Private and Fair Machine Learning: Revisiting the Disparate Impact of Differentially Private SGD
Authors: Lea Demelius
Simone Kopeinik
Dominik Kowald
Roman Kern
Andreas Trügler
Venue: Accepted by TMLR ()

Abstract: Differential privacy (DP) is a prominent method for protecting information about individuals during data analysis. Training neural networks with differentially private stochastic gradient descent (DPSGD) influences the model's learning dynamics and, consequently, its output. This can affect the model's performance and fairness. While the majority of studies on the topic report a negative impact on fairness, it has recently been suggested that fairness levels comparable to non-private models can be achieved by optimizing hyperparameters for performance directly on differentially private models (rather than re-using hyperparameters from non-private models, as is common practice). In this work, we analyze the generalizability of this claim by 1) comparing the disparate impact of DPSGD on different performance metrics, and 2) analyzing it over a wide range of hyperparameter settings. We highlight that a disparate impact on one metric does not necessarily imply a disparate impact on another. Most importantly, we show that while optimizing hyperparameters directly on differentially private models does not mitigate the disparate impact of DPSGD reliably, it can still lead to improved utility-fairness trade-offs compared to re-using hyperparameters from non-private models. We stress, however, that any form of hyperparameter tuning entails additional privacy leakage, calling for careful considerations of how to balance privacy, utility and fairness. Finally, we extend our analyses to DPSGD-Global-Adapt, a variant of DPSGD designed to mitigate the disparate impact on accuracy, and conclude that this alternative may not be a robust solution with respect to hyperparameter choice.

Published in Transactions on Machine Learning Research (10/2025)
Private and Fair Machine Learning: Revisiting the Disparate Impact of Differentially Private SGD
Lea Demelius
lemeeins@hnoo-enntee.d
Know Center Research GmbH, Graz, Austria Graz University of Technology, Graz, Austria
Dominik Kowald
dkouald@@hnow--enter.d
Know Center Reseorch GmbHH, Craz, Austria
Graz University of Technology, Graz, Austria
Simone Kopeinik
skopesiaile@nnovv-enneeedddd
Know Center Research GmbHI Graz, Austria
Roman Kern
rkern@know-center.dr
Know Center Research GmbH
Gruz Universily of Technology, Graz, Austria
Andreas Trügler
andreas. www.gsssttuugleeeuui-greeee
Know Center Research CmblI, Cruz, Austria University of Graz, Graz, Austria
Reviewed OpenReview: https: openrvve/penrrvieee. net/ forum? id= o82rz0b fTp
Abstract
Differential privacy (DP) is a prominent method for protecting information about individ- uals during data analysis. Training neural networks with differentially private stochastic gradient descent (DPSGD) inffuences the model's learning dynamics and, consequently, its output. This can affect the model's performance and fairness. While the majority studies on the topic report a negative impact on fairness, it has recently been suggested that fairness levels comparable to non-private models be achieved by optimizing hyperparameters for performance directly differentially private models (rather than re-using hyperparameters from non-private models, as is common practice). In this work, we analyze the generalizabil- ity of this claim by 1) comparing the disparate impact of DPSGD on different performance metrics, and 2) analyzing over a wide range of hyperparamoter settings. We highlight that disparate impact on one metric does not necessarily imply disparate impact on another. Most importantly, we show that while optimizing hyperparameters directly on differentially private models does not mitigate the disparate impact of DPSGD reliably, it still lead to improved fairnes trade-offs compared to re-using hyperparameters from non-private models. We stress, however, that any form of hyperparameter tuning en- tails additional privacy leakage, calling for careful considerations of how to balance privacy, variant
utility and fairness. Finally, we extend our analyses to OPSGD-Global-Adayyy of DPSGD designed to mitigate the disparate impact on accuracy, and conclude that this alternative may not be robust solution with respect hyperparameter choice.
1 Introduction
The widespread presence of artificial intelligence (AI) and its concurrent influence on society has brought increasing attention to the necessity to develop trustworthy AT systems (Kaur et. al. 2022 Kowald et. al.

---

Published in Transactions on Machine Learning Research (10/2025)
2024h. Among the key requirements are privacy- privacy-preservation and fairness (Smuha 2019 Kaur et al 2021
Li et al. 2023 While both of these aspects are whole research fields on their own, increased effort is put towards understanding their interrelations, synergies and trade-offs.
One prominent method for preserving the privacy of training data in ML models is differential privacy (DP) (Dwork) 2006 Dwork & Roth 2014)- a mathematical notion of privacy that makes possible to learn patterns from the data while protecting information on individuals. For neural networks, the most commonly used method to implement DP is differentially private stochastic gradient descent (DPSGD) (Abadi et al, 2016). It is well known that DPSGD, and DP in general, negatively influence the utility of the computation. While this privacy-utility trade-off is inherent to DP, various techniques from stringent privacy accounting AAbadi et al. 2016) to machine learning best practices (including hyperparameter tuning) (Papernot et al., 2021 have been proposed to keep the utility loss acceptably small even for meaningful levels of privacy.
However, Bagdasaryan et al. (2019) have shown that DPSGD has a disporate impact on accuracy: the accuracy decreases disproportionalely across groups (e.g., women are affected more than men). Follow-up studies (Farrand et al. 2020 Xu et al.) 2021 Tran et al. 2021 confirmed this observation, showing that the effect even occurs with balanced group representations and loose privacy guarantees. In contrast, de Oliveira et al. 2023) suggest that DPSGD does not necessarily have a negative impact on fairness, as long as the DP model's ' hyperparameters are optimized for performance. They infer that the disparate impact of DPSGD primarily occurs when hyperparameter settings that perform well for non-private models are re-used for DP models without further tuning. While this finding would greatly benefit practitioners aiming to train private and fair neural networks, our experiments cannot confirm this claim. Firstly, in contrast to previous work, de Oliveira et al. (2023) uses the area. under the ROC curve (AUC-ROC) to measure the models' performance and performance equality rather than accuracy. The question arises, therefore, if accuracy and AUC inequalities always coincide, and if their finding translates to the disparate impact on accuracy. Secondly, the question remains if tuning the clipping norm would suffice in mitigating DPSGD's negative effect on fairness. In this paper, we thouroughly analyze the impact of metric and hyperparameter choice on the disparate impact of DPSGD by answering the following research questions:
RQ1) How does the disparate impact of DPSGD manifest across metrics beyond accuracy such as area under the curve, precision, acceptance rate and error rate, and do these disparitios co-occur?
RQ2) How dependent are these disparities on the choice of hyperparameters, and how effective and reliable is hyperparameter tuning in developing private models with similar (or even better) performance and fairness than non-private models?
RQ3) How does hyperparameter choice affect DPSGD-Global-Aan (Fsipova et al. 2022 a variant of DPSGD specifically designed to mitigate the disparate impact of DP?
To answer these three questions, first give overview of the relevant literature (Section 2 paying particular attention to the usage of different performance and fairness metrics. Next, we describe the methodologies employed for our analysis (Section Bp and empirically study the impact of DPSGD on various fairness metrics on five datasets, including both tabular and image data (Section 4). We then investigate the influence of the choice of hyperparameters on the impact of DPSGD on performance and fairness by analyzing our results over a wide range of hyperparameter settings, including those optimized for performance (Section 5 Next, we extend our analyses to OPSGD-Global-Adage a variant of DPSGD designed to mitigate the disparate impact on accuracy (Section 6p- Finally, we address the limitations of our findings (Section 7 and present our conclusions along with directions for future research (Section g)
2 Preliminaries and Related Work
2.1 Differentially Private Stochastic Gradient Descent
Differential Privacy (DP) (Dwork 2006 Dwork & Roth 2014 a mathematical definition of privacy for data analysis with the goal of protecting information about individuals while allowing general learnings from their
2

---

Published in Transactions on Machine Learning Research (10/2025)
combined data. A probabilistic algorithm M D + R with domain D and range R is (c, ddifferrnntt private if for any two datasets x, y E 'D differing on at most one data point, and any subset of outputs 8 S R. it holds that
Pr[M(z) E S] erPr(M(v) E ES] 5
(1)
where c is the privacy loss (also referred to as the privacy budget) and ō is the failure probability. The lower e, the stronger the privacy guarantee. ò is typically set to less than the inverse of the datasel size (Ponoaareaa et al., 2023).
While DP was initially developed for statistical analysis, it was subsoquently adopted for training machine learning models upon realizing that information about individual training data points can be inferred from the model's output (Fredrikson et al. 2015 Shokri et al. 2017; Carlini et al. 2019). The most prominent method for training DP (deep) neural networks is Differentially Private Stochastic Gradient Descent (DPSGD). This technique, a private variant of classical Stochastic Gradient Descent (SGD), ensured DP by clipping the per- example gradients to bound the maximum influence one data point can have on the model and then adding Gaussian noise to the gradients. These changes affect the model's learning dynamics and, consequently, properties such as its performance and fairness.
The privacy-utility trade-off is inherent to DP (due to the addition of noise), but various techniques can help balance it. For DPSGD, the most important aspects are stringent privacy accounting methods (Abadi et al. 2016) and hyperparameter optimization, including archilecture choices such as the activation function Papeerot et al. 2021
2.2 Measuring Fairness
Fairness is among the key requirements of trustworthy Al (e.g., (Smuha 2019 Kaur et al., 2022 In order ensure this quality and promote fair treatment of all affected population groups, it requires the mcasurement of fairness. This guides the development of equitable systems that do not disproportionately affect any group, prioritizing those who have historically faced discrimination based on personal attributes such as race, gender, age, or religion. However, the understanding of fairness in a societal context (with and without AI) encompasses a variety of interpretations, with no consensus on when to apply which (Saxenal 2019 The situation is further complicated by the fact that some notions of fairness are mutually exclusive (Verma & Rubin 2018). On a fundamental level, fairness and fairness metrics can be categorized as individual and group fairness that relate to the legal concepts of disparate treatment and disparate impact, respectively [Barocas & Selbst 2016). Hereinafter, will focus the concept of group fairness. The following metrics are commonly used to measure group fairness in machine learning
Performance equality: The model exhibits equal performance (e.g., accuracy, AUC-ROC, or AUC-
PR) for both groups.
Statistical/ Aaaatticall/Dmmmaaphhiii parity: The model predicts a positive outcome with equal probability for both groups, i.e., both groups have the same acceptance rate.
Predictive parity: The model shows an equal positive predictive value (= precision) for both groups, ie., the same percentage of positive predictions are correct.
Prodictive equality: The model's false positive error rate, i.c., the percentage of negative examples lhat are predicted positive, is equal for both groups.
Equal opportunity: The model's false negative error rate, ie., the percentage of positive examples are predicted negative, equal for both groups.
Equalized odds: This metric combines predictive equality and equal opportunity, i.c., both false posilive and false negative error rale are equal for both groups.
For further details, we point readers to Verma & Rubin 2018 which provides illustrative demon- stration of these (and other) fairness definitions.
We explain the metrics based on binary groups here, given that our work limited such; however, metrics can be extended to multiple groups.
3

