SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Even though Theorem 11 might be easier to interpret, we note that it does not result in as sharp a bound as Theorem 10 in some scenarios. For example, if we use Theorem 11 under the assumption in Corollary 3, then the privacy-independent part would be  $\frac{1}{\sqrt{m}} \cdot \frac{\log(1 / \delta)^{1.5}}{\varepsilon} \cdot n_{\mathrm{stat}}^{\mathfrak{T}}$ , instead of  $\frac{1}{m} \cdot n_{\mathrm{stat}}^{\mathfrak{T}}$  implied by Theorem 10. (On the other hand, the privacy-dependent part is the same.)
The remainder of this section is devoted to the proof of Theorem 10. The high-level structure follows the overview in Section 1.1.1: first we show in Section 3.1 that any item-level DP algorithm satisfies sample perfect generalization. Section 3.2.1 then relates this to a local version of user-level DP. We then describe the full algorithm and its guarantees in Section 3.2.2. Since we fix a task  $\mathfrak{T}$  throughout this section, we will henceforth discard the superscript  $\mathfrak{T}$  for brevity.
3.1 DP Implies Sample Perfect Generalization
We begin with the definition of sample perfect generalization algorithms.
Definition 12 ([CLN+16]). For  $\beta, \varepsilon, \delta > 0$ , an algorithm  $\mathbb{A}: \mathcal{Z}^n \to \mathcal{O}$  is said to be  $(\beta, \varepsilon, \delta)$ -sample perfectly generalizing iff, for any distribution  $\mathcal{D}$  (over  $\mathcal{Z}$ ),  $\operatorname{Pr}_{\boldsymbol{x}, \boldsymbol{x}' \sim \mathcal{D}^n}[\mathbb{A}(\boldsymbol{x}) \approx_{\varepsilon, \delta} \mathbb{A}(\boldsymbol{x}')] \geq 1 - \beta$ .
The main result of this subsection is that any  $(\varepsilon, \delta)$ -item-level DP algorithm is  $(\beta, O(\varepsilon \sqrt{n \log(1 / \beta \delta)}), O(n \delta))$ -sample perfectly generalizing:
Theorem 13 (DP  $\Rightarrow$  Sample Perfect Generalization). Suppose that  $\mathbb{A}:\mathcal{Z}^n\to \mathcal{O}$  is  $(\varepsilon ,\delta)$ -item-level DP, and assume that  $\varepsilon ,\delta ,\beta ,\varepsilon \sqrt{n\log(1 / \beta\delta)} >0$  are sufficiently small. Then,  $\mathbb{A}$  is  $(\beta ,\varepsilon^{\prime},\delta^{\prime})$ -sample perfectly generalizing, where  $\varepsilon^{\prime}\leq O(\varepsilon \sqrt{n\log(1 / \beta\delta)})$  and  $\delta^{\prime} = O(n\delta)$ .
3.1.1 Bounding the Expected Divergence
As a first step, we upper bound the expectation of the hockey stick divergence  $d_{\varepsilon^{\prime}}(\mathbb{A}(\pmb {x})\parallel \mathbb{A}(\pmb{x}^{\prime}))$
Lemma 14. Suppose that  $\mathbb{A}:\mathcal{Z}^n\to \mathcal{O}$  is an  $(\varepsilon ,\delta)$ -item-level DP algorithm. Further, assume that  $\varepsilon ,\delta$  and  $\varepsilon \sqrt{n\log(1 / \delta)} >0$  are sufficiently small. Then, for  $\varepsilon^{\prime} = O(\varepsilon \sqrt{n\log(1 / \delta)})$ , we have
$$
\mathbb {E} _ {\boldsymbol {x}, \boldsymbol {x} ^ {\prime} \sim \mathcal {D} ^ {n}} \left[ d _ {\varepsilon^ {\prime}} (\mathbb {A} (\boldsymbol {x}) \| \mathbb {A} (\boldsymbol {x} ^ {\prime})) \right] \leq O (n \delta).
