Privacy Preserving AI (Andrew Trask) | MIT Deep Learning Series

Remote execution allows computations to be performed on data located on a remote machine (e.g., a hospital server) without the data ever leaving that machine. This means data scientists can work with data they don't have direct access to, thus preserving its privacy.

Differential privacy is a mathematical framework that allows for statistical analysis of data while providing strong privacy guarantees. It works by adding a controlled amount of random noise to the results of queries or computations, making it difficult for an attacker to infer information about any single individual from the dataset.

Traditional data anonymization methods, like redacting sensitive fields, are often insufficient because even seemingly anonymous data can contain unique statistical signals. Researchers can sometimes link this data to other publicly available information (like movie ratings or medical records) to re-identify individuals.

Secure multi-party computation (MPC) is a cryptographic technique that allows multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. This enables collaborative analysis and model training on distributed datasets where participants do not trust each other.

The primary challenge with MPC for deep learning is computational complexity, leading to significant slowdowns compared to plaintext computations (up to 13x). Optimizing for non-linear functions, common in neural networks, is particularly demanding.

By allowing data to remain secure and private while still enabling analysis, these technologies can unlock vast amounts of data currently siloed in enterprises and institutions. This 'ImageNet for all data tasks' scenario could accelerate scientific discovery across numerous fields.

An end-to-end encrypted service uses a combination of MPC (for input privacy), ML logic (often in encrypted form), and differential privacy (for output privacy) to provide services like medical diagnosis or personalized recommendations without the provider ever seeing the user's raw data or the sensitive computations performed.

Yes, AI models can still exhibit biases even when trained using privacy-preserving techniques. The encryption itself doesn't inherently remove bias from the data; however, it allows for introspection (using a portion of the privacy budget) to measure and potentially adjust for bias without revealing individual data.

Federated learning, like Google's implementation for next-word prediction, trains models locally on devices. While a step towards privacy, it's not inherently secure and can lead to data leakage or memorization. It's often combined with differential privacy to enhance its privacy guarantees.

Achieving individual control over privacy budgets will likely require a phased approach, starting with enterprise adoption driven by commercial value. Eventually, infrastructure may include centralized accounting mechanisms or 'data banks' akin to financial institutions to manage cross-enterprise data usage and budgets.

Currently, recommendation systems primarily optimize for engagement. With privacy-preserving AI, they could access sensitive private data (without viewing it) to optimize for more holistic goals like improving sleep or fostering meaningful friendships, leading to more beneficial recommendations.