Private Continual Counting of Unbounded Streams
Authors: Ben Jacobsen
Kassem Fawaz
Venue: NeurIPS 2025 poster ()
Keywords: privacy
differential privacy
continual counting
matrix mechanism
online learning
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We derive novel matrix factorizations, leading to an efficient streaming algorithm for privately estimating partial sums even when the size of the input is a priori unknown.

Abstract: We study the problem of differentially private continual counting in the unbounded setting where the input size $n$ is not known in advance. Current state-of-the-art algorithms based on optimal instantiations of the matrix mechanism cannot be directly applied here because their privacy guarantees only hold when key parameters are tuned to $n$. Using the common `doubling trick' avoids knowledge of $n$ but leads to suboptimal and non-smooth error. We solve this problem by introducing novel matrix factorizations based on logarithmic perturbations of the function $\frac{1}{\sqrt{1-z}}$ studied in prior works, which may be of independent interest. The resulting algorithm has smooth error, and for any $\alpha > 0$ and $t\leq n$ it is able to privately estimate the sum of the first $t$ data points with $O(\log^{2+2\alpha}(t))$ variance. It requires $O(t)$ space and amortized $O(\log t)$ time per round, compared to $O(\log(n)\log(t))$ variance, $O(n)$ space and $O(n \log n)$ pre-processing time for the nearly-optimal bounded-input algorithm of Henzinger et al. Empirically, we find that our algorithm's performance is also comparable to theirs in absolute terms: our variance is less than $1.5\times$ theirs for $t$ as large as $2^{24}$.

Private Continual Counting of Unbounded Streams
Ben Jacobsen Department of Computer Sciences University of Wisconsin - Madison
Kassem Fawaz
Department Electrical and Computer Engineering University of Wisconsin Madison kfawaz@wisc. edu
bjacobsen3@visc.
Abstract
We study the problem of differentially private continual counting in the unbounded setting where the input size is not known in advance. Current state-of oftte----hhearrrrr algorithms based on optimal instantiations of the matrix mechanism [33 cannot be directly applied here because their privacy guarantees only hold when key parameters are tuned to n. Using the common 'doubling trick' avoids knowledge of n but leads to suboptimal and non-smooth error. We solve this problem by introducing novel matrix factorizations based on logarithmic perturbations of the function - studied in prior works, which may be of independent interest.
The resulting algorithm has smooth error, and for any a > O and S n is able to privately estimate the sum of the first data points with O(log 2(1o)2+a(11)) variance. It requires Ott) space and amortized (log t) time per round, compared to O (log(n) log(t)) variance, ((n) space and ( log n) pre-procst pre-processing time for the nearly-optimal bounded-inpur algorithm of Henzinger al. [27]. Empirically, we find that our algorithm's performance is also comparable to theirs in absolute terms: our variance is less than 1.5x theirs for as large 2
Introduction
Differentially private counting under continual observation [1] refers to the problem of main- taining accurate running totals over streams of sensitive data. It has attracted a great deal of attention in recent years 3
4
35 for its wide-ranging applications in optimiza- 36 as well as online learning and the private analysis of streaming data more 38
6
7
14
16 23
28
tion 13
12
4
32
It has also been used in many large-scale deployments of differential privacy, such as Google's ' private next-word prediction 34 and Smart Select models [26). To a large extent, this flurry of activity has been prompted by recent algorithmic improvements in matrix factorizations for streaming data [14 23 27 33), which have dramatically improved privacy/utility tradeoff's compared classical approaches based binary trees
broadly 10 30
40
18 29
One challenge when applying matrix- algorithms to streaming settings that they largely assume access to the input size like private model training, researchers from the beginning have also motivated their work with appeals to applications like public health (18) where is much less clear how the assumption could hold. In fact, is known that difficulties related to unbounded inputs have influenced practical deployments of DP 2 famously, after Apple announced that it planned to differential privacy to collect user data, Tang et al. (39 discovered that their implementation achieved this by guaranteeing privacy only over single day while allowing privacy loss per-user grow without bound over time.
parameter. While this is very natural assumption in contexts
Simple solutions to this problem all carry fundamental tradeoffs. Lifting a hounded-input algorithm to the unbounded case with some form of doubling trick [T] asymptotically preserves performance, but it also leads to non-smooth growth in error over time, undermining one of the major selling points of matrix methods over binary trees 27 Using bounded matrix mechanism alongside the classical
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

query model [7 19 and refusing to produce additional outputs once our privacy budget is exhausted preserves performance and smoothness, but is not truly unbounded and is unlikely to be satisfying in practice. Finally, simple algorithms like adding independent noise to each data point are trivially unbounded with smooth noise, but have extremely sub-optimal error: Our main contribution in this paper is matrix-based algorithm that overcomes this trilemma: to the best of our knowledge, it is the first private counting algorithm that is simultaneously smooth and unbounded with almost-optimal asymptotic error. It is also practical to implement, with essentially the same complexity as the foundational algorithm of Henzinger et al. [27], and we show empirically that it enjoys small error for realistic input sizes and not just asymptotically.
Background and Related Work
2.1 Background
Continual (Binary) Counting. In continual counting [8] [1], the input consists of a (potentially unbounded) stream of data 21; 22, At each time step 4, the algorithm receives He and then produces an estimate of the partial sum St = Σ Ty. For the sake of simplicity, we will assume that v2 is single bit, but our results are easy to generalize to 24 E Rdd.
Differential Privacy under Continual Observation. Define two (potentially unbounded) streams T1. T2....... and x', 22..... to be neighboring if there is at most one time step t where I4 * z/ Let Xn (resp. X²) denote the first n data points in each stream. We say that a mechanism M satisfies (s, Sprin) ddifferenti privacy (DP) [20] in the continual observation model [8] if for all neighboring streams X, X', all n E Z+, and all measurable events S, we have (PMM((,)) E S) S e (T((((X))) Sprio- Here, .M(X) represents the full sequence of outputs produced by M on input X. This reduces to the standard definition when the streams are finite; the additional quantification over n is necessary to make sense of the definition for unbounded streams. The mechanisms we study all use additive Gaussian noise, and so can readily be shown to satisfy other notions of indistinguishabilityy as well, such as Rényi DP (37, zCDP [9. or Gaussian DP [15]. By virtue of using Gaussian noise, they also automatically satisfy DP in the stronger adaptive setting where x, is permitted to depend earlier outputs, which is important for learning applications [14].
Two measures of utility are standard in the literature: the root mean squared additive error and the expected maximum additive error, defined respectively as the maximums over X,, of:
err
ls (M) = EM Σ CIIS: - M(X) 15
err (M) = EM max ESn
|| M(Xi)llo))
When M uses additive Gaussian noise, both expectations and matching high-probabie poob-rrbbbblitty bounds can be derived from V(M(X.)), the (non-asymptotic) variance of the noise added as a function of time. This is the main metric we will report when comparing the performance of different algorithms. We additionally say that mechanism has smooth error if V (M))))) is smooth function of t. This is desirable property because err,." depends on the maximum variance across all time steps, which can be significantly higher than the average variance when error is non-smooth B
2.2 Related Works
Differential privacy under continual observation was introduced by Dwork et al. 18 and Chan et al. MII who independently proposed the binary mechanism. Conceptually, this algorithm computes partial sums with the help of binary tree where leaf nodes contain private estimates of individual data points, and internal nodes contain independent estimates of the subsequences spanned by their children. The binary mechanism of Dwork al. [8] used Laplacian noise satisfy (E, O)-DP with
(+)) by Chan et al. [II] This was later reduced to Olog(t)) (og n) by Jain et al. (30] by using Gaussian noise instead. A straightforward optimization of the algorithm follows from the observation that at a given time step, it is only necessary to store logg (n) nodes of the tree in memory. Subsequent work by Honaker [29] additionally showed that it is possible to reduce the error by roughly factor of 2 by making efficient use of multiple independent estimates for the same partial sum.
err (log² 2.5 2.0 (n)), which was improved to Ollog 2
2

