Differential privacy.
Bound what data can reveal.

Compare two neighboring datasets.

Differential privacy describes a randomized analysis whose outputs stay similar when its input changes by one defined privacy unit. That unit might be one row, one event, or all of one person’s records. A meaningful claim therefore says exactly what counts as a neighboring dataset, including whether the difference adds, removes, or replaces a unit.

In approximate differential privacy, the comparison is often written Pr[M(D) ∈ S] ≤ eε Pr[M(D′) ∈ S] + δ. Here, M is the mechanism, D and D′ are neighboring datasets, and S is any possible set of outputs. The bound limits how much including one unit can shift the odds of an outcome; it does not promise that no fact about a person can ever be inferred.

Intuitively, an observer should find it difficult to tell whether a chosen unit’s data was included, based on the protected output alone. This is a mathematical statement about a specified mechanism and threat boundary, not a general label for a product.

Parameters describe a trade-off, not a badge.

Adding more calibrated noise can strengthen the privacy bound while making an answer less useful. The right balance depends on the question, how sensitive the data is, the unit being protected, and the accuracy the decision requires. There is no context-free epsilon value that makes every release safe.

Also examine who benefits from the analysis and who bears its errors. A useful average can hide poor performance for a smaller group, and a strong privacy guarantee does not remove bias in the data or method.

DP-SGD limits how much one training example can steer an update.

Differentially private stochastic gradient descent is one established approach to training models with a formal privacy bound. In broad terms, it clips each example’s gradient to limit its influence, adds calibrated random noise to the aggregate update, and tracks the cumulative privacy cost across training steps.

The 2016 DP-SGD paper by Abadi and colleagues developed this approach for deep learning and described a privacy accountant for composing repeated updates. Its guarantee depends on choices such as the protected unit, sampling, clipping, noise, number of steps, and accounting method. More noise or more training can change the trade-off between privacy and model quality.

To evaluate a reported result, ask whether the guarantee is example-level or person-level, whether one person can contribute many records, which accountant was used, and what utility was measured on held-out data. “Trained with DP” without those details is not enough to compare two systems.

Every release that reads private data belongs in the accounting.

Privacy loss composes: multiple analyses on the same records can reveal more together than each reveals alone. A privacy accountant combines the costs of repeated queries or training steps into a bound for the complete release. Keep that total with the mechanism, dataset version, privacy unit, parameters, and output.

Transforming an already private result without returning to the sensitive data does not add new access to those records. Running another analysis on the raw data does. Treat exports, model versions, dashboards, and follow-up queries as part of the release plan rather than assuming each one starts with a fresh budget.

Privacy math does not secure the whole data pipeline.

Local inference, federated learning, removing names, and generating synthetic records can each be useful design choices. None automatically provides differential privacy. A synthetic dataset is differentially private only when the process that produced it satisfies a stated differential privacy guarantee.

Differential privacy bounds what a defined output reveals about a defined unit under a defined mechanism. It does not encrypt the original data, control who can open it, set retention rules, prevent a compromised service from exposing it, or remove information already known from elsewhere. Those protections still belong in the system around the analysis.

For adjacent questions, see why synthetic data is not automatically private ↗ and how to trace data through a local AI application ↗.

Follow privacy into the design of the system.

Use the AI field guide ↗ to connect differential privacy with data, evaluation, and governance. Then read how to review synthetic training data ↗ or map the full data path of a local model ↗.