Mitigating Data Poisoning Attacks to Local Differential Privacy

Boyang Wang; Ninghui Li; Wenhai Sun; Xiaolin Li

REVIEW 4 major objections 4 minor 29 references

Mitigating Data Poisoning Attacks to Local Differential Privacy

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that data-poisoning attacks on local differential privacy frequency estimation can be detected and neutralized using only the statistical fingerprints of honest report structure, with no attack information or extra data.

desk verdict A practical LDP poisoning-defense package with a steep detection-accuracy gain; the zero-shot claim needs a pinch of salt because the key hyperparameters are hand-set, but the core contribution is sound. read the letter →

arxiv 2506.02156 v2 pith:DKDI2N6W submitted 2025-06-02 cs.CR

Xiaolin Li , Ninghui Li , Boyang Wang , Wenhai Sun This is my paper

classification cs.CR

keywords localdifferentialprivacydatapoisoningattacksfrequencyestimationmalicioususerdetectionattackpatternLDPpost-processingrobustsegmentnormalizationitemgainratio

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Local differential privacy protects individual reports by randomizing them, and that same randomization lets a small number of malicious users inject crafted reports that shift estimated frequencies. This paper argues that such poisoning can be detected and repaired using only the reports already collected and the known protocol parameters, with no information about the attacker or the underlying data. It proposes two zero-shot detectors: Diffstats, which flags fake users by comparing the observed distribution of report weight (the number of items a report supports) against the binomial expectation of honest reports, and ASD, which catches stealthy attacks by checking whether the sum of the largest perturbed item counts exceeds the total number of users beyond a confidence threshold. It then adds robust segment normalization (RSN), a post-processing step that restores utility by adjusting only low-frequency estimates while preserving high-frequency values. If these claims are right, LDP deployments can strip out poisoned reports and recover most lost data quality at a small computational cost.

What carries the argument

The load-bearing object is the report-weight distribution: for each CFO, the number of items a genuine user's perturbed report supports (one-bits in OUE, hash-support size in OLH, ones in the public vector in HST) is modeled as $\mathrm{Binomial}(d,\tilde p)$, with $\tilde p=(p+(d-1)q)/d$ for OUE, $1/g$ for OLH, and $1/2$ for HST. Diffstats compares observed counts against the expected counts $Y_k=nP(X=k)$ and uses the chi-square statistic as the frequency-discrepancy measure; a candidate fake-user set is refined by checking which subsets of users minimize $E_{freq}$ over the clean remainder. ASD is carried by the normal approximation $\tilde C_i\sim N(n f_i,\sigma_i^2)$ and the threshold $\xi(\gamma)=Z(\gamma)\sqrt{n q(1-q)/(p-q)^2}$; the deciding condition is $\sum_{\tilde C_i\in A}\tilde C_i>n$, where $A$ is the set of items above $\xi$, with the confidence $\gamma$ chosen so that the expected misclassification error stays below $\lambda n$. RSN's mechanism is segment-wise normalization: find the low-count region $L$ where estimates can become negative, add an offset $\Delta$ there so all estimates are non-negative, keep high-frequency estimates unchanged, and then scale multiplicatively to enforce consistency (non-negative and summing to one).

What would settle it

Run the released detection code, without re-tuning hyperparameters, on a deployment where honest clients' report weight is shifted by a deliberate client bug (for example, every honest client always emits one extra one-bit, so the weight distribution is $1+\mathrm{Binomial}(d-1,q)$ instead of $\mathrm{Binomial}(d,\tilde p)$); if Diffstats's F1 or ASD's accuracy collapses below the paper's reported ranges, the parametric honest-behavior model is load-bearing. A complementary test is a small domain ($d=10$) with $\epsilon=1$ and $r'=2$, where the paper's own analysis predicts degraded detection, and the observed drop would quantify the boundary of the method.

