Utility-Optimized Local Differential Privacy

• ULDP is defined as a local privacy mechanism that applies differential privacy guarantees only to designated sensitive inputs, allowing non-sensitive data to be reported exactly.
• Canonical mechanisms such as utility-optimized randomized response (uRR) and uRAP enhance statistical estimation by reducing obfuscation on non-sensitive values, achieving near non-private accuracy in certain regimes.
• Recent extensions include personalized ULDP with semantic tags and exact asymptotic optimality results, broadening its application to utility-aware and context-sensitive mechanism design.

Utility-Optimized Local Differential Privacy (ULDP) is a local privacy model for statistical data collection in which the privacy guarantee of standard local differential privacy is imposed only on a designated sensitive part of the input domain, while non-sensitive values are allowed to be reported through invertible outputs that preserve substantially more statistical signal. In its canonical form, ULDP was introduced for discrete distribution estimation over a finite alphabet, where the central motivation is that standard $\epsilon$-LDP treats all symbols as equally sensitive and therefore induces unnecessary obfuscation when only a subset of values is genuinely private. The resulting research area now includes the original sensitive/non-sensitive formulation, personalized extensions with semantic tags, exact asymptotic limits for discrete estimation, and a broader neighboring literature on utility-aware mechanism design under standard or generalized local privacy constraints (Murakami et al., 2018, Yoon et al., 29 Sep 2025).

1. Formal definition and privacy semantics

Let $\mathcal{X}$ be a finite input domain, $\mathcal{X}_S \subseteq \mathcal{X}$ the sensitive subset, and $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$ the non-sensitive subset. Let $\mathcal{Y}$ be the output domain, partitioned into protected outputs $\mathcal{Y}_P$ and invertible outputs $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$. Standard $\epsilon$-LDP requires

$Q(y\mid x) \le e^\epsilon Q(y\mid x')$

for all $x,x'\in\mathcal{X}$ and all $\mathcal{X}$0. ULDP weakens this by requiring the LDP-style inequality only on protected outputs, while forcing invertible outputs to correspond uniquely to non-sensitive inputs. Concretely, an obfuscation mechanism $\mathcal{X}$1 provides $\mathcal{X}$2-ULDP if: first, for any $\mathcal{X}$3, there exists an $\mathcal{X}$4 such that $\mathcal{X}$5 and $\mathcal{X}$6 for any $\mathcal{X}$7; second, for any $\mathcal{X}$8 and any $\mathcal{X}$9,

$\mathcal{X}_S \subseteq \mathcal{X}$0

This yields an LDP-equivalent guarantee for sensitive values because sensitive inputs can only produce protected outputs, while non-sensitive values may be revealed exactly through invertible outputs (Murakami et al., 2018).

The privacy semantics are therefore selective rather than uniform. Standard LDP forbids any output from revealing an input exactly, whereas ULDP explicitly permits exact recovery of non-sensitive symbols through $\mathcal{X}_S \subseteq \mathcal{X}$1. This is the source of the utility gain. The original formulation also proves sequential composition and a post-processing property for mappings that preserve the distinction between protected and invertible outputs. In the later asymptotic theory for discrete distribution estimation, the same Murakami–Kawamoto formulation is adopted, with the notation $\mathcal{X}_S \subseteq \mathcal{X}$2, $\mathcal{X}_S \subseteq \mathcal{X}$3, and $\mathcal{X}_S \subseteq \mathcal{X}$4; when $\mathcal{X}_S \subseteq \mathcal{X}$5, ULDP reduces exactly to ordinary $\mathcal{X}_S \subseteq \mathcal{X}$6-LDP (Murakami et al., 2018, Yoon et al., 29 Sep 2025).

2. Canonical ULDP mechanisms for discrete distribution estimation

The original ULDP setting is non-interactive discrete distribution estimation. There are $\mathcal{X}_S \subseteq \mathcal{X}$7 users, user $\mathcal{X}_S \subseteq \mathcal{X}$8 holds one symbol $\mathcal{X}_S \subseteq \mathcal{X}$9, the data are i.i.d. from an unknown distribution $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$0, and the collector estimates $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$1 from privatized reports $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$2. In the common-mechanism setting, all users share the same sensitive set $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$3 and the same channel $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$4; the paper studies empirical inversion theoretically and empirical, thresholded empirical, and EM reconstruction experimentally (Murakami et al., 2018).

