Title: Counting Distinct Elements in the Turnstile Model with Differential Privacy under Continual Observation
Venue: NeurIPS 2023
Accepted: yes
Keywords: distinct elements

differential privacy

continual release

turnstile streams
Abstract: Privacy is a central challenge for systems that learn from sensitive data sets, especially when a system's outputs must be continuously updated to reflect changing data. We consider the achievable error for differentially private continual release of a basic  statistic---the number of distinct items---in a stream where items may be both inserted and deleted (the turnstile model). With only insertions, existing algorithms have additive error just polylogarithmic in the length of the stream $T$. We uncover a much richer landscape in the turnstile model, even without considering memory restrictions. We show that every differentially private mechanism that handles insertions and deletions has worst-case additive error  at least $T^{1/4}$ even under  a relatively weak, event-level privacy definition. 
Then, we identify a parameter of the input stream, its maximum flippancy, that is low for natural data streams and for which we give tight parameterized error guarantees. Specifically, the maximum flippancy is the largest number of times that the contribution of a single 
item to the distinct elements count changes over the course of the stream. We present an item-level differentially private mechanism that, for all turnstile streams with  maximum flippancy  $w$, continually outputs the number of distinct elements with an $O(\sqrt{w} \cdot \mathsf{poly}\log T)$ additive error,  without requiring prior knowledge of $w$. We prove that this is the best achievable error bound  that depends only on $w$, for a large range of values of $w$. When $w$ is small, the error of our mechanism is similar to the polylogarithmic in $T$ error in the insertion-only setting, bypassing the hardness in the turnstile model.

Counting Distinct Elements in the Turnstile Model with Differential Privacy under Continual Observation

Abstract

Privacy is a central challenge for systems that learn from sensitive data sets, especially when a system's outputs must be continuously updated to reflect changing data. We consider the achievable error for differentially private continual release of a basic statistic-the number of distinct items-in a stream where items may be both inserted and deleted (the turnstile model). With only insertions, existing algorithms have additive error just polylogarithmic in the length of the stream T . We uncover a much richer landscape in the turnstile model, even without considering memory restrictions. We show that every differentially private mechanism that handles insertions and deletions has worst-case additive error at least T 1 / 4 even under a relatively weak, event-level privacy definition. Then, we identify a parameter of the input stream, its maximum flippancy , that is low for natural data streams and for which we give tight parameterized error guarantees. Specifically, the maximum flippancy is the largest number of times that the contribution of a single item to the distinct elements count changes over the course of the stream. We present an item-level differentially private mechanism that, for all turnstile streams with maximum flippancy w , continually outputs the number of distinct elements with an O ( √ w · poly log T ) additive error, without requiring prior knowledge of w . We prove that this is the best achievable error bound that depends only on w , for a large range of values of w . When w is small, the error of our mechanism is similar to the polylogarithmic in T error in the insertion-only setting, bypassing the hardness in the turnstile model.

1 Introduction

Machine learning algorithms are frequently run on sensitive data. In this context, a central challenge is to protect the privacy of individuals whose information is contained in the training set. Differential privacy [27] provides a rigorous framework for the design and analysis of algorithms that publish aggregate statistics, such as parameters of machine learning models, while preserving privacy. In this work, we focus on the model of differential privacy interchangeably called continual observation and continual release that was introduced by Dwork et al. [25] and Chan et al. [13] to study privacy in settings when both the data and the published statics are constantly updated. One of the most fundamental statistics about a data stream is the number of distinct elements it contains (see, e.g., the book by Leskovec et al. [47]). The problem of counting distinct elements has been widely studied, starting with the work of Flajolet and Martin [32], and has numerous applications [2, 30, 49, 42, 4], including monitoring the number of logins from distinct accounts to a streaming service, tracking

the number of different countries represented by people in a chat room, and tracking the number of students signed up for at least one club at a university. Algorithms for this problem are also used as basic building blocks in more complicated data analyses.

We investigate the problem of privately counting the number of distinct elements under continual observation in the turnstile model, which allows both element insertions and deletions. In the continual release model, a data collector receives a sensitive dataset as a stream of inputs and produces, after receiving each input, an output that is accurate for all inputs received so far. The input stream is denoted x and its length (also called the time horizon ) is denoted T . The elements come from a universe U . Each entry in the stream is an insertion (denoted by + u ) or a deletion (denoted by -u ) of some element u ∈ U or, alternatively, a no-op (denoted by ⊥ ), representing that no update occurred in the current time step. More formally, for a universe U , let U ± denote the set { + , -} × U ∪ { ⊥ } of possible stream entries. The shorthand + u and -u is used for the pairs (+ , u ) and ( -, u ) . Given a vector x of length T and an integer t ∈ [ T ] , the vector x [1 : t ] denotes the prefix of x consisting of the first t entries of x .

Next, we define the function CountDistinct in the (turnstile) continual release model.

Definition 1.1 (Existence vector, CountDistinct ) . Fix a universe U and a time horizon T ∈ N . For an element u ∈ U and a stream x ∈ U T ± , the existence vector f u ( x ) ∈ { 0 , 1 } T is an indicator vector that tracks the existence of element u in x : specifically, for each t ∈ [ T ] , the value f u ( x )[ t ] = 1 if and only if there are strictly more insertions than deletions of element u in x [1 : t ] . The function CountDistinct : U T ± → N T returns a vector of the same length as its input, where CountDistinct ( x )[ t ] = ∑ u ∈ U f u ( x )[ t ] for all t ∈ [ T ] .

The focus of our investigation is the best achievable error in the continual release model for a given time horizon T and privacy parameters. We study the worst-case (over all input streams and time steps t ) additive error of privately approximating the distinct elements counts under continual release.

Definition 1.2 (Error of an answer vector and error of a mechanism for CountDistinct ) . Given an answer vector a ∈ R T , the error of this vector with respect to the desired function value f ( x ) ∈ R T computed on dataset x is defined as ERR f ( x, a ) = ‖ f ( x ) -a ‖ ∞ . A mechanism for CountDistinct in the continual release model is α -accurate if it outputs a vector of answers a with error ERR CountDistinct ( x, a ) ≤ α with probability at least 0.99.

Next, we discuss privacy. Originally, differential privacy [27] was defined in a setting where a data collector outputs the desired information about an entire dataset all at once. We call this the batch model to contrast it with continual release. In the batch model, two datasets are called neighbors if they differ in the data of one individual. There are two natural ways to adapt this definition to the continual release model [25, 13], depending on the desired privacy guarantees.

Definition 1.3 (Neighboring streams) . Let x, x ′ ∈ U T ± be two streams of length T . Streams x and x ′ are event-neighbors if one can be obtained from the other by replacing a stream entry with ⊥ . Streams x and x ′ are item-neighbors if one can be obtained from the other by replacing a subset of stream entries pertaining to one specific element of U with symbol ⊥ .

