  We introduce a formal model for the information leakage of probability
distributions and define a notion called distribution privacy as the local
differential privacy for probability distributions. Roughly, the distribution
privacy of a local obfuscation mechanism means that the attacker cannot
significantly gain any information on the distribution of the mechanism's input
by observing its output. Then we show that existing local mechanisms can hide
input distributions in terms of distribution privacy, while deteriorating the
utility by adding too much noise. For example, we prove that the Laplace
mechanism needs to add a large amount of noise proportionally to the infinite
Wasserstein distance between the two distributions we want to make
indistinguishable. To improve the tradeoff between distribution privacy and
utility, we introduce a local obfuscation mechanism, called a tupling
mechanism, that adds random dummy data to the output. Then we apply this
mechanism to the protection of user attributes in location based services. By
experiments, we demonstrate that the tupling mechanism outperforms popular
local mechanisms in terms of attribute obfuscation and service quality.
