On the Protection of Private Information in Machine Learning Systems: Two Recent Approches

By Martín Abadi, Ú. Erlingsson, Ian J. Goodfellow, H. Brendan McMahan, Ilya Mironov, Nicolas Papernot, Kunal Talwar, Li Zhang. 2017

50 citations recorded by the source corpus.

The recent, remarkable growth of machine learning has led to intense interest in the privacy of the data on which machine learning relies, and to new techniques for preserving privacy. However, older ideas about privacy may well remain valid and useful. This note reviews two recent works on privacy in the light of the wisdom of some of the early literature, in particular the principles distilled by Saltzer and Schroeder in the 1970s.

Subfields: Artificial Intelligence, Sociology and Political Science

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

Citations in the corpus

Scalable Private Learning with PATE (2018, background): “Recently, two promising, new model-training approaches have offered the hope that practical, highutility machine learning may be compatible with strong privacy-protection guarantees for sensitive training data (Abadi et al., 2017).”
The Right Complexity Measure in Locally Private Estimation: It is not the Fisher Information (2018, background): “…and local minimax complexity, consider the one-dimensional logistic regression problem of predicting y ∈ {± 1 } from x ∈ R , with p θ ( y | x ) = (1 + exp( − yxθ )) − 1 , where—taking our motivation from applications of machine learning [28, 3, 1]—we wish only to accurately estimate p ( y | x ).”
PROCHLO: Strong Privacy for Analytics in the Crowd (2017, background): “Generally, privacy is intuitively understood as individuals’ socially-defined ability to control the release of their personal information [5,64].”
A Brief Introduction to Machine Learning for Engineers (2017, methodology): “38) as p(μ|xD, a, b) ∝ Beta (μ |a+N [1], b +N [0] ) = μ (1− μ) .”
When Machine Learning Meets Privacy (2020, methodology): “If an ensemble contains enough of models, and each model is trained with disjoint subsets of the training data in a distributed manner, then “any predictions made by most of the models should not be based on any particular part of the training data” [1].”
Algorithms that remember: model inversion attacks and data protection law (2018, background): “through the API business model above), or an white box attack, where an attacker requires full access to the model’s structure and parameters [23, 1].”
Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference (2018, background): “ and dataset D are (;) private if P(M(x2D) 2S) eP(M(x2D0) 2S) + . Applying differential privacy to neural networks helps ensure defenses against membership inference and model inversion attacks [3]. This can be achieved by either applying noise to gradients while training a single model [2] [61] or”