SlowGuess/NeurIPS_2023_OCR huggingface dataset:
To explain why this algorithm is accurate, for the close regions, we obtain additive error proportional to  $S \cdot \rho$  as we apply the private coreset on a ball of radius  $S \cdot \rho$ . There is one region for each center in  $F$ , which multiplies the additive error by  $|F| = \tilde{O}(k)$ . For the far regions, we first note that  $d(\tilde{x}_i, C) = d(x_i, C) \pm \tilde{O}(\rho)$  for any set of  $k$  centers  $C$ , as  $d(x_i, \tilde{x}_i) \leq \tilde{O}(\rho)$ . Hence, we have additive error  $\tilde{O}(\rho)$  per point. While this seems bad as this might induce additive error for  $n$  points, we in fact show that this additive error can be "charged" to multiplicative error. To see why, if  $x_i$  mapped to the far regions, this means  $d(\tilde{x}_i, F) \geq \rho \cdot S$ , which also means  $d(x_i, F) \geq \Omega(\rho \cdot S)$ . If there were  $T$  such points, then the total cost of  $X$  with respect to  $F$  is at least  $T \cdot \rho \cdot S$ , whereas the additive error is roughly  $T \cdot \rho$ . Finally, in our crude approximation we show  $\mathrm{cost}(X; F)$  is at most  $d^{O(1)}$  times the optimum  $k$ -means cost, which means for  $S \gg d^{O(1)}$  the additive error is small even compared to the optimum cost. Hence, we can charge the additive error to multiplicative error. We still have additive error from the close regions, but for  $S = d^{O(1)}$ , the additive error is only  $\mathrm{poly}(k, d) \cdot \rho$ .
To summarize, while our techniques are inspired by [25], one important novel technical contribution of our work is that while [25] uses the true locations of the points to assign them to regions, we first add Gaussian noise to the points to determine their region, and then use the noised points only for the "far" regions and the true points only for the "close" regions. This change is crucial in ensuring the analysis is successful. In addition, we must set several parameters carefully to charge the additional incurred cost either to a small additive or small multiplicative factor.
4 Crude Approximation
In this section, we devise a crude bicriteria approximation that will serve as a starting point in developing our more refined algorithm. A bicriteria approximation is a set  $F$  of  $\alpha \cdot k$  points, that is  $(\varepsilon, \delta, \rho)$ -DP in terms on  $X$ , and in addition, it is a  $(\beta, V)$  approximation, i.e.,  $\mathrm{cost}(X; F) \leq \beta \cdot \mathrm{OPT}_k(X) + V \cdot \rho^p$ , where  $p = 1$  for  $k$ -median and  $p = 2$  for  $k$ -means. Even though  $F$  has more than  $k$  points, we still compare to the optimal solution with exactly  $k$  points. We will show such an algorithm with  $\alpha = \mathrm{poly}(\log n, \log \frac{\Lambda}{\rho})$ ,  $\beta = \mathrm{poly}(d)$ , and  $V = \mathrm{poly}(k, d, \varepsilon^{-1}, \log \delta^{-1}, \log n)$ . We defer the formal theorem statement, along with the proof, to Appendix B.
Algorithm Description: The algorithm works as follows. For each  $i \leq n$ , let  $\tilde{x}_i$  be generated by adding  $O\left(\frac{\rho}{\varepsilon} \cdot \sqrt{\log(1 / \delta)}\right) \cdot \mathcal{N}(0, I)$  noise to each data point  $x_i$ . Let  $\tilde{X} = \{\tilde{x}_1, \dots, \tilde{x}_n\}$ .