---

Published in Transactions on Machine Learning Research (10/2025)
2.3 Fairness under DPSGD
The disparate impact of DPSGD on model accuracy was first shown by [Bgdasaaryn et al. (2019). They demonstrated the effect for different use-cases, e.g,, gender and age classification of face images and sentiment analysis of tweets. They identified group imbalance as a main driver for the effect, showing that underrepre- sented groups produce larger gradients, which in lurn leads to being impacted more by the gradient clipping. They also investigated the individual effects of various hyperparameters- including clipping norm, noise level, batch size, number of training epochs and the size of underrepresented group. In follow-up study, Farrand et a.. 2020) demonstrated that also small group imbalances in the training data can exhibit. a disparate impact of DPSGD on accuracy, and Xu et al. 2021 showed that even overrepresented groups can dispropor- tionately be affected if they have larger average gradient norms (e.g., resulting from a higher complexity of the data distribution). The Farrand et al. (020)) also studied a wider range of privacy budgets and concluded that even loose privacy guarantees can lead to a disparate impact on accuracy. Tighter privacy guarantees can increase fairness as the model becomes more random, i.e, at the cost of overall accuracy. They also reported a disparate impact of DPSGD on equal upportunity and (in some settings) on demographic parily for the CelebA dataset (Liu et al.) 2015). The Hansen et al. (2022 confirmed disparate impact of DPSGD on accuracy for CclebA, and showed disparate impact on Fl scores for two text datasets, and on MSE for an audio dataset.
Complementary to those experimental works, Tran et al. (2021) conducted a theoretical study on the dis- parate impact of DPSGD. They investigated its causes and concluded that the primary factors include both data and model properties, such as input norms, distance privacy budget. While some of their analyses only hold for convex loss functions, they empirically validated their conclusions for non-convex cases. As fairness measure, they relied excessive risk (i.e., the difference between private and non-private expected loss). Along similar lines, Esipova et al. (2022) identified gradient misalignment (i.e., changes of the gradient direction rather than the magnitude) as the main cause for the disparate impact of DPSGD.
the decision boundary, clipping bound and
The role performance- based hyperparameter tuning has on the impact of DPSGD on fairness was first studied by de Oliveira al. (2023)- They pointed out that previous studies re-used hy lypeeraarann paraameters that performed well for the non-private model, rather than tuning them specifically for DP By comparing tuned non- private models (trained with SGD) with both their DP counterparts trained with the same hyperparameters and a separately tuned DP model, de Oliveira et al. (2023) concluded that when specifically optimizing the hyperparameters for DP, DPSGD does not necessarily exhibit a disparate impact. In contrast to most previous work, however, they did not look at overall accuracy and accuracy equality but overall AUC-ROC, and AUC-ROC equality, demographic parity, equalized odds, and predictive parity. This work the one most closely related to ours, although we deliberately made distinct experimental design decisions such as using binary groups instead of more fine-grained combinations of race and sex, adapting the tuned hyperparamoters (see Section B), and using the same privacy budget also replaced two of the tabular datasets with image datasets to diversify our experiments.
5 for the untuned and tuned DPSGD models. We
In addition to advancing the understanding of the disparate impact of DPSGD, several works developed mitigation strategies. The Xu et al. (2021) proposed to compute group-specific clipping norms, Tran et al. (2021] added fairness constraints to the empirical risk minimizer, and ZZhng et al. (2021) suggested using early stopping find the optimal trade-off between accuracy, fairness, and privacy. Based on their finding
that gradient misalignment is the main cause of the disparate impact, Esipova et al. (022) developed variant of DPSGD that alleviates gradient direction changes by scaling the per-example gradients.
For a more detailed review of fairness under differential privacy, see Fioretto et al. (022)) which covers both decision and learning tasks, and also includes an overview of mitigation techniques.
Whiile hyperparameter tuning common practice, Papernot Steinke (201)) showed that hyperparamctors leak private information. This applics to both methods: Adopting hyperparancters from non-private models compromises the ability to account for the privacy budget, while tuning directly on DP models increases the effective privacy budget. Further elahoration on this issue can be found in the discussion (Section
4

---

Published in Transactions on Machine Learning Research (10/2025)
3 Methods
We chose six datasets that were previously used by similar studies Farrand et al., 2020 Xu et al. 2021:
Bagdasaryan et al. 2019 Tran et al. 2021 Esipova et al. 2022. de Oliveira et al. 2023/: four tabular datasets (Adult. (Becker & Kohavi 1996), LSAC (Wightman) 1998), Compas (Angwin el al. 2016) and ACSEmployment Ding al. (2021) and two image datasets (CelebA Liu et al., 2015 and MNIST (LeCun)
For all tabular datascts except ACSEmployment, the protected attribute is sex (as binary attribute, i.c. male or female). For the Adult dataset, the task is income prediction (either S 50k or > 50k). For LSAC, it is the prediction of bar exam results (either fail/not attempted or pass). For Compas, it is re-arrest prediction (yes or no). For ACSEmployment the task is employment status prediction; as the protected attribute we chose vision difficulty due to its high imbalance between groups. CelebA consists of images of faces for which we followed [Esipova et al.] (0022) and performed gender classification (male or female) while wearing eyeglasses (yes or no) is defined as the protected attribute. For MNIST, an image dataset for digit classification (digits 0 to 9), we followed Esipova et al. (2022) and reduced the samples for class 8 by around 90%. We then compared classes 2 and 8 with each other. A detailed description of the datasets can be found in the Appendix (see Section
A.1
Following Esipova el al. 20022. we trained a neural network with 3 linear layers, where the hidden layer has 256 units, for the tabular datasets. For the image datasets, we chose a CNN with convolutional layers with 3x3 kernels and 32 and 16 channels, respectively. All models were trained with 5-fold volssaaai,,,,on, where hyperparameter selections were based on the mean performance on the validation folds, and final results are reported on the hold-out test set. For performance, For fairness, use the notions introduced in Section 2.2 and report the difference of the corresponding difference for evaluating performance
consider accuracy, AUC-ROC, and AUC-PR.
measure between the two groups, i.c., accuracy Ceuuracy/AUC-a CLUC-ROC/AUCA.. equality, acceptance rate difference for evaluating demographic parity, precision difference for predictive parity, maximum of false positive and false negative error rate difference for equalized odds.
Unless otherwise specified, our experiments were conducted with privacy budget of E = 5 and 8 = le 5 [ We also tested different e {0.5, 10) for the
and 8 = le 6 for tabular and image datasets respectively three tabular datasets, but observed unexpeeted deviations. In the case of hyperparameter tuning, we performed either grid search or random search over the following hyperparameter values
Learning rate: [0.0001, 0.001, 0.01, 0.1]
Activation function: [tanh, relu]
Batch size: [256, 512]
Optimizer: [SGD, Adam]
Number of epochs: [5, 10, 20, 40]
Clipping norm (for DPSGD): [0.01, 0.1, 1]
We performed grid search for the smaller tabular datasets (which results in 128 settings for non-DP, and 384 settings for DPSGD and DPSGD-GGlbal-Aaapt), and random search for the ACSEmppoyment dataset and the image datasets CelebA and MNIST (with 50 samples for non-DP, and the corresponding 150 samples for DP). For the sake of reproducibility (Semmelrock et al.] 2025), our source code is basod on Esipova et al. (2022) and is available via GitHub at lhttps://// :tttps://gian thub. www.///eaaaaaariaa2////P...... thub
DisparatellpacttDDPSS0
To focus on general hyperparameters and avoid that results are dominated by the choice of clipping norm, we consistently report outcomes using the clipping norm that yields the best overall performance. For comparison, results obtained with the worst-performing clipping norm are provided in the appendix.
Whenever we report negative or positive influences (i.e., for all tables and healmaps in the main part of the paper), we base our conclusions on significance tests rather than direct mean comparison or threshold- based rules, ensuring that variability is accounted for when assessing differences between the models (sce Appendix A.2 for more details).
In addition to standard DPSGD, we also investigated DPSGD-Clobal-Adaptt Instead of simply clipping per-example gradients that exceed the clipping norm, DPSGD-Global-dan uniformly scales all gradicnts
TThese values were chosen the image datascts larger, therefore lower 5 is needed to follow the convention of choosing 5 smaller than the inverse of the datasct size.
We adopted the hyperparameter values from de Oliveira et 2022 with the only difference that we keep model depth
constant, do include dropout, but additionally lune the mimber of epochs.
5

---

Published in Transactions on Machine Learning Research (10/2025)
they fall below the (adaptive) threshold. This consistent scaling helps prevent gradient misalignment and preserves directional information. We chose this particular method for mitigating the disparate impact of DPSGD because, similar to performance-basee hyperparameter optimization, it is not necessary to know group information during training. Moreover, the mothod is simple to apply due to the openly accessible code and showed better results compared to Xu el al. (2021) and Tran et al. (202T) (both of which need access to the protected attribute during training). We also did not consider the carly stopping method by Zhang et al. (2021) as it would require a public, non-private validation set.
4 Beyond DPSGD's Disparate Impact on Accuracy
As outlined in Scction 2.3
most works studying the impact of DPSGD on fairness refer its disparate
impact on accuracy (Bagdasaryan et al. 2019; Parrand et al.) 2020; Xu et al. 2021 Esipova et al. 2022;
Tran et al. 2021 Farrand et al. (2020) additionally investigate demographic parity and equal opportunity
The work from de Oliveira et al. 2023 is the first to refrain from using accuracy difference, investigating AUC-ROC difference, demographic parity, predictive parity, and equalized odds instead. They presumed that DPSGD has a disparate impact on these fairness metrics (without hyperparameter tuning) even though their experiments could not unambiguously verify this. Out of five datasets, only two exhibit significantly larger AUC-ROC differences for the untuned DP model compared to the non-private model. The results for acceptance rate difference, equalized odds difference, and precision difference are similarly ambiguous (see Table in de Oliveira et al. 2023 or our analysis of their results in Table 5 in the Appendix A.3
With the objective of enhancing clarity in this matter, we conducted our own experiments (see detailed explanations in Section 3). Table [ shows a concise overview of our results regarding the impact of DPSGD on a wider range of metries than previously considered!" [ As expected, our results show a negative impact of DP on performance across all three performance metrics. They also demonstrate a disparate impact on performance metrics, although not for all datasets consistently - providing further evidence that the influence of DPSGD on different fairness metrics is highly dependent on the specific dataset. Notably, a disparate impact one performance metric does not necessarily imply disparate impact another, e.g., for the Adult datasel, DPSGD has a negalive effect on the accuracy difference but not on the AUC differences, for the LSAC dataset, only the AUC-PR difference is negatively impacted, and for the ACSEmployment dataset both AUC differences but not accuracy difference is degraded. For the other fairness metrics (acceptance rate difference, equalized odds difference, and precision difference), we also do not observe a consistent negative impact or consistent co-occurrence patterns.
Takeaways (RQ1)
The impact of DPSGD on fairness tends to depend not only on the dataset but also on the choice of metrics. Conclusions drawn from one metric do not necessarily apply to another even within the same category of fairness metric, such as performance equality.
5 The Role of Hyperparameter Choice
After establishing that the disparate impact of DPSGD does not manifest consistently across metrics and that conclusions drawn from one metric does not necessarily apply to another, we now revisit the role hyperparameters play. de Oliveira et al. (2023) argued that DPSGD does not necessarily exhibit a disparate impact when specifically optimizing the hyperparameterss for DP. Re-analyzing their results (see Table in the Appendix), we show that while it is true that in some cases (e.g., for the ACS Tnc. dataset) hyperparameter tuning mitigates the disparate impact of DPSGD, it docs not seem to hold in general. For example, the disparate impact on AUC-ROC in the case of the Adult dataset is not improved by hyperparameter tuning,
Forr practical reasons, the theoretical analyses of Tran et al. 2021 and Esipova et al. 2022 look at excessive risk (i.e., the difference between private and non-private risk functious or, in other words, the expected loss differences) but they both metric in their experiments. TThe table shows the results for the clippigg norm that achieves the best overall performance (measured by accuracy, AUC- ROC, and AUC-PR, respectively). The conclusions, however, do change even if the worst clipping norms are considered (see Tahle in the Appendix). You can also find tables containing our full results in the Appendix A.6
motivate it via accuracy and Esipova al. (2022) additionally uses accuracy difference
6

