What ε = 8 means, and what it doesn't: the privacy budget in plain language

The question differential privacy answers

Imagine running the generator twice: once on your full patient table, and once on the same table with one patient removed. If the two synthetic datasets could look very different, the output reveals something about that patient. If they are almost indistinguishable, the output says very little about any individual.

Differential privacy makes that second case provable. The engine adds carefully sized random noise at every step where it learns from the data, so that no single patient can move the result much. ε is the number that says how much "much" is.

What the number means

For any synthetic dataset the engine could produce, the chance of producing it with a given patient included is at most e^ε times the chance without that patient. There is also a tiny allowance, δ, for the bound to fail. We use δ = 10⁻⁵, well below one over the number of patients in a typical study table.

Census figure from the Bureau's June 2021 announcement (total budget 19.61: 17.14 for persons, 2.47 for housing units).

Why 2,981× is less alarming than it sounds

The ratio looks large, and it is fair to ask about it. Three things put it in context.

• It is a ratio of probabilities, not a chance of re-identification. If an attacker's guess about a patient starts at 1 in 1,000, a ratio of a few thousand bounds how far the synthetic data could ever move that guess. It does not mean the patient is exposed 2,981 times over.
• It assumes the strongest possible attacker. The bound holds even against someone who already knows every other patient in the table and has unlimited computing power. Real attackers know far less.
• Measured attacks are much weaker than the bound. On five public clinical datasets at ε = 8, a membership attack scored 0.48 to 0.52, where 0.50 is guessing. See the benchmark write-up.

We still treat ε = 8 as a moderate setting, not a strong one. If a dataset will leave your organisation, a lower ε is worth the loss in fidelity.

Where privacy usually leaks: preprocessing

Before any generator trains, software has to learn basic facts about each column: the lowest and highest values, the list of categories, how to scale the numbers. Many tools compute these directly from the raw data and apply privacy only to the training step.

That leaves a gap. If the oldest patient is 97, a synthetic range that ends at exactly 97 confirms someone that age is in the data. A category list that includes a rare diagnosis confirms at least one patient has it.

MirrorCohort measures these facts with noise too. Column ranges and value levels come from private histograms, a numeric value only gets its own level when its count stands out from the noise, and the step that keeps the link to an outcome column also runs inside the budget. A single accountant (Rényi differential privacy) adds up everything spent, so the ε in the report is the total for the run.

What ε does not cover

• The table's shape. Column names, column types and the number of rows are treated as public. If the row count of your cohort is itself sensitive, tell us before a run.
• Repeated releases. Budgets add up. Two separate releases from the same patients at ε = 8 each can together reveal up to ε = 16. The privacy ledger records each run so you can track the total.
• Legal status. Differential privacy is not a HIPAA Safe Harbor or Expert Determination certification. For output derived from protected health information, an independent expert should still review it. The ε, the attack results and the ledger are evidence for that review.
• Independent audit. Our privacy accounting has not yet been independently audited. Every run ships with a machine-readable privacy ledger so your team can check what was spent and where.

Choosing ε for a project

There is no universally correct value, so we suggest starting from who will see the data.

• Inside the study team, for writing and testing analysis code: ε = 8 keeps fidelity high.
• With outside collaborators or vendors under an agreement: consider ε = 4 or lower.
• Teaching or public release: ε = 1 to 2, and accept that the data will be noticeably noisier.

In a pilot we can run the same table at more than one setting, so you can see the trade-off on your own data before deciding.

Questions to ask any vendor about ε

1. Does the ε cover preprocessing, or only model training?
2. What δ is used?
3. Is the ε per run, and how are repeated runs on the same patients tracked?
4. Which accountant composes the steps, and has it been reviewed?
5. Is there an empirical attack test alongside the guarantee, and what does it score?

A vendor who can answer all five clearly understands their own guarantee. We answer them in every validation report.

Raja Pal, PhD is the founder of MirrorCohort. Before founding MirrorCohort, Raja spent nearly nine years as a process and quality engineer at Intel. Questions about privacy budgets: raja@mirrorcohort.com · LinkedIn