Differential Privacy Vectors

The privacy loss parameter (ε) quantifies the maximum information leakage allowed. A lower epsilon (e.g., ε=0.1) provides stronger privacy guarantees but reduces utility.

• Privacy budget: A finite resource consumed by each query
• Composition theorems: Track cumulative privacy loss across multiple analyses
• Typical ranges: ε=0.01 to ε=10, with values below 1 considered strong privacy

Example: Apple uses ε=4 for emoji suggestions, while the US Census Bureau employed ε=19.61 for the 2020 decennial census.

The Laplace mechanism adds calibrated random noise drawn from a Laplace distribution to vector components, scaled by sensitivity (Δf) divided by epsilon.

• Sensitivity (Δf): The maximum change in output when a single record is added or removed
• Scale parameter: b = Δf/ε determines noise magnitude
• Dimensional independence: Noise applied independently to each embedding dimension

This ensures that the presence or absence of any single individual's data in the training set cannot be statistically distinguished from the output.

For high-dimensional embeddings, the Gaussian mechanism provides tighter privacy accounting under (ε, δ)-differential privacy, where δ represents a small failure probability.

• Relaxed definition: Allows a δ probability of exceeding the ε privacy bound
• Better for vectors: More efficient than Laplace for high-dimensional data
• Central Limit Theorem: Gaussian noise naturally suits embedding distributions

This mechanism is preferred when processing thousands of embedding dimensions simultaneously, as it avoids the over-calibration issues of pure ε-differential privacy.

Local DP applies noise on the client device before data leaves, while Global DP adds noise to aggregated outputs on a trusted server.

Local Differential Privacy:

• No trusted curator required
• Higher noise per individual record
• Used by Apple and Google for telemetry

Global Differential Privacy:

• Requires a trusted data aggregator
• Better utility for the same epsilon
• Used by the US Census Bureau

Vector databases typically implement global DP at query time to protect against extraction attacks.

A critical property: any computation applied to a differentially private output cannot weaken the privacy guarantee. This is known as the post-processing theorem.

• Composability: DP outputs can be safely combined with other systems
• No reverse engineering: Adversaries cannot "un-noise" the vectors
• Downstream safety: Vector search results remain protected

This means that once embeddings are privatized, any semantic search, clustering, or analysis performed on them inherits the same privacy guarantee without additional risk.

The fundamental tension: adding noise protects privacy but degrades semantic fidelity. Calibration requires balancing recall accuracy against reconstruction resistance.

• Recall@k degradation: Higher noise reduces nearest-neighbor accuracy
• Dimension-dependent scaling: More dimensions require proportionally more noise
• Adaptive clipping: Bounding vector norms before noise injection preserves utility

Example: A vector store with 768-dimensional embeddings and ε=1 may experience a 5-15% drop in top-10 retrieval accuracy compared to non-private vectors.

The foundational mechanism of differential privacy vectors. Calibrated statistical noise—typically drawn from a Laplace or Gaussian distribution—is added directly to the embedding values. The scale of the noise is governed by the privacy budget (ε).

• Mechanism: Transforms a precise vector v into a noisy vector v'.
• Trade-off: Higher noise increases privacy guarantees but degrades semantic utility.
• Goal: Ensure that the output of a query is statistically indistinguishable whether or not a specific individual's data was included in the dataset.

A mathematical parameter that quantifies the privacy loss allowed by a differential privacy mechanism. A smaller epsilon (e.g., 0.1) provides a stronger guarantee that an adversary cannot infer the presence of a single record.

• Composition: Privacy budgets are cumulative; sequential queries on the same data consume the total budget.
• Accounting: A privacy accountant tracks total spend to prevent complete privacy erosion.
• Vector Context: Dictates the magnitude of noise added to embeddings before storage or release.

Defensive techniques specifically designed to prevent adversaries from reconstructing sensitive source data from model outputs. In vector databases, an attacker might issue thousands of semantic queries to map the boundary of a private cluster.

• Differential Privacy Defense: By adding noise to vectors, the exact geometry of private data clusters is obscured.
• Output Perturbation: The system returns a noisy aggregate rather than the exact nearest neighbor.
• Rate Limiting: Restricting the number of queries prevents an attacker from averaging out the injected noise to recover the ground-truth embedding.

A privacy-preserving mechanism that prevents an adversary from determining with high confidence whether a specific data record was included in a model's training dataset. For vector stores, this means preventing an attacker from confirming if a specific document was indexed.

• How it works: Differential privacy ensures the output distribution of a query is nearly identical regardless of a single record's inclusion.
• Vector Implication: An attacker cannot distinguish if a specific embedding exists in the database by observing query results.
• Guarantee: Provides plausible deniability regarding the presence of any single data point in the semantic index.

Techniques designed to prevent an attacker from deducing sensitive attributes of a data subject by observing the outputs and behavior of a machine learning model. In a semantic vector space, this stops an adversary from inferring hidden properties (e.g., a medical condition) from non-sensitive query results.

• Correlation Masking: Noise injection breaks the statistical correlations between non-sensitive public embeddings and sensitive private attributes.
• Contextual Privacy: Ensures that semantic similarity does not leak protected characteristics.
• Application: Critical for compliance with regulations like GDPR, which protects inferred sensitive data.

The process of applying a reversible or irreversible transformation to a vector to mask its true semantic meaning from unauthorized observers. Differential privacy provides a rigorous, mathematically provable form of irreversible obfuscation.

• Differential Privacy vs. Encryption: Unlike encryption, the data remains usable for analysis without a decryption key.
• Utility Preservation: The noisy vector retains a high cosine similarity to the original, preserving semantic search functionality.
• Irreversibility: The noise process is one-way; the original precise vector cannot be mathematically recovered from the noisy version.