SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
S _ {M} (y, i) = \left\{ \begin{array}{l l} 0 & \text {i f} M _ {y \to i} = 0 \\ \mathsf {U} & \text {i f} M _ {y \to i} = p _ {i} ^ {\max } = e ^ {\varepsilon} \cdot p _ {i} ^ {\min } \\ \mathsf {L} & \text {i f} M _ {y \to i} = p _ {i} ^ {\min } = e ^ {- \varepsilon} \cdot p _ {i} ^ {\max } \\ \mathsf {S} & \text {o t h e r w i s e .} \end{array} \right.
$$
We show that for any  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}^{(0)}$ , there exists another  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}$ , which satisfies certain nice properties, while not increasing the noisy label loss.
Claim 11. Suppose  $|\mathcal{Y}| \geq 2$ . For any  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}^{(0)}$  mapping to a finite set of output labels, there exists an  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}$  with output label sequence  $\hat{\mathcal{Y}} = (\hat{y}_i)_{i \in \mathcal{I}}$ , encoded by  $(M_{y \to i})_{y,i}$  such that the following hold:
$\triangleright \mathcal{G}(\mathcal{M}^0;P)\geq \mathcal{G}(\mathcal{M};P).$
Each column of  $S_{M}$  consists of only U's and L's, with at least one U and one L.
$\triangleright$  With row indices in  $\mathcal{V}$  sorted in increasing order from top to bottom, every non-zero column of  $S_{M}$  matches the regular expression  $\mathsf{L}^{*}\mathsf{U}^{+}\mathsf{L}^{*}$ . For each  $i\in \mathcal{I}$ , let  $\Phi_1(i)$  and  $\Phi_2(i)$  be the smallest and the largest  $y$  respectively for which  $S_{M}(y,i) = \mathsf{U}$ .
For all  $i < i'$  it holds that  $\Phi_1(i) \leq \Phi_1(i')$  and  $\Phi_2(i) \leq \Phi_2(i')$ , with at least one of the inequalities being strict.
Before we prove Claim 11, we prove Theorem 6 using it.
Proof of Theorem 6. If  $|\mathcal{Y}| = 1$ , then it is immediate that the optimal unbiased randomizer simply returns the unique value in  $\mathcal{Y}$  with probability 1. If  $|\mathcal{Y}| \geq 2$ , then for any optimal unbiased randomizer  $\mathcal{M}^{(0)}$ , we can apply Claim 11 to get another optimal unbiased randomizer  $\mathcal{M}$  that satisfies the stated conditions. Let  $\mathcal{I}_{\neq 0} \subseteq \mathcal{I}$  be the subsequence of all outputs for which  $M_{y \to i} \neq 0$  (for all  $y$ ). The sequence  $(\Phi_1(i), \Phi_2(i))$  ordered in increasing order of  $i \in \mathcal{I}_{\neq 0}$  is strictly increasing in the partial order  $\mathcal{Y} \times \mathcal{Y}$ , that is, at least one of  $\Phi_1(i)$  or  $\Phi_2(i)$  strictly increases from one  $i$  to next. It is easy to see that this can happen at most  $2|\mathcal{Y}|$  times, thereby concluding that  $|\mathcal{I}_{\neq 0}| \leq 2|\mathcal{Y}|$ .
To prove Claim 11, we perform several transformations to the given  $\varepsilon$ -DP randomizer  $\mathcal{M}^{(0)}$ , which is say encoded by  $M^{(0)} = (M_{y\rightarrow i}^{(0)})_{y,i}$  for some  $\hat{\mathcal{V}} = (\hat{y}_i)_{i\in \mathcal{I}}$ , such that the randomizer obtained in each step satisfies  $\mathbb{E}\mathcal{M}^{(r)}(y) = \mathbb{E}\mathcal{M}^{(r + 1)}(y)$  for all  $y\in \mathcal{V}$  and  $\mathcal{G}(\mathcal{M}^{(r)};P)\geq \mathcal{G}(\mathcal{M}^{(r + 1)};P)$ .
