About
I study the exact finite-sample theory of privacy amplification by shuffling — the mechanism by which anonymizing user reports can provably strengthen differential privacy guarantees.
My current work develops a complete asymptotic and exact framework for the shuffle model: sharp Gaussian and non-Gaussian limits for neighboring experiments, optimal mechanism design under local privacy constraints, and exact privacy envelopes that go beyond existing upper bounds.
Research interests: differential privacy, information theory, shuffle model, f-divergences, statistical experiment theory, optimal mechanism design.
Papers
March 2026
Growing Alphabets Do Not Automatically Amplify Shuffle Privacy: Obstruction, Estimation Bounds, and Optimal Mechanism Design
One-step neighboring shuffle experiments for ε₀-LDP channels along growing alphabets d → ∞ and optimal mechanism design for frequency estimation. An exact compression theorem, universal extremal bound χ²(W) ≤ (eᵋ⁰−1)²/eᵋ⁰ sharp iff the likelihood ratio is two-point, explicit obstruction families, and a sharp diluting/persistent dichotomy. Universal minimax lower bound of order (d−1)/(nχ*(W)). Augmented GRR — a fraction p of users applies aggressive GRR with λ* = √(d−1), the rest send null — is optimal under the canonical χ²-budget. GRR is the unique matched-budget optimizer within the subset-selection family.
Part III · March 2026
Universal Shuffle Asymptotics, Part III: Dominant-Block Quotient Geometry and Hybrid Gaussian–Compound-Poisson Limits in Finite-Alphabet Shuffle Privacy
Completes the finite-alphabet weak-limit theory by identifying the dominant-block quotient geometry governing neighboring shuffle experiments. Dominant blocks of arbitrary finite size, overlap between dominant output sets, and a decomposition: projecting onto the sum of dominant tangent spaces yields a Gaussian factor, while quotienting isolates a compound-Poisson jump field. Sharp O(n⁻¹/²) rate with an explicit compatibility condition for the sharper O(n⁻¹) rate, a boundary Berry–Esseen theorem, and a strong-boundary obstruction. Together with Parts I–II, yields a three-regime universality picture and a precise finite-alphabet Lévy–Khintchine layer for shuffle privacy.
Part II · March 2026
Universal Shuffle Asymptotics, Part II: Non-Gaussian Limits for Shuffle Privacy — Poisson, Skellam, and Compound-Poisson Regimes
Characterizes the first universality-breaking frontier for shuffle experiments. When exp(ε₀)/n → c², the Gaussian limit fails: Poisson-shift limits for canonical neighboring pairs, Skellam-shift limits for proportional compositions, and multivariate compound-Poisson limits for general finite alphabets. Explicit Le Cam rates of O(n⁻¹) and quantitative privacy curve convergence. Together with Part I, yields a three-regime picture: Gaussian/GDP, critical Poisson/Skellam/compound-Poisson, and super-critical no privacy.
Part I · January 2026
Universal Shuffle Asymptotics: Sharp Privacy Analysis in the Gaussian Regime
A sharp, experiment-level privacy theory for amplification by shuffling in the Gaussian regime. Exact likelihood-ratio identities for shuffled histograms, a complete conditional-expectation linearization theorem, sharp Jensen–Shannon divergence expansions with universal leading constant I_π/(8n), equivalence to Gaussian Differential Privacy with Berry–Esseen bounds, the full limiting (ε,δ) privacy curve, and Local Asymptotic Normality with quantitative Le Cam equivalence.