Edge-Local Differential Privacy

• Edge-local differential privacy is a robust privacy model that secures individual edge data using local randomized mechanisms without needing a trusted server.
• It applies randomized response and unbiased estimators in decentralized graph analytics, aiding tasks like subgraph counting, community detection, and GNN training.
• The model balances privacy, communication, and computational trade-offs, enabling practical privacy-preserving solutions in IoT and federated machine learning.

Edge-local differential privacy (edge-LDP) is a robust privacy model for data generated by the edges of a network or graph, ensuring that the presence or absence of any single edge in a user's local view remains confidential, even from an untrusted aggregator or adversary. In edge-LDP, the privacy guarantee is enforced at the individual user or device level, with no reliance on a trusted server, making it particularly relevant for settings such as decentralized graph learning, IoT, and local model federated learning. This article surveys the definition, theory, core mechanisms, algorithmic frameworks, central lower bounds, and practical impact of edge-LDP across both graph and non-graph machine learning domains.

1. Formal Definition and Principles

Let $G=(V,E)$ be a simple undirected graph with vertex set $V$ and edge set $E$. In the edge-LDP model, each user $v_i\in V$ holds a private neighbor list (adjacency vector) $a_i \in \{0,1\}^n$ indicating incident edges. Two graphs $G,G'$ are called edge-neighbors if $|E \triangle E'|=1$.

A randomized mechanism $\mathcal{R}:\{0,1\}^n \to \mathcal{Y}$ satisfies $\varepsilon$-edge local differential privacy if for all $a_i,a_i'$ differing in one coordinate (i.e. one edge), and all measurable $S \subseteq \mathcal{Y}$,

$$\Pr[\mathcal{R}(a_i)\in S] \leq e^\varepsilon \Pr[\mathcal{R}(a_i')\in S].$$

Composition across multiple invocations or phases sums privacy loss across all mechanisms. In distributed settings, the joint transcript of all messages must satisfy $\varepsilon$-edge-DP globally, with per-edge budget at most $\varepsilon$ (sum across endpoints).

This guarantee ensures that the output distribution of the released data cannot be used to infer the presence or absence of any single edge with confidence greater than $e^\varepsilon$ over all other possible edge configurations (Vishwanath et al., 24 Apr 2025, Hillebrand et al., 2023, Dhulipala et al., 2022, Hidano et al., 2022, Eden et al., 2023).

2. Core Mechanisms for Edge-Local Differential Privacy

The dominant mechanism for enforcing edge-LDP is randomized response (RR), originally due to Warner, adapted as follows:

• Each bit $a_{ij}$ of the adjacency vector is flipped (complemented) independently with probability $p=\frac{1}{1+e^\varepsilon}$ and retained with probability $q=1-p=\frac{e^\varepsilon}{1+e^\varepsilon}$.
• This construction yields $\varepsilon$-LDP per edge. For aggregated statistics, unbiased estimators are constructed via linear correction (e.g., $$Y_{ij} = (X_{ij}(e^\varepsilon+1)-1)/(e^\varepsilon-1)$$) (Eden et al., 2023, Guo et al., 9 Jul 2025).

Several improved or specialized mechanisms extend this principle:

• Degree-Preserving RR (DPRR) uses a two-stage process: Laplace mechanism adds noise to the degree, and a subsequent probabilistic sampling stage ensures that the expected noisy degree matches the true value. This approach stabilizes topological properties critical for graph neural networks (GNNs) (Hidano et al., 2022).
• In high-dimensional ML or deep architectures, bitwise representations of intermediate features are subjected to "utility-enhancing randomization" protocols, altering flip probabilities across bits to balance utility and privacy (Chamikara et al., 2019).
• Local hash-based grouping with RR allows dramatic communication reduction for large graphs, with privacy amplification by subsampling (Hillebrand et al., 2023).

For scalar queries (e.g. degree, core number counts), the Laplace or geometric mechanism is used, adding noise proportional to the function's sensitivity.