Combining columns with identical signatures. For convenience let  $k \coloneqq |\mathcal{Y}|$ . Let  $b_{j}$  be the  $k$ -dimensional binary vector corresponding to the binary representation of  $j$  for  $j \leq 2^{k} - 1$ . A matrix  $S^{(k)} \in \{1, e^{\varepsilon}\}^{k \times (2^{k} - 2)}$  is called a Staircase Pattern Matrix [KOV16] if the  $j$ th column of  $S^{(k)}$  is  $S_{j}^{(k)} = (e^{\varepsilon} - 1)b_{j} + 1$ , for  $j \in \{1, \ldots, 2^{k} - 2\}$ . For example,
$$
S ^ {(3)} = \left[ \begin{array}{c c c c c c} 1 & 1 & 1 & e ^ {\varepsilon} & e ^ {\varepsilon} & e ^ {\varepsilon} \\ 1 & e ^ {\varepsilon} & e ^ {\varepsilon} & 1 & 1 & e ^ {\varepsilon} \\ e ^ {\varepsilon} & 1 & e ^ {\varepsilon} & 1 & e ^ {\varepsilon} & 1 \end{array} \right]
$$
Since  $\mathcal{M}^{(0)}$  is  $\varepsilon$ -DP, we have that each column of  $M^{(0)}$ , namely  $(M_{y \to i}^{(0)})_{y \in \mathcal{Y}}$  is a conic combination of the columns of  $S^{(k)}$ .
Claim 12. Let  $\mathcal{M}^{(0)}$  be an  $\varepsilon$ -DP randomizer, mapping  $\mathcal{V}$  to a finite subset  $\hat{\mathcal{Y}}^{(0)}$  of  $\mathbb{R}$ . Then there exists an  $\varepsilon$ -DP randomizer  $\mathcal{M}^{(1)}$  mapping  $\mathcal{V}$  to  $\hat{\mathcal{Y}}^{(1)} \subseteq \mathbb{R}$  encoded by  $(M_{y \to \hat{y}})_{y \in \mathcal{Y}, \hat{y} \in \hat{\mathcal{Y}}^{(1)}}$  such that:
$\triangleright \mathcal{G}(\mathcal{M}^{(1)};\mathcal{P})\leq \mathcal{G}(\mathcal{M}^{(0)};\mathcal{P})$  for any convex loss  $g$
$\triangleright \mathbb{E}[\mathcal{M}^{(1)}(y)|y] = \mathbb{E}[\mathcal{M}^{(0)}(y)|y].$
$\triangleright |\hat{y} |\leq 2^{|\mathcal{Y}|}$
$\triangleright$  The vector  $(M_{y\rightarrow \hat{y}})_{y\in \mathcal{Y}}$  is a positive multiple of a staircase column, with the staircase column being unique for each  $\hat{y}\in \hat{\mathcal{V}}^{(1)}$
The proof idea of combining columns of staircase type to potentially decrease loss was shown in [KOV16].
Proof. By  $\varepsilon$ -DP constraint, the columns of  $M^{(0)}$  lie in the cone made by convex combinations of the rays  $\{c, c \cdot e^{\varepsilon}\}^{|\mathcal{Y}|}$  where  $c \geq 0$ . Because positive multiples of the staircase columns are specifically these rays, except the ray  $\{c\}^{|\mathcal{Y}|}$  which is already in the convex hull, this column of  $\mathcal{M}^{(0)}$  is a convex combination of positive multiples of the staircase columns.
Let  $v_{\hat{y}}$  be the columns of  $M^{(0)}$  indexed by  $\hat{\mathcal{V}}^{(0)}$ , which by the above can be written as:
$$
v _ {\hat {y}} = \sum_ {j = 1} ^ {2 ^ {k} - 2} c _ {\hat {y}} ^ {j} \cdot S _ {j} ^ {(k)}.
$$
Define for each  $j$ :
$$
C ^ {j} = \sum_ {\hat {y} \in \hat {y} ^ {0}} c _ {\hat {y}} ^ {j} \qquad \text {a n d} \qquad \hat {y} _ {j} = \frac {\sum_ {\hat {y} \in \hat {y} ^ {0}} \hat {y} \cdot c _ {\hat {y}} ^ {j}}{C ^ {j}}.
$$
Define  $M^{(1)}$  as being supported only at  $\hat{y}_j$  with the vector of probabilities being  $C^j \cdot S_j^{(k)}$ . We now prove  $M^{(1)}$  has all the desired properties.
