SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Definition 5.1 (Approximate zCDP and Ex-post Private Sequence). Consider a sequence of mechanisms  $(A_{n})_{n\geq 1}$ , where  $A_{n}:\mathcal{X}\to \mathcal{Y}$ . The sequence  $(A_{n})_{n\geq 1}$  is called a sequence of approximate zCDP and ex-post private mechanisms if for each round  $n$ , the analyst will select  $A_{n}(\cdot)$  to be  $\delta_n(\cdot)$ -approximate  $\rho_{n}(\cdot)$ -zCDP given previous outcomes  $A_{i}(\cdot)$  for  $i < n$ , or the analyst will select  $A_{n}(\cdot)$  to be  $(\mathcal{E}_n(A_n(\cdot);\cdot),\delta_n'(\cdot))$ -ex-post private conditioned on  $A_{i}(\cdot)$  for  $i < n$ . In rounds where zCDP is selected, we will simply write  $\mathcal{E}_i(A_i(\cdot);\cdot)\equiv 0$ , while in rounds where an ex-post private mechanism is selected, we will set  $\rho_{i}(\cdot) = 0$ .
We now state a composition result that allows an analyst to combine ex-post private and zCDP mechanisms adaptively, while still ensuring a target level of privacy. Because we have two different interactive systems that are differentially private, one that uses only zCDP mechanisms and the other that only uses ex-post private mechanisms, we can then use concurrent composition, see Appendix A for more details.
Theorem 2. Let  $\varepsilon, \varepsilon', \delta, \delta', \delta'' > 0$ . Let  $(A_{n})_{n \geq 1}$  be a sequence of approximate zCDP and ex-post private mechanisms. We require that the ex-post private mechanisms that are selected at each round  $n$  to have ex-post privacy functions  $\mathcal{E}_{n}$  that do not exceed the remaining budget from  $\epsilon'$ . Consider the following function  $N: \mathcal{Y}^{\infty} \to \mathbb{N}$  as the following for any sequence of outcomes  $(y_{n})_{n \geq 1}$
$$
N \left(\left(y _ {n}\right) _ {n \geq 1}, \left(y _ {n}\right) = \inf  \left\{N _ {\mathrm {z C D P}} \left(\left(y _ {1: n - 1}\right) _ {n \geq 1}\right), N _ {\text {p o s t}} \left(\left(y _ {n}\right) _ {n \geq 1}\right) \right\}, \right.
$$
where  $N_{\mathrm{zCDP}}((y_n)_{n \geq 1})$  is the stopping rule given in Theorem 1 with privacy parameters  $\varepsilon, \delta, \delta''$  and  $N_{\mathrm{post}}((y_n)_{n \geq 1})$  is the stopping rule where the sum of realized  $\mathcal{E}_n(y_n; y_1, \dots, y_{n-1})$  values cannot go above  $\varepsilon'$  nor can the sum of  $\delta_n'(y_1, \dots, y_{n-1})$  go above  $\delta'$  (see Lemma B.2 with privacy parameters  $\varepsilon', \delta'$ ). Then, the algorithm  $A_{1:N(\cdot)}(\cdot)$  is  $(\varepsilon + \varepsilon', \delta + \delta' + \delta'')$ -DP, where  $N(x) = N((A_n(x))_{n \geq 1})$ .
Although we are able to leverage advanced composition bounds from traditional differential privacy for the mechanisms that are approximate zCDP, we are simply adding up the ex-post privacy guarantees, which seems wasteful. Next, we consider how we can improve on this composition bound for certain ex-post private mechanisms.
6 Brownian Noise Reduction Mechanisms
We now consider composing specific types of ex-post private mechanisms, specifically the Brownian Noise Reduction mechanism. From Theorem 3.4 in Whitehouse et al. [2022], we can decompose the privacy loss as an uncentered Brownian motion, even when the stopping time is adaptively selected.
