Differential Privacy (DP)

When multiple differentially private computations are performed on the same dataset, the total privacy loss accumulates additively. If mechanism M1 satisfies ε1-DP and M2 satisfies ε2-DP, their combined release satisfies (ε1 + ε2)-DP. This property forces strict management of the privacy budget, requiring data scientists to track cumulative epsilon expenditure across all queries in a training run or analysis session.

When differentially private computations are applied to disjoint subsets of a dataset, the total privacy loss is bounded by the maximum epsilon among the computations, not the sum. If a dataset is partitioned by patient ID and a query runs on each partition independently, the overall guarantee remains max(ε1, ε2, ..., εk)-DP. This property enables efficient federated learning by allowing each client to consume privacy budget independently.

Any computation applied to the output of a differentially private mechanism—without revisiting the original private data—cannot weaken the privacy guarantee. An adversary with arbitrary auxiliary information cannot increase privacy loss by transforming the result. This means model weights trained with DP remain protected even if an attacker inspects, averages, or reverse-engineers them. The guarantee is future-proof against any post-hoc analysis.

Differential privacy naturally extends to protect groups of correlated individuals. A mechanism satisfying ε-DP for a single record provides kε-DP for any group of size k. This property is critical in healthcare, where genomic data from family members is inherently correlated. Protecting a patient's record with ε = 0.1 means protecting their immediate family of four with ε = 0.4, requiring careful calibration of the privacy budget for sensitive cohorts.

The formal guarantee is defined through the privacy loss random variable L = ln( P[M(D)=o] / P[M(D')=o] ), where D and D' are neighboring datasets differing by one record. Pure ε-DP requires this ratio to be bounded by ε for all possible outputs. Advanced relaxations like (ε, δ)-DP allow a small failure probability δ where the bound may be violated, enabling more practical mechanisms like the Gaussian mechanism for federated model training.

The privacy guarantee holds even when an adversary adaptively chooses subsequent queries based on previous outputs. This models a realistic threat where an attacker dynamically probes the system. The composition theorems remain valid regardless of the adversary's strategy, ensuring that no sequence of cleverly chosen queries can circumvent the cumulative privacy budget. This property underpins the security of interactive differentially private query engines.

A privacy audit technique simulating an adversary attempting to determine whether a specific patient's record participated in federated training. Evaluators use this to quantify information leakage from shared model updates. The attack exploits differences in model confidence between members and non-members of the training set. A successful defense requires DP noise calibrated to make membership indistinguishable beyond a provable bound.

A privacy-preserving method for aggregating classification performance across institutions by securely summing true positive, false positive, true negative, and false negative counts. Each institution computes its local confusion matrix and contributes encrypted or DP-noised counts. The global matrix enables computation of:

• Precision and recall
• F1-score
• Specificity and sensitivity Without exposing individual patient predictions.

A decentralized implementation of Shapley additive explanations quantifying each feature's contribution to a model's prediction. Computed across distributed data partitions without centralizing records. The process requires:

• Local Shapley value computation per client
• Secure aggregation of feature attributions
• DP noise injection to mask individual contributions This enables auditable model interpretability while preserving patient privacy.

A simulated security evaluation where an attacker attempts to reconstruct representative features of private training data from shared gradients or model outputs. In federated evaluation, this tests whether DP guarantees hold under adversarial conditions. Effective defenses include:

• Gradient clipping to bound individual influence
• Gaussian noise calibrated to the sensitivity of the query
• Privacy amplification via subsampling