Define the protected unit and neighboring datasets

Add/remove record adjacency compares datasets differing by one included record. Replacement adjacency compares equal-size datasets where one record is replaced. User-level add/remove adjacency removes all contributions belonging to one user under a declared identity policy. These relations are not interchangeable, even when they use the same raw table. Define whether public metadata such as an enrollment roster or a padded capacity is fixed across neighbors, and identify which actual participation information is included in the mechanism’s observable transcript.

For every ordered neighboring pair and measurable output event, the probability inequality must hold. Epsilon is a dimensionless multiplicative-loss parameter and delta is additive slack in that inequality. Delta should not be casually described as the probability that a particular person’s data is exposed. The guarantee limits distributional dependence; it does not promise that no sensitive population fact can be inferred. Encryption, access control and statistical privacy address different observations and can be needed together.

Suppose each independent record contributes a vector with Euclidean norm at most C and the query sums those vectors. Adding or removing one contribution changes the sum by at most C. Replacing one contribution by another changes it by at most 2C, because the two bounded vectors can point in opposite directions. These are worst-case bounds for this sum, not a rule that every scalar query has a factor-two difference. A correctness indicator in [0,1], for example, changes by at most one under replacement.

If a user contributes several clipped records, removing that user can remove several bounded vectors. Record clipping therefore does not itself bound the entire user contribution by C. One option is a public cap on records per user plus an appropriate group analysis; another is aggregating and clipping one whole user contribution. Identity linkage matters: treating two devices owned by the same person as unrelated privacy units does not establish a person-level claim. State the intended unit before selecting the sampler and accountant.

Pure add/remove record-level epsilon-DP implies a k-epsilon group bound for datasets differing by at most k record additions or removals, by chaining neighboring datasets. That can give a user-level bound when every user has a proven contribution cap k, but it is weaker than the original epsilon claim. Approximate DP also accumulates delta through a group theorem, so merely multiplying epsilon and leaving delta unchanged is not generally valid. Without a bounded group size, no fixed small user-level budget follows from this simple translation.

The vectors lab can illustrate the sensitivity geometry. Reset and set both angle 0° and magnitude 2; predict vector (2,0). Separately Reset and set both angle 180° and magnitude 2; predict (-2,0). Their difference has norm four, while either vector alone has norm two. The instrument draws one deterministic vector at a time and performs no neighboring-dataset comparison or privacy accounting. Use the paper subtraction to distinguish removal from replacement, not to assign epsilon to a real learning system.