SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
(*) = \sum_{j = 1}^{k}\binom {N - \mathbf{c}_{x^{\mathrm{(val)}},\tau}}{k - j}\left[\binom {\mathbf{c}_{x^{\mathrm{(val)}},\tau} - 1}{j}\frac{\mathbb{1}[y_{i} = y^{\mathrm{(val)}}]}{1 + j} +\left(\frac{1}{1 + j} -\frac{1}{j}\right)\sum_{\substack{S_{0}\subseteq \mathbb{NB}_{x^{\mathrm{(val)}},\tau}(D_{-z_{i}})\\ |S_{0}| = j}}\sum_{(x,y)\in S_{0}}\mathbb{1}[y = y^{\mathrm{(val)}}]\right]
$$
$$
\begin{array}{l} \sum_{\substack{S_{0}\subseteq \mathbb{N}B_{x(\mathrm{val}),\tau}(D - z_{i})\\ |S_{0}| = j}}\sum_{(x,y)\in S_{0}}\mathbb{1}[y = y^{\mathrm{(val)}}] = \sum_{\ell = 0}^{j}\ell \binom {\mathbf{c}_{z(\mathrm{val}),\tau}^{(+)},\tau}{\ell}\binom {\mathbf{c}_{x(\mathrm{val}),\tau} - 1 - \mathbf{c}_{z(\mathrm{val}),\tau}^{(+)}}{j - \ell} \\ = \mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} \sum_ {\ell = 1} ^ {j} \binom {\mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} - 1} {\ell - 1} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} - 1 - \mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)}} {j - \ell} \\ = \mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} - 2} {j - 1} \\ \end{array}
$$
$(*)$
$$
\begin{array}{l} = \sum_{j = 1}^{k}\binom {N - \mathbf{c}_{x^{\mathrm{(val)}},\tau}}{k - j}\left[\binom {\mathbf{c}_{x^{\mathrm{(val)}},\tau} - 1}{j}\frac{\mathbb{1}[y_{i} = y^{\mathrm{(val)}}]}{1 + j} +\mathbf{c}_{z^{\mathrm{(val)}},\tau}^{(+)}\left(\frac{1}{1 + j} -\frac{1}{j}\right)\binom {\mathbf{c}_{x^{\mathrm{(val)}},\tau} - 2}{j - 1}\right] \\ = \mathbb{1}[\mathbf{c}_{x(\text{val}),\tau}\geq 2]\mathbb{1}[y_{i} = y^{(\text{val})}]\sum_{j = 1}^{k}\binom {N - \mathbf{c}_{x(\text{val}),\tau}}{k - j}\binom {\mathbf{c}_{x(\text{val}),\tau} - 1}{j}\frac{1}{1 + j} \\ - \mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} \sum_ {j = 1} ^ {k} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k - j} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} - 2} {j - 1} \frac {1}{j (j + 1)} \\ = \mathbb {1} [ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 ] \mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ] \sum_ {j = 1} ^ {k} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k - j} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {j + 1} \frac {1}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} \\ - \mathbf {c} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} \sum_ {j = 1} ^ {k} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k - j} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {j + 1} \frac {\mathbb {1} [ \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} \geq 2 ]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)} \\ = \mathbb {1} \left[ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 \right] \left(\frac {\mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)}\right) \sum_ {j = 1} ^ {k} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k - j} \binom {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {j + 1} \\ = \mathbb {1} [ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 ] \left(\frac {\mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)}\right) \underbrace {\left[ \binom {N} {k + 1} - \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} {k + 1} - \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} {k} \right]} _ {B (k)} \\ \end{array}
$$
$$
