Differential privacy

In one line

Differential privacy (DP) adds carefully calibrated noise to query results or model training so that no output meaningfully depends on any single individual's record — with a tunable, provable bound (epsilon) on how much one person can matter.

The problem it solves

"We anonymised it" is a promise that keeps breaking. Stripping names doesn't stop linkage attacks, and aggregate statistics can still leak individuals — especially in small cohorts (a single patient in a rural district's count). Differential privacy replaces the promise with a mathematical guarantee: a provable bound on how much any one person's data can influence any published output.

The guarantee, intuitively

The formal property: a query's result is nearly indistinguishable whether your record is included or removed. So an attacker comparing outputs can't tell if you are in the dataset — which means they can't learn your data from the result. It's privacy as a property of the mechanism, not a hope about the data.

How it works

• Calibrated noise — random noise is added, scaled to the query's sensitivity (how much one record could change the answer).
• Privacy budget (epsilon, ε) — every query spends from a budget that accumulates; ask too many questions and the budget is exhausted. Lower ε = stronger privacy, noisier answers — choosing it is policy, not just math.
• DP-SGD applies the same idea to model training (noise in the gradients), so a model can't memorise individuals.
• Secure aggregation pairs it with federated learning.

Where it shows up in digital health

• Publishing health statistics without re-identification risk (small rural cohorts make naïve "anonymisation" famously breakable).
• Releasing research datasets with a bounded privacy cost.
• Privacy-bounded analytics on national health programmes.

The sober truth DP formalises: aggregation alone is not anonymity — and a provable bound beats a promise. It complements de-identification (which removes identifiers) by bounding what remains.

Common pitfalls

• Treating ε as a magic number — it's a privacy/utility policy choice with real trade-offs.
• Forgetting budget accumulation — many "private" queries can together leak; track the budget.
• Assuming DP fixes everything — it bounds inference from outputs, not access control or breach.

Key takeaways

• DP adds calibrated noise so no output meaningfully depends on any one record — provably.
• Epsilon is the tunable privacy/utility dial; it accumulates across queries.
• DP-SGD extends it to ML training; secure aggregation pairs it with federated learning.
• The rigorous answer to "aggregation isn't anonymity" — a bound, not a promise.