Differential Privacy is a mathematical framework providing provable privacy guarantees by adding carefully calibrated noise to data queries or model outputs, ensuring that the presence or absence of any single individual’s data has negligible impact on analysis results. The epsilon (ε) parameter quantifies the privacy budget, with smaller values indicating stronger guarantees.
Semantic Classification
Content
Compositional Relationships (Components)
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:LaplaceМechanism))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:GaussianMechanism))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:ExponentialMechanism))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:PrivacyBudgetManagement))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:CompositionTheorems))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:RenyiDifferentialPrivacy))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:DPStochasticGradientDescent))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:LocalDifferentialPrivacy))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:hasPart ai:ShuffleModel))
Dependency Relationships
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:requires ai:SensitivityAnalysis))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:requires ai:NoiseCalibration))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:requires ai:PrivacyAccountant))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:requires ai:QueryMechanism))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:dependsOn ai:ProbabilityTheory))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:dependsOn ai:InformationTheory))
Capability Relationships
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:PrivacyPreservingMachineLearning))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:PrivacyByDesign))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:FederatedLearning))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:DifferentiallyPrivateAnalytics))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:SyntheticDataGeneration))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:enables ai:PrivateEmpiricalRiskMinimisation))
Implementation Relationships
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:implements ai:PrivacyMechanism))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:implements ai:FormalPrivacyGuarantee))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:implements ai:StatisticalDisclosureLimitation))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:supports ai:GDPRCompliance))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:supports ai:DataMinimisation))
Reduction Relationships
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:reducesTo ai:EpsilonDPGuarantee))
SubClassOf(ai:LocalDifferentialPrivacy
ObjectSomeValuesFrom(ai:reducesTo ai:DifferentialPrivacy))
SubClassOf(ai:RenyiDifferentialPrivacy
ObjectSomeValuesFrom(ai:reducesTo ai:DifferentialPrivacy))
SubClassOf(ai:DPStochasticGradientDescent
ObjectSomeValuesFrom(ai:reducesTo ai:DifferentialPrivacy))
SubClassOf(ai:ShuffleModel
ObjectSomeValuesFrom(ai:reducesTo ai:DifferentialPrivacy))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:contrastsWith ai:KAnonymity))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:contrastsWith ai:DataAnonymisation))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:relatedTo ai:HomomorphicEncryption))
SubClassOf(ai:DifferentialPrivacy
ObjectSomeValuesFrom(ai:relatedTo ai:FederatedLearning))
About
Differential Privacy (DP) is the gold-standard formal framework for reasoning about the privacy of individuals in statistical datasets and Machine Learning models. The central idea is elegantly simple: add enough random noise to query outputs or model updates so that no adversary, regardless of their side information or computational power, can determine with confidence whether any given individual’s record was included in the dataset. The mathematical guarantee takes the form of a bound on the “privacy loss” random variable, quantified by the epsilon (ε) parameter. When ε is small — ideally below 1.0 — the mechanism provides very strong protection, meaning the output distributions on neighbouring datasets (differing by exactly one person’s record) are nearly indistinguishable. When ε is larger, the distributions are more separable and individual contributions become detectable.
The framework was introduced by Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith at TCC 2006 and formalised in subsequent foundational works. In the decade following the original paper, the theory matured substantially: the smooth sensitivity framework handled data-dependent queries; the exponential mechanism extended DP to arbitrary output spaces; and the composition theorems — both basic and advanced — provided accountants for multi-query pipelines. A decisive practical advance came in 2016 when Abadi et al. proposed DP-SGD, the first scalable algorithm for training deep neural networks under DP guarantees, by clipping per-sample gradients to bound their L2 sensitivity and injecting Gaussian noise before aggregating across a mini-batch. This unlocked differentially private deep learning as a mainstream technique.
