Title: The Target-Charging Technique for Privacy Analysis across Interactive Computations
Venue: NeurIPS 2023
Accepted: yes
Keywords: Differential Privacy; Adaptive Composition; Sparse Vector Technique
Abstract: We propose the \emph{Target Charging Technique} (TCT), a unified privacy analysis framework for interactive settings where a sensitive dataset is accessed multiple times using differentially private algorithms. Unlike traditional composition, where privacy guarantees deteriorate quickly with the number of accesses, TCT allows computations that don't hit a specified \emph{target}, often the vast majority, to be essentially free (while incurring instead a small overhead on those that do hit their targets). TCT generalizes tools such as the sparse vector technique and top-k selection from private candidates and extends their remarkable privacy enhancement benefits from noisy Lipschitz functions to general private algorithms.

The Target-Charging Technique for Privacy Analysis across Interactive Computations

Abstract

We propose the Target Charging Technique (TCT), a unified privacy analysis framework for interactive settings where a sensitive dataset is accessed multiple times using differentially private algorithms. Unlike traditional composition, where privacy guarantees deteriorate quickly with the number of accesses, TCT allows computations that don't hit a specified target , often the vast majority, to be essentially free (while incurring instead a small overhead on those that do hit their targets). TCT generalizes tools such as the sparse vector technique and topk selection from private candidates and extends their remarkable privacy enhancement benefits from noisy Lipschitz functions to general private algorithms.

1 Introduction

In many practical settings of data analysis and optimization, the dataset D is accessed multiple times interactively via different algorithms ( A i ) , so that A i depends on the transcript of prior responses ( A j ( D )) j<i . When each A i is privacy-preserving, we are interested in tight end-to-end privacy analysis. We consider the standard statistical framework of differential privacy introduced in [11]. Composition theorems [14] are a generic way to do that and achieve overall privacy cost that scales linearly or (via 'advanced' composition) with square-root dependence in the number of private computations. We aim for a broad understanding of scenarios where the overall privacy bounds can be lowered significantly via the following paradigm: Each computation is specified by a private algorithm A i together with a target ⊤ i , that is a subset of its potential outputs. The total privacy cost depends only on computations where the output hits its target, that is A i ( D ) ∈ ⊤ i . This paradigm is suitable and can be highly beneficial when (i) the specified targets are a good proxy for the actual privacy exposure and (ii) we expect the majority of computations to not hit their target, and thus essentially be 'free' in terms of privacy cost.

The Sparse Vector Technique (SVT) [12, 30, 18, 34] is a classic special case. SVT is designed for computations that have the form of approximate threshold tests applied to Lipschitz functions. Concretely, each such AboveThreshold test is specified by a 1 -Lipschitz function f and a threshold value t and we wish to test whether f ( D ) ≳ t . The textbook SVT algorithm compares a noisy value with a noisy threshold (independent Laplace noise for the values and threshold noise that can be updated only after positive responses). Remarkably, the overall privacy cost depends only on positive responses: Roughly, composition is applied to twice the number of positive responses instead of to the total number of computations. In our terminology, the target of each test is a positive response. SVT privacy analysis benefits when the majority of AboveThreshold test results are negative (and hence 'free'). This makes SVT a key ingredient in a range of methods [13]: private multiplicative weights [18], Propose-Test-Release [10], fine privacy analysis via distance-tostability [33], model-agnostic private learning [1],and designing streaming algorithms that are robust to adaptive inputs [19, 6].

Xin Lyu

We aim to extend such target-hits privacy analysis to interactive applications of general private algorithms (that is, algorithms that provide privacy guarantees but have no other assumptions): private tests, where we would hope to incur privacy cost only for positive responses, and private algorithms that return more complex outputs, e.g., vector average, cluster centers, a sanitized dataset, or a trained ML model, where the goal is to incur privacy cost only when the output satisfies some criteria. Textbook SVT, however, is less amenable to such extensions: First, SVT departs from the natural paradigm of applying private algorithms to the dataset and reporting the output. A natural implementation of private AboveThreshold tests would add Laplace noise to the value and compare with the threshold. Instead, SVT takes as input the Lipschitz output of the non-private algorithms with threshold value and the privacy treatment is integrated (added noise both to values and threshold). The overall utility and privacy of the complete interaction are analyzed with respect to the non-private values, which is not suitable when the algorithms are already private. Moreover, the technique of using a hidden shared threshold noise across multiple AboveThreshold tests is specific for Lipschitz functions, introduces dependencies between responses, and more critically, results in separate privacy costs for reporting noisy values (that is often required by analytics tasks [22]).

Consider private tests. The natural paradigm is to sequentially choose a test, apply it, and report the result. The hope is to incur privacy loss only on positive responses. Private testing was considered in prior works [21, 7] but in ways that departed from this paradigm: [21] processed the private tests so that a positive answer is returned only when the probability p of a positive response by the private test is very close to 1. This seems unsatisfactory: If the design goal of the private testing algorithm was to report only very high probabilities, then this could have been more efficiently integrated into the design, and if otherwise, then we miss out on acceptable positive responses with moderately high probabilities (e.g. 95%).

Consider now Topk selection , which is a basic subroutine in data analysis, where input algorithms ( A i ) i ∈ [ m ] (aka candidates) that return results with quality scores are provided in a batch (i.e., non interactively). The selection returns the k candidates with highest quality scores on our dataset. The respective private construct, where the data is sensitive and the algorithms are private, had been intensely studied [23, 17, 32]. The topk candidates can be viewed as target-hits and we might hope for privacy cost that is close to a composition over k private computations, instead of over m ≫ k . The natural approach for topk is one-shot (Algorithm 3), where each algorithm is applied once and the responses with topk scores are reported. Prior works on private selection that achieve this analysis goal include those [9, 29] that use the natural one-shot selection but are tailored to Lipschitz functions (apply the Exponential Mechanism [24] or the Report-Noise-Max paradigm [13]) and works [21, 28, 7] that do apply with general private algorithms but significantly depart from the natural one-shot approach: They make a randomized number of computations that is generally much larger than m , with each A i invoked multiple times or none. The interpretation of the selection deviates from top1 and does not naturally extend to topk . We seek privacy analysis that applies to one-shot topk selection with candidates that are general private algorithms.

The natural interactive paradigm and one-shot selection are simple, interpretable, and general. The departures made in prior works were made for a reason: Simple arguments (that apply with both top1 one-shot private selection [21] and AboveThreshold tests) seem to preclude efficient targetcharging privacy analysis: With pure-DP, if we perform m computations that are ε -DP (that is, m candidates or m tests), then the privacy parameter value for a pure DP bound is Ω( m ) ε . With approximate-DP, and even a single 'hit,' the parameter values are (Ω( ε log(1 /δ )) , δ ) . The latter suggests a daunting overhead of O (log(1 /δ )) instead of O (1) per 'hit.' We circumvent the mentioned limitations by taking approximate DP to be a reasonable relaxation and additionally, aim for application regimes where many private computations are performed on the same dataset and we expect multiple, say Ω(log(1 /δ )) , 'target hits' (e.g. positive tests and sum of the k -values of selections). With these relaxations in place, we seek a unified target-charging analysis (e.g. privacy charge that corresponds to O (1) calls per 'target hit') that applies with the natural paradigm across interactive calls and topk selections.

2 Overview of Contributions

We overview our contributions (proofs and details are provided in the Appendix). We introduce the Target-Charging Technique (TCT) for privacy analysis over interactive private computations (see Algorithm 1). Each computation performed on the sensitive dataset D is specified by a pair of

private algorithm A i and target ⊤ i . The interaction is halted after a pre-specified number τ of computations satisfy A i ( D ) ∈ ⊤ i . We define targets as follows:

Definition 2.1 ( q -Target) . Let M : X n →Y be a randomized algorithm. For q ∈ (0 , 1] and ε > 0 , we say that a subset ⊤ ⊆ Y of outcomes is a q -Target of M , if the following holds: For any pair D 0 and D 1 of neighboring data sets, there exist p ∈ [0 , 1] , and three distributions C , B 0 and B 1 such that

The distributions M ( D 0 ) and M ( D 1 ) can be written as the following mixtures:

B 0 , B 1 are ( ε, 0) -indistinguishable,

The effectiveness of a target as a proxy of the actual privacy cost is measured by its q -value where q ∈ (0 , 1] . We interpret 1 /q as the overhead factor of the actual privacy exposure per target hit, that is, the number of private accesses that correspond to a single target hit. Note that an algorithm with a q -target for ε > 0 must be ( ε, 0) -DP and that any ( ε, 0) -DP algorithm has a 1 -target, as the set of all outcomes ⊤ = Y is a 1 -target (and hence also a q -target for any q ≤ 1 ). More helpful targets are 'smaller' (so that we are less likely to be charged) with a larger q (so that the overhead per charge is smaller). We establish the following privacy bounds.

Lemma 2.2 (simplified meta privacy cost of target-charging) . The privacy parameters of Algorithm 1 are ( ε ′ , δ ) where ε ′ ≈ τ q ε and δ = e -Ω( τ ) .

Alternatively, we obtain parameter values ( ε ′ , δ ′ ) = ( f ε ( r, ε ) , f δ ( r, ε ) + e -Ω( τ ) ) where r ≈ τ/q and ( f ε ( r, ε ) , f δ ( r, ε )) are privacy parameter values for advanced composition [14] of r ε -DP computations.

Proof details for a more general statement that also applies with approximate DP algorithms are provided in Section B (in which case the δ parameters of all calls simply add up). The idea is simple: We compare the execution of Algorithm 4 on two neighboring data sets D 0 , D 1 . Given a request ( A , ⊤ ) , let p, C , B , B 0 , B 1 be the decomposition of A w.r.t. D 0 , D 1 given by Definition 2.1. Then, running A on D 0 , D 1 can be implemented in the following equivalent way: we flip a p -biased coin. With probability p , the algorithm samples from C and returns the result, without accessing D 0 , D 1 at all (!). Otherwise, the algorithm needs to sample from B 0 or B 1 , depending on whether the private data is D 0 or D 1 . However, by Property 3 in Definition 2.1, there is a probability of at least q that Algorithm 1 will 'notice' the privacy-leaking computation by observing a result in the target set ⊤ . If this indeed happens, the algorithm increments the counter. On average, each counter increment corresponds to 1 q accesses to the private data. Therefore we use the number of target hits (multiplied by 1 /q ) as a proxy for the actual privacy leak. Finally, we apply concentration inequalities to obtain high confidence bounds on the probability that the actual number of accesses significantly exceeds its expectation of τ/q . The multiplicative error decreases when the number τ of target hits is larger. In the regime τ > ln(1 /δ ) , we amortize the mentioned O (log(1 /δ )) overhead of the natural paradigm so that each target hit results in privacy cost equivalent to O (1 /q ) calls. In the regime of very few target hits (e.g., few private tests or private selections), we still have to effectively 'pay' for the larger τ = Ω(ln(1 /δ )) , but TCT still has some advantages over alternative approaches, due to its use of the natural paradigm and its applicability with general private algorithms.

TCT is simple but turns out to be surprisingly powerful due to natural targets with low overhead. We present an expansive toolkit that is built on top of TCT and describe application scenarios.

2.1 NotPrior targets

A NotPrior target of an ε -DP algorithm is specified by any outcome of our choice (the 'prior') that we denote by ⊥ . The NotPrior target is the set of all outcomes except ⊥ . Surprisingly perhaps, this is an effective target (See Section C for the proof that applies also with approximate-DP):

Lemma 2.3 (Property of a NotPrior target) . Let A : X → Y ∪ {⊥} , where ⊥ ̸∈ Y , be an ε -DP algorithm. Then the set of outcomes Y constitutes an 1 e ε +1 -target for A .

Algorithm 1: Target Charging

Note that for small ε , we have q approaching 1 / 2 and thus the overhead factor is close to 2 . The TCT privacy analysis is beneficial over plain composition when the majority of all outcomes in our interaction match their prior ⊥ . Wedescribe application scenarios for NotPrior targets. For most of these scenarios, TCT is the only method we are aware of that provides the stated privacy guarantees in the general context.

