Mechanism Design via Differential Privacy
Practical privacy: the SuLQ framework