The period 2020–2026 has seen DP transition from theoretical framework to production infrastructure. The U.S. Census Bureau deployed DP for the U.S. Census 2020, applying the TopDown algorithm with a carefully negotiated global ε that balanced statistical accuracy across geographic hierarchies against population-level privacy. Apple deployed count-mean sketch and RAPPOR-derived local DP mechanisms for iOS keyboard analytics and Safari telemetry. Google’s Gboard keyboard training adopted DP-SGD with published ε = 8.9 per round. Meta deployed DP-based analytics for aggregated ad measurement. The PyTorch ecosystem received the Opacus library (Meta AI Research), providing a production-grade DP-SGD implementation with Rényi DP accounting and automatic per-sample gradient hooks. By 2025, the NHS and UK academic medical centres were actively exploring DP for federated analysis of Electronic Health Record (EHR) data, supported by GDPR Article 89 research exemptions and the new UK Data (Use and Access) Act 2025 which entered force on 19 June 2025.
Mechanisms and Mathematical Foundations
The four canonical noise mechanisms implement differential privacy through distinct approaches to randomisation:
-
Laplace Mechanism: Adds noise drawn from Laplace(0, Δf/ε) where Δf is the L1 sensitivity of the query function f. Optimal for scalar and low-dimensional numeric queries. Achieves pure ε-DP (δ = 0).
-
Gaussian Mechanism: Adds noise drawn from N(0, σ²) where σ is calibrated to L2 sensitivity and the (ε, δ) parameters. Standard choice for Deep Learning and high-dimensional queries because Gaussian noise composes more cleanly under Rényi divergence accounting.
-
Exponential Mechanism: Selects an output o with probability proportional to exp(ε × u(D, o) / 2Δu), where u is a utility scoring function. Essential for non-numeric tasks such as query selection, hyperparameter optimisation, and model selection under DP.
-
Report Noisy Max / Sparse Vector Technique: Efficient mechanisms for answering many threshold queries while consuming minimal privacy budget, foundational to differentially private data release tools.
Sensitivity is the maximum change in query output caused by adding or removing one record. Global sensitivity provides a worst-case bound; local sensitivity is tighter but data-dependent, requiring smooth sensitivity frameworks for safe use. The choice of sensitivity definition directly governs noise scale and thus the utility-privacy trade-off.
Composition Theorems formalise privacy budget accumulation. Basic sequential composition states total ε = Σεᵢ over k mechanisms. Advanced composition (Dwork et al. 2010) achieves O(√k log(1/δ)) growth. Rényi Differential Privacy (Mironov 2017) further tightens bounds by tracking privacy loss at all orders of the Rényi divergence, enabling near-optimal accounting in DP-SGD training over thousands of steps. Zero-Concentrated DP (zCDP) provides another tight accounting framework with similar practical benefits.
Local Differential Privacy eliminates the need for a trusted curator by applying randomisation client-side. Each user perturbs their data before submission, and the aggregator sees only the noisy outputs. Mechanisms include Randomised Response (Warner 1965), the RAPPOR protocol (Google, 2014), and the Hadamard-based heavy hitters mechanisms. The principal limitation of LDP is that noise must be injected without access to the true global distribution, resulting in dramatically higher noise levels — typically ε_LDP ≈ √n × ε_central — requiring very large user populations for accurate statistics.
The Shuffle Model (Erlingsson et al. 2019; Balle et al. 2019) bridges LDP and central DP: users apply LDP-style randomisation, but all messages pass through an anonymising shuffler before reaching the analyser. The shuffler’s anonymity amplifies privacy by a factor depending on the number of participants, achieving accuracy close to central DP without a trusted curator. Shuffle DP has seen active theoretical development through 2025, with tight accounting bounds now established for common mechanisms including the Shuffle Gaussian mechanism.
Components / Architecture of DP Systems
A practical differentially private system for machine learning comprises five components working in concert:
-
Query Mechanism Layer: Translates high-level analytics or model training objectives into concrete noise-injection calls (Laplace, Gaussian, exponential). Determines sensitivity.
-
Privacy Accountant: Tracks cumulative privacy loss across all queries or training steps. Implementations include moment accountant (Abadi et al. 2016), Rényi DP accountant (Mironov 2017), Gaussian DP accounting (Dong et al. 2022), and f-DP frameworks. The Opacus library’s PRV accountant applies numerical Fourier-space composition for near-exact bound tracking.
