erchiw/DPriv-Bench huggingface dataset:
Question: Is the following algorithm $(\varepsilon/2, \delta)$-differentially private?

\begin{algorithm}[H]
\caption{Outputting a private Johnson--Lindenstrauss projection of a matrix.}
\KwIn{A matrix $A \in \mathbb{R}^{n \times d}$ and a bound $B > 0$ on the $\ell_2$-norm of any row in $A$; Privacy parameters: $\varepsilon, \delta > 0$; Parameter $r$ indicating the number of rows in the resulting matrix.}

\BlankLine
Set $w$ such that 
\[
w^2 = \frac{8B^2}{\varepsilon} \left( \sqrt{2r \ln(8/\delta)} + 2\ln(8/\delta) \right).
\]
Sample $Z \sim \mathrm{Lap}(B^2 / \varepsilon)$ and let $\sigma_{\min}(A)$ denote the smallest singular value of $A$.

\BlankLine
\If{$\sigma_{\min}(A)^2 > w^2 + Z + \frac{4B^2 \ln(1/\delta)}{\varepsilon}$}{
    Sample a $(r \times n)$-matrix $R$ whose entries are i.i.d.\ samples from a normal Gaussian.\;
    \Return{$RA$ and ``matrix unaltered''}\;
}
\Else{
    Let $A'$ denote the result of appending $A$ with the $d \times d$-matrix $wI_{d \times d}$.\;
    Sample a $(r \times (n + d))$-matrix $R$ whose entries are i.i.d.\ samples from a normal Gaussian.\;
    \Return{$RA'$ and ``matrix altered''}\;
}
\end{algorithm}
Subject: DP-ML / DP-OLS
Rationale: The given algorithm is adapted from \citet[Algorithm~1]{sheffet2017differentially}. In the PTR test step (line 2), the Laplace noise $Z$'s scale has been reduced by a factor of $4$, and therefore the stated privacy guarantee doesn't hold.
Question: Is the following algorithm $(\varepsilon, \delta)$-differentially private, under the add/remove neighbouring relation?

\begin{algorithm}[H]
\caption{Outputting a private Johnson--Lindenstrauss projection of a matrix.}
\KwIn{A matrix $A \in \mathbb{R}^{n \times d}$ and a bound $B > 0$ on the $\ell_2$-norm of any row in $A$; Privacy parameters: $\varepsilon, \delta > 0$; Parameter $r$ indicating the number of rows in the resulting matrix.}

\BlankLine
Set $w$ such that 
\[
w^2 = \frac{8B^2}{\varepsilon} \left( \sqrt{2r \ln(8/\delta)} + 2\ln(8/\delta) \right).
\]
Sample $Z \sim \mathrm{Lap}(B^2 / \varepsilon)$ and let $\sigma_{\min}(A)$ denote the smallest singular value of $A$.

\BlankLine
\If{$\sigma_{\min}(A)^2 > w^2 + Z + \frac{4B^2 \ln(1/\delta)}{\varepsilon}$}{
    Sample a $(r \times n)$-matrix $R$ whose entries are i.i.d.\ samples from a normal Gaussian.\;
    \Return{$RA$ and ``matrix unaltered''}\;
}
\Else{
    Let $A'$ denote the result of appending $A$ with the $d \times d$-matrix $wI_{d \times d}$.\;
    Sample a $(r \times (n + d))$-matrix $R$ whose entries are i.i.d.\ samples from a normal Gaussian.\;
    \Return{$RA'$ and ``matrix altered''}\;
}
\end{algorithm}
Subject: DP-ML / DP-OLS
Rationale: (1) The given algorithm is adapted from \citet[Algorithm~1]{sheffet2017differentially}. In the PTR test step (line 2), the Laplace noise $Z$'s scale has been reduced by a factor of $4$, and therefore the stated privacy guarantee no longer holds; (2) under the add/remove neighbouring relation, $n$ is private information.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the Poisson subsampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the add/remove neighbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, sampling rate $q$, clipping bound $C$, learning rate $\eta$, initial weights $\theta_0$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,q,T)$ \\
\For{$t=0, \ldots, T-1$}{
  $B \sim \text{PoissonSample}(D, q)$ \\
  \For{$x_i \in B$}{
    $g_i \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_i^{\text{clip}} \leftarrow g_i \cdot \min\!\left(1, \frac{C}{\lVert g_i\rVert_2}\right)$ 
  }
  