We create  $REP = O(\log n)$  random quadrtrees starting from the top level with side length  $\Lambda$  (full diameter of pointset) until the bottom level of size length  $\rho / B$ , for some parameter  $B$ . Next, for some parameter  $A$ , for each level with side length between  $\rho \cdot A$  and  $\rho / B$ , we count how many points are in each cell, add  $\mathrm{TLap}(1 / \varepsilon', 1 / \delta')$  noise, where  $\varepsilon' = \Theta(\varepsilon / \sqrt{\log n \log(A \cdot B) \log(1 / \delta)})$  and  $\delta' = \Theta(\delta / (\log n \log(A \cdot B)))$ , and then pick the  $4k$  cells in that level with the largest number of points in them, after adding noise to the number of points. For the levels of side length more than  $\rho \cdot A$ , we count how many of the  $\tilde{x}_i$  points are in each cell and then pick the  $4k$  cells in that level with
the largest number of points in  $\tilde{X}$ . Our final algorithm simply outputs the union of all cell centers that we have picked.
One issue is that the number of cells is exponential in  $d$ , so adding noise to each cell count may be inefficient. To fix this, we will only add  $\mathrm{TLap}(1 / \varepsilon', 1 / \delta')$  noise to cells that were nonempty, and will only pick a cell center if its noisy count is at least  $\frac{K}{\varepsilon'} \log \frac{1}{\delta}$ , for some large constant  $K$ . Since an empty cell, even after adding noise to its count, can never exceed  $\frac{K}{\varepsilon'} \log \frac{1}{\delta}$ , we can pretend we did the same procedure to the empty cells, but simply never included them. It is straightforward to verify that every other step of the algorithm is implementable in polynomial time.
We provide pseudocode for the algorithm in Algorithm 2 in Appendix B, and we discuss the runtime at the end of Appendix C.
5 From Crude to Accurate
In this section, we devise an improved approximation that only uses  $k$  centers and achieves a constant approximation ratio, using the crude approximation from Section 4 as a starting point. We will subsequently prove Theorem 1.1. Again, we defer all proof details to Appendix C.
Our approach utilizes both the crude approximation from Section 4 and previously known constant-approximation differentially private (but not dist-DP) algorithms from the literature, to create a dist-DP "semi-coreset" for clustering. More formally, given a set of  $n$  points  $X = \{x_{1},\ldots ,x_{n}\} \in \mathbb{R}^{d}$ , we will compute a (weighted) set of points  $Y$  that is  $(\varepsilon ,\delta ,\rho)$ -dist-DP with respect to  $X$ , such that for any set of  $k$  centers  $C = \{c_1,\dots ,c_k\}$ ,  $\mathrm{cost}(Y;C) = \Theta (\mathrm{cost}(X;C))\pm O(\mathrm{OPT}_k(X))\pm W\cdot \rho^p$ , where  $W$  will be polynomial in  $d,k,\varepsilon^{-1},\log \delta^{-1},\log n$ , and  $\log \frac{\Lambda}{\rho}$ .
If we can achieve this, then we just have to compute an  $O(1)$ -approximate  $k$ -means (or  $k$ -median) solution to  $Y$ , which does not have to be private since  $Y$  already is. Indeed, one can prove an  $O(1)$ -approximation of  $Y$  will be a dist-DP  $(O(1), O(W))$ -approximate solution for  $X$ .
Algorithm Description: Our algorithm works as follows. First, for each point  $x_{i} \in X$ , add  $O\left(\frac{\rho}{\varepsilon} \cdot \sqrt{\log(1 / \delta)}\right) \cdot \mathcal{N}(0, I)$  noise to get a point  $\tilde{x}_{i}$ . (Recall: this was also done for the crude approximation.)
Next, we partition the set of points into regions, using our dist-DP bicriteria approximation  $F$  from Section 4. If  $d(\tilde{x}_i,F) > \rho \cdot S$  for some parameter  $S$ , we send the noised point  $\tilde{x}_i$  to the set  $\tilde{X}_0$ , and send the index  $i$  to the index set  $I_0$ . Else, if  $\tilde{x}_i$  is closest to center  $f_j$  (for  $j \leq \alpha \cdot k$ ), we send the true point  $x_i$  to the set  $\hat{X}_j$ , and send  $i$  to the index set  $I_j$ . In fact, for all  $j$  including  $j = 0$ , we may define  $\hat{X}_j$  to be the set  $\{x_i : i \in I_j\}$ . Note that  $\hat{X}_j$  is a full partition of the dataset  $X$ . For each  $j \geq 1$ , we will define the region  $R_j$  as the ball of radius  $O(\rho \cdot S)$  around  $f_j$ .