(Defines a Mechanism):
$$
\sum_ {j = 1} ^ {2 ^ {k} - 2} C ^ {j} \cdot S _ {j} ^ {(k)} = \sum_ {j = 1} ^ {2 ^ {k} - 2} \left(\sum_ {\hat {y} \in \hat {\mathcal {Y}} ^ {0}} c _ {\hat {y}} ^ {j}\right) \cdot S _ {j} ^ {(k)} = \sum_ {\hat {y} \in \hat {\mathcal {Y}} ^ {0}} v _ {\hat {y}} = \overrightarrow {1}.
$$
$\triangleright$  (Does not increase loss): This follows by Jensen's inequality and the linearity of expectation:
$$
\mathcal {G} (\mathcal {M} ^ {(0)}; \mathcal {P}) = \sum_ {j = 1} ^ {2 ^ {k} - 2} \sum_ {y \in \mathcal {Y}} (S _ {j} ^ {(k)}) _ {y} \cdot \left(\sum_ {\hat {y}} g (\hat {y}, y) \cdot c _ {\hat {y}} ^ {j}\right) \geq \sum_ {j = 1} ^ {2 ^ {k} - 2} \sum_ {y \in \mathcal {Y}} (S _ {j} ^ {(k)}) _ {y} \cdot \left(g (\hat {y} _ {j}, y) \cdot C ^ {j}\right) = \mathcal {G} (\mathcal {M} ^ {(1)}; \mathcal {P}).
$$
$\triangleright$  (Expectation does not change): Because  $M^{(0)}$  is unbiased:
$$
\sum_ {\hat {y} \in \hat {\mathcal {Y}} ^ {0}} \hat {y} \cdot v _ {\hat {y}} = (y) _ {y \in \hat {Y}}.
$$
$$
\sum_ {j = 1} ^ {2 ^ {k} - 2} \hat {y} _ {j} \cdot C ^ {j} \cdot S _ {j} ^ {(k)} = (y) _ {y \in \hat {Y}},
$$
showing that  $M^{(1)}$  is unbiased.
$\triangleright$  (Bounded by  $2^{|\mathcal{V}|}$  and multiple of unique staircase columns): This is clear by construction.
While the finite case is easier to read, the above proof can be done also when the range of  $M^{(0)}$  is  $\mathbb{R}$  and  $v_{\hat{y}}$  is a vector of absolutely continuous probability distributions. The only change is that sums over  $\hat{y} \in \hat{\mathcal{Y}}^{(0)}$  become integrals. The projections of  $v_{\hat{y}}$  onto the staircase columns are continuous maps. Lastly, because a continuous function that is bounded by a function in  $L^1$  is itself in  $L^1$ , all the integrals become well-defined and finite. Therefore, our theorem regarding the structure of the optimal unbiased  $\varepsilon$ -DP mechanism does not depend on a finiteness condition.
Each row matches the pattern  $\mathsf{L}^{*}\mathsf{U}^{+}\mathsf{L}^{*}$ . We now use the ordering of the input and output labels as real numbers to make further deductions.
Claim 13. Suppose  $|\mathcal{Y}| \geq 2$ . For any  $\varepsilon$ -DP randomizer  $\mathcal{M}^{(1)}$  obtained via Claim 12, there exists an  $\varepsilon$ -DP randomizer  $\mathcal{M}^{(2)}$  mapping  $\mathcal{Y}$  to  $\hat{\mathcal{Y}} \subseteq \mathbb{R}$  encoded by  $M := (M_{y \to \hat{y}})_{y \in \mathcal{Y}, \hat{y} \in \hat{\mathcal{Y}}}$  such that:
$\triangleright \mathcal{G}(\mathcal{M}^{(2)};\mathcal{P})\leq \mathcal{G}(\mathcal{M}^{(1)};\mathcal{P})$  for any convex loss  $g$
$\triangleright \mathbb{E}[\mathcal{M}^{(2)}(y)|y] = \mathbb{E}[\mathcal{M}^{(1)}(y)|y],$
Every row of  $S_{M}$  matches the regular expression  $\mathsf{L}^{*}\mathsf{U}^{+}\mathsf{L}^{*}$ .
