UDPLDP-Tree: Range Queries Under User-Distinguished Personalized Local Differential Privacy

Abstract

Local Differential Privacy (LDP) and its personalized variants (PLDP) have been widely used for privacy-preserving data analytics. However, existing schemes often enforce a uniform indistinguishability level among users, failing to accommodate the nuanced privacy needs of diverse individuals. To address this, we propose User-Distinguished Local Differential Privacy (UDPLDP), a novel framework that formalizes user-level distinguishability to support more flexible, non-uniform privacy budgets. Under this framework, we tackle the fundamental task of frequency range queries, namely UDPLDP-Tree, which overcomes the challenge due to limited user-level distinguishability, insufficient robustness in estimation under complex data distributions, and the assumption of uniform privacy requirements across different attributes in existing multi-dimensional schemes. To demonstrate the effectiveness, we conduct extensive experiments and the results show that UDPLDP-Tree reduces the mean squared error (MSE) by about 30–50% compared with a recent state-of-the-art baseline.

1. Introduction

With the growing use of big data analytics, data collectors are increasingly interested in user data to improve their services. However, such practices pose potential risks of information leakage [1,2,3,4]. Even when explicit identifiers are removed, auxiliary data and linkage attacks can still re-identify individuals, as shown by the de-anonymization of the Netflix Prize dataset [5], the uniqueness of human mobility traces [6], and simple demographic linkage [7]. To address these risks, Local Differential Privacy (LDP) [8,9] has been introduced as a method to preserve privacy while still allowing for meaningful data analysis. Under LDP, users locally perturb their data before sending it to data collectors, ensuring privacy while maintaining the usability of the data. This approach has been adopted in several real-world applications, including Google Chrome browser [10], Apple [11] and Microsoft [12].

Despite its effectiveness, standard LDP typically employs a single, uniform privacy budget for all users, which may not accommodate diverse privacy preferences in practice [13]. To overcome the limitations of standard LDP, personalized Local Differential Privacy (PLDP) [14] enables each user to select a personal privacy budget, providing more flexibility without compromising local privacy guarantees. However, in PLDP, once a user’s privacy budget is individualized, the indistinguishability level between that user’s input and the inputs of all other users remains the same. This diverges from real-world application scenarios, as shown in the following example.

Example (Pairwise Distinguishability among Patients). Consider three patients diagnosed with cancer, stomachache, and the common cold, respectively. In general, cancer patients require much stronger privacy protection than common-cold patients, whereas patients with stomachache have intermediate privacy needs. Ideally, the indistinguishability between stomachache and cancer patients should be stronger than that between stomachache and common-cold patients. However, existing PLDP schemes assign a single fixed privacy level to each user, which forces the indistinguishability between a stomachache patient and all other users to be the same. If the privacy level is set high enough to protect cancer patients, the stomachache patient also becomes difficult to distinguish from common-cold patients. This introduces excessive noise into the released data and reduces the accuracy of statistical analysis. Conversely, lowering the privacy level to improve accuracy and better distinguish stomachache from common-cold patients weakens the protection between stomachache and cancer patients, thereby potentially compromising the privacy of cancer patients.

To address these issues, we propose User-Distinguished Local Differential Privacy (UDPLDP), a novel framework that allows different users to have distinct levels of indistinguishability, reflecting their varying privacy requirements. The framework is also designed to support a wide range of data analysis tasks under UDPLDP. Among the various privacy-preserving data analysis tasks under UDPLDP, range queries are a fundamental type and have been extensively studied in recent years [15,16,17,18,19,20,21]. However, practical range queries face a series of challenges; therefore, applying the UDPLDP framework to practical range queries is not straightforward.

Challenges. First, existing work focuses on applying the same budgets over the entire range domain. However, different users may need different privacy budgets for a specific range in real-world applications [15,16,17,18,19,20,21]. Second, current methods often assume data is uniformly [15,16,17,18,19,20] or linearly distributed [21] within a range. However, this fails to capture complex non-linear patterns and peaks in real data, leading to large estimation errors. Third, existing multi-dimensional schemes usually assign the same privacy budget to all attributes [16,17,18,19,20,21]. In practice, different attributes (like age vs. medical condition) have different sensitivities, and a uniform budget either risks privacy or hurts data accuracy.

In this paper, we address the aforementioned challenges under the UDPLDP framework and develop a more practical range query scheme. Our main contributions are summarized as follows:

• We propose the UDPLDP framework, which formalizes user-level distinguishability to provide a flexible theoretical foundation for privacy-preserving data analysis under non-uniform privacy budgets.
• We develop a practical range query scheme that addresses the aforementioned challenges, specifically by handling heterogeneous privacy requirements, capturing complex data distributions, and managing attribute-specific sensitivities.
• We conduct extensive experiments on eight datasets (four synthetic and four real-world) and compare with representative baselines, demonstrating that our proposed scheme achieves consistently lower MSE under the same privacy budgets.

The remainder of this paper is organized as follows: Section 2 provides the preliminaries. Section 3 defines the UDPLDP framework. In Section 4, we address the challenges of one-dimensional range queries by proposing the UDPLDP-Tree. Section 5 extends these methods to support multi-dimensional cases. Section 6 presents the experimental results, while Section 7 reviews related work. Finally, Section 8 concludes the paper.

2. Preliminaries

In this section, we present the necessary preliminaries of our scheme.

2.1. Local Differential Privacy

Definition 1

($\epsilon$-Local Differential Privacy [8,9]). A perturbation mechanism $\mathcal{M}$ satisfies ε-LDP if and only if, for any two input data $v,v^{\prime }\in D$ and any output $y\in \mathrm{Range}\left(\mathcal{M}\right)$, we have

$$Pr[\mathcal{M}\left(v\right)=y]\le e^{\epsilon }Pr[\mathcal{M}\left(v^{\prime }\right)=y].$$

(1)

In Equation (1), the parameter $\epsilon$ represents the privacy budget, which bounds the ratio of the probability distributions of the mechanism’s output for any two adjacent inputs $v,v^{\prime }\in D$. Here, $\mathrm{Range}\left(\mathcal{M}\right)$ denotes the set of all possible outcomes, and the probability is evaluated on the internal randomness of $\mathcal{M}$. The magnitude of $\epsilon$ inherently characterizes the trade-off between privacy and utility: a smaller $\epsilon$ signifies a tighter privacy bound by necessitating higher levels of perturbation, which consequently degrades the utility of the data. In contrast, a larger $\epsilon$ relaxes the privacy constraint, facilitating a higher accuracy of the estimation at the expense of reduced privacy protection.

2.2. Frequency Oracle

Frequency oracles (FOs) [22] are fundamental primitives in LDP-based data analysis to estimate categorical frequency distributions. Among various FO protocols, Optimized Unary Encoding (OUE) [23] is widely utilized for its unbiased estimation and its variance that remains independent of the domain size. The OUE protocol protects these values through the following three strategies.

• Encoding. Given a domain D, the user i represents their private value $v_i$ as a one-hot vector $x_i\in {\{0,1\}}^{\left|D\right|}$, where only the position corresponding to $v_i$ is 1.
• Perturbation. Each bit of $x_i$ is perturbed independently with probabilities $p={\displaystyle \frac{1}{2}}$ and $q={\displaystyle \frac{1}{e^{\epsilon }+1}}$. A 1-bit is kept with probability p and flipped otherwise, while a 0-bit is flipped to 1 with probability q and kept otherwise. The user then uploads the perturbed vector $x_i^{\prime }$.
• Aggregation and Estimation. After receiving the perturbed vectors ${\left\{x_i^{\prime }\right\}}_{i=1}^N$, the server counts the number of reported 1’s for each index j, i.e., $\mathrm{count}\left[j\right]={\sum }_{i=1}^N{x}_i^{\prime }\left[j\right]$. The unbiased frequency estimator is given by $\widehat{f}\left[j\right]={\displaystyle \frac{\mathrm{count}\left[j\right]-Nq}{N(p-q)}}$, where $p={\displaystyle \frac{1}{2}}$ and $q={\displaystyle \frac{1}{e^{\epsilon }+1}}$. The variance of OUE is

  $${\mathrm{Var}}_{\mathrm{OUE}}\left(\epsilon \right)={\displaystyle \frac{4e^{\epsilon }}{N{(e^{\epsilon }-1)}^2}},$$

  (2)

  where $\mathrm{Var}$ is independent of the domain size $\left|D\right|$.

2.3. B-Spline Basis Functions

A B-spline curve [24] is defined as a parametric piecewise polynomial curve. Given a non-decreasing knot vector $T=\{t_0,t_1,\dots ,t_m\}$ defined in the parameter domain $[a,b]$, and a set of control points ${\left\{{\mathbf{P}}_i\right\}}_{i=0}^n$, the B-spline curve $\mathbf{C}\left(t\right)$ is expressed as

$$\mathbf{C}\left(t\right)=\sum _{i=0}^n{N}_{i,p}\left(t\right){\mathbf{P}}_i,a\le t\le b$$

(3)

where $N_{i,p}\left(t\right)$ denotes the i-th B-spline basis function of degree p. The relationship between the number of knots (m), the degree (p), and the number of control points (n) is given by $m=n+p+1$. The basis functions are defined recursively using the Cox–de Boor formula [24]. For degree 0, we have

$$N_{i,0}\left(t\right)=\left\{\begin{array}{cc}1,\hfill & t_i\le t<t_{i+1}\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(4)

and for any degree $p\ge 1$,

$$N_{i,p}\left(t\right)={\displaystyle \frac{t-t_i}{t_{i+p}-t_i}}{N}_{i,p-1}\left(t\right)+{\displaystyle \frac{t_{i+p+1}-t}{t_{i+p+1}-t_{i+1}}}{N}_{i+1,p-1}\left(t\right),$$

(5)

where terms with a zero denominator are defined to be zero.

3. UDPLDP: User-Distinguished Local Differential Privacy

In this section, we introduce UDPLDP, a privacy definition that generalizes personalized Local Differential Privacy by incorporating flexible pairwise indistinguishability constraints.

3.1. Personalized Local Differential Privacy

We revisit PLDP and its inherent limitation, which motivates UDPLDP. PLDP generalizes standard Local Differential Privacy by allowing users to adopt different privacy budgets.

Personalization is motivated by heterogeneous privacy sensitivities: only a small fraction of users may need very strong protection (heavy noise), while many others accept milder privacy for better utility. In practice, a uniform worst-case privacy level often yields worst-case accuracy and unstable outputs, so personalization avoids forcing the entire system to operate at the utility level dictated by a small high-sensitivity subgroup.

From the perspective of its design objective, PLDP extends standard Local Differential Privacy by allowing different users to adopt different privacy budgets, thereby providing a more flexible privacy model.

Definition 2

(Personalized Local Differential Privacy ($\mathcal{E}$-PLDP) [14]). Given a set of users $\mathcal{U}$, where each user $u\in \mathcal{U}$ is associated with a privacy budget ${\epsilon }_u\in \mathcal{E}$, a randomized mechanism M satisfies $\mathcal{E}$-PLDP if and only if, for any user u, any two possible input values $x,x^{\prime }\in D$, and any output $y\in \mathrm{Range}\left(M\right)$, the following condition holds:

$${\displaystyle \frac{Pr\left[M\right(x)=y]}{Pr[M\left(x^{\prime }\right)=y]}}\le e^{{\epsilon }_u}.$$

(6)

Under PLDP, the privacy budget ${\epsilon }_u$ bounds the distinguishability between any two possible inputs of user u, regardless of the identities or privacy requirements of other users. This design enables user-level personalization while retaining the simplicity of a single-user privacy constraint.