For each  $0 \leq j \leq \alpha \cdot k$ , we let  $\hat{n}_j$  be the number of indices in  $I_j$ . Note that this equals the number of points mapped to  $\hat{X}_j$ . If  $\hat{n}_j < T$  for some parameter  $T$ , then we define  $\tilde{X}_j$  to be the corresponding points  $\{\tilde{x}_i : i \in I_j\}$ . Otherwise, we apply the private semi-coreset algorithm from [70] to find a private semi-coreset  $\tilde{X}_j$  of the dataset  $\hat{X}_j$ , with respect to the ball  $B(f_j, \rho \cdot O(S / \gamma))$  for some parameter  $\gamma < 1$ . Finally, we will merge all the semi-coresets  $\tilde{X}_j$  together, which includes  $\tilde{X}_0$  defined in the previous paragraph, to obtain  $\tilde{X}$ . Finally, we may apply any  $O(1)$ -approximate (non-private) clustering to  $\tilde{X}$ .
We provide pseudocode for the algorithm, in Algorithm 1.
In this section, we study the empirical approximation of our  $\rho$ -dist-DP  $k$ -means clustering algorithm.
Datasets. We evaluate our algorithm on 6 well-known public datasets brightkite  $(51406\times 2)$ , gowalla  $(107092\times 2)$ , shuttle  $(58000\times 10)$ , skin [12]  $(245057\times 4)$ , rangequeries [67]  $(200000\times 6)$  and  $s$ -sets [42]  $(5000\times 2)$ , where brightkite and gowalla are datasets of geographic locations (latitude and longitude) of users and can be found in Stanford Large Network Dataset Collection (SNAP) [54], shuttle, skin and rangequeries are non-geographic datasets and can be found on UCI Repository [29],
and s-sets is another non-geographic dataset and can be found in the clustering benchmark dataset<sup>2</sup>. For each dataset, we preprocess it to make it fit into  $[-1, 1]^d$ . We refer readers to Appendix E for more details of the preprocessing steps.
Setup. We compare our algorithm described in Algorithm 1 in Section 5 with other three algorithms. We report the  $k$ -means cost of all algorithms. In all plots, the label of our algorithm is "dist-DP  $k$ -means". The three compared baseline algorithms are as follows.
1. Non-private baseline ( $k$ -means++): We compare our algorithm with the non-private  $k$ -means solver using  $k$ -means++ seeding implemented by Python scikit-learn package [66]. The output  $k$ -means cost of this baseline can be regarded as the groundtruth cost.
2. DP baseline (DP  $k$ -means): This is a  $k$ -means clustering algorithm in the standard DP setting implemented in part of a standard open-source DP library<sup>3</sup>.
3.  $\rho$ -Dist-DP baseline (dist-DP random points): Finally, we also compare with a natural  $\rho$ -dist-DP algorithm described as the following. We run non-private  $k$ -means solver on  $\tilde{X}$  described in Section 4. Since  $\tilde{X}$  is a  $\rho$ -dist-DP version of  $X$ , the output centers are  $\rho$ -dist-DP. Note that since the final solution of this baseline only depends on  $\tilde{X}$ , we assign the entire privacy budget  $(\varepsilon, \delta)$  to computing  $\tilde{X}$ .
In all experiments, we fix privacy parameters  $\varepsilon = 1$ ,  $\delta = 10^{-6}$ . These parameter setups are standard in many other DP papers as well. We evaluate our algorithms for different choices of the privacy parameter  $\rho$ . Note that the parameter  $\rho$  should not be determined by our algorithm. We try different  $\rho$  to show how the choice of  $\rho$  affects the clustering quality. We refer readers to Section 7 for more discussions of the choice of  $\rho$ .
We use the DP coreset implementation provided by the DP baseline for the purpose of the computation of semi-coreset  $\tilde{X}_j$  described in Section 5.
Our Results. We run all algorithms for  $k = 4,6,8,12,16$ . For each experiment, we repeat 10 times and report the mean and the standard error. In the experiments shown in Figure 1, we fix  $\rho = 0.05^4$ . As shown, the  $k$ -means cost of our dist-DP  $k$ -means algorithm is always smaller than the cost of DP
2https://cs.joensuu.fi/sipu/datasets/.
<sup>3</sup>https://ai.googleblog.com/2021/10/practical-differentially-private.html.
<sup>4</sup>We show advantages of our clustering for an example  $\rho$  which neither depends on our algorithm nor be optimized. An example of the privacy guarantee of  $\rho = 0.05$ : For geographic (latitude and longitude) datasets (e.g., brightkite, gowalla), an attacker is hard to distinguish whether a user was in New York or in Toronto.
$k$ -means baseline and is only slightly worse than the non-DP baseline which is as expected. The dist-DP baseline introduces a large  $k$ -means cost which implies that our partitioning strategies described in Section 4 and Section 5 are indeed necessary and can improve the clustering quality significantly in practice. Finally, we fix  $k = 8$  and investigate how the changes of  $\rho$  affect the  $k$ -means cost of our dist-DP  $k$ -means algorithm. We run our algorithm on all datasets for  $\rho = 1, 0.08, 0.008, 0.0001$ . As shown in Figure 2, the  $k$ -means cost of our algorithm decreases as  $\rho$  decreases, which is as expected. For running time, though we did not optimize our implementation, each algorithm runs within at most a few minutes in a single thread mode.
In summary, for a reasonable range of  $\rho$ , we significantly outperform previous DP  $k$ -means algorithms, whereas more naive distance-based DP algorithms perform far worse. In addition, we have comparable approximation guarantees even to the non-private  $k$ -means algorithm.
7 Limitations and Open Problems
In this work, we propose efficient  $(\varepsilon, \delta, \rho)$ -dist-DP algorithms for  $k$ -means and  $k$ -median problems for any given privacy parameters  $\varepsilon, \delta, \rho$ . However, the choices of  $\varepsilon, \delta$  and  $\rho$  remain open. Notice that these privacy parameters should not be determined by our algorithm, but rather by legal teams, policy makers, or other experts for different specific scenarios. This is an expert determination that is outside of the scope of this paper but has been studied by practitioners extensively.
In proving Theorem 1.1, we obtain an additive error proportional to  $k^2 \cdot \rho^2$  (ignoring polynomial factors in  $d$  and logarithmic factors in the other parameters - see Theorem C.1), whereas the work of [61] has dependence  $k \cdot \Lambda^2$ . This is because to improve the dependence on  $\Lambda$  to a dependence on  $\rho$ , we end up partitioning the data into roughly  $k$  regions and must apply a separate private  $k$ -means algorithm on each region, which increases the additive dependence on  $k$ . Hence, a natural open question is whether one can improve the additive error's dependence on  $k$ .
Acknowledgements: SN is supported by a NSF Graduate Fellowship (Grant No. 1745302) and a Google PhD Fellowship.
[67] Fotis Savva, Christos Anagnostopoulos, and Peter Triantafillou. Explaining aggregates for exploratory analytics. In 2018 IEEE International Conference on Big Data (Big Data), pages 478-487. IEEE, 2018.
[68] Stephen Shankland. How google tricks itself to protect chrome user privacy. CNET, October, 2014.
[69] Uri Stemmer. Locally private k-means clustering. In Symposium on Discrete Algorithms (SODA), pages 548-559, 2020.
[70] Uri Stemmer and Haim Kaplan. Differentially private k-means with constant multiplicative error. In Advances in Neural Information Processing Systems, pages 5436-5446, 2018.