Watch

Extended reading notes

Core claim

At the core is the claim that each categorical frequency oracle leaves a computable statistical signature for honest users, and poisoning attacks distort that signature unless the attacker perfectly mirrors the honest random process. For OUE, the number of one-bits in an honest report is approximated by $\mathrm{Binomial}(d, (p+(d-1)q)/d)$; for OLH the support size follows $\mathrm{Binomial}(d, 1/g)$; for HST it follows $\mathrm{Binomial}(d, 1/2)$. Diffstats computes the discrepancy between observed counts $O_k$ and these expected counts $Y_k$, using $E_{sq}(k)=(O_k-Y_k)^2$ and the chi-square statistic $E_{freq}=\sum_k (O_k-Y_k)^2/Y_k$, then inspects the common-support set of the top-$L$ items to isolate fake users. The paper shows theoretically that MGA and MGA-A errors grow quadratically with the number of fake users, which is what makes them detectable. When the attacker tunes its report weights to match honest probabilities, a new adaptive pattern attack (APA) defeats fake-user detection, but a second detector, ASD, still recognizes the attack by approximating each perturbed item count as $\tilde C_i\sim N(n f_i,\sigma_i^2)$ and testing whether the sum of the high counts exceeds $n$ with a confidence-controlled threshold $\xi(\gamma)$. The paper reports near-perfect accuracy for ASD against APA and against GRR-based MGA/MGA-A, where report-level detection is impossible. Finally, robust segment normalization identifies the low-count region where negative estimates arise, adds a single offset there, keeps high-frequency estimates unchanged, and rescales multiplicatively, achieving the best MSE in most settings while preserving more high-frequency items.

Load-bearing premise

Both detectors depend on the server's model of honest behavior: if genuine users' report formats deviate from the assumed binomial or normal distributions (due to client bugs, differing privacy budgets, small domains, or correlated data), the claimed zero-shot accuracy cannot be expected to transfer without re-tuning the manual hyperparameters.

Editorial extensions

If this is right

Diffstats identifies fake users under MGA and MGA-A with F1 scores above 0.8 in most tested settings, compared with below 0.4 for FIAD, and it remains effective in adaptive MGA settings where FIAD fails.
ASD detects the adaptive pattern attack and MGA/MGA-A on GRR with accuracy at or near 100% in almost all tested configurations, and it runs in under one second, making real-time attack screening feasible.
Robust segment normalization yields the lowest MSE among the compared post-processors on clean data and on data cleaned by attack detection, and it preserves more high-frequency items than Norm-Sub and LDPRecover at comparable MSE.
The consistency condition, not attack-specific estimation, is the dominant factor in recovering corrupted utility; LDPRecover offers little gain over simpler consistency-based methods, and Normalization is not adaptive to the data or protocol.
The new item gain ratio (IGR) metric gives a protocol-independent, per-fake-user and per-target-item measure of attack recovery, which allows meaningful comparison of defenses across different LDP protocols and attack strengths.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension, not tested in the paper, is to apply the differential-statistics idea to other LDP mechanisms with known perturbation distributions, such as numerical mechanisms or multidimensional collection, where the expected report structure is computable.
The paper's evidence that consistency dominates attack recovery suggests that simple consistency post-processing may be a cheap first defense before deploying attack-specific estimators; this goes beyond the experiments because the paper only compares existing methods and RSN.
The zero-shot claim would be stress-tested by non-protocol-conforming clients: a client bug that changes the honest report-weight distribution would violate the binomial model and likely degrade detection without re-tuning the hyperparameters $L=6$ and $\lambda=0.02$.
Because ASD costs under a second, it could plausibly be run repeatedly over sliding windows to catch slow, evolving poisoning campaigns, though the paper does not evaluate streaming or time-varying attacks.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. First, it is one of the more complete mitigation packages for LDP poisoning to date: a new attack, two detectors, a recovery method, a new metric, and a public codebase. Second, the "zero-shot" label is doing more work than the evidence supports. The authors fix L=6 and lambda=0.02 by hand and never test sensitivity, so the claim that detection requires no attack knowledge is true in spirit but not as clean as advertised.

