  In the conventional robust $T$-colluding private information retrieval (PIR)
system, the user needs to retrieve one of the possible messages while keeping
the identity of the requested message private from any $T$ colluding servers.
Motivated by the possible heterogeneous privacy requirements for different
messages, we consider the $(N, T_1:K_1, T_2:K_2)$ two-level PIR system with a
total of $K_2$ messages in the system, where $T_1\geq T_2$ and $K_1\leq K_2$.
Any one of the $K_1$ messages needs to be retrieved privately against $T_1$
colluding servers, and any one of the full set of $K_2$ messages needs to be
retrieved privately against $T_2$ colluding servers. We obtain a lower bound to
the capacity by proposing two novel coding schemes, namely the non-uniform
successive cancellation scheme and the non-uniform block cancellation scheme. A
capacity upper bound is also derived. The gap between the upper bound and the
lower bounds is analyzed, and shown to vanish when $T_1=T_2$. Lastly, we show
that the upper bound is in general not tight by providing a stronger bound for
a special setting.
