Privacy-preserving release of aggregate dynamic models