Separating Local & Shuffled Differential Privacy via Histograms

TL;DR

This paper introduces a histogram estimation protocol in the shuffled differential privacy model that achieves error independent of domain size, highlighting a significant sample complexity gap from the local model.

Contribution

It demonstrates a protocol with domain-size-independent error in the shuffled model, contrasting with local model limitations, and clarifies the models' equivalence under pure differential privacy.

Findings

Histogram error is independent of domain size in the shuffled model.

Large sample complexity gap exists between shuffled and local models.

Models are equivalent under pure differential privacy constraints.

Abstract

Recent work in differential privacy has highlighted the shuffled model as a promising avenue to compute accurate statistics while keeping raw data in users' hands. We present a protocol in this model that estimates histograms with error independent of the domain size. This implies an arbitrarily large gap in sample complexity between the shuffled and local models. On the other hand, the models are equivalent when we impose the constraints of pure differential privacy and single-message randomizers.