Theorem 3 (Whitehouse et al. [2022]). Let  $BM$  be the Brownian noise reduction mechanism associated with time values  $(t^{(k)})_{k\geq 1}$  and a function  $f$ . All reference measures generated by the mechanism are those generated by the Brownian motion without shift (starting at  $f(x) = 0$ ). For neighbors  $x\sim x'$  and stopping function  $T$ , the privacy loss between  $BM^{(1:T(x))}(x)$  and  $BM^{(1:T(x'))}(x')$  is given by
$$
\mathcal {L} _ {B M} ^ {(1: T (x))} (x, x ^ {\prime}) = \frac {| | f (x ^ {\prime}) - f (x) | | _ {2} ^ {2}}{2 t ^ {(T (x))}} + \frac {| | f (x ^ {\prime}) - f (x) | | _ {2}}{t ^ {(T (x))}} \left\langle \frac {f (x ^ {\prime}) - f (x)}{| | f (x ^ {\prime}) - f (x) | | _ {2}}, B ^ {(t ^ {(T (x))})} \right\rangle .
$$
This decomposition of the privacy loss will be very useful in analyzing the overall privacy loss of a combination of Brownian noise reduction mechanisms. In Appendix C we provide a more general analysis than in Whitehouse et al. [2022] to show that both the Laplace noise reduction from Ligett et al. [2017] and the Brownian noise reduction Whitehouse et al. [2022] are indeed noise reduction mechanisms and give the form of the privacy loss at an adaptive stopping time.
6.1 Backward Brownian Motion Martingale
We now present a key result for our analysis of composing Brownian noise reduction mechanisms. Although in Whitehouse et al. [2022], the ex-post privacy proof of the Brownian mechanism applied Ville's inequality [for proof, cf. Howard et al., 2020, Lemma 1] to the (unscaled) standard Brownian motion  $(B^{(t)})_{t > 0}$ , it turns out that the scaled standard Brownian motion  $(B^{(t)} / t)$  forms a backward martingale [cf. Revuz and Yor, 2013, Exercise 2.16] and this fact is crucial to our analysis.
Lemma 6.1 (Backward martingale). Let  $(B^{(t)})$  be a standard Brownian motion. Define the reverse filtration  $\mathcal{G}^{(t)} = \sigma(B^{(u)}; u \geq t)$ , meaning that  $\mathcal{G}^{(s)} \supset \mathcal{G}^{(t)}$  if  $s < t$ . For every real  $\lambda$ , the process
$$
M ^ {(t)} := \exp (\lambda B ^ {(t)} / t - \lambda^ {2} / (2 t)); \quad t > 0
$$
is a nonnegative (reverse) martingale with respect to the filtration  $\mathcal{G} = (\mathcal{G}^{(t)})$ . Further, at any  $t > 0$ ,  $\mathbb{E}[M^{(t)}] = 1$ ,  $M^{(\infty)} = 1$  almost surely, and  $\mathbb{E}[M^{(\tau)}] \leq 1$  for any stopping time  $\tau$  with respect to  $\mathcal{G}$  (equality holds with some restrictions). In short,  $M^{(\tau)}$  is an "e-value" for any stopping time  $\tau$  — an e-value is a nonnegative random variable with expectation at most one.
