How much is enough? choosing ε for differential privacy
Differential Privacy