Proof. The only way a row of  $S_{M}$  does not match the regular expression  $\mathsf{L}^{*}\mathsf{U}^{+}\mathsf{L}^{*}$  is if (i) there is no U present, or (ii) if there is an L between an two U's. It is easy to see that (i) is not possible because  $\sum_{\hat{y}} M_{y \to i} = 1$  for all  $y \in \mathcal{V}$ , and if one row has no U's, this would imply no row has any U's, which is not possible by the uniqueness of the columns if  $|\mathcal{V}| \geq 2$ , and we know such an  $\mathcal{M}$  exists.
If (ii) is true, then we can construct  $\mathcal{M}^{(2)}$  as follows. For any  $y$  and  $\hat{y}_1 < \hat{y}_2 < \hat{y}_3$  such that  $S_{M^{(1)}}(y,\hat{y}_1) = S_{M^{(1)}}(y,\hat{y}_3) = \mathsf{U}$  and  $S_{M^{(1)}}(y,\hat{y}_2) = \mathsf{L}$ , consider a perturbation (for a small enough  $\eta >0$ ), where we set
$$
M _ {y \rightarrow \hat {y} _ {1}} ^ {(2)} = M _ {y \rightarrow \hat {y} _ {1}} ^ {(1)} - (y _ {3} - y _ {2}) \eta ,
$$
$$
M _ {y \rightarrow \hat {y} _ {2}} ^ {(2)} = M _ {y \rightarrow \hat {y} _ {2}} ^ {(1)} + (y _ {3} - y _ {1}) \eta ,
$$
$$
M _ {y \rightarrow \hat {y} _ {3}} ^ {(2)} = M _ {y \rightarrow \hat {y} _ {3}} ^ {(1)} - (y _ {2} - y _ {1}) \eta .
$$
This choice ensures that  $M^{(2)}$  remains an unbiased randomizer. By Jensen's inequality, due to convexity of  $g$ , it holds that  $\mathcal{G}(\mathcal{M}^{(2)}; P) < \mathcal{G}(\mathcal{M}^{(1)}; P)$ . We can keep repeating these steps, in addition to Claim 12 if necessary, till we arrive at  $\mathcal{M}^{(2)}$  such that each row of  $S_{M^{(2)}}$  matches the regular expression  $\mathsf{L}^*\mathsf{U}^+\mathsf{L}^*$ .
Set of U's in any row cannot be a subset of the set of U's in another, and are "moving forward".
Claim 14. For an  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}^{(2)}$  obtained via Claim 13, let  $T(y) \subseteq \hat{\mathcal{V}}$  be defined as  $T(y) := \{\hat{y}: S_M(y, \hat{y}) = \mathsf{U}\}$ . Then, for all  $y \neq y'$ , it holds that  $T(y) \not\subset T(y')$ , and moreover if  $y < y'$ , then  $\min T(y) < \min T(y')$  and  $\max T(y) < \max T(y')$ .
Proof. If  $T(y) \subset T(y')$ , then it holds that  $M_{y \to \hat{y}} \leq M_{y' \to \hat{y}}$  with the inequality being strict for some  $\hat{y}$ . Thus, we have  $\sum_{\hat{y}} M_{y \to \hat{y}} < \sum_{\hat{y}} M_{y' \to \hat{y}} = 1$ , which is a contradiction.
Given that both  $T(y)$  and  $T(y')$  are contiguous subsets of  $\hat{\mathcal{V}}$ , it follows that one of the following holds:
$\triangleright \min T(y) <   \min T(y^{\prime})$  and  $\max T(y) <   \max T(y^{\prime})$  , or
$\triangleright \min T(y) > \min T(y')$  and  $\max T(y) > \max T(y')$ .
However, if  $y < y'$ , the latter is not possible because in that case, we would have  $y' = \mathbb{E}_{\hat{y} \sim \mathcal{M}^{(2)}}(y') < \mathbb{E}_{\hat{y} \sim \mathcal{M}^{(2)}}(y) = y$ , which is a contradiction.
