Keep an irreversible release ledger across retries and deletion

For mechanisms on the same protected population, conservative sequential composition adds component epsilons and deltas when their conditional guarantees and adjacency match. The sum is a sufficient bound, not necessarily optimal realized privacy loss. A user appearing in several datasets can be affected by all their releases, so a new file path, dataset version or row split does not reset the user’s ledger. Parallel composition requires proven disjoint privacy units under an applicable theorem, rather than assuming disjoint rows imply disjoint people.

An accountant should retain more than a final scalar: sampling law and rates, clipping unit and thresholds, noise schedules, logical update count, analysis orders, target delta, theorem and implementation version. Store private evaluation and selection entries as well as training. A release identifier should connect the ledger to the exact artifact and permitted metadata. Opacus v1.5.4 checkpoint support includes accountant state; a resumed optimizer without its prior accountant can otherwise report a misleading fresh-run budget for an accumulated history.

Deleting raw data can prevent future access, and deleting local artifacts can reduce future accidental exposure. Neither action removes information from a model or metric already received by an observer. Retraining without a user creates a new artifact and a new data-access history; it does not retroactively retract the old model. Machine unlearning can target a different operational goal, but its guarantee must be stated separately from DP and cannot erase copies already distributed outside the system’s control.

Postprocessing is the useful contrasting boundary. A function of an already accounted DP output, public information and fresh randomness independent of protected data retains that output’s DP guarantee. It need not be charged as a fresh raw-data query. But accessing a private validation set, private normalization statistic or raw training cache while performing that function breaks the postprocessing premise. Document dependencies rather than labeling an entire inference or export job postprocessing simply because its main input is a private-trained model.

A failed training attempt can still expose logs, partial models or data-dependent failure information. Whether it contributes privacy cost depends on the actual observable mechanism, not the word failed. Do not assume unlimited aborted retries are free, and do not publish raw diagnostic gradients outside the sanitized path. Preserve enough privacy-safe operational evidence to reconcile attempted, completed and released mechanisms. Noise reuse across supposedly independent attempts also needs analysis because an observer may combine outputs to cancel or reduce the intended randomization.

The modular lab offers a caution about counters. Reset and set both m=8 and additive step a=3. Predict residues 3,6,1 after three Steps, although the ordinary unwrapped accumulated amount is nine. The orbit wraps by definition and does not represent a privacy ledger. Its displayed return to a small residue cannot mean earlier cost vanished. This is only public integer arithmetic: the instrument has no epsilon, delta, dataset or accounting theorem, and a real ledger must preserve its nonwrapping mechanism history.