SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Generalization by differential privacy The generalization guarantee of differential privacy arises from adaptive data analysis. Existing research [28, 31, 32] has shown that any mechanism for answering adaptively chosen queries that is differentially private and sample-accurate is also accurate out-of-sample.
Definition 2 (Accuracy).  $\mathcal{M}$  satisfies  $(\alpha, \beta)$ -sample accuracy for adversary  $\mathcal{A}$  and distribution  $\mathcal{P}$  iff
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max  _ {t} | a _ {t} - q _ {t} (S) | \geq \alpha \right] \leq \beta ,
$$
where  $a_{t}$  is the output of  $\mathcal{M}$  and  $q_{t}$  is the query given by  $\mathcal{A}$  at time  $t$ .  $\mathcal{M}$  satisfies  $(\alpha, \beta)$ -distributional accuracy iff
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max  _ {t} | a _ {t} - q _ {t} (\mathcal {P} ^ {m}) | \geq \alpha \right] \leq \beta .
$$
Recently, Jung et al. [32] discovered a simplified analysis of the generalization theorem by introducing the posterior data distribution  $\mathcal{Q}_{\pi}$  as the key object of interest. Through a natural resampling lemma, they showed that a sample-accurate mechanism is also accurate with respect to  $\mathcal{Q}_{\pi}$ .
Lemma 2 ([32]). Suppose that  $\mathcal{M}$  is  $(\alpha, \beta)$ -sample accurate. Then for every  $c > 0$  it also satisfies:
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max  _ {t} | a _ {t} - q _ {t} \left(\mathcal {Q} _ {\Pi}\right) | > \alpha + c \right] \leq \frac {\beta}{c}.
$$
Thus, to achieve distributional accuracy, it suffices to prove the closeness between  $\mathcal{Q}_{\pi}$  and  $\mathcal{P}^m$ . Then they showed that this can be guaranteed by differential privacy.
Lemma 3 ([32]). If  $\mathcal{M}$  is  $(\varepsilon, \delta)$ -differentially private, then for any data distribution  $\mathcal{P}$ , any analyst  $\mathcal{A}$ , and any constant  $c > 0$ :
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max  _ {t} | q _ {t} (\mathcal {P} ^ {m}) - q _ {t} \left(\mathcal {Q} _ {\Pi}\right) | > (e ^ {\varepsilon} - 1) + 2 c \right] \leq \frac {\delta}{c}.
$$
3 Partial Differential Privacy and Its Generalization Property
In the definition of partial DP, we specify the set of data whose privacy is leaked via a mapping  $f_{L}:\Pi \to 2^{[m]}$ . Given a transcript  $\pi$ , partial DP guarantees privacy only on  $S\setminus f_L(\pi)$ . Intuitively, this means that the transcripts on two database  $S,S^{\prime}$  that differs only on a position  $i\in S\setminus f_{L}(\pi)$  have similar distributions. However,  $\pi$  is not known in advance, which causes trouble to this direct definition. We remedy this by first fixing  $i$ ; then we only consider  $S,S^{\prime}$  that differs only on  $i$  and only those events  $E$  whose elements do not contain  $i$  in their privacy leaked set.
Definition 3 (Partial Differential Privacy).  $\mathcal{M}$  is  $(\varepsilon, \delta, \kappa)$ -partial differentialally private, if there exists a privacy leak mapping  $f_{L}:\Pi \to 2^{[m]}$  with  $\max_{\pi}|f_L(\pi)|\leq \kappa$ , the following holds: for any  $\mathcal{A}$ , any  $i$ , any  $S,S^{\prime}\in \mathcal{X}^{m}$  that differs only on the  $i$ th position, and any  $E\subseteq \Pi$  such that  $i\notin \bigcup_{\pi \in E}f_L(\pi)$ ,
A generalization theorem for partial DP is presented below. Generalization for linear queries suffices for our application, but this can be extended to general low-sensitivity queries.
