Flexible Privacy-Preserving Cardinality Query for Massive Distributed Datasets

Counting distinct elements (cardinality) across multiple data holders (DHs) privately is fundamental with broad applications, ranging from crowd counting to network monitoring. It is referred to as private distributed cardinality estimation (PDCE). Similarly, determining the intersection cardinality between the unions of two DH groups holds practical significance, a problem we call private distributed intersection cardinality estimation (PDICE). While many efficient methods (e.g., FM and LL sketches) exist, their differential privacy relies on secret hash functions. In PDCE, DHs must share the functions to enable sketch merging, which breaks this assumption and invalidates such guarantees. Although a recent protocol implements the FM sketch on a secret-sharing-based multiparty computation (MPC) framework for PDCE, we observe that it lacks differential privacy guarantees and is computationally expensive. To address these limitations, we propose DP-DICE-Bino, a novel protocol that is computationally efficient and differentially private for PDCE. DP-DICE-Bino is flexible in that it can compute the cardinality of any group of DHs without repeatedly interacting with the DHs. Furthermore, DP-DICE-Bino can also handle PDICE. Experiments show that DP-DICE-Bino achieves orders-of-magnitude speedups and reduces the estimation error by several times compared with the state of the art under the same security requirements.