Network-Aware Differential Privacy

Sang-Woo Jun; Tianhao Wang; Yu Zheng; Zhou Li

REVIEW 3 major objections 5 minor 59 references

Network-Aware Differential Privacy

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that decentralized differential privacy has not systematically considered the network environment, and that a network adversary dropping, replaying, or delaying packets can manipulate local-DP frequency estimates with gains

desk verdict A clearly written vision paper with a useful agenda but an overstated gap claim; worth referee time as a position statement, not as an empirical or theoretical result. read the letter →

arxiv 2509.04710 v1 pith:Q2Y6FOYO submitted 2025-09-04 cs.CR

Zhou Li , Yu Zheng , Tianhao Wang , Sang-Woo Jun This is my paper · ORCID

classification cs.CR

keywords differentialprivacylocalshufflemodelnetworkadversariesmanipulationattackspacketreplaytopologyresearchopportunities

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that decentralized differential privacy—local DP and shuffle DP—has largely ignored the network environment through which user reports travel, and that this is both a security gap and a design opportunity. It proposes a new research direction, network-aware DP, with two focus areas: security under untrusted networks and adapting DP to network topology. A preliminary experiment simulates packet drop, replay, and delay against three local-DP frequency estimation protocols and reports attack gains comparable to those of baseline user-corruption attacks, with replay the most effective. The paper then lays out five research opportunities spanning network-adversary analysis, network-centric defenses, routing of shuffled reports, open-shuffler discovery and verification, and multi-tier caching. If correct, this would push DP research to treat routing, loss, latency, and topology as first-class design inputs rather than abstraction boundaries.

What carries the argument

The key objects are the network adversary and the routing lens on shuffle DP. The network adversary is a standard network threat—compromised access point, ISP insider, or man in the middle—whose capabilities do not require breaking encryption: packet drop, replay, and delay, plus traffic sniffing. Its effectiveness is quantified by attack gain, the normalized difference in estimation error before and after the attack, using the same metric as the user-corruption baseline. The routing lens treats the user–shuffler–server architecture as a message-routing problem: addressing modes (unicast, multicast, broadcast, anycast), routing algorithms, cost measures (bandwidth, latency, and a shuffler's

What would settle it

Reproduce the Section 4 experiment on real network traces with confidence intervals; if replay gains do not exceed natural jitter and loss on a lossy LoRa-like channel, the network-adversary threat would not be distinguishable from benign network noise. Separately, a literature search finding mechanisms explicitly designed around network conditions, such as loss-aware local DP or topology-aware shuffler selection, would directly contradict the claimed gap.

Watch

Extended reading notes

Core claim

The paper's central claim is that network awareness is a missing component of differential privacy research: no systematic study has surveyed the intersection of networking and DP, and no significant effort has developed DP mechanisms explicitly tailored to network environments. To fill this gap, the authors propose network-aware DP and organize it around two focus areas—security under untrusted networks and adaptation to network topology. As evidence that network adversaries matter, their preliminary experiment extends two local-DP manipulation attacks to a network adversary that drops, replays, or delays packets, and reports attack gains comparable to the user-corruption baseline: the rand

Load-bearing premise

The load-bearing premise is that previous differential-privacy work has not seriously accounted for real-world network conditions, with topology-adjacent shuffling schemes set aside as not network-aware; if those count, the gap motivating the paper narrows, and the experiment further assumes simulated packet manipulation stands in for real network adversaries.

Editorial extensions

If this is right

Network adversaries can obtain attack gains comparable to user-corruption attacks without breaking encryption, so threat models for decentralized DP should include packet drop, replay, and delay, not only corrupted users.
Existing defenses against corrupted users—such as detecting abnormal values or corrupted accounts—may be irrelevant against network adversaries; report IDs, latency checks, and loss-calibrated detection become the relevant tools.
Shuffle DP can be understood as a routing problem: addressing modes, routing algorithms, and cost metrics, including a shuffler's privacy-affinity to a client, shape the privacy-utility tradeoff.
Open-shuffler deployments require discovery protocols and verification drawn from mixnet auditing, including randomized partial checking, trip wires, and zero-knowledge proofs, plus incentives to run the service.
Caching DP reports at multiple tiers can reduce latency and strengthen privacy, borrowing DNS-style trust levels and cache policies such as TTL and source preference.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

I infer that replay deserves the most immediate defense investment, since the paper's own data show replay outperforms drop and delay; a natural next step is measuring the marginal attack gain per replayed copy.
Beyond the paper's routing analogy, if privacy amplification can be modeled as an edge weight on a shuffle path, then shuffler selection becomes a constrained shortest-path problem that network protocols could solve in a decentralized way.
A testable extension I would propose is to run the same attacks on naturally lossy traffic traces: in channels with high packet-loss rates, adversarial dropping may be indistinguishable from benign loss, so DP mechanisms should specify loss-tolerant aggregation rather than only attack detection.
An implicit consequence is that network planning itself becomes a privacy lever: choosing topologies with more shuffle hops or better-connected intermediate nodes could lower the privacy budget needed for a given utility.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You can read this as a roadmap, not a result. The paper proposes 'network-aware DP' as a research direction and lists five concrete opportunities: network-adversary attacks on decentralized DP, network-centric defenses, multi-hop shuffle routing, shuffler discovery/verification, and network-aware caching for DP. The framing is genuinely new as an organized agenda, and a few of the opportunities, like open-shuffler discovery and tying DP caching to network caching, are not collected anywhere else. The paper is also honest: it calls its experiments preliminary and explicitly sets aside message-size overhead as low priority.

What it does well is synthesis. It draws useful connections between shuffle-DP and existing networking concepts (multicast, anycast, BGP/OSPF, DNS caches, mix-net verification) and cites the relevant prior work rather than ignoring it. The writing is clear and the structure is easy to follow.

The main soft spot is the motivating claim that 'no significant efforts' exist at the networking/DP intersection. That's not supported by the paper's own bibliography. Network shuffling [33] is literally a routing scheme over a user graph, concurrent shuffle [43] is multicast-style routing to multiple shufflers, and the side-channel work [46] is explicitly about network traffic analysis against shuffle DP. The authors dismiss these as not considering 'factors of a real-world network environment,' but they never define what that means, so the gap claim becomes a judgement call rather than a factual finding. It would be easy to soften this to 'no systematic framework has connected these efforts,' which is true and still valuable. As written, the stronger claim will draw fire and weaken the paper's credibility.

Second, the preliminary experiment is very light. One synthetic uniform dataset, no error bars, no repeated trials, no confidence intervals, and the attack gain comparison to LDPGuard is qualitative. That is acceptable for a vision paper, but the paper should either add a couple of datasets and error bars or clearly label the experiment as an illustrative feasibility check, not a measurement. If they release code, that would help a lot.

Overall this paper is for a reader who wants a map of open problems in decentralized DP plus network systems. It is not a deep technical contribution. It deserves peer review as a position paper, with the expectation that the authors will revise the gap claim and either strengthen or demote the experiment. I would send it to a workshop or a venue that accepts vision papers, but not to a top-tier venue as a regular paper.

My recommendation: accept with major revisions, conditional on the framing changes and the experimental caveats. It is worth a serious referee, but the current draft overstates its novelty and under-delivers on evidence.

Referee Report

3 major / 5 minor

Summary. The paper argues that differential privacy has been decentralized (local and shuffle DP), that this decentralization makes DP depend on network communications, and that the networking dimension is missing from existing DP research. It asserts two gap claims in the abstract and Section 1: no systematic study has surveyed networking×DP research opportunities, and no significant efforts have developed DP mechanisms explicitly tailored to network environments. It then introduces "network-aware DP", identifies two focus areas (untrusted network and topology), and lists five research opportunities: RO1 network-adversary security analysis; RO2 network-centric defenses; RO3 message routing for shuffle DP; RO4 open-shuffler discovery/verification; RO5 network-aware caching. A preliminary simulation attacks three LDP frequency-estimation protocols with packet drop, replay, and delay, and reports attack gains similar to user-corruption baselines.

