SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Observe that when Algorithm HypothesisLearner does not fail,  $r_x$  (and hence  $h(x)$ ) is chosen with equal probability among  $(h_1(x), h_2(x), \ldots, h_R(x))$  and hence  $\mathbb{E}_{\theta}[e_h(x)] = \mathbb{E}_{i \in_{R[R]} [e_{h_i}(x)]}$  where  $\theta$  denotes the randomness of HypothesisLearner. We get:
$$
\begin{array}{l} \mathbb {E} _ {\theta} \left[ \operatorname {e r r o r} _ {\mathcal {D}} (c, h) \right] = \mathbb {E} _ {\theta} \mathbb {E} _ {x \sim \mathcal {D}} \left[ e _ {h} (x) \right] = \mathbb {E} _ {x \sim \mathcal {D}} \mathbb {E} _ {\theta} \left[ e _ {h} (x) \right] \\ = \mathbb {E} _ {x \sim \mathcal {D}} \mathbb {E} _ {i \in R [ R ]} \left[ e _ {h _ {i}} (x) \right] = \mathbb {E} _ {i \in R [ R ]} \mathbb {E} _ {x \sim \mathcal {D}} \left[ e _ {h _ {i}} (x) \right] \\ \leq \mathbb {E} _ {i \sim \mathcal {R}} [ \alpha ] = \alpha . \\ \end{array}
$$
By Markov inequality, we have  $\operatorname{Pr}_{\theta}[\operatorname{error}_{\mathcal{D}}(c,h) \geq 8\alpha] \leq 1/8$ . The claim follows noting that Algorithm HypothesisLearner fails with probability at most  $\beta \leq 1/8$ .
The second part of the transformation is Algorithm AccuracyBoost that applies Algorithm HypothesisLearner  $O(\log(1/\beta))$  times to obtain with high probability a hypothesis with  $O(\alpha)$  error.
Algorithm AccuracyBoost
Parameters:  $\beta, R = 104\ln \frac{1}{\beta}$
Input:  $R$  labeled samples with  $n$  examples each  $(S_{1},\ldots ,S_{R})$  where  $S_{i}\in (X\times \{0,1\})^{n}$
1. for  $i = 1,2\ldots R$
(a) execute  $\mathcal{A}(S_i)$  to obtain a hypothesis sequence  $\{h_r^i\}_{r\geq 0}$
(b) execute Algorithm WeakHypothesisLearner on  $\{h_r^i\}_{r\geq 0}$  to obtain hypothesis  $h^i$
2. construct the hypothesis  $\hat{h}$ , where  $\hat{h}(x) = \max(h^1(x), \ldots, h^R(x))$ .
Claim B.2. With probability  $1 - \beta$ , Algorithm AccuracyBoost output a  $24\alpha$ -good hypothesis over distribution  $\mathcal{D}$ .
Proof. Define  $B_{i}$  to be the event where the sequence of hypotheses  $\{h_r^i\}_{r\geq 0}$  produced in Step 1a of AccuracyBoost does not satisfy Equation 1. We have,
$$
\Pr \left[ \operatorname {e r r o r} _ {\mathcal {D}} (c, h _ {i}) > 8 \alpha \right] \leq \Pr [ B ] + (1 - \Pr [ B ]) \cdot \Pr \left[ \operatorname {e r r o r} _ {\mathcal {D}} (c, h) > 8 \alpha \right] \leq \beta + 1 / 4 <   3 / 8.
$$
Hence, by the Chernoff bound, when  $R \geq 104\ln \frac{1}{\beta}$ , we have at least  $7R/8$  hypotheses are  $8\alpha$ -good over distribution  $\mathcal{D}$ . Consider the worst case, in which  $R/8$  hypotheses always output wrong labels. To output a wrong label of  $x$ , we require at least  $3R/8$  hypotheses to output wrong labels. Thus  $h$  is  $24\alpha$ -good over distribution  $\mathcal{D}$ .
C Tools from Prior Works
C.1 Algorithm LabelBoost [Beimel et al., 2021]
Algorithm LabelBoost [Beimel et al., 2021]
Parameters: A concept class  $C$ .
Input: A partially labeled database  $S \circ T \in (X \times \{0, 1, \bot\})^*$ .
$\%$  We assume that the first portion of the database (denoted  $S$ ) contains labeled examples.
The algorithm outputs a similar database where both  $S$  and  $T$  are (re)labeled.
