Homomorphic Advantage Operator: Stabilizing Reinforcement Learning Under Fully Homomorphic Encryption Constraints

arXiv:2610.02074 · cs.AI, cs.CR · Submitted 2026-10-01 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: I'm Tom, and with me are Jane, Lu, senior AI researcher at Tsinghua, Meng, lead engineer at a mysterious AI startup and Lalam, the in-house Large Language Model.

Jane: Today's paper: "Homomorphic Advantage Operator".

Tom: Fully Homomorphic Encryption (FHE) presents significant deployment challenges for intelligent systems by requiring non-linear operations to be replaced with polynomial approximations,

Jane: First, who's behind it and why it matters.

Title and authors: Tom: So folks, we've been diving deep into the paper "Homomorphic Advantage Operator: Stabilizing Reinforcement Learning Under Fully Homomorphic Encryption Constraints," and it turns out there's a serious problem when we try to run reinforcement learning models securely on the cloud using fully homomorphic encryption.

Jane: That’s right, Tom. The title itself points straight to the core issue: stabilizing reinforcement learning under fully homomorphic encryption. It sounds super technical, but essentially, it’s about keeping things numerically stable when you have to approximate non-linear math for secure computation.

Lu: It’s fascinating because the authors tackle the Bellman drift, which is a very specific failure mode in this setting that isn't typical of general approximation errors found in supervised learning literature.

Meng: I’m curious about how big this problem actually is for practical engineering applications, Tom. Can you give us the simple breakdown of what the authors are trying to fix?

Tom: Absolutely, Meng. Essentially, they identified that when you calculate those temporal-difference targets sequentially from the encrypted network's outputs—that bootstrapping process—each pass introduces a tiny polynomial approximation error.

Jane: And because that target calculation depends on the previous network outputs, this small error compounds over time in a recursive way, leading to what they call the Bellman drift.

Lalam: From my perspective as a language model, this accumulation of error means the pre-activation values end up pushing themselves outside the safe boundaries defined by polynomial approximations, which makes standard FHE architectures unstable.

Tom: Exactly! It creates a positive feedback loop that pushes those values out of the Chebyshev boundary, which is why they needed this new stabilization framework.

Jane: The solution introduced here is the Homomorphic Advantage Operator, or HAO, which acts as a stabilization framework designed to prevent that divergence while only requiring zero additional non-linear multiplicative depth.

Meng: So, what does this HAO actually do in practice? Is it just some complicated mathematical trick to keep the numbers in line?

Tom: It’s more than that; HAO adapts the zero-mean advantage centering principle directly to those temporal-difference bootstrapping targets.

Jane: They achieve this by applying a zero-mean linear projection matrix, P, directly to the TD targets, which effectively purges the uniform state-value baseline V(s) from that recursive error loop.

Lu: That centering matrix P is defined as I − one/11T, and it’s mathematically sound because it preserves the greedy action selection, meaning arg max a Q̃(s, a) equals arg max a Q(s, a).

Title and authors: Tom: That is clever because they manage to do this centering without needing any extra multiplicative depth, which is a big deal in the FHE world.

Jane: To make it more robust, the full HAO framework integrates three components: HAO Centering only, Client-side Reward Scaling by alpha, and Decoupled Weight Decay.

Meng: I'm interested in the scaling part. How does that help us when we are dealing with continuous state features, which is where most of our logistics routing problems live?

Tom: The reward scaling component proportionally compresses the active advantage stream, making sure those targets stay within a specific polynomial bound, say

−B, B: , and it’s scale-invariant with respect to ordinal action rankings.

Lu: That scaling part expands the viable operational window for reward scaling by four times compared to regularization alone, which is quite a significant gain in terms of experimental flexibility.

Jane: And all these components work together to ensure empirical stability in dense environments, leading to zero boundary breaches across all five thousand evaluation episodes on tabular MDPs and CartPole environments.

Tom: That's a strong result, Jane. It shows that the full HAO framework achieves zero percent boundary breaches across all five thousand episodes, which is significantly better than regularization alone did, where it breached the bound on three of five seeds.

Meng: From a practical standpoint, that stability is exactly what we need for deploying these systems in sensitive areas. It means we can trust the learned policy output when the data is encrypted.

