DP Noise — crypto-lab

Start here

What is differential privacy?

Suppose a company will publish statistics about its payroll but promises never to reveal what any individual earns. Differential privacy asks a sharper question than "is anyone named?": would this answer have come out roughly the same if you had never been in the database at all? If the answer is yes — for every possible output, and no matter what else an attacker already knows — then nothing anyone learns from the release is really about you.

The way to achieve it is to add carefully calibrated random noise to the answer. How much noise is set by a single number, ε, and that number is the whole subject. Small ε means the two versions of the world — with you, without you — look nearly identical, so nobody learns much about you and nobody learns much from the answer either. Large ε means a sharp, useful answer that also tells an attacker rather a lot. There is no setting that avoids the trade; there is only writing the number down and defending it.

Jargon, unpacked

ε (epsilon): The privacy parameter. It bounds a ratio: for every possible output, the probability of seeing that output changes by a factor of at most e^ε when one person is added to or removed from the data. It is not a probability, and it is not an amount of noise.
δ (delta): A small allowance for the ε promise to fail outright. Pure ε-DP has δ = 0; the Gaussian mechanism needs a non-zero δ because a Gaussian's tails are too light for any e^ε ceiling to hold everywhere. Exhibit 2 shows exactly where it breaks.
Neighbouring databases: Two datasets differing in one person's record — one with Alice, one without. The definition quantifies over every such pair, which is why it does not matter what an attacker already knows about the other eleven people.
Sensitivity (Δ): How much one person's presence can move a query's answer, in the worst case. A headcount has Δ = 1; a payroll total has Δ equal to the whole declared salary range. Noise is calibrated to Δ/ε, so the same ε means very different noise for different queries.
The Laplace mechanism: Add noise drawn from a Laplace distribution of scale b = Δ/ε. Its density falls off exponentially in both directions, which is exactly the shape that makes the likelihood ratio flat at e^ε.
Composition: What repeated answers cost. Privacy loss accumulates across queries, so ε is a budget to be spent rather than a setting to be chosen once.
Local versus global DP: Global DP trusts a curator with the raw data and randomises the published answer; local DP randomises on each person's own device, so nobody ever holds the truth. Local needs far more noise for the same ε. This page demonstrates the global model; the deployments panel labels which is which.
Post-processing: Anything computed from a released answer — a ratio, a chart, a model — costs no additional privacy. Differential privacy is closed under it, which is why an analyst can be handed a released table and left alone with it.

Honest framing up front. Differential privacy is not a cryptographic primitive. Nothing here is encrypted and there is no adversary who cannot compute something; the guarantee is statistical, and it protects the output of a computation rather than its inputs. Its neighbour in this suite is Silent Tally, which protects the inputs with secure multi-party computation and says nothing about what the result reveals. The two are complementary halves of the same problem, and each is useless in the other's place.

Exhibit 1

Two harmless totals, one person's salary

Before any mechanism, the problem. Here is the entire database — twelve people, one of whom we will call the target. The system publishing this data has a rule: only aggregates, never an individual. Watch that rule fail.

The database

The differencing attack

Two queries, both of which the system is happy to answer, neither of which mentions a person. Subtract them.

How the two totals are answered

What about anonymising the table instead?

The obvious alternative is to publish the table with the identifying columns blurred until every record looks like several others — k-anonymity. Choose how hard to blur, and the page measures the k that results and then attacks it.

Generalisation applied to the quasi-identifiers

Both failures have the same shape: they are properties of the data released, and an attacker attacks with everything else they know. Differential privacy makes the promise about the mechanism instead — which is the move that survives.

Exhibit 2 · the headline

The definition, drawn

Two worlds. In one, Alice is in the payroll database; in the other, she is not. Both are asked the same question — how many people earn more than $100,000? — whose true answer is 6 with her and 5 without. The mechanism adds noise, so each world produces not an answer but a distribution of possible answers. Those two distributions are the first chart.

Differential privacy is one inequality about those two curves: at every possible output, the probability under one world is at most e^ε times the probability under the other. The second chart is that ratio, drawn between rails at ±ε. Drag ε and watch it step from one rail to the other and stop dead — then switch to the Gaussian and watch it sail straight through, which is the entire reason δ exists.

Privacy parameter ε — 1

Mechanism

The two worlds

One curve per world. As ε falls they slide together until no observer could say which one produced a given answer.

The ratio, and its rails

The log of the likelihood ratio between the two worlds, at each output. The definition says this line must stay between −ε and +ε — and for the Laplace mechanism it does not merely stay inside, it sits on the rails, which is what a tight ε looks like.