Private testing A private test is a private algorithm with a Boolean output. By specifying our prior to be a negative response, we obtain (for small ε ) an overhead of 2 for positive responses, which matches SVT. TCT is the only method we are aware of that provides SVT-like guarantees with general private tests.

Pay-only-for-change When we have a prior on the result of each computation and expect the results of most computations to agree with their respective prior, we set ⊥ to be our prior. We report all results but pay only for those that disagree with the prior. We describe some use cases where paying only for change can be very beneficial (i) the priors are results of the same computations on an older dataset, so they are likely to remain the same (ii) In streaming or dynamic graph algorithms, the input is a sequence of updates where typically the number of changes to the output is much smaller than the number of updates. Differential privacy was used to obtain algorithms that are robust to adaptive inputs [19, 2] by private aggregation of non-robust copies. The pay-only-for-change allows for number of changes to output (instead of the much larger number of updates) that is quadratic in the number of copies. Our result enables such gain with any private aggregation algorithm (that is not necessarily in the form of AboveThreshold tests).

2.2 Conditional Release

We have a private algorithm A : X →Y but are interested in the output A ( D ) only when a certain condition holds (i.e., when the output is in ⊤ ⊆ Y ). The condition may depend on the interaction transcript thus far (depend on prior computations and outputs). We expect most computations not to meet their release conditions and want to be 'charged' only for the ones that do. Recall that with differential privacy, not reporting a result also leaks information on the dataset, so this is not straightforward. We define A ⊤ := ConditionalRelease ( A , ⊤ ) as the operation that inputs a dataset D , computes y ← A ( D ) . If y ∈ ⊤ , then publish y and otherwise publish ⊥ . We show that this operation can be analysed in TCT as a call with the algorithm and NotPrior target pair ( A ⊤ , ⊤ ) , that is, a target hit occurs if and only if y ∈ ⊤ :

Lemma 2.4 ( ConditionalRelease privacy analysis) . A ⊤ satisfies the privacy parameters of A and ⊤ is a NotPrior target of A ⊤ .

Proof. A ⊤ processes the output of the private algorithm A and thus from post processing property is also private with the same privacy parameter values. Now note that ⊤ is a NotPrior target of A , with respect to prior ⊥ .

We describe some example use-cases:

(i) Private learning of models from the data (clustering, regression, average, ML model) but we are interested in the result only when its quality is sufficient, say above a specified threshold, or when some other conditions hold.

(ii) Greedy coverage or representative selection type applications, where we incur privacy cost only for selected items. To do so, we condition the release on the 'coverage' of past responses. For example, when greedily selecting a subset of features that are most relevant or a subset of centers that bring most value.

(iii) Approximate AboveThreshold tests on Lipschitz functions, with release of above-threshold noisy values: As mentioned, SVT incurs additional privacy cost for the reporting whereas TCT (using ConditionalRelease ) does not, so TCT benefits in the regime of sufficiently many target hits.

(iv) AboveThreshold tests with sketch-based approximate distinct counts: Distinct counting sketches [16, 15, 5] meet the privacy requirement by the built-in sketch randomness [31]. We apply ConditionalRelease and set ⊤ to be above threshold values. In comparison, despite the function (distinct count) being 1-Lipschitz, the use of SVT for this task incurs higher overheads in utility (approximation quality) and privacy: Even for the goal of just testing, a direct use of SVT treats the approximate value as the non-private input, which reduces accuracy due to the additional added noise. Treating the reported value as a noisy Lipschitz still incurs accuracy loss due to the threshold noise, threshold noise introduces bias, and analysis is complicated by the response not following a particular noise distribution. For releasing values, SVT as a separate distinct-count sketch is needed to obtain an independent noisy value [22], which increases both storage and privacy costs.

2.3 Conditional Release with Revisions

We present an extension of Conditional Release that allows for followup revisions of the target. The initial ConditionalRelease and the followup ReviseCR calls are described in Algorithm 2. The ConditionalRelease call specifies a computation identifier h for later reference, an algorithm and a target pair ( A , ⊤ ) . It draws r h ∼ A ( D ) and internally stores r h and a current target ⊤ h ← ⊤ . When r h ∈ ⊤ then r h is published and a charge is made. Otherwise, ⊥ is published. Each (followup) ReviseCR call specifies an identifier h and a disjoint extension ⊤ ′ to its current target ⊤ h . If r h ∈ ⊤ ′ , then r h is published and a charge is made. Otherwise, ⊥ is published. The stored current target for computation h is augmented to include ⊤ ′ . Note that a target hit occurs at most once in a sequence of (initial and followup revise) calls and if and only if the result of the initial computation r h is in the final target ⊤ h .

Algorithm 2: Conditional Release and Revise Calls

We show the following (Proof provided in Section D):

Lemma 2.5 (Privacy analysis for Algorithm 2) . Each ReviseCR call can be analysed in TCT as a call to a 2 ε -DP algorithm with a NotPrior target ⊤ ′ .

Thus, the privacy cost of conditional release followed by a sequence of revise calls is within a factor of 2 (due to the doubled privacy parameter on revise calls) of a single ConditionalRelease call made with the final target. The revisions extension of conditional release facilitates our results for private selection, which are highlighted next.

2.4 Private Topk Selection

Consider the nature one-shot topk selection procedure as shown in Algorithm 3: We call each algorithm once and report the k responses with the highest quality scores. We establish the following:

Lemma 2.6 (Privacy of One-Shot Topk Selection) . Consider one-shot topk selection (Algorithm 3) on a dataset D where {A i } are ( ε, δ i ) -DP. This selection can be simulated exactly in TCT by a sequence of calls to (2 ε, δ ) -DP algorithms with NotPrior targets that has k target hits.

As a corollary, assuming ε < 1 , Algorithm 3 is ( O ( ε √ k log(1 /δ )) , 2 -Ω( k ) + δ + ∑ i δ i ) -DP for every δ > 0 .

To the best of our knowledge, our result is the first such bound for one-shot selection from general private candidates. For the case when the only computation performed on D is a single top1 selection, we match the 'bad example' in [21] (see Theorem J.1). In the regime where k > log(1 /δ ) our bounds generalize those specific to Lipschitz functions in [9, 29] (see Section J). Moreover, Lemma 2.6 allows for a unified privacy analysis of interactive computations that are interleaved with one-shot selections. We obtain O (1) overhead per target hit when there are Ω(log(1 /δ )) hits in total.

The proofs of Lemma 2.6 and implications to selection tasks are provided in Section J. The proof utilizes Conditional Release with revisions (Section 2.3).

2.4.1 Selection using Conditional Release

We analyze private selection procedures using conditional release (see Section J for details). First note that ConditionalRelease calls (without revising) suffice for one-shot above-threshold selection (release all results with a quality score that exceeds a pre-specified threshold t ), with target hits only on what was released: We simply specify the release condition to be s i > t . What is missing in order to implement one-shot topk selection is an ability to find the 'right' threshold (a value t so that exactly k candidates have quality scores above t ), while incurring only k target hits. The revise calls provide the functionality of lowering the threshold of previous conditional release calls (lowering the threshold amounts to augmenting the target). This functionality allows us to simulate a sweep of the m results of the batch in the order of decreasing quality scores. We can stop the sweep when a certain condition is met (the condition must be based on the prefix of the ordered sequence that we viewed so far) and we incur target hits only for the prefix. To simulate a sweep, we run a high threshold conditional release of all m candidates and then incrementally lower the threshold using sets of m revise calls (one call per candidate). The released results are in decreasing order of quality scores. To prove Lemma 2.6 we observe that the one-shot topk selection (Algorithm 3) is simulated exactly by such a sweep that halts after k scores are released (the sweep is only used for analysis).

As mentioned, with this approach we can apply any stopping condition that depends on the prefix . This allows us to use data-dependent selection criteria. One natural such criteria (instead of using

a rigid value of k ) is to choose k when there is a large gap in the quality scores, that the ( k +1) st quality score is much lower than the k th score [35]. This criterion can be implemented using a oneshot algorithm and analyzed in the same way using an equivalent sweep. Data-dependent criteria are also commonly used in applications such as clustering (choose 'the right' number of clusters according to gap in clustering cost) and greedy selection of representatives.

2.5 Best of multiple targets

Multi-target charging is a simple but useful extension of Algorithm 1 (that is 'single target'). With k -TCT, queries have the form ( A , ( ⊤ i ) i ∈ [ k ] ) where ⊤ i for i ∈ [ k ] are q -targets (we allow targets to overlap). The algorithm maintains k counters ( C i ) i ∈ [ k ] . For each query, for each i , we increment C i if r ∈ ⊤ i . We halt when min i C i = τ .

The multi-target extension allows us to flexibly reduce the total privacy cost to that of the 'best' among k target indices in retrospect (the one that is hit the least number of times). Interestingly, this extension is almost free in terms of privacy cost: The number of targets k only multiplies the δ privacy parameter (see Section B.1 for details).

2.6 BetweenThresholds in TCT

The BetweenThresholds classifier refines the AboveThreshold test: The goal is to report if the noisy Lipschitz value is below , between , or above two thresholds t l < t r . We aim for privacy loss that only depends on between outcomes. An SVT-based BetweenThresholds was proposed by [3] (with noisy value and thresholds). Their analysis required the gap size to satisfy t r -t l ≥ (12 /ε )(log(10 /ε ) + log(1 /δ ) + 1) .

We consider the 'natural' BetweenThresholds classifier that compares the Lipschitz value with added Lap (1 /ε ) noise to the two threshold values and reports the result. This is ε -DP and we show (see Section G) that the between outcome is a target with q ≥ (1 -e -( t r -t l ) ε ) · 1 e ε +1 . This q value is at most that of a NotPrior target ( 1 e ε +1 ) and degrades smoothly as the gap decreases. Importantly, there is almost no degradation for fairly small gaps: When t r -t l ≥ 2 /ε (resp. 3 /ϵ ) the q -value is ≈ 0 . 87 e ε +1 (resp 0 . 95 e ε +1 ).

One benefit of TCT BetweenThresholds is that it applies with much smaller gaps t r -t l compared with [3], also asymptotically. Another benefit that holds even for large gaps (where the SVT variant is applicable) is that the natural algorithm requires lower privacy noise for a given accuracy. In Section H we demonstrate this improvement numerically in that we can answer × 6 -× 95 fold more queries for the same accuracy requirements compared to [3]. This bring BetweenThresholds into the practical regime.

We can compare an AboveThreshold test with a threshold t with a BetweenThresholds classifier with t l = t -1 /ε and t r = t + 1 /ε . Surprisingly perhaps, despite BetweenThresholds being more informative than AboveThreshold , as it provides more granular information on the value, its privacy cost is lower , and is much lower when values are either well above or well below the thresholds. Somehow, the addition of the third between outcome to the test tightened the privacy analysis! A natural question is whether we can extend this benefit more generally - inject a 'boundary outcome' as a target when our private algorithm does not have one, then tighten the privacy analysis when queries are 'far' from the boundary. We introduce next a method that achieves this goal.

2.7 The Boundary Wrapper Method

When the algorithm is a tester or a classifier, the result is most meaningful when one outcome dominates the distribution A ( D ) . Moreover, when performing a sequence of tests or classification tasks we might expect most queries to have high confidence labels (e.g., [27, 1]). Our hope then is to incur privacy cost that depends only on the 'uncertainty,' captured by the probability of nondominant outcomes. When we have for each computation a good prior on which outcome is most likely, this goal can be achieved via NotPrior targets (Section 2.1). When we expect the whole sequence to be dominated by one type of outcome, even when we don't know which one it is, this goal can be achieved via NotPrior with multiple targets (Section 2.5). But these approaches do not apply when a dominant outcome exists in most computations but we have no handle on it.

For a private test A , can we choose a moving target per computation to be the value with the smaller probability arg min b ∈{ 0 , 1 } Pr[ A ( D ) = b ] ? More generally, with a private classifier, can we somehow choose the target to be all outcomes except for the most likely one? Our boundary wrapper , described in Algorithm 4, achieves that goal. The privacy wrapper W takes any private algorithm A , such as a tester or a classifier, and wraps it to obtain algorithm W ( A ) . The wrapped algorithm has its outcome set augmented to include one boundary outcome ⊤ that is designed to be a q -target. The wrapper returns ⊤ with some probability that depends on the distribution of A ( D ) and otherwise returns a sample from A ( D ) (that is, the output we would get when directly applying A to D ). We then analyse the wrapped algorithm in TCT.