What is genuinely new: the APA attack, which hides by matching the distribution of support counts, though the paper honestly reports that Diffstats gets F1=0 against it and ASD picks up the slack; the extension of MGA to OLH-Server and HST; Diffstats, a chi-square goodness-of-fit detector that is orders of magnitude faster than FIAD and clearly better in the user settings; ASD as a complementary detector for stealthy attacks and GRR; and RSN post-processing plus the IGR metric for attack suppression. The theoretical analysis (Theorems 4.1-4.6) is standard approximation work but internally consistent, and invoking the Ehm bound for the Poisson-binomial-to-binomial step is a nice touch. The code is on GitHub, which makes the experiments reproducible in principle.

Soft spots, in proportion: the ASD evaluation uses 40 instances total, and the 95% CIs at small beta are wide (e.g., 0.53 [0.36,0.68] for HST-User at beta=1%), so the near-100% accuracy claims rest on a fairly small sample. The hyperparameters L and lambda appear once, in Section 5.1, with no sensitivity analysis; the zero-shot claim would be easier to defend if they showed performance across a grid of these values, especially for domain sizes outside the 296-1496 range tested. Recovery comparisons (Section 6.2) are averages of 10 trials without error bars, so the differences between Norm-Sub, LDPRecover, and RSN are less crisp than the prose suggests. Model misspecification of the binomial/normal assumptions under heterogeneous privacy budgets or non-uniform hashing is a genuine risk, though the paper does discuss domain-size effects and is honest about the degraded performance in server settings. None of these flaws is fatal; they are the usual gap between a usable defense and a fully characterized one.

This paper is for people building or analyzing LDP aggregation pipelines in hostile environments. It will not change how LDP is understood conceptually, but it gives practitioners concrete tools with real empirical advantages over the previous state of the art. It deserves a serious referee; I would ask for sensitivity analysis on the hyperparameters, more ASD trials, and error bars on recovery before accepting, but the core contribution is solid and the authors deserve credit for reporting the F1=0 case against APA rather than hiding it.

Referee Report

4 major / 4 minor

Summary. The paper proposes a mitigation framework for data poisoning attacks on local differential privacy (LDP) frequency estimation. It introduces a new attack (adaptive pattern attack, APA), two detection methods (Diffstats for fake-user detection and ASD for abnormal statistics detection), and a new post-processing method (robust segment normalization, RSN). The detection methods are claimed to be zero-shot, requiring no attack-specific information. Experiments on one synthetic and two real datasets report high F1 scores for Diffstats against MGA/MGA-A, high detection accuracy for ASD, and improved MSE for RSN compared to prior post-processing approaches. The paper also proposes a new metric (IGR) for comparing attack suppression across methods.

Significance. If the empirical claims hold, this is a substantial contribution to LDP security: it addresses an under-explored defense problem with lightweight, practical methods, and it ships open-source code. The theoretical analysis in Theorems 4.1–4.6 provides explicit performance expressions, and the new APA attack and IGR metric are useful additions to the literature. However, the evidence for the zero-shot and near-100% accuracy claims is incomplete because the methods depend on manually chosen hyperparameters and on exact parametric models of honest-user behavior, and because some experimental results omit variance information.

major comments (4)

