Adaptive Queries Refute the Conjectured Worst Case of Shuffled DP-SGD

DP-SGD is usually trained on shuffled fixed-size batches, and Chua et al. conjectured that a simple pair of Gaussian mixtures is the worst case for one epoch. We prove that the conjecture is false with two batches: an adaptive adversary beats the conjectured pair at every privacy level and noise scale. For identical other records the gap is small in practice: the exact worst case is a one-state recursion sandwiched between two random walks, and in the forward direction the conjectured pair is asymptotically tight in relative terms. Assuming identical records are worst (an open hypothesis, tested only at three batches), we give an upper-bound accountant and a pip-installable tool, and two-sided intervals for several published shuffled runs, in idealised models of their pipelines. Files: the paper PDF; the arXiv source; a supplement (tool source and tests, accountant, certified results, proofs, verification records, table generators) that regenerates every reported table byte-identically; SHA256SUMS.