Differential Privacy in Production: The Epsilon Ledger

Q: What is differential privacy in simple terms?

Differential privacy is a mathematical guarantee that the output of an analysis changes very little whether or not any one person's data is included. It is achieved by adding carefully calibrated random noise to statistics or query answers. The strength of the guarantee is measured by epsilon, where smaller means stronger privacy and noisier results. Unlike masking or thresholds, it holds even against an attacker who has outside information about the people in the data.

Q: What does epsilon mean, and what value should we use?

Epsilon bounds the privacy loss from a release: how much any single privacy unit's data can shift the output distribution. There is no universal correct value. It only means something together with the privacy unit, the contribution bounds, the accounting period and the threat model. Set it per dataset and period with the data owner and DPO, and remember that every release spends part of it, so the total across releases is what you must justify.

Q: Why is a privacy budget ledger necessary?

Because privacy loss composes. Two releases about the same people add up, under basic composition at least as the sum of their epsilons, so a policy of a small epsilon per query says nothing about the total after hundreds of queries. A ledger records every release by dataset, privacy unit, period, epsilon, delta, mechanism and requester, computes spend with a proper accountant, and lets the query gateway refuse anything the remaining budget cannot afford.

Q: What is a privacy unit and why does it matter?

The privacy unit is the thing whose presence or absence the guarantee hides, such as one event, one user or one household. If the unit is an event but a single user contributes thousands of events, that user is not protected at the stated epsilon. Contribution bounding, capping how many rows or how much value each unit can contribute, is what makes a user-level guarantee real. Always state the unit alongside epsilon.

Q: What is the difference between central and local differential privacy?

In central differential privacy a trusted curator holds the raw data and adds noise to the outputs, which gives good accuracy for a given epsilon. In local differential privacy each device adds noise before sending anything, so the collector never sees raw values, but far more noise is needed and very large populations are required for useful results. Apple describes using local differential privacy with per-donation budgets and daily contribution limits.

Q: What is NIST SP 800-226?

NIST Special Publication 800-226, Guidelines for Evaluating Differential Privacy Guarantees, was published in March 2025. It helps organisations evaluate claims about differential privacy, presenting a differential privacy pyramid of factors to consider and cataloguing privacy hazards, the common pitfalls that arise when the mathematical framework is implemented in practice. It is a good checklist for auditing a vendor's claim or your own deployment before you state a guarantee publicly.

Q: Which libraries should we use for differential privacy?

Use a maintained, audited library rather than writing noise mechanisms yourself, because naive floating-point implementations can break the guarantee. The OpenDP library has a Rust core with Python bindings and composition tools including odometers and privacy filters. Google's differential-privacy repository provides C++, Go and Java building blocks, Privacy on Beam and PipelineDP4j for pipelines, an accounting library for tracking privacy budget, and DP Auditorium for auditing guarantees.

Q: When should we not use differential privacy?

Do not use it where exact values are required, such as billing, payroll, financial reporting or fraud investigation, because the noise is the point. Avoid it for small populations, where the noise needed to hide one person overwhelms the signal. It is pointless if analysts can reach the raw tables through a warehouse login, notebook or text-to-SQL assistant, and it does not replace data minimisation or erasure obligations under GDPR or India's DPDP Act.

Satyam Kumar

返回博客

cyber-security-patterns

Differential Privacy in Production, 2026: Epsilon Is a Budget, Not a Setting, and Deployments Fail at the Ledger, Not the Math (2026)

By Satyam KumarOctober 11, 202612 min read

differential privacy differential privacy in production privacy budget epsilon differential privacy privacy loss accounting nist sp 800-226 opendp google differential privacy library privacy on beam local differential privacy contribution bounding privacy unit dp synthetic data privacy preserving analytics gdpr dpdp anonymisation data privacy engineering 2026

Differential Privacy in Production, 2026: Epsilon Is a Budget, Not a Setting, and Deployments Fail at the Ledger, Not the Math (2026)

Frequently Asked Questions

分享这篇文章

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

人工智能和云架构师。帮助团队构建可扩展到数百万的系统。

LinkedIn GitHub

Differential Privacy in Production, 2026: Epsilon Is a Budget, Not a Setting, and Deployments Fail at the Ledger, Not the Math (2026)

Frequently Asked Questions

分享这篇文章

Comments

Leave a comment