Differential Privacy Attack Lab

Target

Selected person

#—

Differential privacy

Privacy budget ε 1.00

Lower ε → more noise → stronger privacy, weaker precision. Higher ε → less noise.

Attack

Result

Run an attack to begin

True value

—

Inferred value

—

Attack error

—

Aggregate accuracy

True avg (all N)

—

Published avg

—

Aggregate error

—

The whole-population average stays close to the truth even with noise on — only the single-person subtraction attack is defeated.

low income mid high income target

Query A = avg(income | all N people) · Query B = avg(income | all N people EXCEPT target)
Attacker computes: target ≈ N·A − (N−1)·B