1. Initialize  $H = \emptyset$
2. Let  $P = \{p_1, \dots, p_\ell\}$  be the set of all points  $p \in X$  appearing at least once in  $S \circ T$ . Let  $\Pi_C(P) = \{(c(p_1), \dots, c(p_\ell)): c \in C\}$  be the set of all dichotomies generated by  $C$  on  $P$ .
3. For every  $(z_{1},\ldots ,z_{\ell})\in \Pi_{C}(P)$ , add to  $H$  an arbitrary concept  $c\in C$  s.t.  $c(p_i) = z_i$  for every  $1\leq i\leq \ell$ .
4. Choose  $h \in H$  using the exponential mechanism with privacy parameter  $\epsilon = 1$ , solution set  $H$ , and the database  $S$ .
5. (Re)label  $S \circ T$  using  $h$ , and denote the resulting database  $(S \circ T)^h$ , that is, if  $S \circ T = (x_i, y_i)_{i=1}^t$  then  $(S \circ T)^h = (x_i, y_i')_{i=1}^t$  where  $y_i' = h(x_i)$ .
6. Output  $(S\circ T)^h$
Lemma C.1 (privacy of Algorithm LabelBoost [Beimel et al., 2021]). Let  $\mathcal{A}$  be an  $(\epsilon, \delta)$ -differentially private algorithm operating on partially labeled databases. Construct an algorithm  $\mathcal{B}$  that on input a partially labeled database  $S \circ T \in (X \times \{0, 1, \bot\})^*$  applies  $\mathcal{A}$  on the outcome of LabelBoos(S  $\circ T$ ). Then,  $\mathcal{B}$  is  $(\epsilon + 3, 4e\delta)$ -differentially private.
Consider an execution of LabelBoost on a database  $S \circ T$ , and assume that the examples in  $S$  are labeled by some target concept  $c \in C$ . Recall that for every possible labeling  $\vec{z}$  of the elements in  $S$  and in  $T$ , algorithm LabelBoost adds to  $H$  a hypothesis from  $C$  that agrees with  $\vec{z}$ . In particular,  $H$  contains a hypothesis that agrees with the target concept  $c$  on  $S$  (and on  $T$ ). That is,  $\exists f \in H$  s.t.  $error_S(f) = 0$ . Hence, the exponential mechanism (on Step 4) chooses (w.h.p.) a hypothesis  $h \in H$  s.t.  $error_S(h)$  is small, provided that  $|S|$  is roughly  $\log |H|$ , which is roughly  $\mathrm{VC}(C) \cdot \log(|S| + |T|)$  by Sauer's lemma. So, algorithm LabelBoost takes an input database where only a small portion of it is labeled, and returns a similar database in which the labeled portion grows exponentially.
Lemma C.2 (utility of Algorithm LabelBoost [Beimel et al., 2021]). Fix  $\alpha$  and  $\beta$ , and let  $S \circ T$  be s.t.  $S$  is labeled by some target concept  $c \in C$ , and s.t.
$$
| T | \leq \frac {\beta}{e} \mathrm {V C} (C) \exp \left(\frac {\alpha | S |}{2 \mathrm {V C} (C)}\right) - | S |.
$$
Consider the execution of LabelBoost on  $S \circ T$ , and let  $h$  denote the hypothesis chosen on Step 4. With probability at least  $(1 - \beta)$  we have that  $\text{error}_S(h) \leq \alpha$ .
D Some Technical Facts
We refer to the execution of steps 3a-3g of algorithm GenericBBL as a phase of the algorithm, indexed by  $i = 1,2,3,\ldots$ .
In GenericBBL, we require that the set of all predictions in the phase  $i$  is  $(1,\delta)$ -differentially private.
Claim D.1. For  $\delta < 1$ , the composited Laplace mechanism used in step 3c in the  $i$ -th iteration, is  $(1,\delta)$ -differentially private.
Proof. Let  $\varepsilon_{i}^{\prime},\delta_{i}^{\prime}$  be as in Step 3c. Since  $e^{\varepsilon_i'} - 1 < 2\varepsilon_i'$  for  $0 < \varepsilon_i' < 1$ , we have
$$
\sqrt {2 R _ {i} \ln (\frac {1}{R _ {i} \delta_ {i} ^ {\prime}})} \cdot \varepsilon_ {i} ^ {\prime} + R _ {i} \varepsilon_ {i} ^ {\prime} (e ^ {\varepsilon_ {i} ^ {\prime}} - 1) \leq \sqrt {2 R _ {i} \ln (\frac {2}{\delta})} \cdot \varepsilon_ {i} ^ {\prime} + 2 R _ {i} \varepsilon_ {i} ^ {\prime 2} = \frac {\sqrt {2}}{3} + \frac {2}{9 \ln (\frac {2}{\delta})} \leq 1.
$$
The proof is concluded by using advanced composition (Theorem 2.6).