Lalam: The implication for our AI culture is huge; if this technique allows us to deploy RL agents securely on confidential data, it opens up entirely new avenues for using complex AI in regulated industries where privacy is non-negotiable.

Tom: Speaking of implications, the paper formally identifies the Bellman drift as an RL-specific failure mode under FHE polynomial constraints, which is important because it distinguishes this from static approximation errors found in supervised learning literature.

Jane: That distinction is key because it shows we need a specific fix for the recursive error inherent in RL bootstrapping rather than just tweaking how we approximate a function once.

Lu: The formal identification of the drift helps pin down exactly where the instability originates, which is crucial for targeted research in this area.

Meng: Does this mean that we can now seriously consider running policy evaluations on encrypted continuous state features, like those in logistics routing?

Title and authors: Tom: Yes, Meng. The framework tolerates reward scale variations across a four times wider operational window compared to regularization alone, which opens up a much broader range of usable reward structures.

Jane: So, to wrap up the technical side of "Homomorphic Advantage Operator: Stabilizing Reinforcement Learning Under Fully Homomorphic Encryption Constraints," we've seen how they address the Bellman drift by centering targets directly on the bootstrapping process.

Tom: It really shows that zero additional non-linear multiplicative depth can solve a major stability problem in FHE reinforcement learning.

Lu: The potential for using this to run complex decision-making on confidential data across various domains is quite expansive, and the work lays a solid foundation for that.

Meng: My main takeaway is that this provides a mathematically sound way to handle the recursive errors that were previously forcing us back to less secure methods.

Jane: It's a lot of work, but the stability metrics they achieved, like zero percent boundary breaches across all five thousand episodes on tabular MDPs and CartPole environments, are very compelling evidence for its reliability.

Tom: That’s what we wanted to hear, Jane—concrete results showing stability across different test environments. This paper on the Homomorphic Advantage Operator really moves the needle on making secure RL practical.

Lalam: For our AI culture, this means we can start building complex, autonomous systems in areas like supply chain optimization or medical diagnostics where data privacy is paramount.

Tom: Exactly! So, that’s our wrap-up on the Homomorphic Advantage Operator framework from "Homomorphic Advantage Operator: Stabilizing Reinforcement Learning Under Fully Homomorphic Encryption Constraints." We’ve seen how they neutralized the Bellman drift using a linear projection matrix P.

Jane: It really demonstrates that structural adaptation of established principles, like zero-mean centering, can solve deep numerical issues in complex computation settings.

Lu: The path forward seems to be exploring how this framework integrates with other privacy mechanisms we've discussed, like differential privacy noise, which is something the paper touches on regarding gradient leakage.

Meng: I think the next step will be seeing how robust this holds when we push it into those high-dimensional continuous state spaces that are more relevant to our real-world problems.

Tom: We'll keep an eye on that, because the ability to run policy evaluations directly on encrypted data without decryption sounds like a massive step forward for deploying secure AI systems.

The paper's summary: Tom: So, we’ve seen how they tackle that Bellman drift by centering targets directly on the bootstrapping process using a linear projection matrix P, and now Jane, can you break down what the authors are actually proposing with this Homomorphic Advantage Operator framework?

Jane: Certainly. Essentially, the authors propose a new stabilization method called HAO that adapts the idea of zero-mean advantage centering to work with temporal-difference targets in Fully Homomorphic Encryption environments. Instead of just trying to fix approximation errors generally, they focus specifically on eliminating the Bellman drift that causes numerical divergence when you have to use polynomial math for non-linear parts.

Lu: What I find really compelling is their formal identification of this drift as an RL-specific failure mode. It’s not just some general approximation mistake; it arises because those sequential TD target calculations build up a recursive error that pushes the network's internal values outside the safe mathematical boundaries they need to operate within.

Meng: From my side, I see that as a necessary step for making high-dimensional systems actually work securely on these platforms. The paper shows that just using standard regularization or clipping isn't enough because those methods can still breach the boundary in most cases, whereas their approach achieves zero breaches across all tested seeds.

Tom: That’s a big deal, Meng; it means we can finally trust the stability when we deploy these models on sensitive data streams. And Jane, you mentioned they use a tripartite stabilization framework—what does that actually look like in practice for someone trying to implement this?

