[DP-EBM] Question regarding range R and sensitivity

[Jogima-cyber]

Hello,
It appears that the range $R$ is defined to be $\max_i y_i - \min_i y_i$ in the code:

• DP noise with R: the noise is scaled by domain_size ($=R$).
• Definition of R: domain_size is set to max_target - min_target.

However with this definition of $R$ it seems to me that the sensitivity $\sum_{b \in S_{\ell}} \sum_{x_i \in \hat{H}_k (b)} y_i$ isn't $R$. Instead, it appears to be $\max\left(\max_i|y_i|, \max_i y_i - \min_i y_i\right)$. When writing the sensitivity in the case when the two samples that are different are in two different splits, one of each being $S_l$:

In this case, by taking $\max_i y_i=10000$ and $\min_i y_i=9000$ we would have $R=1000$ but the sensitivity goes up to $10000$.

[paulbkoch]

I'm not an expert in DP, so I had claude code write the response below. @Harsha-Nori, please correct if anything is wrong:

The sensitivity calculation is correct, but the reasoning relies on a detail that's easy to miss.

The key is that targets are clipped to [min_target, max_target] before training (line 778), and the intercept is initialized to the mean of the clipped targets. So the maximum residual any single sample can produce is bounded by max_target - min_target, not by the absolute magnitude of the targets.

In your example with targets between 9000 and 10000:

• domain_size = 1000
• Intercept initializes near ~9500
• Maximum possible residual for any sample ≈ 500 (half the range)

So, domain_size = 1000 is a correct (and conservative) upper bound on the gradient contribution of a single sample. The sensitivity of 10000 would only apply if the model started predictions at 0, but it doesn't — the intercept absorbs the base level.

That said, the privacy_target_min and privacy_target_max parameters should be set to publicly known bounds rather than derived from the data, to avoid leaking information through the clipping range itself. If those aren't set, the code warns about a possible privacy violation (line 769-774).