# Unleashing Sensitive Datasets with Distributed Data Science

Blaise Thomson, Bitfount | MLOps Meetup | Episode 112 | 39:26
Hosted by Ben Epstein

Source: https://www.youtube.com/watch?v=yju0E6OdRkc
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/unleashing-sensitive-datasets-with-distributed-data-science
Published: 2022-11-04
Tags: finance, governance, healthcare, privacy

## TL;DR
- Distributed data science sends algorithms to sensitive data instead of moving the data to the analysis environment.
- Usage-based access controls can specify how a person may use data, such as evaluating a model without training one or receiving any data.
- Federated learning can combine data from different sites, improving models when each site has different examples or demographics, without transferring the underlying data.

## Summary
Blaise Thomson explains how distributed data science lets teams work with medical, financial, and device data that cannot easily leave its current location. The basic pattern is to send algorithms to the data, then return protected analytics or model updates. This supports permissions based on intended use, such as allowing model evaluation while blocking training or data export. Thomson reviews tokenization, synthetic data, aggregation, differential privacy, trusted execution environments, homomorphic encryption, secure multi-party computation, and private set intersection. He illustrates federated learning with an eye-disease image dataset split across sites with different disease distributions. Training across all sites produced the best model in that experiment because it exposed the training process to more examples. He is candid about the cost: engineers lose direct visibility into individual records and must rely on tools such as histograms, SQL-style analysis, and testing on accessible data. The approach applies to tabular, image, and NLP models.

## Key ideas
### Sensitive data becomes usable when computation moves to the data
[05:52](https://www.youtube.com/watch?v=yju0E6OdRkc&t=352s)
Thomson frames distributed data science around data that cannot be directly inspected or transferred, including medical and financial records and messages stored on phones. The usual pattern sends data to the place where an algorithm runs. His alternative sends the algorithm to the data. An orchestration platform can run the computation where the data already lives, apply privacy protections before returning results, and check whether the requested use is permitted. This helps organizations work with data that would otherwise remain inaccessible because of regulation, security concerns, or organizational boundaries.

### Access rules should cover how data is used, not only who can open it
[08:35](https://www.youtube.com/watch?v=yju0E6OdRkc&t=515s)
Traditional controls often answer who can access which data. Thomson argues that data owners also need to control what the recipient is allowed to do. One example allows a pharmaceutical company to send a model to a hospital for clinical-trial recruitment, while preventing hospital data from leaving. Another allows model training without giving the trainer the records, as in some on-device systems. A further option permits arbitrary queries only when private records cannot be reconstructed. The platform can attach these usage rules to computation rather than treating access as a one-time transfer.

### Privacy protection can be applied at several stages of data sharing
[12:28](https://www.youtube.com/watch?v=yju0E6OdRkc&t=748s)
Thomson groups privacy methods by what happens between raw data and the returned insight. Tokenization replaces names, phone numbers, and credit card numbers with tokens, although it removes information and may not provide sufficient protection. Hashing can be attacked with dictionary guesses. Synthetic data can reproduce broad statistics for testing, but without differential privacy it may reveal real records. Aggregations, noise addition, human review, and k-anonymity offer other forms of disclosure control. He points out that k-anonymous results can still be combined to recover an individual value, while differential privacy limits what can be inferred from released results.

### Secure computation allows collaboration without exposing individual inputs
[15:46](https://www.youtube.com/watch?v=yju0E6OdRkc&t=946s)
The talk covers trusted execution environments, homomorphic encryption, and secure multi-party computation. Thomson gives a simple secure aggregation example: two parties mask their values with a shared random number, allowing a data scientist to receive the sum without learning either input. The same idea can aggregate gradients during federated training. Each site computes its local gradient, and secure aggregation produces a combined update without identifying each site's contribution. Differential privacy can add another layer of protection. More complex computations are possible, though they require more network communication or computation.

