Differential Privacy Budget (Epsilon)

Epsilon (ε) defines the privacy loss budget—the maximum allowable information leakage. A mechanism M satisfies ε-differential privacy if for all neighboring datasets D and D' differing by one record, and all outputs S:

Pr[M(D) ∈ S] ≤ e^ε × Pr[M(D') ∈ S]

• ε = 0: Perfect privacy, identical output distributions—but zero utility
• ε = 0.1–1: Strong privacy, typical for census and high-sensitivity data
• ε = 1–10: Moderate privacy, common in enterprise analytics
• ε > 10: Weak privacy guarantees, approaching raw data release

The exponential function e^ε bounds the multiplicative difference in output probabilities.

Multiple queries on the same dataset consume privacy cumulatively. Composition theorems quantify this total loss:

• Basic Sequential Composition: Running k mechanisms with budgets ε₁, ε₂, ..., εₖ results in total privacy loss Σεᵢ
• Advanced Composition: Provides tighter bounds for adaptive queries, accounting for probabilistic failure probability δ
• Parallel Composition: When queries operate on disjoint data partitions, the total budget equals the maximum single-query budget, not the sum

This is critical for privacy accounting in iterative model training, where each gradient step consumes a fraction of the total budget.

Epsilon directly governs the noise scale injected into query responses. Lower epsilon means more noise and stronger privacy, but degraded utility:

• Laplace Mechanism: Adds noise scaled by Δf/ε, where Δf is the query's L1 sensitivity
• Gaussian Mechanism: Adds noise scaled by Δ₂f·√(2·ln(1.25/δ))/ε for (ε, δ)-differential privacy

In fraud detection, this trade-off is acute: a model trained with ε=0.5 may fail to detect subtle fraud patterns, while ε=8 may expose individual transaction characteristics. Privacy accountants must calibrate epsilon to satisfy both regulatory requirements and detection efficacy thresholds.

In collaborative financial crime analytics, epsilon governs how much information each bank reveals about its customer transactions:

• Local Differential Privacy: Each institution perturbs its model updates with noise calibrated to a per-round epsilon before sending to the aggregation server
• Distributed Noise Generation: Secure aggregation protocols combine encrypted updates, with noise applied collectively to achieve a target global epsilon
• Per-Example Budgeting: Each training record receives an individual privacy guarantee, ensuring that even repeated participation in training rounds does not exhaust the budget for any single customer

A typical deployment might allocate ε=4 total budget across 100 training rounds, with advanced composition tracking the cumulative spend.

Selecting an appropriate epsilon requires balancing regulatory mandates, threat models, and utility requirements:

• GDPR and CCPA compliance does not prescribe specific epsilon values, but regulators expect documented privacy risk assessments justifying the chosen budget
• US Census Bureau uses ε=19.61 for the 2020 decennial census redistricting data, demonstrating that even large organizations debate appropriate values
• Apple's differential privacy implementation uses per-day epsilon of 4–8 for emoji suggestions and lookup hints
• Financial services typically target ε=1–8 for internal analytics, with lower values (ε<1) reserved for external data sharing consortia

The privacy-utility curve should be empirically measured: plot model accuracy against epsilon to identify the knee point where additional privacy budget yields diminishing returns.

Pure ε-differential privacy can be overly restrictive. The (ε, δ) relaxation introduces a small failure probability δ, enabling more practical mechanisms:

• δ parameter: Bounds the probability that the privacy guarantee is violated by more than the ε factor. Typically set to be cryptographically small (e.g., δ < 1/n where n is dataset size)
• Gaussian Mechanism: Requires (ε, δ)-DP, as pure ε-DP with Gaussian noise is impossible
• Rényi Differential Privacy (RDP): Uses Rényi divergence for tighter composition analysis, converting to (ε, δ)-DP bounds post-training
• Zero-Concentrated DP (zCDP): Provides even tighter composition, widely used in deep learning with DP-SGD

Most production fraud detection systems using DP-SGD operate under (ε, δ)-DP with δ=10⁻⁵ to 10⁻⁶.

The foundational mechanism for achieving pure ε-differential privacy on numerical queries. It works by adding random noise drawn from a Laplace distribution to the true query output. The scale of the noise is calibrated by dividing the query's L1 sensitivity by the privacy budget epsilon. A smaller epsilon results in a wider Laplace distribution and therefore more noise, providing stronger privacy but lower accuracy. This mechanism is optimal for simple counting and summation queries.

A mechanism that achieves approximate (ε, δ)-differential privacy by adding noise from a Gaussian (normal) distribution. Unlike the Laplace mechanism, it uses the query's L2 sensitivity to calibrate the noise scale. The introduction of the delta parameter (δ) allows for a small probability of catastrophic privacy failure, but in exchange, the Gaussian mechanism often provides better utility for high-dimensional queries and is the workhorse of modern deep learning with differential privacy, such as DP-SGD.

A general mechanism for selecting a discrete output from a set of candidates while preserving ε-differential privacy. Instead of adding noise to a value, it assigns a utility score to each candidate and samples an output with a probability exponentially proportional to the product of epsilon and its utility score. This is essential for tasks where the output is not a real number, such as choosing the best split point in a privacy-preserving decision tree or selecting a representative synthetic data point.

The mathematical rules that govern how the privacy budget (ε) degrades when multiple differentially private queries are performed on the same dataset. Basic composition states that the total epsilon is simply the sum of the individual epsilons. Advanced composition provides a tighter, sub-linear bound on the total privacy loss, introducing a delta parameter. Rényi Differential Privacy (RDP) and zero-concentrated DP (zCDP) offer even tighter composition analysis, enabling more efficient use of the total privacy budget in iterative algorithms.

The process of determining the maximum possible change in a query's output when a single record is added to or removed from the dataset. Global L1 sensitivity is the maximum absolute difference in the L1 norm, used by the Laplace mechanism. Global L2 sensitivity is the maximum Euclidean distance, used by the Gaussian mechanism. Accurate sensitivity analysis is critical: overestimating sensitivity forces the injection of unnecessary noise, wasting the privacy budget and degrading utility.

The rigorous, algorithmic process of tracking the total consumed privacy budget (ε, δ) during the iterative training of a machine learning model. A privacy accountant uses composition theorems and moment accounting techniques to compute the precise privacy guarantee at each step. The Moments Accountant, a key innovation in DP-SGD, tracks the log moments of the privacy loss random variable to provide a much tighter estimate of the total epsilon than naive composition, allowing for more training iterations under a fixed budget.