What is Differential Privacy in Computing?

Differential privacy is a rigorous mathematical framework developed in computer science to provide provable, quantifiable privacy guarantees when extracting insights from sensitive datasets.

First formulated in 2006 by Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith, differential privacy answered a profound question: How can an analyst compute useful aggregate statistics across a population without revealing whether any specific individual participated in the dataset?

The mathematical definition of $(\epsilon, \delta)$-Differential Privacy

An algorithm $\mathcal{M}$ satisfies $(\epsilon, \delta)$-differential privacy if, for all neighboring datasets $D_1$ and $D_2$ differing by at most one individual’s record, and for all possible output subsets $S$:

$$\Pr[\mathcal{M}(D_1) \in S] \le e^{\epsilon} \cdot \Pr[\mathcal{M}(D_2) \in S] + \delta$$

Where:

• $\epsilon$ (epsilon) is the privacy loss budget. As $\epsilon \to 0$, the algorithm’s output distributions become mathematically indistinguishable regardless of whether your data was included.
• $\delta$ (delta) represents a small probability of catastrophic privacy failure (typically chosen to be smaller than $1/|D|$).

The mechanism: Adding calibrated mathematical noise

Differential privacy works by injecting precisely calibrated statistical noise into query results:

• Laplace Mechanism: Adds noise drawn from a zero-mean Laplace distribution scaled by the global sensitivity of the query $\Delta f$ divided by $\epsilon$: $\text{Lap}(\Delta f / \epsilon)$.
• Gaussian Mechanism: Adds noise drawn from a normal distribution, useful for vector embeddings and deep learning gradient updates (DP-SGD).

Local differential privacy vs Central differential privacy

1. Central DP: A trusted curator collects raw, unencrypted data from all users, computes aggregate statistics, injects mathematical noise, and publishes the noisy result.
2. Local DP (LDP): Each user’s device perturbs its own data locally before transmitting it over the network (used by Apple for macOS and iOS keyboard suggestions).

Why Oyma chooses Zero Telemetry over Differential Privacy

While tech giants often promote differential privacy as a justification for collecting telemetry, differential privacy has fundamental trade-offs:

• Privacy budgets ($epsilon$) accumulate over time; repeated queries eventually erode privacy.
• Even mathematically noisy data contains lingering metadata leaks (timestamps, IP addresses, network origins).

In Oyma, we take the purist engineering stance:

• We don’t collect noisy telemetry.
• We don’t collect private telemetry.
• We collect zero telemetry.

Your notes, meeting transcripts, and search patterns stay 100% on your Mac. When data remains on local disk without network transmission, privacy guarantees are structural.