  Privacy-preserving vector mean estimation is a crucial primitive in federated
analytics. Existing practices usually resort to Local Differentiated Privacy
(LDP) mechanisms that inject random noise into users' vectors when
communicating with users and the central server. Due to the privacy-utility
trade-off, the privacy budget has been widely recognized as the bottleneck
resource that requires well-provisioning. In this paper, we explore the
possibility of privacy budget recycling and propose a novel Chained-DP
framework enabling users to carry out data aggregation sequentially to recycle
the privacy budget. We establish a sequential game to model the user
interactions in our framework. We theoretically show the mathematical nature of
the sequential game, solve its Nash Equilibrium, and design an incentive
mechanism with provable economic properties. We further derive a differentially
privacy-guaranteed protocol to alleviate potential privacy collusion attacks to
avoid holistic exposure. Our numerical simulation validates the effectiveness
of Chained-DP, showing that it can significantly save privacy budget and lower
estimation error compared to the traditional LDP mechanism.