\begin{array}{l} \phi_ {z _ {i}} \left(D _ {- z _ {i}}; v, w\right) = \frac {1}{N} \sum_ {k = 0} ^ {N - 1} w (k + 1) \left\{\mathbb {1} \left[ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 \right] \left(\frac {\mathbb {1} \left[ y _ {i} = y ^ {(\mathrm {v a l})} \right]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)}\right) B (k) \right. \\ \left. + \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k} \left[ \mathbb {1} \left[ y _ {i} = y ^ {(\mathrm {v a l})} \right] - 1 / C \right] \right\} \\ = \frac {\mathbb {1} [ \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} \geq 2 ]}{N} \left(\frac {\mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)}\right) \sum_ {k = 0} ^ {N - 1} w (k + 1) B (k) \\ + \frac {1}{N} \left[ \mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ] - 1 / C \right] \sum_ {k = 0} ^ {N - 1} w (k + 1) \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k} \\ \end{array}
$$
C.2.1 The Shapley value for TKNN (TKNN-Shapley)
Theorem 13 (Full version of TKNN-Shapley). Consider the utility function  $v_{z(\mathrm{val})}^{TKNN}$  in (3). Given a validation data point  $z^{\mathrm{(val)}} = (x^{\mathrm{(val)}}, y^{\mathrm{(val)}})$ , the Shapley value  $\phi_{z_i}^{TKNN}(v_{z(\mathrm{val})}^{TKNN})$  of each training point  $z_i = (x_i, y_i) \in D$  can be calculated as follows:
$$
\phi_ {z _ {i}} ^ {\text {T K N N}} = \left\{ \begin{array}{l l} \mathbb {1} \left[ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 \right] A _ {1} A _ {2} + \frac {\mathbb {1} \left[ y _ {i} = y ^ {(\mathrm {v a l})} \right] - 1 / C}{\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} & d \left(x _ {i}, x ^ {(\mathrm {v a l})}\right) \leq \tau \\ 0 & d \left(x _ {i}, x ^ {(\mathrm {v a l})}\right) > \tau \end{array} \right. \tag {7}
$$
$$
w h e r e A _ {1} = \frac {\mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ]}{\mathbf {c} _ {x (\mathrm {v a l}) , \tau}} - \frac {\mathbf {c} _ {z (\mathrm {v a l}) , \tau} ^ {(+)}}{\mathbf {c} _ {x (\mathrm {v a l}) , \tau} (\mathbf {c} _ {x (\mathrm {v a l}) , \tau} - 1)}, A _ {2} = \sum_ {k = 0} ^ {\mathbf {c}} \left[ \frac {1}{k + 1} - \frac {1}{k + 1} \cdot \frac {\left(\mathbf {\Delta} _ {\mathbf {c}} \mathbf {\Delta} _ {x (\mathrm {v a l}) , \tau} \mathbf {\Delta}\right)}{\left(\mathbf {\Delta} _ {\mathbf {c}} \mathbf {\Delta} _ {x (\mathrm {v a l}) , \tau} \mathbf {\Delta}\right)} \right] - 1,
$$
$$
\mathbf {c} = \mathbf {c} \left(D _ {- z _ {i}}\right) := | D _ {- z _ {i}} | \quad (s i z e o f D _ {- z _ {i}})
$$
$$
\mathbf {c} _ {x ^ {(\text {v a l})}, \tau} = \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} (D _ {- z _ {i}}) := 1 + | \mathcal {N B} _ {x ^ {(\text {v a l})}, \tau} (D _ {- z _ {i}}) | \quad (1 + \# \text {n e i g h b o r s} x ^ {(\text {v a l})} \text {i n} D _ {- z _ {i}})
$$
$$
\mathbf{c}_{z(\text{val}),\tau}^{(+)} = \mathbf{c}_{z(\text{val}),\tau}^{(+)}(D_{-z_{i}}):= \sum_{\substack{(x,y)\in NB\\ x(\text{val}),\tau}}\mathbb{1}[y = y^{(\text{val})}] \quad (\# \text{same - label neighbors in} D_{-z_{i}})
$$
and  $C$  is the number of classes for the classification task, and  $1 / C$  is the random guess accuracy.
Runtime: the computation of all  $(\phi_{z_1}^{TKNN},\ldots ,\phi_{z_N}^{TKNN})$  can be achieved in  $O(N)$  runtime in total.
Proof. For the Shapley value, we have  $w(k) = \binom{N-1}{k-1}^{-1}$ .
$$
\begin{array}{l} \sum_ {k = 0} ^ {N - 1} w (k + 1) \cdot \left( \begin{array}{c} N \\ k + 1 \end{array} \right) = \sum_ {k = 0} ^ {N - 1} \left( \begin{array}{c} N - 1 \\ k \end{array} \right) ^ {- 1} \cdot \left( \begin{array}{c} N \\ k + 1 \end{array} \right) \\ = \sum_ {k = 0} ^ {N - 1} \frac {N}{k + 1} \\ \end{array}
$$
$$
\begin{array}{l} \sum_ {k = 0} ^ {N - 1} w (k + 1) \cdot \left( \begin{array}{c} N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \\ k + 1 \end{array} \right) = \sum_ {k = 0} ^ {N - 1} \left( \begin{array}{c} N - 1 \\ k \end{array} \right) ^ {- 1} \cdot \left( \begin{array}{c} N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \\ k + 1 \end{array} \right) \\ = \sum_ {k = 0} ^ {N - 1} \frac {k ! (N - 1 - k) !}{(N - 1) !} \frac {\left(N - \mathbf {c} _ {x ^ {(\text {v a l})} , \tau}\right) !}{(k + 1) ! \left(N - \mathbf {c} _ {x ^ {(\text {v a l})} , \tau} - k - 1\right) !} \\ = \frac {\left(N - \mathbf {c} _ {x ^ {(\text {v a l})} , \tau}\right) !}{(N - 1) !} \sum_ {k = 0} ^ {N - 1} \frac {1}{k + 1} \frac {(N - 1 - k) !}{\left(N - \mathbf {c} _ {x ^ {(\text {v a l})} , \tau} - k - 1\right) !} \\ = \frac {(N - \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}) ! \mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} !}{(N - 1) !} \sum_ {k = 0} ^ {N - 1} \frac {1}{k + 1} \binom {N - 1 - k} {\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} \\ = N \binom {N} {\mathbf {c} _ {x ^ {(\text {v a l})}, \tau}} ^ {- 1} \sum_ {k = 0} ^ {N - 1} \frac {1}{k + 1} \binom {N - 1 - k} {\mathbf {c} _ {x ^ {(\text {v a l})}, \tau}} \\ \end{array}
$$
$$
\begin{array}{l} \sum_ {k = 0} ^ {N - 1} w (k + 1) \cdot \left( \begin{array}{c} N - \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} \\ k \end{array} \right) = \sum_ {k = 0} ^ {N - 1} \left( \begin{array}{c} N - 1 \\ k \end{array} \right) ^ {- 1} \cdot \left( \begin{array}{c} N - \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} \\ k \end{array} \right) \\ = \frac {(N - \mathbf {c} _ {x ^ {(\text {v a l}) , \tau}}) !}{(N - 1) !} \sum_ {k = 0} ^ {N - 1} \frac {(N - 1 - k) !}{(N - \mathbf {c} _ {x ^ {(\text {v a l}) , \tau}} - k) !} \\ = \left( \begin{array}{c} N - 1 \\ \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} - 1 \end{array} \right) ^ {- 1} \sum_ {k = 0} ^ {N - 1} \left( \begin{array}{c} N - 1 - k \\ \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} - 1 \end{array} \right) \\ = \left( \begin{array}{c} N - 1 \\ \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} - 1 \end{array} \right) ^ {- 1} \left( \begin{array}{c} N \\ \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} \end{array} \right) \\ = \frac {N}{\mathbf {c} _ {x ^ {\mathrm {(v a l)}} , \tau}} \\ \end{array}
$$
$$
\begin{array}{l} \phi_ {z _ {i}} (D _ {- z _ {i}}) \\ = \frac {\mathbb {1} \left[ \mathbf {c} _ {x ^ {(\mathrm {v a l}) , \tau}} \geq 2 \right]}{N} \left(\frac {\mathbb {1} \left[ y _ {i} = y ^ {(\mathrm {v a l})} \right]}{\mathbf {c} _ {x ^ {(\mathrm {v a l}) , \tau}}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l}) , \tau}} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l}) , \tau}} (\mathbf {c} _ {x ^ {(\mathrm {v a l}) , \tau}} - 1)}\right) \sum_ {k = 0} ^ {N - 1} \binom {N - 1} {k} ^ {- 1} B (k) \\ + \frac {1}{N} \left[ \mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ] - 1 / C \right] \sum_ {k = 0} ^ {N - 1} \binom {N - 1} {k} ^ {- 1} \binom {N - \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} {k} \\ = \mathbb {1} \left[ \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} \geq 2 \right] \left(\frac {\mathbb {1} \left[ y _ {i} = y ^ {(\mathrm {v a l})} \right]}{\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau}} - \frac {\mathbf {c} _ {z ^ {(\mathrm {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau} - 1)}\right) \left[ \sum_ {k = 0} ^ {N - 1} \left(\frac {1}{k + 1} - \frac {1}{k + 1} \frac {\binom {N - 1 - k} {\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}}}{\binom {N} {\mathbf {c} _ {x ^ {(\mathrm {v a l})} , \tau}}}\right) - 1 \right] \\ + \left[ \mathbb {1} \left[ y _ {i} = y ^ {(\text {v a l})} \right] - 1 / C \right] \frac {1}{\mathbf {c} _ {x ^ {(\text {v a l})} , \tau}} \\ = \mathbb {1} \left[ \mathbf {c} _ {x ^ {(\text {v a l})}, \tau} \geq 2 \right] \left(\frac {\mathbb {1} \left[ y _ {i} = y ^ {(\text {v a l})} \right]}{\mathbf {c} _ {x ^ {(\text {v a l})}, \tau}} - \frac {\mathbf {c} _ {z ^ {(\text {v a l})} , \tau} ^ {(+)}}{\mathbf {c} _ {x ^ {(\text {v a l})} , \tau} (\mathbf {c} _ {x ^ {(\text {v a l})} , \tau} - 1)}\right) \left[ \sum_ {k = 0} ^ {\mathbf {c}} \left(\frac {1}{k + 1} - \frac {1}{k + 1} \frac {\binom {\mathbf {c} - k} {\mathbf {c} _ {x ^ {(\text {v a l})} , \tau}}}{\binom {\mathbf {c} + 1} {\mathbf {c} _ {x ^ {(\text {v a l})} , \tau}}}\right) - 1 \right] \\ + \left[ \mathbb {1} \left[ y _ {i} = y ^ {(\text {v a l})} \right] - 1 / C \right] \frac {1}{\mathbf {c} _ {x ^ {(\text {v a l})} , \tau}} \\ \end{array}
$$
C.2.2 Efficient Computation of TKNN-Shapley
As we can see, all of the quantities that are needed to compute TKNN-Shapley value  $(\mathbf{c},\mathbf{c}_{x(\mathrm{val}),\tau},\mathbf{c}_{z(\mathrm{val}),\tau}^{(+)})$  are simply counting queries on  $D_{-z_i}$ , and hence  $\mathbf{C}_{z(\mathrm{val})}(D_{-z_i})$  can be computed in  $O(N)$  runtime for any  $z_i\in D$ . Since our goal is to release  $\phi_{z_i}^{\mathrm{TKNN}}$  for all  $z_i\in D$ , we need to compute  $\mathbf{C}_{z(\mathrm{val})}(D_{-z_i})$  for all  $z_i\in D$ . A more efficient way for this case is to first compute  $\mathbf{C}_{z(\mathrm{val})}(D)$  on the full dataset  $D$ , and then we can compute each of  $\mathbf{C}_{z(\mathrm{val})}(D_{-z_i})$  by
$$
\mathbf {c} \left(D _ {- z _ {i}}\right) = \mathbf {c} (D) - 1
$$
$$
\mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} (D _ {- z _ {i}}) = \mathbf {c} _ {x ^ {(\mathrm {v a l})}, \tau} (D) - \mathbb {1} [ z _ {i} \in \mathbb {N B} _ {x ^ {(\mathrm {v a l})}, \tau} ]
$$
$$
\mathbf {c} _ {z ^ {(\text {v a l})}, \tau} ^ {(+)} (D _ {- z _ {i}}) = \mathbf {c} _ {z ^ {(\text {v a l})}, \tau} ^ {(+)} (D) - \mathbb {1} [ z _ {i} \in \mathbb {N B} _ {x ^ {(\text {v a l})}, \tau} ] \mathbb {1} [ y _ {i} = y ^ {(\text {v a l})} ]
$$
which can be computed in  $O(1)$  runtime. Hence, we can compute TKNN-Shapley  $\phi_{z_i}^{\mathrm{TKNN}}(v_{z(\mathrm{val})}^{\mathrm{TKNN}})$  for all  $z_i \in D$  within an overall computational cost of  $O(N)$ .
D Extra Details for DP-TKNN-Shapley
D.1 Privacy Guarantee for DP-TKNN-Shapley
Theorem 14 (Restatement of Theorem 6). For any  $z^{(\mathrm{val})} \in D^{(\mathrm{val})}$ , releasing  $\widehat{\phi}_{z_i}^{TKNN}(v_{z(\mathrm{val})}^{TKNN}) := \phi_{z_i}^{TKNN}\left[\widehat{C}_{z(\mathrm{val})}(D_{-z_i})\right]$  to data owner  $i$  is  $(\varepsilon, \delta)$ -DP with  $\sigma = \sqrt{3} \cdot \sqrt{\log(1.25 / \delta)} / \varepsilon$ .
