# SOK: Privacy Definitions and Classical Mechanisms in the Local Setting

Nan Wang, Likun Qin, Tianshuo Qiu

Department of Electrical and Computer Engineering  Shandong University, Jinan,
China

###### Abstract

This paper delves into the intricate landscape of privacy notions,
specifically honed in on the local setting. Central to our discussion is the
juxtaposition of point-wise protection and average-case protection, offering a
comparative analysis that highlights the strengths and trade-offs inherent to
each approach. Beyond this, we delineate between context-aware and context-
free notions, examining the implications of both in diverse application
scenarios. The study further differentiates between the interactive and non-
interactive models, illuminating the complexities and nuances each model
introduces. By systematically navigating these core themes, our goal is to
provide a cohesive framework that aids researchers and practitioners in
discerning the most suitable privacy notions for their specific requirements
in the local setting.

##  I Introduction

In the vast, interconnected expanse of our contemporary data ecosystem, the
principles and mechanisms underpinning data privacy have never been more
critical. As more sectors—from healthcare to commerce, from social networking
to infrastructure—rely heavily on large-scale data processing, ensuring robust
privacy, especially in the local setting, becomes a pivotal challenge. Within
this challenge lies the multifaceted landscape of privacy notions, each
tailored to cater to specific needs and scenarios.

Central to our exploration is the differentiation between point-wise
protection and average-case protection[1, 2]. Point-wise protection, as the
term suggests, focuses on the individual, ensuring that each data point, when
taken in isolation, is afforded its unique protective shield against potential
breaches or misuse. On the other hand, average-case protection operates on a
broader scale, aiming to ensure that when data is looked at collectively or in
aggregates, its privacy properties are maintained. The distinction between
these two approaches is not merely theoretical; it has profound implications
for how we design algorithms, systems, and policies.

Beyond this foundational dichotomy, the realm of privacy expands into the
realms of context [3]. Context-aware notions introduce an additional layer of
complexity by ensuring that privacy definitions are crafted with a keen eye on
the surrounding environment or setting of the data[4]. It poses intriguing
questions: How does the nature of a data-sharing platform, or the socio-
cultural dynamics of a region, impact what ’privacy’ truly means? Conversely,
context-free notions strive for universality, aiming to provide privacy
guarantees that remain robust, irrespective of the specific nuances of a given
setting[5].

Last but not least, our discourse ventures into the interactive versus non-
interactive models of privacy. The interactive model envisions a dynamic
environment where the data and the querying mechanism engage in a continuous,
two-way dialogue. This stands in stark contrast to the non-interactive model,
where data is processed, analyzed, and subsequently shared or stored without
further real-time interaction[6]. This distinction, while subtle, is pivotal
in determining the operational efficiency, user experience, and often, the
very feasibility of certain privacy-preserving mechanisms.

Through the length and breadth of this study, our ambition extends beyond mere
elucidation. We aim to bridge the gap between theory and practice, between
abstract notions and tangible applications. By offering a comprehensive,
nuanced, and layered understanding of privacy in the local setting, we hope to
empower researchers, practitioners, policymakers, and even everyday users to
navigate the intricate world of data privacy with confidence and clarity.

Figure 1: Model of local privacy notions

##  II Delineating Point-wise and Average-case Protections

The quest for privacy in data analysis begins with an understanding of the
granularity at which protection is applied. This section dives deep into the
nuances of two pivotal paradigms: point-wise protection and average-case
protection.

###  II-A Point-wise Protection: Guarding Every Individual

Definition: Point-wise protection refers to mechanisms that offer privacy
guarantees for individual data points, ensuring that each unique entry is
shielded from potential external breaches or internal misuse.

Characteristics: 1. Fine-grained Control: It allows for individualized
protection settings, enabling users or systems to tweak privacy settings for
specific data points.[7] 2\. Localized Errors: Since each data point is
protected in isolation, any noise or error introduced for privacy does not
propagate across the dataset. 3\. Demands Higher Overheads: Given its granular
nature, point-wise protection often demands higher computational and storage
overheads.

In scenarios where the individual’s data is extremely sensitive, like personal
medical records or financial transactions, point-wise protection is pivotal

###  II-B Average-case Protection: Safeguarding the Collective

Definition: Average-case protection pertains to the privacy of data when
viewed en masse. Instead of focusing on individual data points, it ensures
that aggregates, statistics, or averages derived from the data are protected.

