Differential Privacy

Epsilon (ε) is the primary privacy parameter that quantifies the maximum information leakage allowed. A smaller epsilon (e.g., 0.1) provides stronger privacy but adds more noise, while a larger epsilon (e.g., 10) provides weaker privacy with higher accuracy.

• ε = 0: Perfect privacy, but zero utility (output is pure noise)
• ε < 1: Strong privacy guarantee, suitable for sensitive healthcare data
• ε = 1–10: Moderate privacy, common in industry deployments
• ε > 10: Weak guarantee, approaching non-private analysis

The epsilon value represents the maximum multiplicative change in output probability when any single record is added or removed from the dataset.

Delta (δ) is a relaxation parameter that allows the privacy guarantee to fail with probability δ. In (ε, δ)-differential privacy, the strict ε guarantee holds with probability at least 1 − δ.

• δ = 0: Pure ε-differential privacy, the strongest form
• δ > 0: Approximate differential privacy, allowing slightly more utility
• δ < 1/n: Cryptographically safe, where n is the dataset size
• δ = 10⁻⁵ to 10⁻⁶: Common in practical deployments

A safe delta must be cryptographically small—significantly smaller than the inverse of the dataset size—to prevent catastrophic privacy failures.

Sensitivity measures the maximum possible change in a query's output when a single record is added or removed from the dataset. It determines how much noise must be added to achieve a given ε.

• Global Sensitivity (GS): The worst-case change over all possible neighboring datasets
• Local Sensitivity (LS): The maximum change for a specific dataset instance
• Smooth Sensitivity: A smoothed upper bound on local sensitivity that avoids leaking information

For a counting query, sensitivity is 1. For a sum query with values bounded in [0, B], sensitivity is B. Higher sensitivity requires more noise to maintain the same privacy guarantee.

Sequential composition states that when multiple differentially private mechanisms are applied to the same dataset, their privacy budgets add together. Running k mechanisms, each with privacy parameter εᵢ, yields a total privacy cost of Σ εᵢ.

• Running two ε = 0.5 queries costs ε = 1.0 total
• Running ten ε = 0.1 queries costs ε = 1.0 total
• This property forces privacy budget accounting across an entire analysis pipeline

This is why privacy engineers track cumulative epsilon expenditure and set hard limits—once the budget is exhausted, no further queries can be answered without degrading the guarantee.

Parallel composition provides a more favorable bound when queries operate on disjoint subsets of the data. If the dataset is partitioned into non-overlapping segments and each query runs on a separate partition, the total privacy cost is the maximum of the individual ε values, not their sum.

• Querying patients in different hospitals separately: cost = max(ε₁, ε₂)
• Querying disjoint age groups: cost = max(ε₁, ε₂, ..., εₖ)
• This property enables efficient distributed analytics across siloed data

Parallel composition is the mathematical foundation for federated learning with differential privacy, where each client contributes to a disjoint partition of the training data.

Post-processing immunity guarantees that any computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee. Once noise has been added to satisfy ε-differential privacy, no subsequent analysis—no matter how sophisticated—can extract the original individual-level information.

• Rounding, thresholding, or normalizing the output preserves privacy
• Training a model on differentially private outputs preserves the guarantee
• Publishing summary statistics derived from private outputs is safe

This property is critical for composability in complex pipelines: downstream consumers of private outputs need not trust or verify the privacy practices of upstream processors.

Enables pharmaceutical sponsors to share adverse event statistics and aggregate efficacy results with external researchers without exposing individual participant records. By injecting calibrated noise into query responses, the privacy loss budget (ε) can be strictly bounded.

• Facilitates open science while maintaining patient confidentiality
• Supports regulatory submissions where aggregate safety data must be shared publicly
• Prevents differencing attacks that could isolate a single participant's trajectory

Allows public health agencies to publish disease prevalence maps and mortality statistics with formal privacy guarantees. The Laplace mechanism adds noise proportional to the sensitivity of the query, ensuring that the presence or absence of any single patient's record does not materially change the published output.

• Supports CDC and WHO reporting pipelines
• Enables granular zip-code-level analytics without re-identification risk
• Maintains utility for epidemiological modeling while preserving privacy

Protects highly sensitive genomic sequences during collaborative research. Because a genome is inherently identifying, standard de-identification is insufficient. Differential privacy enables GWAS (Genome-Wide Association Studies) queries where noise is calibrated to mask the contribution of any single individual's variants.

• Supports federated genomic cohorts across institutions
• Prevents allele frequency attacks that could reveal family membership
• Enables biobank queries with auditable privacy expenditure

Integrates Differentially Private Stochastic Gradient Descent (DP-SGD) into the training loop of predictive models for healthcare. Gradients are clipped and Gaussian noise is added, ensuring that the final model parameters do not memorize individual training examples.

