Strip the name and the patient number off an EEG recording and what remains is still traceable. EEG carries an individual signature, which has been known for years, so removing identifiers does not finish the job. The method the field reaches for instead is differential privacy, because rather than promising that a record "cannot be identified" it hands you a number, ε, and says that one person's presence or absence can move the released output by at most that much.
The engineering question is what ε = 1 actually costs in noise on a table of EEG features. A new paper from the University of South-Eastern Norway builds exactly that pipeline and puts its parameters on the table. The most valuable thing in it is a mismatch in the authors' own implementation, which they report plainly: the noise they added is about nineteen times smaller than a formal guarantee would require.
what actually leaves the hospital
Start with what is released, because every number downstream depends on it. The raw signal is not released. They take 122 recording files at roughly 33 channels and 250–500 Hz, band-pass from 0.5 to 70 Hz, notch out mains at 50 Hz, average re-reference, and cut the signal into 2-second windows at 50% overlap.
From each window, on each channel, they compute eleven numbers: line length, root mean square, variance, zero-crossing rate, band power in δ, θ, α, β, γ and high-γ, and the 95% spectral edge frequency. Eleven features across 33 channels is 363. Window-level features are then averaged per patient, so each patient ends up as exactly one 363-dimensional vector. That table, one row per patient, is the released object.
The privacy unit is the same thing: one whole patient, not one window and not one file. Their adjacency relation is stated explicitly: two tables are neighbours if they hold the same number of patients and differ in exactly one patient's complete feature vector. Hold onto that definition, because every number that follows is derived from it.
bounding one patient's contribution
Before you can size the noise you need to know how far one person can move the output. That quantity is the sensitivity, and you obtain it by capping each patient's contribution.
The cap is simple. Each patient vector is scaled down so its length does not exceed a fixed threshold, set here to C = 2.0, where length means the L2 norm, the square root of the sum of squared entries. Swap one patient for another and the worst case removes a vector of length 2 and inserts a vector of length 2, so the whole table moves by at most 2C, or 4 units, in L2. That is the L2 sensitivity, Δ₂ = 4.0.
Nothing is wrong so far. The Gaussian mechanism runs on exactly this quantity: add normal noise with standard deviation σ, and derive σ from the L2 sensitivity together with ε and δ. The paper fixes δ = 10⁻⁵ and sweeps ε over 0.5, 1, 2, 5, 10 and 20.
follow the numbers, and see where nineteen comes from
The second mechanism is Laplace, and this is where intuition misleads. Laplace noise is added independently to each coordinate, and its scale is not calibrated to the L2 sensitivity. It is calibrated to the L1 sensitivity, the sum of absolute values rather than the square root of the sum of squares.
In high dimensions those two norms are nowhere near each other. If all you know is that a vector's L2 length is at most r, the only thing you can conclude about its L1 norm is that it is at most r√d, where d is the number of entries. The worst case is the vector whose mass is spread evenly across all coordinates, and there the sum of absolute values is exactly √d times the square root of the sum of squares.
Now substitute. With d = 363 and C = 2.0, the L1 sensitivity bound is 2 × √363 × 2.0 ≈ 76.21, so the correct Laplace scale would be 76.21/ε.
What the implementation used was 4.0/ε, the L2 sensitivity dropped into the Laplace formula. Take the ratio: 76.21 / 4.0 = 19.05, which is precisely √363. So at ε = 1 the code added Laplace noise at scale 4 where a formal full-vector release needed scale 76.21.
And because Laplace variance goes as the square of the scale, the gap in power is worse still: the variance ratio is 19.05², which is exactly 363, the feature count itself. The correct noise carries 363 times the power of the noise that was actually added.
What matters is that the authors did not bury this. Both scales appear side by side in their text, with an explicit statement that the Laplace results characterise utility at the implemented magnitudes and are not claimed to provide a formal full-vector ε-DP guarantee under their adjacency relation. That honesty is the best thing in the paper, and it is not what most comparable papers do.
why nobody runs the correct scale
The answer is also arithmetic, and it is worth a moment. The clipped vector has length at most 2 across 363 entries, so the root-mean-square magnitude of a single entry is at most 2/√363 ≈ 0.105. Laplace noise at scale 76.21 has a standard deviation of 76.21 × √2 ≈ 108.
