How Much Could One Person Change This Statistic?

A Privacy Claim Needs a Neighbouring-Dataset Definition

BOTIE

Publishing a statistic can reveal something about a person even after their name is removed. Researchers studying statistical databases therefore needed a privacy claim about what changes when one person’s information changes. Dwork, McSherry, Nissim and Smith’s 2006 work connected the random noise used in a release to the sensitivity of its calculation: the greatest effect one allowed contribution can have.

Differential privacy concerns the behaviour of the randomised release across those neighbouring datasets. The neighbouring-dataset definition matters before we choose noise. Here the participant count is fixed and public, and one person has one bounded value that may be replaced. We will calculate the mean’s resulting influence bound. The exact teaching mean is still an exact disclosure; bounding it alone does not make it a private release.

Sources for this history

Removing Names Does Not Make Every Report Private

Botie reports the average number of support requests per person. A user’s name is absent, but an unusual contribution can still shift the result substantially. Releasing several related aggregates can reveal more than one report suggests.

Differential privacy starts with a precise question: how much can the output change when one person’s contribution changes? We will calculate that bound before discussing a randomised release.

Exact teaching outputs, not private releases. Fixed public n, one contribution per person, replace-one adjacency.

Step 1 of 1

Bound one contribution before averaging

Each person contributes one value, clipped to [0,10].

Clipping limits influence but does not itself provide differential privacy.
Person	Raw count	Clipped
A	2	2
B	4	4
C	100	10

A
Raw count
2
Clipped
2
B
Raw count
4
Clipped
4
C
Raw count
100
Clipped
10

Clipping limits influence but does not itself provide differential privacy.

Define the protected unit

Sensitivity follows the declared contribution bounds and fixed count.

Bound one person’s influence on a report

A single extreme contribution dominates an ML service aggregate.

BOTIE

A single extreme contribution dominates an ML service aggregate.

Choose an example

One contribution per person

1

2

Public lower bound

Public upper bound

Clipped mean and replacement sensitivity

03
15

Follow the operations

1. One contribution per person
1. 02
2. 14
2. Public lower bound
```
0
```
3. Public upper bound
```
10
```
4. Limit a numerical range
1. 02
2. 14
5. Mean
```
3
```
6. Subtract
```
10
```
7. Count items
```
2
```
8. Divide
```
5
```
9. Collect two results
1. 03
2. 15
10. Result
1. 03
2. 15

Exact teaching outputs, not private releases. Fixed public n, one contribution per person, replace-one adjacency.

1. Define the protected unit

Here one person contributes exactly one bounded value and the number of people is fixed and public. Imagine two versions of the table with the same number of people. Every row agrees except one person’s bounded value. These are neighbouring datasets under the replacement rule used here.

If a person contributes many rows, first define and enforce a per-person contribution bound. Row-level protection is not automatically person-level protection.

The dataset’s shape, grouping and count can themselves carry information. Our assumptions must be stated, not silently inherited.

2. Find the greatest change to the mean

The largest possible replacement changes a contribution from the lower bound to the upper bound. Division by the fixed count gives the mean’s maximum change.

bounds = [0,10], n = 3
clipped mean = (2 + 4 + 10) / 3 = 16 / 3
replace-one sensitivity = (10 - 0) / 3 = 10 / 3

This sensitivity bound depends on fixed n and replacement adjacency. It is not the same formula for every mean-release design.

Bounding changes the statistic too

An extreme value is replaced by the public upper bound.

Python

import numpy as np
print(np.clip([2,4,100],0,10).tolist())

Output

[2, 4, 10]

The clipping step introduces bias relative to the raw mean. It bounds contribution without making the exact output private.

Check yourself

What exactly may one person change?

Question 1 of 2

What is mean sensitivity?

Use the information below.

Fixed public n=4, one value per person, bounds [0,8], replace-one adjacency.

3. Clipping is not the private release

The exact clipped mean still reveals information. A correctly configured Laplace mechanism can add noise with scale equal to sensitivity divided by epsilon for this scalar query and adjacency.

Epsilon describes a privacy guarantee, not a probability that a person is exposed. Repeated releases consume a combined privacy budget; averaging many noisy releases can defeat a policy that ignores composition.

Use a vetted privacy library and review the complete release. This lesson deliberately does not implement a production privacy mechanism or use a fixed random seed for private releases.

4. Measure utility under the declared bounds

Clipping introduces bias when true contributions exceed the bounds. Noise adds uncertainty. Pick bounds independently of private data or account for how they were selected.

Evaluate whether the released statistic remains useful for the ML monitoring decision. A precise-looking number without its uncertainty can mislead operators.

The workshop outputs an exact teaching mean and sensitivity. Neither output should be described as a differentially private publication.

5. A privacy budget follows the whole release process

A dashboard that publishes a private mean every minute has made many releases. Simple composition adds epsilon values for pure differential privacy, though more refined accounting may apply to a particular mechanism and interaction pattern.

Private selection of bounds, group membership or which result to display can also consume budget. Review the complete process, including retries and repeated queries, using an appropriate vetted accountant.

This is why the workshop stops at a sensitivity calculation. A random number added to a statistic is not by itself a complete privacy argument.