Differential Privacy

The parameter epsilon (ε) is the central metric of privacy loss. It quantifies the maximum amount of information that can be leaked about any single individual's data. A lower ε value provides a stronger mathematical guarantee of privacy.

• ε = 0: Perfect privacy, but zero utility (output is pure noise).
• ε = 0.1-1.0: A commonly targeted range for strong privacy in sensitive applications like genomic studies.
• ε > 10: Weak privacy guarantees, where individual contributions become statistically distinguishable. The budget is consumed with each query, and once it is exhausted, no further analysis on that dataset is permitted to maintain the overall guarantee.

This theorem defines how the privacy budget (ε) degrades when multiple differentially private computations are performed on the same dataset. The total privacy loss is the sum of the individual ε values.

• Mechanism: If you run one query with budget ε₁ and a second with budget ε₂, the total guarantee is exactly ε₁ + ε₂.
• Practical Impact: A data scientist must carefully allocate a global budget across all planned analyses. Running 10 queries, each with ε = 0.1, results in a total privacy loss of ε = 1.0.
• Accounting: This linear property allows for precise privacy accounting, a critical feature for building complex, multi-step genomic analysis pipelines.

This property provides a powerful optimization when differentially private queries operate on disjoint subsets of data. The total privacy cost is not the sum, but the maximum of the individual ε values.

• Mechanism: If a dataset is partitioned by patient cohort, and a query with budget ε is run independently on each partition, the total privacy loss for any single individual is only ε, not n*ε.
• Genomic Application: This is crucial for federated learning. A model can be trained on data partitioned across multiple hospitals, and the privacy guarantee for a patient at Hospital A is not degraded by computations performed exclusively on data at Hospital B.

A defining and powerful property: any computation performed on the output of a differentially private algorithm, without revisiting the original private data, cannot weaken the privacy guarantee.

• Formal Definition: If a mechanism M satisfies ε-differential privacy, then for any function f, the composition f(M(x)) also satisfies ε-differential privacy.
• Practical Impact: An analyst can safely perform arbitrary transformations, visualizations, or statistical tests on a noisy, privacy-preserving result. The privacy guarantee is not degraded by subsequent analysis, preventing accidental leakage through post-hoc data manipulation.
• Security: This property ensures that even a malicious actor with access to the private output cannot reverse-engineer or amplify the privacy loss.

The standard definition protects the presence or absence of a single record. Group privacy quantifies the guarantee when an adversary attempts to distinguish datasets differing by a group of k records.

• Mechanism: An ε-differentially private mechanism provides k*ε-differential privacy for groups of size k.
• Implication: Protecting a family trio in a genomic database (k=3) with a guarantee of ε = 0.1 requires the mechanism to operate with a much stricter per-individual budget of ε = 0.033.
• Trade-off: This demonstrates the inherent tension between protecting correlated records (like related genomes) and maintaining data utility. The privacy guarantee degrades linearly with group size.

The formal definition is built on the privacy loss random variable, which measures the log-ratio of the probability of an output under two neighboring datasets (differing by one record).

• Definition: For an output o, the loss is L = ln( Pr[M(D)=o] / Pr[M(D')=o] ).
• Pure ε-DP: The absolute value of this loss is bounded by ε for all possible outputs, providing a worst-case guarantee.
• Relaxed (ε, δ)-DP: A relaxation that allows the bound to fail with a small probability δ, enabling more efficient mechanisms like the Gaussian mechanism. This is the standard for most deep learning applications, including federated training of genomic models.

The privacy loss parameter that quantifies the strength of the guarantee. A smaller epsilon (e.g., 0.1) provides stronger privacy but requires more noise, reducing utility. An epsilon of zero means perfect secrecy. In genomic federated learning, the privacy accountant tracks cumulative epsilon loss across multiple queries to a model, ensuring the total leakage never exceeds a predefined threshold before the model must be retired or retrained.

A primary threat that differential privacy is designed to defeat. An adversary analyzes a model's outputs to determine if a specific individual's genomic record was part of the training set. For example, an attacker might query a federated polygenic risk score model to infer whether a known celebrity's DNA was in a cancer study. A tight epsilon guarantee mathematically bounds the adversary's true positive rate, making such inference provably unreliable.

A complementary cryptographic protocol often paired with differential privacy. While differential privacy masks the content of a model update, secure aggregation masks the source. It allows a central server to compute the sum of encrypted model updates from multiple hospitals without ever inspecting any single hospital's contribution in plaintext. The combination of both techniques provides a dual-layer defense against inference and reconstruction attacks on genomic data.

The sensitivity of a query defines the maximum impact any single record can have on the output. In deep learning, this is controlled by gradient clipping: bounding the L2 norm of per-sample gradients before aggregation. For genomic models, this prevents a rare pathogenic variant from disproportionately skewing a federated update. The clipped norm directly scales the amount of noise required to satisfy a given epsilon, creating a direct trade-off between learning rare signals and preserving privacy.

The foundational optimization algorithm that differential privacy modifies. Standard FedAvg combines local model weights by simple averaging. Differentially Private Federated Averaging adds two steps: the server clips local updates and injects calibrated Gaussian noise into the aggregated sum. This ensures the final global genomic model—whether predicting gene expression or calling variants—carries a formal, quantifiable privacy guarantee for every contributing data donor.