Pith. sign in

REVIEW 4 major objections 5 minor 36 references

Mitigating Disparate Impact of Differentially Private Learning through Bounded Adaptive Clipping

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a lower bound to adaptive gradient clipping prevents private models from crushing minority-class gradients, lifting worst-class accuracy by over 10 points.

desk verdict A one-line floor on adaptive clipping's bound is a plausible fix for a real failure mode, but the headline gains should be discounted until the evaluation uses a proper validation split. read the letter →

arxiv 2506.01396 v2 pith:XETZE5LW submitted 2025-06-02 cs.LG cs.CRstat.ML

Linzh Zhao , Aki Rehn , Mikko A. Heikkilä , Razane Tajeddine , Antti Honkela This is my paper · ORCID
classification cs.LGcs.CRstat.ML
keywords differentialprivacyDP-SGDadaptiveclippingboundeddisparateimpactworst-classaccuracyfairnessprivatehyperparameteroptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adaptive gradient clipping in differentially private stochastic gradient descent (DP-SGD) is meant to help underrepresented groups, but this paper argues that the current schemes often do the opposite: the clipping bound shrinks geometrically once the majority of samples fit well, crushing the gradients of harder or minority samples and lowering their class accuracy. The proposed fix is a one-line change to the update rule, a tunable lower bound $C_{\mathrm{LB}}$ on the adaptive clipping threshold, so the bound keeps adapting but cannot collapse to a value that silences challenging groups. On skewed MNIST and Fashion MNIST, this bounded adaptive clipping improves worst-class accuracy by over 10 percentage points over unbounded adaptive clipping, around 7 points over automatic clipping, and over 5 points over constant clipping, with no added privacy cost. The privacy analysis is unchanged because the noisy gradient update and the noisy bound-counting query compose exactly into one Gaussian mechanism. If the claim is right, flooring the clipping bound is a cheap, drop-in way to reduce the disparate impact that DP training is known to create.

What carries the argument

The load-bearing object is the lower-bounded adaptive clipping rule $C_{t+1}=\max(C_{\mathrm{LB}}, C_t\exp(\eta_C(\tilde b_t-\gamma)))$, a geometric quantile tracker fitted with a floor. In the update, $\gamma$ is the target quantile, $\tau$ marks outlier gradients relative to the current bound, $\eta_C$ is the bound's learning rate, and $\tilde b_t$ is the privacy-protected count of gradients exceeding $\tau C_t$; setting $C_{\mathrm{LB}}=0$ recovers the earlier unbounded methods. The floor is what prevents the exponential decay that otherwise silences minority gradients, while the multiplicative update keeps adaptivity. The companion privacy machinery is a composition lemma showing that two Gaussian mechanisms with sensitivity 1 and noise multipliers $\sigma_1,\sigma_2$ are jointly equivalent to one Gaussian mechanism with $\sigma=(\sigma_1^{-2}+\sigma_2^{-2})^{-1/2}$, which lets the counting query be charged together with the gradient update in a standard accountant.

What would settle it

Track the clipping bound $C_t$ and per-class clipped gradient norms during unbounded adaptive clipping of a deep network on an imbalanced dataset: if $C_t$ stays near a stable equilibrium rather than decaying toward machine precision while the worst class's clipped gradient magnitude drops, the collapse mechanism is absent, and the observed worst-class gaps should also vanish. Alternatively, on a benchmark where the two schemes differ, set $C_{\mathrm{LB}}$ below the smallest naturally reached bound; the method's worst-class advantage should disappear.

