Privacy Amplification via Shuffling for Linear Contextual Bandits
  Contextual bandit algorithms are widely used in domains where it is desirable
to provide a personalized service by leveraging contextual information, that
may contain sensitive information that needs to be protected. Inspired by this
scenario, we study the contextual linear bandit problem with differential
privacy (DP) constraints. While the literature has focused on either
centralized (joint DP) or local (local DP) privacy, we consider the shuffle
model of privacy and we show that is possible to achieve a privacy/utility
trade-off between JDP and LDP. By leveraging shuffling from privacy and
batching from bandits, we present an algorithm with regret bound
$\widetilde{\mathcal{O}}(T^{2/3}/\varepsilon^{1/3})$, while guaranteeing both
central (joint) and local privacy. Our result shows that it is possible to
obtain a trade-off between JDP and LDP by leveraging the shuffle model while
preserving local privacy.
