# Enhancing User Experience with Visual Controls for Local Differential Privacy
## 4 Proposed Privacy Mechanism
### Setting the Privacy Level  
Our implementation helps to visualize the effect of different values of \(\varepsilon\) on the privatized data with epsilon ranges from 0.01 to 10. As shown in Figure 1, for small \(\varepsilon\) values (high privacy), the privatized data looks very noisy and different from the original data. As \(\varepsilon\) increases, the privatized data starts to resemble the original data (blue curve) more closely, indicating a decrease in privacy but an increase in utility. This visualization helps users understand and select appropriate privacy levels based on their specific requirements for data protection and utility.  
Regarding the Gaussian mechanism and the choice of \(\varepsilon>1\), we acknowledge that \(\varepsilon<1\) is commonly recommended in the differential privacy literature. However, our choice of larger \(\varepsilon\) values is supported by both theoretical and practical considerations: (a) From a theoretical perspective, the Gaussian mechanism provides (\(\varepsilon\), \(\Delta\))-differential privacy guarantees through the interaction of both parameters. The privacy guarantee remains mathematically sound with larger \(\varepsilon\) values when properly accounting for delta. (b) From a practical perspective, real-world implementations have demonstrated the effectiveness of larger \(\varepsilon\) values. For example, [PERSON] et al. [4] showed that RAPPOR [14] achieves \(\varepsilon\)-LDP for \(\varepsilon\approx\) 4.39. Our extensive experiments show that the privacy-utility trade-off remains meaningful with these values.  
We consider different privacy levels (PLs) ranging from 1 to 10, with \(\varepsilon=\frac{1}{PL}\) and \(\delta\) = \(1\times 10^{-5}\). PLs significantly impact category transformations, showing a clear pattern of increasing changes as privacy strengthens. As shown in Table 1, at Level 1 (\(\varepsilon\) = 1.000), only 33.3% of categories change, with \"music\", \"lights\", and \"volume\" typically unchanged. As privacy increases, transformations become more frequent: Level 3 (\(\varepsilon\) = 0.333) shows a 64.3% transformation rate with \"music\" changing to \"volume\", Level 4 (\(\varepsilon\) = 0.250) reaches 68.0% with more pronounced changes like \"music\" to \"heat\", and Level 7 (\(\varepsilon\) = 0.143) peaks at a 73.6% transformation rate with almost all categories changing. This progression shows that adjacent categories in the original mapping are more likely to be interchanged than distant ones, and the probability of change increases non-linearly with the privacy level. The data also indicates that category stability consistently decreases as epsilon values become smaller, reflecting the inherent trade-off between privacy protection and data utility.  
Although our research can measure specific change probabilities (such as action changes ranging from 32.4% to 69.1%), we deliberately excluded these metrics from the user interface for two reasons: First, these probabilities fluctuate with the continuous growth of the dataset, making fixed percentages potentially misleading. Second, users interact with discrete categorical data (specific commands and categories), so presenting continuous probability metrics might create a disconnect between user experience and privacy expectations. Instead, our interface focuses on visualizing the privacy-utility relationship through discrete, practical examples of how commands might change, pro  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Privacy** & **Epsilon** & **Action** & **Category** \\
**Level (PL)** & **(\(\varepsilon=\frac{1}{PL}\))** & **Change Rate** & **Change Rate** \\ \hline
1 & 1.000 & 32.4\% & 33.2\% \\ \hline
3 & 0.333 & 60.2\% & 64.3\% \\ \hline
4 & 0.250 & 63.7\% & 68.0\% \\ \hline
7 & 0.143 & 69.1\% & 73.6\% \\ \hline \hline \end{tabular}
\end{table}
Table 1: Settings for different privacy levels.  
viding users with a more intuitive and relevant understanding of privacy impacts on their voice commands.