dpgmean: Differentially-private mean via the analytic Gaussian...

In rmoriedata: Integrated Datasets for the 'rmorie' Package

Differentially-private mean via the analytic Gaussian mechanism

Description

Releases an (\epsilon, \delta)-DP mean of a bounded numeric vector, as a noised sum over a noised count, each with half the budget. Under the add-or-remove-one relation every mechanism here uses, one record moves the clipped sum by at most max(abs(lower), abs(upper)) and the count by 1, so neither the sum nor length(x) is treated as public.

Usage

dpgmean(x, lower, upper, epsilon, delta = 1e-06, budget = NULL)

Arguments

x	Numeric vector (no NAs).
lower, upper	Hard bounds on x. Values outside are clipped (with a warning); the bounds must be chosen without looking at the data.
epsilon, delta	Privacy parameters for the whole release. delta should be well below 1 / length(x).
budget	Optional dpbudget() to charge against.

Details

Each half is calibrated with the analytic Gaussian mechanism (Balle and Wang 2018), which holds for every \epsilon > 0; the classical bound \sigma = \Delta \sqrt{2 \ln(1.25/\delta)}/\epsilon holds only for \epsilon \le 1 and is not used. Noise comes from the operating system's CSPRNG; set.seed() has no effect.

Value

A noised mean (single numeric).

References

Balle and Wang (2018), Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising, ICML.

Examples

x <- runif(1000, 0, 1)
dpgmean(x, lower = 0, upper = 1, epsilon = 1.0)
mean(x) # the true mean, for comparison

# Wider bounds raise sensitivity, so the same epsilon adds more noise.
dpgmean(x, lower = -5, upper = 5, epsilon = 1.0)

rmoriedata documentation built on Nov. 12, 2026, 9:06 a.m.