Proof. The Gaussian mechanism is known to satisfy  $(\varepsilon, \delta)$ -DP with  $\sigma = \Delta \cdot \sqrt{2 \log(1.25 / \delta)} / \varepsilon$  [16], where  $\Delta := \sup_{D \sim D'} \|f(D) - f(D')\|$  represents the global sensitivity of the underlying function  $f$  in  $\ell_2$  norm. In our case,  $f$  calculates the 3-dimensional vector  $\left[\mathbf{c}, \mathbf{c}_{x^{(\mathrm{val})},\tau}, \mathbf{c}_{z^{(\mathrm{val})},\tau}^{(+)}\right]$ . As each training data point may alter both  $\mathbf{c}_{x^{(\mathrm{val})},\tau}$  and  $\mathbf{c}_{z^{(\mathrm{val})},\tau}^{(+)}$  by 1, the sensitivity  $\Delta$  is  $\sqrt{3}$ . Since both  $\widehat{\mathbf{c}}_{x^{(\mathrm{val})},\tau}$  and  $\widehat{\mathbf{c}}_{z^{(\mathrm{val})},\tau}^{(+)}$  are privatized using the Gaussian mechanism, the privacy guarantee of  $\widehat{\phi}_{z_i}$  is ensured by the post-processing property of differential privacy.
D.2 Advantages of DP-TKNN-Shapley
D.2.1 Computational Efficiency via Reusing Privatized Statistics
Recall that in practical data valuation scenarios, it is often desirable to compute the data value scores for all of  $z_{i} \in D$ . As we detailed in Section 4.2 and Appendix C.2.2, for TKNN-Shapley, such a computation only requires  $O(N)$  runtime in total if we first compute  $\mathbf{C}_{z(\mathrm{val})}(D)$  and subsequently  $\mathbf{C}_{z(\mathrm{val})}(D_{-z_i})$  for each  $z_{i} \in D$ . In a similar vein, we can efficiently compute the DP variant  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}$  for all  $z_{i} \in D$ . To do so, we first calculate  $\widehat{\mathbf{C}}_{z(\mathrm{val})}(D)$  and then, for each  $z_{i} \in D$ , we compute  $\widehat{\mathbf{C}}_{z(\mathrm{val})}(D_{-z_i})$  as follows:
$$
\widehat {\mathbf {c}} \left(D _ {- z _ {i}}\right) = \widehat {\mathbf {c}} (D) - 1
$$
$$
\widehat {\mathbf {c}} _ {x ^ {(\mathrm {v a l})}, \tau} (D _ {- z _ {i}}) = \widehat {\mathbf {c}} _ {x ^ {(\mathrm {v a l})}, \tau} (D) - \mathbb {1} [ z _ {i} \in \mathbb {N B} _ {x ^ {(\mathrm {v a l})}, \tau} ]
$$
$$
\widehat {\mathbf {c}} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} (D _ {- z _ {i}}) = \widehat {\mathbf {c}} _ {z ^ {(\mathrm {v a l})}, \tau} ^ {(+)} (D) - \mathbb {1} [ z _ {i} \in \mathbb {N B} _ {x ^ {(\mathrm {v a l})}, \tau} ] \mathbb {1} [ y _ {i} = y ^ {(\mathrm {v a l})} ]
$$
which can be computed in  $O(1)$  runtime. Hence, we can compute DP-TKNN-Shapley  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}(v_{z(\mathrm{val})}^{\mathrm{TKNN}})$  for all  $z_i \in D$  within an overall computational cost of  $O(N)$ . It is important to note that when releasing  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}$  to individual  $i$ , the data point they hold,  $z_i$ , is not private to the individual themselves. Therefore, as long as  $\widehat{\mathbf{C}}_{z(\mathrm{val})}(D)$  is privatized,  $\widehat{\mathbf{C}}_{z(\mathrm{val})}(D_{-z_i})$  and hence  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}$  also satisfy the same privacy guarantee due to DP's post-processing property.
