differential privacy

Differential privacy adds calibrated noise during training to mathematically guarantee training examples can't be extracted. **Core guarantee**: Model output is statistically similar whether any individual example is in training data or not - bounded privacy leakage (ε, δ parameters). **Mechanism (DP-SGD)**: Clip individual gradients (bound influence), add Gaussian noise to aggregated gradients, privacy amplification through subsampling. **Privacy budget (ε)**: Lower ε = stronger privacy, but more noise = lower accuracy. Typical values: 1-10. **Trade-offs**: Privacy vs utility - more privacy requires more noise, degrades model quality. Need large datasets to overcome noise. **For LLMs**: DP-SGD during training, DP fine-tuning of pretrained models, inference-time DP for queries. **Advantages**: Mathematically provable guarantee, composes across multiple analyses, standardized framework. **Limitations**: Accuracy degradation, computational overhead, privacy budget accounting complexity, may not protect all types of information. **Tools**: Opacus (PyTorch), TensorFlow Privacy. **Regulations**: Increasingly viewed as gold standard for privacy compliance in ML.