Differential privacy can be defined with respect to any notion of neighboring datasets. There are two privacy parameters: ε > 0 and δ ∈ [0 , 1) . An algorithm A is ( ε , δ ) -differentially private (DP) if for all pairs of neighboring datasets x, x ′ and all events S in the output space of A ,

The case when δ = 0 is referred to as pure differential privacy, and the general case as approximate differential privacy. For event-neighboring (respectively, item-neighboring) streams x, x ′ ∈ U T ± , we say that A is ( ε , δ ) -event-level-DP (respectively, item-level-DP ). Item-level differential privacy imposes a more stringent requirement than event-level, since it guards against larger changes in the input stream. To contrast with the batch setting, we refer to continual release algorithms as mechanisms .

In the batch setting, where only CountDistinct ( x )[ T ] is released, there is an ε -DP algorithm for counting distinct elements with expected error O (1 / ε ) since the function CountDistinct ( x )[ T ] has sensitivity 1-regardless of whether we consider event-level or item-level privacy. Privacy is more challenging in the continual release setting, where we aim to release a sequence of estimates, one for each time t , and we require that the privacy guarantee hold for the entire sequence of outputs.

(

(

))

(

(

))

Prior work on privately estimating distinct elements in this setting considered the insertion-only model, exclusively: Bolot et al. [9] show that one can get a sequence of estimates, all of which are within additive error poly (log T ) / ε . Their result holds for both item-level and event-level privacy (which are essentially equivalent for counting distinct elements with only insertions). Follow-up work generalized their mechanism but, again, considered only insertions [35, 29].

We uncover a much richer landscape in the turnstile model, even without considering memory restrictions. We show that any differentially private mechanism that handles insertions and deletions has worst-case additive error at least T 1 / 4 even under event-level privacy, the weaker of the two privacy notions. To overcome this lower bound, we identify a property of the input stream, its maximum flippancy , that is low for natural data streams and for which one can give tight parameterized error guarantees. To define flippancy, recall the notion of the existence vector from Definition 1.1.

/negationslash

Definition 1.4 (Flippancy) . Given a stream x of length T and an element u ∈ U , the flippancy of u in x , denoted by flip ( u, x ) , is the number of pairs of adjacent entries in the existence vector f u ( x ) with different values. That is, flip ( u, x ) = |{ j ∈ [ T -1] : f u ( x )[ j ] = f u ( x )[ j +1] }| . The maximum flippancy of a stream x , denoted w x , is max u ∈ U flip ( u, x ) .

In other words, the maximum flippancy is the largest number of times the contribution of a single item to the distinct elements count changes over the course of the stream. We design item-level private mechanisms whose error scales with the maximum flippancy of the stream, even though the maximum flippancy is not an input to the mechanism. We show matching lower bounds for item-level privacy that hold in all parameter regimes. For a large range of the flippancy parameter, we also show a matching lower bound for event-level privacy, via a different argument. This leaves a range with an intriguing gap between item-level and event-level bounds.

1.1 Our results

Our results are summarized in Table 1. Our first result is a mechanism for privately approximating CountDistinct for turnstile streams. For a stream x of length T with maximum flippancy w x , this mechanism is item-level-DP and has error O ( min( √ w x · polylog T, T 1 / 3 ) ) . Crucially, the mechanism is not given the maximum flippancy upfront.

Theorem 1.5 (Upper bound) . For all ε , δ ∈ (0 , 1] and sufficiently large T ∈ N , there exists an ( ε , δ ) -item-level-DP mechanism for CountDistinct that is α -accurate for all turnstile streams x of length T , where and w x is the maximum flippancy of the stream x .

Since this mechanism is item-level-DP, it is also event-level-DP with the same privacy parameters. The error it achieves is the best possible in terms of dependence only on w x for item-level privacy, and this error is nearly tight for event-level privacy. When w x is small, as is the case for many natural streams, our mechanism has error O (polylog T ) , similar to mechanisms for the insertion-only setting.

Theorem 1.5 can be easily extended to ε bounded by any constant larger than 1 . We fixed the bound to be 1 to simplify the presentation. Our mechanism has polynomial time and space complexity in the

input parameters, although it does not achieve the typically sublinear space guarantees of streaming algorithms. (See 'Bounded Memory' in Section 1.4 for discussion.)

Our lower bounds on the accuracy for CountDistinct for turnstile streams are parametrized by a flippancy bound w , and apply for streams with maximum flippancy w x ≤ w . For event-level DP, our lower bound shows that for all mechanisms with error guarantees expressed solely in terms of the maximum flippancy w x , time horizon T , and privacy parameter ε , our CountDistinct mechanism is asymptotically optimal for a large range of values of w x , namely, for all w x ≤ T 1 / 2 and w x ≥ T 2 / 3 . The best achievable error for w x ∈ ( T 1 / 2 , T 2 / 3 ) for event-level DP remains an open problem.

Theorem 1.6 (Event-level lower bound) . Let ε , δ ∈ (0 , 1] , and sufficiently large w,T ∈ N such that w ≤ T . For all ( ε , δ ) -event-level-DP mechanisms that are α -accurate for CountDistinct on turnstile streams of length T with maximum flippancy at most w , if δ = o ( ε T ) ,

In particular, any accuracy bound for event-level algorithms depending only on w x , as in Theorem 1.5, must grow as Ω ( min ( √ w x ε , T 1 / 4 ε 3 / 4 , T )) , in all ranges of w x . This is reflected in Table 1.

For item-level DP, our lower bound on the error matches our upper bound for all regimes of w x up to polylogarithmic factors.

Theorem 1.7 (Item-level lower bound) . Let ε ∈ (0 , 1] , δ ∈ (0 , 1] , and sufficiently large w,T ∈ N such that w ≤ T . For all ( ε , δ ) -item-level-DP mechanisms that are α -accurate for CountDistinct on turnstile streams of length T with maximum flippancy at most w ,

In particular, any accuracy bounds depending only on w x must grow at least as quickly as the expressions in Table 1.

Variants of the model. All our lower bounds also hold in the strict turnstile model , where element counts never go below 0 . They also apply to offline mechanisms that receive the entire input stream before producing output; they do not rely on the mechanism's uncertainty about what comes later in the stream. Furthermore, our item-level lower bounds hold even in the model where each element can be inserted only when it is absent and deleted only when it is present (as is the case, for example, with the 'like' counts on social media websites).

1.2 Our techniques

Upper bound techniques: tracking the maximum flippancy. Before describing our algorithmic ideas, we explain the main obstacle to using the techniques previously developed for insertiononly streams [9, 29] in the turnstile setting. Bolot et al. [9] and Epasto et al. [29] used a reduction from CountDistinct to the summation problem. A mechanism for the summation problem outputs, at every time step t ∈ [ T ] , the sum of the first t elements of the stream. Dwork et al. [27] and Chan et al. [13] designed the binary-tree mechanism to obtain a O (polylog T ) -accurate mechanism for summation. Given an input stream x of length T (to the CountDistinct problem), define a corresponding summation stream s x ∈ { -1 , 0 , 1 } T . At time step t ∈ [ T ] , the entry s x [ t ] equals the difference in the count of distinct elements between time steps t -1 and t , i.e., s x [ t ] = CountDistinct ( x )[ t ] -CountDistinct ( x )[ t -1] . Then CountDistinct ( x )[ t ] is precisely the sum of the first t elements of s x . In the insertion-only model, changing one entry of x changes at most 2 entries of s x , and thus, by group privacy, the binary-tree mechanism has O (polylog T ) additive error for CountDistinct . For turnstile streams, even under the weaker notion of event-level privacy, a change in the stream x can cause Ω ( T ) changes to s x . To see this, consider the stream consisting of alternating insertions ( + u ) and deletions ( -u ) of a single element u ∈ U , and its event-neighboring stream where the first occurrence of + u is replaced with ⊥ . This example illustrates that one of the difficulties of the CountDistinct problem for turnstile streams lies with items that switch from being present to absent multiple times over the course of the stream, that is, have high flippancy. We present

a private mechanism that outputs estimates of the count of distinct elements in a turnstile stream with optimal accuracy in terms of maximum flippancy.