3. Algorithmic Frameworks and Applications

Edge-LDP acts as a foundational primitive for diverse algorithmic frameworks:

Private Graph Analytics and Subgraph Counting

Edge-LDP enables local algorithms for triangle counting, $k$-core decomposition, densest subgraph finding, and other subgraph statistics. Typical logic:

• Users release privatized adjacency lists via RR, possibly constrained via personalized or protocol-derived sampling (Dhulipala et al., 2022, Mundra et al., 25 Jun 2025, Guo et al., 9 Jul 2025, Hillebrand et al., 2023).
• Central aggregators reconstruct unbiased estimators for graph statistics (triangles, quadrangles, stars) using suitable polynomial estimators on the noisy adjacency matrix.
• Multiple rounds (e.g., noisy matrix construction + secondary local computations) enable further accuracy/computation trade-offs, leveraging confidence-interval-driven dynamic sensitivity calibration in second-round DP mechanisms (Guo et al., 9 Jul 2025).

Recent advances exploit input-dependent calibrations: using the graph's degeneracy and max degree to substantially improve error bounds, replacing edge-count dependence from $O(n^2/\epsilon)$ to $O(nd^2/\epsilon^4)$ for triangle counting (Mundra et al., 25 Jun 2025).

Private Community Detection and Latent Structure Recovery

Private spectral clustering: Edge-flip RR mechanisms preserve expectation of the adjacency matrix's spectrum, allowing standard concentration bounds and consistent clustering under conditions on graph density. Robustness depends on flipping probability: for $p=O(\log n/n)$ (i.e., $\varepsilon=\Theta(\log n)$), clustering recovers the underlying communities with small error in graphs with spectral-gap robustness (Hehir et al., 2021, Mukherjee et al., 2023, Vishwanath et al., 24 Apr 2025).

Signal recovery in latent position models (e.g., GRDPG): Recent work establishes that edge-LDP induces a geometric transformation (affine embedding) on latent positions, and explicit bias/rescaling adjustments to the private graph restore consistent estimators of latent positions and their topological invariants with minimax-optimal error scaling (Vishwanath et al., 24 Apr 2025).

Private Distributed and Federated Machine Learning

Edge-LDP has been incorporated in split learning and federated learning for resource-constrained or decentralized settings. Notably:

• In split learning, intermediate CNN representations are privatized on-device prior to transfer, with SDN/NFV-integration enabling scalable edge deployment (Chamikara et al., 2019).
• In hierarchical federated learning (HierSFL), local layers and edge-aggregated updates are independently privatized using the Laplace mechanism at both client and edge-server, accumulating privacy loss by sequential and parallel composition (Quan et al., 2024).

Private Decentralized Graph and GNN Learning

Edge-LDP supports privacy-preserving training of GNNs on social graphs:

• Each participant releases feature vectors and adjacent edges via suitably paired (possibly multi-stage) local mechanisms, with post-collection smoothing and regularization to preserve essential structural properties for accurate learning (Lin et al., 2022, Hidano et al., 2022).

4. Lower Bounds and Limitations

Fundamental limitations have been established for graph statistics under edge-LDP:

• For noninteractive (one-round) triangle counting, any edge-LDP protocol must incur additive error $\Omega(n^2)$, matched by optimized randomized response algorithms (Eden et al., 2023).
• For interactive protocols (multiple rounds), the optimal lower bound improves only to $\Omega(n^{3/2}/\epsilon)$.
• These lower bounds preclude utility unattainable in the local model that is achievable in the central (curator) DP model. Central DP via Laplace mechanism can achieve $O(n/\epsilon)$ error for triangles, while in local privacy, errors for dense graphs rise much more rapidly in $n$ (Eden et al., 2023, Dhulipala et al., 2022, Mundra et al., 25 Jun 2025).

For spectral clustering, optimal robustness degrades to triviality if the edge-flip probability exceeds $O(\log n/n)$ ($\varepsilon$ drops below $\Theta(\log n)$), even for well-clustered but non-SBM graphs (Mukherjee et al., 2023).

