Differential privacy, epsilon, and noisy aggregates

What's really being asked

This checks whether you grasp differential privacy as a mathematical guarantee about the mechanism, not a property of a dataset, and whether you can correctly calibrate noise to sensitivity and epsilon.

The full answer

Differential privacy guarantees that the output of a computation is almost unchanged whether or not any single individual's record is included. Formally, for any two datasets differing in one record, the probability of any output changes by at most a multiplicative factor of e to the epsilon. This means an adversary observing the result cannot confidently tell if a given person participated, which protects individuals even against attackers with arbitrary side knowledge, unlike k-anonymity. Epsilon is the privacy budget: a small epsilon adds more noise and gives strong privacy at the cost of accuracy, while a large epsilon adds little noise and gives weak privacy with high accuracy. The budget composes, so each query spends some epsilon and the total spent across queries is bounded. The mechanism adds random noise calibrated to the query's sensitivity, the maximum amount one record can change the output, divided by epsilon. For a count, sensitivity is one; for an average you bound salaries to a known range to make sensitivity finite.

A GOOD ANSWER COVERS the pseudocode in prose: define dp_average(salaries, epsilon, lower, upper). Clip each salary to the range lower to upper. Compute the true sum and the count n. Sensitivity of the sum is upper minus lower. Add Laplace noise with scale equal to sensitivity divided by epsilon to the sum, and add Laplace noise with scale one over epsilon to the count. Return the noisy sum divided by the noisy count.

The mistakes people make

Confusing DP with anonymization or k-anonymity. Adding noise without scaling it to sensitivity, which breaks the guarantee. Forgetting to clip salaries, leaving unbounded sensitivity. Ignoring that repeated queries deplete the budget.

What usually comes next

Why must you bound the salary range? How does the budget compose across many queries? What is the difference between local and central DP?

A concrete example

With epsilon set to one and salaries clipped to zero through five hundred thousand, you compute the true average, then add Laplace noise of scale five hundred thousand to the sum and small noise to the count before dividing. An analyst sees an average close to the truth, but no one can determine whether any specific employee was in the table.