-
Privacy Budget Management: Allocates ε across queries, model versions, and data refreshes. In production ML systems, budget exhaustion necessitates either refreshing the privacy guarantee with new data or discontinuing training.
-
Data Processing Pipeline: Handles micro-batch sampling (Poisson or fixed mini-batch), per-sample gradient clipping at norm C in DP-SGD, and compatibility with Federated Learning aggregation protocols.
-
Auditing and Certification Layer: Empirically tests DP implementations via privacy auditing attacks (Jagielski et al. 2020; Steinke et al. 2023), which attempt to distinguish mechanism outputs on adjacent datasets and measure the empirical privacy loss. The 2026 paper “Privacy in Theory, Bugs in Practice” documented implementation bugs in several DP libraries that allowed privacy loss beyond theoretical bounds, underlining the importance of this layer.
DP-SGD: Differentially Private Deep Learning
DP-SGD (Abadi et al. 2016) is the foundational algorithm enabling Neural Network training under differential privacy. The algorithm proceeds as follows:
- Sample a Poisson mini-batch B ⊆ D with probability q = L/n (batch size L, dataset size n).
- Compute per-sample gradients ∇ℓ(θ; xᵢ) for each xᵢ ∈ B.
- Clip each gradient: g̃ᵢ = gᵢ / max(1, ‖gᵢ‖₂/C) to enforce L2 sensitivity C.
- Add Gaussian noise: g̃ = (1/L)(Σ g̃ᵢ + N(0, σ²C²I)).
- Update parameters: θ ← θ − η × g̃.
- Accumulate privacy cost (ε, δ) using the moment accountant.
The privacy-utility trade-off in DP-SGD is primarily governed by three factors: (1) the clipping norm C and noise multiplier σ (lower σ/C improves utility but increases ε per step); (2) the sampling ratio q (subsampling amplifies privacy by approximately 1/q); and (3) the number of training steps (more steps consume more budget). Research by Google in 2023–2024 established that DP-SGD becomes more practical at larger model scales: the relative accuracy degradation at ε = 8 decreases from ~15% for small models to ~2–5% for billion-parameter models, making DP fine-tuning of Large Language Models increasingly viable.
The Opacus library (Meta AI Research, 2021–2025) provides a production-grade PyTorch implementation of DP-SGD with support for Rényi DP accounting, PRV accountant, gradient accumulation, mixed precision, and compatibility with distributed data parallel training. Flower (Beutel et al. 2022) and TensorFlow Privacy extend DP-SGD to Federated Learning pipelines where each client trains locally and sends clipped, noised gradient updates to a federated server.
Use Cases / Major Deployment Families
National Statistical Databases: The U.S. Census Bureau’s 2020 Decennial Census deployed DP via the TopDown algorithm, setting a precedent for national-scale DP deployment. The approach applies hierarchical ε allocation across geographic levels (national, state, county, tract, block), balancing accuracy for large geographies against privacy loss for small populations. The total ε budget was set at 19.61 for the person-level file, generating significant academic debate about appropriate ε thresholds for democratic data.
Technology Product Telemetry: Apple’s iOS and macOS systems have employed LDP since 2016 to collect emoji usage frequencies, Safari crash information, and keyboard usage patterns without transmitting raw user data to Apple servers. Google’s Chrome browser uses RAPPOR for browser configuration telemetry. These deployments collectively protect billions of users whilst feeding product improvement analytics.
Machine Learning Model Training: Google’s Gboard mobile keyboard model is trained with DP-SGD (ε = 8.9 per round), demonstrating that next-word prediction of high quality is achievable under DP constraints. DeepMind and NHS England research collaborations have explored DP-SGD for training medical AI on EHR data, with 2025 npj Digital Medicine research showing clinically acceptable performance at moderate ε ≈ 10 in medical imaging tasks, though strict ε ≤ 1 regimes cause significant accuracy loss particularly on small or heterogeneous datasets.
Federated Learning Integration: DP is the standard privacy amplification mechanism in Federated Learning systems, where it is combined with Secure Aggregation to provide both semantic privacy (no individual gradient is readable) and formal DP guarantees. The 2024 “Belt and Brace” paper (arXiv:2404.18814) synthesised the composition of federated learning and DP, showing that ε can be amplified by the number of participating clients under Poisson subsampling.