Significance. If the gap claims held, the paper would be a useful agenda-setting contribution: it gives crisp ROs and a concrete motivating sensor-network scenario, and it names specific networking mechanisms (routing, discovery, caching) that could be imported into shuffle DP. The authors appropriately label the experiments preliminary and point to a public LDPGuard code base, which gives some reproducibility. I also credit the paper for not overclaiming the empirical results. However, because the novelty of the paper rests on the absence of prior "network-aware DP" work, the literature framing must carry real weight; in its current form the central premise is under-specified and contradicted by works the paper itself cites. The contribution is therefore more plausible as an "underexplored direction" paper than as a demonstration that the area is unstudied.

major comments (3)

[Abstract, §1, §5] The two motivating claims—"no systematic study has surveyed..." and "nor have there been significant efforts..."—are not established. §5 discusses network shuffling [33], which routes reports via random walks over the user graph, and concurrent shuffle [43], which distributes messages to k shufflers; these are topology-/routing-aware by construction. §4 relies on [46], which designs shuffle-DP side-channel defenses based on traffic timing/size/count. Any ordinary reading of "tailored for network environments" includes these. To make the gap claim falsifiable, the paper needs (i) an explicit definition of "network-aware DP", (ii) a literature-search/inclusion method, and (iii) a concrete analysis of why [33], [43], and [46] fall outside the definition. Without this, the claim is circular.
[§5, RO3] The sentence "none of the aforementioned works consider factors of a real-world network environment" is a conclusion without a criterion. The paper uses "real-world network environment" nowhere else. Is the criterion packet loss/delay/bandwidth, topology realism, or deployment constraints? This matters because [33] already studies a user graph and routing, so the mere presence of routing is not enough to separate the paper from prior work. Please state the dimensions on which [33], [43], and [46] fall short, and use that same list to evaluate RO3–RO5. If the dimensions are added after the fact, the claimed gap is constructed rather than discovered.
[§4, Preliminary experiments] The preliminary experiments are presented as evidence that network adversaries should be considered, but the evidence is not quantitatively supported. There is one synthetic uniform dataset, no repeated trials, no error bars or confidence intervals, and no formal definition of "attack gain" in the text. The comparisons to the LDPGuard baseline [25] are qualitative ("also around 0.05", "ranges between 0.2 to 0.5 in [25]"), not matched re-runs under identical configurations. Since Figures 2 and 3 are not reproducible from the text, the conclusion "network adversary should be considered" goes beyond the displayed evidence. Add formal attack-gain definitions, report variance over multiple runs, use more datasets, and include a direct re-run of the baseline under the same conditions.

minor comments (5)

[§4] "package drop/replay/delay" should be "packet drop/replay/delay" throughout the experiment description.
[§5, Figure 4] "multi-hop shuffle DP" appears in the caption but is not formally defined in RO3; either define the scheme or rename the figure element.
[§5, RO4] "Open shufflers" are described as a promising primitive, but the paper does not state what privacy guarantee they must satisfy or how their misbehavior interacts with shuffle-DP amplification; label this explicitly as an open question.
[§6, Low-priority goals] The dismissal of message-size/count overhead relies on an assertion about small periodic reports; this should be supported or softened, since [12,51] highlight asymptotic message complexity.
[§2] Typo: "signficant adoption" should be "significant adoption". Also reference [15] is a personal blog and should be labeled as such if used as evidence for the scale of the DP literature.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the paper is a vision/position piece whose central gap claim is a literature-review assertion, not a derived result.