[71] Dong Su, Jianneng Cao, Ninghui Li, Elisa Bertino, and Hongxia Jin. Differentially private k-means clustering. In Proceedings of the sixth ACM conference on data and application security and privacy, pages 26-37, 2016.
[72] Salil Vadhan. The Complexity of Differential Privacy, pages 347-450. Springer International Publishing, 2017.
[73] Yining Wang, Yu-Xiang Wang, and Aarti Singh. Differentially private subspace clustering. Advances in Neural Information Processing Systems, 28, 2015.
[74] Zhibo Wang, Jiahui Hu, Ruizhao Lv, Jian Wei, Qian Wang, Dejun Yang, and Hairong Qi. Personalized privacy-preserving task allocation for mobile crowdsensing. IEEE Transactions on Mobile Computing, 18(6):1330-1341, 2018.
In this section, we state some additional definitions and preliminary results that are of use.
We note one notation that we may abuse: for positive reals  $A, B$ , we say that  $C = A \pm B$  if  $C \in [A - B, A + B]$ . Likewise, we may say  $C = (1 \pm \gamma)B$  if  $C \in [(1 - \gamma)B, (1 + \gamma)B]$ .
A.1 Differential Privacy
In Section 2, we described the Laplace mechanism for approximating functions  $f: X \to \mathbb{R}$ .
Similar to the Laplace mechanism, there also exists the Gaussian mechanism, which is useful for high-dimensional functions  $f: X \to \mathbb{R}^d$ . We will state a simpler version that is sufficient for our purposes. Namely, a dataset consists of a single data point  $x$ , it is known that outputting  $\tilde{x} = x + \rho \cdot \frac{\sqrt{2\log(1.25 / \delta)}}{\varepsilon} \cdot \mathcal{N}(0, I)$  satisfies  $(\varepsilon, \delta, \rho)$ -dist-DP, where  $\mathcal{N}(0, I)$  represents a standard  $d$ -dimensional Gaussian. This implicitly follows from [32, Theorem 3.22]. As a result, we have the following basic proposition.
Proposition A.1. Let  $X = \{x_{1},\ldots ,x_{n}\}$  be a dataset of size  $n$ . Then, the dataset  $\{\tilde{x}_1,\dots ,\tilde{x}_n\}$ , where each  $\tilde{x}_i$  is i.i.d. drawn as  $x_{i} + \rho \cdot \frac{\sqrt{2\log(1.25 / \delta)}}{\varepsilon}\cdot \mathcal{N}(0,I)$ , is  $(\varepsilon ,\delta ,\rho)$ -dist-  $DP$ .
Next, we note two classic theorems regarding the privacy of composing private mechanisms (see, for instance, [32] or [72]). Note that these theorems hold for adaptive composition, which allows to run algorithms  $\mathcal{A}_1, \ldots, \mathcal{A}_k$  in sequence, where each  $\mathcal{A}_i$  is allowed to treat  $\mathcal{A}_1, \ldots, \mathcal{A}_{i-1}$  as a fixed public input to its algorithm.
Theorem A.2 (Basic Adaptive Composition). Let  $\mathcal{A}_1, \ldots, \mathcal{A}_k$  be adaptive mechanisms on a dataset  $X$  such that each  $\mathcal{A}_i$  is  $(\varepsilon_i, \delta_i)$ -differentially private as a function of  $X$ , assuming that the previous outputs  $\mathcal{A}_1, \ldots, \mathcal{A}_{i-1}$  are fixed. Then, the mechanism  $\mathcal{A}$  which concatenates the outputs of  $\mathcal{A}_1, \ldots, \mathcal{A}_k$  is  $(\sum \varepsilon_i, \sum \delta_i)$ -differentially private.
Likewise, if each  $\mathcal{A}_i$  were  $(\varepsilon_i,\delta_i,\rho)$ -dist-  $DP$ , the concatenated mechanism  $\mathcal{A}$  is  $(\sum \varepsilon_{i},\sum \delta_{i},\rho)$ -dist-  $DP$ .
