# PAPAYA Federated Analytics Stack: Engineering Privacy, Scalability and Practicality

arXiv: https://arxiv.org/abs/2412.02340 · HTML: https://mlsanity.com/paper/2412.02340/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 42 references that are in the map.
- First posted on arXiv 3 Dec 2024.

## Builds on (most cited first, 21 of 21)

- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [Federated Learning for Mobile Keyboard Prediction](https://mlsanity.com/paper/1811.03604/) (2018)
- [RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response](https://mlsanity.com/paper/1407.6981/) (2014)
- [Papaya: Practical, Private, and Scalable Federated Learning](https://mlsanity.com/paper/2111.04877/) (2021)
- [DRIVE: One-bit Distributed Mean Estimation](https://mlsanity.com/paper/2105.08339/) (2021)
- [Connect the Dots: Tighter Discrete Approximations of Privacy Loss Distributions](https://mlsanity.com/paper/2207.04380/) (2022)
- [Privacy Loss in Apple's Implementation of Differential Privacy on MacOS 10.12](https://mlsanity.com/paper/1709.02753/) (2017)
- [Prio: Private, Robust, and Scalable Computation of Aggregate Statistics](https://mlsanity.com/paper/1703.06255/) (2017)
- [Federated Heavy Hitters Discovery with Differential Privacy](https://mlsanity.com/paper/1902.08534/) (2019)
- [FLINT: A Platform for Federated Learning Integration](https://mlsanity.com/paper/2302.12862/) (2023)
- [Lightweight Techniques for Private Heavy Hitters](https://mlsanity.com/paper/2012.14884/) (2020)
- [Computing Extremely Accurate Quantiles Using t-Digests](https://mlsanity.com/paper/1902.04023/) (2019)
- [Towards Sparse Federated Analytics: Location Heatmaps under Distributed Differential Privacy with Secure Aggregation](https://mlsanity.com/paper/2111.02356/) (2021)
- [DDSketch: A fast and fully-mergeable quantile sketch with relative-error guarantees](https://mlsanity.com/paper/1908.10693/) (2019)
- [Private Protocols for U-Statistics in the Local Model and Beyond](https://mlsanity.com/paper/1910.03861/) (2019)
- [Exact Privacy Analysis of the Gaussian Sparse Histogram Mechanism](https://mlsanity.com/paper/2202.01100/) (2022)
- [Samplable Anonymous Aggregation for Private Federated Data Analysis](https://mlsanity.com/paper/2307.15017/) (2023)
- [Federated Calibration and Evaluation of Binary Classifiers](https://mlsanity.com/paper/2210.12526/) (2022)
- [Elephants Do Not Forget: Differential Privacy with State Continuity for Privacy Budget](https://mlsanity.com/paper/2401.17628/) (2024)
- [STAR: Secret Sharing for Private Threshold Aggregation Reporting](https://mlsanity.com/paper/2109.10074/) (2021)
- [Sketch-Flip-Merge: Mergeable Sketches for Private Distinct Counting](https://mlsanity.com/paper/2302.02056/) (2023)

## Built on by (most cited first, 1 of 1)

- [Robust Federated Learning Under Real-World Client Churn](https://mlsanity.com/paper/2607.06979/) (2026)

## Abstract (arXiv)

Cross-device Federated Analytics (FA) is a distributed computation paradigm designed to answer analytics queries about and derive insights from data held locally on users' devices. On-device computations combined with other privacy and security measures ensure that only minimal data is transmitted off-device, achieving a high standard of data protection. Despite FA's broad relevance, the applicability of existing FA systems is limited by compromised accuracy; lack of flexibility for data analytics; and an inability to scale effectively. In this paper, we describe our approach to combine privacy, scalability, and practicality to build and deploy a system that overcomes these limitations. Our FA system leverages trusted execution environments (TEEs) and optimizes the use of on-device computing resources to facilitate federated data processing across large fleets of devices, while ensuring robust, defensible, and verifiable privacy safeguards. We focus on federated analytics (statistics and monitoring), in contrast to systems for federated learning (ML workloads), and we flag the key differences.