The first canonical mechanism is utility-optimized randomized response (uRR), for which $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$5, $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$6, and $\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$7. Define

$\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$8

Then

$\mathcal{X}_N=\mathcal{X}\setminus \mathcal{X}_S$9

Sensitive inputs are therefore randomized only inside the protected region, whereas non-sensitive inputs are reported exactly with probability $\mathcal{Y}$0 and otherwise mapped into protected outputs. In the high privacy regime $\mathcal{Y}$1, the asymptotic expected $\mathcal{Y}$2 loss scales with $\mathcal{Y}$3 rather than $\mathcal{Y}$4, and in the low privacy regime $\mathcal{Y}$5 with $\mathcal{Y}$6, the loss approaches the non-private benchmark (Murakami et al., 2018).

The second canonical mechanism is utility-optimized RAPPOR (uRAP), which uses a one-hot encoding over $\mathcal{Y}$7 and protected outputs

$\mathcal{Y}$8

Sensitive values are encoded and perturbed through the protected coordinates, whereas non-sensitive values preserve an invertible signature outside that region. The shorthand parameter choice used in the paper is

$\mathcal{Y}$9

The key theoretical result is that uRAP is order-optimal in the high privacy regime: its worst-case $\mathcal{Y}_P$0 loss scales as $\mathcal{Y}_P$1 and its $\mathcal{Y}_P$2 loss scales as $\mathcal{Y}_P$3, matching the lower bounds for ULDP mechanisms. Empirically, uRAP is strongest in the high privacy regime, whereas uRR is strongest around $\mathcal{Y}_P$4 and can get extremely close to non-private estimation when most symbols are non-sensitive (Murakami et al., 2018).

3. Personalized ULDP and semantic tags

The original ULDP model assumes a common sensitive subset, but the same paper also studies a more realistic setting in which the distinction between sensitive and non-sensitive values differs from user to user. The difficulty is that if each user used a fully user-specific ULDP mechanism $\mathcal{Y}_P$5, the collector would learn the user’s sensitive set from the mechanism itself. The proposed personalized ULDP mechanism (PUM) resolves this through a secret pre-processor and semantic tags (Murakami et al., 2018).

Each user defines a private map

$\mathcal{Y}_P$6

where the symbols $\mathcal{Y}_P$7 are bots associated with semantic tags such as “home” or “workplace.” If $\mathcal{Y}_P$8 is the set of user $\mathcal{Y}_P$9’s sensitive values associated with tag $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$0, then

$\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$1

After this deterministic preprocessing, the user applies a common ULDP mechanism $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$2 over $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$3, so that

$\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$4

The common channel can itself be instantiated by uRR or uRAP on $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$5 (Murakami et al., 2018).

This construction yields two privacy effects. First, $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$6 provides $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$7-ULDP, so user-specific sensitive values inherit the same selective LDP guarantee. Second, for protected outputs $\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$8, the paper proves the cross-user bound

$\mathcal{Y}_I=\mathcal{Y}\setminus \mathcal{Y}_P$9

which means that protected reports reveal almost no information about which user-specific preprocessing rule was used. The mechanism does not hide all negative information about sensitivity, because an invertible non-sensitive output shows that the corresponding value is not in the user’s sensitive set, but it does keep the actual sensitive values hidden when the candidate set remains large (Murakami et al., 2018).

Estimation under PUM is two-stage. The collector first estimates an intermediate distribution $\epsilon$0 over $\epsilon$1, then reconstructs the original distribution using semantic priors $\epsilon$2 for each bot:

$\epsilon$3

The central error decomposition is

$\epsilon$4

The first term is the ULDP estimation error of the common mechanism, while the second is the penalty for imperfect semantic background knowledge. If no background knowledge is available, the paper suggests choosing $\epsilon$5 proportional to the observed non-bot distribution (Murakami et al., 2018).