Watch

Extended reading notes

Core claim

The central discovery is that unbounded adaptive clipping, the quantile-tracking rule used by the two prior state-of-the-art schemes, has a structural failure mode once different groups learn at different speeds. Its update is $C_{t+1}=C_t\exp(\eta_C(\tilde b_t-\gamma))$, where $\tilde b_t$ is a privately noisy estimate of the fraction of per-sample gradients with norm above $\tau C_t$ and $\gamma$ is the target quantile; when the majority is well fit, its gradients fall below the current bound, $\tilde b_t$ stays below $\gamma$, and the bound decays exponentially until every minority gradient is clipped to the same tiny magnitude, turning the update into a majority vote. The paper shows this collapse in a bimodal mean-estimation toy model and observes it in image benchmarks. The proposed remedy is bounded adaptive clipping, whose update is $C_{t+1}=\max(C_{\mathrm{LB}}, C_t\exp(\eta_C(\tilde b_t-\gamma)))$, with the lower bound $C_{\mathrm{LB}}$ keeping a nonzero voice for underrepresented and confusable classes in every update. Privacy is preserved exactly: the two Gaussian mechanisms used for gradients and for counting clipped gradients compose to a single Gaussian mechanism with noise multiplier $\sigma=(\sigma_{\mathrm{grad}}^{-2}+\sigma_{\mathrm{count}}^{-2})^{-1/2}$, so the usual privacy accountant applies unchanged. In experiments, the bounded scheme consistently outperforms unbounded adaptive and constant clipping on worst-class accuracy and matches or exceeds them on macro accuracy.

Load-bearing premise

The claim depends on the assumption that in real training runs the adaptive bound persistently decays once the majority fits well, so the noisy count stays below the target quantile and the floor is what rescues minority gradients; if the bound instead oscillates, or if the floor is set too high relative to the natural bound, the method would lose adaptivity without gaining fairness.

Editorial extensions

If this is right

  • On skewed MNIST and Fashion MNIST, bounded adaptive clipping raises worst-class accuracy by over 10 percentage points over unbounded adaptive clipping, around 7 points over automatic clipping, and over 5 points over constant clipping when every method is tuned on its own hyperparameters.
  • Adding the lower bound does not change the privacy guarantee: the full adaptive algorithm remains $(\varepsilon,\delta)$-DP under the Gaussian composition of the gradient and counting mechanisms.
  • Under differentially private hyperparameter optimization, bounded adaptive clipping keeps worst-class and subgroup accuracy higher at smaller total $\varepsilon$, indicating a smoother tuning landscape than the unbounded baseline.
  • On tabular census datasets with gender as the protected attribute, bounded adaptive clipping matches or beats constant clipping and clearly beats unbounded adaptive clipping on gender-specific accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the floor could itself be scheduled or data-dependent, for example decaying over training or set from a private estimate of per-class gradient norms, which would remove the extra tuning dimension while keeping the protection.
  • The same collapse-and-floor logic should transfer beyond DP-SGD: any adaptive mechanism that tracks a quantile of a signal shrinking non-uniformly across groups is prone to the same majority-vote dynamic, so a floor may help non-private robust learning as well.
  • A direct test of the failure model is to log $C_t$ and per-class clipped gradient norms during unbounded adaptive clipping on a larger benchmark; the paper predicts persistent exponential decay of $C_t$ that tracks the drop in worst-class accuracy, not transient dips.
  • Because the mechanism changes only the clipping rule, it is compatible with group-specific noise or loss re-weighting; whether the fairness gains are additive with those methods is left open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes 'bounded adaptive clipping' for differentially private SGD: a tunable lower bound CLB is added to the adaptive clipping update so that the clipping bound cannot shrink below a fixed floor. The authors argue that unbounded adaptive clipping (Andrew et al. 2021; Esipova et al. 2023) can drive the clipping bound toward zero, suppressing gradients of underrepresented or confusable classes, and they illustrate this with a one-dimensional toy model and with experiments on Skewed MNIST, Fashion MNIST, Adult, and Dutch datasets. The privacy argument composes the per-iteration gradient and counting Gaussian mechanisms via Gaussian DP (Lemma 3.1 and Theorem 3.2). The headline empirical claim is that bounded adaptive clipping improves worst-class accuracy by over 10 percentage points on average relative to unbounded adaptive clipping and by over 5 percentage points relative to constant clipping on the image datasets.

Significance. If the headline empirical claim holds, the contribution is simple and practically useful: a one-line floor on the adaptive clipping bound improves worst-class accuracy while preserving the existing DP guarantee. The privacy analysis via composition of two Gaussian mechanisms is standard and appears correct. The toy model gives an instructive mechanistic illustration, and the experiments cover four datasets, two image architectures plus logistic regression, and both fixed-hyperparameter and DPHPO settings. The main weakness is that the evaluation protocol as described does not separate hyperparameter selection from test reporting, and the comparison fixes several adaptive-clipping hyperparameters rather than tuning each baseline, so the magnitude of the reported gains is not yet established.

