Improving Utility and Security of the Shuffler-based Differential Privacy
arXiv:1908.11515
Abstract
When collecting information, local differential privacy (LDP) alleviates privacy concerns of users because their private information is randomized before being sent it to the central aggregator. LDP imposes large amount of noise as each user executes the randomization independently. To address this issue, recent work introduced an intermediate server with the assumption that this intermediate server does not collude with the aggregator. Under this assumption, less noise can be added to achieve the same privacy guarantee as LDP, thus improving utility for the data collection task. This paper investigates this multiple-party setting of LDP. We analyze the system model and identify potential adversaries. We then make two improvements: a new algorithm that achieves a better privacy-utility tradeoff; and a novel protocol that provides better protection against various attacks. Finally, we perform experiments to compare different methods and demonstrate the benefits of using our proposed method.
References in corpus (11)
- RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
- Geo-Indistinguishability: Differential Privacy for Location-Based Systems
- Prochlo: Strong Privacy for Analytics in the Crowd
- Collecting Telemetry Data Privately
- Protection Against Reconstruction and Its Applications in Private Federated Learning
- Hadamard Response: Estimating Distributions Privately, Efficiently, and with Little Communication
- Scalable and Differentially Private Distributed Aggregation in the Shuffled Model
- Encode, Shuffle, Analyze Privacy Revisited: Formalizations and Empirical Evaluation
- On the Power of Multiple Anonymous Messages
- One-sided Differential Privacy
- Composing Differential Privacy and Secure Computation: A case study on scaling private record linkage