3.2. Limitation of PLDP: Uniform Pairwise Indistinguishability

Despite enabling individualized budgets, PLDP is structurally limited because a single ${\epsilon }_u$ imposes a uniform privacy semantics for user u: it controls indistinguishability involving u with the same strength across all counterparts, and thus cannot express pair-dependent requirements such as making u much harder to distinguish from users in one group than from users in another. In short, PLDP cannot specify different indistinguishability strengths across user pairs $(u,v)$.

This limitation becomes salient in practice when users’ privacy levels are public or inferable and aggregates are computed from mixed-accuracy reports. For example, consider an anonymous workplace survey with a binary question such as whether an employee took mental-health leave this month. Alice selects high privacy with a small ${\epsilon }_A$ and heavy noise, while Bob selects low privacy with a large ${\epsilon }_B$ and light noise. Once a team-level count is released, Bob’s near-accurate report can act as an anchor: an adversary can largely account for Bob’s contribution and thereby infer Alice’s status with much higher confidence than what assigning ${\epsilon }_A$ alone intends to capture. This leakage does not require any correlation between users’ data; it stems from public privacy levels and mixed-noise aggregation.

These observations motivate UDPLDP: instead of only assigning a single ${\epsilon }_u$ per user, UDPLDP explicitly models user-distinguished (individual-to-individual) indistinguishability so that protection can be specified and optimized at the granularity of user pairs.

3.3. User-Distinguished Local Differential Privacy

To address the above limitation, we propose UDPLDP, which generalizes PLDP by introducing user-dependent pairwise indistinguishability through a privacy budget function.

Let the data domain be D, and each user u is associated with a privacy budget ${\epsilon }_u\in \mathcal{E}$. In the local model, the private input is the user’s value $x\in D$, while the budget ${\epsilon }_u$ is treated as public metadata (i.e., we do not aim to hide which privacy level a user chooses). Accordingly, we view a mechanism invocation as parameterized by the budget and denote it by $M(x;\epsilon )$. We say two invocations $(x;{\epsilon }_u)$ and $(x^{\prime };{\epsilon }_{u^{\prime }})$ are adjacent if they correspond to two possible private values $x,x^{\prime }\in D$ (potentially under different public budgets). This adjacency specifies the neighboring inputs whose distinguishability we aim to bound.

Definition 3

(User-Distinguished Local Differential Privacy ($\mathcal{E}$-UDPLDP)). Given a set of users $\mathcal{U}$, where each user $u\in \mathcal{U}$ is assigned a privacy budget ${\epsilon }_u\in \mathcal{E}$, a randomized mechanism M satisfies $\mathcal{E}$-UDPLDP if and only if, for any two users $u,u^{\prime }\in \mathcal{U}$, any two input values $x,x^{\prime }\in D$, and any output $y\in \mathrm{Range}\left(M\right)$, the following condition holds:

$${\displaystyle \frac{Pr[M(x;{\epsilon }_u)=y]}{Pr[M(x^{\prime };{\epsilon }_{u^{\prime }})=y]}}\le exp\left(min\{{\epsilon }_u,{\epsilon }_{u^{\prime }}\}\right).$$

(7)

That is, the pairwise indistinguishability is governed by the stricter privacy requirement. When $u=u^{\prime }$, the definition reduces to the standard PLDP/LDP-style guarantee $Pr[M(x;{\epsilon }_u)=y]/Pr[M(x^{\prime };{\epsilon }_u)=y]\le e^{{\epsilon }_u}$.

Unlike PLDP, which is inherently user-wise (the privacy loss is not parameterized by which other user it is compared against), UDPLDP explicitly constrains cross-user distinguishability under heterogeneous public budgets via the pairwise bound $min\{{\epsilon }_u,{\epsilon }_{u^{\prime }}\}$. From a generalized-DP viewpoint, UDPLDP can also be interpreted as a lightweight policy/relation-based instantiation in the local model, where the policy strength between a user pair $(u,u^{\prime })$ is induced by $min\{{\epsilon }_u,{\epsilon }_{u^{\prime }}\}$.

4. UDPLDP-Tree: Range Query Processing over UDPLDP Framework

In this section, we introduce UDPLDP-Tree, a private tree structure built upon the $\mathcal{E}$-UDPLDP mechanism presented in Section 3. By integrating piecewise curve-fitting techniques, UDPLDP-Tree is specifically tailored to support range-frequency queries while strictly adhering to user-level personalized privacy budgets.

4.1. Problem Definition

We consider N users, where each user $u_i$ holds a d-dimensional private record ${\mathbf{v}}_i=(v_i^{\left(1\right)},v_i^{\left(2\right)},\dots ,v_i^{\left(d\right)})$. Here, $v_i^{\left(j\right)}\in D_j$ denotes the value of attribute $A_j$ for user $u_i$, and $D_j$ is the public domain of $A_j$.

Let $\Phi \subseteq \{A_j\mid 1\le j\le d\}$ be a set of queried attributes with $\lambda =|\Phi |$. For each $A_j\in \Phi$, the analyst specifies a one-dimensional range $[l_j,r_j]\subseteq D_j$, and we write ℓ$={\left(l_j\right)}_{A_j\in \Phi }$ and $\mathbf{r}={\left(r_j\right)}_{A_j\in \Phi }$, where ℓ and $\mathbf{r}$ collect the lower and upper bounds for all attributes in $\Phi$. Denote by ${\mathbf{v}}_i^{\Phi }$ the projection of ${\mathbf{v}}_i$ onto the attribute set $\Phi$. The corresponding $\lambda$-dimensional hyper-rectangle is $[\mathit{\ell },\mathbf{r}]=\{\mathbf{x}\mid l_j\le x^{\left(j\right)}\le r_j,\forall A_j\in \Phi \}.$ The range query asks for the fraction of user records that fall into this multi-dimensional interval:

$$Q\left([\mathit{\ell },\mathbf{r}]\right)={\displaystyle \frac{1}{N}}\sum _{i=1}^N\mathbb{I}\left({\mathbf{v}}_i^{\Phi }\in [\ell ,\mathbf{r}]\right),$$

(8)

where $\mathbb{I}(·)$ is the indicator function that returns 1 if its argument is true and 0 otherwise.

4.2. Technical Overview

UDPLDP-Tree enables accurate range-frequency queries under heterogeneous local privacy, where (i) users may have different privacy sensitivities over sub-ranges and (ii) real distributions are often skewed and non-linear. These factors make existing LDP range query mechanisms inefficient in budget usage and inaccurate in estimation. We summarize our key ideas as follows.

• Range-wise heterogeneous budgets. We extend UDPLDP to range queries by letting each user specify a privacy range ${\tau }_u\subseteq D$, so privacy is enforced only on overlapping sensitive ranges. Here, ${\tau }_u$ is treated as public metadata specified by the user together with ${\epsilon }_u$ before perturbation; we do not aim to hide ${\tau }_u$ itself. Intuitively, ${\tau }_u$ captures the finest exposure granularity the user is willing to accept, such as allowing disclosure at the district level but not at the street level. On top of this model, we design a multi-level unary oracle (Section 4.4.2) following OUE with $a_p=\frac{1}{2}$, and calibrate $\left\{b_p\right\}$ by minimizing the MSE upper bound subject to UDPLDP feasibility constraints (Equations (15)–(19)), yielding an unbiased and variance-optimized frequency estimator.
• Skewed and non-linear distributions. Pure tree-based LDP methods suffer on small intervals: noise can dominate low counts, and leaf nodes often drive range query error. Merging nodes reduces noise but introduces bias under uniform/linear assumptions and misses sharp peaks or heavy tails. We therefore use a hybrid strategy: (i) fit a cubic B-spline from a dedicated user subset (Section 4.5), and (ii) build a UDPLDP-Tree whose internal nodes store UDPLDP-protected aggregates while boundary intervals are answered by integrating the stored cubics. This combines low-variance aggregation with expressive boundary modeling.

4.3. Overall Workflow

We now present the overall workflow of our framework in the one-dimensional setting. Our objective is to answer range-frequency queries over a discrete domain D under heterogeneous, user-specific local privacy requirements, while maintaining high accuracy for non-linear data distributions. As illustrated in Figure 1, the framework consists of three consecutive phases, followed by a query answering procedure.

Figure 1. Workflow of our method.

• Phase I: UDPLDP-based local frequency reporting. In this phase, we instantiate the UDPLDP framework to support local frequency estimation under range-wise heterogeneous privacy budgets. Each user specifies a sensitive range ${\tau }_u\subseteq D$ and a privacy level ${\epsilon }_u$. Both $({\tau }_u,{\epsilon }_u)$ are user-declared public personalization metadata used to parameterize the mechanism, rather than private values to be protected. Based on these specifications, we design a multi-level unary frequency oracle under the $\mathcal{E}$-UDPLDP model. The oracle is built upon OUE and is calibrated via constrained optimization to achieve unbiased estimation with minimized variance. Details are given in Section 4.4.
• Phase II: Offline distribution modeling with B-splines. This phase fits a smooth approximation of the global frequency distribution over D to capture non-linear patterns. At the start of each collection round, we perform a one-time random user split independent of private values: each user joins $U_{\mathsf{model}}$ with probability $\rho$ and $U_{\mathsf{tree}}$ otherwise, where $\rho$ is fixed. This disjoint split ensures each user participates in at most one interactive stage, so the modeling step and subsequent tree calibration do not incur sequential composition. Using only reports from $U_{\mathsf{model}}$, we build a private histogram and fit a cubic B-spline. The fitted spline is treated as an offline shared prior and is reused only via post-processing in later steps, without any adaptive tuning based on outputs from $U_{\mathsf{tree}}$. Details are provided in Section 4.5.
• Phase III: UDPLDP-Tree construction and calibration. In this phase, we build a hierarchical index on top of the fitted B-spline model to support efficient range queries. Each spline segment is treated as a leaf interval, and a balanced binary tree is constructed bottom-up. The tree is then pruned to minimize the overall estimation error. Using the reserved user set $U_{\mathsf{tree}}$, we apply the UDPLDP mechanism to estimate frequencies for selected internal nodes. The final structure is a pruned UDPLDP-Tree whose internal nodes store noisy frequency estimates and whose leaves store local cubic polynomials. Details are given in Section 4.6.

Given a range query $Q\left(\right[l,r\left]\right)$, the UDPLDP-Tree decomposes the query range into a set of disjoint node intervals. Fully covered internal nodes contribute their calibrated frequency estimates, while at most two boundary leaf nodes are evaluated by integrating their local cubic polynomials over the corresponding sub-intervals. The query answer is obtained by summing these contributions, achieving accurate range-frequency estimation under heterogeneous local privacy constraints.

4.4. Local Frequency Reporting Under UDPLDP

In the overall workflow, local frequency estimation serves as the basic primitive for answering range-frequency queries. This subsection focuses on designing such a primitive under range-wise heterogeneous privacy constraints. We now adapt the UDPLDP framework to the range query setting, where users may only require privacy protection over localized intervals of the domain. This subsection first formalizes a range-aware UDPLDP model and then presents a unary frequency oracle that satisfies this model. In what follows, we first specify how users declare their sensitive ranges and how indistinguishability is enforced within overlaps, and then instantiate a concrete oracle whose parameters will be optimized for accuracy under these constraints.

4.4.1. UDPLDP with User-Specified Privacy Ranges

We instantiate the UDPLDP framework introduced in Section 3 to the range query setting by restricting where pairwise indistinguishability must be enforced. Since range queries only depend on values within queried intervals, users may require privacy protection only over localized regions of the domain. Accordingly, each user u specifies a pair $({\tau }_u,{\epsilon }_u)$, where ${\tau }_u\subseteq D$ denotes the privacy range in which the user’s value is considered sensitive, and ${\epsilon }_u$ is the corresponding privacy budget selected from a finite, ordered set $\mathcal{E}=\{{\epsilon }_1,\dots ,{\epsilon }_m\}$, with smaller values indicating stronger protection; values outside ${\tau }_u$ are treated as non-sensitive for user u. In our personalization setting, $({\tau }_u,{\epsilon }_u)$ are explicitly declared and treated as public mechanism parameters (similar to a user’s chosen privacy level), while the private value is still $v_u\in D$. Operationally, a user chooses ${\tau }_u$ as the coarsest region she is willing to reveal about her value (e.g., “within this district”), so reporting outside ${\tau }_u$ being exact only discloses that coarse membership. This range-aware specification aligns the privacy requirement with the semantics of range queries, while still allowing heterogeneous budgets across users.