Putting together the claims. Finally, we put together Claims 12 to 14 to prove Claim 11.
Proof of Claim 11. Given any  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}$ , we apply Claims 12 and 13 to obtain the  $\varepsilon$ -DP unbiased randomizer  $\mathcal{M}^{(2)}$ , which satisfies the conditions in Claim 14. Consider the signature matrix  $S_M$  corresponding to  $\mathcal{M}^{(2)}$ , with the row indices sorted in increasing order of  $\mathcal{V}$ .
If a column has a signature with an L between two U's, this would contradict Claim 14, since the U's only "move forward".
Additionally, for the signatures of column  $\hat{y}_1 < \hat{y}_2$ , the first U of column  $\hat{y}_2$  cannot come before the first U of column  $\hat{y}_1$ , as this would also contradict the claim of the U's moving forward. Similarly, the last U of column  $\hat{y}_1$  cannot come after the last U of column  $\hat{y}_2$ . Finally, the columns must be unique, since each column is a unique staircase matrix vector. Thus, each column of  $S_M$  matches the regular expression  $\mathsf{L}^*\mathsf{U}^+\mathsf{L}^*$ .
C Optimal Unbiased Randomizers with Approximate Prior
We elaborate on the approach of splitting privacy budget for estimating the prior and for generating noisy labels as described in Section 3.
To privately estimate the prior, we use the Laplace mechanism. The Laplace distribution with scale parameter  $b$ , denoted by  $\mathrm{Lap}(b)$ , is the distribution supported on  $\mathbb{R}$  whose probability density function is  $\frac{1}{2b}\exp (-|x| / b)$ . The Laplace mechanism is presented in Algorithm 4.
It is well-known (e.g., [DMNS06]) that this mechanism satisfies  $\varepsilon$ -DP. It is also well-known that this yields an approximation of the true distribution up to small total variation distance (e.g., [DHS15]).
In  $\mathrm{[GKK^{+}23]}$ , it is argued that the best choice of  $(\varepsilon_{1},\varepsilon_{2})$  that minimizes the excess noisy label loss achieved by randomizer computed in Algorithm 3 over the optimal unbiased randomizer computed using the true prior and privacy parameter  $\varepsilon$ , is given as  $\varepsilon_{1} = \sqrt{k / n}$ . (We follow the same budget splitting method in our experiments.)
Algorithm 4 Laplace Mechanism for Estimating Probability Distribution  $\mathcal{M}_{\varepsilon}^{\mathrm{Lap}}$
Output: A probability distribution  $P^{\prime}$  over  $\mathcal{V}$ .
for  $y\in \mathcal{V}$  do
$h_y\gets$  number of  $i$  such that  $y_{i} = y$
$h_y^\prime \gets \max \{h_y + \mathrm{Lap}(2 / \varepsilon),0\}$
return Distribution  $P^{\prime}$  over  $\mathcal{V}$  such that  $p_y^\prime = \frac{h_y^\prime}{\sum_{y\in\mathcal{Y}}h_y^\prime}$
D Excess Loss of SGD with Biased Gradient Oracles
Consider a convex objective  $\mathcal{L}(\cdot)$  over  $\mathbb{R}^D$ , for which we have a gradient oracle, that given  $w$ , returns a stochastic estimate  $g(w)$  of  $\nabla \mathcal{L}(w)$ . We say that the gradient oracle has bias  $\alpha$  and variance  $\sigma^2$  if  $g(w) = \nabla \mathcal{L}(w) + \zeta(w)$  such that  $\| \mathbb{E}\zeta(w) \| \leq \alpha$  and  $\mathbb{E}\|\zeta(w) - \mathbb{E}\zeta(w)\|^2 \leq \sigma^2$  holds for all  $w$ . When optimizing over a convex set  $\mathcal{K} \subseteq \mathbb{R}^D$ , projected GD with step size  $\eta$  is defined as iteratively performing  $w_{t+1} \gets \Pi_{\mathcal{K}}(w_t - \eta g(w_t))$ , where  $\Pi_{\mathcal{K}}(\cdot)$  is the projection onto  $\mathcal{K}$ . We recall the following guarantee on the expected excess loss using a standard analysis (see [Haz22]).