Let  $B_{1} = (B_{1}^{(t)})_{t\geq 0}, B_{2} = (B_{2}^{(t)})_{t\geq 0}, \ldots$  be independent, standard Brownian motions, with corresponding backward martingales  $M_{1} = (M_{1}^{(t)})_{t\geq 0}, M_{2} = (M_{2}^{(t)})_{t\geq 0}, \ldots$  and (internal to each Brownian motion) filtrations  $\mathcal{G}_1 = (\mathcal{G}_1^{(t)})_{t\geq 0}, \mathcal{G}_2 = (\mathcal{G}_2^{(t)})_{t\geq 0}, \ldots$  as defined in the previous lemma. Select time values  $(t_1^{(k)})_{k\geq 1}$ . Let a Brownian noise reduction mechanism  $\mathbb{BM}_1$  be run using  $B_{1}$  and stopped at  $\tau_{1}$ . Then  $E[M_1^{(\tau_1)}] \leq 1$  as per the previous lemma. Based on outputs from the  $\mathbb{BM}_1$ , we choose time values  $(t_2^{(k)})_{k\geq 1} \in \sigma(B_1^{(t)}; t \geq \tau_1) := \mathcal{F}_1$ . Now run the second Brownian noise reduction  $\mathbb{BM}_2$  using  $B_{2}$ , stopping at time  $\tau_{2}$ . Since  $B_{1}, B_{2}$  are independent, we still have that  $\mathbb{E}[M_2^{(\tau_2)}|\mathcal{F}_1] \leq 1$ . Let  $\mathcal{F}_2 := \sigma((B_1^{(t)})_{t\geq \tau_1}, (B_2^{(t)})_{t\geq \tau_2})$  be the updated filtration, based on which we choose time values  $(t_3^{(k)})_{k\geq 1}$ . Because  $B_{3}$  is independent of the earlier two, at the next step, we still have  $\mathbb{E}[M_3^{(\tau_3)}|\mathcal{F}_2] \leq 1$ . Proceeding in this fashion, it is clear that the product of the stopped e-values  $E_m$ , where
$$
E _ {m} := \prod_ {s = 1} ^ {m} M _ {s} ^ {\left(\tau_ {s}\right)} = \exp \left(\lambda \sum_ {s = 1} ^ {m} \frac {B _ {s} ^ {\left(\tau_ {s}\right)}}{\tau_ {s}} - \frac {\lambda^ {2}}{2} \sum_ {s = 1} ^ {m} \frac {1}{\tau_ {s}}\right), \tag {1}
$$
is itself a (forward) nonnegative supermartingale with respect to the filtration  $\mathcal{F} = (\mathcal{F}_n)_{n\geq 1}$ , with initial value  $E_0\coloneqq 1$ . Applying the Gaussian mixture method [cf. Howard et al., 2021, Proposition 5], we get that for any  $\gamma ,\delta >0$  and with  $\psi (t;\gamma ,\delta)\coloneqq \sqrt{(t + \gamma)\log\left(\frac{t + \gamma}{\delta^2\gamma}\right)}$
$$
\Pr \left[ \sup  _ {m \geq 1} \left\{\left| \sum_ {s = 1} ^ {m} \frac {B _ {s} ^ {\left(\tau_ {s}\right)}}{\tau_ {s}} \right| \geq \sum_ {s \in [ m ]} \frac {1}{2 \tau_ {s}} + \psi \left(\sum_ {s \in [ m ]} 1 / \tau_ {s}; \gamma , \delta\right) \right\} \right] \leq \delta .
$$
This then provides an alternate way to prove Theorem 3.6 in Whitehouse et al. [2022].
Theorem 4. Let  $(T_{i})_{i\geq 1}$  be a sequence of stopping functions, as in Definition 4.3, and a sequence of time values  $(t_i^{(j)}:j\in [k_i])_{i\geq 1}$ . Let  $BM_{i}$  denote a Brownian noise reduction with statistic  $f_{i}$  that can be adaptively selected based on outcomes of previous Brownian noise reductions and  $f_{i}$  has  $\ell_2$ -sensitivity 1. We then have, for any  $\gamma ,\delta >0$
$$
\sup  _ {x \sim x ^ {\prime}} \Pr \left[ \sum_ {i = 1} ^ {\infty} \mathcal {L} _ {B M _ {i}} ^ {(T _ {i} (x))} \geq \psi \left(\sum_ {i = 1} ^ {\infty} 1 / t _ {i} ^ {(T _ {i} (x))}; \gamma , \delta\right) \right] \leq \delta .
$$
In other words,  $\left(BM_i^{(1:T_i(\cdot))}\right)_{i\geq 1}$  is  $\left(\psi \left(\sum_{i = 1}^{\infty}1 / t_i^{(T_i(\cdot))};\gamma ,\delta\right),\delta\right)$ -ex post private.