Our first key idea allows us to obtain a mechanism, Algorithm 1, that is given as input a flippancy upper bound w . For a stream x whose maximum flippancy is bounded by w , changing to an itemneighbor of x causes at most 2 w changes to the corresponding summation stream s x . This observation, combined with a group privacy argument, gives a mechanism with error O ( w · polylog T ) directly from the accuracy guarantee of the binary-tree mechanism for summation. Previous works in the insertion-only model [9, 29] used precisely this approach for the special case w = 1 . To obtain the better √ w dependence on w in our upper bound, we 'open up' the analysis of the binary-tree mechanism. By examining the information stored in each node of the binary tree for the summation stream, we show that changing the occurrences of one item in a stream x with maximum flippancy at most w can change the values of at most w nodes in each level of the binary tree. The √ w dependence in the error then follows from the privacy guarantees of the Gaussian mechanism (used inside the binary-tree mechanism) for approximate differential privacy. This type of noise reduction makes crucial use of the binary tree approach: there are optimized noise addition schemes for prefix sums that improve quantitatively over the binary-tree mechanism (see, e.g., [18, 41]), but it is unclear if they allow the same noise reduction. While our mechanism is only accurate for streams with maximum flippancy at most w , it is private even for streams that violate this condition. To achieve this, our mechanism ignores stream elements after their flippancy exceeds w .

The second key idea allows our algorithms to adapt automatically to the maximum flippancy w x of the input, without the need for an a-priori bound w . We design a private mechanism, Algorithm 3, that approximately keeps track of the maximum flippancy of the prefix of the stream seen so far and invokes our first mechanism (Algorithm 1) with the current estimated maximum flippancy ˆ w as an input. Our main innovation lies in the careful application of the sparse vector algorithm [24] to track the maximum flippancy of the stream. We cannot do this directly, since the sparse vector algorithm achieves good utility only for queries of low sensitivity, and maximum flippancy has global sensitivity Ω ( T ) under item-level changes.

Instead, we track a low sensitivity proxy that indirectly monitors the maximum flippancy w x : given the current estimate ˆ w of the flippancy, we use the sparse vector algorithm to continuously query the number of items in the stream with flippancy above ˆ w . This query has sensitivity one for item-level neighbors, as desired, but it is not a priori clear how to use it to upper bound the maximum flippancy of the stream. This is remedied by observing that Algorithm 1, invoked with a flippancy bound ˆ w , has the same error (and privacy) guarantee even if at most √ ˆ w items in the stream have flippancy higher than ˆ w . That is, an exact upper bound on the maximum flippancy is not needed to design an accurate mechanism. Items that violate the flippancy bound are safely ignored by Algorithm 1 and do not contribute to the distinct elements count.

When the number of high-flippancy items gets large, we adjust the estimate ˆ w and invoke a new instantiation of Algorithm 1. By doubling ˆ w each time this happens, we ensure that it remains at most twice the actual maximum flippancy w x , and that we need only invoke log T different copies of Algorithm 1 and the sparse vector algorithm 1 . With these ideas, we obtain an item-level private mechanism that, for all streams x , has error that scales with √ w x .

Lower bound techniques. Our lower bounds use the embedding technique introduced by Jain et al. [44] to obtain strong separations between the batch and continual release models of differential privacy. The approach of Jain et al. embeds multiple separate instances of an appropriately chosen base problem on the same sensitive dataset in the batch model into a single instance of a continual release problem. Then, the continual release mechanism can be used to solve multiple instances of the base problem in the batch model. The hardness results in the continual release model follow from lower bounds for the batch model.

A key idea in our event-level lower bound is a connection between the inner product of two binary vectors and the count of distinct elements in the union of those indices where the vector bits equal 1 . Estimates of distinct elements counts can thus be used to estimate inner products on a sensitive dataset of binary bits. Lower bounds on the accuracy of private algorithms for estimating inner product queries have been previously established in the batch model through the reconstruction attack of Dinur and Nissim [21]. This connection was used by Mir et al. [50] to provide lower bounds for

pan-private algorithms for counting distinct elements. However, continual release and pan-privacy are orthogonal notions, and their results don't imply any lower bounds in our setting. We crucially use deletions to embed multiple instances of inner product queries into a stream: once a query is embedded and the desired estimate is received, the elements inserted to answer that query can be entirely deleted from the stream to obtain a 'clean slate' for the next query. We obtain a lower bound of T 1 / 4 on the error of event-level private mechanisms for CountDistinct in turnstile streams.

We obtain our stronger item-level lower bounds (for pure and approximate differential privacy) by embedding multiple instances of a 1 -way marginal query. We then apply lower bounds of Hardt and Talwar [38] and Bun et al. [12] for releasing all 1-way marginals in the batch model in conjunction with our reduction. The 1-way marginals of a dataset y ∈ { 0 , 1 } n × d , consisting of n records and d attributes, are the averages of all d attributes of y . Deletions in the stream are once again crucially used to embed a marginal query for one attribute and then clean the slate for the next attribute. Changing one record/row in the dataset y translates to d changes of an item in the constructed stream, and thus this reduction is particularly tailored to item-level lower bounds.

1.3 Related work

The study of differential privacy under continual release was initiated by two concurrent works [25, 13]. They proposed the binary-tree mechanism for computing sums of binary bits. The binarytree mechanism has found numerous applications in the continual release setting and elsewhere, demonstrating the versatility of this mechanism. Under continual release, it has been extended to work for sums of real values [52], weighted sums [9], graph statistics [55, 31], and most relevantly, counting distinct elements [9, 29, 35]. It has also been employed for private online learning [45, 57, 1] and for answering range queries [25, 26, 28].

Prior to our work, the CountDistinct problem with continual release was studied exclusively in the insertions-only model. Bolot et al. [9] were the first to study this problem and showed a O (log 1 . 5 T ) -accurate item-level-DP mechanism. Ghazi et al. [35] considered the more challenging sliding-window model and showed nearly-matching upper and lower bounds for this setting, parameterized by the window size, for item-level and event-level differential privacy. Epasto et al. [29] studied the more general /lscript p -frequency estimation problem with a focus on space efficiency. For distinct elements, i.e., p = 0 , their mechanism provides an estimate with 1 + η multiplicative error and O (log 2 T ) additive error, using space poly(log T/ η ) . They also extended their results to the sliding-window model. Two of the works [9, 29] reduced the CountDistinct problem to the bit summation primitive, which allowed them to use the binary-tree mechanism. Since the streams are restricted to be insertion-only, the bit summation primitives they considered have low constant sensitivity. The same primitives have sensitivity Ω ( T ) for turnstile streams, and thus this approach cannot be directly extended to our setting. Ghazi et al. [35] observed that for fixed and sliding windows, the distinct elements problem can be reduced to range queries. For the special case when the window is the entire stream, their reduction is to the summation problem.

