[System]
You are a **scientific‐rigor auditor**. You will receive the parsed contents of a research paper. Your job is to identify **only** those errors or flaws that directly undermine the **scientific validity** of the paper’s methods, analyses, or conclusions.

Your sole focus is to identify flaws—such as errors in experimental design, data integrity, calculations, statistical inference, or reproducibility—that directly call into question the validity of a specific claim, paragraph, or the paper as a whole.

**Do not** report issues that are purely presentational, rhetorical, stylistic, or related to citation practices.

---

After you’ve done a **detailed walkthrough** of the paper, output exactly in this format—no extra keys or commentary:

```
<analysis>
{detailed walk‑through of how you checked each section/figure and why you flagged (or did not flag) any flaw}
</analysis>

<response>
{
  "has_error": <true|false>,
  "errors": [
    {
      "location": "Section 2.1",
      "description": "Claim that ‘all X are Y’ is contradicted by citation [5], which shows examples of non‑Y X."
    },
    {
      "location": "Figure 3",
      "description": "XAxis labeled ‘Time (s)’ but units appear to be milliseconds; scale bar mismatches caption."
    }
    // …more entries…
  ]
}
</response>
```

- **Do not** include any other keys or prose outside these two tagged blocks.
- **Do not** report stylistic or citation issues.
- Be as precise as possible about **where** (section ID or figure/table) and **what** the scientific flaw is.
- Each description for the errors must be rooted in a scientific rationale explaining why it is 'wrong' (not how it could be improved).

Begin your analysis now.

[User]
Jesse Campbell*
Chunjiang Zhu†

The all-pairs shortest distances (APSD) with differential privacy (DP) problem takes as input an undirected, weighted graph \( G = (V, E, w) \) and outputs a private estimate of the shortest distances in \( G \) between all pairs of vertices. In this paper, we present a simple \( \tilde{O}(n^{1/3} / \varepsilon) \)-accurate algorithm to solve APSD with \( \varepsilon \)-DP, which reduces to \( \tilde{O}(n^{1/4} / \varepsilon) \) in the \((\varepsilon, \delta)\)-DP setting, where \( n = |V| \). Our algorithm greatly improves upon the error of prior algorithms [CGK+23, FLL22], namely \( \tilde{O}(n^{2/3} / \varepsilon) \) and \( \tilde{O}(\sqrt{n} / \varepsilon) \) in the two respective settings, and is the first to be optimal up to a polylogarithmic factor, based on a lower bound of \( \tilde{\Omega}(n^{1/4}) \) proven by [BDG+24].

In the case where a multiplicative approximation is allowed, we give two different constructions of algorithms with reduced additive error. Our first construction allows a multiplicative approximation of \( O(k \log \log n) \) and has additive error \( \tilde{O}(k \cdot n^{1/k} / \varepsilon) \) in the \( \varepsilon \)-DP case and \( \tilde{O}(\sqrt{k} \cdot n^{1/(2k)} / \varepsilon) \) in the \((\varepsilon, \delta)\)-DP case. Our second construction allows multiplicative approximation \( 2k - 1 \) and has the same asymptotic additive error as the first construction. Both constructions significantly improve upon the currently best-known additive error of, \( \tilde{O}(k \cdot n^{1/2+1/(4k+2)}/\varepsilon) \) and \( \tilde{O}(k \cdot n^{1/3+2/(9k+3)}/\varepsilon) \), respectively from [CGK+23]. Our algorithms are straightforward and work by decomposing a graph into a set of spanning trees, and applying a key observation by [Sea16] that we can privately release APSD in trees with \( O(\mathrm{polylog}(n)) \) error.

*Duke Kunshan University (jesse.campbell@duke.edu)
†University of North Carolina at Greensboro (chunjiang.zhu@uncg.edu)

---

**Differential privacy** (DP) is a mathematical framework which quantifies the leakage of sensitive user information by an algorithm. Differential privacy has seen applications in industry and government agencies, with algorithms satisfying differential privacy being adopted by organizations such as Google [ABC+20, BDD+20, BBD+21], Microsoft [DKY17], and the US Census Bureau [GAP18, FMM19]. The definition of differential privacy requires that the probability of a certain outcome being attained from a dataset without the contribution of any single individual is very close to the probability the same outcome is attained from a dataset with the individual's contribution restored, with the notion of *closeness* depending on chosen privacy parameters \( \varepsilon \) and \( \delta \). In the development of differentially private algorithms, a key trade-off occurs between privacy and accuracy, where privacy is, loosely speaking, the amount of leakage, the amount of leakage of sensitive information, and accuracy is how close the private output is to its true value.

---

The *all-pairs shortest distances* (APSD) problem is a cornerstone of the field of graph algorithms and has been studied extensively. Given a connected graph \( G = (V, E, w) \) with \( n = |V| \), the goal is to release the shortest distances in \( G \) between every vertex pair in \( V \times V \). Algorithms such as the notable Floyd-Warshall algorithm solve APSD in \( O(n^3) \) time. It is conjectured that APSD cannot be solved in \( n^{3-\Omega(1)} \) time, being one among a list of problems which are either all solvable in subcubic time, or none of them are [WW10].

---

In 2016, Adam Sealfon [Sea16] was the first to study the application of differential privacy to the all-pairs shortest distances problem. We follow their DP framework where two graphs are neighboring if they share the same underlying unweighted graphs and their edge weight \( w \) differs by at most 1 in the \( l_1 \)-distance. This

definition is suitable for problems where the graph topology \(G = (V, E)\) is public and the edge weights \(w\) need to be kept private. For example, the topology of a road map in a navigation system is public knowledge while the weight of an edge depends on the number of vehicles on it, which is typically estimated based on clearly private GPS locations of vehicles. In particular, [Sea16] showed an algorithm based on adding Laplace noise to every edge weight which solves the problem with \(\tilde{O}(n/\epsilon)\) error (where \(\tilde{O}(\cdot)\) hides a polylogarithmic term), and posed the question about whether it can be solved with error sublinear in \(n\). In addition, they considered special cases and presented \(\epsilon\)-DP algorithms to release APSD on trees with \(O(\log^{2.5} (n)/\epsilon)\) error, and release APSD on graphs of edge weights bounded by \(M > 0\) with error \(\tilde{O}((nM)^{2/3}/\epsilon^{1/3})\) (\(\tilde{O}(\sqrt{nM/\epsilon})\) in the \((\epsilon, \delta)\)-DP setting). A key observation we make is that the polylogarithmic error in trees is significantly smaller than the polynomial error in general graphs, inspiring the development of the techniques in this work.

Later, Fan et al. [FLL22] and Chen et al. [CGK+23] both positively answered Sealfon's question by proving algorithms for general graphs with error \(\tilde{O}(n^{2/3}/\epsilon)\) in the \(\epsilon\)-DP case and \(\tilde{O}(\sqrt{n/\epsilon})\) in the \((\epsilon, \delta)\)-DP case. In addition, Chen et al. gave algorithms with improved accuracy for graphs with bounded weights, namely \(O(n^{0.5616})\) in the \(\epsilon\)-DP setting and \(O(n^{0.4143})\) in the \((\epsilon, \delta)\)-DP setting. They also presented an algorithm based on the celebrated distance oracle of Thorup and Zwick [TZ05] which reduces the additive error for APSD on general graphs by introducing a multiplicative error term. Moreover, they showed an additive error lower bound of \(\Omega(n^{1/6})\) for the problem on general graphs. This lower bound was recently improved to \(\tilde{\Omega}(n^{1/4})\) by Bodwin et al. [BDG+24].

In this paper, we improve upon the accuracy of the currently best-known algorithms for APSD with DP under both additive and mixed additive and multiplicative approximations. In particular, we show the additive approximation problem to be \(\tilde{\Theta}(n^{1/4})\)-accurate by giving a nearly optimal algorithm which matches the known lower bound of \(\tilde{\Omega}(n^{1/4})\) up to a polylogarithmic factor.

Section 3 gives algorithms to release estimates of all-pairs distances which incur additive error terms. Table 1 gives a summary of the size of the additive error term for each released distance for known algorithms compared to the improved error in the algorithms in this paper. We greatly improve the additive error from \(\tilde{O}(n^{2/3}/\epsilon)\) to \(\tilde{O}(n^{1/3}/\epsilon)\) in the \(\epsilon\)-DP case and from \(\tilde{O}(\sqrt{n/\epsilon})\) to \(\tilde{O}(n^{1/4}/\epsilon)\) in the \((\epsilon, \delta)\)-DP case. The latter matches the lower bound \(\tilde{\Omega}(n^{1/4})\) of Bodwin et al. [BDG+24] (up to a polylog factor) for any \((\epsilon, \delta)\)-DP algorithm. The new upper bounds are even smaller than the previously best results \(O(n^{0.5616})\) and \(O(n^{0.4143})\) for graphs of bounded weights [CGK+23] while we don't need the assumption on edge weights.

When a multiplicative approximation is allowed, it is theoretically possible to break the lower bound of \(\tilde{\Omega}(n^{1/4})\) for general graphs, however no such algorithm has existed until now. In Section 4, we give two constructions to release APSD with differential privacy that break the lower bound for additive error in general graphs. If an approximation \(\tilde{f}(x)\) of \(f(x)\) is \((\alpha, \beta)\)-accurate, we mean that \(f(x) - \beta \leq \tilde{f}(x) \leq \alpha \cdot f(x) + \beta\). Table 2 gives a summary of the error bounds for known algorithms compared to the improved bounds in the algorithms in this paper. The additive term gets significantly improved compared to previous results.