---

Published in Transactions on Machine Learning Research (10/2025)
Table 1: Negative impact of DPSGD on the respective metrics. The crosses (X) indicate significantly worse outcomes of the DPSGD model compared the tuned SGD modcl, using the same hyperparameters and and equalized odds are not applicable
the clipping norm with the best overall performance. Acceplance (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference is not defined (n.d.) when model only predicts the negative class.
Adult
LSAC
Compas
ACSEmployment
CelebA
MNIST
Overall accuracy
X
x
x
X
X
Accuracy difference
X
x
X
X
Acceptance rate difference
X
X
N/A
Equalized odds difference
X
X
X
N/A
Precision difference
n.d.
Overall AUC-ROC
x
x
X
X
X
AUC-ROC difference
X
X
Acceptance rate difference
X
X
N/A
Equalized odds difference
X
x
X
N/A
Precision difference
Overall AUC-PR
X
X
X
X
X
X
AUC-PR difference
x
x
x
X
X
Acceptance rate difference
x
N/A
Equalized odds difference
x
N/A
Precision difference
Thus, deeper analysis of hyperparameter tuning is still needed in the context of the disparate impact of DPSGD.
As prefatory remark, it has been shown that the clipping norm is an important factor in the disparate impact of DPSGD (Bagdasaryan et al. 2019 Tran et al. 2021). This could lead one to the conclusion that tuning the clipping norm alone might already mitigate the disparate impact of DPSGD, de Oliveira et al.) (2023) used fixed clipping norm for their untuned DPSGD models. In contrast, we report the untuned DPSGD model with their respective best-performing clipping norm. The results for the worst-performing clipping norms be found in Appendix Section A.5. We observed that only tuning the clipping norm does not considerably and consistently improve the negative impact of DPSGD. It also does not change conclusions.
Table 2 shows our results on whether hyperparamoter tuning improves the impact of DPSGD on performance and fairness. While performance-based hyperparameter tuning siguificantly improves the performance of DPSGD in all cases, the results are less clear for fairness. While some settings, hyperparameter tuning mitigates disparities introduced by DP for part of the metrics, sometimes even eliminating the negative impact of DP altogether, it fails improve fairness consistently. For the ACSEmployment dataset, tuning hyperparameters is unable to improve any fairness metric.
We have to keep in mind, however, that when we look at only the best-performing hyperparameter setting, we ignore the fact that similarly performing hyperparameter settings can exhibit considerably different (un)fairness levels (see Fig. in the Appendix for an illustrative example of this circumstance). Thus, in the following, we will present the results of our experiments over the full range of tested hyperparametors. For those results, will exclusively report accuracy and accuracy differences, given that the disparate impact accuracy is the most consistently observed effect of DPSGD fairness.
Figs. I show accuracy and accuracy difference over the different hyperparancter settings. The solid blue line represents the tuned SGD models plotted over the hyperparameter settings sorted by accuracy. The dash-dot green line depicts the corresponding DPSGD models using the same hyperparameter settings as the SGD model. The dashed orange line shows the tuned DPSGD models over the hyperparamcters, sorted by their accuracy. This means that for one position on the x-axis, the solid blue and dash-dot green line share the same hyperparameter setting, while the dashed orange does not. The heatmaps
BB summarize

---

Published in Transactions on Machine Learning Research (10/2025)
Table 2: Improvements on the impact of DPSGD on the respective metrics through performance- baasoedd hyperparameter tuning. The checkmarks (V) indicate significant improvements over the untuned DPSGD model (using the clipping norm with the best overall performance). The stars (*) mark results where the tuned DPSGD eliminates the disparate impact of DPSGD, i.e., the tuned DPSGD model performs similar or better than the tuned SGD model, while the untuned does not. Acceptance rate and equalized odds are not applicable (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference not defined (n.d.) when a model only predicts the negative class.
Adult
LSAC
Compas
ACSEmployment
CelebA
MNIST
Overall accuracy
Accuracy difference
x
Acceptance rate difference
4+
N/A
Equalized odds difference
x
N/A
Precision difference
/
n.d.
Overall AUC-ROC
/
V
AUC-ROC difference
Acceptance rate difference
N/A
Equalized odds difference
N/A
Precision difference
Overall AUC-PR
/
xx
AUC-PR difference
4+
x+
Acceptance rate difference
N/A
Equalized odds difference
N/A
Precision difference
how often DPSGD achieves better/simmilar/oose performance and is fairer/similarly fair fair/unfairer than the SGD model with the same hyperparameters (i.e., it compares the solid blue and dash-dot green lines).
The first thing for all hyperparameter settings. While for most datasets, the percentage of settings for which DPSGD leads to worse and unfairer results constitutes the largest part, considerable number of hyperparameter settings clicit DPSGD models that achieve similar or, in rare cases, even better results for at least one of the two measures.
observe is that DPSGD does not have negative impact performance and/or fairness
By comparing the SGD models with their corresponding DPSGD version (i.e., the solid blue with the dash- dot green line), we can that hyperparameter settings that achieve high accuracy for the SGD model may may not perform well for the DPSGD model. That is to say, the dash-dot green line sometimes reaches high accuracy (for some datasets even similar values to the non-DP model) but exhibits strong fluctuations in the unfavorable direction.
Moreover, we can observe that, for accuracy difference, the dashed orange curve is smoother than the dash- dot green one, in particular for higher accuracy settings, and except for LSAC, where the two lines are more similar. This means that DP models with similar accuracy exhibit lower variations in accuracy differences than DP models where the non-DP counterparts achieve similar accuracy, leading to the conclusion that performance-bast based hyperparameter tuning of the DP model produces more reliable results than re-using well-performing hyperparancters from the non-private model. However, this docs not mcan that DPSGD achieves competitive performance and fairness compared to the non-DP model: For one, the DP model often does not reach non-DP performance (see Compas, LSAC, CelebA, MNIST), Secondly, high-perfornin DP models sometimes do not reach non-DP fairness levels (sce CelebA and MNIST). Interestingly, our experiments suggest that multi-objective hyperparameter tuning that takes both performance and fairness into account (for example along the line of Cruz et al. (2221) would not be able to considerably improve
8

---

Published in Transactions on Machine Learning Research (10/2025)
93.75%
78.125%
62.5%
SGD (Ord. by SGD acc.)
(Ord. by
0.25
46. 86587
Accuracy diference
DPSGD (Ord. by SGD acc.)
0.20
-31.55%
0.15
fairer
0.10
worse
similar accuracy better
0.0%
Hyperparameter settings
Figure Results over all hyperparameter settings for the Adult dataset. A) shows accuracy and accuracy difference over all tested hyperparameter scttings for the SGD and DPSGD models. Intervals shown corre- spond to +1 standard deviation, reflecting variability across the 5 training runs. The results for the SGD model, represented by the solid blue line, are ordered by its accuracy. The dash-dot green line illustrates the DPSGD model with the same hyperparameters as the SGD model. The dashed orange line shows the results for the DPSGD model ordered by its own accuracy. Takcaway: As expected, hyperparameter set- tings that result in high accuracy for SGD do not necessarily do so for DPSGD. Interestingly, accuracy and accuracy difference are negatively correlated, i.c., hyperparameter settings that result lower performance also result in lower fairness. B) summarizes how often DPSGD achieves better sitter/ssmllar/worsee /wolleerw/ooeeeeee performance and is fairer/sie siimilrlly fair/unfairer than the SGD model with the same hyperparameters.. Takeaway: While for most hyperparameter settings DPSGD has a negative effect on both performance and fairness, there exist some settings for which DPSGD results in similar accuracy difference and similar or even better overall accuracy.
0.8
93.75%
78.125%
62.5%
SGD (Ord. by SGD acc.)
(Ord. by similarly
46 875%
DPSGD (Ord. by SGD acc.)
0.3
31.25%
fairer
0.0
worse
similar accuracy better
0.0%
Hyperparameter settings
Figure Results over all hyperparameter settings for the LSAC dataset (details explained in Fig. Takcaway: For this dataset, DPSGD results in slightly worse accuracy but similar accuracy difference than SGD for most hyperparameter settings.
the performance-fairness trade-off While there remaining fluctuations in the dashed orange line, they are small for high accuracy settings.
Unllie for performance-Be based hyperparameter tuning, multi-objective hyperparameter tuning would require that the pro- tected groups are known during training.

---

Published in Transactions on Machine Learning Research (10/2025)
Aj
93.75%
0.60
unfairer
78.125%
0.50
62.5%
SGD (Ord. by SGD acc.)
(Ord. by similarly
16.875%
diffrrnce
0.15
DPSGD (Ord. by SGD acc.)
0.10
31.22%%
fairer
0.05
15.625%
worse
similer accuracy better
0.00
0.0%
Hyperparameter settings
Figure Results over all hyperparameter settings for the Compas dataset (details explained in Fig. Takcaway: Choosing hyperparameters for DPSGD based SGD accuracy leads to unpredictable accuracy and accuracy difference: While some hyperparameters work well for both, others exhibit considerably worse performance and fairness for DPSGD. In general, higher accuracy difference coincides with lower overall accuracy.
100.0%
B)
0.7
0.6
unfairer
0.5
60.0%
DPSGD [Ord. by DPSGD acc.
similarly fair
difference
DPSGD (Ord. by SGD acc.)
-40.0%
0.3
fairer
0.1
worse
similar sccuracy
better
0.0%
Hyperparameter settings
Figure 4: Results over all hyperparameter settings for the ACSEmployment dataset (details explained in Fig, D.
Takeaway: Choosing hyperparameters for DPSGD based on SGD accuracy leads to more unpredictable accuracy difference than tuning on DPSGD itself. For most hyperparameter settings DPSGD results in worse performance and increased unfairness.
Takeaways (RQ2)
DPSGD did not demonstrate disparate impact accuracy across all hyperparameter settings. Hyper- parameter tuning of the DP model may not reliably result in competitive accuracy and accuracy difference compared to the tuned non-DP model, but generally yields more reliable results alongside higher accuracies than re-using the hyperparameters from the tuned non-DP model. Therefore, when training models with DPSGD, it appears to be beneficial to do hyperparameter tuning from fairness point of view. Multi- objective hyperparameter optimization seems offer limited potential to improve the performance-- trade-off further.
6 DPSGD-Global-Adapt and Hyperparameter Choice
The DPSGD variant DPSGD-Global-Adayg (Esipova et al. 2022) showed improved accuracy and accuracy differences on four datasets compared DPSGD (and other mitigation methods). However, the authors only tested fixed setting of hyperparameters, and did not perform separate hyperparameter optimization.
10