D.2.2 Collusion Resistance via Reusing Privatized Statistics
In Section 5.1, we consider the single Shapley value  $\phi_{z_i}^{\mathrm{TKNN}}(D_{-z_i})$  as the function to privatize. However, when we consider the release of all Shapley values  $\mathcal{M}(D) \coloneqq (\widehat{\phi}_{z_1}^{\mathrm{TKNN}}(D_{-z_1}), \ldots, \widehat{\phi}_{z_N}^{\mathrm{TKNN}}(D_{-z_N}))$  as a whole mechanism, one can show that such a mechanism satisfies joint differential privacy (JDP) [34] if we reuse the privatized statistic  $\widehat{\mathbf{C}}_{z(\mathrm{val})}(D)$  for the release of all  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}$ . The consequence of satisfying JDP is that our mechanism is resilient against collusion among groups of individuals without any privacy degradation. That is, even if an arbitrary group of individuals in  $[N] \setminus i$  colludes (i.e., shares their respective  $\widehat{\phi}_{z_j}^{\mathrm{TKNN}}$  values within the group), the privacy of individual  $i$  remains uncompromised. Our method also stands resilient in scenarios where a powerful adversary sends multiple data points and receives multiple value scores.
Definition 15 (Joint Differential Privacy [34]). For  $\varepsilon, \delta \geq 0$ , a randomized algorithm  $\mathcal{M} : \mathbb{N}^{\mathcal{X}} \to \mathcal{Y}^N$  is  $(\varepsilon, \delta)$ -joint differentially private if for every possible pair of  $z, z' \in \mathcal{X}$ , for every  $i \in [N]$ , and for every subset of possible outputs  $E \subseteq \mathcal{Y}^{N-1}$ , we have
$$
\operatorname * {P r} _ {\mathcal {M}} [ \mathcal {M} (z \cup D _ {- z}) _ {- i} \in E ] \leq e ^ {\varepsilon} \operatorname * {P r} _ {\mathcal {M}} [ \mathcal {M} (z ^ {\prime} \cup D _ {- z}) _ {- i} \in E ] + \delta
$$
where  $\mathcal{M}_{-i}$  denotes the output of  $\mathcal{M}$  that excludes the  $i$ th dimension.
Theorem 16. The mechanism of releasing of all noisy KNN-Shapley values
$$
\mathcal {M} (D) := \left(\widehat {\phi} _ {z _ {1}} ^ {T K N N} \left(D _ {- z _ {1}}\right), \dots , \widehat {\phi} _ {z _ {N}} ^ {T K N N} \left(D _ {- z _ {N}}\right)\right)
$$
satisfy  $(\varepsilon, \delta)$ -JDP if  $\sigma = \sqrt{3} \cdot \sqrt{\log(1.25 / \delta)} / \varepsilon$  and each  $\phi_{z_i}^{TKNN}$  is computed via reusing the privatized  $C_{z(\mathrm{val})}$ .
Proof. The proof relies on the "post-processing" property of differential privacy.
First of all, we select  $\sigma = \sqrt{3} \cdot \sqrt{\log(1.25 / \delta)} / \varepsilon$ , ensuring that  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D)$  satisfies  $(\varepsilon, \delta)$ -DP.
In the context of DP-TKNN-shapley, we calculate  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D_{-z_i})$  for each  $z_{i}$  as part of a postprocessing step on  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D)$ .
It is important to note that the released data value  $\widehat{\phi}_{z_i}^{\mathrm{TKNN}}(D_{-z_i})$  is a function of  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D_{-z_i})$ , and  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D_{-z_i})$  can be obtained as post-processing of  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D)$  given only the knowledge of  $z_i$ . Hence, we can express the probability of  $\mathcal{M}(z_i,D_{-z_i})_{-i}$  belonging to a certain set  $E$  as follows:
$$
\operatorname * {P r} _ {\mathcal {M}} [ \mathcal {M} (z _ {i}, D _ {- z _ {i}}) _ {- i} \in E ] = \operatorname * {P r} _ {\widehat {\mathbf {C}} _ {z (\mathrm {v a l})} (D)} [ f _ {D _ {- z _ {i}}} (\widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} (D)) \in E ]
$$
$$
\begin{array}{l} f _ {D _ {- z _ {i}}} \big (\widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} (D) \big) \\ = \left(\widehat {\phi} _ {z _ {1}} ^ {\mathrm {T K N N}} \left[ \widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} \left(D _ {- z _ {1}}\right) \right], \dots , \phi_ {z _ {i - 1}} ^ {\mathrm {T K N N}} \left[ \widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} \left(D _ {- z _ {i - 1}}\right) \right], \phi_ {z _ {i + 1}} ^ {\mathrm {T K N N}} \left[ \widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} \left(D _ {- z _ {i + 1}}\right) \right], \dots , \phi_ {z _ {N}} ^ {\mathrm {T K N N}} \left[ \widehat {\mathbf {C}} _ {z ^ {(\mathrm {v a l})}} \left(D _ {- z _ {N}}\right) \right]\right) \\ \end{array}
$$
We note that  $f_{D - z_i}$  is a function that does not depend on  $z_i$ .