6.2 Privacy Filters with Brownian Noise Reduction Mechanisms
Given Lemma 6.1 and the decomposition of the privacy loss for the Brownian mechanism given in Theorem 3, we will be able to get tighter composition bounds of multiple Brownian noise reduction mechanisms rather than resorting to the general ex-post privacy composition (see Lemma B.2 in the appendix). It will be important to only use time values with the Brownian noise reduction mechanisms that cannot exceed the remaining privacy loss budget. We then make the following condition on the time values  $(t_n^{(j)})_{j = 1}^{k_n}$  that are used for each Brownian noise reduction given prior outcomes  $y_{1},\dots ,y_{n - 1}$  from the earlier Brownian noise reductions with time values  $(t_i^{(j)})_{j = 1}^{k_i}$  and stopping functions  $T_{i}$  for  $i < n$  and overall budget  $\rho >0$
$$
\frac {1}{2 t _ {n} ^ {\left(k _ {n}\right)}} \leq \rho - \sum_ {i <   n} \frac {1}{2 t _ {i} ^ {\left(T _ {i} \left(y _ {1 : i}\right)\right)}}. \tag {2}
$$
Lemma 6.2. Let  $\rho >0$  and consider a sequence of  $(BM_{n})_{n\geq 1}$  each with statistic  $f_{n}:\mathcal{X}\to \mathbb{R}^{d_{n}}$  with  $\ell_2$  sensitivity 1, stopping function  $T_{n}$ , and time values  $(t_n^{(j)})_{j = 1}^{k_n}$  which can be adaptively selected and satisfies (2). Consider the function  $N:\mathcal{V}^{\infty}\rightarrow \mathbb{N}\cup \{\infty \}$  where  $\mathcal{V}$  contains all possible outcome streams from  $(BM_{n})_{n\geq 1}$  as the following for any sequence of outcomes  $(y_{n})_{n\geq 1}$ :
$$
N \left(\left(y _ {n}\right) _ {n \geq 1}\right) = \inf  \left\{n: \rho = \sum_ {i \in [ n ]} \frac {1}{2 t _ {i} ^ {\left(T _ {i} \left(y _ {1 : i}\right)\right)}} \right\}.
$$
Then, for  $\delta > 0$ ,  $BM_{1:N(\cdot)}(\cdot)$  is  $(\rho + 2\sqrt{\rho \log(1 / \delta)}, \delta)$ -DP, where  $N(x) = N((BM_n(x))_{n \geq 1})$ .
One approach to defining a privacy filter for both approximate zCDP and Brownian noise reduction mechanisms would be to use concurrent composition, as we did in Lemma B.2 in the appendix. However, this would require us to set separate privacy budgets for approximate zCDP mechanisms and Brownian noise reduction, which is an extra (nuissance) parameter to set.
We now show how we can combine Brownian noise reduction and approximate zCDP mechanisms with a single privacy budget. We will need a similar condition on the time values selected at each round for the Brownian noise reduction mechanisms as in (2). Note that at each round either an approximate zCDP or Brownian noise reduction mechanism will be selected. Given prior outcomes  $y_{1}, \dots, y_{n-1}$  and previously selected zCDP parameters  $\rho_{1}, \rho_{2}(y_{1}), \dots, \rho_{n}(y_{1:n-1})$  — noting that at round  $n$  where BM is selected we have  $\rho_{n}(y_{1:n-1}) = 0$  or if a zCDP mechanism is selected we simply set  $k_{n} = 1$  and  $\frac{1}{t_{n}^{(1)}} = 0$  — we have the following condition on  $\rho_{n}(y_{1:n-1})$  and the time values  $(t_{n}^{(j)})_{j=1}^{k_{n}}$  if we select a BM at round  $n$  and have overall budget  $\rho > 0$ ,
$$
0 \leq \frac {1}{2 t _ {n} ^ {\left(k _ {n}\right)}} + \rho_ {n} \left(y _ {1: n - 1}\right) \leq \rho - \sum_ {i <   n} \left(\rho_ {i} \left(y _ {1: i - 1}\right) + \frac {1}{2 t _ {i} ^ {\left(T _ {i} \left(y _ {1 : i}\right)\right)}}\right). \tag {3}
$$
Theorem 5. Let  $\rho >0$  and  $\delta \geq 0$ . Let  $(A_{n})_{n\geq 1}$  be a sequence of approximate zCDP and ex-post private mechanisms where each ex-post private mechanism at round  $n$  is a Brownian Mechanism with an adaptively chosen stopping function  $T_{n}$ , a statistic  $f_{n}$  with  $\ell_2$ -sensitivity equal to 1, and time values  $(t_n^{(j)})_{j = 1}^{k_n}$  that satisfy the condition in (3). Consider the function  $N:\mathcal{Y}^{\infty}\to \mathbb{N}$  as the
following for any sequence of outcomes  $(y_{n})_{n\geq 1}$  ..
$$
N \left(\left(y _ {n}\right) _ {n \geq 1}\right) = \inf  \left\{n: \delta <   \sum_ {i \in [ n + 1 ]} \delta_ {i} \left(y _ {1: i - 1}\right) o r \rho = \sum_ {i \in [ n ]} \left(\rho_ {i} \left(y _ {1: i - 1}\right) + \frac {1}{2 t _ {i} ^ {\left(T _ {i} \left(y _ {1 : i}\right)\right)}}\right) \right\}.
$$
Then for  $\delta'' > 0$ , the algorithm  $A_{1:N(\cdot)}(\cdot)$  is  $(\rho + 2\sqrt{2\rho\log(1 / \delta'')}, \delta + \delta'')$ -DP, where the stopping function is  $N(x) = N((A_n(x))_{n \geq 1})$ .
