BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model

We propose a hybrid model of differential privacy that considers a combination of regular and opt-in users who desire the differential privacy guarantees of the local privacy model and the trusted curator model, respectively. We demonstrate that within this model, it is possible to design a new type of blended algorithm for the task of privately comput- ing the head of a search log. This blended approach provides significant improvements in the utility of obtained data compared to related work while pro- viding users with their desired privacy guarantees. Specifically, on two large search click data sets, com- prising 1.75 and 16 GB respectively, our approach attains NDCG values exceeding 95% across a range of privacy budget values.