  Local differential privacy (LDP) is an efficient solution for providing
privacy to client's sensitive data while simultaneously releasing aggregate
statistics without relying on a trusted central server (aggregator) as in the
central model of differential privacy. The shuffle model with LDP provides an
additional layer of privacy, by disconnecting the link between clients and the
aggregator, further improving the utility of LDP. However, LDP has been shown
to be vulnerable to malicious clients who can perform both input and output
manipulation attacks, i.e., before and after applying the LDP mechanism, to
skew the aggregator's results. In this work, we show how to prevent malicious
clients from compromising LDP schemes. Specifically, we give efficient
constructions to prevent both input \'and output manipulation attacks from
malicious clients for generic LDP algorithms. Our proposed schemes for
verifiable LDP (VLDP), completely protect from output manipulation attacks, and
prevent input attacks using signed data, requiring only one-time interaction
between client and server, unlike existing alternatives [28, 33]. Most
importantly, we are the first to provide an efficient scheme for VLDP in the
shuffle model. We describe and prove secure, two schemes for VLDP in the
regular model, and one in the shuffle model. We show that all schemes are
highly practical, with client runtimes of < 2 seconds, and server runtimes of
5-7 milliseconds per client.
