Toward provably private learning from federated data (research.google)