Differentially Private Synthetic Data: Google’s Differentially Private Data Generator (DP-GAN) and systems such as MST (McKenna et al. 2021) and AIM generate Synthetic Data that statistically resembles real datasets whilst providing DP guarantees on the generation process. The NIST Differential Privacy Synthetic Data Challenge (2018–2020) benchmarked these approaches and spurred rapid progress.
Digital Twin and Healthcare Analytics: NHS Digital has explored DP for aggregated reporting on patient cohorts, enabling research analytics on Digital Twin representations of population health without exposing individual records. DP-based anonymisation supports compliance with the NHS Data Security and Protection Toolkit and, since June 2025, the UK Data (Use and Access) Act.
Academic Context
The intellectual lineage of differential privacy extends through statistical disclosure limitation research from the 1970s (Dalenius 1977), through randomised response (Warner 1965), through the database privacy literature of the 1990s. The formal definition crystallised at TCC 2006 in Dwork, McSherry, Nissim, and Smith’s paper “Calibrating Noise to Sensitivity in Private Data Analysis.” The 2008 CCS paper “Mechanism Design via Differential Privacy” introduced the exponential mechanism. The 2010 FOCS paper by Dwork et al. on advanced composition established the √k scaling law. The 2014 paper by Bassily, Smith, and Thakurta formalised private empirical risk minimisation. Abadi et al.’s 2016 CCS paper on DP-SGD and the moments accountant enabled deep learning applications. Mironov’s 2017 IEEE S&P paper introduced Rényi DP. Wang et al. (2017) extended DP to local DP algorithms. The 2019–2021 period saw the shuffle model formalised by Erlingsson, Feldman, Mironov, Raghunathan, Ramchandran, and Talwar; and by Balle, Bell, Gascón, and Nissim independently. By 2024, the field had achieved near-optimal accounting via PRV accountant (Gopi et al. 2021) and the Gaussian DP framework (Dong, Roth, and Su 2022), and the empirical privacy auditing paradigm (Jagielski et al. 2020; Steinke et al. 2023) had matured into a standard engineering practice.
Key research groups include the Theory of Computation groups at Harvard (Salil Vadhan), Stanford (Aaron Roth, Dan Boneh), Penn (Michael Kearns, Aaron Roth), and CMU (Avrim Blum). In the UK, the Computational Privacy Group at Imperial College London (formerly led by Yves-Alexandre de Montjoye) studies re-identification risks in supposedly anonymised datasets and designs attack-informed defences. The University of Edinburgh and University of Warwick contribute to the theoretical foundations of information-theoretic privacy. The Alan Turing Institute hosts privacy-preserving AI research bridges across GCHQ/NCSC, the ICO, and NHS England.
Current Landscape (2026)
As of mid-2026, differential privacy has achieved mainstream adoption across several verticals. The PyTorch Opacus library is the de facto standard for DP-SGD, used by Meta AI Research, Google Brain, and dozens of academic groups. The Flower federated learning framework integrates Opacus for differentially private federated training out-of-the-box. Apple continues to publish annual reports on its differential privacy deployments, reporting on emoji, autocorrect, and browsing statistics collected at scale under LDP.
The UK regulatory context has crystallised significantly: the UK GDPR (retained post-Brexit) Article 89 permits processing of personal data for research with appropriate safeguards; the ICO’s Privacy-Enhancing Technologies guidance (2023, updated 2025) explicitly endorses differential privacy as a recognised anonymisation technique; and the Data (Use and Access) Act 2025 (entering force 19 June 2025) creates a statutory framework for Smart Data sharing that positions DP as an enabling technology.
Research frontiers in 2025–2026 include: correlated noise mechanisms (arXiv:2506.08201) that exploit gradient correlations in federated training to achieve DP with less noise than the independent-noise baseline (already deployed in Google’s Gboard); private fine-tuning of Large Language Models at moderate ε values (Google, Meta); shuffle model implementations with tight privacy accounting for federated settings (Erlingsson et al.; Ghazi et al.); and privacy auditing toolchains that provide certificates of DP implementation correctness against adaptive adversaries.