Note that the probability of the wrapper A returning ⊤ is at most 1 / 3 and is roughly proportional to the probability of sampling an outcome other than the most likely from A ( D ) . When there is no dominant outcome the ⊤ probability tops at 1 / 3 . Also note that a dominant outcome (has probability p ∈ [1 / 2 , 1] in A ( D ) ) has probability p/ (2 -p ) to be reported. This is at least 1 / 3 when p = 1 / 2 and is close to 1 when p is close to 1 . For the special case of A being a private test, there is always a dominant outcome.

A wrapped AboveThreshold test provides the benefit of BetweenThresholds discussed in Section 2.6 where we do not pay privacy cost for values that are far from the threshold (on either side). This is achieved mechanically without the need to explicitly introduce two thresholds around the given one and defining a different algorithm.

We show (proofs provided in Section E) that the wrapped algorithm is nearly as private as its baseline:

Lemma 2.7 (Privacy of a wrapped algorithm) . If A is ε -DP then Algorithm 4 applied to A is t ( ε ) -DP where t ( ε ) ≤ 4 3 ε .

Lemma 2.8 ( q -value of the boundary target) . The outcome ⊤ of a boundary wrapper (Algorithm 4) of an ε -DP algorithm is a e t ( ε ) -1 2( e ε + t ( ε ) -1) -target.

For small ε we obtain q ≈ t ( ε ) / (2( ε + t ( ε )) . Substituting t ( ε ) = 4 3 ε we obtain q ≈ 2 7 . Since the target ⊤ has probability at most 1 / 3 , this is a small loss of efficiency ( 1 / 6 factor overhead) compared with composition in the worst case when there are no dominant outcomes.

The boundary wrapper yields light-weight privacy analysis that pays only for the 'uncertainty' of the response distribution A ( D ) and can be an alternative to more complex approaches based on smooth sensitivity (the stability of A ( D ) to changes in D ) [25, 10, 33]. Note that the boundary-wrapper method assumes availability of the probability of the most dominant outcome in the distribution A ( D ) , when it is large enough. The probability can always be computed without incurring privacy costs (only computation cost) and is readily available with the Exponential Mechanism [24] or when applying known noise distributions for AboveThreshold , BetweenThresholds , and ReportNoise-Max [9]. In Section F we propose a boundary-wrapper that only uses sampling access to A ( D ) .

2.7.1 Applications to Private Learning using Non-privacy-preserving Models

Methods that achieve private learning through training non-private models include Private Aggregation of Teacher Ensembles (PATE) [26, 27] and Model-Agnostic private learning [1]. The private dataset D is partitioned into k parts D = D 1 ⊔ · · · ⊔ D k and a model is trained (non-privately) on each part. For multi-class classification with c labels, the trained models can be viewed as functions { f i : X → [ c ] } i ∈ [ k ] . Note that changing one sample in D can only change the training set of one of the models. To privately label an example x drawn from a public distribution, we compute the

predictions of all the models { f i ( x ) } i ∈ [ k ] and consider the counts n j = ∑ i ∈ [ k ] 1 { f i ( x ) = j } (the number of models that gave label j to example x ) for j ∈ [ c ] . We then privately aggregate to obtain a private label, for example using the Exponential Mechanism [24] or Report-Noisy-Max [9, 29]. This setup is used to process queries (label examples) until the privacy budget is exceeded. In PATE, the new privately-labeled examples are used to train a new student model (and { f i } are called teacher models). In these applications we seek tight privacy analysis. Composition over all queries - for O (1) privacy, only allows for O ( k 2 ) queries. We aim to replace this with O ( k 2 ) 'target hits.' These works used a combination of methods including SVT, smooth sensitivity, distance-to-instability, and propose-test-release [10, 33]. The TCT toolkit can streamline the analysis:

(i) It was noted in [1, 27] that when the teacher models are sufficiently accurate, we can expect that n j ≫ k/ 2 on the ground truth label j on most queries. High-agreement examples are also more useful for training the student model. Moreover, agreement implies stability and lower privacy cost (when accounted through the mentioned methods) is lower. Instead, to gain from this stability, we can apply the boundary wrapper (Algorithm 4) on top of the Exponential Mechanism. Then use ⊤ as our target. Agreement queries, where max j n j ≫ k/ 2 (or more finely, when h = arg max j n j and n h ≫ max j ∈ [ k ] \{ h } n j ) are very unlikely to be target hits.

(ii) If we expect most queries to be either high agreement max j n j ≫ k/ 2 or no agreement max j n j ≪ k/ 2 and would like to avoid privacy charges also with no agreement, we can apply AboveThreshold test to max j n j . If above, we apply the exponential mechanism. Otherwise, we report 'Low.' The wrapper applied to the combined algorithm returns a label in [ c ] , 'Low,' or ⊤ . Note that 'Low' is a dominant outcome with no-agreement queries (where the actual label is not useful anyway) and a class label in [ c ] is a dominant outcome with high agreement. We therefore incur privacy loss only on weak agreements.

2.8 SVT with individual privacy charging

Our TCT privacy analysis simplifies and improves the analysis of SVT with individual privacy charging, introduced by Kaplan et al [20]. The input is a dataset D ∈ X n and an online sequence of linear queries that are specified by predicate and threshold value pairs ( f i , T i ) . For each query, the algorithms reports noisy AboveThreshold test results ∑ x ∈ D f i ( x ) ≳ T . Compared with the standard SVT, which halts after reporting τ positive responses, SVT with individual charging maintains a separate budget counter C x for each item x . For each query with a positive response, the algorithm only charges items that contribute to this query (namely, all the x 's such that f i ( x ) = 1 ). Once an item x contributes to τ hits (that is, C x = τ ), it is removed from the data set. This finer privacy charging improves utility with the same privacy budget, as demonstrated by several recent works [20, 6]. We establish the following:

Theorem 2.9 (Privacy of Algorithm 5) . Assume ε < 1 . Algorithm 5 is ( O ( √ τ log(1 /δ ) ε, 2 -Ω( τ ) + δ ) -DP for every δ ∈ (0 , 1) .

Compared with prior work [20]: Algorithm 5 simply adds Laplace noise to obtain ˆ f i = (∑ x ∈ D f i ( x ) ) + Lap (1 /ε ) and then tests whether ˆ f i ≥ T , whereas [20] adds two independent Laplace noises and publishes the approximate sum ˆ f i for 'Above-Threshold' without incurring additional privacy loss. Our analysis is much simpler (few lines instead of several pages) and significantly tighter, also asymptotically: For the privacy bound in the statement of Theorem 5, our additive error is lower by a log(1 /ε ) √ log(1 /δ ) factor. Importantly, our improvement aligns the bounds of SVT with individual privacy charging with those of standard SVT, bringing the former into the practical regime. See Section I for details.

Conclusion We introduced the Target Charging Technique (TCT), a versatile unified privacy analysis framework that is particularly suitable when a sensitive dataset is accessed multiple times via differentially private algorithms. We provide an expansive toolkit and demonstrate significant improvement over prior work for basic tasks such as private testing and one-shot selection, describe use cases, and list challenges for followup works. TCT is simple with low overhead and we hope will be adopted in practice.

Acknowledgement Edith Cohen is partially supported by Israel Science Foundation (grant no. 1156/23)

References

Raef Bassily, Om Thakkar, and Abhradeep Guha Thakurta. Model-agnostic private learning. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 31. Curran Associates, Inc., 2018.

Amos Beimel, Haim Kaplan, Yishay Mansour, Kobbi Nissim, Thatchaphol Saranurak, and Uri Stemmer. Dynamic algorithms against an adaptive adversary: Generic constructions and lower bounds. CoRR , abs/2111.03980, 2021.

Mark Bun, Thomas Steinke, and Jonathan Ullman. Make Up Your Mind: The Price of Online Queries in Differential Privacy , pages 1306-1325. 2017.

H. Chernoff. A measure of the asymptotic efficiency for test of a hypothesis based on the sum of observations. Annals of Math. Statistics , 23:493-509, 1952.

E. Cohen. Hyperloglog hyper extended: Sketches for concave sublinear frequency statistics. In KDD . ACM, 2017. full version: https://arxiv.org/abs/1607.06517 .

Edith Cohen, Xin Lyu, Jelani Nelson, Tam´ as Sarl´ os, Moshe Shechner, and Uri Stemmer. On the robustness of countsketch to adaptive inputs. In Proceedings of the 39th International Conference on Machine Learning (ICML) , 2022.

Edith Cohen, Xin Lyu, Jelani Nelson, Tam´ as Sarl´ os, and Uri Stemmer. Generalized Private Selection and Testing with High Confidence. In 14th Innovations in Theoretical Computer Science Conference (ITCS 2023) , volume 251 of Leibniz International Proceedings in Informatics (LIPIcs) , Dagstuhl, Germany, 2023. Schloss Dagstuhl - Leibniz-Zentrum f¨ ur Informatik.

Edith Cohen, Xin Lyu, Jelani Nelson, Tam´ as Sarl´ os, and Uri Stemmer. Optimal differentially private learning of thresholds and quasi-concave optimization. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing , STOC 2023, page 472-482, New York, NY, USA, 2023. Association for Computing Machinery.

David Durfee and Ryan M. Rogers. Practical differentially private top-k selection with paywhat-you-get composition. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d'Alch´ e-Buc, Emily B. Fox, and Roman Garnett, editors, Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada , pages 3527-3537, 2019.

Cynthia Dwork and Jing Lei. Differential privacy and robust statistics. STOC '09, New York, NY, USA, 2009. Association for Computing Machinery.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In TCC , 2006.

Cynthia Dwork, Moni Naor, Omer Reingold, Guy N. Rothblum, and Salil Vadhan. On the complexity of differentially private data release: Efficient algorithms and hardness results. In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing , STOC '09, page 381-390, New York, NY, USA, 2009. Association for Computing Machinery.

Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci. , 9(3-4):211-407, aug 2014.

Cynthia Dwork, Guy N. Rothblum, and Salil P. Vadhan. Boosting and differential privacy. In 51th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2010, October 23-26, 2010, Las Vegas, Nevada, USA , pages 51-60. IEEE Computer Society, 2010.

P. Flajolet, E. Fusy, O. Gandouet, and F. Meunier. Hyperloglog: The analysis of a near-optimal cardinality estimation algorithm. In Analysis of Algorithms (AofA) . DMTCS, 2007.

P. Flajolet and G. N. Martin. Probabilistic counting algorithms for data base applications. Journal of Computer and System Sciences , 31:182-209, 1985.

Arik Friedman and Assaf Schuster. Data mining with differential privacy. In Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , KDD '10, page 493-502, New York, NY, USA, 2010. Association for Computing Machinery.

Moritz Hardt and Guy N. Rothblum. A multiplicative weights mechanism for privacypreserving data analysis. In 51th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2010, October 23-26, 2010, Las Vegas, Nevada, USA , pages 61-70. IEEE Computer Society, 2010.

Avinatan Hassidim, Haim Kaplan, Yishay Mansour, Yossi Matias, and Uri Stemmer. Adversarially robust streaming algorithms via differential privacy. In Annual Conference on Advances in Neural Information Processing Systems (NeurIPS) , 2020.

Haim Kaplan, Yishay Mansour, and Uri Stemmer. The sparse vector technique, revisited. In Mikhail Belkin and Samory Kpotufe, editors, Conference on Learning Theory, COLT 2021, 15-19 August 2021, Boulder, Colorado, USA , volume 134 of Proceedings of Machine Learning Research , pages 2747-2776. PMLR, 2021.

Jingcheng Liu and Kunal Talwar. Private selection from private candidates. In Moses Charikar and Edith Cohen, editors, Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, STOC 2019, Phoenix, AZ, USA, June 23-26, 2019 , pages 298-309. ACM, 2019.

Min Lyu, Dong Su, and Ninghui Li. Understanding the sparse vector technique for differential privacy. Proc. VLDB Endow. , 10(6):637-648, 2017.