As in the general UDPLDP model, privacy guarantees between users with heterogeneous budgets are governed by a symmetric, monotone non-decreasing pairwise budget function $r:\mathcal{E}\times \mathcal{E}\to {\mathbb{R}}_{>0}$. Under range query semantics, UDPLDP is enforced only when both inputs fall within the users’ sensitive regions: for any users $u,u^{\prime }$, any $x\in {\tau }_u$ and $x^{\prime }\in {\tau }_{u^{\prime }}$ with $x,x^{\prime }\in {\tau }_u\cap {\tau }_{u^{\prime }}$, and any output $y\in \mathrm{Range}\left(\mathcal{M}\right)$, the perturbation mechanism $\mathcal{M}$ satisfies

$${\displaystyle \frac{Pr\left[\mathcal{M}\right(x)=y]}{Pr[\mathcal{M}\left(x^{\prime }\right)=y]}}\le exp\left(min\{{\epsilon }_u,{\epsilon }_{u^{\prime }}\}\right).$$

(9)

When all users specify the full domain (${\tau }_u=D$) and share a common privacy budget, this formulation reduces to standard $\epsilon$-LDP. With the range-aware UDPLDP notion in place, we next construct a concrete frequency oracle that (i) perturbs only sensitive coordinates, and (ii) satisfies the above pairwise indistinguishability over overlapping privacy ranges.

4.4.2. Frequency Estimation Under UDPLDP

Given the above range-aware UDPLDP model, we now construct a frequency oracle that supports multiple privacy levels under the $\mathcal{E}$-UDPLDP model, and formulate an optimization problem for choosing its parameters. At a high level, the oracle follows the OUE-style unary encoding and bitwise randomized response, but applies perturbation only within each user’s declared privacy range. The overall procedure of the proposed frequency oracle, including user-side perturbation and server-side aggregation, is described in Algorithm 1.

Algorithm 1: Frequency estimation under $\mathcal{E}$-UDPLDP.

To make the design and its analysis explicit, we next elaborate the four components underlying Algorithm 1: encoding, range-aware perturbation with heterogeneous budgets, aggregation, and parameter selection.

• Encoding. Each user u with private value $v_u\in D$ encodes it as a one-hot vector $x_u\in {\{0,1\}}^{\left|D\right|}$. The coordinate corresponding to $v_u$ is set to 1, and all other coordinates are set to 0. This encoding is identical to that used in OUE and is shared by all privacy levels. This common representation allows us to isolate the effect of heterogeneous privacy budgets to the perturbation parameters alone.
• Perturbation under $\mathcal{E}$-UDPLDP. Building on the above encoding, we now describe how user reports are privatized to satisfy the range-aware $\mathcal{E}$-UDPLDP constraints. Users are partitioned into m privacy levels $\mathcal{E}=\{{\epsilon }_1,\dots ,{\epsilon }_m\}$ according to their privacy budgets. For a level-p user u, only coordinates corresponding to values in the privacy range ${\tau }_u$ are treated as sensitive and will be perturbed; all other coordinates are left unchanged and are regarded as non-sensitive in our model. For each sensitive position k of a level-p user, the mechanism perturbs the bit $x\left[k\right]\in \{0,1\}$ using a bitwise randomized response with parameters $(a_p,b_p)$:

  $$\begin{array}{cc}\hfill Pr\left[y\left[k\right]=1\mid x\left[k\right],{\epsilon }_p\right]& =a_{p}x\left[k\right]+b_p(1-x\left[k\right]),\hfill \\ \hfill Pr\left[y\left[k\right]=0\mid x\left[k\right],{\epsilon }_p\right]& =(1-a_p)x\left[k\right]+(1-b_p)(1-x\left[k\right]).\hfill \end{array}$$

  (10)

Thus, if $x\left[k\right]=1$, then $y\left[k\right]=1$ (resp. 0) with probability $a_p$ (resp. $1-a_p$), and if $x\left[k\right]=0$, then $y\left[k\right]=1$ (resp. 0) with probability $b_p$ (resp. $1-b_p$). Throughout this paper, we adopt an OUE-style parametrization and fix $a_p=\frac{1}{2}$ and $0<b_p<\frac{1}{2}$ for all $p\in \{1,\dots ,m\}$. We next verify that this bitwise mechanism indeed satisfies $\mathcal{E}$-UDPLDP when comparing users from potentially different privacy levels.

Let users u and $u^{\prime }$ belong to privacy levels p and q, respectively. Since each bit of the unary vector is perturbed independently, for any output vector y, we have

$${\displaystyle \frac{Pr[y\mid x]}{Pr[y\mid x^{\prime }]}}={\displaystyle \frac{{\prod }_{k=1}^{\left|D\right|}Pr\left(y\left[k\right]\mid x\left[k\right],{\epsilon }_p\right)}{{\prod }_{k=1}^{\left|D\right|}Pr\left(y\left[k\right]\mid x^{\prime }\left[k\right],{\epsilon }_q\right)}}.$$

(11)

Because x and $x^{\prime }$ differ only on two coordinates, say positions r and s, all remaining factors in the numerator and denominator are identical and cancel out. When writing $x\left[r\right]=1$, $x\left[s\right]=0$ and $x^{\prime }\left[r\right]=0$, $x^{\prime }\left[s\right]=1$, we obtain

$${\displaystyle \frac{Pr[y\mid x]}{Pr[y\mid x^{\prime }]}}={\displaystyle \frac{Pr\left(y\left[r\right]\mid x\left[r\right]=1,{\epsilon }_p\right)Pr\left(y\left[s\right]\mid x\left[s\right]=0,{\epsilon }_p\right)}{Pr\left(y\left[r\right]\mid x^{\prime }\left[r\right]=0,{\epsilon }_q\right)Pr\left(y\left[s\right]\mid x^{\prime }\left[s\right]=1,{\epsilon }_q\right)}}.$$

(12)

Let $y=(y\left[r\right],y\left[s\right])\in {\{0,1\}}^2$ be the corresponding output. By (10) and independence across coordinates, enumerating the four possible outputs $\left(y\right[r],y[s\left]\right)$ and substituting $a_p=a_q=\frac{1}{2}$ yields

$${\displaystyle \frac{Pr[y\mid x]}{Pr[y\mid x^{\prime }]}}=\left\{\begin{array}{cc}{\displaystyle \frac{1-b_p}{1-b_q},}\hfill & y=(0,0),\hfill \\ {\displaystyle \frac{b_p}{b_q},}\hfill & y=(1,1),\hfill \\ {\displaystyle \frac{b_p}{1-b_q},}\hfill & y=(0,1),\hfill \\ {\displaystyle \frac{1-b_p}{b_q},}\hfill & y=(1,0).\hfill \end{array}\right.$$

(13)

Since $0<b_p<\frac{1}{2}$ implies $b_p<1-b_p$, we have

$${\displaystyle \frac{b_p}{1-b_q}}<{\displaystyle \frac{1-b_p}{1-b_q}}<{\displaystyle \frac{1-b_p}{b_q}},{\displaystyle \frac{b_p}{b_q}}<{\displaystyle \frac{1-b_p}{b_q}},$$

(14)

so the maximum ratio is attained at $y=(1,0)$ and equals $(1-b_p)/b_q$. According to the definition of $\mathcal{E}$-UDPLDP, this ratio must satisfy

$${\displaystyle \frac{1-b_p}{b_q}}\le exp\left(min({\epsilon }_p,{\epsilon }_q)\right),\forall p,q\in \{1,\dots ,m\}.$$

(15)

This family of inequalities characterizes the feasible region of the level-wise false-positive probabilities $\left\{b_p\right\}$ under the $\mathcal{E}$-UDPLDP model and will serve as the privacy constraint in our subsequent parameter optimization. Having established the privacy constraint, we now turn to how the collector aggregates these heterogeneous, range-aware reports into a global frequency estimate.

• Aggregation. Given the perturbed unary reports, the collector performs level-wise aggregation to account for heterogeneous privacy parameters. On the collector side, users are grouped by their privacy level. Fix a value $v\in D$. For each level p, let $n_p\left[v\right]$ denote the number of level-p users whose privacy range ${\tau }_u$ contains v, i.e., the users that treat the coordinate corresponding to v as sensitive and apply randomized response on this bit. Equivalently, $n_p\left[v\right]=\left|\{u:{\epsilon }_u={\epsilon }_p\wedge v\in {\tau }_u\}\right|$, which depends only on the public metadata $\left\{({\tau }_u,{\epsilon }_u)\right\}$ and can be computed before collecting perturbed values. We also define $N\left[v\right]={\sum }_{p=1}^m{n}_p\left[v\right]$ as the total number of users who randomize the bit of v. For each level p, the collector records ${\mathrm{count}}_p\left[v\right]$, the number of level-p users whose report has bit 1 at the position corresponding to v. Given $(a_p,b_p)$, we decode these statistics using an OUE-style linear estimator:

  $${\widehat{f}}_v=\sum _{p=1}^m{\displaystyle \frac{{\mathrm{count}}_p\left[v\right]-n_p\left[v\right]b_p}{N\left[v\right](a_p-b_p)}}.$$

  (16)

Since only users with $v\in {\tau }_u$ randomize this bit, we have

$$\mathbb{E}\left[{\mathrm{count}}_p\left[v\right]\right]=n_p\left[v\right]\left(f_v^p{a}_p+(1-f_v^p)b_p\right),$$

(17)

where $f_v^p$ is the true frequency of value v among level-p users who treat v as sensitive. Substituting into (16) gives $\mathbb{E}\left[{\widehat{f}}_v\right]=f_v$, so the estimator is unbiased for the underlying global frequency $f_v$. To guide parameter selection, we next quantify the resulting estimation error under heterogeneous levels.

• Estimation error. We analyze the MSE of the above unbiased estimator as a function of the level-wise parameters, which will later serve as the optimization objective. Because user groups at different levels are disjoint, ${\mathrm{count}}_p\left[v\right]$ are independent across p, and the MSE of ${\widehat{f}}_v$ satisfies

  $$\mathrm{MSE}\left({\widehat{f}}_v\right)=\sum _{p=1}^m{\displaystyle \frac{\mathrm{Var}\left({\mathrm{count}}_p\left[v\right]\right)}{N{\left[v\right]}^2{(a_p-b_p)}^2}}\le \sum _{p=1}^m{\displaystyle \frac{n_p\left[v\right]b_p(1-b_p)}{N{\left[v\right]}^2{(a_p-b_p)}^2}},$$

  (18)

  where the inequality follows from the standard variance bound of OUE under $a_p=1/2$. Finally, we instantiate the oracle by choosing $\left\{b_p\right\}$ to minimize this bound subject to the UDPLDP feasibility constraints derived above.
• Parameter optimization. We minimize the MSE upper bound in (18) over $\mathbf{b}=(b_1,\dots ,b_m)$ under the feasibility constraints in (15):

  $$\underset{\mathbf{b}}{min}\sum _{p=1}^m{\displaystyle \frac{n_p{b}_p(1-b_p)}{N^2{(a_p-b_p)}^2}}\mathrm{s}.\mathrm{t}.{\displaystyle \frac{1-b_p}{b_q}}\le exp\left(min({\epsilon }_p,{\epsilon }_q)\right),\forall p,q.$$

  (19)

The collector can obtain all quantities needed above: since each user declares $({\tau }_u,{\epsilon }_u)$ as public metadata, it can precompute $n_p\left[v\right]=\left|\{u:{\epsilon }_u={\epsilon }_p\wedge v\in {\tau }_u\}\right|$ before reading any privatized bits. For a single parameter set shared by all $v\in D$, we aggregate $n_p={\displaystyle \frac{1}{\left|D\right|}}{\sum }_{v\in D}{n}_p\left[v\right]$ and $N={\sum }_{p=1}^m{n}_p$, i.e., we minimize the average MSE bound over $v\in D$.

