Beyond Statistical Estimation: Differentially Private Individual Computation via Shuffling
This work addresses the problem of enabling personalized computations in privacy-preserving systems for users in data-driven applications, representing a foundational advancement beyond incremental improvements.
The paper tackles the limitation of the shuffle model of differential privacy to statistical estimation by introducing Private Individual Computation (PIC), a novel paradigm that supports permutation-equivariant computations for personalized outputs while preserving privacy and achieving privacy amplification through shuffling, with empirical evaluations showing superior utility compared to existing solutions.
In data-driven applications, preserving user privacy while enabling valuable computations remains a critical challenge. Technologies like differential privacy have been pivotal in addressing these concerns. The shuffle model of DP requires no trusted curators and can achieve high utility by leveraging the privacy amplification effect yielded from shuffling. These benefits have led to significant interest in the shuffle model. However, the computation tasks in the shuffle model are limited to statistical estimation, making it inapplicable to real-world scenarios in which each user requires a personalized output. This paper introduces a novel paradigm termed Private Individual Computation (PIC), expanding the shuffle model to support a broader range of permutation-equivariant computations. PIC enables personalized outputs while preserving privacy, and enjoys privacy amplification through shuffling. We propose a concrete protocol that realizes PIC. By using one-time public keys, our protocol enables users to receive their outputs without compromising anonymity, which is essential for privacy amplification. Additionally, we present an optimal randomizer, the Minkowski Response, designed for the PIC model to enhance utility. We formally prove the security and privacy properties of the PIC protocol. Theoretical analysis and empirical evaluations demonstrate PIC's capability in handling non-statistical computation tasks, and the efficacy of PIC and the Minkowski randomizer in achieving superior utility compared to existing solutions.