There has been much recent work in the shuffle model of differential privacy, particularly for approximate d-bin histograms. While these protocols achieve low error, the number of messages sent by each user -- the message complexity -- has so far scaled with d or the privacy parameters. This is problematic for off-the-shelf implementations of the shuffler. Here, we propose a protocol whose message complexity is two when there are sufficiently many users. The protocol essentially pairs each row in the dataset with a fake row and performs a simple randomization on all rows. Experiments on real-world language confirm that the protocol's error is small . We also bound the impact corrupt users have on the estimatesand show that it compares favorably to prior state-of-the-art .
There has been much recent work in the shuffle model of differential privacy, particularly for approximate d-bin histograms. While these protocols achieve low error, the number of messages sent by each user -- the message complexity -- has so far scaled with d or the privacy parameters. The message complexity is an informative predictor of a shuffle protocol's resource consumption. We present a protocol whose message complexity is two when there are sufficiently many users. The protocol essentially pairs each row in the dataset with a fake row and performs a simple randomization on all rows. We show that the error introduced by the protocol is small, using rigorous analysis as well as experiments on real-world data . We also prove that corrupt users have a relatively low impact on our protocol's estimates .
R
This is problematic for off-the-shelf implementations of the shuffler. Here, we propose
The message complexity is an informative predictor of a shuffle protocol's resource consumption. We present
R
Experiments on
We show that the error introduced by the protocol is small, using rigorous analysis as well as experiments on
R
language confirm that the protocol's error is small
data
R
bound the impact
prove that
R
on the estimatesand show that it compares favorably to prior state-of-the-art
a relatively low impact on our protocol's estimates