Distributed, Private, Sparse Histograms in the Two-Server Model

We consider the computation of sparse, (𝜀, 𝛿)-differentially private (DP) histograms in the two-server model of secure multi-party computation (MPC), which has recently gained traction in the context of privacy-preserving measurements of aggregate user data. We introduce protocols that enable two semi-honest non-colluding servers to compute histograms over the data held by multiple users, while only learning a private view of the data. Our solution achieves the same asymptotic ℓ ∞ -error of 𝑂 log(1/𝛿 ) 𝜀 as in the central model of DP, but without relying on a trusted curator. The server communication and computation costs of our protocol are independent of the number of histogram buckets, and are linear in the number of users, while the client cost is independent of the number of users, 𝜀, and 𝛿. Its linear dependence on the number of users lets our protocol scale well, which we confirm using microbenchmarks: for a billion users, 𝜀 = 0.5, and 𝛿 = 10 -11 , the per-user cost of our protocol is only 1.08 ms of server computation and 339 bytes of communication. In contrast, a baseline protocol using garbled circuits only allows up to 10 6 users, where it requires 600 KB communication per user.