Differential Privacy

The privacy loss parameter that quantifies the strength of a differential privacy guarantee. Epsilon bounds the multiplicative difference in the probability of any output occurring when a single record is added to or removed from a dataset. A smaller epsilon—typically values between 0.1 and 1 in clinical settings—indicates a stronger privacy guarantee, as the output distributions become nearly indistinguishable. In practice, epsilon is not a binary threshold but a continuous dial that trades off privacy against utility: too small an epsilon renders query results useless, while too large an epsilon effectively provides no meaningful protection.

A finite, quantifiable resource representing the total allowable privacy loss over a series of differentially private computations. Each query against a dataset consumes a portion of the budget, and once exhausted, no further queries can be answered without risking re-identification. Budget management is critical in federated learning scenarios where a global model is updated over hundreds of communication rounds. Techniques like moments accountant track cumulative privacy loss precisely, enabling data custodians to set a maximum epsilon threshold—often governed by institutional policy or regulatory mandate—before training must halt.

A differential privacy technique that adds random noise drawn from a Gaussian (normal) distribution to a query's output, calibrated to the L2 sensitivity of the function. This mechanism satisfies (ε, δ)-differential privacy, where δ represents a small probability of catastrophic privacy failure. The Gaussian mechanism is preferred in high-dimensional machine learning applications—such as gradient perturbation in federated stochastic gradient descent—because the L2 norm scales more gracefully with dimensionality than the L1 norm used by the Laplace mechanism. The standard deviation of the noise is proportional to sensitivity divided by epsilon.

The maximum change in the output of a query function when a single record is added to or removed from a dataset. Sensitivity determines the magnitude of noise required to achieve a differential privacy guarantee. Two variants exist:

• L1 sensitivity: maximum absolute difference in output, used by the Laplace mechanism
• L2 sensitivity: maximum Euclidean distance, used by the Gaussian mechanism In federated learning, gradient clipping is applied to bound the sensitivity of individual model updates before noise is added, preventing any single patient's data from exerting disproportionate influence on the global model.

An adversarial attack that determines whether a specific data record was used in the training set of a machine learning model. Attackers exploit differences in model confidence, loss values, or gradient behavior between seen and unseen samples. In healthcare, a successful membership inference attack could reveal that a particular patient's records were included in a clinical trial or disease registry. Differential privacy provides a provable defense against such attacks by ensuring that model outputs are statistically indistinguishable regardless of any single individual's inclusion, reducing attack accuracy to near-random guessing.

A differential privacy model where noise is added to data on the individual user's device before transmission to an untrusted aggregator. Unlike the central model where a trusted curator applies the mechanism, LDP guarantees privacy even against a malicious data collector. Each participant independently randomizes their response using techniques like randomized response. In healthcare IoT and wearable scenarios, LDP enables continuous physiological monitoring where raw sensor data never leaves the device, yet population-level insights can still be derived from the privatized aggregates.