Algorithm with Additive Approximation. We give a simple algorithm which releases a private approximation of the shortest path distances between all-pairs of vertices while only incurring an additive approximation. Given a pair of vertices, their private shortest distance is computed in one of two ways depending on the number of edges in a shortest path between them (ties broken arbitrarily). For short paths, or those whose hop lengths are bounded above by some constant $t$, we can directly apply the Laplace mechanism to release their shortest path distance. Namely, we perturb the edge weights in $G$ by adding noise sampled from the Laplace distribution, and compute the shortest path distance on the noisy graph. By a concentration inequality for Laplace random variables (Lemma 2.4), we can achieve additive error $\tilde{O}(\sqrt{t}/\varepsilon)$ for distances computed via this method. Note that previous constructions [Sea16, CGK+23] also add Laplace noise to edge weights, but their analysis simply sums up the error accumulated from each edge in the path, leading to an error $\tilde{O}(t/\varepsilon)$.

For long shortest paths between vertices, we utilize a result from Sealfon [Sea16] to release the distances from the root vertex of a rooted tree to all other vertices with $O(\mathrm{polylog}(n)/\varepsilon)$ error. In particular, we construct a hitting set of vertices of size $s$ from which to grow shortest path trees. Then, we privately release the distance between the root vertex in the hitting set and each other vertex in the graph with low error. If at least one of the vertices in the hitting set intersects the shortest path between two vertices, then the shortest path is completely contained within a shortest path tree, and the shortest path distance is the sum of two distances to the root vertex. Moreover, if we assume that the number of edges in the shortest path is bounded below by some constant, there is a high probability that the hitting set will intersect the path. We can divide our privacy budget ($\varepsilon$) among all of the $s$ shortest path trees, such that by basic composition releasing their distances is $\varepsilon$-DP, giving an additive error of $\tilde{O}(s/\varepsilon)$.

In theory, letting $s := \tilde{O}(n/t)$ is an appropriate size to ensure that the hitting set intersects every shortest path that traverses at least $t$ edges with high probability. In the $\varepsilon$-DP case, we choose $s := \tilde{O}(n^{1/3})$ to minimize the error from the two methods. The $(\varepsilon,\delta)$-DP case is similar, except we use advanced composition to release the distance estimates computed in each shortest path tree, making the error from this method $\tilde{O}(\sqrt{s}/\varepsilon)$, hence the final error is $\tilde{O}(n^{1/4}/\varepsilon)$.

Algorithms with Additive and Multiplicative Approximations. At a high level, our algorithms work by constructing a collection of spanning trees $\mathbf{T}$, the shortest path distances in which can be used to estimate the shortest path distances in $G$ for every pair of vertices with a multiplicative error. Then, in the same vein as the previous section, we can release APSD for each tree in $\mathbf{T}$ with additive error $\tilde{O}(|\mathbf{T}|/\varepsilon)$. Releasing APSD in this way yields a combination of multiplicative and additive errors.

In the first construction, the collection of spanning trees $\mathbf{T}$ is simply the tree-padding spanner as constructed by Abraham et al. [ACE+20]. In particular, they showed that, for each vertex $v \in V$, there is a tree $T_v \in \mathbf{T}$ such that $d_{T_v}(v, u) \leq O(k \log\log n) \cdot d_G(v, u)$ for all $u \in V$, where $k \in \mathbb{Z}^+$ is a parameter. The number of trees in $\mathbf{T}$ is $kn^{1/k}$, hence the total algorithm is $(O(k \log\log n), \tilde{O}(k n^{1/k} / \varepsilon))$-accurate. The $(\varepsilon, \delta)$-DP case is very similar, except we use advanced composition to release the distance estimates computed within each tree, exactly as in the previous section, reducing the additive error to $O(\sqrt{k n^{1/(2k)}}/\varepsilon)$.

in [CGK+23], i.e., from $\tilde{O}(k \cdot n^{1/2+1/(4k+2)}/\varepsilon)$ to $\tilde{O}(k \cdot n^{1/k}/\varepsilon)$ in the $\varepsilon$-DP case and from $\tilde{O}(k \cdot n^{1/3+2/(9k+3)}/\varepsilon)$ to $\tilde{O}(\sqrt{k} \cdot n^{1/(2k)}/\varepsilon)$ in the $(\varepsilon,\delta)$-DP case. While our first result slightly increases the multiplicative error from $2k-1$ to $O(k\log\log n)$, its simplicity makes it a good alternative and warm-up for the subsequent construction.

the formation of **T** in this construction is simple, we include it as a *warm-up* for the next construction, which uses the same mechanism for differentially private release, but requires a more in-depth approach to construct **T**.

Our next construction of **T** is based on the celebrated distance oracle of Thorup and Zwick [TZ05], which allows us to reduce the multiplicative approximation from the previous construction to \(2k-1\). The original distance oracle constructs sets of connected vertices called *clusters*, which are computed based on the sets \(V = A_0 \supseteq A_1 \supseteq \ldots \supseteq A_{k-1}\) which decrease in size as the index increases. The original oracle constructs a shortest-path tree which spans the subgraph induced by each cluster, and computes distances estimates based on the distances in these trees. If we were to directly apply Sealfon's result to these cluster-spanning trees, the additive error would be \(\tilde{O}(|A_1|/\varepsilon) = \tilde{O}(n^{1-1/k}/\varepsilon)\), which is higher than the error in our additive approximation.

Instead, we *pack* multiple clusters into a single spanning tree of \(G\) such that we can reduce the number of trees in **T**. In the original distance oracle, the total number of edges in the combined spanning trees of the clusters is \(O(kn^{1+1/k})\), so ideally we should be able to fit all of the clusters into \(n^{1/k}\) trees at each level \(1 \leq i \leq k-1\), resulting in a final additive error of \(\tilde{O}(kn^{1/k}/\varepsilon)\). The main obstacle is that, in the original distance oracle, the clusters are not necessarily disjoint, and consequently adding the edges from their spanning trees to a single graph may contain cycles. To overcome this, we divide each set \(A_i\) into \(\tilde{O}(n^{1/k})\) (not necessarily disjoint) sets \(A_i^r\) and modify the definition of clusters by ensuring that any vertex in a cluster centered at \(w \in A_i^r\) is closer to \(w\) than any other center in \(A_i^r\). In this way, the clusters with centers in \(A_i^r\) are guaranteed to be disjoint. Hence, we can add all the edges from the trees spanning each subgraph induced by a cluster with center in \(A_i^r\) into exactly one spanning tree of \(G\). Consequently, \(|\mathbf{T}| = \tilde{O}(kn^{1/k})\) as desired.

For the analysis, we show that our sets \(A_{i+1}\) are large enough relative to the size of \(A_i^r\) such that every vertex is closer to \(A_{i+1}\) than \(A_i^r\) with high probability. Going back to the original distance oracle, this implies that our modified clusters are at least as large as the original clusters, and hence any distance we can compute from a shortest path tree spanning the original cluster we can also compute from a shortest path tree spanning our modified cluster. This observation implies that the original stretch analysis from [TZ05] also applies in our setting. In particular, this gives a multiplicative approximation of \(2k-1\). Hence, our total algorithm is \((2k-1, \tilde{O}(kn^{1/k}))\)-accurate in the \(\varepsilon\)-DP case and \((2k-1, O(\sqrt{kn^{1/(2k)}}))\)-accurate in the \((\varepsilon, \delta)\)-DP case.

## 1.4 Related Work

In 2009, Hay et al. [HLMJ09] were the first to study differentially private graph algorithms by giving a mechanism to release a private estimate of the degree distribution in a graph. In their work, they introduce the notions of node- and edge-differential privacy, which defines neighboring graphs based on their underlying graph topology. Algorithms with node- and edge-differential privacy have been studied considerably in recent literature [LLXL21, JWC23, LML20, ZNF23, SU21, HCYH24, ELRS23].

By contrast, Sealfon [Sea16] introduced the all-pairs shortest distances problem with differential privacy, defining neighboring graphs based on differing edge weights assigned to a fixed, public graph topology. In particular, Sealfon constructed an \(\varepsilon\)-DP algorithm that releases APSD in trees with additive error \(O(\log^{2.5}(n) \cdot \log(1/\gamma)/\varepsilon)\) with probability \(1-\gamma\), which is the basis of our algorithms in this paper. Furthermore, for graphs with edge weights bounded by \(M>0\), they proved an upper bound of \(O((n \cdot M)^{2/3} \cdot \log(n \cdot M \cdot \varepsilon/\gamma) / \varepsilon^{1/3})\) in the pure-DP case and \(O(\sqrt{n} \cdot M \cdot \log(1/\delta)/\varepsilon \cdot \log(n \cdot M \cdot \varepsilon/\gamma))\) in the approximate-DP case. For general graphs, Sealfon used a simple application of the Laplace mechanism to achieve additive error \(\tilde{O}(n)\) in the \(\varepsilon\)-DP case, but posed the question about whether an algorithm for general graphs with error sublinear in \(n\) is possible.

Later, Chen et al. [CGK\(^+\)23] positively answered Sealfon's question by giving algorithms to release all-pairs shortest distances with error \(O(n^{2/3}\cdot\log^{4/3}(n)/\varepsilon)\) in the pure-DP case and \(O(\sqrt{n}\cdot\log(n)\cdot\sqrt{\log(1/\delta)/\varepsilon})\) in the approximate-DP case. Moreover, for graphs with bounded edge weights, they gave an algorithm which is \(O(n^{(\sqrt{17}-3)/2+o(1)}/\varepsilon)\)-accurate in the \(\varepsilon\)-DP case and \(O(n^{\sqrt{2}-1+o(1)}/\varepsilon)\)-accurate in the \((\varepsilon, \delta)\)-DP case. In the case where multiplicative error is allowed, Chen et al. gave an \((2k-1, O(k\cdot n^{(k+1)/(2k+1)}\cdot\log^2(n)/\varepsilon))\)-accurate

algorithm for APSD with ε-DP and a (2k − 1, O(n^((k+1)/(3k+1)) · log (n)^((5k+2)/(3k+1)) · log (1/δ)^(k/(3k+1))/ε))-accurate algorithm for APSD with (ε, δ)-DP. Similar to our work, their algorithm is based on the oracle of Thorup and Zwick [TZ05], which they adapted to the DP setting by using the exponential mechanism to select bunches of vertices based on their distance to a fixed vertex.