[5.1; Algorithm 1; 4.2.1] The detection methods rely on manually fixed hyperparameters, L=6 for the top-L supported items in Diffstats (Algorithm 1) and lambda=0.02 for the ASD error threshold (Section 4.2.1), yet no sensitivity analysis is provided. Since the paper describes both methods as zero-shot (Section 1), the absence of evidence that performance is stable over a range of L and lambda leaves open the possibility that the reported F1 and accuracy values are tied to dataset-specific tuning. Please report F1 and accuracy as functions of these hyperparameters, or justify the fixed values from first principles.
[4.1.1; 4.2.1] Diffstats computes the expected distribution Y_k from a binomial model X ~ B(d, (p+(d-1)q)/d) for OUE and analogous models for OLH and HST, and ASD assumes perturbed counts follow C_i ~ N(n f_i, sigma_i^2). These models presume a homogeneous privacy budget, perfectly uniform hash families/public vectors, and sufficiently large domain sizes for the Poisson-binomial approximation to be accurate. The zero-shot claim depends on these assumptions, but the paper provides no misspecification analysis, e.g., for users with heterogeneous epsilon values or for small domains where the approximation is loose. Please quantify how F1 and ASD accuracy degrade under such perturbations, or explicitly narrow the zero-shot claim to the homogeneous, large-domain setting.
[5.3; Table 2] Table 2 shows that at beta=1%, ASD achieves accuracy 0.50 for OUE, OLH-User, and HST-User on emoji, and 0.50, 0.65, and 0.53 on fire for the three protocols; these values are at or near chance for the 40-instance evaluation. This contradicts the statement in Section 5.3 that 'our ASD can effectively detect the APA attack with various epsilon irrespective of the underlying LDP protocols.' The claim should be scoped to beta >= 5% for these datasets, and the failure at small beta should be discussed in the context of attack strength and detection limits.
[6.2; Figures 4-6] The recovery experiments are reported as averages of 10 trials without confidence intervals, error bars, or significance tests, even though MSE spans several orders of magnitude. The recommendation that RSN is preferred (Section 6.2.3) rests on comparisons where some curves are close, e.g., under APA on zipf in Figure 5. Without a measure of variance, the reader cannot determine whether the observed MSE differences are meaningful. Please add error bars or statistical tests, and clarify which pairwise differences are significant.

minor comments (4)

[4.1.1] 'malicous' should be 'malicious'.
[Figure 3 legend] 'HSTS-Server' should be 'HST-Server'.
[5.1] The use of r'=4 as a default for APA is confusing, because APA is defined via omega[k] rather than a subset size r'; please clarify the role of r' in APA.
[4.1.3] The computational cost of enumerating all combinations P(S_L) is not discussed; a brief statement on complexity would help, especially since L=6 is a fixed choice.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: detection baselines are derived from the LDP protocols' own null distributions, the new attack is used only as an evaluation adversary, and no results are fitted from the defended metrics.

full rationale

The central claims are self-contained. Diffstats computes Y_k = n·P(X=k) from the protocol parameters (e.g., OUE: X∼B(d,(p+(d−1)q)/d); OLH: B(d,1/g); HST: B(d,1/2)) and flags deviations; the theorems (4.1–4.5) analyze the expected deviation under attacks using that same null model, but they do not feed attack labels back into the detector. ASD derives ξ(γ) from the normal approximation of per-item counts for zero-frequency items and uses the aggregate condition Σ_{C_i in A} C_i > n; the threshold is a standard confidence bound, with λ=0.02 fixed rather than fitted to maximize reported accuracy. RSN is a post-processing heuristic evaluated against external baselines (Norm-Sub, Base-Cut, LDPRecover). The paper's self-citations ([23], [15], [26]) are to protocol primitives and prior consistency/post-processing work; they are not invoked as uniqueness theorems or as substitutes for the derivation. The acknowledged failure F1=0 against the optimal APA (Section 5.2) and the admitted difficulty of computing E_rr exactly (Appendix G) are limitations on the zero-shot claim, not evidence that any prediction is equivalent to its inputs. The manually chosen L=6 and λ=0.02 lack sensitivity analysis, which is a transferability/robustness concern rather than circularity.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No new physical or synthetic entities are introduced. The main load-bearing inputs are the parametric models of honest report behavior, the threat-model assumptions, and the hand-chosen hyperparameters L and lambda. These are reasonable but not fully validated across all LDP settings.

free parameters (3)

L (top-L supported items) = 6
Number of top supported items used in Diffstats to form candidate sets; set as default in Section 5.1 with no sensitivity analysis, so it may be tuned to the evaluated datasets.
lambda (ASD error threshold) = 0.02
Controls the error bound in ASD's optimization for choosing gamma; set in Section 5.1 without a systematic search.
sigma multiple in RSN = 2
RSN defines the low-frequency region using n*f_i - 2*sigma_i = 0; the factor 2 is a heuristic choice analogous to a 95% confidence bound, not derived from the attack model.

