Spectrum Is Not Enough: A Random-Matrix Account of Data-Free Preconditioning for Differentially Private Learning
Shilin Zhang, Kangning Wang
原文摘要
At a fixed privacy budget, curvature is exactly the object the budget makes unavailable. A recent answer estimates it from synthetic probes, at neither privacy cost nor distribution shift, and validates a probe by the eigenvalue decay it reproduces. That test reads the spectrum, not the basis, and what a probe reconstructs is unknown. This paper gives a random-matrix account of data-free preconditioning, organized by one dichotomy. Of the two Kronecker factors, the error-signal factor $ G $ and the architecture-determined bulk of the activation factor $ A $ are reconstructible without data up to an explicit error-energy bound; only the data-induced spikes of $ A $ are not. We verify that bound with zero violations along a full training trajectory, though it stays one to nearly three orders of magnitude above the gap it bounds. We locate the failure boundary at a Baik-Ben Arous-Péché threshold: a bulk-only probe suffers an exact damage $s^2/(1-s^2)$ from a spike of strength $s^2$, invisible once its amplitude exceeds the scaled-bulk threshold $( \sqrt {c}/(1+ \sqrt {c}))^{1/2}$, $c = d/n$. The test in use is basis-blind: rotating only the probe eigenbasis at a near-exact matched spectrum inflates the residual by $2.3 \times $ to $89.8 \times $, and a closed-form volume law fixes the within-spectrum ordering of the critical volume while a two-oracle construction proves that no functional of the probe spectrum fixes its magnitude. Over forty seeds on three modalities, per-layer tuning does not transfer to accuracy, no data-free arm beats the flat probe, public-data curvature does on both modalities tested, and the ordering inverts on PathMNIST under real DP noise. The account yields a probe-design protocol and falsifiable predictions for the regimes where data-free curvature can be trusted.
cs.LG