Pith. sign in

REVIEW 4 major objections 4 minor 28 references

Don't Hash Me Like That: Exposing and Mitigating Hash-Induced Unfairness in Local Differential Privacy

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hash functions drawn at random in OLH create real disparities in attack vulnerability, and an entropy-based filter, F-OLH, removes most of the gap.

desk verdict BIA half is a clean empirical result; MGA half contradicts its own algorithm and is unsupported as written. read the letter →

arxiv 2506.20290 v1 pith:C5FZTMQ6 submitted 2025-06-25 cs.CR

Berkay Kemal Balioglu , Alireza Khodaie , Mehmet Emre Gursoy This is my paper · ORCID
classification cs.CR
keywords localdifferentialprivacyhash-inducedunfairnessOLHprotocolBayesianinferenceattackmaximalgainentropy-basedfairnessfrequencyestimationF-OLH
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Local differential privacy protocols such as OLH are supposed to give every user the same $\varepsilon$-level guarantee, but the paper argues the hash function a user happens to draw changes that guarantee in practice. Users whose hash gives a small preimage set for their value (Low-PIS) are 1.5–2 times more likely to be correctly guessed by a Bayesian inference attack at $\varepsilon \ge 2$, while users whose hash gives a large preimage set (High-PIS) can make maximal-gain poisoning attacks 3–4 times more damaging at $\varepsilon \le 1$. The paper proposes Fair-OLH (F-OLH), which repeatedly draws hash functions until the hash's entropy is close to the optimal uniform hash, measured by the ratio $E_{\text{opt}}/E_{\text{comp}} \le \rho$. Experiments on five datasets show F-OLH nearly eliminates the attack-rate gap when $\rho$ is close to 1 and roughly halves poisoning damage at $\rho=1.01$, at a time cost that stays in the millisecond range per user. The point is that hash selection, usually treated as an implementation detail, is a first-order parameter for who gets real privacy and who does not.

What carries the argument

The load-bearing object is the preimage set $P_u$ of a user's hash output under OLH, with its size compared against the output space $g = e^\varepsilon + 1$. BIA exploits $P_u$ because every value inside it is treated as equally likely, so smaller preimages sharpen the attacker's guess; MGA exploits it because a large bucket collides with many targets $T$. F-OLH's control mechanism is the entropy ratio $\rho_u = E_{\text{opt}}/E_{\text{comp}}$, where $E_{\text{comp}}$ is the entropy of a hash's distribution over the domain and $E_{\text{opt}} = \log g$ is the uniform-hash maximum; Algorithm 4 redraws the hash seed until $\rho_u \le \rho$. The $\rho$ threshold is the single knob that trades fairness and attack resilience against per-user hashing time.

What would settle it

Run the MGA exactly as Algorithm 2 specifies—let every malicious user search all of $\mathcal{H}$ for the most damaging $\langle H_u, x'_u\rangle$—and measure ULoss separately for Low-PIS, High-ENT, and High-PIS users. If the gaps shrink or vanish, the poisoning half of the hash-unfairness claim does not hold as stated. Separately, a direct replication at $\varepsilon=3$ on any of the five datasets should reproduce the 1.5–2 times ASR gap between Low-PIS and High-PIS if the inference half is right.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that hash-function behavior is a source of protocol unfairness in OLH: users are assigned a random hash $H_u$ from a family $\mathcal{H}$, and the preimage set $P_u = \{v \in D : H_u(v) = H_u(v_u)\}$ of the user's true value is what determines both sides of the ledger. Small preimages make Bayesian inference easier because the attacker's score increments concentrate on fewer candidate values, so Low-PIS users are correctly predicted more often. Large preimages make maximal-gain poisoning stronger because a single reported bucket collides with more target items, so High-PIS users raise ULoss by 3–4 times. The paper claims this is not an artifact of a particular dataset: it appears across Adult, BMS-POS, Kosarak, Gaussian, and Uniform data, and across $\varepsilon$ regimes. F-OLH then enforces fairness by rejection-sampling hashes until $E_{\text{opt}}/E_{\text{comp}} \le \rho$, bringing subpopulation attack rates together and shrinking MGA's impact.

