Explain differential privacy in ML and how it mitigates privacy risks.

• A. It uses deterministic outputs to ensure reproducibility.
• B. Differential privacy adds calibrated noise to data or computations to bound the influence of any single record on outputs, reducing risk of re-identification.
• C. It increases dataset size to dilute individual records.
• D. It encrypts all data to stop any access.

Answer: (B)

Differential privacy in ML provides a formal guarantee that the presence or absence of any single individual's data has only a small, controllable impact on the outputs of a computation. Practically, this is achieved by injecting calibrated randomness into the process, such as adding noise to data or to computations used to train a model. In training, a common approach is DP-SGD: for each training step, the contribution of each example is clipped to limit its influence, and then random noise is added to the aggregated gradient before updating the model. The amount of noise is tied to a privacy budget (epsilon, and sometimes delta), which formalizes the trade-off between privacy protection and model utility.

Because outputs—whether model parameters or query results—become probabilistically similar whether or not any single record is included, it becomes hard for an attacker to determine if a particular individual’s data was used. This reduces risks of re-identification, membership inference, and dataset reconstruction, even if the attacker has additional background information.

This differs from using deterministic outputs, which can leak exact information about individuals; from simply increasing dataset size, which does not provide a formal bound on an individual’s influence; or from encryption, which protects data access but does not address potential leakage through model outputs or learned parameters. Differential privacy provides a mathematical, algorithm-level safeguard that limits how much any one record can affect the results.