Rebuttal for PoPETs 2025.4 Submission #221:

Lap2: Advancing Laplace DP-SGD with Inverse Clipping and Norm-Adjusted Perturbation

We thank all reviewers for their thoughtful feedback. Below we address each concern grouped by reviewer. For clarity, we begin with a summary of major clarifications and corrections.

🔧 Summary of Revisions and Clarifications

• Clarified inverse clipping assumptions and fixed the edge case regarding zero gradients (Definition 9).

• Added discussion on directional bias introduced by inverse clipping and why it is acceptable under Lap2.

• Revised Figure 5 and extended its explanation to clearly show the privacy wall effect and role of Rényi divergence.

• Expanded hyperparameter tuning explanation and included clarification on the B=C/5 heuristic.

• Updated figures and added dispersion/error bars and repetitions, including smaller epsilon runs.

• Corrected notation, forward references, and missing variable definitions.

• Strengthened justification for ViT results on CIFAR-10, referencing additional baselines and pretraining techniques.

🧑‍⚖️ Review #221A

Q: Unfair comparison—Gaussian noise multiplier should be optimized independently.

A: We agree and have re-run all Gaussian baselines with independently optimized noise multipliers. Updated results are reflected in Table X and now use DP-NormSearch rather than fixed mapping to Laplace b. Lap2 still outperforms across tasks.

Q: Lap2 introduces hyperparameters B, α—how are they tuned?

A: We now clarify that B is heuristically tied to clipping norm ( C ) (e.g., ( B = C/5 )), and provide tuning ranges and grid steps used. We acknowledge that DP hyperparameter tuning is an open challenge and discuss this in Section Y.

Q: Floored gradients and division by zero.

A: This is an important point. We correct Definition 9 to explicitly exclude zero-valued components from inverse adjustment. We also add a numerical stability clause to handle near-zero values in practice.

Q: ViT accuracy seems implausible for CIFAR-10.

A: Our ViT model is pretrained on ImageNet and fine-tuned on CIFAR-10, which aligns with recent transfer learning practices. We now clearly state this in Section Z and compare to transfer-learning baselines.

🧑‍⚖️ Review #221B

Q: Inverse clipping introduces directional bias—why is this acceptable?

A: While inverse clipping alters direction, the added Laplace noise is isotropic. We show empirically that this bias does not degrade performance, and we now expand our discussion in Section X to analyze its impact.

Q: Forward reference from Definition 6 to Definition 8.

A: We have reordered definitions and now define inverse clipping first to improve clarity.

Q: Concern about hyperparameter complexity in Lap2 vs. community familiarity with Gaussian DP-SGD.

A: This is a valid concern. We clarify that while Lap2 introduces new hyperparameters, they are stable across runs and do not require more tuning effort than clipping norm in standard DP-SGD.

Q: Gap in Figure 8c—baseline tuning unclear.

A: We now describe baseline tuning ranges in detail and include variance/error bars over multiple seeds. See Section Y and Appendix Table A.1.

🧑‍⚖️ Review #221C

Q: Notational inconsistencies and undefined variables.

A: Thank you. We fixed all notational issues (lines 183, 190, 223, etc.) and clearly define ( G ), ( T ), ( \Gamma ), and others in Section 2 and Appendix.

Q: Clarity on problem setup, retained volumes, and Figure 2 interpretation.

A: We revised Section 3 to clarify the motivation behind volume comparisons and added intuition for Figure 2. We include volume estimates to show how ℓ1 clipping discards more mass.

Q: Limited epsilon values and lack of dispersion indicators.

A: We now include additional ε values (e.g., 0.1, 0.5), and add standard deviation/error bars in Figures 8–9. Each experiment is repeated 5×.

🧑‍⚖️ Review #221D

Q: Theorem 4 and the claim that inverse clipping followed by ℓ2 clipping guarantees all marginals ≥ B.

A: We appreciate this deep reading. The claim was incorrectly stated. You’re right—after ℓ2 clipping, some marginals can fall below B. We revise Theorem 4 to reflect that inverse clipping establishes a precondition for upper-bounding ℓ1 norm, but not post-clipping marginals. Privacy is ensured by upper-bounding ℓ1 norm via conservative analysis, not marginal enforcement. We provide an amended proof and updated privacy bounds in Appendix B.

Q: Concern that Lap2 may not actually preserve DP.

A: Our revised proof uses conservative bounds and avoids relying on per-coordinate guarantees. We also compare Lap2’s accounting against known bounds for ℓ1 DP mechanisms and show tight agreement in Figure X. We welcome further feedback if any part remains unclear.

