Tight Accounting in the Shuffle Model of Differential Privacy

Abstract

Shuffle model of differential privacy is a novel distributed privacy model based on a combination of local privacy mechanisms and a trusted shuffler. It has been shown that the additional randomisation provided by the shuffler improves privacy bounds compared to the purely local mechanisms. Accounting tight bounds, especially for multi-message protocols, is complicated by the complexity brought by the shuffler. The recently proposed Fourier Accountant for evaluating (ε, δ)-differential privacy guarantees has been shown to give tighter bounds than commonly used methods for non-adaptive compositions of various complex mechanisms. In this paper we show how to compute tight privacy bounds using the Fourier Accountant for multi-message versions of several ubiquitous mechanisms in the shuffle model and demonstrate looseness of the existing bounds in the literature.

Shuffled Check-in: Privacy Amplification towards Practical Distributed Learning

“…We first consider binary randomized response within the (subsampled) shuffle model, which has been studied before in [14,21,25,30]. Here, we give the full treatment for completeness.…”

Shuffle Gaussian Mechanism for Differential Privacy

“…A preliminary analysis of the shuffle Gaussian mechanism using the Fourier/numerical accountant [28,37,49] has been performed in [36]. This approach is known to give tight composition in general, but faces the curse of dimensionality; only n 10 (n being the database size) can be evaluated within reasonable accuracy and amount of computation, not suitable for evaluating tasks like distributed learning.…”

“…The shuffle model can be realized in practice through a Trusted Execution Environment (TEE) [8], mix-nets [12], or peer-to-peer protocols [40]. Various aspects of the shuffle model have been investigated in the literature [4,5,13,14,23,24,26,27,29,36].…”

“…However, perhaps due to the difficulty of handling approximate DP mechanisms (particularly in privacy accounting), such as the Gaussian mechanism, the shuffle Gaussian mechanism, and its applications in distributed learning have not been explored in depth [36,39]. Distributed learning in the local or shuffle model is often conducted by utilizing variants of the LDP-SGD algorithm [15,21] in the literature, which is arguably more sophisticated than the Gaussian mechanism.…”

Impact of Sampling on Locally Differentially Private Data Collection

“…ii) Shuffling: Privacy amplification methods have been recently studied a lot involving the shuffle model. If we look to apply shuffling to the LDP data using DE as the local randomizer, that should mean we should have a high level of central differential privacy guarantee using a lower intensity of local noise using the recent advancements and studies for deriving the amplified formal central differential privacy guarantees using shuffling [19,20,21,22]. As the estimators we proposed, both c DE and T , are functions function of the underlying LDP mechanism used -in particular, the obfuscating probability distribution which is dependant on -it is obvious that a higher value of will engender a better bound.…”