Load-bearing premise

The poisoning-unfairness result assumes a malicious user's attack power is fixed by the preimage size of the hash they were assigned, even though the paper's own Maximal Gain Attack algorithm lets any attacker search the whole hash family for the hash that does the most damage; if attackers are allowed to do that, the reported 3–4 times gap between subpopulations needs an unstated restriction to survive.

Editorial extensions

If this is right

  • If the claim holds, privacy budgets in OLH are not equal in practice: a fixed $\varepsilon$ gives Low-PIS users roughly 1.5–2 times the Bayesian-inference success rate of High-PIS users at $\varepsilon \ge 2$.
  • If the claim holds, poisoning risk is concentrated: at $\varepsilon \le 1$, a High-PIS attacker can push ULoss 3–4 times higher than a Low-PIS or High-ENT attacker, so aggregate statistics are less trustworthy when unlucky hashes are in circulation.
  • F-OLH with $\rho$ near 1 equalizes ASR across subpopulations (at $\rho=1$ they are equal) and at $\rho=1.01$ cuts MGA's ULoss roughly in half relative to OLH.
  • F-OLH's cost is tunable: stricter $\rho$ raises hashing time, but because users run in parallel the per-user cost stays in milliseconds, so replacing OLH with F-OLH is practically viable.
  • The choice of $\rho$ can be guided by simulating $P_{\min}$, $P_{\max}$, and $P_{\text{avg}}$: values close to the theoretical average $\lvert D\rvert / g$ with a tight $P_{\min}$–$P_{\max}$ spread indicate a fair setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Our inference: because F-OLH's reported hash distribution is biased toward near-uniform hashes and depends on $\rho$ and $\lvert D\rvert$, a server that knows $\rho$ gains information about the user's hash-search process; quantifying this extra leakage is a natural follow-up.
  • Our inference: the same entropy-filter idea transfers to RAPPOR, BLH, and OUE, which also use user-side hashing; if the mechanism generalizes, hash-induced unfairness is a family-wide issue, not an OLH quirk.
  • Our inference: if the paper's MGA disparity is real under a restricted attacker, then the fairness fix is not just entropy filtering—it is also making the hash family and seed selection secret, or bounding the preimage size directly, because Algorithm 2 as written lets any attacker escape the assigned-hash model.
  • Our inference: the harmed group here is defined by the realized hash draw, not by any demographic characteristic, so unlike fair-ML notions this unfairness is hard to audit after the fact; a practical deployment would need to enforce fairness at hash-selection time, exactly as F-OLH does.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies whether the choice of hash function in the OLH local differential privacy protocol creates group-level disparities in vulnerability to inference and poisoning attacks. The authors define three subpopulations (High-ENT, Low-PIS, High-PIS) by entropy and by preimage-set size of the user's assigned hash function, and report that Low-PIS users are 1.5-2x more vulnerable to a Bayesian inference attack (BIA) while High-PIS users achieve 3-4x larger utility loss under a maximal gain attack (MGA). They then propose Fair-OLH (F-OLH), which repeatedly draws hash functions until a user's entropy ratio Eopt/Ecomp is below a threshold rho, and report that F-OLH reduces the BIA disparity and the MGA utility loss at acceptable time overhead.

