From Erasure to Leakage: Nonresponse under Local Differential Privacy

Nonresponse is often treated as a loss of data. Under local differential privacy, however, its effect depends on why users fail to respond. We study categorical distribution estimation with an explicit nonresponse symbol and distinguish two cases. When nonresponse is independent of the private category, the mechanism is exactly $k$-ary randomized response followed by erasure. This gives a simple statistical interpretation: several information measures contract by $1-\delta$, and the squared risk of the raw inverse estimator is inflated asymptotically by $1/(1-\delta )$. The situation is different when response probabilities vary across private categories. The decision to respond then carries information about the private value and also changes the composition of the observed sample. We derive the exact privacy cost of this effect and characterize the resulting selection bias. If the true response propensities are known, the population distribution can be recovered with an unbiased estimator. If they are latent, the released distribution generally does not identify the population separately from the response process. Experiments on synthetic distributions and empirical categorical distributions from four UCI datasets closely match the theoretical predictions. They also show that two mechanisms with the same average nonresponse rate can have very different privacy and estimation costs.