Exhibit 3 · break it yourself

Can you tell which world you are in?

The guarantee says an attacker cannot reliably distinguish the two databases from a released answer. You are the attacker. First draw a few thousand real releases from each world and see how far apart the histograms land; then play the game, where a cryptographic coin picks a world, the real mechanism releases one answer, and you guess.

Privacy parameter ε — 1

Sampled, against the exact probabilities

The game

Deal a release, then say which database you think it came from. Your running score sits next to the best score any attacker could achieve at this ε.

Exhibit 4

The dial: what ε costs in usefulness

Every value of ε buys privacy with accuracy at a fixed exchange rate, and the rate depends on the query. Pick a question, pick an ε, pick a mechanism, and read both sides at once: how far an attacker's belief can move, and how wrong the answer is. Switching from the headcount to the total payroll changes the noise by five orders of magnitude at the same ε — because sensitivity, not ε alone, sets the scale.

Question

Mechanism

Privacy parameter ε — 1

Release an answer

Six independent releases of the same question. They differ every time; that is the mechanism working.

Post-processing is free

Release the payroll total and the headcount, then divide them for an average salary. The division costs no privacy at all — differential privacy is closed under post-processing.

Both sides of the trade, on one axis

Exhibit 4b · you decide

Where does Δ come from? You have to answer

Everything above took the payroll query's sensitivity as given. It is not given. A sum has no sensitivity at all until somebody declares how much one person is allowed to contribute, and that declaration is the single most consequential decision in a differentially private release — far more so than which noise distribution gets used. Real deployments fail here, in the query definition, not in the sampler.

So make the declaration yourself. Pick the bound, watch what it does to the noise and to the bias, and then meet the record that does not fit.

Declare the range, before you look at the data

Every salary is clamped into this range before the total is taken, which is what gives the query a finite Δ at all. Raise the bound and the noise rises with it; lower it and the answer is systematically too small.

Declared upper bound on one person's salary

A thirteenth person joins, and she does not fit

The bound was published. Then Mara Kowalski was hired at $480,000. The mechanism has to do something with her record, and all three of these are things real systems do. Two of them are defensible. One is not, and it is the one that looks most reasonable.

Exhibit 5

Composition: ε is a budget, not a setting

Every answer released from the same data spends privacy. Ask enough questions and you have spent it all — and the only fail-closed response left is to stop answering. This exhibit is a working ledger, and the attack the ledger exists to prevent.

The ledger

Ask questions and watch the budget deplete. Both composition rules are computed on every request and the cheaper one is billed; a query that would overdraw is refused outright.

Total ε budget for this session

Two ways to add up privacy loss

Basic composition adds ε. Advanced composition grows as √k instead, in exchange for a small extra failure probability δ′. Neither is simply better — the crossover is computed below.

The averaging attack — what happens with no budget at all

Ask the same question over and over and average the answers. Every individual answer is differentially private; the average is not.

Number of times to ask, at ε = 0.5 each — 600

Exhibit 6

ε in the wild

Differential privacy is not a research curiosity — it is running on your phone and it drew your voting district. What it is not, in any of those deployments, is a single agreed level of protection. Each ε below is put through the same belief calculation the rest of this page uses, so the numbers can be compared with each other rather than admired.

The parameters, on a log scale

Who is using what, and where the number came from

One mechanism, four different ε

The 2020 Census budget was set in ρ, not ε. Converting it is a choice, and different defensible choices give answers a full unit apart.

Recap

Differential privacy in five lines

Each of these is something you watched happen above, not something you were told.

1 · Aggregates are not privacy

Two totals over twelve people subtracted to Alice's exact salary, and generalising the table until k = 6 disclosed her salary band anyway. Both failures are properties of what was released; neither is fixed by releasing it more carefully.

2 · ε bounds a ratio, not a noise level

For every possible output, the two worlds differ in probability by at most e^ε. The chart in Exhibit 2 shows the ratio reaching that ceiling and stopping — tight, not merely respected.

3 · That ratio bounds belief

Bayes turns e^ε into a limit on what anyone can conclude: an even prior cannot move past e^ε/(1+e^ε), whatever they see and whatever else they know. That is the sentence ε actually buys, and it is what the guessing game in Exhibit 3 measures.

4 · The trade-off does not go away

Exhibit 4 puts both curves on one axis. Differential privacy does not make a private answer accurate; it makes the exchange rate explicit, and forces someone to write down and defend a number.

