The Role of Interactivity in Local Differential Privacy

Joseph, Matthew; Mao, Jieming; Neel, Seth; Roth, Aaron

doi:10.1109/focs.2019.00015

Cited by 45 publications

(68 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We believe that the notion of the privacy blanket is of interest beyond the shuffle model, as it leads to a canonical decomposition of local randomizers that might be useful also in the study of the local model of differential privacy. For example, Joseph et al [19] already used a generalization of our blanket decomposition in their study of the role of interactivity in local DP protocols. [24] Apple's Differential Privacy Team.…”

Section: Resultsmentioning

confidence: 99%

The Privacy Blanket of the Shuffle Model

Balle

Bell

Gascón

et al. 2019

Lecture Notes in Computer Science

168

227

View full text Add to dashboard Cite

This work studies differential privacy in the context of the recently proposed shuffle model. Unlike in the local model, where the server collecting privatized data from users can track back an input to a specific user, in the shuffle model users submit their privatized inputs to a server anonymously. This setup yields a trust model which sits in between the classical curator and local models for differential privacy. The shuffle model is the core idea in the Encode, Shuffle, Analyze (ESA) model introduced by Bittau et al. (SOPS 2017). Recent work by Cheu et al. (EUROCRYPT 2019) analyzes the differential privacy properties of the shuffle model and shows that in some cases shuffled protocols provide strictly better accuracy than local protocols. Additionally, Erlingsson et al. (SODA 2019) provide a privacy amplification bound quantifying the level of curator differential privacy achieved by the shuffle model in terms of the local differential privacy of the randomizer used by each user.In this context, we make three contributions. First, we provide an optimal single message protocol for summation of real numbers in the shuffle model. Our protocol is very simple and has better accuracy and communication than the protocols for this same problem proposed by Cheu et al. Optimality of this protocol follows from our second contribution, a new lower bound for the accuracy of private protocols for summation of real numbers in the shuffle model. The third contribution is a new amplification bound for analyzing the privacy of protocols in the shuffle model in terms of the privacy provided by the corresponding local randomizer. Our amplification bound generalizes the results by Erlingsson et al. to a wider range of parameters, and provides a whole family of methods to analyze privacy amplification in the shuffle model. * The Alan Turing Institute. jbell@posteo.net.

show abstract

Section: Resultsmentioning

confidence: 99%

The Privacy Blanket of the Shuffle Model

Balle

Bell

Gascón

et al. 2019

Lecture Notes in Computer Science

168

227

View full text Add to dashboard Cite

show abstract

“…Joseph et al [19] characterized the relationship between the sample complexity of fully interactive and sequentially interactive locally private protocols in terms of a parameter called "compositionality", providing the first separations between full and sequential interactivity. While this characterization is tight in terms of the compositionality parameter, their lower bound viewed as a function of n only shows a sample complexity gap on the order of Ω( √ n) between the two models.…”

Section: Related Workmentioning

confidence: 99%

“…Any computation occurs on privatized outputs from each of the n individuals, and the private computation becomes a public interaction between users. Accordingly, we imitate the interactive transcript-based framework of Joseph et al [19] and view the computation as an interaction between the n individuals that is coordinated by a protocol A. In each round of this interaction, the protocol A observes the transcript of interactions so far and selects a set of users and randomizers.…”

Section: Differential Privacymentioning

confidence: 99%

“…Note that an implication of [19] is that any fully interactive protocol that uses r local randomizer calls per user can be converted into a sequentially interactive protocol with an O(r) factor blowup in sample complexity. Consequently, it is necessary that any protocol witnessing an exponential separation between the sample complexities of fully and sequentially interactive protocols must make at least exponentially many queries per user.…”

Section: Fully Interactive Upper Bound For Hlmentioning

confidence: 99%

“…It is known that there are problems that require exponentially larger sample complexity in noninteractive protocols than sequentially interactive protocols [20]. Before our work, however, only polynomial separations were known between sequentially and fully interactive protocols [19], and it was conjectured that the power of these two models was indeed polynomially related.…”

Section: Introductionmentioning

confidence: 98%

See 2 more Smart Citations

Exponential Separations in Local Differential Privacy

Joseph¹,

Mao²,

Roth³

2020

Proceedings of the Fourteenth Annual ACM-SIAM Symposium on Discrete Algorithms

Self Cite

View full text Add to dashboard Cite

We prove a general connection between the communication complexity of two-player games and the sample complexity of their multi-player locally private analogues. We use this connection to prove sample complexity lower bounds for locally differentially private protocols as straightforward corollaries of results from communication complexity. In particular, we 1) use a communication lower bound for the hidden layers problem to prove an exponential sample complexity separation between sequentially and fully interactive locally private protocols, and 2) use a communication lower bound for the pointer chasing problem to prove an exponential sample complexity separation between k-round and (k + 1)-round sequentially interactive locally private protocols, for every k.

show abstract