In concurrent work, Henzinger et al. [40] studied CountDistinct with insertions and deletions in a different version of the continual release model (which we call the 'likes' model), where an item can be deleted at a time step only if it is already present in the stream at that time step, and inserted only if it is absent from the stream at that time step. Our model is more general, since multiple insertions and deletions of the same item can happen consecutively. Our upper bound and our item-level privacy lower bound can be extended to the 'likes' model. On the other hand, our event-level private lower bound provably does not apply to that model: in the 'likes' model, for event-level privacy, there is a simple reduction to the bit summation problem in the continual release model such that the resulting algorithm incurs only a polylogarithmic in T error, whereas we show that in our model, any event-level private algorithm incurs a polynomial in T error.

Henzinger et al. [40] showed error bounds for item-level privacy in the likes model that are parameterized by the total number of updates K in the stream. The parameter K is related to our concept of flippancy: in the likes model, K equals the sum of all items' flippancies and, in general, is at least that sum. Henzinger et al. [40] give an ( ε , 0) -DP algorithm with error ˜ O ( √ K log T ) and show a nearly matching lower bound on the error for ( ε , 0) -DP algorithms using a packing argument. This lower bound applies to our model as well. It is incomparable to our lower bounds, since it scales differently and depends on a different parameter. In our model, their algorithm can be analyzed to give

error bounds in terms of the sum K ′ of the flippancies of the items and incurs error ˜ O ( √ K ′ log T ) ; however,it is unclear if their algorithm can be analyzed in our model to give bounds in terms of the (potentially smaller) maximum flippancy.

Another line of work investigated private sketches for distinct elements, motivated by the popularity of sketching algorithms for the streaming setting. Mergeable sketches for counting distinct elements have received particular attention [56, 15, 51, 39], since they allow multiple parties to estimate the joint count of distinct elements by merging their private sketches. While these sketches can be combined with the binary-tree mechanism to obtain private mechanisms for CountDistinct , the utility deteriorates when many (log T ) sketches are merged. In fact, Desfontaines et al. [19] showed that achieving both privacy and high accuracy is impossible when many sketches for counting distinct elements are merged. Other private sketches have been studied [54, 20, 58] for the streaming batch setting (without continual release). The distinct elements problem has also been studied in a distributed setting [14, 34] and under pan-privacy [50]. In particular, our lower bound for event-level privacy uses ideas from the lower bound of Mir et al. [50], as described in Section 1.2

The CountDistinct problem has been extensively studied in the non-private streaming setting, where the goal is to achieve low space complexity [32, 3, 16, 36, 37, 6, 5, 22, 43, 59, 30, 7, 33, 10, 46]. Blocki et al. [8] showed a black-box transformation for every streaming algorithm with tunable accuracy guarantees into a DP algorithm with similar accuracy, for low sensitivity functions. Their transformation does not obviously extend to the continual release setting. Moreover CountDistinct has high sensitivity for turnstile streams.

The first lower bound in the continual release model of differential privacy was an Ω (log T ) bound on the accuracy of mechanisms for bit summation, shown by Dwork et al. [25]. Jain et al. [44] gave the first polynomial separation in terms of error between the continual release model and the batch model under differential privacy. Our lower bounds also show such a separation. The lower bounds of Jain et al. [44] were for the problems of outputting the value and index of the attribute with the highest sum, amongst d attributes of a dataset. Our lower bounds are inspired by their sequential embedding technique to reduce multiple instances of a batch problem to a problem in the continual release model. Similar to them, we also reduce from the 1-way marginals problem to obtain our item-level lower bound. However, our event-level lower bound involves reducing from a different problem, and our reductions use the specific structure of CountDistinct for turnstile streams.

1.4 Broader impact, limitations, and open questions

We study the achievable error of DP mechanisms for CountDistinct under continual observation in streams with insertions and deletions. We show that it is characterized by the maximum flippancy of the stream. Our work is motivated by societal concerns, but focused on fundamental theoretical limits. It contributes to the broader agenda of obtaining privacy-preserving algorithms for data analysis. We discuss natural directions for future research and some limitations of our work.

Tight bounds: We found the best achievable error in some settings, but our upper and lower bounds do not match in some parameter regimes. What is the right error bound for event-level privacy for streams x with maximum flippancy w x between √ T and T 2 / 3 ? Our results yield a lower bound of T 1 / 4 and an upper bound of roughly √ w x .

Bounded memory: We did not consider any memory restrictions. Prior to our work, no other work addressed CountDistinct with deletions under continual release-with or without space constraints. We consider only the privacy constraint since it is more fundamental-it cannot be avoided by buying more memory-and the best algorithms with unbounded memory provide a benchmark by which to evaluate space-constrained approaches.

Space complexity is certainly a natural topic for future work. While it is not clear how to apply the sketching techniques of Epasto et al. [29] to the turnstile setting, it would be interesting to come up with accurate, private, and low-memory mechanisms for counting distinct elements in turnstile streams. Such algorithms would necessarily mix multiplicative and additive error guarantees (due to space and privacy constraints, respectively).

1.5 Organization

In Section 2, we present a mechanism for privately approximating CountDistinct on turnstile streams. Preliminaries on differential privacy, proofs omitted from Section 2 as well as proofs of Theorems 1.6 and 1.7 all appear in the supplementary material.

2 Item-level private mechanisms for CountDistinct

In this section, we present our item-level-DP mechanism for CountDistinct for turnstile streams. Its guarantees are stated in Theorem 2.1 with zero Concentrated Differential Privacy (zCDP). Using this notion of privacy, one can show tight bounds for the Gaussian mechanism and cleaner and tighter bounds for composition. Theorem 2.1 is the key ingredient in our proof of Theorem 1.5. This section is dedicated to our CountDistinct mechanism and the main ideas behind it. All proofs are deferred to the supplementary material.

Theorem 2.1 (Upper bound) . For all ρ ∈ (0 , 1] and sufficiently large T ∈ N , there exists a ρ -itemlevel-zCDP mechanism for CountDistinct that is α -accurate for all turnstile streams x of length T , where and w x is the maximum flippancy of the stream x .

In Section 2.1, we describe a modification to the binary-tree mechanism which, when analyzed carefully, provides the desired error guarantees-but only if the maximum flippancy of the stream is known upfront. In Section 2.2, we use this mechanism, in conjunction with a method for adaptively estimating the flippancy bound, to obtain our item-level-DP mechanism for CountDistinct .

2.1 Enforcing a given flippancy bound w

When a flippancy upper bound w is given upfront, we leverage the structure of the binary-tree mechanism to privately output the number of distinct elements at each time t ∈ [ T ] , where T is the stream length. The mechanism and its error guarantees are presented in Algorithm 1 and Theorem 2.2, respectively. To provide intuition, we first describe the mechanism when it is run on streams with maximum flippancy at most w . We then discuss a modification that ensures privacy of the mechanism for all streams regardless of maximum flippancy.

