A privacy promise stated as an inequality, not a hope: change any one record and the released answer barely moves. The engine is the Laplace mechanism — to release a query f of sensitivity Δ under ε-DP, publish f(D) + Laplace(Δ/ε). Down the center, data flows: the query and its sensitivity go in, the mechanism adds calibrated noise, the private release comes out. The blue team builds and defends it; the red team tries to break it.
source Dwork, McSherry, Nissim & Smith, Calibrating Noise to Sensitivity in Private Data Analysis, TCC 2006, LNCS 3876:265–284 — doi.org/10.1007/11681878_14. Rendered, not quoted.
The Laplace density is p(z) = e−|z|/b / (2b) with scale b = Δ/ε. Because it decays as |z|, shifting the center by up to Δ changes the log-density at every point by at most Δ/b = ε — that bound is the guarantee.
ε-DP. For adjacent datasets (differ in one record, so |f(D)−f(D′)| ≤ Δ) the ratio of output densities is ≤ eε everywhere. Composition. Two ε-DP releases together are 2ε-DP — log-ratios add. Unbiased. E[output] = f, variance 2(Δ/ε)².
Live, for the current ε and Δ:
The sphere behind the line is the-membership-inference: an attacker asks was this record in D? by comparing how likely the release is with vs. without it — a likelihood ratio.
ε-DP caps that ratio at eε, for every record and every adversary, no matter their side knowledge. The attack does not become impossible; its evidence becomes provably bounded. Privacy stated as an inequality, not a hope. Each sphere is the next one's premise.
The blue team's live check: recompute the worst-case log density ratio and the noise variance for the current setting and confirm them against the known formulas (ε and 2(Δ/ε)²). If red tampers, this badge is where it shows.
A release has three inputs: the true answer f(D) (a statistic — say a count), the sensitivity Δ (the most one record can move f), and the privacy budget ε. Adjacency d = |f(D)−f(D′)| is how far a one-record change actually pushes the answer — always ≤ Δ.
| symbol | meaning | role |
|---|---|---|
| ε | privacy budget | smaller = stronger |
| Δ | query sensitivity | sets noise size |
| b = Δ/ε | Laplace scale | the calibration |
| d ≤ Δ | one-record shift | the adjacency |
Calibrating b to Δ and ε is the whole game — and it is what you feed the panel below.
The noise is drawn with a fixed-seed PRNG, so the mechanism is honest and reproducible; resample steps the seed deterministically.
Change any control — the release and the ε-guarantee are computed from the density on the spot, never looked up.
What the machine produces, proven: a noisy answer whose distribution shifts by at most a factor eε when any one record changes. For adjacency d ≤ Δ the worst-case log density ratio is d/b ≤ ε — the mechanism is ε-DP. k releases compose to kε. The noise is unbiased; only its variance 2(Δ/ε)² is the price.
The blue team's witness (left) confirms the bound and variance live; the red team (right) tries to make the guarantee false.
Worse, the ideal is over the reals: Mironov (2012) showed a naïve floating-point Laplace sampler leaks bits and breaks DP outright. ε itself is a policy choice, not a proof — DP bounds the leak per query; it never says which ε is "private enough."
"DP makes the data anonymous — re-identification is impossible." Cut. DP bounds how much more an adversary learns from your record; it is not anonymization and forbids no inference that holds without you.
"Any added noise gives privacy." Cut. Only noise calibrated to Δ/ε. Wrong scale voids it — the tamper (window 6) is exactly this, caught live.
"ε is a privacy percentage." Kept, corrected. ε bounds a log-likelihood-ratio (factor eε), not a probability. Small ε = strong; it is unbounded above.
The red team's move: invert the calibration — scale the noise by ε/Δ instead of Δ/ε. For ε<1 the noise shrinks, the density ratio blows past eε, and the ε-DP promise is false. The blue team's witness (window 7) is watching.
Invert b to ε/Δ and the worst-case log-ratio becomes Δ²/ε — for ε<1 that exceeds ε, so the guarantee fails. The witness recomputes, disagrees with the known bound, and turns red. Nothing is faked; the attack is real and it is caught.