Characteristics:1\. Broad Strokes: It is more about ensuring privacy for large
groups rather than individuals, reducing the granularity of control. 2\. Noise
Distribution: Any noise introduced for privacy reasons is often distributed
across the dataset, leading to more consistent and predictable errors. 3\.
Efficiency Gains: Due to its collective nature, average-case protection
mechanisms can often be more efficient and scalable.

###  II-C Point-wise vs. Average-case: A Comparative Lens

The interplay between point-wise and average-case protection forms the crux of
many privacy-centric decisions in data analysis. Both methods, while aiming to
offer privacy guarantees, follow inherently different paths, bringing distinct
advantages and challenges. This section delves deeper into their comparative
analysis.

Flexibility: Point-wise protection stands out in its adaptability. By focusing
on individual data points, it enables granular adjustments tailored to the
unique sensitivities and characteristics of each data point. This granularity
often translates to personalized privacy settings, ensuring that specific data
points can be safeguarded based on their individual attributes. On the
contrary, average-case protection casts a broader net. It looks at data in
aggregates, ensuring that when a large set of data points is considered,
privacy is not compromised. While this might not offer the individualized
control that point-wise protection does, it brings a consistency that can be
crucial for wide-scale data operations.

Overhead Costs: The intricate nature of point-wise protection brings with it
challenges. Given its focus on individual data points, computational resources
are often stretched, leading to higher overheads both in terms of processing
time and storage. This granularity can also mean that more intricate
algorithms are required, especially when dealing with diverse datasets.
Average-case protection, with its collective approach, often streamlines
processes. By handling data en masse, it can introduce efficiencies, making it
more scalable and often faster, especially when dealing with very large
datasets.

Application Suitability: The choice between point-wise and average-case often
boils down to the end goal of the data operation. Point-wise protection is the
go-to choice in situations where individual data points are of utmost
importance. Think of applications like personal health records, where each
record’s confidentiality and integrity can have significant implications.
Conversely, average-case finds its strength in scenarios where broader
insights are the goal. When dealing with large-scale surveys, market research,
or any application where discerning overarching trends is more vital than the
specifics of individual data points, average-case protection comes into its
own.

Data Utility vs. Privacy Trade-off: An often-overlooked aspect is the trade-
off between data utility and privacy. Point-wise, while offering heightened
privacy for individual data points, might sometimes compromise on the overall
utility of the data, especially when significant noise is introduced for
privacy preservation. Average-case, by working on aggregates, often manages to
retain a better balance, ensuring that while individual data points might be
obfuscated, the overall insights drawn from the data remain intact.

Evolving Data Landscape: As data operations evolve and datasets become more
dynamic, the adaptability of the privacy mechanism becomes essential. Point-
wise protection, with its granular approach, might be better suited to handle
dynamic datasets where new data points are continuously added. In contrast,
average-case, with its broader view, can be more resilient to minor changes,
ensuring consistent privacy guarantees even as data evolves.

In essence, the debate between point-wise and average-case protection is not
about which is superior, but rather about which is more appropriate for a
given scenario. Recognizing the strengths and limitations of each is pivotal
in making informed, effective, and efficient privacy-centric decisions.

##  III  Local Privacy Definitions: A Comparative Study

####  III-1 Local Differential Privacy (LDP)

A mechanism $M$ adheres to $\epsilon$-LDP if, for every input data point $x$
and its possible adjacent data points $x^{\prime}$, the probability ratio of
their outputs $M(x)$ and $M(x^{\prime})$ remains bounded by $e^{\epsilon}$.

$\frac{P[M(x)=o]}{P[M(x^{\prime})=o]}\leq e^{\epsilon}\quad\forall\,o\in
Range(M)$ (1)

From the definition of LDP, we have the following observations: a) the
likelihood ratio $\mathsf{LR}(y,x,x^{\prime})$ of observing $y$ as an output
for any two distinct inputs $x,x^{\prime}$ from the mechanism $\mathcal{M}$
must be bounded; b) the definition does not assume any prior on the data; thus
LDP provides prior-agnostic guarantees, and c) the likelihood probabilities,
and thus the leakage of LDP only depends on the randomness used in the
mechanism[8].

