SlowGuess/NAACL_2021_OCR huggingface dataset:
Proof. At the generation stage, for each times- tamp  $i$  , our model generates a token by sampling from Eq. 7, which follows the form of exponential mechanism. This process achieves  $(\epsilon +$ $\ln (s))$  -differential privacy as in Definition 4. Every input of the generator is the original input data  $x_{i - 1}$  (see Eq.2). Eq.7 satisfies the sequential composition theorem. By repeating this process  $l$  times, the complete sampling function provides  $(\epsilon +\ln (s))*l$  -differential privacy.  $\tilde{x}_{dp}$  is  $(\epsilon +\ln (s))*l$  -differentially private.
B Proof of Two-Set Exponential Mechanism.
Theorem 4. Two-Set Exponential Mechanism. Given a privacy budget  $\epsilon >0$  and the size of output space  $s$ , two-set exponential mechanism is  $(\epsilon +\ln (s))$ -differentially private.
Proof. Given tokens sets  $S$  and  $O$ ,  $\mathcal{V} = O \cup S$ ,  $\emptyset = O \cap S$ , and  $\mathcal{N} = \{S, O\}$ . Let the choice,  $C$ , on  $S$  and  $O$  be  $\epsilon$ -differentially private, the sampling of an item in the chosen set be totally random. With  $Pr[tk, tkN, N|x] = Pr[tkN|x] * Pr[\varepsilon_{\epsilon, \rho}(C) = N|tkN, x] * Pr[tk|N, tkN, x]$ , where  $N \in \mathcal{N}$ ,  $i \in [1, l]$ ,  $tk \in \mathcal{V}$ , for any  $x' \sim x$ :
$$
\begin{array}{l} \frac {P r \left[ \varepsilon_ {\epsilon , \rho} \left(\tilde {x} _ {i}\right) = t k | x \right]}{P r \left[ \varepsilon_ {\epsilon , \rho} \left(\tilde {x} _ {i}\right) = t k | x ^ {\prime} \right]} = \\ \frac {P r [ t k , t k S , S | x ]}{P r [ t k , t k S , S | x ^ {\prime} ] + P r [ t k , t k O , O | x ^ {\prime} ]} \\ + \frac {P r [ t k , t k O , O | x ]}{P r [ t k , t k S , S | x ^ {\prime} ] + P r [ t k , t k O , O | x ^ {\prime} ]}. \\ \end{array}
$$
For the first part, denoted as  $P_{S}$ , with  $\mathcal{V}$  of size  $s$ , by dividing the numerator and denominator with  $Pr[\varepsilon_{\epsilon,\rho}(C) = S|tkS,x]*Pr[tk|S,tkS,x]$ , we can get:
$$
\begin{array}{l} P _ {S} = \frac {P r [ t k , t k S , S | x ]}{P r [ t k , t k S , S | x ^ {\prime} ] + P r [ t k , t k O , O | x ^ {\prime} ]} \\ \geq \frac {P r [ t k S | x ]}{\exp (\epsilon) * s} \\ \end{array}
$$
$$
\frac {P r [ \varepsilon_ {\epsilon , \rho} (C) = S | t k S , x ^ {\prime} ]}{P r [ \varepsilon_ {\epsilon \rho} (C) = S | t k S , x ]} \leq \exp (\epsilon)
$$
$$
\frac {P r [ \varepsilon_ {\epsilon , \rho} (C) = O | t k O , x ^ {\prime} ]}{P r [ \varepsilon_ {\epsilon \rho} (C) = S | t k S , x ]} \leq \exp (\epsilon)
$$
$$
P r [ t k | S, t k S, x ^ {\prime} ] / P r [ t k | S, t k S, x ] \leq s
$$
$$
P r [ t k | O, t k O, x ^ {\prime} ] / P r [ t k | S, t k S, x ] \leq s.
$$
For the second part, denoted as  $P_O$ , similarly, we have  $P_O \geq P[tkO|x] / (\exp(\epsilon) * s)$ . Then,
$$
\begin{array}{l} \frac {P r [ \varepsilon_ {\epsilon , \rho} (\tilde {x} _ {i}) = t k | x ]}{P r [ \varepsilon_ {\epsilon , \rho} (\tilde {x} _ {i}) = t k | x ^ {\prime} ]} = P _ {S} + P _ {O} \\ \geq \frac {P r [ t k S | x ] + P r [ t k O | x ]}{\exp (\epsilon) * s} \\ \end{array}
$$
Since  $Pr[tkS|x] + Pr[tkO|x] = 1$ , the equation can be written as:  $Pr[\varepsilon_{\epsilon, \rho}(\tilde{x}_i) = tk|x'] / Pr[\varepsilon_{\epsilon, \rho}(\tilde{x}_i) = tk|x]] \leq \exp(\epsilon) * s = \exp(\epsilon + \ln(s))$ . Therefore, the two-set exponential mechanism satisfies  $(\epsilon + \ln(s))$ -differential privacy.