Proving Differential Privacy in Hoare Logic | Publicación