Exam PA · Ethics, Bias, and Fairness · Tutorial 864 of 966

Differential Privacy for Fairness Audits

Learn to calibrate privacy noise for fairness-audit statistics and assess how privacy budgets affect the accuracy of group disparity estimates.

Advanced 12 min read

What You'll Learn

Define record-level differential privacy using an explicit neighboring-dataset rule
Calibrate Laplace noise from query sensitivity and a privacy budget
Work through private group-rate and disparity estimates
Compare privacy-noise variability under different privacy budgets
Account for privacy loss when releasing multiple audit statistics
Recognize when denominators or group membership require additional privacy protection

Why Privacy Changes a Fairness Audit

A fairness audit can reveal sensitive information even when it reports only group summaries. A small group’s error count, for example, may make an individual’s outcome easier to infer when combined with other information. Differential privacy offers a formal way to limit how much a released statistic can depend on any one person’s record. It does so by adding calibrated random noise, which creates a deliberate tradeoff: stronger privacy generally means less precise audit estimates.

The central practical question is not simply whether noise is added. An auditor must specify what counts as one person’s contribution, measure how much the statistic could change when that contribution changes, choose a privacy budget, and explain how the resulting noise affects the reported group comparison. A private estimate also has ordinary sampling uncertainty; privacy noise does not replace that uncertainty.

Definition: A randomized release mechanism is $\varepsilon$-differentially private under an explicitly specified neighboring-dataset rule if, for every pair of neighboring data sets $D,D'$ and every possible set of released outputs $T$, $$ P(M(D)\in T)\leq e^\varepsilon P(M(D')\in T). $$ The rule for “neighboring” data sets describes what change to an individual’s data is being protected. Under an add/remove rule, two data sets are neighbors if one can be obtained from the other by adding or removing one person’s record. Smaller $\varepsilon$ gives a stronger privacy guarantee, but generally requires more noise for a fixed query.

Sensitivity and the Laplace Mechanism

A query is a statistic to be released, such as a count or a vector of counts. Its sensitivity measures the largest change in the query across neighboring data sets. For a vector query, the $L_1$ sensitivity is the greatest sum of absolute changes across its components. Under the add/remove rule, if one record can change at most one cell of a count vector by one, that vector has $L_1$ sensitivity 1.

Theorem: If a numerical vector query $f(D)$ has $L_1$ sensitivity $\Delta_1$, releasing $$ M(D)=f(D)+(Z_1,\ldots,Z_k), \qquad Z_j\sim \operatorname{Laplace}(0,b), \qquad b=\frac{\Delta_1}{\varepsilon}, $$ with independent noise in its $k$ coordinates is $\varepsilon$-differentially private. A Laplace random variable with scale $b$ has density $g(z)=\frac{1}{2b}e^{-|z|/b}$, mean 0, and variance $2b^2$.

The scale $b$ is measured in the same units as the query. For a count, it is in counts; for a dollar total, it is in dollars. Smaller $\varepsilon$ increases $b$, while a query with greater sensitivity needs more noise at the same privacy budget. Under a replacement-one-record rule, changing a record can affect more than one cell; sensitivity must be calculated for that rule rather than borrowed from the add/remove case.

Why the Noise Scale Gives the Privacy Guarantee

The guarantee follows by comparing the probability densities of the same released value under two neighboring data sets. For a vector query, the density at output $y$ is proportional to $\exp(-\|y-f(D)\|_1/b)$. The triangle inequality gives $\|y-f(D')\|_1-\|y-f(D)\|_1\leq\|f(D)-f(D')\|_1\leq\Delta_1$. Thus the ratio of the density under $D$ to the density under $D'$ is at most $\exp(\Delta_1/b)=\exp(\varepsilon)$. Integrating this density inequality over any output set $T$ gives the stated differential-privacy inequality. This argument also shows why both sensitivity and the noise scale matter.

A useful consequence is post-processing: calculating a rate, difference, or chart from an already private release does not require extra privacy budget, provided the calculation uses only the released output and public information. Post-processing cannot restore the information obscured by noise. If a calculation uses new confidential data, it is not merely post-processing.

Worked Example: A Noisy Difference in Group Error Rates

A hypothetical audit compares false-negative rates for two groups. The audited group sizes are fixed and public: $n_A=200$ and $n_B=100$. The respective false-negative counts are 30 and 18. The auditor releases only the two counts with $\varepsilon=0.5$, under an add/remove-one-record rule. For this illustration, suppose the realized Laplace noise is $+1.2$ for group A and $-0.8$ for group B. Estimate the private rates and their difference, defined as group A’s rate minus group B’s rate.