---

Published in Transactions on Machine Learning Research (10/2025)
A)
100.0%
1.0
B)
80.0%
0.6
60.0%
SGD (Ord. by SGD acc.)
DPSGD (Ord. by similarly
Accuracy diffrrncce
DPSGD (Ord. by SGD acc.)
0.4
fairer
20.0%
worse
Similar accuracy better
0.0%
Hyperparameter settings
Figure Results over all hyperparameter settings for the CelebA dataset (details explained in Fig. Takcaway: Again, higher overall accuracy correlates with better fairness. Which hyperparameters work bost for SGD and DPSGD respectively varies significantly, however, settings which yield high accuracy for SGD tend to be comparably stable when applied to DPSGD, but still can lead to considerably less performance and fairness.
A)
100.0%
MM
Accuracy
80.0%
unfairer
SGD (Ord. SGD acc.)
DPSGD (Ord. by DPSGD acc
similarty
Accuracy difference
0.75
DPSGD (Ord. SGD acc.)
40.0%
0.50
20.0%
0.25
0.00
similar accuracy better
0.0%
Hyperparameter settings
Figure Results over all hyperparamoter settings for the MNIST dataset (details explained in Fig. Takeaway: DPSGD results in lower accuracy and higher accuracy difference for all hyperparameters except those that yield low performance for SGD.
We thus expand their analysis to answer the following questions: Does DPSGD-Global-Adapp outperform DPSGD also over wide range of hyperparameters? 2) Tf performance-basel hyperparameter tuning is performed, does DPSGD-Global-Adapp outperform DPSGD?
The heatmaps in Fig. illustrate the comparison between DPSGD and DPSGD-GHobll-Adag across ac- curacy and accuracy difference, with each cell representing whether DPSGD-GIobal-Adap performs worse, similar, or better than DPSGD for the respective metries. Again, the results vary across datasets. For Adult, CelebA and ACSEmpplyment,, DPSGD-Global-Adaph outperforms standard DPSGD for the major- ity of hyperparameter settings. For LSAC, the distribution is less positively skewed but still includes a few hyperparaneter settings where DPSGD-Global-Adapt negatively impacts either performance or fairness compared to DPSGD. For Compas, DPSGD-GGlbal-Adee mainly performs similarly to DPSGD, sometimes decreasing performance. For MNIST, OPSGD-Global-Aie mainly results in similar or improved perfor- not robustly
mance but occasionally deteriorates fairness. We conclude that while DPSGD-Global-Ade superior to DPSGD over a wide range of hyperparameter settings, more often than not, it improves or least does not worsen performance and fairness.
11

---

Published in Transactions on Machine Learning Research (10/2025)
A) Adult
B) LSAC
C) Compas
unfairer
unfairer
unfeirer
93%
similarly fair
similarly fair
similarly fair
fairer-
faiine-
worse
similar accuracy better
worse
similar accuracy
better
worse
similar accuracy
Letter
67%
53%
40%
ACSEmployment
CelebA
F) MNIST
unfainer
unfairer
unfairer
27%
lall
similarly
similarly
13%
fairer-
fairer
fairee
0%
worse
similar accuracy
better
worse
similar accuracy
batter
worse
similar accuracy
better
Figure 7: DPSGD-GGobal-Adapp compared to DPSGD over all hyperparameter. The heatmaps illustrate how often DPSGD-Global-Adap achieves than the standard DPSGD model with the same hyperparameters.
worse performance and is fairer hairer/similary ssimilarly fair fair/nfairer
In Table 3 we report the cases in which DPSGD-Global-Adatt improves on all considered metrics compared DPSGD, for both the untuned and tuned selting. The results do not allow a definitive answer to the question of whether DPSGD-GGobal-Adapp outperforms DPSGD, For some datasets and metrics, does, but for most, does not. There is also no consistency between untuned and tuned settings in terms of for which datasets and metrics Global-Adapt. However, in most cases, DPSGDD-Global-Adnn also does not negatively impact the results which still makes it eligible to be a reasonable alternative to DPSGD.
performs better. This weakens the usefulness of DPSGD-
Takeaways (RQ3)
The analysis of different hyperparameter settings reveals that DPSGD-Global-Adaatt does not robustly achieve better fairness than standard DPSGD. This finding persists even when hyperparameters are op- timized for performance. Considering that DPSGDDGGobal-Adang seldom compromises performance and fairness compared to DPSGD, it remains a reasonable alternative. However, it may not sufficiently address the adverse ellects of DP on fairness.
7 Limitations and Discussion
Following the line of previous studies, this paper draws a comparison across models to isolate the algorith- mic influence of DP. However, our results show that even in this setting, the data dependence cannot disregarded, as data and algorithmic propertics interrelate. Morcover, we emphasize that while ensuring the implementation of privacy-preserving technologies does not inadvertently increase unfairness is a crucial first step, the ultimate goal is to train private models that uphold fairness overall. Thus, we consider it
12

---

Published in Transactions on Machine Learning Research (10/2025)
Table 3: Improvements of DPSGID-Globl-AACE on the respective metrics compared to DPSGD for both the untuned and tuned setting. The checkmarks indicate significant improvements over standard DPSGD, using the respective clipping norm with the best overall performance. Acceptance rate and equalized odds are not applicable (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference is not defined (n.d.) when a model only predicts the negative class.
Adult
LSAC
Compas
ACSEmployment
CelebA
MNIST
Tuned
no
yes
yes
no
yes
yes
yes
yes
Overall accuracy
/ Acceptance rate difference
Accuracy difference
N/A
N
A
Equalized odds difference
N/A
N/A
Precision difference
n.d.
Overall AUC-ROC
AUC-ROC difference
Acceptance rate difference
N/A
N/A
Equalized odds difference
N/A
N/A
Precision difference
Overall AUC-PR
AUC-PR difference
Acceptance rate difference
N/A N/A
Equalized odds difference
N/A
N/A
Precision difference
imperative to examine the broader context of fairness, even though the cross-model comparison approach can yield valuable insights.
Our results show that the impact DPSGD highly depends on the used fairness metric, and that a negative impact
metric does not necessarily result in negative impact of another metric. That fairness metrics capture diverse fairness notions and, thus, lead to substantially different outcomes is well-known challenge in fairness research (see e.g.. Verma & Rubin (018)). ). Our work shows that these challenges extend to privacy-fairees trade-offis, where different fairness metrics are affected differently by DPSGD. Moreover, our results demonstrate that the algorithmic influence of DPSGD (as well as DPSGD-Global-Adaph is interdependent. with the influence of hyperparameeeers. This aligns with previous observations that using DPSGD instead of standard SGD necessitates different architecture and hyperparameter choices achieve high utility Papernot et al. 2021 and shows that these findings extend to fairness.
As already brielly mentioned in Section 2.3 Papernot & Steinke 2021 have drawn attention to the potential information leakage from optimized hyperparameters. The resulting trade-off should be carefully weighed when training differentially private ML models. Tuning hyperparameters on differentially private models as done in this study in contrast to optimizing them on non-private models intuitively reduces the potential privacy leakage and avoids utility losses that may arise due differences in model behavior between non-private and private training Papernot al. (2021). However, ensure a theoretically sound privacy guarantee that both minimizes and accounts for the privacy loss elicited by hyperparameter tuning, it would be necessary to apply differentially private hyperparameter tuning (e.g., private random search {Liu & Talwar 2019 Papernot & Steinke 2021 Differentially private hyperparamcter tuning is still "in its infancy" Ponomareva el al. 2023) and additiona ellort is needed to develop methods that are compatible with standard machine learning practices such as cross- validaaiii Moreover, empirical analyses of the privacy leakage through hyperparameter tuning suggest significantly lower privacy cost than the current thcoretical bounds, and hardly any leakage in practical settings, where the adversary does not have control over, e.g., the validation process (iiang et al. 2024). We also show that similarly performing hyperparameter settings
13

---

Published in Transactions on Machine Learning Research (10/2025)
for DP models result in similar fairness levels. Therefore, even if we had used private hyperparameter tuning, which reduces the chance of finding the best setting, we would still expect our results to remain similar.
8 Conclusions and Outlook
In this study, we investigated the rolc of metric and hyperparameter choice on the performance and fairness of DPSGD. Our findings show that DPSGD's disparate impact on one metric does not necessarily imply that also has a disparate impact on another metric even for metries from the same category, e-g-, performance metrics such accuracy, AUC-ROC, and AUC-PR. Moreover, we demonstrate that the impact of DPSGD fairness cannot be assumed to be consistent across wide range of hyperparameter settings. We provide evidence that performance-based hyperparameter tuning is not reliable method to achieve performance and fairness levels similar to non-private models, but conclude that it can yicld improvements compared to re-using well-performing hyperparameter settings from non-private models. DPSGD-Global Adapt, variant of DPSGD proposed to mitigate its disparate impact on accuracy, does not demonstrate significant improvements in fairness compared standard DPSGD in our experiments when hyperparamcters are varied luned. This suggests that existing methods remain insufficient for reliably achieving strong performance-faimen trade-offs.
In future studies, it would be advisable to give careful consideration to the choice of metrics and exercise caution when generalizing findings from one metric to another. Moreover, more research is needed on data properties and their effect on fairness, also in studies that investigate the interplays between fairness and privacy. While our results suggest that when training private and fair ML models hyperparameters should be optimized directly on differentially private models rather than re-using those from non-private models, caution that any hyperparameter tuning entails additional privacy leakage. Developing effective private hyperparameter tuning methods thercfore remains important direction for future rescarch.
Acknowledgments
This research was supported by the project PROWREESS managed by the Austrian Research Promotion Agency FFG (grant number 60155996). Know Center Rescarch GmbH is COMET competence center that is financed by the Austrian Federal Ministry of Innovation, Mobility and Infrastructure (BMIMI), the Austrian Federal Ministry of Economy, Energy and Tourism (BMWET), the Province of Styria, the Steirische wittschaffssrrderungggselllllll
m.b.H. (SFG), the Vienna business agency and the Standortagentur Tirol. The COMET programme is managed by the Austrian Research Promotion Agency FFG.
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Πyya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference compuler and communications security, pp. 308-318, 2016.
Julia Augwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine bias, 2016. URL https://wwit
wttp://///..ccciiiaaaaa--aaeeeie assessments- cwtpenttttiinnnnimiiiiii
Eugene Bagdasaryan, Omid Poursaced, and Vitaly Shmatikov. Differential privacy has disparate impact model accuracy. Advances in neural information processing systems, 32, 2019.
Solon Barocas and Andrew D Selbst. Big data's disparate impact. Calif. L. Rev., 104:671, 2016.
Barry Bocker and Ronny Kohavi.
Adult.
UCI Machine Learning Repository, 1996. DOL:
https://doi.org/ 13.///00..432/55333
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security symposium (USENIX security 19), pp. 367-284) 2019.
14