### Federated training can improve a model when sites hold different examples
[19:01](https://www.youtube.com/watch?v=yju0E6OdRkc&t=1141s)
Thomson describes an experiment using Kaggle optical coherence tomography images for three eye diseases, with separate datasets dominated by different diseases. Models trained and tested on the same distribution performed best on that distribution, while cross-distribution performance was weaker. A federated model trained across all three datasets achieved the best accuracy in the experiment because it saw more examples across the disease types. The point is not simply that more data helps. Federated training makes otherwise unavailable data usable without requiring the participating sites to transfer their images.

### Private set intersection can find overlap without revealing the sets
[21:26](https://www.youtube.com/watch?v=yju0E6OdRkc&t=1286s)
Private set intersection lets two parties discover which entities they have in common without sharing their full lists. Thomson uses customer lists as an example and also mentions checking whether a password appears in a list of compromised passwords. Sending ordinary hashes is unsafe because an attacker can try dictionary values. A protocol using different salts and repeated hashing lets both sides compare protected values while keeping their original secrets private. The same pattern can help link datasets before federated learning, compare data held by resellers, or support collaborations in areas such as investment banking.

### The main use cases depend on the relationship between data owners and the data scientist
[23:39](https://www.youtube.com/watch?v=yju0E6OdRkc&t=1419s)
Thomson separates use cases by whether the parties belong to one organization, whether one data scientist works with several providers, or whether a consortium shares a goal. Within one company, the method can distribute governance and support work across jurisdictions or remote datasets. A company building AI products can train on customer data inside the customer's cloud or a separate AWS organization. Data sellers can let potential buyers test or measure overlap without transferring the dataset. Research, benchmarking, and shared model training are consortium cases. The common benefit is access to computation or data value without surrendering control of the underlying records.

### Working without direct data visibility changes debugging and model operations
[29:08](https://www.youtube.com/watch?v=yju0E6OdRkc&t=1748s)
In the discussion, Thomson accepts that privacy-preserving workflows make error analysis harder. Teams cannot inspect individual records, so they may use SQL-style analysis, histograms, and models tested against data they are allowed to see. Whether the extra data is worth losing direct visibility depends on the use case. The techniques apply to structured and unstructured data, including tabular data, image models, and NLP models. Federated training can also help with demographic imbalance when hospitals see different populations, although Thomson says the team was only starting its work on bias detection.

## Notable quotes
- Blaise Thomson: "The basic idea is that instead of sending data to where you do the analysis, to where the algorithm is, you send the algorithms to the data." (09:40)
- Blaise Thomson: "Who has access to what data and how are they allowed to use it?" (11:05)
- Blaise Thomson: "The whole idea of this whole paradigm is you don't always have to send data to where the algorithm is." (27:46)
- Blaise Thomson: "The benefit of the extra data is worth it for the fact that you weren't able to see that extra data." (30:13)

## Tools & references mentioned
- Bitfount
- Apple
- Siri
- Kaggle
- differential privacy
- k-anonymity
- Intel SGX
- AWS
- private set intersection
- federated learning
- PySyft
- OpenMined

## Who should watch
- You are building models from medical, financial, customer, or device data that cannot be moved into your own environment.
- Your team needs permissions that distinguish model evaluation, model training, querying, and data export.
- You want a practical introduction to federated learning and privacy methods before choosing between tools such as Bitfount and PySyft.

## Related talks

- [Private data, Data Science friendly](https://mlopstalks.com/talks/private-data-data-science-friendly) (Jean-François Rajotte, University of British Columbia & Sumit Mukherjee, Microsoft AI for Good Research Lab, 41:39)
- [The revolution of Federated Learning](https://mlopstalks.com/talks/the-revolution-of-federated-learning) (Fabiana Clemente, MLOps Community & Ramen Dutta, TensoAI, 29:22)
- [FLOps with Scaleout's Open-core Platform](https://mlopstalks.com/talks/flops-with-scaleouts-open-core-platform) (Marco Capuccini, Scaleout Systems, 44:36)
- [Federated Learning: Machine Learning on the Edge](https://mlopstalks.com/talks/federated-learning-machine-learning-on-the-edge) (Varun Kumar Khare, Nimble Edge, 46:38)
- [Just Fetch the Data and then...](https://mlopstalks.com/talks/just-fetch-the-data-and-then) (David Bayliss, LexisNexis Risk Solutions, 51:56)