---

Table Asymptotic Comparison of Private Counting Algorithms
Mechanism
V(M(Xi))
Time for outputs
Space
Smooth
Unbounded
Binary
30
(log(() log(n))
O(t)
O t)
No
No
Hybrid Binary
11
( 2 t + log t)
((t)
(log t)
No
Yes
Smooth Binary
3
(glog n + log log n)
O(t)
Ologg)
Yes
No
Sqrt Matrix 27 23
(log(() log(n))
O log m)
O(n)
Yes
No
Algorithm
Ollog2+20 t)
(t f)
O(t)
Yes
Yes
Hybrid Matrix
O(log" 2 + log" log2+2n logt)
2422
Otg
O(t)
No
Yes
(*) Originally satisfied e-DP with Laplacian noise; numbers reported are for the Gaussian variant, A mechanism is smooth if its variance is a smooth function of t, and it is unbounded if it doesn't 't require n as input. Algorithms with bolded names are original to this work. Constant factors differ significantly between algorithms - we investigate this more closely in onsecttion 3 Jand 2
Both the original binary mechanism and Honaker's variant have very uneven noise scale across time steps. Recently, Andersson and Pagh [ proposed smooth variant of the binary mechanism which equalizes the noise distribution across time steps, further improving err by constant factor.
The binary mechanism can be seen as special case of the general matrix method (33 Given dataset & and a matrix A = LR, the matrix method estimates Ax by L [(Rr + =) = Ax + L22. This satisfies DP when is Gaussian scaled to
[R]] 1- the maximum l norm over the columns of R. The final error also scales with || 1- the maximum Eg norm over the rows of L. and so by choosing and R carefully we can achieve error depending on the factorization norm (2(AA)
min(] L||2 || LR = A}. This is often much more accurate than calibrating to A directly. In the case of continual counting, A Mcount, the all-ones wrianttri matrix.
This matrix-basee approach has rapidly become the standard in the field. Edmonds et al. [22 proved a lower bound of 22(lg n) on the per-time-step lx error of continual counting by lower-bounding
72 Mommar). Denisov et al. [14] approached the problem of finding optimal decompositions as a convex optimization problem, building on earlier work in the offline setting 411) They proved that, for lower-triangular matrices like M Moone. it is sufficient to consider only decompositions where J. and R are both lower-triangular. This a particularly nice result because it implies there is no extra cost for using the matrix method in streaming settings. Subsequently, Fichtenberger et al. [23] provided an
explicit factorization I, R M cown: and studied its errh~ error, and Henzinger al.
27 proved
that the same decomposition is simultaneously nearly optimal in terms of err More recent work has investigated various computational modifications of this factorization, trading a small amount of accuracy for efficiency by approximating the optimal decomposition in more compact ways, e.g. through finite recurrences [16 5 or by binning together similar values 4
A distinct line of work has investigated the unbounded case. In their seminal work, Chan et al. [ proposed a 'hybrid' mechanism which uses variant of the classic doubling trick match the asymptotic errf- rate of the binary mechanism when n. is unknown. Their technique is generic and can be used to 'lift' any fixed-size algorithm into one that works on unbounded streams with the help of a (potentially inefficient) unbounded algorithm - in /section 5) we investigate a version of this mechanism instantiated with [Algorithm I] An alternative strategy for handling unbounded inputs is to only permit queries based on sliding windows or decaying sums [8] 40 The dual approach, proposed by Bolot et al. (8] and recently extended by Andersson et al. 6 instead relaxes the classical privacy definition to allow DP guarantees for past data points to gradually expire over time.
Our work is most directly inspired by the rational approximation methods of Dvijotham et al. [16]. and in particular by their use of the equivalence between certain matrix factorizations and generating functions. While they search for simple approximations of functions to derive computationally efficient factorizations, we take the opposite approach by searching for more complicated functions to derive matrix factorizations that are usable in the unbounded setting. Because we are not directly concerned with reducing computational complexity below O(r) space and O(n n)) time, we will
generally take the M mechanism of Henzinger et al. 27 and Fichtenberger et al. [23 ("Sqrt Matrix" in Table and Figure 2) the baseline against which our algorithm is compared.
3

---

3 Overview of Results
3.1 Preliminaries and Notation
The lower-triangular Toeplitz matrix corresponding to a sequence dg, 01.... .. is defined as the square matrix whose i.j entry is a;-j when i 2 j and otherwise. For a given sequence, we will denote the corresponding matrix LoToopp(ao, a1,...). .... All matrices we consider will be infinite, but for practical computations we will work with [A].. the leading submatrix formed by the first n rows and (1,
columns of A. The special matrix Meounr is defined
LTToep matrices are closed under multiplication, and LTToep((S) LTToop(SS)) (TTTopps) where S * S' denotes the convolution of the sequences S and S'. This means that multiplication of T.Toepp matrices commutative and can be performed in On log n) time using the Fast Fourier Transform (FFT). Given an analytic function [()) with Taylor coefficients on [=), we will abuse notation and write LTToep(() (f) for L.TToep(ap- (1,...). With this notation, applying the Cauchy product to their Taylor series gives us that LTToopp(f) LTToep(g) = LTToep(ffg) We refer the curious reader to the full version of Dvijotham et al. [T6] for an excellent and detailed introduction to ToTp matrices in this context, including proofs of the properties just described.
LTToep(S S*).
Finally, we note that we reserve the symbol 8 to refer the exponent of the log log term in Enqutioon When we need to refer to the privacy parameter of DP algorithm, we will use Spriv-
3.2 Main Result
Our main result the following theorem and its associated algorithm (Algorithm I}:
Theorem 1. For all a > O, there exists an infinite lower-triangular Toeplitz matrix factorization L, R. E Rexx with the following properties:
Joint Validity: For all n E Z+, [4] = [Mcoun]J
Bounded Sensitivity: lim ||| R 1-22 C 00 for some computable constant C
Near-Optimal Asymptotic Error: [[[4]a 12-000 = O(log"
Computability: There exists an unbounded streaming algorithm that at each time step t takes as input 2t and outputs (T.2); using (tt) memory and amortized O(log t) time
Corollary 1. For all e, 5.8priv. a > 0 there exists an unbounded streaming algorithm for continual counting, described in [lAloorithm 1 which has the same complexity as in Theorem 1 and satisfies (e, - in the continual release model. At each time step t, the algorithm adds Gaussian noise independent of the imput.
with scale 0 (lgg++(())Ce.))) where C.,8 = 0(s /log(1/8prr))
We prove Theorem in section
Corollary then follows from existing results.
33 14
3.3
Technical Overview
The matrix decompositions we consider are of the form L = LTTo -8)), R LTTocp(f(2;;; 5)), where:
(1)
fe(2;)) = - ((-2)) fa(z;0) = ( in
2
f1(2)
In
V1 V1-="
As motivation for why one might study such matrices, recall that the first column of Mcoum corre- sponds to the Taylor coefficients of (1-2) -)- This implies that for any pair of functions 91, 92 analytic on the open unit disc with product (1 2)-1, we have Meount LTToop((1)) LTTocp(g2)) Conversely, any pathoooooll decomposition of Momm into LTToep matrices will correspond to such a pair of functions. So, rather than searching for arbitrary sequences of real numbers (which are complicated to represent and reason about), we can instead take the approach of searching for nice analytic functions with the hope of translating their functional properties into statements about the sequences we'n re ultimately interested in.

---

Algorithm Logarithmic Matrix Method
Require:
Matrix parameters < -1/2 and 6, privacy parameter Ce.6 Compute + [[LTTopp(((:;:)))]
See 'Bounded Sensitivity" in section
for 1= ,, do
Receive imput z E [0,
Set S: < Σ 24 if l 2 for some integer m then
Sample 2N ~ (O, C2 A2) for S & 2/ -
Compute next t coefficients of L = LiTTopp( -y, 7--07-- -)) in (og time
See "Computability" in sectiinnn
Compute next t terms of the sequence La in Ot (ollog t) time with an FFT
Output St (Tzz),
To understand why these functions in particular are good candidates, consider the special case where ? O. This gives R LTTTop((1 =)-1/2), which is exactly M [66.. The key issue that makes this sequence inapplicable to unbounded inputs is that it is not square-summable. By Parseval's theorem, this equivalent the statement that the function f not square-integrable. To fix this, we would like to 'nudge' f so that it becomes gquare-integrable while still being as 'close' to the original function as possible. plausible first attempt in this direction would be to choose R LTToopp(11 -111/++ for some a
but this gives O error; the key issue is that (1 - -)= diverges very quickly as + 1 even when a is small. To obtain logarithmic overhead, we require functions like In(1/(1 - 2)) that diverge more slowly. Multiplying by f2 turns out be sufficient to prove Theorem but we show in sectiiionn 5 that incorporating fa can further improve our variance by constant factor. Finally, the inclusion of the 1/2 and 2/2 terms in Eqquation I climinates the 0 of ln(1/(1 - =)) at = 0, which ensures that f is always analytic with f(0)= 1.
To study the asymptotic growth of [|[*]= 112- and 1111-2,, Flajolet and Odlyzko (24], whose Theorem 3B (reproduced fully in Theorem 2} provides the following
draw the classic work of
asymptotic expansion for the coefficient of 2" in the Taylor series f:
[am] (==
(Inn) (2nn) (1+ O(n ([+=0ln((n))
V2T
In particular, this implies that y = 11/2-a for some a > O, then the series In=o([="] [f converges, which is equivalent R having bounded column norm. This is the crucial step that allows us to operate on unbounded time streams without the use of doubling tricks - by calibrating our noise scale this limit, which can be computed exactly by integrating If(2; 0) over the unit circle using Parseval's theorem, we can guarantee privacy for all finite inputs. Using the same asymptotic expansion, can also show that the row norm of the corresponding L matrix grows like Olog (o) when
6))²
or O(log" I+a++[[]) (n)) when 8 <
Finally, we can compute the first / coefficients of fr. and its convolution with = in O () time and (l)) space using FFTs. Algorithh 1 combines all of these ideas together alongside standard doubling trick on i, which allows us to achieve On log n.) time complexity even when n is unknown.
Proof of Theorem
We will begin by fixing a and choosing a, -5) with f defined as in Equation I Our goal is to show that the matrix decomposition L = I.Tooep(ft), I.TTopp(T (n) satishes all four properties listed in Theorem I
a,,), fz(=) f(;
Joint Validity. We have that LR = LTTocp(fL.R) = LTToop(1 Meount-
Bounded Sensitivity. We begin by showing that the column norm of R is finite, or equivalently that fn E L.?. Recall that ||
2 ([2*) fn)) By Theorem 3B of Flajolet and Odlyzko
24], we know that [n)) = O(n -1 log 1-22 (n) log 26 (logn) = O(n log log-)-((m)), and the
series therefore converges by the integral test.
5