Theorem A.3 (Advanced Adaptive Composition). Let  $\mathcal{A}_1, \ldots, \mathcal{A}_k$  be adaptive mechanisms on a dataset  $X$  such that each  $\mathcal{A}_i$  is  $(\varepsilon, \delta)$ -differentially private as a function of  $X$ , assuming that the previous outputs  $\mathcal{A}_1, \ldots, \mathcal{A}_{i-1}$  are fixed. Then, for any  $\delta' > 0$ , the mechanism  $\mathcal{A}$  which concatenates the outputs of  $\mathcal{A}_1, \ldots, \mathcal{A}_k$  is  $(\sqrt{2k\log\delta^{-1}} \cdot \varepsilon + k\varepsilon(e^{\varepsilon} - 1), k\delta + \delta')$ -differentially private.
Likewise, if each  $\mathcal{A}_i$  were  $(\varepsilon, \delta, \rho)$ -dist-  $DP$ , the concatenated mechanism  $\mathcal{A}$  is  $(\sqrt{2k\log\delta^{-1}} \cdot \varepsilon + k\varepsilon(e^{\varepsilon} - 1), k\delta + \delta', \rho)$ -dist-  $DP$ .
A.2 Clustering
In  $k$ -means or  $k$ -median clustering, given a dataset  $X \subset B(0, \Lambda)$  of size  $n$ , we recall that our goal is to efficiently find a set of points  $C$  such that  $\mathrm{cost}(X; C)$  is a good approximation to  $\mathrm{OPT}(X)$ . In general, we wish for purely multiplicative approximations, but due to the nature of private  $k$ -means (and  $k$ -median), we will additionally have a small additive approximation that is proportional to  $\Lambda^p$ . We now define approximate  $k$ -means/  $k$ -median solutions.
Definition A.4. Suppose we are given data  $X = \{x_{1},\ldots ,x_{n}\} \in \mathbb{R}^{d}$ , and implicit parameters  $\rho$  and  $k$ . Then, for any  $\beta \geq 1$ , we define a set  $C$  of size  $k$  to be a  $(\beta ,V)$ -approximate solution for  $X$  if  $\mathrm{cost}(X;C)\leq \beta \cdot \mathrm{OPT}(X) + V\cdot \rho^p$ .
We also define bicriteria solutions for  $k$ -means and  $k$ -median: here, we are allowed to use a larger dataset  $C$  that may have more than  $k$  points, but still compare to the optimal  $k$ -clustering.
Definition A.5. Suppose we are given data  $X = \{x_{1},\ldots ,x_{n}\} \in \mathbb{R}^{d}$ , and implicit parameters  $\rho$  and  $k$ . Then, for any  $\alpha ,\beta \geq 1$ , a set  $C$  is an  $(\alpha ,\beta ,V)$ -bicriteria approximate solution for  $X$  if  $|C|\leq \beta \cdot k$  and  $\mathrm{cost}(X;C)\leq \beta \cdot \mathrm{OPT}(X) + V\cdot \Lambda^p$ .
Finally, we define coresets and semi-coresets for  $k$ -means (or  $k$ -median) clustering. A coreset of a dataset  $X$ , roughly speaking, is a (usually smaller) dataset  $Y$  such that one can estimate a  $k$ -means
(or  $k$ -median) solution of  $X$  by computing the solution on  $Y$ . More precisely, we have the following definition.