Theorem 3. For linear queries, if  $\mathcal{M}$  satisfies  $(\varepsilon, \delta, \kappa)$  partial differential privacy and  $\mathcal{M}$  is  $(\alpha, \beta)$ -sample accurate, then for any data distribution  $\mathcal{P}$ , any adversary  $\mathcal{A}$ , and any constant  $c, d > 0$ :
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max _ {t} | a _ {t} - q _ {t} (\mathcal {P} ^ {m}) | > \alpha + (e ^ {\varepsilon} - 1) + \frac {2 \kappa}{m} + c + 2 d \right] \leq \frac {\delta}{d} + \frac {\beta}{c}.
$$
Compared with existing results, it has an extra term  $\frac{\kappa}{m}$  in the error. This is intuitive, as the privacy leaked set contributes at most  $\frac{\kappa}{m}$  error in the worst case. Following [32], it suffices to establish the low discrepancy between  $\mathcal{Q}_{\pi}$  and  $\mathcal{P}^m$ . To this end, we prove the following key lemma in the appendix.
Lemma 4. If  $\mathcal{M}$  satisfies  $(\varepsilon, \delta, \kappa)$  partial differential privacy, then for any data distribution  $\mathcal{P}$ , any adversary  $\mathcal{A}$ , and any constant  $c > 0$ :
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max _ {t} | q _ {t} (\mathcal {Q} _ {\pi}) - q _ {t} (\mathcal {P} ^ {m}) | > (e ^ {\varepsilon} - 1) + \frac {2 \kappa}{m} + 2 c \right] \leq \frac {\delta}{c}.
$$
The query function of interest in this paper only depends on  $\hat{m}$  data points, with  $\hat{m} \ll m$ , at each time step. For such queries, we expect the total error to be proportional to  $\hat{m}$  rather than  $m$ , which is formalized in the following refinement of Theorem 3, the proof of which requires only a slight modification and is included in the appendix.
Theorem 4. For linear queries, if  $\mathcal{M}$  satisfies  $(\varepsilon, \delta, \kappa)$  partial differential privacy and  $\mathcal{M}$  is  $(\alpha, \beta)$ -sample accurate. Further, if each linear query depends on at most  $\hat{m}$  data points, then for any data distribution  $\mathcal{P}$ , any adversary  $\mathcal{A}$ , and any constant  $c, d > 0$ :
$$
\operatorname * {P r} _ {S \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; S)} \left[ \max _ {t} | a _ {t} - q _ {t} (\mathcal {P} ^ {m}) | > \alpha + \frac {\hat {m}}{m} (e ^ {\varepsilon} - 1 + c) + \frac {2 \kappa}{m} + 2 d \right] \leq \frac {\delta}{d} + \frac {\beta}{c}.
$$
4 Robust Distributed Count Tracking Algorithm
Our algorithm has multiple rounds. In each round,  $N$  increases roughly by a factor of  $1 + \sqrt{k}\alpha$ . After a round ends, the true count is computed and sent to all sites, and then, the algorithm is reinitialized with fresh randomness. Thus, we only focus on one round, and let  $N_0$  be the true count at the
beginning of the round. In the algorithm,  $C = \sqrt{\left(\left(\log\sqrt{k}\right)^{1.5} + 1\right)\cdot\log\left(\frac{8\sqrt{k}}{\beta}\right)}$  and  $\Delta = \frac{\alpha N_0}{8C\sqrt{k}}$ .
The algorithm on site  $i$  is presented in Algorithm 1. The site divides its own stream into blocks of size  $\Delta$ , and exactly one bit will be sent to the server in each block. The actual time of sending the bit is determined by a random threshold  $r_{ij}$ . Let  $N_{t,i}$  be the number of items received on site  $i$  from the beginning of the current round until time  $t$ . Let  $d_{t,i} = \lfloor N_{t,i} / \Delta \rfloor$  and  $e_{t,i} = N_{t,i} \mod \Delta$ . Thus,  $j = d_{t,i} + 1$  is the index of the current active block, and  $e_{t,i}$  is the offset in this block. As per Algorithm 1, the number of bits sent by site  $i$  up to time  $t$  is  $B_{t,i} = d_{t,i} + 1[r_{i,j} < e_{t,i}] \leq d_{t,i} + 1$ . Since  $r_{i,j} \sim \mathsf{Uni}(0,\Delta)$ ,  $\mathsf{E}[B_{t,i}] = d_{t,i} + \frac{e_{t,i}}{\Delta}$ , meaning  $\Delta \cdot B_{t,i}$  is an unbiased estimate of  $N_{t,i}$ . Let  $D \in (0,\Delta)^m$  ( $m = k \times k'$ ) be the database comprised of all sites' random numbers, i.e.,  $D_{ij} = r_{ij}$ , considering the input generated by the adversary as queries, then the query at time  $t$  can be specified as:
$$
q _ {t} (D) = \frac {1}{m} \left(\sum_ {i \in [ k ]} d _ {t, i} + \sum_ {i \in [ k ]} \mathbf {1} \left[ r _ {i, j} <   e _ {t, i} \right]\right) = \frac {B _ {t}}{m}, \tag {1}
$$
where  $B_{t} = \sum_{i=1}^{k} B_{t,i}$  denotes the total number of bits received by the server at time  $t$ . The value of  $q_{t}$  at each time step depends on  $k$  random numbers corresponding to the active blocks, which is much less than the size of  $D$ , which motivates the use of Theorem 4.