full rationale

The paper contains no derivation chain in which an equation or fitted parameter is reused as a prediction. The central claim is a negative existential ('no systematic study', 'no significant efforts'), supported only by 'based on our literature review'. A weak or under-specified literature review is a novelty/correctness risk, not circularity: no premise already contains the conclusion by construction. The paper's own citations of network shuffling [33], concurrent shuffle [43], and side-channel shuffle defenses [46] could indeed narrow the claimed gap, but that is a question of whether the gap claim is well-supported, not whether it is circular. The preliminary experiments (Section 4) extend the external LDPGuard code [25] by adding packet drop/replay/delay; they compare attack gains against the user-corruption baseline and do not fit a parameter and then 'predict' the same quantity. The self-citations ([7], [48], [49], [50]) are background references for DNS tracking, streaming DP, shuffler defenses, and heavy hitters; none is load-bearing for the paper's proposal, and there is no invoked uniqueness theorem or ansatz smuggled in via self-citation. The mapping of existing shuffle protocols to multicast/multi-hop routing (RO3) is an analogy/reframing rather than a circular reduction; it does not claim to derive a novel result solely from a renamed one. Overall the derivation content is minimal and self-contained, so the circularity score is low.

Assumptions & free parameters 1 free parameters · 4 assumptions · 2 invented entities

The central claim of the paper is an agenda, so the axiomatic load is light: standard DP properties, a specific threat model, and a contestable gap claim. The only numerical inputs are the hand-chosen attack configurations, which are illustrative rather than fitted to a derivation. Two novel architectural concepts (open shufflers and multi-hop shuffle DP) are introduced without independent evidence.

free parameters (1)

packet drop/replay/delay configuration = drop rates 0.1/0.3/0.5; replay counts 5/10/20; delay ratios 0.2/0.5
Hand-chosen simulation settings that determine the attack-gain values in Figures 2 and 3. The paper's conclusion that packet replay is the most effective attack is configuration-specific and not statistically justified.

assumptions (4)

standard math Standard properties of differential privacy (post-processing, composition, ε-LDP definition) hold as described in the primer.
The paper relies on Definition 1 and the standard properties in Section 2 without proving them; they are background mathematical facts.
domain assumption A network adversary can drop, replay, and delay packets without breaking encryption and without corrupting users, and these actions can influence DP aggregation results.
This threat model is introduced in RO1 in Section 4. It is a modeling choice that the preliminary experiment then tests, but the paper does not establish that an attacker with only these capabilities can achieve meaningful gains across real deployments.
ad hoc to paper No prior work has systematically studied the impact of network topology on DP mechanisms.
This is the paper's central gap claim (Section 1 and Section 5). It is used to motivate every research opportunity, but existing works like network shuffling [33] and concurrent shuffle [43] already use topology, so the premise is contestable.
domain assumption Trusted Execution Environment (TEE) based shufflers create a single point of failure and high overhead, making alternative shuffler models desirable.
This assumption about Prochlo [5] is stated in Section 5 and is used to motivate RO3-RO5, but the paper does not quantify the overhead or failure probability.

invented entities (2)

Open shufflers
purpose: Nearby devices that volunteer to relay and shuffle messages for clients without reliable Internet access, enabling shuffle DP in disconnected or edge settings (RO4).
The paper introduces this concept as a way to decentralize the shuffler, but provides no implementation, protocol design, or external evidence that such devices would exist or behave faithfully.
Multi-hop shuffle DP
purpose: An architecture where messages pass through multiple shufflers in sequence, modeled on multi-hop routing, to avoid a single point of failure (RO3, Figure 4c).
The paper sketches this as a design space mapped from network routing, but does not analyze its privacy amplification, communication cost, or adversarial resilience.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Network-Aware Differential Privacy." pith.science (2026). https://pith.science/paper/Q2Y6FOYO

@misc{pith2026250904710,
  author       = {Pith},
  title        = {Pith review of: Network-Aware Differential Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q2Y6FOYO}},
  note         = {Machine review of arXiv:2509.04710}
}

read the original abstract

Differential privacy (DP) is a privacy-enhancement technology (PET) that receives prominent attention from the academia, industry, and government. One main development over the past decade has been the decentralization of DP, including local DP and shuffle DP. Despite that decentralized DP heavily relies on network communications for data collection,we found that: 1) no systematic study has surveyed the research opportunities at the intersection of networking and DP; 2) nor have there been significant efforts to develop DP mechanisms that are explicitly tailored for network environments. In this paper, we seek to address this gap by initiating a new direction of network-aware DP. We identified two focus areas where the network research can offer substantive contributions to the design and deployment of DP, related to network security and topology. Through this work, we hope to encourage more research that adapt/optimize DP's deployment in various network environments.