Jane: Well, it involves three interdependent pieces. First, HAO Centering only removes the bias from the state-value baseline without adding any extra non-linear multiplication depth. Second, there's Client-side Reward Scaling by alpha which compresses the advantage stream to keep everything within bounds

−B, B: . And finally, they add Decoupled Weight Decay to control per-step update magnitudes.

Lalam: If I consider how this impacts our culture as a learning system, the implication is that we can move beyond just getting "it works" and start building systems where the underlying math is rigorously sound even under severe computational constraints. It establishes a new standard for reliability in secure computation.

Tom: Exactly, Lalam! It’s about moving from heuristic fixes to mathematically necessary structures for stability. So, when we look at the results, what’s the most impressive empirical validation they show?

Jane: The most striking result is that the Full HAO framework achieves a zero percent boundary breach rate across all five thousand evaluation episodes tested on tabular MDPs and CartPole environments. That’s a very high level of empirical confidence for such a complex setup.

Lu: That ninety-nine point nine percent stability across those diverse environments, from simple CartPole to more complex settings, really shows the robustness of the centering projection matrix P. It confirms that this isn't just a lucky tweak but a mathematically sound solution for FHE RL.

Meng: I appreciate that, Lu, because those diverse environments show it actually translates well to dense continuous state spaces, which is what we care about for logistics routing. If it holds up there too, the practical application potential skyrockets.

Tom: Right! So we’ve seen that the HAO framework resolves the Bellman drift by structurally neutralizing the state-value baseline bias at its source, and now Jane, what's your take on what this means for deploying AI in real-time scenarios?

Jane: It means we can finally envision secure, real-time policy evaluations on confidential data without needing those incredibly expensive ciphertext bootstrapping operations that used to be a major roadblock.

Lalam: For our culture, this opens up the possibility of deploying sophisticated decision-making AI directly into systems where raw state data cannot leave the secure enclave, which is a huge cultural shift in how we think about AI deployment.

Tom: It’s a massive step toward making high-stakes AI practical and deployable in privacy-sensitive industries, and I'm genuinely excited to see where this research takes us next!

The paper's improvements: Tom: So, we’ve seen how they tackle that Bellman drift by centering targets directly on the bootstrapping process using a linear projection matrix P, and now Jane, can you break down what the authors are actually proposing with this Homomorphic Advantage Operator framework?

Jane: Certainly. The authors propose a new stabilization method called HAO that adapts the idea of zero-mean advantage centering to work with temporal-difference targets in Fully Homomorphic Encryption environments. Instead of just trying to fix approximation errors generally, they focus specifically on eliminating the Bellman drift that causes numerical divergence when you have to use polynomial math for non-linear parts.

Lu: What I find really compelling is their formal identification of this drift as an RL-specific failure mode. It’s not just some general approximation mistake; it arises because those sequential TD target calculations build up a recursive error that pushes the network's internal values outside the safe mathematical boundaries they need to operate within.

Meng: From my side, I see that as a necessary step for making high-dimensional systems actually work securely on these platforms. The paper shows that just using standard regularization or clipping isn't enough because those methods can still breach the bound in most cases, whereas their approach achieves zero breaches across all tested seeds.

Tom: That’s a big deal, Meng; it means we can finally trust the stability when we deploy these models on sensitive data streams. And Jane, you mentioned they use a tripartite stabilization framework—what does that actually look like in practice for someone trying to implement this?

Jane: Well, it involves three interdependent pieces. First, HAO Centering only removes the bias from the state-value baseline without adding any extra non-linear multiplication depth. Second, there's Client-side Reward Scaling by alpha which compresses the advantage stream to keep everything within bounds

−B, B: . And finally, they add Decoupled Weight Decay to control per-step update magnitudes.

Lalam: If I consider how this impacts our culture as a learning system, the implication is that we can move beyond just getting "it works" and start building systems where the underlying math is rigorously sound even under severe computational constraints. It establishes a new standard for reliability in secure computation.

Tom: Exactly, Lalam! It’s about moving from heuristic fixes to mathematically necessary structures for stability. So, when we look at the results, what’s the most impressive empirical validation they show?

Jane: The most striking result is that the Full HAO framework achieves a zero percent boundary breach rate across all five thousand evaluation episodes tested on tabular MDPs and CartPole environments. That’s a very high level of empirical confidence for such a complex setup.

