SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Next, a simple calculation tells us that
$$
\frac {\alpha (c r)}{\beta (c r)} = \frac {1 - \frac {(c r) ^ {2}}{2}}{c r \cdot \sqrt {1 - \frac {(c r) ^ {2}}{4}}} = \frac {1}{c r} \cdot (1 \pm o (1)),
$$
$$
\begin{array}{l} \frac {(\alpha (r) - \alpha (c r)) \cdot \eta_ {u} - 2 \beta (r) \cdot \sqrt {\ln K}}{\beta (c r)} = \frac {\left(\frac {c ^ {2} - 1}{2}\right) r ^ {2} \cdot \sqrt {\frac {\ln n}{K}} \cdot \frac {\lambda}{r} - 2 r \sqrt {\ln K} (1 \pm o (1))}{c r (1 \pm o (1))} \\ = \frac {\sqrt {\frac {\ln n}{K}} \cdot r \cdot \frac {(c ^ {2} - 1) \lambda}{2} \cdot (1 \pm o (1))}{c r (1 \pm o (1))} \\ = \sqrt {\frac {\ln n}{K}} \cdot \frac {(c ^ {2} - 1) \lambda}{2 c} \cdot (1 \pm o (1)). \\ \end{array}
$$
Let  $r' = \frac{\beta(cr)}{c \cdot \alpha(cr)} = r(1 \pm o(1))$ . Then, we can therefore upper bound (2) as at most
$$
\mathbb {P} \left[ Z + \frac {W}{c r ^ {\prime}} \geq \sqrt {\frac {\ln n}{K}} \cdot \frac {(c ^ {2} - 1) \lambda}{2 c} \cdot (1 - o (1)) \Bigg | W \geq 0 \right]. \tag {3}
$$
The CDF of  $\frac{W}{cr'}$  conditioned on  $W \geq 0$  is bounded above by  $O\left(c r' \cdot \eta_u\right) \cdot e^{-c r' \cdot \eta_u \cdot w} \leq (\log n)^{O(1)} \cdot e^{-S \cdot w}$ , where  $S = c \cdot \frac{r'}{r} \cdot \lambda \cdot \sqrt{\ln n / K}$ . In addition, we write  $p_Z$  to represent the PDF of  $Z$  (which is a standard Gaussian) and  $T = \sqrt{\ln n / K} \cdot (c^2 - 1) \lambda / (2c) \cdot (1 - o(1))$ . Note that  $S > T$ , since it suffices for  $c > \frac{c^2 - 1}{2c} \cdot (1 + o(1))$ , which is true for any constant  $c$ . Then, we have that (3) is at most
$$
\begin{array}{l} \int_ {- \infty} ^ {\infty} \mathbb {P} \left(\frac {W}{c r ^ {\prime}} \geq w | W \geq 0\right) \cdot p _ {Z} (T - w) d w \leq (\log n) ^ {O (1)} \cdot \int_ {0} ^ {\infty} e ^ {- S \cdot w} \cdot e ^ {- (T - w) ^ {2} / 2} d w + \int_ {- \infty} ^ {0} e ^ {- (T - w) ^ {2} / 2} d w \\ \leq \left(\log n\right) ^ {O (1)} \cdot \int_ {0} ^ {\infty} e ^ {- T ^ {2} / 2 - (S - T) w - w ^ {2} / 2} d w + \int_ {- \infty} ^ {0} e ^ {- T ^ {2} / 2 + T w - w ^ {2} / 2} d w \\ \leq \left(\log n\right) ^ {O (1)} \cdot e ^ {- T ^ {2} / 2} \cdot \int_ {- \infty} ^ {\infty} e ^ {- w ^ {2} / 2} \\ = (\log n) ^ {O (1)} \cdot e ^ {- T ^ {2} / 2}. \\ \end{array}
$$
The third line uses the fact that  $(S - T)w\geq 0$  when  $w\geq 0$  (since  $S\geq T$ ) and that  $Tw\leq 0$  when  $w\leq 0$  (since  $T$  is positive as we assume  $c\geq 1$ ). Therefore,
$$
\left(\frac {G (c r , \eta_ {q} , \eta_ {u})}{F (\eta_ {u})}\right) ^ {K} \leq \left((\log n) ^ {O (1)} \cdot e ^ {- (T ^ {2} / 2)}\right) ^ {K} \leq n ^ {- (c ^ {2} - 1) ^ {2} \lambda^ {2} / (8 c ^ {2}) + o (1)}.
$$
To finish, we will want to set  $\frac{\lambda^2}{2} = \rho$  and  $\frac{(c^2 - 1)^2\lambda^2}{8c^2} = 1 - \rho$ . Solving gives us  $\lambda = \frac{2\sqrt{2}c}{c^2 + 1}$  and  $\rho = \frac{4c^2}{(c^2 + 1)^2}$ .