7 Application: Bounding Relative Error
Our motivating application will be returning as many counts as possible subject to each count being within  $\alpha \%$  relative error, i.e. if  $y$  is the true count and  $\hat{y}$  is the noisy count, we require  $||\hat{y} / y| - 1| < \alpha$ . It is common for practitioners to be able to tolerate some relative error to some statistics and would like to not be shown counts that are outside a certain accuracy. Typically, DP requires adding a predetermined standard deviation to counts, but it would be advantageous to be able to add large noise to large counts so that more counts could be returned subject to an overall privacy budget.
7.1 Doubling Method
A simple baseline approach would be to use the "doubling method", as presented in Ligett et al. [2017]. This approach uses differentially private mechanisms and checks whether each outcome satisfies some condition, in which case you stop, or the analyst continues with a larger privacy loss parameter. The downside of this approach is that the analyst needs to pay for the accrued privacy loss of all the rejected values. However, handling composition in this case turns out to be straightforward given Theorem 1, due to Whitehouse et al. [2023]. We then compare the 'doubling method' against using Brownian noise reduction and applying Theorem 5.
We now present the doubling method formally. We take privacy loss parameters  $\varepsilon^{(1)} < \varepsilon^{(2)} < \dots$ , where  $\varepsilon^{(i+1)} = \sqrt{2}\varepsilon^{(i)}$ . Similar to the argument in Claim B.1 in Ligett et al. [2017], we use the  $\sqrt{2}$  factor because the privacy loss will depend on the sum of square of privacy loss parameters, i.e.  $\sum_{i=1}^{m}(\varepsilon^{(i)})^2$  up to some iterate  $m$ , in Theorem 1 as  $\rho_i = (\varepsilon^{(i)})^2/2$  is the zCDP parameter. This means that if  $\varepsilon^{\star}$  is the privacy loss parameter that the algorithm would have halted at, then we might overshoot it by  $\sqrt{2}\varepsilon^{\star}$ . Further, the overall sum of square privacy losses will be no more than  $4(\varepsilon^{\star})^2$ . Hence, we refer to the doubling method as doubling the square of the privacy loss parameter.
7.2 Experiments
We perform experiments to return as many results subject to a relative error tolerance  $\alpha$  and a privacy budget  $\varepsilon, \delta > 0$ . We will generate synthetic data from a Zipf distribution, i.e. from a density  $f(k) \propto k^{-a}$  for  $a > 0$  and  $k \in \mathbb{N}$ . We will set a max value of the distribution to be 300 and  $a = 0.75$ . We will assume that a user can modify each count by at most 1, so that the  $\ell_0$ -sensitivity is 300 and  $\ell_{\infty}$ -sensitivity is 1. See Figure 3 in Appendix B for the data distribution we used.
In our experiments, we will want to first find the top count and then try to add the least amount of noise to it, while still achieving the target relative error, which we set to be  $\alpha = 10\%$ . To find the top count, we apply the Exponential Mechanism [McSherry and Talwar, 2007] by adding Gumbel noise with scale  $1 / \varepsilon_{\mathrm{EM}}$  to each sensitivity 1 count (all 300 elements' counts, even if they are zero in the data) and take the element with the top noisy count. From Cesar and Rogers [2021], we know that the Exponential Mechanism with parameter  $\varepsilon_{\mathrm{EM}}$  is  $\varepsilon_{\mathrm{EM}}^2 /8$ -zCDP, which we will use in our composition bounds. For the Exponential Mechanism, we select a fixed parameter  $\varepsilon_{\mathrm{EM}} = 0.1$ .
