Privacy Amplification via Shuffled Check-Ins

TL;DR

This paper introduces a privacy-preserving distributed computation protocol called shuffled check-in, which enhances privacy guarantees through novel analysis and allows independent client participation without server-initiated subsampling.

Contribution

It presents a new shuffled check-in protocol with strong privacy guarantees, a R{é}nyi differential privacy analysis, and a numerical method for privacy tracking of shuffling mechanisms.

Findings

Achieves tight privacy amplification guarantees.

Introduces a numerical approach for privacy tracking.

Demonstrates efficacy through empirical studies.

Abstract

We study a protocol for distributed computation called shuffled check-in, which achieves strong privacy guarantees without requiring any further trust assumptions beyond a trusted shuffler. Unlike most existing work, shuffled check-in allows clients to make independent and random decisions to participate in the computation, removing the need for server-initiated subsampling. Leveraging differential privacy, we show that shuffled check-in achieves tight privacy guarantees through privacy amplification, with a novel analysis based on R{\'e}nyi differential privacy that improves privacy accounting over existing work. We also introduce a numerical approach to track the privacy of generic shuffling mechanisms, including Gaussian mechanism, which is the first evaluation of a generic mechanism under the distributed setting within the local/shuffle model in the literature. Empirical studies are also given to demonstrate the efficacy of the proposed approach.