How much is enough? choosing ε for differential privacy
Practical privacy: the SuLQ framework