Differential privacy mathematically guarantees, by injecting controlled noise, that the addition or removal of any single record has a negligible effect on the output, measured by the privacy budget ε; the smaller ε is, the stronger the privacy protection but the lower the data utility.