Lemma 15. For a  $L$ -Lipschitz loss function, and a gradient oracle with bias  $\alpha$  and variance  $\sigma^2$ , projected  $GD$  over a set  $\mathcal{K}$  with diameter  $R$ , with step size  $\eta = \frac{R}{\sqrt{((L + \alpha)^2 + \sigma^2)T}}$  achieves
$$
\mathbb {E} \left[ \mathcal {L} \left(\frac {1}{T} \sum_ {i = 1} ^ {T} w _ {i}\right) \right] - \mathcal {L} (w ^ {*}) \leq \frac {R L}{\sqrt {T}} \cdot \sqrt {1 + \frac {2 \alpha}{L} + \frac {\alpha^ {2} + \sigma^ {2}}{L ^ {2}}} + \alpha R.
$$
In particular, if  $\alpha = 0$ , we get
$$
\mathbb {E} \left[ \mathcal {L} \left(\frac {1}{T} \sum_ {i = 1} ^ {T} w _ {i}\right) \right] - \mathcal {L} (w ^ {*}) \leq \frac {R L}{\sqrt {T}} \cdot \sqrt {1 + \frac {\sigma^ {2}}{L ^ {2}}}.
$$
The dependence on the bias is essentially tight, for any first order method. Consider the loss function  $\mathcal{L}(w) = \frac{1}{2}\alpha w$  defined over the domain  $\mathcal{K} = [0,R]$ . However, if the gradient oracle is allowed to have a bias of magnitude  $\alpha$ , it is impossible using any first order algorithm to distinguish between the gradients of  $\mathcal{L}$  and that of  $\mathcal{L}'(w) := -\frac{1}{2}\alpha w$ . Note that both  $\mathcal{L}$  and  $\mathcal{L}'$  are  $L$ -Lipschitz for  $L \geq \frac{1}{2}\alpha$ . While  $\mathcal{L}$  is minimized at  $w = 0$ ,  $\mathcal{L}'$  is minimized at  $w = R$ . For any  $w \in \mathcal{K}$ ,  $\min \{\mathcal{L}(w) - \mathcal{L}(0), \mathcal{L}'(w) - \mathcal{L}'(R)\} \geq \frac{1}{4}\alpha R$ .
Thus, with access to gradients with bias  $\alpha$ , it is impossible for any first order method to achieve an excess loss that is smaller than  $\Omega (\alpha R)$ , whereas, with access to gradients with zero bias and variance  $\sigma^2$ , it is possible to achieve an arbitrarily small excess loss using sufficient number of steps of SGD.
E Noisy Label Loss Bound from Discretization
Here we prove Lemma 8, restated below for convenience.
Lemma 8. Let  $\mathcal{M}$  be the optimal unbiased randomizer with  $\hat{\mathcal{V}} = [L,U]$ , and let  $\mathcal{M}_{\Delta}$  be the optimal unbiased randomizer with  $\hat{\mathcal{V}} = \{L,L + \Delta ,\dots ,U - \Delta ,U\}$ . If  $g(\hat{y},y)$  is  $K$ -Lipschitz in  $\hat{y}$ , then  $\mathcal{G}(\mathcal{M}_{\Delta};\mathcal{P})\leq \mathcal{G}(\mathcal{M};\mathcal{P}) + K\Delta$
Proof. Given any unbiased mechanism  $\mathcal{M}$ , we construct a mechanism  $\mathcal{M}_u$  supported on  $\hat{\mathcal{Y}}' := \{L, L + \Delta, \dots, U - \Delta, U\}$  by applying "unbiased randomized rounding"  $\mathsf{URR}_{\hat{\mathcal{Y}}'}$  to the output of  $\mathcal{M}$ , i.e.,  $\mathcal{M}_u(y) := \mathsf{URR}_{\hat{\mathcal{Y}}'}(\mathcal{M}(y))$ .