---

Published in Transactions on Machine Learning Research (10/2025)
André F Cruz, Pedro Saleiro, Catarina Belém, Carlos Soares, and Pedro Bizarro. Promoting fairness through hyperparameter optimization. In 2021 IEEE International Conference on Dala Mining (TCDM), pp. 1036- 1041. IEEE, 2021.
Anderson Santana de Oliveira, Caclin Kaplan, Khawla Mallat, and Tanmay Chakraborty. An empirical anal- ysis of fairness notions under differential privacy. In The Fourth AAAI Workshop on Artificial Intelligence, 2023.
Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. Retiring adult: New datasets for fair machine learning, Advances in Neural Information Processing Systems, 34, 2021.
Cynthia Dwork. Differential privacy. In International colloquium on automata, languages, and programming, pp. 1-12. Springer, 2006.
Cynthia Dwork and Aaron Roth. The algorithmic foundations differential privacy. Foundations and Trendso in Theoretical Computer Science, 9(3 4):21114400 2014.
Maria S Esipova, Atiyeh Ashari Ghomi, Yaqiao Luo, and Jesse C Cresswell. Disparate impact in differential privacy from gradient misalignment. In The Eleventh International Conference on Learning Representa- tions, 2022.
Tom Farrand, Fatemehsadat Mireshghallah, Sahib Singh, and Andrew Trask. Neither private nor fair: Impact of data imbalance on utility and fairness in differential privacy. In Proceedings of the 2020 workshop on prieaccy-rreeerving machine learning in practice, pp. 15-19, 2020.
Ferdinando Fioretto, Cuong Tran, Pascal Van Hentenryck, and Keyu Zhu. Differential privacy and fairness in decisions and learning tasks: A survey, In 31st International Joint Conference on Artificial Intelligence, IJCAI 2022, pp. 5470-5477. International Joint Conferences Artificial Intelligence, 2022.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC conference compuler and communications security, pp. 1322-1333 2015.
Victor Petrén Bach Hansen, Atula Tejaswi Neerkaje, Ramit Sawhney, Lucie Flek, and Anders Søgaard. The impact of differential privacy on group disparity mitigation. In Proceedings of the Fourth Workshop on Privacy Natural Language Processing, pp. 12-12, 2022.
Davinder Kaur, Suleyman Uslu, and Arjan Durresi. Requirements for trustworthy artificial intelligence review. In Advances in Networked Based Information Systems: The 23rd International Conference Network- Based Information Systems (NBiS-202) 23, pp. 105-115. Springer, 2021.
Davinder Kaur, Suleyman Uslu, Kaley J Rittichier, and Arjan Durresi. Trustworthy artificial intelligence: a review. ACM computing surveys (CSUR), 55(2):1-38, 2022.
Dominik Kowald, Sebastian Scher, Viktoria Pammer-Schindler, Peter Müllner, Kerstin Waxnegger, Lea Demelius, Angela Fessl, Maximilian Toller, Inti Gabricl Mendoza Estrada, Πija Simić, al. Establishing and evaluating trustworthy ai: overview and research challenges. Fronliers in Big Dala, 7:1467222, 2024.
Yann LeCun. Mnist. Last accessed August 28, 2024 from yann. lecun. wtt.eooocccceeeeee com/exdb/mnist.
Bo Li, Peng Qi, Bo Liu, Shuai Di, Jingen Liu, Jiquan Pei, Jinfeng Yi, and Bowen Zhou. Trustworthy ai: From principles to practices. ACM Computing Surveys, 55(9):1 46, 2023.
Jingcheng Lin and Kunal Talwar. Private selection from private candidates. In Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, pp. 298 309, 2019.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEFE international conference on compuler vision, pp. 3338, 2015.
15

---

Published in Transactions on Machine Learning Research (10/2025)
Nicolas Papernot and Thomas Steinke. Hyperparameter tuning with renyi differential privacy. In Interna- tional Conference on Learning Representalions, 2021.
Nicolas Papernot, Abhradeep Thakurta, Shnang Song, Steve Chien, and Ülfar Erlingsson. Tempered sigmoid activations for deep learning with differential privacy. In Proceedings of the AAAT Conference on Artificial Intelligence, volume 35, pp. 2312-9321, 2021.
Natalia Ponomareva, Hussein Hazimeh, Alex Kurakin, Zheng Xu, Carson Denison, Brendan McMahan, Sergei Vassilvitskii, Steve Chien, and Abhradecp Guha Thakurta. How to dp-fy ml: A practical guide machine learning with differential privacy. Journal of Artificial Intelligence Research, 77:1113-1201, 2023.
Nripsuta Ani Saxena. Perceptions of fairness. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society, pp. 537-538, 2019.
Harald Semmelrock, Tony Ross Hellauel, Simone Kopeinik, Dieter Theiler, Armin Haberl, Stefan Thalmann, and Dominik Kowald. Reproducibility in nachine-learning--asse research: Overview, barriers, and drivers. Al Magazine, 46(2):e70002, 2025.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. 2017 IEEE symposium on security and pricacy (SP), pp. 3-18. IEFE, 2017.
Nathalie A Smuha. The eu approach to ethics guidelines for trustworthy artificial intelligence. Computer Law Review International, 20(4):97-106, 2019.
Cuong Tran, My Dinh, and Ferdinando Fioretto. Differentially private empirical risk minimization under the fairness lens. Advances in Neural Information Processing Systems, 34:27555 27565, 2021.
Sahil Verma and Julia Rubin. Fairness definitions explained. In Proceedings of the international workshop software fairness, pp. 1-7, 2018.
Linda F Wightman. Lsac national longitudinal bar passage study. Isac research report series. 1998.
Zihang Xiang, Chenglong Wang. and Di Wang. How does selection leak privacy: Revisiting private selection and improved results for hyper-parameter tuning. arXiv preprint "xXi:2402.13087, 2024.
Depeng Xu, Wei Du, and Xintao Wu. Removing disparate impact on model accuracy in differentially private stochastic gradient descent. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery Data Mining, pp. 1924-1932, 2021.
Tao Zhang, Tianqing Zhu, Kun Gao, Wanlei Zhou, and S Yu Philip. Balancing learning model privacy, fairness, and accuracy with early stopping criteria. IEEE Transactions on Neural Networks ond Learning Systems, 34(9):5557 5569, 2021.
A Appendix
A.1 Details about datasets
Table c shows the class and group distributions for all six datasets. MNIST is the only dataset where the class distributions in the test set differ from those in the training set (i.e., classes in the test set are (more or less) oqually distributed). For preproccssing the tabular datasets, we one-hot encoded the categorical features and standardized all features.
16

---

Published in Transactions on Machine Learning Research (10/2025)
Table 4: Dataset class and group distributions. For Adult, LSAC and Compas, group 1 refers female, group 0 to male. For the ACSEmployment, group refers to vision difficutly and group 0 to vision difficulty. For the Adult dataset, class 1 are incomes > 50k; for the LSAC dataset, class 1 are passed exams; for the Compas dataset, class are re-arrests, and for ACSEmployment, class is employment. For the CelebA dataset, class 1 is male, class O is female, and group refers to individuals wearing eyeglasses. For MNIST, the digits and are compared.
Dataset
Class imbalance
Group imbalance
Class imbalance in group
Class imbalance in group 0
Adult (1:0)
25% 75%
32% 68%
12% 88%
31% 69%
LSAC (1:0)
80% 20%
44% 56%
80% 20%
80% 20%
Compas (1:0)
48% 52%
18% 81%
29% 61%
50% 50%
ACSEmployment
46% 54%
98% 2%
99% 1%
96% 4%
CelebA (1:0)
42% 58%
7% 93%
80% 20%
39% 61%
MNIST (2:8)
11% 0.9%
11% 0.9%
A.2 Significance test
To compare two models based specific metric, use 2-sample one-sided Welch's t-tests, with means and μ2, standard deviations $1 and $2 and sample sizes and n2 (both 5 in our experiments, as we perform 5-fold cross-validation).
The t-statistic is computed with
11 P2
(2)
8
where
s
$2
(3)
n1
71
The degrees of freedom (d.f.) are calculated using the following formula:
d.f. =
(4)
n2-1
We reject our null hypotheses Ho: #1 2 H2 or Hp: μ1 S u2 if the p-value is below 0.05 and the t-statistic is negative or positive, respectively. We do not adjust for multiple comparisons avoid overly conservative adjustments that could increase the risk of overlooking meaningful effect.
A.3 Analysis of de Oliveira et al. (2023)
Table and show our analyses of Table 1 in (de Oliveira et al. 2023 As with our own tables, we used Welch's t-tests to determine the influences are significant.
A.4 Example of fairness variations between similarly performing hyperparameter settings
Fig. shows the SGD and DPSGD models for the hyperparameter scttings achieving the 5% best accuracios, and the untuned DPSGD models using the same hyperparameters as the 5% best SGD models. One can see, that similarly performing hyperparameter settings exhibit considerably different (un)fairness levels.
17

---

Published in Transactions on Machine Learning Research (10/2025)
Table 5: Analysis of Table in de Oliveira et al. on the respective metries.
2023
Crosses (X) indicate negative impact of DPSGD
ACS Emp.
ACS Inc.
LSAC
Adult
Compas
Overall AUC-ROC
X
X
AUC-ROC difference
X
X
Acceptance rate difference
X
X
Equalized odds difference
X
Precision difference
x
x
Table 6: Analysis of Table in (de Oliveira al. 2023): Checkmarks (V) indicate improvements through hyperparameter tuning on the respective metrics. Stars (*) indicate instances, where the hyperparameter tuning eliminates the negative impact of DPSGD, i.e., the tuned DPSGD model performs similar or better than the tuned SGD model, while the untuned does not.
ACS Emp.
ACS Inc.
LSAC
Adult
Compas
Overall AUC-ROC
AUC-ROC difference
Acceptance rate difference
v
Equalized odds difference
Precision difference
Accuracy difference
Tuned DPSGD
Untuned DPSGD
0.10
0.08
0.06
0.02
0.52
0.54
0.56
0.58
0.60
0.62
0.64
0.66
Accuracy
Figure 8: An example of the variations between hyperparameter settings based on the Compas dataset. It shows the SGD and DPSGD models with respective 5% best hyperparameter settings, and untuned DPSGD models using the same hyperparameters the 5% best SGD models.
A.5 Results for worst clipping norm
Tables 7 and show the equivalent to Tables I
2 and 3 but with the DPSGD model with the worst
performing clipping norm instcad of the best. Similarly, Figs. 9 14 show the equivalent of Figs. 1 and Fig. the equivalent of Fig.
A.6 Full results
Tables 14 show the detailed results on which Tables clipping norms) are based on.
and (as well as their counterparts with wonst
18

---

Published in Transactions on Machine Learning Research (10/2025)
Table 7: Negative impact of DPSGD the respective metrics. The crosses (x) indicate significantly worse outcomes of the DPSGD model compared to the tuned SGD model, using the same hyperrarareeerrs and the clipping norm with the worst overall performance. Acceptance rate and equalized odds are not applicable (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference not defined (n.d.) when a model only predicts the negalive class.
Adult
LSAC
Compas
ACSEmployymnt
CelebA
MNIST
Overall accuracy
X
x
X
X
X
X
Accuracy difference
X
x
X
X
Acceptance rate difference
N/A
Equalized odds difference
X
N/A
Precision difference
n.d.
X
Overall AUC-ROC
X
X
X
X
AUC-ROC difference
X
X
X
X
Acceptance rate difference
N/A
Equalized odds difference
X
N/A
Precision difference
n.d.
x
X
Overall AUC-PR
X
X
x
X
X
AUC-PR difference
x
X
Acceptance rate difference
N/A
Equalized odds difference
x X
N/A
Precision difference
X
X
Table 8: Improvements the impact of DPSGD the respective metrics through performanco-based hyperparameter luning. The checkmarks (V) indicate significant. improvements over the untuned DPSGD model (using the clipping norm with the worst overall performance). The stars (*) mark results where the tuned DPSGD climinates the disparate impact of DPSGD, i.c., the tuned DPSGD model performs similar or better than the tuned SGD model, while the untuned does not. Acceptance rale and equalized odds are not applicable (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference is not defined (u.d.) when model only predicts the negative class.
Adult LSAC
Compas
ACSEmployment
CelebA
MNIST
Overall accuracy
Accuracy difference
x
Acceptance rate difference
N/A N/A
Equalized odds difference
Precision difference
n.d.
Overall AUC-ROC
/
AUC-ROC difference
Acceptance rate difference
N/A
Equalized odds difference
N/A
Precision difference
n.d.
/x
Overall AUC-PR
/
/x
AUC-PR difference
Acceptance rate difference
N/A
Equalized odds difference
N/A
Precision difference
19