Other notable results are those of Fan et al. [FLL22], who gave an alternative algorithm to Chen et al. for solving APSD with DP with error sublinear in n. Furthermore, Fan and Li [FL22] gave improved algorithms for trees with bounded depth and grid-graphs. Ebrahimi et al. gave improved error bounds for graphs with bounded tree-width [EMK23]. Moreover, related graph problems such as shortest paths publishing and range query on shortest paths with differential privacy have seen a recent increase in the literature [CSC+24, DGUW23].

Another contribution of Chen et al. was proving a lower bound for the additive error of Ω(n^(1/6)) in any algorithm on general graphs, for a sufficiently small ε, δ > 0, by exploiting a reduction from the linear queries problem to APSD, and a hereditary discrepancy lower bound provided by Chazelle and Lvov [CL01]. Chen et al. noted that the greatest lower bound achievable by this method is Ω(n^(1/4)). On this note, Bodwin et al. [BDG+24] proved a lower bound of Ω(n^(1/4)/√log n) as a result of a better discrepancy lower bound.

Given a mechanism that takes as input a dataset and releases some aggregate statistical information about the dataset, the goal of differential privacy is to protect any one individual’s privacy whose data is included in the dataset. For this reason, it is necessary to define the notion of what it means for a dataset to differ in the contribution of one individual. In our case, G = (V, E, w) and G' = (V, E, w̃) are neighbors if their weight vectors differ in the l₁ norm by at most 1.

**Definition 2.1.** Two graphs G = (V, E, w) and G' = (V, E, w̃) with equivalent topology are said to be neighboring if ||w − w̃||₁ ≤ 1.

Given a notion of neighboring datasets X and X', we can define the notion of the sensitivity of a function that takes a dataset as input as the most the function can differ over neighboring datasets.

**Definition 2.2.** The l₁ sensitivity of f : X → R^D is defined as Δ₁(f) := max_{X, X'} ||f(X) − f(X')||₁, where X, X' are neighboring datasets.

We now present the formal definition of differential privacy. Intuitively, a differentially private system limits the amount of information we can gain about any individual in a dataset based solely on the outcome of a mechanism which takes the dataset as input. The strictness of this limitation is controlled by privacy parameters ε, δ ≥ 0.

**Definition 2.3.** An algorithm M : X → R^D is said to be (ε, δ)-differentially private if, for all outcomes S ⊆ R^D and neighboring datasets X, X',

P[M(X) ∈ S] ≤ e^{ε} · P[M(X') ∈ S] + δ

We call the case where δ = 0 pure differential privacy and the case where δ > 0 approximate differential privacy.

One of the strongest aspects of differentially private mechanisms are their composition properties. Namely, the aggregation of outputs from multiple differentially private mechanisms is itself differentially private, albeit with gradually degrading privacy parameters. We present here two main results about the composition of differentially private systems which we will use several times throughout this paper.

**Lemma 2.1** (Basic Composition, [DMNS06, DL09]). Let ε, δ ∈ [0, 1] and k ∈ N. If we run k mechanisms where each mechanism is (ε/k, δ/k)-differentially private, then the entire algorithm is (ε, δ)-differentially private.

Lemma 2.2 (Advanced Composition, [DMNS06, DR14]). Let ε, δ ∈ (0, 1] and k ∈ ℕ. If we run k mechanisms where each mechanism is (ε/(2√(2k log (2/δ))), δ/2k)-DP, then the entire algorithm is (ε, δ)-DP.

Regarding Lemma 2.2, we note that running k mechanisms where each mechanism is ε/(2√(2k log (2/δ)))-DP is at least (ε, δ)-DP, as each individual mechanism we run has an even stronger privacy guarantee.

Next, we present the Laplace mechanism, which is one of the primary tools in the theory of differential privacy. In specific, the Laplace mechanism describes how much one needs to perturb a released statistic in order to guarantee it is ε-DP.

Lemma 2.3 ([DMNS06]). Given any function f : X → ℝ^k, the Laplace mechanism on input X ∈ X independently samples Y₁, ..., Y_k according to Lap(Δ₁(f)/ε) and outputs,
M_{f,ε}(X) = f(X) + (Y₁, ..., Y_k)
The Laplace mechanism is ε-differentially private.

We also present a result about the concentration of Laplace random variables.

Lemma 2.4 ([CSS11]). Let X₁, ..., X_t be independent random variables distributed according to Lap(b), and let X = X₁ + ... + X_t. Then for all γ ∈ (0, 1), with probability at least 1 − γ we have,
|X| < O(b√t log (1/γ))

Next, we state a Chernoff inequality which bounds the tail probability of a binomial random variable.

Lemma 2.5 ([CL06]). Let X ∼ Binomial(n, p) be a random variable, then,
P[X ≤ E[X] − λ] ≤ e^{-λ²/2E[X]}

## 3 A Nearly-Optimal Algorithm for General Graphs

In this section, we present a differentially private algorithm for APSD on general graphs which is Õ(n^{1/3}/ε)-accurate in the ε-DP case and Õ(n^{1/4}/ε)-accurate in the (ε, δ)-DP case. Our algorithm is based on a key observation that we can release shortest path distances in trees with polylog(n) error.

We denote by d_G(u, v) the shortest distance between u, v ∈ V in the graph G. When it is clear in which graph we are computing the distance, G is not specified. Furthermore, we denote by h(u, v) the hop length between u and v, namely, h(u, v) = d_{G'}(u, v) where G' = (V, E, {1}^{|E|}). We let d_G^{(t)}(u, v) be the shortest t-hop path between u and v in the graph G, or the shortest path between u and v under the constraint of traversing at most t edges. In particular, if h(u, v) > t, then d_G^{(t)}(u, v) = ∞.

This section is structured as follows: we will first prove a result which bounds the error of releasing distances via the Laplace mechanism for paths with bounded hop length. Then, we will present the result by Sealfon which gives an accurate algorithm for computing shortest path distances on rooted trees. Finally, we will show how to combine these two mechanisms to release APSD with the claimed error bounds.

The input perturbation algorithm takes as input a graph G, adds noise to each edge weight according to Lap(1/ε), and releases the shortest distances computed on the noisy graph. It is a simple application of the Laplace mechanism (Lemma 2.3) to the function f : w → ℝ^{n²} which takes as input the edge weights of a graph and outputs all-pairs shortest distances. The result was proven by [Sea16] and later by [CGK⁺23]. By a more careful analysis, we establish a lower error for this method.

Lemma 3.1. Let t ∈ ℕ, ε ∈ (0, 1], and γ ∈ (0, 0.5]. There is an ε-DP algorithm for computing d̃^{(t)}(u, v) for every u, v ∈ V such that with probability 1 − γ we have,
max_{u,v ∈ V} |d̃^{(t)}(u, v) - d_G^{(t)}(u, v)| ≤ O(√t · log(n/γ)/ε)

Since a shortest path cannot traverse any single edge more than once, the ℓ₁ sensitivity of a function that takes as input w and returns the shortest path distance between a pair of vertices is 1. Consequently, by Lemma 2.3, releasing the graph G̃ is ε-differentially private. Since the shortest t-hop distances are simply a post-processing of the edge weights of G̃, we can also release them with ε-differential privacy.

Proof. The algorithm works as follows: given a weighted, undirected graph, G = (V, E, w), we construct a noisy graph G̃ = (V, E, w̃) by adding Laplace noise to each component of w, independently sampled from Lap(1/ε). Then, we return d̃^(t)(u, v) ← d̃_{G̃}^{(t)}(u, v) for each u, v ∈ V.

To achieve our upper bound for the accuracy, we note that each distance d̃_{G̃}^{(t)}(u, v) is the sum of a maximum of t edge weights, hence the total error in the estimate d̃^{(t)}(u, v) is the accumulation of at most t Laplace random variables. By Lemma 2.4, with probability at least 1 − γ / n² we have,

|d̃^{(t)}(u, v) − d_{G̃}^{(t)}(u, v)| ≤ O(√t · log(n²/γ)/ε) = O(√t · log(n/γ)/ε)

by Proposition E.2. By a union bound, with probability at least 1 − γ, this upper bound holds for each of the n² released distances.

Next, we will present a result from [Sea16] which gives a recursive algorithm for computing the shortest path distances between the root and all other vertices in a rooted tree, such that the maximum error in any single released distance is O(polylog(n)). We state the result here but defer its proof to Appendix A.

Lemma 3.2 (Theorem 4.1 in [Sea16]). Let T_z = (V, E, w) be a tree with root vertex z ∈ V, ε ∈ (0, 1], and γ ∈ (0, 0.5]. Then there is an ε-DP algorithm for releasing the distance between z and every u ∈ V that is O(log^{1.5}(n) · log(n/γ)/ε)-accurate with probability 1 − γ.

Next, we show how to combine Lemma 3.1 and Lemma 3.2 to release all-pairs distances with a nearly-optimal additive error. Our proof borrows some ideas from the proof of Lemma 3.1 in [CGK⁺23].

Theorem 3.1. For γ ∈ (0, 0.5] and ε ∈ (0, 1], there is an ε-DP algorithm for computing all-pairs shortest distances that is O(n^{1/3} · log(n)^{11/6} · log(1/γ)/ε)-accurate with probability 1 − γ − 1/n².

