It's not central DP

[martinthomson]

The noise application part is basically central, but this is misleading. The individual model we use doesn't really care about where noise is added, so we still need to be clear we are adding noise at the aggregation service.

This was hard text to touch, as it is in a tricky part of the spec. I'd appreciate careful review.

Closes #479.

---

Preview | Diff

[bmcase]

comment on describing how much noise is added

[bmcase]

This is a bit subtle in that the noise added is always sufficient for what was requested to be spent as budget from your device, but one user may have a larger contribution toward the aggregate than other users in the aggregate if that user had more request from their device.

For example:
suppose there are two separate conversion requests to a user's device each asking to spend eps/2 budget for a Delta sensitivity query. The device deducts privacy budget for each as (eps/2)/(individual sensitivity/ Delta). At max individual sensitivity/ Delta = 1 and all of the devices eps budget is spent.

Then both of these get aggregated in the same batch with Lap(Delta/ (esp/2) ) noise applied. This user actually contributes 2*Delta toward the aggregate, but that is okay because they spent all their eps budget where as other users whose contribution to the aggregate is Delta spent only half of their budget.

so I would suggest something like the following. Plus separately adding a note about how the size of the aggregate doesn't impact the theoretical DP protection provided.

Suggested change

	Noise is added during aggregation as a single quantity
	that is proportional to the amount that an individual contributes.
	Noise added during aggregation is sufficient to protect the privacy of any individual contributing to the aggregate in accordance with how much privacy budget was spent from that individual's device. The DP guarantees do not change based on the aggregation group size; however, aggregating with larger groups can provide its own additional privacy benefit beyond what can be measured by DP.

[martinthomson]

Does this work?

Suggested change

	Noise is added during aggregation as a single quantity
	that is proportional to the amount that an individual contributes.
	Noise is added during aggregation as a single quantity
	that is based on the amount of privacy budget
	that has been consumed from each individual
	that contributes to the aggregate.
	Differential privacy guarantees do not change
	based on the number of individuals who participate.

[bmcase]

@martinthomson yes that looks good