$$
This proof follows an idea from  $\mathrm{[CLN^{+}16]}$ , who prove a similar statement for pure-  $DP$  algorithms (i.e.,  $\delta = 0$ ). For every output  $o\in \mathcal{O}$ , they consider the function  $g^o:\mathcal{Z}^n\to \mathbb{R}$  defined by  $g^{o}(\pmb {x}):= \ln (\operatorname *{Pr}[\mathbb{A}(\pmb {x}) = o])$ . The observation here is that, in the pure-  $DP$  case, this function is  $\varepsilon$ -Lipschitz (i.e., changing a single coordinate changes its value by at most  $\varepsilon$ ). They then apply McDiarmid's inequality on  $g^{o}$  to show that the function values are well-concentrated with a variance of  $O(\sqrt{n}\cdot \varepsilon)$ . This suffices to prove the above statement for the case where the algorithm is pure-  $DP$  (but the final bound still contains  $\delta$ ). To adapt this proof to the approximate-  $DP$  case, we prove a "robust" version of McDiarmid's inequality that works even for the case where the Lipschitz property is violated on some pairs of neighbors (Lemma 32). This inequality is shown by arguing that we may change the function "slightly" to make it multiplicative-Lipschitz, which then allows us to apply standard techniques. Due to space constraints, we defer the full proof, which is technically involved, to Appendix C.3.
3.1.2 Boosting the Probability: Proof of Theorem 13
While Lemma 14 bounds the expectation of the hockey stick divergence, it is insufficient to get arbitrarily high probability bound (i.e., for any  $\beta$  as in Theorem 13); for example, using Markov's inequality would only be able to handle  $\beta > \delta'$ . However, we require very small  $\beta$  in a subsequent step of the proofs (in particular Theorem 17). Fortunately, we observe that it is easy to "boost" the  $\beta$  to be arbitrarily small, at an additive cost of  $\varepsilon \sqrt{n \log(1 / \beta)}$  in the privacy loss.
To do so, we will need the following concentration result of Talagrand for product measures:
Theorem 15 ([Tal95]). For any distribution  $\mathcal{D}$  over  $\mathcal{Z}$ ,  $\mathcal{E} \subseteq \mathcal{Z}^n$ , and  $t > 0$ , if  $\operatorname{Pr}_{\boldsymbol{x} \sim \mathcal{D}^n}[\boldsymbol{x} \in \mathcal{E}] \geq 1/2$ , then  $\operatorname{Pr}_{\boldsymbol{x} \sim \mathcal{D}^n}[\boldsymbol{x} \in \mathcal{E}_{\leq t}] \geq 1 - 0.5 \exp(-t^2/4n)$ , where  $\mathcal{E}_{\leq t} := \{\boldsymbol{x}' \in \mathcal{Z}^n \mid \exists \boldsymbol{x} \in \mathcal{E}, \| \boldsymbol{x}' - \boldsymbol{x} \|_0 \leq t\}$ .
Proof of Theorem 13. We consider two cases based on whether  $\beta \geq 2^{-n}$  or not. Let us start with the case that  $\beta \geq 2^{-n}$ . From Lemma 14, for  $\varepsilon'' = O(\varepsilon \sqrt{n \log(1/\delta)})$ , we have
$$
\mathbb {E} _ {\boldsymbol {x}, \boldsymbol {x} ^ {\prime} \sim \mathcal {D} ^ {n}} \left[ d _ {\varepsilon^ {\prime \prime}} (\mathbb {A} (\boldsymbol {x}) \| \mathbb {A} (\boldsymbol {x} ^ {\prime})) \right] \leq O (n \delta) =: \delta^ {\prime \prime}.