---

To actually compute this sensitivity, we make use of Parseval's theorem, classic result in Fourier analysis which relates square-summan summable sequences to functions that are square-integrable over the unit circle. Specifically, it gives us:
Σ (I=TTfR))= m=0
2x { 2
1
) do
In Appendix A we simplify the right- hantt-handdae side into two integrals over smooth, real-valued functions that can be integrated numerically to high precision.
Near-Optima Asymptotic Error. We first consider the case when 8 2 0. Once, again Theo- rem 3B of Flajolet and Odlyzko (24] tells us that f[2 = Onn (In
1 (In lnn)-nn)- =
O(n-'nna ( So, by the definition of big-O, there constants nu, C. such that for all > no., we have Em ([=**][2² S Em=no H m) 1 I C S - (Inx)++2aa de- C (In(n)2+20 - In(no 2)2+ Therefore, v -_ f2) = (In(n))) as desired. 242a
The case where d < 0 is similar, except we have 28 > 0 and so it is no longer true that our coefficients are On (In n2)+ But for any a' > a. IIn 26 = o(IIn n) n)) and so by the same basic argument we can derive an asymptotic error bound of (1n(m) +oao)))) instead.
Computability We formalize the problem we are trying solve as a game: first, an adversary secretly fixes some integer n > 0. Then, at each time step f I,... n, our algorithm is required to output (LTToep((L))a)
where ~ (0, Ia). The algorithm's 's goal is to achieve an optimal asymptotic dependence on the unknown value n with respect to the total memory and computation used. We will model computation in units of (t). the cost of multiplying two polynomials of degree t. Because polynomial multiplication can be implemented through divide-and-congue algorithms, we assume that for any k > 0, ((tt) ~ (t) asymptotically as t + co.
Initially, we disregard the challenge of not having access to n and consider the intermediate problem of computing [LTToep(Jr] (I.))] : for some constant that we choose ourselves. As a pre- view of our eventual strategy for handling unbounded inputs, we assume that we have access to a pre-computed solution of size t/2. From here, we observe that LTToep f(z; -2,-) -6) = LTToep(f fi (2)) ( 7)) LTToop((ss d)). So. it suffices to compute each of these ma- trices in isolation. The final product can then be computed using (t) (or just M (t) if 0).
To compute LTTocp((1 we use the fact that fi = Σ ( (-1/2). This can be used to derive the recurrence relation [29] = 1, [=T']_ = (1 - 2m (am-"Iff presented in prior works 27 23
This recurrence lets us compute the coefficients of this matrix in O(t) time and space.
To compute the cofficients of [TTocp(fa(2: we begin with the fact that f=(;; 1) m++1 which can be derived from the Taylor expansion of In(1 + z). This intermediate sequence can also clearly be computed in linear time and space. To account for the power of -7, we use the identity
1g(2:-7) = exp(-yIn(f2 (2( 1))). To compute (n(f2(2;) 1)), we use the fact that In' (f; 1)) (lai))
Ia(='T) The coefficients of fá(2; 1) can be directly computed from the coefficients of fa(2; 1) through term-by-term differentiation, and using the division algorithm of Hanrot and Zimmermann (25) lets us compute the ratio f²(2; f2() using 2.25.((t.. (t). Term-by berm-by-term integration then allows us to recover all but the constant term of (n(f((2; (2; 1)) in linear time, but this is sufficient because we know In(f2(0; 1)) = In( = O.
Having shown that we can efficiently compute the Taylor coefficients of -y Innnn(((22 1)), it remains to find the coefficients of f2(2; -y) = exp(- In(f2(2; 1)). We achieve this by using the algorithm also presented in (25 that takes an order 1/2 approximation of exp(h) as input and produces an order approximation using 2.25M(
Finally, we can rewrite fa(z; 8) as (2 1n(f2(22 1))* The allows us to reuse our earlier computation of the Taylor coefficients of (n(f((2: 1f). Dividing by z corresponds to simple shift of the coefficients. All that remains is to account for the power of 8, which can be done in 4.5 using the same technique described above for y. We can improve this to just 2.25 (1) if 8 = -y by computing the quotient f2(2; f)/5s(z;) 1) before applying the power operation. Doing so also saves us an extra M (1) by removing the need to multiply LTToep(fall fz(2; 7) and LTToop( (z((z; d) at the end.

---

In total, we require (t) to compute [[]. plus one more (t) to compute [L] To extend to the case of general n, we initialize t=2 and double it when we are asked output the t + 1st estimate.
This gives us a total cost over the entire input of 12 (nM, which can be cut down 17.5.M (m) i = -..0 or (3M when = When polynomial multiplication is implemented with FFTs, we arrive at O(n log n) time and (n) space complexity,
Σ flog, =| M(2)) ~ 12 E fluga #1 2- M (n) S k=1
k=1
asympiotically matching the algorithm of Henzinger et al. [27]. But note that because we have to adjust on the fly, our algorithm requires amortized (loo () time at each step, compared to O(n log n) pre-processing and (1) time per step for Henzinger al. (27]
5 Implementation and Extensions
In this section, we investigate various practical considerations in the implementation of Algorithm We also consider relaxing the assumption that n is completely unknown by giving the algorithm access to (possibly unreliable) side information on its value, and propose approximate variant (Algorithm 2) which sacrifices some theoretical rigor for a greater than 5x improvement in running time for large inputs. Finally, we show that [Alorithm can be used subcomponent of the hybrid mechanism of Chan et al. [1]] to achieve exactly Olog" t) variance with improved constants compared to their original approach.
Choosing the value of a. While it is in principle possible to set a arbitrarily small, this would be unwise. To see why, observe that for the purposes of bounding sensitivity, there is stark qualitative gap between the matrix LoToepp -1/2 - 10 10-100, 8)), which has finite column norm, and the matrix LTToep(f(e - 1/2, 6)) whose column norm diverges. But at the same time, the row norms of the matrices LTToep(f(:: 1/2 10 1001000--00 100 -)) and LTTocp(f 1/2, -5)) both diverge at pretty much the same rate. This asymmetry implies that reducing a past a certain point does little to improve our actual error while inviting numerical instability.
So, how should a be chosen? We observe that, as of mid-2025, the world's population is estimated to be about 8.2e9. If every single one of those people contributed 100 data points to our algorithm, then we would have In 0.01 x 1.03. We conclude that setting a = 0.01 is likely a safe and practical choice for most applications.
Choosing the value of 5. There are three natural choices for setting the value of 5, representing different tradeoffs in speed and accuracy. Setting& 8 = 0 the fastest option computationally, but leads to sub-optimal rate of growth in error. Choosing 6 = -y is roughly 1.5x slower. but substantially
improves error when n is greater than 1,000 or so. Finally, the special value 8 = -67/5 is notable
because it causes the first two Taylor coefficients of both ft and JR to match the function (1 11-33 (1-2)-1) =)-1/2
exactly. For a fixed y, this gives us the L and R matrices that are closest to 1/2 subject to the intuitively reasonable constraint that R. This option is the most expensive, but empirically leads to improved error for greater than 2 which is shown in Figure 2
Exploiting imperfect information about Up to this point we have assumed that is unknown and impossible to predict, but in practice, history or expert knowledge might suggest a range of plausible values. We model this side information with the double-inequaliy no < Crg for some no, C' > O, which is given to the algorithm. We allow these bounds to be unreliable in two senses the upper bound might be loose, it might be entirely wrong. We show that our algorithm can make efficient use of this information when it is reliable without incurring any additional error when it isn" 't.
Our basic strategy is to simply pre-compute La out to Cno terms. Provided that the upper bound is true, we recover the same O(n log n) pre-processing time and O(1) work per-iteration as the M1/2 algorithm. Moreover, we suffer no performance cost if the upper bound turns out to be loose because our error at each round depends only on t. In contrast, if we used the 1/12 algorithm with input C'g, we would be forced to calibrate its noise scale to the sensitivity of the larger matrix (M2 Cno. In the unlucky event where it turns out that no. this would produce a uniform ~ 1 log C/(1 lo) multiplicative scaling of variance across the entire input.
Cno-
'Our code is available at huuss//ghhhbbcoooooooooooobousus

---

In the other direction, if the upper bound turns out to be false then our algorithm can recover gracefully using the same doubling trick described in seccion But by that point, the M algorithm will have completely exhausted the privacy budget of the first data-point, forcing it to either weaken its privacy guarantees post-hoc or restart entirely with a new estimate for the input size! Even if this new estimate is perfectly correct, the initial mistake will still lead to Ollog(Cno)) additive error.
Constant-factor speedups through asymptotic expansions. Flajolet and Odlyzko [2 derive the following asymptotic expansion for the Taylor coefficients of f. which we used earlier in a weaker form to derive the asymptotic error rate of our mechanism:
Theorem 2 (Paraphrased from Flajolet and Odlyzko (24) Theorem 3B). Let y, and å be complex numbers not {0, 1, 2, ..... Then the Taylor coefficients of (z; 0) satisfy:
ck (1)6) (In m)
(217,0)) ~ Vma (In
(1 (7 (In (1
Σ k21
(2)
(In(m) (nn))((((((m))
where (x. (x) is a polynomial of degree k:
(x) = v dh 1
dit (T(-)) 1=--//2 Ex (a)
and Ex(x)) is the htth Taylor coefficient of the function g(u) - xu)) - In(1 ru))
While this expression messy, the cost of computing it is independent of m: for fixed approximation order K, the derivatives of the reciprocal gamma function can be precomputed and the remaining
terms can be calculated in O K log K) time using the same techniques described |section This idea naturally suggests [Algorihhm 2. which switches from exact computations to order K approximations once the relative error of the approximation falls below some threshold 1). We plot relative error as a function of t, 5 and K in Figure
We highlight a potential pitfall with this approach, which is that if we approximate Ż x L directly, then we are implicitly choosing R .Moumn and can no longer calibrate our noise to || as normal. Ideally we would like to able to prove a bound
2
2-4
Delative Error
2
like [|M 111-2 I (1 + [[ but this appears to be non-trivial. We therefore take the
2-12
opposite approach, which is to directly approximate
R x R and calibrate our noise to (1 + n) R111-22
2-1
6=0,K=2
K=
M This version of the algorithm provably valid and private, and for large enough in- puts it reduces the computational cost at each power of 2 from (t) to (t) (the cost of one se- ries division), closing over 80% of the computational gap between our algorithm and a standard doubling trick. The tradeoff is multiplicative (1 + 1/) increase error prior to the switch, and the loss of tight, prov- able bounds on eиror after the switch. In InfFigure we compare the performance of the two algorithms,, and find that after switching around = 2 the performance of Algorithm remains indistinguishable from Algorithm out to f = -24
with L = 1
20
6=0,K=4
K=
K=0
6=
25
29
222 t
215
2
Figure 1: Plots the relative error fft-rel/ie from Algorithm ass function of when
0.51. The asymptotic expansion con- verges much more quickly when 5 = 0.
Asymptotic improvements through hybrid mechanisms. In their seminal paper, Chan et al. [I] propose a generic 'Hybrid Mechanism' for continual counting of unbounded streams. The schema requires one (possibly inefficient) unbounded counting algorithm, which operates on the condensed
sequence y/ = Σi= 2h
Ft, and a bounded algorithm, which is restarted whenever / is a power of 2. The privacy budget is divided between these two algorithms, and the partial sum at time t = 2* +r +r xt. The resulting hybrid mechanism
given by adding together estimates for k-1 y/ and Σt= unbounded and typically preserves the exact asymptotic error rate of the chosen bounded algorithm.
8

