Private aggregate releases: sensitivity, budget and query control

Last updated: 5 Oct 20265 min read

tutorial

A private-release design needs bounded input influence, an approved mechanism and accounting for every disclosed result.

Separate clipping from release

Contribution bounding sets how much one protected unit can change a statistic; it is not the final release. A mechanism may add calibrated randomness under a defined privacy guarantee, but the guarantee depends on the protected unit, sensitivity, mechanism, parameters and all earlier releases. The contribution contract must be reviewed before any budget number is meaningful.

Track composition

Repeatedly querying the same underlying population can spend additional privacy budget, even when each result looks harmless. Register each approved query with a purpose, dataset version, protected unit, mechanism, budget cost and release ID. Do not answer an unregistered analyst query and then add its cost to the ledger afterward. Releasing the same already-approved noisy result again is different from drawing a fresh answer.

Protect small groups

A group with very few learners may produce a noisy but still misleading or unstable statistic. Combine formal accounting with product rules for minimum support, output review and a clear uncertainty statement. Do not treat a group-size threshold alone as a mathematical privacy guarantee. Suppression decisions themselves can reveal information if they depend on sensitive counts without a designed mechanism.

Rehearse the ledger

Give a weekly completion dashboard an approved budget of 1.2 units under its chosen accounting model. Reserve 0.35 for one release and 0.40 for another; a third request costing 0.50 must be rejected because the total would exceed 1.2. This arithmetic ledger is only a control-plane illustration, not a complete differential-privacy implementation.

Implementation

def reserve_release_budget(spent, requested, approved_limit):
    if requested <= 0 or spent < 0 or approved_limit <= 0:
        raise ValueError("invalid budget state")
    if spent + requested > approved_limit:
        return None
    return spent + requested

Performance and operating cost

A ledger reservation is O(1) time and space, but concurrent requests require an atomic transaction. The code does not implement a privacy mechanism; production guarantees need reviewed sensitivity, randomness and composition accounting.

Common Mistakes

Do not claim clipping or minimum group size alone proves differential privacy.
Do not issue fresh noisy answers outside the release ledger.
Do not treat a bookkeeping function as a privacy guarantee.