Original: D IFFERENTIALLY P RIVATE L 2 -H EAVY H ITTERS IN THE S LIDING W INDOW M ODEL
Revised: D IFFERENTIALLY P RIVATE L 2 -H EAVY H ITTERS IN THE S LIDING W INDOW M ODEL

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: The data management of large companies often prioritize more recent data, as a source of higher accuracy prediction than outdated data.
Revised: The data management of large companies often prioritize more recent data, as a source of higher accuracy prediction than outdated data.

Original: For example, the Facebook data policy retains user search histories for 6 months while the Google data retention policy states that browser information may be stored for up to 9 months.
Revised: For example, the Facebook data policy retains user search histories for 6 months while the Google data retention policy states that browser information may be stored for up to 9 months.

Original: These policies are captured by the sliding window model, in which only the most recent
Revised: These policies are captured by the sliding window model, in which only the most recent

Original: W statistics form the underlying dataset.
Revised: W statistics form the underlying dataset.

Original: In this paper, we consider the problem of privately releasing the L 2 -heavy hitters in the sliding window model, which include
Revised: In this paper, we consider the problem of privately releasing the L 2 -heavy hitters in the sliding window model, which include

Original: L p -heavy hitters for p ≤ 2 and in some sense are the strongest possible guarantees that can be achieved using polylogarithmic space, but cannot be handled by existing techniques due to the sub-additivity of the L 2 norm.
Revised: L p -heavy hitters for p ≤ 2 and in some sense are the strongest possible guarantees that can be achieved using polylogarithmic space, but cannot be handled by existing techniques due to the sub-additivity of the L 2 norm.

Original: Moreover, existing non-private sliding window algorithms use the smooth histogram framework, which has high sensitivity.
Revised: Moreover, existing non-private sliding window algorithms use the smooth histogram framework, which has high sensitivity.

Original: To overcome these barriers, we introduce the first differentially private algorithm for L 2 -heavy hitters in the sliding window model by initiating a number of L 2 -heavy hitter algorithms across the stream with significantly lower threshold.
Revised: To overcome these barriers, we introduce the first differentially private algorithm for L 2 -heavy hitters in the sliding window model by initiating a number of L 2 -heavy hitter algorithms across the stream with significantly lower threshold.

Original: Similarly, we augment the algorithms with an approximate frequency tracking algorithm with significantly higher accuracy.
Revised: Similarly, we augment the algorithms with an approximate frequency tracking algorithm with significantly higher accuracy.

Original: We then use smooth sensitivity and statistical distance arguments to show that we can add noise proportional to an estimation of the L 2 norm.
Revised: We then use smooth sensitivity and statistical distance arguments to show that we can add noise proportional to an estimation of the L 2 norm.

Original: To the best of our knowledge, our techniques are the first to privately release statistics that are related to a sub-additive function in the sliding window model, and may be of independent interest to future differentially private algorithmic design in the sliding window model.
Revised: To the best of our knowledge, our techniques are the first to privately release statistics that are related to a sub-additive function in the sliding window model, and may be of independent interest to future differentially private algorithmic design in the sliding window model.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Differential privacy (Dwork, 2006; Dwork et al., 2016) has emerged as the standard for privacy in the both the research and industrial communities.
Revised: Differential privacy (Dwork, 2006; Dwork et al., 2016) has emerged as the standard for privacy in the both the research and industrial communities.

Original: For example, Google Chrome uses RAPPOR (Erlingsson et al., 2014) to collect user statistics such as the default homepage of the browser or the default search engine, etc., Samsung proposed a similar mechanism to collect numerical answers such as the time of usage and battery volume (Nguy ˆ en et al., 2016), and Apple uses a differentially private method (Greenberg, 2016) to generate predictions of spellings.
Revised: For example, Google Chrome uses RAPPOR (Erlingsson et al., 2014) to collect user statistics such as the default homepage of the browser or the default search engine, etc., Samsung proposed a similar mechanism to collect numerical answers such as the time of usage and battery volume (Nguy ˆ en et al., 2016), and Apple uses a differentially private method (Greenberg, 2016) to generate predictions of spellings.

Original: The age of collected data can significantly impact its relevance to predicting future patterns, as the behavior of groups or individuals may significantly change over time due to either cyclical, temporary, or permanent change.
Revised: The age of collected data can significantly impact its relevance to predicting future patterns, as the behavior of groups or individuals may significantly change over time due to either cyclical, temporary, or permanent change.

Original: Indeed, recent data is often a more accurate predictor than older data across multiple sources of big data, such as stock markets or Census data, a concept which is often reflected through the data management of large companies.
Revised: Indeed, recent data is often a more accurate predictor than older data across multiple sources of big data, such as stock markets or Census data, a concept which is often reflected through the data management of large companies.

Original: For example, the Facebook data policy (Facebook) retains user search histories for 6 months, the Apple differential privacy (Upadhyay, 2019) states that collected data is retained for 3 months, the Google data retention policy states that browser information may be stored for up to 9 months (Google), and more generally, large data collection agencies often perform analysis and release statistics on time-bounded data.
Revised: For example, the Facebook data policy (Facebook) retains user search histories for 6 months, the Apple differential privacy (Upadhyay, 2019) states that collected data is retained for 3 months, the Google data retention policy states that browser information may be stored for up to 9 months (Google), and more generally, large data collection agencies often perform analysis and release statistics on time-bounded data.

Original: However, since large data collection agencies often manage highly sensitive data, the statistics must be released in a way that does not compromise privacy.
Revised: However, since large data collection agencies often manage highly sensitive data, the statistics must be released in a way that does not compromise privacy.

Original: Thus in this paper, we study the (event-level) differentially private release of statistics of time-bounded data that only use space sublinear in the size of the data.
Revised: Thus in this paper, we study the (event-level) differentially private release of statistics of time-bounded data that only use space sublinear in the size of the data.

Original: Definition 1.1 (Differential privacy (Dwork et al., 2016)) .
Revised: Definition 1.1 (Differential privacy (Dwork et al., 2016)) .

Original: Given ε > 0 and δ ∈ (0 , 1) , a randomized algorithm A operating on datastreams is ( ε, δ ) -differentially private if, for every pair of neighboring datasets S and S ′ and for all sets E of possible outputs, we have, Pr [ A ( S ) ∈ E ] ≤ e ε ·
Revised: Given ε > 0 and δ ∈ (0 , 1) , a randomized algorithm A operating on datastreams is ( ε, δ ) -differentially private if, for every pair of neighboring datasets S and S ′ and for all sets E of possible outputs, we have, Pr [ A ( S ) ∈ E ] ≤ e ε ·

Original: Pr [ A ( S ′ ) ∈ E ] + δ .
Revised: Pr [ A ( S ′ ) ∈ E ] + δ .

Original: In the popular streaming model of computation, elements of an underlying dataset arrive one-by-one but the entire dataset is considered too large to store; thus algorithms are restricted to using space sublinear in the size of the data.
Revised: In the popular streaming model of computation, elements of an underlying dataset arrive one-by-one but the entire dataset is considered too large to store; thus algorithms are restricted to using space sublinear in the size of the data.

Original: Although the streaming model provides a theoretical means to handle big data and has been studied thoroughly for applications in privacy-preserving data analysis, e.g., (Mir et al., 2011; Blocki et al., 2012; Joseph et al., 2020; Hassidim et al., 2020; Huang et al., 2021), it does not properly capture the ability to prioritize more recent data, which is a desirable quality for data summarization.
Revised: Although the streaming model provides a theoretical means to handle big data and has been studied thoroughly for applications in privacy-preserving data analysis, e.g., (Mir et al., 2011; Blocki et al., 2012; Joseph et al., 2020; Hassidim et al., 2020; Huang et al., 2021), it does not properly capture the ability to prioritize more recent data, which is a desirable quality for data summarization.

Original: The time decay model (Cohen & Strauss, 2006; Kopelowitz &
Revised: The time decay model (Cohen & Strauss, 2006; Kopelowitz &

Original: Porat, 2008; Su et al., 2018; Braverman et al., 2019) emphasizes more recent data by assigning a polynomially decaying or exponentially decaying weight to “older” data points, but these functions cannot capture the zero-one property when data older than a certain age is completely deleted.
Revised: Porat, 2008; Su et al., 2018; Braverman et al., 2019) emphasizes more recent data by assigning a polynomially decaying or exponentially decaying weight to “older” data points, but these functions cannot capture the zero-one property when data older than a certain age is completely deleted.

Original: The sliding window model.
Revised: The sliding window model.

Original: By contrast, the sliding window model takes a large data stream as an input and only focuses on the updates past a certain point in time by implicitly defining the underlying dataset through the most recent W updates of the stream, where W > 0 is the window parameter.
Revised: By contrast, the sliding window model takes a large data stream as an input and only focuses on the updates past a certain point in time by implicitly defining the underlying dataset through the most recent W updates of the stream, where W > 0 is the window parameter.

Original: Specifically, given a stream u 1 , . . .
Revised: Specifically, given a stream u 1 , . . .

Original: , u m such that u i ∈
Revised: , u m such that u i ∈

Original: [ n ] for all i ∈ [ m ] and a parameter W > 0 that we assume satisfies W ≤ m without loss of generality, the underlying dataset is a frequency vector f ∈ R n induced by the last W updates of the stream u
Revised: [ n ] for all i ∈ [ m ] and a parameter W > 0 that we assume satisfies W ≤ m without loss of generality, the underlying dataset is a frequency vector f ∈ R n induced by the last W updates of the stream u

Original: m − W +1 , . .
Revised: m − W +1 , . .