To handle more general applications such as continuous-valued data release, a
relaxed version of $\epsilon$-LDP is studied, which uses $\delta$ to measure
the probability of the likelihood ratio is not bounded. Such relaxation is
denoted as $(\epsilon,\delta)$-LDPc[9, 10].

Pros: Strong guarantees, known noise addition mechanisms. Cons: Can introduce
significant noise, leading to reduced data utility.

####  III-2 Local Randomized Response (LRR)

In this mechanism, participants answer queries truthfully with a probability
$p$ and otherwise respond randomly with probability $1-p$.

$\displaystyle P[\text{response}=\text{true}]$ (2) $\displaystyle=$
$\displaystyle p\cdot P[\text{truth}=\text{true}]+(1-p)\cdot
P[\text{random}=\text{true}]$

Pros: Simple to implement, offers direct individual-level protection. Cons:
Not always optimal for more complex queries.

####  III-3 Local k-Anonymity

For every data point released, there exist at least $k-1$ other data points in
the dataset that are indistinguishable from it. Given a dataset $D$ and a
released data point $d$, the condition is:

$|\\{d^{\prime}\in
D:\text{equivalence\\_class}(d)=\text{equivalence\\_class}(d^{\prime})\\}|\geq
k$ (3)

Pros: Protects individual identity in the dataset. Cons: Doesn’t necessarily
protect against attribute disclosure.

####  III-4 Local l-Diversity

An extension of $k$-anonymity, ensuring that for each equivalence class, there
are at least $l$ “well-represented” values for the sensitive attribute.
Formally, for every equivalence class $E$ in the dataset:

$|\\{\text{distinct sensitive\\_values in }E\\}|\geq l$ (4)

Pros: Protects against attribute disclosure. Cons: More complex to achieve,
potentially reducing data utility.

Now, we focus on context-aware privacy notions. Consider the setting where
there is a prior distribution on the data, denoted by $\mathbf{P}$, and the
prior is perfectly available when designing the mechanism. One such definition
is mutual information privacy (MIP), which uses the mutual information between
$Y$, $X$ to measure the average information leakage of $X$ contained in $Y$,
MIP in the central setting takes $X$ as the input dataset and $Y$ as the
output of the mechanism. Here, we twist it into the local setting, where $X$
denotes one user’s local data in the following definition.

####  III-5 Local Mutual Information Privacy (L-MIP)[11]]

A mechanism $\mathcal{M}$ satisfies $\epsilon$-L-MIP for some
$\epsilon\in{\mathds{R}^{+}}$, if the mutual information between $X$ and $Y$
is bounded by $\epsilon$, i.e., $I(X;Y)\leq{\epsilon}$.

Originally, MIP was proposed under the centralized setting where $X$ is the
database or individual items, and $Y$ is a query output. Here we can adapt it
to the local setting, where $X$ and $Y$ are each individual user’s input and
output. [12]

L-MIP it is an average case leakage measure, i.e., the expected value of the
log of the ratio of posterior $P(X=x|Y=y)$ to the prior $P(X=x)$. On the other
hand, the average operation in L-MIP prohibits deriving closed-form
perturbation parameters in mechanism design.

We next introduce Differential Identifiability. which provides context-aware
pairwise protection overall possible values of $x$ and $y$.

####  III-6 Local Information Privacy

$[(\epsilon,\delta)$-Local Information Privacy][13] A mechanism $\mathcal{M}$
satisfies $(\epsilon,\delta)$-LIP for some $\epsilon\in{\mathds{R}^{+}}$ and
$\delta\in[0,1]$, if $\forall{S_{x}\in{\mathcal{X}}}$,
$S_{y}\in{\textit{Range}(\mathcal{M})}$:

$\displaystyle P(Y\in\mathcal{S}_{y})\geq
e^{-\epsilon}P(Y\in{\mathcal{S}_{y}}|X\in\mathcal{S}_{x})-\delta,$ (5)
$\displaystyle
P(Y\in\mathcal{S}_{y})\leq{e^{\epsilon}P(Y\in{\mathcal{S}_{y}}|X\in\mathcal{S}_{x})}+\delta.$

The operational meaning of LIP is, the output $Y$ provides limited additional
information about any possible input $X$, and the amount of the additional
information is measured by the privacy budget $\epsilon$ and failure
probability $\delta$. Note that, when $\epsilon$ is small, the posterior
probability of $X$ given $Y$ is close to the prior of $X$[14].

