dp-group-stats

How do you repeatedly publish useful numbers about a small group, such as the actual working hours of cardiologists in a state, without exposing anyone in it? The math exists: k-anonymity and differential privacy. But general-purpose libraries are made for one-off statistical analyses. They don't handle the same small groups being published repeatedly, so the protection wears away. dp-group-stats is a free, open-source Python library for this problem. Every publication runs through the same safeguards: contributions are clipped, groups that are too small or dominated by one person are held back, and a rule stops a statistic from leaking information when it appears or disappears. A privacy budget is tracked for each person across all releases and groupings, so that repeated publication can never spend more than an annual cap. The pipeline already runs in production in Open Working Hours, an app where healthcare workers in Germany document their real working hours. The grant turns it into a general library for publishing numbers about small groups, whatever those numbers measure: the whole pipeline packaged as one function, so no safeguard can be skipped; a guided setup that shows how parameter choices trade accuracy against privacy; a threat model and adopter documentation; and tighter privacy accounting (zCDP/PLD).