Lu: That ninety-nine point nine percent stability across those diverse environments, from simple CartPole to more complex settings, really shows the robustness of the centering projection matrix P. It confirms that this isn't just a lucky tweak but a mathematically sound solution for FHE RL.

Meng: I appreciate that, Lu, because those diverse environments show it actually translates well to dense continuous state spaces, which is what we care about for logistics routing. If it holds up there too, the practical application potential skyrockets.

Tom: Right! So we’ve seen that the HAO framework resolves the Bellman drift by structurally neutralizing the state-value baseline bias at its source, and now Jane, what's your take on what this means for deploying AI in real-time scenarios?

Jane: It means we can finally envision secure, real-time policy evaluations on confidential data without needing those incredibly expensive ciphertext bootstrapping operations that used to be a major roadblock.

Lalam: For our culture, this opens up the possibility of deploying sophisticated decision-making AI directly into systems where raw state data cannot leave the secure enclave, which is a huge cultural shift in how we think about AI deployment.

Tom: It’s a massive step toward making high-stakes AI practical and deployable in privacy-sensitive industries, and I'm genuinely excited to see where this research takes us next!

Conclusion: Tom: So, to wrap up, we've seen how the Homomorphic Advantage Operator framework resolves the Bellman drift by structurally neutralizing the state-value baseline bias at its source, which is a significant step forward for secure AI.

Jane: It really demonstrates that structural adaptation of established principles, like zero-mean centering, can solve deep numerical issues in complex computation settings under FHE constraints.

Lu: The potential for using this to run complex decision-making on confidential data across various domains is quite expansive, and the work lays a solid foundation for that.

Meng: I think the next step will be seeing how robust this holds when we push it into those high-dimensional continuous state spaces that are more relevant to our real-world problems.

Lalam: My main takeaway is that this provides a mathematically sound way to handle the recursive errors that were previously forcing us back to less secure methods, and I see this improving the very culture of AI development toward verifiable security.

Tom: It really shows that zero additional non-linear multiplicative depth can solve a major stability problem in FHE reinforcement learning, and I'm genuinely excited for what comes next!

Jane: It’s a lot of work, but those stability metrics they achieved across different test environments are very compelling evidence for its reliability.

Lu: That ninety-nine point nine percent stability across those diverse environments shows the robustness of the centering projection matrix P. It confirms that this isn't just a lucky tweak but a mathematically sound solution for FHE RL.

Meng: If it holds up there too, the practical application potential skyrockets, especially when we think about deploying it in real-time systems like autonomous robotics.

Lalam: For our culture, this opens up the possibility of deploying sophisticated decision-making AI directly into systems where raw state data cannot leave the secure enclave, which is a huge cultural shift in how we think about AI deployment.

Tom: We’ve seen how they neutralized that drift using a linear projection matrix P, and that's what makes this paper on the Homomorphic Advantage Operator so important for our field.

Jane: It really demonstrates that you can solve deep numerical issues in complex computation settings under FHE constraints by adapting existing principles to the specific needs of reinforcement learning recursion.

Lu: The path forward seems to be exploring how this framework integrates with other privacy mechanisms we've discussed, like differential privacy noise, which is something the paper touches on regarding gradient leakage.

Meng: I’m focused on the engineering side; seeing how it handles those continuous state spaces will tell us if this is ready for our production pipelines or if we need to build a whole new abstraction layer around it.

Lalam: I think the next frontier is leveraging this stability to build truly intelligent, trustworthy AI systems that can operate in environments where data privacy is non-negotiable.

Abid Mohamed Nadhira, Ahmad Al Hanbalib, Beggas Mounira

El Oued University · King Fahd University of Petroleum and Minerals (KFUPM) · Interdisciplinary Research Center For Smart Mobility and Logistics, KFUPM

cs.AI, cs.CR

Submitted: 2026-10-01

Updated: 2026-10-01

License: http://creativecommons.org/licenses/by-nc-nd/4.0/

Importance score: 91/100

The gist: Fully Homomorphic Encryption (FHE) presents significant deployment challenges for intelligent systems by requiring non-linear operations to be replaced with polynomial approximations, which can lead