Equation (19) is convex in $\left\{b_p\right\}$ under our OUE-style parametrization. When $a_p=\frac{1}{2}$, each separable term $g_p\left(b_p\right)={\displaystyle \frac{n_p{b}_p(1-b_p)}{N^2{(a_p-b_p)}^2}}$ is strictly convex on $0<b_p<\frac{1}{2}$ since ${\displaystyle \frac{{\mathrm{d}}^2}{\mathrm{d}{b}_p^2}}\left({\displaystyle \frac{b_p(1-b_p)}{{(\frac{1}{2}-b_p)}^2}}\right)={\displaystyle \frac{2}{{(\frac{1}{2}-b_p)}^4}}>0$. The UDPLDP constraints rewrite to linear inequalities $1-b_p\le exp(min({\epsilon }_p,{\epsilon }_q))b_q$ for all $p,q$; together with $0<b_p<\frac{1}{2}$, the feasible set is convex. Hence, a unique global optimum exists. We solve it with SLSQP (SciPy), which attains the global optimum due to convexity.

We solve Equation (19) once per collection round; if $\left\{({\tau }_u,{\epsilon }_u)\right\}$ changes, we recompute $\left\{n_p\right\}$ and re-solve in the next round. Privacy depends only on the feasibility constraints in Equation (15), so errors in $\left\{n_p\right\}$ affect utility (the bound) but not privacy. When metadata statistics are approximate (e.g., subsampling), we use conservative/smoothed $\left\{n_p\right\}$ to avoid over-optimistic calibration.

The solution provides level-wise probabilities that satisfy heterogeneous budgets and minimize the unary MSE bound under $\mathcal{E}$-UDPLDP; we then plug them into Algorithm 1 to finalize the range-aware frequency primitive.

In summary, this subsection provides a range-aware, unbiased unary frequency oracle that supports heterogeneous local privacy budgets. This oracle serves as the fundamental building block for both the spline-based distribution modeling and the UDPLDP-Tree construction in the subsequent sections. In particular, the next sections will invoke this oracle as a modular component, while focusing on how to exploit its estimates to model the distribution and to answer range queries efficiently.

4.5. Distribution Modeling via B-Splines

This subsection builds on the range-aware unary frequency oracle in Section 4.4.2 and uses its multi-level estimates to model the underlying one-dimensional distribution. The $\mathcal{E}$-UDPLDP mechanism yields, for each domain value $v\in D$, an unbiased but noisy frequency estimate ${\widehat{f}}_v$, which collectively forms a noisy histogram of the true distribution over D. However, directly answering range queries on this noisy histogram would inherit its local perturbation noise and lead to unstable estimates, especially near query boundaries. To mitigate this issue, we smooth these noisy point-wise estimates into a continuous representation that suppresses local fluctuations while supporting accurate integration over arbitrary query ranges.

4.5.1. Histogram Representation and Spline Fitting Objective

Before spline fitting, we show unary modeling incurs no extra privacy loss by splitting users into disjoint subsets. We split once per collection round, independent of private values: each user joins $U_{\mathsf{model}}$ with probability $\rho$ (otherwise $U_{\mathsf{tree}}$), where $\rho$ is fixed. Users in $U_{\mathsf{model}}$ run the unary $\mathcal{E}$-UDPLDP mechanism once to fit a global model, while $U_{\mathsf{tree}}$ is reserved for UDPLDP-Tree construction (Section 4.6). The spline is fitted only from perturbed reports in $U_{\mathsf{model}}$ and never uses information from $U_{\mathsf{tree}}$, keeping modeling and calibration independent. Since the sets are disjoint, each user participates in only one phase, so there is no sequential composition across phases for any user. The modeling step is pure post-processing of locally perturbed reports, hence adds no privacy loss.

With $U_{\mathsf{model}}$ fixed, we now turn the unary outputs from $U_{\mathsf{model}}$ into a set of data points and formulate the spline fitting objective. Specifically, running the unary $\mathcal{E}$-UDPLDP estimator on users in $U_{\mathsf{model}}$ produces a noisy frequency estimate ${\widehat{f}}_{v_k}$ for each domain value $v_k\in D$. We assemble these estimates into planar points

$$Q_k={(v_k,{\widehat{f}}_{v_k})}^{\mathsf{T}},k=0,\dots ,\left|D\right|-1,$$

(20)

which can be viewed as a noisy histogram of the underlying distribution over D.

Our goal is to approximate these points with a smooth curve that captures the global distribution trend while suppressing local noise. To this end, we model the distribution as a degree-s planar B-spline curve

$$C\left(t\right)=\sum _{i=0}^{n_{\mathrm{c}}}{N}_{i,s}\left(t\right)P_i,t\in [0,1],$$

(21)

where $P_i\in {\mathbb{R}}^2$ are control points and $N_{i,s}(·)$ are B-spline basis functions of degree s. The curve is clamped at both endpoints so that it interpolates the first and last histogram points:

$$C\left(0\right)=Q_0=P_0,C\left(1\right)=Q_{\left|D\right|-1}=P_{n_{\mathrm{c}}}.$$

(22)

The remaining points $Q_1,\dots ,Q_{\left|D\right|-2}$ are approximated in the least-squares sense. Having specified the curve model and endpoint constraints, we next derive the corresponding least-squares system and show how its solution yields the unknown interior control points.

4.5.2. Least-Squares Formulation and Solution

Let ${\left\{{\overline{t}}_k\right\}}_{k=0}^{\left|D\right|-1}$ denote parameter values associated with the data points. The fitting objective is

$$\underset{P_1,\dots ,P_{n_{\mathrm{c}}-1}}{min}\sum _{k=1}^{\left|D\right|-2}{∥Q_k-C\left({\overline{t}}_k\right)∥}^2.$$

(23)

Substituting (21) and using the endpoint constraints (22), we can rewrite

$$C\left({\overline{t}}_k\right)=N_{0,s}\left({\overline{t}}_k\right)Q_0+\sum _{i=1}^{n_{\mathrm{c}}-1}{N}_{i,s}\left({\overline{t}}_k\right)P_i+N_{n_{\mathrm{c}},s}\left({\overline{t}}_k\right)Q_{\left|D\right|-1}.$$

(24)

Defining

$$R_k=Q_k-N_{0,s}\left({\overline{t}}_k\right)Q_0-N_{n_{\mathrm{c}},s}\left({\overline{t}}_k\right)Q_{\left|D\right|-1},k=1,\dots ,\left|D\right|-2,$$

(25)

the problem reduces to a standard linear least-squares form:

$$\underset{P_1,\dots ,P_{n_{\mathrm{c}}-1}}{min}\sum _{k=1}^{\left|D\right|-2}{∥R_k-\sum _{i=1}^{n_{\mathrm{c}}-1}{N}_{i,s}\left({\overline{t}}_k\right)P_i∥}^2.$$

(26)

To express (26) in matrix form, we stack the unknown interior control points and the residual terms as

$$P={(P_1,\dots ,P_{n_{\mathrm{c}}-1})}^{\mathsf{T}},R={(R_1,\dots ,R_{\left|D\right|-2})}^{\mathsf{T}}.$$

(27)

We further define the basis matrix

$$B=\left[\begin{array}{ccc}{N}_{1,s}\left({\overline{t}}_1\right)& \dots & N_{n_{\mathrm{c}}-1,s}\left({\overline{t}}_1\right)\\ ⋮& \ddots & ⋮\\ N_{1,s}\left({\overline{t}}_{\left|D\right|-2}\right)& \dots & N_{n_{\mathrm{c}}-1,s}\left({\overline{t}}_{\left|D\right|-2}\right)\end{array}\right]\in {\mathbb{R}}^{\left(\right|D|-2)\times (n_{\mathrm{c}}-1)}.$$

(28)

With these definitions, the objective in (26) can be compactly written as

$$\underset{P}{min}{\parallel BP-R\parallel }^2.$$

(29)

Taking derivatives of (29) with respect to P and setting them to zero yields the normal equations

$$B^{\mathsf{T}}BP=B^{\mathsf{T}}R.$$

(30)

In our application, the basis matrix B and the vector R are fully determined by the data points $\left\{Q_k\right\}$, the parameter values $\left\{{\overline{t}}_k\right\}$, and the fixed endpoint control points $P_0$ and $P_{n_{\mathrm{c}}}$. The unknowns are the interior control points $P_1,\dots ,P_{n_{\mathrm{c}}-1}$ collected in P. Since the x-coordinates of the control points follow the domain axis and are fixed by $\left\{v_k\right\}$, (30) is solved only for the frequency (vertical) coordinate. To complete the specification of this system, we next describe how the parameter values $\left\{{\overline{t}}_k\right\}$ and the knot vector are constructed, and then explain how the fitted spline is converted into a representation that can be directly integrated during query answering.

4.5.3. A Bias–Variance Bound for Spline Modeling

We further provide an explicit upper bound that relates the spline modeling error to the knot spacing and the variance of the UDPLDP histogram noise. Let $f(·)$ denote the (unknown) underlying frequency function over the value axis, and let the fitted spline model ${\widehat{f}}_h(·)$ be obtained by the least-squares procedure in Equation (29) using noisy histogram points $Q_k={(v_k,{\widehat{f}}_{v_k})}^{\mathsf{T}}$. Let $h={max}_j({\zeta }_{j+1}-{\zeta }_j)$ be the maximum knot spacing (equivalently, the maximum leaf-interval length), and let $S_h$ be the degree-s spline space induced by the knot vector $\left\{{\zeta }_j\right\}$.

Define the best-approximation spline $f_h^{★}=arg{min}_{g\in S_h}{\parallel f-g\parallel }_2$, and denote by K the number of free spline coefficients (i.e., the number of unknown interior control points). Let ${\xi }_k={\widehat{f}}_{v_k}-f\left(v_k\right)$ be the histogram noise. Since our unary estimator is unbiased, $\mathbb{E}\left[{\xi }_k\right]=0$. Let ${\sigma }^2={max}_k\mathrm{Var}\left({\xi }_k\right)={max}_v\mathrm{Var}\left({\widehat{f}}_v\right)$ denote the worst-case histogram noise variance under the modeling subset $U_{\mathsf{model}}$ (which can be upper bounded by Equation (18) with N replaced by $|U_{\mathsf{model}}|$).

Proposition 1

(Spline modeling error bound). Assume $f\in C^{s+1}$ and the knots are quasi-uniform. There exist constants $C_1,C_2>0$ depending only on s and knot regularity such that

$$\mathbb{E}\left[\parallel {\widehat{f}}_h{-f\parallel }_2^2\right]\le C_1{h}^{2(s+1)}{\parallel f^{(s+1)}\parallel }_2^2+C_2{\sigma }^2{\displaystyle \frac{K}{\left|D\right|}}.$$

(31)

Moreover, since $K=O(1/h)$ for fixed degree s, the variance term scales as $O\left({\displaystyle \frac{{\sigma }^2}{\left|D\right|h}}\right)$, while the squared bias term scales as $O\left(h^{2(s+1)}\right)$.

Equation (31) makes explicit the bias–variance trade-off in spline modeling: denser knots (smaller h) reduce approximation bias but increase the degrees of freedom and thus amplify the effect of histogram noise, whereas larger $|U_{\mathsf{model}}|$ reduces ${\sigma }^2$ and shrinks the variance term.

