Logical counterfactuals and differential privacy — LessWrong