All Papers
Title |
|---|
Title |
|---|

The shuffle model enhances privacy by anonymizing users' reports through random permutation. This paper presents the first systematic study of the single-message shuffle model from an information-theoretic perspective. We analyze two regimes: the shuffle-only setting, where each user directly submits its message (), and the shuffle-DP setting, where each user first applies a local -differentially private mechanism before shuffling (). Let denote the shuffled sequence produced by a uniformly random permutation , and let represent the position of user 1's message after shuffling.For the shuffle-only setting, we focus on a tractable yet expressive \emph{basic configuration}, where the target user's message follows and the remaining users' messages are i.i.d.\ samples from , i.e., . We derive asymptotic expressions for the mutual information quantities and as , and demonstrate how this analytical framework naturally extends to settings with heterogeneous user distributions.For the shuffle-DP setting, we establish information-theoretic upper bounds on total information leakage. When each user applies an -DP mechanism, the overall leakage satisfies and . These results bridge shuffle differential privacy and mutual-information-based privacy.
View on arXiv