Original: , u m so that f k = |{ i : u i = k }| , for all k ∈ [ n ] .
Revised: , u m so that f k = |{ i : u i = k }| , for all k ∈ [ n ] .

Original: Then the goal is to output a private approximation to the frequency f k of each heavy-hitter, i.e., the indices k ∈ [ n ] for which f k ≥ αL p ( f ) , which denotes the L p norm of f for a parameter p ≥ 1 , L p ( f ) =
Revised: Then the goal is to output a private approximation to the frequency f k of each heavy-hitter, i.e., the indices k ∈ [ n ] for which f k ≥ αL p ( f ) , which denotes the L p norm of f for a parameter p ≥ 1 , L p ( f ) =

Original: ∥ f ∥ p = ( (cid:80) ni
Revised: ∥ f ∥ p = ( (cid:80) ni

Original: =1 f pi ) 1 /p .
Revised: =1 f pi ) 1 /p .

Original: In this case, we say that streams S and S ′ are neighboring if there exists a single update i ∈
Revised: In this case, we say that streams S and S ′ are neighboring if there exists a single update i ∈

Original: [ m ] such that u i ̸
Revised: [ m ] such that u i ̸

Original: = u ′ i , where u 1 , . . .
Revised: = u ′ i , where u 1 , . . .

Original: , u m are the updates of S and u ′ 1 , . . .
Revised: , u m are the updates of S and u ′ 1 , . . .

Original: , u ′ m are the updates of S ′ .
Revised: , u ′ m are the updates of S ′ .

Original: Note that if k is an L 1 -heavy hitter, i.e., a heavy-hitter with respect to L 1 ( f ) , then f k ≥ αL 1 ( f ) so that f k ≥ α
Revised: Note that if k is an L 1 -heavy hitter, i.e., a heavy-hitter with respect to L 1 ( f ) , then f k ≥ αL 1 ( f ) so that f k ≥ α

Original: ( (cid:80) ni =1 f i ) ≥ α (cid:0)(cid:80) ni
Revised: ( (cid:80) ni =1 f i ) ≥ α (cid:0)(cid:80) ni

Original: =1 f 2 i (cid:1) 1 / 2 , and k is also an L 2 -heavy hitter.
Revised: =1 f 2 i (cid:1) 1 / 2 , and k is also an L 2 -heavy hitter.

Original: Thus, any L 2 -heavy hitter algorithm will also report the L 1 -heavy hitters, but the converse is not always true.
Revised: Thus, any L 2 -heavy hitter algorithm will also report the L 1 -heavy hitters, but the converse is not always true.

Original: Indeed, for the Yahoo!
Revised: Indeed, for the Yahoo!

Original: password frequency corpus (Blocki et al., 2016)
Revised: password frequency corpus (Blocki et al., 2016)

Original: ( n ≈ 70 million) with heavy-hitter threshold α
Revised: ( n ≈ 70 million) with heavy-hitter threshold α

Original: =
Revised: =

Original: there were 3 , 972 L 2 -heavy hitters, but only one L 1 -heavy hitter.
Revised: there were 3 , 972 L 2 -heavy hitters, but only one L 1 -heavy hitter.

Original: On the other hand, finding L p -heavy hitters for p > 2 requires Ω( n 1 − 2 /p ) space (Chakrabarti et al., 2003; BarYossef et al., 2004), so in some sense, the L 2 -heavy hitters are the best we can hope to find using polylogarithmic space.
Revised: On the other hand, finding L p -heavy hitters for p > 2 requires Ω( n 1 − 2 /p ) space (Chakrabarti et al., 2003; BarYossef et al., 2004), so in some sense, the L 2 -heavy hitters are the best we can hope to find using polylogarithmic space.

Original: Although there is a large and active line of work in the sliding window model (Datar et al., 2002; Braverman & Ostrovsky, 2007; Braverman et al., 2014; 2016; 2018; 2020;
Revised: Although there is a large and active line of work in the sliding window model (Datar et al., 2002; Braverman & Ostrovsky, 2007; Braverman et al., 2014; 2016; 2018; 2020;

Original: Borassi et al., 2020; Woodruff & Zhou, 2021; Braverman et al., 2021; Jayaram et al., 2021), there is surprisingly little work in the sliding window model that considers differential privacy (Upadhyay, 2019; Upadhyay & Upadhyay, 2021).
Revised: Borassi et al., 2020; Woodruff & Zhou, 2021; Braverman et al., 2021; Jayaram et al., 2021), there is surprisingly little work in the sliding window model that considers differential privacy (Upadhyay, 2019; Upadhyay & Upadhyay, 2021).

Original: 1. O UR C ONTRIBUTIONS
Revised: 1. O UR C ONTRIBUTIONS

Original: In this paper, we consider the problem of privately releasing approximate frequencies for the heavyhitters in a dataset defined by the sliding window model.
Revised: In this paper, we consider the problem of privately releasing approximate frequencies for the heavyhitters in a dataset defined by the sliding window model.

Original: We give the first differentially private algorithm for approximating the frequencies of the L 2 -heavy hitters in the sliding window model.
Revised: We give the first differentially private algorithm for approximating the frequencies of the L 2 -heavy hitters in the sliding window model.

Original: Theorem 1.2.
Revised: Theorem 1.2.

Original: For any α ∈ (0 , 1) , c > 0 , window parameter W on a stream of length m that induces a frequency vector f ∈ R n in the sliding window model, and privacy parameter ε > 1000log m α 3 √ W , there exists an algorithm such that:
Revised: For any α ∈ (0 , 1) , c > 0 , window parameter W on a stream of length m that induces a frequency vector f ∈ R n in the sliding window model, and privacy parameter ε > 1000log m α 3 √ W , there exists an algorithm such that:

Original: (1) (Privacy) The algorithm is ( ε, δ ) -differentially private for δ = 1 m c .
Revised: (1) (Privacy) The algorithm is ( ε, δ ) -differentially private for δ = 1 m c .

Original: (2) (Heavy-hitters)
Revised: (2) (Heavy-hitters)

Original: With probability at least 1 − 1 m c , the algorithm outputs a list L such that k ∈ L for each k ∈ [ n ] with f k ≥ α L 2 ( f ) and j / ∈ L for each j ∈ [ n ] with f j ≤ α 2 L 2 ( f ) .
Revised: With probability at least 1 − 1 m c , the algorithm outputs a list L such that k ∈ L for each k ∈ [ n ] with f k ≥ α L 2 ( f ) and j / ∈ L for each j ∈ [ n ] with f j ≤ α 2 L 2 ( f ) .

Original: (3) (Accuracy) With probability at least 1 − 1 m c , we simultaneously have | f k − (cid:101)
Revised: (3) (Accuracy) With probability at least 1 − 1 m c , we simultaneously have | f k − (cid:101)

Original: f k | ≤ α 4 L 2 ( f ) for all k ∈ L , where (cid:101)
Revised: f k | ≤ α 4 L 2 ( f ) for all k ∈ L , where (cid:101)

Original: f k denotes the noisy approximation of f k output by the algorithm.
Revised: f k denotes the noisy approximation of f k output by the algorithm.

Original: (4) (Complexity)
Revised: (4) (Complexity)

Original: The algorithm uses O (cid:16) log 7 m α 6 η 4 (cid:17) bits of space and O (cid:16) log 4 m α 3 η 4 (cid:17) operations per update where η = max { 1 , ε } .
Revised: The algorithm uses O (cid:16) log 7 m α 6 η 4 (cid:17) bits of space and O (cid:16) log 4 m α 3 η 4 (cid:17) operations per update where η = max { 1 , ε } .

Original: We remark that we can achieve similar guarantees for general α ≥ 1 , provided that ε > 1000log m √ W , as well as for general ε ∈ (0 , 1) , though the utility becomes an additive error rather than a multiplicative error, due to the larger noise that must be added to ensure privacy.

Original: Pure differential privacy for L 1 -heavy hitters.
Revised: Pure differential privacy for L 1 -heavy hitters.

Original: Along the way, we develop techniques for handling differentially private algorithms in the sliding window model that may be of independent interest.
Revised: Along the way, we develop techniques for handling differentially private algorithms in the sliding window model that may be of independent interest.

Original: In particular, we also use our techniques to obtain an L 1 -heavy hitter algorithm for the sliding window model that guarantees pure differential privacy.
Revised: In particular, we also use our techniques to obtain an L 1 -heavy hitter algorithm for the sliding window model that guarantees pure differential privacy.

Original: Continual release for L 2 -heavy hitters.
Revised: Continual release for L 2 -heavy hitters.

Original: Finally, we give an algorithm for continual release of Land L 2 -heavy hitters in the sliding window model that has additive error α √ Wfor each estimated heavy-hitter frequency and preserves pure differential privacy, building on a line of work (Chan et al., 2012; Upadhyay, 2019; Huang et al., 2021) for continual release.
Revised: Finally, we give an algorithm for continual release of Land L 2 -heavy hitters in the sliding window model that has additive error α √ Wfor each estimated heavy-hitter frequency and preserves pure differential privacy, building on a line of work (Chan et al., 2012; Upadhyay, 2019; Huang et al., 2021) for continual release.

Original: By comparison, the algorithm of (Upadhyay, 2019) only guarantees O (cid:0) W 3 / 4 (cid:1) additive error while the algorithm of (Huang et al., 2021) gives ( ε, δ ) -differential privacy.
Revised: By comparison, the algorithm of (Upadhyay, 2019) only guarantees O (cid:0) W 3 / 4 (cid:1) additive error while the algorithm of (Huang et al., 2021) gives ( ε, δ ) -differential privacy.