assumptions (5)

domain assumption The number of '1' bits in an honest report follows a Poisson binomial distribution that is well approximated by a binomial distribution using only LDP parameters and the domain size.
Section 4.1.1 uses this to compute expected frequencies Y_k for Diffstats; the approximation error is bounded by Ehm's result but the bound is not evaluated for all protocol settings.
standard math Per-item perturbed counts C_i follow a normal distribution N(n*f_i, sigma_i^2) as per prior work [23].
Section 4.2.1 builds the ASD threshold on this; the approximation improves with n but the paper does not quantify the error for the evaluated dataset sizes.
domain assumption The server knows the exact LDP parameters (epsilon, n, d) and all honest users follow the protocol correctly.
Threat model in Section 3.1; if users deviate due to client bugs or heterogenous privacy budgets, the baselines in Y_k and the ASD threshold would be mis-calibrated.
domain assumption The attacker's capability is limited to controlling a fraction beta of users and crafting arbitrary output-domain values, as in prior work [5,14].
Section 3.1; the defenses are not evaluated against attacks that can coordinate with a subset of the server or manipulate the public randomness.
standard math The sum of true item counts never exceeds n, by construction of categorical frequency estimation.
Used as the invariant behind ASD's detection condition in Section 4.2.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Mitigating Data Poisoning Attacks to Local Differential Privacy." pith.science (2026). https://pith.science/paper/DKDI2N6W

@misc{pith2026250602156,
  author       = {Pith},
  title        = {Pith review of: Mitigating Data Poisoning Attacks to Local Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DKDI2N6W}},
  note         = {Machine review of arXiv:2506.02156}
}

read the original abstract

The distributed nature of local differential privacy (LDP) invites data poisoning attacks and poses unforeseen threats to the underlying LDP-supported applications. In this paper, we propose a comprehensive mitigation framework for popular frequency estimation, which contains a suite of novel defenses, including malicious user detection, attack pattern recognition, and damaged utility recovery. In addition to existing attacks, we explore new adaptive adversarial activities for our mitigation design. For detection, we present a new method to precisely identify bogus reports and thus LDP aggregation can be performed over the ``clean'' data. When the attack behavior becomes stealthy and direct filtering out malicious users is difficult, we further propose a detection that can effectively recognize hidden adversarial patterns, thus facilitating the decision-making of service providers. These detection methods require no additional data and attack information and incur minimal computational cost. Our experiment demonstrates their excellent performance and substantial improvement over previous work in various settings. In addition, we conduct an empirical analysis of LDP post-processing for corrupted data recovery and propose a new post-processing method, through which we reveal new insights into protocol recommendations in practice and key design principles for future research.

Figures

Figures reproduced from arXiv: 2506.02156 by the authors.

**Figure 1.** Mitigation workflow for data poisoning attacks on LDP [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

**Figure 2.** Performance comparison between the proposed [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Figures from the paper (9 more)

**Figure 3.** Figure 3: Performance comparison between the proposed [PITH_FULL_IMAGE:figures/full_fig_p010_3.png]

**Figure 4.** Figure 4: Utility boost of different post-processing methods without attack. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]

**Figure 5.** Figure 5: Utility recoverability of different post-processing methods under APA attack on OUE. [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: Utility recoverability of different post-processing methods under MGA and MGA-A on GRR in zipf. [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: Comparison of histograms after Norm-Sub, LDPRecover, and RSN. The target item frequencies are highlighted in red. [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]

**Figure 8.** Figure 8: Utility recoverability of different post-processing methods under APA attack on OLH-User. [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

**Figure 9.** Figure 9: Utility recoverability of different post-processing methods under APA attack on HST-User. [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]

**Figure 10.** Figure 10: IGR for different post-processing methods under MGA and MGA-A attacks on GRR with emoji and fire. [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

**Figure 11.** Figure 11: MSE for different post-processing methods under MGA and MGA-A attacks on GRR with emoji and fire. [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