In step 3f, GenericBBL takes a random subset of size  $\lambda_{i + 1}T_{t + 1}$  from  $\hat{D}_i^{\prime}$ . We show that the size of  $\hat{D}_i^\prime$  is at least  $\lambda_{i + 1}T_{t + 1}$ .
Claim D.2. When  $\varepsilon \leq 1$ , for any  $i \geq 1$ , we always have  $|\hat{D}_i^{\prime}|\geq \lambda_{i + 1}T_{i + 1}$ .
Proof. Let  $m = 3 + \exp(\varepsilon + 4) < 200$ . By the step 3c, step 3e and step 3f,  $|\hat{D}_j| = \frac{\varepsilon |D_j|}{m} = \frac{12800 |S_j|}{m} \geq 64 |S_j| = 64 \lambda_j T_j$ . Then it is sufficient to verify  $128 \lambda_j T_j \geq \lambda_{j+1} T_{j+1}$
We can verify that
$$
4 \lambda_ {j} = 4 \cdot \frac {8 \mathrm {V C} (C) \log (\frac {1 3}{\alpha_ {i}}) + 4 \log (\frac {2}{\beta_ {i}})}{\alpha_ {i}} = 4 \cdot \frac {8 \mathrm {V C} (C) (\log (\frac {1 3}{\alpha_ {j + 1}}) - 1) + 4 (\log (\frac {2}{\beta_ {j + 1}}) - 1)}{2 \alpha_ {j + 1}} \geq \lambda_ {j + 1}
$$
$$
1 6 T _ {j} = \frac {1 6 \tau \cdot \lambda_ {i} \cdot \log (\frac {1}{\delta}) \cdot \log^ {2} (\frac {\lambda_ {i}}{\varepsilon \alpha_ {i} \beta_ {i} \delta})}{\varepsilon} \geq \frac {4 \tau \cdot \lambda_ {i + 1} \cdot \log (\frac {1}{\delta}) \cdot \log^ {2} (\frac {\lambda_ {i + 1}}{1 6 \varepsilon \alpha_ {i + 1} \beta_ {i + 1} \delta})}{\varepsilon} \geq T _ {j + 1}.
$$
The last inequality holds because  $\lambda_j \geq 4$  and  $\alpha_j, \beta_j \leq 1/2$ .
To apply the privacy and accuracy of LabelBoost, the sizes of the databases need to satisfy the inequalities in lemma C.2. We verify that in each phase, the sizes of the databases always satisfy the requirement.
Claim D.3. When  $\varepsilon \leq 1$ , for any  $i \geq 1$ , we have  $|\hat{D}_i| \leq \frac{\beta_i}{e} \mathrm{VC}(C) \exp \left( \frac{\alpha_i |\hat{S}_i|}{2 \mathrm{VC}(C)} \right) - |\hat{S}_i|$ .
Proof. By claim D.2, step 3c and step 3f,
$$
| \hat {D} _ {i} | = \frac {\varepsilon | D _ {i} |}{m} = O (\lambda_ {i} T _ {i}) = O \left(\mathrm {V C} (C) \log^ {2} (\mathrm {V C} (C)) \cdot \mathrm {p o l y} \left(\frac {1}{\alpha_ {i}}, \log (\frac {1}{\beta_ {i}}), \frac {1}{\varepsilon}, \log (\frac {1}{\delta})\right)\right)
$$
$$
\begin{array}{l} | \hat {S} _ {i} | = \frac {\varepsilon | S _ {i} |}{m} \\ = O \left(\varepsilon \lambda_ {i} T _ {i}\right) = O \left(\lambda_ {i} T _ {i}\right) \tag {2} \\ = O \left(\operatorname {V C} (C) \log^ {2} (\operatorname {V C} (C)) \cdot \operatorname {p o l y} \left(\frac {1}{\alpha_ {i}}, \log \left(\frac {1}{\beta_ {i}}\right), \frac {1}{\varepsilon}, \log \left(\frac {1}{\delta}\right)\right)\right). \\ \end{array}
$$
$$
\frac {\beta_ {i}}{e} \mathrm {V C} (C) \exp \left(\frac {\alpha_ {i} | \hat {S} _ {i} |}{2 \mathrm {V C} (C)}\right) = \Omega \left(\mathrm {V C} ^ {2} (C) \cdot \exp \left(\operatorname {p o l y} \left(\frac {1}{\alpha_ {i}}, \log \left(\frac {1}{\beta_ {i}}\right), \frac {1}{\varepsilon}, \log \left(\frac {1}{\delta}\right)\right)\right)\right),
$$
for  $T_{i} = \frac{\tau\cdot\lambda_{i}\cdot\log(\frac{1}{\delta})\cdot\log^{2}(\frac{\lambda_{j}}{\varepsilon\alpha_{i}\beta_{i}\delta})}{\varepsilon}$ , the inequality holds when  $\tau \geq 50$ .
