Differential Privacy Filter

The parameter ε (epsilon) quantifies the privacy loss. A smaller epsilon provides stronger privacy but introduces more noise.

• ε = 0: Perfect privacy, but zero utility (pure noise).
• ε = 0.1 to 1: Strong privacy, suitable for highly sensitive data.
• ε = 10+: Weak privacy, minimal noise added. The budget is consumed with each query; once exhausted, the data can no longer be accessed with the same guarantee.

The parameter δ (delta) bounds the probability that the pure ε-privacy guarantee is violated. It allows for a small chance of catastrophic privacy loss.

• Typically set to be cryptographically small, e.g., less than 1/n² where n is the dataset size.
• (ε, 0)-differential privacy is the strictest form, where δ=0.
• (ε, δ)-differential privacy is a relaxed, more practical definition used in deep learning.

The filter ensures that any single output is statistically indistinguishable whether any specific individual's record was included or excluded from the training data.

• An adversary observing the output cannot confidently infer membership.
• This is a property of the mechanism, not a post-hoc obfuscation.
• It provides a mathematical defense against membership inference attacks and model inversion.

Privacy loss accumulates predictably across multiple queries or mechanisms.

• Sequential Composition: Querying the same data with ε₁ and then ε₂ results in a total privacy loss of ε₁ + ε₂.
• Parallel Composition: Querying disjoint subsets of data consumes only the maximum ε, not the sum. This property allows engineers to track and manage the total privacy expenditure of a complex agentic system.

Any computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee.

• An adversary cannot 'un-noise' the data through arbitrary post-processing.
• This holds true without needing to trust the downstream processor.
• It allows the filtered output to be safely used in logs, analytics, or further agent reasoning without additional privacy risk.

The amount of noise added is proportional to the sensitivity of the query function—the maximum impact a single record can have on the output.

• Global Sensitivity: The worst-case change across all possible datasets.
• Local Sensitivity: The change specific to a given dataset (requires careful smoothing).
• A filter for an agent's SUM query requires less noise than a MAX query, as the latter has higher sensitivity.

An adversarial technique that reconstructs training data from model outputs by exploiting overfitting and memorization. Attackers query the model repeatedly to extract sensitive features.

• Membership Inference: Determine if a specific record was in the training set
• Attribute Inference: Recover hidden attributes of training data subjects
• Model Extraction: Steal model functionality through query access

A properly calibrated differential privacy filter defeats these attacks by injecting calibrated noise that breaks the statistical link between outputs and individual training examples.

The privacy loss parameter that quantifies the strength of a differential privacy guarantee. Lower epsilon values mean stronger privacy protection.

• ε = 0.1: Very strong privacy, high noise
• ε = 1.0: Moderate privacy, balanced utility
• ε = 10: Weak privacy, minimal noise

Each query against a differentially private system consumes a portion of the privacy budget. Once exhausted, further queries must be denied to maintain the mathematical guarantee. This budget is tracked via a privacy accountant.

The automated process of detecting and masking personally identifiable information from agent outputs before exposure. Unlike differential privacy, redaction is a deterministic approach.

• Named Entity Recognition: Detect names, emails, phone numbers
• Pattern Matching: Identify SSNs, credit card numbers, addresses
• Contextual Redaction: Remove indirect identifiers that could re-identify individuals

Redaction complements differential privacy by handling explicit identifiers, while differential privacy protects against inferential disclosure from aggregate patterns.

The broader security practice of removing or neutralizing dangerous content from agent-generated outputs before delivery. Differential privacy filtering is one specialized sanitization layer.

• Code Execution Prevention: Strip executable scripts from outputs
• Injection Neutralization: Remove prompt injection payloads from responses
• Privacy Noise Injection: Apply differential privacy to statistical outputs

In an agentic validation pipeline, sanitization operates as a multi-stage filter chain: content filtering → PII redaction → differential privacy noise → structured output validation.

Statistical methods that measure a model's confidence in its predictions, enabling systems to abstain from acting on low-certainty outputs. Pairs naturally with differential privacy.

• Conformal Prediction: Produce prediction sets with guaranteed coverage
• Monte Carlo Dropout: Estimate uncertainty through stochastic forward passes
• Ensemble Disagreement: Measure variance across multiple model outputs

When differential privacy noise is injected, uncertainty quantification helps calibrate the utility-privacy tradeoff by identifying outputs where noise has degraded reliability below acceptable thresholds.