Efficient noise generation for streaming differential privacy

Abstract

Methods, systems, and apparatuses, including computer programs encoded on computer storage media, for streaming updating of a data set while ensuring strong data security using differentially private updates. To update the data set at an iteration, the system can initialize a buffer state for updating the data set (if the system has not already done so); receive an initial data set update for the iteration; obtain sampled noise for the iteration; determine a differentially private update to the data set using the initial data set update and the sampled noise; and apply the differentially private update to the data set to update the data set. By determining the noise component of the differentially private update to be one that approximates a product between a particular type of lower-triangular matrix and a matrix of the sampled noise at the iteration and each preceding iteration, the system achieves near optimal utility for the differentially private updates.

Description

[0001]Attorney Docket No.45288-0454WO1 EFFICIENT NOISE GENERATION FOR STREAMING DIFFERENTIAL PRIVACY CROSS-REFERENCE TO RELATED APPLICATION This application claims priority to U.S. Application No.63 / 636,661, filed April 19, 2024, the disclosure of which is incorporated herein by reference. BACKGROUND This specification relates to data security and privacy and, more specifically, to streaming differential privacy. Streaming differential privacy can be used to improve data security in many domains. As one example, streaming differential privacy can be used to make training a machine learning model more secure and private. For example, neural networks are machine learning models that employ one or more layers of nonlinear units to predict an output for a received input. Some neural networks include one or more hidden layers in addition to an output layer. The output of each hidden layer is used as input to the next layer in the network, i.e., the next hidden layer or the output layer. Each layer of the network generates an output from a received input in accordance with current value inputs of a respective set of parameters. SUMMARY This specification describes a system implemented as computer programs on one or more computers in one or more locations that performs streaming updating of a data set while ensuring strong data security using differentially private updates. The updating of the data set is referred as “streaming” because at each of multiple iterations, the system receives an initial update (also referred to here as an “initial data set update”) to the data set and then uses the initial update to update the data set. That is, the final data set after the final iteration reflects a repeated incremental updating of the initial data set, where the system outputs each update after each iteration. The updating of the data set is referred to as “differentially private” because, at each of the iterations, the system transforms the initial update into a differentially private update before using the differentially private update to update the data set. An update being a “differentially private” update means that applying the update results in, at each iteration, the data set having a differential privacy guarantee with respect to the initial data set updates at the iteration and each preceding iteration. The guarantee is Attorney Docket No.45288-0454WO1 that the data set and the differentially private update cannot be used to deduce data included in the initial update (i.e., the data included in the initial update remains private, i.e., the data that represents sensitive information is not leaked). More formally, a differentially private update is said to satisfy (ε, δ)-differential privacy if the ratio of probabilities of obtaining a given output (e.g., an analysis output, a function output, a neural network output, and so on) using two datasets that differ by a differentially private update is at most eεand there is a probability δ of the differentially private update revealing the initial update. Particular embodiments of the subject matter described in this specification can be implemented so as to realize one or more of the following advantages. Streaming updating, i.e., updating a data set at each of a plurality of iterations, is useful for many important applications (e.g., real time data analysis, real time data aggregation, online training of machine learning models, and so on), and the updates included in streaming updating often contain sensitive information (i.e., data that should be secured). Ensuring the data security of the updates included in streaming updates is essential for preventing adverse parties from acquiring the data associated with the update and then using the data to do harm. For example, healthcare research is important to develop disease treatments and involves updating data sets, e.g., statistical analysis values that are continually updated, that include sensitive information e.g., using new and updated patient records. It is necessary to protect the sensitive information included in these data set updates to ensure patient confidentiality. Otherwise, for example, an adverse party could deduce a patient’s medical diagnosis from a dataset update and decide to disclose the diagnosis publicly with the intention of causing reputational harm to the patient. As another example, public policy investigations (e.g., a study of the effect of policy on the economic well-being of a city’s population) are important to determine beneficial decisions for society and involve data sets of analyses of reports and records associated with of individuals (e.g., aggregation of total car loan debt per individuals located in a zip code). It is important to also protect the sensitive information included in the updates, e.g., daily updates, to these data sets to protect the individuals that are included in the dataset. As an example of an adverse party using leaked sensitive information for this case to do harm, if an adverse party were to deduce an individual’s financial information (e.g., an individual’s car loan due amount) then they could target the individual with a deceptive product (e.g., a car loan refinancing scam). Attorney Docket No.45288-0454WO1 As another example, online updating of a machine learning model state (i.e., a data set of trainable parameters) uses data set updates (i.e., trainable parameter updates) that include sensitive data (e.g., user search history, user password text input, user software usage, user GPS data, and so on), especially when the machine learning model is used for applications such as fraud detection, autonomous driving, disease diagnosis, personalized recommendations, and so on). The data set updates (i.e., trainable parameter updates) contain sensitive data because they are derived from model inputs that are themselves sensitive data. For example, a model input that includes an individual’s password text input is a model input that contains sensitive information. If an adverse party had knowledge of the model (i.e., how the model transforms inputs to generate outputs), the adverse party’s access to data included in the trainable parameter updates could allow them to deduce what the input value (the individual’s password text input) is, and the adverse party could use the password to steal the individual’s identity. Given the many important applications of streaming updating and the fact that updates often include sensitive information, securing the data included in data set updates is of paramount importance. Practical differentially private updates ensure that data set updates are both data secure and useful. That is, the initial data set update of an iteration cannot be inferred using the updated data set after the iteration and the initial data set and therefore protects information included in the initial data set update. At the same time, differentially private updates ensure the total of iterations of differentially private updates do not introduce significant errors to the final data set such that the final data set differs significantly from a final data set updated using only initial data set updates. But conventional techniques that perform streaming updating of a data set in a differentially private manner are often either inefficient in terms of their space complexity (i.e., computer memory usage) or add an excessive amount of noise (i.e., the final data set has larger than necessary errors relative to the case of not combining noise with the updates), inducing suboptimal utility. That is, conventional techniques for performing streaming updating of a data set in a differentially private manner tradeoff between efficiency (i.e., limitations of the size of data sets and number of differentially private updates one can apply due to the time and space complexity of the conventional technique) and utility (i.e., limitations in the accuracy of the final data set). For example, consider performing continual counting (receiving a stream of incremental values, i.e., data set updates, and outputting an approximate running total of Attorney Docket No.45288-0454WO1 these incremental values, i.e., data sets at each iteration) with differentially private updates. Adding uncorrelated Gaussian noise (in proportion to chosen input privacy budget of ^ and probability δ) to each received increment helps protect the information included in the increment in a way that is efficient (having negligible time and space complexity), but it also decreases the utility of the running sums, i.e., accuracy of each iteration’s data set, by introducing potential accumulation of errors from the added noise. While adding crafted correlated Gaussian noise mitigates the accumulation of errors from the added noise, adding crafted correlated noise is often inefficient due to associated large memory costs or the resulting utility still not being sufficient. As a particular example, for differentially private updates in the context of continual counting described above, crafting correlated noise using the binary tree mechanism or the FHU (Fichtenberger, Henzinger, and Upadhyay) Toeplitz matrix factorization mechanism each have drawbacks in terms of space complexity (i.e., memory costs) or utility. While the conventional technique of binary tree mechanism for continual counting with differentially private updates requires computational memory usage that scales sublinearly with number of updates (a desirable property), the accuracy in terms of root mean squared error of the ithpartial sum of the final data set is far from optimal. In contrast, the use of the conventional technique of FHU Toeplitz matrix factorization for continual counting with differentially private updates results in a final data set with near optimal upper bound of error (lower bound of accuracy) in terms of root mean squared error of the ithpartial sum but requires computational memory usage that scales linearly with number of updates (an undesirable property). This specification describes a system that can address the aforementioned challenges. That is, this specification describes techniques that perform streaming updating of a data set in a differentially private manner efficiently yet result in the final data set having a near optimal upper bound of a particular type of error. For example, for performing continual counting, the described techniques result in near optimal upper bound of root mean squared error of the final data set while having memory requirements that scale sublinearly with the number of updates. Furthermore, the described techniques have the advantage of being able to be executed computationally in parallel, using parallel software or hardware such as multiple hardware threads, CPUs (central processing units), GPUs (graphical processing units), TPUs (tensor processing units), and ASICs (application- specific integrated circuits). Attorney Docket No.45288-0454WO1 The details of one or more embodiments of the subject matter of this specification are set forth in the accompanying drawings and the description below. According to a first aspect there is a provided a method performed by one or more computers. The method includes initializing a buffer state for updating a data set, where the buffer state includes, for each value in the data set, a respective value for each of a set of memory buffers. Then, at each of a plurality of iterations, the method includes the following steps. The method includes receiving an initial data set update for the iteration. Then the method includes, obtaining sampled noise for the iteration, where the sampled noise includes a respective noise value for each value in the data set. Then, determining a differentially private update to the data set using the initial data set update and the sampled noise. The process of determining a differentially private update includes updating the buffer state, which in turns includes applying a first linear transformation to the sampled noise and a second linear transformation to the update state. The process of determining a differentially private update then includes, after updating the buffer state, determining a noise component of the differentially private update from the buffer state and the sampled noise. Lastly, determining a differentially private update includes combining the initial data set update and the noise component to generate the differentially private update to the data set. Then, after determining a differentially private update, the method for the iteration lastly includes applying the differentially private update to the data set to update the data set. In some implementations, each iteration is a training iteration performed during training of a machine learning model that has a plurality of parameters on an objective