A.2 Embedding into the Euclidean sphere
In the previous sections, we assumed that the data lied on a reasonably low-dimensional Euclidean sphere, and that  $r$  was some reasonably small (but not too small) parameter. In this section, we explain why this assumption can be made without loss of generality, by using a previous work of [BRS11] which allows us to embed the data into a Euclidean sphere.
Lemma A.1. [BRS11, Lemma 6, rephrased] Fix integers  $d, d' \geq 1$  and a parameter  $0 < \gamma < \frac{1}{2}$ . There exists a randomized map  $\Theta: \mathbb{R}^d \to S^{d' - 1}$ , where  $S^{d' - 1}$  represents the unit sphere in  $\mathbb{R}^{d'}$ , that can be computed in time  $O(d \cdot d')$  for any point  $x \in \mathbb{R}^d$ , with the following properties for any  $x, y \in \mathbb{R}^d$ .
1.  $\| \Theta (x) - \Theta (y)\| _2^2\leq (1 + \gamma)\cdot \| x - y\| _2^2$  with failure probability at most  $\exp \left(\frac{D\gamma^2}{6}\right)$ .
The original claim also takes some parameters  $\sigma_{1},\ldots ,\sigma_{D}$  : we will set  $D = d^{\prime} / 2$  and every  $\sigma_{i} = 1$  . It is clear that the final function  $\Theta$  defined in [BRS11] has norm 1 in this case.
2. If  $\| x - y \|_2 \leq \sqrt{\gamma}$ , then  $\| \Theta(x) - \Theta(y) \|_2^2 \geq (1 - \gamma) \cdot \| x - y \|_2^2$  with failure probability at most  $\exp \left( -\frac{3D\gamma^2}{128} \right)$ .
3. If  $\| x - y\| _2\geq \sqrt{\gamma}$ , then  $\| \Theta (x) - \Theta (y)\| _2^2\geq \frac{\gamma}{2}$  with failure probability at most  $\exp \left(-\frac{D\cdot\gamma}{128}\right)$ .<sup>3</sup>
We will set  $d' = O\left(\frac{\log n}{\gamma^2}\right)$ , where we recall that  $n$  equals the number of data points and  $m$  equals the number of queries. Then, if we generate the randomized map  $\Theta$  ahead of time, with high probability the conditions in Lemma A.1 hold for all  $n$  data points and any fixed query point. (In the final algorithm, we repeat the embedding  $O(\log m)$  times to amplify the success probability).
Corollary A.2. Suppose that  $(cr)^{2} \leq \frac{\gamma}{2}$ , and  $d' = C \cdot \frac{\log n}{\gamma^{2}}$  for some sufficiently large constant  $C$ . Then, with at least 0.99 probability over the randomized map  $\Theta: \mathbb{R}^{d} \to S^{d' - 1}$ , for all  $x \in X$  and any fixed query  $y$ ,  $\|x - y\|_{2} \leq r$  implies  $\|\Theta(x) - \Theta(y)\|_{2} \leq (1 + \gamma) \cdot r$  and  $\|x - y\|_{2} \geq cr$  implies  $\|\Theta(x) - \Theta(y)\|_{2} \geq (1 - \gamma) \cdot cr$ .
Proof. We assume that  $\Theta$  was chosen so that for every  $x\in X$  and for the fixed  $y$ , the three claims in Lemma A.1 all hold.
Fix some pair  $(x,y)$ , where  $x\in X,y\in Q$ . First, if  $\| x - y\| _2\leq r$ , then since  $r\leq \sqrt{\gamma}$ ,  $\| \Theta (x) - \Theta (y)\| _2\leq (1 + \gamma)\cdot \| x - y\| _2 = (1 + \gamma)\cdot r$ . Next, if  $c\cdot r\leq \| x - y\| _2\leq \sqrt{\gamma}$ , then  $\| \Theta (x) - \Theta (y)\| _2\geq (1 - \gamma)\cdot \| x - y\| _2\geq (1 - \gamma)\cdot cr$ . Otherwise, if  $\| x - y\| _2\geq \sqrt{\gamma}$ , then  $\| \Theta (x) - \Theta (y)\| _2\geq \sqrt{\frac{\gamma}{2}}\geq c\cdot r$
We can now finish the proof of Theorem 1.1.
