Distinguish a noisy sum from its publicly normalized mean

Assume add/remove record adjacency, separable per-record gradients and a fixed public clipping threshold C. A sum of clipped gradients changes by at most C when one record is added or removed, at a fixed model state. Add a Gaussian vector with independent coordinates of standard deviation sigma times C. Sigma is dimensionless in this convention. For replacement adjacency, the same sum can have sensitivity 2C; using the same noise without changing the analysis does not retain the add/remove guarantee.

The Gaussian distribution is part of a complete mechanism, not merely a measured empirical standard deviation. Reusing or exposing its random seed can reveal noise and invalidate the intended protection. Numerical generation and implementation assumptions matter, which is one reason frameworks expose specific secure-randomness modes. A hand-picked noise vector in a worked arithmetic example is not a private randomizer. The accountant must correspond to the actual protected transcript, including any additional measurements or logs released alongside the final model.

Dividing the entire noisy sum by a fixed public positive B₀ is postprocessing. Both its sensitivity and its Gaussian standard deviation divide by B₀, so their ratio remains unchanged. It is not equivalent to averaging the signal and then adding the original sum-scale noise unless that larger-noise mechanism is intentional. Conversely, adding noise that is too small because the signal was divided twice can invalidate the intended guarantee. Track units at every conversion rather than relying on the variable name gradient.

For Poisson sampling the realized batch size varies and can be zero. Opacus v1.5.4 DPOptimizer uses expected_batch_size for mean scaling rather than inferring the divisor from the realized batch. The public-status assumptions behind any population count or expected size still need to be stated by the application. A private count or a data-dependent divisor is not automatically free postprocessing of the noisy sum. It needs its own joint analysis or a different construction, especially if an empty batch changes observable behavior.

A memory-limited implementation can accumulate clipped contributions across physical microbatches before one noise addition and optimizer update. That differs from independently noising and updating after every microbatch. Record which event advances the accountant and how accumulation changes the logical sampling mechanism. Do not log raw per-example gradients, raw sums or private batch statistics merely because the final update is sanitized. Those outputs lie outside the postprocessing protection of the noisy aggregate and require separate treatment.

The function lab provides a deterministic scaling analogy. Reset and set both coefficient a=1 and position x=2; predict y=4 and slope 4. Separately Reset and set both a=0.5 and x=2; predict y=2 and slope 2. Scaling this public function halves both displayed quantities. It does not draw Gaussian noise, average private records or estimate epsilon. Use the analogy only to check consistent units when the noisy sum is divided, and use a real accountant for the actual mechanism.