major comments (4)
  1. [4.1, A.4, Tables 5-6] The grid search for the learning rate and the clipping parameter uses macro accuracy as the objective, but no held-out validation split is described anywhere in Sections 4.1-4.2 or Appendix A.4. As written, Tables 5-6 appear to report test-set performance at hyperparameters selected on the same test set. Because the bounded method has an extra tunable dimension (CLB) relative to the unbounded method, this protocol can inflate the reported gains; please specify a validation split or otherwise demonstrate that hyperparameter selection is not performed on the test set.
  2. [Abstract] The abstract promises a '7 points vs Automatic clipping' improvement, but no 'Automatic clipping' baseline is defined or evaluated in the main text, experiments, or appendices. This is a missing comparison that is part of the paper's headline; either add the baseline or remove the claim.
  3. [3, Table 2] The unbounded adaptive clipping baseline is evaluated with ηC = 0.2, following Andrew et al. (2021), but Section 3 states that the unified algorithm reduces to Esipova et al. (2023) when ηC = 1. Since Esipova et al. is cited as the current SOTA for fairness in DP, fixing ηC = 0.2 for all adaptive methods may not represent the baseline's intended configuration. Please tune the adaptive-specific hyperparameters separately for each baseline or justify that the fixed values are optimal for all compared methods.
  4. [3.4, Theorem 3.2] Theorem 3.2 is stated without proof; the text refers to 'Implementation details are provided in Appendix A.5', but Appendix A.5 only describes network architectures. Since the DP guarantee of the full adaptive algorithm is a central claim, please include a proof of Theorem 3.2 (or a precise derivation via Lemma 3.1 and standard composition) in the main text or appendix.
minor comments (5)
  1. [1] There is a typo in 'proposelower-bounded adaptive clipping'; a space is missing.
  2. [A.1] The sentence 'while and retaining the standard (balanced) test set' contains a typo; 'while' should be removed.
  3. [4.2] The statement that 'Constant clipping lacks adaptability and underperforms across both metrics' is too strong, since Table 5 shows constant clipping achieving higher macro accuracy than bounded adaptive clipping on Fashion MNIST at ε = 2, and Table 6 shows comparable performance on the tabular datasets.
  4. [4] The abstract states that code is available at a GitHub URL, but Section 4 says 'The code for replicating all the results will be released with the published version of the paper'; please reconcile these statements.
  5. [3.4] The phrase 'Implementation details are provided in Appendix A.5' does not match the content of Appendix A.5, which contains model architectures rather than the promised privacy-accounting details.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the bounded-adaptive-clipping design is a stated constraint, and the claimed accuracy gains are empirical comparisons against external baselines, not derivations from the method's own definition.

full rationale

The paper's central claim is an empirical improvement in worst-class accuracy from adding a lower bound CLB to an adaptive clipping update. The update Ct+1 = max(CLB, Ct exp(ηC(bt − γ))) makes it true by construction that Ct cannot fall below CLB; however, the paper does not present this definitional fact as the evidence for the 10 pp / 5 pp gains. Those gains are reported from trained models on Skewed MNIST, Fashion MNIST, Adult, and Dutch, and are compared against constant clipping and unbounded adaptive clipping baselines. The toy mean-estimation example (Section 3.2) illustrates a plausible mechanism for unbounded bound decay, but the real-data benefit is supported by external benchmark evaluations, not by a derivation that re-imports the conclusion. Privacy is handled by a standard Gaussian composition argument (Lemma 3.1, Theorem 3.2), independent of the empirical claims. No load-bearing self-citation or uniqueness theorem is invoked; prior work by Andrew et al. and Esipova et al. is used as baseline, not as justification for the proposed fix. Concerns that are correctness risks rather than circularity: (i) Section 4.1 describes grid search tuning learning rate and CLB with macro accuracy as the objective, but no held-out validation split is described, so the reported worst-class accuracy may partly reflect test-set selection; (ii) the abstract's '7 points vs Automatic clipping' claim is not matched to any defined baseline in Sections 4.1–4.2; (iii) code is promised only with the published version. These are absent-support issues, not cases where the paper's output is equivalent to its input by construction.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a set of tuned hyperparameters (CLB, gamma, tau, eta_C, C0) and on standard DP composition assumptions. No new physical entities are introduced. The strongest domain assumptions are that worst-class and macro accuracy capture fairness, and that the majority gradient norms shrink persistently enough for the unbounded bound to collapse; both are plausible but not proven in general.

