What ε Actually Buys: Checking a Privacy Guarantee Against Its Own Definition, Not a Simulation

Three days of this series asked what a promise about a model is worth: what a clustering score is a number of, which fairness equalities can hold at once, what the bound printed in front of a training run guarantees.

This is the promise attached to the data — that a release is safe to publish.

Run it: https://dev48.infy.uk/ml/day76-differential-privacy.html

Nothing here is sampled

That is the whole point of the build. "This release is ε-differentially private" is a statement with a definition, and a definition can be checked rather than estimated:

• the mechanisms live on databases small enough to enumerate completely
• the guarantee is checked over all 2,048 neighbouring pairs and every output
• each ratio is an exact rational over BigInt — no floating point, no tolerance
• the attack is a finite sum over all 256 databases, not a simulated adversary

A Monte-Carlo privacy check tells you it did not happen to fail. This one tells you it cannot.

What ε is, stated plainly

ε bounds how much one person's row can change the probability of any output:

Pr[M(D)  = S]
------------- <= exp(epsilon)     for every neighbouring D, D' and every S
Pr[M(D') = S]

That is a bound on a ratio, not on an error, not on accuracy, and not on whether anybody can guess your row. Small ε means the mechanism's output distribution barely moves when you are added or removed.

The gap between the guarantee and the intuition

The guarantee is per-mechanism and it composes: run two ε-private queries and you have spent 2ε. The intuition — my data is protected — is neither per-mechanism nor additive, and that is where budgets get quietly overspent.

Verifier 63 assertions, 0 failures. Vanilla JavaScript, one file, no build step.