**Corrected text from the OCR output (in original order):**

to release the shortest path distances between $z$ and $u \in V$, denoted by $\tilde{d}(z, u)$. Furthermore, we use the $\varepsilon/2$-DP input perturbation algorithm (Lemma 3.1) to compute the shortest $t$-hop distances in $G$ for every pair of vertices $u, v \in V$, where $t := \lceil 10 \cdot (n/s) \log(n) \rceil$, denoted by $d_G^{(t)}(u, v)$. Then, we let,
$$
d(u,v) = \min \left\{ d_G^{(t)}(u,v), \min_{z \in S} \left\{ \tilde{d}(z,u) + \tilde{d}(z,v) \right\} \right\}
$$
be the final distance approximation. By basic composition (Lemma 2.1), running the $s$, $\varepsilon/(2s)$-DP mechanisms and the single $\varepsilon/2$-DP mechanism is $\varepsilon$-DP. In particular, we note that we do not release any shortest path trees themselves, hence no shortest path information is revealed. For the accuracy analysis, we will first show that for pair of vertices $(u,v) \in V \times V$, either,

- **Case A.** There is a vertex $z \in S$ that intersects the shortest path in $G$ from $u$ to $v$, or,

- **Case B.** The shortest path between $u$ and $v$ in $G$ is the $t$-hop shortest path between $u$ and $v$.

In particular, assume that $(u,v)$ is not in **Case B**. Let $u = p_1, p_2, ..., p_l = v$ be a shortest path between $u$ and $v$ in $G$, with ties broken arbitrarily. Because the vertices in $S$ are sampled uniformly, each vertex in $V$ has probability $s/n$ of being included in $S$. Consequently, the probability that none of the vertices $p_j$ for $j \in [l]$ are included in $S$ is $(1-s/n)^l \le (1-s/n)^t \le 1/n^4$ by **Proposition E.1**. It follows that with probability $1-1/n^4$, $(u,v)$ is in **Case A**. We condition on this holding true for all $n^2$ pairs of vertices with probability at least $1-1/n^2$, by a union bound. $(*)$

We begin our accuracy analysis with **Case A**. Suppose $p_i \in S$ for some $i \in [l]$, then $d_G(u,v) = d_{T_{p_i}}(u, p_i) + d_{T_{p_i}}(p_i, v)$. We note that these distances are estimated in **Line 11**. Moreover, **Lemma 3.2** ensures that, with probability $1 - \gamma/(2s)$,
$$
|d_G(u,v) - (\tilde{d}(u,p_i) + \tilde{d}(p_i,v))| \leq O(s \cdot \log^{1.5}(n) \cdot \log(2sn/\gamma)/\varepsilon). \tag{1}
$$
We condition on this upper bound for all $s$ trees with probability at least $1 - \gamma/2$, by a union bound.

We move on to the analysis of **Case B**. Since we are assuming that the true shortest path between $u$ and $v$ has at most $t$ edges, **Lemma 3.1** ensures that with probability $1 - \gamma/2$,
$$
|d(u,v) - d_G^{(t)}(u,v)| \leq O(\sqrt{n/s} \cdot \log^{1.5}(n) \cdot \log(1/\gamma)/\varepsilon) \tag{2}
$$
by **Proposition E.2** to simplify the argument of a logarithmic term. By a union bound, the event $(*)$ and the upper bounds (1) and (2) hold with probability $1 - \gamma - 1/n^2$. Furthermore, choosing $s = n^{1/3}/\log^{2/3}(n)$ by balancing the two errors, the upper bounds (1) and (2) ensure,
$$
\max_{u, v \in V} |d_G(u,v) - d(u,v)| \leq O\left(n^{1/3} \cdot \log^{5/6}(n) \cdot \log\big(2n^{4/3}/(\gamma \cdot \log^{2/3}(n))\big)/\varepsilon\right)
$$
$$
= O\left(n^{1/3} \cdot \log^{11/6}(n) \cdot \log(1/\gamma)/\varepsilon\right)
$$
by **Proposition E.2**.

Next, we present a similar result in the $(\varepsilon, \delta)$-DP setting, which is optimal up to a polylogarithmic factor. The proof is analogous and thus deferred to **Appendix B**.

**Theorem 3.2.** *For $\gamma \in (0,0.5]$ and $\varepsilon, \delta \in (0,1]$, there is an $(\varepsilon, \delta)$-DP algorithm for computing all-pairs shortest distances that is $O(n^{1/4} \cdot \log^2(n) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\varepsilon)$-accurate with probability $1 - \gamma - 1/n^2$.*

## 4 Improved Algorithms Allowing Multiplicative Error

Chen et al. [CGK$^+$23] noted that the known lower bound of $\widetilde{\Omega}(n^{1/4})$ for the purely additive error of an algorithm that privately releases all-pairs distances does not apply in the setting where a multiplicative approximation is allowed. In this section, we adapt two existing mechanisms which output shortest distance estimates to the DP setting, which are the first of their kind to have additive error below the lower bound $\widetilde{\Omega}(n^{1/4})$ in the purely additive setting, as the current best additive term [CGK$^+$23] is $\widetilde{O}(k \cdot n^{1/3 + 2/(9k+3)}/\varepsilon)$. In specific, both of our methods decompose a graph into a collection $\mathcal{T}$ of spanning trees such that for

any pair of vertices \( u, v \in V \), there is a tree \( \mathcal{T} \in \mathbf{T} \) that satisfies \( d_{\mathcal{T}}(u, v) \leq \alpha \cdot d_G(u, v) \) where \( \alpha \) is the multiplicative stretch factor. We then turn to an algorithm of privately releasing all-pairs distances in trees with polylogarithmic additive error. Hence, this leads to a mixed multiplicative and additive error in the shortest distance estimates.

The motivation for decomposing a graph into trees comes from a corollary of Theorem 3.2 originally proven by [Sea16] which extends the algorithm for releasing distances between the root of a tree and every other vertex to all-pairs distances in a tree. We state the result here and defer the proof to Appendix A.

**Corollary 4.1 (Theorem 4.2 in [Sea16]).** Let \( \mathcal{T} = (V, E, w) \) be a tree with \( \epsilon \in (0, 1] \) and \( \gamma \in (0, 0.5] \). Then there is an \( \epsilon \)-DP algorithm for releasing all-pairs distances on \( \mathcal{T} \) that is \( O(\log^{1.5}(n) \cdot \log(n/\gamma)/\epsilon) \)-accurate with probability \( 1 - \gamma \).

In what follows we will give two different constructions of algorithms to release all-pairs shortest distances in general graphs with a multiplicative error term, making heavy use of Corollary 4.1. Construction 1 can be considered a warm-up for Construction 2, as the result from Construction 2 is stronger, but requires a more in-depth analysis.

## 4.1 Construction 1: Tree-Padding Spanner

In this section, we give a simple construction of an algorithm with multiplicative error \( O(k \log \log n) \) which releases all-pairs distances with differential privacy. This section also serves as a warm-up for the next construction.

Abraham et al. [ACE+20] gave the first construction of a *tree-padding spanner*, which, given a graph \( G = (V, E, w) \), returns a collection of spanning trees \( \mathbf{T} \) such that for each vertex \( v \in V \), there exists a tree \( \mathcal{T} \in \mathbf{T} \) that is a sourcewise \( O(k \log \log n) \)-spanner for the source set \( \{v\} \), or equivalently, \( d_{\mathcal{T}}(v, u) \leq O(k \log \log n) \cdot d_G(v, u) \) for all \( u \in V \). We state the result here, but refer the interested reader to [ACE+20] for a detailed proof.

**Lemma 4.1 (Theorem 2 in [ACE+20]).** For a parameter \( k \in \mathbb{Z}^+ \), there exists an algorithm that finds a collection \( \mathbf{T} \) of \( k \cdot n^{1/k} \) spanning trees of \( G \) such that for every \( u, v \in V \), there exists a tree \( \mathcal{T} \in \mathbf{T} \) such that \( d_{\mathcal{T}}(u, v) \leq O(k \log \log n) \cdot d_G(u, v) \).

By applying Corollary 4.1 to each tree in \(\mathbf{T}\), we can release all-pairs distances in the tree-padding spanner, and use these distances to compute an estimate for each pair of vertices in \( V \).

**Theorem 4.1.** For \( \gamma \in (0, 0.5] \), \( k \in \mathbb{Z}^+ \), and \( \epsilon \in (0, 1] \), there is an \( \epsilon \)-DP algorithm to release all-pairs shortest distances that is \( (O(k \log \log n), O(k \cdot n^{1/k} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \log(1/\gamma)/\epsilon)) \)-accurate with probability \( 1 - \gamma \).

**Proof.** Let \( \mathbf{T} \) be the tree-padding spanner constructed in Lemma 4.1. For each \( \mathcal{T} \in \mathbf{T} \) and \( u, v \in V \), we run the \( \epsilon/(k n^{1/k}) \)-DP algorithm given by Corollary 4.1 to release a private estimate of the distance \( d_{\mathcal{T}}(u, v) \), denoted by \( \tilde{d}_{\mathcal{T}}(u, v) \). By basic composition (Lemma 2.1), releasing all the distances is \( \epsilon \)-DP. Moreover, for each estimate \( \tilde{d}_{\mathcal{T}}(u, v) \), the result of Corollary 4.1 ensures, with probability \( 1 - \gamma \) by a union bound over all \( k n^{1/k} \) trees,
\[
\max_{u,v \in V} |d_{\mathcal{T}}(u, v) - \tilde{d}_{\mathcal{T}}(u, v)| \leq O\left(k \cdot n^{1/k} \cdot \log^{1.5}(n) \cdot \log\left(\frac{n}{\gamma/k n^{1/k}}\right)/\epsilon\right)
\]
\[
= O\left(k \cdot n^{1/k} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \log(1/\gamma)/\epsilon\right)
\]
where the equality follows from Proposition E.2. For each \( u, v \in V \), by letting \( \tilde{d}(u, v) \leftarrow \min_{\mathcal{T} \in \mathbf{T}} \tilde{d}_{\mathcal{T}}(u, v) \), the result of Lemma 4.1 guarantees that the stretch of the estimate is at most \( O(k \log \log n) \). Hence, the total algorithm is \( (O(k \log \log n), O(k \cdot n^{1/k} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \log(1/\gamma)/\epsilon)) \)-accurate.