After we have selected a top element via the Exponential Mechanism, we then need to add some noise to it in order to return its count. Whether we use the doubling method and apply Theorem 1 for composition or the Brownian noise reduction mechanism and apply Theorem 5 for composition, we need a stopping condition. Note that we cannot use the true count to determine when to stop, but we can use the noisy count and the privacy loss parameter that was used. Hence we use the following condition based on the noisy count  $\hat{y}$  and the corresponding privacy loss parameter  $\varepsilon^{(i)}$  at iterate  $i$ :
$$
1 - \alpha <   \left| (\hat {y} + 1 / \varepsilon^ {(i)}) / (\hat {y} - 1 / \varepsilon^ {(i)}) \right| \leq 1 + \alpha \quad \text {a n d} \quad | \hat {y} | > 1 / \varepsilon^ {(i)}.
$$
Note that for Brownian noise reduction mechanism at round  $n$ , we use time values  $t_n^{(i)} = 1 / (\varepsilon_n^{(i)})^2$ . We also set an overall privacy budget of  $(\varepsilon, \delta'') = (10, 10^{-6})$ . To determine when to stop, we will simply consider the sum of squared privacy parameters and stop if it is more than roughly 2.705, which corresponds to the overall privacy budget of  $\varepsilon = 10$  with  $\delta'' = 10^{-6}$ . If the noisy value from the largest privacy loss parameter does not satisfy the condition above, we discard the result.
We pick the smallest privacy parameter squared to be  $(\varepsilon_{n}^{(1)})^{2} = 0.0001$  for each  $n$  in both the noise reduction and the doubling method and the largest value will change as we update the remaining sum of square privacy loss terms that have been used. We then set 1000 equally spaced parameters in noise reduction to select between 0.0001 and the largest value for the square of the privacy loss parameter. We then vary the sample size of the data in  $\{8000, 16000, 32000, 64000, 128000\}$  and see how many results are returned and of those returned, how many satisfy the actual relative error, which we refer to as precision. Note that if 0 results are returned, then we consider the precision to be 1. Our results are given in Figure 2 where we give the empirical average and standard deviation over 1000 trials for each sample size.
Figure 2: Precision and number of results returned on Zipfian data for various sample sizes.
We also evaluated our approach on real data from Reddit comments from https://github.com/heyyjudes/differentially-private-set-union/tree/ea7b39285dace35cc9e9029692802759f3e1c8e8/data. This data consists of comments from Reddit authors. To find the most frequent words from distinct authors, we take the set of all distinct words contributed by each author, which can be arbitrarily large and form the resulting histogram which has  $\ell_{\infty}$ -sensitivity 1 yet unbounded  $\ell_{2}$ -sensitivity. To get a domain of words to select from, we take the top-1000 words from this histogram. We note that this step should also be done with DP, but will not impact the relative performance between using the Brownian noise reduction and the Doubling Gaussian Method.
We then follow the same approach as on the synthetic data, using the Exponential Mechanism with  $\varepsilon_{\mathrm{EM}} = 0.01$ , minimum privacy parameter  $\varepsilon_n^{(1)} = 0.0001$ , relative error  $\alpha = 0.01$ , and overall  $(\varepsilon = 1, \delta = 10^{-6})$ -DP guarantee. In 1000 trials, the Brownian noise reduction precision (proportion of results that had noisy counts within  $1\%$  of the true count) was on average  $97\%$  (with minimum  $92\%$ ) while the Doubling Gaussian Method precision was on average  $98\%$  (with minimum  $93\%$ ). Furthermore, the number of results returned by the Brownian noise reduction in 1000 trials was on average 152 (with minimum 151), while the number of results returned by the Doubling Gaussian method was on average 109 (with minimum 108).
We have presented a way to combine approximate zCDP mechanisms and ex-post private mechanisms while achieving an overall differential privacy guarantee, allowing for more general and flexible types of interactions between an analyst and a sensitive dataset. Furthermore, we showed how this type of composition can be used to provide overall privacy guarantees subject to outcomes satisfying strict accuracy requirements, like relative error. We hope that this will help extend the practicality of private data analysis by allowing the release of counts with relative error bounds subject to an overall privacy bound.
9 Acknowledgements
We would like to thank Adrian Rivera Cardoso and Saikrishna Badrinarayanan for helpful comments. This work was done while G.S. was a visiting scholar at LinkedIn. ZSW was supported in part by the NSF awards 2120667 and 2232693 and a Cisco Research Grant.