Let  $\hat{B}_t$  be algorithm's estimate of  $B_t$ . Algorithm 2 consists of  $\sqrt{k}$  phases;  $\hat{B}_t$  remains constant in each phase and a new estimate  $\hat{b}_j$  is obtained at the end of the  $j$ th phase via the binary mechanism. The times that the phases end are denoted by  $H = \{t_1, t_2, \dots, t_{\sqrt{k}}\}$ , and for  $t \in [t_j, t_{j+1})$ , we have  $\hat{B}_t = \hat{b}_j$ . Therefore, the transcript generated by  $\mathcal{M}$  and  $\mathcal{A}$  is of the form  $((\perp, 0), (\perp, 0), \dots, (\top, \hat{b}_1), (\perp, \hat{b}_1), \dots, (\top, \hat{b}_{\sqrt{k}}))$ . We note, in addition to noise in BM, the only noise added for the purpose of DP is the Laplace random variable added on  $T$ , and an independent noise is used in each phase.
4.1 Privacy Analysis
In this section, we analyze the privacy of  $\mathcal{M}$  for a single round, demonstrating that it satisfies  $(\epsilon, 0, \sqrt{k})$ -partial differential privacy with respect to the random numbers  $D$  used by all sites. To achieve this, we first provide the privacy leak mapping. Note that each time the output of  $\mathcal{M}$  updates, i.e., reporting  $\top$ ,  $\mathcal{A}$  knows the site  $i$  it just accessed has sent a bit to the server. Then the active random
Algorithm 1: Site  $i$  for a round
Input: Accuracy parameter  $\alpha$ , failure probability  $\beta$
Initialize:  $k' = Ck$ . Generate  $k'$  i.i.d random number  $\{r_{i1}, r_{i2}, \dots, r_{ik'}\}$  from the uniform distribution on  $[\Delta]$ . Initialize  $c_i = 0$  to count the number of received items.
When site  $i$  receives an item:
$c_{i}\gets c_{i} + 1$ $j\gets \lfloor \frac{c_i}{\Delta}\rfloor +1$ $c_{ij}\gets c_i\bmod \Delta$    
if  $j > k^{\prime}$  then Send a signal to the server to end current round.  
 $c_{ij}\gets c_i\bmod \Delta$    
if  $c_{ij} > r_{ij}$  for the first time then Send a bit to the server.
Algorithm 2: Server
Input: Accuracy parameter  $\alpha$ , failure probability  $\beta$
When receiving a bit from some site:
Initialize: Set  $\varepsilon = C / \sqrt{k}$ ,  $T = 2C\sqrt{k}$ ,  $\hat{T} = T + \mathsf{Lap}(\frac{4}{\varepsilon})$ ,  $j = 1$ ,  $a_0 = N_0$ . Initialize  $\sqrt{k}$  counters  $\{c_1, c_2, \dots, c_{\sqrt{k}}\}$  to 0. Start a Binary Mechanism instance denoted as BM with  $L = \sqrt{k}$  and  $\frac{\varepsilon}{4}$  as privacy parameter.
$c_{j}\gets c_{j} + 1 / \star c_{j}$  counts the number of bits in the  $j$  -th phase.  $\star /$  if  $c_{j} <   \hat{T}$  then Output  $(\bot ,a_{j - 1})$    
else  $\begin{array}{rl} & {\hat{b}_j\leftarrow \mathsf{BM}(c_j) / \star \text{feeding} c_j\text{as the} j\text{-th input to BM}.}\\ & {a_j\leftarrow \hat{b}_j\cdot \Delta +N_0}\\ & {\mathrm{Output}(\top ,a_j)}\\ & {\mathrm{if}j > \sqrt{k}\mathrm{then}}\\ & {\mathrm{Notify~all~sites~to~end~the~current~round,~collect~all~local~counters,~calculate~the~total}}\\ & {\mathrm{count,~broadcast~it~to~all~sites,~and~start~the~next~round.}}\\ & {j\leftarrow j + 1}\\ & {\hat{T}\leftarrow T + \mathrm{Lap}(\frac{4}{\varepsilon})} \end{array}$
number  $r_{ij}$  at this moment is exposed, which means there is no meaningful privacy guarantee<sup>4</sup>. Therefore, we need to relax the DP constraint. Given a transcript  $\pi$ , the privacy leaked set consists of those  $r_{ij}$  that are exposed during the execution.
