Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
January 28, 2022 09:22


PipelineDP is a framework for applying differentially private aggregations to large datasets using batch processing systems such as Apache Spark, Apache Beam, and more.

To make differential privacy accessible to non-experts, PipelineDP:

  • Provides a convenient API familiar to Spark or Beam developers.
  • Encapsulates the complexities of differential privacy, such as:
    • protecting outliers and rare categories,
    • generating safe noise,
    • privacy budget accounting.
  • Supports many standard computations, such as count, sum, and average.

Additional information can be found at

Note that this project is still experimental and is subject to change. At the moment we don't recommend its usage in production systems as it's not thoroughly tested yet. You can learn more in the Roadmap section.

The project is a collaboration between OpenMined and Google in an effort to bring Differential Privacy to production.

Getting started

Here are some examples of how to use PipelineDP:

Please check out the codelab for a more detailed demonstration of the API functionality and usage.

Code sample showing private processing on Spark:

# Define the privacy budget available for our computation.
budget_accountant = pipeline_dp.NaiveBudgetAccountant(total_epsilon=1,

# Wrap Spark's RDD into its private version. You will use this private wrapper
# for all further processing instead of the Spark's RDD. Using the wrapper ensures
# that only private statistics can be released.
private_movie_views = \
    make_private(movie_views, budget_accountant, lambda mv: mv.user_id)

# Calculate the private sum of ratings per movie
dp_result = private_movie_views.sum(
              # The aggregation key: we're grouping data by movies
              partition_extractor=lambda mv: mv.movie_id,
              # The value we're aggregating: we're summing up ratings
              value_extractor=lambda mv: mv.rating,

              # Limits to how much one user can contribute:
              # .. at most two movies rated per user
              #    (if there's more, randomly choose two)
              # .. at most one ratings for each movie
              # .. with minimal rating of "1"
              #    (automatically clip the lesser values to "1")
              # .. and maximum rating of "5"
              #    (automatically clip the greater values to "5")

# Save the results


PipelineDP without any frameworks:

pip install pipeline-dp

If you like to run PipelineDP on Apache Spark:

pip install pipeline-dp pyspark

on Apache Beam:

pip install pipeline-dp apache-beam.

Supported Python version >= 3.8.

Note for Apple Silicon users: PipelineDP pip package is currently available only for x86 architecture. The reason is that PyDP does not have pip pacakge. It might be possible to compile it from sources for Apple Silicon.


To setup a local environment and contribute with the development of PipelineDP, please see our guidelines in CONTRIBUTING.

Support and Community on Slack

If you have questions about the PipelineDP, join OpenMined's Slack and check the #differential-privacy channel.


PipelineDP is a Python framework for applying differentially private aggregations to large datasets using batch processing systems such as Apache Spark, Apache Beam, and more.



Code of conduct





No packages published