SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Next consider the case when  $g_{k}(x) - g_{k}(x^{\prime}) = 1$ . Therefore we have  $\Delta_k(x,x')\leq q$  and also  $f_{k}(x^{\prime}) - f_{k}(x) = q - 1$  which implies  $\Delta_k(x,x') - (f_k(x') - f_k(x))\leq 1$ , so  $\varepsilon (x,x^{\prime})\leq q\varepsilon_{1} + \varepsilon_{2}$ . Similarly, we have that  $\Delta_k(x',x)\leq 1 - q$ , and thus  $\Delta_k(x',x) - (f_k(x) - f_k(x')) = 0$ , so  $\varepsilon (x',x)\leq (1 - q)\varepsilon_1$ .
Combining these bounds gives our desired result.
With these improved bounds we can then show that our methods also extend to the add-subtract definition of neighboring with tighter privacy guarantees.
Corollary C.1. If we run Algorithm 2 with  $\varepsilon_1 = \varepsilon_2$  for a quantile  $q$  under Definition C.1 then it is  $(q\varepsilon_{1} + \varepsilon_{2})$ -DP.
Proof. Combining Lemma C.1 and Corollary B.1 immediately imply the desired result.
C.3 Extension to multiple quantile estimation
As previously established, the framework in Kaplan et al. (2022) is agnostic to the single quantile estimation method. However their proof is for the add-subtract neighbors, although they note that it can be extended easily to the swap neighbors. We also discuss here how it can be extended for completeness.
For the swap neighboring definition, at each level of the recursive partitioning scheme either two partitions differ under the add-subtract definition, or one partition differs under the swap definition. Applying their framework to our algorithm, we will instead compute all the thresholds in advance of the splitting. Accordingly these thresholds will remain fixed. If the thresholds are fixed then we can actually further improve our privacy bounds for the add-subtract definition. Once again we will use our more general characterization from Section B.1.
Lemma C.2. Given the stream of queries  $f_{i}(x) = |\{x_{j}\in x|x_{j} - \ell +1 < \beta^{i}\} |$  with sensitivity  $\Delta = 1$ , for any neighboring datasets  $x,x^{\prime}$  under Definition C.1 we have  $\varepsilon (x,x^{\prime})\leq \max \{\varepsilon_1,\varepsilon_2\}$
Proof. Without loss of generality, assume that  $x$  has one more individuals data, so  $x \in \mathbb{R}^n$  and  $x' \in \mathbb{R}^{n-1}$ . By construction we must have  $f_i(x) - f_i(x') \in \{0, 1\}$  because  $x$  has an additional datapoint. Furthermore, because the thresholds are increasing, if  $f_k(x) - f_k(x') = 0$  then  $f_i(x) - f_i(x') = 0$  for all  $i < k$ . Thus the case of  $f_k(x) - f_k(x') = 0$  is easy.
Instead consider  $f_{k}(x) - f_{k}(x^{\prime}) = 1$ . We know  $\Delta_k(x,x') = 0$  so  $\Delta_k(x,x') - (f_k(x') - f_k(x)) = 1$ , so  $\varepsilon (x,x^{\prime})\leq \varepsilon_{2}$ . Further we must have  $\Delta_k(x',x)\leq 1$  and  $\Delta_k(x',x) - (f_k(x) - f_k(x')) = 0$ , so  $\varepsilon (x',x)\leq \varepsilon_{1}$ . Combining these implies  $\varepsilon (x^{\prime},x)\leq \max \{\varepsilon_1,\varepsilon_2\}$  for any neighboring datasets.
Applying these bounds we see that applying the framework of Kaplan et al. (2022) to the swap definition either leads to one composition of  $(\varepsilon_{1} + \varepsilon_{2})$ -DP for the swap definition or two compositions of  $\max \{\varepsilon_1,\varepsilon_2\}$  for the add-subtract definition at each level. Setting  $\varepsilon_{1} = \varepsilon_{2}$  we then have that the privacy cost of computing  $m$  quantiles with this framework will be equivalent to  $\log (m + 1)$  compositions of  $(\varepsilon_{1} + \varepsilon_{2})$ -DP.
D Implementation code
For ease of implementation, we provide some simple python code to run our method with access to the respective Noise generator of the users choosing. In our experiments we used exponential noise from the numpy library.
def unboundedQuantile(data, l, b, q, eps_1, eps_2):
    d = defaultdict(int)
    for x in data:
        i = math.log(x - l + 1, b) // 1
        d[i] += 1
    t = q * len(data) + noise(1 / eps_1)
    cur, i = 0, 0
while True:
    cur += d[i]
    i += 1
if cur + noise(1 / eps_2) > t:
    break
return b ** i - 1 + 1