Original: We remark that since √ W ≤ L 2 ( t − W + 1 : t ) for any t ∈ [ m ] , where L 2 ( t − W +1 : t ) denotes the L 2 norm of the sliding window, then our improvements over (Upadhyay, 2019) for the continual release of L 1 -heavy hitters actually also resolve the problem of continual release of L 2 -heavy hitters.
Revised: We remark that since √ W ≤ L 2 ( t − W + 1 : t ) for any t ∈ [ m ] , where L 2 ( t − W +1 : t ) denotes the L 2 norm of the sliding window between times t − W + and t , then our improvements over (Upadhyay, 2019) for the continual release of L 1 -heavy hitters actually also resolve the problem of continual release of L 2 -heavy hitters.

Original: Nevertheless, the approach is somewhat standard and thus we defer discussion to the appendix.
Revised: Nevertheless, the approach is somewhat standard and thus we defer discussion to the appendix.

Original: 1. R ELATED W ORK
Revised: 1. R ELATED W ORK

Original: Dynamic structures vs. linear sketching.
Revised: Dynamic structures vs. linear sketching.

Original: Non-private algorithms in the streaming model generally follow one of two main approaches.
Revised: Non-private algorithms in the streaming model generally follow one of two main approaches.

Original: The first main approach is the transformation from static data structures to dynamic structures using the framework of (Bentley & Saxe, 1980).
Revised: The first main approach is the transformation from static data structures to dynamic structures using the framework of (Bentley & Saxe, 1980).

Original: Although the approach has been a useful tool for many applications (Dwork et al., 2010; Chan et al., 2011; 2012;
Revised: Although the approach has been a useful tool for many applications (Dwork et al., 2010; Chan et al., 2011; 2012;

Original: Larsen et al., 2020), it does provide a mechanism to handle the implicit deletion of updates induced by the sliding window model.
Revised: Larsen et al., 2020), it does provide a mechanism to handle the implicit deletion of updates induced by the sliding window model.

Original: The second main approach is the use of linear sketching (Blocki et al., 2012; Bassily & Smith, 2015; Bun et al., 2019; Bassily et al., 2020; Huang et al., 2021), where the data x is multiplied by a random matrix A to create a small-space “sketch” Ax of the original dataset.
Revised: The second main approach is the use of linear sketching (Blocki et al., 2012; Bassily & Smith, 2015; Bun et al., 2019; Bassily et al., 2020; Huang et al., 2021), where the data x is multiplied by a random matrix A to create a small-space “sketch” Ax of the original dataset.

Original: Note that sampling can fall under the umbrella of linear sketching in the case where the random matrix only contains a single one as the nonzero entry in each row.
Revised: Note that sampling can fall under the umbrella of linear sketching in the case where the random matrix only contains a single one as the nonzero entry in each row.

Original: Unfortunately, linear sketching again cannot handle the implicit deletions of the sliding window model, since it is not entirely clear how to “undo” the effect of each expired element in the linear sketch Ax .
Revised: Unfortunately, linear sketching again cannot handle the implicit deletions of the sliding window model, since it is not entirely clear how to “undo” the effect of each expired element in the linear sketch Ax .

Original: Adapting insertion-only streaming algorithms to the sliding window model.
Revised: Adapting insertion-only streaming algorithms to the sliding window model.

Original: Algorithms for the sliding window model are often adapted from the insertion-only streaming model through either the exponential histogram framework (Datar et al., 2002) or its generalization, the smooth histogram framework (Braverman & Ostrovsky, 2007).
Revised: Algorithms for the sliding window model are often adapted from the insertion-only streaming model through either the exponential histogram framework (Datar et al., 2002) or its generalization, the smooth histogram framework (Braverman & Ostrovsky, 2007).

Original: These frameworks transform streaming algorithms for either an additive function (in the case of exponential histograms) or a smooth function (in the case of smooth histograms) into sliding window algorithms by maintaining a logarithmic number of instances of the streaming algorithm, starting at various timestamps during the stream.
Revised: These frameworks transform streaming algorithms for either an additive function (in the case of exponential histograms) or a smooth function (in the case of smooth histograms) into sliding window algorithms by maintaining a logarithmic number of instances of the streaming algorithm, starting at various timestamps during the stream.

Original: Informally, a function is smooth if once a suffix of a data stream becomes a (1+ β ) -approximation of the entire data stream for the function, then the suffix is always a (1 + α ) -approximation, regardless of the subsequent updates in the stream.
Revised: Informally, a function is smooth if once a suffix of a data stream becomes a (1+ β ) -approximation of the entire data stream for the function, then the suffix is always a (1 + α ) -approximation, regardless of the subsequent updates in the stream.

Original: Thus at the end of the stream of say length m , two of the timestamps must “sandwich” the beginning of the window, i.e., there exists timestamps t 1 and t 2 such that t 1 ≤ m − W + 1 < t 2 .
Revised: Thus at the end of the stream of say length m , two of the timestamps must “sandwich” the beginning of the window, i.e., there exists timestamps t 1 and t 2 such that t 1 ≤ m − W + 1 < t 2 .

Original: The main point of the smooth histogram is that the streaming algorithm starting at time t 1 must output a value that is a good approximation of the function on the sliding window due to the smoothness of the function.
Revised: The main point of the smooth histogram is that the streaming algorithm starting at time t 1 must output a value that is a good approximation of the function on the sliding window due to the smoothness of the function.

Original: Therefore, the smooth histogram is a cornerstone of algorithmic design in the sliding window model and handles many interesting functions, such as L p norm estimation (and in particular the sum), longest increasing subsequence, geometric mean, distinct elements estimation, and counting the frequency of a specific item.
Revised: Therefore, the smooth histogram is a cornerstone of algorithmic design in the sliding window model and handles many interesting functions, such as L p norm estimation (and in particular the sum), longest increasing subsequence, geometric mean, distinct elements estimation, and counting the frequency of a specific item.

Original: On the other hand, there remain interesting functions that are not smooth, such as clustering (Braverman et al., 2016; Borassi et al., 2020; Epasto et al., 2021), submodular optimization (Chen et al., 2016; Epasto et al., 2017), sampling (Jayaram et al., 2021), regression and low-rank approximation (Braverman et al., 2020; Upadhyay & Upadhyay, 2021), and crucially for our purposes, heavy hitters (Braverman et al., 2014; 2018; Upadhyay, 2019; Woodruff & Zhou, 2021).
Revised: On the other hand, there remain interesting functions that are not smooth, such as clustering (Braverman et al., 2016; Borassi et al., 2020; Epasto et al., 2021), submodular optimization (Chen et al., 2016; Epasto et al., 2017), sampling (Jayaram et al., 2021), regression and low-rank approximation (Braverman et al., 2020; Upadhyay & Upadhyay, 2021), and crucially for our purposes, heavy hitters (Braverman et al., 2014; 2018; Upadhyay, 2019; Woodruff & Zhou, 2021).

Original: These problems cannot be handled by the smooth histogram framework and thus for these problems, sliding windows algorithms were developed utilizing the specific properties of the objective functions.
Revised: These problems cannot be handled by the smooth histogram framework and thus for these problems, sliding windows algorithms were developed utilizing the specific properties of the objective functions.

Original: Previous work in the DP setting.
Revised: Previous work in the DP setting.

Original: The work most related to the subject of our study is (Upadhyay, 2019) who proposed the study of differentially private L 1 -heavy hitter algorithms in the sliding window.
Revised: The work most related to the subject of our study is (Upadhyay, 2019) who proposed the study of differentially private L 1 -heavy hitter algorithms in the sliding window.

Original: Although (Upadhyay, 2019) gave a continual release algorithm, which was later improved by (Huang et al., 2021), the central focus of our work is the “one-shot” setting, where the algorithm releases a single set of statistics at the end of the stream, because permitting a single interaction with the data structure can often achieve better guarantees for both the space complexity and the utility of the algorithm.
Revised: Although (Upadhyay, 2019) gave a continual release algorithm, which was later improved by (Huang et al., 2021), the central focus of our work is the “one-shot” setting, where the algorithm releases a single set of statistics at the end of the stream, because permitting a single interaction with the data structure can often achieve better guarantees for both the space complexity and the utility of the algorithm.

Original: Indeed, in this paper we present L 2 -heavy hitter algorithms for both the continual release and the one-shot settings, but the space/accuracy tradeoffs in the latter are much better than the former.
Revised: Indeed, in this paper we present L 2 -heavy hitter algorithms for both the continual release and the one-shot settings, but the space/accuracy tradeoffs in the latter are much better than the former.

Original: (Upadhyay, 2019) also proposed a “one-shot” algorithm, which empirically performs well, but lacks the theoretical guarantees claimed in the paper, i.e., see Section 1.3.
Revised: (Upadhyay, 2019) also proposed a “one-shot” algorithm, which empirically performs well, but lacks the theoretical guarantees claimed in the paper, i.e., see Section 1.3.

Original: Privately releasing heavy-hitters in other big data models has also received significant attention.
Revised: Privately releasing heavy-hitters in other big data models has also received significant attention.

Original: (Dwork et al., 2010) introduced the problem of L 1 -heavy hitters and other problems in the pan-privacy streaming model, where the goal is to preserves differential privacy even if the internal memory of the algorithm is compromised, while (Chan et al., 2012) considered the problem of continually releasing L 1 -heavy hitters in a stream.
Revised: (Dwork et al., 2010) introduced the problem of L 1 -heavy hitters and other problems in the pan-privacy streaming model, where the goal is to preserves differential privacy even if the internal memory of the algorithm is compromised, while (Chan et al., 2012) considered the problem of continually releasing L 1 -heavy hitters in a stream.