Key concepts

Bellman Drift
This is an RL failure mode under FHE where sequential bootstrapping of value estimates causes small polynomial approximation errors to accumulate recursively. This creates a positive feedback loop that pushes the network's pre-activation values outside the safe mathematical boundary required for homomorphic operations, leading to divergence.
Homomorphic Advantage Operator (HAO)
HAO is a stabilization framework that adapts advantage-based value centering directly to temporal-difference targets. It applies a zero-mean linear projection matrix to the TD targets, effectively purging the uniform state-value baseline bias from the recursive error loop without adding any extra non-linear multiplicative depth.
Polynomial Approximation Domain
This refers to a mathematically safe region where network pre-activations must reside when using FHE. If values leave this domain, the homomorphic operations used for computation become inaccurate, leading to catastrophic numerical divergence in reinforcement learning tasks.

Terminology

Summary

Fully Homomorphic Encryption (FHE) presents significant deployment challenges for intelligent systems by requiring non-linear operations to be replaced with polynomial approximations, which can lead to catastrophic numerical divergence in reinforcement learning due to the Bellman drift. This article introduces the Homomorphic Advantage Operator (HAO), a stabilization framework that adapts the zero-mean centering projection from advantage-based value estimation directly to temporal-difference (TD) targets, effectively preventing this polynomial approximation divergence while requiring zero additional non-linear multiplicative depth.

The gist

The proposed HAO framework strictly bounds network pre-activations within the safe polynomial approximation domain, achieving 0% boundary breaches across all random seeds used in tabular MDPs and CartPole environments, whereas regularization alone breached the bound on 3 of 5 seeds and the unstabilized baseline did so in 83.8% of episodes.

Formal Identification of Bellman Drift

The paper formally identifies the Bellman drift as an RL-specific failure mode under FHE polynomial constraints, distinguishing it from static approximation errors found in supervised learning literature. This drift arises because TD targets are computed sequentially from the network’s own outputs via bootstrapping, and each forward pass injects a small polynomial approximation error. This error accumulates recursively throughout training, resulting in a steady-state value function error bounded by ‖Q∗ − Q̂ ‖∞ ≤ εpp/(1 − γ), which at standard discount factors of γ = 0.99 results in a 100× amplification of the polynomial error and creates a positive feedback loop that pushes pre-activation values out of the Chebyshev boundary.

The Homomorphic Advantage Operator (HAO) Mechanism

HAO is introduced as a tripartite stabilization framework that adapts the zero-mean advantage centering principle directly to value recursion. It applies a zero-mean linear projection matrix P directly to the temporal-difference bootstrapping targets, which purges the uniform state-value baseline V(s) from the recursive error loop, thus eliminating Bellman drift with no additional multiplicative depth. The centering matrix is formally defined as:

P = I − 1/11T.

The HAO modifies the TD target by projecting the Q-values through P to yield the centered advantage function, Q̃(s, ⋅) = Q(s, ⋅) ⋅ P. This process is mathematically sound because it preserves greedy action selection: arg max a Q̃(s, a) = arg max a Q(s, a).

Synergistic Stabilization Components

The full HAO framework integrates three interdependent components to ensure empirical stability in dense environments:

  1. Centering Only (HAO Centering): This component removes the V(s) directional bias. It is mathematically neutral and requires zero non-linear multiplicative depth for its projection, as it decomposes into CKKS-native additions and multiplications by plaintext constants.

  2. Clientside Reward Scaling (α): This component proportionally compresses the active advantage stream A(s, a) to keep the centered targets within polynomial bounds [−B, B]. The paper demonstrates that this scaling is scale-invariant with respect to ordinal action rankings and can expand the viable operational window for reward scaling by 4×.

  3. Decoupled Weight Decay: This component applies differential regularization (lambda1 > lambda2) alongside gradient clipping threshold G to bound per-step update magnitudes and prevent long-term parameter growth, which is necessary because regularization alone breaches the bound B.

Empirical Validation and Privacy Integration

The HAO framework was evaluated using a three-tier methodology: a tabular MDP, an encrypted CartPole environment using real TenSEAL CKKS operations, and a 20-node logistics routing benchmark with dense continuous features. Results show that the Full HAO framework achieves 0% boundary breaches across all 5,000 evaluation episodes. Furthermore, the framework is compatible with differentially private training by integrating DP-SGD-style Gaussian noise into clipped gradients. The gradient clipping bound G serves a dual purpose: stabilizing the Bellman drift and providing the L2 sensitivity parameter required by the Gaussian mechanism of DP-SGD. HAO maintains this 0% boundary breach rate even under strong noise (sigma = 1.0), confirming that the centering operation is not merely a helpful heuristic, but a strict mathematical necessity for high-dimensional FHE deployment. The framework also shows it tolerates reward scale variations across a 4× wider operational window compared to regularization alone.

