Local Differential Privacy (LDP) has become a widely adopted paradigm for collecting and analyzing sensitive data from user devices. Personalized LDP (PLDP) extends LDP by enabling users to operate under different privacy budgets, better reflecting users' diverse privacy preferences that arise in practice. While PLDP provides greater flexibility, it introduces new challenges for the data collector, particularly in how estimates obtained from users with different privacy budgets should be combined and post-processed to maximize utility. In particular, while post-processing methods have been explored in LDP, similar studies remain lacking for PLDP. In this paper, we present a systematic study of combination and post-processing methods under PLDP. We consider two combination strategies: Simple Averaging (SA) and Inverse Variance Weighting (IVW), as well as three end-to-end post-processing architectures (No-PP, Combine-First, PP-First) that differ in whether post-processing is applied before combination, after combination, or not at all. Through extensive experiments, we show that IVW consistently outperforms SA. We further demonstrate that applying post-processing at the group level before aggregation (PP-First) generally yields higher utility than alternative architectures, although the gap narrows when IVW is used. Our results also reveal that no single post-processing method is universally optimal under PLDP; however, normalization-based methods such as Norm-Sub and Norm-Mul provide strongest performance. Finally, we analyze the impact of population-level privacy preferences and show how the distribution of privacy budgets affects overall utility and user incentives. Together, our results and findings provide practical guidance for designing effective pipelines that improve utility under PLDP.

Local differential privacy (LDP) has recently become a popular notion for privacy-preserving data collection from user devices. It has been applied in numerous contexts related to the Internet of Things (IoT) and cyber-physical systems to enable privacy-preserving edge data analytics. The strength of privacy protection in LDP deployments depends on the privacy budget ɛ, and there are several scenarios in which it is desirable for the value of ɛ to remain hidden from untrusted third parties, or the inference of ɛ by an untrusted third party may constitute a privacy leakage. In this article, we propose a new class of attacks called budget inference attacks (BIAs), which enable an adversary to infer the ɛ budget value from the outputs of an LDP protocol. We develop BIAs for two types of adversaries: informed adversaries who have knowledge of the statistical data distribution, and uninformed adversaries who do not. We apply our BIAs on five popular LDP protocols and experimentally evaluate them using multiple datasets, varying ɛ budgets, population sizes, and attack settings and parameters. Results show that our BIAs are highly effective, as they enable the adversary to infer the ɛ value with low errors. We also propose three potential countermeasures against our BIAs. Analyses show that while our countermeasures can be effective in reducing BIA accuracy, they also increase utility loss; therefore, the tradeoff between BIA accuracy and utility loss needs to be carefully considered.

The popularity of smartphones, GPS-enabled devices, social networks, and connected vehicles all contribute to the increasing volume of spatial data. Spatial decompositions assist in handling big spatial data, and they have been commonly used in the Differential Privacy (DP) literature for range query answering, spatial indexing, count-of-counts histograms, data summarization, and visualization. However, their applications under the emerging Local DP (LDP) notion are scarce. In this article, we study the problem of building hierarchical spatial decompositions under LDP, focusing on two methods: quadtrees and kd-trees. We develop two solutions for quadtrees: a baseline solution that is inspired by the centralized DP literature, and a proposed solution that utilizes a single data collection step from users, propagates density estimates to remaining nodes, and performs structural corrections to the quadtree. Since kd-trees rely on node medians which are data-dependent, we observe that it is not feasible to build kd-trees using a single data collection step. We therefore propose an iterative solution that constructs kd-trees in top-down fashion by utilizing a novel algorithm for estimating node medians at each tree depth. We experimentally evaluate our quadtree and kd-tree algorithms using four real-world spatial datasets, multiple utility metrics, varying privacy budgets, and tree parameters. Results demonstrate that our algorithms enable the building of accurate spatial decompositions that provide high utility in practice. Notably, our quadtrees and kd-trees achieve substantially lower errors in answering spatial density queries (up to 10-fold improvement) when compared with a state-of-the-art method.