function. Additionally, the data set includes a respective value for each of the plurality of parameters, and the initial data set update includes a respective gradient value for each of the plurality of parameters generated by performing the training iteration. In some implementations, applying the differentially private update to the data set includes summing the differentially private update and the data set. In some implementations, when each iteration is a training iteration performed during training of a machine learning model that has a plurality of parameters on an objective function, applying the differentially private update to the data set further includes applying a learning rate for the iteration to the sum. In some cases, combining the initial data set update and the noise component to generate the differentially private update to the data set includes summing the initial data set update and the noise component. Attorney Docket No.45288-0454WO1 In some implementations, updating the buffer state further includes summing an output of the first linear transformation and an output of the second linear transformation. In some implementations, determining a noise component of the differentially private update from the buffer state and the sampled noise includes applying a third linear transformation to the sampled noise. Then, applying a fourth linear transformation to the buffer state. Then lastly, summing an output of the third linear transformation and an output of the fourth linear transformation. In some cases, the noise component approximates a product between a lower- triangular matrix and a matrix of the sampled noise at the iteration and each preceding iteration. Further in some cases, each entry in the lower-triangular matrix is defined by a generating function. Further in some cases, coefficients in the first, second, third, and fourth linear transformations are dependent on the generating function. In some cases, the generating function approximates a function of the form ^^√1 െ ^^,where a is a constant and x is an input to the function. In some implementations, the method further includes performing an optimization to determine parameters that define the generating function. In some implementations, the lower-triangular matrix is a first matrix in a matrix decomposition of a lower-triangular matrix all-ones matrix that has dimensionality n x n, where n is a total number of iterations in the plurality of iterations. In some cases, applying a first linear transformation to the sampled noise includes multiplying a column vector having a respective value for each of the memory buffers with a row vector of the sampled noise to generate a first matrix having a same dimensionality as a matrix containing the update state. Further in some cases, applying a second linear transformation to the update state includes multiplying a matrix having a number of rows equal to the number of memory buffers and a number of columns equal to the number of memory buffers with the matrix containing the update state to generate a third matrix having the same dimensionality as the matrix containing the update state. In some implementations, applying a third linear transformation to the sampled noise includes multiplying the vector of the sampled noise with a scalar value. Attorney Docket No.45288-0454WO1 In some implementations, applying a fourth linear transformation to the buffer state includes multiplying a row vector having a respective value for each memory buffer with a matrix containing the update state after being updated to generate a vector having a same dimensionality as the vector of the sampled noise. In some cases, a total number of memory buffers is less than a total number of iterations in the plurality of iterations. In some cases, initializing a buffer state includes setting each value in the buffer state to zero. In some cases, obtaining sampled noise includes sampling noise from a Gaussian distribution. In some cases, the differentially private update is an update that results in, at each iteration, the data set having a differential privacy guarantee with respect to the initial data set updates at the iteration and each preceding iteration. According to a second aspect, there is provided a system that includes one or more computers and one or more storage devices, where the one or more storage devices include a plurality of registers, and where the one or more storage devices store instructions that when executed by the one or more computers cause the one or more computers to perform operations for updating a data set at each of a plurality of iterations. The operations include storing, in the plurality of registers, a buffer state for updating the data set, where the buffer state includes, for each value in the data set, a respective value for each of a set of memory buffers, and where a total number of memory buffers is less than a total number of iterations in the plurality of iterations. Then, at each of the plurality of iterations, the operations include the following steps. The operations include receiving an initial data set update for the iteration. Then the operations include obtaining sampled noise for the iteration, where the sampled noise includes a respective noise value for each value in the data set. Then the operations include determining a differentially private update to the data set using the initial data set update and the sampled noise. Determining a differentially private update includes updating the buffer state that is stored in the plurality of registers using the sampled noise. Determining a differentially private update also includes, after updating the buffer state, determining a noise component of the differentially private update from the buffer state and the sampled noise, and combining the initial data set update and the noise component to generate the differentially private update to the data set. Then, after determining a differentially private update to the data set, the operations for the iteration include applying the differentially private update to the data set to update the data set. Attorney Docket No.45288-0454WO1 According to a third aspect, there is provided the methods of the first aspect performed by one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one more computers to perform the operations of the respective method. According to a fourth aspect, there is provided the methods of the first aspect performed by one or more computer storage media storing instructions that when executed by one or more computers cause the one more computers to perform the operations of the respective method. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims. BRIEF DESCRIPTION OF THE DRAWINGS FIG.1 shows a secure data set update system. FIG.2 is a flow diagram of an example process for performing streaming updates of a data set in a differentially private manner. FIG.3 is a flow diagram of an example process for determining a differentially private update to the data set using an initial data set update and sampled noise. FIG.4 is a flow diagram of an example process for performing an optimization of coefficients for linear transformations. FIG.5 is an example of the performance of the described techniques. FIG.6 is an example of the performance of the described techniques. DETAILED DESCRIPTION FIG.1 shows an example secure data set update system 100. The secure data set update system 100 is an example of a system implemented as computer programs on one or more computers in one or more locations, in which the systems, components, and techniques described below can be implemented. The system 100 performs streaming updating of a data set 102 in a differentially private manner. That is, the system 100, at each of a plurality of iterations, updates a data set 102 using a differentially private update 114 created from an initial data set update 104, sampled noise 106, and a buffer state 108. Generally, the data set 102 can be any of a variety of types of data sets associated with any of a variety of domains and includes one or more values. The one or more values included in the data set are also referred to here as “data set values”), e.g., a data set that Attorney Docket No.45288-0454WO1 includes ^^ value can be said to include ^^ data set values. In some cases, the initial data set update 104 to the data set 102 contains sensitive information (i.e., contains data that must be kept secure). For example, the data set 102 can include one or more statistics (e.g. one or more numerical values obtained by medical measurement) of one or more medical patients in the context of medical research. As a particular example, a data set 102 can include a value of a statistic such as “average blood pressure of a control group” and an initial data set update 104 for that value can include an individual patient’s blood pressure reading. As another example, the data set 102 can include one or more analyses of populations of people in the context of public policy investigations. As a particular example, a data set 102 can include a value representing “the total income of households in a zip code” and an initial data set update 104 for that value can include a particular household’s income. As another example, the data set 102 can include one or more trainable parameters of a machine learning model in the context of training a machine learning model (via online learning, federated learning, or any other type of training for a machine learning model). As a particular example, a data set 102 can include a value representing “one weight of a deep neural network layer” and an initial data set update 104 for that value can include a scaled gradient of a loss function evaluated for an input that contains sensitive information with respect to the weight. In particular, to perform this streaming update in a computationally efficient manner, the system 100 initializes a buffer state 108 for updating the data set 102. The buffer state 108 includes, for each value in the data set 102, a respective value for each of a set of memory buffers. For example, the initial values in the buffer state may be set at random, or to a default value, such as zero. The state 108 is referred to as a “buffer” state because the values of the memory buffers are values that are maintained across iterations (i.e., updates). Generally, the number of memory buffers is less than and independent of the total number of iterations to be performed. At each of the plurality of iterations, the system 100 receives the initial data set update 104 for the iteration. The system 100 also obtains sampled noise 106 for the iteration, and the sampled noise 106 includes a respective noise value for each value in the data set 102. Attorney Docket No.45288-0454WO1 In some implementations, the system draws the sampled noise 106 from a parameterized probability distribution, such as a Gaussian distribution or Laplace distribution. For example, the system can draw sampled noise 106 from a Gaussian distribution with isotropic covariance. The system 100 then determines a differentially private update 114 to the data set 102 using the initial data set update 104 and the sampled noise 106. In particular, the system 100 updates the buffer state 108 (also called here an “update state”) to create an updated buffer state 110, which includes applying a first linear transformation to the sampled noise 106 and a second linear transformation to the update state 108. After updating the buffer state 108, the system 100 then determines a noise component of the differentially private update 112 from the updated buffer state 110 and the sampled noise 106 and combines the initial data set update 104 and the noise component 112 to generate the differentially private update 114 to the data set 102. Further details of determining a differentially private update to the data set 102 using the initial data set update 104 and the sampled noise 106 are described below. The system then applies the differentially private update 114 to the data set 102 to update the data set 102 and creates an updated data set 116 which is then the data set 102 for the next iteration (i.e., update). For example, the system 100 can sum the differentially private update 114 and the data set 102. As a particular example of this, the system 100 can perform an elementwise sum of the values of the data set 102 with the values of the differentially private update 114. As described above, this streaming updating can be used in any of a variety of domains. As one example, the streaming updating can be used to perform (differentially private) training of a machine learning model. In particular, for differentially private training of a machine learning model, each iteration is a training iteration performed during training of a machine learning model having a plurality of parameters, e.g., a neural network or other model, on an objective function. In this example, the data set 102 includes a respective value for each of the plurality of parameters and the initial data set update 104 includes a respective gradient value for each of the plurality of parameters generated by performing the training iteration. Thus, this streaming updating is used to update the parameters of the model during training while keeping any individual set of gradients differentially private. In other words, the parameters of the model during training (i.e., the data set 102) can be updated using transformed Attorney Docket No.45288-0454WO1 gradients (i.e., a differentially private update 114) such that the data representing sensitive information included in the original set of gradients (i.e., the initial data set update) cannot be deduced using the parameters of the model during training and the transformed gradients. The machine learning model can be configured to perform