BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model

TL;DR

This paper introduces BLENDER, a hybrid differential privacy model combining local and curator privacy guarantees, enabling more accurate private search log analysis with high utility on large datasets.

Contribution

It presents a novel blended differential privacy algorithm that improves utility for private search log analysis within a hybrid privacy model.

Findings

Achieves NDCG over 95% on large search datasets

Provides significant utility improvements over existing methods

Supports a flexible privacy-utility trade-off

Abstract

We propose a hybrid model of differential privacy that considers a combination of regular and opt-in users who desire the differential privacy guarantees of the local privacy model and the trusted curator model, respectively. We demonstrate that within this model, it is possible to design a new type of blended algorithm for the task of privately computing the head of a search log. This blended approach provides significant improvements in the utility of obtained data compared to related work while providing users with their desired privacy guarantees. Specifically, on two large search click data sets, comprising 1.75 and 16 GB respectively, our approach attains NDCG values exceeding 95% across a range of privacy budget values.