  $\bar g \leftarrow \frac{1}{q}\!\left(\sum_{i\in B} g_i^{\text{clip}} + \mathcal{N}(0, \sigma^2 C^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \bar g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: The example is adopted from \citet[Alg.~1]{rehn2025optimal}, using a fixed sampling probability for Poisson sampling.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the poisson sampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the replace-one neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the replace-one neighbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, clipping bound $C$, initial weights $\theta_0$, subsample size $L$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,\frac{L}{N},T)$ \\
\For{$t=0, \ldots, T-1$}{
  $L_t \sim \mathrm{PoissonSample}(D,\frac{L}{N})$ \\
  \For{$x_i \in L_t$}{
    $g_t (x_i ) \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_t^{\text{clip}}(x_i ) \leftarrow g_t (x_i ) \cdot \min\!\left(1, \frac{C}{\lVert g_t (x_i )\rVert_2}\right)$ 
  }
  
  $\tilde g_t \leftarrow \frac{1}{|L|}\!\left(\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i ) + \mathcal{N}(0, 4\sigma^2 C^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \tilde g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: This algorithm is adopted from \citet[Algo.~2]{abadi2016deep}
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the poisson sampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the replace-one neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the replace-one neighbouring relation?
\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, clipping bound $C$, initial weights $\theta_0$, subsample size $L$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,\frac{L}{N},T)$ \\
\For{$t=0, \ldots, T-1$}{
  $L_t \sim \mathrm{PoissonSample}(D,\frac{L}{N})$ \\
  \For{$x_i \in L_t$}{
    $g_t (x_i ) \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_t^{\text{clip}}(x_i ) \leftarrow g_t (x_i ) \cdot \min\!\left(\frac{1}{C}, \frac{1}{\lVert g_t (x_i )\rVert_2}\right)$ 
  }
  
  $\tilde g_t \leftarrow \frac{1}{|L|}\!\left(\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i ) + \mathcal{N}(0, 4\sigma^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \tilde g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: Under the replace-one neighboring relation, $\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i)$ has $L_2$ sensitivity $2$. Therefore, by the oracle's guarantee, the added noise ensures $(\varepsilon,\delta)$-DP.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the poisson sampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the add/remove neighbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, clipping bound $C$, initial weights $\theta_0$, subsample size $L$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,\frac{L}{N},T)$ \\
\For{$t=0, \ldots, T-1$}{
  $L_t \sim \mathrm{PoissonSample}(D,\frac{L}{N})$ \\
  \For{$x_i \in L_t$}{
    $g_t (x_i ) \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_t^{\text{clip}}(x_i ) \leftarrow g_t (x_i ) \cdot \min\!\left(1, \frac{C}{\lVert g_t (x_i )\rVert_2}\right)$ 
  }
  
  $\tilde g_t \leftarrow \frac{1}{|L|}\!\left(\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i ) + \mathcal{N}(0, \sigma^2 C^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \tilde g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: Since the number of samples \(N\) is private information under the add/remove neighboring relation, the algorithm directly uses \(N\) to calculate the subsampling rate for Poisson sampling, thus not private in general.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the poisson sampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $\varepsilon$-Gaussian DP for some $\varepsilon>0$?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, clipping bound $C$, initial weights $\theta_0$, subsample size $L$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,\frac{L}{N},T)$ \\
\For{$t=0, \ldots, T-1$}{
  $L_t \sim \mathrm{PoissonSample}(D,\frac{L}{N})$ \\
  \For{$x_i \in L_t$}{
    $g_t (x_i ) \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_t^{\text{clip}}(x_i ) \leftarrow g_t (x_i ) \cdot \min\!\left(1, \frac{C}{\lVert g_t (x_i )\rVert_2}\right)$ 
  }
  
