Struct PrivateHyperparameterOptimizer 

pub struct PrivateHyperparameterOptimizer<T: Float + Debug + Send + Sync + 'static> { /* private fields */ }

Privacy-preserving hyperparameter optimizer

Implementations

impl<T: Float + Debug + Send + Sync + 'static> PrivateHyperparameterOptimizer<T>

pub fn new( config: PrivateHPOConfig<T>, parameterspace: ParameterSpace<T>, ) -> Result<Self>

Create new private hyperparameter optimizer.

The objective’s global sensitivity must be declared in config.sensitivity_bounds (under "objective", or as the only entry). Every evaluation releases its objective under a differentially private noise mechanism whose scale is sensitivity / epsilon, so an undeclared sensitivity has no safe default: substituting 1.0 silently rescales the noise, and every epsilon reported afterwards would describe a guarantee the run did not deliver. Construction therefore fails instead of guessing, whether or not private_model_selection is set.

pub fn seed_for_tests(&mut self, seed: u64)

Seed every stochastic component deterministically (tests only).

The sub-seeds are domain-separated. Seeding the objective’s noise mechanism and the selection mechanism from the same seed makes both draw the same underlying uniform stream, so the evaluation that receives the largest objective noise also receives the largest selection noise – the private selection then reproduces the exact argmax and looks deterministic when it is not. That correlation is an artefact of the test harness, not of the mechanisms, and this is where it is avoided.

pub fn total_privacy_cost(&self) -> PrivacyBudget

The epsilon spent so far across every objective release and the private selection.

This used to be privacy_accountant() -> &MomentsAccountant. That accountant was constructed from base_privacyconfig’s DP-SGD parameters (noise_multiplier, batch_size, dataset_size) and then never stepped, so it reported the spend of a training run that had not happened while the hyperparameter search’s real, pure-epsilon spend was tracked entirely by HPOBudgetManager. A moments accountant models subsampled-Gaussian composition and is the wrong primitive for the Laplace / exponential releases this optimizer performs, so it is gone rather than fed fabricated (sigma, q) pairs. Read the real ledger here or in PrivateHPOResults::total_privacy_cost.

pub fn budget_manager(&self) -> &HPOBudgetManager

The budget manager.

pub fn private_objective(&self) -> &PrivateObjective<T>

The private objective, including the noise mechanism and the scale it last used.

pub fn optimize( &mut self, objective_fn: ObjectiveFn<T>, ) -> Result<PrivateHPOResults<T>>

Optimize hyperparameters with differential privacy.

The final configuration is chosen by the configured private selection mechanism when private_model_selection is set. When it is not, the exact argmax is returned and PrivateHPOResults::selection records was_private: false so the caller cannot mistake it for a private choice.