Chapter 36 — Privacy and data protection: performance and scale
Lesson map
Lesson 36 published. Map, example, EX106.
flowchart TD
N0["Learning outcomes"]
N1["36.1 Publishing clinic statistics"]
N2["36.2 The budget lab"]
N3["36.3 Scale effects"]
N4["36.4 Engineering the pipeline"]
N5["Lab — Splitting a yearly privacy budget across relea"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX106"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["36.1 Publishing clinic statistics"]
N2["36.2 The budget lab"]
N3["36.3 Scale effects"]
N4["36.4 Engineering the pipeline"]
N5["Lab — Splitting a yearly privacy budget across relea"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX106"]
[Learning outcomes]
|
v
[36.1 Publishing clinic statistics]
|
v
[36.2 The budget lab]
|
v
[36.3 Scale effects]
|
v
[36.4 Engineering the pipeline]
|
v
[Lab — Splitting a yearly privacy budget across relea]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX106]
Learning outcomes
You will (1) plan a differential privacy budget for repeated releases; (2) understand accuracy at scale; (3) choose release frequency.
36.1 Publishing clinic statistics
Pellmore wants to publish clinic waiting-time and diagnosis statistics for public health partners. Zara proposes differential privacy for the published counts. Dwork and Roth (2014) explain that privacy loss accumulates across releases under composition, so a yearly budget must be shared among all releases. She sets an illustrative yearly epsilon of three for a family of counts and asks how frequently Pellmore can publish while keeping useful accuracy. The question links scale and performance to privacy: more releases mean more noise per release.
36.2 The budget lab
The lab divides the yearly budget equally among releases and computes the Laplace error for a count with sensitivity one. Monthly releases get epsilon 0.25 each and a mean absolute error of 4.0 per count. Weekly releases get epsilon 0.0577 and error 17.3. Daily releases get epsilon 0.0082 and error 121.7, which would swamp most clinic counts. Zara recommends monthly publication. She explains to partners that daily figures would look precise but mostly show noise, which would mislead rather than inform public health decisions. Weekly releases spend the budget more wisely.
36.3 Scale effects
Larger counts tolerate noise better. A national total of thousands is barely affected by an error of four, while a rural clinic's count of twenty changes visibly. Zara proposes publishing at regional level for rare diagnoses and clinic level for common ones. She also explains that the budget applies per person: if each person contributes to many counts, sensitivity rises. She limits each patient's contribution per release to one count, which keeps sensitivity at one and makes the error figures in the lab valid.
36.4 Engineering the pipeline
Zara implements a release pipeline that tracks budget spent, refuses releases that would exceed the yearly budget and logs each release with its epsilon. Post-processing rounds noisy counts and replaces negative values with zero, which does not weaken the guarantee. She writes a short public note explaining the method. Prof. Holm reminds the class that implementations of differential privacy can fail through subtle bugs, such as poor random number generation, so the pipeline uses a vetted library and independent review. Seeds are never fixed in production.
Lab — Splitting a yearly privacy budget across releases
# Differential privacy budget for daily clinic dashboards: per-release epsilon and Laplace error under a yearly budget.
yearly = 3.0
for releases in [12, 52, 365]:
eps = yearly / releases
print(f"{releases:3d} releases/year: epsilon per release {eps:.4f}; mean abs error per count {1/eps:7.1f}")
Run with python3 lab_budget.py. Verified output:
12 releases/year: epsilon per release 0.2500; mean abs error per count 4.0
52 releases/year: epsilon per release 0.0577; mean abs error per count 17.3
365 releases/year: epsilon per release 0.0082; mean abs error per count 121.7
Worked example
Zara splits a yearly epsilon of 3 across releases: monthly gives error 4.0 per count, weekly 17.3 and daily 121.7, so she recommends monthly publication with regional aggregation for rare diagnoses.
Synthetic case. The budget and counts are illustrative; Dwork and Roth (2014) is real.
Errors and limits
Simple composition is conservative; advanced accounting gives tighter bounds but needs expertise.
Exercises
- EX106 — Daily error. What error would daily releases have? Rubric: 3 = 121.7 per count;; 2 = over a hundred;; 1 = wrong;; 0 = none.
- EX107 — Contribution limit. Why limit each patient to one count per release? Rubric: 3 = keeps sensitivity at one so error figures hold;; 2 = mentions sensitivity;; 1 = vague;; 0 = none.
- EX108 — Safe post-processing. Does rounding and clamping noisy counts weaken the guarantee? Rubric: 3 = no; post-processing does not weaken differential privacy;; 2 = no without reason;; 1 = yes;; 0 = none.
Synthesis
Chapter 36 plans releases at scale. Chapter 37 runs privacy in operations.
Continue studying — chapter 36 of 50
← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →