## 6 Conclusions  
We have studied the privacy preservation of key-value data using the LDP algorithm PrivKV. Our proposed emPrivKV scheme uses the OT protocol to prevent the intentional sampling of target keys and uses the EM algorithm for estimation. This improves the accuracy of statistical information estimation from randomized data. In our experiments using the MovieLens dataset, the MSE of the estimated frequencies and mean values improved by 0.5% and 0.2% of that of PrivKV, respectively, where \(\epsilon\) was 0.1. In addition, the frequency and mean of the keys were robust against fake data poisoning attacks. Our proposed emPrivKV improved the frequency and mean gains by 17.1% and 25.9% of those of PrivKV, respectively, where the number of fake users was 0.1 of genuine users, when using the MovieLens dataset.  
The main future challenges raised in this paper can be summarized as follows. First, the robustness of poisoning attacks on machine learning models depends on the dataset [44]. We plan to conduct comprehensive experiments using multiple datasets to evaluate the  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **PrivKV [2]** & **PrivKVM [2]** & **[PERSON] et al. [6]** & \
\begin{tabular}{c} **Proposed** \\ **Method** \\ \end{tabular} \\ \hline Defense method & N/A & N/A & OCC & OT \\ Estimation & MLE & MLE & MLE & EM \\
\begin{tabular}{c} Frequency gain \\ \end{tabular} & 2.5 & 2.5 & – & 0.4 \\ Mean gain & 10.5 & 30.2 & – & 2.9 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Comparison with previous research, where fake users are 0.1 of genuine users.  
robustness. Second, the computational resources for users are generally limited [45], and it is necessary to explore an effective method against poisoning attacks with less computational overhead. Finally, it is challenging to set an appropriate level of protection for sensitive data [46]. In our results, as we collect data more privately, our protocol tends to become more vulnerable to poisoning attacks. From the perspective of both privacy and security against poisoning attacks, it is essential to determine the proper levels of protection.  
Conceptualization, H.H. and H.K.; Methodology, H.H., H.K. and C.-M.Y.; Software, H.H.; Investigation, H.H.; Resources, H.K. and M.F.; Data curation, H.H.; Writing--original draft, H.H. and H.K.; Writing--review & editing, H.K., M.F. and C.-M.Y.; Visualization, H.H.; Supervision, H.K. and M.F.; Project administration, H.H. and M.F.; Funding acquisition, H.K. All authors have read and agreed to the published version of the manuscript.  
Part of this work was supported by JSPS KAKENHI Grant Number JP18H04099, JP23K11110 and JST, CREST Grant Number JPMJCR21M1, Japan.  
Not applicable.  
Publicly available datasets were analyzed in this study. This data can be found at [[https://grouplens.org/datasets/movielens/](https://grouplens.org/datasets/movielens/)]([https://grouplens.org/datasets/movielens/](https://grouplens.org/datasets/movielens/)) and [[https://www.kaggle.com/datasets/rmisra/clothing-fit-dataset-for-size-recommendation/](https://www.kaggle.com/datasets/rmisra/clothing-fit-dataset-for-size-recommendation/)]([https://www.kaggle.com/datasets/rmisra/clothing-fit-dataset-for-size-recommendation/](https://www.kaggle.com/datasets/rmisra/clothing-fit-dataset-for-size-recommendation/)).  
Authors [PERSON] and [PERSON] were employed by the company Mitsubishi Electric Corporation. The remaining authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.