4.5.4. Parameterization and Polynomial Conversion

To fully specify the least-squares system in Equation (30), we next define the data parameterization and the associated knot vector. We adopt a standard B-spline approximation setup: the two endpoints are interpolated, while interior points are fitted in the least-squares sense. The spline degree s is a tunable modeling hyper-parameter. In our implementation we use the cubic case ($s=3$), a common default that provides $C^2$ continuity and a stable bias–variance trade-off for fitting an LDP-noisy histogram: lower degrees often underfit and produce non-smooth piecewise trends, while higher degrees can be more noise-sensitive and less stable. Notably, model expressiveness is mainly governed by the knot/control-point density, and the privacy guarantee is unchanged because spline fitting is pure post-processing on locally perturbed reports.

• (i) Parameterization. We adopt a cumulative chord-length parameterization for the data points $\left\{Q_k\right\}$. (Alternative parameterizations such as equally-spaced and centripetal can also be used; we choose chord-length since it adapts the parameter spacing to local variations of the noisy histogram.) Let $L_{\mathsf{chord}}={\sum }_{k=1}^{\left|D\right|-1}\parallel Q_k-Q_{k-1}\parallel$ denote the total chord length of the polyline through $Q_0,\dots ,Q_{\left|D\right|-1}$. We set ${\overline{t}}_0=0$, ${\overline{t}}_{\left|D\right|-1}=1$, and for $k=1,\dots ,\left|D\right|-2$ define ${\overline{t}}_k={\overline{t}}_{k-1}+{\displaystyle \frac{\parallel Q_k-Q_{k-1}\parallel }{L_{\mathsf{chord}}}}.$ This parameterization allocates larger parameter increments to regions where the noisy histogram varies more rapidly, which improves the local fitting quality of the spline.
• (ii) Clamped knot vector construction. Given the parameter values $\left\{{\overline{t}}_k\right\}$, we construct a clamped knot vector $U=\{u_0,\dots ,u_{n_{\mathrm{c}}+s+1}\}$ using the De Boor averaging method. First, we enforce endpoint interpolation by setting the boundary knots with multiplicity $s+1$: $u_0=\cdots =u_s={\overline{t}}_0,u_{n_{\mathrm{c}}+1}=\cdots =u_{n_{\mathrm{c}}+s+1}={\overline{t}}_{\left|D\right|-1}.$ Then, for internal knots, let $n=\left|D\right|-1$ and $m=n_{\mathrm{c}}$ (so the number of control points is $m+1=n_{\mathrm{c}}+1$). Define $d={\displaystyle \frac{n+1}{m-s+1}}.$ For $j=1,\dots ,m-s$, we compute $i=\lfloor jd\rfloor ,\alpha =jd-i,u_{j+s}=(1-\alpha ){\overline{t}}_{i-1}+\alpha {\overline{t}}_i.$ This construction places internal knots according to the distribution of $\left\{{\overline{t}}_k\right\}$, which empirically yields well-conditioned normal equations in our implementation.
• (iii) Number of control points. The number of control points $n_{\mathrm{c}}+1$ controls the bias–variance trade-off: too few control points underfit the global trend, while too many may follow local perturbation noise. To avoid dataset-specific manual tuning, we optionally use a simple residual-driven refinement rule: starting from an initial $n_{\mathrm{c}}+1$, we increase the number of control points until the spline approximation error on $\left\{Q_k\right\}$ falls below a fixed threshold or a preset maximum is reached.

After solving the normal equations and obtaining the control points, we convert the fitted B-spline into a piecewise cubic polynomial form to support efficient query answering in UDPLDP-Tree, where repeated evaluation and integration over sub-intervals are needed.

We partition the domain into intervals $I_j=[v_j,v_{j+1})$ and represent the curve on each interval as

$$C\left(x\right)={\alpha }_j{x}^3+{\beta }_j{x}^2+{\gamma }_{j}x+{\delta }_j,x\in I_j.$$

(32)

The coefficients $({\alpha }_j,{\beta }_j,{\gamma }_j,{\delta }_j)$ are computed from the fitted spline and stored.

This representation enables closed-form integration on partially covered leaf intervals, avoiding extra discretization or simplifying assumptions. As a result, UDPLDP-Tree can refine the (at most two) boundary leaves via analytic integrals while using low-variance aggregates from fully covered internal nodes; the next subsection details this construction and query procedure.

4.6. UDPLDP-Tree Construction and Calibration

Based on the fitted B-spline model in Section 4.5, we build a hierarchical index, UDPLDP-Tree, for one-dimensional range-frequency queries under user-distinguished local privacy. The design is hybrid: leaf nodes store the cubic polynomials from the private spline fit, while internal nodes store UDPLDP-protected frequencies over unions of consecutive leaf intervals. This separates boundary refinement from interior aggregation: during query answering, fully covered internal nodes provide low-variance aggregates, and only the (at most two) boundary leaf intervals are handled by integrating their cubics. Construction has three steps: (i) define the tree over spline knot spans, (ii) calibrate internal nodes via privacy-compatible user allocation, and (iii) prune the tree to minimize expected range query error.

4.6.1. Tree Structure and Node Semantics

We begin by specifying the node granularity and what is stored at each node. The fitted spline induces L knot spans on the normalized domain, $I_j=[{\zeta }_j,{\zeta }_{j+1})$ for $j=1,\dots ,L$. We align each $I_j$ with one leaf and store its cubic coefficients $({\alpha }_j,{\beta }_j,{\gamma }_j,{\delta }_j)$ from Equation (32). We then build a balanced binary tree bottom-up over these leaves. Each internal node $n_k$ corresponds to a contiguous block of leaves, denoted by an index interval $I_k=[{\ell }_k,r_k]$ (in leaf order), and stores a frequency estimate ${\widehat{f}}_k$ for the mass within its covered domain range. With these semantics fixed, the remaining question is how to estimate ${\widehat{f}}_k$ under UDPLDP without repeatedly querying the same user along a path.

4.6.2. User Allocation and Node-Wise Estimation

Given a potentially unbalanced UDPLDP-Tree $\mathcal{T}$, we adopt path-wise user allocation [17,21] rather than layer-wise allocation [15,16], since nodes on a root-to-leaf path are nested and overlap.

We calibrate internal nodes using the held-out set $U_{\mathsf{tree}}$ with $N^{\prime }=\left|U_{\mathsf{tree}}\right|$. Path-wise allocation avoids repeatedly querying the same users on overlapping intervals, which would inflate variance and complicate privacy accounting. When processing a non-root internal node $n_k$, let $U_k$ be the users passed from its parent and sample $U_k^{\prime }\subseteq U_k$ with fraction $1/h_k$, where $h_k$ is the number of remaining internal levels in the subtree of $n_k$. The $1/h_k$ rule spreads users over the remaining levels without dataset-specific per-layer tuning. We pass only the remaining users to children, i.e., for each child $n_c$, set $U_c:=U_k\setminus U_k^{\prime }$, and denote ${\eta }_k=\left|U_k^{\prime }\right|/N^{\prime }$.

Since selected users are removed from the entire subtree, along any root-to-leaf path, the allocated sets are pairwise disjoint; thus, each user contributes to at most one node on that path and privacy composes in parallel (not sequential) across nodes on the same path.

Given $U_k^{\prime }$, each user $u\in U_k^{\prime }$ reports depending on whether membership in $I_k$ is sensitive: if ${\tau }_u\subseteq I_k$, the contribution is counted deterministically; otherwise, u reports the perturbed unary bit $\mathbb{1}[x_u\in I_k]$ using the level-specific $(a_p,b_p)$ from Section 4.4.2. The collector aggregates reports by privacy level and applies the same multi-level unary estimator to obtain an unbiased ${\widehat{f}}_k$. Because ${\eta }_k$ controls the node sample size, it also controls $Var\left({\widehat{f}}_k\right)$; we exploit this in pruning to trade off noise reduction and query flexibility. We also include an empirical comparison with a representative non-path allocation baseline to validate the benefit of path-wise allocation.

4.6.3. Pruning by Expected Range Query Error

Starting from the balanced tree, following the workload-agnostic pruning strategies used in PrivNUD and PriPL-Tree [17,21], we perform a top-down pruning to reduce noise while preserving query flexibility.

Concretely, we compare alternative local structures by their expected query error under uniformly random one-dimensional ranges, which captures how often each internal estimate is used and how noisy it is under the allocation. We adopt the “uniformly random ranges” model as a workload-agnostic surrogate: when no prior query workload is available, treating all intervals $[l,r]$ (with $l\le r$) as equally likely avoids tailoring the structure to any specific dataset or query pattern, while leading to a closed-form and efficiently computable node-usage weight. The pruning criterion is the expected query error under uniformly random one-dimensional ranges, measured by

$$\mathsf{Err}=\sum _{n_k\in \mathcal{N}}{w}_k·Var\left({\widehat{f}}_k\right)\propto \sum _{n_k\in \mathcal{N}}{\displaystyle \frac{w_k}{{\eta }_k}},$$

(33)

where $\mathcal{N}$ is the set of internal nodes, $w_k$ is the probability that $n_k$ participates in answering a random range query, and the proportionality uses the variance bound of the unary estimator together with ${\eta }_k$. Under this model, the sample space contains exactly $M(M+1)/2$ intervals over a domain of size $M=\left|D\right|$. Here, $w_k$ is the fraction of intervals for which node $n_k$ is selected in the canonical tree decomposition (i.e., $I_k\subseteq [l,r]$ but the parent interval is not fully contained), so $w_k$ directly quantifies the expected “usage frequency” of $n_k$. For a non-root node $n_k$ with leaf-index interval $[{\ell }_k,r_k]$ and parent $n_p$ with $[{\ell }_p,r_p]$, we compute

$$w_k={\displaystyle \frac{{\ell }_k(M-r_k+1)-{\ell }_p(M-r_p+1)}{(M+1)M/2}}.$$

(34)

In practice, removing a node only affects allocations and weights on the ancestor–descendant paths around that node, so we evaluate Equation (33) locally on the affected subtree and keep the structure that yields a smaller error. We also include empirical validation by reporting results with and without pruning under the same user-allocation rule.

At last, given a pruned UDPLDP-Tree $\mathcal{T}$ and a range $[l,r]$, we compute the estimated answer by the procedure in Algorithm 2. The algorithm performs a stack-based traversal to aggregate fully covered nodes: whenever a node interval $I_k\subseteq [l,r]$ but its parent is not fully contained, we add its estimated mass ${\widehat{f}}_k$ to the accumulator, which ensures that each covered region is counted exactly once (Lines 2–11). For the remaining boundary parts, the algorithm refines the estimate at the leaf level by integrating the stored piecewise cubic polynomial on each partially overlapped leaf interval $I_j$ over $[l,r]\cap I_j$ (Lines 12–15), yielding the final estimate $Q\left(\right[l,r\left]\right)$.

Algorithm 2: Range query answering on UDPLDP-Tree.

In practice, removing a node only changes allocations and weights along nearby ancestor–descendant paths, so we evaluate Equation (33) locally on the affected subtree and keep the structure with smaller error. While Equation (34) derives $w_k$ under uniformly random ranges for a closed form, the pruning objective is workload-agnostic. For a workload $\pi$, one can set $w_k$ to the probability (under $\pi$) that $n_k$ is used to answer a random query, and apply the same top-down pruning: frequently used nodes get larger $w_k$ and are retained, while rarely used nodes are pruned. A systematic empirical study of workload-adaptive pruning is left for future work. We also report results with and without pruning under the same allocation rule to empirically validate the pruning criterion.

4.7. Privacy and Error Analysis

This subsection completes the description of UDPLDP-Tree by analyzing (i) why the overall mechanism satisfies the intended $\mathcal{E}$-UDPLDP guarantee and (ii) how different design stages contribute to the final range query error. We first establish privacy by tracing all user interactions and invoking the post-processing property, and then decompose the estimation error into interpretable components aligned with the modeling and tree-calibration pipeline.