Frank McSherry and Ilya Mironov. Differentially private recommender systems: Building privacy into the netflix prize contenders. In Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , KDD '09, page 627-636, New York, NY, USA, 2009. Association for Computing Machinery.

Frank McSherry and Kunal Talwar. Mechanism design via differential privacy. In 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS 2007), October 20-23, 2007, Providence, RI, USA, Proceedings , pages 94-103. IEEE Computer Society, 2007.

Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. Smooth sensitivity and sampling in private data analysis. In Proceedings of the Thirty-Ninth Annual ACM Symposium on Theory of Computing , STOC '07, page 75-84, New York, NY, USA, 2007. Association for Computing Machinery.

Nicolas Papernot, Mart´ ın Abadi, ´ Ulfar Erlingsson, Ian J. Goodfellow, and Kunal Talwar. Semisupervised knowledge transfer for deep learning from private training data. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings . OpenReview.net, 2017.

Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and ´ Ulfar Erlingsson. Scalable private learning with PATE. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net, 2018.

Nicolas Papernot and Thomas Steinke. Hyperparameter tuning with R´ enyi differential privacy. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022.

Gang Qiao, Weijie J. Su, and Li Zhang. Oneshot differentially private top-k selection. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event , volume 139 of Proceedings of Machine Learning Research , pages 8672-8681. PMLR, 2021.

Aaron Roth and Tim Roughgarden. Interactive privacy via the median mechanism. In Leonard J. Schulman, editor, Proceedings of the 42nd ACM Symposium on Theory of Computing, STOC 2010, Cambridge, Massachusetts, USA, 5-8 June 2010 , pages 765-774. ACM, 2010.

Adam Smith, Shuang Song, and Abhradeep Thakurta. The flajolet-martin sketch itself preserves differential privacy: Private counting with minimal space. In Proceedings of the 34th International Conference on Neural Information Processing Systems , NIPS'20, 2020.

Thomas Steinke and Jonathan R. Ullman. Tight lower bounds for differentially private selection. In Chris Umans, editor, 58th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2017, Berkeley, CA, USA, October 15-17, 2017 , pages 552-563. IEEE Computer Society, 2017.

Abhradeep Guha Thakurta and Adam Smith. Differentially private feature selection via stability arguments, and the robustness of the lasso. In Shai Shalev-Shwartz and Ingo Steinwart, editors, Proceedings of the 26th Annual Conference on Learning Theory , volume 30 of Proceedings of Machine Learning Research , pages 819-850, Princeton, NJ, USA, 12-14 Jun 2013. PMLR.

Salil P. Vadhan. The complexity of differential privacy. In Yehuda Lindell, editor, Tutorials on the Foundations of Cryptography , pages 347-450. Springer International Publishing, 2017.

Yuqing Zhu and Yu-Xiang Wang. Adaptive private-k-selection with adaptive k and application to multi-label pate. In Gustau Camps-Valls, Francisco J. R. Ruiz, and Isabel Valera, editors, Proceedings of The 25th International Conference on Artificial Intelligence and Statistics , volume 151 of Proceedings of Machine Learning Research , pages 5622-5635. PMLR, 28-30 Mar 2022.

A Preliminaries

Notation. We say that a function f over datasets is t -Lipschitz if for any two neighboring datasest D 0 , D 1 , it holds that | f ( D 1 ) -f ( D 0 ) | ≤ t . For two reals a, b ≥ 0 and ε > 0 , we write a ≈ ε b if e -ε b ≤ a ≤ e ε b .

For two random variables X 0 , X 1 , we say that they are ε -indistinguishable, denoted X 0 ≈ ε X 1 , if their max-divergence and symmetric counterpart are both at most ε . That is, for b ∈ { 0 , 1 } , max S ⊆ supp ( X b ) ln [ Pr[ X b ∈ S ] Pr[ X 1 -b ∈ S ] ] ≤ ε .

We similarly say that for δ > 0 , the random variables are ( ε, δ ) -indistinguishable, denoted X 0 ≈ ε,δ X 1 , if for b ∈ { 0 , 1 }

For two probability distributions, B 0 , B 1 We extend the same notation and write B 0 ≈ ε B 1 and B 0 ≈ ε,δ B 1 when this holds for random variables drawn from the respective distributions.

The following relates ( ε, 0) and ( ε, δ ) -indistinguishability with δ = 0 and δ > 0 .

Lemma A.1. Let B 0 , B 1 be two distributions. Then B 0 ≈ ε,δ B 1 if and only if we can express them as mixtures

where N 0 ≈ ε N 1 .

We treat random variables interchangeably as distributions, and in particular, for a randomized algorithms A and input D we use A ( D ) to denote both the random variable and the distribution.

For a space of datasets equipped with a symmetric neighboring relation, we say an algorithm A is ε -DP(pure differential privacy), if for any two neighboring datasets D and D ′ , A ( D ) ≈ ε A ( D ′ ) . Similarly, we say A is ( ε, δ ) -DP (approximate differential privacy) if for any two neighboring datasets D,D ′ , it holds that A ( D ) ≈ ε,δ A ( D ′ ) [11]. We refer to ε, δ as the privacy parameters .

A private test is a differentially private algorithm with Boolean output (say in { 0 , 1 } ).

Remark A.2. The literature in differential privacy uses different definitions of neighboring datasets. TCT, and properties in these preliminaries, apply with any symmetric relation over the space of possible input datasets.

The following is immediate from Lemma A.1:

Corollary A.3 (Decomposition of an approximate DP Algorithm) . An algorithm A is ( ε, δ ) -DP if and only if for any two neighboring datasets D 0 and D 1 we can represent each distribution A ( D b ) ( b ∈ { 0 , 1 } ) as a mixture

where N 0 ≈ ε N 1 .

Differential privacy satisfies the post-processing property (post-processing of the output of a private algorithm remains private with the same parameter values) and also has nice composition theorems:

LemmaA.4 (DP composition [11, 14]) . An interactive sequence of r executions of ε -DP algorithms satisfies ( ε ′ , δ ) -DP for

ε ′ = rε and δ = 0 by basic composition [11] , or

for any δ > 0 ,

by advanced composition [14] .

A.1 Simulation-based privacy analysis

Privacy analysis of an algorithm A via simulations is performed by simulating the original algorithm A on two neighboring datasets D 0 , D 1 . The simulator does not know which of the datasets is the actual input (but knows everything about the datasets). Another entity called the 'data holder' has the 1-bit information b ∈ { 0 , 1 } on which dataset it is. We perform privacy analysis with respect to what the holder discloses to the simulator regarding the private bit b (taking the maximum over all choices of D 0 , D 1 ). The privacy analysis is worst case over the choices of two neighboring datasets. This is equivalent to performing privacy analysis for A .

Lemma A.5 (Simulation-based privacy analysis) . [8] Let A be an algorithm whose input is a dataset. If there exist a pair of interactive algorithms S and H satisfying the following 2 properties, then algorithm A is ( ε, δ ) -DP.

0 1

For every two neighboring datasets D , D and for every bit b ∈ { 0 , 1 } it holds that

Here ( S ( D 0 , D 1 ) ↔ H ( D 0 , D 1 , b ) ) denotes the outcome of S after interacting with H .

Algorithm H is ( ε, δ ) -DP w.r.t. the input bit b .

A.2 Privacy Analysis with Failure Events

Privacy analysis of a randomized algorithm A using designated failure events is as follows:

Designate some runs of the algorithm as failure events .

Compute an upper bound on the maximum probability, over datasets D , of a transcript with a failure designation.

Analyse the privacy of the interaction transcript conditioned on no failure designation.

Note that the failure designation is only used for the purpose of analysis. The output on failure runs is not restricted (e.g., could be the dataset D )

Lemma A.6 (Privacy analysis with privacy failure events) . Consider privacy analysis of A with failure events. If the probability of a failure event is bounded by δ ∗ ∈ [0 , 1] and the transcript conditioned on non-failure is ( ε ′ , δ ′ ) -DP then the algorithm A is ( ε, δ + δ ∗ ) -DP.

Proof. Let D 0 and D 1 be neighboring datasets. From our assumptions, for b ∈ { 0 , 1 } , we can represent A ( D b ) as the mixture A ( D b ) ≡ (1 -δ b ) · Z b + δ b · F b , where Z 0 ≈ ε ′ ,δ ′ Z 1 , and δ ( b ) ≤ δ ∗ . From Lemma A.1, we have Z b ≡ (1 -δ ′ ) · N b + δ ′ · E b , where N 0 ≈ ε ′ N 1 .

Then

The claim follows from Corollary A.3.

Using simulation-based privacy analysis we can treat an interactive sequence of approximate-DP algorithms (optionally with designated failure events) as a respective interactive sequence of pureDP algorithms where the δ parameters are anlaysed through failure events. This simplifies analysis:

We can relate the privacy of a composition of approximate-DP algorithms to that of a composition of corresponding pure-DP algorithms:

Corollary A.7 (Composition of approximate-DP algorithms) . An interactive sequence of ( ε i , δ i ) -DP algorithms ( i ∈ [ k ] ) has privacy parameter values ( ε ′ , δ ′ + ∑ k i =1 δ i ) , where ( ε ′ , δ ′ ) are privacy parameter values of a composition of pure ( ε i , 0) -DP algorithms i ∈ [ k ] .

Proof. Weperform simulation-based analysis. Fix two neighboring datasets D 0 , D 1 . For an ( ε i , δ i ) -DP algorithm, we can consider the mixtures as in Corollary A.3. We draw c ∼ Ber ( δ i ) and if c = 1 designate the output as failure and return r ∼ E ( b ) . Otherwise, we return r ∼ N ( b ) . The overall failure probability is bounded by 1 -∏ i (1 -δ i ) ≤ ∑ i δ i . The output conditioned on non-failure is a composition of ( ε i , 0) -DP algorithms ( i ∈ [ k ] ). The claim follows using Lemma A.6.

B The Target-Charging Technique

We extend the definition of q -targets (Definition 2.1) so that it applies with approximate DP algorithms:

Definition B.1 ( q -target with ( ε, δ ) of a pair of distributions) . Let A → Y be a randomized algorithm. Let Z 0 and Z 1 be two distributions with support Y . We say that ⊤ ⊆ Y is a q -target of ( Z 0 , Z 1 ) with ( ε, δ ) , where ε > 0 and δ ∈ [0 , 1) , if there exist p ∈ [0 , 1] and five distributions C , B b , and E b (for b ∈ { 0 , 1 } ) such that Z 0 and Z 1 can be written as the mixtures

where B 0 ≈ ε B 1 , and min(Pr[ B 0 ∈ ⊤ ] , Pr[ B 1 ∈ ⊤ ]) ≥ q .

Definition B.2 ( q -target with ( ε, δ ) of a randomized algorithm) . Let A → Y be a randomized algorithm. We say that ⊤ ⊆ Y is a q -target of A with ( ε, δ ) , where ε > 0 and δ ∈ [0 , 1) , if for any pair D 0 , D 1 of neighboring datasets, ⊤ is a q -target with ( ε, δ ) of A ( D 0 ) and A ( D 1 ) .

We can relate privacy of an algorithms or indistinguishability of two distributions to existence of q -targets:

Lemma B.3. (i) If ( Z 0 , Z 1 ) have a q -target with ( ε, δ ) then Z 0 ≈ ε,δ Z 1 . Conversely, if Z 0 ≈ ε,δ Z 1 then ( Z 0 , Z 1 ) have a 1 -target with ( ε, δ ) (the full support is a 1 -target).

(ii) If an algorithm A has a q -target with ( ε, δ ) then A is ( ε, δ ) -DP. Conversely, if an algorithm A is ( ε, δ ) -DP then it has a 1-target (the set Y ) with ( ε, δ ) .

Proof. If two distributions B 0 , B 1 have a q -target with ( ε, δ ) than from Definition B.1 they can be represented as mixtures. Now observe the if B 0 ≈ ε B 1 then the mixtures also satisfy p · C +(1 -p ) · B 0 ≈ ε p · C +(1 -p ) · B 0 . Using Lemma A.1, we get Z 0 ≈ ε,δ Z 1 .

