Differential Privacy Simulation: Laplace Mechanism for Resident Recycling Rebate Statistics

Differential Privacy Release

Privacy budget ε 1.00

District size N 800

True count

–

Latest release

–

Noise scale b=1/ε

–

Releases so far

Mean abs. error

–

Within ±5 of truth

–

How it works

Each dot below is one resident of a synthetic district; amber dots are enrolled in a municipal recycling-rebate program. The city wants to publish the enrollment count without ever revealing whether any single resident is enrolled. The Laplace mechanism does this by adding noise drawn from a Laplace distribution to the true count before release:

released = trueCount + Lap(b),  b = Δf / ε
Δf = 1  (one resident joining/leaving changes the count by exactly 1)
Lap(b) sampled as: -b·sign(u)·ln(1-2|u|), u ~ Uniform(-0.5, 0.5)

ε (epsilon) — the privacy budget. Smaller ε means more noise (b = 1/ε grows), stronger privacy, and a less accurate release. Larger ε leaks more information about individuals but is more useful statistically.
Sensitivity Δf = 1 — a count query's worst-case change from adding or removing one record; it is what calibrates how much noise is mathematically required for ε-differential privacy, not a guess.
Run 400 releases — draws 400 independent fresh noise samples at the current ε and rebuilds the histogram, so the accuracy numbers are the real empirical spread of an honest Laplace mechanism, not a canned figure.
Mean absolute error — over many releases, converges to the Laplace distribution's expected |noise| = b, which you can watch happen live as ε changes.

Real-world relevance: this is the same mechanism (Laplace noise calibrated to query sensitivity, governed by an epsilon privacy budget) that statistical agencies including the U.S. Census Bureau use to publish aggregate counts from sensitive administrative and survey data without disclosing any individual's record.

Enrolled resident Not enrolled Noisy releases (histogram) True count

Differential Privacy: Releasing a Government Statistic Safely