SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\frac {P r (\tilde {s} _ {j} = - 1)}{P r (\tilde {s} _ {j} ^ {\prime} = - 1)} = \frac {\exp \left(\frac {L _ {j} ^ {\prime}}{k} \epsilon\right) + 1}{\exp \left(\frac {L _ {j}}{k} \epsilon\right) + 1}.
$$
Similarly, when  $L_{j} = L_{j}^{\prime}$ , the ratio equals 1. When  $L_{j} = L_{j}^{\prime} - 1$ , we have  $\frac{Pr(\tilde{s}_j = -1)}{Pr(\tilde{s}_j^{\prime} = -1)} \leq \exp \left( \frac{L_j'}{k} \epsilon - \frac{L_j}{k} \epsilon \right) = e^{\frac{\epsilon}{k}}$ . By symmetry we obtain  $e^{-\frac{\epsilon}{k}} \leq \frac{Pr(\tilde{s}_j = -1)}{Pr(\tilde{s}_j^{\prime} = -1)} \leq e^{\frac{\epsilon}{k}}$ .
- Case II:  $L_{j} = 1$ . In this case,  $s_{j}$  might be different from  $s_{j}^{\prime}$ . First, if  $L_{j}^{\prime} = 2$ , then the above analysis also applies that  $\frac{Pr(\tilde{s}_{j} = 1)}{Pr(\tilde{s}_{j}^{\prime} = 1)}$  and  $\frac{Pr(\tilde{s}_{j} = -1)}{Pr(\tilde{s}_{j}^{\prime} = -1)}$  are both lower and upper bounded by  $e^{-\frac{\epsilon}{k}}$  and  $e^{\frac{\epsilon}{k}}$ , respectively. It suffices to examine the case when  $L_{j}^{\prime} = 1$ . In this case, if  $s_{j}^{\prime} = s_{j} = 1$  then the probability ratios simply equal 1. If  $s_{j}^{\prime} = -1$ , we have
$$
\frac {P r (\tilde {s} _ {j} = 1)}{P r (\tilde {s} _ {j} ^ {\prime} = 1)} = \frac {\frac {\exp (\frac {\epsilon}{k})}{\exp (\frac {\epsilon}{k}) + 1}}{\frac {1}{\exp (\frac {\epsilon}{k}) + 1}} = e ^ {\frac {\epsilon}{k}}, \quad \frac {P r (\tilde {s} _ {j} = - 1)}{P r (\tilde {s} _ {j} ^ {\prime} = - 1)} = \frac {\frac {1}{\exp (\frac {\epsilon}{k}) + 1}}{\frac {\exp (\frac {\epsilon}{k})}{\exp (\frac {\epsilon}{k}) + 1}} = e ^ {- \frac {\epsilon}{k}}.
$$
Combining two cases, we have that  $\log \frac{Pr(\tilde{s}_j = t)}{Pr(\tilde{s}_j' = t)} \leq \frac{\epsilon}{k}$ , for  $t = -1, 1$ , and for all  $j = 1, \dots, k$ . That is, each single perturbed sign achieves  $\frac{\epsilon}{k}$ -DP. Since the  $k$  projections are independent, by Theorem 2.1, we know that the output bit vector  $\tilde{s} = [\tilde{s}_1, \dots, \tilde{s}_k]$  is  $\epsilon$ -DP as claimed.