Differential privacy and accounting

Choose adjacency first: adding or removing one record, replacing one record, or adding or removing all records belonging to one person. These are different guarantees. A person with many records may receive weak protection if the accounting only treats each record as a separate participant. Specify the unit, contribution bounds, public information, and which outputs are released, including model checkpoints, evaluation reports, and intermediate statistics.

For neighboring datasets, differential privacy bounds event probabilities across the mechanism's randomness. Epsilon controls a multiplicative comparison and delta an additive relaxation. Delta is not generally the chance that a particular person is exposed, and epsilon is not a percentage of privacy lost. A useful policy interprets these parameters with the protected population, use case, and cumulative release process rather than relying on a universal safe threshold.

Sensitivity measures the largest change in a query across neighboring datasets. For an add-or-remove neighboring relation and a sum of contributions clipped into zero through one, absolute sensitivity is one. Adding Laplace noise with scale sensitivity divided by epsilon gives pure differential privacy for that scalar release. This statement assumes correct clipping, independent appropriate randomness, and the exact query; it does not automatically cover an unbounded mean with a private denominator.

DP-SGD follows the same influence-control principle with per-example or per-user gradient clipping and calibrated random noise. Sampling scheme, clipping unit, noise multiplier, number of steps, and accountant all matter. Clipping only the already-averaged gradient is a different operation and generally does not bound each person's influence as required. Use a validated implementation and accountant, then test that logging and checkpoint publication do not bypass the intended mechanism.

Basic sequential composition adds epsilon and delta across mechanisms applied to overlapping protected data, including adaptively chosen mechanisms satisfying their conditional guarantees. Stronger accounting can provide tighter bounds for specific mechanisms. Do not add per-step values from incompatible accountants or claim privacy amplification without the required sampling assumptions. Independent datasets may support a parallel-composition argument only when the protected individuals are disjoint in the relevant sense.

Hyperparameter searches and decisions based on private validation can consume privacy too. Releasing a postprocessed function of an already private output does not add privacy loss by itself, provided it uses no additional private data. Maintain a release ledger and establish a stopping policy before experiments. Utility testing remains necessary: a formally private mechanism can still produce inaccurate or unfair results, and formal privacy cannot remedy data collection that was inappropriate in the first place.