Definition 4 (Privacy Leaked Set). For a given transcript  $\pi$ , let  $A$  be the set of time steps when output updates, i.e.  $A = \{t \mid \pi_t = (\top, \cdot)\}$  where  $\pi_t$  is the output at time  $t$ . Let  $i_t$  be the site  $\mathcal{A}$  chooses at time  $t$ . Then,  $f_L(\pi) = \{(i_t, j_t) \mid t \in A(\pi), j_t = \lfloor N_{t,i_t} / \Delta \rfloor + 1\}$ .
Since there is one data point exposed in each phase,  $\kappa \leq \sqrt{k}$ . The privacy guarantee with this privacy leak mapping is presented below.
Lemma 5. For any two neighboring databases  $D \sim D'$  that differ only on  $(i,j)$ , any transcript  $\pi$  satisfying  $(i,j) \notin f_L(\pi)$ , our mechanism (Algorithm 1 and 2) satisfies the following inequality,
$$
e ^ {- \varepsilon} \cdot \operatorname * {P r} _ {\Pi \sim I (\mathcal {M}, \mathcal {A}; D ^ {\prime})} \left[ \Pi = \pi \right] \leq \operatorname * {P r} _ {\Pi \sim I (\mathcal {M}, \mathcal {A}; D)} \left[ \Pi = \pi \right] \leq e ^ {\varepsilon} \cdot \operatorname * {P r} _ {\Pi \sim I (\mathcal {M}, \mathcal {A}; D ^ {\prime})} \left[ \Pi = \pi \right],
$$
i.e., it satisfies  $(\varepsilon, 0, \sqrt{k})$ -partial differential privacy.
1   
2   
3   
4   
5   
6   
7   
8   
9
1   
2   
3   
4   
5   
6   
7   
8   
9   
10   
11   
12
Note approximate DP is also not satisfied, since the indices  $i,j$  are not random and can be manipulated by the adversary.
4.2 Accuracy and Communication
Observe that the size of  $D$  is  $m = k \times k'$ , and each query  $q_{t}$  depends only on  $\hat{m} = k$  of them. In the algorithm  $q_{t}(D)$  is estimated by  $\hat{B}_{t} / m$ . Suppose it is  $(\alpha, \beta)$ -sample accurate, then by Lemma 5 and Theorem 4, we have
$$
\operatorname * {P r} _ {D \sim \mathcal {P} ^ {m}, \Pi \sim I (\mathcal {M}, \mathcal {A}; D)} \left[ \max _ {t} \left| \frac {\hat {B} _ {t}}{m} - q _ {t} (\mathcal {P} ^ {m}) \right| > \alpha + \frac {k}{m} (e ^ {\varepsilon} - 1 + c) + \frac {2 \sqrt {k}}{m} \right] \leq \frac {\beta}{c}.
$$
Note that  $\varepsilon = C / \sqrt{k}$ . By setting  $c = 1 / \sqrt{k}$ , we get the following lemma.
Lemma 6. For query function  $q_{t}$  defined in equation (1), if our mechanism  $\mathcal{M}$  is  $(\alpha, \beta)$ -sample accurate for  $q_{t}$ , it is  $\left(\frac{4C\sqrt{k}}{m} + \alpha, \sqrt{k}\beta\right)$ -distributional accurate.