####  III-7 $\epsilon$-Differential Identifiability (DI)

[15, 11] A mechanism $\mathcal{M}$ satisfies $\epsilon$-DI for some
$\epsilon\in{\mathds{R}^{+}}$, if
$\forall{S_{x},S_{x}^{\prime}\in{\mathcal{X}}}$ and
$\forall{S_{y}\in{\textit{Range}(\mathcal{M})}}$ if

$\frac{P(X\in\mathcal{S}_{x}|Y\in\mathcal{S}_{y})}{P(X\in\mathcal{S}_{x}^{\prime}|Y\in\mathcal{S}_{y})}\leq{e^{\epsilon}}.$

####  III-8 $\epsilon$-Local Pufferfish Privacy [16]

Given set of potential secrets $S$, a set of discriminative pairs $S_{pairs}$,
a set of data evolution scenarios $\mathsf{\theta}_{\mathcal{X},\mathcal{S}}$,
and a privacy parameter $\epsilon\in{\mathds{R}^{+}}$, an (potentially
randomized) algorithm $\mathcal{M}$ satisfies $\epsilon$-Pufferfish ($S$,
$S_{pairs}$, $\mathsf{\theta}_{\mathcal{X},\mathcal{S}}$) privacy if for all
possible outputs $y\in\text{range}(\mathcal{M})$, for all pairs
$(s_{i},s_{j})\in S_{pairs}$ of potential secrets, for all distributions
$\theta_{\mathcal{X},\mathcal{S}}\in\mathsf{\theta}_{\mathcal{X},\mathcal{S}}$
for which $P(s_{i}|\theta_{\mathcal{X},\mathcal{S}})\neq{0}$ and
$P(s_{j}|\theta_{\mathcal{X},\mathcal{S}})\neq{0}$, the following holds:

$\frac{P(\mathcal{M}(X)=y|\theta_{\mathcal{X},\mathcal{S}},s_{i})}{P(\mathcal{M}(X)=y|\theta_{\mathcal{X},\mathcal{S}},s_{j})}\leq{e^{\epsilon}}.$

The first observation is that the pufferfish privacy is not necessarily
context-aware, as it defines a bounded region for all the possible prior
distributions, when the region is large enough to include all possible priors,
it is equivalent to a context-free setting. Also note that, the input $X$ is
not necessarily sensitive itself, but may be correlated to some hidden
properties defined in the secret set, the correlations are described through
$\mathsf{\theta}_{\mathcal{X},\mathcal{S}}$, i.e.,
$\mathsf{\theta}_{\mathcal{X},\mathcal{S}}$ is not only the set of all
possible prior distribution, but also contains the data dependence[17].

The next privacy notion is Maximal Information Leakage (MIL). Suppose an
adversary is interested in some sensitive data $U$ with domain $\mathcal{U}$
which is correlated to $X$, then observing $Y$, MIL measures the information
gain at the adversary from the aspect of correct guessing:

####  III-9 $\epsilon$-Maximal Information Leakage (MIL)[18]

The maximal information leakage for a mechanism $\mathcal{M}$ is

$\displaystyle\mathsf{L}_{\textsf{MIL}}(X;{Y})=\sup_{U-X-Y-\hat{U}}\ln\frac{P({U=\hat{U}})}{\max_{u\in\mathcal{U}}P_{U}(u)},$
(6)

where $U$ is a (possibly randomized) function of $X$, $\hat{U}$ denotes a
guess from the adversary. For any joint distribution $P_{X,Y}$ on finite
alphabets $\mathcal{X}$ and $\mathcal{Y}$, (6) can be rewritten as

$\displaystyle\mathsf{L}_{\textsf{MIL}}(X;{Y})=\ln\sum_{y\in{\mathcal{Y}}}\max_{x\in{\mathcal{X}}}P_{Y|X}(y|x)$

and $\mathcal{M}$ satisfies $\epsilon$-Maximal Information Leakage Privacy if
$\mathsf{L}_{\textsf{MIL}}(X;{Y})\leq\epsilon$. if for some
$\epsilon\in{\mathds{R}^{+}}$, $\forall{x\in{\mathcal{X}}}$,
$\forall{y\in\mathcal{Y}}$.

MIL captures the average likelihood over all possible $y\in{\mathcal{Y}}$
given the corresponding value of $x$(s) that provide the maximal likelihood
probability. However, MIL does not provide pairwise protection over all
possible values of $x$ and $y$.