29 extracted references · 29 canonical work pages

[1]

Emoji Stats

2024. Emoji Stats. https://www.emojistats.org/

work page 2024
[2]

San Francisco Fire Department Calls for Service

2024. San Francisco Fire Department Calls for Service. http://bit.ly/336sddL

work page 2024
[3]

Raef Bassily, Kobbi Nissim, Uri Stemmer, and Abhradeep Guha Thakurta

work page
[4]

Raef Bassily and Adam Smith. 2015. Local, private, efficient protocols for succinct histograms. In Proceedings of the forty-seventh annual ACM symposium on Theory of computing. 127–135

work page 2015
[5]

Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2021. Data poisoning attacks to local differential privacy protocols. In30th USENIX Security Symposium. 947– 964

work page 2021
[6]

Albert Cheu, Adam Smith, and Jonathan Ullman. 2021. Manipulation attacks in local differential privacy. In 2021 IEEE Symposium on Security and Privacy. IEEE, 883–900

work page 2021
[7]

Abraham De Moivre. 2020. The doctrine of chances: A method of calculating the probabilities of events in play. Routledge

work page 2020
[8]

John C Duchi, Michael I Jordan, and Martin J Wainwright. 2013. Local privacy and statistical minimax rates. In 2013 IEEE 54th annual Symposium on Foundations of Computer Science. IEEE, 429–438

work page 2013

Show all 29 references

[9]

John C Duchi, Michael I Jordan, and Martin J Wainwright. 2018. Minimax optimal procedures for locally private estimation. J. Amer. Statist. Assoc. 113, 521 (2018), 182–201

2018
[10]

Werner Ehm. 1991. Binomial approximation to the Poisson binomial distribution. Statistics & Probability Letters 11, 1 (1991), 7–16

1991
[11]

Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. 2014. Rappor: Ran- domized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 1054–1067

2014
[12]

Kai Huang, Gaoya Ouyang, Qingqing Ye, Haibo Hu, Bolong Zheng, Xi Zhao, Ruiyuan Zhang, and Xiaofang Zhou. 2024. LDPGuard: Defenses against data poisoning attacks to local differential privacy protocols. IEEE Transactions on Knowledge and Data Engineering (2024)

2024
[13]

Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2014. Extremal mecha- nisms for local differential privacy. Advances in Neural Information Processing Systems 27 (2014)

2014
[14]

Xiaoguang Li, Ninghui Li, Wenhai Sun, Neil Zhenqiang Gong, and Hui Li. 2023. Fine-grained poisoning attack to local differential privacy protocols for mean and variance estimation. In 32nd USENIX Security Symposium. 1739–1756

2023
[15]

Xiaoguang Li, Zitao Li, Ninghui Li, and Wenhai Sun. 2025. On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attacks. In 32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025

2025
[16]

Zitao Li, Tianhao Wang, Milan Lopuhaä-Zwakenberg, Ninghui Li, and Boris Škoric. 2020. Estimating numerical distributions under local differential pri- vacy. In Proceedings of the 2020 ACM SIGMOD International Conference on Management of Data. 621–635

2020
[17]

Karl Pearson. 1896. VII. Mathematical contributions to the theory of evolu- tion.—III. Regression, heredity, and panmixia. Philosophical Transactions of the Royal Society of London. Series A, containing papers of a mathematical or physical character 187 (1896), 253–318
[18]

Zhan Qin, Yin Yang, Ting Yu, Issa Khalil, Xiaokui Xiao, and Kui Ren. 2016. Heavy hitter estimation over set-valued data with local differential pri- vacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 192–203

2016
[19]

Xinyue Sun, Qingqing Ye, Haibo Hu, Jiawei Duan, Tianyu Wo, Jie Xu, and Renyu Yang. 2024. LDPRecover: Recovering frequencies from poisoning attacks against local differential privacy. In 2024 IEEE 40th International Conference on Data Engineering. 1619–1631

2024
[20]

