Abstract:How to achieve distributed differential privacy (DP) without a trusted central party is of great interest in both theory and practice. Recently, the shuffle model has attracted much attention. Unlike the local DP model in which the users send randomized data directly to the data collector/analyzer, in the shuffle model an intermediate untrusted shuffler is introduced to randomly permute the data, which have already been randomized by the users, before they reach the analyzer. The most appealing aspect is that while shuffling does not explicitly add more noise to the data, it can make privacy better. The privacy amplification effect in consequence means the users need to add less noise to the data than in the local DP model, but can achieve the same level of differential privacy. Thus, protocols in the shuffle model can provide better accuracy than those in the local DP model. What looks interesting to us is that the architecture of the shuffle model is similar to private aggregation, which has been studied for more than a decade. In private aggregation, locally randomized user data are aggregated by an intermediate untrusted aggregator. Thus, our question is whether aggregation also exhibits some sort of privacy amplification effect? And if so, how good is this "aggregation model" in comparison with the shuffle model. We conducted the first comparative study between the two, covering privacy amplification, functionalities, protocol accuracy, and practicality. The results as yet suggest that the new shuffle model does not have obvious advantages over the old aggregation model. On the contrary, protocols in the aggregation model outperform those in the shuffle model, sometimes significantly, in many aspects.

Privacy Preserving Distributed Permutation Test

Privacy Preserving Distributed DBSCAN Clustering

Differentially Private Permutation Tests: Applications to Kernel Methods

Towards Secure and Practical Machine Learning Via Secret Sharing and Random Permutation

Privacy preserving sort algorithm

A Privacy Preserving Outlier Detection Algorithm Based on Connected Domain

Privacy Preserving Distributed Classification: A Satisfaction Equilibrium Approach

Data Level Privacy Preserving: A Stochastic Perturbation Approach based on Differential Privacy

Permutation Anonymization: Improving Anatomy for Privacy Preservation in Data Publication

Privacy-Preserving Genetic Relatedness Test

PEM: A Practical Differentially Private System for Large-Scale Cross-Institutional Data Mining.

Double-Private Distributed Estimation Algorithm Using Differential Privacy and a Key-Like Proportionate Matrix with Its Performance Analysis

Privacy Preserving ID3 Algorithm over Horizontally Partitioned Data

Privacy-Accuracy Trade-Off in Differentially-Private Distributed Classification: A Game Theoretical Approach

Differentially Private Hypothesis Testing, Revisited.

Majority Vote for Distributed Differentially Private Sign Selection

Privacy-Accuracy Trade-Off in Distributed Data Mining

Revisiting Differentially Private Hypothesis Tests for Categorical Data

Secure Two-Party Frequent Itemset Mining with Guaranteeing Differential Privacy

Differentially private data release through multidimensional partitioning

Distributed Differential Privacy via Shuffling Versus Aggregation: A Curious Study