Quantiles are key in distributed analytics, but computing them over sensitive data risks privacy. Local differential privacy (LDP) offers strong protection but lower accuracy than central DP, which assumes a trusted aggregator. Secure multi-party computation (MPC) can bridge this gap, but generic MPC solutions face scalability challenges due to large domains, complex secure operations, and multi-round interactions. We present Piquantε, a system for privacy-preserving estimation of multiple quantiles in a distributed setting without relying on a trusted server. Piquantε operates under the malicious threat model and achieves accuracy of the central DP model. Built on the two-server model, Piquantε uses a novel strategy of releasing carefully chosen intermediate statistics, reducing MPC complexity while preserving end-to-end DP. Empirically, Piquantε estimates 5 quantiles on 1 million records in under a minute with domain size 109, achieving up to 104-fold higher accuracy than LDP, and up to ∼10× faster runtime compared to baselines.
@article{arxiv.2509.14035,
title = {Piquant$\varepsilon$: Private Quantile Estimation in the Two-Server Model},
author = {Hannah Keller and Jacob Imola and Fabrizio Boninsegna and Rasmus Pagh and Amrita Roy Chowdhury},
journal= {arXiv preprint arXiv:2509.14035},
year = {2025}
}