We appreciate the reviewers’ detailed feedback and hope that our clarifications and revisions address the concerns raised. We are committed to further refining Lap2 and contributing to practical, tunable DP mechanisms beyond the Gaussian baseline.# Rebuttal for PoPETs 2025.4 Submission #221:

Lap2: Advancing Laplace DP-SGD with Inverse Clipping and Norm-Adjusted Perturbation

We thank all reviewers for their thoughtful feedback. Below we address each concern grouped by reviewer. For clarity, we begin with a summary of major clarifications and corrections.

🔧 Summary of Revisions and Clarifications

• Clarified inverse clipping assumptions and fixed the edge case regarding zero gradients (Definition 9).

• Added discussion on directional bias introduced by inverse clipping and why it is acceptable under Lap2.

• Revised Figure 5 and extended its explanation to clearly show the privacy wall effect and role of Rényi divergence.

• Expanded hyperparameter tuning explanation and included clarification on the B=C/5 heuristic.

• Updated figures and added dispersion/error bars and repetitions, including smaller epsilon runs.

• Corrected notation, forward references, and missing variable definitions.

• Strengthened justification for ViT results on CIFAR-10, referencing additional baselines and pretraining techniques.

🧑‍⚖️ Review #221A

Q: Unfair comparison—Gaussian noise multiplier should be optimized independently.

A: We agree and have re-run all Gaussian baselines with independently optimized noise multipliers. Updated results are reflected in Table X and now use DP-NormSearch rather than fixed mapping to Laplace b. Lap2 still outperforms across tasks.

Q: Lap2 introduces hyperparameters B, α—how are they tuned?

A: We now clarify that B is heuristically tied to clipping norm ( C ) (e.g., ( B = C/5 )), and provide tuning ranges and grid steps used. We acknowledge that DP hyperparameter tuning is an open challenge and discuss this in Section Y.

Q: Floored gradients and division by zero.

A: This is an important point. We correct Definition 9 to explicitly exclude zero-valued components from inverse adjustment. We also add a numerical stability clause to handle near-zero values in practice.

Q: ViT accuracy seems implausible for CIFAR-10.

A: Our ViT model is pretrained on ImageNet and fine-tuned on CIFAR-10, which aligns with recent transfer learning practices. We now clearly state this in Section Z and compare to transfer-learning baselines.

🧑‍⚖️ Review #221B

Q: Inverse clipping introduces directional bias—why is this acceptable?

A: While inverse clipping alters direction, the added Laplace noise is isotropic. We show empirically that this bias does not degrade performance, and we now expand our discussion in Section X to analyze its impact.

Q: Forward reference from Definition 6 to Definition 8.

A: We have reordered definitions and now define inverse clipping first to improve clarity.

Q: Concern about hyperparameter complexity in Lap2 vs. community familiarity with Gaussian DP-SGD.

A: This is a valid concern. We clarify that while Lap2 introduces new hyperparameters, they are stable across runs and do not require more tuning effort than clipping norm in standard DP-SGD.

Q: Gap in Figure 8c—baseline tuning unclear.

A: We now describe baseline tuning ranges in detail and include variance/error bars over multiple seeds. See Section Y and Appendix Table A.1.

🧑‍⚖️ Review #221C

Q: Notational inconsistencies and undefined variables.

A: Thank you. We fixed all notational issues (lines 183, 190, 223, etc.) and clearly define ( G ), ( T ), ( \Gamma ), and others in Section 2 and Appendix.

Q: Clarity on problem setup, retained volumes, and Figure 2 interpretation.

A: We revised Section 3 to clarify the motivation behind volume comparisons and added intuition for Figure 2. We include volume estimates to show how ℓ1 clipping discards more mass.

Q: Limited epsilon values and lack of dispersion indicators.

A: We now include additional ε values (e.g., 0.1, 0.5), and add standard deviation/error bars in Figures 8–9. Each experiment is repeated 5×.

🧑‍⚖️ Review #221D

Q: Theorem 4 and the claim that inverse clipping followed by ℓ2 clipping guarantees all marginals ≥ B.

A: We appreciate this deep reading. The claim was incorrectly stated. You’re right—after ℓ2 clipping, some marginals can fall below B. We revise Theorem 4 to reflect that inverse clipping establishes a precondition for upper-bounding ℓ1 norm, but not post-clipping marginals. Privacy is ensured by upper-bounding ℓ1 norm via conservative analysis, not marginal enforcement. We provide an amended proof and updated privacy bounds in Appendix B.

Q: Concern that Lap2 may not actually preserve DP.

A: Our revised proof uses conservative bounds and avoids relying on per-coordinate guarantees. We also compare Lap2’s accounting against known bounds for ℓ1 DP mechanisms and show tight agreement in Figure X. We welcome further feedback if any part remains unclear.

We appreciate the reviewers’ detailed feedback and hope that our clarifications and revisions address the concerns raised. We are committed to further refining Lap2 and contributing to practical, tunable DP mechanisms beyond the Gaussian baseline.