E Accuracy of Algorithm GenericBBL - proof of Theorem 6.2
We give some technical facts in Appendix D. In Claim E.1, we show that in each phase, samples are labeled with high accuracy. In Claim E.3, we prove that algorithm GenericBBL fails with low probability. In Claim E.4, we prove that algorithm GenericBBL predict the labels with high accuracy.
Claim E.1. For each phase  $i$  we have
$$
\Pr \left[ \exists g _ {i} \in C s. t. \operatorname {e r r o r} _ {S _ {i}} (g) = 0 a n d \operatorname {e r r o r} _ {\mathcal {D}} (g _ {i}, c) \leq \sum_ {j = 1} ^ {i} \alpha_ {j} \right] \geq 1 - 2 \sum_ {j = 0} ^ {i} \beta_ {j}.
$$
Proof. The proof is by induction on  $i$ . The base case for  $i = 1$  is trivial, with  $g_{1} = c$ . Assume the claim holds for all  $j \leq i$ . By the properties of LabelBoost (Lemma C.2) and Claim D.3, with probability at least  $1 - \beta_{i}$  we have that  $S_{i}$  is labeled by a hypothesis  $g_{i} \in C$  s.t. error $_{S_{i-1}}(g_{i-1}, g_{i}) \leq \alpha_{i}$ . Observe that the points in  $S_{i}$  (without their labels) are chosen i.i.d. from  $\mathcal{D}$ , and hence, By Theorem A.2 (VC bounds) and  $|S_{i-1}| \geq 128\lambda_{i-1} \geq \lambda_{i}$ , with probability at least  $1 - \beta_{i}$  we have that error $_{\mathcal{D}}(g_{i}, g_{i-1}) \leq \alpha_{i}$ . Hence, with probability  $1 - 2\beta_{i}$ , we have error $_{\mathcal{D}}(g_{i}, g_{i-1}) \leq \alpha_{i}$ . Finally, by the triangle inequality, error $_{\mathcal{D}}(g_{i}, c) \leq \sum_{j=1}^{i} \alpha_{j}$ , except with probability  $2\sum_{j=1}^{i} \beta_{j}$
Combining claims E.1 union bound, we get:
Claim E.2. Let  $\mathcal{D}$  be an underlying distribution and let  $c\in C$  be a target concept. Then
$$
\Pr \left[ \forall i \exists g _ {i} \in C s. t. \operatorname {e r r o r} _ {S _ {i}} (g _ {i}) = 0 a n d \operatorname {e r r o r} _ {\mathcal {D}} (g _ {i}, c) \leq \alpha \right] \geq 1 - 2 \beta .
$$
For each phase  $i$ , if there exists a noise  $\eta_j \geq 1/16$  in step 3c, we say the phase  $i$  fails. Define the following good event.
Event  $E_{1}$ : Phase  $i$  doesn't fail for all  $i \geq 1$ .
Claim E.3. When  $\lambda \geq 1, \varepsilon \leq 1, \alpha \leq 1/2, \beta \leq 1/2, \delta \leq 1/2$ , event  $E_1$  occurs with probability at least  $1 - \beta$ .
Proof. In each phase  $i$ , For each  $\eta_j$ , by the property of Laplace distribution, we have  $\operatorname*{Pr}[|\eta| \geq 1/16] = e^{-T_i\varepsilon_i'/16} = e^{-\frac{T_i}{48\sqrt{R_i\ln(2/\delta)}}} \leq \beta_i / R_i$ . This inequality holds when  $\tau \geq 1$ . By union bound, we have  $\operatorname*{Pr}\{\text{phase } i \text{ fails}\} \leq \beta_i$ .
