Differential privacy mathematically guarantees that an individual patient record cannot be reverse-identified by adding controlled noise to the data or gradients.