Original: The heavy-hitter problem has also been extensively studied in the local model (Bassily & Smith, 2015;
Revised: The heavy-hitter problem has also been extensively studied in the local model (Bassily & Smith, 2015;

Original: Ding et al., 2017; Acharya & Sun, 2019; Bun et al., 2019; Bassily et al., 2020), where individual users locally add privacy to their data, e.g., through randomized response, before sending their private information to a central and possibly untrusted server to aggregate the statistics across all users.
Revised: Ding et al., 2017; Acharya & Sun, 2019; Bun et al., 2019; Bassily et al., 2020), where individual users locally add privacy to their data, e.g., through randomized response, before sending their private information to a central and possibly untrusted server to aggregate the statistics across all users.

Original: 1. O VERVIEW OF O UR T ECHNIQUES
Revised: 1. O VERVIEW OF O UR T ECHNIQUES

Original: In this section, we give a brief overview of our techniques and the various challenges that they overcome.
Revised: In this section, we give a brief overview of our techniques and the various challenges that they overcome.

Original: We defer full proofs to the supplementary material.
Revised: We defer full proofs to the supplementary material.

Original: We first use the smooth histogram to obtain a constant factor approximation to the L 2 norm of the sliding window similar to existing heavy-hitter non-DP algorithms in the sliding window model (Braverman et al., 2014; 2018).
Revised: We first use the smooth histogram to obtain a constant factor approximation to the L 2 norm of the sliding window similar to existing heavy-hitter non-DP algorithms in the sliding window model (Braverman et al., 2014; 2018).

Original: We maintain a series of timestamps t 1 < t 2 < . . .
Revised: We maintain a series of timestamps t 1 < t 2 < . . .

Original: < t s for s =
Revised: < t s for s =

Original: O (log n ) , such that L 2 ( t 1 : m ) >
Revised: O (log n ) , such that L 2 ( t 1 : m ) >

Original: L 2 ( t 2 : m ) > . . .
Revised: L 2 ( t 2 : m ) > . . .

Original: > L 2 ( t s : m ) and t 1 ≤ m − W + 1 < t 2 .
Revised: > L 2 ( t s : m ) and t 1 ≤ m − W + 1 < t 2 .

Original: Hence, L 2 ( t 1 : m ) is a constant factor approximation to L 2 ( m − W + 1 : m ) , which is the L 2 norm of the sliding window.
Revised: Hence, L 2 ( t 1 : m ) is a constant factor approximation to L 2 ( m − W + 1 : m ) , which is the L 2 norm of the sliding window.

Original: For each timestamp t i with i ∈ [ s ] , we also run an L 2 -heavy hitter algorithm C OUNT S KETCH i , which outputs a list L i of size at most O (cid:0) 1 α 2 (cid:1) that contains the L 2 -heavy hitters of the suffix of the stream starting at time t
Revised: For each timestamp t i with i ∈ [ s ] , we also run an L 2 -heavy hitter algorithm C OUNT S KETCH i , which outputs a list L i of size at most O (cid:0) 1 α 2 (cid:1) that contains the L 2 -heavy hitters of the suffix of the stream starting at time t

Original: i , as well as approximations to each of their frequencies.
Revised: i , as well as approximations to each of their frequencies.

Original: It might be tempting to simply output a noisy version of the list L 1 output by C OUNT S KETCH 1 , since t 1 and t 2 sandwich the start of the sliding window, m − W + 1 .
Revised: It might be tempting to simply output a noisy version of the list L 1 output by C OUNT S KETCH 1 , since t 1 and t 2 sandwich the start of the sliding window, m − W + 1 .

Original: Indeed, this is the approach by (Upadhyay, 2019), although they only consider the L 1 -heavy hitter algorithm C OUNT M IN because they study the weaker L 1 -heavy hitter problem and they do not need to run a norm estimation algorithm because L 1 can be computed exactly.
Revised: Indeed, this is the approach by (Upadhyay, 2019), although they only consider the L 1 -heavy hitter algorithm C OUNT M IN because they study the weaker L 1 -heavy hitter problem and they do not need to run a norm estimation algorithm because L 1 can be computed exactly.

Original: However, (Braverman et al., 2014; 2018) crucially note that L 1 can also include a number of items that are heavy-hitters with respect to the suffix of the stream starting at time t 1 but are not heavy-hitters in the sliding window because many or even all of them appeared before time m − W +1 .
Revised: However, (Braverman et al., 2014; 2018) crucially note that L 1 can also include a number of items that are heavy-hitters with respect to the suffix of the stream starting at time t 1 but are not heavy-hitters in the sliding window because many or even all of them appeared before time m − W +1 .

Original: Thus although L 1 can guarantee that all the L 2 -heavy hitters are reported by considering a lower threshold, say α 2 , the frequencies of each reported heavy-hitter can be arbitrarily inaccurate.
Revised: Thus although L 1 can guarantee that all the L 2 -heavy hitters are reported by considering a lower threshold, say α 2 , the frequencies of each reported heavy-hitter can be arbitrarily inaccurate.

Original: Observe it does not suffice to instead report the L 2 -heavy hitters starting from time t 2 .
Revised: Observe it does not suffice to instead report the L 2 -heavy hitters starting from time t 2 .

Original: Although this will remove the false-positive issue of outputting items that are not heavy-hitters, there is now a false-negative issue; there may be heavy-hitters that appear after time m − W +
Revised: Although this will remove the false-positive issue of outputting items that are not heavy-hitters, there is now a false-negative issue; there may be heavy-hitters that appear after time m − W +

Original: but before time t 2 that will not be detected by C OUNT S KETCH 2 .
Revised: but before time t 2 that will not be detected by C OUNT S KETCH 2 .

Original: Hence, there may be heavy-hitters of the sliding window that are not reported by L 2 .
Revised: Hence, there may be heavy-hitters of the sliding window that are not reported by L 2 .

Original: See Figure 1 for an example.
Revised: See Figure 1 for an example.

Revised: [Figure]

Revised: the active elements at the end of the stream (the blue rectangle).

Revised: The challenge is that there may be heavy-hitters with respect to the blue rectangle that only appear before the active elements and therefore may be detected as heavy-hitters of the sliding window even though they are not.

Original: Approximate counters.
Revised: Approximate counters.

Original: The fix by (Braverman et al., 2014; 2018) that is missed by (Upadhyay, 2019) is to run approximate counters for each item k ∈ [ n ] reported by some heavy-hitter algorithm
Revised: The fix by (Braverman et al., 2014; 2018) that is missed by (Upadhyay, 2019) is to run approximate counters for each item k ∈ [ n ] reported by some heavy-hitter algorithm

Original: C OUNT S KETCH i , i.e., there exists
Revised: C OUNT S KETCH i , i.e., there exists

Original: i ∈
Revised: i ∈

Original: [ s ] such that k ∈ L i .
Revised: [ s ] such that k ∈ L i .

Original: An approximate counter is simply a sliding window algorithm that reports a constant factor approximation to the frequency of a specific item k ∈ [ n ] .
Revised: An approximate counter is simply a sliding window algorithm that reports a constant factor approximation to the frequency of a specific item k ∈ [ n ] .

Original: One way to achieve an approximate counter is to use the smooth histogram framework (Braverman & Ostrovsky, 2007), but we show that an improved accuracy can be guaranteed if the maintenance procedure instead considers additive error rather than multiplicative error.
Revised: One way to achieve an approximate counter is to use the smooth histogram framework (Braverman & Ostrovsky, 2007), but we show that an improved accuracy can be guaranteed if the maintenance procedure instead considers additive error rather than multiplicative error.

Original: Given the approximate counter that reports an estimate (cid:98) f
Revised: Given the approximate counter that reports an estimate (cid:98) f

Original: k as the frequency for an item k ∈ [ n ] , we can then compare (cid:98) f k to the estimated L 2 norm of the sliding window to determine whether k could possibly be an L 2 -heavy hitter.
Revised: k as the frequency for an item k ∈ [ n ] , we can then compare (cid:98) f k to the estimated L 2 norm of the sliding window to determine whether k could possibly be an L 2 -heavy hitter.

Original: This rules out the false positives that can be returned in L 1 without incurring false negatives omitted by L 2 .[Figure]
Revised: This rules out the false positives that can be returned in L 1 without incurring false negatives omitted by L 2 .

Original: Large sensitivity of subroutines.
Revised: Large sensitivity of subroutines.

Original: So far we have only discussed the techniques required to release
Revised: So far we have only discussed the techniques required to release

Original: L 2 -heavy hitters in the non-DP setting.
Revised: L 2 -heavy hitters in the non-DP setting.

Original: In order to achieve differential privacy, a first attempt might be to add Laplacian noise to each of the procedures.
Revised: In order to achieve differential privacy, a first attempt might be to add Laplacian noise to each of the procedures.

Original: Namely, we would like to add Laplacian noise to the estimate of the L 2 norm of the sliding window and the frequency of each reported heavyhitter.
Revised: Namely, we would like to add Laplacian noise to the estimate of the L 2 norm of the sliding window and the frequency of each reported heavyhitter.

Original: However, since both the estimate of the L 2 norm of the sliding window and the frequency of each reported heavy-hitter is governed by the timestamps t 1 , . . .
Revised: However, since both the estimate of the L 2 norm of the sliding window and the frequency of each reported heavy-hitter is governed by the timestamps t 1 , . . .

Original: , t s , then the sensitivity of each quantity can be rather large.
Revised: , t s , then the sensitivity of each quantity can be rather large.