$$
Let  $\mathcal{E} \subseteq \mathcal{Z}^n \times \mathcal{Z}^n$  denote the set of  $(\tilde{\boldsymbol{x}}, \tilde{\boldsymbol{x}}')$  such that  $\mathbb{A}(\tilde{\boldsymbol{x}}) \approx_{\varepsilon''}, 4\delta'' \mathbb{A}(\tilde{\boldsymbol{x}}')$ . By Markov's inequality, we have that  $\operatorname{Pr}_{\boldsymbol{x}, \boldsymbol{x}' \sim \mathcal{D}^n} [d_{\varepsilon''}(\mathbb{A}(\tilde{\boldsymbol{x}}) \| \mathbb{A}(\tilde{\boldsymbol{x}}')) \leq 4\delta''] \geq 3/4$  and  $\operatorname{Pr}_{\boldsymbol{x}, \boldsymbol{x}' \sim \mathcal{D}^n} [d_{\varepsilon''}(\mathbb{A}(\tilde{\boldsymbol{x}}') \| \mathbb{A}(\tilde{\boldsymbol{x}})) \leq 4\delta''] \geq 3/4$  and hence  $\operatorname{Pr}_{\boldsymbol{x}, \boldsymbol{x}' \sim \mathcal{D}^n}[(\boldsymbol{x}, \boldsymbol{x}') \in \mathcal{E}] \geq 1/2$ . By Theorem 15, for  $t = O(\sqrt{n \log(1/\beta)})$ , we have
$$
\operatorname * {P r} _ {\boldsymbol {x}, \boldsymbol {x} ^ {\prime} \sim \mathcal {D} ^ {n}} [ (\boldsymbol {x}, \boldsymbol {x} ^ {\prime}) \in \mathcal {E} _ {\leq t} ] \geq 1 - \beta .
$$
Next, consider any  $(\pmb{x},\pmb{x}^{\prime})\in \mathcal{E}_{\leq t}$ . Since there exists  $(\tilde{\pmb{x}},\tilde{\pmb{x}}^{\prime})\in \mathcal{E}$  such that  $\| \pmb {x} - \tilde{\pmb{x}}\| _0,\| \pmb {x}^{\prime}-$ $\tilde{\pmb{x}}^{\prime}\|_{0}\leq t$ , we may apply Lemma 6 to conclude that  $d_{\varepsilon t}(\mathbb{A}(\pmb {x})\parallel \mathbb{A}(\tilde{\pmb{x}})),d_{\varepsilon t}(\mathbb{A}(\tilde{\pmb{x}}^{\prime})\parallel \mathbb{A}(\pmb{x}^{\prime}))\leq$
This is a substantially simplified version compared to the one in [Tal95], but is sufficient for our proof.
$O(t\delta)$ . Furthermore, since  $d_{\varepsilon''}(\mathbb{A}(\tilde{\boldsymbol{x}}) \parallel \mathbb{A}(\tilde{\boldsymbol{x}}')) \leq 4\delta''$ , we may apply Lemma 5 to conclude that  $d_{\varepsilon'}(\mathbb{A}(\boldsymbol{x}) \parallel \mathbb{A}(\boldsymbol{x}')) \leq \delta'$  where  $\varepsilon' = \varepsilon'' + 2t\varepsilon = O(\varepsilon \sqrt{n\log(1/\beta\delta)})$  and  $\delta' = O(\delta'' + t\delta) = O(n\delta)$ . Similarly, we also have  $d_{\varepsilon'}(\mathbb{A}(\boldsymbol{x}' \parallel \mathbb{A}(\boldsymbol{x})) \leq \delta')$ . In other words,  $\mathbb{A}(\boldsymbol{x}) \approx_{\varepsilon', \delta'} \mathbb{A}(\boldsymbol{x}')$ . Combining this and the above inequality implies that  $\mathbb{A}$  is  $(\beta, \varepsilon', \delta')$ -sample perfectly generalizing as desired.
For the case  $\beta < 2^{-n}$ , we may immediately apply group privacy (Lemma 6). Since any  $\pmb{x},\pmb{x}^{\prime}\sim \mathcal{D}^{n}$  satisfies  $\| \pmb {x} - \pmb{x}^{\prime}\|_{0}\leq n$ , we have  $\mathbb{A}(\pmb {x})\approx_{\varepsilon ',\delta '}\mathbb{A}(\pmb{x}^{\prime})$  for  $\varepsilon^{\prime} = n\varepsilon$  and  $\delta^\prime = O(n\delta)$ . This implies that  $\mathbb{A}$  is  $(\beta ,\varepsilon^{\prime},\delta^{\prime})$ -sample perfectly generalizing (in fact,  $(0,\varepsilon^{\prime},\delta^{\prime})$ -sample perfectly generalizing), which concludes our proof.
