Distributed Differential Privacy via Shuffling

Abstract

We consider the problem of designing scalable, robust protocols for computing statistics about sensitive data. Specifically, we look at how best to design differentially private protocols in a distributed setting, where each user holds a private datum. The literature has mostly considered two models: the "central" model, in which a trusted server collects users' data in the clear, which allows greater accuracy; and the "local" model, in which users individually randomize their data, and need not trust the server, but accuracy is limited. Attempts to achieve the accuracy of the central model without a trusted server have so far focused on variants of cryptographic secure function evaluation, which limits scalability.In this paper, we initiate the analytic study of a shuffled model for distributed differentially private algorithms, which lies between the local and central models. This simple-to-implement model, a special case of the ESA framework of Bittau et al. [5], augments the local model with an anonymous channel that randomly permutes a set of user-supplied messages. For sum queries, we show that this model provides the power of the central model while avoiding the need to trust a central server and the complexity of cryptographic secure function evaluation. More generally, we give evidence that the power of the shuffled model lies strictly between those of the central and local models: for a natural restriction of the model, we show that shuffled protocols for a widely studied selection problem require exponentially higher sample complexity than do central-model protocols.

The Role of Interactivity in Local Differential Privacy

“…We prove our lower bound for sequentially interactive (ε, 0)-locally private protocols. As previous work [9,12] has established that (ε, 0)-and (ε, δ)-local privacy are approximately equivalent for reasonable parameter ranges, our lower bound also holds for sequentially interactive (ε, δ)-locally private protocols. For an extended discussion of this equivalence, see Section 5.1.2.…”

“…We now show that the folklore ε-private non-interactive test is optimal amongst all (ε, δ)-private fully interactive tests. First, combining (slightly modified versions of) Theorem 6.1 from Bun et al [9] and Theorem A.1 in Cheu et al [12], we get the following result 5 for j = 0, 1 do…”

The Privacy Blanket of the Shuffle Model

“…Together with our upper bound, this result shows that the single-message shuffle model sits strictly between the curator and the local models of differential privacy. This had been shown by Cheu et al [11] in a less direct way by showing that (i) the private selection problem can be solved more accurately in the curator model than the shuffle model, and (ii) the private summation problem can be solved more accurately in the shuffle model than in the local model. For (i) they rely on a generic translation from the shuffle to the local model and known lower bounds for private selection in the local model, while our lower bound operates directly in the shuffle model.…”

“…To see the benefit of creating a privacy blanket, consider the recent shuffle model summation protocol by Cheu et al [11]. This protocol also applies randomized rounding.…”

Exponential Separations in Local Differential Privacy

“…Finally, for simplicity we state all of our results for pure ε-local privacy. However, for reasonable values of δ (roughly δ = o ε n log(n) ) they easily extend to (ε, δ)-local privacy using the approximateto-pure transformation described by Bun et al [9] and Cheu et al [10].…”