# Are Privacy-Enhancing Technologies a Myth?

Fabiana Clement, MLOps Community & Charles Radcliffe | MLOps Community | Episode 4 | 22:59

Source: https://www.youtube.com/watch?v=HOSbcySk6yI
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/are-privacy-enhancing-technologies-a-myth
Published: 2020-11-26
Tags: privacy, synthetic-data

## TL;DR
- Privacy-enhancing technologies cover different methods for reducing privacy risks in machine learning, including homomorphic encryption, differential privacy, federated learning, and synthetic data.
- Each method has a cost or limitation: homomorphic encryption can make computation much slower, federated learning depends on communication and varied device capabilities, and synthetic data cannot repair poor source data.
- Facebook's differential privacy project showed the trade-off between privacy and data utility, since adding more randomness protects individuals more strongly but can reduce the usefulness of released data.

## Summary
Fabiana Clement introduces privacy-enhancing technologies as methods for using data in machine learning while reducing privacy and security risks. She explains four approaches. Homomorphic encryption lets a third party compute on encrypted data, although the computation can become far slower. Differential privacy adds mathematical protections by making analyses produce similar inferences whether a person is included in a dataset or not. Federated learning trains a shared model across devices while keeping training data local, but communication and device differences create engineering problems. Synthetic data is generated by computer models and can give data science teams access to useful patterns without a one-to-one link to real records. Clement is careful about the limits. Synthetic data does not fix low-quality source data, and Facebook's experience showed that stronger privacy can reduce data utility. The episode ends with examples from Facebook, Hazy, and YData, plus a preview of a later discussion about homomorphic encryption.

## Key ideas
### Privacy-enhancing technologies reduce risks while keeping machine learning possible
[03:32](https://www.youtube.com/watch?v=HOSbcySk6yI&t=212s)
Clement defines privacy-enhancing technologies as a broad group of technologies designed to support privacy and data protection. She frames the central question as whether organizations can obtain commercial, scientific, and social value from data without compromising information security. The technologies have different objectives and fit different situations, so she focuses on four approaches: homomorphic encryption, differential privacy, federated learning, and synthetic data.

### Homomorphic encryption allows computation on data that remains encrypted
[05:43](https://www.youtube.com/watch?v=HOSbcySk6yI&t=343s)
With homomorphic encryption, data owners encrypt their data and a third party performs computations without seeing the underlying information. The encrypted results go back to the owner, who can decrypt them. Clement uses medical data as an example, where hospitals could receive the results of analysis without exposing the records. The limitation is speed. She says applying fully homomorphic schemes to a full dataset can make computation about a million times slower than equivalent work on unencrypted data.

### Differential privacy protects individuals by making their inclusion hard to infer
[08:15](https://www.youtube.com/watch?v=HOSbcySk6yI&t=495s)
Clement describes differential privacy as a mathematical definition of privacy for statistics and machine learning. An analysis should lead to essentially the same inference about a person's private information whether or not that person is in the input data. Her example uses Bob, an alcoholic who joins a survey about alcohol intake and liver cancer. The population-level conclusion should not reveal information specific to Bob. Differential privacy generally introduces random noise before statistical information is extracted, which creates a trade-off between privacy and accuracy.

### Federated learning keeps training data on local devices
[11:05](https://www.youtube.com/watch?v=HOSbcySk6yI&t=665s)
Federated learning lets multiple actors build a shared model without sending their data to a central location. Local models are sent to a server, where their weights are averaged and consolidated into a global model. That model is then returned to the devices. Clement connects this approach to mobile phones and other small devices. It can reduce the need to collect and store data centrally, and it can support low-latency predictions because inference happens on the device.

### Federated learning depends on communication and heterogeneous devices
[13:40](https://www.youtube.com/watch?v=HOSbcySk6yI&t=820s)
The distributed design creates practical problems. Communication can become a bottleneck in federated learning networks, so systems need methods that make communication more efficient. Devices may also differ widely in hardware, computing power, and communication capacity. Clement says a federated system must tolerate that variability. She also notes that federated datasets do not need to be identically distributed or similar in size, which makes the setting different from simpler decentralization assumptions.

