Plume: Differential Privacy at Scale
summary
Plume is a distributed system for histograms, sums and quantiles that runs on datasets of trillions of records and petabyte scale, using the Gaussian mechanism with user-specified L0 and L∞ sensitivity interpreted as “distinct keys per user” and “per-key contributions.” It enforces those bounds via contribution bounding, applies a DP key selection step, then re-restricts and re-bounds to recover near-exact counts. Naive execution requires five shuffles and was ~13× slower; optimizations (pre-aggregation, reusing user-shuffled results, Bloom filters with false-positive correction) cut overhead to ~2–3×.
AI-written summary · about
chapters (6)
related talks
19mPractical Considerations for Differential Privacy
27mYou've got trust issues, we've got solutions: Differential Privacy
01h 01mFrom Theory to Practice: Crafting Differential Privacy Systems with Haskell
35mPrivacy amplification by random allocation
27mPrivacy-preserving statistical analyses
17mPrivate Tuning of LLMs in Practice: From VaultGemma to Custom Fine-Tuning
01h 00mPractical Difficulties in the Application of Differential Privacy for the Release of Large-Scale...
37mUser-level and federated local differential privacy