Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity
Differential Privacy