Privacy Budget

Epsilon is the single scalar value that defines the privacy loss of a mechanism. A lower epsilon enforces stronger privacy by requiring more noise, while a higher epsilon permits greater accuracy at the cost of weaker guarantees.

• ε = 0: Perfect, absolute privacy—output is completely independent of any individual's data, rendering analysis useless.
• ε ≈ 0.1 to 1: A commonly cited strong privacy range suitable for highly sensitive clinical data.
• ε ≈ 1 to 10: Moderate privacy, often used in practical deployments balancing utility and protection.
• ε > 10: Weak privacy; the formal guarantee degrades significantly, approaching non-private analysis.

Epsilon is not a probability but a bound on the multiplicative change in outcome likelihood when a single record is added or removed from the dataset.

When multiple differentially private queries are executed on the same dataset, the total privacy budget consumed is the sum of the individual epsilons. This is the fundamental accounting rule that makes the budget a finite, depletable resource.

• If a data scientist runs Query A with ε = 0.3 and Query B with ε = 0.2, the total privacy loss is ε = 0.5.
• This linear accumulation forces careful planning: every ad-hoc analysis, model training epoch, or hyperparameter tuning run spends from the same fixed allocation.
• Once the total budget is exhausted, no further queries can be answered with formal privacy guarantees on that dataset without risking re-identification.

This property directly mirrors financial budgeting, where each expenditure reduces remaining capital.

Parallel composition is the counterbalancing accounting rule: when queries operate on disjoint, non-overlapping subsets of the data, the total privacy cost is the maximum epsilon among the queries, not the sum.

• Partitioning a hospital dataset by department and querying each partition independently at ε = 0.5 results in a total cost of ε = 0.5, not ε = 0.5 × N.
• This principle is critical for scaling differentially private systems across federated networks where each hospital's local data forms a natural disjoint partition.
• It enables efficient budget utilization in cross-silo federated learning, where each silo's local training loop consumes budget independently of peer institutions.

A privacy budget is typically defined over a fixed time window or a specific dataset release. Once depleted, the system must either deny further queries or trigger a renewal event.

• Static Budget: A one-time allocation (e.g., ε = 1.0) for publishing a synthetic dataset or a trained model. No further queries are permitted.
• Periodic Renewal: Budget resets at defined intervals (daily, weekly), common in interactive query systems. This introduces a time-based risk calculus—an adversary can accumulate knowledge across periods.
• Sliding Window: A continuous budget that tracks expenditure over a rolling time window, preventing burst attacks while allowing sustained utility.

In federated learning, each communication round consumes a fraction of the budget. The total number of rounds must be calibrated against the global epsilon target before training begins.

The privacy budget formalizes the inherent tension between statistical accuracy and individual protection. Adding noise to satisfy a low epsilon degrades signal, particularly for small subgroups or rare conditions.

• High-dimensional queries (e.g., genome-wide association studies) consume budget rapidly because each dimension leaks information.
• Sparse data (rare disease cohorts) suffers disproportionately from noise injection, as the signal-to-noise ratio collapses.
• Techniques like smooth sensitivity and propose-test-release frameworks adapt noise calibration to the data's local structure, maximizing utility within a fixed budget.

This trade-off is not a bug but the provable guarantee that privacy is being preserved. A system that claims both perfect accuracy and perfect privacy is mathematically impossible under differential privacy.

In a federated learning network, the privacy budget must be tracked across heterogeneous, distrusting nodes without a central data repository. Each participating hospital or device maintains its own local budget ledger.

• Local Budgets: Each node independently tracks epsilon expenditure on its local dataset. A global model's privacy guarantee is bounded by the weakest (highest epsilon) participating node.
• Cryptographic Enforcement: Secure aggregation protocols ensure the central server cannot inspect individual updates, preventing budget side-channel leakage.
• Auditability: Blockchain-anchored commitment logs provide tamper-evident records of per-round epsilon consumption for regulatory review under HIPAA and GDPR.
• Heterogeneous Budgets: Nodes may operate under different epsilon constraints based on local regulatory requirements, requiring the aggregation algorithm to harmonize disparate privacy levels.

The fundamental unit of the privacy budget, epsilon quantifies the maximum distance between query outputs on datasets differing by one record. A lower epsilon (e.g., 0.1) enforces stronger privacy by injecting more noise, while higher values (e.g., 10) permit greater accuracy at the cost of weaker guarantees. In practice, epsilon is not a binary threshold but a continuous dial: clinical genomics pipelines often target ε ≤ 1, while low-sensitivity aggregate statistics may tolerate ε = 4–8. The parameter directly bounds the privacy loss random variable, ensuring an adversary cannot confidently distinguish whether any single patient's record was included in the training set.

Delta represents the failure probability of differential privacy—the infinitesimal chance that the privacy guarantee is violated outright. In (ε, δ)-differential privacy, δ bounds the probability that privacy loss exceeds ε. Cryptographically significant values are typically δ ≤ 10⁻⁵ or smaller, often set inversely proportional to dataset size. For healthcare federated learning, δ is commonly chosen to be much smaller than 1/N, where N is the number of patients, ensuring no individual record is catastrophically exposed. Neglecting δ leads to overly optimistic privacy accounting and potential regulatory non-compliance.

Composition theorems govern how privacy budgets accumulate across multiple queries or training rounds. Basic composition states that k sequential (ε, δ)-DP mechanisms consume at most (kε, kδ) budget—a linear but pessimistic bound. Advanced composition provides a tighter, sublinear bound using the moments accountant, reducing total privacy loss to roughly O(√k · ε) under Gaussian noise. In federated learning, each communication round consumes a fraction of the global budget; without careful composition tracking, a model may inadvertently exhaust its privacy allowance before convergence, violating regulatory commitments.

A relaxation of standard (ε, δ)-DP based on Rényi divergence, providing tighter composition analysis for Gaussian mechanisms commonly used in federated learning. RDP expresses privacy loss as a function of order α, enabling numerically stable tracking across hundreds of training rounds. The RDP accountant converts final (α, ε)-RDP guarantees back to (ε, δ)-DP for reporting. This approach avoids the looseness of basic composition and the complexity of the full moments accountant, making it the preferred accounting method in production federated systems like those deployed across hospital networks.

The point at which cumulative epsilon expenditure reaches a predefined threshold of acceptable risk, after which no further queries or training rounds are permitted on the sensitive dataset. Depletion triggers mandatory stoppage—the model can no longer access raw patient data for training. Strategies to delay depletion include: gradient clipping to bound per-sample sensitivity, subsampling to amplify privacy through randomness, and noise calibration optimized per layer. In longitudinal clinical studies, budget depletion must be forecast across the entire study duration, requiring upfront allocation planning aligned with both statistical power requirements and regulatory epsilon limits.

The random variable characterizing the actual information leakage from a differentially private mechanism, as opposed to the worst-case bound provided by (ε, δ). The PLD captures the full distribution of the privacy loss random variable L = log(P(M(D)=o) / P(M(D')=o)), enabling precise numerical composition via Fourier-based accountants. Unlike RDP which uses a single divergence order, PLD accounting computes the exact convolution of loss distributions across mechanisms. This yields the tightest known composition bounds for heterogeneous federated learning pipelines where different rounds may use varying noise scales and clipping norms.