any of a variety of tasks. For example, the task can be speech recognition, hotword identification, or another speech processing task, such a task performed on a sound signal captured by a microphone from the real world. As another example, the task can be image classification (e.g. a determination, for a plurality of image classes, of a likelihood that pixelated intensity data in the image is in the class), object detection (e.g. a determination, for each of a plurality of object classes, of a likelihood that the image depicts an object in the class), or another computer vision task performed on an image (e.g. a still image or a video image), such as one captured by a camera from the real world. As yet another example, the task can be text generation task, a text prediction task, or another natural language processing task. For example, the machine learning model may be a multi-modal generative model operative to generate an output (e.g. text, but optionally additionally or alternatively including image(s) and / or audio data) by processing an input comprising an image (still or video image) and / or an audio signal (the image and / or the audio signal having been optionally captured from the real world) and optionally further comprising text. The machine learning model may operate auto-regressively, i.e. at each of a plurality of time steps processing an input to generate a corresponding output, such the input for each time step except the first comprises the output of the model at the previous time step(s). Additional details of what tasks the machine learning model can be configured to perform will be described below. FIG.2 is a flow diagram of an example process 200 for performing streaming updates of a data set in a differentially private manner. For convenience, the process 200 will be described as being performed by a system of one or more computers located in one or more locations. For example, a computer system, e.g., the secure data set update system 100 of FIG.1, appropriately programmed in accordance with this specification, can perform the process 100. The process is performed on a data set (e.g. corresponding to the data set 102 of Fig.1), which is updated in one or more iterations, which may be labelled by an index k. Each iteration produces a new updated data set (e.g. the updated data set 116 of Fig.1). In the first iteration, an initial realization of the data set 102 (“the starting data set”) is updated to be an updated data set 116, based on a corresponding differentially private update (e.g. the differentially private update 114) generated in the iteration. In each iteration Attorney Docket No.45288-0454WO1 except the first iteration, the data set 102 is replaced by the updated data set 116 generated in the previous iteration, and the iteration updates the updated data set 116 generated during the preceding iteration, based on a corresponding differentially private update generated in the iteration (e.g. the differentially private update 114 of Fig.1). The system initializes a buffer state for updating the data set, where the buffer state includes, for each value in the data set, a respective value for each of a set of memory buffers (step 202). There may be plural respective memory buffers for each value in the data set. As described above, the buffer state persists across the plurality of iterations the system executes to perform streaming updating of the data set, and the number of memory buffers associated with each value of the data set can be far fewer than the total number of iterations to be performed. For example, the system can include 1, 2, 5, or 7 memory buffers for each value in a data set, while the number of iterations can be 10, 100, 10,000, or 1,000,000. In some implementations, the total number of memory buffers is less than a total number of iterations in the plurality of iterations. For example, the system can include ^^ memory buffers for each value in a data set of ^^ values, while the number of iterations canbe ^^ such that ^^ ⋅ ^^ ≪ ^^ . When the total number of memory buffers is much less than thenumber of iterations, the computational memory usage of the system is efficient, which makes the system advantageous over other others for updating a data set with differentially private updates. In some implementations, the system initializes the buffer state by setting each value in the buffer state to zero. For example, the system can allocate memory by reserving memory in RAM, assigning a memory address for each value, and initialize the values stored at the memory addresses to zero. In some implementations, the system stores a buffer state for updating the data set in a plurality of registers (e.g., CPU registers). For example, a CPU executing a program may have recently accessed one or more values of the buffer state onto CPU registers for the logical processing unit to operate on. At each of plurality of iterations, the system performs steps 204-210. The system receives an initial data set update for the iteration (step 204). The system can receive an initial data set update from any of a variety of sources including a user or another system. For example, the system can receive an initial data set Attorney Docket No.45288-0454WO1 update over a network connection, e.g., a cloud-based network, the internet, or a local network. That is, the system can receive an initial data set update as a result of a user- initiated action (e.g., receiving a user upload of an initial data set update), another system- initiated action (e.g., receiving real-time data, or receiving periodically scheduled data according to real-time conditions or other conditions). The system obtains sampled noise for the iteration, where the sampled noise includes a respective noise value for each value in the data set (step 206). As described above, the system can sample noise from a probability distribution, and the probability distribution can be a parameterized probability distribution, e.g., a Gaussian, Laplace, Poisson, or another distribution. In some implementations, the system determines the parameterization of the probability distribution that the noise is sampled from using a privacy budget ^ and a probability of δ provided by a user or another system. For example, as described in arXiv:2404.16706, for the case of continual counting (i.e., a data set that contains running sums of incremental values which represent initial data set updates), to ensure each incremental value update is (ε, δ)-differentially private, noise can be sampled from a Gaussian distribution N(0, ^^ଶI), where the standard deviation ^^ is determined in part by ^^, and where ^^ = ^^^^ఢ^^^^^^^^1 / ^^^^ is a noise multiplier depending only on the privacy parameters (ε, The system determines a update to the data set using the initial data set update and the sampled noise (step 208). That is, the system generally determines a differentially private update to the data set by combining the initial data set update and sampled noise (which, in some cases, can be calibrated according to (ε, δ)-differential privacy settings) to ensure any individual initial data set update remains private (i.e., the data representing sensitive information included in the initial data cannot be deduced). Further details of determining a differentially private update to the data set using the initial data set update and the sampled noise are described below with reference to FIG.3 The system applies the differentially private update to the data set to update the data set (step 210). In some cases, as described above, the system applies the differentially private update to the data set by summing the differentially private update and the data set. For example, if the data set is the list of values [3, 5, 10] and the differentially private update for each value is the list [2, 6, 3], then the system applying the differentially Attorney Docket No.45288-0454WO1 private update to the data set by summing the differentially private update and the data set results in [5, 11, 13], i.e., [3+2, 5+6, 10+3]. As described above, process 200 for performing streaming updates of a data set in a differentially private manner can be used in the context of training of a machine learning model. That is, each iteration for process 200 can be a training iteration performed during training of a machine learning model having a plurality of parameters on an objective function, where the data set includes a respective value for each of the plurality of parameters, and the initial data set update includes a respective gradient value for each of the plurality of parameters generated by performing the training iteration. When process 200 is used for training a machine learning model, in some cases, in addition to the system applying the differentially private update to the data set by summing the differentially private update and the data set, the system also applies a learning rate for the iteration to the sum (e.g. multiplies the differentially private update by the learning rate before forming the sum with the data set). More generally, to handle more complex updates, the system can apply an optimizer (i.e., an algorithm used to update model parameters) that receives the data set of model parameters and the differentially private update of parameter gradients to generate the updated the data set. For example, process 200 can be applied as a stochastic gradient descent update with constant learning rate. As a particular example the process 200 can be applied as part of a differentially private follow-the-regularized-leader (DP-FTRL) optimization algorithm, i.e., ௧ି^ DP-FTRL:^^^ ௧← ^^^ െ ^^^^∇^^^^^^^^ ^ ^^^ ^ where ^^^is the data set set), the iterations run from k=0 to t-1 (thus, t , in each iteration k is denoted ^^^, each loss function ^^^is an optimization loss, dependent on ^^^, and generated from a disjoint minibatch of data samples used in an iteration k, η is the learning rate, the initial data set update in the k-iteration is ∇^^^^^^^^, the noise component of the differentially ^ private update in iteration k is ^^^which ensures that the computation of the sequence of {^^^}’s are differentially private, and ^^௧is the final data set. In some cases, the system performs streaming updates in parallel. That is, the system can receive initial updates from more than one source simultaneously. In some of these cases, updating the dataset is an atomic operation, e.g., occurs in one cycle of the CPU (central processing unit) of the computer system so that no other process or thread during Attorney Docket No.45288-0454WO1 parallel processing can corrupt the writing to memory that is responsible for updating the dataset values. FIG.3 is a flow diagram of an example process 300 for determining a differentially private update to the data set using an initial data set update and sampled noise. For convenience, the process 300 will be described as being performed by a system of one or more computers located in one or more locations. For example, a computer system, e.g., the secure data set update system 100 of FIG.1, appropriately programmed in accordance with this specification, can perform the process 100. The system updates the buffer state by applying a first linear transformation to the sampled noise and a second linear transformation to the update state (step 302). Generally, the system maintains data representing the buffer state (update state) and updates the maintained data when updating the buffer state. For example, in some cases, the system updates the buffer state by updating or overwriting the memory location of the buffer state stored in RAM (random access memory) so that the updated buffer state replaces the previous buffer state in its allocated memory address. As described above, the sampled noise includes a respective noise value for each value in the data set and can be drawn from a parameterized distribution. Generally, the sampled noise is sampled for the differentially private update during the iteration. In some implementations, the system applies the first linear transformation to the sampled noise by multiplying a column vector having a respective value for each of the memory buffers with a row vector of the sampled noise to generate a first matrix having a same dimensionality as a matrix containing the update state. For example, the system can multiply a column vector ^^ ∈ ℝௗൈ^ having a respectivevalue for each of the memory buffers (i.e., the column vector ^^ has ^^ entries, one for eachmemory buffer) with a row vector of the sampled noise ^^ ^ൈ^^,⋅ ∈ ℝ (where ^^ is theiteration index and there are ^^ data set values) to generate a first matrix ^^^^ ௗൈ^^ ∈ ℝhaving a same dimensionality as a matrix containing the update state. Generally, the system maintains data necessary to perform the first linear transformation. For example, the system can maintain the coefficients associated with the first linear transformation, e.g., the coefficients of the column vector described above. The data necessary to perform the first linear transformation can be determined by the system, provided by a user, or provided by another system. For example, as will be described in Attorney Docket No.45288-0454WO1 further detail below with reference to FIG.4, the system can perform an optimization of the coefficients of the first linear transformation to determine the values of the coefficients. In some implementations, the system further applies a second linear transformation to the update state by multiplying a matrix having a number of rows equal to the number of memory buffers and a number of columns equal to the number of memory buffers with the matrix containing the update state to generate a third matrix having the same dimensionality as the matrix containing the update state. For example, the system can multiply a matrix ^^ ∈ ℝௗൈௗ with the matrix ^^^ ∈ℝௗൈ^ containing the update state to generate a third matrix ^^ ⋅ ^^^ ∈ ℝௗൈ^ , where ^^ is theiteration index, ^^ is the number of memory buffers, ^^^is the update state, and ^^ is the matrix with a number of rows and columns equal to the number of memory buffers. Generally, the system maintains data necessary to perform the second linear transformation. For example, the system can maintain the coefficients associated with the second linear transformation, e.g., the coefficients of the ^^ matrix described above. The data necessary to perform the second linear transformation can be determined by the system, provided by a user, or provided by another system. For example, as will be described in further detail below with reference to FIG.4, the system can perform an optimization of the coefficients of the second linear transformation to determine the values of the coefficients. In some cases, to update the buffer state the system sums an output of the first linear transformation and an output of the second linear transformation. For example, considering the previous examples of the output of the first lineartransformation ^^^^^ and the output of the second linear transformation ^^ ⋅ ^^^, then thesystem can sum these outputs as ^^^ା^ ൌ ^^^^^,⋅ ^ ^^ ⋅ ^^^ ∈ ℝௗൈ^, where ^^^ା^ is the updatedbuffer state and ^^^is the update state. When the system determines the next differentially private update to the data set for the next iteration, ^^^ା^will be the update state used to generate the updated buffer state ^^^ାଶ. Because updating the buffer state includes applying a first linear transformation to the sampled noise and a second linear transformation to the update state, updating the buffer state only requires storing the coefficients for the transformations and the buffer state. Additionally, when the number of data set values is much larger than the number of memory buffers, the memory requirements is dominated by the storage of the buffer state rather than the coefficients for the linear transformations. Since the storage of the buffer state is invariant to the number of iterations of differentially private updates the system performs, Attorney Docket No.45288-0454WO1 the computational memory usage of the system is very efficient for updating the buffer state and constant with respect to the number of iterations the system performs. After updating the buffer state, the system determines a noise component of the differentially private update from the buffer state and the sampled noise (step 304). In some implementations, the system determines the noise component of the differentially private update from the buffer state and the sampled noise by applying a third linear transformation to the sampled noise, a fourth linear transformation to the buffer state and summing an output of the third linear transformation and an output of the fourth linear transformation. As an example of a third linear transformation to the sampled noise that the system can apply, the third linear transformation can be multiplying the vector of the sampled noisewith a scalar value. For example, the system can multiply the sampled noise ^^ ^ൈ^^,⋅ ∈ ℝ bythe scalar ^^, i.e., ^^^^^,⋅, where ^^ is the iteration index and there are ^^ data values. Note that t has a different meaning here from in the equation above, where it denotes the number of iterations. As an example of a fourth linear transformation to the buffer state that the system can apply, the fourth linear transformation can be multiplying a row vector having a respective value for each memory buffer with a matrix containing the update state after being updated to generate a vector having a same dimensionality as the vector of thesampled noise. For example, the system can multiply a row vector ^^் ∈ ℝ^ൈௗ withrespective value for each of ^^ memory buffers with a matrix ^^ ௗൈ^^ା^ ∈ ℝ containing theupdate state after being updated to generate a vector ^^்^^ ^ൈ^^ା^ ∈ ℝ having a samedimensionality as the vector of the sampled noise (i.e., ^^ data set values and therefore m sampled noise values). Generally, the system maintains data necessary to perform the third and fourth linear transformation. For example, the system can maintain the scalar value of ^^ associated with the third linear transformation and the coefficients of ^^்described above. The data necessary to perform the third linear transformation can be determined by the system, provided by a user, or provided by another system. For example, as will be described in further detail below with reference to FIG.4, the system can perform an optimization of the coefficients of the third and fourth linear transformations to determine the values of the coefficients. Attorney Docket No.45288-0454WO1 As an example of summing the output of the third and fourth linear transformations, the system can sum the above example third linear transformation output ^^^^^,⋅and fourthlinear transformation output ^^்^^ ் ^ൈ^^ା^, i.e., ^^^^^,⋅ ^ ^^ ^^^ା^ ∈ ℝ .Because determining the noise component of the differentially private update includes applying a third linear transformation to the sampled noise and a fourth linear transformation to the update state, the system only requires storing the coefficients for the transformations and the buffer state. Additionally, as was the case for step 302, the memory requirements for step 304 are dominated by the storage of the buffer state and are constant with respect to the number of iterations the system performs. Therefore, for both step 302 and step 304, the computational memory usage of the system is very efficient and constant with respect to the number of iterations the system performs. In some implementations, the noise component of step 304 approximates a product between a lower-triangular matrix and a matrix of the sampled noise at the iteration and ^ each preceding iteration. For example, if the noise component ^^^,⋅is defined using the ் ^ above example third and fourth linear transformation outputs ^^^^^,⋅and ^^ ^^^ା^, i.e., ^^^,⋅ൌ ் ^^^^^^,⋅ ^ ^^ ^^^ା^ ∈ ℝ^ൈ^ , then ^^ ^,⋅can approximate the product between the lower- triangular matrix ^^ and a matrix ^^ of the sampled noise at the iteration and each preceding ^ iteration. That is ^^^,⋅ ^ ^^^^^^^,⋅, where each row of ^^ is the sampled noise of an iteration.Further in some implementations, each entry in the lower-triangular matrix is defined by a generating function. For example, a lower-triangular matrix B can be defined as ^^^,^ ൌ ^^^ି^ such that theterms ^^ are of a generating function defined by the Taylor approximation of ^ √^ି௫i.e., ^^^^^^ ൌ ^√^ି௫ൌ ^^ ଶ ଷ^ ^ ^^^^^ ^ ^^ଶ^^ ^ ^^ଷ^^ ^ ⋯.^^ is a first matrix in a matrix matrix that has dimensionality ^^ ൈ ^^,where n is a total number of iterations in the plurality of iterations. That is, the matrix ^^ isdefined by ^^^^ ൌ ^^, where ^^ is the ^^ ൈ ^^ lower-triangular all-ones matrix and B and C arealso ^^ ൈ ^^ matrices.For example, the lower-triangular ^^ ൈ ^^ matrix ^^ can be the result of the lowertriangular Toeplitz factorization of Fichtenberger, Henzinger, and Upadhyay (i.e., FHUfactorization as described in arXiv:2202.11205). That is, ^^ can be defined as ^^^^ ൌ ^^ and Attorney Docket No.45288-0454WO1^^ ൌ ^^ ൌ ^^^ି^ , where A is a lower triangular ^^ ൈ ^^ matrix of all-ones matrix and are defined by terms of a Taylor series approximation of ^^√^ି௫, i.e., ^^^^^^ ൌ√^ି௫ൌ ^^^ ^ ^^^^^ ^^^ଶ^^ଶ ^ ^^ଷ^^ଷ ^ ⋯.If the noise component of the differentially private update of step 304 approximates a product between a lower-triangular matrix B that is the result of FHU factorization (as described above) and a matrix of the sampled noise at the iteration and each preceding iteration, then combining this noise component approximation with the initial data set update (i.e., step 306 described below) to update a dataset will result in generating an updated data set that has a near theoretical optimal upper bound of root mean error relative to an updated data set that is instead updated using an initial data set update. In some cases, when the noise component approximates a product between a lower- triangular matrix whose entries are defined by a generating function and a matrix of the sampled noise at the iteration and each preceding iteration, the coefficients in the first, second, third, and fourth linear transformations are dependent on the generating function. For example, if the generating function is ^^^^^^ ൌ ^^^ ^ ^^^^^ ^ ^^ଶ^^ଶ ^ ^^ଷ^^ଷ ^ ⋯ thenthe representation of the sequence ^^^ ^^ can be in t ் ^^ ^ୀ^ erms of matrix powers ^^^ ൌ ^^ ^^ ^^ ^^^^^^^^ ൌ 0^ where ^^ is the indicator function, and ^^ refers to the iteration index and the powerof the matrix ^^, which in turn can define the coefficients in the first, second, third, and fourth linear transformation, e.g., the coefficients of ^^், ^^^, ^^, and ^^ described above. Such a matrix power expression is a closed form expression for the terms of the sequence that only requires storing the coefficients, e.g., the coefficients of ^^், ^^^, ^^, and ^^ described above. In some implementations, the generating function ^^^^^^ ൌ ^^ ^ ଶ ଷ^ ^^^^^ ^ ^^ଶ^^ ^ ^^ଷ^^ ^⋯ approximates a function of the form ^^√1 െ ^^, where a is a constant and x is an input tothe function. For example, the system can determine a generating function for a rational approximation (i.e., a rational function of degree d, i.e., a ratio of polynomials each ofdegree d or less) to the function ^^^^^^ ൌ 1 / √1 െ ^^ . The polynomials can be chosen usingstandard results from rational function approximation theory, or for better results, the coefficients of the polynomials can be directly optimized to minimize loss for a specific number of iterations. If the coefficients in the first, second, third, and fourth linear transformations aredependent on a generating function that is an approximation to 1 / √1 െ ^^ and are used to Attorney Docket No.45288-0454WO1 approximate the noise component of step 304 that approximates a product between a lower- triangular FHU factorized matrix B and a matrix of the sampled noise Z at the iteration and each preceding iteration, then computing the noise component of the differentially private update of step 304 has the advantage of not requiring the storage of sampled noise ofprevious iterations or storing a matrix B with ^^ ൈ ^^ dimensions for ^^ iterations, savingcomputational memory and simultaneously achieving near optimal utility for the differentially private update. In some cases, the system performs an optimization to determine parameters that define the generating function. Further details of performing an optimization to determine parameters that define the generating function are described below with reference to FIG.4. An example technique for determining the noise component of the differentially private update from the buffer state and the sampled noise that includes aspects of steps 302-304 is shown in Table 1. Table 1 In particular, ^^^^^, ^^^ is a lower triangular Toeplitz factorization matrix ofdimensions n by ^^ for rational function ^^; ^^ is the number of memory buffers; the column vector ^^ and matrix ^^ belong to the first linear transformation (e.g., as described above), the column vector ^^ and scalar ^^ belong to the second linear transformation (e.g., asdescribed above); there are ^^ data set values, and ^^ െ 1 iterations indexed as ^^; thesampled noise per iteration is denoted as ^^^, which is a row of the matrix ^^, and the noisecomponent of the differentially private update is denoted as ^^^^; for iteration ^^ the updatedbuffer state is denotes as ^^^ା^and the update state is ^^^. Note that for the example technique of Table 1, the differentially private update ^^^^approximates a product between a lower-triangular matrix ^^^^^,^^^ and a matrix of the sampled noise at the iteration and each preceding iteration ^^. Attorney Docket No.45288-0454WO1 Another example technique for determining the noise component of the differentially private update from the buffer state and the sampled noise that includes aspects of steps 302-304 is shown in Table 2. Table 2 In particular, the index ℓ and differentiatesterms such as ^^ℓ െ 1 and ^^ℓି^ െ 1; the term to a copy of algorithm 1 asdescribed in Table 1 above where ℓ indicates the recursion depth index; the item“Recursion ℓ ↦ ℓ െ 1” signifies instantiating a copy of algorithm 2 with decrement of therecursion noise per is denoted as ^^^ᇱℓି^; the noise component ~ of the differentially private update is denoted as the row vector ^^^ℓି^for ^^ data set values, defined by the lower case ^^ terms that are ‘intermediate noise components of the ~ differentially private update’; and ^^ approximates a product between a matrix ^^ℓand a ~ matrix of the sampled noise ^^ at the iteration and each preceding iteration, i.e., ^^ൌ ^^^ℓ ⋅^^^ ∈ ℝ^ℓൈ^.The described techniques of algorithm 1 of Table 1 above and algorithm 2 of Table 2 both require memory that scales with the number of memory buffers ^^, providing a memory requirement scaling advantage over conventional techniques that require memory the iteration count. Attorney Docket No.45288-0454WO1 The system combines the initial data set update and the noise component to generate the differentially private update to the data set (step 306). In some cases, the system combines the initial data set update and the noise component to generate the differentially private update to the data set by summing the initial data set update and the noise component. For example, if the initial data set update is the list of values [4, 6, 11] and the noise component for each value is the list [3, 7, 4], then the system summing the initial data set update and the noise component results in [7, 13, 15], i.e., [4+3, 6+7, 11+4]. In some cases, the system performs the process for determining a differentially private update