ADP Team et al. 2017. Learning with privacy at scale. Apple Mach. Learn. J 1, 8 (2017), 1–25

2017
[21]

Wei Tong, Haoyu Chen, Jiacheng Niu, and Sheng Zhong. 2024. Data Poisoning Attacks to Locally Differentially Private Frequent Itemset Mining Protocols.arXiv preprint arXiv:2406.19466 (2024)

2024 arXiv
[22]

Ning Wang, Xiaokui Xiao, Yin Yang, Jun Zhao, Siu Cheung Hui, Hyejin Shin, Junbum Shin, and Ge Yu. 2019. Collecting and analyzing multidimensional data with local differential privacy. In 2019 IEEE 35th International Conference on Data Engineering. IEEE, 638–649

2019
[23]

Tianhao Wang, Jeremiah Blocki, Ninghui Li, and Somesh Jha. 2017. Locally differentially private protocols for frequency estimation. In26th USENIX Security Symposium. 729–745

2017
[24]

Tianhao Wang, Bolin Ding, Jingren Zhou, Cheng Hong, Zhicong Huang, Ninghui Li, and Somesh Jha. 2019. Answering multi-dimensional analytical queries under local differential privacy. In Proceedings of the 2019 International Conference on Management of Data. 159–176

2019
[25]

Tianhao Wang, Ninghui Li, and Somesh Jha. 2019. Locally differentially pri- vate heavy hitter identification. IEEE Transactions on Dependable and Secure Computing 18, 2 (2019), 982–993

2019
[26]

Tianhao Wang, Milan Lopuhaa-Zwakenberg, Zitao Li, Boris Skoric, and Ninghui Li. 2020. Locally Differentially Private Frequency Estimation with Consistency. In Proceedings of the NDSS Symposium

2020
[27]

Yongji Wu, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2022. Poisoning attacks to local differential privacy protocols for key-value data. In 31st USENIX Security Symposium. 519–536

2022
[28]

Qingqing Ye, Haibo Hu, Xiaofeng Meng, and Huadi Zheng. 2019. PrivKV: Key- value data collection with local differential privacy. In 2019 IEEE Symposium on Security and Privacy. IEEE, 317–331. Appendix A Proof of Theorem 4.1 Proof. E 𝐸𝑀𝐺𝐴 𝑠𝑞 (𝑘) =E (𝑂𝑘 𝑀𝐺𝐴−𝑌 𝑘)2 =E (𝑂𝑘 𝑀𝐺𝐴)2 −2...

2019
[2017]

Advances in Neural Information Processing Systems 30 (2017)

Practical locally private heavy hitters. Advances in Neural Information Processing Systems 30 (2017)

2017

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Emoji Stats

2024. Emoji Stats. https://www.emojistats.org/

work page 2024

[2] [2]

San Francisco Fire Department Calls for Service

2024. San Francisco Fire Department Calls for Service. http://bit.ly/336sddL

work page 2024

[3] [3]

Raef Bassily, Kobbi Nissim, Uri Stemmer, and Abhradeep Guha Thakurta

work page

[4] [4]

Raef Bassily and Adam Smith. 2015. Local, private, efficient protocols for succinct histograms. In Proceedings of the forty-seventh annual ACM symposium on Theory of computing. 127–135

work page 2015

[5] [5]

Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2021. Data poisoning attacks to local differential privacy protocols. In30th USENIX Security Symposium. 947– 964

work page 2021

[6] [6]

Albert Cheu, Adam Smith, and Jonathan Ullman. 2021. Manipulation attacks in local differential privacy. In 2021 IEEE Symposium on Security and Privacy. IEEE, 883–900

work page 2021

[7] [7]

Abraham De Moivre. 2020. The doctrine of chances: A method of calculating the probabilities of events in play. Routledge

work page 2020

[8] [8]

John C Duchi, Michael I Jordan, and Martin J Wainwright. 2013. Local privacy and statistical minimax rates. In 2013 IEEE 54th annual Symposium on Foundations of Computer Science. IEEE, 429–438

work page 2013