By Theorem 2, with probability  $1 - \frac{\beta}{2}$ , for all  $t_j \in H$ , we have that:
$$
\left| \hat {B} _ {t _ {j}} - B _ {t _ {j}} \right| \leq \frac {1}{\varepsilon} \cdot \left(\log \sqrt {k}\right) ^ {1. 5} \cdot \log \left(\frac {2 \sqrt {k}}{\beta}\right) \leq C \sqrt {k}, \tag {2}
$$
where the second inequality is from  $\varepsilon = C / \sqrt{k}$  and the definition of  $C$ . Denote the Laplace variables used in Algorithm 2 as  $\{\sigma_1, \dots, \sigma_{\sqrt{k}}\}$ . By the union bound, with probability  $1 - \frac{\beta}{2}$ ,  $|\sigma_j| \leq \frac{\log(4\sqrt{k} / \beta)}{\varepsilon}$  for all  $j \in [\sqrt{k}]$ . Consider the  $(j + 1)$ th phase. For every time step  $t \in (t_j, t_{j + 1})$ , since  $B_t - B_{t_j} \leq T + \sigma_{j + 1} \leq 2C\sqrt{k} + \frac{\log(4\sqrt{k} / \beta)}{\varepsilon}$  and  $\hat{B}_t = \hat{B}_{t_j}$ , we have
$$
\left| \hat {B} _ {t} - B _ {t} \right| = \left| \hat {B} _ {t _ {j}} - B _ {t} \right| = \left| \hat {B} _ {t _ {j}} - B _ {t _ {j}} + B _ {t _ {j}} - B _ {t} \right| \leq 3 C \sqrt {k} + \frac {\log (4 \sqrt {k} / \beta)}{\varepsilon} \leq 4 C \sqrt {k}. \tag {3}
$$
Then  $\hat{B}_t / m$  is  $(4C\sqrt{k} /m,\beta)$ -sample accurate with respect to  $q_{t}(D)$ . By Lemma 6, it follows that  $\hat{B}_t / m$  is  $(8C\sqrt{k} /m,\sqrt{k}\beta)$ -accurate w.r.t.  $\mathsf{E}_{D\sim \mathcal{P}^m}[q_t(D)] = N_t / m\Delta$ . We establish the following lemma of the accuracy guarantee.
Lemma 7. With probability  $1 - \sqrt{k}\beta$ , for all  $t$  in a round starting from  $N_0$ , we have  $|\Delta \cdot \hat{B}_t + N_0 - (N_t + N_0)| \leq 8C\sqrt{k} \cdot \Delta = \alpha N_0$ .
For the Communication complexity, in one round, the total number of received bits by the server is  $c_{1} + c_{2} + \ldots + c_{\sqrt{k}}$ . By analysis above, with probability  $1 - \beta / 2$ , for all  $j \in [\sqrt{k}]$ , we have
$$
\sum_ {j = 1} ^ {\sqrt {k}} c _ {j} \leq \sum_ {j = 1} ^ {\sqrt {k}} \left(\hat {T} _ {j} + 1\right) \leq \sum_ {j = 1} ^ {\sqrt {k}} \left(T + | \sigma_ {j} | + 1\right) \leq \sum_ {j = 1} ^ {\sqrt {k}} 2 C \cdot \sqrt {k} = 2 C k, \tag {4}
$$
$$
\sum_ {j = 1} ^ {\sqrt {k}} c _ {j} \geq \sum_ {j = 1} ^ {\sqrt {k}} \hat {T} \geq \sum_ {j = 1} ^ {\sqrt {k}} \left(T - \left| \sigma_ {j} \right|\right) \geq \sum_ {j = 1} ^ {\sqrt {k}} C \sqrt {k} \geq C k. \tag {5}
$$
Therefore, in one round, the communication cost is upper bounded by  $O(Ck)$ . By (5), there are at least  $Ck \cdot \Delta = \alpha N_0\sqrt{k} / 8$  items received in this round, which means  $N$  increases by an  $O(1 + \alpha \sqrt{k} / 8)$  factor after one round. It follows that there are at most  $O\left(\frac{\log N}{\alpha\sqrt{k}}\right)$  rounds. Combined this with the communication cost in one round, we can conclude the final communication complexity is  $O\left(\frac{C\sqrt{k}\log N}{\alpha}\right)$ . Now we are ready to prove Theorem 1.
Proof of Theorem 1. Since  $N_0$  is the exact count at the beginning of a round, the Lemma 7 guarantees an  $\alpha$ -relative error in the round. Since the lemma holds for any round, the correctness is established. We set the failure probability as  $\beta = \delta / (\sqrt{k} \cdot O(\frac{\log N}{\alpha \sqrt{k}}))$ . Since there are  $O(\frac{\log N}{\alpha \sqrt{k}})$  rounds, by the union bound and Lemma 7, it can be concluded that with probability  $1 - \delta$ , the output of  $\mathcal{M}$  is an  $\alpha$ -approximate to  $N$  at all times. The communication complexity is  $O(\frac{C \sqrt{k} \log N}{\alpha})^5$ .