to the data set using an initial data set update and sampled noise in parallel. For example, the system can perform the linear transformation described above using hardware, software, or both. For example, the system can use hardware parallelism such as multiple CPUs, one or more GPUs, TPUs, or ASICs to perform scalar, vector, or matrix addition and multiplication. As another example, the system can use software parallelism through software frameworks such as CUDA for GPUs, OpenMP for multi- threading CPUs or Open MPI for multiple CPUS to perform scalar, vector, or matrix addition and multiplication. FIG.4 is a flow diagram of an example process 400 for performing an optimization to determine parameters that define the generating function. For convenience, the process 400 will be described as being performed by a system of one or more computers located in one or more locations. For example, a computer system, e.g., the secure data set update system 100 of FIG.1, appropriately programmed in accordance with this specification, can perform the process 100. Prior to performing streaming updates, the system can parameterize a generating function and determine the parameter values through an optimization process. As described above, in some cases, the coefficients of the first, second, third, and fourth linear transformations are dependent on the generating function. For such cases, parameterizing the generating function defines the coefficients associated with linear transformations, and optimizing the coefficients of the linear transformation is equivalent to optimizing the parameters of the generating function. The system can optimize the coefficients associated with linear transformations (and therefore optimize the parameters of the generating function) by minimizing the error differentially private updates would introduce to the final data set. That is, by minimizing the expected error to the final data set determined using ^^ differentially private updates (i.e., Attorney Docket No.45288-0454WO1 ^^ iterations) that each use the first, second, third, and fourth linear transformations, the system can determine the coefficients associated with the first, second, third, and fourth linear transformations (and in turn determine the parameters that define the generating function). For example, the system can represent the terms of the sequence ^^^^^^^ୀ^of agenerating function ^^^^^^ ൌ 1 ^ ^^^∑ ௗି^ఠ^^ୀ^^ିఏ^௫^ of degree ^^ with optimizable parameters ω^and θ as terms of ் ^^ matrix powers ^^^ ൌ ^^ ^^ ^^ ^ ^^^^^^^ ൌ 0^, i.e.,^^^ 0 0 0^^^ / ^^^^^ ൌ ^^^^^^^ ൌ 0 ^^^ 0 ⋮^^^ ^^^ / ^^^^ ⋮ 0 ⋱ 0^, ⋮ ⋮ 10 0 … ^^ௗି^^^ௗି^ / ^^ௗି^where ^^ ൌanobjective updates would the final data set using these parameters ^^^^^ and ^^^^^ (i.e., the coefficients of the linear transformations) and iteratively update the parameters to minimize the expected error represented by the objective function. In particular, to begin optimizing the coefficients of the linear transformations, the system initializes the parameters (step 402). That is, the system sets the initial values of the parameters before beginning the process of iteratively updating those values. For example, the system can set the initial values of the parameters to be random values, the optimized coefficients of a previous optimization, or as values chosen by a user or another system. The system evaluates an objective function using the parameters (step 404). The objective function represents a metric for evaluating the quality of the parameters. Generally, minimizing the objective function represents the goal that the system is trying to achieve by optimizing the parameters. For example, as described above, the objective function can be the expected error ^^ iterative differentially private updates will introduce to the final data set. For this example objective function, the system’s goal is to updates the parameters to minimize this error. In some cases, the system includes regularization terms in the objective function to improve optimization of the coefficients. Attorney Docket No.45288-0454WO1 For example, the system can include a barrier function ℓ^^^,^^^ ൌ 10ି^ ∑ ^∈^ௗ^ െlog ^^^^^ െ log ^^^^^ in the objective function to make optimization of parameters ^^^ and ^^^more stable by ensuring these parameters remain strictly positive. The system updates the parameters to optimize the objective function (step 406). The system can update the parameters to optimize the objective in any variety of ways, e.g., gradient based method, evolutionary algorithm-based method, etc. For example, the system can optimize the objective function by minimizing its value using any of a variety of gradient descent techniques that include the use of a backpropagation technique to estimate the gradient of the objective with respect to the parameters and to update the parameters accordingly. As another example, the system can optimize the objective function by minimizing its value using a second order derivative information. For example, the system can use the “Limited-memory Broyden-Fletcher-Goldfarb-Shannon” (L-BFGS) algorithm to update the parameters. In some cases, the system uses software libraries to perform automatic differentiation to determine first and higher order derivatives (e.g., gradient and Hessian matrix) of the objective function with respect to the parameters. For example, the system can use the JAX software package (as described by http: / / github.com / jax-ml / jax) to compute the gradient with respect to the parameters of an objective function that is a set composable transformation of Python / NumPy functions. Generally, the system repeats the above steps (404-406) until one or more criteria are satisfied (e.g., the system performs a pre-determined number of iterations, the updates to the parameters no longer exceed a pre-determined magnitude of change, and so on). FIG.5 is an example 500 of the performance of the described techniques. More specifically, example 500 shows the performance of the described techniques’ determination of differential privacy updates relative to the optimal differential privacy updates using the metric of “relative error” introduced to the final dataset as the y-axis. The term “relative error” refers to how much additional error is introduced relative to the lowest possible error. In particular, example 500 shows the performance of the described techniques, the points labeled as method “Opt-BLT” and method “RA-BLT” represent the described techniques, with “Opt-BLT” including the aspects for performing an optimization of coefficients for linear transformations (e.g., as described above with reference to FIG.4) Attorney Docket No.45288-0454WO1 and “RA-BLT” not including these particular aspects. Instead, “RA-BLT” determines the coefficients for the linear transformations through an explicit analytical approach. The described techniques are evaluated using relative error across various values of steps “^^” (i.e., number of iterative differentially private updates) and degree “^^” (i.e., the number of memory buffers used for the buffer state) compared to the optimal error of differentially private updates, i.e., the line at relative error = 1x labeled as “FHU22”. Example 500 shows that the relative error of “Opt-BLT” (where each point along the x-axis for the same degree represents an optimization for the number of steps ^^ corresponding to the specific point)decreases as ^^ and ^^ increase, and at ^^ ൌ 5 and ^^ ൌ 10^7 the relative error is less than 1%of the optimal error. Example 500 also shows that the relative error of “RA-BLT” (where each point along the x-axis for the same degree utilizes the same linear transformation parameters) decreases as ^^ increases. Because “Opt-BLT” outperform “RA-BLT” in example 500 for the same degree values and for cases in which the degree of “Opt-BLT” is less than the degree of “RA-BLT”, the features included in “Opt-BLT” that are not in “RA- BLT”, i.e., performing an optimization of coefficients for linear transformations (e.g., as described above with reference to FIG.4), are responsible for a significant performance gain. Such trends are significant because they demonstrate that the relative error using the described techniques can be made arbitrarily close to the optimal value by increasing ^^ and / or ^^, while only requiring memory that scales with ^^ as ^^^^^^ଶ^^^^instead of ^^, as the conventional technique that results in optimal error requires. Consequently, due to the memory efficiency of the described techniques, the described techniques can perform ^^ differentially private updates for values of n well beyond what is possible with the conventional technique. FIG.6 is an example 600 of the performance of the described techniques. More specifically, example 600 shows the performance of the described techniques’ determination of differential privacy updates (labeled as “Opt-BLT d=4”) relative to a class of optimal differential privacy updates (labeled as “Optimal Toeplitz”), the hypotheticaloptimal differential privacy updates (labeled as “1 ^ ^^^^^^^^^^ / π”), and various otherbenchmarks using the metric of “Max Error” (i.e., the maximum root mean squared error of the i-th data set update) and “Max Errror – Optimal Toeplitz” (i.e., the difference of maximum root mean squared error of the ith data set update relative to an error associated using the Optimal Toeplitz to generate the differentially private update to update the data set). Attorney Docket No.45288-0454WO1 In particular, example 600 plots the performance of the various techniques over a range of differentially private update iteration counts (i.e., n = 1 to n = 106iterations). Example 600 shows that the described techniques (i.e., “Opt-BLT d=4”) on par with variousoptimal utility techniques (i.e., “Optimal Toeplitz” and “1 ^ ^^^^^^^^^^ / π”). In fact, thedescribe techniques essentially match the performance of “Optimal Toeplitz” , while requiring time and memory complexity of O(1) instead of O(n). As described above, in some cases, the described techniques can be used to train a machine learning model through streaming updating to perform (differentially private) training of the machine learning model. Some examples of machine learning tasks that the machine learning model can be configured to perform now follow. For instance, the machine learning model may be a generative neural network configured to process a conditioning input (“input prompt”) to generate a data item. Generally the data item represents a response to the conditioning input which may be, e.g., a “prompt” for the generative neural network. For example the conditioning input can characterize one or more desired properties for the generated data item. As one example the task may include an object or action detection task. For example the generated data item may comprise or represent text that describes or otherwise labels detected object(s) or action(s) in a conditioning input comprising an image or audio, and may include coordinates such as bounding-box coordinates for the detected object(s) or action(s), e.g., "102090100 cat 2030100100 dog”. As another example the task may comprise a classification task, e.g., an object or action classification task. The generated data item may comprise data, e.g., text, that classifies the object(s) or action(s) in represented in the conditioning data, e.g., in an image or audio, into one of a plurality of classes, or that otherwise classify object(s) or action(s) represented in the conditioning data. As another example the task may comprise a still or moving image describing task, e.g., a captioning task (which, as used here, includes an audio description task to explain what is happening in an image). The generated data item may comprise data, e.g., text, describing an image or video in the conditioning data. For example the generated data item may provide a caption or description or it may count objects in the image or video, or it may provide some other form of description. As another example the task may comprise a still or moving image question- answering task. The generated data item may comprise data, e.g., text, that answers a question about the conditioning input, e.g., an image or audio, where the question is also Attorney Docket No.45288-0454WO1 specified in the conditioning input, e.g., as sequence of text. This may be used, e.g., to answer questions about visual plots and charts or about sounds. As another example the task may comprise a character or word recognition task, e.g., an OCR (optical character recognition) task. The conditioning input may comprise a still or moving image and the generated data item may comprise text that represents characters or words in the conditioning input, e.g., in a natural language. As another example the task may comprise a still or moving image generation task. The generated data item may comprise image data defining values for pixels of a still or moving image, and the conditioning input, e.g., a sequence of text, may describe or characterize the image to be generated. Merely as an example, an image of a plot or chart may be generated to represent the conditioning input, e.g., comprising text. As another example the task may comprise a computer language text generation task. The conditioning data may comprise a natural language description of a task to be performed, and optionally an image (if the task is to be performed on or in relation to an image), and the generated data item may comprise text in a computer language to perform the task, e.g., a task of analyzing the content of the image to provide a result of the analysis or to search for information relating to the content of the image. As a particular example the computer language in the generated data item may comprise computer language for invoking a function or calling one or more external