Differential Privacy

The privacy loss parameter epsilon (ε) quantifies the maximum information leakage allowed. A smaller ε (e.g., 0.1) provides stronger privacy by injecting more noise, while a larger ε (e.g., 10) retains higher utility but offers weaker guarantees.

• ε = 0: Perfect privacy, zero utility (pure noise)
• ε < 1: Strong privacy regime, suitable for sensitive patient data
• ε > 1: Weaker guarantees, higher statistical accuracy
• Composition: Privacy loss accumulates additively across multiple queries

The foundational concept that differential privacy protects: two datasets are considered neighboring if they differ by exactly one individual's record. The guarantee ensures that any analysis output is statistically indistinguishable whether or not a specific patient's data was included.

• Add/Remove: One dataset contains the patient, the other does not
• Substitution: One patient's record is swapped for another's
• The choice of neighboring definition directly impacts the strength of the privacy guarantee

Global sensitivity measures the maximum possible change in a query's output when a single individual's data is added or removed. This value determines the minimum amount of noise required to achieve a given ε.

• Counting queries: Sensitivity = 1 (one person changes count by at most 1)
• Sum queries: Sensitivity = max possible individual contribution
• Gradient queries: Clipping bounds are applied to limit sensitivity in federated learning
• Higher sensitivity demands more noise, reducing utility

Privacy loss accumulates predictably when multiple analyses are performed on the same dataset. Composition theorems provide the mathematical rules for tracking total privacy expenditure over a sequence of queries or training rounds.

• Basic Composition: k queries each with ε_i results in total privacy loss of Σ ε_i
• Advanced Composition: Tighter bounds using Gaussian mechanisms, reducing total loss to roughly O(√k · ε)
• Moments Accountant: Tracks privacy loss in deep learning with differentially private stochastic gradient descent (DP-SGD)

A critical property: any arbitrary computation applied to the output of a differentially private mechanism cannot weaken the privacy guarantee. Once noise is injected, no downstream analysis, visualization, or model can reverse the protection.

• Enables safe sharing of privatized outputs with third parties
• Allows federated model updates to be aggregated without additional privacy risk
• Does not apply if the analyst has access to the original raw data
• Guarantees that privacy is a one-way, irreversible property

Differential privacy naturally extends to protect groups of correlated individuals, such as family members in a genomic study. If ε protects a single record, then a group of size g is protected with a privacy budget of g · ε.

• Critical for genomic data where relatives share genetic information
• The guarantee weakens linearly with group size
• Requires careful consideration when designing queries on familial or clustered health data
• Motivates the use of very small ε values in sensitive cohort analyses

The parameter ε (epsilon) quantifies the privacy loss. A smaller epsilon (e.g., ε=0.1) provides a stronger guarantee by injecting more noise, while a larger epsilon (e.g., ε=8) offers higher utility but weaker privacy. In clinical settings, a privacy accountant tracks cumulative epsilon expenditure across multiple training rounds to ensure the total budget never exceeds a predefined threshold, preventing gradual information leakage over time.

The most common implementation in federated learning applies the Gaussian mechanism to gradient updates before they leave a hospital's server. The process:

• Clip gradients to a maximum L2 norm (S) to bound individual influence
• Add calibrated Gaussian noise with scale proportional to S/ε
• Aggregate the noisy updates at the central server This ensures the global model update is (ε, δ)-differentially private, where δ represents a small failure probability.

Two deployment models exist in healthcare networks:

• Local DP: Noise is added by each hospital before sharing data or updates. The aggregator never sees raw values. Highest trust model.
• Central DP: A trusted curator collects raw data and adds noise to the output. Requires a trusted aggregation server, which is often impractical across competing institutions. Federated learning typically employs a distributed DP variant where noise is added locally but calibrated for global guarantees.

Differentially Private Stochastic Gradient Descent (DP-SGD) modifies standard training by:

1. Computing per-example gradients for each patient record in a batch
2. Clipping each gradient to bound sensitivity
3. Aggregating clipped gradients and adding Gaussian noise
4. Descending the noisy gradient This provides per-record privacy guarantees during model training. In federated settings, DP-SGD runs locally at each hospital, and the Federated Averaging step combines the noisy updates.

Applying differential privacy to medical imaging models introduces a measurable accuracy cost. A study on chest X-ray classification found:

• ε=8: < 1% accuracy degradation vs. non-private baseline
• ε=2: 3-5% degradation, potentially clinically significant
• ε=0.5: 8-12% degradation, often unacceptable for diagnostic use This trade-off drives research into adaptive clipping and subsampling amplification to maximize utility under tight privacy budgets.

Each round of federated training consumes privacy budget. Composition theorems quantify how epsilon accumulates:

• Basic composition: k rounds each with ε₀ consume k·ε₀ total budget
• Advanced composition: Total budget scales as O(√(k log(1/δ))·ε₀), providing tighter bounds
• Moments accountant: Used in DP-SGD to track precise privacy loss across training iterations This enables federated system designers to calculate the maximum number of training rounds before exhausting the privacy budget.