What epsilon controls
A mechanism is (epsilon, delta)-differentially private when one person's record can change the probability of any published outcome by at most a factor of e^epsilon, except with probability delta. Epsilon is the size of that change. Delta is the chance that the guarantee fails outright.
Epsilon is not a property of your data. It is a promise you publish. Two releases with the same epsilon are only comparable when they use the same delta and the same mechanism class.
Step 1: set delta before epsilon
Delta must be smaller than the chance that any single record matters. For a table of n records, the usual convention is delta = 1/n or smaller, so the failure probability stays below one record's worth of risk. Write the value down as a number, not as "small".
Delta is also the term that sets the noise floor. The table below uses delta = 0.00001 for a table of up to 100,000 records, which is the same as delta = 1/n.
Step 2: compute the noise that each epsilon demands
For the Gaussian mechanism the classic bound is sigma = sqrt(2 ln(1.25/delta)) times the L2 sensitivity, divided by epsilon. Sensitivity is the largest change one record can cause in the query answer. The table below uses sensitivity 1.0, so the noise multiplier equals sigma.
| Epsilon | Sigma (noise) | Noise multiplier | Signal-to-noise |
|---|---|---|---|
| 0.1 | 48.45 | 48.45 | 0.02 |
| 0.5 | 9.69 | 9.69 | 0.10 |
| 1 | 4.84 | 4.84 | 0.21 |
| 2 | 2.42 | 2.42 | 0.41 |
| 4 | 1.21 | 1.21 | 0.83 |
| 8 | 0.61 | 0.61 | 1.65 |
The same computation for epsilon 8 gives sigma 0.61, and for epsilon 0.1 it gives sigma 48.45. The ratio is 80. That is the real cost of a smaller epsilon: at 0.1 the noise is 80 times larger than at 8, so a per-record style answer becomes unreadable and only large aggregates survive.
This table comes from the classic closed-form bound. That bound is only valid for epsilon below 1. For epsilon above 1, or when the noise budget is tight, use an exact analytic calibration instead. The Gaussian mechanism noise calibrator computes both and prints the saving.
Step 3: count composition before you ship
Each answer spends part of the budget. Twenty queries at epsilon 0.1 in sequence cost epsilon 2.0 and delta 0.0002 in total. The same twenty queries over twenty disjoint sets of records cost only epsilon 0.1, because each record is used once.
So the question "what epsilon should I use" is really "what total epsilon may I spend, and how many queries will I run". Pick the total first, then divide.
Step 4: choose from the release, not from a blog post
Match epsilon to who can see the output:
- Public record-level release: the smallest budget you can afford. Check the noise column first. If the noise swamps the signal, publish aggregates instead of rows.
- Internal analytics with access control: a larger epsilon is defensible when the output stays inside the organisation and each analyst is accountable for their queries.
- Model training or synthetic data: the budget is per training run, and the run output is reused many times. Count the reuse.
Record four numbers for every release: epsilon, delta, mechanism, and query count. A budget without delta cannot be audited.
Common mistakes
- Reporting epsilon without delta. The guarantee is a pair.
- Comparing an approximate-DP epsilon from a Gaussian mechanism with a pure-DP epsilon from Laplace noise. They are not the same scale.
- Ignoring composition. Ten quiet queries are not one quiet query.
- Raising epsilon until the chart looks clean. That trades the promise for the picture.
Related LockML tools
Use the privacy budget calculator to add up composition for a query plan, the Gaussian mechanism noise calibrator for the noise scale, and the differential privacy answer page for the definitions.