A limit on one person’s influence
Differential privacy is a property of an algorithm. It limits how much the probabilities of its outputs can change when one person’s data changes. Joseph Near and Chiké Abuah’s textbook explains epsilon, the privacy parameter: a smaller value requires closer output probabilities and stronger protection under that definition. It is not a percentage of records hidden. [1]
- First release: epsilon 0.4
- Second release: epsilon 0.4
- Combined bound: epsilon 0.8
Several releases need one accounting
For pure epsilon-differential privacy, a basic sequential-composition rule adds the epsilon values of releases made from the same dataset. This is an upper bound on the combined privacy cost, not necessarily an exact loss. Checking each release separately can miss the question of what they reveal together. [2]
Why this matters for AI
The same book develops differentially private machine-learning classifiers. Privacy accounting belongs to the protected training procedure, not just a claim attached to its output. A separate post-processing property says calculations using only an already protected output do not worsen its differential-privacy guarantee; a fresh private-data query is a different operation. [2] [3]
Go a little deeper
Optional reading · about 1 more minute
A small accounting example
Hypothetical example: Two releases from the same people each satisfy pure differential privacy with epsilon 0.4. The basic addition rule gives a combined epsilon bound of 0.8. This illustrates arithmetic, not a recommended privacy setting or proof that a particular real system is acceptable. [2]
Ask what the number covers
Our interpretation: A useful explanation names the protected unit, the releases included and the assumptions behind the accounting. Without that scope, “we used a privacy budget” leaves the reader unable to tell which activity the claim covers.
Original sources
Attributed synthesis, not original reporting. Examples labeled hypothetical or illustrative are explanatory. Reviewing a source does not independently validate its findings.
- Near and Abuah: differential privacy ↗
Living textbook, bibliographic year 2021; current definition chapter read in Chrome September 22, 2026. No recommended epsilon chosen.
- Near and Abuah: composition and post-processing ↗
Current chapter read in Chrome September 22, 2026; sequential-composition theorem and post-processing. Chapter revision date not established.
- Near and Abuah: private machine learning ↗
Opening and learning objectives read September 22, 2026. Scope: private classifier training; no performance claim or implemented model.