5. Utility–Privacy–Overhead Trade-offs

The design of edge-LDP protocols requires balancing several trade-offs:

• Privacy budget $\varepsilon$ controls the noise scale. Lower $\varepsilon$ means stronger privacy, but increases estimate variance, potentially reducing utility (classification or estimation accuracy, clustering error).
• Communication cost is a dominant concern for distributed graphs. Innovations such as group-hashed reporting via universal hashing enable quadratic reductions in communication at a linear cost in variance (Hillebrand et al., 2023).
• Computational overhead can be mitigated by structuring protocols to minimize per-node or per-interaction complexity (e.g., bit-level randomization in IoT gateways, low number of interaction rounds in core decomposition (Chamikara et al., 2019, Dhulipala et al., 2022, Mundra et al., 25 Jun 2025)).

Empirically, state-of-the-art protocols such as the UER protocol for deep learning or hybrid subgraph estimators maintain $>90\%$ of nonprivate accuracy at moderate privacy budgets ($\varepsilon=0.5-1.0$) in vision and graph learning tasks (Chamikara et al., 2019, Quan et al., 2024, Lin et al., 2022, Mundra et al., 25 Jun 2025, Guo et al., 9 Jul 2025).

6. Algorithmic and Practical Recommendations

For practical deployment:

• Employ privacy budget $\varepsilon$ in the range $[0.5,1]$ for high privacy and modest utility loss in canonical tasks.
• Select mechanism parameters (e.g., bit-lengths in feature encoding, flip bias, group size in hashing) to match the application’s scale and resource profile; maximize communication reduction where possible without excessive variance inflation (Chamikara et al., 2019, Hillebrand et al., 2023).
• Deploy randomized response–based mechanisms as default for adjacency-vector privacy; augment with degree-preserving or utility-enhancing extensions when topological invariants must be preserved (Hidano et al., 2022, Mundra et al., 25 Jun 2025).
• Employ multi-round frameworks for motif or neighborhood queries in bipartite and general graphs to dramatically reduce variance for queries involving low-degree nodes (He et al., 4 Feb 2025).

A summary of leading algorithmic variants and their target domains is provided below.

Task/domain	Canonical edge-LDP mechanism	Notable features/trade-offs
Subgraph counting	Randomized response + unbiased estimators	Lower bounds: $\Omega(n^2)$ for triangles, communication/variance trade-off (Eden et al., 2023, Hillebrand et al., 2023, Guo et al., 9 Jul 2025)
k-core, densest subgraph	Interactive locally adjustable protocols	Polylogarithmic error/rounds (Dhulipala et al., 2022, Mundra et al., 25 Jun 2025)
Graph/edge learning (GNNs)	RR + degree-preserving sampling (DPRR)	Preserves node degrees, stabilizes GNN accuracy (Hidano et al., 2022)
Community detection	Edge-flip RR + spectral adjustment	Dense graphs: asymptotically optimal error (Hehir et al., 2021, Vishwanath et al., 24 Apr 2025)
IoT/machine learning	Bitwise UER protocol, SDN/NFV integration	Near-baseline DL accuracy at moderate privacy (Chamikara et al., 2019)
Bipartite queries	Multi-round local + Laplace, optimal α-weights	Handles degree imbalance, scalable (He et al., 4 Feb 2025)
Federated/Split learning	Laplace/bitwise LDP at edge/client/server	Hierarchical DP composition (Quan et al., 2024)

7. Outlook and Current Challenges

Ongoing research directions in edge-LDP focus on sharp upper/lower bounds for more graph statistics in both one-shot and multi-round models, adapting input-sensitive calibrations across more statistics (e.g., PageRank, spectral embedding), and further scaling communication and computation for massive graphs (Mundra et al., 25 Jun 2025, Hillebrand et al., 2023). Incorporating real-world graph structure (sparsity, degeneracy, clustering) enables practical gains not possible under worst-case bounds.

The edge-LDP paradigm has become central for privacy-preserving analytics and learning on distributed or decentralized graphs, underpinning the design and deployment of high-utility, strong-privacy algorithms within both industrial and scientific applications.