SlowGuess/NAACL_2022_OCR huggingface dataset:
Instantiating the type-1 and type-2 queries in Theorem 2 with the regular and private updates defined in Algorithm 1 yields the privacy guarantees for Algorithm 1. Theorem 2 provides a convenient way of calculating the S-DP guarantees for Algorithm 1: one can apply off-the-shelf privacy composition tools to calculate the overall DP guarantees for all the private updates and then the entire algorithm satisfies S-DP with the same values of  $\epsilon$  and  $\delta$ . Specifically, in this paper, we leverage moment accountant (Abadi et al., 2016) to calculate the DP guarantees for the composition of all privacy queries.
A.4 Models with Different Parameters
We plot the performances of models with different parameters in Figure 7. We find that fixing the noise multiplier  $\sigma = 0.5$ , the clipping threshold  $C$  has a big impact on the performance, and it cannot be too big (0.01) or too small (5e-6); if we fix  $C$  and change  $\sigma$  from 0.5 to 0.1, the perplexity will be lower but at a huge cost of the privacy budget  $\sigma$ . As expected, there is always a trade-off between the utility and the privacy spent, so we choose a balancing point with a reasonable utility and privacy guarantee ( $\sigma = 0.5$  and  $C = 1\mathrm{e} - 3$ ) for the main experiments.
Figure 7: Validation perplexity over epochs on WikiText-2 for models with different parameters.
A.5 Membership Inference on CUSTOMERSIM
Figure 8: Original membership inference results on CUSTOMERSIM. The best inference accuracy is around  $58\%$ .
The original membership inference attack doesn't achieve good results on CUSTOMERSIM. Figure 8 shows the original membership inference result on CUSTOMERSIM. The best inference accuracy is around  $58\%$ . So we employ a more advanced version, where we first perform the attack on 1000 names, and then pick the best-predicted and worst-predicted names to form a new subset of 300 names to perform the attack again. But even for the advanced version, the inference accuracy is only a little better than random guess probability  $(60 + \%)$ , so this attack is not successful on CUSTOMERSIM.