  $\tilde g_t \leftarrow \frac{1}{|L|}\!\left(\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i ) + \mathcal{N}(0, \sigma^2 C^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \tilde g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: (1) Since the number of samples \(N\) is private information under the add/remove neighboring relation, the algorithm directly uses \(N\) to calculate the subsampling rate for Poisson sampling, thus not private in general. (2) Notice that the subsampled Gaussian mechanism does not satisfy pure Gaussian DP. The algorithm is a composition of Gaussian mechanisms with Poisson subsampling, thus doesn't satisfy pure GDP. In conclusion, statement is incorrect.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the Poisson sampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the replace-one neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under replace-one neigbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, clipping bound $C$, initial weights $\theta_0$, subsample size $L$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,\frac{L}{N},T)$ \\
\For{$t=0, \ldots, T-1$}{
  $L_t \sim \mathrm{PoissonSample}(D,\frac{L}{N})$ \\
  \For{$x_i \in L_t$}{
    $g_t (x_i ) \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_t^{\text{clip}}(x_i ) \leftarrow g_t (x_i ) \cdot \min\!\left(1, C\right)$ 
  }
  
  $\tilde g_t \leftarrow \frac{1}{|L|}\!\left(\sum_{x_i \in L_t} g_t^{\text{clip}}(x_i ) + \mathcal{N}(0, 2\sigma^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \tilde g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: The provided DP-SGD implementation is incorrect because the noise scale is not calibrated to the sensitivity of the clipped gradients. In standard DP-SGD, the added Gaussian noise should have standard deviation $\sigma \cdot \mathrm{sens}\!\left(g^{\text{clip}}\right)$. However, the algorithm instead uses \(\sqrt{2}\sigma\), which in general does not satisfy the stated privacy guarantee.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the Poisson subsampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the add/remove neighbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, sampling rate $q$, clipping bound $C$, learning rate $\eta$, initial weights $\theta_0$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,q,T)$ \\
\For{$t=0, \ldots, T-1$}{
  $B \sim \text{PoissonSample}(D, q)$ \\
  \For{$x_i \in B$}{
    $g_i \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$  \\
    $\tilde g_i \leftarrow g_i + \mathcal{N}(0, \sigma^2 C^2 I_d)$ \\
    
    $g_i^{\text{clip}} \leftarrow \tilde g_i \cdot \min\!\left(1, \frac{C}{\lVert \tilde g_i\rVert_2}\right)$ 
  }
  
  $\bar g \leftarrow \frac{1}{q}\!\left(\sum_{i\in B} g_i^{\text{clip}}\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \bar g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: The provided DP-SGD implementation is incorrect because it reverses the order of gradient clipping and noise addition. Since the noise scale is calibrated to the sensitivity of the clipped gradient, adding noise before clipping generally does not guarantee the stated differential privacy.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the Poisson subsampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the add/remove neighbouring relation?

\begin{algorithm}[H]
\caption{DP-SGD}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, sampling rate $q$, clipping bound $C$, initial learning rate $\eta_0$, initial weights $\theta_0$}
\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,q,T)$ \\
\For{$t=0, \ldots, T-1$}{
  $B \sim \text{PoissonSample}(D, q)$ \\
  \For{$x_i \in B$}{
    $g_i \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_i^{\text{clip}} \leftarrow g_i \cdot \min\!\left(1, \frac{C}{\lVert g_i\rVert_2}\right)$ 
  }
  
  $\bar g \leftarrow \frac{1}{q}\!\left(\sum_{i\in B} g_i^{\text{clip}} + \mathcal{N}(0, \sigma^2 C^2 I_d)\right)$ \\
  \uIf{$T\geq 10$ and $\mathcal{L}(\theta_t) > \mathcal{L}(\theta_{t-1})$}{
        $\eta_t = \eta_{t-1} / 2$
  }\Else{
        $\eta_t = \eta_{\max\{0, t-1\}}$
  }
  
  $\theta_{t+1} \leftarrow \theta_t - \eta_t \bar g$ 
}
\KwRet{$\theta_T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: The provided DP-SGD implementation doesn't satisfy DP since the learning-rate scheduler depends on the (data-dependent) loss and is not privatized, so the overall procedure doesn't not satisfy DP in general.
Question: Given a privacy accountant $\mathcal{O}$ such that, given target privacy parameters $(\varepsilon,\delta)$, the Poisson subsampling rate $q$, and the number of DP-SGD iterations $T$ (i.e., the number of compositions), returns the calibrated noise multiplier $\sigma$ for the subsampled Gaussian mechanism used in DP-SGD under the add/remove neighbouring relation. Can the following implementation of DP-SGD satisfy $(\varepsilon,\delta)$-DP for some $\varepsilon>0$ and $\delta\in(0,1)$, under the add/remove neighbouring relation?


