privacy-preserving machine learning

The collection of methods that let machine-learning models be trained, evaluated or used without exposing sensitive data beyond what a stated threat modelthreat model, n.: A clear statement of who might attack a system, what they want, what they know and what they can do — the yardstick for judging whether a defense is good enough. allows. Statistical methods limit what outputs reveal about individuals (differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person., DP-SGDDP-SGD, abbr.: A way of training a neural network so that it cannot learn too much about any single person in the data: each example's influence is capped, and random noise is added at every step., PATEPATE, abbr.: A privacy method in which several 'teacher' models, each trained on a separate slice of sensitive data, vote noisily to label public examples, and a 'student' model learns only from those noisy votes.); architectural methods keep data where it is (federated learningfederated learning, n.: Training one shared AI model across many phones, hospitals or companies without collecting their data in one place: each trains on its own data and sends back only model updates., on-device processing); cryptographic methods compute on data that stays hidden (secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others., homomorphic encryptionhomomorphic encryption, n.: A way of locking data so that a computer can still work with it while it stays locked: the computer never sees the real numbers, and only the owner can open the answer., secure aggregationsecure aggregation, n.: A cryptographic trick that lets a server add up updates from many devices while learning only the total, never any single device's contribution.); and hardware methods isolate computation (confidential computingconfidential computing, n.: Running computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine.). The techniques protect different things — inputs, training data, model parameters or outputs — and are often combined. Each trades privacy against accuracy, cost or trust assumptions, and privacy attacks such as membership inferencemembership inference attack, n.: An attack that tries to tell whether a particular person's record, or a particular document, was part of an AI model's training data — which can itself reveal private facts. are used to audit them.

The privacy-preserving machine learning stack combined federated learning, secure aggregation and differential privacy.