BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model
A firm foundation for private data analysis