Abstract Many data analysis operations can be expressed as a GROUP BY query on an unbounded set of partitions, followed by a per-partition aggregation. To make such a query differentially private, adding noise to each aggregation is not enough: we also need to make sure that the set of partitions released is also differentially private. This problem is not new, and it was recently formally introduced as differentially private set union [14]. In this work, we continue this area of study, and focus on the common setting where each user is associated with a single partition. In this setting, we propose a simple, optimal differentially private mechanism that maximizes the number of released partitions. We discuss implementation considerations, as well as the possible extension of this approach to the setting where each user contributes to a fixed, small number of partitions.

We develop two models of highway traffic: (i) a deterministic fluid model based on conservation laws building on previous work and (ii) a mean-field model of a series of infinite server queues, where each stage in the tandem models a segment of highway. The models define the ``highway-map''---a transformation of time-varying arrival rate functions according to which vehicles arrive at the highway to the corresponding departure rate functions of vehicles exiting the highway. The two models are shown to be equivalent in that they obtain the same highway-map. The cost of congestion for vehicles traversing the highway is the total extra time they spend on the highway due to congestion. This cost is shown to be equal to the ``d-bar'' distance between the input and the output rate measures of the highway-map. This fact is used to formulate a convex optimization problem for determining the optimal way to shift users from peak to off-peak hours using incentives so that congestion costs are lowered.