"Proving Differential Privacy in Hoare Logic."

Gilles Barthe et al. (2014)
a service of  Schloss Dagstuhl - Leibniz Center for Informatics