---

Algorithm 2 Approximate Logarithmic Matrix Method
Require:
Matrix parameters 7, (0,1,...), order K, enror tolerance 1,, privacy parameter Ce,6
for 1,...,, do if = 2m for some integer mn then
Sample 2n ~ (0, (1 + C2, for S - -
1 [ using section 4 ('Computability")
Degree K approximation of [2 'l,R from Equation
if r= > 7) then
Use section 4 to compute next entries of LTToop(fn
else
Use Equation 2 to approximate the next entries of I.T
Save computed sequence [R]]
Compute [R] (Mcum))2
Output (M R 2)e
2-1
Matrix Coefficients
2-4
100
Variance
2
50
22
2 2-1
0
2
26
2 22
28
24
2
2
2
2
24
t
Hybrid (Alg 1: -=-0.5
Alg 1; -=50.51
Smooth Binary
Hybrid (Independent noise)
Alg 1; -=-0.5,, 6=0.51
Sqrt Matrix
Alg 2; 0-50.,, n=le-04
Alg 1; Y=-0.51, 6=0.61
Figure 2: Left: Comparison of the exact variance of different algorithms and parameter choices. Contrast with asymptotics in Table I] The Hybrid mechanism using Algorithm for the unbounded component outperforms the variant using independent noise as in Chan et al. [11]. but both variants exhibit very erratic performance when close a power of For Algorithmm I the parameters 5 == y and 8 = 6-/5 give similar performance, but the latter is slightly better once / > 220 and both outperform 5 = when / > 210 Note that the performance of Algorithm with 5 visually indistinguishable from that of Algorithm 1 Right: Coefficients of the matrices (TToep(fz) (upper) and LTToep(fRR (lower) for various choices of The choice = -67 produces lines that are as close as possible to that of M1/2 without crossing it, which we hypothesize explains its good performance.
The original hybrid mechanism used simple unbounded algorithm that adds independent noise to each input (corresponding to the matrix decomposition L M R = I). Our work enables a more powerful instantiation using Algorithm I as the unbounded algorithm instead ('Hybrid Matrix' in Table T which we compare against the original. For both implementations, we improve on the
original presentation by using M112 for the bounded algorithm and allocating 75% of the privacy budget to the bounded learner, which reduces the constant of the leading O(log" i) term. In the spirit of Honaker [29), we also reuse the outputs of the bounded mechanism on earlier subsequences to optimize the variance of the final estimate. Our results are visualized in Figure 2

---

6 Conclusion
We have shown for the first time that the classic matrix factorization method 33 can be efficiently extended to online settings with unknown input size without the use of doubling tricks. The resulting algorithm is the first that we are aware of that is simultaneously unbounded and smooth with almost-optimal asymptotic error. Empirically, we have also shown that it enjoys excellent constants when its parameters are set correctly, with variance that is uniformly less than 1.5x that of Henzinger et al. [27 for inputs large as 2
Many interesting questions remain unanswered, however. For instance: the only algorithms we are aware of that exactly achieve asymptotically optimal Olog" t) variance in the unbounded setting rely on some form of doubling trick, and despite a great deal of effort, we were not able to find Topp decomposition with this property. Our suspicion that no such decomposition exists, and that this related the classic result that the sequence a, (n log log log no...... ..... log n)
diverges for any k. We believe that a formal proof of this conjecture would be very interesting as it would constitute clean separation between the power of LTToop and general power-tringulaa matrices in online learning. We therefore conclude by posing the following open question:
Open Question 1. Do there exist ToTp matrices L, R. such that [4]][ = [Meoun] limp-400 [10m]]1 < co, and [[4]n||2->oo = O(log" n
References
[1] Naman Agarwal and Karan Singh. The price of differential privacy for online learning. In International Conference on Machine Learning, pages 32-40. PMLR, 2017.
[2] Kareem Amin, Alex Kulesza, and Sergei Vassilvitskii. Practical considerations for differential privacy. arXiv preprint arXiv:2408.07614, 2024.
[3] Joel Daniel Andersson and Rasmus Pagh. A Smooth Binary Mechanism for Efficient Private Continual Ohservation.
[4] Joel Daniel Andersson and Rasmus Pagh. Strcaming Private Continual Counting via Binning, December 2024. URL http://arxiv wwg. otgp at1////b.//22.22/// 07093 arXiw:2412.07003 [cs].
[5] Joel Daniel Andersson and Amir Yehudayoff. On the Space Complexity of Online Convolution, April 2025. URL http://arxiv.. http:/aaxivv..o///aaaa aba/ 255550055118 arXiv:2505.00181 [es].
[6] Joel Daniel Andersson, Monika Henzinger, Rasmus Pagh, Teresa Anna Steiner, and Jalaj Upadhyay. Continual Counting with Gradual Privacy Expiration.
[7] Alexander Bienstock, Ujjwal Kumar, and Antigoni Polychromiadou. DMM: Distributed Matrix Mechanism for Differentially-Priiee Federated Learning using Packed Secret Sharing, October 2024. URLhtttp 7/arxiv //arxiv.org/all abs/ abs/2410. 2410. 16161 arXiv:2410.1616 [es].
[8] Jean Bolot, Nadia Fawaz, Shanmugavelayutham Muthukrishnan, Aleksandar Nikolov, and Nina Taft. Private decayed predicate sums on streams. In Proceedings the 16th International Conference on Database Theory, pages 284-295, 2013.
[9] Mark Bun Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of cryptography conference, pages 635 658. Springer, 2016.
[10] Adrian Rivera Cardoso and Ryan Rogers. Differentially private histograms under continual observation: Streaming selection into the unknown. In International Conference on Artificial Intelligence and Statistics, pages 2397-2419, PMLR, 2022.
[11] T-H Hubert Chan, Elaine Shi. and Dawn Song. Private and continual release of statistics. ACM Transactions on Information and System Security (TISSEC), 14(3):1 224 2011.
[12] Christopher A Choquette-Coon Choo. H Brendan McMahan, Keith Rush, and Abhradeep Thakurta. Multi-epoch matrix factorization mechanisms for private machine learning. arXiv preprint arXiv:2211.06530, 2022.
[13] Christopher A Choquette- Chouu, Arun Ganesh. Ryan McKenna, Brendan McMahan, John Rush, Abhradeep Guha Thakurta, and Zheng Xu. (amplified) banded matrix factorization: A unified approach to private training. Advances in Neural Information Processing Systems,
2023.
10

---

[14] Sergey Denisov, H Brendan McMahan. John Rush. Adam Smith, and Abhradeep Guha Thakurta. Improved differential privacy for sgd via optimal private linear operators adaptive streams, Advances in Neural Information Procexsing Systems, 35:5910-5924, 2022.
[15] Jinshuo Dong, Aaron Roth, and Weijie Su. Gaussian differential privacy. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 84(1):3-37, 2022.
[16] Krishnamurthy Dj Dvijotham, H. Brendan McMahan, Krishna Pillutla, Thomas Steinke, and Abhradeep Thakurta. Efficient and Near-Optimal Noise Generation for Streaming Differential Privacy. In 2024 IEEE 65th Annual Symposium on Foundations of Computer Science (FOCS), pages 2306 2317, October 2024. doi: 10.1 10100//0066666..... 202.660222001333.3 35. JRLLhttpss///eeexpplrrs ieee 3rg//bocumonn/1175666/
Parnumber-1075604 ISSN: 2575-8454.
[17] Cynthia Dwork and Kobbi Nissim. Privacy-presetey datamining on vertically partitioned databases. In Advances Cryptology- CRYPTO 2004: 24th Annual International Cryptology Conference, Santa Barbura, Califormia, USA, August 15-19, 2004. Pruceedingy 24, pages 528-544. Springer, 2004.
[18] Cynthia Dwork, Moni Naor, Toniann Pitassi, and Guy Rothblum. Differential privacy under continual observation.
[19] Cynthia Dwork. Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Thirl Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3. pages 265-284, Springer, 2006.
[20] Cynthia Dwork. Aaron Roth, al. The algorithmic foundations of differential privacy. Foundations and Trends Theoretical Computer Science, (3-4))211-401) 2014.
[21] Cynthia Dwork, Kunal Talwar, Abhradeep Thakurta, and Li Zhang. Analyze gauss: optimal bounds for privacy-preservee principal component analysis. In Proceedings of the forty-sixth annual ACM symposium on Theory of computing, pages 11-20, 2014.
[22] Alexander Edmonds, Aleksandar Nikolov, and Jonathan Ullman. The Power Factorization Mechanisms in Local and Central Differential Privacy, November 2019. URL http::////// org/ htt///aa//111111/11 08339 Siti:1911.0833 [es].
[23] Hendrik Fichtenberger, Monika Henzinger, and Jalaj Upadhyay. Constant matters: Fine-grained enror bound differentially private continual observation. In International Conference Machine Learning, pages 10072 10092. PMLR, 2023.
[24] Philippe Flajolet and Andrew Odlyzko. Singularity analysis of generating functions. SIAM Journal on discrete mathematics, 32):216-240, 1990.
[25] Guillaume Hanrot and Paul Zimmermann. Newton iteration revisited, 2004.
[26] Florian Hartmann and Peter Kairouz. Distributed differential privacy for federated learning. Google Research, 2023.
[27] Monika Henzinger, Jalaj Upadhyay, and Sarvagya Upadhyay. Almost Tight Error Bounds on Differentially Private Continual Counting. 2023.
[28] Monika Henzinger, Jalaj Upadhyay, and Sarvagya Upadhyay. unifying framework for differentially private sums under continual observation. In Proceedings of the 2024 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 1018. SIAM, 2024.
[29] James Honaker. Efficient use of differentially private binary trees. Theory and Practice of Differential Privacy (TPDP 2015), London, UK, 2:26 2015.
[30] Prateek Jain, Pravesh Kothari, and Abhradeep Thakurta. Differentially Private Online Learning.
[31] Fredrik Johansson, Vinzent Steinberg, Sergey B Kirpichev, Kristopher I. Kuhlman, Aaron Meurer, Ondřej Čertík, Case Van Horsen, Paul Masson, Juan Arias De Reyna, Timo Hartmann, et al. mpmath: a python lihrary for
floating-point arithmetic. Zenodo, 2013.
[32] Peter Kairouz, Brendan McMahan, Shuang Song, Om Thakkar, Abhradeep Thakurta, and Zheng Xu. Practical and private (deep) learning without sampling or shuffling. In International Conference on Machine Learning, pages 5213-5225 PMLR, 2021.
[33] Chao Li. The matrix mechanism: optimizing linear counting queries under differential privacy.
11

