Differential Privacy

A guarantee about what a released result can reveal: whether or not any single person's record was in the dataset, the output looks nearly the same. It is a promise about the procedure rather than about the data, so it holds against attackers you have not thought of — which is what makes it different from anonymisation, and why anonymisation keeps failing.

The mechanism is calibrated noise, and the amount depends on sensitivity — how much one record can move the answer. ε is a bound on a likelihood ratio, not a probability of being caught, and small ε means strong privacy. The part practitioners get wrong is composition: every query spends budget, so a pipeline that reports ε per query and never sums them has not measured what it claims.

A mechanism M is (ε, δ)-differentially private when for neighbouring datasets D, D′ differing in one record, P[M(D) ∈ S] ≤ e super ^ε ·P[M(D′) ∈ S] + δ for every S. The guarantee composes: k queries at ε each give kε under basic composition, and roughly √(k)·ε under advanced composition — which is why the accounting method matters as much as the mechanism.