## 2 Methods and Materials
### Differential Privacy  
Definition 1 (differential privacy): If there is a mechanism \(F\) satisfying differential privacy protection, the sum of its outputs is \(S\) and \(\Pr[]\) is the probability of the output results. For all adjacent data sets \(A\) and \(A^{\prime}\), there is  
\[\frac{\Pr[F(A)=S]}{\Pr[F(A^{\prime})=S]}\leq e^{\varepsilon} \tag{1}\]  
Mechanism \(F\) is said to satisfy differential privacy [39], where \(\varepsilon\) is the privacy budget. When \(\varepsilon\) is smaller, \(F\) needs to give a very similar output and therefore provide higher privacy. Conversely, a larger \(\varepsilon\) allows \(F\) to give less similar outputs, providing less privacy. Satisfying Equation (1) is called the strictly satisfying \(\varepsilon\)-differential privacy definition.  
Definition 2 (approximate differential privacy): In the process of experimentation, because of too-strict protection, the availability of data will be seriously affected. In order to solve this problem, [PERSON] et al. [40] gave the concept of approximate differential privacy, when the  
\[\Pr[F(A)=S]\leq e^{\varepsilon}\Pr[F(A^{\prime})=S]+\delta \tag{2}\]  
where the privacy parameter \(\delta\) is a small constant indicating the \"probability of failure\" that does not meet this approximate differential privacy definition, and we set the \(\delta\) to 0.00001. Like strict differential privacy, approximate differential privacy, which is known as (\(\varepsilon\),\(\delta\))-differential privacy, also satisfies sequence combinatory and parallel combinatory.  
Satisfying approximate difference privacy means that if we change an element in the database, the probability of the output should be close to the probability of the original data, thus protecting the original data from leakage [41].  
Figure 1: Flowchart of breast cancer classification model with data privacy protection.  
**Definition 3 (global sensitivity).**_The sensitivity of the function reflects the degree to which the output changes when the input of the function changes. For a query function \(f:D\rightarrow\mathbb{R}^{k}\) and a norm function \(\left\|\cdot\right\|\), the sensitivity is_  
\[s(f_{\text{,}}\left\|\cdot\right\|)=\max_{d(A,A^{\prime})\leq 1}\left\|f(A)-f(A^{ \prime})\right\| \tag{3}\]  
The norm function is usually \(L_{1}\) or \(L_{2}\)[42], the length of the vector \(V\) is \(k\), the \(L_{1}\) norm is defined as \(\left\|v\right\|_{1}=\sum_{i=1}^{k}\left|v_{i}\right|\), thus the sum of the elements of the vector and the \(L_{2}\) norm is defined as \(\left\|v\right\|_{2}=\sqrt{\sum_{i=1}^{k}{v_{i}}^{2}}\). In two-dimensional space, the \(L_{2}\) norm is always less than or equal to the \(L_{1}\) norm.  
**Definition 4 (Gaussian noise mechanism).**_The Gaussian mechanism cannot satisfy strict \(\varepsilon\)-differential privacy, but it can satisfy (\(\varepsilon\),\(\delta\))-differential privacy, so for the function \(f:D\rightarrow\mathbb{R}^{k}\), the Gaussian mechanism defined below is applied to obtain \(F(A)\) satisfying approximate differential privacy:_  
\[F(A)=f(A)+N(\sigma^{2}) \tag{4}\]  
_where \(N(\sigma^{2})\) represents the Gaussian (normal) distribution sampling result with a mean of 0 and a variance of \(\sigma^{2}\), where \(\sigma^{2}\geq c\Delta_{2}f^{2}/\varepsilon^{2}\), \(c^{2}\geq 2\ln(1.25/\delta)\)[39], \(\Delta_{2}f\) is the \(L\) global sensitivity._