Original: In fact, if the frequency of each reported heavy-hitter has sensitivity α · L 2 ( m − W + 1 : m ) through the approximate counters, then with high probability, the Laplacian noise added to the frequency of some reported heavy-hitter will completely dominate the actual frequency of the item to the point where it is no longer possible to identify the heavy-hitters.
Revised: In fact, if the frequency of each reported heavy-hitter has sensitivity α · L 2 ( m − W + 1 : m ) through the approximate counters, then with high probability, the Laplacian noise added to the frequency of some reported heavy-hitter will completely dominate the actual frequency of the item to the point where it is no longer possible to identify the heavy-hitters.

Original: Thus the approximate counters missed by (Upadhyay, 2019) actually pose a significant barrier to the privacy analysis of the algorithm.
Revised: Thus the approximate counters missed by (Upadhyay, 2019) actually pose a significant barrier to the privacy analysis of the algorithm.

Original: Noisy timestamps.
Revised: Noisy timestamps.

Original: A natural idea might be to make the timestamps in the histogram themselves noisy, e.g., by adding Laplacian noise to each of the timestamps.
Revised: A natural idea might be to make the timestamps in the histogram themselves noisy, e.g., by adding Laplacian noise to each of the timestamps.

Original: Unfortunately, we would no longer have sketches that correspond to the noisy timestamps in the sense that if the smooth histogram maintains a heavy-hitter algorithm C OUNT S KETCH 1 starting at a time t 1 and prior to releasing the statistics, we add noise to the value of t 1 and obtain a noisy timestamp ˜ t 1 , then we do not actually have a streaming algorithm starting at a time ˜
Revised: Unfortunately, we would no longer have sketches that correspond to the noisy timestamps in the sense that if the smooth histogram maintains a heavy-hitter algorithm C OUNT S KETCH 1 starting at a time t 1 and prior to releasing the statistics, we add noise to the value of t 1 and obtain a noisy timestamp ˜ t 1 , then we do not actually have a streaming algorithm starting at a time ˜

Original: t 1 .
Revised: t 1 .

Original: Lower smooth sensitivity through better approximations.
Revised: Lower smooth sensitivity through better approximations.

Original: Instead, we guarantee differential privacy using the notion of smooth sensitivity (Nissim et al., 2007).
Revised: Instead, we guarantee differential privacy using the notion of smooth sensitivity (Nissim et al., 2007).

Original: The idea is the following — given an α -approximation algorithm A for a function with sensitivity ∆ f , we would like to intuitively say the approximation algorithm has sensitivity α ∆ f .
Revised: The idea is the following — given an α -approximation algorithm A for a function with sensitivity ∆ f , we would like to intuitively say the approximation algorithm has sensitivity α ∆ f .

Original: Unfortunately, this is not true because A ( X ) may report α · f ( X ) and A ( Y ) may report 1 α · f ( Y ) for adjacent datasets X and Y .
Revised: Unfortunately, this is not true because A ( X ) may report α · f ( X ) and A ( Y ) may report 1 α · f ( Y ) for adjacent datasets X and Y .

Original: However, if A is instead a (1 + α ) -approximation algorithm, then difference of the output of A on X and Y can be bounded by α · f ( X ) + α · f ( Y ) + ∆ f through a simple triangle inequality, conditioned on the correctness of A .
Revised: However, if A is instead a (1 + α ) -approximation algorithm, then difference of the output of A on X and Y can be bounded by α · f ( X ) + α · f ( Y ) + ∆ f through a simple triangle inequality, conditioned on the correctness of A .

Original: In other words, if α is sufficiently small, then we can show that the local sensitivity of A is sufficiently small, which allows us to control the amount of Laplacian noise that must be added through existing mechanisms for smooth sensitivity.
Revised: In other words, if α is sufficiently small, then we can show that the local sensitivity of A is sufficiently small, which allows us to control the amount of Laplacian noise that must be added through existing mechanisms for smooth sensitivity.

Original: Unfortunately, if A is not correct, then even the local sensitivity could be quite large; we handle these cases separately by analyzing the smooth sensitivity of an approximation algorithm that is always correct and then arguing indistinguishability through statistical distance.
Revised: Unfortunately, if A is not correct, then even the local sensitivity could be quite large; we handle these cases separately by analyzing the smooth sensitivity of an approximation algorithm that is always correct and then arguing indistinguishability through statistical distance.

Original: Therefore, we can set the accuracy of the L 2 norm estimation algorithm, each L 2 -heavy hitter algorithm, and each approximate counter algorithm to be sufficiently small and finally we can add Laplacian noise to each procedure without significantly impacting the final check of whether the estimated frequency for each item exceeds the heavy-hitter threshold.
Revised: Therefore, we can set the accuracy of the L 2 norm estimation algorithm, each L 2 -heavy hitter algorithm, and each approximate counter algorithm to be sufficiently small and finally we can add Laplacian noise to each procedure without significantly impacting the final check of whether the estimated frequency for each item exceeds the heavy-hitter threshold.

Original: Pure differential privacy for L 1 -heavy hitters in the sliding window model.
Revised: Pure differential privacy for L 1 -heavy hitters in the sliding window model.

Original: Due to the linearity of L 1 , our algorithm for differentially private L 1 -heavy hitters in the sliding window model is significantly simpler than the L 2 -heavy hitters algorithm.
Revised: Due to the linearity of L 1 , our algorithm for differentially private L 1 -heavy hitters in the sliding window model is significantly simpler than the L 2 -heavy hitters algorithm.

Original: For starters, each set of c updates must contribute exactly c to the L 1 norm, whereas their contribution to the L 2 norm depends on the particular coordinates they update.
Revised: For starters, each set of c updates must contribute exactly c to the L 1 norm, whereas their contribution to the L 2 norm depends on the particular coordinates they update.

Original: Therefore, not only do we not require an algorithm to approximate the L 1 norm of the active elements of the sliding window, but also we can fix a set of static timestamps in the smooth histogram, so we do not need to perform the same analysis to circumvent the sensitivity of the timestamps.
Revised: Therefore, not only do we not require an algorithm to approximate the L 1 norm of the active elements of the sliding window, but also we can fix a set of static timestamps in the smooth histogram, so we do not need to perform the same analysis to circumvent the sensitivity of the timestamps.

Original: Instead, it suffices to initialize a deterministic L 1 -heavy hitter algorithm at each timestamp and maintain deterministic counters for each reported heavy-hitter.
Revised: Instead, it suffices to initialize a deterministic L 1 -heavy hitter algorithm at each timestamp and maintain deterministic counters for each reported heavy-hitter.

Original: Pure differential privacy then follows from the lack of failure conditions in the subroutines, which was not possible for
Revised: Pure differential privacy then follows from the lack of failure conditions in the subroutines, which was not possible for

Original: L 2 -heavy hitters.
Revised: L 2 -heavy hitters.

Original:  P RELIMINARIES
Revised:  P RELIMINARIES

Original: For an integer n > 0 , we use the notation [ n ] := { 1 , . . . , n } .
Revised: For an integer n > 0 , we use the notation [ n ] := { 1 , . . . , n } .

Original: We use the notation poly( n ) to represent a constant degree polynomial in n and we say an event occurs with high probability if the event holds with probability 1 − 1 poly( n ) .
Revised: We use the notation poly( n ) to represent a constant degree polynomial in n and we say an event occurs with high probability if the event holds with probability 1 − 1 poly( n ) .

Original: Differential privacy.
Revised: Differential privacy.

Original: In this section, we first introduce simple or well-known results from differential privacy.
Revised: In this section, we first introduce simple or well-known results from differential privacy.

Original: We say that streams S and S ′ are neighboring , if there exists a single update i ∈ [ m ] such that u i ̸
Revised: We say that streams S and S ′ are neighboring , if there exists a single update i ∈ [ m ] such that u i ̸

Original: = u ′ i , where u 1 , . . .
Revised: = u ′ i , where u 1 , . . .

Original: , u m are the updates of S and u ′ 1 , . . .
Revised: , u m are the updates of S and u ′ 1 , . . .

Original: , u ′ m are the updates of S ′ .
Revised: , u ′ m are the updates of S ′ .

Original: Definition 2.1 ( L 1 sensitivity) .
Revised: Definition 2.1 ( L 1 sensitivity) .

Original: The L 1 sensitivity of a function f : U ∗ → R k is defined by ∆ f = max x,y ∈U ∗ | , ∥ x − y ∥ 1 =1 ∥
Revised: The L 1 sensitivity of a function f : U ∗ → R k is defined by ∆ f = max x,y ∈U ∗ | , ∥ x − y ∥ 1 =1 ∥

Original: f
Revised: f

Original: ( x ) − f ( y ) ∥ 1 .
Revised: ( x ) − f ( y ) ∥ 1 .

Original: The L 1 sensitivity of a function f bounds the amount that f can change when a single coordinate of the input to f changes and is often used to parameterize the amount of added noise to ensure differential privacy.
Revised: The L 1 sensitivity of a function f bounds the amount that f can change when a single coordinate of the input to f changes and is often used to parameterize the amount of added noise to ensure differential privacy.

Original: We define the following notion of local L 1 sensitivity for a fixed input, which can be much smaller than the (global) L 1 sensitivity.
Revised: We define the following notion of local L 1 sensitivity for a fixed input, which can be much smaller than the (global) L 1 sensitivity.

Original: Definition 2.2 (Local sensitivity) .
Revised: Definition 2.2 (Local sensitivity) .

Original: For f : U ∗ → R and x ∈ U ∗ , the local sensitivity of f at x is defined as LS f ( x ) = max y :
Revised: For f : U ∗ → R and x ∈ U ∗ , the local sensitivity of f at x is defined as LS f ( x ) = max y :

Original: ∥ x − y ∥ 1 =1 ∥ f ( x ) − f ( y ) ∥ 1 .
Revised: ∥ x − y ∥ 1 =1 ∥ f ( x ) − f ( y ) ∥ 1 .