Proof. We will prove that we can solve the  $(c \cdot \frac{1 + \gamma}{1 - \gamma}, \frac{r}{1 + \gamma})$ -near neighbor counting with differential privacy, where  $r = (\log n)^{-1/8}$  and  $\gamma = (\log n)^{-1/8}$ , over Euclidean space. By scaling, this automatically implies the same result for any choice of  $r$ , and  $c$  replaced with  $\frac{c(1 + \gamma)}{1 - \gamma} = c(1 + o(1))$ .
We will run  $O(\log m)$  independent copies of the data structure and algorithm, where each individual data structure satisfies  $(\epsilon', \delta') = \left( \frac{\epsilon}{O(\log m)}, \frac{\delta}{O(\log m)} \right)$ -DP. By basic composition, this implies  $(\epsilon, \delta)$ -DP overall. For each query, we output the median of the responses of each data structure, which by a Chernoff bound will significantly decrease the failure probability.
For each copy of the data structure, we first preprocess the data  $X \in \mathbb{R}^d$  by using the random map  $\Theta$  from Lemma A.1 to map each point  $x \in X$  to  $\Theta(x)$ , which takes  $O(nd \cdot d')$  time. Next, we create the data structure on  $\Theta(X)$ , which is on a  $d' = O\left(\frac{\log n}{\gamma^2}\right) = (\log n)^{O(1)}$ -dimensional sphere. To answer any query  $q \in \mathbb{R}^d$ , we compute  $\Theta(q)$  in  $O(d \cdot d')$  time, and answer the query  $\Theta(q)$  using the data structure created on  $\Theta(X)$ . By Corollary A.2, with 0.99 probability, any accurate answer for  $(c, r)$ -near neighbor counting on  $S^{d' - 1}$  for a fixed query  $\Theta(q)$  is an accurate answer for  $\left(\frac{(cr) / (1 - \gamma)}{r / (1 + \gamma)}, \frac{r}{1 + \gamma}\right) = (c \cdot \frac{1 + \gamma}{1 - \gamma}, \frac{r}{1 + \gamma})$ -near neighbor counting problem for  $q$  over  $\mathbb{R}^d$ . Moreover, the embedding  $\Theta$  is oblivious to the data, which means privacy is preserved.
Now, we have embedded the data and queries onto the unit sphere  $S^{d' - 1}$  for  $d' = (\log n)^{O(1)}$ , in  $O(nd \cdot d') = \tilde{O}(nd)$  preprocessing time. We may now create the data structure (Algorithm 1) and answer each query (Algorithm 2) on  $S^{d' - 1}$ . We recall that, to improve the failure probability so that every query is answered with high probability, we replaced  $(\epsilon, \delta)$  with  $(\epsilon', \delta') = \left(\frac{\epsilon}{O(\log m)}, \frac{\delta}{O(\log m)}\right)$ , and we will take the median over  $O(\log m)$  independent copies of the data structure, for each query. By Lemmas 3.2 and 3.6, the privacy and runtime conditions of Theorem 1.1 are all satisfied. Moreover, by Lemma 3.5, with probability at least  $2/3 - 0.01 \geq 0.6$ , for each query  $q$ , each copy of the data structure is accurate, replacing the additive error  $\frac{1}{\epsilon} \log \frac{1}{\delta} \cdot n^{\rho + o(1)}$  with  $\frac{\log m}{\epsilon} \log \frac{\log m}{\delta} \cdot n^{\rho + o(1)}$ . By a Chernoff bound, the overall algorithm (taking the median of  $O(\log m)$  copies) is accurate on each
3In the original paper [BRS11] they only prove this result for  $\| x - y\| _2\geq \frac{1}{\sqrt{2}}$ , the same proof can extend to  $\| x - y\| _2\geq \gamma$ , at the cost of reducing the failure probability from exponential in  $-D$  to exponential in  $-D\cdot \gamma$ .
query with probability at least  $1 - \frac{1}{100m}$ , so it is accurate on all queries simultaneously with at least 0.99 probability. This concludes the proof.
