issue, verifying the default clip on real weights (BL-23), is already covered by #247 and PR #263, so I'm dropping it from here to avoid duplicate work. The Laplace calibration fix (F4) and labelling the post-training mechanisms experimental (F5) still stand.
[-]DP: fix Laplace calibration (F4), label post-training mechanisms experimental (F5), and verify the default clip on real weights (BL-23)[/-][+]DP: fix Laplace calibration (F4) and label post-training mechanisms experimental (F5)[/+]Abidoyesimze commentedon Oct 28, 2026
Picked up all three tracks. Opened as three separate, independently-reviewable PRs since they touch different concerns:
Track A (#288, already up): reclassified both
post_training_gaussianandpost_training_laplaceas experimental/no-formal-guarantee - runtime warning on selection, docs updated, BL-24 noted.Track B (#292): F4 fix, not just a recommendation. Confirmed the mismatch is real and severe - for this repo's ~109K-parameter reference model, the L1-vs-L2 gap is roughly 330x (
√d), and for real (dense, not sparse) NN weight tensors the actual ratio tends toward that worst case rather than away from it. Addedupdate_laplace: mirrorsupdate_gaussian's delta-level privatization but L1-clips the delta instead of L2, soclipping_normbecomes the sensitivity bound Laplace noise is actually calibrated against.post_training_laplaceitself is untouched and stays experimental-only (F5 applies to it independently of F4).Track C (#293): verified
clipping_norm: 1.0against a real trained model (real MNIST, real architecture,train_client_model's actual hyperparameters) rather than synthetic tensors. It was badly destructive - clipping alone dropped holdout accuracy from 85.25% to 36.25%, and the real post-training weight norm measured 9.3-12.6 across seeds/configs (9-12x over the old default). Raised to 15.0.That investigation also turned up something not in BL-23's original framing: raising
clipping_normalone doesn't fix the collapse, because the defaultnoise_multiplier: 0.5is independently destructive at any clipping_norm - the aggregate noise norm scales asnoise_multiplier * clipping_norm * √(num_params), which for this model size is a ~330x multiplier regardless of how well the clip is tuned. Full numbers and sweeps are in the newDocumentation/technical/audits/dp-clipping-norm-verification.md(#293). Left that one unfixed deliberately - it's an epsilon/accounting decision, not a default-value tweak, and belongs with the accountant-integration workdp-mechanism-review.mdalready prioritizes.All three PRs run standalone against current
develop(no dependency chain between them), each with their own test coverage and doc updates.feat(dp): add update_laplace -- L1-clipped delta privatization (issue I…
docs(good-first-issues): mark DP review done (PR #89); add #245 setup…
feat(dp): label post-training mechanisms experimental (issue #279 Tra…
abrahamnash commentedon Oct 29, 2026
Status update:
@tudorcebere a short written view on any of these would help a lot, even a few lines:
If we haven't heard back by 12 November, we'll go ahead with the core team's review of #292 and the interim fix in #299 (DP off by default, with a clear warning and measured utility table). Your view would still be welcome after that.
feat(dp): add update_laplace -- L1-clipped delta privatization (issue I…