---

[34] Brendan McMahan, Abhradeep Thakurta, Galen Andrew, Borja Balle, Peter Kairouz, Daniel Ramage. Shuang Song, Thomas Steinke, Andreas Terzis. Om Thakkar, et al. Federated learning with formal differential privacy guarantees. Google Blog, 2022.
[35] H. Brendan McMahan and Krishna Pillutla. An Inversion Theorem for Buffered Linear Toeplitz (BLT) Matrices and Applications Streaming Differential Privacy, April 2025. URLhttt::/arzzv.org// hrgp://iiwrrr//s/s..s//aaa/// 2504. 21413 arXiv:2504214133 [es].
[36] H Brendan McMahan, Zheng Xu, and Yanxiang Zhang. A hassle-free algorithm private learning in practice: Don't t use tree aggnegation, use blts. arXiv preprint arXiv:2408. 08868, 2024.
[37] Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263-275. IEEE, 2017.
[38] Adam Smith and Abhradeep Thakurta. (Nearly) Optimal Algorithms Private Online Learning in Full-information and Bandit Settings.
[39] Jun Tang, Aleksandra Korolova, Xiaolong Bai, Xueqiang Wang, and Xiaofeng Wang. Privacy loss in apple's 's implementation of differential privacy on macos 10.12. arXiv preprint arXiv:1709.02755 2017.
[40] Jalaj Upadhyay. Sublinear space private algorithms under slicing window model. International Conference on Machine Learning, pages 6363-6372. PMLR, 2019.
[41] Ganzhao Yuan, Yin Yang, Zhenjie Zhang, and Zhifeng Hao. Optimal linear aggregate query processing under approximate differential privacy. CoRR, abs/1602.0430,, 2016.
12

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction are exactly the content of Theorem 1, which prove.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Our work has two main limitations: the computational cost of computing the matrices we consider, and the slightly-suboptimall asymptotic error growth. These issues are discussed in detail in section 4) and the conclusion, respectively.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
13

---

Answer: [Yes]
Justification: Our primary theoretical result heorem which proved fully in section 4 Other minor results in section 5 Jrre presented with justification. One computational proof, related to the sensitivity calculation, is deferred to the appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proof's provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Our experiments all relate to non-random numerical quantities that are explic- itly defined in the paper, and we offer a very thorough description of the algorithm used to compute them in section 4
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
14

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We have released code open-source software, including scripts to reproduce all figures the paper. It is available at htttns//gghuuu..coo////jooooooss
dpolo/
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cr cc/
hot.eesuuubisssoooooooooooo for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/nips..ccpublicce gewiis/gguee//eeeeeeeiei.icissee CodeeSumiiiseeeeee onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: We only conduct two small experiments, which are described in Figure Tand Figure 2] We provide all parameters for our algorithm, and explicitly deseribe the construction of the hybrid mechanisms. The Smooth Binary and Sqrt Matrix algorithms have hyperparameters.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[NA]
Justification:
Our experiments are all exact and involve no randomness.
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [No]
There are special computational resources required to reproduce our experiments. All of them were carried out in python using a single commercial CPU in few seconds or minutes.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported didn't 'tttt make it into the paper).
paper (e.g., preliminary or failed experiments that NeurlPS Code of Ethics https::///// /tte::////eeree/e httpp///.....p.cecccccccceeeeeea
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the
Answer: [Yes]
Justification: Our work is largely theoretical and defensive in nature, and does not involve any human subjects sensitive datasets.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [No]
16

---

Justification: The work is largely theoretical and not tied to any concrete application. We do not anticipate any particular negative societal impacts.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation. generating fake profiles, surveillance), fairness considerations (c.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper does not release any data or models.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We do not use any existing data or models. The primary package we use is mpmath, which we cite in Appendix A
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
17

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperssi thoode com/ com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's ' creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the datasct/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve human subjects.
Guidelines:
18

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification:
This paper did not use LLMs.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should not be described.
19

---

A
Technical Details for Computing Sensitivity
To actually compute the sensitivity, make use Parseval's theorem, which gives us:
= 2T S )
1 2x
fn)²
de
n=0
22
Jo (2
2n
( )
11
10-(1112 (In (2sin
1 (5) +
(T (T- 0)2 1/22-a
(2 (2))
(T - 0)2)
4 In2
2TT
4
276
0 ) + atan2(-sinn sin 0, cos () )²
+ +(aatan atan2
π
In sin
d0
2
Where atan2 x)) arctan(y/z)) possibly shifted by मं fall within (-,, With the change of variables w (TT 0)/2, this simplifies to:
22
n/2
(2 (2c0sw) ( (2 + w²) 11/2-a In2 (2 + w²)
-/22
c2s w)) + aaaan(-ssin(2))) - -cos(2w)) 76 + (atan2(ws - (2
dw
From here, define the functions:
[w) = 2 cos w 12(w) = (I² + Ia(w) = 1 (n2((2(w)) I+ww) = arctan (-w/ (nl[((((()))) + 2w)
By using symmetry and splitting the interval based the offset of alan2, finally arrive at:
22426
x/3
|
Ta())) dw
10 ((()) (In(w) + (I(ww) 2) dw
8/2
4/3
Expressed in this way, both integrands are sufficiently smooth to be numerically integrated to high precision. We mpmath [1 for this purpose in experiments, which supports arbitrary-precision floating point computations and numerical integration.
20