We also provide a similar (\( \epsilon, \delta \))-DP algorithm, and defer the proof to Appendix C.

**Theorem 4.2.** For any \( \gamma \in (0, 0.5] \), \( k \in \mathbb{Z}^+ \) and \( \epsilon, \delta \in (0, 1] \), there is an (\( \epsilon, \delta \))-DP algorithm to release all-pairs shortest distances that is \( (O(k \log \log n), O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\epsilon)) \)-accurate with probability \( 1 - \gamma \).

In this section, we give an algorithm that modifies the oracle of Thorup and Zwick [TZ05] in order to apply **Corollary 4.1** effectively. The original oracle constructs a total of O(n^{1-1/k}) sets of vertices called *clusters*, and for each cluster computes a shortest path tree spanning it. The shortest path distances within each cluster are then used to output the distance approximations. Applying **Corollary 4.1** directly to all O(n^{1-1/k}) trees would result in \~O(n^{1-1/k}/ε) additive error, which is clearly worse than our result from the previous section. Instead, we modify the sampling process to *pack* multiple clusters into a single spanning tree of G. Namely, we add the edges from the shortest path tree spanning each cluster to a single graph to form a spanning tree of G. This allows us to bound the number of times we need to call the algorithm from **Corollary 4.1** to be \~O(k · n^{1/k}). In the original distance oracle, this is not possible as the clusters can share common vertices with one another, so adding their shortest path spanning trees to a single graph may create cycles.

Throughout this section, for a subset of vertices S ⊆ V and v ∈ V, we let d(v, S) = min_{u∈S} d(v, u). Furthermore, for an integer parameter i ∈ Z^+, we let [i] := {1, 2, ..., i}. Lastly, for a graph H = (V_H, E_H), we let E(H) = E_H.

Our algorithm (**Algorithm 2**) begins by constructing the sets V = A_0 ⊇ A_1 ⊇ ... ⊇ A_{k-1}, but starting from A_{k-1} to A_1 in a backward manner. In particular, the algorithm runs for t := ⌈100 · n^{1/k} log(n)⌉ iterations, and we sample a portion of the vertices in each set A_i in each iteration. For each r ∈ [t], we begin by letting A^r_{k-1} be a single vertex sampled at random from V. Then, for each i ∈ [k - 2], we let A^r_i be A^r_{i+1}, and sample n^{1-(i+1)/k} - n^{1-(i+2)/k} vertices randomly from the set V - A^r_{i+1} to add to the set A^r_i. Lastly, we let A_i = ∪_r A^r_i for each i ∈ [k - 1].

Moreover, for every w ∈ A^r_i, we let C^r(w) = {u ∈ V | d(w, u) < d(u, A^r_i - {w})} be the cluster *centered at* w. We define clusters in this way in order to ensure that the vertices in each cluster with a center in A^r_i are disjoint, so that we can *fit* them into a single spanning tree.

The next step is to define the *pivots* and *bunches* for every vertex u ∈ V, which we do in the same way as [TZ05], except for our modified sets A_i. Namely, for each i ∈ [k - 1], we let p_i(u) ∈ A_i be a vertex such that d_G(u, p_i(u)) = d_G(u, A_i), where ties are broken arbitrarily. In particular, if d(u, A_i) = d(u, A_{i+1}), then p_i(u) ← p_{i+1}(u). Furthermore, we define the bunches as B(u) = {w ∈ V | d(w, u) < d(u, p_{i+1}(u))}.

We make the following observations about our construction which will be critical to our later analysis. Throughout our analysis, we assume that 2 ≤ k ≤ ⌊log(n)/log(2)⌋ such that n^{1/k} ≥ 2 for simplicity. At the end of this section, we will justify this assumption.

Our first observation establishes that each cluster is disjoint by construction.

**Lemma 4.2.** *For all r ∈ [t], i ∈ [k-1], and w_1, w_2 ∈ A^r_i with w_1 ≠ w_2, C^r(w_1) ∩ C^r(w_2) = ∅.*

Proof. By way of contradiction, suppose C^r(w_1) ∩ C^r(w_2) ≠ ∅. Then, there exists a vertex u ∈ C^r(w_1) ∩ C^r(w_2). Let a_1 be the closest vertex to u in A^r_i - {w_1} and a_2 be the closest vertex to u in A^r_i - {w_2}. Then, by our definition of clusters,

d(w_1, u) < d(u, a_1) ≤ d(u, w_2) < d(u, a_2) ≤ d(u, w_1)

Hence no such vertex u can exist.

Next, we make a key observation that no one vertex has a higher probability of being included in the sets A^r_i or A_i than any other vertex.

**Lemma 4.3.** *Each vertex u ∈ V has a uniform probability of being included in A^r_i and A_i for i ∈ [k - 1] and r ∈ [t].*

Proof. By Line 15, the set A_i is simply the union of the sets A^r_i over all values of r ∈ [t]. Since the sampling procedure in each of the t iterations is independent with respect to every other iteration, if each vertex has an equal probability of being included in A^r_i, then each vertex has an equal probability of being included in A_i.

Therefore, it suffices to show that $\mathbb{P}[u \in A^{r}_{i}] = |A^{r}_{i}|/n = n^{-(i+1)/k}$. We prove the claim by induction on $i$. For the base case of $i = k-1$, by Line 3, $A^{r}_{k-1}$ consists of a single vertex picked at random, so each vertex has probability $1/n$ of being picked. Now, suppose that $1 \leq i < k-1$ and the claim holds for index $i + 1$. By Lines 5 and 7, $\mathbb{P}[u \in A^{r}_{i}] = \mathbb{P}[u \in A^{r}_{i+1}] + \mathbb{P}[u \notin A^{r}_{i+1}] \cdot \mathbb{P}[u \in A^{r}_{i} - A^{r}_{i+1}]$. By the induction hypothesis, $\mathbb{P}[u \in A^{r}_{i+1}] = n^{-(i+2)/k}$, hence,
\[
\mathbb{P}[u \in A^{r}_{i}] = n^{-(i+2)/k} + (1-n^{-(i+2)/k}) \cdot \frac{n^{1-(i+1)/k} - n^{1-(i+2)/k}}{n - n^{1-(i+2)/k}} = n^{-(i+1)/k}
\]

In our sampling procedure, the sets $A^{r}_{i}$ are sampled without replacement, however, a single vertex can be sampled at the $i$th level in more than one iteration $r \in [t]$. Consequently, $|A_{i}| \leq t \cdot |A^{r}_{i}|$, so for our analysis we must give a lower bound on the size of $A_{i}$, which we do next.

Proof. By Line 15, for $i \in [k-1]$, $A_{i}$ is the union of the sets $A^{r}_{i}$ over $r \in [t]$, each of which is sampled uniformly and independently from $V$ without replacement by Lemma 4.3 and has size $n^{1-(i+1)/k}$. In particular, if we fix $u \in V$, then $\mathbb{P}[u \in A^{r}_{i}] = |A^{r}_{i}|/n$. Hence, the probability that $u$ is included in $A_{i}$ after $t$ iterations is $1 - (1 - |A^{r}_{i}|/n)^{t} = p_{i}$. Let $X_{i} \sim \text{Binomial}(n, p_{i})$ be the number of vertices in $A_{i}$. It follows that,

\[
\mathbb{E}[X_{i}] = n \cdot (1 - (1 - |A^{r}_{i}|/n)^{t}) \\
\geq n \cdot \left(1 - \frac{1}{1 + |A^{r}_{i}|t/n}\right) \\
= \frac{t}{1 + |A^{r}_{i}|t/n} \cdot |A^{r}_{i}| \\
> (t/2) \cdot |A^{r}_{i}| = (t/2) \cdot n^{1-(i+1)/k}
\]

Lemma 4.4. $|A_{i}| \geq (t/4) \cdot n^{1-(i+1)/k}$ for all $i \in [k-1]$ with probability at least $1 - 1/(2n^{2})$

Proof. Let O_u : V → [n] be the ordering of vertices V by sorting vertices based on their distance to vertex u in G, with ties broken arbitrarily. For example, the j^th-closest vertex to u in G maps to j. We note d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w}) if at least one vertex in A_{i+1} comes before all the vertices in A^r_i - {w} in this ordering. Suppose that for a vertex v ∈ A_{i+1} we have O_u(v) = j. By Lemma 4.3, since each vertex has an equal probability of being included in the set A^r_i, the probability that all the vertices in A^r_i - {w} come after v, or O_u(y) > O_u(v) for all y ∈ A^r_i - {w}, is (1 - j/n)^{|A^r_i|-1}. Also by Lemma 4.3, the probability that O_u(v) = j is 1/n for every j ∈ [n]. Since the events O_u(v) = j and O_u(v) = m are clearly disjoint when j ≠ m, we have that,

P[d(u, v) ≤ d(u, A^r_i - {w})] = P[⋃_{j=1}^n (O_u(v) = j) ∩ (O_u(y) > j for all y ∈ A^r_i - {w})]

= ∑_{j=1}^{n} (1 - j/n)^{|A^r_i|-1} (1/n)