Significance. If the claimed phenomenon were established, this would be a useful, previously underexplored observation for LDP protocol design: hash function behavior could create de facto unequal privacy and attack resilience under an identical nominal epsilon. The proposed F-OLH mitigation is simple and implementable, and the time-cost analysis is a reasonable practical consideration. However, the current evidence does not support the central poisoning-unfairness claim because the stated attack algorithm contradicts the claimed mechanism, and the BIA finding is substantially definitional because the subpopulations are defined by the exact quantity that determines BIA success. The F-OLH contribution additionally lacks an unbiasedness or privacy analysis for its modified hash distribution. No machine-checked proofs, formal statements, or public code are provided, and all empirical claims rest on point estimates without error bars.

major comments (4)
  1. [Algorithm 2 and Section 3.3, Figure 2] The MGA results are inconsistent with the attack algorithm as written. Algorithm 2 (lines 3-13) draws candidate hash functions from the entire family H and returns the pair <H_u, x'_u> that maximizes the number of target items in one hash bucket. Under this algorithm, a malicious user's protocol-assigned hash function and its preimage size P_u play no role in the chosen tuple. The Section 3.3 explanation ('When P_u is large...') attributes the ULoss differences to the user's own P_u, but a Low-PIS attacker has exactly the same search space as a High-PIS attacker and can return the same optimum. The reported High-PIS vs. Low-PIS separation in Figure 2 can only be reproduced if the experiments silently restrict each malicious user to their assigned hash, a restriction that is not stated anywhere. Since F-OLH changes only how honest users draw hash functions and leaves the attacker's search space and the server estimator unchanged, Figure 5 inherits the same unstated restriction. The poisoning-unfairness exposure and the F-OLH MGA-mitigation claims are therefore unsupported by the algorithm as written.
  2. [Section 4.2 and Appendix A, Equations (3), (9), Figure 5] F-OLH changes the distribution of hash functions from uniform over H to a conditioned distribution that depends on the entropy threshold rho, but the server-side estimation formula (3) is the standard OLH estimator. The unbiasedness of (3) relies on the uniform-hash-family property that for any two distinct values v and w, Pr[H(v)=H(w)] = 1/g. Under F-OLH's entropy conditioning this collision probability changes; for example, for perfectly balanced hashes it becomes (|D|/g - 1)/(|D|-1) rather than 1/g. The paper provides no proof that (3) remains unbiased under the F-OLH hash distribution, and the frequency plots in Appendix A show systematic over- and under-estimation (described as a 'scaling up' effect), which is consistent with estimator bias. Consequently, the ULoss reduction attributed to MGA mitigation in Figure 5 may be in part an artifact of a biased estimator rather than a genuine reduction in attack impact.
  3. [Section 3.2 and Algorithm 1, Figure 1] The BIA subpopulations are constructed by selecting extreme quantiles of exactly the preimage-size quantity |P_u| that determines BIA success under Algorithm 1. Because line 5 of Algorithm 1 increments the scores of values in the preimage set P_u, a user's ASR is a monotone function of |P_u| by construction. The observed ordering Low-PIS > High-ENT > High-PIS in Figure 1 is therefore a direct consequence of the grouping criterion, rather than an independent empirical discovery about hash-induced vulnerability. To support the exposure claim, the paper should report ASR as a function of |P_u| or entropy across the entire population, or define subpopulations in a way that is not the attack-determining quantity, and show that the spread arises from hash assignments in a standard OLH deployment.
  4. [All figures, Sections 3 and 4] The paper reports only averages over 10 runs and provides no error bars, confidence intervals, or statistical tests. The headline quantitative claims are ratios such as '1.5-2x' and '3-4x', and the central conclusion is that subpopulations have systematically different mean outcomes. Without variance estimates, the reader cannot assess whether the reported differences are stable or within the noise of the LDP mechanisms. At minimum, the main figures (Figures 1, 2, 4, and 5) should include standard deviations or confidence intervals.
minor comments (4)
  1. [Algorithm 1] The loop variable v is reused in the nested loops of lines 1 and 4, which is confusing even if functionally correct; using a distinct variable for the inner loop would improve clarity.
  2. [Section 4.2] The paper does not state explicitly why the rejection sampling in Algorithm 4 preserves epsilon-LDP. Because the acceptance condition (line 5) depends only on H and the domain D, not on the private value v_u, the mechanism is indeed a mixture of epsilon-LDP mechanisms, but this argument should be stated.
  3. [Appendix B, Table 1] There is a typo in the appendix header: 'T able 1' should read 'Table 1'.
  4. [Equation (9)] The notation rho_u for the user's entropy ratio is introduced but never used after the definition; the paper can either drop the subscript or use rho_u consistently in the explanation of the threshold condition.

