Privacy (differential privacy, membership inference): Worked examples

This page is the worked-example engine for Privacy (differential privacy, membership inference). We take every knob the topic can turn — the size of the privacy budget, the sign and scale of sensitivity, degenerate inputs, limiting values, and a couple of exam traps — and grind through each one until the machinery feels obvious.

Before we compute anything, we re-anchor the three symbols we lean on, so nothing is used before it is earned.

Everything below is just: find $Δ f$ → divide by $ε$ → that is your noise scale. The whole art is finding $Δ f$ honestly in each scenario.

The scenario matrix

Each cell is a class of situation this topic can throw at you. The examples that follow are tagged with the cell they cover.

#	Cell (case class)	What is unusual about it	Covered by
A	Normal numeric query, moderate $ε$	baseline sanity	Ex 1
B	Zero-range / degenerate input ( $Δ f = 0$ )	sensitivity collapses	Ex 2
C	Sign & scale of sensitivity (counting vs. bounded-range sum)	how $Δ f$ is found, not guessed	Ex 3
D	Limiting $ε$ ( $ε \to 0$ and $ε \to \infty$ )	the two extremes of the dial	Ex 4
E	Add/remove vs. replace-one (the factor-of-2 trap)	which neighbor definition	Ex 5
F	Composition — many queries stacked	budget adds up	Ex 6
G	DP-SGD scaling ( $T$ + subsampling)	the deep-learning case	Ex 7
H	Membership inference word problem	the attack that motivates all this	Ex 8
I	Exam twist — vector query, $ℓ_{1}$ sensitivity	sensitivity of a list of numbers	Ex 9

We now walk cells A → I.

Worked example Example 1 — Cell A: baseline numeric release

Statement. A hospital releases the mean age of $n = 1000$ patients, ages in $[0, 100]$ , with $ε = 1.0$ using the add/remove definition. What noise scale do we add, and how blurry is the answer?

Forecast: guess now — is the noise scale closer to $0.1$ , $1$ , or $100$ ? Write it down.

Find the sensitivity of the sum. Removing one person of age up to $100$ moves the sum by at most $100$ . Why this step? Sensitivity always starts at the worst single record, and the worst age is $100$ .
Convert to sensitivity of the mean. Mean $= sum /1000$ , so $Δ f = 100/1000 = 0.1$ . Why this step? Dividing the query by a constant divides its sensitivity by the same constant.
Noise scale. $b = Δ f / ε = 0.1/1.0 = 0.1$ . Why this step? This is the whole Laplace recipe: $b = Δ f / ε$ .
Blurriness. For $Lap (b)$ , the standard deviation is $2 b \approx 0.141$ years. Why this step? $Var (Lap (b)) = 2 b^{2}$ , so SD $= 2 b$ ; this tells us the typical error.

Verify: noise SD $\approx 0.14$ years against a mean age of maybe $50$ years — a $\sim 0.3%$ perturbation. Negligible distortion, strong privacy. ✔ Forecast answer: $0.1$ .

Worked example Example 2 — Cell B: the degenerate / zero-sensitivity input

Statement. A dataset records a field that is the same constant for everyone (say every patient's country = "IN", encoded as $f (D) =$ number of distinct countries $= 1$ always). We release $f (D)$ with $ε = 0.5$ . How much noise?

Forecast: trick question — how much noise does a query need if no single person can change the answer?

Test the worst case. Add or remove any one person: the count of distinct countries stays $1$ . So $∣ f (D_{1}) - f (D_{2}) ∣ = 0$ for all neighbors. Why this step? Sensitivity is defined as a max over neighbors; here every neighbor pair gives $0$ .
Sensitivity. $Δ f = 0$ .
Noise scale. $b = Δ f / ε = 0/0.5 = 0$ . Why this step? A query no individual can influence leaks nothing about any individual, so DP costs it zero noise.