### Synthetic data can reproduce patterns without copying real records one to one
[14:35](https://www.youtube.com/watch?v=HOSbcySk6yI&t=875s)
Synthetic data is generated by a computer rather than collected directly from real-world events. Clement gives synthetic earthquake waves as an older example, then describes newer methods that use deep neural networks and high computation to reproduce dataset patterns, attributes, details, and correlations. For machine learning, masking or hashing real data can make it less useful, while synthetic data can give practitioners faster access to granular data with fewer concerns about direct data breaches and internal authorizations.

### Synthetic data cannot correct problems in the original data
[18:08](https://www.youtube.com/watch?v=HOSbcySk6yI&t=1088s)
Clement warns that synthetic data needs careful use. If the original dataset has quality problems or does not contain enough useful information, synthesization will not solve them. She applies the familiar data science warning, "garbage in, garbage out," to synthetic data generation. She also leaves questions about how to validate synthetic data and whether it is suitable for production systems for later episodes.

### Facebook's differential privacy work shows the privacy and utility trade-off
[19:31](https://www.youtube.com/watch?v=HOSbcySk6yI&t=1171s)
Clement describes Facebook's initiative to support independent research on social media and elections by releasing privacy-preserving datasets. Researchers could study aggregated groups without identifying individual users. The first release ran into trouble because the data quality was poor. Adding more randomness increased privacy but reduced utility. Facebook later released a larger dataset that researchers could use, and it also released mobility data during the COVID-19 response.

## Notable quotes
- Fabiana Clement: "Privacy enhancing technologies or pets which covers a very broad range of technologies that were designed with the particular objective of supporting privacy and data protection." (04:32)
- Fabiana Clement: "Homomorphic encryption is an encryption form that allows data owners to encrypt their own data while allowing a third party to perform computations on it without even knowing anything about the underlying data." (06:06)
- Fabiana Clement: "Federated learning can be shortly described as collaborative machine learning without centralized data." (11:05)
- Fabiana Clement: "The more randomness you introduce, the more private the data will be, but also that data will have much less utility." (21:09)

## Tools & references mentioned
- MLOps Community
- YData
- homomorphic encryption
- differential privacy
- federated learning
- synthetic data
- IBM differential privacy
- PyTorch Opacus
- Facebook
- Google
- Hazy
- Opacus

## Who should watch
- You are building machine learning systems that use sensitive medical, device, or user data and need a practical overview of privacy-preserving options.
- You want to understand the trade-offs behind homomorphic encryption, differential privacy, federated learning, and synthetic data before choosing an approach.
- You work with synthetic datasets and need a reminder that generated data inherits problems from poor source data.

## Related talks

- [Privacy-preserving ML with Differential Privacy](https://mlopstalks.com/talks/privacy-preserving-ml-with-differential-privacy) (Christos Dimitrakakis, University of Oslo & Fabiana Clemente, 35:56)
- [When Machine Learning Meets Privacy, Episode 1](https://mlopstalks.com/talks/when-machine-learning-meets-privacy-episode-1) (Fabiana Clemente, YData, 18:44)
- [ML and Encryption: It's All About Secure Insights](https://mlopstalks.com/talks/ml-and-encryption-its-all-about-secure-insights) (Fabiana Clemente, MLOps Community & Théo Ryffel, Arkhn and Open-Mined, 36:06)
- [Private data, Data Science friendly](https://mlopstalks.com/talks/private-data-data-science-friendly) (Jean-François Rajotte, University of British Columbia & Sumit Mukherjee, Microsoft AI for Good Research Lab, 41:39)
- [Security and Privacy](https://mlopstalks.com/talks/security-and-privacy) (Ads Dawson, Kaseya & Katharine Jarmul, Thoughtworks & David Haber, Lira, 34:37)