Shuffle Gaussian Mechanism for Differential Privacy. (arXiv:2206.09569v2 [cs.CR] UPDATED)

We study Gaussian mechanism in the shuffle model of differential privacy
(DP). Particularly, we characterize the mechanism's R\'enyi differential
privacy (RDP), showing that it is of the form: $$ \epsilon(\lambda) \leq
\frac{1}{\lambda-1}\log\left(\frac{e^{-\lambda/2\sigma^2}}{n^\lambda}\sum_{\substack{k_1+\dotsc+k_n=\lambda;\\k_1,\dotsc,k_n\geq
0}}\binom{\lambda}{k_1,\dotsc,k_n}e^{\sum_{i=1}^nk_i^2/2\sigma^2}\right) $$ We
further prove that the RDP is strictly upper-bounded by the Gaussian RDP
without shuffling. The shuffle Gaussian RDP is advantageous in composing
multiple DP mechanisms, where we demonstrate its improvement over the
state-of-the-art approximate DP composition theorems in privacy guarantees of
the shuffle model. Moreover, …

differential privacy privacy