---

Published in Transactions on Machine Learning Research (10/2025)
A]
0.3
W
93.75%
Accuracy
0.6
unfairer
78.125%
SED (Ord. SGD acc.)
(Ord. by acc.)
similarly
46.875%
DPSGD (Ord. by SGD acc)
MMMMMM
31.25%
fairer
Accuracy
0.1-
15.625%
werse
similar accuracy better
0.0%
Hyperparameter settings
Figure Results over hyperparameter settings for the Adult dataset, using the clipping norms with the worst accuracy. A) shows accuracy and accuracy difference over all tested hyperparameter settings for the SGD and DPSGD models. Intervals shown correspond to +1 standard deviation, reflecting variability across the training runs. The results for the SGD model, represented by the solid blue line, are ordered by its accuracy. The dash-dot green line illustrates the DPSGD model with the same hyperparameters as the SGD model. The dashed orange line shows the results for the DPSGD model ordered by its own accuracy. Takcaway: As expected, hyperparameter scttings that result high accuracy for SGD do not necessarily do so DPSGD. Interestingly accuracy and accuracy difference are negatively correlated, i.e., hyperparameter settings that result in lower performance also result in lower fairness. B) summarizes how often DPSGD achieves better teitter/immlar///// /woree performance and is fairer/similarty fair/unfairer than the SGD model with the same hyperparameters. Takeaway: While for most hyperparameter settings DPSGD has negative effect both performance and fairness, there exist some settings for which DPSGD results in similar accuracy difference and similar or even better overall accuracy.
0.8
B)
93.75%
Accuracy
unfoiror
78.125%
0.4
0.2
SGD SGD
DPSGD (Ord. by DPSGD acc.l
similarly fair
46.875%
DPSGD by acc.)
fairer
Accuracy
15.625%
worse
better
similar
0.0%
Hyperparamater settings
Figure 10: Results over all hyperparameter settings for the LSAC dataset, using the clipping norms with the worst accuracy (details explained in Fig. 9 Takeaway: For this dataset, DPSGD results worse accuracy but similar accuracy difference than SGD for most. hyperparameter settings.
20

---

Published in Transactions on Machine Learning Research (10/2025)
AJ
0.65
93.75%
0.55
0.50
62.5%
SED (Ord. by SGD acc.)
DPSGD jord. by DPSGD
similarly fair
0.15
DPSGD (Ord. by SGD acc.)
31.25%
fairer
0.05
worse
similar accuracy better
0.00
0.0%
Hyperparameter settings
Figure 11: Results over all hyperparameter settings for the Compas dataset, using the clipping norms with the worst accuracy (details explained in Fig. 9 Takeaway: Choosing hyperparameters for DPSGD based on SGD accuracy leads to unpredictable accuracy and accuracy difference: While some hyperparameters work well for both, others exhibit considerably worse performance and fairness for DPSGD. In general, higher accuracy difference coincides with lower overall accuracy.
A)
B)
0.7
80.0%
0.6
unfairer
60.0%
SGD by SCD acc.)
DPSGD (Ord. DPSGD acc.)
similarty fair
DPSGD (ord. by SGD acc.)
40.0%
0.3
0.2
fairer
0.1
worse
simiiar accuracy better
0.0
0.0%
Hyperparameter settings
Figure 12: Results over all hyperparameter settings for the ACSEmployment dataset, using the clipping norms with the worst accuracy (details explained in Fig. 9 Takeaway: Choosing hyperparameters for DPSGD based on SGD accuracy leads to more unpredictable accuracy difference than tuning on DPSGD itself. For most hyperparameter settings DPSGD results in worse performance and increased unfairness.
21

---

Published in Transactions on Machine Learning Research (10/2025)
A)
1.0
B)
80.0%
unfairer
0.6
60.0%
SED (Ord. by SGD acc.)
DPSGD (Ord. by DPSGD
similarly fair
DPSGD (ord. by SGD acc.)
40.0%
fairer
Accuracy
worse
simiiar accuracy better
0.0
0.0%
Hyperparameter
Figure 13: Results over all hyperparameter settings for the CelebA dataset, using the clipping norms with the worst accuracy (details explained in Fig, 9 Takeaway: Choosing lyperparameters for DPSGD based on SGD accuracy leads to umpredictable accuracy and accuracy difference: While some hyperparameters work well for both SGD and DPSGD, others exhibit considerably worse performance and fairness for DPSGD. Again, higher overall accuracy correlates with lower accuracy difference.
100.0%
1.0
B)
unfairer
60.0%
DPSGD [Ord. by DPSGD acc.)
similarly fair
Accurscy affference
DPSGD (Ord. by SGD acc.)
0.75
40.0%
0.50
fairer
0.25
0.00
worse
similar accuracy belter
0.0%
Hyperparamener settings
Figure 14: Results over all hyperparameter settings for the MNIST dataset, using the clipping norms with the worst accuracy (details explained in Fig. 9.. Takeaway: DPSGD results in lower accuracy and higher accuracy difference for all hyperparameters except those that yield low performance for SGD.
22

---

Published in Transactions on Machine Learning Research (10/2025)
Adult
LSAC
Compas
unfairer
unfairer
unfairer
93%
similariy
similarly
similarty
80%
fairer
Tairer
feirer
worse
simitar accuracy
better
worse
similar accuracy better
worse
similar accuracy
bitterr
67%
53%
40%
D) ACSEmployment
E) CelebA
F) MNIST
27%
similaryy fair
similarty fair
similarly fair
13%
fairer
fairer
fairer
worse
simitar accuracy
better
worse
similar accuracy
better
worse
similer accuracy Cetter
Figure 15: DPSGD-GIobal-Adag compared to DPSGD over all hyperparameter, using the clipping norms with the worst accuracy. The heatmaps illustrate how often DPSGD-Global-Adapt achieves bet- ter/similar/ Mataar/wore worse performance and is fairer/similan fair/unfairer than the standard DPSGD model with the same hypepparameters.
23

---

Published in Transactions on Machine Learning Research (10/2025)
the respective metrics compared to DPSGD for both the untuned and tuned setting. The checkmarks (V) indicate significant improvements over standard DPSGD, using the respective clipping norm with the worst overall performance. Acceptance rate and equalized odds are not applicable (N/A) metrics for MNIST, as the comparison is made between classes rather than groups. The precision difference is not defined (n.d.) when a model only predicts the negative class.
Table 9: Improvements of DPSGIDGlobal-AAnn
Adult
LSAC
Compas
ACSEmployment yes
CelebA
MNIST
Tuned
no yes
yes
yes
yes
yes
Overall accuracy
/
/
Accuracy difference
/
1
Acceptance rate difference
N/A
N
A
Equalized odds difference
N/A
N/A
Precision difference
n.d.
Overall AUC-ROC
AUC-ROC difference
Acceptance rate difference
N/A
N/A
Equalized odds difference
N/A
N/A
Precision difference
n.d.
Overall AUC-PR
AUC-PR difference
Acceptance rate difference
N/A
N/A
Equalized odds difference
N/A
N/A
Precision difference
24

---

Published in Transactions on Machine Learning Research (10/2025)
Tuned DPSGD G-A.
0.8557 0.0014
0.1145 0.0016
0.8282 0.007
0.0698 = 0.0046
0.008 # 0.0044
0.911 0.0003
0.0176 = 0.000S
0. 071782 # 0.007
0.0608 = 0,00446
0,006 0.0011
0.7827 0. 0,0008
0.0682 # 0.002
0,1733 = 0.0139
0.0888 = 0.0097
0.008 + 0.0071
Tuned DPSGD-G.
0.8297 0,0009
0.0183 0. 0.0022
0.0039 0.002
0.0196 = 0.0101
0.0233 = 0:0016
0.7504 0.0026
0,0214 = 0.0026
0,0065 = 0.0042
0,0136
0,0021
0.0018
0.0011
0.0042
0.0227 = 01336
= 0.022
Best/ wwrst C denotes the clipping norm with the respective highest/ Seahees///wwweee /lowest performance.
Best, /worst C denotes the clipping norm with the respective highest, highest//lower /lwwollw......... performance.
0.0327
0,0251
0.9995
0.0211
0,0085
0.0254
Untuned DPSGD-G.-A
Untuned DPSGD-
0.8499 0.0004 (worst C)
0.1189 0.0006
0.1907 0.0057
0.0895 0.0076
0.0127 0.0056
0.837 T 0.0099
0.0291 = 0.0146
0.772 + 0.0008
0.0727 0.0016
0.1811 1 0.0049
0.0764 = 0.00/17
0.0062 + 0.0048
0.8267 0.0000
0.0214 0.0026
0.0084 0.0054
0.0399 0.0177
0.027 0.008
0.733 + 0.0019
0,0309 0.0024
0.0084 0.0054
0.0399 0.017T
0,027 0.003
0,8907 1 0.001
0.0334 0.0027
0.0084 0.0034
0.0399 0.01IT
0.027 = 0.003
0.0 0.0
U.0 10=40 0.0
(worst C)
N/A
Untuned DPSGD-G.-A
Untumed DPSGD-G.AA
0.8498 + 0.001
0.1183 0.0000
0.1819 0.0071
0.078 1 0.0062
0.0092 0.0061
0,91 = 0.0003
0.0172 = 0,0001
0.1882 0.0031
0,0820 0.0072
0.0125 0.0136
0.7727 0.0014
0.0711 0.0017
0.1784 1 0.0095
0.0799 = 0.0133
0.0103 + 0.0051
0.0000
0.0205 0.0013
0.0071 0.0064
0.0341 0.01533
0.026 + 0.0002
0.735 + 0.0018
0.0323 0.0028
0.0071 = 0.0064
0.0341 0.0153
0,026 + 0,0022
0,897S 0.0013
0.0025
0.0071 0.0064
0.0341 = 0.0153
0.026 + 0.0022
(best C)
(best C)
0.8255
0.0356
Tuned DPSGD
0.8532 0.001
0.0111
0.1682 + 0.0044
0.0653 1 0.0027
0.0088 = 0.0047
0,9096 1 0.0002
0.0466 = 0.0015
0.1736 + 0.0045
0,0706 + 0.0069
0.0162 # 0.0117
0.7796 + 0,0005
0.0697 = 0.0017
0.1682 1 0.0044
0.0653 # 0.0027
0.0088 + 0.0047
Tunod DPSGD
0.8298 + 0.0014
0.092 1 0.002
0.005 = 0.0009
0.0051 + 0.0048
0.0216 + 0.0006
0.7449 0.011
0.016
0.0075 + 0.0041
0.0466 1 0.0173
0,02811 + 0.0028
0,9072 1 0.0014
0.013 = 0.0036
0.0188 + 0.0185
0.0411 + 0.0862
0.024 = 0.0087
0.1177
0.0377
Untuned DPSGD
0 0.8471 0.0005
U. 1.1236 0,0005
0. 101878 4 0.0023
0.0609 1. 0.0047
0.0222 + 0.0068
0.8144 T 0.0168
0,0207 + 0.0137
0,7067 + 0.0003
0.0086 + 0.0012
0.1676 1 0.0029
0.0714 + 0.0031
0.0243 + 0.0084
Untumed DPSGD
0.8152 + 0.0023
0.001
0.0019 + 0.0011
0.0043 0.0027
0.022 +: 0.0008
0,7089 + 0.0036
0,0449 # 0.0045
0.0119 E 0.0011
0,0043 TF 0,0027
0.022 + 0,000S
1. 188844 1. 0,0027
0.04 0.0021
0.0019 + 0.0011
0.0033 + 0.0027
0,022 + 0.0008
(worst (?)
0.0 + 0.0
0.0 +: 0.0
(worst C)
N/A
0.0206
Table 10: Detailed results for the Adult dataset.
Untuned DPSGD
0.0005
0.0033
0.0823 1 0.0061
0.0129 + 0.0062
0.907T 1. 0.0003
0.017 = 0.0011
0.1731 + 0.0036
0.U69T + U.0025
0,0182 + 0.0041
1.7709 + 0000
0.0009 = 0-0016
0.1786 1 0.0046
0.0779 + 0.0057
0.0159 + 0.0058
Table 11: Delailed results for the LSAC datasel.
Untumed DPSGD
0.8236 + 0.0024
0,0215 0.0011
0.001
0.0048
0.028 + 0.0008
0,7185 + 0.0012
0,8888 f 0.0016
0,001
T. 0.0048
0,0008
1:0012
1.0011
0.001
0.092 + UND43
+ DADDS
(best C))
(best C)
0.8491
0.1199
0. 1.1822
0.0022
0.0062
110022
0,0062
0,0228
0,0333
0.002
00228
0. 0,8556 0.0013
0.1126 0,0027
1.1713 0,0088
0.0657 1. 0.0068
0. 0202 # 0.0084
0.9118 1 0.0002
0,0483 + 0.0011
0. 1797 +: 0.0091
0,0758 + 0,0102
0,0181 0.0123
7922 + 0.0016
0,0084 0.009
0.1775 1. 0.0162
0.076 = 0.0197
0.017 = 0.0073
0,8582 0.0007
0.0201 0.0018
0.0021
0.0101
0. 0244 + 0.0021
1383 + 0.0016
0.0351 + 0.0040
0.0031 - 0.0021
0.0413 1. 0.0101
0.0241 + 0,0021
0.9333 0.0012
0.0061
0.0031 0.0021
0.0413 + 0.0101
0,0244 + 0.0021
Tuned SGD
Tumed SGD
0.0031
0.0413
0.0321
Acceptance mate difference
Equilized odds difference
Acceptanoe rate differencc
Equalized odds difference
Acceptance mate diffcrence
Equalized odds difference
Acceptance rate difference
Equalized odds difference
Acceptance rate difference
Equalizei odds differeuce
Acceptance rate differennee
Equalizod odds difference
Overall accuracy
Accuracy difference
Precision difference
Overal AUC-ROC
AUC-ROC difference
Precision difference
Overall AUC-PR
AUC-PR difference
Precision difference
Overall aceuray
Accurac differenee
Precision difference
Overall AUC-ROC
AUC-ROC difference
Precision difference
Overall AUC-PR
AUC-PR difference
Precision difference
25