≥ ∫_{1/n}^1 (1 - x)^{|A^r_i|-1} dx

= (1 - 1/n)^{|A^r_i|} / |A^r_i|

≥ (1 - (|A^r_i| / n)) / |A^r_i| ≥ 1 / (2|A^r_i|)

where the last inequality follows from |A^r_i|/n ≤ n^{-2/k} ≤ n^{-1/k} ≤ 1/2. We note that |A^r_i| = n^{1-(i+1)/k} and by Lemma 4.4 we condition on the event that |A_{i+1}| ≥ (t/4) · n^{1-(i+2)/k} for all i ∈ [k-2] with probability at least 1 - 1/(2n^2). Hence, the probability that at least one of the vertices in A_{i+1} comes before A^r_i - {w} in the ordering O_u is at least,

P[d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w})] ≥ 1 - (1 - 1/(2|A^r_i|))^{|A_{i+1}|}

≥ 1 - (1 - 1/(2|A^r_i|))^{(t/4)·n^{1-(i+2)/k}}

≥ 1 - n^{-7}

where the last inequality follows from Proposition E.1. We condition on the event d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w}) for all u ∈ V, for all levels 1 through k - 2, for all t iterations with probability at least 1 - n·t·k/n^7,

where the last inequality follows from |A^r_i|/n ≤ n^{-2/k} ≤ n^{-1/k} ≤ 1/2. We note that |A^r_i| = n^{1-(i+1)/k} and by Lemma 4.4 we condition on the event that |A_{i+1}| ≥ (t/4) · n^{1-(i+2)/k} for all i ∈ [k-2] with probability at least 1 - 1/(2n^2). Hence, the probability that at least one of the vertices in A_{i+1} comes before A^r_i - {w} in the ordering O_u is at least,

P[d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w})] ≥ 1 - (1 - 1/(2|A^r_i|))^{|A_{i+1}|}

≥ 1 - (1 - 1/(2|A^r_i|))^{(t/4)·n^{1-(i+2)/k}}

≥ 1 - n^{-7}

where the last inequality follows from Proposition E.1. We condition on the event d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w}) for all u ∈ V, for all levels 1 through k - 2, for all t iterations with probability at least 1 - n·t·k/n^7,

Lemma 4.5. For all i ∈ [k-2], r ∈ [t], u ∈ V, if w ∈ A^r_i is the closest to u in G, then d(u, p_{i+1}(u)) ≤ d(u, A^r_i - {w}) with probability at least 1 - 1/n^2.

where the first inequality follows from Bernoulli's inequality, and the last inequality follows from |A^r_i| · t ≤ n.

Furthermore, by a Chernoff bound (Lemma 2.5 with λ = E[X_i]/2), we have that P[X_i ≤ E[X_i]/2] ≤ e^{-E[X_i]/8}. The expectation of X_i, E[X_i] is minimized when i = k - 1, as we sample the least amount of vertices in A_{k-1}. So, E[X_i] ≥ E[X_{k-1}] ≥ t/2 = 50 · n^{1/k} log n. Hence, we have that

P[X_i ≤ E[X_i]/2] ≤ e^{-E[X_i]/8}
≤ exp (-(50/8) · n^{1/k} log n)
= n^{-(50/8)n^{1/k}} ≤ 1/(2n^3)

where the first inequality follows from Bernoulli's inequality, and the last inequality follows from |A^r_i| · t ≤ n.

Since the assumption k ≤ ⌊log(n)/log(2)⌋ implies k ≤ n, by a union bound we get that the event |A_i| ≥ (t/4) · n^{1-(i+1)/k} for all 1 ≤ i ≤ k - 1 occurs with probability at least 1 - 1/(2n^2).

Finally, we make the key observation that our sets A_{i+1} are large enough relative to the size of A^r_i such that every vertex in a cluster C^r(w) is closer to the set A_{i+1} than A^r_i - {w} for every i ∈ [k-2], r ∈ [t].

by a union bound. Furthermore, $t \cdot k \leq \frac{100}{\log(2)} \cdot n^{1/k} \cdot \log^2 (n) \leq n^3$ for all $n$ sufficiently large, where the first inequality holds from $k \leq \lfloor\log (n)/ \log (2)\rfloor$. Hence, $t \cdot k/n^6 \leq 1/n^3 \leq 1/(2n^2)$, so the probability of success is bounded below by $1 - 1/(2n^2)$. By a union bound with Lemma 4.4, $d(u, p_{i+1}(u)) \leq d(u, A_i^r - \{w\})$ occurs with probability at least $1 - 1/n^2$.

The next step in our algorithm is to form a collection $\mathbf{T}$ of trees, the distances in which will be used to compute the final distance estimates as in the construction from the previous section. In particular, to construct $T_i^r \in \mathbf{T}$, we begin by letting $T_i^r = (V, \emptyset)$. Then, for each center $w \in A_i^r$, we add the edges of the shortest path tree centered at $w$ and spanning $C^r(w)$ to $T_i^r$. By Lemma 4.2, $T_i^r$ is a forest. To connect the components of the forest into a single spanning tree of $G$, we imagine contracting each cluster into its center and adding the vertices of the minimum spanning tree of the new graph to $T_i^r$.

In fact, we do not utilize the distances between clusters in each level, so any arbitrary connection of the components such that no cycles are formed is adequate. To give an explicit algorithm for connecting the clusters into a single spanning tree, we give a simple modification of Kruskal's algorithm [Kru56]. In specific, let $E'$ be the set of edges $E(G) - E(T_i^r)$. We (1) pick the edge in $E'$ with the smallest weight, with ties broken arbitrarily, and check if it forms a cycle in $T_i^r$. If it doesn't, we add the edge to $T_i^r$. Then, we remove the edge from $E'$. We (2) repeat step (1) until $T_i^r$ has $n - 1$ edges. By the condition in step (1) and Lemma 4.2, $T_i^r$ is acyclic. Furthermore, $T_i^r$ cannot be disconnected as the graph $G$ is connected and the first edge encountered in $E'$ that connects two disconnected components in $T_i^r$ must be added to $T_i^r$ as it won't form a cycle.

Now we let $\mathbf{T} = \cup_i \cup_r T_i^r$. In this way, we construct exactly one spanning tree for each set $A_i^r$, hence there are $t \cdot k = 100 \cdot k n^{1/k} \log(n)$ total trees in $\mathbf{T}$. Next, we analyze the maximum stretch of the distance estimates computed in $\mathbf{T}$, which parallels the analysis in [TZ05]. We begin by showing that the pivot of a vertex is always included in its bunch.

Lemma 4.6. For all $i \in [k-1]$ and $u \in V$, $p_i(u) \in B(u)$.

Proof. The claim follows by induction on the index $i$. For the base case of $i = k-1$, since $A_k = \emptyset$, for all $w \in A_{k-1}$, $d(w, A_k) = \infty$. Consequently, $d(w, u) < d(w, A_k)$, so $w \in B(u)$. It follows that $p_{k-1}(u) \in A_{k-1} \subseteq B(u)$. Suppose further that $i < k-1$ and $p_{i+1}(u) \in B(u)$. There are two cases. In the first case, $d(u, A_i) = d(u, A_{i+1})$, and $p_i(u) \leftarrow p_{i+1}(u) \in B(u)$ by Line 16. In the second case, $d(u, A_i) = d(u, p_i(u)) < d(u, A_{i+1})$, and hence $p_i(u) \in B(u)$ by the definition of bunches.

For a pair of vertices $u, v \in V$, to compute a distance estimate $\tilde{d}(u, v)$, we first introduce a placeholder variable $w = u$ and initially set $i = 0$. If $w \in B(v)$, then the algorithm stops. Otherwise, we let $i \leftarrow i + 1$, swap $u$ and $v$, and let $w \leftarrow p_i(u) \in A_i$. We repeat this process of checking if $w \in B(v)$ and swapping until the algorithm stops. We note that the algorithm is guaranteed to stop as $A_{k-1} \subseteq B(v)$ for every vertex.

v ∈ V, as the cluster constructed for each vertex in A_{k-1} in Line 3 of Algorithm 2 is simply the entire vertex set. Once the swapping algorithm stops, we let d(u, v) = d(w, u) + d(w, v).

It remains to show that the swapping procedure outlined above indeed releases an estimate with stretch at most (2k − 1), which we will prove next.

Proof. Let Δ = d_G(u, v). Initially, we set w = u, hence d(w, u) = 0. We will show that each iteration of the swapping procedure increases d(w, u) by at most Δ. Let u_i, v_i, and w_i be the values of the variables u, v, and w respectively in iteration i ∈ [k − 1] of the algorithm. If the algorithm does not terminate at iteration i − 1, then w_{i-1} ∉ B(v_{i-1}), so d(w_{i-1}, v_{i-1}) ≥ d(A_i, v_{i-1}) = d(p_i(v_{i-1}), v_{i-1}). However, since v_{i-1} = u_i and w_i = p_i(u_i), we have that,

d(w_i, u_i) = d(p_i(u_i), u_i) = d(p_i(v_{i-1}), v_{i-1}) ≤ d(w_{i-1}, v_{i-1}) ≤ d(w_{i-1}, u_{i-1}) + Δ

Since A_{k-1} ⊆ B(v), there are at most k−1 iterations in the algorithm, hence d(w, u) ≤ (k−1)Δ. Furthermore, d(w, v) ≤ d(w, u) + d(u, v) ≤ (k − 1)Δ + Δ = kΔ by the triangle inequality. It follows that d(u, v) = d(w, u) + d(w, v) ≤ (2k − 1)Δ.

We can now apply Corollary 4.1 to the set T of trees as in the previous section.

Theorem 4.3. For γ ∈ (0, 0.5], ε ∈ (0, 1], and k ∈ {2, ..., ⌊log(n)/log(2)⌋}, there is an ε-DP algorithm for computing all-pairs shortest distances that is (2k − 1, O(k · n^{1/k} · log^{2.5}(n) · log(k) · log(1/γ)/ε))-accurate with probability 1 − γ − 1/n^2.