Figures

Figures reproduced from arXiv: 2509.04710 by the authors.

**Figure 2.** Network RPA attack on the uniform dataset [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Network RIA attack on the uniform dataset. motivating example: Liu et al. conducted a study of packet losses in a standard LoRa network of Shanghai, China [35], and they found the packet loss rate (PLR) for most devices ranges from 0% to 10%, while it rises to over 90% for a few devices. Defenses tailored to network topologies could be investigated, and we describe a few ideas in Section 5. Preliminary experiments. … view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Comparison between local, standard shuffle and new multi-hop shuffle DP (described in RO3). For [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 54 canonical work pages

[33]

Seng Pei Liew, Tsubasa Takahashi, Shun Takagi, Fumiyuki Kato, Yang Cao, and Masatoshi Yoshikawa. 2022. Network shuffling: Privacy amplification via random walks. InProceedings of the 2022 International Conference on Management of Data. 773–787

work page 2022
[43]

Jay Tenenbaum, Haim Kaplan, Yishay Mansour, and Uri Stemmer. 2023. Concurrent shuffle differential privacy under continual observation. InInternational Conference on Machine Learning. PMLR, 33961–33982

work page 2023
[46]

Shaowei Wang, Jin Li, Changyu Dong, Zhili Zhou, Di Wang, and Zikai Wen. 2025. Side-channel Attacks and New Principles in the Shuffle Model of Differential Privacy.IEEE Transactions on Information Forensics and Security(2025)

work page 2025
[25]

Kai Huang, Gaoya Ouyang, Qingqing Ye, Haibo Hu, Bolong Zheng, Xi Zhao, Ruiyuan Zhang, and Xiaofang Zhou. 2024. LDPGuard: Defenses Against Data Poisoning Attacks to Local Differential Privacy Protocols. IEEE Trans. Knowl. Data Eng.36, 7 (2024), 3195–3209

work page 2024
[1]

Amazon. 2023. Amazon sidewalk privacy and security whitepa- per. https://m.media-amazon.com/images/G/01/sidewalk/final _pri vacy_security_whitepaper.pdf

work page 2023
[2]

Apple. 2023. Find My Network. https://developer.apple.com/find-my/

work page 2023
[3]

Apple and Google. 2021. Exposure Notification Privacy-preserving Analytics (ENPA) white paper. (2021)

work page 2021
[4]

Reyhane Attarian, Esfandiar Mohammadi, Tao Wang, and Emad Hey- dari Beni. 2023. Mixflow: Assessing mixnets anonymity with con- trastive architectures and semantic network information.Cryptology ePrint Archive(2023)

work page 2023

Show all 59 references

[5]

Andrea Bittau, Úlfar Erlingsson, Petros Maniatis, Ilya Mironov, Ananth Raghunathan, David Lie, Mitch Rudominer, Ushasree Kode, Julien Tinnes, and Bernhard Seefeld. 2017. Prochlo: Strong privacy for ana- lytics in the crowd. InProceedings of the 26th Symposium on Operating Syst...

2017
[6]

Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2021. Data poi- soning attacks to local differential privacy protocols. In30th USENIX Security Symposium (USENIX Security 21). 947–964

2021
[7]

Deliang Chang, Joann Qiongna Chen, Zhou Li, and Xing Li. 2022. Hide and Seek: Revisiting DNS-based User Tracking. In2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P). IEEE, 188–205

2022
[8]

David L Chaum. 1981. Untraceable electronic mail, return addresses, and digital pseudonyms.Commun. ACM24, 2 (1981), 84–90

1981
[9]

Albert Cheu. 2021. Differential privacy in the shuffle model: A survey of separations.arXiv preprint arXiv:2107.11839(2021)

2021 arXiv
[10]

Albert Cheu, Adam Smith, and Jonathan Ullman. 2021. Manipulation attacks in local differential privacy. In2021 IEEE Symposium on Security and Privacy (SP). IEEE, 883–900

2021
[11]

Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev. 2019. Distributed differential privacy via shuffling. InAd- vances in Cryptology–EUROCRYPT 2019: 38th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Darmstad...

