For many differentially private algorithms, such as the prominent noisy
stochastic gradient descent (DP-SGD), the analysis needed to bound the privacy
leakage of a single training run is well understood. However, few studies have
reasoned about the privacy leakage resulting from the mu