Thus, for localized pufferfish privacy, we have,
$\forall{s_{i},s_{j}\in{S_{pair}}}$,
${P}_{X}\in\mathsf{\theta}_{\mathcal{X}}$, and
$y\in\text{range}(\mathcal{M})$:

$e^{-\epsilon}\leq\frac{P(\mathcal{M}(s_{i})=y|{P}_{X})}{P(\mathcal{M}(s_{j})=y|{P}_{X})}\leq{e^{\epsilon}}.$
(7)

One drawback of pufferfish privacy is the lack of mechanisms, even though in
[19], a Wasserstein Mechanism is proposed, however, it is computationally
impractical, and the approximated mechanism trades in some utility.

####  III-10 Geo-indistinguishability

Geo-indistinguishability[20] is a privacy measure that ensures that the
location of an individual remains indistinguishable within a certain
geographical radius. Formally, a mechanism $M$ ensures $\epsilon$-geo-
indistinguishability if for any two locations $x,x^{\prime}$ and any possible
output $o$, the following holds:

$\frac{P[M(x)=o]}{P[M(x^{\prime})=o]}\leq e^{\epsilon\cdot d(x,x^{\prime})}$
(8)

where $d(x,x^{\prime})$ is the Euclidean distance between the two locations.

The operational meaning of LIP is, the output $Y$ provides limited additional
information about any possible input $X$, and the amount of the additional
information is measured by the privacy budget $\epsilon$ and failure
probability $\delta$. Note that, when $\epsilon$ is small, the posterior
probability of $X$ given $Y$ is close to the prior of $X$.

##  IV Classical Mechanisms for Each Privacy Notion

In the evolving domain of data protection, various mechanisms have emerged to
guarantee privacy to users. Each of these mechanisms aligns with specific
privacy notions, ensuring optimal utility while preventing unintended
information leakage. This section offers a detailed examination of some of the
significant privacy mechanisms available:

Randomized Response (RR) Mechanism:

This mechanism involves introducing randomness in responses to mask the actual
data values. Examples including RAPPOR from Google [21]. Suitable for Local
Differential Privacy (LDP)[22, 23], Local Information Privacy (LIP), and other
privacy paradigms that emphasize pointwise privacy protection. By using
randomization, this method ensures that the output is not directly associated
with the input, thus providing a certain degree of privacy.

Random Sampling Mechanism: This mechanism is based on the probabilistic
release of actual data values. Data is released in its true form with a
probability $p$ and is sampled from the underlying data distribution with
probability $1-p$. Essentially, this mechanism either reveals the actual data
or provides a sample that resembles it. With a given prior distribution, it
can be translated into the Randomized Response (RR) mechanism[24].

Convex Optimization Mechanism: Designed for Maximal Information Privacy
(MIP)[25], this mechanism is grounded in the principle that the privacy
definition is convex. By leveraging convex optimization techniques, it aims to
find the best protection strategy while maintaining utility and ensuring that
the data’s privacy is not compromised.

Wasserstein Mechanism: A unique approach primarily used for Pufferfish
privacy, the Wasserstein mechanism determines the distance between two data
distributions. By leveraging the Wasserstein distance, it ensures that any two
given distributions are indistinguishable to a certain extent, thus providing
a robust privacy guarantee.

Noise Adding Mechanism: One of the fundamental methods of ensuring data
privacy is by adding noise to the data[26]. Common noise distributions include
Gaussian and Laplacian. However, there are challenges in the local model,
especially in measuring sensitivity. The primary drawback is the often
undesirable trade-off between utility and privacy. When too much noise is
added, the utility of the data diminishes, and vice versa.

Utility Optimized Mechanism[27, 28]: Recognizing the essential balance between
utility and privacy, some mechanisms have been developed to optimize utility
without significantly compromising privacy. [29, 30, 31] Examples include
Optimized Local Differential Privacy (OLDP), Optimized Unary Encoding Local
Differential Privacy (OUE-LDP)[32], and Optimized Unary Encoding Local
Information Privacy (OUE-LIP)[33]. These mechanisms employ optimization
techniques to find the right balance, ensuring that data remains useful while
maintaining the desired privacy level.

