Shuffle privacy: users submit locally privatized data to a shuffler that randomly permutes the submissions before an analyst sees them. The shuffling amplifies the privacy — the analyst can't link a response to a user. The amplification depends on how the users' messages aggregate through the shuffling.
For binary alphabets, the shuffled output is approximately Gaussian by the central limit theorem. For finite alphabets with more than two symbols, the asymptotics are different. The paper identifies a transition: when a single alphabet symbol dominates the distribution, the shuffled output follows a hybrid Gaussian–compound Poisson distribution, not a pure Gaussian.
The geometry behind the transition is quotient geometry on the space of symbol frequencies. The dominant symbol creates a manifold structure — a fiber bundle where the base is the dominant symbol's frequency and the fiber describes the distribution of remaining symbols. The quotient geometry determines which limit theorem applies. In the dominant-block regime, the base direction is Gaussian (central limit theorem) while the fiber direction is compound Poisson (rare-event statistics). The hybrid limit captures both scales simultaneously.
The structural content: the limit distribution of a privacy mechanism is not determined by the mechanism alone but by the geometry of the message space. Different regions of the parameter space (different frequency profiles) produce different limit theorems. The central limit theorem is a local result — it describes behavior near the center of the distribution. The compound Poisson correction captures behavior in the tails, where the rare symbols live. Privacy amplification operates differently in the two regimes, and the geometry tells you which regime you're in.