B Lower Bound
In this section, we prove Theorem 1.2.
Given  $n$  points  $z_{1},\ldots ,z_{n}\in \{0,1\}^{d}$ , and a series of  $m$  queries  $B_{1},\dots,B_{m}$  represented by axis-parallel boxes, we create the matrix  $A_{i,j}$  to be the indicator of  $B_{i}$  containing  $z_{j}$ . We define the red-blue discrepancy to be  $\max_{x\in \{-1,1\}^n}\| Ax\|_\infty$ .
First, we have the following result due to Chazelle and Lvov [CL01].
Theorem B.1. [CL01] For sufficiently large  $n$  and  $d = C \log n$  for a large constant  $C$ , there exists a set of  $n$  points  $z_1, \ldots, z_n \in \{0, 1\}^d$  and  $n$  boxes  $B_1, \ldots, B_n$  such that the matrix  $\{A_{i,j}\} \in \mathbb{R}^{n \times n}$  has red-blue discrepancy  $n^{\Omega(1)} = 2^{\Omega(d)}$ .
Now, we switch to the result of Muthukrishnan and Nikolov [MN12]. They have a slightly more general definition of discrepancy, of  $\mathrm{disc}_{p,\alpha}(A) = \min_{x\in \{-1,0,1\}^d, \| x\|_1\geq \alpha \cdot d}\| Ax\|_p$ , so the above result is written as a lower bound on  $\mathrm{disc}(A)\coloneqq \mathrm{disc}_{\infty ,1}(A)$ . Now, we describe their theorem.
Theorem B.2. [MN12] For all  $x \in \{0, 1\}^n$ , there exist constants  $\epsilon, \delta > 0$  such that no mechanism  $\mathcal{M} = \{\mathcal{M}_n\}$  that satisfies
$$
\forall x \in \{0, 1 \} ^ {n}, \mathbb {P} \left(\| \mathcal {M} _ {n} (x) - A x \| _ {\infty} <   \frac {\operatorname {d i s c} (A)}{2}\right) \geq 2 / 3
$$
is  $(\epsilon, \delta)$ -DP, where two data points  $x, x' \in \{0,1\}^n$  are adjacent if they differ exactly in one coordinate location.
Given these lemmas, we are ready to prove our main lower bound, Theorem 1.2.
Proof of Theorem 1.2. We set  $m = n$  and  $d = C\log n$  for some constant  $C$ . By using Theorem B.1, we can construct a public set  $\{z_1,\dots ,z_n\}$  of distinct points in  $\{0,1\} ^d$  and a fixed set of boxes  $B_{1},\ldots ,B_{n}$ , that generate a matrix  $A$  with discrepancy  $\mathrm{disc}(A)\geq n^{\rho}$ , where  $\rho >0$  is a fixed constant. For any  $x\in \{0,1\} ^n$ , we define the dataset  $\mathcal{D}_x$  will be the subset of the public set where  $z_{i}\in \mathcal{D}_{x}$  if and only if  $x_{i} = 1$ . Then,  $Ax$  would be an  $m = n$  dimensional vector that precisely tells us the number of points in  $\mathcal{D}_x$  are in each box. In addition, if  $x,x^{\prime}$  are adjacent in  $\{0,1\} ^n$ , then  $D_{x},D_{x^{\prime}}$  are adjacent datasets. Next for any axis-parallel box  $B_{i}$ , we create a query point  $q_{i}\in \{0,1\}^{d}$  as follows. In the  $k$ th coordinate dimension, if  $B_{i}$  intersects either both or neither of the planes  $x_{k} = 0$  and  $x_{k} = 1$ , we set  $q_{i,k} = 1 / 2$ . Otherwise, if  $B_{i}$  only intersects the plane  $x_{k} = 0$ , we set  $q_{i,k} = -1 / 2$ . Finally, if  $B_{i}$  only intersects the plane  $x_{k} = 1$ , we set  $q_{i,k} = 3 / 2$ .