5 · Privacy is spent, not set

Two thousand individually-private answers averaged to the true payroll. Composition accounting is not paperwork — it is the only thing standing between a well-behaved mechanism and no privacy at all, and refusing to answer is the correct behaviour when the budget runs out.

One thing the pictures can mislead you about

A small ε does not mean an attacker learns nothing. It means they learn little about any one person. Population-level conclusions — that this company pays engineers well — are exactly what the release is for, and if such a conclusion embarrasses someone, differential privacy neither prevents it nor claims to.

Exit challenge

Four situations this page has not shown you

The recap above lists what you watched happen. This asks whether the model travels. None of these four scenarios appears anywhere else on the page — different organisations, different queries, a release pattern the exhibits never ran — so recalling this page's wording will not get you through them. Answer without scrolling back up; each wrong answer names the one interaction that establishes what it tested.

Honest scoping

What this demo does and does not prove

This section is on both routes and nothing in it is collapsed, because a page that stages its limitations the way it stages its explanations is not being honest, it is being tidy. If you read only one paragraph of it, read this one:

The mechanisms here are real and exactly sampled, and the ε bound is computed rather than proved — over the outputs examined, which is evidence and not a theorem. Differential privacy is a statistical guarantee about an individual, not a cryptographic one and not a guarantee about a population. The payroll query is released on a coarse lattice, an approximation the panel discloses wherever it applies. And none of this is production code.

The eight cards below are that paragraph in full, one claim at a time — what is genuinely real here, what is approximated, what is offered only as a labelled counter-example, and what was never built at all.

Real here

Every noisy answer on this page comes from an exact sampler driven by crypto.getRandomValues: the discrete Laplace as a difference of two geometrics, and the discrete Gaussian by Canonne–Kamath–Steinke rejection, both using only rational Bernoulli draws. ε is an exact rational, never a float. Sensitivity is computed from a declared clamp; the e^ε bound, the exact δ, and the optimal distinguishing rate are all computed from the mechanism's own PMF. The repository's current CI run executes the full Vitest suite before it can build or deploy; that suite includes reference values for Φ to twelve digits, the Balle–Wang analytic Gaussian calibration checked against the textbook one, and the ε bound asserted at every stop on the ε ladder. The linked run is the evidence for the current pass/fail result, rather than a test count copied into this page that goes stale as coverage grows.

Not a cryptographic primitive

Differential privacy is a statistical guarantee, not a computational one. Nothing here is encrypted, and the protection holds against an adversary with unlimited computing power — but only against conclusions about an individual. It sits in this suite because obliviousness is the shared idea, not because it is cryptography.

Not proven here

No proof of the definition is offered — the bound is computed over the outputs examined, which is evidence rather than a theorem. The guessing game measures one attacker over a few dozen rounds; the ceiling beside it comes from theory, not from your score. And a demonstration that this implementation honours e^ε says nothing about whether the ε chosen is a sensible one.

The float sampler is offered, and labelled

The textbook continuous Laplace is selectable in Exhibit 4 because it is what nearly every tutorial implements. It is not the default: sampling as b·ln(u) over a double leaves artefacts that Mironov (CCS 2012) turns into a recovery attack. The discrete modes exist precisely to avoid it.

Not built: local DP, RDP, zCDP as mechanisms

This page demonstrates the global model — a trusted curator holding the raw data. Local DP (randomising on your own device) is mentioned and labelled in Exhibit 6 but not implemented; Rényi DP and zero-concentrated DP appear only in the Census conversion, where ρ is converted to ε and nothing else. Federated learning is out of scope entirely.

Not the discrete Gaussian's own accounting

σ is calibrated with the analytic Gaussian mechanism for the continuous case and the discrete sampler is run at that σ. The test suite checks that the δ needed by the discrete PMF agrees with the continuous closed form to within 10%, which is a cross-check, not a re-derivation of the CKS20 accounting.

The lattice is a real approximation

Queries with a large sensitivity are released on a coarse lattice, because an exact integer sampler at Δ = $250,000 would need minutes per draw. The true answer is rounded onto that lattice first — without that step the two neighbouring databases would have disjoint supports and no privacy at all — and the rounding is paid for with one extra step of sensitivity. The panel says so wherever it applies.

Not production

A teaching demo. No backend, no data leaves the browser, nothing is persisted. Real deployments need accountants that track privacy across sessions and users, protection against the timing and error channels this page ignores entirely, and far more care about sensitivity than a hard-coded clamp. Use a reviewed library — Google's or OpenDP — for anything real.