Skip to content

AI Glossary · Governance & compliance

What is Differential Privacy?

Differential Privacy

Differential privacy is a mathematical guarantee that the result of an analysis barely changes whether or not any one person's data is included, so, with a small enough privacy parameter, the output reveals little about any individual. How much protection it gives depends on that parameter and on what counts as one person's data.

Also known as: differentially private, DP

· Updated · Chain of Thought

AI SecurityModel Training

  • 1 explainer
  • 1 episode
  • 1 guest clip
  • 3 sources

The usual technique is to add carefully calibrated random noise. Suppose a hospital publishes how many patients in a county have diabetes. If the exact count changes by one when a single person joins the dataset, a determined attacker comparing releases could learn that person’s diagnosis. With differential privacy, the published number has noise added so the answer looks essentially the same with or without any one person, while staying accurate in aggregate. A setting usually called epsilon, the “privacy budget,” controls the trade-off: less noise means more accuracy and less privacy, and every additional query spends some of the budget.

In episode 22 at 38:58, Databricks’ Denny Lee explains “differential privacy in its most simplistic form” as privacy-preserving histograms for aggregate queries, using a diabetes-count example, after tracing the idea back to research on re-identifying people from supposedly anonymous data. Galileo sponsored the show at the time; Conor mentions the company in the episode at this point.

The best-known large deployment is the U.S. Census Bureau’s use of a differential-privacy framework for 2020 Census data; as of October 24, 2026, its page says it is evaluating alternatives after a Commerce Department order prohibiting noise infusion. For AI teams, the technique also appears in training (to limit what a model memorizes about individuals) and in analytics on user data. Editorially, it complements rather than replaces PII redaction: redaction removes obvious identifiers, while differential privacy limits what can be inferred from what remains. It also bears on synthetic data, which is not automatically private.

Hear it from the guest

“Differential privacy in its most simplistic form in terms of privacy preserving histograms”

Quotes lightly edited to remove filler words.

Sources

Go deeper

From the conversation