Reviews:
[{"review_id": "HTLS2TUOAl", "reviewer": "Reviewer_mDPS", "summary": "This paper introduces a new differentially private algorithm for the continual release of running counts over streams of unbounded length. Their work addresses a major limitation of prior methods that assume a fixed or bounded stream size. The algorithm achieves near-optimal error (variance O(\\log^{2 + 2\\alpha} t)) using space O(t) and amortized time O(log(t)). \nThe authors construct a novel matrix mechanism by factoring the prefix-sum matrix into two infinite lower-triangular Toeplitz matrices, using carefully designed generating functions. These functions are modified with logarithmic terms to ensure the resulting matrix has bounded column norms as otherwise, the sensitivity of the streams would be unbounded. \nThe authors also integrate their mechanism into the hybrid framework of Chan et al., replacing bounded components with their unbounded version to achieve smoother and more accurate continual counts. They further propose an approximation variant using asymptotic expansions for faster practical performance.", "questions": "1) Line 182 states that the algorithm operates on unbounded streams without the use of doubling tricks, but Line 189 states that you use a standard doubling trick — which is it? \n\n2) Table 1 is confusing, what is the Hybrid Matrix? Is this your contribution? Otherwise where is the citation?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n\nThis paper addresses an important open question in the area of continual counting. The techniques in this paper are strong and builds upon the intuition of previous works\n\nWeaknesses\n\nThe paper would benefit from additional technical details and preliminary material to help readers understand the proposed techniques. At minimum, the formal statements of cited theorems (e.g., Theorem 3B) should be included in the appendix for completeness.\nCorollary 1 should include an explicit proof, especially since this represents the paper's main result. Simply stating that it follows from prior work makes it difficult for readers unfamiliar with those references to verify the correctness of the claim. Providing a complete derivation would make the paper much more accessible.", "was_revised": true, "final_justification": "The authors have responded to my concerns, and I have raised my score accordingly.", "rebuttal": "Thank you for the very helpful review! We agree with many of your suggestions and address all of the weaknesses and questions you raised below:\n\n**Weaknesses**: We definitely want our paper to be accessible to as broad an audience as possible, so this is very valuable feedback! We are happy to include both a formal statement of all cited theorems and a formal proof of Corollary 1 as additional appendices in the final version. The essential idea of the proof is described when we introduce matrix methods in the Related Work section (line 85), but we can make this more explicit.\n\n**Question 1**: We **don't** use a doubling trick in the sense of restarting the entire private learning algorithm, which would lead to a lot of excess error.\n\nWe do, however, use a doubling trick when precomputing matrix products since it lets us amortize the computational cost. This is only relevant for speed and not for accuracy. We agree that the use of two different senses of the term ‘doubling trick’ so close together is unfortunate, and we’ll edit the indicated lines to remove the ambiguity.\n\n**Question 2**: Hybrid Matrix is the Hybrid schema of Chan et al. instantiated with our unbounded matrix mechanism, so it's original to our work. To improve clarity, we'll modify the table to add a reference to the end of Section 5 where it's defined, and also edit that section to explicitly flag the fact that the algorithm discussed is the same as the 'Hybrid Matrix' in the table."}, {"review_id": "TOOlQT4eT6", "reviewer": "Reviewer_G47C", "summary": "This paper studies the problem of privately counting streaming data when the input size, $n$ (the total number of observations), is unknown. The state-of-the-art approach is the matrix mechanism, but it is only effective when $n$ is known in advance. The authors propose an algorithm that operates in the unbounded setting (where n is not known beforehand) and achieves a smooth error over time with an almost-optimal asymptotic error.", "questions": "1. Can the authors clarify the privacy implications of selecting $\\alpha$?\n\n2. I think the unbounded setting is relevant in practice. I am more skeptic of how important smoothness is? I am not familiar with specific applications but in many cases (e.g. SGD, or counting) one does not care much about results after a burn-in period. Can the authors comment on this?\n\n3. It seems like this algorithm is good when the time is unbounded (potentially large, otherwise one could set up a cap and use previous algorithms) but in this long running times setting memory and computation of the algorithm seem large. Is there hope to improve on this? could this be a limiting factor for certain online applications?\n\n\n4. For Algorithm 2 , after switching to the approximation, you lose bounds on error. While it performs well empirically out to t=2^24, can you provide any intuition or heuristic bounds on how the error might behave in a worst-case scenario after the switch?", "limitations": "The presentation of the experimental results could be significantly improved. The figures are difficult to interpret due to unclear labels and uninformative captions.\n\nIt was challenging to distinguish between the different plotted lines, such as the baselines versus Algorithm 1 and Algorithm 2. Furthermore, the specific parameters used for each result were not clearly indicated within the figures themselves. The captions lacked sufficient detail, forcing me to jump back and forth between the main text in Section 5, the figures, and the captions to understand the setup and outcomes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "**Strenghts**\n\nThe paper studies a significant problem in the literature: counting unbounded streams of data. The paper is clearly written. It relies on previous work but proposes an elegant solution to avoid the doubling trick.\n\nThe core idea is to use infinite matrices while controlling the column norm of the factorization matrix R, so that one does not need access to the total count n. The authors achieve this by cleverly designing the underlying function f, incorporating the parameters α and γ, and relying on previous work that analyzes the norm of corresponding matrices.\n\n**Weaknesses**\n\n- Throughout the introduction and theorem statements, the purpose of $\\alpha$ is completely obscure besides its contribution to the error. This is not explained until Section 3, where the authors clarify its role. They add a third function to make the function f square-integrable, which prevents the error from blowing up by $t^\\alpha$  while ensuring the function diverges slowly as z→1.", "was_revised": true, "final_justification": "I am maintaining my score, the authors appropriately answered my questions. I would suggest they clarify the importance of smoothness in this context, since multiple reviewers were initially unclear on the definition and importance.", "rebuttal": "Thank you for your review! It was very helpful and we appreciated all of the insightful questions. We address each of them individually below:\n\n**Question 1**: As long as you pick $\\alpha>0$, $R$ will have a bounded matrix norm, so from a privacy perspective the exact value doesn't matter that much - we can always compute the sensitivity and add sufficient noise to guarantee whatever level of privacy we want. At a high level, we think that selecting $\\alpha$ is best understood as a (fairly low-impact) tradeoff between constant factors and asymptotic growth rates in the variance.\n\n\n**Question 2**: The biggest reason to care about smoothness is that the expected $\\ell_\\infty$ error generally scales with the maximum variance across all time steps. If that’s a relevant metric in a given context, then allowing your variance to fluctuate erratically over time is in some sense inefficient - you'll be penalized for the peaks without being rewarded for the valleys. This is also the motivation behind algorithms like Andersson and Pagh's Smooth Binary mechanism, which has comparable $\\ell_2$ error to the classic binary mechanism but much lower $\\ell_\\infty$ error thanks to being smooth.\n\nA secondary concern is that non-smooth error could complicate downstream analysis by introducing artifacts that look like data anomalies. For instance, if we were using DP continual counting to estimate the spread of an infectious disease, then having dramatically different variance from one time step to the next could plausibly lead to panic or overreactions if the output was shared with non-experts.\n\n**Question 3**: We agree that this is an important consideration for very large-scale deployments. If we restrict ourselves to LTT matrix factorizations, then there isn’t any hope to improve on the space complexity: recent work by Andersson and Yehudayoff has shown that for LTT matrices like ours that correspond to irrational functions, $\\Omega(t)$ space complexity is unavoidable, and generating noise with LTT matrices is fundamentally tied to convolution so we would be very surprised if it was possible to do better than $O(t \\log t)$ time.\n\nThe Toeplitz part of the LTT restriction isn’t fundamental, however, and we’re aware of another recent work in this area (Andersson and Pagh, 2025, SaTML) which uses binning to approximate Toeplitz matrices in a way that only requires sub-linear space. One potential obstacle we can foresee with directly applying their results to our factorization is that their algorithm assumes efficient random access to the $L$ matrix being approximated, which isn’t obviously possible in our case. But, we speculate that this could maybe be circumvented for sufficiently large inputs by using the asymptotic expansion for the elements of $L$ alongside some robustness analysis to show that their algorithm can still work well if the input is allowed to have small errors.\n\n**Question 4**: In general, we believe our empirical results are the most compelling evidence that the approximation is 'safe' from a utility perspective. But as a very rough heuristic, if we imagine that Equation 2 systematically had relative error $\\eta$ across the board, then the inverse matrix would have relative error of roughly $\\eta$ as well, which would imply something like a $(1+\\eta)^2$ overhead in error after adjusting for sensitivity. \n\nIn practice we see that the relative error varies over time, but it does so in a smooth, monotonic way. In our view, it would be pretty surprising if that led to the behavior of the inverse matrix being qualitatively very different from the idealized case of uniform error, especially if that qualitative difference only emerged after a very long period in which it behaved exactly as we would expect.\n\n**Limitations**: Thank you for the helpful feedback! We aren’t totally satisfied with that figure either and have a few ideas for improvements. In particular, for the final version we would like to split the two subfigures apart, which would make it easier to distinguish the lines and also give us more horizontal space to include longer and more informative labels in the legend. We expect that we’ll be able to find enough extra space for this by moving the more technical components of the Computability proof in Section 4 to the appendix, which will also let us expand that section in line with reviewer nSpn’s suggestions. We can also take another pass over the captions to make them more self-contained so readers won’t have to do so much jumping around."