  We identify a new class of vulnerabilities in implementations of differential
privacy. Specifically, they arise when computing basic statistics such as sums,
thanks to discrepancies between the implemented arithmetic using finite data
types (namely, ints or floats) and idealized arithmetic over the reals or
integers. These discrepancies cause the sensitivity of the implemented
statistics (i.e., how much one individual's data can affect the result) to be
much larger than the sensitivity we expect. Consequently, essentially all
differential privacy libraries fail to introduce enough noise to meet the
requirements of differential privacy, and we show that this may be exploited in
realistic attacks that can extract individual-level information from private
query systems. In addition to presenting these vulnerabilities, we also provide
a number of solutions, which modify or constrain the way in which the sum is
implemented in order to recover the idealized or near-idealized bounds on
sensitivity.