Circularity Check

3 steps flagged · score 8.0 of 10

Central unfairness findings reduce to the defining preimage-size quantity: the BIA result is a corollary of the grouping, the MGA result requires an unstated assigned-hash restriction, and F-OLH's mitigation is its filtering condition by construction.

  1. self definitional [Section 3.2 (subpopulation definitions) and Section 3.3 (BIA explanation after Figure 1)]
    "It is intuitive that Low-PIS users have higher vulnerability than others. By definition of Low-PIS, users in this subpopulation use hash functions with small preimage sets P_u. From Algorithm 1, we observe that if P_u is small, then lines 5-6 of the algorithm will increment the scores of fewer different values, since the condition on line 5 will be satisfied by only those v ∈ P_u. Hence, the argmax on line 7 will recover the correct prediction."

    Low-PIS and High-PIS are constructed by ranking every user's |P_u| and taking the bottom/top 10%. Algorithm 1's BIA scores a candidate v by whether Hu(v) equals the observed output, which is exactly membership in P_u; with smaller P_u fewer candidates are scored, so the argmax is correct more often. The reported ASR ordering is therefore a direct corollary of the group definitions plus the attack definition. The 'empirical finding' that Low-PIS users are roughly 2x more vulnerable at epsilon=3 restates the defining quantity as the measured outcome rather than predicting an independent phenomenon.

  2. other [Section 3.3, MGA results and explanation after Figure 2; Algorithm 2]
    "The reason behind these results is that the hash function and the resulting P_u are important in MGA as well. Consider lines 6-10 of Algorithm 2. When P_u is large, it becomes more likely that many ¯v ∈ T are also members of P_u. Consequently, the final ⟨Hu, x′u⟩ returned by Algorithm 2 affects the resulting frequencies ˜f (v) more."

    Algorithm 2 as written draws hash functions from the full family H in every iteration and returns the ⟨Hu, x′u⟩ that maximizes the number of target items hashed into one bucket; it never uses the malicious user's protocol-assigned hash, so Low-PIS, High-ENT, and High-PIS attackers all have the same search space and can return the same optimum. The paper's explanation refers to P_u when discussing Algorithm 2 lines that do not involve P_u. The reported 3-4x ULoss separation can only arise under an unstated restriction that each attacker is limited to the hash they were assigned; under that restriction the disparity is again essentially definitional, since High-PIS means a large assigned preimage bucket and the MGA output for that hash is at least that bucket.

1 more flagged steps
  1. self definitional [Section 4.3, F-OLH BIA results (Figure 4 discussion) and MGA results (Figure 5 discussion)]
    "A key take-away message from Figure 4 is that F-OLH is indeed effective in reducing the ASR differences between different subpopulations using the ρ threshold. For example, ASRs of Low-PIS, High-ENT, and High-PIS users are all equal when ρ = 1, indicating a fair outcome for all subpopulations. This is an intuitive result because ρ = 1 enforces all users' hash functions to behave like Eopt; therefore, there are no disparate impacts between different subpopulations."