Proof. For each T ∈ T and u, v ∈ V, we run the ε/(t·k)-DP algorithm given by Corollary 4.1 to release the private distance estimates 𝑑̃_T(u, v) and let 𝑑̃(u, v) ← min_{T∈T} 𝑑̃_T(u, v). By basic composition (Lemma 2.1), releasing all the private estimates is ε-DP. Moreover, for each 𝑑̃_T(u, v), the result of Corollary 4.1 guarantees that, with probability 1−γ by a union bound over all t·k trees,

max_{u,v∈V} |d_T(u, v) − 𝑑̃_T(u, v)| ≤ O(k · n^{1/k} · log^{1.5}(n) · log(n · t · k/γ)/ε)
= O(k · n^{1/k} · log^{2.5}(n) · log(k) · log(1/γ)/ε)        (3)

by Proposition E.2. Moreover, we note that for our distance estimate d(u, v) = d(w, u) + d(w, v), w ∈ A^m_l for some m ∈ [t] and l ∈ [k − 1]. Furthermore, w ∈ B(v) as it is a condition for stopping, and w ∈ B(u) by Lemma 4.6. w ∈ B(u) implies d(w, u) < d(u, p_{i+1}(u)) ≤ d(u, A^r_i − {w}) with probability 1 − 1/n^2 by Lemma 4.5, and consequently u ∈ C^m(w). By equivalent logic, v ∈ C^m(w). It follows that, with probability 1 − 1/n^2, for any pair of vertices u, v ∈ V there is some tree T* ∈ T such that d(u, v) = d(w, u) + d(w, v) = d_{T*}(w, u) + d_{T*}(w, v). Hence, by Lemma 4.7,

min_{T∈T} d_T(u, v) ≤ (2k − 1) · d_G(u, v)        (4)

By a union bound, the upper bounds (3) and (4) hold with probability 1 − γ − 1/n^2, and ensure that,

d_G(u, v) − O(k · n^{1/k} · log^{2.5}(n) · log(k) · log(1/γ)/ε) ≤ 𝑑̃(u, v)
≤ (2k − 1) · d_G(u, v) + O(k · n^{1/k} · log^{2.5}(n) · log(k) · log(1/γ)/ε)

Consequently, the algorithm is (2k −1, O(k · n^{1/k} · log^{2.5}(n) · log(k) · log(1/γ)/ε))-accurate, as claimed.

The proof of the following theorem is analogous to the proof of Theorem 4.3, and hence is deferred to Appendix D.

Theorem 4.4. For γ ∈ (0, 0.5], ε, δ ∈ (0, 1], and k ∈ {2, ..., ⌊log(n)/log(2)⌋}, there is an (ε, δ)-DP algorithm for computing all-pairs shortest distances that is (2k − 1, O(√k · n^{1/(2k)} · log^{2.5}(n) · √log(2/δ) · log(k) · log(1/γ)/ε))-accurate with probability 1 − γ − 1/n^2.

Finally, we give a short justification as to why our assumption that k ≤ ⌊log(n)/log(2)⌋ is reasonable. When k = ⌊log(n)/log(2)⌋, both multiplicative and additive errors become O(polylog(n)). As such, further increasing the value of k would only increase the multiplicative error.

In this work, we give an algorithm to release all-pairs shortest distances for general graphs with Õ(n^{1/3}/ε) additive error in the ε-DP setting and Õ(n^{1/4}/ε) additive error in the (ε,δ)-DP setting, which is optimal up to a polylogarithmic factor based on the lower bound of Ω(n^{1/4}/√log n) proven by [BDG+24]. In the case with the added assumption that the edge weights are in (0, M] for some M ∈ ℝ^+, [CGK+23] showed that there is a constant c > 0 such that no (ε,δ)-DP algorithm for APSD can be o(n^c)-accurate, even when M = O(1). That is, one natural open question is whether an algorithm with error O(n^{1/4-Ω(1)}) is possible in the bounded edge weights setting.

Furthermore, we give algorithms on general graphs that have additive error whose polynomial dependence on n beats the known lower bound for purely additive algorithms if one allows a multiplicative approximation. The question remains open that whether an algorithm with an O(1) multiplicative approximation and O(polylog(n)) additive approximation is possible.

This material is based upon work supported by the National Science Foundation Grant CNS-2349369. This work was completed during the UNCG GraLNA 2024 REU, where Jesse Campbell was working under the mentorship of Chunjiang Zhu.

[CL01] B. Chazelle and A. Lvov. A trace bound for the hereditary discrepancy. Discrete & Computational Geometry, 26(2):221–231, 2001.

[CL06] Fan Chung and Linyuan Lu. Concentration inequalities and martingale inequalities: a survey. Internet Mathematics, 3(1):79–127, 2006.

[CSC+24] Bin Cai, Weihong Sheng, Jiajun Chen, Chunqiang Hu, and Jiguo Yu. Shortest paths publishing with differential privacy. IEEE Transactions on Sustainable Computing, 9(2):209–221, 2024.

[CSS11] Hubert Chan, Elaine Shi, and Dawn Song. Private and continual release of statistics. ACM Trans. Inf. Syst. Secur., 14(3), 2011.

[DGUW23] Chengyuan Deng, Jie Gao, Jalaj Upadhyay, and Chen Wang. Differentially private range query on shortest paths. In Pat Morin and Subhash Suri, editors, Algorithms and Data Structures - 18th International Symposium, WADS 2023, Proceedings, pages 340–370, Germany, 2023. Springer Science and Business Media Deutschland GmbH.

[DKY17] Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. Collecting telemetry data privately. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017.

[DL09] Cynthia Dwork and Jing Lei. Differential privacy and robust statistics. In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing, STOC '09, page 371–380, New York, NY, USA, 2009. Association for Computing Machinery.

[DMNS06] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Shai Halevi and Tal Rabin, editors, Theory of Cryptography, pages 265–284, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg.

[DR14] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3–4):211–407, 2014.

[ELRS23] Talya Eden, Quanquan C. Liu, Sofya Raskhodnikova, and Adam Smith. Triangle counting with local edge differential privacy. arXiv preprint, arXiv:2305.02263, 2023.

[EMK23] Javad B. Ebrahimi, Alireza Tofighi Mohammadi, and Fatemeh Kermani. Differentially private all-pairs shortest distances for low tree-width graphs. In 2023 International Symposium on Networks, Computers and Communications (ISNCC), pages 1–6, 2023.

[FL22] Chenglin Fan and Ping Li. Distances release with differential privacy in tree and grid graph. In 2022 IEEE International Symposium on Information Theory (ISIT), pages 2190–2195, 2022.

[FLL22] Chenglin Fan, Ping Li, and Xiaoyun Li. Breaking the linear error barrier in differentially private graph distance release. NeurIPS, 2022.

[FMM19] Andrew David Foote, Ashwin Machanavajjhala, and Kevin McKinney. Releasing earnings distributions using differential privacy: Disclosure avoidance system for post-secondary employment outcomes (pseo). Journal of Privacy and Confidentiality, 9(2), 2019.

[GAP18] Simson L. Garfinkel, John M. Abowd, and Sarah Powazek. Issues encountered deploying differential privacy. In Proceedings of the 2018 Workshop on Privacy in the Electronic Society, WPES'18, page 133–137, New York, NY, USA, 2018. Association for Computing Machinery.

[HCYH24] Calvin Hawkins, Bo Chen, Kasra Yazdani, and Matthew Hale. Node and edge differential privacy for graph laplacian spectra: Mechanisms and scaling laws. IEEE Transactions on Network Science and Engineering, 11(2):1690–1701, 2024.

The proofs presented are slightly modified from [Sea16] and are given for completeness. In particular, in the proof of Lemma 3.2 instead of showing that, with probability 1 − γ, any single released distance is bounded above by some term, we show that with probability 1 − γ, all the released distances are bounded above by some term. We do this by letting the probability of failure for releasing any single distance to be γ/n such that, by a union bound, the total failure probability over all n released distances is γ. This gives a term log (n/γ) in the final bound instead of log (1/γ) as in the original proof. We note that this slightly changes our proof of Corollary 4.1, however it does not affect the final result.

Lemma 3.2. Let T_z = (V, E, w) be a tree with root vertex z ∈ V, ε ∈ (0, 1], and γ ∈ (0, 0.5]. Then there is an ε-DP algorithm for releasing the distance between z and every u ∈ V that is O(log^1.5(n) · log(n/γ)/ε)-accurate with probability 1 − γ.

Proof. Let T_z be the tree rooted at vertex z ∈ V. The algorithm works by splitting the tree into subtrees, each with fewer than n/2 vertices, computing distances between the root and the roots of the subtrees, and then applying the algorithm recursively on each subtree.

It is a well-known result that every tree has either one or two vertices known as centroids such that their removal disconnects the tree into subtrees, each with fewer than n/2 vertices (see, for example, [Wan15]). If T_z has a single centroid, we let z* be that vertex. If T_z has two centroids, we let z* be the centroid that is closer to the root node z. By choosing it in this way, we guarantee that z* is the unique vertex such that the subtree rooted at z* has more than n/2 vertices, but the subtree rooted at each of z*'s children has at most

n/2 vertices. Let z₁, ..., zₜ be the children of z* and Tᵢ = (Vᵢ, Eᵢ), i ∈ {1, ..., t}, their corresponding subtrees. Additionally, we define T₀ to be the subtree rooted at z with vertex set V₀ = V − {V₁, ..., Vₜ}.

Next, we release the distances between z and z*, as well as between z* and each of its children by adding Laplace noise from the distribution Lap(log(n)/ε). In particular, we note that since each tree is disjoint by construction, the function which releases these distances has sensitivity 1. Hence, by Lemma 2.3, releasing each subtree is (ε/ log(n))-DP. Then, we recursively call this algorithm for each subtree until each subtree consists only of a single vertex.

