Differential Privacy (DP)

The epsilon (ε) parameter quantifies the privacy loss. A smaller epsilon means stronger privacy but more noise.

• ε = 0: Perfect privacy, zero utility.
• ε ≈ 0.1–1: Strong privacy, typical for census data.
• ε ≈ 2–10: Weaker privacy, higher accuracy.

Epsilon represents the maximum divergence between outputs on neighboring datasets. It is not a binary switch but a continuous dial controlling the privacy-utility trade-off.

When multiple differentially private computations are performed on the same dataset, the total privacy loss is the sum of their individual epsilons.

• Query 1 with ε=0.5 plus Query 2 with ε=0.3 results in a total privacy cost of ε=0.8.
• This property forces engineers to track a global privacy budget across an entire system.
• It prevents the illusion of privacy created by simply re-running a private query many times.

When differentially private queries operate on disjoint subsets of the data, the total privacy cost is the maximum of the individual epsilons, not the sum.

• If user A's data is in Partition 1 and user B's data is in Partition 2, querying both partitions costs max(ε1, ε2).
• This property is critical for scalable systems; it allows running many private queries in parallel without draining the budget.
• It relies on strict data partitioning with no overlap.

Any computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee.

• An adversary cannot reverse the noise by applying a function.
• Sorting, rounding, or feeding the output into a machine learning model does not degrade the original epsilon guarantee.
• This is a closure property: DP outputs remain DP under arbitrary post-processing without consuming additional budget.

Differential privacy naturally extends to protect groups of correlated records. If a mechanism is ε-differentially private for a single record, it is k·ε-differentially private for a group of size k.

• Protecting a family of 4 in a medical dataset costs 4ε.
• This property quantifies the increased risk from correlated data.
• It highlights the importance of setting epsilon low enough to protect the largest plausible group, not just individuals.

The entire guarantee hinges on the definition of neighboring datasets—two datasets that differ by exactly one record.

• Add/Remove: One dataset has an extra record.
• Substitution: One record's value is changed.
• The choice impacts the sensitivity of queries and the noise required. Substitution is common in the DP-SGD training algorithm, while add/remove is standard for statistical queries.

The 2020 U.S. Census implemented differential privacy as its primary disclosure avoidance system, replacing traditional swapping and suppression techniques. The system injects Gaussian noise into census block statistics to prevent reconstruction-abetted re-identification attacks.

• Protects 331 million individual records across demographic tables
• Uses a privacy-loss budget (epsilon) carefully calibrated to balance accuracy for redistricting against individual privacy
• Defeated a 2018 internal reconstruction attack that reverse-engineered 46% of the 2010 Census population using commercial databases
• Represents the largest-scale deployment of formal privacy guarantees in government history

Apple deploys local differential privacy across iOS and macOS to collect usage patterns, emoji preferences, and typing suggestions without accessing raw user data. Noise is added on-device before transmission, ensuring Apple never sees the true value.

• Private Count Mean Sketch algorithm estimates frequency of popular emojis and web domains
• Hadamard Count Mean Sketch identifies frequently used words for QuickType keyboard suggestions
• Each user's contribution is randomized with a fixed epsilon budget per day
• Deployed across over 1 billion active devices globally

During the pandemic, Google published Community Mobility Reports using differential privacy to show movement trends across retail, transit, and workplace categories without revealing individual location histories.

• Applied Laplace noise to aggregated location category visit counts
• Privacy budget carefully managed to prevent longitudinal tracking across daily report releases
• Enabled public health officials to assess lockdown compliance without surveillance infrastructure
• Reports covered 131 countries and served as a model for privacy-preserving public health analytics

LinkedIn applies differential privacy to protect advertiser analytics dashboards, preventing competitors from inferring specific company demographics through repeated querying of audience breakdowns.

• Thresholding suppresses results for audiences below a minimum size
• Noise addition obscures exact counts in demographic slices (industry, seniority, location)
• Prevents membership inference attacks where an adversary deduces whether a specific individual belongs to a targeted advertising segment
• Balances marketer utility with member privacy across millions of daily analytic queries

Medical institutions use Differentially Private Stochastic Gradient Descent (DP-SGD) combined with federated learning to train diagnostic models across hospital networks without pooling sensitive patient records.

• Per-sample gradient clipping bounds the influence of any single patient's data
• Gaussian noise added to aggregated gradients before each model update
• Enables multi-site clinical trials for rare diseases where centralized data pooling violates HIPAA or GDPR
• NVIDIA FLARE and OpenMined provide production frameworks for DP-secured federated healthcare AI