The idea, explained
Start with the output, rather than the names in a spreadsheet. An aggregate is a statistic about a group, such as a count. Even an aggregate can reveal someone’s information if an observer compares carefully chosen groups. Removing names does not address every such comparison. Differential privacy controls how much one person can change the probability of an output, including when an observer has other information.
First define the unit being protected. Neighboring datasets differ in that unit: for example, all records belonging to one person. Protecting one purchase is different from protecting a shopper who made hundreds of purchases. Sensitivity means the largest possible change in the statistic between these neighboring datasets. A system must bound contributions before choosing its randomization.
Noise means deliberately introduced randomness. A mechanism is the complete procedure that produces the released answer. Adding an arbitrary random number is not automatically differential privacy: the noise distribution and its magnitude must be calibrated to the sensitivity and the promised guarantee. Smaller groups can suffer larger relative errors from the same amount of noise.
Epsilon is a parameter controlling the allowed difference between output probabilities. Lower epsilon generally gives stronger protection under the same definition and mechanism. It is not a percentage chance of exposure. Releasing several answers about the same people requires composition: accounting for their combined privacy loss. Adding the individual epsilon values gives a basic upper bound; more advanced accounting can sometimes prove a tighter bound.
In AI training, one approach limits each example’s training contribution and adds calibrated noise to the combined update. Training contributions are called gradients: quantities indicating how model parameters should change to reduce error. Repeated updates require privacy accounting. This can reduce predictive usefulness or increase computing requirements. A private model still needs secure storage and access controls for the original data.
Follow a worked example.
Consider a fictional learning platform that wants to release the number of people completing a lesson. Each person can contribute either zero or one to this count. The protected unit is one person, and adding or removing that person changes the count by at most one. The count’s sensitivity is therefore one.
Suppose the real count is 120. A properly configured privacy mechanism might produce 118 on one run or 123 on another. These are illustrative possible outputs, not a recipe for choosing noise and not guaranteed error limits. A correct mechanism must protect every allowed neighboring dataset, not just hide which answer occurred in this particular example.
The platform sets a total epsilon budget of 1 for three planned releases concerning the same people. It allocates 0.2 to the first count, 0.3 to the second and 0.5 to the third. Basic composition gives 0.2 + 0.3 + 0.5 = 1, so these releases use the planned upper bound. A fourth fresh analysis at epsilon 0.2 would raise that bound to 1.2 and exceed the plan.
The team cannot justify endless reruns by saying each answer is noisy. Repeated fresh answers consume privacy budget and can help an observer average away noise. Republishing the exact already released answer, without consulting private data again, is different from calculating another fresh answer. The platform should track releases and their accounting, and explain the uncertainty rather than display the private true count next to the noisy result.
Where people get stuck
Differential privacy does not mean that nobody can learn a population pattern or that the underlying database is safe to expose. Its guarantee depends on the protected unit, contribution bounds, implementation and complete release history. A low epsilon for one isolated step does not describe the privacy of an entire system.
Now try it yourself.
1. Check the core idea
Two fresh analyses of the same people each use epsilon 0.4. Under basic composition, what is the combined upper bound? Would rerunning the second analysis again be free?
Reveal the answer & reasoning
The upper bound is 0.4 + 0.4 = 0.8. A third fresh analysis at epsilon 0.4 would make it 1.2, so it is not free. Returning the exact previously published result without accessing private data again adds no new information beyond that release. Epsilon is a privacy-loss parameter, not an 80% or 120% probability of someone being identified.
Why this was added
The catalog covers access control, fairness and probability, but does not teach differential privacy, neighboring datasets, contribution sensitivity or cumulative privacy budgets. This standalone lesson explains a distinct privacy guarantee for analytics and AI training.