3.2 From Sample Perfect Generalization to User-Level DP
Next, we will use the sample perfect generalization result from the previous subsection to show that our algorithm satisfies a certain definition of a local version of user-level DP. We then finally turn this intuition into an algorithm and prove Theorem 10.
3.2.1 Achieving Local-Deletion DP
We start by defining local-deletion  $DP$  (for user-level DP). As alluded to earlier, this definition only considers  $x_{-i}$  for different  $i$ 's. We also define the multi-deletion version where we consider  $x_{-S}$  for all subsets  $S$  of small size.
Definition 16 (Local-Deletion DP). An algorithm  $\mathbb{A}$  is  $(\varepsilon, \delta)$ -local-deletion  $DP$  (abbreviated LDDP) at input  $\pmb{x}$  if  $\mathbb{A}(\pmb{x}_{-i}) \approx_{\varepsilon, \delta} \mathbb{A}(\pmb{x}_{-i'})$  for all  $i, i' \in [n]$ . Furthermore, for  $r \in \mathbb{N}$ , an algorithm  $\mathbb{A}$  is  $(r, \varepsilon, \delta)$ -local-deletion  $DP$  at  $\pmb{x}$  if  $\mathbb{A}(\pmb{x}_{-S}) \approx_{\varepsilon, \delta} \mathbb{A}(\pmb{x}_{-S'})$  for all  $S, S' \subseteq [n]$  such that  $|S| = |S'| = r$ .
Below we show that, with high probability (over the input  $x$ ), any item-level DP algorithm satisfies LDDP with the privacy loss increased by roughly  $r\sqrt{m}$ . The proof uses the crucial observation that relates sample perfect generalization to user-level DP.
Theorem 17. Let  $n, r \in \mathbb{N}$  with  $r \leq n$ , and let  $\mathbb{A}: \mathcal{X}^{(n - r)m} \to \mathcal{O}$  be any  $(\varepsilon', \delta')$ -item-level DP algorithm. Further, assume that  $\varepsilon', \delta', \varepsilon' r \sqrt{m \log\left(\frac{n}{\beta \delta'}\right)} > 0$  are sufficiently small. Then, for any distribution  $\mathcal{D}$ ,
$$
\operatorname * {P r} _ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} \left[ \mathbb {A} i s (r, \varepsilon , \delta) - L D D P a t \boldsymbol {x} \right] \geq 1 - \beta ,
$$
where  $\varepsilon = O\bigl (\varepsilon^{\prime}r\sqrt{m\log\bigl(n / \beta\delta^{\prime}\bigr)}\bigr)$  and  $\delta = O(rm\delta^{\prime})$
Proof. Let  $\beta' = \beta / \binom{n}{r}^2$ . Consider any fixed  $S, S' \subseteq [n]$  such that  $|S| = |S'| = r$ . Let  $T = S \cup S', t = |T|$ ,  $U = S' \setminus S$ ,  $U' = S \setminus S'$ ,  $q = |U| = |U'|$ , and let  $\mathbb{A}_{\boldsymbol{x}_{-T}}'$  denote the algorithm defined by  $\mathbb{A}_{\boldsymbol{x}_{-T}}'(\boldsymbol{y}) = \mathbb{A}(\boldsymbol{x}_{-T} \cup \boldsymbol{y})$ .
Thus, for any fixed  $\pmb{x}_{-T} \in \mathcal{Z}^{(n - t)m}$ , Theorem 13 implies that
$$
\Pr_ {\boldsymbol {x} _ {U}, \boldsymbol {x} _ {U ^ {\prime}} \sim \mathcal {D} ^ {q m}} \left[ \mathbb {A} _ {\boldsymbol {x} _ {- T}} ^ {\prime} (\boldsymbol {x} _ {U}) \not \approx_ {\varepsilon , \delta} \mathbb {A} _ {\boldsymbol {x} _ {- T}} ^ {\prime} \left(\boldsymbol {x} _ {U ^ {\prime}}\right) \right] \leq \beta^ {\prime}, \tag {1}
$$
where  $\varepsilon = O(\varepsilon' \sqrt{q m \log(1 / \beta' \delta')}) \leq O(\varepsilon' r \sqrt{m \log(n / \beta \delta')})$  and  $\delta = O(r m \delta')$ .