Suppose that  $\mathcal{A}$  is an  $(\epsilon, \delta)$ -DP algorithm acting on subsets  $S$  of  $\{0,1\}^d$  of size at most  $n$ , that returns an estimate to  $|S \cap B_{\infty}(q_i,1)|$  for all queries  $q_i$ . Since every  $q_i$  has half-integral coordinates, and every data point has integral coordinates, we have that  $B_{\infty}(q_i,1) = B_{\infty}(q_i,1/2) = B_{\infty}(q_i,3/2 - \alpha)$  for any  $\alpha > 0$ , and these all equal  $B_i$ . So, for any subset  $S \subset \{0,1\}^d$ ,
$$
\left| S \cap B _ {\infty} \left(q _ {i}, 1\right) \right| = \left| S \cap B _ {\infty} \left(q _ {i}, 1 / 2\right) \right| = \left| S \cap B _ {\infty} \left(q _ {i}, 3 / 2 - \alpha\right) \right| = \left| S \cap B _ {i} \right|.
$$
Suppose that for any  $S \subset \{0,1\}^d$  of size at most  $n$ , with probability at least  $2/3$ , the output of  $\mathcal{A}(S)$  for each query  $q_i$  differs by at most  $T$  from  $|S \cap B_i|$ . Then, we can consider the algorithm  $\mathcal{M}$  that acts on an element in  $\{0,1\}^n$ , where  $\mathcal{M}(x) = \mathcal{A}(D_x)$ . Since  $\mathcal{A}$  is  $(\epsilon, \delta)$ -DP, this implies that  $\mathcal{M}$  is also  $(\epsilon, \delta)$ -DP, with respect to adjacent elements in  $\{0,1\}^n$ . Moreover,  $(A \cdot x)_i = \sum_j A_{i,j} x_j = |\{j : A_{i,j} = x_j = 1\}| = |D_x \cap B_i|$ . Hence, by Theorem B.2, there must exist  $x \in \{0,1\}^n$  such that
$$
\mathbb {P} \left(\| \mathcal {A} (D _ {x}) - | D _ {x} \cap B _ {i} | \| _ {\infty} <   \frac {\operatorname {d i s c} (A)}{2}\right) = \mathbb {P} \left(\| \mathcal {M} (x) - A x \| _ {\infty} <   \frac {\operatorname {d i s c} (A)}{2}\right) <   \frac {2}{3},
$$
so  $T \geq \frac{\operatorname{disc}(A)}{2}$ . This completes the proof as  $\operatorname{disc}(A) \geq n^{\rho}$ .
C Extensions
$\ell_1$  balls. It is easy to extend our algorithms to ranges that are balls in the  $\ell_1$  norm. This relies on the well-known fact that the  $\ell_1$  norm embeds (almost) isometrically into a negative-type metric, i.e., into a squared Euclidean metric  $(\ell_2)^2$ . We use the following constructive version of this fact, from [LN14, Theorem 116] based on [MN04].
Theorem C.1 ([LN14] $^{4}$ ). Let  $1 \leq p < 2$ . Let  $X \subset \mathbb{R}^{d}$  be a point set with  $\ell_{p}$ -aspect ratio  $\Phi$ . There is a mapping  $f: X \to \mathbb{R}^{d'}$  for  $d' = d \cdot \text{poly}(\log \Phi, \log d, 1 / \epsilon)$  such that for every  $x, y \in X$ ,
$$
\| x - y \| _ {p} ^ {p} \leq \| f (x) - f (y) \| _ {2} ^ {2} \leq (1 + \epsilon) \| x - y \| _ {p} ^ {p}.
$$
The above theorem, applied for  $p = 1$ , reduces approximate range queries for  $\ell_1$  balls with approximation factor  $c$  to approximate range queries for  $(\ell_2)^2$  balls with approximation factor  $c / (1 + \epsilon)$  and  $d$  replaced by  $d'$ . The latter problem is equivalent to approximate range queries for  $\ell_2$  balls with approximation factor  $\sqrt{c / (1 + \epsilon)}$ . The final bound follows by following this sequence of reductions.
Pure Differential Privacy. The only reason that our algorithm requires approximate differential privacy is that we use truncated Laplace noise in line 19 of Algorithm 1. We use truncated Laplace noise so that if any leaf node is empty, then the noisy count will be 0 with probability 1. To make the algorithm pure-DP, we modify line 19 to add  $\mathrm{Lap}(2 / \epsilon)$  noise to the count  $c_{v}$ , and in lines 20-21, we replace  $c_{v}$  with 0 whenever the noised count is at most  $\frac{10}{\epsilon} \cdot K \log T$ . For the parameters in subsection 3.4, this is at most  $\frac{1}{\epsilon} \cdot (\log n)^{O(1)}$ .