For (ii) consider A and two neighboring datasets D 0 and D 1 . Using Definition B.2 and applying the argument above we obtain A ( D 0 ) ≈ ε,δ A ( D 1 ) . The claim follows using Corollary A.3.

Now for the converse. If Z 0 ≈ ε,δ Z 1 then consider the decomposition as in Lemma A.1. Now we set p = 0 and B b ← N b to obtain the claim with q = 1 and the target being the full support.

For (ii), if A → Y is ( ε, δ ) -DP then consider neighboring { D 0 , D 1 } . We have A ( D 0 ) ≈ ε,δ A ( D 1 ) . We proceed as with the distributions.

Algorithm 6 is an extension of Algorithm 1 that permits calls to approximate DP algorithms. The extension also inputs a bound τ on the number of target hits and a bound τ δ on the cummulative δ parameter values of the algorithms that were called. We apply adaptively a sequence of ( ε, δ ) -DP algorithms with specified q -targets to the input data set D and publish the results. We halt when the first of the following happens (1) the respective target sets are hit for a specified τ number of times (2) the accumulated δ -values exceed the specified limit τ δ .

The privacy cost of Target-Charging is as follows (This is a precise and more general statement of Lemma 2.2):

Algorithm 6: Target Charging with Approximate DP

Algorithm 7: Simulation of Target Charging

Theorem B.4 (Privacy of Target-Charging) . Algorithm 6 satisfies the following approximate DP privacy bounds:

where δ ∗ ( τ, α ) ≤ e -α 2 2(1+ α ) τ and C δ ≤ τ δ is as computed by the algorithm.

Proof. We apply the simulation-based privacy analysis in Lemma A.5 and use privacy analysis with failure events (Lemma A.6).

The simulation is described in Algorithm 7. Fix two neighboring data sets D 0 and D 1 . The simulator initializes the target hit counter C ← 0 and the cumulative δ -values tracker C δ ← 0 . For i ≥ 1 it proceeds as follows. It receives ( A i , ⊤ i ) where A i is ( ε, δ i ) -DP. If C δ + δ i > τ δ it halts. Since ⊤ i is a q -target for A i , there are p , C , B 0 , B 1 , E 0 and E 1 as in Definition B.2. The simulator flips a biased coin c ′ ∼ Ber ( δ ) . If c ′ = 1 it outputs r ∼ E b and the execution is designated as Fail . In this

case there is an interaction with the data holder but also a failure designation. The simulator flips a biased coin c ∼ Ber ( p ) . If c = 1 , then the simulator publishes a sample r ∼ C (this does not require an interaction with the data holder). Otherwise, the data holder is called. The data holder publishes r ∼ B b . We track the number h of calls to the data holder. If h exceeds (1 + α ) τ/q , we designate the execution as Fail . If r ∈ ⊤ i then C is incremented. If C = τ , the algorithm halts.

The correctness of the simulation (faithfully simulating Algorithm 1 on the dataset D b ) is straightforward. We analyse the privacy cost. We will show that

(i) the simulation designated a failure with probability at most C δ + δ ∗ ( τ, α ) .

(ii) Conditioned on no failure designation, the simulation performed at most r = (1 + α ) τ q adaptive calls to ( ε, 0) -DP algorithms

Observe that (ii) is immediate from the simulation declaring failure when h > r . We will establish (i) below.

The statement of the Theorem follows from Lemma A.6 and when applying the DP composition bounds (Lemma A.4). The first bounds follow using basic composition and the second follow using advanced composition [14].

This analysis yields the claimed privacy bounds with respect to the private bit b . From Lemma A.5 this is the privacy cost of the algorithm.

It remains to show bound the failure probability. There are two ways in which a failure can occur. The first is on each call, with probability δ i . This probability is bounded by 1 -∏ i δ i ≤ ∑ i δ i ≤ C δ . The second is when the number h of private accesses to the data holder exceeds the limit. We show that the probability that the algorithm halts with failure due to that is at most δ ∗ .

We consider a process that continues until τ charges are made. The privacy cost of the simulation (with respect to the private bit b ) depends on the number of times that the data holder is called. Let X be the random variable that is the number of calls to the data holder. Each call is ε -DP with respect to the private b . In each call, there is probability at least q for a 'charge' (increment of C ).

A failure is the event that the number of calls to data holder exceeds (1 + α ) τ/q before τ charges are made. We show that this occurs with probability at most δ ∗ ( τ, α ) :

To establish (1), we first observe that the distribution of the random variable X is dominated by a random variable X ′ that corresponds to a process of drawing i.i.d. Ber ( q ) until we get τ successes (Domination means that for all m , Pr[ X ′ > m ] ≥ Pr[ X > m ] ). Therefore, it suffices to establish that

Let Y be the random variable that is a sum of m = 1 + ⌊ (1 + α ) τ q ⌋ i.i.d. Ber ( q ) random variables. Note that

We bound Pr[ Y < τ ] using multiplicative Chernoff bounds [4] 1 . The expectation is µ = mq and we bound the probability that the sum of Bernoulli random variables is below 1 1+ α µ = (1 -α 1+ α ) µ . Using the simpler form of the bounds we get using µ = mq ≥ (1 + α ) τ

Remark B.5 (Number of target hits) . The TCT privacy analysis has a tradeoff between the final ' ε ' and ' δ ' privacy parameters. There is multiplicative factor of (1 + α ) ( √ 1 + α with advanced composition) on the ' ε ' privacy parameter. But when we use a smaller α we need a larger value of τ to keep the ' δ ' privacy parameter small. For a given α, δ ∗ > 0 , we can calculate a bound on the smallest value of τ that works. We get

For α = 0 . 5 we get τ > 10 . 6 · ln(1 /δ ∗ ) . For α = 1 we get τ > 3 . 26 · ln(1 /δ ∗ ) . For α = 5 we get τ > 0 . 31 · ln(1 /δ ∗ ) .

Remark B.6 (Mix-and-match TCT) . TCT analysis can be extended to the case where we use algorithms with varied privacy guarantees ε i and varied q i values. 2 In this case the privacy cost depends on ∑ i |A i ( D ) ∈⊤ i ε i q i . The analysis relies on tail bounds on the sum of random variables, is more complex. Varied ε values means the random variables have different size supports. A simple coarse bound is according to the largest support, which allows us to use a simple counter for target hits, but may be lossy with respect to precise bounds. The discussion concerns the (analytical or numerical) derivation of tail bounds is non-specific to TCT and is tangential to our contribution.

B.1 Multi-Target TCT

Multi-target charging is described in Algorithm 8. We show the following

Lemma B.7 (Privacy of multi-TCT) . Algorithm 8 satisfies ( ε ′ , kδ ′ ) -approximate DP bounds, where ( ε ′ , δ ′ ) are privacy bounds for single-target charging (Algorithm 1).

Specifically, when we expect that one (index) of multiple outcomes ⊥ 1 , . . . , ⊥ k will dominate our interaction but can not specify which one it is in advance, we can use k -TCT with NotPrior targets with priors ⊥ 1 , . . . , ⊥ k . From Lemma B.7, the overall privacy cost depends on the number of times that the reported output is different than the most dominant outcome. More specifically, for private testing, when we expect that one type of outcome would dominate the sequence but we do not know if it is 0 or 1 , we can apply 2 -TCT. The total number of target hits corresponds to the less dominant outcome. The total number of privacy charges (on average) is at most (approximately for small ε ) double that, and therefore is always comparable or better to composition (can be vastly lower when there is a dominant outcome).

Algorithm 8: Multi-Target Charging

Proof of Lemma B.7 (Privacy of multi-Target TCT). 3 Let ( ε, δ ) be the privacy bounds for M i that is single-target TCT with ( A i , ⊤ i ) . Let M be the k -target algorithm. Let ⊤ j i be the i th target in step j .

We say that an outcome sequence R = ( r j ) h j =1 ∈ R is valid for i ∈ [ k ] if and only if M i would halt with this output sequence, that is, ∑ h j =1 1 { r j ∈ ⊤ j i } = τ and r h ∈ ⊤ h i . We define G ( R ) ⊂ [ k ] to be all i ∈ [ k ] for which R is valid.

Consider a set of sequences H . Partition H into k +1 sets H i so that H 0 = { R ∈ H | G ( R ) = ∅} and H i may only include R ∈ H for which i ∈ G ( R ) . That is, H 0 contains all sequences that are not valid for any i and H i may contain only sequences that are valid for i .

C Properties of NotPrior targets

Recall that a NotPrior target of an ( ε, δ ) -DP algorithm is specified by any potential outcome (of our choice) that we denote by ⊥ . The NotPrior target is the set of all outcomes except ⊥ . In this Section we prove (a more general statement of) Lemma 2.3:

Lemma C.1 (Property of a NotPrior target) . Let M : X → Y ∪ {⊥} , where ⊥ ̸∈ Y , be an ( ε, δ ) -DP algorithm. Then the set of outcomes Y constitutes an 1 e ε +1 -target with ( ε, δ ) for M .

We will use the following lemma:

Lemma C.2. If two distributions Z 0 , Z 1 with support Y ∪{⊥} satisfy Z 0 ≈ ε Z 1 then Y constitutes an 1 e ε +1 -target with ( ε, 0) for ( Z 0 , Z 1 ) .

Proof of Lemma 2.3. From Definition B.2, it suffices to show that for any two neighboring datasets, D 0 and D 1 , the set Y is an 1 e ε +1 -target with ( ε, δ ) for ( M ( D 0 ) , M ( D 1 )) (as in Definition B.1).

Consider two neighboring datasets. We have M ( D 0 ) ≈ ε,δ M ( D 1 ) . Using Lemma A.1, for b ∈ { 0 , 1 } we can have

where N 0 ≈ ε N 1 . From Lemma C.2, Y is a 1 e ε +1 -target with ( ε, 0) for ( N 0 , N 1 ) . From Definition B.1 and (2), this means that Y is a 1 e ε +1 -target with ( ε, δ ) for ( M ( D 0 ) , M ( D 1 )) .

C.1 Proof of Lemma C.2

We first prove Lemma C.2 for the special case of private testing (when the support is { 0 , 1 } ):

Lemma C.3 (target for private testing) . Let Z 0 and Z 1 with support { 0 , 1 } satisfy Z 0 ≈ ε Z 1 Then ⊤ = { 1 } (or ⊤ = { 0 } ) is an 1 e ε +1 -target with ( ε, 0) for ( Z 0 , Z 1 ) .

Proof. We show that Definition B.1 is satisfied with ⊤ = { 1 } , q = 1 e ε +1 and ( ε, 0) , and Z 0 , Z 1 .

be the probabilities of ⊤ outcome in Z 0 and Z 1 respectively. Assume without loss of generality (otherwise we switch the roles of Z 0 and Z 1 ) that π ′ ≥ π . If π ≥ 1 e ε +1 , the choice of p = 0 and B b = Z b (and any C ) trivially satisfies the conditions of Definition 2.1. Generally, (also for all π < 1 e ε +1 ):

Let

Note that since Z 0 ≈ ε Z 1 it follows that π ′ ≈ ε π and (1 -π ′ ) ≈ ε (1 -π ) and therefore p ∈ [0 , 1] for any applicable 0 ≤ π ≤ π ′ ≤ 1 .

Let C be the distribution with point mass on ⊥ = { 0 } .

Let B 0 = Ber (1 -π ′ -π π ′ -e -ε π ) = Ber ( π -πe -ε π ′ -e -ε π )

Let B 1 = Ber (1 -π ′ -π e ε π ′ -π ) = Ber ( e ε π ′ -π ′ e ε π ′ -π )

We show that this choice satisfies Definition 2.1 with q = 1 e ε +1 .

We show that for both b ∈ { 0 , 1 } . Z b ≡ p · C +(1 -p ) · B b : It suffices to show that the probability of ⊥ is the same for the distributions on both sides. For b = 0 , the probability of ⊥ in the right hand side distribution is

For b = 1 , the probability is

We show that for b ∈ { 0 , 1 } , Pr[ B b ∈ ⊤ ] ≥ 1 e ε +1 .

Note that the inequalities are tight when π ′ = π (and are tighter when π ′ is closer to π ). This means that our selected q is the largest possible that satisfies the conditions for the target being ⊤ .

