# When Machine Learning Meets Privacy, Episode 1

Fabiana Clemente, YData | MLOps Community | Episode 1 | 18:44

Source: https://www.youtube.com/watch?v=l4UGDHTOZX0
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/when-machine-learning-meets-privacy-episode-1
Published: 2020-11-05
Tags: governance, privacy

## TL;DR
- Machine learning increases privacy risks because it can combine many features and infer sensitive information from data that appears anonymized.
- Data security controls unauthorized access, while data privacy concerns how information is collected, used, and handled.
- Privacy-enhancing technologies can allow machine learning on sensitive data, and TensorFlow Privacy applies differential privacy to model training.

## Summary
Fabiana Clemente introduces a podcast series about data privacy in machine learning. She explains privacy as an individual's control over personal information and discusses GDPR, HIPAA, CCPA, and LGPD. The talk focuses on cases where data that seemed anonymous exposed people: Netflix Prize ratings could be linked to IMDb records, while Strava's public activity map revealed sensitive military locations and routines. Clemente also describes adaptive malware and machine learning attacks on cryptographic systems. She separates privacy from security. Encryption, authentication, and access controls can protect data from unauthorized users, but they do not control how data is collected or what new information models infer from it. The episode argues that machine learning and privacy are compatible through privacy-enhancing technologies. It closes with TensorFlow Privacy, which provides differentially private optimizers intended to reduce the risk that model weights memorize sensitive training examples.

## Key ideas
### Privacy gives people control over how companies collect and use their information
[02:23](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=143s)
Clemente defines data privacy as the right for individuals to control personal information collected and later used by companies. She introduces GDPR as a restrictive regulation that changed the relationship between citizens, their data, and companies. She also names HIPAA, the CCPA, and Brazil's LGPD. GDPR fines illustrate the practical consequences of mishandling data. Clemente points listeners to an enforcement tracker and says British Airways was listed with a 200 million fine in 2019.

### Apparently anonymous data can still identify people when combined with outside information
[05:48](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=348s)
Clemente uses the Netflix Prize as an example. Netflix released movie ratings with subscriber identifiers and no obvious personal information, yet researchers could re-identify users by combining the ratings with the public IMDb database. The example shows why removing names does not necessarily remove privacy risk. A machine learning system can connect patterns in one dataset with information held elsewhere and recover details about individuals.

### Location data can reveal sensitive places and routines without extra personal details
[08:00](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=480s)
Strava's public activity map exposed more than exercise records. Clemente says researchers used the map to identify sensitive sites, including US military bases in Afghanistan and Syria, along with military exercise routines. Her point is that location data can disclose where people live, where they go, and what they regularly do. Machine learning can extract these patterns even when the dataset does not contain an obvious sensitive field.

### Machine learning expands privacy risk by combining many features
[09:29](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=569s)
Clemente says AI systems can compute scenarios that combine hundreds of features and variables in complex ways. That ability can turn ordinary records into privacy breaches. She also describes adaptive malware that learns which behavior can bypass defenses and changes itself inside an environment. She says machine learning can speed up brute-force attempts against cryptographic systems. These examples frame machine learning as a source of new attack and inference capabilities, rather than only a tool for analyzing data.

### Security protects access, while privacy governs data handling and use
[12:46](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=766s)
Clemente separates two ideas that organizations often combine. A security breach can cause a privacy breach when sensitive information is exposed, but security and privacy are not synonyms. Privacy concerns how data is collected, how it is used, and whether its handling complies with rules. Security concerns access and protection from unauthorized users through methods such as encryption, key management, and authentication. Securing production data therefore does not guarantee privacy when models extract new information from it.

### Privacy regulations do not make machine learning impossible
[14:10](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=850s)
Clemente rejects the idea that privacy rules will end AI. She says machine learning amplifies privacy problems, while privacy-enhancing technologies can address some of them. The unresolved questions for the next episode include which technology to apply, when to apply it, and whether any one solution can solve every privacy problem. Her claim is limited: these methods can support machine learning without compromising data privacy in every case.

### TensorFlow Privacy applies differential privacy during model training
[16:02](https://www.youtube.com/watch?v=l4UGDHTOZX0&t=962s)
Clemente introduces TensorFlow Privacy as the episode's open-source project. She focuses on the risk that models trained on personal photos, emails, or text conversations may memorize specific examples instead of learning only general patterns. TensorFlow Privacy provides tools for building deep learning models with privacy at the level of model weights. It includes differentially private stochastic gradient optimizers, which provide formal privacy guarantees while reducing the chance that sensitive training data is exposed.

## Notable quotes
- "Data privacy as the right for individuals to have control over their own personal information that gets collected and further down used by companies." (02:23)
- "It was possible to re-identify a lot of the users in the database." (07:31)
- "Data privacy is related to the proper handling of data, how it is collected, how it is used and how can be kept in compliance, whereas data security is all about the access and protection of data from unauthorized users." (13:16)
- "With privacy enhancing technologies you can leverage machine learning without compromising data privacy." (15:34)
- "Ideally the parameters of the trained machine learning models should encode general patterns rather than memorizing specific examples." (16:48)

## Tools & references mentioned
- MLOps Community
- YData
- Fabiana Clemente
- GDPR
- HIPAA
- CCPA
- LGPD
- British Airways
- Netflix Prize
- IMDb
- Strava
- TensorFlow Privacy
- differential privacy
- privacy-enhancing technologies
- adaptive malware

## Who should watch
- You work with personal or regulated data and need a clear distinction between data security and data privacy.
- You build machine learning systems from data that appears anonymized and want concrete examples of re-identification risk.
- You want an introduction to privacy-enhancing technologies before learning about differential privacy and related methods in later episodes.

## Related talks

- [Privacy-preserving ML with Differential Privacy](https://mlopstalks.com/talks/privacy-preserving-ml-with-differential-privacy) (Christos Dimitrakakis, University of Oslo & Fabiana Clemente, 35:56)
- [What are regulations saying about data privacy?](https://mlopstalks.com/talks/what-are-regulations-saying-about-data-privacy) (Cat Coode, 35:40)
- [ML and Encryption: It's All About Secure Insights](https://mlopstalks.com/talks/ml-and-encryption-its-all-about-secure-insights) (Fabiana Clemente, MLOps Community & Théo Ryffel, Arkhn and Open-Mined, 36:06)
- [Are Privacy-Enhancing Technologies a Myth?](https://mlopstalks.com/talks/are-privacy-enhancing-technologies-a-myth) (Fabiana Clement, MLOps Community & Charles Radcliffe, 22:59)
- [ML Security: Why should you care?](https://mlopstalks.com/talks/ml-security-why-should-you-care) (Sahbi Chaieb, SAS, 52:20)