Differential Privacy, explained.
Differential privacy limits how much the probability of a released output can change when one person's contribution changes. The guarantee belongs to a specified random mechanism and privacy parameters.
Why it happens
A count with sensitivity one can use Laplace noise of scale 1/epsilon. Smaller epsilon makes the output distributions for neighbouring counts more similar but adds more uncertainty. Releasing more independent answers spends more budget under composition, even if somebody later averages the answers.
Differential privacy bounds how much a released result's probability distribution changes when one person's contribution changes. It is a property of a mechanism, not a claim that any noisy number is private.
Read the result
Release a count and inspect the latest value, noise scale, and cumulative epsilon. The true count of 40 is synthetic and intentionally public here. Changing epsilon affects future releases only. The mean may move closer to 40 after several releases, but that apparent accuracy has consumed more budget rather than created free information.
A worked example
Two protected-count releases in a teaching model
A first release uses epsilon 0.5, giving a Laplace scale of two around the synthetic count 40.
Change epsilon to one and release again. The next scale is one, while the cumulative basic-composition budget becomes 1.5.
Compare the two outputs or their mean, remembering that averaging is post-processing of already released information and does not refund either release's privacy cost.
OPTIONAL DEEPER DETAILGo deeper: inside the model
Inside this model
The synthetic count is 40 and neighbouring datasets differ by one. Each release adds independently seeded Laplace noise with scale 1/epsilon. Epsilon is chosen from 0.1 to 2. No rounding or clipping is applied. Basic sequential composition adds epsilon across releases, even when epsilon changes; the mean of releases is also shown.
Where this idea is useful
A practical use
A statistics publisher may release a protected aggregate rather than exact individual records, while accounting for all related releases.
A common misconception
“Adding arbitrary noise automatically makes data private.”
The guarantee requires an appropriate sensitivity bound, a correctly calibrated mechanism, suitable randomness, and accounting for all releases. This seeded demonstration is not a production privacy implementation.
What this explanation leaves out
- No personal data are used or stored. This single-count teaching mechanism is not a deployable privacy service. Correct bounds require a valid sensitivity model, secure randomness, and accounting for every release.
Why can a noisy count be below zero or above the dataset size?
The unbounded Laplace mechanism can produce those outputs. A separately justified clipping step is post-processing; this board leaves values unmodified so you can inspect the noise.
If you publish several statistics about the same people, where is their combined privacy cost being tracked?
Associated thinkers
Associations marked provisional are awaiting source review.
Further reading
Explore the original research or the teaching reference behind this experiment.