Account for tuning and private release selection

If several candidate models are individually DP for the same protected units, their joint outputs have a conservative sequential-composition bound. Selecting among those outputs using genuinely public validation data and public randomness is postprocessing of their joint DP transcript. That selection does not require an additional private-data query, but the transcript’s training cost still reflects the valid joint bound. A discarded candidate is not automatically free merely because its parameters are not published; a specialized analysis is needed to claim a smaller search cost.

Evaluating candidates on a private holdout introduces another protected data access. The score or selection must be privatized under the appropriate adjacency, including overlap of users between training and validation. Disjoint rows do not imply disjoint users. Logging raw validation scores or choosing an early-stop point from unsanitized metrics creates a path outside the training model’s postprocessing guarantee. Fixed public search budgets are easier to audit than raw-data-dependent stopping, whose privacy analysis must cover the stopping decision itself.

For a finite public candidate set and a utility function whose value changes by at most Delta_u for every candidate across neighboring validation datasets, the exponential mechanism samples according to the displayed distribution. Higher utility is preferred, and epsilon_select determines the privacy parameter of this selector under that utility-sensitivity bound. Releasing only the selected candidate does not mean releasing every raw utility is safe. Candidate models depending on earlier DP outputs are handled conditionally; their identity and score sensitivity must remain valid for each allowed prior transcript.

An accuracy count with one bounded contribution per protected validation unit has a simple sensitivity bound. A score combining several unbounded records from one user does not inherit the same user-level sensitivity. If candidate generation itself uses nonprivate validation statistics, privatizing the final index cannot retrospectively protect those exposed intermediate choices. Research on private hyperparameter tuning gives stronger results for specific search constructions; the elementary composition bound here remains a valid baseline when its stated components and scopes are satisfied.

Keep candidate configurations, training and evaluation data boundaries, accountant states, selected artifact identifiers and any private stopping decisions in the release record. Choose public development data for exploratory debugging when possible, and reserve private evaluation access for a declared procedure. If a candidate fails a utility target, a retry on the same protected population is still part of the search history. Reusing an already released DP model for a public benchmark is different from retraining or querying fresh private holdout labels.

The optimization lab permits a public-data selection exercise. Reset and set both η=0.25 and x₀=2; one Step predicts x=1.5 and f=1.125. Separately Reset and set both η=0.5 and x₀=2; one Step predicts x=1 and f=0.5. Choosing the lower displayed public toy loss needs no private access here. The lab contains no protected training data, exponential selector or privacy accountant, so its choice says nothing about the budget of tuning a real model on private validation records.