Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity
Calibrating Noise to Sensitivity in Private Data Analysis