This is a tool to calculate noise scales and error metrics for simple differentially private queries.

Currently, only counting queries are supported. More precisely, we assume that each row of an input table is associated with a user identifier and a group, and we want to release the number of records associated with each group, under user-level DP. All groups are known in advance.

For example, the dataset could be a log of user requests, where each request is associated with a user ID and a device type. We would then want to calculate the number of requests that come from each device type, and make sure that adding or removing all records from a given record is protected with \((\varepsilon,\delta)\)-DP.

Input

Sensitivity

These parameters determine how much a single user can impact the results. If you want to use record-level privacy (with the add-or-remove-one notion) instead of user-level privacy, simply use one-stage sensitivity with a sensitivity of 1.

One-stage sensitivity

Maximum number of rows associated with each user identifier:

Two-stage sensitivity

Maximum number of distinct groups associated with each user identifier:

Maximum number of rows associated with each identifier in each group:

Noise type

The counts should be perturbed with: Laplace noise Gaussian noise

Privacy budget

The query should be \((\varepsilon,\delta)\)-DP, with:

• \(\varepsilon=\) 
• \(\delta=\) 
  
  

Output

Implementation details

This uses the same logic as the converters between different definitions. The noise is rounded up before being shown, the error metrics are based on the rounded value (and rounded to nearest). The usual caveats regarding floating-point issues apply.

This page only runs in your browser and doesn't log anything.

If you need additional features added to this page, let me know! And if you'd like me to help you design, audit, and/or deploy differential privacy for your use case, let me know! I'd be happy to help.