    Algorithm 4 rejects every user hash unless Eopt/Ecomp ≤ ρ, i.e., unless entropy is at least Eopt/ρ. Since Algorithm 1's ASR is governed by preimage size, and entropy is the aggregate measure of preimage-size spread, enforcing a common entropy bound necessarily compresses ASR differences. The 'effectiveness' of F-OLH against BIA is the algorithm's own acceptance condition presented as an experimental result, not an independent prediction. The MGA mitigation claim has the same structure: Section 4.3 explains it via 'the maximum preimage set size P_u ... ends up being much smaller', which again is the filtering condition restated; it also inherits the unstated assigned-hash restriction from the MGA step above.

full rationale

The quantitative headline results all reduce to the single quantity |P_u| that defines the subpopulations and is directly constrained by F-OLH. The BIA asymmetry is a corollary of Algorithm 1 and the Low-PIS/High-PIS grouping, as the paper's own explanation admits. The MGA asymmetry is not implied by Algorithm 2, because any attacker can search the whole hash family; it only becomes definitional under an unstated restriction to the assigned hash. F-OLH's BIA convergence is the entropy filter by construction, and its MGA benefit inherits the same unstated model. There is some independent empirical content, including the measured variation of real hash-function entropy (Figure 3), the execution-time overhead analysis (Section 4.4), and the utility comparisons, so the paper is not entirely without novel data. No load-bearing self-citation chain was found: the BIA description is fully reproduced in the paper, and the self-cited prior work is not the reason the result holds. Nonetheless, the paper's central claims of exposing and mitigating hash-induced unfairness in inference and poisoning attacks are forced by the defining quantity or depend on an unstated attack restriction, so the circularity score is 8.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claims rest on assumptions about the attack model and the privacy guarantee of the modified protocol rather than on fitted physical constants. The main ledger entries are the unproven epsilon-LDP preservation of F-OLH and the dubious assumption that MGA impact depends on the assigned hash.

free parameters (2)
  • rho (fairness threshold) = 1.01 to 1.05 in experiments; 1.0 in conceptual limit
    Chosen by hand; controls trade-off between fairness and runtime. No principled selection method, only heuristic guidance in the appendix.
  • subpopulation tail size = 10% (top/bottom decile)
    Subpopulations High-ENT, Low-PIS, High-PIS are defined as the top or bottom 10% of users by entropy or preimage size; the reported disparities depend on this post-hoc cutoff.
assumptions (3)
  • domain assumption The hash family H in OLH is value-independent and uniform, so rejection sampling in F-OLH preserves the epsilon-LDP guarantee because the selected H is still independent of the true value v_u.
    Paper asserts F-OLH is like OLH after selecting H but never proves the protocol remains epsilon-LDP; Section 4.2, Algorithm 4. If the rejection probability depends on D but not v_u, the ratio bound likely holds, but it is unproven.
  • domain assumption Entropy or preimage size of a user's hash over the full domain D is the correct and sufficient measure of fairness; attack vulnerability is monotone in these quantities.
    Section 3.2 defines subpopulations by these quantities and Section 3.3 measures attack success on them; the unfairness result is therefore partly built into the group definitions.
  • ad hoc to paper MGA impact depends on the malicious user's protocol-assigned hash function and its preimage size.
    Algorithm 2 lets the attacker draw any H from the family, so impact should not depend on the assigned hash; the paper's Figure 2 relies on this assumption without stating the restriction.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Don't Hash Me Like That: Exposing and Mitigating Hash-Induced Unfairness in Local Differential Privacy." pith.science (2026). https://pith.science/paper/C5FZTMQ6

@misc{pith2026250620290,
  author       = {Pith},
  title        = {Pith review of: Don't Hash Me Like That: Exposing and Mitigating Hash-Induced Unfairness in Local Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C5FZTMQ6}},
  note         = {Machine review of arXiv:2506.20290}
}
read the original abstract

Local differential privacy (LDP) has become a widely accepted framework for privacy-preserving data collection. In LDP, many protocols rely on hash functions to implement user-side encoding and perturbation. However, the security and privacy implications of hash function selection have not been previously investigated. In this paper, we expose that the hash functions may act as a source of unfairness in LDP protocols. We show that although users operate under the same protocol and privacy budget, differences in hash functions can lead to significant disparities in vulnerability to inference and poisoning attacks. To mitigate hash-induced unfairness, we propose Fair-OLH (F-OLH), a variant of OLH that enforces an entropy-based fairness constraint on hash function selection. Experiments show that F-OLH is effective in mitigating hash-induced unfairness under acceptable time overheads.

