"Proving differential privacy in Hoare logic."

Gilles Barthe et al. (2014)
a service of Schloss Dagstuhl - Leibniz Center for Informatics