Notice that  $\mathbb{A}_{\pmb{x}_{-T}}^{\prime}(\pmb{x}_U) = \mathbb{A}(\pmb{x}_{-S})$  and  $\mathbb{A}_{\pmb{x}_{-T}}^{\prime}(\pmb{x}_{U^{\prime}}) = \mathbb{A}(\pmb{x}_{-S^{\prime}})$ . Thus, we have
$$
\begin{array}{l} \Pr_ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} \left[ \mathbb {A} \left(\boldsymbol {x} _ {- S}\right) \not \approx_ {\varepsilon , \delta} \mathbb {A} \left(\boldsymbol {x} _ {- S ^ {\prime}}\right) \right] = \mathbb {E} _ {\boldsymbol {x} _ {- T} \sim \mathcal {D} ^ {(n - t) m}} \left[ \Pr_ {\boldsymbol {x} _ {U}, \boldsymbol {x} _ {U ^ {\prime}} \sim \mathcal {D} ^ {q m}} \left[ \mathbb {A} _ {\boldsymbol {x} _ {- T}} ^ {\prime} \left(\boldsymbol {x} _ {U}\right) \not \approx_ {\varepsilon , \delta} \mathbb {A} _ {\boldsymbol {x} _ {- T}} ^ {\prime} \left(\boldsymbol {x} _ {U ^ {\prime}}\right) \right] \right] \\ \stackrel {(1)} {\leq} \mathbb {E} _ {\boldsymbol {x} _ {- T} \sim \mathcal {D} ^ {(n - t) m}} \left[ \beta^ {\prime} \right] = \beta^ {\prime}. \\ \end{array}
$$
Hence, by taking a union bound over all possible  $S,S^{\prime}\subseteq [n]$  such that  $|S| = |S^{\prime}| = r$ , we have  $\operatorname *{Pr}_{\pmb{x}\sim \mathcal{D}^{nm}}[\mathbb{A}$  is not  $(r,\varepsilon ,\delta)$ -LDDP at  $\pmb {x}]\leq \beta$  as desired.
3.2.2 From LDDP to DP via Propose-Test-Release
Our user-level DP algorithm is present in Algorithm 1. Roughly speaking, we try to find a small subset  $S$  such that  $\pmb{x}_{-S}$  is LDDP with appropriate parameters. (Throughout, we assume that  $n\geq 4\kappa$
where  $\kappa$  is from Definition 8.) The target size of  $S$  is noised using the discrete Laplace distribution. As stated in Section 1.1.1, the algorithm is very similar to that of  $[\mathrm{GKK}^+23]$ , with the main difference being that (i)  $\mathcal{X}_{\mathrm{stable}}^{R_1}$  is defined based on LDDP instead of the local deletion sensitivity and (ii) our output is  $\mathbb{A}(\boldsymbol{x}_{-T})$ , whereas their output is the function value with Gaussian noise added. It is not hard to adapt their proof to show that our algorithm is  $(\varepsilon, \delta)$ -user-level DP, as stated below. (Full proof is deferred to Appendix C.4.)
Lemma 18 (Privacy Guarantee). DelStab $_{\varepsilon, \delta, \mathbb{A}}$  is  $(\varepsilon, \delta)$ -user-level  $DP$ .
