> stronger estimated privacy protection, with the estimated posterior mean of the privacy parameter epsilon of 4.32 That isnt a differential privacy guarantee, its a Bayesian estimate of one, so the comparison to the DP-only run is pretty soft. Also, HE on the training path and DP on inspection/release are protecting different surfaces, so