Since each tree has at most n/2 vertices, the maximum recursion depth is bounded by log(n). Hence, by basic composition (Lemma 2.1), since the released distances in our algorithm are a composition of log(n), (ε/ log(n))-DP mechanisms, the total algorithm is ε-DP.

It remains to be shown that the error in each released distance is bounded above by O(polylog(n)). We note that for every u ∈ V, the distance d(z, u) is the composition of released distances from root nodes to centroids, and from centroids to their children. By bounding the number of released distances in the composition, we can bound the total error incurred from each noisy random variable.

We will prove by induction on the number of vertices that the number of released distances used to calculate d(z, u) is bounded above by 2 log(n). Firstly, the base case of n = 1 is vacuously true. Suppose n > 1. In the first iteration of the algorithm, the vertex sets V₀, V₁, ..., Vₜ are a partition of V. Hence, u ∈ Vᵢ for some i ∈ [t]. By the induction hypothesis, we can release the distance from zᵢ to u by the composition of at most 2 log(n/2) = 2 log(n) − 2 noisy distances. Then, we have that d(z, zᵢ) = d(z, z*) + d(z*, zᵢ), giving a total of 2 log(n) noisy distances.

It follows that the error in each released distance is the concatenation of 2 log(n) random variables distributed according to Lap(log(n)/ε). By Lemma 2.4, with probability at most γ/n, we have that the error exceeds O(log¹·⁵(n)·log(n/γ)/ε). Hence, by a union bound, with probability at least 1−γ, the error for any distance from z to a vertex u ∈ V is bounded above by O(log¹·⁵(n)·log(n/γ)/ε), as desired.

**Corollary 4.1.** Let T = (V, E, w) be a tree with ε ∈ (0, 1] and γ ∈ (0, 0.5]. Then there is an ε-DP algorithm for releasing all-pairs distances on T that is O(log¹·⁵(n)·log(n/γ)/ε)-accurate with probability 1 − γ.

**Proof.** Choose a vertex z ∈ V arbitrarily as a root vertex of T, and call the rooted tree T_z. Then, using Lemma 3.2, we can privately release the distance from z to every other vertex in T_z. We will show that these distances suffice to compute the distance for any pair x, y ∈ V of vertices in V.

Let vₓ,ᵧ ∈ V be the lowest common ancestor of x and y in the rooted tree T_z. Then, d_T(x, y) = d_T(x, vₓ,ᵧ) + d_T(vₓ,ᵧ, y) = d_{T_z}(z, x) + d_{T_z}(z, y) − 2d_{T_z}(z, vₓ,ᵧ). By the result in Lemma 3.2, we condition on the event that for all w ∈ V, d(z, w) is O(log¹·⁵(n)·log(n/γ)/ε)-accurate with probability 1 − γ. Since our distance estimate is the sum of four distances from z, the total error is at most four times this, which is still O(log¹·⁵(n)·log(n/γ)/ε).

## B Proof of Theorem 3.2

**Theorem 3.2.** For γ ∈ (0, 0.5] and ε, δ ∈ (0, 1], there is an (ε, δ)-DP algorithm for computing all-pairs shortest distances that is O(n^{1/4}·log²(n)·√log(2/δ)·log(1/γ)/ε)-accurate with probability 1 − γ − 1/n².

**Proof.** The algorithm is the same as Algorithm 1, except we run the ε/(4√2s log(2/δ))-DP algorithm from Lemma 3.2 to release the shortest path distances in each tree. Namely, in Lines 7 and 9 we sample the Laplacian noise from Lap(4√2|S| log(2/δ)·log(n)/ε). By advanced composition (Lemma 2.2), running the s, ε/(4√2s log(2/δ))-DP mechanisms is (ε/2, δ)-DP. By basic composition (Lemma 2.1), running the (ε/2, δ)-DP mechanism and the ε/2-DP input perturbation algorithm is (ε, δ)-DP.

We note that the upper bound for the additive error from distance estimates computed via the input perturbation algorithm is the same as in Theorem 3.1. Furthermore, by Lemma 3.2, with probability 1 − γ/2,

\[
\max_{z∈S, u∈V} |d_G(z, u) - \tilde{d}(z, u)| \leq O(\sqrt{s}· \log^{1.5}(n)· \sqrt{\log(2/δ)}· \log(2sn/γ)/ε)
\]
(5)

We again condition on the event (*) and the bounds (5) and (2) with probability $1 - \gamma - 1/n^2$. Moreover, in Line 1 we choose $s = \sqrt{n}/(\log(n) \cdot \sqrt{\log(2/\delta)})$, and hence the upper bounds (5) and (2) ensure,
\[
\max_{u,v \in V} |d_G(u, v) - d(u, v)| \leq O\left(n^{1/4} \cdot \log^2(n) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\varepsilon\right)
\]
by Proposition E.2.

Theorem 4.2. For any $\gamma \in (0, 0.5]$, $k \in \mathbb{Z}^+$ and $\varepsilon, \delta \in (0, 1]$, there is an $(\varepsilon, \delta)$-DP algorithm to release all-pairs shortest distances that is $(O(k \log \log n), O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\varepsilon))$-accurate with probability $1 - \gamma$.

Proof. The proof is identical to the proof of Theorem 4.1, except we run the $\varepsilon/(2\sqrt{2}(k n^{1/k}) \log(2/\delta))$-DP algorithm from Corollary 4.1 to release APSD for each tree $\mathcal{T} \in \mathbb{T}$. By advanced composition (Lemma 2.2), releasing all the distances is $(\varepsilon, \delta)$-DP. Moreover, the result of Corollary 4.1 ensures that with probability $1-\gamma$,
\[
\max_{u,v \in V} |d_{\mathcal{T}}(u, v) - \tilde{d}_{\mathcal{T}}(u, v)| \leq O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\varepsilon)
\]
by Proposition E.2. By letting $\tilde{d}(u, v) \leftarrow \min_{\mathcal{T} \in \mathbb{T}} \tilde{d}_{\mathcal{T}}(u, v)$, the result in Lemma 4.1 guarantees the total algorithm is $(O(k \log \log n), O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \log(k) \cdot \sqrt{\log(2/\delta)} \cdot \log(1/\gamma)/\varepsilon))$-accurate, as claimed.

Theorem 4.4. For $\gamma \in (0, 0.5]$, $\varepsilon, \delta \in (0, 1]$, and $k \in \{2, ...,\lfloor \log(n)/\log(2) \rfloor \}$, there is an $(\varepsilon, \delta)$-DP algorithm for computing all-pairs shortest distances that is $(2k-1, O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \sqrt{\log(2/\delta)} \cdot \log(k) \cdot \log(1/\gamma)/\varepsilon))$-accurate with probability $1-\gamma-1/n^2$.

Proof. The proof is the same as Theorem 4.3, except we run the $\varepsilon/(2\sqrt{2}(t\cdot k) \cdot \log(2/\delta))$-DP algorithm given by Corollary 4.1 to release private APSD $\tilde{d}_{\mathcal{T}}(u, v)$ for each $\mathcal{T} \in \mathbb{T}$. By advanced composition (Lemma 2.2), releasing the distances is $(\varepsilon, \delta)$-DP. Moreover, by a union bound over all $t \cdot k$ trees, with probability $1-\gamma$,
\[
\max_{u,v \in V} |d_{\mathcal{T}}(u, v) - \tilde{d}_{\mathcal{T}}(u, v)| \leq O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \sqrt{\log(2/\delta)} \cdot \log(k) \cdot \log(1/\gamma)/\varepsilon)
\]
by Proposition E.2. The stretch analysis is the same as in Theorem E.2. Consequently, with probability $1-\gamma-1/n^2$, the algorithm is $(2k-1, O(\sqrt{k} \cdot n^{1/(2k)} \cdot \log^{2.5}(n) \cdot \sqrt{\log(2/\delta)} \cdot \log(k) \cdot \log(1/\gamma)/\varepsilon))$-accurate.

We will make use of the following result several times, and so we prove it here for convenience.

Proposition E.1. For any $x \in (0, 1)$, $n > 0$ and $m \in \mathbb{Z}^+$, we have that,
\[
(1-x)^{mx^{-1} \log(n)} \leq n^{-m}
\]

Proof. First, note that $(1-x)^{mx^{-1} \log(n)} = n^{mx^{-1} \log(1-x)}$. Hence, it suffices to show that $mx^{-1} \log(1-x) \leq -m$. To see this, we let $f(x) = mx^{-1} \log(1-x)$ and note that $\lim_{x\to 0^+} f(x) = -m$, and $f'(x)<0$ for all $x \in (0, 1)$.

Finally, we state some elementary results regarding big-$O$ notation which we will use several times throughout this paper in order to simplify the arguments of our asymptotic upper-bounds.

**Proposition E.2.** Let $\alpha \geq 2$, $\gamma \in (0, 0.5]$, and $\lambda > 0$, then

1. $\log(\alpha^{1+\lambda}/\gamma) = O(\log(\alpha/\gamma))$, and,
2. $\log(\alpha/\gamma) = O(\log(\alpha) \log(1/\gamma))$.

**Proof of 1.** $\log(\alpha^{1+\lambda}/\gamma) = \log((\alpha/\gamma^{1/(1+\lambda)})^{1+\lambda}) = (1+\lambda) \cdot \log(\alpha/\gamma^{1/(1+\lambda)}) \leq (1+\lambda) \cdot \log(\alpha/\gamma) = O(\log(\alpha/\gamma))$.

**Proof of 2.** Suppose the base of our logarithm is $b = \{2, e\}$. Then

$\log(\alpha/\gamma) = \log(\alpha) + \log(1/\gamma) = O(\max\{\log(\alpha), \log(1/\gamma)\}) = O(\log(\alpha) \log(1/\gamma))$

as $\alpha, 1/\gamma \geq 2$.

$\Box$