Next, we prove the utility guarantee under the assumption that  $\mathbb{A}$  is item-level DP:
Lemma 19 (Utility Guarantee). Let  $\varepsilon, \delta > 0$  be sufficiently small. Suppose that  $\mathbb{A}$  is  $(\varepsilon', \delta')$ -item-level  $DP$  such that  $\varepsilon' = \Theta \left( \frac{\varepsilon}{\kappa \sqrt{m \log(nm / \delta)}} \right)$  and  $\delta' = \Theta \left( \frac{\delta}{\kappa m} \right)$ . If  $\mathbb{A}$  is  $\gamma$ -useful for any task  $\mathfrak{T}$  with  $(n - 4\kappa)m$  samples, then  $\operatorname{DelStab}_{\varepsilon, \delta, \mathbb{A}}$  is  $(\gamma - o(1))$ -useful for  $\mathfrak{T}$  (with nm samples).
Proof. Consider another algorithm  $\mathbb{A}_0$  defined in the same way as  $\mathrm{DelStab}_{\varepsilon, \delta, \mathbb{A}}$  except that on Line 5, we simply let  $\mathcal{X}_{\mathrm{stable}}^{R_1} \gets \binom{n}{R_1}$ . Note that  $\mathbb{A}_0(\boldsymbol{x})$  is equivalent to randomly selecting  $n - 4\kappa$  users and running  $\mathbb{A}$  on it. Therefore, we have  $\operatorname*{Pr}_{\boldsymbol{x} \sim \mathcal{D}^{nm}}[\mathbb{A}_0(\boldsymbol{x}) \in \Psi_{\mathfrak{T}}] = \operatorname*{Pr}_{\boldsymbol{x} \sim \mathcal{D}^{(n - 4\kappa)m}}[\mathbb{A}(\boldsymbol{x}) \in \Psi_{\mathfrak{T}}] \geq \gamma$
Meanwhile,  $\mathbb{A}_0$  and  $\operatorname{DelStab}_{\varepsilon, \delta, \mathbb{A}}$  are exactly the same as long as  $\mathcal{X}_{\mathrm{stable}}^{R_1}(\boldsymbol{x}) = \binom{[n]}{R_1}$  in the latter. In other words, we have
$$
\begin{array}{l} \operatorname * {P r} _ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} \left[ \operatorname {D e l S t a b} _ {\varepsilon , \delta , \mathbb {A}} (\boldsymbol {x}) \in \Psi_ {\mathfrak {T}} \right] \geq \operatorname * {P r} _ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} \left[ \mathbb {A} _ {0} (\boldsymbol {x}) \in \Psi_ {\mathfrak {T}} \right] - \operatorname * {P r} _ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} \left[ \mathcal {X} _ {\text {s t a b l e}} ^ {R _ {1}} (\boldsymbol {x}) \neq \binom {[ n ]} {R _ {1}} \right] \\ \geq \gamma - \Pr_ {\boldsymbol {x} \sim \mathcal {D} ^ {n m}} [ \mathbb {A} \text {i s n o t} (4 \kappa , \bar {\varepsilon}, \bar {\delta}) \text {- L D D P a t} \boldsymbol {x} ] \quad \geq \gamma - o (1), \\ \end{array}
$$
where in the last inequality we apply Theorem 17 with, e.g.,  $\beta = 0.1 / nm$ .
Putting Things Together. Theorem 10 is now "almost" an immediate consequence of Lemmas 18 and 19 (using  $\kappa = O\left(\log(1/\delta)/\varepsilon\right)$ ). The only challenge here is that  $\varepsilon'$  required in Lemma 19 depends polylogarithmically on  $n$ . Nonetheless, we show below via a simple subsampling argument that this only adds polylogarithmic overhead to the user/sample complexity.
Proof of Theorem 10. Let  $\varepsilon' = \varepsilon'(n), \delta'$  be as in Lemma 19. Furthermore, let  $\varepsilon'' = \frac{\varepsilon^2}{\log(1/\delta)\sqrt{m\log(m/\delta)}}$ . Notice that  $\varepsilon'(n)/\varepsilon'' \leq (\log n)^{O(1)}$ . Let  $N \in \mathbb{N}$  be the smallest number such that  $N$  is divisible by  $m$  and
$$
\left(e ^ {\varepsilon^ {\prime \prime}} - 1\right) \cdot \frac {n _ {1} \left(\varepsilon^ {\prime \prime} , \delta^ {\prime}\right)}{N} \leq e ^ {\varepsilon^ {\prime} (N / m + 4 \kappa)} - 1,
$$
Observe that  $N \leq \widetilde{O}\left(m\kappa + n_{1}(\varepsilon^{\prime \prime}, \delta^{\prime})\right)$ .
