Extremal Mechanisms for Local Differential Privacy