Differential Privacy

Differential privacy is a mathematical property of a data-analysis mechanism, not a particular method of removing names or a guarantee that a dataset contains no sensitive information. Informally, the results of an analysis should be difficult to distinguish depending on whether one defined unit of data is present. In the common individual-level setting, neighboring datasets differ in one person’s data. More generally, the chosen unit might be an event, account or other contribution, so the unit must be specified when a guarantee is reported.

For approximate (ε, δ)-differential privacy, a randomized mechanism M must satisfy Pr[M(D) ∈ S] ≤ e^ε Pr[M(D′) ∈ S] + δ for every pair of neighboring datasets D and D′ and every set of possible outputs S. The parameter ε controls how different the output distributions may be; δ allows an additive probability of exceptions. Pure ε-differential privacy is the special case δ = 0. This bound limits how much an analysis can reveal because of one defined contribution, but it does not prevent conclusions that could be drawn from population-wide patterns or other information.

Differential privacy is commonly achieved by adding carefully calibrated random noise to query results or to other intermediate values. The amount of noise depends on the sensitivity of the calculation: how much its output could change when one unit of data changes. The Laplace mechanism, for example, adds noise from a Laplace distribution scaled to the query’s sensitivity; other mechanisms use different distributions and privacy definitions.

A smaller ε generally means a stronger formal privacy guarantee but requires more noise, which can make results less accurate. A larger ε permits greater changes in output distributions and generally improves accuracy, while providing a weaker guarantee. The appropriate balance depends on the data, analysis, and intended use; the parameter alone is not a complete measure of practical protection.

The privacy cost of multiple analyses of the same data can accumulate. Under the basic composition rule for pure differential privacy, guarantees with parameters ε₁, ε₂, and so on combine to a total bound of ε₁ + ε₂ + … . This cumulative amount is often called a privacy budget. Systems may track that budget and limit the number or precision of analyses so that repeated queries do not silently exhaust the intended protection. More advanced accounting methods exist, but their parameters and assumptions must be interpreted carefully.

In the central model, a trusted data curator holds the original records and adds noise before releasing results. In a local model, contributors add noise before sending their data, so the curator need not see the original values; this usually requires more noise and can reduce accuracy. Differential privacy is used in statistical releases, data analytics and machine learning, among other applications.

The guarantee applies to the specified randomized analysis and its outputs. It does not by itself secure raw data while they are collected, stored or processed, nor does it remedy an unrelated data breach. The privacy unit, parameters, algorithm, implementation and the use of other releases all affect what protection a deployed system provides. NIST therefore advises evaluating the whole system rather than relying on the phrase “differentially private” alone.