APIs. Merely as one example, such a data item may comprise data formatted as a JSON object. As previously, the conditioning input may define the task to be performed and may also include an image in relation to which the task is to be performed. In general the task can involves manipulation of particular types of data that may benefit from access to an API such as mathematical data, date / time related data, scientific data, recent data that may post- date training of the system (that may be accessed by a search function or API), and so forth; and the generated data item may comprise text in a computer language for performing the task. The method may then include using the text in the computer language to perform the task. In general where the generated data item comprises text this may be converted to speech representing the text, and an audio (speech) output provided. In some implementations the task comprises an agent control task in which the agent interacts with an environment to perform the agent control task. In these implementations the conditioning input can include an observation characterizing the environment. For example the conditioning input can include a sequence of text that defines the task to be Attorney Docket No.45288-0454WO1 performed by the agent and the image can represent an observation of the environment, e.g., captured by a camera or other imaging device from a real-world environment. The generated data item can comprise an action selection output, e.g., including text, that is used to select one or more actions to be performed by the agent in the environment in response to the observation. As an illustration the generated data item may define an action as text such as “A: 132114128525156”, that can be converted into a control signal for a mechanicalagent, such as a robot, e.g., “Δ^^ ൌ ^0.1,െ0.2,0^ Δ^^ ൌ ^10^, 25^,െ7^^”. The actionselection output may also or instead define one or more low-level skills, e.g., from a vocabulary of previously learnt skills. As before, the sequence of text in the conditioning input to the system may describe the task to be performed, e.g., “What action should the robot take to [perform task]”. Examples of systems for controlling an agent that may be fine tuned as described herein can include PaLM-E (Driess et al. arXiv:2303.03378), RT-1 (Brohan et al. arXiv:2212.06817), and RT-2 (Brohan et al. arXiv:2307.15818). In some agent control implementations, the environment is a real-world environment and the agent is a mechanical agent interacting with the real-world environment, e.g., a robot or an autonomous or semi-autonomous land, air, or sea vehicle operating in or navigating through the environment, and the actions are actions taken by the mechanical agent in the real-world environment to perform the task. For example, the agent may be a robot or other mechanical agent interacting with the environment to accomplish a specific task, e.g., to locate or manipulate an object of interest in the environment or to move an object of interest to a specified location in the environment or to navigate to a specified destination in the environment. In these implementations, the observations may include, e.g., one or more of: images, object position data, and sensor data to capture observations as the agent interacts with the environment. The actions may define control signals to control the robot or other mechanical agent, e.g., positions, torques, or other control signals for the parts of the mechanical agent, or higher-level control commands. In some agent control implementations the agent may be a human agent and the environment may be a real-world environment. For example the agent can be a human user of a digital assistant such as a smart speaker, smart display, or some other device that is used to instruct the user to perform actions. The task may be any real-world task that the user wishes to perform. The observations may be obtained from an observation capture subsystem, e.g., a monitoring system such as a video camera or sound capture system, to capture visual observations of the user performing the task. The actions may comprise Attorney Docket No.45288-0454WO1 instructions in the form of, e.g., text, image, video, or audio data such as speech, that guide the user in performing the task. In some cases, the machine learning model may not be a generative neural network but instead be, for instance, a neural network or neural network system configured to perform one or more tasks that do not require generating a data item. Some examples of such tasks follow. The neural network system can perform any kind of machine learning task, i.e., can be configured to receive any kind of digital data input and to generate any kind of score, classification, or regression output based on the input. In some cases, the neural network system is configured to perform an image processing task, i.e., receive an input image and to process the input image, i.e., to process intensity values of the pixels of the image, to generate a network output for the input image. For example, the task may be image classification and the output generated by the neural network for a given image may be scores for each of a set of object categories, with each score representing an estimated likelihood that the image contains an image of an object belonging to the category. As another example, the task can be image embedding generation and the output generated by the neural network can be a numeric embedding of the input image. As yet another example, the task can be object detection and the output generated by the neural network can identify locations in the input image at which particular types of objects are depicted. As yet another example, the task can be image segmentation and the output generated by the neural network can assign each pixel of the input image to a category from a set of categories. As another example, the task can be a depth prediction task. In a depth prediction task, the output generated by the neural network identifies, for each pixel in the image, a predicted depth of the scene at the pixel. As yet another example, the task can be a surface normal prediction task. In a surface normal prediction task, the output generated by the neural network identifies, for each pixel in the image, a predicted surface normal of the scene at the pixel. As another example, the neural network can be configured to perform a video processing task, where the neural network receives a video that includes a sequence of input images and processes the input images, i.e., process the intensity values of the pixels of the images, to generate a network output for the video. For example, the network output can be a classification output that includes a respective score for each of multiple categories, where the categories represent, e.g., topics of the video, object categories, or action categories that each correspond to possible actions that may be being performed by entities in the video, Attorney Docket No.45288-0454WO1 and each score represents an estimated likelihood that the video belongs to the category. As another example, the network output can identify optical flow between pixels of the images in the video. As another example, the network output can be one or more predicted images that are predicted to follow the last image in the sequence. As another example, if the inputs to the neural network system are Internet resources (e.g., web pages), documents, or portions of documents or features extracted from Internet resources, documents, or portions of documents, the task can be to classify the resource or document, i.e., the output generated by the neural network system for a given Internet resource, document, or portion of a document may be a score for each of a set of topics, with each score representing an estimated likelihood that the Internet resource, document, or document portion is about the topic. As another example, if the inputs to the neural network system are features of an impression context for a particular advertisement, the output generated by the neural network system may be a score that represents an estimated likelihood that the particular advertisement will be clicked on. As another example, if the inputs to the neural network system are features of a personalized recommendation for a user, e.g., features characterizing the context for the recommendation, e.g., features characterizing previous actions taken by the user, the output generated by the neural network system may be a score for each of a set of content items, with each score representing an estimated likelihood that the user will respond favorably to being recommended the content item. As one example, the task may be a neural machine translation task. For example, if the input to the neural network system is a sequence of text, e.g., a sequence of words, phrases, characters, or word pieces, in one language, the output generated by the neural network system may be a translation of the sequence of text into another language, i.e., a sequence of text in the other language that is a translation of the input sequence of text. As a particular example, the task may be a multi-lingual machine translation task, where a single neural network is configured to translate between multiple different source language – target language pairs. In this example, the source language text may be augmented with an identifier that indicates the target language into which the neural network system should translate the source language text. As another example, the task may be an audio processing task. For example, if the input to the neural network system is a sequence representing a spoken utterance, e.g., a spectrogram or a waveform or features of the spectrogram or waveform, the output Attorney Docket No.45288-0454WO1 generated by the neural network system may be a piece of text that is a transcript for the utterance. As another example, if the input to the neural network system is a sequence representing a spoken utterance, the output generated by the neural network system can indicate whether a particular word or phrase (“hotword”) was spoken in the utterance. As another example, if the input to the neural network system is a sequence representing a spoken utterance, the output generated by the neural network system can identify the natural language in which the utterance was spoken. As another example, the task can be a natural language processing or understanding task, e.g., an entailment task, a paraphrase task, a textual similarity task, a sentiment task, a sentence completion task, a grammaticality task, and so on, that operates on a sequence of text in some natural language. As another example, the task can be a text to speech task, where the input is text in a natural language or features of text in a natural language and the network output is a spectrogram, a waveform, or other data defining audio of the text being spoken in the natural language. As another example, the task can be a health prediction task, where the input is a sequence derived from electronic health record data for a patient and the output is a prediction that is relevant to the future health of the patient, e.g., a predicted treatment that should be prescribed to the patient, the likelihood that an adverse health event will occur to the patient, or a predicted diagnosis for the patient. As another example, the task can be a text generation task, where the neural network system receives a conditioning input and generates as output a sequence of text. For example, the conditioning input can be another sequence of text, e.g., so that the output sequence is a completion of the input sequence of text, a response to a question posed in the input sequence, or a sequence of text that is about a topic specified by the first sequence of text. As another example, the input to the text generation task can be an input other than text, e.g., an image, and the output sequence can be text that describes the input. As another example, the task can be an image generation task, where the input is a conditioning input and the output is a sequence of intensity values for the pixels of an image. As another example, the task can be a computer vision task, where the input is an image or a point cloud and the output is a computer vision output for the image or point cloud, e.g., a classification output that includes a respective score for each of a plurality of categories, with each score representing the likelihood that the image or point cloud Attorney Docket No.45288-0454WO1 includes an object belonging to the category. When the input is an image or point cloud, the neural network system can include an embedding subnetwork that generates a respective embedding for each multiple patches of the image or point cloud, and the input to the first block of the neural network system can be a sequence that includes the respective embeddings (and, optionally, one or more additional embeddings, e.g., at a predetermined position that will later be used to generate the output). Each patch includes the intensity values of the pixels in a different region of the input image. As another example, the task can be an agent control task, where the input is a sequence of observations or other data characterizing states of an environment and the output defines an action to be performed by the agent in response to the most recent data in the sequence. The agent can be, e.g., a real-world or simulated robot, a control system for an industrial facility, or a control system that controls a different kind of agent. As another example, the task can be a genomics task, where the input is a sequence representing a fragment of a DNA sequence or other molecule sequence and the output is either an embedding of the fragment for use in a downstream task, e.g., by