Algorithm 1 stores vectors ˜ f u ∈ { 0 , 1 } T for all elements u ∈ U that appear in the stream. For streams with maximum flippancy at most w , the vector ˜ f u is equal to the existence vector f u . In this case, by Definition 1.1, the number of distinct elements at timestep t ∈ [ T ] equals ∑ u ∈ U ˜ f u [ t ] . The mechanism outputs values ∑ u ∈ U ˜ f u [ t ] with Gaussian noise added according to the binary-tree mechanism, with privacy parameter ≈ ρ /w (see Definition 2.4)-that is, with noise scaled up by a factor of ≈ √ w/ ρ . The accuracy of this mechanism follows from that of the binary-tree mechanism.

However, if the mechanism computed f u instead of ˜ f u , it would not be private for streams with maximum flippancy greater than w , since it adds noise that scales according to w . That is because for every stream x ∈ U T ± with maximum flippancy w x > w there exists a neighboring stream x ′ such that the vectors CountDistinct ( x ) and CountDistinct ( x ′ ) differ in as many as Θ ( w x ) indices. To provide privacy for such streams, the mechanism simply 'truncates' the vector f u ∈ { 0 , 1 } T to obtain ˜ f u [ t ] = 0 for all t ≥ t ∗ if the flippancy of u in x [1 : t ∗ ] exceeds w . This corresponds to running the naive version of the mechanism (that uses f u instead of ˜ f u ) on the 'truncated' version of the stream x , where elements in x are ignored after their flippancy exceeds w . (Note that the computation of ˜ f u can be done online since ˜ f u [ t ] depends only on x [1 : t ] .) With a careful analysis of the value stored in each node of the binary tree, we are able to show that this mechanism is ρ -item-level-zCDP for all streams, however, it loses accuracy for streams with many high flippancy elements. In Section 2.2, we leverage this mechanism to provide estimates of CountDistinct that are both accurate and private for all streams.

Theorem 2.2 (Mechanism for a given flippancy bound w ) . Fix ρ ∈ (0 , 1] , sufficiently large T ∈ N , and w ≤ T . Algorithm 1 is a mechanism for CountDistinct for turnstile streams that is ρ -item-

level-zCDP for all input streams of length T , and α -accurate for streams of length T with maximum flippancy at most w , where α = O ( √ w log T +log 3 T √ ρ ) .

Algorithm 1 Mechanism M for CountDistinct with given flippancy bound

Input: Time horizon T ∈ N , privacy parameter ρ > 0 , flippancy bound w > 0 , stream x ∈ U T ± Output: s T

1: Sample a binary-tree random variable Z ∈ R T with parameter ρ ′ = ρ 4 w (log T +1) /triangleright Definition 2.4

Vector ∈ R of distinct count estimates

2: Initialize U x = ∅

4: Obtain entry x [ t ] and skip to Step 10 if x [ t ] = ⊥

3: for all t ∈ [ T ] do

5: Suppose x [ t ] is an insertion or deletion of a universe element u

6: if u / ∈ U x then insert u into U x ; initialize count u = 0 and ˜ f u = 0 T /triangleright vector with T zeros

8: for all v ∈ U x do

7: if x [ t ] = + u then count u += 1 else count u -= 1

9: if flip ( v, x [1 : t ]) ≤ w and count v > 0 then set ˜ f v [ t ] = 1

Definition 2.3 (Dyadic decomposition) . For t ∈ N , the dyadic decomposition of the interval (0 , t ] is a set of at most log t +1 disjoint intervals whose union is (0 , t ] , obtained as follows. Consider the binary representation of t (which has at most log t +1 bits), and express t as a sum of distinct powers of 2 . Then, the first interval is (0 , r ] , where r is the largest power of 2 in the sum. The second interval starts at r +1 and its size is the second largest power of 2 in the sum. The remaining intervals are defined similarly for all remaining summands. For example, for t = 11 = 8 + 2 + 1 , the dyadic decomposition of (0 , 11] is the intervals (0 , 8] , (8 , 10] and (10 , 11] .

10: Return s [ t ] = ( ∑ u ∈ U x ˜ f u [ t ]) + Z [ t ]

Definition 2.4 (Binary tree and binary-tree random variable) . Let ρ > 0 be a privacy parameter and T ∈ N be a power of 2. Consider a complete binary tree with T leaves whose nodes are labeled as follows. The T leaves are labeled by the intervals ( t -1 , t ] for all t ∈ [ T ] and the internal nodes are labeled by intervals obtained from the union of their children's intervals. Specifically, the binary tree consists of log T +1 levels. A level /lscript ∈ [0 , log T ] partitions the interval (0 , T ] into a set of T 2 /lscript disjoint intervals, each of length 2 /lscript , of the form (( i -1) · 2 /lscript , i · 2 /lscript ] . The nodes in level /lscript are labelled by the intervals in this partition.

The binary-tree random variable Z ∈ R T with parameter ρ is defined as follows. For each node ( t 1 , t 2 ] in the binary tree with T leaves, let Z ( t 1 ,t 2 ] ∼ N (0 , 1 / ρ ) . For each t ∈ [ T ] , consider the dyadic decomposition of the interval (0 , t ] (Definition 2.3) and let Z [ t ] be the sum of the random variables corresponding to the intervals in this dyadic decomposition.

The proof of Theorem 2.2 can be found in Section B.

2.2 Adaptively estimating a good flippancy bound w

In this section, we leverage the privacy and accuracy guarantees of Algorithm 1 to construct a new mechanism (Algorithm 3) for estimating CountDistinct . It achieves the privacy and accuracy guarantees of Theorem 2.1, when the maximum flippancy is not known upfront. Algorithm 3 instantiates log T +1 different copies B 0 , . . . B log T of Algorithm 1 with flippancy bounds 2 0 , . . . , 2 log T , respectively (the maximum flippancy of a stream is at most T ). To obtain an accurate estimate of the distinct elements count, at each time t ∈ [ T ] , we privately select i ∈ [0 , log T ] such that the output of B i satisfies the desired accuracy guarantee for the stream entries x [1 : t ] received so far. Selecting such i amounts to selecting a good bound on the maximum flippancy of the stream x [1 : t ] . Next, we describe how to obtain this bound using the sparse vector technique (Algorithm 2).

The maximum flippancy has high sensitivity; changing one stream entry can change the maximum flippancy drastically. However, the number of items with flippancy greater than any particular threshold is a function of sensitivity one. Furthermore, since Algorithm 1 when run with flippancy bound w already has error about √ w/ ρ , its accuracy guarantee remains asymptotically the same even if it simply ignores that many elements with flippancy greater than w . Thus, Algorithm 3 uses the sparse vector technique to maintain an upper bound on the flippancy of x [1 : t ] such that not too

many elements in x [1 : t ] violate that bound. This bound, in combination with the error guarantee of Algorithm 1, suffices to provide the desired low error guarantee. Since the sparse vector algorithm remains differentially private even when its queries are chosen adaptively, the privacy guarantees of Algorithm 3 follow from the privacy of Algorithms 1 and 2.

Algorithm 2 SVT : Answering Threshold Queries with Sparse Vector Technique

The proof of Theorem 2.1 can be found in Section C.