4.7.1. Privacy Guarantee

UDPLDP-Tree can answer range query while satisfying rigorous UDPLDP guarantees as shown in the following theorem.

Theorem 1.

UDPLDP-Tree satisfies $\mathcal{E}$-UDPLDP.

Proof. 

UDPLDP-Tree consists of four phases: (i) frequency-oracle reporting, (ii) B-spline fitting, (iii) tree calibration, and (iv) query answering. We analyze privacy phase by phase.

(i)

Frequency oracle (users in $U_{\mathsf{model}}$). The split of users into $U_{\mathsf{model}}$ and $U_{\mathsf{tree}}$ is independent of users’ private values, hence it incurs no privacy loss. Each user $u\in U_{\mathsf{model}}$ runs the unary $\mathcal{E}$-UDPLDP mechanism once to report a perturbed unary vector for her value. By the privacy theorem of the unary mechanism (see Section 4.4.2), this interaction satisfies $\mathcal{E}$-UDPLDP.

(ii)

B-spline fitting. The aggregator computes the noisy histogram and fits the B-spline model using only the perturbed reports from Phase (i). This phase does not access raw inputs and is therefore pure post-processing. So, it consumes no additional privacy budget.

(iii)

Tree calibration (users in $U_{\mathsf{tree}}$). Given the tree structure obtained from Phase (ii), each user $u\in U_{\mathsf{tree}}$ is assigned a set of internal nodes ${\mathcal{S}}_u$ whose corresponding intervals are pairwise disjoint (not on the same root-to-leaf path). User u forms a membership indicator vector ${\mathbf{v}}_u\in {\{0,1\}}^{|{\mathcal{S}}_u|}$ over ${\mathcal{S}}_u$, where exactly one coordinate equals 1 (the unique interval containing x) and all others are 0; thus, ${\mathbf{v}}_u$ is one-hot. She then perturbs each coordinate independently using the same bit randomizer as in the unary mechanism (parameterized by ${\epsilon }_u$), producing an output vector $\mathbf{O}$. Hence, the entire tree-calibration interaction satisfies $\mathcal{E}$-UDPLDP for each user in $U_{\mathsf{tree}}$.

(iv)

Query answering. Tree construction/pruning, node-frequency decoding, and answering range queries are computed solely from the perturbed reports collected in Phases (i) and (iii). Therefore, they are post-processing and incur no additional privacy loss.

Finally, since $U_{\mathsf{model}}$ and $U_{\mathsf{tree}}$ are disjoint and each user participates in at most one interactive phase, the overall algorithm satisfies $\mathcal{E}$-UDPLDP. □

4.7.2. Error Analysis

With privacy established, we now analyze the error sources of UDPLDP-Tree for a range query $Q\left(\right[l,r\left]\right)$. Because UDPLDP-Tree answers queries by combining (i) a smoothed spline model at the leaves and (ii) calibrated internal-node aggregates, its error naturally decomposes along the same pipeline. Specifically, the error has three components: (i) noise and sampling error of the unary estimation on $U_{\mathsf{model}}$; (ii) approximation error of the cubic B-spline fitted on the noisy histogram; and (iii) noise and sampling error of internal-node estimation on $U_{\mathsf{tree}}$.

(i)

Unary estimation error on $U_{\mathsf{model}}$. We first quantify the noise level of the histogram that serves as the input to B-spline fitting. For each domain point (or bin) $x\in D$, the collector obtains an unbiased estimate ${\widehat{f}}_x$ using Equation (16) on reports from $U_{\mathsf{model}}$. Its mean squared error is bounded by Equation (18), where N and $\left\{n_p\right\}$ are interpreted on $U_{\mathsf{model}}$ (i.e., $n_p$ counts level-p users whose privacy range contains x).

(ii)

Spline modeling error. Let $C_s(·)$ be the fitted cubic B-spline (least squares) from the noisy histogram ${\left\{{\widehat{f}}_x\right\}}_{x\in D}$. For any $x\in [{\zeta }_j,{\zeta }_{j+1})$,

$$C_s\left(x\right)-f_x=\left(C_s\left(x\right)-{\widehat{f}}_x\right)+\left({\widehat{f}}_x-f_x\right),$$

(35)

so by ${(a+b)}^2\le 2a^2+2b^2$,

$${\left(C_s\left(x\right)-f_x\right)}^2\le 2{\left(C_s\left(x\right)-{\widehat{f}}_x\right)}^2+2{\left({\widehat{f}}_x-f_x\right)}^2.$$

(36)

The first term is the spline-fitting residual to $\widehat{f}$, and the second is the unary histogram noise from (i). Hence, the modeling error decomposes into a data-dependent fitting residual plus unary-estimation noise; it decreases for smoother distributions and/or finer knots.

Spline integration can introduce boundary bias in addition to the variance of locally perturbed internal-node estimates. Under smoothness and maximum knot spacing h, the degree-s spline approximation error is $O\left(h^s\right)$ in the interior; since a range Q has at most two partial boundary segments, their contribution scales as $O(h^{s+1}/|Q\left|\right)$. In contrast, internal-node estimators are unbiased with variance $O(1/\left(N{\epsilon }^2\right))$ under our unary randomizer. Thus, for our regimes (moderate $\epsilon$, realistic N, and ranges spanning many cells), internal-node noise is dominant and boundary bias is lower-order. Boundary bias dominates mainly when LDP noise is negligible (very large N and high $\epsilon$) and the workload focuses on very short boundary ranges or highly non-smooth tails, consistent with DP–model-bias interactions reported in security-sensitive settings [25].

(iii)

Internal-node estimation error on $U_{\mathsf{tree}}$. Finally, we quantify the uncertainty contributed by internal-node aggregates that are used whenever a query fully covers a node interval. Users in $U_{\mathsf{tree}}$ are allocated to non-root internal nodes as described in Section 4.6. For an internal node $n_k$, let $U_k^{\prime }$ be its assigned user set and $N_k=\left|U_k^{\prime }\right|$. Applying the same multi-level unary estimator to $U_k^{\prime }$ yields an unbiased node frequency estimate ${\widehat{f}}_k$, whose variance admits the same functional bound as Equation (18) with N replaced by $N_k$.

We now connect the above point-wise and node-wise errors to the final range query estimator. Given a query interval $[l,r]$, UDPLDP-Tree decomposes $[l,r]$ into (a) a set of disjoint fully covered internal-node intervals and (b) at most two boundary sub-ranges within leaf intervals. The query answer is estimated by summing the selected internal-node estimates $\left\{{\widehat{f}}_k\right\}$ and adding the spline integrals over the boundary sub-ranges. Since $U_{\mathsf{model}}$ and $U_{\mathsf{tree}}$ are disjoint, and the path-wise allocation ensures that the user sets $\left\{U_k^{\prime }\right\}$ for different internal nodes are disjoint, the internal-node estimation errors contribute additively in variance. Therefore, the MSE of the range estimator is given by (a) the sum of variances of the internal nodes used in the decomposition and (b) the spline-modeling error on the boundary parts, whose point-wise error is controlled by the decomposition in (ii) together with the histogram MSE in (i).

4.7.3. Computational and Communication Costs

We summarize the computational and communication costs of UDPLDP-Tree in the one-dimensional setting. Let $M=\left|D\right|$ be the domain size, $m=\left|\mathcal{E}\right|$ be the number of privacy levels, $N_{\mathsf{model}}=\left|U_{\mathsf{model}}\right|$, and $N_{\mathsf{tree}}=\left|U_{\mathsf{tree}}\right|$. Let L be the number of spline knot spans (thus L leaf intervals in the tree) and $\left|\mathcal{T}\right|=O\left(L\right)$ be the number of nodes after pruning.

(i)

Local frequency reporting. Each user perturbs only the coordinates within her declared range ${\tau }_u$; hence, the user-side time is $O\left(\right|{\tau }_u\left|\right)$. In terms of communication, each user sends the privacy-level index and the randomized bits for ${\tau }_u$, which is $O\left(\right|{\tau }_u\left|\right)$ bits (and degenerates to $O\left(M\right)$ in the worst case when ${\tau }_u=D$). On the collector side, level-wise aggregation maintains counters per privacy level, yielding time $O\left({\sum }_{u\in U_{\mathsf{model}}}\right|{\tau }_u\left|\right)$ and memory $O\left(mM\right)$ for the sufficient statistics.

(ii)

B-spline fitting. The spline is fitted once from the noisy histogram of M points. Because B-spline bases have local support ($s+1$ non-zero bases per parameter value), forming the normal equations is linear in M (up to a constant depending on s), and solving for the $n_{\mathrm{c}}-1$ unknown interior control-point ordinates is efficient due to the banded structure. The subsequent conversion to the piecewise cubic form stores one polynomial per leaf interval, requiring $O\left(L\right)$ time and $O\left(L\right)$ memory.

(iii)

Tree calibration and pruning. Tree construction and pruning are offline and take $O\left(\right|\mathcal{T}\left|\right)$ time and $O\left(\right|\mathcal{T}\left|\right)$ space. For calibration, each user in $U_{\mathsf{tree}}$ reports membership indicators for the nodes she is allocated to; if a user is assigned $|{\mathcal{S}}_u|$ nodes, her computation and communication are $O\left(\right|{\mathcal{S}}_u\left|\right)$. The collector-side aggregation scales as $O\left({\sum }_{u\in U_{\mathsf{tree}}}\right|{\mathcal{S}}_u\left|\right)$ with an additional linear factor in m for maintaining level-wise sufficient statistics, and the memory overhead is $O\left(m\right|\mathcal{T}\left|\right)$.

(iv)

Query answering. After offline construction, answering a query requires traversing the pruned tree to collect the canonical decomposition plus integrating at most two boundary cubics; thus the per-query time is $O(log|\mathcal{T}\left|\right)$ in typical balanced cases, with $O\left(1\right)$ extra arithmetic for boundary refinement. Overall, the dominant online cost is logarithmic in the tree size, while the costs that scale with M and m occur only once per data-collection round.

5. Multi-Dimension Extension with Attribute-Weighted Privacy

This section extends UDPLDP-Tree from one-dimension to multi-dimension range queries. In multi-attribute data, sensitivities differ across dimensions, so a uniform budget can under-protect sensitive attributes or over-noise less sensitive ones. We address this by introducing attribute weights to scale user-level budgets, and combining 1-D UDPLDP-Trees with grid-based decompositions [17,20] for multi-dimension range answering. Importantly, we apply the same attribute-weighted budget rule to all reporting tasks in our multi-dimension framework, including one-dimension marginal reporting and two-dimension grid reporting, so the privacy semantics remains consistent when moving from single-attribute to attribute-pair estimation.

5.1. Motivation: Attribute-Heterogeneous Privacy Requirements

We start by motivating why a dimension-aware privacy allocation is needed in the multi-dimension setting. Most existing multi-dimension LDP-based range-frequency mechanisms implicitly assume that all attributes share the same privacy budget, and that users have homogeneous privacy requirements across attributes. This assumption is often unrealistic. In practice, attributes such as disease type, income, and precise location are substantially more sensitive than, e.g., age group or coarse demographic information. Enforcing a single budget for all attributes has two adverse effects: highly sensitive attributes may be under-protected, while less sensitive attributes are over-perturbed, leading to unnecessary noise and degraded accuracy for multi-dimension range-frequency queries.

Motivated by this gap, we introduce an attribute-weighted personalization scheme: the system first pre-assigns attribute-wise sensitivity weights for all dimensions, and each user then specifies a base privacy budget and a multi-dimension privacy range; the attribute-specific effective budgets are obtained by scaling the base budget with the pre-assigned weights. The key idea is to keep the user-chosen base budget as the protection level for the most sensitive attributes, while allowing less sensitive attributes (or reports involving them) to use larger effective budgets and thus lower noise. The next subsection formalizes this mechanism and clarifies how it preserves UDPLDP personalization while differentiating protection across attributes.