Using to union bound,
$$
\Pr [ \text {E v e n t} E _ {1} \text {o c c u r s} ] \geq 1 - \beta .
$$
Notations. Consider the  $i$ th phase of Algorithm GenericBBL, and focus on the  $j$ -th iteration of Step 3. Fix all of the randomness of noises. Now observe that the output on step 3(d)iii is a deterministic function of the input  $x_{i,j}$ . This defines a hypothesis which we denote as  $h_{i,j}$ .
Figure 2: Hypothesis  $h_{i,j}$
Claim E.4. For  $\beta < 1/16$ , with probability at least  $1 - 4\beta$ , all of the hypotheses defined above are  $4\alpha$ -good w.r.t.  $\mathcal{D}$  and  $c$ .
Proof. In the phase  $i$ , by Claim E.2, with probability at least  $1 - 2\beta$  we have that  $S_{i}$  is labeled by a hypothesis  $g_{i} \in C$  satisfying error  $\mathcal{D}(g_i, c) \leq \alpha$ . We continue with the analysis assuming that this is the case.
On step 3a of the  $i$ th phase we divide  $S_{i}$  into  $T_{i}$  subsamples of size  $\lambda_{i}$  each, identify a consistent hypothesis  $f_{t} \in C$  for every subsample  $S_{i,t}$ , and denote  $F_{i} = (f_{1},\dots,f_{T})$ . By Theorem A.2 (VC bounds), every hypothesis in  $F_{i}$  satisfies error  $\mathcal{D}(f_t,g_i) \leq \alpha$  with probability  $1 - \beta_{i}$ , in which case, by the triangle inequality we have that error  $\mathcal{D}(f_t,c) \leq 2\alpha$ .
Set  $T_{i} \geq \frac{512(1 - 4\beta_{i})\ln(\frac{1}{\beta_{i}})}{(1 - 64\beta_{i})^{2}}$ , using Chernoff bound, it holds that for at least  $15T_{i} / 16$  of the hypotheses in  $F_{i}$  have error error  $D(f_{t},c) \leq 2\alpha$  with probability at least  $1 - \beta_{i}$ .
By Claim E.3, with probability  $1 - \beta$ , all Laplace noises added in step 3d is less than  $\frac{T_i}{16}$ . Let  $m: X \to \{0,1\}$  defined as  $m(x) = \max_{f_t \in F_i} (f_t(x))$ . For  $m$  to err on a point  $x$  (w.r.t. the target concept  $c$ ), it must be that at least  $3/8$ -fraction of the  $2\alpha$ -good hypotheses in  $\hat{F}_i$  err on  $x$ . Consider the worst case in Figure 3, based on Claim E.3, we have error  $\mathcal{D}(m,c) \leq 4\alpha$  with probability  $1 - \beta$ .
Figure 3: The horizontal represents the input point. The vertical represents the hypothesis. The red parts represent the incorrect prediction. We let  $\frac{T_i}{16}$  hypothesis predict all labels incorrectly and let Laplace noises to be as large as  $\frac{T_i}{16}$ . To output an incorrect label, there must exist  $\frac{3T_i}{8}$  hypothesis output the incorrect label. In the worst case, at most  $4\alpha$  of points are incorrectly classified.
Conclude all above, with probability  $1 - 4\beta$ , all the hypotheses are  $4\alpha$ -good.
E.1 Privacy analysis - proof of Claim 6.3
Fix  $t \in \mathbb{N}$  and the adversary  $\mathcal{B}$ . We need to show that  $\mathrm{View}_{\mathcal{B},t}^0$  and  $\mathrm{View}_{\mathcal{B},t}^1$  (defined in Figure 1) are  $(\varepsilon, \delta)$ -indistinguishable. We will consider separately the case where the executions differ in the training phase (Claim E.5) and the case where the difference occurs during the prediction phase (Claim E.6).
Privacy of the initial training set  $S$ . Let  $S^0, S^1 \in (X \times \{0, 1\})^n$  be neighboring datasets of labeled examples and let  $\mathrm{View}_{\mathcal{B},t}^0$  and  $\mathrm{View}_{\mathcal{B},t}^1$  be as in Figure 1 where  $\left((x_1^0, y_1^0), \ldots, (x_n^0, y_n^0)\right) = S^0$  and  $\left((x_1^1, y_1^1), \ldots, (x_n^1, y_n^1)\right) = S^1$ .
