Wiki · Translation · concept
Differential privacy
A mathematical guarantee that a result barely changes whether or not any one person's data was used.
Differential privacy is a formal promise about what a computation can leak. It guarantees that the output — a statistic, a trained model, a query answer — looks almost the same whether or not any single person’s record was included. If no one result depends much on you, then no one can reverse-engineer you out of it. The guarantee is mathematical, not a policy or a hope: it holds against any attacker, no matter what side information they already have.
How it works
The trick is calibrated noise. Before releasing a result, you add a carefully sized dose of randomness — enough to blur any single person’s contribution, but not so much that the overall signal disappears. How much you add is set by a knob called ε (epsilon), the privacy budget: small ε means more noise and stronger privacy; large ε means less noise and more accuracy. Every query you answer spends from that budget. The intuition is plausible deniability — because the output could have come from many different datasets, no one can point to your data as the reason for it.
Why it matters (for bio × AI)
Health and genomic data are among the most sensitive that exist, and also among the most valuable to train on. Differential privacy lets you train a model on real patient records while carrying a provable bound on what any individual reveals — useful for EHR foundation models and for federated learning settings where data never leaves the hospital. The honest tension: privacy has a cost. Stronger guarantees mean more noise, and that noise lands hardest on small or rare subgroups — exactly the patients where a wrong answer matters most. DP makes the trade-off explicit; it doesn’t make it free.
Related
See federated learning for training across data that stays in place, a setting where differential privacy is often layered on top.