##  V Conclusion and Future Works:

This paper delved deep into the intricate world of privacy definitions,
examining their nuances and presenting mechanisms tailored to each. From the
classic Randomized Response to the more contemporary Utility Optimized
Mechanisms, our exploration underscores a profound commitment in the academic
and tech community towards securing individual data.

Our study has revealed two primary insights. Firstly, there is no one-size-
fits-all approach in the realm of data protection. Depending on the unique
requirements and constraints of each application, different mechanisms and
privacy definitions may be more apt. Secondly, the dynamic between data
utility and privacy stands as a central challenge in this field. As mechanisms
become more sophisticated, ensuring that they don’t unduly compromise the
utility of data becomes increasingly paramount.

Future research in this domain should focus on the interplay of these
mechanisms in real-world scenarios, quantifying their efficiency in diverse
datasets and applications. Furthermore, as threats to privacy evolve, so must
our mechanisms, making this an ever-evolving field of study.

## References

  * [1] J. C. Duchi, M. I. Jordan, and M. J. Wainwright, “Local privacy and statistical minimax rates,” in _2013 IEEE 54th Annual Symposium on Foundations of Computer Science_ , October 2013, pp. 429–438.
  * [2] S. Boukoros, M. Humbert, S. Katzenbeisser, and C. Troncoso, “On (the lack of) location privacy in crowdsourcing applications,” in _28th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 19)_, 2019, pp. 1859–1876.
  * [3] M. Lopuhaä-Zwakenberg, B. Škorić, and N. Li, “Information-theoretic metrics for local differential privacy protocols,” _arXiv preprint arXiv:1910.07826_ , 2019.
  * [4] C. Huang, P. Kairouz, X. Chen, L. Sankar, and R. Rajagopal, “Context-aware generative adversarial privacy,” _CoRR_ , vol. abs/1710.09549, 2017. [Online]. Available: http://arxiv.org/abs/1710.09549
  * [5] Y. Cao, Y. Xiao, L. Xiong, L. Bai, and M. Yoshikawa, “Protecting spatiotemporal event privacy in continuous location-based services,” _IEEE Transactions on Knowledge and Data Engineering_ , 2019.
  * [6] P. Kairouz, K. Bonawitz, and D. Ramage, “Discrete distribution estimation under local privacy,” _arXiv preprint arXiv:1602.07387_ , 2016.
  * [7] M. Lopuhaä-Zwakenberg, “The privacy funnel from the viewpoint of local differential privacy,” _arXiv preprint arXiv:2002.01501_ , 2020.
  * [8] G. Cormode, S. Jha, T. Kulkarni, N. Li, D. Srivastava, and T. Wang, “Privacy at scale: Local differential privacy in practice,” in _Proceedings of the 2018 International Conference on Management of Data_ , ser. SIGMOD ’18. New York, NY, USA: ACM, 2018, pp. 1655–1658. [Online]. Available: http://doi.acm.org/10.1145/3183713.3197390
  * [9] P. Kairouz, S. Oh, and P. Viswanath, “Extremal mechanisms for local differential privacy,” in _Advances in neural information processing systems_ , 2014, pp. 2879–2887.
  * [10] C. Dwork, “Differential privacy,” in _Automata, Languages and Programming: 33rd International Colloquium, ICALP 2006, Part II_ , M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener, Eds., 2006, pp. 1–12. [Online]. Available: https://doi.org/10.1007/11787006_1
  * [11] W. Wang, L. Ying, and J. Zhang, “On the relation between identifiability, differential privacy, and mutual-information privacy,” _IEEE Transactions on Information Theory_ , vol. 62, no. 9, pp. 5018–5029, Sept 2016\.
  * [12] P. Cuff and L. Yu, “Differential privacy as a mutual information constraint,” in _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , October 2016, pp. 43–54.
  * [13] B. Jiang, M. Seif, R. Tandon, and M. Li, “Context-aware local information privacy,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 3694–3708, 2021.
  * [14] B. Jiang, M. Li, and R. Tandon, “Local information privacy with bounded prior,” in _ICC 2019-2019 IEEE International Conference on Communications (ICC)_ , May 2019, pp. 1–7.
