Right. Even if you assume the worst-case-scenario there isn't some standard risk metric nor threshold to meet. I feel like differential privacy is the stronges

Right. Even if you assume the worst-case-scenario there isn't some standard risk metric nor threshold to meet. I feel like differential privacy is the strongest definition we have, but it is also lacking from a practical standpoint. What does it mean to have N nats/bits of information gain from seeing the result of a query? How does this translate to my risk of a PII leak?