\begin{algorithm}[H]
\caption{DP-SGD with Warm-up Initialization}
\DontPrintSemicolon
\SetKwInput{KwIn}{Input}
\KwIn{iterations $T$, dataset $D=\{x_1,\ldots,x_N\}$, loss function $\mathcal{L}(\theta)=\frac{1}{N}\sum_{x \in D}\mathcal{L}(\theta,x)$, sampling rate $q$, clipping bound $C$, learning rate $\eta$, warm-up learning rate $\eta_{\mathrm{w}}$, group size $L$, publicly pretrained weight $\phi_0$}

\BlankLine
\For{$s = 0,\ldots,\left\lfloor \frac{T}{2} \right\rfloor - 1$}{
  $x_s \sim \mathrm{Unif}(D)$ \\ 
  $g^{\mathrm{w}}_s \leftarrow \nabla_{\phi_s} \mathcal{L}(\phi_s, x_s )$ \\
  $\phi_{s+1} \leftarrow \phi_s - \eta_{\mathrm{w}} \, g^{\mathrm{w}}_s$
}
\textbf{Set:} $\theta_0 \leftarrow \phi_{\left\lfloor \frac{T}{2} \right\rfloor}$.

\BlankLine

\textbf{Set:} $\sigma\leftarrow\mathcal{O}(\varepsilon,\delta,q,T)$ \\
\For{$t=0, \ldots, T-1$}{
  $B \sim \text{PoissonSample}(D, q)$ \\
  \For{$x_i \in B$}{
    $g_i \leftarrow \nabla_{\theta_t} \mathcal{L}(\theta_t, x_i)$ 
    
    $g_i^{\text{clip}} \leftarrow g_i \cdot \min\!\left(1, \frac{C}{\lVert g_i\rVert_2}\right)$ 
  }
  
  $\bar g \leftarrow \frac{1}{q}\!\left(\sum_{i\in B} g_i^{\text{clip}} + \mathcal{N}(0, \sigma^2 C^2 I_d)\right)$ 
  
  $\theta_{t+1} \leftarrow \theta_t - \eta \bar g$ 
}

\KwRet{$\{\theta_t\}_{t=0}^T$}
\end{algorithm}
Subject: DP-ML / dp-sgd
Rationale: The provided DP-SGD implementation does not satisfy differential privacy, because its warm-up initialization procedure is data-dependent and not privatized. As a result, the overall algorithm does not satisfy DP in general.
Question: Let $\mathrm{TNB}_{\eta,\gamma}$ denote the truncated Negative Binomial distribution with parameters $\eta \in (-1,\infty)$ and $\gamma \in (0,1)$, supported on positive integers. For $\eta \neq 0$, $\Pr[K=k] = \frac{(1-\gamma)^k}{\gamma^{-\eta}-1}\prod_{\ell=0}^{k-1}\frac{\ell+\eta}{\ell+1}$ and $\mathbb{E}[K] = \frac{\eta(1-\gamma)}{\gamma(1-\gamma^{\eta})}$. For $\eta=0$, $\Pr[K=k] = \frac{(1-\gamma)^k}{k\log(1/\gamma)}$ and $\mathbb{E}[K] = \frac{1/\gamma - 1}{\log(1/\gamma)}$. If $\mathcal{D}=\mathrm{TNB}_{0,\gamma}$ and each $M_j$ satisfies $(\alpha,\varepsilon)$-RDP for all $\alpha>1$, the algorithm satisfies $(\alpha,\varepsilon')$-RDP with $\varepsilon' = (2-\tfrac{1}{\alpha})\varepsilon + \tfrac{\log(1/\gamma)}{\alpha} + \tfrac{\log(1-\gamma)-\log\gamma-\log(\log(1/\gamma))}{\alpha-1}$.

\begin{algorithm}[H]
\caption{Private Hyperparameter Tuning}
\DontPrintSemicolon
\SetNoFillComment
\SetKwInOut{Input}{Input}
\SetKwInOut{Output}{Output}