Verify: Plug $b = 0$ into $Pr [M (D_{1}) = z] / Pr [M (D_{2}) = z]$ : both mechanisms are identical (no randomness needed), so the ratio is exactly $e^{0} = 1 \leq e^{ε}$ for any $ε > 0$ . Degenerate input handled. ✔

Worked example Example 3 — Cell C: finding sensitivity by its

type (count vs. bounded sum) Statement. Two queries on $N$ people, add/remove definition, $ε = 1$ : (a) count = "how many people are diabetic?" (b) sum = "total of a lab value clipped to $[0, 50]$ ." Give $Δ f$ and $b$ for each.

Forecast: which query has the larger sensitivity, and by what factor?

Counting query. Adding one person changes a count by at most $1$ . So $Δ f_{count} = 1$ . Why this step? A person either is or isn't diabetic — the count moves by $0$ or $1$ ; worst case $1$ .
Bounded-sum query. Adding one person adds a value in $[0, 50]$ , so the sum moves by at most $50$ . $Δ f_{sum} = 50$ . Why this step? Sensitivity of a sum = the range of one clipped record.
Noise scales. $b_{count} = 1/1 = 1$ ; $b_{sum} = 50/1 = 50$ .

Verify: ratio $b_{sum} / b_{count} = 50$ . The bounded sum needs 50× more noise — exactly why real systems clip aggressively: shrinking the range from $[0, 50]$ to $[0, 1]$ would cut required noise 50-fold. ✔

Figure — Privacy (differential privacy, membership inference)

The figure above shows why $ε$ is a dial: it plots the Laplace noise for a fixed $Δ f = 1$ as $ε$ sweeps. The legend names each curve by its $ε$ and the resulting scale $b = Δ f / ε$ . Follow them from the amber curve ( $ε = 0.25$ , the flattest and widest — strongest privacy) up to the violet curve ( $ε = 2.0$ , the tallest, sharpest peak — least privacy). Smaller $ε$ is literally a fatter blur.

Worked example Example 4 — Cell D: the two limits of the privacy dial

Statement. Fix $Δ f = 1$ . Describe the mechanism as (a) $ε \to 0^{+}$ and (b) $ε \to \infty$ .

Forecast: at which limit does the answer become pure noise, and at which does it become the raw truth?

Limit $ε \to 0^{+}$ . $b = Δ f / ε = 1/ ε \to + \infty$ . Why this step? Dividing by a vanishing budget explodes the noise scale.
Interpret. Infinite-scale Laplace noise drowns the signal $f (D)$ : output is essentially random, revealing nothing. Maximum privacy, zero utility.
Limit $ε \to \infty$ . $b = 1/ ε \to 0^{+}$ : noise scale collapses to zero. Why this step? A huge budget permits nearly no distortion.
Interpret. With $b \to 0$ the mechanism returns $f (D)$ almost exactly — the raw truth, no privacy.

Verify: the DP bound $e^{ε}$ agrees: as $ε \to 0$ , $e^{ε} \to 1$ (outputs indistinguishable ⇒ private); as $ε \to \infty$ , $e^{ε} \to \infty$ (no constraint ⇒ can reveal all). Both limits consistent. ✔

Worked example Example 5 — Cell E: add/remove vs. replace-one (the factor-of-2 trap)

Statement. A bounded-sum query with per-record range $[0, C]$ , $C = 1$ , $ε = 1$ . Compute $Δ f$ and $b$ under both neighbor definitions.

Forecast: which definition doubles the noise, and why exactly $2 \times$ ?

Add/remove. Neighbors differ by one record present or absent. The sum changes by at most one record's value $\leq C = 1$ . $Δ f_{a/r} = 1$ . Why this step? Only one contribution appears/disappears.
Replace-one. Neighbors differ by swapping one record for another. Worst case: remove a value $C$ and add a value $C$ elsewhere — change up to $2 C = 2$ . $Δ f_{rep} = 2$ . Why this step? A swap is a removal plus an addition, so two records' worth of movement.
Noise scales. $b_{a/r} = 1/1 = 1$ ; $b_{rep} = 2/1 = 2$ .