4. Optimality theory and asymptotic limits

A major later development is the exact asymptotic minimax theory for discrete distribution estimation under ULDP. In that setting, the alphabet is $\epsilon$6, the sensitive subset is $\epsilon$7, the non-sensitive subset is $\epsilon$8, and the goal is to estimate an unknown distribution $\epsilon$9 from privatized samples under squared $Q(y\mid x) \le e^\epsilon Q(y\mid x')$0 loss. The asymptotic constant

$Q(y\mid x) \le e^\epsilon Q(y\mid x')$1

is characterized exactly by a saddle-point problem

$Q(y\mid x) \le e^\epsilon Q(y\mid x')$2

where $Q(y\mid x) \le e^\epsilon Q(y\mid x')$3 is a probability mass function over protected-output cardinalities and $Q(y\mid x) \le e^\epsilon Q(y\mid x')$4. The three terms have a precise interpretation: $Q(y\mid x) \le e^\epsilon Q(y\mid x')$5 is the cost of estimating the shape within the sensitive subset, $Q(y\mid x) \le e^\epsilon Q(y\mid x')$6 is the cost of estimating the shape within the non-sensitive subset, and $Q(y\mid x) \le e^\epsilon Q(y\mid x')$7 is the cost of estimating the total sensitive mass (Yoon et al., 29 Sep 2025).

The converse proof proceeds through three structural ingredients. The first is a generalized uniform asymptotic Cramér–Rao lower bound that is uniform over a compact class of channels. The second is a reduction showing that it suffices to consider extremal ULDP mechanisms. The third is a decomposition of the simplex tangent space into three orthogonal components corresponding to within-sensitive fluctuations, within-non-sensitive fluctuations, and transfer of total mass between the two parts of the alphabet. This decomposition is what produces the three-term risk formula above (Yoon et al., 29 Sep 2025).

The extremal ULDP mechanisms in this theory have protected outputs indexed by all nonempty subsets of the sensitive symbols,

$Q(y\mid x) \le e^\epsilon Q(y\mid x')$8

and invertible outputs indexed by singleton non-sensitive symbols,

$Q(y\mid x) \le e^\epsilon Q(y\mid x')$9

On protected outputs, they have a staircase form:

$x,x'\in\mathcal{X}$0

while the remaining mass for non-sensitive inputs is placed on invertible outputs. Every ULDP mechanism is degraded by an extremal one, so the extremal class is sufficient for the minimax analysis (Yoon et al., 29 Sep 2025).

The matching achievability result introduces utility-optimized block design schemes (uBD). A uBD mechanism mixes block designs of different protected-output cardinalities using the distribution $x,x'\in\mathcal{X}$1, and a score-based linear estimator is built to saturate the lower bound at the relevant reference distribution. This yields the first exact asymptotic characterization of the ULDP privacy–utility trade-off (Yoon et al., 29 Sep 2025).

Two closed-form regimes are especially important. In one regime, a saddle point is attained by $x,x'\in\mathcal{X}$2, which means that the optimal mechanism is exactly uRR; this is the first proof that uRR is optimal in a nontrivial regime. In another regime, the optimal risk collapses to the ordinary LDP optimum on the sensitive alphabet,

$x,x'\in\mathcal{X}$3

so the non-sensitive symbols do not improve the worst-case asymptotic constant. The same paper also shows that uSS is strictly suboptimal in part of the parameter space (Yoon et al., 29 Sep 2025).

5. Related frameworks for utility optimization under local privacy

ULDP is one branch of a broader literature on utility-aware local privacy. Some of that literature stays within standard $x,x'\in\mathcal{X}$4-LDP and optimizes utility by selecting an optimal channel or an optimal parameterization; other work changes the privacy notion itself by incorporating context, metric structure, or a restricted class of sensitive distinctions. The relation is conceptual rather than terminological: not every utility-aware local mechanism is ULDP, but several neighboring frameworks solve closely related optimization problems.