---

Published in Transactions on Machine Learning Research (10/2025)
Best, worst C denotes the clipping norm with the respective highest, highest/lowee /lowest performance.
Tined DPSGD G..A.
Tined DPSGD-G. ---..A
0.6463 0.0055
0,0101
0.0101
0.3031 0.0186
0.0744 = 0.0164
0.6924 = 0.0045
0.0116 = 0.0082
0.2791 = 0.0147
0,2839 + 0.033
0,0691 = 0,0405
0.6779 0,0026
0.1248 = 0.0161
0,2821 0.0178
0.3038 = 0.0379
0.0882 # 0.021
0.8328 0,000S
0.0012 = 0.0034
0.4144 1 0.011
0.5014 = 0.0207
0,1895 = 0.0263
0.9107 = 0.0002
0,0414 = 0.0058
0.4184 0,0121
0.4080 0,0552
0.1517 = 0.0398
0,3335 0.0002
0.3204 0.016
0.4184 = 0.0121
0.4589 = 0.0352
0.1517 = 0.0398
Best/ worst C denotes the clipping norn with the respective highest highest/lowee flowest performance.
0.0250
0.2878
Untuned DPSGI-G.-A
Untuned DPSGD
0.543 + 0,0006
0.1 192 0.0147
0.048 0.0195
0.0618 = 0.028
0. 0.1558 0.0342
0.4985 0.0349
0.0119 = 0.0065
0.1054 = 0.0801
0. 0.1 + 0.073
0.1322 0.0178
0.4925 0.0247
0.1303 0.0284
0.1813 0.1386
0.215 E 0.1453
0.1636 = 0.0557
0.0689 0.0144
0.2177 0.1117
0,1825 = 0.136
0.3157 0.0327
0.7617 0.0142
0.0497 0.0329
0.2177 0.1117
0.1825 = 0.136
0.3157 0.0527
0.6926 0.0225
0.3234 0.0303
0.2177 0.1117
0.1825 = 0.136
0.3157 = 0.0527
(worsl C)
(worst
0.6901
Untuned DPSGD-G.-A,
Untamed DPSGD-G...
0.0223
0.0953 0.0389
0.1126 = 0.07
0.1278 0.0733
0.0900 0.0377
0.6729 0.0074
0.0178 = 0.0174
0.3074 = 0.0981
0.3469 0.0675
0.0726
0.0006
0.183 F 0.0221
0.0742
0.3273 0.0897
0,1236 = 0.04
0,832 0.0006
0,0026 0.0017
0.4217 0.0099
0.5119 0.0207
0.1819 = 0.0158
0.908 E 0.0001
0.0432 0,0033
0.4217 0.0099
0.5119 0.0207
0.1819 0.0158
0.8791 + 0.001
0.3276 = 0.0106
0,4217 = 0.0099
0.5119 = 0.0207
0.1819 = 0.0158
(best C)
(best C)
0.5501
0.1201
0.6180
0,2849
Tined DPSGD
0.6477 + 0,00
0.0296 + 0.0144
0,2703 = 0.0108
0.285 0.0228
0.0759 + 0.0819
0.7035 + 0.0025
0.0071 1 0.0077
0,2828 + 0.0109
0.303 # 0.0201
0,0811 + 0.0234
0,0019 F 0.0014
0.1453 + 0,0067
0.3343 0.0098
0.3716 E 0.0117
0.0621 + 0.0191
Tined DPSGD
0.0002
0.0069 = 0.0011
0.4098 1 0.0106
0.4763 + 0.0395
0. 0.1831 + 0.0237
0,9071 + 0.0007
0.0431 + 0.0018
0. 0.4098 + 0.0106
0.4763 # 0,0595
0.1834 0.0237
0.878 0.0009
0,3309 1 0.0046
0 0:4098 + 0.0106
0.4763 + 0.0395
0,1834 + 0.0237
0,8325
Untamed DPSGD
0.5297 000
0. 1334 + 0.0078
0.02 0.0137
0.0294 + 0.0186
0.5017 + 0.0373
0,0331 1 0.0189
1.2287 1 0.0887
0.25 0,2518 + O. 1019
0. 1325 4: 0,0390
0.5123 1. 0.0187
0. 1236 + 0.0295
0.1345 + 0.0838
0.1517 0.077
0.1155 + 0.0232
Untuned DPSGD
0,6626 D0S
0.0548
0.1603 1. 0.0813
0. 1396 + 0.0784
0,2887 + 0.0677
0,7519 + 0.0100
0.0432 F 0.007!
O. 1616 + 0.0813
1813966 # 0.0784
0. 1.2987 0.0677
0.02 # 0.0194
0.3135 1 0.0067
1616 + 0.0813
O. 1396 + 0.0784
0.288T 1 0.0677
(worst C)
(worst C)
N/A
0.0882
Table 13: Detailed results for the ACSEmployment dataset.
Table 12: Detailed results for the Compas dataset.
Untaned DPSGD
0.5462 + 0,0183
1.2 + 0.0174
0.0503 0.0313
0.0725 + 0.0412
0.0894 F0.0023
0.0239 I 0.0087
1.331 = 0,0362
0.3876 0.046
O. 0.0067 1.0 0362
1. 0. 0,0099
0.0154
0.0079
0.2938 + 0.0176
0.0091 + 0.0395
Untuned DPSGD
0,8319 0.0003
0.0028
0.414 1. 0.0081
0.4706 + 0.0273
0. 1808 + 0.0074
0,9059 + 0.0001
0.0448 + 0.0015
0.14 + 0.0081
0.4766 # 0,0273
0. 1898 0,0074
0.0007
1:3221 + 0.0094
0.414 = 0.0081
0.4706 + 0,0273
0,1806 + 0.0074
[best C)
[best. C)
N/A
0.0033
0. 166666
1,2622
0,0046
0,8766
Tinel SGD
0,6533 + 0.0021
0.049 = 0.0166
0.26336 0.0108
0.2437 = 0.0263
0.026
0. 0.6882 + 0.0031
0.0081 1 0.0051
0.2741 + 0.0138
1,28 + 0.0172
070785 4: 0.0223
0. 08888 0.0028
1362 + 0.0114
0.31 0.0099
0.3456 1: 0.0198
0.0835 + 0.0269
Tined SGD
0,8334 0.0000
0.0076 0.0047
0.0069
0.4177 + 0.0231
0.183 = 0.0201
0.9124 + 0.0000
0.0347 + 0.0025
0.38-46 4: 0.0060
0.4177 0.0231
0.183 = 0.0201
8888 + 0,0006
0.2884 1 0.0075
0.3846 + 0.0060
0.4177 + 0.0231
0.183 = 0.0201
0.0358
0.3846
Acceptance rate differenne
Equalized odds difference
Acceptance rate difference
Equalized odds difference
Acceptance rate difference
Equalized odds difference
Acorptanoe rate difference
Equalized odds difference
Acceptante rate diffeernne
Equalized odds difference
Acceptance rate diffcrence
Equalized odds difference
Overall accuracy
Amurcy difference
Precision difference
Overall AUC-ROC
AUC-ROC ROC difference
Precision difference
Overal AUC-PR
ARC-PR& difference
Precision difference
Overall accuracy
Accuracy difference
Precision difference
Overall AUC-ROC
AUC-ROC differencr
Precision dillerence
Overall AUC-PR
AUC-PR PR difference
Precision difference
26