Verify: $b_{rep} / b_{a/r} = 2$ — exactly the factor-of-2 the parent note warns about. Always state your definition; the same $ε$ buys different noise. ✔

Worked example Example 6 — Cell F: composition (budgets add up)

Statement. You answer $k = 5$ separate queries, each made $ε_{0} = 0.4$ -DP by its own noise. Under basic (sequential) composition, what is the total budget $ε_{total}$ ?

Forecast: does releasing 5 answers make you 5× more private or 5× less private?

Recall the rule. Basic composition: releasing mechanisms $M_{1}, \dots, M_{k}$ that are $ε_{0}$ -DP each is $(\sum_{i} ε_{0})$ -DP. Why this step? In log-probability, the per-query bounds $e^{ε_{0}}$ multiply, i.e. exponents add — this is exactly why the exponential form was chosen.
Add. $ε_{total} = 5 \times 0.4 = 2.0$ . Why this step? Five queries, each spending $0.4$ from the same budget wallet.

Verify: $2.0 > 0.4$ , so more queries = less private (bigger $ε$ ). Multiplying five $e^{0.4}$ bounds gives $e^{0.4 \cdot 5} = e^{2.0}$ — the exponents literally summed. This is why DP-SGD's many steps force advanced composition to avoid a linear blow-up. ✔

Worked example Example 7 — Cell G: DP-SGD

$T$ + subsampling Statement. Reproduce the parent's Example 2. Logistic regression, $N = 1000$ , batch $B = 250$ so $q = B / N = 0.25$ , clip $C = 1.0$ , noise multiplier $σ = 4.0$ , steps $T = 400$ , $δ = 1 0^{- 5}$ . Estimate $ε$ with the subsampled-Gaussian bound $ε \approx q \frac{2 T l n ( 1/ δ )}{σ} .$

Forecast: the naïve linear guess would replace the $T$ growth by a full $T$ . Do you expect the real $ε$ to be single-digit or in the tens?

Log term. $ln (1/ δ) = ln (1 0^{5}) = 5 ln 10 \approx 11.513$ . Why this step? $δ = 1 0^{- 5}$ is the tiny "failure probability" allowed by $(ε, δ)$ -DP; it enters through this log.
Square-root growth. $2 T ln (1/ δ) = 2 \cdot 400 \cdot 11.513 = 9210.3 \approx 95.97$ . Why this step? Advanced composition makes privacy loss grow like $T$ , not $T$ — the key saving.
Subsampling amplification. Multiply by $q = 0.25$ (an individual is only touched a quarter of the time) and divide by $σ = 4.0$ . Why this step? $q$ dilutes each person's exposure; larger $σ$ = more noise = smaller $ε$ .
Combine. $ε \approx 0.25 \times 95.97/4.0 \approx 5.998 \approx 6.0$ .

Verify: $ε \approx 6.0$ — single digit. To see the value of the $T$ saving, compare the two "growth factors" before the $q / σ$ prefactor: the honest advanced-composition factor is $2 T ln (1/ δ) \approx 95.97$ , whereas a crude bound that grows like the full $T$ would use $T = 400$ in its place. Their ratio is $400/95.97 \approx 4.17$ , so the naïve linear-in- $T$ intuition would over-count the privacy loss by roughly $4 \times$ here. The $T$ scaling is what keeps DP deep learning feasible. ✔

Worked example Example 8 — Cell H: membership inference word problem

Statement. An adversary suspects Alice's record was in the training set. A non-private model outputs confidence $0.99$ on Alice's exact record but averages $0.60$ on fresh unseen records. After DP training with $ε = 1$ , the model outputs $0.63$ on Alice's record. Should the adversary conclude Alice was a member?

Forecast: DP promises the distribution of outputs shifts by at most a factor $e^{ε}$ whether Alice is in or out. Guess: can the attacker still tell?

