Differential Privacy

The epsilon (ε) parameter quantifies the maximum privacy loss an individual could incur from a query's output. A smaller epsilon (e.g., ε=0.1) provides stronger privacy guarantees but requires more noise, reducing data utility. An epsilon of zero means perfect privacy—the output is completely independent of any single record. This budget is composable: running multiple queries on the same dataset consumes a cumulative budget, requiring careful accounting to stay within a predefined total privacy loss threshold.

When multiple differentially private queries are executed on the same dataset, their privacy losses sum linearly. If query A is ε₁-differentially private and query B is ε₂-differentially private, publishing both results satisfies (ε₁ + ε₂)-differential privacy. This property forces system architects to track a global privacy budget across an entire analysis session, preventing adversaries from averaging out noise through repeated queries. Privacy accountants use this theorem to enforce hard limits on total information leakage.

When differentially private queries operate on disjoint subsets of a dataset, the total privacy cost equals the maximum epsilon among the queries, not their sum. For example, querying user data partitioned by geographic region allows each regional analysis to consume the full epsilon budget independently. This property is critical for scalable privacy systems, enabling federated analytics where local computations on non-overlapping data slices do not compound privacy loss.

Any arbitrary computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee. Once noise has been injected to satisfy ε-differential privacy, an adversary gains no additional advantage by transforming, filtering, or analyzing that output further. This closure property ensures that downstream data consumers—visualization tools, machine learning models, or statistical summaries—cannot inadvertently reverse the privacy protection, making differential privacy composable with arbitrary post-processing pipelines.

While standard differential privacy protects the presence or absence of a single individual, group privacy extends this guarantee to cohorts of size k. A mechanism that is ε-differentially private for one individual provides kε-differential privacy for a group of k individuals. This means protecting a family of four requires a budget four times larger. This property quantifies the inherent tension between granular privacy and group-level inference, informing risk assessments for correlated data like household records or genomic datasets.

The foundational implementation of differential privacy for numerical queries. It adds noise drawn from a Laplace distribution calibrated to the query's sensitivity (Δf) divided by epsilon: noise ∝ Lap(Δf/ε). Sensitivity measures the maximum change in query output when a single record is added or removed. A count query has sensitivity 1; a sum query's sensitivity equals the maximum possible value. The Laplace mechanism guarantees pure ε-differential privacy and remains the canonical construction taught in privacy engineering curricula.

The privacy loss parameter that quantifies the maximum information leakage allowed by a differential privacy mechanism. A lower epsilon (e.g., ε = 0.1) provides stronger privacy guarantees but introduces more noise, while a higher epsilon (e.g., ε = 10) preserves more utility at the cost of weaker privacy. The budget is consumed cumulatively across all queries against a dataset, requiring careful allocation in iterative analysis workflows. Once the budget is exhausted, no further queries can be answered without risking re-identification.

The foundational noise-injection algorithm for achieving ε-differential privacy on numerical queries. It adds random noise drawn from a Laplace distribution calibrated to the query's sensitivity and the desired epsilon value. For a query function f with global sensitivity Δf, the mechanism outputs f(D) + Lap(Δf/ε). This ensures that the presence or absence of any single record cannot shift the output distribution beyond a factor of e^ε, providing a formal mathematical guarantee against membership inference attacks.

An alternative noise-addition mechanism that uses the Gaussian (normal) distribution instead of Laplace, providing (ε, δ)-differential privacy rather than pure ε-differential privacy. The delta parameter (δ) represents a small probability of catastrophic privacy failure, typically set to be cryptographically small (e.g., 10^-5). The Gaussian mechanism is preferred in high-dimensional machine learning applications like differentially private stochastic gradient descent (DP-SGD) because the L2-norm sensitivity composes more gracefully across iterative training steps.

The maximum change in a query's output when a single record is added or removed from any possible dataset. Formally, for a query function f, global sensitivity Δf = max ||f(D1) - f(D2)|| over all neighboring datasets D1 and D2 differing by one record. This metric directly determines the scale of noise required—higher sensitivity demands more noise to achieve the same privacy guarantee. Common examples:

• Count queries: Δf = 1
• Sum queries: Δf = max possible value
• Gradient norms in DP-SGD: Clipped to a fixed threshold C

A powerful property where randomly sampling a subset of data before applying a differentially private mechanism amplifies the privacy guarantee. When a mechanism is applied to a random fraction q of the dataset, the effective epsilon is reduced because an adversary cannot determine whether a specific record was included in the sample. This is the key insight enabling DP-SGD in deep learning: each mini-batch is a random subsample, providing much stronger privacy than the per-iteration epsilon would suggest. The amplified privacy bound follows the moments accountant theorem.

A relaxation of pure differential privacy based on Rényi divergence that provides tighter composition bounds for iterative algorithms. Unlike (ε, δ)-DP, RDP uses a continuous parameter α to measure privacy loss at different divergence orders, enabling more accurate accounting across hundreds of training steps. The moments accountant technique used in TensorFlow Privacy and Opacus converts RDP guarantees back to standard (ε, δ)-DP. RDP is the de facto standard for tracking privacy budgets in modern DP-SGD implementations.