Method and sensitivity. The query is the vector of the two false-negative counts. One record contributes to at most one of these cells by one, so its $L_1$ sensitivity is $\Delta_1=1$. The Laplace scale is $b=\Delta_1/\varepsilon=1/0.5=2$ counts.

Add the realized noise. The released counts are $30+1.2=31.2$ for group A and $18-0.8=17.2$ for group B. Noisy counts can be fractional because the mechanism adds real-valued noise.

Calculate the rates. Since the denominators are stipulated to be public and fixed, the rates are $31.2/200=0.156$ and $17.2/100=0.172$. The private estimate of the difference is $0.156-0.172=-0.016$, or $-1.6$ percentage points.

Check. Without privacy noise, the rates are $30/200=0.150$ and $18/100=0.180$, giving a difference of $-0.030$. The noise changes the difference by $0.014$: group A’s rate rose by $1.2/200=0.006$, while group B’s fell by $0.8/100=0.008$, so the difference rises by $0.006-(-0.008)=0.014$. The calculation avoids the mistake of treating the noisy count as if it were already a rate.

The public-denominator assumption is important. If group sizes are confidential, dividing by their unprotected values can disclose information. The denominators would need to be protected as well, with the privacy cost and instability of a noisy ratio considered.

How the Budget Affects Disparity Accuracy

For two counts with fixed, public denominators, suppose independent Laplace noise with scale $b=1/\varepsilon$ is added to each count. If the actual group sizes are $n_A,n_B$, the noise component of the estimated rate difference is $Z_A/n_A-Z_B/n_B$. Because independent Laplace errors have mean zero and variance $2b^2$, the difference has zero-mean privacy error with variance $$ \operatorname{Var}\left(\frac{Z_A}{n_A}-\frac{Z_B}{n_B}\right) =2b^2\left(\frac{1}{n_A^2}+\frac{1}{n_B^2}\right). $$

This is the variance due to privacy noise alone, not a full confidence interval for the fairness statistic. Audit estimates also vary because the observed people are a sample from a population. If both sources of uncertainty matter, they should be described distinctly and combined only under appropriate assumptions. In particular, the Laplace difference is not itself generally Laplace, so a Laplace tail formula should not be applied directly to the difference.

Worked Example: Comparing Two Privacy Budgets

In a hypothetical audit, group A has $n_A=250$ observations and 40 false negatives; group B has $n_B=150$ observations and 30 false negatives. The group sizes are public. First release the two counts with $\varepsilon=0.5$, and suppose the realized noises are $+2$ and $-1$. Then compare the standard deviation of privacy noise in the rate difference under budgets $\varepsilon=0.5$ and $\varepsilon=1$.

Method. The count vector has $L_1$ sensitivity 1 under add/remove adjacency. At $\varepsilon=0.5$, the scale is $b=1/0.5=2$. The private counts in this specified release are $40+2=42$ and $30-1=29$.

Calculate the released rates and gap. The rates are $42/250=0.168$ and $29/150=0.193333\ldots$. Therefore the group A minus group B difference is $0.168-0.193333\ldots=-0.025333\ldots$, or $-2.5333\ldots$ percentage points. The unperturbed difference was $40/250-30/150=0.160-0.200=-0.040$, so the specified noise realization changes it by about $0.014667$.

Compare privacy-noise standard deviations. At $\varepsilon=0.5$, $b=2$, so the variance of the rate-difference noise is $2(2^2)(1/250^2+1/150^2)=8(0.000016+0.000044444\ldots)=0.000483556\ldots$. Its standard deviation is approximately $0.0220$. At $\varepsilon=1$, $b=1$, so the variance is $2(1^2)(0.000016+0.000044444\ldots)=0.000120889\ldots$, with standard deviation approximately $0.0110$.

Check. Doubling $\varepsilon$ halves the noise scale and, here, halves the standard deviation of the rate-difference noise. It does not guarantee that every realized estimate is closer to the true difference; it reduces the distribution’s spread. The calculation avoids claiming that a larger privacy budget removes sampling uncertainty.

Multiple Releases and Budget Accounting

If separate analyses are run on the same confidential records, their privacy costs accumulate. Under basic composition, releasing one $\varepsilon_1$-differentially private result and then one $\varepsilon_2$-differentially private result gives a combined guarantee of at most $(\varepsilon_1+\varepsilon_2)$-differential privacy. This bound is a useful conservative accounting rule. Repeatedly releasing counts with fresh noise is not free simply because the query is familiar.

