## 2 Related Works  
### Privacy Preservation for Key-Value Data  
Differential privacy (DP) was proposed by [PERSON] [10]. DP is a central model that theoretically guarantees the privacy of statistical information publications [11; 12] and machine learning models [13; 14]. [PERSON] et al. proposed LDP [15], which does not require trustworthiness of the collectors. Academic research has been conducted on LDP owing to its stronger privacy guarantees. [PERSON] et al. [16] proposed an LDP protocol for discrete values using randomized response (RR) [17]. [PERSON] et al. proposed an LDP protocol known as RAPPOR [1] using a Bloom filter [18] and RR to improve the estimation accuracy. [PERSON] et al. proposed the LDP protocol stochastic rounding (SR) [19] and [PERSON] et al. proposed the LDP protocol Harmony [20] for continuous values. [PERSON] et al. [21] proposed the piecewise mechanism (PM) and hybrid mechanism to improve the estimation accuracy for continuous values. LDP protocols including PrivKV, PrivKVM [2], PCKV [3], and PrivKVM* [4] have been proposed for key-value data that consist of a combination of discrete and continuous values. In addition, advanced methods have been proposed to improve the estimation accuracy. [PERSON] et al. [22] and [PERSON] et al. [23] proposed a method that applies the EM algorithm [8] and LASSO regression [24] to the LDP protocol RAPPOR. [PERSON] et al. proposed the EM with a smoothing algorithm [25] that applies the EM algorithm to SR and PM. The LDP protocol is vulnerable to poisoning attacks that manipulate the estimated values by intentionally modifying the protocol [26]. Poisoning attacks have been studied for several LDP protocols [5; 6; 27]. [PERSON] et al. [5] evaluated the robustness of discrete-value LDP protocols against poisoning attacks and demonstrated that attackers could increase the estimated frequency of specific target items by injecting fake users into the system. [PERSON] et al. [6] studied the robustness of LDP protocols for key-value data such as PrivKV and PCKV against poisoning attacks. [PERSON] et al. [27] studied targeted poisoning attacks on LDP protocols to estimate the mean and variance of the numerical data. Furthermore, prior works [28; 29; 30] studied poisoning attacks on LDP protocols for specific use cases. [PERSON] et al. [28] investigated poisoning attacks on multidimensional preference data, including both implicit preference data, such as the item list bought by a user, and explicit preference data, such as ranking data over candidates. [PERSON] et al. [29] studied poisoning attacks on LDP protocols for degree estimation in graphs. [PERSON] et al. [30] considered targeted poisoning attacks on LDP protocols for location data estimation. Previous studies [31; 32; 33] investigated poisoning attacks against machine learning models employing DP or LDP. Machine learning models against data poisoning attacks involve the manipulation of a poisoned training dataset to change the models to a desired one. [PERSON] et al. [31] demonstrated that differential private data augmentation can mitigate poisoning attacks. [PERSON] et al. [32] investigated the impact of poisoning attacks on a machine learning model trained using differential private algorithms. [PERSON] et al. [33] investigated the robustness against poisoning attacks in federated learning using DP and LDP. Several simple countermeasures against poisoning attacks on LDP have been proposed in existing studies. [PERSON] et al. [6] developed one-class classification (OCC) [34] using an isolation forest [35] and a method based on an anomaly score for detecting fake users. Similarly, [PERSON] et al. [27] proposed a sampling-then-clustering (STC) method [36] using k-means clustering. [PERSON] et al. [37] proposed an optimization method for setting parameters that are robust against poisoning attacks on LDP.