The difficulty, however, is that we need to speed up the runtime from  $T^K$ , as done in the runtime analysis in subsection 3.3. Specifically, we need to ensure that few nodes are created (i.e., have  $c_v = 0$ ): we prove that, in expectation, this holds. In addition, we need to determine which nodes will have  $c_v \neq 0$  efficiently. If so, we only need to create these nodes in the preprocessing, which completes the proof.
First, we determine which nodes every data point  $p \in X$  is sent to, in the same fashion as in runtime analysis in subsection 3.3. Suppose there are  $n' \leq n$  nonempty regions: then there are  $N := T^K - n'$  empty regions. For each node  $v$ , we wish to sample  $c_v \sim \mathrm{Lap}(2 / \epsilon)$  as the noise, and if  $c_v > \frac{10}{\epsilon} \cdot K \log T$ , we keep the node  $v$  and store  $c_v$ . Otherwise, we reset  $c_v$  back to 0, and do not need to store  $v$ .
We note that the probability of any fixed  $c_v > \frac{4}{\epsilon} \cdot K \log T$  is  $\frac{1}{2} \cdot e^{-(\epsilon/2) \cdot (10/\epsilon) \cdot K \log T} = e^{-5K \log T} / 2 = T^{-5K} / 2$ . Let  $\alpha := T^{-5K} / 2$ . We first consider the problem of sampling from  $\operatorname{Bin}(N, \alpha)$ , which represents the number of empty regions that will have  $c_v > 0$ . Note that  $\mathbb{P}(\operatorname{Bin}(N, \alpha) > 0) = 1 - (1 - T^{-5K} / 2)^{T^K - n'} \leq T^{-4K}$ . By using a repeated squaring approach, we can compute this probability exactly in  $\operatorname{poly} \log(T^K) = \operatorname{poly} \log n$  time. Then, we can flip a coin with this probability, and with at most  $T^{-4K}$  failure probability, the Binomial equals 0. Otherwise, need to compute the distribution  $\operatorname{Bin}(N, \alpha)$  conditioned on it being at least 1. However, we can compute each term  $\binom{N}{r} \alpha^r (1 - \alpha)^{N-r} = \mathbb{P}(\operatorname{Bin}(N, \alpha) = r)$  in time at most  $O(N^2)$ , which thus means we can compute every  $\mathbb{P}(\operatorname{Bin}(N, \alpha) = r)$  in time  $O(N^3)$ . Hence, in the  $T^{-4K} \leq N^{-4}$  probability event that  $\operatorname{Bin}(N, \alpha) > 0$ , we can still draw from the conditional distribution in time  $O(N^3)$ . Hence, in expected time poly log  $n$ , we can draw from  $\operatorname{Bin}(N, \alpha)$ .
In the case that  $\operatorname{Bin}(N, \alpha) = r > 0$ , because every  $c_v$  (for empty regions  $v$ ) has the same distribution, we can create the full tree, and then uniformly choose the subset of  $r$  regions which will have noisy count at least  $\frac{10}{\epsilon} \cdot K \log T$ . This takes time at most  $T^{2K}$ . We then have to compute each  $c_v \sim \mathrm{Lap}(2/\epsilon)$  for the  $r$  choices of  $v$  where  $c_v > \frac{10}{\epsilon} \cdot K \log T$ . However, by using the well-known memoryless property of exponential distributions, the distribution of each  $c_v$  is just  $\frac{10}{\epsilon} \cdot K \log T + \mathrm{Exp}(2/\epsilon)$ . Hence, we can compute the full data structure in time  $O(T^{3K})$ , in this setting. This, however, only happens with at most  $T^{-4K}$  probability.
4The statement in [LN14] is for  $\Phi = d^{O(1)}$ , but applies to any  $\Phi > 0$ . The statement given here is by setting  $R = d^{-1/q}$  in [LN14, Theorem 116] and scaling the minimal distance in the given metric to 1.
Alternatively, if  $r = 0$ , we can avoid computing any  $c_v$  when  $v$  is empty. The rest of the analysis in this case proceeds identically to subsection 3.3. Finally, in either case, the time to answer each query, in expectation, is still the same as in subsection 3.3.
Finally, we need to verify the accuracy of the algorithm. In expectation, each  $c_v$  is off by at most  $O(T\log K / \epsilon) = (\log n)^{O(1) / \epsilon}$ , as the noise adds an expected  $O(1 / \epsilon)$  error, and the replacing of  $c_v$  with 0 only happens when  $c_v < O(T\log K / \epsilon)$ . The analysis of Lemma 3.3 proceeds identically, except that the first source of error replaces the  $\log \frac{1}{\delta}$  term with a  $T\log K = (\log n)^{O(1)}$  term.