Acknowledgments and Disclosure of Funding

We thank Teresa Steiner and an anonymous reviewer for useful suggestions on the initial version of this paper. S.S. was supported by NSF award CNS-2046425 and Cooperative Agreement CB20ADR0160001 with the Census Bureau. A.S. and P.J. were supported in part by NSF awards CCF-1763786 and CNS-2120667 as well as Faculty Awards from Google and Apple.

References

Naman Agarwal and Karan Singh. The price of differential privacy for online learning. In Proceedings, International Conference on Machine Learning (ICML) , pages 32-40, 2017.

Aditya Akella, Ashwin R. Bharambe, Michael K. Reiter, and Srinivasan Seshan. Detecting DDoS attacks on ISP networks. In Workshop on Management and Processing of Data Streams , 2003.

Noga Alon, Y. Matias, and Mario Szegedy. The space complexity of approximating the frequency moments. In Proceedings, ACM Symposium on Theory of Computing (STOC) , 1996.

Daniel N. Baker and Ben Langmead. Dashing: fast and accurate genomic distances with hyperloglog. Genome Biology , 20, 2018.

Ziv Bar-Yossef, T. S. Jayram, Ravi Kumar, D. Sivakumar, and Luca Trevisan. Counting distinct elements in a data stream. In Proceedings, International Workshop on Randomization and Computation (RANDOM) , volume 2483, pages 1-10, 2002.

Ziv Bar-Yossef, Ravi Kumar, and D. Sivakumar. Reductions in streaming algorithms, with an application to counting triangles in graphs. In Proceedings, ACM-SIAM Symposium on Discrete Algorithms (SODA) , 2002.

Kevin S. Beyer, Peter J. Haas, Berthold Reinwald, Yannis Sismanis, and Rainer Gemulla. On synopses for distinct-value estimation under multiset operations. In ACM SIGMOD Conference , 2007.

Jeremiah Blocki, Elena Grigorescu, Tamalika Mukherjee, and Samson Zhou. How to make your approximation algorithm private: A black-box differentially-private transformation for tunable approximation algorithms of functions with low sensitivity. In APPROX/RANDOM , volume 275, pages 59:1-59:24, 2023.

Jean Bolot, Nadia Fawaz, S. Muthukrishnan, Aleksandar Nikolov, and Nina Taft. Private decayed predicate sums on streams. In International Conference on Database Theory (ICDT) , page 284-295, 2013.

Joshua Brody and Amit Chakrabarti. A multi-round communication lower bound for gap hamming and some consequences. Proceedings, IEEE Conference on Computational Complexity (CCC) , pages 358-368, 2009.

Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Proceedings, Theory of Cryptography Conference (TCC) , volume 9985, pages 635-658, 2016.

Mark Bun, Jonathan Ullman, and Salil Vadhan. Fingerprinting codes and the price of approximate differential privacy. SIAM Journal on Computing , 47(5):1888-1938, 2018.

T.-H. Hubert Chan, Elaine Shi, and Dawn Song. Private and continual release of statistics. ACM Trans. Inf. Syst. Secur. , 14(3):26:1-26:24, 2011.

Lijie Chen, Badih Ghazi, Ravi Kumar, and Pasin Manurangsi. On distributed differential privacy and counting distinct elements. In Proceedings, Innovations in Theoretical Computer Science (ITCS) , volume 185, pages 56:1-56:18, 2021.

Seung Geol Choi, Dana Dachman-Soled, Mukul Kulkarni, and Arkady Yerukhimovich. Differentially-private multi-party sketching for large-scale statistics. Proceedings on Privacy Enhancing Technologies , 2020:153 - 174, 2020.

Edith Cohen. Size-estimation framework with applications to transitive closure and reachability. J. Comput. Syst. Sci. , 55:441-453, 1997.

Anindya De. Lower bounds in differential privacy. In Proceedings, Theory of Cryptography Conference (TCC) , volume 7194, pages 321-338, 2012.

Sergey Denisov, H. Brendan McMahan, John Rush, Adam D. Smith, and Abhradeep Guha Thakurta. Improved differential privacy for SGD via optimal private linear operators on adaptive streams. In Advances in Neural Information Processing Systems (NeurIPS) , 2022.

Damien Desfontaines, Andreas Lochbihler, and David A. Basin. Cardinality estimators do not preserve privacy. Proceedings on Privacy Enhancing Technologies , 2019:26 - 46, 2018.

Charles Dickens, Justin Thaler, and Daniel Ting. Order-invariant cardinality estimators are differentially private. In Advances in Neural Information Processing Systems (NeurIPS) , 2022.

Irit Dinur and Kobbi Nissim. Revealing information while preserving privacy. In Proceedings, ACM Symposium on Principles of Database Systems (PODS) , pages 202-210, 2003.

Marianne Durand and Philippe Flajolet. Loglog counting of large cardinalities (extended abstract). In Embedded Systems and Applications , 2003.

Cynthia Dwork, Frank McSherry, and Kunal Talwar. The price of privacy and the limits of LP decoding. In Proceedings, ACM Symposium on Theory of Computing (STOC) , pages 85-94, 2007.

Cynthia Dwork, Moni Naor, Omer Reingold, Guy N. Rothblum, and Salil P. Vadhan. On the complexity of differentially private data release: efficient algorithms and hardness results. In Proceedings, ACM Symposium on Theory of Computing (STOC) , pages 381-390, 2009.

Cynthia Dwork, Moni Naor, Toniann Pitassi, and Guy N. Rothblum. Differential privacy under continual observation. In Proceedings, ACM Symposium on Theory of Computing (STOC) , pages 715-724, 2010.

Cynthia Dwork, Moni Naor, Omer Reingold, and Guy N. Rothblum. Pure differential privacy for rectangle queries via private partitions. In Advances in Cryptology - ASIACRYPT , volume 9453, pages 735-751, 2015.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam D. Smith. Calibrating noise to sensitivity in private data analysis. J. Priv. Confidentiality , 7(3):17-51, 2016.

Alexander Edmonds, Aleksandar Nikolov, and Jonathan R. Ullman. The power of factorization mechanisms in local and central differential privacy. In Proceedings, ACM Symposium on Theory of Computing (STOC) , pages 425-438, 2020.

Alessandro Epasto, Jieming Mao, Andres Mu˜ noz Medina, Vahab Mirrokni, Sergei Vassilvitskii, and Peilin Zhong. Differentially private continual releases of streaming frequency moment estimations. In Proceedings, Innovations in Theoretical Computer Science (ITCS) , volume 251, pages 48:1-48:24, 2023.

Cristian Estan, George Varghese, and Michael E. Fisk. Bitmap algorithms for counting active flows on high-speed links. IEEE/ACM Trans. Netw. , 14(5):925-937, 2006.

Hendrik Fichtenberger, Monika Henzinger, and Wolfgang Ost. Differentially private algorithms for graphs under continual observation. In European Symposium on Algorithms (ESA) , volume 204, pages 42:1-42:16, 2021.

Philippe Flajolet and G. Nigel Martin. Probabilistic counting algorithms for data base applications. J. Comput. Syst. Sci. , 31(2):182-209, 1985.

