This is enabled through a new theoretical technique to analyze the Rényi Differential Privacy (RDP) of the sub-sampled shuffle model.

Here, we give local and central differential privacy definitions that we use throughout this work. Now, we prove Theorem 5. Our proof is an adaptation of the proof of [ 's are disjoint for all We present a proof of Lemma 4 in Appendix C.2. From Lemma 3 and Lemma 4, we get E By substituting from (27) into (25) completes the proof of Theorem 5. C.2 Proof of Lemma 4 We only show (22); (23) and (24) can be shown similarly. Let x, y 2 R be any two real numbers. From Lemma 6, we get the following corollary. Remark 3. Observe that the proof of Corollary 1 does not require This is what we do in the lemma below.