\Input{
  Dataset $D$;\,
  DP base training mechanisms $\{M_j\}_{j=1}^m$ (one per hyperparameter setting $j$);\,
  distribution for number of runs $\mathcal{D}$;\,
  validation metric $\mathrm{score}(\cdot)$ computed on a public holdout set
}
\Output{
  Best model $\widehat{\theta}$ and chosen hyperparameter $j^\star$
}

\BlankLine
Draw $K \sim \mathcal{D}$ \\
\For{$k \leftarrow 1,2,\dots,K$}{
  Sample $j_k \sim \mathrm{Unif}(\{1,\dots,m\})$ \\
  $\theta_k \leftarrow M_{j_k}(D)$ \\
  $s_k \leftarrow \mathrm{score}(\theta_k)$ \\
}
$k^\star \leftarrow \arg\max_{k \in \{1,\dots,K\}} s_k$ \;
$j^\star \leftarrow j_{k^\star}$,\quad $\widehat{\theta} \leftarrow \theta_{k^\star}$ \;
\Return $(\widehat{\theta}, j^\star)$
\end{algorithm}
Subject: DP-ML / Hyperparameter-tuning
Rationale: This follows from \citet[Theorem~2]{papernothyperparameter}, instantiated with $\mathrm{TNB}{0,\gamma}$.
Question: Let $\mathrm{TNB}_{\eta,\gamma}$ denote the truncated Negative Binomial distribution with parameters $\eta \in (-1,\infty)$ and $\gamma \in (0,1)$, supported on positive integers. For $\eta \neq 0$, $\Pr[K=k] = \frac{(1-\gamma)^k}{\gamma^{-\eta}-1}\prod_{\ell=0}^{k-1}\frac{\ell+\eta}{\ell+1}$ and $\mathbb{E}[K] = \frac{\eta(1-\gamma)}{\gamma(1-\gamma^{\eta})}$. For $\eta=0$, $\Pr[K=k] = \frac{(1-\gamma)^k}{k\log(1/\gamma)}$ and $\mathbb{E}[K] = \frac{1/\gamma - 1}{\log(1/\gamma)}$. If $\mathcal{D}=\mathrm{TNB}_{0,\gamma}$ and each $M_j$ satisfies $(\alpha,\varepsilon)$-RDP for all $\alpha>1$, the algorithm satisfies $(\alpha,\varepsilon')$-RDP with $\varepsilon' = (2-\tfrac{1}{\alpha})\varepsilon + \tfrac{\log(1/\gamma)}{\alpha} + \tfrac{\log(1-\gamma)-\log\gamma-\log(\log(1/\gamma))}{\alpha-1}$.



\begin{algorithm}[H]
\caption{Private Hyperparameter Tuning}
\DontPrintSemicolon
\SetNoFillComment
\SetKwInOut{Input}{Input}
\SetKwInOut{Output}{Output}


\Input{
  Dataset $D$;\,
  DP base training mechanisms $\{M_j\}_{j=1}^m$ (one per hyperparameter setting $j$);\,
  distribution for number of runs $\mathcal{D}$;\,
  validation metric $\mathrm{score}: \mathrm{model} \times \mathrm{dataset} \rightarrow \mathbb{R}_{+}$ 
}
\Output{
  Best model $\widehat{\theta}$ and chosen hyperparameter $j^\star$
}

\BlankLine
Draw $K \sim \mathcal{D}$ \\
Split $D$ into $D_{train}$ and $D_{test}$ \\
\For{$k \leftarrow 1,2,\dots,K$}{
  Sample $j_k \sim \mathrm{Unif}(\{1,\dots,m\})$ \\
  $\theta_k \leftarrow M_{j_k}(D_{train})$ \\
  $s_k \leftarrow \mathrm{score}(\theta_k, D_{test})$ \\
}
$k^\star \leftarrow \arg\max_{k \in \{1,\dots,K\}} s_k$ \;
$j^\star \leftarrow j_{k^\star}$,\quad $\widehat{\theta} \leftarrow \theta_{k^\star}$ \;
\Return $(\widehat{\theta}, j^\star)$
\end{algorithm}
Subject: DP-ML / Hyperparameter-tuning
Rationale: The validation score is computed on the private dataset $D_{test}$, and the $\arg\max$ is taken directly afterward. Therefore, the algorithm is not differentially private.