Philippe Flajolet, ´ Eric Fusy, Olivier Gandouet, and Fr´ ed´ eric Meunier. Hyperloglog: the analysis of a near-optimal cardinality estimation algorithm. Discrete Mathematics & Theoretical Computer Science , pages 137-156, 2007.

Badih Ghazi, Ben Kreuter, Ravi Kumar, Pasin Manurangsi, Jiayu Peng, Evgeny Skvortsov, Yao Wang, and Craig Wright. Multiparty reach and frequency histogram: Private, secure, and practical. Proc. Priv. Enhancing Technol. , 2022(1):373-395, 2022.

Badih Ghazi, Ravi Kumar, Jelani Nelson, and Pasin Manurangsi. Private counting of distinct and k -occurring items in time windows. In Proceedings, Innovations in Theoretical Computer Science (ITCS) , volume 251, pages 55:1-55:24, 2023.

Phillip B. Gibbons. Distinct sampling for highly-accurate answers to distinct values queries and event reports. In Proceedings, Very Large Databases (VLDB) Endowment , 2001.

Phillip B. Gibbons and Srikanta Tirthapura. Estimating simple functions on the union of data streams. In Proceedings, ACM Symposium on Parallelism in Algorithms and Architectures (SPAA) , pages 281-291, 2001.

Moritz Hardt and Kunal Talwar. On the geometry of differential privacy. In Proceedings, ACM Symposium on Theory of Computing (STOC) , pages 705-714, 2010.

Jonathan Hehir, Daniel Ting, and Graham Cormode. Sketch-flip-merge: Mergeable sketches for private distinct counting. In Proceedings, International Conference on Machine Learning (ICML) , volume 202, pages 12846-12865, 2023.

Monika Henzinger, A. R. Sricharan, and Teresa Anna Steiner. Differentially private data structures under continual observation for histograms and related queries. CoRR , abs/2302.11341, 2023.

Monika Henzinger, Jalaj Upadhyay, and Sarvagya Upadhyay. Almost tight error bounds on differentially private continual counting. In Proceedings of the 2023 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA) , pages 5003-5039. SIAM, 2023.

Stefan Heule, Marc Nunkesser, and Alexander Hall. Hyperloglog in practice: algorithmic engineering of a state of the art cardinality estimation algorithm. In International Conference on Extending Database Technology (EDBT) , pages 683-692, 2013.

Piotr Indyk and David P. Woodruff. Tight lower bounds for the distinct elements problem. In Proceedings, IEEE Symposium on Foundations of Computer Science (FOCS) , pages 283-288, 2003.

Palak Jain, Sofya Raskhodnikova, Satchit Sivakumar, and Adam D. Smith. The price of differential privacy under continual observation. In Proceedings, International Conference on Machine Learning (ICML) , volume 202, pages 14654-14678, 2023.

Prateek Jain, Pravesh Kothari, and Abhradeep Thakurta. Differentially private online learning. In Conference on Learning Theory (COLT) , volume 23, pages 24.1-24.34, 2012.

Daniel M. Kane, Jelani Nelson, and David P. Woodruff. An optimal algorithm for the distinct elements problem. In Proceedings, ACM Symposium on Principles of Database Systems (PODS) , pages 41-52, 2010.

Jure Leskovec, Anand Rajaraman, and Jeffrey D. Ullman. Mining of Massive Datasets, 2nd Ed . Cambridge University Press, 2014.

Min Lyu, Dong Su, and Ninghui Li. Understanding the sparse vector technique for differential privacy. Proceedings, Very Large Databases (VLDB) Endowment , 10(6):637-648, 2017.

Ahmed Metwally, Divyakant Agrawal, and Amr El Abbadi. Why go logarithmic if we can go linear?: Towards effective distinct counting of search traffic. In International Conference on Extending Database Technology (EDBT) , volume 261, pages 618-629. ACM, 2008.

Darakhshan Mir, S. Muthukrishnan, Aleksandar Nikolov, and Rebecca N. Wright. Pan-private algorithms via statistics on sketches. In Proceedings, ACM Symposium on Principles of Database Systems (PODS) , page 37-48, 2011.

Rasmus Pagh and Nina Mesing Stausholm. Efficient differentially private F 0 linear sketching. In International Conference on Database Theory (ICDT) , volume 186, pages 18:1-18:19, 2021.

Victor Perrier, Hassan Jameel Asghar, and Dali Kaafar. Private continual release of real-valued data streams. In Network and Distributed System Security Symposium (NDSS) , 2019.

Alfred R´ enyi. On measures of entropy and information. Berkeley Symp. on Math. Statist. and Prob., , pages 547-561, 1961.

Adam D. Smith, Shuang Song, and Abhradeep Thakurta. The Flajolet-Martin sketch itself preserves differential privacy: Private counting with minimal space. In Advances in Neural Information Processing Systems (NeurIPS) , 2020.

Shuang Song, Susan Little, Sanjay Mehta, Staal A. Vinterbo, and Kamalika Chaudhuri. Differentially private continual release of graph statistics. CoRR , abs/1809.02575, 2018.

Rade Stanojevic, Mohamed Nabeel, and Ting Yu. Distributed cardinality estimation of set operations with differential privacy. IEEE Symposium on Privacy-Aware Computing (PAC) , pages 37-48, 2017.

Abhradeep Guha Thakurta and Adam Smith. (Nearly) optimal algorithms for private online learning in full-information and bandit settings. In Advances in Neural Information Processing Systems (NeurIPS) , volume 26, 2013.

Lun Wang, Iosif Pinelis, and Dawn Song. Differentially private fractional frequency moments estimation with polylogarithmic space. In International Conference on Learning Representations (ICLR) , 2022.

David P. Woodruff. Optimal space lower bounds for all frequency moments. In Proceedings, ACM-SIAM Symposium on Discrete Algorithms (SODA) , pages 167-175. SIAM, 2004.

Peer reviews:
comments: SUMMARY:
The paper considers the problem of differentially private cardinality estimation under continual observation in the turnstile model. With only insertions, existing algorithms showcase the additive error is polylogT. With both insertions and deletions, this paper demonstrates that the worst case additive error is at least T^{.25}. While mapping this problem directly to the summation problem (with binary mechanism) and bounding the maximum flip with w, one can directly achieve wpolylogT additive error. This paper further reduces the factor w to sqrt(w) by using the Gaussian mechanism.

STRENGTHS:
This paper studies a very important problem, distinct count with continual observation. The observation of the hardness of the turnstile model and the reason behind the maximum flip are well presented. Adaptively estimating the maximum flip with sparse vector technique is intuitive.
(After reading other reviewers opinion and rethinking what it is meant for a valuable theoretical result. I decided to increase my rating. While it may not yet to be practical, this paper considered important and hard problem and presented interesting results.)

WEAKNESSES:
When it comes to streaming, data streams can have fast velocity and huge volumes (e.g. internet traces). As a result, it motivated the design for data summaries such as flajolet-martin sketch using sublinear space to estimate distinct count of the stream. Since the paper didn’t introduce any memory-efficient algorithms for the distinct count in the turnstile model, the contribution of studying differential privacy in this setting is greatly weakened.

QUESTIONS:
Need more motivations. What might be an application for the proposed algorithm?