Figures

Figures reproduced from arXiv: 2506.20290 by the authors.

Figure 1
Figure 1. The results show that significant differences in ASR can be observed [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 1
Figure 1. BIA results on Adult, BMS-POS, Kosarak, and Gaussian datasets [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. MGA results on Adult, BMS-POS, Kosarak, and Gaussian datasets. too visible in the graphs (though they exist). As ε ≥ 2, the differences become more visible. When ε = 3, ASRs for Low-PIS are typically 2x higher than High￾PIS and 1.5x higher than High-ENT. These validate that the behaviors of hash functions indeed have a substantial impact on ASRs, and users in the Low-PIS population can be twice as vulnerable to a BI… view at source ↗
Figures from the paper (7 more)
Figure 3
Figure 3. Figure 3: Entropy of individual users’ hash functions compared to Eavg and Eopt. First row is with ε = 3 and second row is with ε = 2. Datasets from left to right: Adult, BMS-POS, Kosarak. The reason behind these results is that the hash function and the resulting Pu are importa…
Figure 4
Figure 4. Figure 4: BIA results on Adult, BMS-POS, Kosarak, and Gaussian datasets using the proposed F-OLH protocol instead of OLH. Top row is with ε = 2, bottom row is with ε = 3. which uniformly distributes D to [0, g − 1]. Note that in such a hash function, the probability of each hash…
Figure 5
Figure 5. Figure 5: MGA results using the proposed F-OLH protocol. Top row is with the Kosarak dataset, bottom row is with the Gaussian dataset. Eopt; therefore, there are no disparate impacts between different subpopulations. On the other hand, as ρ is increased, the threshold becomes mo…
Figure 6
Figure 6. Figure 6: Execution time comparison between F-OLH (blue bars) and OLH (orange bar) on Adult, BMS-POS, Kosarak, and Gaussian datasets. ρ. The reason behind this trend is that the ULoss caused by LDP itself is larger when ε is small. In other words, even if there was no attack lik…
Figure 7
Figure 7. Figure 7: Execution time comparison between F-OLH and OLH on Uniform datasets with varying domain sizes |D|. g = 5 on the left, g = 10 on the right. however, is the case when g = 10 and |D| = 100. In this case, the execution time is higher than many other |D|. We found the reaso…
Figure 8
Figure 8. Figure 8: Real frequencies f(v) of items v ∈ D (red curve) versus estimated frequencies ˜f(v) under MGA attack with OLH (green curve) and F-OLH (blue curve). ε = 0.5 is used in all plots, ρ values are ρ = 1.01, 1.02, 1.03, 1.04 from left to right. Top row: BMS-POS dataset, botto…
Figure 9
Figure 9. Figure 9: MGA results of the proposed F-OLH protocol using different Gaussian datasets. First row is with σ = 1, second row is with σ = 5, third row is with σ = 10. B Selection of the ρ Threshold In the paper, we established that selecting ρ close to 1 improves fairness and resi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 21 canonical work pages

  1. [1]

    Digital Communications and Networks (2022)

    Arcolezi, H.H., Couchot, J.F., Al Bouna, B., Xiao, X.: Improving the utility of locally differentially private protocols for longitudinal and multidimensional fre- quency estimates. Digital Communications and Networks (2022)

    2022

  2. [2]

    Proceedings on Privacy Enhancing Technolo- gies 2024(4)

    Arcolezi, H.H., Gambs, S.: Revealing the true cost of locally differentially private protocols: An auditing perspective. Proceedings on Privacy Enhancing Technolo- gies 2024(4)

    work page 2024

  3. [3]

    arXiv preprint arXiv:2503.01482 (2025)