2019
[12]

Albert Cheu and Chao Yan. 2021. Pure differential privacy from secure intermediaries.arXiv preprint arXiv:2112.10032(2021)

2021 arXiv
[13]

Albert Cheu and Maxim Zhilyaev. 2022. Differentially private his- tograms in the shuffle model from fake users. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 440–457

2022
[14]

Jonathan de Carvalho Silva, Joel JPC Rodrigues, Antonio M Alberti, Petar Solic, and Andre LL Aquino. 2017. LoRaWAN-A low power WAN protocol for Internet of Things: A review and opportunities. In 2017 2nd International multidisciplinary conference on computer and energy science...

2017
[15]

Damien Desfontaines. 2022. A bottom-up approach to making dif- ferential privacy ubiquitous. https://desfontain.es/privacy/bottom- up-differential-privacy.html. Ted is writing things (personal blog), Accessed: Oct, 2023

2022
[16]

Sabrina De Capitani di Vimercati, Angelo Genovese, Giovanni Livraga, Vincenzo Piuri, and Fabio Scotti. 2013. Privacy and security in envi- ronmental monitoring systems: issues and solutions. InComputer and Information Security Handbook. Elsevier, 835–853

2013
[17]

Bolin Ding, Janardhan Kulkarni, and Sergey Yekhanin. 2017. Collecting telemetry data privately.Advances in Neural Information Processing Systems30 (2017)

2017
[18]

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Calibrating noise to sensitivity in private data analysis. InTheory of cryptography conference. Springer, 265–284

2006
[19]

Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. 2014. Rap- por: Randomized aggregatable privacy-preserving ordinal response. InProceedings of the 2014 ACM SIGSAC conference on computer and communications security. 1054–1067

2014
[20]

Liyue Fan and Akarsh Pokkunuru. 2021. DPNeT: Differentially private network traffic synthesis with generative adversarial networks. In IFIP Annual Conference on Data and Applications Security and Privacy. Springer, 3–21

2021
[21]

Tim Geoghegan, Christopher Patton, Eric Rescorla, and Christopher A Wood. 2023. Distributed aggregation protocol for privacy preserving measurement.IETF(2023)

2023
[22]

Google. 2022. Google’s Differential Privacy library. https://github.c om/google/differential-privacy

2022
[23]

Thomas Haines and Johannes Müller. 2020. SoK: techniques for ver- ifiable mix nets. In2020 IEEE 33rd Computer Security Foundations Symposium (CSF). IEEE, 49–64

2020
[24]

Naoise Holohan, Stefano Braghin, Pól Mac Aonghusa, and Killian Levacher. 2019. Diffprivlib: the IBM differential privacy library.ArXiv e-prints1907.02444 [cs.CR] (July 2019)

2019 arXiv
[26]

ISC. 2018. Trust levels for RRsets in BIND cache. https://kb.isc.org/d ocs/aa-01534

2018
[27]

Markus Jakobsson, Ari Juels, and Ronald L Rivest. 2002. Making mix nets robust for electronic voting by randomized partial checking. In 11th USENIX Security Symposium (USENIX Security 02)

2002
[28]

Peter Kairouz, Sewoong Oh, and Pramod Viswanath. 2014. Extremal mechanisms for local differential privacy.Advances in neural informa- tion processing systems27 (2014)

2014
[29]

Shahram Khazaei, Tal Moran, and Douglas Wikström. 2012. A mix-net from any CCA2 secure cryptosystem. InAdvances in Cryptology– ASIACRYPT 2012: 18th International Conference on the Theory and Application of Cryptology and Information Security, Beijing, China, December 2-6, 2012...