By contrast, a single vector release can answer several related count questions at once. Its privacy cost is calibrated to the sensitivity of the whole vector, not automatically charged once per coordinate. Under add/remove adjacency, a person who changes only one cell of a histogram contributes one unit of $L_1$ change across the vector. The release still requires the stated mechanism and sensitivity calculation; it is not a general permission to ignore repeated queries.

Worked Example: Splitting a Budget Across Two Releases

An audit team plans two separate releases from the same hypothetical data set: group A’s false-negative count with $\varepsilon_A=0.2$, and group B’s count with $\varepsilon_B=0.3$. Each is a count with add/remove sensitivity 1. Find the total basic privacy guarantee and each Laplace scale. Also find the distance $t$ such that a single Laplace noise term at each scale has probability 0.05 of exceeding $t$ in absolute value.

Account for composition. The combined budget is $0.2+0.3=0.5$, so the two releases together are $0.5$-differentially private under basic composition.

Calibrate each release. The scale for group A is $1/0.2=5$ counts. The scale for group B is $1/0.3=3.3333\ldots$ counts.

Calculate the noise thresholds. For $Z\sim\operatorname{Laplace}(0,b)$, $P(|Z|>t)=e^{-t/b}$. Setting this equal to $0.05$ gives $t=b\ln(20)$, where $\ln(20)\approx2.9957$. Thus the thresholds are $5(2.9957)\approx14.98$ counts for A and $3.3333\ldots(2.9957)\approx9.99$ counts for B.

Check. Each threshold describes one noise term, not a 95% interval for the difference between the two noisy counts or their rates. The calculation avoids the common error of adding the two privacy budgets incorrectly or treating the two separate releases as a single release with no composition cost.

If the counts could instead be released as one vector with sensitivity 1, a single vector mechanism at total $\varepsilon=0.5$ would use scale $1/0.5=2$ for both cells. That option may be more accurate than the separate releases above, but the audit design must ensure that the vector query and its sensitivity truly match the data-contribution rule.

Interpreting Private Fairness Results Responsibly

Noise can matter especially when groups are small. A fixed count perturbation becomes a larger rate perturbation when divided by a smaller denominator. For instance, a one-count error changes a rate by $1/50=0.02$ in a group of 50 but by $1/500=0.002$ in a group of 500. A private disparity estimate may therefore be too noisy to support a confident comparison, even if the underlying audit was otherwise carefully designed. This is a limitation to communicate, not a reason to interpret noise as evidence of equal outcomes.

The audit plan should state the protected unit, neighboring-data rule, query, sensitivity, privacy budget, and whether group denominators are public or privatized. It should also distinguish the private release from any later calculation based only on that release. If group membership or the outcome being audited can itself identify a person, those facts belong in the privacy design; privately releasing a count does not make every other data-handling choice harmless.

A common error is to select a privacy budget without checking the scale and units of the statistic. Another is to label a noisy point estimate “the disparity” without indicating its privacy noise or the limits on interpretation. A sound report explains that differential privacy bounds the influence of one record under the chosen definition of adjacency; it does not establish that the model is fair, eliminate bias, or guarantee that an individual’s information is impossible to infer.

Key takeaway: For a fairness-audit release, define adjacency first, calculate query sensitivity, and set noise using $b=\Delta_1/\varepsilon$. Then interpret the resulting group rates with their denominators and privacy noise in view. Differential privacy is a disclosure-control guarantee, not a fairness criterion. This treatment is aligned with the SOA Exam PA (Predictive Analytics) syllabus.

Check Your Understanding

For each problem, state the relevant sensitivity or privacy-noise calculation before giving the requested result.

A scalar count has add/remove sensitivity 3 and is released with $\varepsilon=0.6$. What Laplace scale is required? (Answer: 5 count units.)
A Laplace noise term has scale 4. Find $P(|Z|>8)$, to four decimals. (Answer: $e^{-2}\approx0.1353$.)
Two public group sizes are $n_A=100$ and $n_B=200$. Their event counts are 20 and 30. A private count release with sensitivity 1 and $\varepsilon=1$ has realized noise $+1$ for A and $-2$ for B. What is the released rate difference, A minus B? (Answer: $21/100-28/200=0.0700$, or 7.00 percentage points.)
Two separate count releases from the same data use budgets $0.15$ and $0.25$, with sensitivity 1 for each query. What is the basic composed budget and the two noise scales? (Answer: total $\varepsilon=0.40$; scales $6.6667$ and $4$ count units.)
Two groups each have public size 100. Independent Laplace noise of scale $b=2$ is added to their event counts. What is the standard deviation of the privacy-noise component of the difference in rates? (Answer: $\sqrt{2(2^2)(1/100^2+1/100^2)}=0.0400$, or 4.00 percentage points.)

Back to Tutorials