For any  $\hat{y} \in [L, U]$  such that  $\hat{y}_1 \leq \hat{y} \leq \hat{y}_2$  for  $\hat{y}_1, \hat{y}_2$  being consecutive elements of  $\hat{\mathcal{V}}'$ ,  $\mathrm{URR}_{\hat{\mathcal{V}}'}(y)$  returns  $\hat{y}'$  drawn as  $\hat{y}_1$  with probability  $\frac{\hat{y}_2 - \hat{y}}{\hat{y}_2 - \hat{y}_1}$  and  $\hat{y}_2$  with probability  $\frac{\hat{y} - \hat{y}_1}{\hat{y}_2 - \hat{y}_1}$ . Observe that  $\mathbb{E}[\mathrm{URR}_{\hat{\mathcal{V}}'}(\hat{y})] = \hat{y}$  and  $|\mathrm{URR}_{\hat{\mathcal{V}}'}(\hat{y}) - \hat{y}| \leq \Delta$  with probability 1.
Thus, we have that  $\mathbb{E}[\mathcal{M}_u(y)] = \mathbb{E}[\mathsf{URR}_{\hat{y}'}(\mathcal{M}(y))] = \mathbb{E}[\mathcal{M}(y)] = y$ , and hence  $\mathcal{M}_u$  is also unbiased. Moreover,
$$
\begin{array}{l} \mathcal{G}(\mathcal{M}_{u};P) = \underset { \begin{array}{c}y\sim \mathcal{P}\\ \hat{y}^{\prime}\sim \mathcal{M}_{u}(y) \end{array} }{\mathbb{E}}[g(\hat{y}^{\prime},y)] = \underset { \begin{array}{c}y\sim \mathcal{P}\\ \hat{y}\sim \mathcal{M}(y)\\ \hat{y}^{\prime}\sim \mathrm{URR}_{\hat{y}^{\prime}}(\hat{y}) \end{array} }{\mathbb{E}}[g(\hat{y}^{\prime},y)] \\ \leq \underset { \begin{array}{c} \hat {y} \sim \mathcal {M} (y) \\ \hat {y} ^ {\prime} \sim \mathrm {U R R} _ {\hat {y} ^ {\prime}} (\hat {y}) \end{array} } {\mathbb {E}} \left[ g (\hat {y}, y) + K | \hat {y} ^ {\prime} - \hat {y} | \right] = \mathcal {G} (\mathcal {M}; P) + K \Delta , \\ \end{array}
$$
where the last line follows from  $K$ -Lipschitzness of  $g$ . Since  $\mathcal{M}_{\Delta}$  is the optimal unbiased randomizer with output labels  $\hat{\mathcal{V}}'$ , we have that  $\mathcal{G}(\mathcal{M}_{\Delta}; \mathcal{P}) \leq \mathcal{G}(\mathcal{M}_u; \mathcal{P}) \leq \mathcal{G}(\mathcal{M}; \mathcal{P}) + K\Delta$ .
F DP Mechanisms Definitions
In this section, we recall the definition of various DP notions that we use throughout the paper.
Definition 16 (Global Sensitivity). Let  $f$  be a function taking as input a dataset and returning as output a vector in  $\mathbb{R}^d$ . Then, the global sensitivity  $\Delta(f)$  of  $f$  is defined as the maximum, over all pairs  $(X, X')$  of adjacent datasets, of  $||f(X) - f(X')||_1$ .
The (discrete) Laplace distribution with scale parameter  $b > 0$  is denoted by  $\mathrm{D}\mathrm{Lap}(b)$ . Its probability mass function is given by  $p(y) \propto \exp (-|y| / b)$  for any  $y \in \mathbb{Z}$ .
Definition 17 (Discrete Laplace Mechanism). Let  $f$  be a function taking as input a dataset  $X$  and returning as output a vector in  $\mathbb{Z}^d$ . The discrete Laplace mechanism applied to  $f$  on input  $X$  returns  $f(X) + (Y_1, \ldots, Y_d)$  where each  $Y_i$  is sampled i.i.d. from  $\mathrm{D}\mathrm{Lap}(\Delta(f)/\varepsilon)$ . The output of the mechanism is  $\varepsilon$ -DP.