A significant challenge identified in 2026 is the “grey-box auditing” problem: the paper “Privacy in Theory, Bugs in Practice” (arXiv:2602.17454) documented gaps between theoretical DP guarantees and actual library implementations, finding that gradient clipping bugs and batch-size miscounting errors in several open-source DP libraries caused empirical privacy loss to exceed theoretical bounds. This has galvanised a new sub-field of formal verification of DP implementations.
UK Context
The UK hosts a distinctive concentration of differential privacy research at the intersection of academic computer science, healthcare data, and regulatory policy. The Computational Privacy Group at Imperial College London (Department of Computing) has contributed foundational work on computational privacy, uniqueness of mobile location traces, and differential privacy mechanisms for sensitive attribute data. The AI Security and Privacy Lab at Imperial (aisp.doc.ic.ac.uk) continues this work with a 2025 ICML contribution on certification for differentially private prediction in gradient-based training.
The University of Edinburgh hosts researchers in the Laboratory for Foundations of Computer Science who work on the probabilistic foundations of privacy, including connections between DP and information-theoretic secrecy. University College London (UCL) contributes through its machine learning groups’ work on federated learning and healthcare AI, including collaborations with NHS Trusts under the UCL Partners Academic Health Science Network.
The Alan Turing Institute serves as the national coordinating body for privacy-preserving AI research in the UK, with joint programmes with GCHQ, NCSC, the ICO, and NHS England. The Institute published a landmark 2024 report on “Privacy-Enhancing Technologies for the NHS” examining DP, Secure Multi-Party Computation, and Homomorphic Encryption for health data research.
In the north of England, NHS Greater Manchester and the Health Innovation Manchester programme have piloted DP-based analytics on combined primary and secondary care data from 2.8 million residents, creating a model for city-scale DP health analytics. University of Leeds contributes through its Institute for Data Analytics; University of Manchester through its Data Science Institute, which co-led the DARE UK Data Research Infrastructure programme exploring DP for Trusted Research Environments. Newcastle University hosts expertise in privacy-preserving methods for demographic research relevant to DP-based census approaches.
Future Directions (2026–2030)
The near-term research agenda centres on closing the remaining utility gaps between DP and non-private training. Scaling DP fine-tuning to frontier Large Language Models (>70B parameters) under ε < 8 without significant accuracy loss is the primary open problem, with approaches including DP-LoRA (low-rank adaptation under DP) and correlated noise injection showing early promise. The shuffle model is expected to achieve standardisation as a production privacy architecture, enabling client-side DP collection with near-central DP accuracy for large user populations. Formal verification of DP software — applying program analysis and property testing to certify that DP library implementations correctly implement their specifications — is emerging as a safety-critical discipline analogous to formal verification in cryptographic protocols.
The intersection of DP with Synthetic Data generation is expected to grow substantially: differentially private generative models (Diffusion Model, VAE-based, and flow-based) will serve as privacy-preserving data release mechanisms for the NHS, ONS, and financial regulators. Integration with Federated Learning and Trusted Execution Environment architectures will enable a three-layer privacy stack (DP + secure aggregation + TEE) for multi-party ML across organisations that cannot share raw data. The emergence of AI Act compliance requirements in the EU (affecting UK firms selling into Europe) will drive DP adoption as a technical compliance mechanism for high-risk AI systems processing personal data.
Research & Literature
- Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006). “Calibrating Noise to Sensitivity in Private Data Analysis.” Theory of Cryptography Conference (TCC 2006), Springer, LNCS 3876, pp. 265–284.
- Dwork, C., Rothblum, G., & Vadhan, S. (2010). “Boosting and Differential Privacy.” FOCS 2010. IEEE. (Advanced composition theorem.)
- McSherry, F., & Talwar, K. (2007). “Mechanism Design via Differential Privacy.” FOCS 2007. IEEE. (Exponential mechanism.)
- Bassily, R., Smith, A., & Thakurta, A. (2014). “Private Empirical Risk Minimization.” FOCS 2014.
- Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016). “Deep Learning with Differential Privacy.” CCS 2016. ACM. (DP-SGD and moments accountant.)
- Mironov, I. (2017). “Rényi Differential Privacy.” IEEE CSF 2017. (Rényi DP accounting framework.)
- Erlingsson, Ú., Feldman, V., Mironov, I., Raghunathan, A., Ramchandran, K., & Talwar, K. (2019). “Amplification by Shuffling.” SODA 2019. SIAM. (Shuffle model DP.)
- Balle, B., Bell, J., Gascón, A., & Nissim, K. (2019). “The Privacy Blanket of the Shuffle Model.” CRYPTO 2019. Springer.
- Gopi, S., Lee, Y. T., & Wutschitz, L. (2021). “Numerical Composition of Differential Privacy.” NeurIPS 2021. (PRV accountant.)
- Dong, J., Roth, A., & Su, W. J. (2022). “Gaussian Differential Privacy.” Journal of the Royal Statistical Society, Series B, 84(1), 3–37.
- Apple Inc. (2017). “Learning with Privacy at Scale.” Apple Machine Learning Research. https://machinelearning.apple.com/research/learning-with-privacy-at-scale
- Rappor: Erlingsson, Ú. et al. (2014). “RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response.” CCS 2014. ACM.
- Abowd, J. M. (2018). “The U.S. Census Bureau Adopts Differential Privacy.” KDD 2018. ACM. (TopDown algorithm for U.S. Census.)
- Holohan, N., Braghin, S., Mac Aonghusa, P., & Levacher, K. (2019). “Diffprivlib: The IBM Differential Privacy Library.” arXiv:1907.02444.
- Yousefpour, A., et al. (2021). “Opacus: User-Friendly Differential Privacy Library in PyTorch.” arXiv:2109.12298.
- McKenna, R., Sheldon, D., & Miklau, G. (2021). “Winning the NIST Contest: A scalable and general approach to differentially private synthetic data.” Journal of Privacy and Confidentiality, 11(3).
- Kairouz, P., McMahan, B., et al. (2021). “Advances and Open Problems in Federated Learning.” Foundations and Trends in Machine Learning, 14(1–2). (Comprehensive FL+DP treatment.)
- Beutel, D. J., et al. (2022). “Flower: A Friendly Federated Learning Research Framework.” arXiv:2007.14390.
- Balle, B., et al. (2019; revised 2024). “Tight Accounting in the Shuffle Model of Differential Privacy.” arXiv:2106.00477.
- Ghazi, B., et al. (2024). “Decomposition-Based Optimal Bounds for Privacy Amplification via Shuffling.” arXiv:2504.07414.
- Steinke, T., Nasr, M., & Jagielski, M. (2023). “Privacy Auditing with One (1) Training Run.” NeurIPS 2023.
- Alvim, M., et al. (2024). “Scenario-based Adaptations of Differential Privacy: A Technical Survey.” ACM Computing Surveys, 57(3). https://doi.org/10.1145/3651153
- Brown, H., et al. (2025). “Differential privacy for medical deep learning: methods, tradeoffs, and deployment implications.” npj Digital Medicine, 8, Article 94. https://doi.org/10.1038/s41746-025-02280-z
- Hazan, E., et al. (2025). “Certification for Differentially Private Prediction in Gradient-Based Training.” ICML 2025. Imperial College London / AI Security and Privacy Lab.
- Researchers at arXiv (2025). “Correlated Noise Mechanisms for Differentially Private Learning.” arXiv:2506.08201. (Deployed in Google Gboard federated training.)
- Veale, M., et al. (2025). Written evidence to UK Parliament Science & Technology Committee on AI and privacy. UK Parliament. https://committees.parliament.uk/writtenevidence/43358/pdf/
- UK Information Commissioner’s Office (2025). “Anonymisation, Pseudonymisation and Privacy Enhancing Technologies guidance.” ICO, updated June 2025. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/
- Anonos / ICO (2025). “Grey-Box Auditing of Differential Privacy Libraries: Privacy in Theory, Bugs in Practice.” arXiv:2602.17454.