Differential Privacy — AI Glossary

Reference details

Related terms

• Membership Inference Attack
• Federated Learning
• PII Detection

How it works

1. Gradients are computed per example rather than per batch, which is the step that makes any individual record's contribution identifiable and therefore boundable.
2. Each per-example gradient is clipped to a fixed norm, so no single record can move the weights more than that bound however unusual it is.
3. Noise drawn from a Gaussian scaled to that same bound is added to the summed gradients before the optimiser step, which is where the guarantee comes from.
4. A privacy accountant then composes the cost of every step across the whole run, because each access to the data spends part of the budget and the total is what the final figure reports.
5. Per-example gradients are the expensive part: they cannot be batched the usual way, so training is run in microbatches and the throughput cost is substantial rather than marginal.
6. The reported epsilon is a property of the clipping bound, the noise scale and the step count together — changing any of them changes the guarantee, which is why it cannot be chosen after the fact to fit a target.

Example: What ε actually promises

The guarantee bounds how much any single record can shift the distribution of outputs: the ratio of probabilities between the dataset with your record and without it is at most e^ε. At ε = 1 that ratio is about 2.7 — an observer's belief about whether you were in the data can barely move. At ε = 8, a value that appears in real deployments, e^8 is roughly 2,981. Formally that is an extremely weak bound. Empirical protection is usually far better than the worst case, but the number quoted in a compliance document is the worst case, and readers rarely exponentiate it.

Commonly confused with

Differential privacy is not anonymisation and not PII detection. It is a property of the algorithm that produced an output, not of the output text. Stripping names from a corpus gives no ε; training with DP-SGD gives an ε that holds even against an adversary who knows every other record.

When to use it

Reach for it when:

• Training or fine-tuning on records where individual membership is itself sensitive
• You need a stated, auditable guarantee rather than a best-effort claim
• Aggregate statistics and telemetry, where the noise cost is small relative to the signal

Reach for something else when:

• Small datasets — the noise required overwhelms the signal
• As a substitute for access control, retention limits or deletion rights
• When ε is chosen to make the accuracy acceptable rather than the privacy meaningful

Primary source

• Abadi et al., Deep Learning with Differential Privacy (arXiv)

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Differential Privacy — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path