5.2. Attribute-Weighted UDPLDP Mechanism

We define an attribute-weighted UDPLDP mechanism by scaling each user’s base budget with public attribute weights. For a d-dimension record ${\mathbf{v}}_u=(v_u^{\left(1\right)},\dots ,v_u^{\left(d\right)})$ with $v_u^{\left(j\right)}\in D_j$, each attribute $A_j$ has a public weight ${\omega }^{\left(j\right)}\ge 1$, where ${\omega }^{\left(j\right)}=1$ is the highest sensitivity. Here, ${\omega }^{\left(j\right)}$ should be interpreted as an inverse-sensitivity (utility) weight: ${\omega }^{\left(j\right)}=1$ denotes the most sensitive attributes, while a larger ${\omega }^{\left(j\right)}$ means the attribute is less sensitive and can therefore tolerate weaker protection (i.e., less noise) for better utility. Recall that in (local) differential privacy, a larger $\epsilon$ implies weaker privacy and thus less injected noise. Each user declares a base budget ${\epsilon }_u\in \mathcal{E}$ (for ${\omega }^{\left(j\right)}=1$) and an attribute-wise privacy range ${\tau }_u={\prod }_{j=1}^d{\tau }_u^{\left(j\right)}$.

Effective budgets are then assigned per reporting task according to which attributes the task involves. For a 1-D task on $A_j$, we set ${\epsilon }_u^{\left(j\right)}={\omega }^{\left(j\right)}{\epsilon }_u$. More generally, when a reporting task involves an attribute subset $S\subseteq \{1,\dots ,d\}$, we assign the effective task budget as ${\epsilon }_u^{\left(S\right)}=\left({\prod }_{j\in S}{\omega }^{\left(j\right)}\right){\epsilon }_u$. We use a multiplicative aggregation so that the task budget is amplified only when all involved attributes are relatively less sensitive; in particular, if any attribute is maximally sensitive (${\omega }^{\left(j\right)}=1$), the task budget will not be overly inflated. This unified rule will be used by our framework below: Phase I corresponds to $\left|S\right|=1$ (marginals), while Phase II corresponds to $\left|S\right|=2$ (pairwise grids). For a task on S, we define the induced task domain $D_S={\prod }_{j\in S}{D}_j$ and induced privacy range ${\tau }_u^{\left(S\right)}={\prod }_{j\in S}{\tau }_u^{\left(j\right)}$. Since ${\omega }^{\left(j\right)}$ is public and does not depend on users’ private values, it only changes the intended protection level per attribute and does not introduce additional leakage beyond the UDPLDP model.

We instantiate the task-level randomizer on $D_S$ by reusing the 1-D UDPLDP building block (unary OUE-style construction and the same pairwise budget operator in Section 4.4.2). For $S=\left\{j\right\}$, this is a UDPLDP mechanism on $D_j$ using ${\left\{{\epsilon }_u^{\left(j\right)}\right\}}_u$ and ${\left\{{\tau }_u^{\left(j\right)}\right\}}_u$. For an attribute-pair task on $⟨A_i,A_j⟩$, we instantiate the same unary UDPLDP mechanism on the grid domain $D_i\times D_j$ using the task budgets ${\left\{{\epsilon }_u^{(i,j)}\right\}}_u$, where ${\epsilon }_u^{(i,j)}={\omega }^{\left(i\right)}{\omega }^{\left(j\right)}{\epsilon }_u$ is exactly the $\left|S\right|=2$ case of the unified rule above.

Crucially, the UDPLDP constraint is enforced at the level of each task: for any user pair $(u,u^{\prime })$, indistinguishability is controlled by applying the same pairwise operator to the effective task budgets $min\{{\epsilon }_u^{\left(S\right)},{\epsilon }_{u^{\prime }}^{\left(S\right)}\}$. Accordingly, $M^{\left(S\right)}$ satisfies user-level UD-PLDP if, for all $u,u^{\prime }\in \mathcal{U}$, $x\in {\tau }_u^{\left(S\right)}$, $x^{\prime }\in {\tau }_{u^{\prime }}^{\left(S\right)}$, and $y\in \mathrm{Range}\left(M^{\left(S\right)}\right)$,

$${\displaystyle \frac{Pr[M^{\left(S\right)}\left(x\right)=y]}{Pr[M^{\left(S\right)}\left(x^{\prime }\right)=y]}}\le exp\left(min\{{\epsilon }_u^{\left(S\right)},{\epsilon }_{u^{\prime }}^{\left(S\right)}\}\right).$$

(37)

where $M^{\left(S\right)}$ denotes the task-level local randomizer instantiated on $D_S$ (e.g., $D_j$ for $S=\left\{j\right\}$ and $D_i\times D_j$ for $S=\{i,j\}$).

If a user participates in multiple reporting tasks, the overall privacy loss follows standard sequential composition across those interactions. In our framework, we avoid unintended budget accumulation by allocating users to disjoint tasks, so that each user contributes to at most one task (either one marginal or one grid). We next build a query answering framework that scales to $\lambda$-dimension ranges.

5.3. Multi-Dimension Framework

Given the attribute-weighted UDPLDP mechanism above, we adopt a standard decomposition framework that reduces $\lambda$-dimension ($\lambda \ge 2$) range queries to one-dimension marginals and two-dimension grids, similar in spirit to prior work [20]. We emphasize that our contribution lies in the privacy allocation scheme; the decomposition serves as a compatible and efficient wrapper for turning the task-level UDPLDP mechanisms into multi-dimension query answers. The apparent “1-D then 2-D” structure is purely algorithmic: both are instances of the same task-level UDPLDP mechanism with different task domains and effective task budgets. The framework proceeds in three phases that estimate 1-D marginals, 2-D pairwise joint counts, and then reconcile them for consistency.

• Phase I: One-dimension marginals via UDPLDP-Trees. We first allocate a subset of users to estimate one-dimension marginal distributions, since these marginals provide both standalone 1-D query answers and constraints for refining higher-dimensional estimates. For each attribute $A_j$, we build an independent UDPLDP-Tree on domain $D_j$ using only the attribute-specific budgets ${\left\{{\epsilon }_u^{\left(j\right)}\right\}}_u$ and privacy ranges ${\left\{{\tau }_u^{\left(j\right)}\right\}}_u$. This yields a set of 1-D UDPLDP-Trees that provide smoothed, piecewise-cubic approximations of the marginals and can answer one-dimension range-frequency queries along each attribute.
• Phase II: Two-dimension grids for attribute pairs. While marginals alone are insufficient for $\lambda \ge 2$ range queries, a lightweight way to capture cross-attribute dependence is to estimate pairwise joint distributions. For each attribute pair $⟨A_i,A_j⟩$ with $i\ne j$, we construct a regular grid over $D_i\times D_j$ using the same granularity as in [20] and assign a disjoint subset of users to this pair. Each assigned user u contributes exactly one privatized report to the grid task, using the effective task budget ${\epsilon }_u^{(i,j)}={\omega }^{\left(i\right)}{\omega }^{\left(j\right)}{\epsilon }_u$ defined in the mechanism above. For any user u assigned to $⟨A_i,A_j⟩$, we form a single attribute-pair privacy budget ${\epsilon }_u^{(i,j)}={\omega }^{\left(i\right)}{\omega }^{\left(j\right)}{\epsilon }_u$ and apply the UDPLDP unary mechanism (Section 4.4.2) to her grid cell in $D_i\times D_j$ under this budget. Aggregating the privatized reports over all users yields noisy but unbiased estimates of the cell frequencies in each two-dimension grid. The resulting indistinguishability for any user pair $(u,u^{\prime })$ in this task is bounded by $min\{{\epsilon }_u^{(i,j)},{\epsilon }_{u^{\prime }}^{(i,j)}\}$, consistent with the UDPLDP semantics under heterogeneous effective budgets.
• Phase III: Response matrices and consistency refinement. The final step converts the separate 1-D and 2-D estimates into a coherent set of statistics that can be used for multi-dimension query answering. For each attribute pair $⟨A_i,A_j⟩$, we combine the one-dimension marginals from the two corresponding UDPLDP-Trees with the two-dimension grid counts to construct a response matrix that approximates the joint distribution on $D_i\times D_j$ [17,20]. A lightweight consistency refinement (e.g., a weighted least-squares adjustment) can be applied so that the row and column marginals of each response matrix match the 1-D UDPLDP-Tree estimates while remaining close to the noisy grid counts. This step does not consume additional privacy budget.

6. Evaluation

In this section, we evaluate the performance of UDPLDP-Tree and its extension for both one-dimension and multi-dimension range queries.

6.1. Experimental Setup

• Environment. All experiments are conducted on a desktop with an 11th Gen Intel Core i5-11500 CPU @ 2.70 GHz, 16 GB RAM, and Intel UHD Graphics 750.
• Datasets. Following the dataset configuration in prior work, we use four synthetic datasets (Gaussian, MixGaussian, Cauchy, Zipf) and four real-world datasets (Adult [26], Loan [27], Salary [28], Financial [29]). Each dataset contains five attributes. For the synthetic data, every dimension is independently drawn from a target distribution: Gaussian from $\mathcal{N}(0,1)$, Cauchy from $\mathrm{Cauchy}(0,1)$, and Zipf from $\mathrm{Zipf}\left(1.1\right)$. The MixGaussian dataset is generated from a mixture of two Gaussians, $\mathcal{N}(0,0.5)$ and $\mathcal{N}(3,0.8)$. For the real-world datasets, we select five attributes per dataset and discretize them into finite domains for range-frequency evaluation. Table 1 summarizes the dataset sizes and basic statistics after discretization.
• Metrics. We use the MSE as the main measure of utility. For a workload $\mathcal{Q}$ of range-frequency queries, let $f_Q$ and ${\widehat{f}}_Q$ denote the true and estimated answers for $Q\in \mathcal{Q}$. The error is computed as $MSE\left(\mathcal{Q}\right)={\displaystyle \frac{1}{\left|\mathcal{Q}\right|}}{\sum }_{Q\in \mathcal{Q}}{(f_Q-{\widehat{f}}_Q)}^2.$ Unless otherwise stated, each configuration is evaluated on 1000 randomly generated range queries with a given range-length distribution, and the final MSE is obtained by averaging over 20 independent runs of the experiment. In each run, we use an independent random seed that controls (i) the sampling of users/records, (ii) the randomness of the local perturbation mechanism, and (iii) the random query workload generation. For readability, the figures plot the mean MSE over the 20 independent runs.
• Competitors. For one-dimension range-frequency tasks, we compare UDPLDP-Tree with AHEAD [16], PrivNUD [17], and PriPL-Tree [21]. For multi-dimension experiments, we additionally include HDG [20] as a strong hierarchical baseline. These baselines cover both hierarchical schemes (AHEAD, HDG, PrivNUD) and recent model-assisted schemes (PriPL-Tree) under local privacy. All implementations follow the original papers with default/recommended parameters. All methods use the same datasets, privacy budgets, query workloads, and user population size, so MSE differences reflect mechanism design rather than mismatched settings.
• Default Settings. Unless otherwise specified, we split users evenly between the modeling and tree sets, i.e., $|U_{\mathsf{model}}|$:$|U_{\mathsf{tree}}|$ = 1:1. The average privacy budget is fixed to $\overline{\epsilon }=0.4$ for all methods. We set the query volume to $\mathrm{vol}\left(Q\right)=0.5$, i.e., the range-length/domain-size ratio on each queried attribute. We use the default 1:1 split as in PriPL-Tree [21]; fixing this split across all methods/datasets ensures like-for-like comparison, since the ratio trades off modeling vs. tree-estimation variance. While [21] derives an optimal split for its LP-based model, extending split optimization to our spline-based model is left for future work. To instantiate heterogeneous privacy ranges, each user samples a granularity level g from a fixed categorical distribution and sets ${\tau }_u$ as a contiguous interval (fixed length ratio) containing her true value, clipped at boundaries; we use the same $\left\{({\tau }_u,{\epsilon }_u)\right\}$ generation for all methods. Unless stated otherwise, we use the default B-spline setting in Section 4.5 and the default tree calibration/pruning rules in Section 4.6.

