ModelRefs / Differential Privacy — AI Glossary
Differential Privacy — AI Glossary
A mathematical guarantee limiting how much any individual training example can influence model outputs or weights. Also called DP or DP-SGD.
Overview
DP training (Abadi et al. 2016, DP-SGD) clips per-example gradients and adds calibrated Gaussian noise, providing (ε,δ)-DP guarantees. ε quantifies privacy loss: smaller ε = stronger privacy but degraded accuracy. Used by Google (BERT pretraining experiments) and Meta. Trade-off: privacy budget constrains model utility.
Reference details
| Topic | safety |
|---|---|
| Also known as | DP, DP-SGD |
| Last reviewed | 2026-06-24 |
Related terms
Example: What ε actually promises
The guarantee bounds how much any single record can shift the distribution of outputs: the ratio of probabilities between the dataset with your record and without it is at most e^ε. At ε = 1 that ratio is about 2.7 — an observer's belief about whether you were in the data can barely move. At ε = 8, a value that appears in real deployments, e^8 is roughly 2,981. Formally that is an extremely weak bound. Empirical protection is usually far better than the worst case, but the number quoted in a compliance document is the worst case, and readers rarely exponentiate it.
Commonly confused with
Differential privacy is not anonymisation and not PII detection. It is a property of the algorithm that produced an output, not of the output text. Stripping names from a corpus gives no ε; training with DP-SGD gives an ε that holds even against an adversary who knows every other record.
When to use it
Reach for it when:
- Training or fine-tuning on records where individual membership is itself sensitive
- You need a stated, auditable guarantee rather than a best-effort claim
- Aggregate statistics and telemetry, where the noise cost is small relative to the signal
Reach for something else when:
- Small datasets — the noise required overwhelms the signal
- As a substitute for access control, retention limits or deletion rights
- When ε is chosen to make the accuracy acceptable rather than the privacy meaningful
Primary source
Continue your research
Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to Differential Privacy — AI Glossary.
Frequently asked questions
What is Differential Privacy?
A mathematical guarantee limiting how much any individual training example can influence model outputs or weights.
Is Differential Privacy the same as DP?
Yes — DP, DP-SGD are common aliases for Differential Privacy.
What concepts are related to Differential Privacy?
Closely related concepts include membership inference, federated learning, pii detection.