free parameters (6)
  • Lower clipping bound CLB = Grid-searched per dataset; optimal values vary over roughly 0.001 to 30 depending on epsilon and dataset (Appendix B.2)
    The central tunable floor; reported gains are at the best CLB found on each benchmark.
  • Target quantile gamma = 0.5 (fixed after sensitivity analysis)
    Controls the fixed point of the adaptive bound update; chosen by hand, not derived.
  • Clipping threshold multiplier tau = 2.5 (fixed after sensitivity analysis)
    Defines which gradients count as outliers for the bound update; fixed across all experiments.
  • Clipping bound learning rate eta_C = 0.2 (fixed after sensitivity analysis)
    Governs the exponential update speed of the clipping bound; chosen by hand.
  • Counting noise scale sigma_count = 10 * sigma_grad
    Allocates privacy budget between the gradient and counting mechanisms; follows Esipova et al. (2023).
  • Initial clipping bound C0 = 1.0
    Set to 1 for all experiments; the paper states it works robustly but does not derive it.
assumptions (6)
  • standard math The normalized DP-SGD gradient query has sensitivity 1 under add/remove adjacency.
    Used in Theorem 3.2 to compose gradient and count mechanisms with Delta=1; see Algorithm 2 and Section 3.4.
  • standard math The clipped gradient count b_t has sensitivity 1 under add/remove adjacency.
    Required for the Gaussian mechanism on the count query; see Algorithm 2 and Section 3.4.
  • standard math Gaussian DP composition with sigma = (sigma_grad^-2 + sigma_count^-2)^-1/2 correctly accounts for the two per-step mechanisms under Poisson subsampling.
    Lemma 3.1 and Theorem 3.2; relies on Dong et al. Gaussian DP and the Opacus accountant.
  • standard math The deterministic lower bound CLB does not break the privacy guarantee.
    Post-processing of the private bound sequence; Section 3.4.
  • domain assumption Gradient norms of well-optimized majority samples persistently drop below tau*C_t, so the unbounded bound collapses.
    Core mechanism in Section 3.2 illustrated with a toy mean-estimation model; not proven for deep networks.
  • domain assumption Macro accuracy and worst-class accuracy are appropriate fairness objectives.
    Metrics adopted in Section 4.1; the paper acknowledges alternative fairness definitions are left to future work.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating Disparate Impact of Differentially Private Learning through Bounded Adaptive Clipping." pith.science (2026). https://pith.science/paper/XETZE5LW

@misc{pith2026250601396,
  author       = {Pith},
  title        = {Pith review of: Mitigating Disparate Impact of Differentially Private Learning through Bounded Adaptive Clipping},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XETZE5LW}},
  note         = {Machine review of arXiv:2506.01396}
}
read the original abstract

Differential privacy (DP) has become an essential framework for privacy-preserving machine learning. Existing DP learning methods, however, often have disparate impacts on model predictions, e.g., for minority groups. Gradient clipping, which is often used in DP learning, can suppress larger gradients from challenging samples. We show that this problem is amplified by adaptive clipping, which will often shrink the clipping bound to tiny values to match a well-fitting majority, while significantly reducing the accuracy for others. We propose bounded adaptive clipping, which introduces a tunable lower bound to prevent excessive gradient suppression. Our method improves worst-class accuracy by over 10 percentage points on Skewed and Fashion MNIST compared to unbounded adaptive clipping, 7 points compared to Automatic clipping, and 5 points compared to constant clipping. The code is available at https://github.com/TrustworthyMLHelsinki/adaptive-clipping-fairness.

Figures

Figures reproduced from arXiv: 2506.01396 by the authors.

