  Nowadays, high-volume and privacy-sensitive data are generated by mobile
devices, which are better to be preserved on devices and queried on demand.
However, data analysts still lack a uniform way to harness such distributed
on-device data. In this paper, we propose a data querying system, Deck, that
enables flexible device-centric federated analytics. The key idea of Deck is to
bypass the app developers but allow the data analysts to directly submit their
analytics code to run on devices, through a centralized query coordinator
service. Deck provides a list of standard APIs to data analysts and handles
most of the device-specific tasks underneath. Deck further incorporates two key
techniques: (i) a hybrid permission checking mechanism and mandatory
cross-device aggregation to ensure data privacy; (ii) a zero-knowledge
statistical model that judiciously trades off query delay and query resource
expenditure on devices. We fully implement Deck and plug it into 20 popular
Android apps. An in-the-wild deployment on 1,642 volunteers shows that Deck
significantly reduces the query delay by up to 30x compared to baselines. Our
microbenchmarks also demonstrate that the standalone overhead of Deck is
negligible.