We show that B 0 and B 1 are ε -indistinguishable, that is

Recall that Ber ( a ) ≈ ε Ber ( b ) if and only if a ≈ ε b and (1 -a ) ≈ ε (1 -b ) . First note that

Hence

It also holds that

Proof of Lemma C.2. The proof is very similar to that of Lemma C.3, with a few additional details since ⊤ = Y can have more than one element (recall that ⊥ is a single element).

Assume (otherwise we switch roles) that Pr[ Z 0 = ⊥ ] ≥ Pr[ Z 1 = ⊥ ] . Let

Note that π ′ ≥ π .

We choose p , C , B 0 , B 1 as follows. Note that when π ≥ 1 e ε +1 , then the choice of p = 0 and B b = Z b satisfies the conditions. Generally,

Let

Let C be the distribution with point mass on ⊥ .

Let B 0 be ⊥ with probability π ′ -π π ′ -e -ε π and otherwise (with probability π -πe -ε π ′ -e -ε π ) be Z 0 conditioned on the outcome being in Y .

Let B 1 be ⊥ with probability π ′ -π e ε π ′ -π and otherwise (with probability e ε π ′ -π ′ e ε π ′ -π ) be Z 1 conditioned on the outcome being in Y .

It remains to show that these choices satisfy Definition 2.1:

The argument for Pr[ B b ∈ Y ] ≥ e ε -1 e 2 ε -1 is identical to Lemma C.3 (with Y = ⊤ ).

We next verify that for b ∈ { 0 , 1 } : Z b ≡ p · C +(1 -p ) · B b . The argument for the probability of ⊥ is identical to Lemma C.3. The argument for y ∈ Y follows from the probability of being in Y being the same and that proportions are maintained.

For b = 0 , the probability of y ∈ Y in the right hand side distribution is

For b = 1 , the probability of y ∈ Y in the right hand side distribution is

Finally, we verify that B 0 and B 1 are ε -indistinguishable. Let W ⊂ Y . We have

Therefore

and we use Z 0 ≈ ε Z 1 . The case of W = ⊥ is identical to the proof of Lemma C.3. The case ⊥ ∈ W follows.

D Conditional Release with Revisions

In this section we analyze an extension to conditional release that allows for revision calls to be made with respect to previous computations. This extension was presented in Section 2.3 and described in Algorithm 2. A conditional release applies a private algorithm A → Y with respect to a subset of outcomes ⊤ ⊂ Y . It draws y ∼ A ( D ) and returns y if y ∈ ⊤ and ⊥ otherwise. Each revise calls effectively expands the target to ⊤ h ∪ ⊤ ′ , when ⊤ h is the prior target and ⊤ ′ a disjoint extension. If the (previously) computed result hits the expanded target ( y ∈ ⊤ ′ ), the value y is reported and charged. Otherwise, additional revise calls can be performed. The revise calls can be interleaved with other TCT computations at any point in the interaction.

D.1 Preliminaries

For a distribution Z with support Y and W ⊂ Y we denote by Z W the distribution with support W ∪ {⊥} where outcomes not in W are 'replaced' by ⊥ . That is, for y ∈ W , Pr[ Z W = y ] := Pr[ Z = y ] and Pr[ Z W = ⊥ ] := Pr[ Z ̸∈ W ] .

For a distribution Z with support Y and W ⊂ Y we denote by Z | W the conditional distribution of Z on W . That is, for y ∈ W , Pr[( Z | W ) = y ] := Pr[ Z = y ] / Pr[ Z ∈ W ] .

Lemma D.1. If B 0 ≈ ε,δ B 1 then B 0 W ≈ ε,δ B 1 W .

Lemma D.2. Let B 0 , B 1 be probability distributions with support Y such that B 0 ≈ ε B 1 . Let W ⊂ Y . Then B 0 | W ≈ 2 ε B 1 | W .

We extend these definitions to a randomized algorithm A , where A W ( D ) has distribution A ( D ) W and ( A | W )( D ) has distribution A ( D ) | W . The claims in Lemma D.1 and Lemma D.2 then transfer to privacy of the algorithms.

D.2 Analysis

To establish correctness, it remains to show that each ConditionalRelease call with an ( ε, δ ) -DP algorithm A can be casted in TCT as a call to an ( ε, δ ) -DP algorithm with a NotPrior target and each ReviseCR call cap be casted as a call to an 2 ε -DP algorithm with a NotPrior target.

Proof of Lemma 2.5. The claim for ConditionalRelease was established in Lemma 2.4: Conditional release ConditionalRelease ( A , ⊤ ) calls the algorithm A ⊤ with target ⊤ . From Lemma D.1, A ⊤ is ( ε, δ ) -DP when A is ( ε, δ ) -DP. ⊤ constitutes a NotPrior target for A ⊤ with respect to prior ⊥ .

We next consider revision calls as described in Algorithm 2. We first consider the case of a pure-DP A ( δ = 0 ).

When ConditionalRelease publishes ⊥ , the internally stored value r h conditioned on published ⊥ is a sample from the conditional distribution A ( D ) | ¬⊤ .

We will show by induction that this remains true after ReviseCR calls, that is the distribution of r h conditioned on ⊥ being returned in all previous calls is A ( D ) | ¬⊤ h where ⊤ h is the current expanded target.

An ReviseCR call with respect to current target ⊤ h and extension ⊤ ′ can be equivalently framed as drawing r ∼ A ( D ) | ¬⊤ h . From Lemma D.2, if A is ε -DP then A | ¬⊤ h is 2 ε -DP. If r ∈ ⊤ ′ we publish it and otherwise we publish ⊥ . This is a conditional release computation with respect to the 2 ε -DP algorithm A | ¬⊤ h and the target ⊤ ′ . Equivalently, it is a call to the 2 ε -DP algorithm ( A | ¬⊤ h ) ⊤ ′ with a NotPrior target ⊤ ′ .

Following the ReviseCR call, the conditional distribution of r h conditioned on ⊥ returned in the previous calls is A ( D ) | ¬ ( ⊤ h ∪ ⊤ ′ ) as claimed. We then update ⊤ h ←⊤ h ∪ ⊤ ′ .

It remains to handle the case δ > 0 . We consider ReviseCR calls for the case where A is ( ε, δ ) -DP (approximate DP). In this case, we want to show that we charge for the δ value once, only on the original ConditionalRelease call. We apply the simulation-based analysis in the proof of Theorem B.4 with two fixed neighboring datasets. Note that this can be viewed as each call being

with a pair of distributions with an appropriate q -target (that in our case is always a NotPrior target).

The first ConditionalRelease call uses the distributions A ( D 0 ) and A ( D 1 ) . From Lemma A.1 they can be expressed as respective mixtures of pure N 0 ≈ ε N 1 part (with probability 1 -δ ) and non-private parts. The non-private draw is designated failure with probability δ . Effectively, the call in the simulation is then applied to the pair ( N 0 ⊤ , N 1 ⊤ ) with target ⊤ .

A followup ReviseCR call is with respect to the previous target ⊤ h and target extension ⊤ ′ . The call is with the distributions ( N b | ¬⊤ h ) ⊤ ′ that using Lemma D.1 and Lemma D.2 satisfy ( N 0 | ¬⊤ h ) ⊤ ′ ≈ 2 ε ( N 1 | ¬⊤ h ) ⊤ ′ .

E Boundary Wrapper Analysis

In this section we provide details for the boundary wrapper method including proofs of Lemma 2.7 and Lemma 2.8. For instructive reasons, we first consider the special case of private testing and then outline the extensions to private classification.

Algorithm 4 when specialized for tests first computes π ( D ) = min { Pr[ A ( D ) = 0] , 1 -Pr[ A ( D ) = 0] } , returns ⊤ with probability π/ (1 + π ) and otherwise (with probability 1 / (1 + π ) ) return A ( D ) . Overall, we return the less likely outcome with probability π/ (1 + π ) , and the more likely one with probability (1 -π ) / (1 + π ) .

Lemma E.1 (Privacy of wrapped test) . If the test is ε -DP then the wrapper test is t ( ε ) -DP where t ( ε ) ≤ 4 3 ε .

Proof. Working directly with the definitions, t ( ε ) is the maximum of

Inequality (3) bounds the ratio change in the probably of the larger probability outcome when it remains the same and (4) the ratio change in the probability of the smaller probability outcome when it remains the same between the neighboring datasets. When the less probable outcome changes between the neighboring datasets it suffices to consider the case where the probability of the initially less likely outcome changes to e ε π > 1 / 2 so that e ε π < 1 -π , that is the change is from π to e ε π where π ∈ ( e -ε 2 , 1 1+ e ε ) . Inequalities 5 and 6 correspond to this case. The wrapped probabilities of the ⊤ outcome are the same as the less probably outcome in the case that it is the same in the two databases. Inequality 7 corresponds to the case when there is change.

We now show that ⊤ is a target for the wrapped test.

Lemma E.2 ( q -value of the boundary target) . The outcome ⊤ of a boundary wrapper of an ε -DP test is a e t ( ε ) -1 2( e ε + t ( ε ) -1) -target.

Proof. Consider two neighboring datasets where the same outcome is less likely for both and π ≤ π ′ . Suppose without loss of generality that 0 is the less likely outcome.

The common distribution ( C ) has point mass on 1 .

The distribution B 0 is a scaled part of M ( D 0 ) that includes all 0 and ⊤ outcomes (probability π/ (1 + π ) each) and probability of ∆ e t ( ε ) e t ( ε ) -1 of the 1 outcomes, where ∆ = 2 π ′ 1+ π ′ -2 π 1+ π .

The distribution B 1 is a scaled part of M ( D 1 ) that includes all 0 and ⊤ outcomes (probability π ′ / (1 + π ′ ) each) and probability of ∆ 1 e t ( ε ) -1 of the 1 outcomes.

It is easy to verify that B 0 ≈ t ( ε ) B 1 and that

Extension to Private Classification To extension from Lemma E.1 to Lemma 2.7 follows by noting that the same arguments also hold respectively for sets of outcomes and also cover the case when there is no dominant outcome and when there is a transition between neighboring datasets from no dominant outcome to a dominant outcome. The extension from Lemma E.1 to Lemma 2.7 is also straightforward by also noting the cases above (that only make the respective ∆ smaller), and allowing C to be empty when there is no dominant outcome.

F Boundary wrapping without a probability oracle

We present a boundary-wrapping method that does not assume a probability oracle. This method accesses the distribution A ( D ) in a blackbox fashion.

̸

At a very high level, we show that one can run an ( ε, 0) -DP algorithm A twice and observe both outcomes. Then, denote by Y the range of the algorithm A . We can show that E = { ( y, y ′ ) : y = y ′ } ⊆ Y × Y is an Ω(1) -target of this procedure. That is, if the analyst observes the same outcome twice, she learns the outcome 'for free'. If the two outcomes are different, the analyst pays O ( ε ) of privacy budget, but she will be able to access both outcomes, which is potentially more informative than a single execution of the algorithm.

̸

Lemma F.1. Suppose A : X ∗ → Y is an ( ε, 0) -DP algorithm where |Y| < ∞ . Denote by A◦A the following algorithm: on input D , independently run A twice and publish both outcomes. Define E := { ( y, y ′ ) : y = y ′ } ⊆ Y × Y . Then, A◦A is a (2 ε, 0) -DP algorithm, and E is a f ( ε ) -target for A◦A , where

Proof. A◦A is (2 ε, 0) -DP by the basic composition theorem. Next, we verify the second claim.

Identify elements of Y as 1 , 2 , . . . , m = |Y| . Let D,D ′ be two adjacent data sets. For each i ∈ [ m ] , let

We define a distribution C . For each i ∈ [ m ] , define q i to be the largest real such that

Then, we define C to be a distribution over { ( i, i ) : i ∈ [ m ] } where Pr[ C = ( i, i )] = q i ∑ j q j .

We can then write ( A◦A )( D ) = α · C +(1 -α ) · N 0 and ( A◦A )( D ′ ) = α · C +(1 -α ) · N 1 , where α = ∑ i q i , and N 0 and N 1 are 2 ε -indistinguishable.

