Extremal Mechanisms for Local Differential Privacy Peter Kairouz Sewoong Oh