Calibrating noise to sensitivity in private data analysis