    Arcolezi, H.H., Gambs, S.: Revisiting locally differentially private protocols: To- wards better trade-offs in privacy, utility, and attack resistance. arXiv preprint arXiv:2503.01482 (2025)

    work page arXiv 2025

  4. [4]

    Proceedings of the VLDB Endowment (PVLDB) 16(5), 1126–1139 (2023)

    Arcolezi, H.H., Gambs, S., Couchot, J.F., Palamidessi, C.: On the risks of collecting multidimensional data under local differential privacy. Proceedings of the VLDB Endowment (PVLDB) 16(5), 1126–1139 (2023)

    work page 2023

  5. [5]

    Arcolezi, H.H., Makhlouf, K., Palamidessi, C.: (local) differential privacy has no disparateimpactonfairness.In:IFIPAnnualConferenceonDataandApplications Security and Privacy. pp. 3–21. Springer (2023)

    work page 2023

  6. [6]

    In: 30th USENIX Security Symposium (USENIX Security 21)

    Cao, X., Jia, J., Gong, N.Z.: Data poisoning attacks to local differential privacy protocols. In: 30th USENIX Security Symposium (USENIX Security 21). pp. 947–

    work page

  7. [7]

    In: Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022

    Chen, C., Liang, Y., Xu, X., Xie, S., Hong, Y., Shu, K.: When fairness meets privacy: Fair classification with semi-private sensitive attributes. In: Workshop on Trustworthy and Socially Responsible Machine Learning, NeurIPS 2022

    work page 2022

  8. [8]

    In: 2021 IEEE Symposium on Security and Privacy (SP)

    Cheu, A., Smith, A., Ullman, J.: Manipulation attacks in local differential privacy. In: 2021 IEEE Symposium on Security and Privacy (SP). pp. 883–900. IEEE (2021)

    work page 2021

Show all 28 references
  1. [9]

    In: Proceedings of the 2018 Interna- tional Conference on Management of Data

    Cormode, G., Jha, S., Kulkarni, T., Li, N., Srivastava, D., Wang, T.: Privacy at scale: Local differential privacy in practice. In: Proceedings of the 2018 Interna- tional Conference on Management of Data. pp. 1655–1658. ACM (2018)

    2018

  2. [10]

    Proceedings of the VLDB Endowment14(11), 2046–2058 (2021)

    Cormode,G.,Maddock,S.,Maple,C.:Frequencyestimationunderlocaldifferential privacy. Proceedings of the VLDB Endowment14(11), 2046–2058 (2021)

    2021

  3. [11]

    In: Ad- vances in Neural Information Processing Systems

    Ding, B., Kulkarni, J., Yekhanin, S.: Collecting telemetry data privately. In: Ad- vances in Neural Information Processing Systems. pp. 3571–3580 (2017)

    2017

  4. [12]

    In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

    Erlingsson, Ú., Pihur, V., Korolova, A.: Rappor: Randomized aggregatable privacy- preserving ordinal response. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. pp. 1054–1067 (2014)

    2014

  5. [13]

    In: 31st USENIX Security Symposium

    Gadotti, A., Houssiau, F., Annamalai, M.S.M.S., de Montjoye, Y.A.: Pool inference attacks on local differential privacy: Quantifying the privacy guarantees of apple’s count mean sketch in practice. In: 31st USENIX Security Symposium. pp. 501–518 (2022)

    2022

  6. [14]

    IEEE Transactions on Information Forensics and Security17, 1785–1799 (2022)

    Gursoy, M.E., Liu, L., Chow, K.H., Truex, S., Wei, W.: An adversarial approach to protocol analysis and selection in local differential privacy. IEEE Transactions on Information Forensics and Security17, 1785–1799 (2022)

    2022

  7. [15]

    Turkish Journal of Electrical Engineering and Computer Sciences 32(1), 198–218 (2024)

    Gursoy, M.E.: Longitudinal attacks against iterative data collection with local dif- ferential privacy. Turkish Journal of Electrical Engineering and Computer Sciences 32(1), 198–218 (2024)