Framework	Key privacy idea	Representative utility result
Staircase mechanisms	Standard $x,x'\in\mathcal{X}$5-LDP, extremal likelihood ratios	Optimal channels for broad sublinear utilities
OUE / OLH	Standard $x,x'\in\mathcal{X}$6-LDP frequency oracles	Closed-form variance-optimal parameters
BRR	Standard $x,x'\in\mathcal{X}$7-LDP with utility-ranked outputs	Top-$x,x'\in\mathcal{X}$8 high-utility outputs share the maximal probability
Context-aware LDP	Pairwise privacy matrix $x,x'\in\mathcal{X}$9	Sample-optimal HLLDP and BSLDP schemes
Metric-based local privacy	Distance-sensitive indistinguishability	Better utility than flat LDP in metric domains
Piecewise bounded-data mechanisms	Standard $\mathcal{X}$00-LDP on bounded numerical domains	Closed-form optimal piecewise mechanisms within a generalized family

Within standard LDP, one foundational line of work formulates the privacy–utility trade-off as

$\mathcal{X}$01

and proves that for utilities of the form $\mathcal{X}$02 with $\mathcal{X}$03 sublinear, an optimal mechanism can always be chosen from the staircase family, with

$\mathcal{X}$04

The infinite-dimensional optimization then reduces to a finite linear program over $\mathcal{X}$05 staircase patterns. In the high privacy regime, binary mechanisms are optimal for $\mathcal{X}$06-divergence utility and mutual information; in the low privacy regime, randomized response is optimal for KL divergence and mutual information (Kairouz et al., 2014).

For standard LDP frequency estimation, a separate line develops analytically optimized protocols rather than selective privacy notions. The pure-protocol framework of OUE and OLH gives the generic estimator

$\mathcal{X}$07

with exact variance

$\mathcal{X}$08

OUE is obtained by setting

$\mathcal{X}$09

and OLH by choosing

$\mathcal{X}$10

Both achieve

$\mathcal{X}$11

and the paper gives the decision rule that direct encoding is preferable when $\mathcal{X}$12, while OUE or OLH are preferable beyond that point (Wang et al., 2017).

Another standard-LDP utility-aware mechanism is Bipartite Randomized Response (BRR), which keeps the local privacy definition unchanged but replaces GRR’s single privileged output with a high-utility equivalence class $\mathcal{X}$13:

$\mathcal{X}$14

The paper’s main claim is that for its expected-similarity objective, solving the utility maximization problem is equivalent to deciding how many high-utility outputs should be treated equally to the true value in release probability. This yields a similarity-aware generalization of GRR for finite discrete domains (Zhang et al., 29 Apr 2025).

Context-aware local differential privacy generalizes the sensitive/non-sensitive idea even further by replacing the scalar privacy budget with a matrix $\mathcal{X}$15 and requiring

$\mathcal{X}$16

Its high-low special case (HLLDP) is especially close to ULDP: if $\mathcal{X}$17 is the sensitive set, then

$\mathcal{X}$18

For $\mathcal{X}$19 and $\mathcal{X}$20, the sample complexity of distribution estimation is

$\mathcal{X}$21

which improves on the classical LDP rate $\mathcal{X}$22 when $\mathcal{X}$23. The block-structured special case gives

$\mathcal{X}$24

showing that only within-block distinctions need to pay the full privacy cost (Acharya et al., 2019).

Metric-based local privacy takes a different route. Instead of partitioning the alphabet into sensitive and non-sensitive values, it equips the whole domain with a metric $\mathcal{X}$25 and requires

$\mathcal{X}$26

Privacy therefore degrades with distance: nearby values must induce very similar output distributions, while far-apart values may be more distinguishable. For distribution estimation in metric domains, the geometric and discretized Laplacian mechanisms concentrate outputs near the truth and achieve much better utility than flat $\mathcal{X}$27-ary randomized response when compared at the same expected obfuscation distance (Alvim et al., 2018).

For bounded numerical data, utility optimization has been developed within standard LDP through generalized piecewise mechanisms. The generalized $\mathcal{X}$28-piecewise mechanism assigns constant densities on $\mathcal{X}$29 intervals subject to

$\mathcal{X}$30

Under the hypothesis that the optimum in the generalized family occurs at $\mathcal{X}$31, the paper derives closed-form same-domain and circular-domain mechanisms, proves optimality within the generalized piecewise family, and shows improved utility for distribution estimation and mean estimation. In the normalized same-domain case $\mathcal{X}$32, the optimal density is

$\mathcal{X}$33

with

$\mathcal{X}$34

The same work extends the design to circular domains, where wrap-around geometry materially changes the utility optimum (Zheng et al., 21 May 2025).