LIMITATIONS:
No
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-04

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the problem of the continual release of distinct elements subject to differential privacy in the turnstile model.\n\nIn particular, the algorithm must maintain a multi-set S containing elements from a universe U. The algorithm should support the insertion and deletion of elements. After each update, the algorithm needs to report a number which is approximately the number of distinct items in the current set S. Finally, differential privacy constraints require the list of reported numbers over the whole interaction to be private for either (1) the contribution from one item (item-level privacy) or (2) the contribution from one update (event-level privacy). The basic question is to understand the trade-off between (a) interaction length T; (b) privacy budget (eps, delta); and (c) the additive error of reports.\n\nIt is shown, via upper and lower bounds, that the additive error is characterized by the \"flip number\" of the stream. Namely, it is roughly the minimum w such that the contribution from one item changes by at most w times throughout the interaction.\n\nThe upper bound combines many standard tools from differential privacy, including noise-addition mechanisms, the binary-tree mechanism, and the sparse vector technique. I find the application of these tools to be standard. The lower bound is an adaptation of a previous technique.\n\nThe lower bound and upper bound nearly match for the case of item-level privacy; However this is a gap for event-level DP.\n\nSTRENGTHS:\n* Counting distinct elements is a basic task in streaming algorithms. Understanding the possibility of this task under privacy constraints is a natural question. This paper presents nice progress on this question.\n* This paper satisfactorily shows that the hardness of the problem is tightly connected to the \"flip number\" quantity, which, depending on the scenario, could be much smaller than the pessimistic bound of poly(T). In this sense, this paper goes beyond the worst-case analysis usually considered in many DP theory papers.\n\nWEAKNESSES:\n* This paper does a good job of skillfully combining techniques in DP. However, the new technical meat looks limited (or maybe I was missing something)\n* This paper did not consider the space complexity of algorithms, which is usually a major resource to optimize in the streaming context.\n\nQUESTIONS:\nNA\n\nLIMITATIONS:\nThe limitations and possible future directions are discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

comments: SUMMARY:
The paper studies private counting problem in continual release under the strict turnstile model. The authors focus on two neighboring definition: item-level and event-level. To gain an upper bound of error for both settings, the authors combine max flippancy, binary tree mechanism for private prefix summation and group privacy. To enforce max flippancy, the authors use SVT to privately track the flippancy. The authors also use embedding technique to obtain a lower bound which matches the upper bound for item-level privacy and most regimes of event-level privacy.

STRENGTHS:
Reading the paper is a pleasure. The authors did a good job disentangling the math under the hood into plain language and clear intuition.

The main contribution of the paper is to provide the first error analysis of private counting under continual observation in the turnstile model. The derivation of the upper bound and lower bound is clear but not trivial.

The papers also list a few interesting open problems which can be good start point for future research in this area.

WEAKNESSES:
I do not find any conspicuous weakness of the manuscript.

QUESTIONS:
N/A

LIMITATIONS:
Yes, the authors adequately discuss the limitations
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the problem of counting the number of distinct elements in a turnstile stream with differential privacy under continual release. For an insertion-only stream of length $T$ and $\\epsilon$-DP, it was previously shown that is possible to achieve roughly $\\text{polylog}(T)/\\epsilon$ additive error. The results in this paper show that this is not possible in general in turnstile streams. Instead, a particular quantity of interest seems to be the flippancy number of the stream, which is the largest number of times the contribution of a single item to the distinct element count changes over the course of the stream. \n\nFor maximum flippancy $w$, this paper shows that it is possible to achieve additive error proportional to $O(\\sqrt{w})$ for approximate DP, and moreover, $\\Omega(\\sqrt{w})$ additive error is necessary for approximate DP and $\\Omega(w)$ additive error is necessary for pure DP, and the paper notes it is relatively straightforward to achieve $O(w)$ additive error for pure DP. \n\nThe approximate DP upper bound is achieved through a standard binary tree mechanism along with a sparse vector technique, where the latter is used to guess the maximum flippancy $w$ when it is not input to the stream. The lower bound is achieved through a reduction from multiple instances of private inner product queries for the event-level lower bound and through a reduction from multiple instances of a 1-way marginal query for the item-level lower bound.\n\nSTRENGTHS:\n+ The separation between insertion-only and turnstile streams is a nice conceptual result. \n+ The usage of the sparse vector technique to privately adapt to the growth of the maximum flippancy $w$ seems creative to me.\n\nIn summary, I think the strengths significantly outweigh the following weaknesses, though I'm a bit confused about the claimed sensitivity for maximum flippancy for event-neighboring streams (see below). Hopefully this can be resolved during the discussion phase. \n\nEDIT: As the author response in the discussion phase has resolved this point, I've increased my score from 6 to 7.\n\nWEAKNESSES:\n- The proposed algorithms fully store the entire dataset, which can often be undesirable in the streaming model.\n- There is a gap between the upper and lower bounds for certain regimes of $w$ and $T$, i.e., $w\\in[\\sqrt{T},T^{2/3}]$.\n\nQUESTIONS:\nP5, L171 and P8, L349: Why does the maximum flippancy have sensitivity 1 for event-neighboring streams? I thought the example in the first paragraph of Section 1.2 shows that the flippancy can change by $\\Omega(T)$.\n\nIn terms of correctness, this still seems fine since the sparse vector technique only cares about the *number* of items with flippancy more than $w$, which seems to have sensitivity 1 for both event-neighboring streams and item-neighboring streams. On the other hand, I'm confused about the differences between the event-level and item-level privacy settings and in particular, what algorithmic components can be simplified for event-level privacy.\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies distinct elements under the turnstile continual observation model. The paper provides both upper bounds and lower bounds for event-level and item-level privacy. The error depends on the maximum flippancy, i.e., the maximum number of times that the occurrence of an element changes from positive to 0. In particular the error has sqrt dependency of the maximum flippancy, and they also show the tightness of the result.\n\nSTRENGTHS:\n- Distinct element is a fundamental problem in the literature of differential privacy. This paper gives an (almost) tight result for distinct element problem for the continual release model with both insertions and deletions. Previous work only studies insertion-only model, and previous techniques can only imply an error which has linear dependence on maximum flippancy. This paper open the black box of the binary tree mechanism and shows a sqrt(maximum flippancy) dependence.\n\n- I feel the lower bounds are very interesting. To the best of my knowledge, this is the first work formally studying the necessity of the dependence on maximum flippancy for the distinct element problem under turnstile continual observation model.\n\n- The proposed algorithm also works for item-level DP, i.e., even when considering the neighboring stream which is obtained by removing all occurrence of one item, the algorithm is still DP.\n\nWEAKNESSES:\n- The algorithm does not work in the low memory regime, i.e., the space required is linear in the stream size.\n\n- The lower bound of event level DP is not tight. \n\n- For the upper bound, the algorithmic idea is not very impressive. It is basically a clever combination of several standard techniques and ideas appeared in the previous DP continual observation literature. But maybe it is not really a weakness because the lower bound shows that such clean and simple algorithm is the best one can get.\n\nQUESTIONS:\nWhat's authors' conjectured lower bound for the case when maximum flippancy is between T^{0.5} and T^{2/3}?\n\nLIMITATIONS:\nAuthors adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-26"}