2012
[30]

LDPGuard. 2022. main.py. https://github.com/TechReport2023/LDPG uard/blob/main/LDPGuardCode/main.py

2022
[31]

Huang-Chen Lee and Kai-Hsiang Ke. 2018. Monitoring of large-area IoT sensors using a LoRa wireless mesh network system: Design and evaluation.IEEE Transactions on Instrumentation and Measurement67, 9 (2018), 2177–2187. 7 Zhou Li, Yu Zheng, Tianhao Wang, and Sang-Woo Jun

2018
[32]

Xiaoguang Li, Ninghui Li, Wenhai Sun, Neil Zhenqiang Gong, and Hui Li. 2023. Fine-grained poisoning attack to local differential privacy protocols for mean and variance estimation. In32nd USENIX Security Symposium (USENIX Security 23). 1739–1756

2023
[34]

Jianqing Liu, Chi Zhang, and Yuguang Fang. 2018. Epic: A differential privacy framework to defend smart homes against internet traffic analysis.IEEE Internet of Things Journal5, 2 (2018), 1206–1217

2018
[35]

Qian Liu, Yanyan Mu, Jin Zhao, Jingxia Feng, and Bin Wang. 2020. Characterizing packet loss in city-scale LoRaWAN deployment: Anal- ysis and implications. In2020 IFIP Networking Conference (Networking). IEEE, 704–712

2020
[36]

Miti Mazmudar, Thomas Humphries, Jiaxiang Liu, Matthew Rafuse, and Xi He. 2022. Cache Me If You Can: Accuracy-Aware Inference Engine for Differentially Private Data Exploration.Proceedings of the VLDB Endowment16, 4 (2022), 574–586

2022
[37]

Takao Murakami, Yuichi Sei, and Reo Eriguchi. 2024. Augmented Shuffle Protocols for Accurate and Robust Frequency Estimation under Differential Privacy. In2025 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 19–19

2024
[38]

OpenDP. 2022. Smartnoise. https://smartnoise.org/

2022
[39]

Edo Roth, Karan Newatia, Yiping Ma, Ke Zhong, Sebastian Angel, and Andreas Haeberlen. 2021. Mycelium: Large-scale distributed graph queries with differential privacy. InProceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles. 327–343

2021
[40]

Edo Roth, Hengchu Zhang, Andreas Haeberlen, and Benjamin C Pierce
[41]

Amir Sabzi, Rut Vora, Swati Goswami, Margo Seltzer, Mathias Lécuyer, and Aastha Mehta. 2023. NetShaper: A Differentially Private Net- work Side-Channel Mitigation System.arXiv preprint arXiv:2310.06293 (2023)

2023 arXiv
[42]

Apple Differential Privacy Team. 2017. Learning with Privacy at Scale. https://machinelearning.apple.com/research/learning-with-pr ivacy-at-scale

2017
[44]

Stacey Truex, Ling Liu, Ka-Ho Chow, Mehmet Emre Gursoy, and Wenqi Wei. 2020. LDP-Fed: Federated learning with local differential privacy. InProceedings of the third ACM international workshop on edge systems, analytics and networking. 61–66

2020
[45]

Paul Vines, Samuel McKay, Jesse Jenter, and Suresh Krishnaswamy
[47]

Tianhao Wang, Jeremiah Blocki, Ninghui Li, and Somesh Jha. 2017. Locally Differentially Private Protocols for Frequency Estimation. In Proceedings of the 26th USENIX Security Symposium. 729–745

2017
[48]

Tianhao Wang, Joann Qiongna Chen, Zhikun Zhang, Dong Su, Yue- qiang Cheng, Zhou Li, Ninghui Li, and Somesh Jha. 2021. Continuous release of data streams under both centralized and local differential pri- vacy. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Com...