Note that we assume that  $k \leq \frac{1}{\alpha^2}$  and thus there are at most  $O\left(\frac{\log N}{\alpha\sqrt{k}}\right)$  rounds. For  $k > \frac{1}{\alpha^2}$ , there are at most  $\log N$  rounds. The communication complexity is  $O(Ck\log N)$ . Therefore the communication complexity for all regimes of  $k$  is  $O(Ck\log N + \frac{C\sqrt{k}\log N}{\alpha})$ .
In this paper, we study the robustness of distributed count tracking to adaptive inputs. We present a new randomized algorithm that employs differential privacy to achieve robustness. Our new algorithm has near optimal communication complexity. Besides, we introduce a relaxed version of differential privacy, which allows privacy leak of some data points. Based on this definition, we prove a new generalization theorem of differential privacy, which we believe can be of independent interest and have broader applications.
This work is supported by National Natural Science Foundation of China No. U2241212, No. 62276066.
[1] M Dilman and D Raz. Efficient reactive monitoring. In Proceedings IEEE INFOCOM 2001., volume 2, pages 1012-1019. IEEE, 2001.
[2] Brian Babcock and Chris Olston. Distributed top-k monitoring. In Proceedings of the 2003 ACM SIGMOD international conference on Management of data, pages 28-39, 2003.
[3] Graham Cormode, Minos Garofalakis, Shanmugavelayutham Muthukrishnan, and Rajeev Rastogi. Holistic aggregates in a networked world: Distributed tracking of approximate quantiles. In Proceedings of the 2005 ACM SIGMOD international conference on Management of data, pages 25-36, 2005.
[4] Ram Keralapura, Graham Cormode, and Jeyashankher Ramamirtham. Communication-efficient distributed monitoring of thresholded counts. In Proceedings of the 2006 ACM SIGMOD international conference on Management of data, pages 289-300, 2006.
[5] Graham Cormode, S Muthukrishnan, and Ke Yi. Algorithms for distributed functional monitoring. In 19th Annual ACM-SIAM Symposium on Discrete Algorithms, pages 1076-1085, 2008.
[6] Ke Yi and Qin Zhang. Optimal tracking of distributed heavy hitters and quantiles. In Proceedings of the twenty-eighth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, pages 167-174, 2009.
[7] Chrisil Arackaparambil, Joshua Brody, and Amit Chakrabarti. Functional monitoring without monotonicity. In Automata, Languages and Programming: 36th International Colloquium, ICALP 2009, Rhodes, Greece, July 5-12, 2009, Proceedings, Part I 36, pages 95-106. Springer, 2009.
[8] Srikanta Tirthapura and David P Woodruff. Optimal random sampling from distributed streams revisited. In Distributed Computing: 25th International Symposium, DISC 2011, Rome, Italy, September 20-22, 2011. Proceedings 25, pages 283-297. Springer, 2011.
[9] Graham Cormode, Shanmugavelayutham Muthukrishnan, Ke Yi, and Qin Zhang. Continuous sampling from distributed streams. Journal of the ACM (JACM), 59(2):1-25, 2012.
[10] David P Woodruff and Qin Zhang. Tight bounds for distributed functional monitoring. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing, pages 941-960, 2012.
[11] Jiecao Chen and Qin Zhang. Improved algorithms for distributed entropy monitoring. Algorithmica, 78:1041-1066, 2017.
[12] Hao Wu, Junhao Gan, and Rui Zhang. Learning based distributed tracking. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2040–2050, 2020.
[29] Cynthia Dwork, Moni Naor, Toniann Pitassi, and Guy N Rothblum. Differential privacy under continual observation. In Proceedings of the forty-second ACM symposium on Theory of computing, pages 715-724, 2010.
[30] T-H Hubert Chan, Elaine Shi, and Dawn Song. Private and continual release of statistics. ACM Transactions on Information and System Security (TISSEC), 14(3):1-24, 2011.
[31] Raef Bassily, Kobbi Nissim, Adam Smith, Thomas Steinke, Uri Stemmer, and Jonathan Ullman. Algorithmic stability for adaptive data analysis. In Proceedings of the forty-eighth annual ACM symposium on Theory of Computing, pages 1046-1059, 2016.
[32] Christopher Jung and Katrina Ligett. A new analysis of differential privacy's generalization guarantees. Innovations in Theoretical Computer Science (ITCS), 2020.