BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model
  We propose a hybrid model of differential privacy that considers a
combination of regular and opt-in users who desire the differential privacy
guarantees of the local privacy model and the trusted curator model,
respectively. We demonstrate that within this model, it is possible to design a
new type of blended algorithm for the task of privately computing the head of a
search log. This blended approach provides significant improvements in the
utility of obtained data compared to related work while providing users with
their desired privacy guarantees. Specifically, on two large search click data
sets, comprising 1.75 and 16 GB respectively, our approach attains NDCG values
exceeding 95% across a range of privacy budget values.