̸

̸

Next, we consider lower-bounding Pr[ N 0 = ( y, y ′ ) : y = y ′ ] . The lower bound of Pr[ N 0 = ( y, y ′ ) : y = y ′ ] will follow from the same argument.

̸

Indeed, we have

We claim that

The inequality is trivially true if p 2 i ≤ 1 -p ′ i 2 . Otherwise, we can observe that for q := p i 2 + p ′ i 2 -1 > 0 , we have p i 2 -q = 1 -p ′ i 2 and p ′ i 2 -q = 1 -p i 2 . Since 1 -p ′ i 2 ∈ [ e -2 ε (1 -p 2 i ) , e 2 ε (1 -p 2 i )] , this implies that q i can only be larger than q .

Since we also trivially have that p 2 i -q i ≤ p i 2 , we conclude that

̸

Next, it is straightforward to show that, for every p ∈ [0 , 1] , one has

Consequently,

as desired.

Remark F.2. For a typical use case where ϵ = 0 . 1 , we have f ( ε ) ≈ 0 . 258 . Then, by applying Theorem B.4, on average we pay ≈ 8 ε privacy cost for each target hit. Improving the constant of 8 is a natural question for future research. We also note that while the overhead is more significant compared to the boundary wrapper of Algorithm 4, the output is more informative as it includes two independent responses of the core algorithm whereas Algorithm 4 returns one or none (when ⊤ is returned). We expect that it is possible to design less-informative boundary wrappers for the case of blackbox access (no probability oracle) that have a lower overhead. We leave this as an interestion question for followup work.

G q value for BetweenThresholds

We provide details for the BetweenThresholds classifier (see Section 2.6). The BetweenThresholds classifier is a refinement of AboveThreshold . It is specified by a 1 -Lipschitz function f , two thresholds t ℓ < t r , and a privacy parameter ε . We compute ˜ f ( D ) = f ( D ) + Lap (1 /ε ) , where Lap is the Laplace distribution. If ˜ f ( D ) < t ℓ we return L . If ˜ f ( D ) > t r we return H . Otherwise, we return ⊤ .

Lemma G.1 (Effectiveness of the 'between' target) . The ⊤ outcome is an (1 -e -( t r -t l ) ε ) · e ε -1 e 2 ε -1 -target for BetweenThresholds .

Proof. Without loss of generality we assume that t ℓ = 0 and t r = t/ε for a parameter t .

Consider two neighboring data sets D 0 and D 1 and the respective f ( D 0 ) and f ( D 1 ) . Since f is 1 -Lipschitz, we can assume without loss of generality (otherwise we switch the roles of the two data

̸

̸

̸

sets) that f ( D 0 ) ≤ f ( D 1 ) ≤ f ( D 0 ) + 1 . Consider the case f ( D 1 ) ≤ 0 . The case f ( D 0 ) ≥ t/ε is symmetric and the cases where one or both of f ( D b ) are in (0 , t/ε ) make ⊥ a more effective target.

Note that π 0 L ≈ ε π 1 L and π 1 H ≈ ε π 0 H , π 0 L ≥ π 1 L and π 1 H ≥ π 0 H

We set

and the distribution C to be L with probability ( π 1 L -1 e ε -1 ( π 0 L -π 1 L )) /p and H otherwise.

We specify p and the distributions B b and C as we did for NotPrior (Lemma 2.3) with respect to 'prior' L . (We can do that and cover also the case where f ( D 0 ) > t/ε where the symmetric prior would be H because the target does not depend on the values being below or above the threshold).

The only difference is that our target is smaller, and includes only ⊤ rather than ⊤ and H . Because of that, the calculated q value is reduced by a factor of

H Numerical Comparison of BetweenThresholds

We demonstrate numerically the benefits of our TCT-based BetweenThresholds (Section 2.6) compared with the SVT-based prior work of [3].

Consider a sensitive dataset D = { x 1 , . . . , x n } of size n and thresholds t l < t r . We process a sequence of queries where each is specified by a function f : X → [0 , 1] . We aim to process each query by performing a noisy comparison of 1 n ∑ n i =1 f ( x i ) to t l and t r with the goal of having a error of at most α on our responses to queries with confidence at least β = 1 -1 /n . That is, for below responses it holds that 1 n ∑ n i =1 f ( x i ) ≤ t l + α , for above responses it holds that 1 n ∑ n i =1 f ( x i ) ≥ t r -α , and for between responses it holds that t l -α ≤ 1 n ∑ n i =1 f ( x i ) ≤ t r + α .

We then consider how many ⊤ (that is, between ) responses we can incur under the requirement that the whole sequence is ( ε, δ ) -DP with ε ≤ 1 and δ = 1 /n .

TCT: For a query f , we compare the noisy count 1 n ∑ n i =1 f ( x i ) + Lap ( α log( n ) ) with the thresholds t l , t r and report below , between ( ⊤ ), or above accordingly. To achieve the desired accuracy and confidence of α and β = 1 -1 /n , we set the Laplace noise parameter to α log( n ) . This ensures that with confidence at least (1 -1 n ) , the noisy count is within relative error α of the true count. The sensitivity is 1 /n and each call is ε ′ -DP with ε ′ = log n αn .

For t r -t l ≥ 2 ε ′ , each call has a q -target with q = 1 -e -2 1+ e ε ′ . We can then compute the overall privacy cost for a number of target hits using basic or advanced composition according to Theorem B.4 using the appropriate q values and δ . We solve for the number of target hits that keeps the overall privacy parameter values below (1 , 1 /n ) .

SVT-based [3]: Through the analysis in [3], we obtain that we need ε ′ ≥ 16 · log( n ) αn . An 'optimistic' analysis that we performed implied that we can not get better than ε ′ ≥ 4 · log( n ) αn .

Figure 1 shows the dependence of the number of between responses ( y axis) on the number of data points n ( x axis) for TCT and for the provided and optimistic bounds for [3]. TCT has a factor of 95 gain with respect to the provided bound and a factor of 6 gain over the optimistic bound.

100000

200000

300000

400000

500000

600000

Number of Data Points

10 1

10 2

10 3

Number of Queries

Comparison for BetweenThreshold

TCT

BSU - Optimistic

BSU - Original

Finally, the gains reported in the figure assume that both algorithms use the same gap that is large enough to satisfy the requirement of [3] that | t r -t l | > = 12(log(1 /ε ′ )+log(1 /δ )) ε ′ . But in situations where we are interested in a narrow gap around a single threshold, TCT with the smaller effective gap also benefits from much fewer target hits.

I Analysis of SVT with individual privacy charging

Our improved SVT with individual charging is described in Algorithm 5 (see Section 2.8).

We establish the privacy guarantee:

Proof of Theorem 2.9. We apply simulation-based privacy analysis (see Section A.5). Consider two neighboring datasets D and D ′ = D ∪{ x } . The only queries where potentially f ( D ) = f ( D ′ ) and we may need to call the data holder are those with f ( x ) = 0 . Note that for every x ′ ∈ D , the counter C x ′ is the same during the execution of Algorithm 5 on either D or D ′ . This is because the update of C x ′ depends only on the published results and f i ( x ′ ) , both of which are public information. Hence, we can think of the processing of C x ′ as a post-processing when we analyze the privacy property between D and D ′ .

̸

̸

After x is removed, the response on D and D ′ is the same, and the data holder does not need to be called. Before x is removed from D ′ , we need to consider the queries such that f ( x ) = 0 while C x < τ . Note that this is equivalent to a sequence of AboveThreshold tests to linear queries, we apply TCT analysis with ConditionalRelease applied with above threshold responses. The claim follows from Theorem B.4.

We also add that Algorithm 5 can be implemented with BetweenThresholds test (see Section 2.6), the extension is straightforward with the respective privacy bounds following from Lemma G.1 ( q value for target hit).

J Private Selection

In this section we provide proofs and additional details for private selection in TCT (Sections 2.4 and 2.4.1). Let A 1 , . . . , A m be of m private algorithms that return results with quality scores. The private selection task asks us to select the best algorithm from the m candidates. The one-shot selection described in Algorithm 3 (with k = 1 ) runs each algorithm once and returns the response with highest quality.

It is shown in [21] that if each A i is ( ε, 0) -DP then the one-shot selection algorithm degrades the privacy bound to ( mε, 0) -DP. However, if we relax the requirement to approximate DP, we can show that one-shot selection is ( O (log(1 /δ ) ε ) , δ ) -DP, which is independent of m (the number of candidates). Moreover, in light of a lower-bound example by [21], Theorem J.1 is tight up to constant factors.

̸

Formally, our theorem can be stated as

Theorem J.1. Suppose ε < 1 . Let A 1 , . . . , A m : X n → Y × R be a list of ( ε, δ i ) -DP algorithms, where the output of A i consists of a solution y ∈ Y and a score s ∈ R . Denote by Best( A 1 , . . . , A m ) the following algorithm (Algorithm 3 with k = 1 ): run each A 1 , . . . , A m once, get m results ( y 1 , s 1 ) , . . . , ( y m , s m ) , and output ( y i ∗ , s i ∗ ) where i ∗ = arg max i s i .

Then, for every δ ∈ (0 , 1) , Best( A 1 , . . . , A m ) satisfies ( ε ′ , δ ′ ) -DP where ε ′ = O ( ε log(1 /δ )) , δ ′ = δ + ∑ i δ i .

Proof. Discrete scores. We start by considering the case that the output scores from A 1 , . . . , A m always lie in a finite set X ⊆ R . The case with continuous scores can be analyzed by a discretization argument.

Fix D 0 , D 1 to be a pair of adjacent data sets. We consider the following implementation of the vanilla private selection.

Algorithm 9: Private Selection: A Simulation

Input: Private data set D . The set X defined above.

for ˆ s ∈ X in the decreasing order do for

i

= 1

, . . . , m do

if

s

i

ˆ

s

then return

(

y

i

, s

i

)

Assuming the score of A i ( D ) always lies in the set X , it is easy to see that Algorithm 9 simulates the top-1 one-shot selection algorithm (Algorithm 3 with k = 1 ) perfectly. Namely, Algorithm 9 first runs each A i ( D ) once and collects m results. Then, the algorithm searches for the lowest ˆ s ∈ X such that there is a pair ( y i , s i ) with a score of at least s i ≥ ˆ s . The algorithm then publishes this score.

On the other hand, we note that Algorithm 9 can be implemented by the conditional release with revisions framework (Algorithm 2). Namely, Algorithm 9 first runs each private algorithm once and stores all the outcomes. Then the algorithm gradually extends the target set (namely, when the algorithm is searching for the threshold ˆ s , the target set is { ( y, s ) : s ≥ ˆ s } ), and tries to find an outcome in the target. Therefore, it follows from Lemma 2.5 and Theorem B.4 that Algorithm 9 is ( O ( ε log(1 /δ )) , δ + ∑ i δ i ) -DP.

Continuous scores. We then consider the case that the distributions of the scores of A 1 ( D ) , . . . , A K ( D ) are continuous over R . We additionally assume that the distribution has no 'point mass'. This is to say, for every i ∈ [ m ] and ˆ s ∈ R , it holds that

This assumption is without loss of generality because we can always add a tiny perturbation to the original output score of A i ( D ) .

Fix D,D ′ as two neighboring data sets. We show that the vanilla selection algorithm preserves differential privacy between D and D ′ .

Let η > 0 be an arbitrarily small real number. Set M = 10 · m 4 η . For each ℓ ∈ [1 , M ] , let q ℓ ∈ R be the unique real such that

Similarly we define q ′ ℓ with respect to A i ( D ′ ) . Let X = { q ℓ , q ′ ℓ } .

Now, consider running Algorithm 9 with the set X and candidate algorithms A 1 , . . . , A K on D or D ′ . Sort elements of X in the increasing order, which we denote as X = { ˆ q 1 ≤ · · · ≤ ˆ q m } . After

sampling A i ( D ) for each i ∈ [ m ] , Algorithm 9 fails to return the best outcome only if one of the following events happens.

The best outcome ( y ∗ , s ∗ ) satisfies that s ∗ < ˆ q 1 .

