Differential Privacy

The parameter epsilon (ε) quantifies the privacy loss. A smaller ε provides stronger privacy but adds more noise, reducing utility.

• ε < 1: Strong privacy regime.
• ε > 10: Weak privacy, minimal noise.
• The budget is consumed with every query to the data.
• A privacy accountant tracks cumulative spending to prevent total leakage.

Sensitivity measures the maximum impact a single individual's record can have on the output of a query. It determines the scale of noise required.

• Global Sensitivity: The worst-case change over all possible neighboring datasets.
• Local Sensitivity: The change specific to a given dataset instance.
• A query calculating a sum has higher sensitivity than a count, requiring more noise for the same ε.

The foundational mechanism for achieving ε-differential privacy for numerical queries. It adds random noise drawn from a Laplace distribution.

• Noise scale is calibrated as sensitivity / ε.
• Ideal for queries with low sensitivity, like counting.
• The exponential mechanism is used for non-numerical outputs, selecting an output with probability proportional to its utility score.

Adds noise drawn from a Gaussian (normal) distribution to satisfy the relaxed definition of (ε, δ)-differential privacy.

• The δ parameter allows for a small probability of catastrophic privacy failure.
• Tolerates a higher sensitivity for a given ε compared to the Laplace mechanism.
• The standard mechanism used in DP-SGD for training deep learning models.

A critical property stating that any arbitrary computation applied to the output of a differentially private mechanism does not weaken the privacy guarantee.

• An adversary cannot increase privacy loss by post-processing the results.
• This holds true without any additional assumptions about the adversary's auxiliary information.
• It ensures that safe, privatized statistics can be visualized, analyzed, or fed into other algorithms without risk.

The property that governs how privacy loss accumulates across multiple queries or releases on the same dataset.

• Sequential Composition: The total ε is the sum of the ε values of each query.
• Parallel Composition: If queries operate on disjoint subsets of data, the total ε is the maximum of the individual ε values.
• This allows for the design of complex, multi-stage private algorithms with a bounded total privacy cost.

Differential privacy enables collaborative fraud detection across competing financial institutions without exposing customer transaction records. By injecting calibrated noise into shared aggregate statistics, banks can identify cross-institutional fraud rings and money laundering patterns while providing a provable privacy guarantee (ε-differential privacy) to regulators. This directly addresses the tension between anti-money laundering (AML) cooperation and data protection regulations like GDPR.

Fraud detection models trained on sensitive transaction data are vulnerable to membership inference attacks, where adversaries determine if a specific individual's data was in the training set. Training with DP-SGD (Differentially Private Stochastic Gradient Descent) bounds the influence of any single training example by:

• Per-sample gradient clipping to limit sensitivity
• Gaussian noise addition to obfuscate individual contributions This provides a formal defense against model inversion and data extraction attacks targeting the fraud model itself.

Differential privacy provides the theoretical foundation for generating synthetic transaction datasets that preserve the statistical properties of real fraud patterns without exposing actual customer data. These privacy-preserving synthetic datasets are critical for:

• Training and benchmarking fraud models without regulatory risk
• Sharing data with third-party analytics vendors
• Stress-testing detection systems against novel fraud typologies The privacy budget (ε) directly quantifies the trade-off between synthetic data fidelity and privacy protection.

In federated learning deployments across bank branches or partner institutions, differential privacy is applied to model updates before they leave each node. This prevents gradient leakage attacks that could reconstruct local transaction data from shared parameter updates. The combination of federated averaging with local differential privacy enables:

• Collaborative model improvement without centralizing data
• Compliance with data residency and sovereignty requirements
• Robustness against honest-but-curious participants in the federation

Financial regulators require demonstrable proof that privacy protections are not being eroded over time. Differential privacy's composition theorems provide a rigorous accounting framework:

• Sequential composition: The total privacy loss is the sum of ε values across queries
• Parallel composition: Queries on disjoint data subsets do not accumulate privacy loss
• Privacy odometers track cumulative ε expenditure across an analytics lifecycle This mathematical accountability is essential for model risk management (MRM) and regulatory audits under frameworks like the EU AI Act.

Sophisticated model inversion attacks attempt to reconstruct representative transaction profiles from a fraud model's confidence scores. Differential privacy provides a certified defense by ensuring that the model's output distribution is nearly identical whether or not any specific individual's data was included in training. This plausible deniability guarantee means that even an adversary with unlimited computational power and access to the model cannot confidently infer any individual's financial activity, protecting against both external attackers and insider threats.

The privacy loss parameter that quantifies the strength of the privacy guarantee. A smaller epsilon (e.g., ε=0.1) provides stronger privacy by ensuring outputs from neighboring datasets are nearly indistinguishable. An epsilon of zero provides perfect privacy but zero utility. In practice, values between 0.1 and 10 are common, with the choice representing a formal trade-off between privacy and accuracy. The budget is consumed cumulatively across multiple queries, a property known as composability.

Sensitivity measures the maximum influence a single individual's data can have on a query's output. For a counting query, the sensitivity is 1. The Laplace Mechanism achieves pure ε-differential privacy by adding noise drawn from a Laplace distribution scaled by (sensitivity/ε). Higher sensitivity requires more noise for the same privacy guarantee. This is the foundational mechanism for numeric queries and is provably optimal for L1 sensitivity.

An alternative to the Laplace mechanism that adds noise from a Gaussian (normal) distribution. It provides a relaxed guarantee called (ε, δ)-approximate differential privacy, where δ represents a small probability of catastrophic privacy failure. The Gaussian mechanism is preferred for high-dimensional data and is the foundation of the DP-SGD algorithm used to train deep neural networks with differential privacy guarantees.

The standard algorithm for training deep learning models with differential privacy. It modifies standard SGD by: 1) Clipping per-sample gradients to bound sensitivity, 2) Aggregating clipped gradients into a batch, and 3) Adding calibrated Gaussian noise before the parameter update. A privacy accountant tracks cumulative privacy loss across training epochs using moments accountant or Rényi DP composition theorems.

Central DP: A trusted curator collects raw data and applies privacy mechanisms to query outputs. Provides high utility but requires trust. Local DP: Noise is added by each individual before data leaves their device. No trusted curator is needed, but utility degrades significantly due to the higher noise required. Google's RAPPOR and Apple's iOS data collection use local DP. The choice represents a fundamental architectural trade-off between trust and accuracy.

A relaxation of pure differential privacy based on Rényi divergence that provides tighter composition bounds than the standard strong composition theorem. RDP is parameterized by an order α > 1 and is the preferred accounting method in modern DP-SGD implementations, including TensorFlow Privacy and Opacus. It enables training with significantly less noise for the same privacy guarantee compared to moments accountant.