Claim E.5. For all adversaries  $\mathcal{B}$ , for all  $t > 0$ , and for any two neighbouring database  $S^0$  and  $S^1$  selected by  $\mathcal{B}$ ,  $View_{\mathcal{B},t}^0$  and  $View_{\mathcal{B},t}^1$  are  $(\varepsilon, \delta)$ -indistinguishable.
Proof. Let  $R_1' = \min(t, R_1)$ . Note that  $\mathrm{View}_{\mathcal{B}, R_1'}^b$  is a prefix of  $\mathrm{View}_{\mathcal{B}, t}^b$  which includes the labels Algorithm GenericBBL produces in Step 3(d)iii for the  $R_1'$  first unlabeled points selected by  $\mathcal{B}$ . Let  $S_2^b$  be the result of the first application of algorithm LabelBoost in Step 3f of GenericBBL (if  $t < R_1$  we set  $S_2^b$  as  $\bot$ ). The creation of these random variables is depicted in Figure 4, where  $D_1^L$  denotes the labels Algorithm GenericBBL produces for the unlabeled points  $D_1$ .
Observe that  $\mathrm{View}_{\mathcal{B},t}^b$  results from a post-processing (jointly by the adversary  $\mathcal{B}$  and Algorithm GenericBBL) of the random variable  $\left(\mathrm{View}_{\mathcal{B},R_1'}^b, S_2^b\right)$ , and hence it suffices to show that  $\left(\mathrm{View}_{\mathcal{B},R_1',S_2^0}\right)$  and  $\left(\mathrm{View}_{\mathcal{B},R_1',S_2^1}\right)$  are  $(\varepsilon, \delta)$ -indistinguishable.
We follow the processes creating  $\mathrm{View}_{\mathcal{B},t}^b$  and  $S_2^b$  in Figure 4: (i) The mechanism  $M_{1}$  corresponds to the loop in Step 3d of GenericBBL where labels are produced for the adver
Figure 4: Privacy of the labeled sample  $S$
sarily chosen points  $D_1^b$ . By application of claim D.1,  $M_{1}$  is  $(1,\delta)$ -differentially private. (ii) The mechanism  $M_{2}$ , corresponds to the subsampling of  $\hat{S}_1^b$  from  $S_1^b$  and the application of procedure LabelBoost on the subsample in Step 3f of GenericBBL resulting in  $S_2^b$ . By application of Claim 2.9 and Lemma C.1,  $M_{2}$  is  $(\varepsilon,0)$ -differentially private. Thus  $(M_{1},M_{2})$  is  $(\varepsilon +1,\delta)$ -differentially private. (iii) The mechanism  $M_{3}$  with input of  $S^b$  and output  $\left(D_1^{b,L},S_2^b\right) = \left(\mathrm{View}_{\mathcal{B},R_1'}^b,S_2^b\right)$  applies  $(M_{1},M_{2})$  on the sub-sample  $S_1^b$  obtained from  $S^b$  in Step 2 of GenericBBL. By application of Claim 2.9  $M_{3}$  is  $(\varepsilon,\frac{4\varepsilon\delta}{3+\exp(\varepsilon+1)})$ -differentially private. Since  $\frac{4\varepsilon\delta}{3+\exp(\varepsilon+1)}\leq \delta$  for any  $\varepsilon$ , hence  $\left(\mathrm{View}_{\mathcal{B},R_1'}^0,S_2^0\right)$  and  $\left(\mathrm{View}_{\mathcal{B},R_1'}^1,S_2^1\right)$  are  $(\varepsilon,\delta)$ -indistinguishable
Privacy of the unlabeled points  $D$ . Let  $D^0, D^1 \in X^t$  be neighboring datasets of unlabeled examples and let  $\operatorname{View}_{\mathcal{B}, t}^0$  and  $\operatorname{View}_{\mathcal{B}, t}^1$  be as in Figure 1 where  $(x_1^0, \ldots, x_t^0) = D^0$  and  $(x_1^1, \ldots, x_t^1) = D^1$ .
