Tight Accounting in the Shuffle Model of Differential Privacy

Antti Koskela, Mikko A. Heikkilä, Antti Honkela

Keywords: Differential Privacy, Shuffle Model, Privacy Accounting, Tight Privacy Bounds

TL;DR: We show how to compute tight privacy bounds for several ubiquitous mechanisms in the shuffle model of differential privacy.

Abstract: Shuffle model of differential privacy is a novel distributed privacy model based on a combination of local privacy mechanisms and a trusted shuffler. It has been shown that the additional randomisation provided by the shuffler improves privacy bounds compared to the purely local mechanisms. Accounting tight bounds, especially for multi-message protocols, is complicated by the complexity brought by the shuffler. The recently proposed Fourier Accountant for evaluating $(\varepsilon,\delta)$-differential privacy guarantees has been shown to give tighter bounds than commonly used methods for non-adaptive compositions of various complex mechanisms. In this paper we show how to compute tight privacy bounds using the Fourier Accountant for multi-message versions of several ubiquitous mechanisms in the shuffle model and demonstrate looseness of the existing bounds in the literature.

Paper Under Submission: The paper is currently under submission at NeurIPS