Differential Privacy Quiz

Answers and explanations appear as you take the quiz.

1. For otherwise comparable differential-privacy mechanisms, what does a smaller epsilon specify?
   • A larger dataset file
   • An increased model parameter count
   • A tighter bound on the allowed privacy loss
   • A faster GPU clock
2. Why is noise calibrated to sensitivity in a differential-privacy mechanism?
   • To encrypt every raw record
   • To limit how a permitted neighboring-data change affects released output distributions
   • To remove the need to define neighboring datasets
   • To guarantee every person is impossible to identify under all conditions
3. What distinguishes the 'local' model of differential privacy from the 'central' model?
   • Local requires a fully trusted central curator
   • Local never uses any noise at all
   • Local works only on images
   • Local adds noise on each person's device before data leaves
4. What is 'sensitivity' used for when calibrating noise?
   • Measuring how much one person's data can change a query's result
   • Counting the number of columns in a table
   • Detecting hardware temperature
   • Choosing a font for the report
5. Why does each new query spend from a 'privacy budget'?
   • Queries cost money per row
   • Privacy loss accumulates across multiple analyses
   • The dataset shrinks with each query
   • Budgets are only about storage limits
6. What does correctly configured DP-SGD aim to bound through clipping, noise, and privacy accounting?
   • Every possibility of memorizing any fact
   • The total number of model layers automatically
   • The need for a training objective
   • The privacy loss associated with the specified neighboring training datasets
7. A count query includes each person at most once. Under adding or removing one person, what is its sensitivity?
   • One
   • The entire number of database columns
   • Zero because it is a count
   • The model’s hidden dimension
8. Two separately randomized analyses use the same private dataset. Why evaluate them together?
   • The second analysis deletes the first output
   • Each analysis makes the previous privacy cost exactly zero
   • Privacy loss can compose across the released outputs
   • Composition applies only to public data