Original: Unfortunately, the local sensitivity can behave wildly for specific algorithms.
Revised: Unfortunately, the local sensitivity can behave wildly for specific algorithms.

Original: Thus we have the following definition that smooths such behavior for local sensitivity.
Revised: Thus we have the following definition that smooths such behavior for local sensitivity.

Original: Definition 2.3 (Smooth upper bound on local sensitivity) .
Revised: Definition 2.3 (Smooth upper bound on local sensitivity) .

Original: For β > 0 , a function S : U ∗ → R is a β -smooth upper bound on the local sensitivity of f : U ∗ → R if
Revised: For β > 0 , a function S : U ∗ → R is a β -smooth upper bound on the local sensitivity of f : U ∗ → R if

Original: (1) For all x ∈ U ∗ , we have S ( x ) ≥ LS f ( x ) .
Revised: (1) For all x ∈ U ∗ , we have S ( x ) ≥ LS f ( x ) .

Original: For all x, y ∈ U ∗ with ∥ x − y ∥ 1 = 1 , we have S ( x ) ≤ e β · S ( y ) .
Revised: For all x, y ∈ U ∗ with ∥ x − y ∥ 1 = 1 , we have S ( x ) ≤ e β · S ( y ) .

Original: Even though the local sensitivity can be much smaller than the global L 1 sensitivity, the Laplace mechanism adds noise scaling with the global L 1 sensitivity.
Revised: Even though the local sensitivity can be much smaller than the global L 1 sensitivity, the Laplace mechanism adds noise scaling with the global L 1 sensitivity.

Original: Hence it seems natural to hope for a mechanism that adds less noise.
Revised: Hence it seems natural to hope for a mechanism that adds less noise.

Original: The following result shows that this is indeed possible.
Revised: The following result shows that this is indeed possible.

Original: Theorem 2.4 (Corollary 2.4 in (Nissim et al., 2007)) .
Revised: Theorem 2.4 (Corollary 2.4 in (Nissim et al., 2007)) .

Original: Let f : U ∗ → R and S : U ∗
Revised: Let f : U ∗ → R and S : U ∗

Original: →
Revised: →

Original: R be a β -smooth upper bound on the local sensitivity of f .
Revised: R be a β -smooth upper bound on the local sensitivity of f .

Original: If β ≤ ε 2ln(2 /δ ) and δ ∈ (0 , 1) , then the mechanism that outputs f ( x ) + X , where X ∼ Lap (cid:16) 2 S ( x ) ε (cid:17) is ( ε, δ ′ )
Revised: If β ≤ ε 2ln(2 /δ ) and δ ∈ (0 , 1) , then the mechanism that outputs f ( x ) + X , where X ∼ Lap (cid:16) 2 S ( x ) ε (cid:17) is ( ε, δ ′ )

Original: -differentially private, for δ ′ =
Revised: -differentially private, for δ ′ =

Original: δ 2 (cid:0) 1 + exp (cid:0) ε 2 (cid:1)(cid:1) .
Revised: δ 2 (cid:0) 1 + exp (cid:0) ε 2 (cid:1)(cid:1) .

Original: Heavy hitters.
Revised: Heavy hitters.

Original: In this section, we formally introduce the L p -heavy hitter problem and the algorithm
Revised: We now formally introduce the L p -heavy hitter problem and the algorithm

Original: C OUNT S KETCH , which is commonly used to find the L 2 -heavy hitters.
Revised: C OUNT S KETCH , which is commonly used to find the L 2 -heavy hitters.

Original: Definition 2.5 ( L p -heavy hitter problem) .
Revised: Definition 2.5 ( L p -heavy hitter problem) .

Original: Given an accuracy/threshold parameter α ∈ (0 , 1) , p > 0 , and a frequency vector f ∈ R n , report all coordinates k ∈ [ n ] such that f k ≥ α L p ( f ) and no coordinates j ∈ [ n ] such that f j ≤ α 2 L p ( f ) .
Revised: Given an accuracy/threshold parameter α ∈ (0 , 1) , p > 0 , and a frequency vector f ∈ R n , report all coordinates k ∈ [ n ] such that f k ≥ α L p ( f ) and no coordinates j ∈ [ n ] such that f j ≤ α 2 L p ( f ) .

Original: For each reported coordinate k ∈ [ n ] , also report an estimated frequency (cid:98) f
Revised: For each reported coordinate k ∈ [ n ] , also report an estimated frequency (cid:98) f

Original: k such that | (cid:98) f
Revised: k such that | (cid:98) f

Original: k − f k | ≤ α 4 L p ( f ) .
Revised: k − f k | ≤ α 4 L p ( f ) .

Original: Theorem 2.6 (Heavy-hitter algorithm C OUNT S KETCH (Charikar et al., 2004)) .
Revised: Theorem 2.6 (Heavy-hitter algorithm C OUNT S KETCH (Charikar et al., 2004)) .

Original: Given an accuracy parameter α > 0 and a failure probability δ ∈ (0 , 1) , there exists a one-pass streaming algorithm C OUNT S KETCH for the L 2 -heavy hitter problem that uses O (cid:0) 1 α 2 log nδ (cid:1) words of space and
Revised: Given an accuracy parameter α > 0 and a failure probability δ ∈ (0 , 1) , there exists a one-pass streaming algorithm C OUNT S KETCH for the L 2 -heavy hitter problem that uses O (cid:0) 1 α 2 log nδ (cid:1) words of space and

Original: O (cid:0) log nδ (cid:1) update time
Revised: O (cid:0) log nδ (cid:1) update time.

Original: Sliding window model.
Revised: Sliding window model.

Original: In this section, we introduce simple or well-known results for the sliding window model.
Revised: In this section, we introduce simple or well-known results for the sliding window model.

Original: Definition 2.7 (Sliding window model) .
Revised: Definition 2.7 (Sliding window model) .

Original: Given a universe U of items, which we associate with [ n ] , let a stream S of length m consist of updates u 1 , . . .
Revised: Given a universe U of items, which we associate with [ n ] , let a stream S of length m consist of updates u 1 , . . .

Original: , u m to the universe U , so that u i ∈ [ n ] for each i ∈ [ m ] .
Revised: , u m to the universe U , so that u i ∈ [ n ] for each i ∈ [ m ] .

Original: After the stream, a window parameter W is given, which induces the frequency vector f ∈ R n so that f k = |{ i : u i = k
Revised: After the stream, a window parameter W is given, which induces the frequency vector f ∈ R n so that f k = |{ i : u i = k

Original: ∧ i ≥ m − W + 1 }| for each k ∈ [ n ] .
Revised: ∧ i ≥ m − W + 1 }| for each k ∈ [ n ] .

Original: In other words, each coordinate k of the frequency vector is the number of updates to k within the last W updates.
Revised: In other words, each coordinate k of the frequency vector is the number of updates to k within the last W updates.

Original: We say A and B are adjacent substreams of a stream S of length m if A consists of the updates u i , . . .
Revised: We say A and B are adjacent substreams of a stream S of length m if A consists of the updates u i , . . .

Original: , u j and B consists of the updates u j +1 , . . .
Revised: , u j and B consists of the updates u j +1 , . . .

Original: , u k for some i, j, k ∈ [ m ] .
Revised: , u k for some i, j, k ∈ [ m ] .

Original: We have the following definition of a smooth function for the purposes of sliding window algorithms, not to be confused with the smooth sensitivity definition for differential privacy.
Revised: We have the following definition of a smooth function for the purposes of sliding window algorithms, not to be confused with the smooth sensitivity definition for differential privacy.

Original: Definition 2.8 (Smooth function) .
Revised: Definition 2.8 (Smooth function) .

Original: Given adjacent substreams A and B , a function g : U ∗ → R is ( α, β ) -smooth
Revised: Given adjacent substreams A and B , a function g : U ∗ → R is ( α, β ) -smooth

Original: if (1 − β ) g
Revised: if (1 − β ) g

Original: ( A ∪ B ) ≤ g ( B ) implies (1 − α ) g
Revised: ( A ∪ B ) ≤ g ( B ) implies (1 − α ) g

Original: ( A ∪ B ∪ C ) ≤ g ( B ∪ C ) for some parameters 0 < β ≤ α < 1 and any adjacent substream C .
Revised: ( A ∪ B ∪ C ) ≤ g ( B ∪ C ) for some parameters 0 < β ≤ α < 1 and any adjacent substream C .

Original: Smooth functions are a key building block in the smooth histogram framework by (Braverman &
Revised: Smooth functions are a key building block in the smooth histogram framework by (Braverman &

Original: Ostrovsky, 2010), which creates a sliding window algorithm for a large number of functions using multiple instances of streaming algorithms starting at different points in time.
Revised: Ostrovsky, 2010), which creates a sliding window algorithm for a large number of functions using multiple instances of streaming algorithms starting at different points in time.

Original: See Algorithm 1 for more details on the smooth histogram.
Revised: See Algorithm 1 for more details on the smooth histogram.

Original: Theorem 2.9 (Smooth histogram (Braverman & Ostrovsky, 2010)) .
Revised: Theorem 2.9 (Smooth histogram (Braverman & Ostrovsky, 2010)) .

Original: Given accuracy parameter α ∈ (0 , 1) , failure probability δ ∈ (0 , 1) and an ( α, β ) -smooth
Revised: Given accuracy parameter α ∈ (0 , 1) , failure probability δ ∈ (0 , 1) and an ( α, β ) -smooth

Original: function g : U m → R , suppose there exists an insertion-only streaming algorithm A that outputs a (1 + α ) -approximation to g with high probability using space S ( α, δ, m, n ) and update time T ( α, δ, m, n ) .
Revised: function g : U m → R , suppose there exists an insertion-only streaming algorithm A that outputs a (1 + α ) -approximation to g with high probability using space S ( α, δ, m, n ) and update time T ( α, δ, m, n ) .

