Scholarlink

<p>Utility-Optimized Local Differential Privacy (ULDP) improves frequency estimation utility by separating sensitive from non-sensitive values, yet a single sensitive scope limits personalization and bandwidth efficiency. We propose Multi-Domain Personalized ULDP (MDPULDP), which partitions the <i>real</i> sensitive domain into disjoint subdomains and lets users choose both a protected scope and a privacy budget. We aggregate heterogeneous reports via align-then-weight: per-scope debiasing, server-side alignment/lifting to the global domain, frequency-weighted averaging, and preserving unbiasedness. We instantiate MDPULDP with Generalized Randomized Response (GRR) and Randomized Aggregatable Privacy-Preserving Ordinal Response (RAPPOR). For both instantiations, we prove <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\((\epsilon ,\delta )\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mo stretchy="false">(</mo> <mi>ϵ</mi> <mo>,</mo> <mi>δ</mi> <mo stretchy="false">)</mo> </mrow> </math></EquationSource> </InlineEquation>-ULDP privacy, unbiasedness, and closed-form variance/Mean Squared Error (MSE) bounds. Under equal privacy budgets and frequency weights, GRR-based MDPULDP never underperforms ULDP (strictly better whenever any subdomain is smaller). In standard ULDP regimes for RAPPOR, MSE decreases as the protected scope shrinks. Communication scales with scope (logarithmically for GRR, linearly for RAPPOR). On Adult, DrugsCom, and synthetic data, MDPULDP consistently reduces MSE and bandwidth compared to strong baselines. Ablations and deployment notes (e.g., mitigating policy-selection leakage) demonstrate its robustness and practicality.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Personalized frequency estimation via multi-domain utility-optimized local differential privacy

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年3月7日

查看全文
  • Yunfei Li,
  • Xiaodong Fu,
  • Li Liu,
  • Jiaman Ding,
  • Wei Peng

摘要

Utility-Optimized Local Differential Privacy (ULDP) improves frequency estimation utility by separating sensitive from non-sensitive values, yet a single sensitive scope limits personalization and bandwidth efficiency. We propose Multi-Domain Personalized ULDP (MDPULDP), which partitions the real sensitive domain into disjoint subdomains and lets users choose both a protected scope and a privacy budget. We aggregate heterogeneous reports via align-then-weight: per-scope debiasing, server-side alignment/lifting to the global domain, frequency-weighted averaging, and preserving unbiasedness. We instantiate MDPULDP with Generalized Randomized Response (GRR) and Randomized Aggregatable Privacy-Preserving Ordinal Response (RAPPOR). For both instantiations, we prove \((\epsilon ,\delta )\) ( ϵ , δ ) -ULDP privacy, unbiasedness, and closed-form variance/Mean Squared Error (MSE) bounds. Under equal privacy budgets and frequency weights, GRR-based MDPULDP never underperforms ULDP (strictly better whenever any subdomain is smaller). In standard ULDP regimes for RAPPOR, MSE decreases as the protected scope shrinks. Communication scales with scope (logarithmically for GRR, linearly for RAPPOR). On Adult, DrugsCom, and synthetic data, MDPULDP consistently reduces MSE and bandwidth compared to strong baselines. Ablations and deployment notes (e.g., mitigating policy-selection leakage) demonstrate its robustness and practicality.