A randomized mechanism satisfies differential privacy with parameters if, for every ordered pair of adjacent datasets and measurable output event ,Adjacency specifies the contribution of one individual, such as adding or removing one record. The probability is over the mechanism's randomness.
For an integer count query with sensitivity one under add/remove adjacency, releasing the count plus independent Laplace distribution noise of scale gives privacy. The ratio of output densities is at most by the triangle inequality. The guarantee limits distinguishability between neighboring inputs; it does not require publishing identical results or certify that every statistical estimate is accurate.[ref]
The Algorithmic Foundations of Differential Privacy by Cynthia Dwork and Aaron Roth. Definition 2.4 and Theorem 3.6, Laplace mechanism for counting queries
The Laplace mechanism releases a numerical query with added Laplace distribution noise scaled to the query's sensitivity. For , define its sensitivity under the chosen dataset adjacency byFor and positive finite sensitivity, release with independent noise coordinates of density , where . The ratio of output densities for adjacent inputs is bounded by , by the triangle inequality. Integrating over any measurable output event proves differential privacy.[ref]
For a count with add/remove sensitivity one and , the noise scale is two and its variance is . Smaller privacy parameters increase uncertainty in this mechanism. A fixed output when sensitivity is zero needs no noise. The adjacency convention is essential: changing what one person can contribute changes the required sensitivity bound.
Articles by others on the same topic
Differential privacy is a mathematical framework designed to provide a rigorous privacy guarantee when sharing or analyzing data that may contain sensitive information about individuals. The primary goal of differential privacy is to enable the release of useful statistical information while ensuring that the privacy of individual data points is preserved. The core idea is to ensure that the outcome of a data analysis (like a query or a statistical result) does not significantly change when any single individual's data is added or removed from the dataset.