From the definition of  $n_1$ , there exists an  $(\varepsilon'', \delta')$ -item-level DP algorithm  $\mathbb{A}_0$  that is  $\gamma$ -useful for  $\mathfrak{T}$  with sample complexity  $n_1(\varepsilon'', \delta')$ . We start by constructing an algorithm  $\mathbb{A}$  on  $N$  samples as follows: randomly sample (without replacement)  $n_1(\varepsilon'', \delta')$  out of  $N$  items, then run  $\mathbb{A}_0$  on this
subsample. By amplification-by-subsampling (Theorem 7), we have that  $\mathbb{A}$  is  $(\varepsilon'(n), \delta')$ -item-level DP for  $n = N/m + 4\kappa$ . Thus, by Lemma 18 and Lemma 19, we have that  $\mathrm{DelStab}_{\varepsilon, \delta, \mathbb{A}}$  is  $(\varepsilon, \delta)$ -DP and  $(\gamma - o(1))$ -useful for  $\mathfrak{T}$ . Its user complexity is
$$
n = N / m + 4 \kappa = \widetilde {O} \left(\frac {\log (1 / \delta)}{\varepsilon} + \frac {1}{m} \cdot n _ {1} \left(\frac {\varepsilon^ {2}}{\log (1 / \delta) \sqrt {m \log (m / \delta)}}, \delta^ {\prime}\right)\right).
$$
4 Pure-DP: PAC Learning
In this section we prove Theorem 4. Let  $\mathbf{z}$  denote the input and for  $i \in [n]$ , let  $z_{i} = ((x_{i,1},y_{i,1}),\ldots ,(x_{i,m},y_{i,m}))$  denote the input to the  $i$ th user. A concept class is a set of functions of the form  $\mathcal{X} \to \{0,1\}$ . For  $T \subseteq \mathcal{X} \times \{0,1\}$ , we say that it is realizable by  $c:\mathcal{X}\to \{0,1\}$  iff  $c(x) = y$  for all  $(x,y) \in T$ . Recall the definition of PRDim:
Definition 20 ([BNS19]). A distribution  $\mathcal{P}$  on concept classes is an  $(\alpha, \beta)$ -probabilistic representation (abbreviated as  $(\alpha, \beta)$ -PR) of a concept class  $\mathcal{C}$  if for every  $c \in \mathcal{C}$  and for every distribution  $\mathcal{D}_{\mathcal{X}}$  on  $\mathcal{X}$ , with probability  $1 - \beta$  over  $\mathcal{H} \sim \mathcal{P}$ , there exists  $h \in \mathcal{H}$  such that  $\operatorname*{Pr}_{x \sim \mathcal{D}_{\mathcal{X}}} [c(x) \neq h(x)] \leq \alpha$ .
The  $(\alpha, \beta)$ -PR dimension of  $\mathcal{C}$  is defined as  $\mathrm{PRDim}_{\alpha, \beta}(\mathcal{C}) := \min_{(\alpha, \beta) \in \mathcal{P}} \mathcal{C} \text{ size}(\mathcal{P})$ , where  $\text{size}(\mathcal{P}) := \max_{\mathcal{H} \in \operatorname{supp}(\mathcal{P})} \log |\mathcal{H}|$ . Furthermore, let the probabilistic representation dimension of  $\mathcal{C}$  be  $\mathrm{PRDim}(\mathcal{C}) := \mathrm{PRDim}_{1/4, 1/4}(\mathcal{C})$ .
Lemma 21 ([BNS19]). For any  $\mathcal{C}$  and  $\alpha \in (0,1 / 2)$ ,  $\mathrm{PRDim}_{\alpha ,1 / 4}(\mathcal{C})\leq \widetilde{O}$  (PRDim  $(\mathcal{C})\cdot \log (1 / \alpha)$ ).