Figure 1
Figure 1. Existing adaptive clipping methods can lead [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison of macro accuracy (top) and worst-class accuracy (bottom) across privacy [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Gender-specific accuracy on Adult and Dutch datasets using logistic regression under DP training. These tabular tasks are relatively simple, and models often reach high accuracy even at small privacy budgets (ε, δ = 10−5 ), making it difficult to differentiate methods based on overall accuracy alone. Despite this, bounded adaptive clipping consistently achieves the best or near￾best performance across privacy levels… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Performance comparison across privacy budgets ( [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The heatmap of macro accuracy on Fashion MNIST with [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: The heatmap of macro accuracy on skewed MNIST with [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]
Figure 7
Figure 7. Figure 7: The heatmap of macro accuracy on Adult with [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: The heatmap of macro accuracy on Dutch with [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 25 canonical work pages

  1. [1]

    J., McMahan, H

    Abadi, M., Chu, A., Goodfellow, I. J., McMahan, H. B., Mironov, I., Talwar, K., and Zhang, L. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016 , pp.\ 308--318. ACM , 2016

    work page 2016

  2. [2]

    Optuna: A next-generation hyperparameter optimization framework

    Akiba, T., Sano, S., Yanase, T., Ohta, T., and Koyama, M. Optuna: A next-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2019, Anchorage, AK, USA, August 4-8, 2019 , pp.\ 2623--2631. ACM , 2019

    work page 2019

  3. [3]

    Differentially private learning with adaptive clipping

    Andrew, G., Thakkar, O., McMahan, B., and Ramaswamy, S. Differentially private learning with adaptive clipping. In Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp.\ 17455--17466, 2021

    work page 2021

  4. [4]

    Differential privacy has disparate impact on model accuracy

    Bagdasaryan, E., Poursaeed, O., and Shmatikov, V. Differential privacy has disparate impact on model accuracy. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp.\ 15453--15462, 2019

    work page 2019

  5. [5]

    and Kohavi, R

    Becker, B. and Kohavi, R. Adult . UCI Machine Learning Repository, 1996. DOI : https://doi.org/10.24432/C5XW20

    doi:10.24432/c5xw20 1996

  6. [6]

    Algorithmic decision making and the cost of fairness

    Corbett - Davies, S., Pierson, E., Feller, A., Goel, S., and Huq, A. Algorithmic decision making and the cost of fairness. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada, August 13 - 17, 2017 , pp.\ 797--806. ACM , 2017

    work page 2017

  7. [7]

    L., and Balle, B

    De, S., Berrada, L., Hayes, J., Smith, S. L., and Balle, B. Unlocking high-accuracy differentially private image classification through scale. CoRR, abs/2204.13650, 2022. doi:10.48550/ARXIV.2204.13650. URL https://doi.org/10.48550/arXiv.2204.13650

    arXiv doi:10.48550/arxiv.2204.13650 2022

  8. [8]

    Dong, J., Roth, A., and Su, W. J. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84 0 (1): 0 3--37, 2022. doi:10.1111/rssb.12454

    doi:10.1111/rssb.12454 2022

Show all 36 references
  1. [9]

    and Roth, A

    Dwork, C. and Roth, A. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci., 9 0 (3-4): 0 211--407, 2014. doi:10.1561/0400000042. URL https://doi.org/10.1561/0400000042

    2014 doi

  2. [10]

    Our data, ourselves: Privacy via distributed noise generation

    Dwork, C., Kenthapadi, K., McSherry, F., Mironov, I., and Naor, M. Our data, ourselves: Privacy via distributed noise generation. In Advances in Cryptology - EUROCRYPT 2006, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, St. Pe...

    2006

  3. [11]

    Dwork, C., McSherry, F., Nissim, K., and Smith, A. D. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography, Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006, Proceedings , volume 3876 of Lecture Notes in Comp...

    2006

  4. [12]

    Dwork, C., Hardt, M., Pitassi, T., Reingold, O., and Zemel, R. S. Fairness through awareness. In Innovations in Theoretical Computer Science 2012, Cambridge, MA, USA, January 8-10, 2012, pp.\ 214--226. ACM , 2012

    2012

  5. [13]

    S., Ghomi, A

    Esipova, M. S., Ghomi, A. A., Luo, Y., and Cresswell, J. C. Disparate impact in differential privacy from gradient misalignment. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023 . OpenReview.net, 2023

    2023

  6. [14]

    V., and Zhu, K

    Fioretto, F., Tran, C., Hentenryck, P. V., and Zhu, K. Differential privacy and fairness in decisions and learning tasks: A survey. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI 2022, Vienna, Austria, 23-29 July 2022 , pp.\...

