three utility functions for differential privacy