Proof of Theorem 4. The lower bound  $\tilde{\Omega}\left(d / \varepsilon\right)$  was shown in [GKM21] (for any value of  $m$ ). The lower bound  $\tilde{\Omega}\left(\frac{d}{\varepsilon\alpha m}\right)$  follows from the lower bound of  $\tilde{\Omega}\left(\frac{d}{\varepsilon\alpha}\right)$  on the sample complexity in the item-level setting by [BNS19] and the observation that any  $(\varepsilon, \delta)$ -user-level DP algorithm is also  $(\varepsilon, \delta)$ -item-level DP with the same sample complexity. Thus, we may focus on the upper bound.
It suffices to only prove the upper bound  $\widetilde{O}\left(\frac{d}{\varepsilon} + \frac{d}{\varepsilon \alpha m}\right)$  assuming  $m \leq 1 / \alpha$ . Let  $\mathcal{P}$  denote a  $(0.01\alpha, 1/4)$ -PR of  $\mathcal{C}$ ; by Lemma 21, there exists such  $\mathcal{P}$  with  $\mathrm{size}(\mathcal{P}) \leq \widetilde{O}\left(d \cdot \log(1 / \alpha)\right)$ . Assume that the number  $n$  of users is at least  $\frac{\kappa \cdot \mathrm{size}(\mathcal{P})}{\varepsilon \alpha m} = \widetilde{O}\left(\frac{d}{\varepsilon \alpha m}\right)$ , where  $\kappa$  is a sufficiently large constant. Our algorithm works as follows: Sample  $\mathcal{H} \sim \mathcal{P}$  and then run the  $\varepsilon$ -DP EM (Theorem 9) on candidate set  $\mathcal{H}$  with the scoring function  $\mathrm{scr}_h(z) := \sum_{i \in [n]} 1[z_i]$  is not realizable by  $h$ .
Observe that the sensitivity of  $\mathrm{scr}_h$  is one. Indeed, this is where our "clipping" has been applied: a standard item-level step would sum up the error across all the samples, resulting in the sensitivity as large as  $m$ , while our scoring function above "clips" the contribution of each user to just one.
A simple concentration argument (deferred to Appendix D) gives us the following:
Lemma 22. With probability 0.9 (over the input), the following hold for all  $h \in \mathcal{H}$ :
(i) If  $\operatorname{err}_{\mathcal{D}}(h) \leq 0.01\alpha$ , then  $\operatorname{scr}_h(z) \leq 0.05\alpha nm$ .
(ii) If  $\operatorname{err}_{\mathcal{D}}(h) > \alpha$ , then  $\operatorname{scr}_h(z) > 0.1\alpha nm$ .
We now assume that the event in Lemma 22 holds and finish the proof. Since a  $\mathcal{P}$  is a  $(0.01\alpha, 1/4)$ -PR of  $\mathcal{C}$ , with probability  $3/4$ , we have that there exists  $h^* \in \mathcal{H}$  such that  $\mathrm{err}_{\mathcal{D}}(h^*) \leq 0.01\alpha$ . From Lemma 22(i), we have  $\mathrm{scr}_{h^*}(z) \leq 0.05\alpha nm$ . Thus, by Theorem 9, with probability  $2/3$ , the algorithm outputs  $h$  that satisfies  $\mathrm{scr}_h(z) \leq 0.05\alpha nm + O(\mathrm{size}(\mathcal{P}) / \varepsilon)$ , which, for a sufficiently large  $\kappa$ , is at most  $0.1\alpha nm$ . By Lemma 22(ii), this implies that  $\mathrm{err}_{\mathcal{D}}(h) \leq \alpha$  as desired.
5 Conclusion and Open Questions
We presented generic techniques to transform item-level DP algorithms to user-level DP algorithms.
If  $m$  is larger, then we can simply disregard the extra examples (as the first term dominates the bound).
There are several open questions. Although our upper bounds are demonstrated to be tight for many tasks discussed in this work, it is not hard to see that they are not always tight $^{8}$ ; thus, an important research direction is to get a better understanding of the tight user complexity bounds for different learning tasks.