Differentially private count

A count has sensitivity 1 no matter how large the dataset is – one person changes it by one – so the noise is O(1) and the RELATIVE error falls like 1/n. Counting is the query differential privacy is kindest to.

Usage

morie_dp_count(D, epsilon = 1, predicate = NULL, seed = NULL, nonneg = TRUE)

Arguments

D

data: a logical vector, a 0/1 vector, or anything with a length (in which case the count is the number of rows).

epsilon

privacy budget.

predicate

optional function applied to each element; the count is the number of TRUE results.

seed

optional integer seed.

nonneg

clamp a negative release to zero. The clamp is a post-processing step and costs no privacy, but it does bias the release upward near zero, which is recorded in clamped.

Value

list with release, raw (pre-clamp), true_count, noise_scale, clamped.

References

Dwork, C. and Roth, A. (2014). FnTTCS, 9(3-4), Sec. 3.3.

Examples

morie_dp_count(rep(TRUE, 1000), epsilon = 1, seed = 1)$noise_scale
#> [1] 1