}, {"review_id": "RQV3yTyic8", "reviewer": "Reviewer_nSpn", "summary": "The paper considers matrix factorization mechanism for continually counting elements in a stream $x_1,x_2,\\dots$ in a differentially private fashion. At any point of time $t$, our algorithm should return an estimate of $\\sum_{i=1}^tx_i$. The paper considers the case where the $x_i$'s are single bits but state that their results generalize easily to the case of arbitrary vectors. \n\nThe state-of-the-art methods for countinual counting uses the above matrix factorization mechanism which factors the $n$ by $n$ counting matrix $M$ (lower triangular with $1$s on and below the diagonal) into $M=LR$, and the estimate of the counts are obtained by applying $R$ to the vector $x$ of $n$ updates, adding noise to $Rx$ and then multiplying the final result by $L$. With $L=R=M^{1/2}$ this method is near-optimal for both $\\ell_\\infty$ error and $\\ell_2$ error if I understand the literature correctly. \n\nWhile powerful, this factorization has the deficit of only working when the length of the stream $n$ is known in advance, which is often an unrealistic assumption. As the length of the stream increases above $n$, the algorithm fails to retain its privacy guarantees. To resolve this, one can apply a doubling trick, but this solution is somewhat ad hoc and unnatural. The paper's main contribution, is to provide a different factorization that works in the limit $n\\to\\infty$. The error guarantees are quite close to the $\\log t \\log n$ bound on the variance from Henzinger et al. [27] holding at any time step $t$. Namely at any time step $t$, the variance of their estimator is $\\log^{2+2\\alpha}t$ for any desired small constant $\\alpha$. They also show that the matrix vector products are efficiently computable using the fast Fourier transform.", "questions": "Can you detail how you came up with the function $f$? Does a similar construction appear in past work or is this factorization a novel idea? I think the paper was a little unclear about this (or maybe I missed it), but if it's a new construction, that adds to the novelty of your work. \n\nI find that the paper is missing a final statement on the tradeoffs between utility and privacy for continual counting. The table on page 3 does not include any dependencies on $\\varepsilon$ and $\\delta$. Corollary 1 does mention what the noise scales with in the matrix mechanism, but how does this affect the final bound? I'm assuming such a statement wouldn't be too hard to produce from the stated results, but I think it would benefit the paper. I think presently it's not even mentioned explicitely that you consider approximate DP.\n\nYou mention that your results easily generalize to $x_t\\in \\mathbb{R}^d$. Could you comment on why this is the case. If it generalizes easily, why aren't the theorems stated in this more general setting? Are there any proofs that should be modified and how? Does it affect the proofs that the arriving vectors can have negative coordinates in the general setting? \n\nYou compute the variance of your estimator which suffices to get bounds on the expected error. However, often we are interested in also obtaining bounds that work with high probability. Can you discuss whether your techniques achieve this, or whether there is fundamental limitations in getting such bounds?\n\nI think it would be useful to state the theoretical guarantees that are achievable using the doubling trick. I understand that this method has impracticalities, but I'm currently unsure whether your method also comes with asymptotic improvements in the unbounded case. Could you discuss this?\n\n\nSome more detailed comments:\n\nl136-137. On the contrary, I found this choice unfortunate and very confusing. Is it correctly understood that $\\delta$ is used for two completely unrelated notions? It seems so, since later in the paper $\\delta$ can be negative.  \n\nl175-176: Your work could be more clear about in which regions your functions are analytic. Also, it is not immediately clear to me why the definitions by $z$ makes the functions analytic. \n\nl204 and rest of the page: This proof is quite difficult to read and could use some polishing. Specific comments below:\n\nl206: What is $n_0$? It doesn't seem to be introduced properly and some quantifiers are missing in the statement.\n\nl216-217: This is very informal. I don't know what $M(kt)\\sim kM(t)$ means. For $t=1$, with some interpretation, it seems to imply that $M(k)=O(k)$ which I don't think is true. \n\nl227-240: I couldn't  follow how this shows to how we can compute the coefficients as some parts are very loosely written and many details are glossed over. This seems to be one of the core parts of your theoretical contribution, so I think it would be nice to provide more details.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "(1) I find the paper relatively well motivated in that continual counting is an important problem and it makes sense to strive for a more smooth solution that doesn't resort to 'clumsy' doubling tricks.\n\n(2) It is mathematically quite interesting that there is a matrix factorization mechanism with almost the same error guarantees that works in the limit $n\\to \\infty$. I also like the open problem at the end of the paper.\n\n\\textbf{Weaknesses}:\n\n(1) I find that the technical contribution is perhaps a little underwhelming. The main contribution is the analysis of the new factorization which is technical but relatively straightforward. I am a little in doubt whether the new factorization is new or has appeared in past work, e.g., Flajolet and Odlyzko [24]. \n\n(2) While it is nice to have results in the unbounded setting, they come with a worse logarithmic dependence, and it is unclear to me whether their approach would actually lead to better estimators than using some doubling trick. \n\n\n(3) Parts of the paper are quite hard to read and could use some rewriting for better clarity and mathematical precision. \n\n\\textbf{Overall Evaluation}: Taking the above points into consideration I am hesitant to accept the paper at NeurIPS.", "was_revised": true, "final_justification": "Please see the answer to the authors", "rebuttal": "Thank you for providing so many detailed suggestions and insightful questions! We appreciate being pushed to be more mathematically precise and feel confident that the final paper will be much clearer as a result. We respond individually to each of the weaknesses and questions you raised below:\n\n**Weakness 1**: Although the sequence we consider is based on generating functions that have been studied before, this is also the case for many other works in this area - for instance, Henzinger et al. (2023) use the coefficients of the generating function of $1/\\sqrt{1-z}$, which were already known to Newton, and Dvijotham et al. (2024) build on known results about rational approximations of the function $1/\\sqrt{1-z}$ on the unit circle that were first published in the 1960s.\n\nLike these prior works, our contribution is not in being the first people to write down this particular sequence, but rather in A) recognizing that the analytic properties of the sequences studied in prior works are equivalent to interesting properties of differentially-private streaming algorithms, like unboundedness, B) showing that the implied algorithm can be implemented in a computationally efficient way, and C) empirically demonstrating that the resulting algorithm is a concrete improvement over the state of the art in relevant metrics.\n\n**Weakness 2**: This is a great point, and it’s true that asymptotically our algorithm is slightly worse than a (well-implemented) doubling trick. But as we show in Figure 2, the slightly-worse logarithmic dependence is counterbalanced by much better constants, and so for the input sizes we evaluate, our approach **does** actually lead to better estimators. In particular, Figure 2 shows that the Hybrid mechanism of Chan et al. (orange line), which is based on a doubling trick, has much higher variance than our proposed algorithm (yellow line).\n\n**Weakness 3**: We address this point in more detail below.\n\n\n**Question 1**: To the best of our knowledge, no prior work in the DP literature has used similar constructions, so in that context we believe it is novel. We also aren’t aware of any earlier work that explicitly considers these functions in the context of LTT matrix factorizations.\n\nAs for how we came up with the function $f$ - we'd been working on the general problem for a few months by starting with the square-root factorization, manually perturbing coefficients to make them convergent, and trying to use Fourier analysis to derive features of the implicitly defined function. Reading Dvijotham et al. (2024) put the idea of going in the opposite direction in our heads. Later on, a search for relevant works turned up the Flajolet and Odlyzko paper and we realized that the functions that they had studied in the context of analytic combinatorics could potentially do what we needed. \n\n**Question 2**: Every algorithm we design and compare against satisfies DP by adding Gaussian noise, and so all of them have exactly the same dependence on epsilon and delta. This is why we don't emphasize the dependence on privacy parameters - both our asymptotic results and our comparisons against related work would be unaffected by varying the privacy level. That said, it does make sense that readers would expect to see some sort of dependency on the privacy parameters. To fix this, we'll modify the second column of Table 1 to indicate that it represents the variance *after* being normalized by a data-independent value that depends on epsilon and delta, analogous to Table 1 in Andersson and Pagh (2023).\n\n**Question 3**: Focusing on bits is a convention in the private counting literature, going all the way back to Chan et al. (2011) and Dwork et al. (2010). The general case can be reduced to bit-counting as follows:\n\nFirst, consider $d$-dimensional bit vectors. We can construct a continual counting algorithm for that setting by applying $d$ versions of our single-bit algorithm in parallel to each coordinate. We can then use composition theorems to control the overall privacy cost, which translates to an extra factor of $d$ in the variance.\n\nNext, consider real-valued vectors in a bounded set with $\\ell_\\infty$ diameter $D$. By shifting and scaling, we can convert them to vectors in $[0,1]^d$. From there, the fact that they can take intermediate values doesn't impact sensitivity, so our private $d$-dimensional bit counting algorithm will work out of the box. At the end, we rescale our estimates, increasing variance by a factor of $D^2$. \n\nSimilar reductions are possible if you instead assume your vectors are in a set with bounded $\\ell_2$ diameter, or if they're contained in an ellipsoid. In particular, it doesn't matter if the original coordinates are negative or not - only the distances between them are important. To be more precise, we can revise this section to say that it's easy to generalize our results to vectors in any bounded subset of $\\mathbb{R}^d$.\n\n**Question 4**: Yes, high-probability bounds can be derived from the variance of each mechanism. The important point here is that the noise added for privacy follows a zero-mean Gaussian distribution. This means that knowing the variance fully determines the distribution and therefore all relevant error metrics, including both expectations and high-probability bounds.\n\nConcretely, if you want a high probability bound on $\\ell_\\infty$ error, you can use MGFs to upper bound the expected maximum error across all time steps and then apply the Borel-TIS inequality, which says that the distribution of the maximum of a set of Gaussian random variables has sub-Gaussian tails. Analogous bounds can be derived for $\\ell_2$ error using the fact that Borel-TIS-like inequalities hold for any Lipschitz function of a normal random variable, including vector norms (see e.g. equation 5 in \"Four Talagrand inequalities under the same umbrella\" by Michel Ledoux).\n\n**Question 5**: The most naive doubling trick will give you $O(\\log^3 t)$ variance. We don't compare against that algorithm because the Hybrid mechanism of Chan et al. (row 2 of the table 1) is a more sophisticated version of the same idea. \n\nAsymptotically speaking, that algorithm is already optimal (i.e. it achieves $O(\\log^2 t)$ variance), but it has pretty poor constants - this is shown in figure 2 (orange line), where it has the worst variance of all of the algorithms we consider. We also show that those constants can be improved substantially by replacing one of its subcomponents with our own algorithm (teal line in figure 2; 'Hybrid Matrix' in table 1). So, even if someone was primarily interested in asymptotic guarantees, they would still be better off using the version of the Hybrid mechanism based on our matrix factorization instead of the classic variant.\n\n**L136-137**: You understand correctly, yes - we're sorry that it ended up being confusing. Our goal here was to make it easier for an interested reader to cross-reference our results with the original Flajolet paper, which uses $\\delta$ as the exponent of the $\\log\\log$ term. We'll revise our definition of DP to use $\\varepsilon_{\\textit{priv}},\\delta_{\\textit{priv}}$ instead of $\\varepsilon,\\delta$ to remove the ambiguity.