That is noise roughly a thousand times the signal. The released vector would be indistinguishable from pure noise, and no utility measure computed on it would mean anything. So choosing the smaller scale was not an oversight of convenience. The correct scale, at this dimension, destroys the data outright. That is itself a finding, but it has to be stated as one: coordinate-wise Laplace is the wrong tool for releasing a 363-dimensional vector, rather than a formula you feed a smaller number into.
This is also where the Gaussian mechanism earns its place. Gaussian calibrates to L2 and never pays the √d penalty. That is the whole reason the Gaussian mechanism exists: accept a small δ, and the square-root-of-dimension factor goes away.
the dimension is a privacy parameter
The practical consequence runs past this one paper. The √d factor wires the feature count directly to the noise magnitude.
33 channels × 11 features = 363, giving a factor near 19. Run the same eleven features on a 64-channel headset and d = 704, pushing the factor to about 26.5. Add a single extra per-channel feature at 33 channels and 33 × 12 = 396 takes it to about 19.9.
Nobody writing a feature-extraction function thinks they are making a privacy decision. Under coordinate-wise Laplace, feature selection is the privacy decision. Every channel you add makes the same ε more expensive, and that cost shows up in no accuracy plot and no resource report.
the quieter leak
There is something else in the same paper, quieter than the factor of nineteen and more important. Before clipping and noise, each feature column is normalised: subtract the median, divide by the interquartile range.
The problem is that this median and this interquartile range are computed across the very patients being protected. A statistic drawn straight out of the confidential data sits in the release pipeline with no noise on it at all. The authors flag this too, noting that the sensitivity bounds assume a fixed scaling transformation and do not establish an end-to-end guarantee for the complete preprocessing pipeline.
This is the classic differential-privacy failure. The mechanism is correct, the noise is correct, and the guarantee still does not hold, because the guarantee is a property of the entire path from raw data to released artifact, not a property of the function that adds the noise. Anywhere a statistic is drawn from private data and travels through the pipeline unbudgeted, the same thing happens.
what the library will not do for you
The noise here came from IBM's differential privacy library. I raise that because both problems above sit outside anything a library can catch.
Every DP library takes the sensitivity as an argument and faithfully adds exactly the noise you asked for. It does not know your vector's dimension, it does not know which norm your clipping threshold was set on, and it does not know your adjacency relation. In practice I have never seen that derivation written down anywhere reviewable; the call that adds the noise always gets read in review, while the few lines of algebra that take you from an adjacency relation to a sensitivity bound stay in somebody's head. Any serious privacy review should start with those few lines, not with the library call.
how much the results can carry
Several constraints come from the paper itself and deserve respect. Each privacy configuration was evaluated with a single noise realisation: one draw, no repeats, no error bars. The dataset is 122 files with imbalanced classes. Labels were assigned at patient level by matching seizure-related keywords in metadata files.
So the ε-versus-utility curve should not be read as a price list you pick a budget from. The paper calls it a case study and claims no more; the classification experiment is explicitly framed as a side check on how much of the data survives, not as the objective.
the chain that ε sits at the end of
ε looks like a dial: open it wider and more of your data survives. But ε is the last link in a chain and means nothing on its own.
The chain starts with the adjacency relation, with what you are hiding, one patient or one window. Then how tightly that unit's contribution is capped. Then which norm the cap was set on, and which norm the mechanism you picked actually consumes. Then the number of dimensions, which multiplies the noise on one of those paths and not on the other. ε arrives only after all of that.
Get any link wrong and ε still prints, still sits neatly in the results table, and still raises no warning. The only thing that makes a privacy claim checkable is publishing the whole chain. What this paper did, and this is precisely its value, was expose the link that was not tight in its own work.