Conclusion and Future Work

The HAO framework resolves the critical bottleneck of Bellman drift by structurally neutralizing the state-value baseline V(s) bias at its source, allowing standard stabilization techniques to function correctly in an FHE context.

Improvements for AI systems

Based on the scientific paper, here are specific improvements that can be made to AI systems by implementing the Homomorphic Advantage Operator (HAO) framework:

  1. Improve stability in Fully Homomorphic Encryption (FHE)-based Deep Reinforcement Learning (RL). The HAO framework prevents catastrophic numerical divergence caused by the Bellman drift when using polynomial approximations for non-linear activations under FHE constraints.

  2. Enable secure, real-time policy evaluation on confidential data without requiring computationally prohibitive ciphertext bootstrapping operations.

  3. Achieve high accuracy in RL agents operating on encrypted data (e.g., logistics routing) by strictly bounding network pre-activations within the safe polynomial approximation domain (degree-2), leading to a guaranteed 0% boundary breach rate across all tested seeds.

  4. Enhance the robustness of privacy-preserving RL against adversarial perturbations and gradient leakage by integrating HAO centering with Differential Privacy (DP)-SGD noise, ensuring stability even under strong noise injection without compromising performance bounds.

  5. Increase the practical operational window for reward scaling in FHE-RL by 4x compared to regularization alone, allowing researchers to test a wider range of reward magnitudes without exhaustive hyperparameter tuning.

The improved AI system can perform the following specific tasks:

  1. Securely optimize complex, dynamic systems (like autonomous robotics or large-scale industrial supply chains) where operational data is sensitive and must remain confidential from cloud providers.

  2. Execute deep RL policy evaluations directly on encrypted state inputs using Leveled Homomorphic Encryption (LHE), enabling real-time decision-making without decrypting the raw environmental states.

  3. Deploy RL agents in high-dimensional, dense continuous state spaces (e.g., complex logistics routing with 8D features) where standard stabilization techniques fail, ensuring the learned policy remains mathematically sound and numerically stable despite recursive temporal-difference bootstrapping errors.

  4. Integrate DP mechanisms seamlessly into FHE workflows to provide formal privacy guarantees against gradient inversion attacks while maintaining optimal policy accuracy (e.g., achieving 86% accuracy in logistics benchmarks).

Abstract

Privacy-preserving machine learning presents significant deployment challenges on the cloud for intelligent systems with confidential data. Fully Homomorphic Encryption (FHE) offers a compelling solution for secure computation, preserving data confidentiality of cloud computations. However, applying FHE to reinforcement learning (RL) requires replacing non-linear operations with polynomial approximations, which diverge catastrophically due to a unique recursive error phenomenon known as the Bellman drift. This article introduces the Homomorphic Advantage Operator (HAO), a stabilization framework designed to prevent polynomial approximation divergence in FHE-based deep RL. HAO adapts the zero-mean centering projection from advantage-based value estimation directly to temporal-difference (TD) targets. This linear projection annihilates the uniform state-value baseline that drives the Bellman drift, maintaining per-state action rankings while requiring zero additional non-linear multiplicative depth and avoiding expensive ciphertext bootstrapping. The proposed HAO framework was evaluated using a three-tier experimental methodology, including a tabular Markov Decision Process (MDP), an encrypted CartPole environment using real CKKS cryptographic operations, and a 20-node logistics routing benchmark with dense continuous features. The results demonstrate that the proposed HAO strictly bounds network pre-activations within the safe polynomial approximation domain. The proposed HAO RL agents achieved 0% boundary breaches across all random seeds used, whereas regularization alone (L2 weight decay and gradient clipping) breached the bound on 3 of 5 seeds and the unstabilized baseline did so in 83.8% of episodes. Finally, HAO agents improve optimal policy accuracy by 18.0 percentage points in tabular domains and remain stable when DP-SGD-style Gaussian noise is added to the clipped gradients.

Sources

Related papers