  Behavioral data generated by users' devices, ranging from emoji use to pages
visited, are collected at scale to improve apps and services. These data,
however, contain fine-grained records and can reveal sensitive information
about individual users. Local differential privacy has been used by companies
as a solution to collect data from users while preserving privacy. We here
first introduce pool inference attacks, where an adversary has access to a
user's obfuscated data, defines pools of objects, and exploits the user's
polarized behavior in multiple data collections to infer the user's preferred
pool. Second, we instantiate this attack against Count Mean Sketch, a local
differential privacy mechanism proposed by Apple and deployed in iOS and Mac OS
devices, using a Bayesian model. Using Apple's parameters for the privacy loss
$\varepsilon$, we then consider two specific attacks: one in the emojis setting
-- where an adversary aims at inferring a user's preferred skin tone for emojis
-- and one against visited websites -- where an adversary wants to learn the
political orientation of a user from the news websites they visit. In both
cases, we show the attack to be much more effective than a random guess when
the adversary collects enough data. We find that users with high polarization
and relevant interest are significantly more vulnerable, and we show that our
attack is well-calibrated, allowing the adversary to target such vulnerable
users. We finally validate our results for the emojis setting using user data
from Twitter. Taken together, our results show that pool inference attacks are
a concern for data protected by local differential privacy mechanisms with a
large $\varepsilon$, emphasizing the need for additional technical safeguards
and the need for more research on how to apply local differential privacy for
multiple collections.