Original: Then there exists a sliding window algorithm that outputs a (1 + α ) -approximation to g with high probability using space O (cid:16) 1 β ( S ( β, δ, m, n ) + log m ) log m (cid:17) and update time O (cid:16) 1 β ( T ( β, δ, m, n )) log m (cid:17) . 
Revised: Then there exists a sliding window algorithm that outputs a (1 + α ) -approximation to g with high probability using space O (cid:16) 1 β ( S ( β, δ, m, n ) + log m ) log m (cid:17) and update time O (cid:16) 1 β ( T ( β, δ, m, n )) log m (cid:17) . Input: Stream S , accuracy parameter ρ ∈ (0 , 1) , streaming algorithm A for ( ρ, β ( ρ ))

Original:  ) -approximation of predetermined function with probability at least 1 − δ 1: H ← ∅ 2: for each update u twith t ∈ [ m ] do 3:
Revised: -smooth function Output: (1 + ρ ) -approximation of predetermined function with probability at least 1 − δ 1: H ← ∅ 2: for each update u t t ∈ [ m ] do 3:

Original: H ← H ∪ { t } 4: for each time t s ∈ H do 5:
Revised: H ← H ∪ { t } 4: for each time t s ∈ H do 5:

Original: Let x s be the output of A with failure probability δ poly( n,m ) starting at time t s and ending at time t .
Revised: Let x s be the output of A with failure probability δ poly( n,m ) starting at time t s and ending at time t .

Original: 6: if x s − 1 ≤ (cid:16) 1 − β ( ρ ) 2 (cid:17) x s +1 then 7:
Revised: 6: if x s − 1 ≤ (cid:16) 1 − β ( ρ ) 2 (cid:17) x s +1 then 7:

Original: Delete t s from H and reorder the indices in H 8: Let s be the smallest index such that t s ∈ H and t s ≤ m − W + 1 .
Revised: Delete t s from H and reorder the indices in H 8: Let s be the smallest index such that t s ∈ H and t s ≤ m − W + 1 .

Original: 9: Let x s be the output of A starting at time t s at time t .
Revised: 9: Let x s be the output of A starting at time t s at time t .

Original: 10: return x s
Revised: 10: return x s

Original: We slightly tweak the smooth histogram framework to achieve a deterministic algorithm C OUNTER that can be parametrized to give an additive M -approximation to the estimated frequency (cid:98)
Revised: We slightly tweak the smooth histogram framework to achieve a deterministic algorithm C OUNTER that can be parametrized to give an additive M -approximation to the estimated frequency (cid:98)

Original: f i of a particular element i ∈ [ n ] in the sliding window model.
Revised: f i of a particular element i ∈ [ n ] in the sliding window model.

Original: Lemma 2.10.
Revised: Lemma 2.10.

Original: There exists a deterministic algorithm C OUNTER that outputs an additive M approximation to the frequency of an element i ∈ [ n ] in the sliding window model.
Revised: There exists a deterministic algorithm C OUNTER that outputs an additive M approximation to the frequency of an element i ∈ [ n ] in the sliding window model.

Original: The algorithm uses
Revised: The algorithm uses

Original: O (cid:16) f i M log m (cid:17) bits of space.
Revised: O (cid:16) f i M log m (cid:17) bits of space.

Original:  D IFFERENTIALLY P RIVATE H EAVY -H ITTERS IN THE S LIDING W INDOW M ODEL
Revised:  D IFFERENTIALLY P RIVATE H EAVY -H ITTERS IN THE S LIDING W INDOW M ODEL

Original: In this section, we give a private algorithm for L 2 -heavy hitters in the sliding window model.
Revised: In this section, we give a private algorithm for L 2 -heavy hitters in the sliding window model.

Original: Our algorithm will initially use a smooth histogram approach by instantiating a number of L 2 norm estimation algorithm starting at various timestamps in the stream.
Revised: Our algorithm will initially use a smooth histogram approach by instantiating a number of L 2 norm estimation algorithm starting at various timestamps in the stream.

Original: Through a sandwiching argument, these L 2 norm estimation algorithms will provide a constant factor approximation to the L 2 norm of the sliding window, which will ultimately allow us to determine whether elements of the stream are heavy-hitters.
Revised: Through a sandwiching argument, these L 2 norm estimation algorithms will provide a constant factor approximation to the L 2 norm of the sliding window, which will ultimately allow us to determine whether elements of the stream are heavy-hitters.

Original: Moreover, by using a somewhat standard smooth sensitivity argument, we can show that these subroutines can be maintained in a way that preserves differential privacy.
Revised: Moreover, by using a somewhat standard smooth sensitivity argument, we can show that these subroutines can be maintained in a way that preserves differential privacy.

Original: To identify a subset of elements that can be heavy-hitters, we also run a private L 2 -heavy hitters algorithm starting at each timestamp.
Revised: To identify a subset of elements that can be heavy-hitters, we also run a private L 2 -heavy hitters algorithm starting at each timestamp.

Original: Unfortunately, because the timestamps do not necessarily coincide with the beginning of the sliding window, it may be possible that depending on our approach, we may either output a number of elements with very low, possibly even zero, frequency, or we may neglect to output a number of heavy-hitters.
Revised: Unfortunately, because the timestamps do not necessarily coincide with the beginning of the sliding window, it may be possible that depending on our approach, we may either output a number of elements with very low, possibly even zero, frequency, or we may neglect to output a number of heavy-hitters.

Original: To overcome this issue, we maintain a private algorithm
Revised: To overcome this issue, we maintain a private algorithm

Original: C OUNTER that outputs an estimated frequency for each item that is reported by our private L 2 -heavy hitters algorithms, which allows us to rule out initially reported false positives without incurring false negatives.
Revised: C OUNTER that outputs an estimated frequency for each item that is reported by our private L 2 -heavy hitters algorithms, which allows us to rule out initially reported false positives without incurring false negatives.

Original: We give the algorithm in full in Algorithm 2.
Revised: We give the algorithm in full in Algorithm 2.

Original: [Table] [Table] [Table] [Table]
Revised: (cid:18)

Original: [Table]
Revised: [Table]

Original: m (cid:99) L 2 for each reported heavy-hitter 7:

Original: Let (cid:98) f
Revised: Let (cid:98) f

Original: k be the approximate frequency reported by C OUNTER 8:
Revised: k be the approximate frequency reported by C OUNTER 8:

Original: Y [Equation] ← 
Revised: Y k ← Lap (cid:16)

Original: [Equation]
Revised: [Equation]

Original: 9: if (cid:101) f k ≥ 3 α 4 ( (cid:99) L 2 + X )
Revised: 9: if (cid:101) f k ≥ 3 α 4 ( (cid:99) L 2 + X )

Original: + Y k then 10:
Revised: + Y k then 10:

Original: L ← L ∪ { ( k, (cid:101) f k ) } 11: return L
Revised: L ← L ∪ { ( k, (cid:101) f k ) } 11: return L

Original: We first describe the procedure for the approximate frequency estimation for each reported heavyhitter.
Revised: We first describe the procedure for the approximate frequency estimation for each reported heavyhitter.

Original: Let C OUNT S KETCH a be an L 2 -heavy hitter algorithm starting at timestamp t a , where a = max { i ∈ [ s ] : t i ≤ m − W + 1 } on window query W > 0 .
Revised: Let C OUNT S KETCH a be an L 2 -heavy hitter algorithm starting at timestamp t a , where a = max { i ∈ [ s ] : t i ≤ m − W + 1 } on window query W > 0 .

Original: For a coordinate k ∈ [ n ] that is reported by C OUNT S KETCH a from times t through m , we use C OUNTER to maintain a number of timestamps such that the frequency of k on the suffixes induced by the timestamps are arithmetically increasing by roughly α 2 L 2 ( f ) / 16 .
Revised: For a coordinate k ∈ [ n ] that is reported by C OUNT S KETCH a from times t through m , we use C OUNTER to maintain a number of timestamps such that the frequency of k on the suffixes induced by the timestamps are arithmetically increasing by roughly α 2 L 2 ( f ) / 16 .

Original: We emphasize that we run the C OUNTER for each reported heavy-hitter in the same pass as the rest of the algorithm.
Revised: We emphasize that we run the C OUNTER for each reported heavy-hitter in the same pass as the rest of the algorithm.

Original: Lemma 3.1.
Revised: Lemma 3.1.

Original: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .
Revised: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .

Original: Let
Revised: Let

Original: C OUNT S KETCH a be the instance of C OUNT S KETCH starting at time t a .
Revised: C OUNT S KETCH a be the instance of C OUNT S KETCH starting at time t a .

Original: Conditioned on E , then for each reported heavy-hitter k by C OUNT S KETCH a , Algorithm 2 outputs an estimated frequency (cid:98)
Revised: Conditioned on E , then for each reported heavy-hitter k by C OUNT S KETCH a , Algorithm 2 outputs an estimated frequency (cid:98)

Original: f
Revised: f

Original: k such that | f k − (cid:98)
Revised: k such that | f k − (cid:98)

Original: f k | ≤
Revised: f k | ≤

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: L [Equation] ( f ) . The algorithm uses O (cid:0)

Original: [Equation]
Revised: [Equation]

Original: The algorithm uses O (cid:0) 1 α 6 ε 2 log 3 m (cid:1) space and O (cid:16) log 2 m α [-
-] ε 2 (cid:17) update time per instance of C OUNT S KETCH .
Revised: space and O (cid:16) log 2 m α [-
-]4 ε 2 (cid:17) update time per instance of C OUNT S KETCH .

