Abstract
We study the problem of private vector mean estimation in the shuffle model of privacy where n users each have a unit vector v⁽ⁱ⁾ ∈R^d. We propose a new multi-message protocol that achieves the optimal error using O(min(nε²,d)) messages per user. Moreover, we show that any (unbiased) protocol that achieves optimal error requires each user to send Ω(min(nε²,d)/log(n)) messages, demonstrating the optimality of our message complexity up to logarithmic factors. Additionally, we study the single-message setting and design a protocol that achieves mean squared error O(dn^d/(d+2)ε^-4/(d+2)). Moreover, we show that any single-message protocol must incur mean squared error Ω(dn^d/(d+2)), showing that our protocol is optimal in the standard setting where ε = Θ(1). Finally, we study robustness to malicious users and show that malicious users can incur large additive error with a single shuffler.