Programming Differential Privacy

Joseph P. Near and Chiké Abuah’s Programming Differential Privacy develops privacy through examples, mechanisms, properties, and implementation concerns. The linked PDF is dated September 19, 2026. Sixteen substantive chapters progress from weaknesses in de-identification to formal guarantees, composition, learning, synthetic data, and practical limitations. The central discipline is to state the protected unit, assumptions, and privacy accounting rather than assume that adding randomness automatically creates a guarantee.

Chapter-by-chapter summaries

Introduction

The opening connects practical programming with a formal account of privacy. It explains the learning approach and the need to reason about what an output can reveal. This establishes a distinction between an intuitive sense that data looks anonymous and a property that can be stated and analyzed.

De-identification

Removing obvious identifiers does not necessarily prevent linkage or inference. The chapter uses this limitation to examine the relationship between a released dataset and other available information. Aggregation also requires analysis rather than automatic trust, motivating the need for a guarantee that does not depend on guessing every possible auxiliary source.

k-Anonymity

The chapter explains a grouping-based approach and its generalization choices, then examines weaknesses such as homogeneity. It makes the difference between satisfying a structural condition and protecting the intended sensitive information visible. A dataset can meet a rule while still leaving an important inference available.

Differential Privacy

Differential privacy compares outputs under neighboring inputs and ties protection to a defined unit and adjacency relation. The Laplace mechanism introduces noise calibrated to the query's possible change. The chapter makes the guarantee explicit: privacy depends on the mechanism and parameters, not on whether one particular released result appears harmless.

Properties of Differential Privacy

Sequential and parallel composition and post-processing explain how guarantees behave when mechanisms are combined or outputs are transformed. These properties make system-level reasoning possible. The privacy analysis must follow the actual sequence and overlap of data use rather than examine each query as if no other release existed.

Sensitivity

Sensitivity measures how much a query can change under the chosen neighboring relation. Distance, bounds, and clipping affect that analysis. Underestimating sensitivity can undermine the intended protection, so the chapter connects mathematical calculation with input assumptions that an implementation must actually enforce.

Approximate Differential Privacy

The approximate formulation and Gaussian mechanism extend the toolbox while introducing additional accounting considerations. Vector-valued functions and composition make the role of parameters more visible. Readers should distinguish the guarantee being used and its interpretation rather than treating all mechanisms as interchangeable ways to add noise.

Local Sensitivity

Local sensitivity considers the behavior around a particular dataset, creating both opportunities and difficulties for privacy. The chapter examines approaches including propose-test-release, smooth sensitivity, and sample-and-aggregate. The key question is how a data-dependent choice can be made without exposing the very information the mechanism is meant to protect.

Variants of Differential Privacy

Alternative formulations use different mathematical measures to reason about privacy and composition. The chapter connects these variants with their accounting benefits and relationships. A change in formal language requires understanding the conversion and assumptions, not simply carrying a familiar numerical parameter into a different definition.

The Exponential Mechanism

The exponential mechanism supports selection among outputs using a quality function. It extends private computation beyond releasing a noisy numerical query. The chapter connects a useful choice with the sensitivity of the score and the privacy parameters, making the selection process itself part of the guarantee.

The Sparse Vector Technique

Threshold-based techniques can answer certain patterns of questions with a distinctive privacy accounting structure. The chapter examines above-threshold reasoning and multiple outputs. Correctness depends on the actual information released and the conditions of the construction; an informal resemblance to the algorithm is not sufficient for its proof to apply.

Design and Deployment

Design exercises connect mechanisms with summary statistics, heavy hitters, hierarchical queries, and workloads. The deployment checklist makes operational assumptions visible. A privacy guarantee needs a system that enforces the intended data boundaries, accounting, and implementation behavior rather than a correct formula embedded in an otherwise inconsistent process.

Machine Learning

Private learning connects model training, gradient methods, clipping, and noise. The chapter examines the effect on training and the relationship between an individual contribution and the released model. Utility and privacy need to be assessed together, while preserving the distinction between successful prediction and a justified privacy claim.

Local Differential Privacy

Local approaches alter information before it reaches the central collector. Randomized response and encoding methods illustrate a different trust arrangement. The chapter helps readers compare where randomization occurs and what that changes about the information available for analysis, rather than assuming all privacy models place the same responsibilities on the same party.

Synthetic Data

Synthetic representation can support a release, but generated data is not inherently private. The chapter constructs the connection with formal privacy through mechanisms applied to representations such as histograms. The guarantee follows from the construction and accounting, not from the fact that the output contains newly generated rows.

Efficiency and Limitations

Time, space, random-number generation, and numerical representation affect implementation. The final chapter brings formal reasoning back to actual computation. Practical constraints can change what an algorithm does, so a careful implementation needs to examine whether its numerical behavior preserves the assumptions used in the theoretical explanation.

Study instructions

1. For each example, write the protected unit, adjacency relation, query, sensitivity, mechanism, and accounting assumptions.
2. Test a program on neighboring toy datasets to understand its behavior without treating an empirical test as a privacy proof.
3. Compare utility under different parameters while explaining the guarantee associated with each.
4. Use the deployment checklist to identify where a complete system could violate an otherwise correct mechanism's assumptions.

Sources and coverage

This original study guide follows the linked source edition and its chapters or explicitly identified sections. It condenses the main ideas and their relationships; examples and practice directions are for study alongside the complete text. Complete source edition.