Privacy-Preserving ML
Differential privacy accounting, federated learning, secure aggregation, and the utility cost of each guarantee.
12concepts
110flashcards
89minutes of reading
- 01 Attestation-Gated Key Release The deployment pattern that turns an attestation token into an enforceable control, where a key manager releases model weights or a data key only to an enclave whose measurements match policy, plus the revocation, upgrade and trust-concentration problems the pattern creates.
- 02 Confidential Computing for Model Inference How a CPU trusted execution environment paired with a GPU in confidential mode keeps prompts, KV cache and weights encrypted while they are being computed on, why the cost lands on the host-to-device transfer rather than the matmuls, and what the measured overhead is on Hopper and Blackwell.
- 03 Differential Privacy and the Epsilon You Actually Get What the differential privacy guarantee says precisely, how DP-SGD achieves it through clipping and noise, and why the epsilon values used in practice permit far more leakage than the formalism's reputation suggests.
- 04 Federated Learning and Secure Aggregation Why keeping data on device is not by itself a privacy guarantee, how gradient inversion recovers training inputs, and what secure aggregation does and does not prevent.
- 05 Machine Unlearning What it would mean to remove a training example's influence from a model, why retraining is the only exact method, and the approximate approaches and their verification problem.
- 06 Remote Attestation for AI Workloads What an attestation report actually contains, how a verifier turns raw evidence into a signed token by comparing measurements against reference values, why freshness and the composition of CPU and GPU evidence are where implementations go wrong, and the specific claims attestation cannot make.
- 07 Secure Multiparty Computation and Homomorphic Encryption for ML How secret sharing and homomorphic encryption let a server run a model on inputs it cannot read, why non-linear layers dominate the bill, and the measured overheads, from seconds for ResNet-50 to minutes per token for a 7B LLM, that decide where cryptographic inference is actually deployed.
- 08 Side Channels Against Confidential Inference The attack classes that survive memory encryption, from ciphertext side channels and single-stepping on confidential VMs to GPU power, interconnect and PCIe leakage, and what the repeated disclosure cycle implies for how much weight an attestation should carry.
- 09 Synthetic Data and What It Does Not Protect Why generating data from a model trained on real records does not by itself anonymise anything, the utility-privacy frontier that no generator escapes, and the evaluation that a synthetic dataset needs.
- 10 Verifiable Transparency and Non-Targetability Why attestation plus encryption still leaves a provider able to ship one bad build or single out one user, and how transparency logs, client-side enforcement, stateless nodes and anonymising relays turn a privacy promise into a property an outsider can check.