Epsilon in differential privacy and its trade-offs

WHAT THIS TESTS Whether you understand differential privacy's central parameter and can reason about the three-way tension between privacy strength, model utility, and the extra computation differentially private training demands.

A GOOD ANSWER COVERS Epsilon is the privacy budget. Formally it bounds the ratio of output probabilities on two datasets that differ by a single record, so a mechanism is epsilon-differentially private if no single individual's data can change the result distribution by more than a factor governed by epsilon. The crucial point is direction: smaller epsilon means stronger privacy because outputs are nearly indistinguishable whether or not any one person is included; larger epsilon means weaker privacy. In practice you implement private training with DP-SGD, which clips each per-sample gradient to a bounded norm and then adds calibrated Gaussian noise to the aggregated gradient, with a privacy accountant tracking cumulative epsilon over training. The trade-offs follow directly. A tighter privacy guarantee, smaller epsilon, requires more noise relative to the signal, which lowers model accuracy, especially for underrepresented classes. Per-sample gradient clipping breaks the usual batched gradient computation and typically requires microbatching or specialized libraries, increasing memory use and training time. So you tune epsilon, the clipping norm, and the noise multiplier to hit an acceptable accuracy at a target privacy level within a compute budget.

COMMON WRONG ANSWERS The classic error is claiming a larger epsilon gives more privacy; it is the opposite. Another is ignoring that DP-SGD's per-sample clipping materially raises compute and memory cost, or assuming privacy is free in accuracy terms.

LIKELY FOLLOW-UPS What does delta add in (epsilon, delta)-DP? How does the privacy accountant compose epsilon across steps? Why does DP disproportionately hurt rare classes?

ONE CONCRETE EXAMPLE Training a model on medical records, you target epsilon near 1 for strong protection. The required noise drops validation accuracy several points and rare conditions suffer most, while per-sample clipping doubles step time. Relaxing to a larger epsilon recovers accuracy but weakens the guarantee, forcing an explicit privacy-utility decision with stakeholders.