  * [15] J. Lee and C. Clifton, “Differential identifiability,” in _Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining_ , ser. KDD ’12. ACM, 2012, pp. 1041–1049. [Online]. Available: http://doi.acm.org/10.1145/2339530.2339695
  * [16] D. Kifer and A. Machanavajjhala, “A rigorous and customizable framework for privacy,” in _Proceedings of the 31st ACM SIGMOD-SIGACT-SIGAI symposium on Principles of Database Systems_. ACM, 2012, pp. 77–88.
  * [17] S. Song, Y. Wang, and K. Chaudhuri, “Pufferfish privacy mechanisms for correlated data,” in _Proceedings of the 2017 ACM International Conference on Management of Data_. ACM, 2017, pp. 1291–1306.
  * [18] I. Issa, A. B. Wagner, and S. Kamath, “An operational approach to information leakage,” _CoRR_ , vol. abs/1807.07878, 2018. [Online]. Available: http://arxiv.org/abs/1807.07878
  * [19] Y. Wang, S. Song, and K. Chaudhuri, “Privacy-preserving analysis of correlated data,” _CoRR_ , vol. abs/1603.03977, 2016. [Online]. Available: http://arxiv.org/abs/1603.03977
  * [20] M. E. Andrés, N. E. Bordenabe, and K. Chatzikokolakis, “Geo-indistinguishability: Differential privacy for location-based systems,” _CoRR_ , vol. abs/1212.1984, 2012. [Online]. Available: http://arxiv.org/abs/1212.1984
  * [21] Úlfar Erlingsson, V. Pihur, and A. Korolova, “Rappor: Randomized aggregatable privacy-preserving ordinal response,” in _Proceedings of the 21st ACM CCS_ , 2014. [Online]. Available: https://arxiv.org/abs/1407.6981
  * [22] M. Joseph, A. Roth, J. Ullman, and B. Waggoner, “Local differential privacy for evolving data,” in _Advances in Neural Information Processing Systems_ , 2018, pp. 2375–2384.
  * [23] A. D. Sarwate and L. Sankar, “A rate-disortion perspective on local differential privacy,” in _2014 52nd Allerton_ , Sept 2014, pp. 903–908.
  * [24] R. Dewri, “Local differential perturbations: Location privacy under approximate knowledge attackers,” _IEEE Transactions on Mobile Computing_ , vol. 12, no. 12, pp. 2360–2372, Dec 2013.
  * [25] W. Zhang, B. Jiang, M. Li, and X. Lin, “Privacy-preserving aggregate mobility data release: An information-theoretic deep reinforcement learning approach,” _IEEE Transactions on Information Forensics and Security_ , vol. 17, pp. 849–864, 2022.
  * [26] F. Tramèr and Z. Huang, “Differential privacy with bounded priors: Reconciling utility and privacy in genome-wide association studies,” in _Proceedings of the 22Nd ACM SIGSAC_ , 2015, pp. 1286–1297. [Online]. Available: http://doi.acm.org/10.1145/2810103.2813610
  * [27] Z. Qin, Y. Yang, T. Yu, I. Khalil, X. Xiao, and K. Ren, “Heavy hitter estimation over set-valued data with local differential privacy,” in _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , 2016, pp. 192–203.
  * [28] T. Murakami and Y. Kawamoto, “Utility-optimized local differential privacy mechanisms for distribution estimation,” in _28th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 19)_, 2019, pp. 1877–1894.
  * [29] C. Xu, J. Ren, D. Zhang, and Y. Zhang, “Distilling at the edge: A local differential privacy obfuscation framework for iot data analytics,” _IEEE Communications Magazine_ , vol. 56, no. 8, pp. 20–25, 2018.
  * [30] Y. Han, J. Jiao, and T. Weissman, “Minimax estimation of discrete distributions,” in _2015 IEEE International Symposium on Information Theory (ISIT)_ , June 2015, pp. 2291–2295.
  * [31] R. Bassily, K. Nissim, U. Stemmer, and A. G. Thakurta, “Practical locally private heavy hitters,” in _Advances in Neural Information Processing Systems_ , 2017, pp. 2288–2296.
  * [32] T. Wang, J. Blocki, N. Li, and S. Jha, “Locally differentially private protocols for frequency estimation,” in _26th USENIX Security 17_. USENIX Association, 2017, pp. 729–745. [Online]. Available: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-tianhao
  * [33] B. Jiang, M. Li, and R. Tandon, “Local information privacy and its application to privacy-preserving data aggregation,” _IEEE Transactions on Dependable and Secure Computing_ , vol. 19, no. 3, pp. 1918–1935, 2022.