\n\n**L175-176**: This is a good point and we will clarify - our functions are analytic on the open unit disc. The division by $z$ is there to eliminate the zero of $\\ln(1/(1-z))$ at $z=0$, which makes it possible to take further logarithms or raise our function to non-integer powers without running into issues with the domain of definition.\n\n**L206**: Thank you for pointing this out - the constants $n_0$ and $C$ come from the definition of big-$O$, which we will clarify.\n\n**L216-217**: This model of computation comes from the Hanrot and Zimmerman note that we cite and is intended to simplify away linear and logarithmic terms that don’t matter asymptotically. The intuitive justification is that polynomial multiplication can be implemented as a divide-and-conquer algorithm, and so the cost of multiplying polynomials of degree $tk$ is asymptotically equal to the cost of multiplying $k$ pairs of polynomials with degree $t$.\n\nThe upshot of using this model of computation vs. big-$O$ is that it makes it easy to track the multiplicative constants - every parameterization of our algorithm requires $O(n \\log n)$ time, but this approach lets us additionally estimate that choosing $\\delta=0$ should roughly halve the actual computation required, for example.\n\nRegardless, your counterexample definitely highlights that we were too informal in our presentation, and we'll add a clarification that $M(kt) \\sim kM(t)$ should be interpreted as holding asymptotically for large $t$.\n\n**L227-240**: This section is definitely very dense. Given the suggestions from other reviewers about the clarity of figures and spots where we could include more detail, we plan to move the technical exposition here to the appendix. This will give us space to make it more explicit by giving a step-by-step formula for constructing each of the sequences we consider instead of describing the process in natural language."}, {"review_id": "Y3gCkSqAqt", "reviewer": "Reviewer_8hq2", "summary": "This paper studies the problem of differentially private continual counting for unbounded streams.\nIn particular, the input is a stream of bits $x_1, x_2, ..., x_n$. At each time step $t$, after receiving $x_t$, the algorithm needs to output a private estimate of the partial sum $\\sum_{i=1}^{t} x_i$. Two streams are $x_1, x_2, ..., x_n$ and $x'_1, x'_2, ..., x'_n$ are considered to be neighboring if there is at most one time step $t$ such that $x_t \\ne x'_t$.\nA stream is said to be unbounded if $n$ is unbounded, which means we do not assume a priori bound on $n$.\nA mechanism M is ($\\epsilon$, $\\delta$)-DP if for all $n = 1, 2, ...$, all neighboring streams $x_1, x_2, ..., x_n$ and $x'_1, x'_2, ..., x'_n$ , and all events $S$, $P(M(x_1, ..., x_n) \\in S) \\le e^{\\epsilon} P(M(x'_1, ..., x'_n) \\in S) + \\delta$.\nThe utility of a mechanism is measured from the following aspects in the paper:\n- Error: the variance of the noise added at time step $t$\n- Time complexity: the amount of time for $t$ outputs\n- Space complexity\n\nAnother aspect considered in this paper is that if a mechanism is \"smooth\". A mechanism is smooth if its error is a smooth function of t.\n\nThe private continual counting problem is well-studied and has a large body of literature. However, there are various drawbacks of previous algorithms. The matrix mechanisms cannot be directly applied to the unknown n setting, as their privacy guarantee only holds when n is known. The doubling trick leads to suboptimal and non-smooth error.\nThis paper gets the first algorithm that is simultaneously smooth and unbounded with almost-optimal asymptotic error.\nTheir technique is built on the rational approximation methods of Dvijotham et al. In particular, they introducing novel matrix factorizations based on logarithmic perturbations of the function $1/\\sqrt{1−z}$ .", "questions": "- Is the expectation of $M(X_t)$ equal to $S_t$ ? (I guess you need this for $V(M(X_t))$ to be a reasonable error metric)\n- How to translate V(M(X_t)) to the more standard error metrics?\n- Table 1:\n    - Why is Binary Mechanism not smooth while Sqrt Matrix Mechanism smooth, given they have the same $V(M(X_t))$?\n    - Is there a typo in the $V(M(X_t))$ of Hybrid Binary Mechanism? Isn't $\\log^2(t) + \\log(t)$ just $\\log^2(t)$?", "limitations": "no", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:** This paper obtains nice results for a well-motived and well-studied problem. And it is well-written in general.\n\n**Weaknesses:** The definition of smooth mechanism is confusing to me. It is phrased as an important feature of a mechanism, but it does not seem to be formally defined or explained in detail anywhere. Also see my question below.", "was_revised": true, "final_justification": "I think private continual counting in the unbounded setting is an interesting and well-motivated problem. The authors have addressed my questions and I maintain my score.", "rebuttal": "Thank you for your kind comments! We address all of your questions individually below:\n\n**Question 1**: Yes, all of the mechanisms we consider add zero-mean Gaussian noise, so they're all unbiased estimators.\n\n**Question 2**: To upper-bound the expected $\\ell_\\infty$ error, there’s a standard trick based on moment-generating functions and the log-sum-exp function; if your mechanism runs for $t$ steps and the maximum variance across time steps is $\\sigma^2$, then the expected $\\ell_\\infty$ error is at most $\\sigma \\sqrt{2 \\log t}$. You can also derive high probability bounds using the Borel-TIS inequality, which essentially says that the maximum of Gaussians has sub-Gaussian tails.\n\nFor $\\ell_2$ error, linearity of expectation means we can just add up all of the per-time-step variances, take the square root, and normalize. In the case of matrix mechanisms, this gives us error proportional to $\\sqrt{\\text{tr} LL^T} = \\lVert L \\rVert_F$. But on that note, your question helped us realize that we had a typo in our original presentation: the $1/n$ factor should be inside the square root, not outside of it. So thank you for prompting us to check over that part of the paper again!\n\n**Question 3**: We use 'smooth' to describe the actual variance at each time step, and not just its rate of asymptotic growth. For the binary mechanism, the noise at time step $t$ depends on the number of '1's in the binary representation of $t$, which makes it oscillate. We actually intended to include the binary mechanism in Figure 2 for comparison, but the oscillations were so extreme that it made the rest of the figure illegible. We can clarify this point in the introduction when we first introduce the term.\n\n**Question 4**: That's true, yes. We present it this way to highlight the differences in the internal structure of the various algorithms - the error of the Hybrid Binary mechanism decomposes into the error of the bounded component (which is $O(\\log^2 t)$) and the error of the unbounded component (which is $O(\\log t)$)."}, {"review_id": "9r6h3qj2rK", "reviewer": "Reviewer_4GaH", "summary": "This paper addresses the private continual counting problem in the unbounded setting, where the length of the entire data stream is not known in advance. By introducing a novel matrix factorization, the authors present an algorithm that is simultaneously smooth, unbounded, and with almost-optimal error. They also demonstrate through empirical results that their method outperforms previous approaches.", "questions": "1. Could the authors provide a concrete illustration of why smoothness is important and what advantages an algorithm with smooth error offers?\n2. I am curious why Hybrid Binary and Hybrid Matrix are marked as non-smooth in Table 1. Aren't $\\log^2 t+\\log t$ and $\\log^2t + \\log^{2+2\\alpha}t$ smooth functions of $t$ ?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The authors propose the first algorithm for private continual counting that is smooth, unbounded, and achieves almost-optimal error ($O(\\log^{2+2\\alpha}(t)))$ at round $t$. The algorithm is based on the matrix mechanism with a novel factorization.\n2. They also provide comprehensive experiments, demonstrating that the proposed algorithm outperforms previous methods. \n\nWeakness:\n\n1. The authors do not clearly articulate the benefits of smoothness, which is crucial for understanding the significance of the problem addressed in this paper.\n2. The algorithm incurs higher time and space costs compared to binary-based mechanisms.", "was_revised": true, "final_justification": "This paper addresses the private continual counting problem in the unbounded setting. While the results are nice and the contributions are clear, I am not very sure about the importance of the investigated problem. So I decide to give a borderline accept.", "rebuttal": "Thank you for your very helpful review! We agree with you and reviewer G47C that we should do a better job of explaining the idea of smoothness and why it's important. We respond to each of your questions and concerns individually below:\n\n**Weakness 1**: We go into more detail about the meaning and importance of smoothness in response to your questions, and we can incorporate these details into the final paper to make the significance of our contribution more clear.\n\n**Weakness 2**: Binary-based methods achieve sub-linear space complexity, but this comes at the cost of much worse constant factors in their error. This is shown in Figure 2, where the Smooth Binary mechanism (brown line) has substantially higher error than both the original square-root matrix method (black line) and our new unbounded method (yellow line). \n\nBecause the relative importance of factors like speed, memory usage and accuracy can change a lot depending on the context, we believe that it's valuable to explore the full range of possible tradeoffs. We therefore see our primary contribution as enabling matrix methods to be used in settings where they *would* be practical except for the fact that $n$ is unknown.\n\n**Question 1**: The biggest reason to care about smoothness is that the expected $\\ell_\\infty$ error generally scales with the maximum variance across all time steps. If that’s a relevant metric in a given context, then allowing your variance to fluctuate a over time is in some sense inefficient - you'll be penalized for the peaks without being rewarded for the valleys. This is also the motivation behind algorithms like Andersson and Pagh's Smooth Binary mechanism, which has comparable $\\ell_2$ error to the classic binary mechanism but much lower $\\ell_\\infty$ error thanks to being smooth.\n\nA secondary concern is that non-smooth error could complicate downstream analysis by introducing artifacts that look like data anomalies. For instance, if we were using DP continual counting to estimate the spread of an infectious disease, then having dramatically different variance from one time step to the next could plausibly lead to panic or overreactions if the output was shared with non-experts.\n\n**Question 2**: We use 'smooth' to describe the actual variance at each time step, and not just its rate of asymptotic growth. If you look at Figure 2, you can see that both hybrid mechanisms have very sharp fluctuations in variance whenever $t$ is close to a power of 2 - this is why they’re categorized as non-smooth. We can clarify this point in the introduction when we first use the term."}]

Author rebuttal:

Meta-review: This paper studies differentially private algorithms for the continual release of running counts over streams of unbounded length, observing that previous works assume a fixed or bounded stream size. The algorithm achieves near-optimal error by constructing a novel matrix mechanism that factors the prefix-sum matrix into two infinite lower-triangular Toeplitz matrices, using carefully designed generating functions. 

Despite the high scores of the reviews, concerns emerged about the motivation of the problem setting of unbounded settings, as the abstract assumes $t\le n$ and whether the technical novelty of the paper is sufficiently interesting given that there exist standard doubling tricks, in particular, given that both the matrix mechanism and binary tree mechanism are standard approaches for continual release for private counting. Nevertheless the reviewers agreed that the quantitative contribution of the paper is valuable. 

The reviewer feedback includes a number of actionable items that could strengthen the potential impact of this work; I would encourage the authors to take these points into consideration.
Decision: Accept (poster)