Next, recall that the (continuous) Laplace distribution  $\mathrm{Lap}(b)$  with scale parameter  $b > 0$  has probability density function given by  $h(y) \propto \exp(-|y|/b)$  for any  $y \in \mathbb{R}$ .
Definition 18 (Continuous Laplace Mechanism, [DMNS06]). Let  $f$  be a function taking as input a dataset  $X$  and returning as output a vector in  $\mathbb{R}^d$ . The continuous Laplace mechanism applied to  $f$  on input  $X$  returns  $f(X) + (Y_1, \ldots, Y_d)$  where each  $Y_i$  is sampled i.i.d. from  $\mathrm{Lap}(\Delta(f) / \varepsilon)$ . The output of the mechanism is  $\varepsilon$ -DP.
We next define the discrete and continuous versions of the staircase mechanism [GV14].
Definition 19 (Discrete Staircase Distribution). Fix  $\Delta \geq 2$ . The discrete staircase distribution is parameterized by an integer  $1 \leq r \leq \Delta$  and has probability mass function given by:
$$
p _ {r} (i) = \left\{ \begin{array}{l l} a (r) & \text {f o r} 0 \leq i <   r, \\ e ^ {- \varepsilon} a (r) & \text {f o r} r \leq i <   \Delta \\ e ^ {- k \varepsilon} p _ {r} (i - k \Delta) & \text {f o r} k \Delta \leq i <   (k + 1) \Delta \text {a n d} k \in \mathbb {N} \\ p _ {r} (- i) \text {f o r} i <   0, \end{array} \right. \tag {3}
$$
$$
a (r) = := \frac {1 - b}{2 r + 2 b (\Delta - r) - (1 - b)}.
$$
Let  $f$  be a function taking as input a dataset  $X$  and returning as output a scalar in  $\mathbb{Z}$ . The discrete staircase mechanism applied to  $f$  on input  $X$  returns  $f(X) + Y$  where  $Y$  is sampled from the discrete staircase distribution given in (3).
Definition 20 (Continuous Staircase Distribution). The continuous staircase distribution is parameterized by  $\gamma \in (0,1)$  and has probability density function given by:
$$
h _ {\gamma} (x) = \left\{ \begin{array}{l l} a (\gamma) & \text {f o r} x \in [ 0, \gamma \Delta) \\ e ^ {- \varepsilon} a (\gamma) & \text {f o r} x \in [ \gamma \Delta , \Delta) \\ e ^ {- k \varepsilon} h _ {\gamma} (x - k \Delta) & \text {f o r} x \in [ k \Delta , (k + 1) \Delta) \text {a n d} k \in \mathbb {N} \\ h _ {\gamma} (- x) \text {f o r} x <   0, \end{array} \right. \tag {4}
$$
$$
a (\gamma) = := \frac {1 - e ^ {- \varepsilon}}{2 \Delta (\gamma + e ^ {- \varepsilon} (1 - \gamma)}.
$$
Let  $f$  be a function taking as input a dataset  $X$  and returning as output a scalar in  $\mathbb{R}$ . The continuous staircase mechanism applied to  $f$  on input  $X$  returns  $f(X) + Y$  where  $Y$  is sampled from the continuous staircase distribution given in (4).
Definition 21 (Randomized Response, [War65]). Let  $\varepsilon \geq 0$ , and  $q$  be a positive integer. The randomized response mechanism with parameters  $\varepsilon$  and  $q$  (denoted by  $\mathsf{RR}_{\varepsilon,q}$ ) takes as input  $y \in \{1,\ldots,q\}$  and returns  $\hat{y} \sim \hat{Y}$ , where the random variable  $\hat{Y}$  is distributed as:
$$
\Pr [ \hat {y} = \hat {y} ] = \left\{ \begin{array}{l l} \frac {e ^ {\varepsilon}}{e ^ {\varepsilon} + q - 1} & \text {f o r} \hat {y} = y \\ \frac {1}{e ^ {\varepsilon} + q - 1} & \text {o t h e r w i s e .} \end{array} \right. \tag {5}
$$
The output of  $\mathsf{RR}_{\varepsilon ,q}$  is  $\varepsilon$  -DP.