Table 1. Summary of datasets.

Dataset	U.#	L.#	Mean	Var.	Dataset	U.#	L.#	Mean	Var.
Gaussian	${10}^6$	0	155.0	775.34	Adult	32,561	4	30.36	336.88
MixGaussian	${10}^6$	0	135.12	2516.62	Loan	148,045	3	48.67	1620.19
Cauchy	${10}^6$	5	159.37	609.50	Salary	2,013,799	2	33.59	515.88
Zipf	${10}^6$	5	24.40	2517.47	Financial	6,362,620	5	0.23	2.65

U.#: The number of users (i.e., samples). L.#: The number of leptokurtic attributes with a kurtosis exceeding 3.

6.2. Evaluation for One-Dimension Range Queries

In this subsection, we evaluate the performance of UDPLDP-Tree on one-dimension range queries. We first compare UDPLDP-Tree with AHEAD, PrivNUD, and PriPL-Tree on synthetic and real-world datasets. Note that the one-dimension comparison is not limited to a single baseline: we include both a representative hierarchical method (AHEAD) and two recent model-assisted methods (PrivNUD and PriPL-Tree), which enables a like-for-like evaluation across different design families under the same settings.

6.2.1. Results for One-Dimension Range Queries on Synthetic Datasets

We begin with four synthetic datasets (Gaussian, MixGaussian, Cauchy, and Zipf). For each dataset, we report the MSE of different methods under the default settings described in Section 5. The curves show how UDPLDP-Tree behaves under different distribution shapes, including light-tailed, heavy-tailed, and multi-modal cases, and provide a clean comparison with AHEAD, PrivNUD, and PriPL-Tree.

Figure 2 reports the MSE of one-dimension range queries on the four synthetic datasets. Across all privacy budgets $\epsilon$ and all distributions, UDPLDP-Tree consistently achieves the lowest error. For example, when $\epsilon \le 0.6$, UDPLDP-Tree typically reduces the MSE by around 30∼50% compared with PriPL-Tree, and by about 2–$5\times$ compared with AHEAD, while also outperforming PrivNUD. As $\epsilon$ increases, the MSE of all methods decreases, but UDPLDP-Tree maintains a stable margin, indicating that our user-distinguished privacy allocation and distribution modeling bring benefits over the whole privacy regime. The gains are particularly evident on the heavy-tailed Cauchy and Zipf datasets, where the B-spline-based modeling and adaptive tree partition enable UDPLDP-Tree to better capture skewed densities and avoid over-allocating noise to low-density regions. Overall, these results confirm that combining UDPLDP with piecewise curve fitting and hierarchical aggregation yields a more accurate one-dimension range query mechanism than existing LDP approaches on synthetic data.

Figure 2. One-dimension range query MSE comparison under four synthetic datasets.

6.2.2. Results for One-Dimension Range Queries on Real-World Datasets

We next evaluate one-dimension range queries on the four real-world datasets (Adult, Loan, Salary, and Financial). Under the same default configuration, we plot the MSE of all methods and observe how they perform on practical, heterogeneous data. These results demonstrate the robustness of UDPLDP-Tree when facing skewed frequencies and attribute discretization in real applications.

Figure 3 reports the MSE of one-dimension range queries on the four real-world datasets. Across all privacy budgets $\epsilon$, UDPLDP-Tree consistently attains the lowest error. On Adult, when $\epsilon =0.6$, UDPLDP-Tree reduces the MSE to around ${10}^{-4}$, which is about three times smaller than PriPL-Tree and nearly an order of magnitude lower than AHEAD and PrivNUD. On Loan and Salary, for $\epsilon$ in the range $[0.4,1.0]$, UDPLDP-Tree typically achieves about 2–$4\times$ lower MSE than PriPL-Tree and PrivNUD, and more than one order of magnitude improvement over AHEAD. Even on the relatively easy Financial dataset, where all methods already obtain very small errors, UDPLDP-Tree still delivers the best accuracy for most privacy budgets.

Figure 3. One-dimension range query MSE comparison under four real datasets.

These gains are consistent with our design. Real-world datasets often exhibit skewed and clustered distributions, together with heterogeneous user sensitivities. The UDPLDP mechanism allows users with different privacy ranges and budgets to contribute with appropriate noise levels, while the B-spline modeling and UDPLDP-Tree construction adapt the partition to dense regions and avoid spending privacy budget on sparse intervals. As a result, UDPLDP-Tree captures the underlying frequency patterns more accurately, leading to substantially lower MSE than existing LDP schemes on all four real datasets.

6.3. Evaluation for Multi-Dimension Range Queries

We next evaluate the multi-dimension extension of UDPLDP-Tree under attribute-weighted privacy. In this setting, each user holds a d-dimensional record, while each query involves a subset of attributes and asks for the fraction of records falling into a multi-dimension hyper-rectangle. Following Section 5, we focus on three-dimension range queries and vary the total privacy budget $\epsilon$ while keeping the attribute-weight configuration fixed. For multi-dimension evaluation, we additionally include HDG as a strong hierarchical baseline; together with AHEAD, PrivNUD, and PriPL-Tree, the competitor set covers multiple state-of-the-art design families under the same privacy budgets and query workloads. For clarity, we denote our proposed multi-dimension mechanism as UDPLDP in the plots. The performance metric is the MSE between the estimated and true query answers.

6.3.1. Results for Multi-Dimension Range Queries on Synthetic Datasets

Figure 4 reports the MSE of multi-dimensional range queries on the four synthetic datasets. Across all distributions and privacy budgets $\epsilon$, UDPLDP-Tree achieves the best accuracy and shows a clear and stable advantage over all baselines. On light-tailed Gaussian data, UDPLDP-Tree yields uniformly lower MSE than PriPL-Tree, PrivNUD, and HDG, and improves over AHEAD by one to two orders of magnitude. Similar trends appear on the multi-modal MixGaussian distribution, where UDPLDP-Tree maintains a noticeable margin for all $\epsilon$, typically reducing the MSE by about 30∼60% compared with PriPL-Tree and by several times compared with PrivNUD and HDG.

Figure 4. Mutil-dimension range query MSE comparison under four synthetic datasets.

The advantage of UDPLDP-Tree becomes even more pronounced on the heavy-tailed Cauchy and Zipf datasets. In these skewed settings, the MSE of AHEAD, PrivNUD, and HDG decreases slowly and remains relatively high even at large $\epsilon$, while UDPLDP-Tree quickly converges to the lowest error across the whole privacy regime. This behavior confirms that combining user-distinguished privacy allocation with multi-dimensional B-spline modeling and hierarchical partitioning helps UDPLDP-Tree concentrate the privacy budget on dense regions and reduce unnecessary noise in sparse areas, thereby mitigating the “curse of dimensionality” that affects existing LDP schemes in multi-dimensional range queries.

6.3.2. Results for Multi-Dimension Range Queries on Real-World Datasets

Figure 5 presents the MSE of multi-dimensional range queries on the four real-world datasets. The overall pattern is consistent with the synthetic results: UDPLDP-Tree consistently achieves the lowest error for all tested $\epsilon$. On the Adult and Loan datasets, UDPLDP-Tree significantly outperforms AHEAD, HDG, and PrivNUD, and provides a substantial improvement over PriPL-Tree. For example, in the medium-privacy regime ($\epsilon$ between $0.4$ and $1.0$), UDPLDP-Tree typically reduces the MSE by roughly 2–$4\times$ compared with PriPL-Tree, while the gap to AHEAD can reach one order of magnitude.

Figure 5. Mutil-dimension range query MSE comparison under four real datasets.

On the Salary and Financial datasets, where attribute correlations and frequency skew are more evident, UDPLDP-Tree remains the most accurate method across all privacy budgets. The competing schemes either suffer from large errors at small $\epsilon$ or exhibit a much slower decrease in MSE as $\epsilon$ grows. By contrast, UDPLDP-Tree leverages the UDPLDP mechanism and attribute-weighted budget allocation to tailor noise to users’ heterogeneous privacy ranges, and uses the multi-dimensional UDPLDP-Tree structure to align partitions with high-density regions. These design choices enable UDPLDP-Tree to capture real-world joint distributions more precisely, resulting in robust and consistently lower MSE than existing LDP-based methods on all four datasets.

7. Related Work

This section reviews prior studies on personalized privacy protection and range query answering under both centralized DP and local DP.

7.1. Personalized Privacy Protection

Personalized privacy was first explored in location-centric settings, e.g., through personalized anonymization models [30] and later mechanisms designed to resist long-term observation attacks in location privacy publishing [31]. To obtain formal guarantees, personalized differential privacy (PDP) further studies heterogeneous protection through mechanism design or dataset partitioning, including adaptive personalized DP [32], heterogeneous DP via stretching transformations [33], and partitioning-based personalized DP mechanisms [34]. However, most PDP-style solutions assume the curator can access users’ raw data before perturbation, which is undesirable in high-sensitivity applications.

To avoid collecting raw data, subsequent work shifts personalization to the local model and develops personalized LDP mechanisms for basic statistics. Representative examples include locally private spatial data aggregation [14], personalized histogram/frequency estimation with customized privacy levels [35,36], and personalized local aggregation mechanisms for numeric queries [37]. In parallel, value-dependent sensitivity has been leveraged to improve distribution estimation [38], and input-discriminative protection further strengthens such value awareness under LDP [13].

7.2. Range Query Under DP

Range query answering under centralized DP is often built on hierarchical summaries. Early work uses tree-based decompositions together with constrained inference to enforce consistency among noisy node estimates [39,40]. Subsequent studies reduce tree noise through improved representations (e.g., wavelet transforms) [41] and more careful privacy-budget allocation and partitioning strategies tailored to data distributions and query workloads [42,43]. For multi-dimension settings, variants such as optimized quad-trees and balanced box-decomposition trees further improve geometric range counting [44,45]. Beyond trees, grid-based methods with optimized granularity are commonly used for high-dimensional queries [40], and more recent model-driven designs learn from noisy low-dimensional range answers to predict results without complex indexes [46].

7.3. Range Query Under LDP

Existing range query mechanisms under LDP can be broadly grouped into tree-based and grid-based approaches. Tree-based methods build hierarchical summaries over the domain and typically tune the fan-out to balance noise and bias, as in HH [15] and HIO [18]. Later improvements further reduce error by adapting the hierarchy to the data, e.g., merging low-frequency intervals (AHEAD [16]), customizing node-wise fan-out (PrivNUD [17]), or enhancing the tree with Haar wavelet transforms (DHT [15] following [41]). Grid-based methods instead discretize the domain and answer queries via cell aggregation; representative designs include hybrid dimensional grids (HDG [20]) and prefix-sum cubes that replace simple grids (PRISM [19]). Beyond these two families, some works study more general query-answering primitives in LDP, such as matrix mechanisms for linear queries that can specialize to ranges [47]. Furthermore, PriPL-Tree models non-uniform partitions using a tree with piecewise-linear fits [21].

8. Conclusions

In this paper, we first propose the UDPLDP framework, which supports personalized indistinguishability levels for different users. Subsequently, we leverage this framework to facilitate range queries, introducing the UDPLDP-Tree to overcome the challenges of data utility and privacy in both one-dimensional and multi-dimensional spaces. Finally, experimental evaluations validate the efficiency and effectiveness of our approach. In future work, we plan to extend the UDPLDP framework to support a wider range of complex query types to improve the data utility.