    2022

  7. [15]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016 , pp.\ 770--778. IEEE Computer Society, 2016

    2016

  8. [16]

    Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings , 2015

    2015

  9. [17]

    and Kulkarni, T

    Koskela, A. and Kulkarni, T. D. Practical differentially private hyperparameter tuning with subsampling. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - ...

    2023

  10. [18]

    J., Loftus, J

    Kusner, M. J., Loftus, J. R., Russell, C., and Silva, R. Counterfactual fairness. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA , pp.\ 4066--4076, 2017

    2017

  11. [19]

    and Cortes, C

    LeCun, Y. and Cortes, C. MNIST handwritten digit database. 2010. URL http://yann.lecun.com/exdb/mnist/

    2010

  12. [20]

    and Talwar, K

    Liu, J. and Talwar, K. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, STOC 2019, Phoenix, AZ, USA, June 23-26, 2019 , pp.\ 298--309. ACM , 2019

    2019

  13. [21]

    Maaten, L. v. d. and Hannun, A. The Trade - Offs of Private Prediction , 2020

    2020

  14. [22]

    and Steinke, T

    Papernot, N. and Steinke, T. Hyperparameter tuning with renyi differential privacy. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022

    2022

  15. [23]

    H., and Feragen, A

    Petersen, E., Ganz, M., Holm, S. H., and Feragen, A. On (assessing) the fairness of risk score models. In Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, FAccT 2023, Chicago, IL, USA, June 12-15, 2023 , pp.\ 817--829. ACM , 2023

    2023

  16. [24]

    and Richt \'a rik, P

    Shulgin, E. and Richt \'a rik, P. On the convergence of DP - SGD with adaptive clipping. In OPT 2024: Optimization for Machine Learning, 2024

    2024

  17. [25]

    Song, S., Chaudhuri, K., and Sarwate, A. D. Stochastic gradient descent with differentially private updates. In IEEE Global Conference on Signal and Information Processing, GlobalSIP 2013, Austin, TX, USA, December 3-5, 2013 , pp.\ 245--248. IEEE , 2013

    2013

  18. [26]

    H., and Fioretto, F

    Tran, C., Dinh, M. H., and Fioretto, F. Differentially private empirical risk minimization under the fairness lens. In Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virt...

    2021

  19. [27]

    Integrating administrative registers and household surveys

    Van der Laan, P. Integrating administrative registers and household surveys. Netherlands Official Statistics, 15 0 (2): 0 7--15, 2000

    2000

  20. [28]

    Pytorch image models

    Wightman, R. Pytorch image models. https://github.com/rwightman/pytorch-image-models, 2019

    2019

  21. [29]

    and He, K

    Wu, Y. and He, K. Group Normalization . International Journal of Computer Vision, 128 0 (3): 0 742--755, 2020. doi:10.1007/s11263-019-01198-w

    2020 doi

  22. [30]

    Fashion-MNIST : a novel image dataset for benchmarking machine learning algorithms

    Xiao, H., Rasul, K., and Vollgraf, R. Fashion-MNIST : a novel image dataset for benchmarking machine learning algorithms. CoRR, abs/1708.07747, 2017. URL http://arxiv.org/abs/1708.07747

    2017 arXiv

  23. [31]

    Removing disparate impact on model accuracy in differentially private stochastic gradient descent

    Xu, D., Du, W., and Wu, X. Removing disparate impact on model accuracy in differentially private stochastic gradient descent. In KDD '21: The 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, Singapore, August 14-18, 2021 , pp.\ 1924--1932. ACM , 2021

    2021

  24. [32]

    Opacus: User-friendly differential privacy library in pytorch

    Yousefpour, A., Shilov, I., Sablayrolles, A., Testuggine, D., Prasad, K., Malek, M., Nguyen, J., Ghosh, S., Bharadwaj, A., Zhao, J., Cormode, G., and Mironov, I. Opacus: User-friendly differential privacy library in pytorch. CoRR, abs/2109.12298, 2021. URL https://arxiv.org/ab...

    2021 arXiv

  25. [33]

    B., Valera, I., Gomez - Rodriguez, M., and Gummadi, K

    Zafar, M. B., Valera, I., Gomez - Rodriguez, M., and Gummadi, K. P. Fairness constraints: Mechanisms for fair classification. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, AISTATS 2017, 20-22 April 2017, Fort Lauderdale, FL, USA...

    2017

  26. [34]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  27. [35]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  28. [36]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.