Then, for any  $z_i, z_i'$  and for any tuple of  $D_{-z_i}$ , denote  $D := z_i \cup D_{-z_i}$  and  $D' := z_i' \cup D_{-z_i}$ , we have
$$
\begin{array}{l} \operatorname * {P r} _ {\mathcal {M}} [ \mathcal {M} (z _ {i}, D _ {- z _ {i}}) _ {- i} \in E ] = \operatorname * {P r} _ {\widehat {\mathbf {C}} _ {z (\text {v a l})} (D)} \left[ f _ {D _ {- z _ {i}}} \left(\widehat {\mathbf {C}} _ {z (\text {v a l})} (D)\right) \in E \right] \\ = \Pr_ {\widehat {\mathbf {C}} _ {z (\text {v a l})} (D)} \left[ \widehat {\mathbf {C}} _ {z (\text {v a l})} (D) \in f _ {D - z _ {i}} ^ {- 1} (E) \right] \\ \leq e ^ {\varepsilon} \Pr_ {\widehat {\mathbf {C}} _ {z (\text {v a l})} (D ^ {\prime})} \left[ \widehat {\mathbf {C}} _ {z (\text {v a l})} (D ^ {\prime}) \in f _ {D _ {- z _ {i}}} ^ {- 1} (E) \right] + \delta \\ = e ^ {\varepsilon} \Pr_ {\widehat {\mathbf {C}} _ {z (\text {v a l})} (D ^ {\prime})} \left[ f _ {D _ {- z _ {i}}} \left(\widehat {\mathbf {C}} _ {z (\text {v a l})} (D ^ {\prime})\right) \in E \right] + \delta \\ = e ^ {\varepsilon} \operatorname * {P r} _ {\mathcal {M}} [ \mathcal {M} (z _ {i} ^ {\prime}, D _ {- z _ {i}}) \in E ] + \delta \\ \end{array}
$$
where the first inequality is due to the  $(\varepsilon, \delta)$ -DP guarantee of  $\widehat{\mathbf{C}}_{z^{(\mathrm{val})}}(D)$ .
Hence, the privacy guarantee for our DP-TKNN-Shapley remains the same even if multiple attackers collude and share the received noisy data value scores with each other. As a comparison, the naive DP-KNN-Shapley which independently adds noise for each released data value score does not enjoy such powerful collusion resistance property.
D.2.3 Privacy Amplification by Subsampling
In order to further boost the privacy guarantee, we incorporate the privacy amplification by subsampling technique [4]. Specifically, before any computation, we first sample each data point independently with a probability  $q$  (this is usually referred to as Poisson subsampling). The differentially private quantities based on the subsampled dataset, denoted as  $\mathrm{sample}(D)$ , are calculated easily as follows:
$$
\widehat {\mathbf {c}} (D) := \text {r o u n d} \left(\mathbf {c} (\text {s a m p l e} (D)) + \mathcal {N} \left(0, \sigma^ {2}\right)\right)
$$
$$
\widehat {\mathbf {c}} _ {x (\text {v a l})}, \tau (D) := \operatorname {r o u n d} \left(\mathbf {c} _ {x (\text {v a l})}, \tau (\text {s a m p l e} (D)) + \mathcal {N} \left(0, \sigma^ {2}\right)\right)
$$
$$
\widehat {\mathbf {c}} _ {z ^ {(\text {v a l})}, \tau} ^ {(+)} (D) := \operatorname {r o u n d} \left(\mathbf {c} _ {z ^ {(\text {v a l})}, \tau} ^ {(+)} (\text {s a m p l e} (D)) + \mathcal {N} \left(0, \sigma^ {2}\right)\right)
$$