At the most general level, recent work on optimal privacy–utility trade-offs under standard LDP gives a unified functional and geometric framework for Bayesian risk, minimax risk, mutual information, $\mathcal{X}$35-divergences, and Fisher information. The key structural reduction is

$\mathcal{X}$36

where $\mathcal{X}$37 is a finite-dimensional polytope of maximal LDP channels. Under transitive group symmetry, the optimum reduces further to a finite scan over subset-selection orbits. This literature is not ULDP in the selective-value sense, but it supplies a general mechanism-design toolkit for utility-aware local privacy (Nam et al., 4 May 2026).

6. Utility quantification, applications, and deployment considerations

A practical issue in ULDP and neighboring frameworks is that choosing $\mathcal{X}$38 or selecting among mechanisms is often harder than specifying the formal privacy notion. One line of work addresses this directly for randomized-response LDP by using influence functions to approximate the change in test loss under privatization without repeatedly privatizing the data and retraining the model. For label-only randomized response with $\mathcal{X}$39 classes, the key influence expression is

$\mathcal{X}$40

The method is utility-aware parameter tuning rather than a new ULDP mechanism, but it provides a cheap way to estimate the curve $\mathcal{X}$41 and choose privacy parameters accordingly (Carey et al., 2023).

For inference-time classification under LDP, another recent framework quantifies utility through the probability that a privatized input preserves the original classifier prediction. Its central lower bound is

$\mathcal{X}$42

which decomposes utility into mechanism concentration inside a robustness region and classifier stability inside that region. The same framework shows that piecewise mechanisms often give higher utility than Laplace and often better utility than discrete alternatives because they place higher density in an interval around the true input. It also introduces a robustness-hyperrectangle refinement and PAC-LDP refinements such as the privacy indicator

$\mathcal{X}$43

which improves the lower bound to $\mathcal{X}$44 (Zheng et al., 3 Jul 2025).

Utility-aware local privacy also appears in end-to-end systems. One recommendation pipeline represents an entire user profile as a Bloom filter, applies Permanent Randomized Response followed by Instantaneous Randomized Response, decodes the perturbed profile using a neural network or XGBoost, and clusters reconstructed profiles with K-means for recommendation. The reported headline numbers are a $\mathcal{X}$45 clustering success rate for $\mathcal{X}$46 and $\mathcal{X}$47 for $\mathcal{X}$48, although the same manuscript notes that these values are unusual and that some numerical claims appear inconsistent. The same work reports an empirical operating point near $\mathcal{X}$49 with $\mathcal{X}$50 privacy and $\mathcal{X}$51 utility, illustrating a task-oriented privacy–utility trade-off rather than a formal ULDP definition (Rahali et al., 2021).

In high-dimensional mean estimation, utility optimization can occur entirely on the collector side. The HDR4ME protocol keeps the local randomizer unchanged and replaces naive coordinate-wise averaging with a regularized reconstruction

$\mathcal{X}$52

For $\mathcal{X}$53 regularization, the solution is soft thresholding,

$\mathcal{X}$54

and for $\mathcal{X}$55 regularization,

$\mathcal{X}$56

This work is not a selective-value ULDP formulation, but it shows that high-dimensional utility optimization under local privacy can also be achieved through post-processing rather than mechanism redesign (Duan et al., 2022).

A further deployment-oriented direction is attack-aware parameter optimization within fixed LDP protocol families. The objective studied there is

$\mathcal{X}$57

where ASR is attacker success rate under value reconstruction attack and MSE is estimation error for frequency estimation. This yields adaptive variants of subset selection, unary encoding, local hashing, and thresholded histogram encoding that preserve the same formal $\mathcal{X}$58-LDP guarantee but move the operating point closer to the ASR–MSE Pareto frontier. The paper is therefore best understood as multi-objective, attack-aware LDP optimization rather than canonical ULDP, but it captures the same deployment logic: utility should not be optimized in isolation from operational privacy leakage (Arcolezi et al., 3 Mar 2025).

Taken together, these developments show that ULDP is both a specific privacy definition and part of a larger methodological shift. In its narrow sense, ULDP means selective local privacy for sensitive values with invertible treatment of non-sensitive values. In the broader research landscape, it is one instance of a general principle: local privacy mechanisms, estimators, and privacy parameters should be designed with explicit regard to statistical utility, semantic structure, geometry, robustness, and attack models, rather than by enforcing uniform indistinguishability on the entire domain regardless of task.