Differential Privacy

Epsilon (ε) is the core privacy parameter that quantifies the maximum allowable privacy loss. A smaller ε provides stronger privacy. It bounds the log of the ratio of probabilities that a mechanism's output is observed with or without any single individual's data.

• Interpretation: ε=0.1 offers very strong privacy, while ε=10 is weaker but may yield more accurate outputs.
• Composition: The privacy budget is consumed with each query; sequential applications of mechanisms add their ε values, requiring careful management to avoid exceeding a total allowable budget.

Delta (δ) is a secondary parameter in the (ε, δ)-differential privacy definition. It represents a small probability that the strict ε privacy guarantee is violated.

• (ε, 0)-DP: Known as pure differential privacy, offering the strongest guarantee with no allowed failure.
• (ε, δ)-DP: Known as approximate differential privacy, where δ is typically a cryptographically small value (e.g., 1e-10). This relaxation often enables more practical algorithms and better utility while maintaining a robust, quantifiable safety margin.

The Laplace Mechanism is a fundamental algorithm for achieving differential privacy for numerical queries. It adds controlled noise drawn from a Laplace distribution to the true query result.

• Noise Scaling: The amount of noise is calibrated to the query's global sensitivity (Δf) and the desired ε: scale = Δf / ε.
• Global Sensitivity (Δf): The maximum possible change in the query's output when any single individual is added or removed from the dataset. This is a property of the query itself, not the data.
• Use Case: Ideal for releasing counts, sums, and averages (e.g., 'How many patients have a specific condition?').

The Gaussian Mechanism achieves (ε, δ)-differential privacy by adding noise drawn from a Gaussian (normal) distribution. It is commonly used when the Laplace mechanism's noise is too large for high-dimensional queries.

• Noise Scaling: Noise variance is scaled to the L2 sensitivity of the query and the (ε, δ) parameters.
• Advantage: The sum of Gaussian noises is also Gaussian, which simplifies privacy accounting for complex, iterative algorithms like differentially private stochastic gradient descent (DP-SGD) used in machine learning.

The Exponential Mechanism is the standard tool for achieving differential privacy for non-numeric, selection-based queries, such as choosing the best candidate from a set of options.

• How it works: It randomly selects an output (e.g., a decision rule, a bin for a histogram) with a probability exponentially weighted by a utility function. Options with higher utility are exponentially more likely to be chosen.
• Utility Function: Assigns a score to each possible output, measuring its quality for the given dataset. The mechanism's sensitivity is the maximum possible change in this score from altering one data record.
• Use Case: Privately selecting the most frequent item, the median value, or a good machine learning model hyperparameter.

Sensitivity is the cornerstone of noise calibration in differential privacy, defining how much one person's data can change a computation.

• Global Sensitivity (Δ): The worst-case change in a query's output across any pair of neighboring datasets. Used in central models like the Laplace Mechanism.
• Local Sensitivity: The change in output for the specific dataset at hand. It's usually smaller but cannot be used directly as it leaks information. Advanced techniques like propose-test-release can sometimes leverage it safely.
• Local Differential Privacy: A different model where each user perturbs their own data before sending it to the aggregator. The sensitivity is defined at the individual user's device, providing a stronger trust model for distributed data collection.

An umbrella term for techniques that enable machine learning on sensitive datasets without exposing the raw data. It encompasses several core methodologies:

• Differential Privacy: Adds mathematical noise to queries or training processes.
• Federated Learning: Trains models across decentralized devices; only model updates are shared.
• Homomorphic Encryption: Allows computation on encrypted data.
• Secure Multi-Party Computation (SMPC): Enables joint computation on private inputs. The goal is to unlock insights from siloed, regulated data (e.g., healthcare, finance) while maintaining strict confidentiality guarantees.

A decentralized machine learning paradigm where the model is trained across multiple client devices (e.g., phones, hospitals) holding local data samples. The process is:

1. A global model is distributed to clients.
2. Each client trains the model locally on its private data.
3. Only the model updates (gradients or weights), not the raw data, are sent to a central server for aggregation. This architecture minimizes data movement, addressing privacy and data residency concerns. It is often combined with differential privacy to provide formal guarantees against inference attacks on the shared updates.

A form of encryption that allows specific types of computations to be performed directly on ciphertext, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. For agentic memory, this enables:

• Querying an encrypted vector database without decrypting the stored embeddings.
• Performing secure inference on encrypted user data. While providing the strongest confidentiality, it introduces significant computational overhead. Practical systems often use partially homomorphic encryption (PHE) or somewhat homomorphic encryption (SHE) for specific operations like addition or multiplication.

A cryptographic protocol that allows multiple parties, each with their own private input, to jointly compute a function over those inputs while keeping the inputs concealed from each other. In the context of agentic systems, SMPC could enable:

• Multiple agents to compute a collective decision based on their private memories or observations.
• Privacy-preserving analytics across data owned by different departments or organizations.
• Secure aggregation of model updates in federated learning, even from an untrusted central coordinator. It guarantees that parties learn nothing beyond the output of the function, but communication complexity can be high.

A secure, isolated area within a main processor (e.g., Intel SGX, AMD SEV) that guarantees the confidentiality and integrity of code and data loaded inside it. For differential privacy and memory systems, a TEE acts as a trusted black box:

• Sensitive data can be sent into the TEE for processing.
• The differential privacy algorithm runs inside the TEE, protected from the host operating system or hypervisor.
• Only the privacy-protected output is released. This hardware-based isolation reduces the need to trust the entire software stack and can improve the performance of privacy-preserving computations compared to pure cryptographic techniques.

A variant of differential privacy where the noise addition happens at the individual user's device before data is collected by a central server. This is a stronger model than central DP, as it does not require trusting the data curator. The process is:

1. Each user perturbs their true data locally using a randomized algorithm.
2. Only the noisy, privatized data is sent to the server.
3. The server aggregates the already-noisy reports. This is foundational for privacy in federated learning and large-scale data collection (e.g., Apple's use in iOS). It provides a strong user-centric guarantee but often requires more noise for the same privacy budget, potentially reducing utility.