---

Published in Transactions on Machine Learning Research (10/2025)
Tuned DPSGD-G--... -.-
0.9458 0,0017
0,0801 = 0,0071
0.3942 0.0064
0,235 0.0215
0.0147 = 0.0038
0.9871 = 0.0003
0.0644 # 0.004
0.3942 = 0. 0.0064
0,235 = 0.0215
0,0147 = 0.0058
0.9796 0,0005
0,0082 0.0022
0.3942 = 0.0064
0,233 0.0215
0.0147 = 0.0038
Table 14: Detailed results for the MNIST dataset. Bost, worst C denotos the clipping norm with the respective highest, /lowsst performance.
Table 15: Detailed results for the CelebA dataset. Best/ /worst denotes the clipping norm with the respective highest /lowest performance.
Tuned DPSGD-G.A
0.0023
0.0123
0.0111
0.9963 1: 0.0005
0,0032 010011
0.0551 = 0,013
0.9767 0,0018
0.0259 0.0025
0.0596 0.0111
0.9233
0.2557
0.0596
Untuned DPSGI-G.-A (worst
0,9402 0.0035
0.085 + 0.0056
0.3925 0.01.37
0.2552 0.0355
0.0095 0.0054
0.9847 0.0008
0.0779 = 0.003
0.3925 0.0137
0.2552 0.0355
0.0095 0,0054
0.9757 0,0012
0.0109 0.0015
0.3925 0.0137
0.2552 0.0355
0.0054
Untunel DPSGD.G.-
0.0077
0.3253 0.0563
0,0624 0.0197
0.9922 I 0 00003
0.0095 = 0 0.0016
0.0796 + 0.0139
0.9337 = 0.0027
0.0555 0.0133
0.0679 0.0189
(worst C)
0.0095
0.9007
Untuned DPSGI-G.-A.
0.9421 0.0011
0.0056
0.0043
0,2306 0.0114
0.0079
0.985 # 0.0003
0.0745 0.0038
0.3905 = 0.0043
0. 0.2396 0.0114
0,0079
0.9702 0.0007
0.0007 0.0017
0.0043
0.2396 0.0114
0.0133 = 0.0079
Untunel DPSGD.G.-A
0,0044
0.024
0.0186
0.9925 = 0007
0.0017
0,0621 + 0.0197
0.0033
0.0143
0.0168
(brett C)
(best C)
0.0811
0.3905
0.0133
0.0133
0.3905
0,9011
0.3222
0.0741
0.0105
0.9549
0.0518
0.0859
Thmed DPSGD
0.001
0.0932 + 9,0033
0.3907 + 0.0084
0,2543 0.0107
0.0219 0.0044
0.9851 + 0.0004
0.0734 = 0.0026
0.383 1 0.0128
0,2327 1 0.0383
0.0127 + 0.0056
0,9709 + 0.0008
0.0013
0.3837 0.0128
0.2327 + 0.0383
0.0127 +: 0.0056
Tuned DPSGD
0.9187 + 0.0032
0.3626 I 0.047
0.0859 +. 0.0258
O 0.999 E 0.0006
0.0126 E 0.0012
0.0859 + 0.0258
0.9765 + 0,0019
0.0215 1. 0.0056
0.0518 +f 0.0089
0.0438
0.000
Untuned DPSGD
0,9844 1. 0,0016
0. 1.10002 + 0,0103
0,3718 + 0.0131
0.2416 0.0174
0.0107 0.0043
0.9791 + 0.0013
0. 1015 I 0.0093
0.3718 1 0.0131
0,2116 E 0.0174
0.0107 + 0.0043
0,9082 + 0.0017
0.0146 4 0.0027
0,3718 0.0131
0.2416 + 0.0174
0.0107 + 0.0043
(worst. C)
Untuned DPSGD
0,8952 = 0.0051
0.3450 = 0.0631
0,0716 0.022
0.9900 = 0. 0004
0. 0,0097 = 1,082
0.0716 + 0.022
0,9521 = 0,0014
0,0523 = 0.0044
0,0682 = 0.0115
(worst C)
Untuned DPSGD
0.9382 1. 0.0031
0.091 = 0.0033
0.012
0.0283
0030
0,9825 + 0.0006
0.0874 = 0.003
0.3832 1 0.0075
0,2542 E 0.0205
0 + 0.0015
0.001
0 I 0.0015
0.0075
0,0205
+ 00015
Untuned DPSGD
0 8970 + 0.0012
033335 4. 0.0160
0.0549 1: 0.0173
0 9015 1 0. 0007
0.006
0. 0.0563 + 0.0144
0.9645 + 0.0021
0.052 1. 0.0122
0.077 0.0197
[best C)
(best C)
1.3908
260
0.01
1.9731
1.8832
1,2542
0.0811
0.0116
0.9608 1. 0.0017
0.0541 + 0.0072
0.0034
0.1714 0.0193
0.0066
1.9929 + 0.0005
0.0333 # 0.0052
0.3992 1 0.0084
0.1711 1 0.0193
0.0117 + 0.0066
1.9895 + 0.0009
0.003 0.0014
0.39992-0 0.0084
0.0192
0.0117 4 0.0066
Tuned SGD
0.9781 = 0.0023
0.0883 = 0.0144
0.0324 = 0.0033
0.9996 = 0.0001
0.0014 = 0,0022
0.0324 = 0,0073
Overall AUC-PR 0,9977 = 0,0033
0,0044 = 0,0011
0,0386 = 0.0196
Tuned SGD
0.3992--
0.0117
0.1714
Acceptance mate differrnne
Equalized odds difference
Acosptatios rate difference
Equalized odds difference
Acceptatice rate difference
Equalized odds difference
AUC-ROC difference
Accuracy difference
Precision difference
Overall AUC-ROC
A-C-OOC difference
Precision differenc:
AUC-PR difference
Procision differenoe
Overall accuracy
Accuracy difference
Precision difference
Overall AUC-ROC
Precision difference
Overall AUC-PR
AUC-PR PR dillerence
Precision difference
Overall accuracy
27


Reviews:
[{"review_id": "1m9ylE4yb3", "reviewer": "Reviewer_1dwj", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- Paper is well structured and reasoning is easy to follow - particular good point given to the 3 research questions outlined in the beginning which are each answered and discussed\n- Explanations are clear and analyses are rigorous - good nuance in the different performance metrics used and comprehensiveness of the parameter set explored\n\nWeaknesses:\n- The core findings are basically \"it depends on the dataset/metric/hyperparameters\", which lacks some depth. The paper does catalogs inconsistencies but doesn't give any explanation or mechanism or theoretical exploration behind these inconsistencies.\n- Only 5 datasets are tested, with toy examples examples (MNIST) and small tabular datasets (Adult, Compas). For a paper that is primarily empirical and aims at benchmarking, this is not enough - and not enough real-world complexity (imbalance, large scale etc.)\n- The recommendations of \"tuning hyperparameters help\" are obvious and already adopted in practice. I would have wanted more light on the why/how one should tune their hyperparameters to balance fairness and privacy.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates how both Differentially Private Stochastic Gradient Descent (DPSGD) and DPSGD-Global-Adapt affect performance and fairness metrics for neural networks. To do so, it empirically analyzes neural networks across different datasets (3 tabular, 2 image) and hyperparameters (e.g., clipping norm, learning rate) using a range of metrics. One of the main con that DPSGD’s disparate impacts on fairness (e.g., accuracy disparity vs. AUC disparity) do not consistently co-occur which challenges prior results. Likewise, the paper shows that although not consistent, hyperparameter tuning can bring more reliable results when compared to simply reusing the same parameters as the non-DP model. Finally, it shows that DPSGD-Global-Adapt does not bring significant advantages over DPSGD in terms of fairness.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See weaknesses section.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "OJ0YWVGVeO", "reviewer": "Reviewer_mQAm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I think this paper needs substantial revisions before it is accepted. There are many low-level experimental observations that fail to connect to the larger story. Because the results depend so heavily on the dataset, learning algorithm, and notion of fairness, I feel the paper fails to identify trends or deliver insights that would be useful for someone wishing to train a fair and private neural network. It is possible that the experiments contain these insights, but they didn't not come through to me in the discussion.\n\nSetting practitioners aside, it is not clear to me what this work contributes to our understanding of privacy and fairness. The submission fails to make a convincing argument that it adds to scientific knowledge: the overarching theme seems to be \"it depends.\" I struggle to even call this a negative result, since I don't see a clear hypothesis being tested.\n\nThis submission largely extends experiments from prior work, and at times I was unclear about which results are actually new. For example, from the conclusion: \"Our findings reveal that disparate impacts on different metrics do not necessarily co-occur, and that the impact of DPSGD is not consistent across a wide range of hyperparameter settings.\" As I understood it, both of these statements are known from prior work. We know that some metrics are incompatible and that the clipping norm plays a significant role in fairness. \n\nIt's possible I misunderstand the submission. I look forward to reading the other reviews.\n\nMinor comments\n- I found the line plots in Figues 1-5 difficult to parse. Once I did understand what was going on, I had trouble interpreting them.\n- I suggest including a concise takeaway in each figure caption, or one takeaway per subfigure.\n- In your significance tests, do you adjust for multiple comparisons? You should mention this, either way.\n- \"The Algorithmic Foundations of Differential Privacy\" is just by Dwork and Roth, there's no \"et al.\"\n- Footnotes marks should go after the period to end a sentence. The submission is inconsistent here.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper considers the interaction of DP-SGD and group fairness. Prior work has suggested that DP-SGD may result in less fair models compared to (non-private) SGD. Some studies have investigated how hyperparameter tuning affects the story: since DP-SGD may require, for example, a different learning rate than SGD, it may be more appropriate to tune the hyperparameters separately before comparing fairness metrics. \n\nThis submission continues that line of work and investigates hyperparameter tuning, group fairness, and privacy. They consider five datasets and six notions of group fairness. The two main experimental setups are: i) select the best hyperparameters non-privately, then run DP-SGD with the same hyperparameters, and ii) tune the two algorithms independently. There are also some experiments on \"DPSGD-Global-Adapt,\" a recently proposed variation of DP-SGD intended to improve fairness.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Before recommending this paper for acceptance, I would like a revision that helps me understand:\n1. What new insights are in this paper,\n1. Who these insights are helpful for, and\n1. How they differ from existing knowledge.\n\nIt may be the case that, with substantial effort to clarify the results and takeaways, this paper will be a solid contribution. As it stands, I have a hard time arguing that any substantial part of the TMLR audience will find it useful.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "rTul63jd2h", "reviewer": "Reviewer_ziH6", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths \n\n- I’m not versed enough in DP to comment on novelty, but I find the thesis of the paper clear enough: trying to shed some light on how metrics, methods, and data interrelate when it comes to fairness and classification performance. \n- I appreciated that key takeaways are spelled out in the paper.\n- The experiments are tracking a large variety of metrics; this would make this paper a useful reference for future experiments. \n\n### Weaknesses \n\n1. The paper would benefit from more discussion on the confidence of the results. The authors mention that they carried out Welch’s t-tests to check for significance. I assume this was carried over the results of the 5-fold cross-validation? While there is little variability between the methods when accuracy is close to its max value, the same is not true about accuracy difference. Would there be any benefit in adding more folds to the mix?\n\n2. I feel that this paper had a chance to go a bit further and discuss the effects some of those hyperparameters have on fairness in a bit more detail, but maybe this goes beyond the goals the authors have for this work.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "I sincerely apologize for the delay in reviewing this work; I am still dealing with a family health issue. \n\n----------------------------------------\n\nThis work evaluates the performance of SGD, DPSGD, and DPSGD-Global-Adapt (DPSGD-GA) across five datasets, various hyperparameter settings, and multiple metrics of fairness and classification performance. The authors investigate two scenarios: using the optimal hyperparameters selected for SGD with DPSGD versus optimizing DPSGD separately. The authors also include in the comparison the classification / fairness performance of DPSGD-GA.\n\nThe experiments demonstrate that:\n\t1.\tDPSGD does not consistently outperform SGD across different fairness metrics.\n\t2.\tFor certain hyperparameters, DPSGD is competitive with SGD in terms of accuracy.\n\t3.\tDPSGD-GA does not consistently surpass DPSGD in fairness.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Not a change, but just a comment: A point is made in the text (after Figure 2.) about how the DPSGD line is smoother when sorted by its performance. Isn't the smoothness expected when you sort like that, even for a random set of points? It's possible I misunderstood the point there. \n\nSuggested Changes\n\n(These suggestions will not affect the decision, but may improve the presentation.)\n\n1.\tIt would be helpful for the reader if the type of intervals used in the plots were mentioned. As I understand, there are five data points per element (one per 5-fold validation?), so are these intervals driven by standard deviation?\n2.\tIn some tables, checkmarks indicate improvement, while in others they indicate a negative impact. Could the authors consider using, for instance, “x” for negative and a checkmark for improvement to enhance clarity?\n3.\tPlease add a reference to DPSGD-Global-Adapt where it is first introduced in the paper’s introduction. While there is a reference later in the text, it would be more convenient for the reader to have it earlier.\n4.\tIs it feasible to briefly mention how DPSGD-Global-Adapt differs from standard DPSGD in the paper?\n5.\tMentioning the thresholds used for \"fairer / similarly fair / unfairer\" (and similarly for accuracy) may be useful to readers.", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)