Finally, the embedding of arbitrary Euclidean data into the Euclidean sphere, as in Appendix A.2, proceeds the same way. Overall, Theorem 1.1 still holds when  $\delta = 0$ , except that the runtime of both the preprocessing and answering each query is in expectation, and the additive error removes the  $\log (\log m / \delta)$  term. (Indeed, the additional  $(\log n)^{O(1)}$  factors in the runtime and additive error can be absorbed into the  $n^{o(1)}$  term).
Large  $\epsilon$ . We remark that our analysis extends to  $\epsilon \leq n^{o(1)}$  in a straightforward manner. We remark that in practice, because the probability ratio in differential privacy depends on  $e^{\epsilon}$ , it is highly impractical to use any  $\epsilon$  significantly larger than  $\Omega (\log n)$ , and therefore we believe that it is not interesting to analyze an algorithm beyond  $\epsilon \leq n^{o(1)}$ .
To see why, note that for  $1 \leq \epsilon \leq n^{o(1)}$ , any  $(1/2, \delta)$ -DP algorithm is automatically  $(\epsilon, \delta)$ -DP. (This also holds in the  $\delta = 0$  case.) Note that the runtime bounds do not depend on  $\epsilon$ , and the accuracy bounds are proportional to  $1/\epsilon$  in the additive error. Therefore, if we allow the  $n^{\rho + o(1)}$  term in the additive error to have a slightly larger  $o(1)$  in the exponent (i.e., up to  $n^{\rho + o(1)}/\epsilon$ ), the claim still holds until  $\epsilon \leq n^{o(1)}$  for any  $o(1)$ .
Adaptive Queries. Here, we explain how we are able to improve Theorem 1.1 to handle adaptive queries.
We assume we are promised that all data points are in  $[-R,R]^d$ , where  $R > r$  is some parameter. Let  $\mathcal{T}$  represent the set of points  $(x_{1},\ldots ,x_{d})$  where every  $|x_i|\leq 2R$  and  $x_{i}$  is an integral multiple of  $r / d$ . Note that  $|\mathcal{T}|\leq O(d\cdot R / r)^{d} = e^{O(d\log (dR / r))}$ .
Now, consider having  $M = O(d\log (dR / r))$  independent copies of the data structure, where each data structure is initialized with  $(\frac{\epsilon}{M},\frac{\delta}{M})$ -DP. To answer each query, each data structure computes its approximation, and the overall data structure outputs the mean of the  $M$  responses. By a standard Chernoff bound, and the accuracy bounds of Theorem 1.1, the output will be between  $(1 - o(1))\cdot |X\cap B_2(q,r)| - n^{\rho +o(1)}\cdot \frac{\log(\log m\cdot M / \delta)\cdot\log m}{\epsilon / M}$  and  $(1 + o(1))\cdot |X\cap B_2(q,cr)| + n^{\rho +o(1)}\cdot \frac{\log(\log m\cdot M / \delta)\cdot\log m}{\epsilon / M}$ , with  $e^{-\Omega (M)}$  failure probability. In other words, the failure probability is  $e^{-\Omega (M)}$  (assuming non-adaptive queries) and the additive error multiplies by at most  $O(M\log M)$ . Moreover, each data structure is  $(\frac{\epsilon}{M},\frac{\delta}{M})$ -DP, so the overall algorithm, by basic composition, is  $(\epsilon ,\delta)$ -DP. Finally, the runtime will only increase by a factor of  $M$  (both for preprocessing and answering queries), since we have to repeat the process for  $M$  data structures.
Now, we explain how we can deal with arbitrary adaptive queries. We can assume WLOG that every query is in the range  $[-2R, 2R]^d$ , or else the algorithm can simply output 0 without sacrificing either privacy or accuracy. Next, we can assume WLOG that every query is in  $\mathcal{T}$ , because any query  $q$  is within  $r / \sqrt{d}$  of some point  $q' \in \mathcal{T}$ , and answering the query on  $q'$  will be accurate up to an additive error of  $r / \sqrt{d} = o(r)$ . Therefore, as long as the data structure is accurate for all of the queries in  $\mathcal{T}$ , this is sufficient.