There are two outcomes ( y i , s i ) and ( y j , s j ) such that s i , s j ∈ [ˆ q ℓ , ˆ q ℓ +1 ) for some ℓ ∈ [ n ] .

If Item 1 happens, Algorithm 9 does not output anything. If Item 2 happens, then it might be possible that i < j, s i > s j , but Algorithm 9 outputs s i .

It is easy to see that Event 1 happens with probability at most m 2 M ≤ η by the construction of X . Event 2 happens with probability at most M · m 4 M 2 ≤ η . Therefore, the output distribution of Algorithm 9 differs from the true best outcome by at most O ( η ) in the statistical distance. Taking the limit η → 0 completes the proof.

Remark J.2. Theorem J.1 shows that there is a factor of log(1 /δ ) overhead when we run top-1 oneshot private selection (Algorithm 9) only once. Nevertheless, we observe that if we compose top-1 one-shot selection with other algorithms under the TCT framework (e.g., compose multiple top-1 one-shot selections, generalized private testing, or any other applications mentioned in this paper)), then on-average we only pay 4 ε privacy cost (one NotPrior target hit with a 2 ε -DP algorithm) per top-1 selection (assuming ε is sufficiently small so that e ε ≈ 1 ). In particular, adaptively performing c executions of top-1 selection is ( ε ′ , δ ) -DP where ε ′ = ε · (4 √ c log(1 /δ ) + o ( √ c )) .

Liu and Talwar [21] established a lower bound of 2 ε on the privacy of a more relaxed top-1 selection task. Hence, there is a factor of 2 gap between this lower bound and our privacy analysis. Note that for the simpler task of one-shot above threshold score (discussed in Section 2.4.1), where the goal is to return a response that is above the threshold if there is one, can be implemented using a single target hit on Conditional Release call (without revise) and this matches the lower bound of 2 ε . We therefore suspect that it might be possible to tighten the privacy analysis of top-1 one-shot selection. We leave it as an interesting question for followup work.

J.1 One-Shot Topk Selection

In this section, we prove our results for topk selection.

We consider the natural one-shot algorithm for topk selection described in Algorithm 3, which (as mentioned in the introduction) generalizes the results presented in [9, 29], which were tailored for selecting from 1 -Lipschitz functions, using the Exponential Mechanism or the Report-Noise-Max paradigm.

We prove the following privacy theorem for Algorithm 3.

Theorem J.3. Suppose ε < 1 . Assume that each A i is ( ε, 0) -DP. Then, for every δ ∈ (0 , 1) , Algorithm 3 is ( ε · O ( √ k log( 1 δ ) + log( 1 δ )) , δ ) -DP.

Remark J.4. The constant hidden in the big-Oh depends on ε . For the setting that ε is close to zero so that e ε ≈ 1 and δ ≥ 2 o ( k ) , the privacy bound is roughly ( ε ′ , δ ) -DP where ε ′ = ε · (4 √ k log(1 /δ ) + o ( √ k )) .

Remark J.5. We can take A i as the Laplace mechanism applied to a 1 -Lipschisz quality function f i (namely, A i ( D ) outputs a pair ( i, f i ( D ) + Lap (1 /ε )) , where i denotes the ID of the i -th candidate, and f i ( D ) + Lap (1 /ε ) is the noisy quality score of Candidate i with respect to the data D ). In this way, Theoerem J.3 recovers the main result of [29].

Moreover, Theorem J.3 improves over [29] from three aspects: Firstly, Theorem J.3 allows us to report the noisy quality scores of selected candidates for free, while [29] needs to run one additional round of Laplace mechanism to publish the quality scores. Second, our privacy bound has no dependence on m , while the bound in the prior work [29] was ( O ( ε √ k log( m/δ )) , δ ) -DP. Lastly, Theorem J.3 applies more generally to any private-preserving algorithms, instead of the classic Laplace mechanism.

Proof. The proof is similar to that of Theorem J.1. Namely, we run each A i ( D ) once and store all results. Then we maintain a threshold T , which starts with T = ∞ . We gradually decrease T ,

and use Algorithm 2 (Conditional Release with Revised Calls) to find outcomes with a quality score larger than T . Wekeep this process until we identify k largest outcomes. The claimed privacy bound now follows from Lemma 2.5 and Theorem B.4.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nDrawing inspiration from the Sparse Vector Technique (SVT), the authors introduce a privacy analysis framework called Target Charging Technique (TCT). TCT operates by primarily accounting for the privacy loss incurred through queries that hit pre-specified target sets. This framework relies on the concept of q-targets, which model a structural property of the distribution of privacy mechanism outputs. The authors show that q-targets appear in a variety of use cases, leading to natural applications of TCT. Of particular interest is the application of TCT in the privacy analysis of one-shot k-top selection and conditional releases. Also, the authors theoretically demonstrate that the parameter degradation of TCT improves over known techniques.\n\nSTRENGTHS:\n1. The problem is rather natural, as well as the proposed algorithm\n\n2. The framework is flexible enough to accommodate interesting applications, e.g., one-shot k-top selection and conditional releases. Furthermore, it can be generalized to multiple targets.\n\n3. The technical part of the paper seems to be solid.\n\nWEAKNESSES:\nThe reviewer acknowledges that the primary focus of the present paper is to establish the foundations of TCT and prove some of its theoretical properties. However, the absence of numerical experiments poses a significant weakness. Considering the authors' expressed intention for TCT to be adopted in practice, it is important to supplement the theoretical analysis with concrete evidence through the inclusion of some simulations. Such simulations would provide valuable insights into the practical implications and potential benefits of employing TCT in real-world scenarios.\n\nQUESTIONS:\nAs highlighted in the Weaknesses Section, the primary limitation of the present paper lies in the absence of numerical experiments that demonstrate the benefits of the proposed framework. It would be advantageous for the reader if the authors could include some illustrative simulations, even if they are relatively simple in nature. This addition would provide valuable insights into the practical advantages of the proposed framework.\n\nLIMITATIONS:\nThe authors' treatment of the limitations of the proposed method could be improved. Specifically, there is a lack of empirical experimentation to showcase the benefits of TCT.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-01"}

comments: SUMMARY:
This paper introduces the Target Charging Technique (TCT) privacy analysis framework that focuses on providing better privacy utility trade-off on sensitive dataset with multiple differential private algorithm  access. The essential idea is to only pay budget cost to the positive target and negative targets become free. TCT framework can improve several classical DP algorithms such as private Top-K, conditional release, private learning with non-private models etc.

STRENGTHS:
This paper studies a very important problem and proposes a very generalized framework that works for several classical algorithms and with many applications. The framework provide tighter privacy-utility trade off by considering the amortized overheads over user desired target. When the number of hits is large, the $log(1/\delta)$ privacy charge amortized to O(1) per target hit.

The intuition behind this paper is well presented in which if the computations do not touch user targets then the overhead should be small.

WEAKNESSES:
The assumption in q-Target definition seems to be stringent. How to ensure the randomized algorithm M satisfy such condition? 

While it is a formal paper, it would still benefits with some empirical evidence.

QUESTIONS:
See weakness.

LIMITATIONS:
No
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-06

comments: SUMMARY:
Introduced Target-Charging Technique (TCT) for privacy analysis over interactive private computations

STRENGTHS:
1.  Introduced Target-Charging Technique (TCT) for privacy analysis over interactive private computations

WEAKNESSES:
1. They could add experiment part

QUESTIONS:
1. Thank you author because the best presentation as far as I have seen. Even after this, I will also use comment feature for algorithm or coding snippet of my paper.

LIMITATIONS:
1. I am missing experimental result.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes Target Charging Techniques: a method that generalizes sparse vector technique and top-k selection from private candidates. Specifically their goal is to obtain better privacy guarantees in the settings where only a small number of computations are *successful*. One of their main ideas is to consider a prior on the output that has high probability (some sort of a default output), and only pay in privacy if the output of the algorithm is not equal to that prior.\n\nThey suggest a definition \"$q$-target\" for a subset of events $T$ and a private algorithm $M$. Roughly speaking, this definition helps us measure the actual privacy exposure when the algorithm $M$ hits an event in T. For every $1/q$ private accesses we're going to have $1$ hit (we'll have $ M(D)$ in $T$).\n\nSuppose we have a dataset $D$, a set of $\\epsilon$-DP algorithms $A_i$'s and events $T_i$, and a threshold $\\tau$. They show an algorithm that outputs $A_i(D)$'s until $\\tau$ many of $A_i(D)$'s are in $T_i$ and then stops is $(\\tau / q \\epsilon, \\exp(O(\\tau))$ private.\n\nIn the rest of the paper they apply their technique to multiple use cases.\n\nSome examples of the use cases of this technique include: private learning when we want to release only if the answer has high quality, greedy coverage, and above threshold tests.\n\nSTRENGTHS:\nThis paper provides a simple framework for accounting for privacy that is applicable to a number of problems in dp such as top-k selection and sparse vector technique with individual privacy charging. These problems mostly had tailor-made algorithms and analysis prior this work. The framework in this paper recovers some of the previously known bounds on these problems and improves on some of them, often through a simpler analysis.\n\nWEAKNESSES:\nI expected the authors to include at least one setting where this framework significantly improves upon prior work on a specific application. This paper provides a pipeline that is simple, nice, and will probably be useful. Still, I am not convinced that the applications of this framework provide a significant improvement in terms of results compared to prior work.\n\nQUESTIONS:\nsuggestion: add some text around definition 2.1 to explain what's going on in the definition and to help interpret lemma 2.2\n\nLemma 2.2 talks about $A_i$'s and $\\tau_i$'s, but algorithm 1 only has $A$ and $\\tau$.\n\nIn line 374: can you give a more complete explanation of what their result is and what are the guarantees that you obtain?\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-10"}

comments: SUMMARY:
This paper presents a new privacy analysis framework called Target Charging Technique (TCT). Designed for interactive scenarios where sensitive datasets are frequently accessed using differentially private algorithms, TCT offers a unique perspective. Unlike traditional composition schemes where privacy assurances degrade with multiple data accesses, TCT provides an alternative approach. It allows computations that avoid hitting a specified target to occur without significant cost but imposes a minor overhead on computations that do meet their targets. Furthermore, TCT generalizes tools such as the sparse vector technique and top-k selection from private candidates and extends their remarkable privacy enhancement benefits from noisy Lipschitz functions to general private algorithms.

STRENGTHS:
1. This paper is well written. The details of movtivation, methodology, proofs are described clearly.
2. The insight of this paper is quite reasonable and the proposed approach looks novel.

WEAKNESSES:
1. The related work section is missing.
2. The effectiveness of this approach is not clear to me. What are the main improvements offered by this method?

QUESTIONS:
It seems that this work is very promising in theory. Have you tested it on some real-world scenarios? Will it become open-source?

LIMITATIONS:
See weakness.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-21

comments: SUMMARY:
The submission studies a privacy analysis framework for interactive computations. The main contribution is extending the conventional differential privacy analysis framework, namely the sparse vector technique, which counts the privacy cost only for the positive response. Particularly, the proposed framework, namely the target charging technique, generalizes from the specific constraints (e.g., threshold) of positive response to general expressions that are not necessarily threshold. The overall analyses are regarding the $(\epsilon,\delta)$-DP.

STRENGTHS:
The paper is well-organized. I think the problem of privacy analysis for interactive computing is an essential topic and the extension/generalization made in this work is significant. 
I think that the privacy analysis shown in Lemma 2.2 for a general system is important in DP literature. 
The list of application scenarios of the proposed framework is well-categorized and shows the applicability of the proposed technique in practice.

WEAKNESSES:
I think the results and definitions are hard to read. In particular, it is hard to see how one can distinguish the q value of a q-target. It is also not straightforward to understand the notPrior target.
I know this paper is a theory paper, but it would be good to show some experimental results of the application of the main results, which makes the paper more sound.

QUESTIONS:
1) As written in the weaknesses part, I cannot see how the q value is attained from the target setting in practice. Could you provide a (toy) example for the q-target? 

2) What happens if the $\epsilon$ is not too small (e.g. $\epsilon=10$ in Lemma 2.3)? It seems the resulting $\epsilon$ would be very large, which is not acceptable in general. Is there any way to compensate for it?

LIMITATIONS:
N/A
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-25