Heavy Hitters and the Structure of Local Privacy

Bun, Mark; Nelson, Jelani; Stemmer, Uri

doi:10.1145/3196959.3196981

Cited by 105 publications

(144 citation statements)

References 28 publications

Supporting

Mentioning

141

Contrasting

Order By: Relevance

“…We prove our lower bound for sequentially interactive (ε, 0)-locally private protocols. As previous work [9,12] has established that (ε, 0)-and (ε, δ)-local privacy are approximately equivalent for reasonable parameter ranges, our lower bound also holds for sequentially interactive (ε, δ)-locally private protocols. For an extended discussion of this equivalence, see Section 5.1.2.…”

Section: A Lower Bound For Sequentially Interactive Mechanismssupporting

confidence: 71%

“…We now show that the folklore ε-private non-interactive test is optimal amongst all (ε, δ)-private fully interactive tests. First, combining (slightly modified versions of) Theorem 6.1 from Bun et al [9] and Theorem A.1 in Cheu et al [12], we get the following result 5 for j = 0, 1 do…”

Section: A Lower Bound For Arbitrarily Adaptive (ε δ)-Locally Privatmentioning

confidence: 87%

“…Bun et al[9] and Cheu et al[12] prove their results for noninteractive protocols. However, their constructions both rely on replacing a single (ε, δ)-local randomizer call for each user with an (O(ε), 0)-local randomizer call and…”

mentioning

confidence: 88%

See 2 more Smart Citations

The Role of Interactivity in Local Differential Privacy

Joseph

Mao

Neel

et al. 2019

2019 IEEE 60th Annual Symposium on Foundations of Computer Science (FOCS)

View full text Add to dashboard Cite

We study the power of interactivity in local differential privacy. First, we focus on the difference between fully interactive and sequentially interactive protocols. Sequentially interactive protocols may query users adaptively in sequence, but they cannot return to previously queried users. The vast majority of existing lower bounds for local differential privacy apply only to sequentially interactive protocols, and before this paper it was not known whether fully interactive protocols were more powerful.We resolve this question. First, we classify locally private protocols by their compositionality, the multiplicative factor k ≥ 1 by which the sum of a protocol's single-round privacy parameters exceeds its overall privacy guarantee. We then show how to efficiently transform any fully interactive k-compositional protocol into an equivalent sequentially interactive protocol with an O(k) blowup in sample complexity. Next, we show that our reduction is tight by exhibiting a family of problems such that for any k, there is a fully interactive k-compositional protocol which solves the problem, while no sequentially interactive protocol can solve the problem without at least anΩ(k) factor more examples.We then turn our attention to hypothesis testing problems. We show that for a large class of compound hypothesis testing problems -which include all simple hypothesis testing problems as a special case -a simple noninteractive test is optimal among the class of all (possibly fully interactive) tests.

show abstract

Section: A Lower Bound For Sequentially Interactive Mechanismssupporting

confidence: 71%

Section: A Lower Bound For Arbitrarily Adaptive (ε δ)-Locally Privatmentioning

confidence: 87%

See 1 more Smart Citation

The Role of Interactivity in Local Differential Privacy

Joseph

Mao

Neel

et al. 2019

2019 IEEE 60th Annual Symposium on Foundations of Computer Science (FOCS)

View full text Add to dashboard Cite

show abstract

“…The key to Theorem 6.1 is to show that if P S = (R S , S, A S ) is a protocol in the one-message shuffled model satisfying (ε S , δ S )-differential privacy, then the algorithm R S itself satisfies (ε L , δ S )-differential privacy without use of the shuffler S. Therefore, the local protocol P L = (R S , A S • S) is (ε L , δ S )-private in the local model and has the exact same output distribution, and thus the exact same accuracy, as P S . To complete the proof, we use (a slight generalization of) a transformation of Bun, Nelson, and Stemmer [7] to turn R into a related algorithm R satisfying (8(ε S + ln n), 0)-differential privacy with only a slight loss of accuracy. We prove the latter result in Appendix D .…”

Section: Lower Bounds For the Shuffled Modelmentioning

confidence: 99%

Distributed Differential Privacy via Shuffling

Cheu

Smith

Ullman

et al. 2019

Lecture Notes in Computer Science

219

262

View full text Add to dashboard Cite

We consider the problem of designing scalable, robust protocols for computing statistics about sensitive data. Specifically, we look at how best to design differentially private protocols in a distributed setting, where each user holds a private datum. The literature has mostly considered two models: the "central" model, in which a trusted server collects users' data in the clear, which allows greater accuracy; and the "local" model, in which users individually randomize their data, and need not trust the server, but accuracy is limited. Attempts to achieve the accuracy of the central model without a trusted server have so far focused on variants of cryptographic secure function evaluation, which limits scalability.In this paper, we initiate the analytic study of a shuffled model for distributed differentially private algorithms, which lies between the local and central models. This simple-to-implement model, a special case of the ESA framework of Bittau et al. [5], augments the local model with an anonymous channel that randomly permutes a set of user-supplied messages. For sum queries, we show that this model provides the power of the central model while avoiding the need to trust a central server and the complexity of cryptographic secure function evaluation. More generally, we give evidence that the power of the shuffled model lies strictly between those of the central and local models: for a natural restriction of the model, we show that shuffled protocols for a widely studied selection problem require exponentially higher sample complexity than do central-model protocols.

show abstract

“…Finally, for simplicity we state all of our results for pure ε-local privacy. However, for reasonable values of δ (roughly δ = o ε n log(n) ) they easily extend to (ε, δ)-local privacy using the approximateto-pure transformation described by Bun et al [9] and Cheu et al [10].…”

Section: Our Contributionsmentioning

confidence: 99%

Exponential Separations in Local Differential Privacy

Joseph¹,

Mao²,

Roth³

2020

Proceedings of the Fourteenth Annual ACM-SIAM Symposium on Discrete Algorithms

View full text Add to dashboard Cite

We prove a general connection between the communication complexity of two-player games and the sample complexity of their multi-player locally private analogues. We use this connection to prove sample complexity lower bounds for locally differentially private protocols as straightforward corollaries of results from communication complexity. In particular, we 1) use a communication lower bound for the hidden layers problem to prove an exponential sample complexity separation between sequentially and fully interactive locally private protocols, and 2) use a communication lower bound for the pointer chasing problem to prove an exponential sample complexity separation between k-round and (k + 1)-round sequentially interactive locally private protocols, for every k.

show abstract

Heavy Hitters and the Structure of Local Privacy

Cited by 105 publications

References 28 publications

The Role of Interactivity in Local Differential Privacy

The Role of Interactivity in Local Differential Privacy

Distributed Differential Privacy via Shuffling

Exponential Separations in Local Differential Privacy

Contact Info

Product

Resources

About