Attack logic (no DP). The gap $0.99$ (member) vs $0.60$ (non-member) is huge → the adversary confidently guesses "member." This is a membership inference attack succeeding. Why this step? Over-confidence on training points is the memorization fingerprint DP is built to erase.
What DP actually bounds. DP does not cap the shift of a single confidence value. It bounds ratios of output probabilities/measures: for any set $S$ of possible outputs, $Pr [M (D_{Alice in}) \in S] \leq e^{ε} Pr [M (D_{Alice out}) \in S]$ . So the whole distribution of the training run — hence any statistic the attacker computes from the model, including the confidence score — differs by at most this factor between the two worlds. Why this step? Reading DP as "point values move by $e^{ε}$ " is a common mistake; the guarantee lives at the level of probability measures over outputs.
Read the DP output. With $ε = 1$ , the two worlds are indistinguishable up to $e^{1} \approx 2.718$ in probability, and empirically the score $0.63$ now sits right at the non-member baseline $0.60$ ; the once-glaring gap has collapsed. Why this step? DP forced Alice's presence to barely move the output distribution, so the attacker's evidence nearly vanishes.

Verify: the attacker's confidence advantage is bounded. A standard bound relates the best possible attack success rate to $\frac{e ^{ε}}{1 + e ^{ε}}$ ; for $ε = 1$ that is $\frac{2.718}{3.718} \approx 0.731$ — far below the near-certainty the non-private model gave. The defense worked. ✔

Worked example Example 9 — Cell I: exam twist — vector query,

$ℓ_{1}$ sensitivity Statement. A query returns a histogram — a vector counting people in each of $3$ disjoint age buckets, e.g. $f (D) = (n_{child}, n_{adult}, n_{senior})$ . Add/remove definition, $ε = 2$ . Find the $ℓ_{1}$ sensitivity and the per-coordinate Laplace scale.

Forecast: if one person moves the vector, how many coordinates change — one, or all three?

Effect of one person. Every individual falls in exactly one bucket. Adding/removing them changes one coordinate by $1$ and leaves the others fixed. Why this step? Disjoint buckets ⇒ a person contributes to a single count, so at most one coordinate can move.
$ℓ_{1}$ sensitivity. The $ℓ_{1}$ sensitivity sums the absolute coordinate changes over the worst neighbor pair: $Δ f = max \sum_{j} ∣ f (D_{1})_{j} - f (D_{2})_{j} ∣ = 1$ , because only one coordinate changes and it changes by exactly $1$ . Why $ℓ_{1}$ ? The Laplace mechanism's guarantee is driven by the sum of coordinate changes (the $ℓ_{1}$ norm), so histograms are cheap: only one coordinate ever moves.
Per-coordinate noise. Add independent $Lap (Δ f / ε) = Lap (1/2) = Lap (0.5)$ to each of the $3$ bucket counts. Why this step? The recipe $b = Δ f / ε$ still applies; the low $ℓ_{1}$ sensitivity of $1$ keeps every bucket's noise small even though we release three numbers.

Verify: $b = Δ f / ε = 1/2 = 0.5$ per bucket, so each bucket's noise SD is $2 \cdot 0.5 \approx 0.707$ counts. The whole $3$ -bucket histogram is released for the price of a single count's sensitivity ( $Δ f = 1$ ) — the classic exam-favourite result. ✔

Recall gauntlet

Recall Every cell in one breath

Baseline mean-age noise scale for $Δ f = 0.1, ε = 1$ ::: $b = 0.1$ Sensitivity of a query no individual can change ::: $Δ f = 0$ , so $b = 0$ Ratio of noise: bounded-sum $[0, 50]$ vs a count ::: $50 \times$ more noise for the sum As $ε \to 0^{+}$ the mechanism becomes ::: pure noise (infinite $b$ ), maximum privacy As $ε \to \infty$ the mechanism returns ::: the raw truth, no privacy Replace-one vs add/remove sensitivity factor ::: $2 \times$ under replace-one Basic composition of five $0.4$ -DP queries ::: $ε_{total} = 2.0$ DP-SGD $ε$ for $q = 0.25, T = 400, σ = 4, δ = 1 0^{- 5}$ ::: $\approx 6.0$ $ℓ_{1}$ sensitivity of a disjoint 3-bucket histogram ::: $Δ f = 1$ , per-bucket $b = 0.5$