Original: We first show that the list L output by Algorithm 2 does not contain any items with “low” frequency.
Revised: We first show that the list L output by Algorithm 2 does not contain any items with “low” frequency.

Original: Lemma 3.2 (Low frequency items are not reported) .
Revised: Lemma 3.2 (Low frequency items are not reported) .

Original: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .
Revised: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .

Original: Let f be the frequency vector induced by the sliding window parameter
Revised: Let f be the frequency vector induced by the sliding window parameter

Original: W and suppose f k ≤ α 2 L 2 ( f ) .
Revised: W and suppose f k ≤ α 2 L 2 ( f ) .

Original: Then conditioned on E , k / ∈ L .
Revised: Then conditioned on E , k / ∈ L .

Original: We then show that the heavy-hitters are reported and bound the error in the estimated frequency for each reported item.
Revised: We then show that the heavy-hitters are reported and bound the error in the estimated frequency for each reported item.

Original: Lemma 3.3 (Heavy-hitters are estimated accurately) .
Revised: Lemma 3.3 (Heavy-hitters are estimated accurately) .

Original: Let f be the frequency vector induced by the sliding window parameter W .
Revised: Let f be the frequency vector induced by the sliding window parameter W .

Original: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .
Revised: Let E be the event that (1) the smooth histogram data structure does not fail, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .

Original: Conditioned on E ,
Revised: Conditioned on E ,

Original: then k ∈ L for each k ∈ [ n ] with f k ≥ α L 2 ( f ) .
Revised: then k ∈ L for each k ∈ [ n ] with f k ≥ α L 2 ( f ) .

Original: Moreover, for each item k ∈ L , | f k − (cid:98) f
Revised: Moreover, for each item k ∈ L , | f k − (cid:98) f

Original: k | ≤ α 3 ε 500log m L 2 ( f ) .
Revised: k | ≤ α 3 ε 500log m L 2 ( f ) .

Original: We show that the event E conditioned by Lemma 3.1, Lemma 3.2, and Lemma 3.3 occurs with high probability.
Revised: We show that the event E conditioned by Lemma 3.1, Lemma 3.2, and Lemma 3.3 occurs with high probability.

Original: Lemma 3.4.
Revised: Lemma 3.4.

Original: Let E be the event that (1) the smooth histogram data structure does not fail on either stream, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .
Revised: Let E be the event that (1) the smooth histogram data structure does not fail on either stream, (2) all instances of C OUNT S KETCH do not fail, and (3) X ≤ L 2 ( f ) 10 and max j ∈ [ n ] ( Y j , Z j ) ≤ αL 2 ( f ) 10 .

Original: Then Pr [ E ] ≥ 1 − 4 m 2 − 2 m 114 .
Revised: Then Pr [ E ] ≥ 1 − 4 m 2 − 2 m 114 .

Original: Before analyzing the privacy guarantees of Algorithm 2, we must analyze the local sensitivity of its subroutines.
Revised: Before analyzing the privacy guarantees of Algorithm 2, we must analyze the local sensitivity of its subroutines.

Original: We first show a β -smooth upper bound on the local sensitivity of the frequency moment.
Revised: We first show a β -smooth upper bound on the local sensitivity of the frequency moment.

Original: We defer this statement to the supplementary material and also show the similar following β -smooth upper bound on the local sensitivity for each estimated frequency output by Algorithm 2.
Revised: We defer this statement to the supplementary material and also show the similar following β -smooth upper bound on the local sensitivity for each estimated frequency output by Algorithm 2.

Original: Lemma 3.5 (Smooth sensitivity of the estimated frequency) .
Revised: Lemma 3.5 (Smooth sensitivity of the estimated frequency) .

Original: Let S be a data stream of length m that induces a frequency vector f and let (cid:98)
Revised: Let S be a data stream of length m that induces a frequency vector f and let (cid:98)

Original: f k be the estimate of the frequency of a coordinate k ∈ [ n ] output by the smooth histogram.
Revised: f k be the estimate of the frequency of a coordinate k ∈ [ n ] output by the smooth histogram.

Original: Define the function h ( f ) by
Revised: Define the function h ( f ) by

Original: [Equation]
Revised: [Equation]

Original: 1000log m L 2 ( f ) , if (cid:98) f k > f k + α 3 ε 1000log m L 2 ( f ) .
Revised: 1000log m L 2 ( f ) , if (cid:98) f k > f k + α 3 ε 1000log m L 2 ( f ) .

Original: Then the function S ( f ) =
Revised: Then the function S ( f ) =

Original: α 3 ε 200log m h ( f ) + 2 is a β -smooth upper bound on the local sensitivity of h ( f ) for β ≥ α 3 ε 150log m , ε > 1000log m √ Wα 3 , and sufficiently large W .
Revised: α 3 ε 200log m h ( f ) + 2 is a β -smooth upper bound on the local sensitivity of h ( f ) for β ≥ α 3 ε 150log m , ε > 1000log m √ Wα 3 , and sufficiently large W .

Original: With the structural results on smooth sensitivity in place, we show that Algorithm 2 is ( ε, δ ) - differentially private.
Revised: With the structural results on smooth sensitivity in place, we show that Algorithm 2 is ( ε, δ ) - differentially private.

Original: Lemma 3.6.
Revised: Lemma 3.6.

Original: There exists an algorithm (see Algorithm 2) that is ( ε, δ ) -differentially private for α ∈ (0 , 1) , ε > 1000log m √ Wα 3 , and δ > 6 m 2 .
Revised: There exists an algorithm (see Algorithm 2) that is ( ε, δ ) -differentially private for α ∈ (0 , 1) , ε > 1000log m √ Wα 3 , and δ > 6 m 2 .

Original: Since Algorithm 2 further adds Laplacian noise Z ∼ Lap (cid:16)
Revised: Since Algorithm 2 further adds Laplacian noise Z ∼ Lap (cid:16)

Original: [Equation]
Revised: [Equation]

Original: to each (cid:98) f
Revised: to each (cid:98) f

Original: [Equation]
Revised: [Equation]

Original: with k ∈ L , then Lemma 3.3 implies that the additive error to f k is
Revised: with k ∈ L , then Lemma 3.3 implies that the additive error to f k is

Original: [Equation]
Revised: [Equation]

Original: for each reported coordinate k ∈ [ n ] .
Revised: for each reported coordinate k ∈ [ n ] .

Original: Thus through Lemma 3.6 (privacy), Lemma 3.2 and Lemma 3.3 (heavy-hitters/accuracy), and a simple analysis for space complexity, we have Theorem 1.2, our main result for differentially private
Revised: Thus through Lemma 3.6 (privacy), Lemma 3.2 and Lemma 3.3 (heavy-hitters/accuracy), and a simple analysis for space complexity, we have Theorem 1.2, our main result for differentially private

Original: L 2 -heavy hitters in the sliding window model.
Revised: L 2 -heavy hitters in the sliding window model.

Original: Pure differential privacy for L 1 -heavy hitters and continual release for L 2 -heavy hitters in the sliding window model.
Revised: Pure differential privacy for L 1 -heavy hitters and continual release for L 2 -heavy hitters in the sliding window model.

Original: To achieve pure differential privacy, we use a deterministic L 1 -heavy hitter algorithm M ISRA G RIES at each timestamp and maintain deterministic counters for each reported heavy-hitter.
Revised: To achieve pure differential privacy, we use a deterministic L 1 -heavy hitter algorithm M ISRA G RIES at each timestamp and maintain deterministic counters for each reported heavy-hitter.

Original: Due to the linearity of L 1 , the global L 1 sensitivity of our algorithm is at most 2 and thus it suffices to use the Laplace mechanism to guarantee pure differential privacy.
Revised: Due to the linearity of L 1 , the global L 1 sensitivity of our algorithm is at most 2 and thus it suffices to use the Laplace mechanism to guarantee pure differential privacy.

Original: To achieve continual release of L 2 -heavy hitters in the sliding window model, our algorithm consists of L :
Revised: To achieve continual release of L 2 -heavy hitters in the sliding window model, our algorithm consists of L :

Original: = O (log W ) =
Revised: = O (log W ) =

Original: O (log n ) levels of subroutines.
Revised: O (log n ) levels of subroutines.

Original: In each level ℓ ∈ [ L ] , we split the stream into continuous blocks of length S ℓ := 2 ℓ − 2 · α √ W 100log W .
Revised: In each level ℓ ∈ [ L ] , we split the stream into continuous blocks of length S ℓ := 2 ℓ − 2 · α √ W 100log W .

Original: Given a threshold parameter α > 0 , for each block in level ℓ , we run M ISRA G RIES with threshold 1 2 ℓ +1 L .
Revised: Given a threshold parameter α > 0 , for each block in level ℓ , we run M ISRA G RIES with threshold 1 2 ℓ +1 L .

Original: At the end of the stream, we stitch together a sketch of the underlying dataset represented by the sliding window through a binary tree mechanism.
Revised: At the end of the stream, we stitch together a sketch of the underlying dataset represented by the sliding window through a binary tree mechanism.

Original: Due to a sharper balancing argument and analysis than previous work for continual release of L 1 -heavy hitters, we obtain more accurate estimates of each item, which translates to sufficiently small error to catch the L 2 -heavy hitters.
Revised: Due to a sharper balancing argument and analysis than previous work for continual release of L 1 -heavy hitters, we obtain more accurate estimates of each item, which translates to sufficiently small error to catch the L 2 -heavy hitters.

Original: We defer full details of both procedures to the supplementary materials.
Revised: We defer full details of both procedures to the supplementary materials.

Original: R
Revised: R