Differential Privacy Fine-Tuning by Budget

Differential privacy fine-tuning should begin with a protected unit, an explicit epsilon and delta budget, and authority to stop. Noise, clipping, and accountant output are useful only when they constrain a real training and release decision.

This guide connects DP-SGD mechanics to cohort utility and a pre-run stop rule. The runnable ledger is deliberately small; a pinned Opacus job remains the empirical path for the actual model.

Start differential privacy fine-tuning with adjacency

Differential privacy fine-tuning needs a protected unit and neighboring-dataset definition before it needs a noise multiplier. The plan names whether removing one person, account, or bounded contribution creates the neighbor, then declares epsilon, delta, accountant, sampling rule, utility floor, and authorized stop. That turns privacy budget from a decorative model-card number into an enforceable training constraint.

A privacy budget begins with the protected unit: one person, one account, or one document collection. Sampling assumptions and clipping only become meaningful after that adjacency definition is written down. I record dataset size, expected inclusions, delta rationale, target epsilon, accountant, sampling scheme, and allowed reruns before training touches the private corpus.

Runnable artifact: The pure ledger validates delta, composes illustrative costs, and stops before budget or cohort failure.

Save this proof as privacy-budget-ledger.test.mjs and run node privacy-budget-ledger.test.mjs. Expected final line: PASS: privacy stop rule.

import assert from "node:assert/strict";
const validate=x=>{assert.ok(x.delta>0&&x.delta<1);assert.ok(x.epsilon>0);return x}; const compose=entries=>entries.reduce((sum,x)=>sum+validate(x).epsilon,0); const decide=({spent,next,budget,utility,gain,cohort})=>spent+next>budget||gain<.002||utility<cohort?"stop":"continue";
assert.equal(compose([{epsilon:1.2,delta:1e-6},{epsilon:.8,delta:1e-6}]),2); assert.equal(decide({spent:3.7,next:.5,budget:4,utility:.84,gain:.01,cohort:.8}),"stop"); assert.throws(()=>validate({epsilon:1,delta:1})); console.log("PASS: privacy stop rule");

Connect clipping, noise, and utility.

DP-SGD clips each protected contribution before adding calibrated noise to the aggregate. A smaller norm bounds influence more aggressively but can discard useful gradients; a larger norm preserves more signal while requiring more noise for the same privacy target. The matrix makes that three-way pressure visible, and cohort clipping statistics reveal who pays the utility cost hidden by an average.

Per-sample gradients are clipped to a declared norm before calibrated noise is added, limiting how much one protected unit can move an update. The clipping distribution is logged by cohort because a globally acceptable median can still erase a minority pattern. Raising the norm to recover utility spends sensitivity, while lowering it too far converts privacy protection into silent underfitting.

Use an accountant as a ledger, not an oracle

The Opacus privacy-accounting API connects sample rate, steps, noise, and delta to an epsilon estimate under a named accountant. The Dwork–Roth monograph grounds composition. Neither decides the organization's acceptable budget, so the signed plan records that governance judgment separately from the computed result.

Opacus computes an accountant result from the actual sample rate, noise multiplier, steps, and delta; the article never treats epsilon as a universal quality grade. The Dwork–Roth monograph gives the formal composition foundation, while deployment policy decides what budget is acceptable for this use. Those two judgments belong in different fields of the release receipt.

Run a tiny Opacus path with pinned inputs.

The Opacus text-classifier tutorial shows how per-sample gradient machinery enters a training loop. The article's Node artifact tests budget logic quickly, while the production receipt pins the actual Opacus job, dataset transform, sample rate, secure randomness setting, and accountant checkpoints. This is a simplified control model, not a substitute for executing the library.

Utility gates use a public or separately governed evaluation set and report the non-private baseline beside the private candidate. I compare overall quality, worst named cohort, memorization probes, calibration, and operational cost. A model that clears average accuracy while collapsing a small cohort fails even if the accountant remains under budget.

Stop before the privacy budget is exhausted

Before each epoch, the controller projects next-step privacy cost and evaluates utility gain and worst-cohort floor. It stops on budget breach, stalled benefit, or a cohort regression. Links to DPO drift checks and QLoRA memory receipts show that private training still needs ordinary model-quality and systems evidence.

The stop rule is checked before every next epoch, not after the run consumes its full allocation. Training stops when projected privacy cost crosses the approved ceiling, marginal utility stalls for two evaluations, or any safety cohort falls below its floor. Unused budget is not an invitation to keep optimizing; it is retained capacity for a reviewed future run.