    2024

  8. [16]

    arXiv preprint arXiv:2210.14376 (2022)

    Imola, J., Chowdhury, A.R., Chaudhuri, K.: Robustness of locally differentially private graph analysis against poisoning. arXiv preprint arXiv:2210.14376 (2022)

    2022 arXiv

  9. [17]

    In: 32nd USENIX Security Symposium (USENIX Security 23)

    Li, X., Li, N., Sun, W., Gong, N.Z., Li, H.: Fine-grained poisoning attack to local differential privacy protocols for mean and variance estimation. In: 32nd USENIX Security Symposium (USENIX Security 23). pp. 1739–1756 (2023) 18 Balioglu, Khodaie, and Gursoy

    2023

  10. [18]

    arXiv preprint arXiv:2403.19510 (2024)

    Li, X., Li, Z., Li, N., Sun, W.: On the robustness of ldp protocols for numerical attributes under data poisoning attacks. arXiv preprint arXiv:2403.19510 (2024)

    2024 arXiv

  11. [19]

    Data Mining and Knowledge Discovery 38(4), 2252–2275 (2024)

    Makhlouf, K., Arcolezi, H.H., Zhioua, S., Brahim, G.B., Palamidessi, C.: On the impact of multi-dimensional local differential privacy on fairness. Data Mining and Knowledge Discovery 38(4), 2252–2275 (2024)

    2024

  12. [20]

    In: International Conference on Machine Learning

    Mozannar,H.,Ohannessian,M.,Srebro,N.:Fairlearningwithprivatedemographic data. In: International Conference on Machine Learning. pp. 7066–7075. PMLR (2020)

    2020

  13. [21]

    Transactions on Data Privacy14(3), 79–116 (2021)

    Murakami, T., Takahashi, K.: Toward evaluating re-identification risks in the local privacy model. Transactions on Data Privacy14(3), 79–116 (2021)

    2021

  14. [22]

    In: 26th USENIX Security Symposium (USENIX Security 17)

    Wang, T., Blocki, J., Li, N., Jha, S.: Locally differentially private protocols for frequency estimation. In: 26th USENIX Security Symposium (USENIX Security 17). pp. 729–745. USENIX Association, Vancouver, BC (Aug 2017)

    2017

  15. [23]

    In: Proceedings of the Network and Distributed System Security (NDSS) Symposium (2020)

    Wang, T., Lopuhaa-Zwakenberg, M., Li, Z., Skoric, B., Li, N.: Locally differentially private frequency estimation with consistency. In: Proceedings of the Network and Distributed System Security (NDSS) Symposium (2020)

    2020

  16. [24]

    In: 31st USENIX Security Symposium

    Wu, Y., Cao, X., Jia, J., Gong, N.Z.: Poisoning attacks to local differential privacy protocols for key-value data. In: 31st USENIX Security Symposium. pp. 519–536 (2022)

    2022

  17. [25]

    Security and Communication Networks2020, 1–29 (2020)

    Xiong, X., Liu, S., Li, D., Cai, Z., Niu, X.: A comprehensive survey on local differ- ential privacy. Security and Communication Networks2020, 1–29 (2020)

    2020

  18. [26]

    Computer Standards & Interfaces p

    Yang, M., Guo, T., Zhu, T., Tjuawinata, I., Zhao, J., Lam, K.Y.: Local differen- tial privacy and its applications: A comprehensive survey. Computer Standards & Interfaces p. 103827 (2023)

    2023

  19. [27]

    scales up

    Zheng, Z., Li, Z., Huang, C., Long, S., Li, M., Shen, X.: Data poisoning attacks and defenses to ldp-based privacy-preserving crowdsensing. IEEE Transactions on Dependable and Secure Computing (2024) A Additional Experiments with MGA InFigure8,wepresenttheresultsoftheMGAattack...

    2024

  20. [964]

    USENIX Association (Aug 2021)

    2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.