DataTerminology.comNEW
The allowable cumulative privacy loss allocated and tracked across multiple differentially private analyses.
DESCRIPTION
A privacy budget limits the sum of privacy loss parameters spent across queries or releases using differential privacy. It enforces that repeated analyses do not exceed acceptable risk. Budgets are typically denominated in epsilon (and sometimes delta) and managed by a privacy accountant. Teams allocate portions of the budget to analyses and track consumption via composition theorems. Advanced accounting methods like Rényi DP or the Moments Accountant can provide tighter estimates. Budget design is a governance decision involving policy, risk, and utility tradeoffs. Transparency about budget use supports trust and compliance reporting.
ALTERNATIVE DEFINITIONS
U.S. Census Bureau
A privacy-loss budget (epsilon) limits the total privacy loss from applying differentially private methods across multiple statistics and data products.
Connects budget use to real statistical products and repeated releases.
Wikipedia
Because privacy losses compose, one often allocates a privacy budget of ε across multiple computations to control the total privacy loss.
Emphasizes composition as the reason budgets are necessary.
OpenDP
A privacy budget is a limit on the cumulative privacy parameters (such as ε, δ) spent by a system, tracked by an accountant under composition.
Links budget to accounting and composition in practical systems.
RELATED TERMS
Differential Privacy Epsilon Delta Composition Privacy Accountant Rényi Differential Privacy Recall Laplace Mechanism Gaussian Mechanism
COMPETING TERMS
Rényi DP Accountant Moments Accountant
RELATIONS
- Broader: Budget
KNOWLEDGE AREAS
Data Privacy & Compliance AI Governance AI Data Science
TARGET AUDIENCE
Data Privacy Officer Chief Information Security Officer Data Governance Manager Data Scientist AI Engineer MLOps Engineer
EXTERNAL SOURCES
- Wikipedia - Differential privacy
- OpenDP - Open-source tools and glossary for DP
- Google Research - Explainer including DP accounting ideas
- Harvard Privacy Tools - Academic primer on budgets and composition
TOP QUESTIONS
What is a Privacy Budget in differential privacy?
It is a limit on cumulative privacy loss across computations. Budgets are typically measured in epsilon and managed via composition rules and accountants.
Category: Definition
Why do we need a Privacy Budget?
Repeated queries consume privacy, so budgets prevent exceeding acceptable risk. They enforce governance and protect individuals over time.
Category: Relevancy
How is a Privacy Budget allocated?
Teams divide the budget across analyses based on priority, sensitivity, and required accuracy. Allocation is documented and enforced by a privacy accountant.
Category: Management
What happens when the Privacy Budget is exhausted?
Additional queries must be denied, delayed to a new budget window, or redesigned with lower epsilon. Proceeding would violate the stated privacy guarantees.
Category: Risk
How do advanced accountants affect the Privacy Budget?
Advanced accountants like Rényi DP or Moments Accountant can provide tighter bounds, effectively stretching the budget compared to basic composition.
Category: Opinion
What is a common mistake managing Privacy Budgets?
Not tracking all releases end-to-end, including exploratory analyses. Unaccounted consumption leads to unintended privacy overrun.
Category: Mistakes
How should Privacy Budgets be reported?
Provide the accounting method, per-query epsilons, and cumulative totals. Clear reporting supports audits and stakeholder trust.
Category: Collaboration
Can Privacy Budgets reset over time?
Organizations may use time-bound budgets or per-project budgets, but resets must be justified to avoid cumulative disclosure risks.
Category: Requirements
What are alternatives to epsilon-based Privacy Budgets?
Rényi DP and Moments Accountant track privacy with different parameters, sometimes yielding tighter or more interpretable budgets.
Category: Alternatives