Claim E.6. For all adversaries  $\mathcal{B}$ , for all  $t > 0$ , and for any two neighbouring databases  $D^0$  and  $D^1$  selected by  $\mathcal{B}$ ,  $View_{\mathcal{B},t}^0$  and  $View_{\mathcal{B},t}^1$  are  $(\varepsilon, \delta)$ -indistinguishable.
Figure 5: Privacy leakage of  $D_{i}$
Proof. Let  $D_1^0, D_2^0, \ldots, D_k^0$  and  $D_1^1, D_2^1, \ldots, D_k^1$  be the set of unlabeled databases in step 3e of GenericBBL. Without loss of generality, we assume  $D_i^0$  and  $D_i^1$  differ on one entry. When
$i = k$ ,  $\mathrm{View}_{\mathcal{B},t}^{0} = \mathrm{View}_{\mathcal{B},t}^{1}$  because all selected hypothesis are the same. When  $i < k$ , let  $R' = \min \left( \sum_{j=1}^{i+1} R_{j}, t \right)$ .
Similar to the analysis if Claim E.5,  $\mathrm{View}_{\mathcal{B},t}^b$  results from a post-processing of the random variable  $(\mathrm{View}_{\mathcal{B},R^{\prime \prime}}^b,S_{i + 2}^b)$  (if  $t < \sum_{j = 1}^{i + 1}R_j$  we set  $S_{i + 2}^b$  as  $\bot$ ). Note that  $\mathrm{View}_{\mathcal{B},R_1'}^b = (D_1^{b,L},\dots,D_i^{b,L*},D_{i + 1}^{b,L})$ , and  $(D_1^{b,L},\dots,D_{i - 1}^{b,L},D_i^{b,L*})$  follow the same distribution for  $b\in \{0,1\}$ , where  $D_{i}^{b,L*}$  is the labels of points in  $D_{i}^{b}$  expect the different point. So that it suffices to show that  $\left(D_{i + 1}^{0,L},S_2^0\right)$  and  $\left(D_{i + 1}^{1,L},S_2^1\right)$  are  $(\varepsilon ,\delta)$ -indistinguishable.
We follow the processes creating  $D_{i+1}^{b,L}$  and  $S_{i+2}^{b}$  in Figure 5: (i) The mechanism  $M_1$  corresponds to the loop in Step 3d of GenericBBL where labels are produced for the adversarially chosen points  $D_{i+1}^{b}$ . By application of claim D.1,  $M_1$  is  $(1,\delta)$ -differentially private. (ii) The mechanism  $M_2$ , corresponds to the subsampling of  $\hat{S}_{i+1}^{b}$  from  $S_{i+1}^{b}$  and the application of procedure LabelBoost on the subsample in Step 3f of GenericBBL resulting in  $S_{i+2}^{b}$ . By application of Claim 2.9 and Lemma C.1,  $M_2$  is  $(\varepsilon,0)$ -differentially private. Thus  $(M_1,M_2)$  is  $(\varepsilon +1,\delta)$ -differentially private. (iii) The mechanism  $M_3$  with input of  $\hat{D}_i^b$  and output  $(D_{i + 1}^{b,L},S_{i + 2}^{b})$  applies  $(M_2,M_3)$  on  $S_{i + 1}$ , which is generated from  $\hat{D}_i^b$  and in Step 3f of GenericBBL. By application of Claim C.1,  $M_3$  is  $(\varepsilon +4,4\varepsilon \delta)$ -differentially private. (iv) The mechanism  $M_4$ , corresponds to the subsampling  $\hat{D}_i^b$  from  $D_i^b$  and the application of  $M_4$  on  $\hat{D}_i^b$ . By application of Claim 2.9,  $M_4$  is  $(\varepsilon ,\frac{16\varepsilon\delta}{3 + \exp(\varepsilon +4)})$ -differentially private. Since  $\frac{16\varepsilon\varepsilon}{3 + \exp(\varepsilon +4)}\leq 1$  for any  $\varepsilon$ ,  $(D_{i + 1}^{0,L},S_{2}^{0})$  and  $(D_{i + 1}^{1,L},S_{2}^{1})$  are  $(\varepsilon ,\delta)$ -indistinguishable.
Remark E.7. The above proofs work on the adversarially selected  $D$  because: (i) Lemma ?? works on the adaptively selected queries. (We treat the hypothesis class  $F_{i}$  as the database, the unlabelled points  $x_{i,\ell}$  as the query parameters.) (ii) LabelBoost generates labels by applying one private hypothesis on points. The labels are differentially private by post-processing.