Local differential privacy (LDP) enables the efficient release of aggregate statistics without having to trust the central server (aggregator), as in the central model of differential privacy, and simultaneously protects a client's sensitive data. The shuffle model with LDP provides an additional layer of privacy, by disconnecting the link between clients and the aggregator. However, LDP has been shown to be vulnerable to malicious clients who can perform both input and output manipulation attacks, i.e., before and after applying the LDP mechanism, to skew the aggregator's results. In this work, we show how to prevent malicious clients from compromising LDP schemes. Our only realistic assumption is that the initial raw input is authenticated; the rest of the processing pipeline, e.g., formatting the input and applying the LDP mechanism, may be under adversarial control. We give several real-world examples where this assumption is justified. Our proposed schemes for verifiable LDP (VLDP), prevent both input and output manipulation attacks against generic LDP mechanisms, requiring only one-time interaction between client and server, unlike existing alternatives [37, 43]. Most importantly, we are the first to provide an efficient scheme for VLDP in the shuffle model. We describe, and prove security of, two schemes for VLDP in the local model, and one in the shuffle model. We show that all schemes are highly practical, with client run times of less than 2 seconds, and server run times of 5-7 milliseconds per client.

In this paper we propose and implement a digital permissioned decentralized anonymous payment scheme that finds a balance between anonymity and auditability. This approach allows banks to ensure that their clients are not participating in illegal financial transactions, whilst clients stay in control over their sensitive, personal information. Existing anonymous payment schemes often provide good privacy, but only little or mostly no auditability. We provide both by extending the Zerocash zk-SNARK based approach and adding functionality that allows for customer due diligence ‘at the gate’. Clients can do fully anonymous transactions up to a certain amount per time unit and larger transactions are forced to include verifiably encrypted transactions details that can only be opened by a select group of ‘judges’.