2021
[49]

Tianhao Wang, Bolin Ding, Min Xu, Zhicong Huang, Cheng Hong, Jingren Zhou, Ninghui Li, and Somesh Jha. 2020. Improving utility and security of the shuffler-based differential privacy.Proceedings of the VLDB Endowment13, 13 (2020), 3545–3558

2020
[50]

Tianhao Wang, Ninghui Li, and Somesh Jha. 2021. Locally differentially private heavy hitter identification.IEEE Transactions on Dependable and Secure Computing(2021)

2021
[51]

Teng Wang, Xuefeng Zhang, Jingyu Feng, and Xinyu Yang. 2020. A comprehensive survey on local differential privacy toward data statis- tics and analysis.Sensors20, 24 (2020), 7030

2020
[52]

Stanley L Warner. 1965. Randomized response: A survey technique for eliminating evasive answer bias.J. Amer. Statist. Assoc.60, 309 (1965), 63–69

1965
[53]

Jean-Luc Watson, Tess Despres, Alvin Tan, Shishir G Patil, Prabal Dutta, and Raluca Ada Popa. 2024. Nebula: A Privacy-First Platform for Data Backhaul. In2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 92–92

2024
[54]

Ashkan Yousefpour, Igor Shilov, Alexandre Sablayrolles, Davide Tes- tuggine, Karthik Prasad, Mani Malek, John Nguyen, Sayan Ghosh, Akash Bharadwaj, Jessica Zhao, Graham Cormode, and Ilya Mironov
[55]

Xiaokuan Zhang, Jihun Hamm, Michael K Reiter, and Yinqian Zhang
[2019]

InProceedings of the 26th ISOC Symposium on network and distributed system security

Statistical privacy for streaming traffic. InProceedings of the 26th ISOC Symposium on network and distributed system security. 8
[2020]

In14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)

Orchard: Differentially private analytics at scale. In14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 1065–1081
[2021]

arXiv preprint arXiv:2109.12298(2021)

Opacus: User-Friendly Differential Privacy Library in PyTorch. arXiv preprint arXiv:2109.12298(2021)

2021 arXiv
[2024]

Communication Breakdown: Modularizing Application Tunnel- ing for Signaling Around Censorship.Proceedings on Privacy Enhanc- ing Technologies(2024)

2024

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [33]

Seng Pei Liew, Tsubasa Takahashi, Shun Takagi, Fumiyuki Kato, Yang Cao, and Masatoshi Yoshikawa. 2022. Network shuffling: Privacy amplification via random walks. InProceedings of the 2022 International Conference on Management of Data. 773–787

work page 2022

[2] [43]

Jay Tenenbaum, Haim Kaplan, Yishay Mansour, and Uri Stemmer. 2023. Concurrent shuffle differential privacy under continual observation. InInternational Conference on Machine Learning. PMLR, 33961–33982

work page 2023

[3] [46]

Shaowei Wang, Jin Li, Changyu Dong, Zhili Zhou, Di Wang, and Zikai Wen. 2025. Side-channel Attacks and New Principles in the Shuffle Model of Differential Privacy.IEEE Transactions on Information Forensics and Security(2025)

work page 2025

[4] [25]

Kai Huang, Gaoya Ouyang, Qingqing Ye, Haibo Hu, Bolong Zheng, Xi Zhao, Ruiyuan Zhang, and Xiaofang Zhou. 2024. LDPGuard: Defenses Against Data Poisoning Attacks to Local Differential Privacy Protocols. IEEE Trans. Knowl. Data Eng.36, 7 (2024), 3195–3209

work page 2024

[5] [1]

Amazon. 2023. Amazon sidewalk privacy and security whitepa- per. https://m.media-amazon.com/images/G/01/sidewalk/final _pri vacy_security_whitepaper.pdf

work page 2023

[6] [2]

Apple. 2023. Find My Network. https://developer.apple.com/find-my/

work page 2023

[7] [3]

Apple and Google. 2021. Exposure Notification Privacy-preserving Analytics (ENPA) white paper. (2021)

work page 2021

[8] [4]

Reyhane Attarian, Esfandiar Mohammadi, Tao Wang, and Emad Hey- dari Beni. 2023. Mixflow: Assessing mixnets anonymity with con- trastive architectures and semantic network information.Cryptology ePrint Archive(2023)

work page 2023