Definition A.6. Given a dataset  $X = \{x_{1},\ldots ,x_{n}\}$  and some  $\gamma ,W\geq 0$ , a  $(\gamma ,W,\rho)$ -coreset for  $k$ -means (resp.,  $k$ -median) is a dataset  $\mathcal{V}$  such that for any subset  $C\subset \mathbb{R}^d$  of size  $k$ ,
$$
\frac {1}{1 + \gamma} \cdot \mathrm {c o s t} (Y, C) - W \cdot \rho^ {p} \leq \mathrm {c o s t} (Y; C) \leq (1 + \gamma) \cdot \mathrm {c o s t} (X, C) + W \cdot \rho^ {2},
$$
where  $p = 2$  (resp.,  $p = 1$ ). Likewise, a  $(\kappa, W, \rho)$ -semi-coreset (for  $\kappa, W \geq 0$ ) for  $k$ -means (resp.,  $k$ -median) is a dataset  $\mathcal{V}$  such that for any subset  $C \subset \mathbb{R}^d$  of size  $k$ ,
$$
\frac {1}{1 + \kappa} \cdot \mathrm {c o s t} (Y, C) - \kappa \cdot \mathrm {O P T} _ {k} (X) - W \cdot \rho^ {p} \leq \mathrm {c o s t} (Y; C) \leq (1 + \kappa) \cdot \mathrm {c o s t} (X, C) + \kappa \cdot \mathrm {O P T} _ {k} (X) + W \cdot \rho^ {2}.
$$
A.3 Randomly Shifted Grids
In our algorithms, we will make use of the Quadtree data structure which is composed of randomly shifted grids, which we now describe. This data structure has proven useful in various geometric settings beyond clustering, such as approximate near neighbor and computing other geometric quantities such as Earth-Mover distance and Minimum Spanning Tree cost.
Definition A.7. A randomly shifted Quadtree is constructed as follows. We start with a top level of some size  $\Lambda$  and let level 0 be a single grid cell, which is the  $d$ -dimensional hypercube  $[- \Lambda, \Lambda]^d$ . Next, we choose a uniformly random point  $\nu = (\nu_1, \ldots, \nu_d) \in [-\Lambda, \Lambda]^d$ , which will represent our shift vector. Now, for each level  $\ell \geq 1$ , we partition the region  $[- \Lambda, \Lambda]^d$  into grid cells of size  $\Lambda / 2^\ell$ , shifted by  $\nu$ . In other words, each cell is the form  $[\nu_1 + a_1 \cdot \Lambda / 2^\ell, \nu_1 + (a_1 + 1) \cdot \Lambda / 2^\ell] \times \dots \times [\nu_d + a_d \cdot \Lambda / 2^\ell, \nu_d + (a_d + 1) \cdot \Lambda / 2^\ell]$ , where  $a_1, \ldots, a_d \in \mathbb{Z}$ . We say that  $\Lambda / 2^\ell$  is the grid size at level  $\ell$ . (We remark that we may truncate some grid cells so that they do not escape  $[- \Lambda, \Lambda]^d$ .) We continue this for a finite number of levels, until we reach some bottom level.
We will utilize the following fact about Quadtrees, or more specifically the randomly shifted grid at some fixed level  $\ell$ .
Proposition A.8. (see Proof of Theorem B.1 in [25]) Given a randomly shifted grid of dimension  $20r \cdot d$ , a Euclidean ball of radius  $r$  (in  $\mathbb{R}^d$ ) is split into at most 2 pieces in expectation.
A.4 Private  $k$ -means
Finally, we note the result of [61] on differentially private  $k$ -means (and  $k$ -median) clustering.
Theorem A.9. [61] There exists a polynomial-time  $(\varepsilon, \delta)$ -DP algorithm that, given a set  $X = \{x_{1}, \ldots, x_{n}\}$  in a fixed ball of radius  $\Lambda$  in  $\mathbb{R}^d$ , outputs a set of  $k$  centers  $C = \{c_{1}, \ldots, c_{k}\}$  such that
$$
\operatorname {c o s t} (X; C) \leq O (1) \cdot \operatorname {O P T} _ {k} (X) + U \cdot \Lambda^ {p},
$$
where  $U = O\left(\frac{k\log^2n\log(1 / \delta) + k\sqrt{d\log(1 / \delta)}}{\varepsilon}\right)$ , and  $p = 2$  for  $k$ -means and  $p = 1$  for  $k$ -median.