Work a budget from proposal to stopped epoch. Suppose a team protects one account's bounded message contribution, approves delta at one over a documented population scale, caps epsilon at 4, and requires at least 0.82 quality on its smallest language cohort. The accountant reports 3.35 after epoch six and projects 0.72 for epoch seven, while utility improved only 0.001 on the last evaluation. Differential privacy fine-tuning stops: the next epoch would cross budget and marginal benefit has already fallen below the approved rule.

The ledger retains the epoch-six checkpoint, accountant state, clipping histogram, public evaluation metrics, and the rejected projection. Nobody rounds 4.07 down or reruns with a different seed outside the trial budget. This example is simplified composition logic, but it demonstrates why stop authority must exist before an exciting training curve appears. The rule defeats optimism precisely when the team is most tempted to negotiate with its earlier limit.

Budget model selection and repeated access

A run ledger includes failed trials, private validation queries, restarts, and selection logic, not only the winning checkpoint. Public proxy experiments can narrow the space before one governed private confirmation. Without that accounting, teams can spend privacy through hyperparameter search while publishing the epsilon of a single final run as though the other interactions never occurred.

Hyperparameter search also consumes information about the protected data when private metrics guide selection. The ledger therefore budgets trials and selection, or uses public proxies before one private confirmation. Reporting only the final run's epsilon while hiding dozens of privately tuned candidates understates the mechanism's real exposure.

Plan deletion, retraining, and downstream release. Differential privacy fine-tuning can bound one training mechanism without settling data retention, model access, or deletion obligations. The source dataset still needs purpose, access, correction, and retention policy; derived checkpoints still need release controls and incident response. If adjacency assumptions change because accounts can now contribute unbounded records, the old accountant receipt no longer supports the new story, even when model weights are unchanged.

Downstream distillation, merging, or continued training receives the prior privacy receipt as input and evaluates its own composition or post-processing assumptions. The model registry displays protected unit, budget, accountant, code and data revisions, evaluation gates, and authorized uses. Differential privacy fine-tuning is strongest as one layer in a governed lifecycle, not a mathematical phrase used to waive ordinary privacy engineering.

Compare the private candidate by cohort

The non-private baseline, private candidate, and an untrained or frozen control use the same evaluation contract. Report task utility, calibration, memorization probes, subgroup floors, latency, and training cost. Related work on model distillation can reduce serving cost later, but it does not refund privacy already spent during fine-tuning.

The tiny artifact tests ledger arithmetic and stopping behavior without claiming to train a useful language model inside a documentation test. A real Opacus job is pinned separately with framework, dataset transform, secure random setting, and accountant state checkpoints. This split keeps continuous integration fast while preserving a reproducible path to the empirical receipt.

Monitor the released private checkpoint. Release monitoring watches utility cohorts, memorization probes, access patterns, and uses outside the approved purpose. A privacy guarantee under stated assumptions does not make unrestricted distribution wise, and a later data-pipeline bug may invalidate the contribution bounds used by the accountant. Differential privacy fine-tuning receipts therefore link to incident response and model withdrawal procedures. If a protected-unit or sampling assumption changes, the owner freezes promotion, reconstructs the ledger, and either supplies a new valid analysis or retires the affected checkpoint.

Sign a release receipt with real authority

Differential privacy fine-tuning ships with protected-unit definition, dataset version, target and realized budget, clipping distribution, accountant state, baseline comparison, cohort gates, owner, and retraining trigger. The AI eval contract supplies the measurement spine. If reviewers cannot explain both epsilon assumptions and utility loss, the checkpoint remains an experiment.

Opacus fine-tuning can produce the accountant receipt for the pinned run, but governance still owns the release decision. The epsilon delta pair is meaningful only beside its adjacency definition, sample process, step count, and utility evidence.

Release authority belongs to someone who can reject both privacy and utility failures. The signed receipt includes budget owner, protected unit, accountant output, baseline deltas, cohort gates, code revision, and deletion or retraining trigger. Differential privacy fine-tuning becomes credible when the number constrains the program rather than decorating its model card.

Differential privacy fine-tuning is a governed optimization problem: adjacency, budget, clipping, accounting, cohort utility, and stop authority travel together. Release differential privacy fine-tuning only when both the privacy ledger and model-quality receipt pass.