making use of an unsupervised learning technique on a data set of DNA sequence fragments, or an output for the downstream task. Examples of downstream tasks include promoter site prediction, methylation analysis, predicting functional effects of non-coding variants, and so on. In this specification, the term "configured" is used in relation to computing systems and environments, as well as computer program components. A computing system or environment is considered "configured" to perform specific operations or actions when it possesses the necessary software, firmware, hardware, or a combination thereof, enabling it to carry out those operations or actions during operation. For instance, configuring a system might involve installing a software library with specific algorithms, updating firmware with new instructions for handling data, or adding a hardware component for enhanced processing capabilities. Similarly, one or more computer programs are "configured" to perform particular operations or actions when they contain instructions that, upon execution by a computing device or hardware, cause the device to perform those intended operations or actions. The embodiments and functional operations described in this specification can be implemented in various forms, including digital electronic circuitry, software, firmware, computer hardware (encompassing the disclosed structures and their structural equivalents), or any combination thereof. The subject matter can be realized as one or more computer programs, essentially modules of computer program instructions encoded on a tangible non- Attorney Docket No.45288-0454WO1 transitory storage medium for execution by or to control the operation of a computing device or hardware. The storage medium can be a storage device such as a hard drive or solid-state drive (SSD), a storage medium, a random or serial access memory device, or a combination of these. Additionally or alternatively, the program instructions can be encoded on a transmitted signal, such as a machine-generated electrical, optical, or electromagnetic signal, designed to carry information for transmission to a receiving device or system for execution by a computing device or hardware. Furthermore, implementations may leverage emerging technologies like quantum computing or neuromorphic computing for specific applications, and may be deployed in distributed or cloud-based environments where components reside on different machines or within a cloud infrastructure. The term "computing device or hardware" refers to the physical components involved in data processing and encompasses all types of devices and machines used for this purpose. Examples include processors or processing units, computers, multiple processors or computers working together, graphics processing units (GPUs), tensor processing units (TPUs), and specialized processing hardware such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). In addition to hardware, a computing device or hardware may also include code that creates an execution environment for computer programs. This code can take the form of processor firmware, a protocol stack, a database management system, an operating system, or a combination of these elements. Embodiments may particularly benefit from utilizing the parallel processing capabilities of GPUs, in a General-Purpose computing on Graphics Processing Units (GPGPU) context, where code specifically designed for GPU execution, often called kernels or shaders, is employed. Similarly, TPUs excel at running optimized tensor operations crucial for many machine learning algorithms. By leveraging these accelerators and their specialized programming models, the system can achieve significant speedups and efficiency gains for tasks involving artificial intelligence and machine learning, particularly in areas such as computer vision, natural language processing, and robotics. A computer program, also referred to as software, an application, a module, a script, code, or simply a program, can be written in any programming language, including compiled or interpreted languages, and declarative or procedural languages. It can be deployed in various forms, such as a standalone program, a module, a component, a subroutine, or any other unit suitable for use within a computing environment. A program may or may not correspond to a single file in a file system and can be stored in various ways. This includes being embedded within a file containing other programs or data (e.g., Attorney Docket No.45288-0454WO1 scripts within a markup language document), residing in a dedicated file, or distributed across multiple coordinated files (e.g., files storing modules, subprograms, or code segments). A computer program can be executed on a single computer or across multiple computers, whether located at a single site or distributed across multiple sites and interconnected through a data communication network. The specific implementation of the computer programs may involve a combination of traditional programming languages and specialized languages or libraries designed for GPGPU programming or TPU utilization, depending on the chosen hardware platform and desired performance characteristics. In this specification, the term "engine" broadly refers to a software-based system, subsystem, or process designed to perform one or more specific functions. An engine is typically implemented as one or more software modules or components installed on one or more computers, which can be located at a single site or distributed across multiple locations. In some instances, one or more dedicated computers may be used for a particular engine, while in other cases, multiple engines may operate concurrently on the same one or more computers. Examples of engine functions within the context of AI and machine learning could include data pre-processing and cleaning, feature engineering and extraction, model training and optimization, inference and prediction generation, and post-processing of results. The specific design and implementation of engines will depend on the overall architecture and the distribution of computational tasks across various hardware components, including CPUs, GPUs, TPUs, and other specialized processors. The processes and logic flows described in this specification can be executed by one or more programmable computers running one or more computer programs to perform functions by operating on input data and generating output. Additionally, graphics processing units (GPUs) and tensor processing units (TPUs) can be utilized to enable concurrent execution of aspects of these processes and logic flows, significantly accelerating performance. This approach offers significant advantages for computationally intensive tasks often found in AI and machine learning applications, such as matrix multiplications, convolutions, and other operations that exhibit a high degree of parallelism. By leveraging the parallel processing capabilities of GPUs and TPUs, significant speedups and efficiency gains compared to relying solely on CPUs can be achieved. Alternatively or in combination with programmable computers and specialized processors, these processes and logic flows can also be implemented using specialized processing hardware, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs), for even greater performance or energy efficiency in specific use cases. Attorney Docket No.45288-0454WO1 Computers capable of executing a computer program can be based on general- purpose microprocessors, special-purpose microprocessors, or a combination of both. They can also utilize any other type of central processing unit (CPU). Additionally, graphics processing units (GPUs), tensor processing units (TPUs), and other machine learning accelerators can be employed to enhance performance, particularly for tasks involving artificial intelligence and machine learning. These accelerators often work in conjunction with CPUs, handling specialized computations while the CPU manages overall system operations and other tasks. Typically, a CPU receives instructions and data from read-only memory (ROM), random access memory (RAM), or both. The elements of a computer include a CPU for executing instructions and one or more memory devices for storing instructions and data. The specific configuration of processing units and memory will depend on factors like the complexity of the AI model, the volume of data being processed, and the desired performance and latency requirements. Embodiments can be implemented on a wide range of computing platforms, from small embedded devices with limited resources to large-scale data center systems with high-performance computing capabilities. The system may include storage devices like hard drives, SSDs, or flash memory for persistent data storage. Computer-readable media suitable for storing computer program instructions and data encompass all forms of non-volatile memory, media, and memory devices. Examples include semiconductor memory devices such as read-only memory (ROM), solid-state drives (SSDs), and flash memory devices; hard disk drives (HDDs); optical media; and optical discs such as CDs, DVDs, and Blu-ray discs. The specific type of computer-readable media used will depend on factors such as the size of the data, access speed requirements, cost considerations, and the desired level of portability or permanence. To facilitate user interaction, embodiments of the subject matter described in this specification can be implemented on a computing device equipped with a display device, such as a liquid crystal display (LCD) or an organic light-emitting diode (OLED) display, for presenting information to the user. Input can be provided by the user through various means, including a keyboard), touchscreens, voice commands, gesture recognition, or other input modalities depending on the specific device and application. Additional input methods can include acoustic, speech, or tactile input, while feedback to the user can take the form of visual, auditory, or tactile feedback. Furthermore, computers can interact with users by exchanging documents with a user's device or application. This can involve sending web content or data in response to requests or sending and receiving text messages or other Attorney Docket No.45288-0454WO1 forms of messages through mobile devices or messaging platforms. The selection of input and output modalities will depend on the specific application and the desired form of user interaction. Machine learning models can be implemented and deployed using machine learning frameworks, such as TensorFlow or JAX. These frameworks offer comprehensive tools and libraries that facilitate the development, training, and deployment of machine learning models. Embodiments of the subject matter described in this specification can be implemented within a computing system comprising one or more components, depending on the specific application and requirements. These may include a back-end component, such as a back-end server or cloud-based infrastructure; an optional middleware component, such as a middleware server or application programming interface (API), to facilitate communication and data exchange; and a front-end component, such as a client device with a user interface, a web browser, or an app, through which a user can interact with the implemented subject matter. For instance, the described functionality could be implemented solely on a client device (e.g., for on-device machine learning) or deployed as a combination of front-end and back-end components for more complex applications. These components, when present, can be interconnected using any form or medium of digital data communication, such as a communication network like a local area network (LAN) or a wide area network (WAN) including the Internet. The specific system architecture and choice of components will depend on factors such as the scale of the application, the need for real-time processing, data security requirements, and the desired user experience. The computing system can include clients and servers that may be geographically separated and interact through a communication network. The specific type of network, such as a local area network (LAN), a wide area network (WAN), or the Internet, will depend on the reach and scale of the application. The client-server relationship is established through computer programs running on the respective computers and designed to communicate with each other using appropriate protocols. These protocols may include HTTP, TCP / IP, or other specialized protocols depending on the nature of the data being exchanged and the security requirements of the system. In certain embodiments, a server transmits data or instructions to a user's device, such as a computer, smartphone, or tablet, acting as a client. The client device can then process the received information, display results to the user, and potentially send data or feedback back to the server for further Attorney Docket No.45288-0454WO1 processing or storage. This allows for dynamic interactions between the user and the system, enabling a wide range of applications and functionalities. While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any invention or on the scope of what may be claimed, but rather as descriptions of features that may be specific to particular embodiments of particular inventions. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially be claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination. Similarly, while operations are depicted in the drawings and recited in the claims in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products. Particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results. As one example, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous. What is claimed is:

Claims

Attorney Docket No.45288-0454WO1 CLAIMS 1. A method performed by one or more computers and for updating a data set at each of a plurality of iterations, the method comprising: initializing a buffer state for updating the data set, wherein the buffer state comprises, for each value in the data set, a respective value for each of a set of memory buffers; and at each of the plurality of iterations: receiving an initial data set update for the iteration; obtaining sampled noise for the iteration, the sampled noise comprising a respective noise value for each value in the data set; determining a differentially private update to the data set using the initial data set update and the sampled noise, comprising: updating the buffer state, comprising applying a first linear transformation to the sampled noise and a second linear transformation to the update state; after updating the buffer state, determining a noise component of the differentially private update from the buffer state and the sampled noise; and combining the initial data set update and the noise component to generate the differentially private update to the data set; and applying the differentially private update to the data set to update the data set.

2. The method of claim 1, wherein each iteration is a training iteration performed during training of a machine learning model having a plurality of parameters on an objective function, the data set comprises a respective value for each of the plurality of parameters, and the initial data set update comprises a respective gradient value for each of the plurality of parameters generated by performing the training iteration.

3. The method of any preceding claim, wherein applying the differentially private update to the data set comprises summing the differentially private update and the data set.

4. The method of claim 3, when dependent on claim 2, wherein applying the differentially private update to the data set further comprises applying a learning rate for the iteration to the sum.Attorney Docket No.45288-0454WO1 5. The method of any preceding claim, wherein combining the initial data set update and the noise component to generate the differentially private update to the data set comprises: summing the initial data set update and the noise component.

6. The method of any preceding claim, wherein updating the buffer state further comprises summing an output of the first linear transformation and an output of the second linear transformation.

7. The method of any preceding claim, wherein determining a noise component of the differentially private update from the buffer state and the sampled noise comprises: applying a third linear transformation to the sampled noise; applying a fourth linear transformation to the buffer state; and summing an output of the third linear transformation and an output of the fourth linear transformation.

8. The method of any preceding claim, wherein the noise component approximates a product between a lower-triangular matrix and a matrix of the sampled noise at the iteration and each preceding iteration.

9. The method of claim 8, wherein each entry in the lower-triangular matrix is defined by a generating function.

10. The method of claim 9, when dependent on claim 7, wherein coefficients in the first, second, third, and fourth linear transformations are dependent on the generating function.

11. The method of claims 9-10, wherein the generating function approximates a functionof the form ^^√1 െ ^^, where a is a constant and x is an input to the function.

12. The of any one of claims 9-11, further comprising: performing an optimization to determine parameters that define the generating function.

13. The method of any one of claims 8-12, wherein the lower-triangular matrix is a first matrix in a matrix decomposition of a lower-triangular matrix all-ones matrix that has dimensionality n x n, where n is a total number of iterations in the plurality of iterations.Attorney Docket No.45288-0454WO1 14. The method of any preceding claim, wherein applying a first linear transformation to the sampled noise comprises: multiplying a column vector having a respective value for each of the memory buffers with a row vector of the sampled noise to generate a first matrix having a same dimensionality as a matrix containing the update state.

15. The method of claim 14, wherein applying a second linear transformation to the update state comprises: multiplying a matrix having a number of rows equal to the number of memory buffers and a number of columns equal to the number of memory buffers with the matrix containing the update state to generate a third matrix having the same dimensionality as the matrix containing the update state.

16. The method of claim 15, when dependent on claim 7, wherein applying a third linear transformation to the sampled noise comprises: multiplying the vector of the sampled noise with a scalar value.

17. The method of claim 16, wherein applying a fourth linear transformation to the buffer state comprises: multiplying a row vector having a respective value for each memory buffer with a matrix containing the update state after being updated to generate a vector having a same dimensionality as the vector of the sampled noise.

18. The method of any preceding claim, wherein a total number of memory buffers is less than a total number of iterations in the plurality of iterations.

19. The method of any preceding claim, wherein initializing a buffer state comprises setting each value in the buffer state to zero.

20. The method of any preceding claim, wherein obtaining sampled noise comprises: sampling noise from a Gaussian distribution.

21. The method of any preceding claim, wherein the differentially private update is an update that results in, at each iteration, the data set having a differential privacy guarantee with respect to the initial data set updates at the iteration and each preceding iteration.Attorney Docket No.45288-0454WO1 22. A system comprising one or more computers and one or more storage devices, wherein the one or more storage devices comprise a plurality of registers, and wherein the one or more storage devices store instructions that when executed by the one or more computers cause the one or more computers to perform operations for updating a data set at each of a plurality of iterations, the operations comprising: storing, in the plurality of registers, a buffer state for updating the data set, wherein the buffer state comprises, for each value in the data set, a respective value for each of a set of memory buffers, and wherein a total number of memory buffers is less than a total number of iterations in the plurality of iterations; and at each of the plurality of iterations: receiving an initial data set update for the iteration; obtaining sampled noise for the iteration, the sampled noise comprising a respective noise value for each value in the data set; determining a differentially private update to the data set using the initial data set update and the sampled noise, comprising: updating the buffer state that is stored in the plurality of registers using the sampled noise; after updating the buffer state, determining a noise component of the differentially private update from the buffer state and the sampled noise; and combining the initial data set update and the noise component to generate the differentially private update to the data set; and applying the differentially private update to the data set to update the data set.

23. A system comprising one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one more computers to perform the operations of the respective method of any one of claims 1-21.

24. One or more computer storage media storing instructions that when executed by one or more computers cause the one more computers to perform the operations of the respective method of any one of claims 1-21.

Images