Heavy hitters and the structure of local privacy

B. U.N. Mark, Jelani Nelson, Uri Stemmer

Research output: Contribution to journalArticlepeer-review


We present a new locally differentially private algorithm for the heavy hitters problem that achieves optimal worst-case error as a function of all standardly considered parameters. Prior work obtained error rates that depend optimally on the number of users, the size of the domain, and the privacy parameter but depend sub-optimally on the failure probability. We strengthen existing lower bounds on the error to incorporate the failure probability and show that our new upper bound is tight with respect to this parameter as well. Our lower bound is based on a new understanding of the structure of locally private protocols. We further develop these ideas to obtain the following general results beyond heavy hitters. • Advanced Grouposition: In the local model, group privacy for k users degrades proportionally to ≈√k instead of linearly in k as in the central model. Stronger group privacy yields improved max-information guarantees, as well as stronger lower bounds (via “packing arguments”), over the central model. • Building on a transformation of Bassily and Smith (STOC 2015), we give a generic transformation from any non-interactive approximate-private local protocol into a pure-private local protocol. Again in contrast with the central model, this shows that we cannot obtain more accurate algorithms by moving from pure to approximate local privacy.

Original languageEnglish
Article number51
JournalACM Transactions on Algorithms
Issue number4
StatePublished - Oct 2019
Externally publishedYes


FundersFunder number
Center for Research on Computation and Society
National Science FoundationCCF-1350670, N00014-17-1-2127, IIS-1447471
Office of Naval ResearchN00014-15-1-2388
Alfred P. Sloan Foundation
Princeton University
Harvard University1565387


    • Differential privacy
    • Heavy hitters
    • Local model


    Dive into the research topics of 'Heavy hitters and the structure of local privacy'. Together they form a unique fingerprint.

    Cite this