• Protects against membership inference attacks on trained models
• Enables multi-institutional model training without raw data pooling
• Produces models with provable privacy guarantees suitable for regulatory review

Allows health insurers to publish utilization trends and cost benchmarks derived from claims databases without exposing individual member diagnoses or procedures. The exponential mechanism can be used to privately select the most representative statistics for publication.

• Supports value-based care benchmarking across provider networks
• Enables fraud detection queries over sensitive claims data
• Maintains HIPAA compliance while enabling third-party actuarial analysis

Implements sequential composition tracking to ensure that the cumulative privacy loss across multiple queries does not exceed a predefined threshold. Each query consumes a portion of the total ε budget, and the system halts access when the budget is exhausted.

• Uses Rényi Differential Privacy for tighter composition bounds
• Provides real-time dashboards showing remaining privacy budget
• Enables adaptive query strategies that maximize utility within budget constraints

The privacy loss parameter that quantifies the strength of the differential privacy guarantee. A lower epsilon (e.g., ε = 0.1) provides stronger privacy but adds more noise, reducing utility. A higher epsilon (e.g., ε = 10) yields higher accuracy but weaker privacy. In clinical workflows, selecting epsilon involves a formal risk-utility trade-off:

• ε < 1: Considered strong privacy, suitable for public data releases
• 1 ≤ ε ≤ 10: Moderate privacy, common in internal analytics
• ε > 10: Weak privacy, approaching non-private analysis

The budget is composable—multiple queries on the same dataset consume cumulative privacy loss, tracked through privacy accounting mechanisms.

Two architectural models for applying differential privacy in data pipelines:

Central DP (CDP): A trusted curator collects raw data, applies the privacy mechanism, and releases only sanitized outputs. Offers higher accuracy for a given epsilon but requires trust in the central server—problematic for multi-institutional clinical studies.

Local DP (LDP): Each individual's data is randomized before collection. No trusted curator is needed, making it ideal for federated learning across hospitals. The trade-off is significantly higher noise for equivalent privacy guarantees.

In healthcare, hybrid models are emerging where hospitals act as trusted curators locally before contributing to federated aggregates.

The most common mechanism for achieving (ε, δ)-differential privacy on numerical queries. It works by adding calibrated Gaussian noise to the true query result, where the noise scale is proportional to the L2 sensitivity of the query divided by epsilon.

Key properties:

• Sensitivity (Δf): The maximum change in query output when one individual's data is added or removed
• Scale parameter: σ = Δf * √(2 * ln(1.25/δ)) / ε
• δ parameter: A small probability that the privacy guarantee fails entirely (typically δ < 1/n, where n is dataset size)

Used extensively in differentially private stochastic gradient descent (DP-SGD) for training clinical language models on PHI-containing datasets.

The standard algorithm for training deep learning models with differential privacy guarantees. DP-SGD modifies standard stochastic gradient descent through two operations:

1. Gradient Clipping: Each per-example gradient is clipped to a maximum L2 norm C, bounding the sensitivity of the training step
2. Noise Addition: Gaussian noise calibrated to the clipping norm and privacy budget is added to the averaged gradient before the model update

This ensures the final model parameters do not memorize individual training examples. In clinical NLP, DP-SGD enables fine-tuning language models on patient records while providing formal membership inference attack resistance. The privacy cost is tracked across training epochs using moments accountant techniques.

A relaxation of standard differential privacy based on Rényi divergence, providing tighter composition bounds than basic composition theorems. RDP is parameterized by an order α > 1, offering a spectrum of privacy definitions:

• α → ∞: Approaches pure ε-differential privacy
• α = 1: Equivalent to Kullback-Leibler divergence-based privacy

RDP's key advantage is tighter accounting under sequential composition—critical when tracking privacy loss across thousands of training iterations in DP-SGD. The moments accountant used in TensorFlow Privacy and Opacus is essentially an RDP-based accounting mechanism. For clinical model deployment, RDP enables more accurate models at equivalent privacy guarantees compared to naive composition.

Techniques for matching patient records across disparate healthcare databases without revealing identifying information. Differential privacy complements cryptographic approaches like Bloom filter encoding and secure multi-party computation:

• DP-based blocking: Adding calibrated noise to blocking keys prevents frequency-based re-identification attacks on encoded identifiers
• Noisy matching thresholds: Differential privacy can obscure the exact similarity scores between record pairs
• Synthetic overlap: Generating differentially private statistics about dataset intersections before linkage

This is critical for patient matching in health information exchanges and clinical research networks where organizations cannot share raw PHI but need to identify common patients for longitudinal studies.