All Segments
Privacy Preserving AI (Andrew Trask) | MIT Deep Learning Series
44 segments available
Lecture by Andrew Trask in January 2020, part of the MIT Deep Learning Lecture Series. Website: https://deeplearning.mit.edu Slides: http://bit.ly/38jzide Playlist: http://bit.ly/deep-learning-playlist LINKS: Andrew Twitter: https://twitter.com/iamtrask OpenMined: https://www.openmined.org/ Grokking Deep Learning (book): http://bit.ly/2RsxlUZ OUTLINE: 0:00 - Introduction 0:54 - Privacy preserving AI talk overview 1:28 - Key question: Is it possible to answer questions using data we cannot see? 5:56 - Tool 1: remote execution 8:44 - Tool 2: search and example data 11:35 - Tool 3: differential privacy 28:09 - Tool 4: secure multi-party computation 36:37 - Federated learning 39:55 - AI, privacy, and society 46:23 - Open data for science 50:35 - Single-use accountability 54:29 - End-to-end encrypted services 59:51 - Q&A: privacy of the diagnosis 1:02:49 - Q&A: removing bias from data when data is encrypted 1:03:40 - Q&A: regulation of privacy 1:04:27 - Q&A: OpenMined 1:06:16 - Q&A: encryption and nonlinear functions 1:07:53 - Q&A: path to adoption of privacy-preserving technology 1:11:44 - Q&A: recommendation systems CONNECT: - If you enjoyed this video, please subscribe to this channel. - Twitter: https://twitter.com/lexfridman - LinkedIn: https://www.linkedin.com/in/lexfridman - Facebook: https://www.facebook.com/lexfridman - Instagram: https://www.instagram.com/lexfridman
Segments Timeline
Introduction to Andrew Trask
Andrew Trask, a prominent figure in machine learning and AI, is introduced. He is recognized for his contributions as a researcher, author of 'Grokking Deep Learning', and creator of OpenMined, an initiative focused on privacy-preserving algorithms. This segment sets the stage for his lecture on privacy-preserving AI.
"today we were happy very happy to have Andrew Trask he's a brilliant writer researcher tweeter that's a word in the world of machine learning and artificial intelligence he is the author of grokking d..."
Overview of Privacy-Preserving AI
Trask outlines the structure of his talk on privacy-preserving AI, emphasizing the importance of understanding privacy tools from the perspective of data scientists and researchers. He introduces the key question: Is it possible to answer questions using data we cannot see?
"so yeah today we're going to be talking about privacy preserving AI this talks can kind of come in in two parts so the first it's going to be looking at sort of privacy tools from the context of a dat..."
The Challenge of Accessing Sensitive Data
Trask discusses the complexities of accessing sensitive data, using the example of tumor images versus handwritten digits. He highlights the barriers researchers face in obtaining private data, which often leads to a focus on less impactful projects. This segment emphasizes the need for privacy-preserving techniques to tackle significant societal issues.
"question is it possible to answer questions using data that we cannot see this is going to be the key question that we look at today and let's let's start with an example so first if we wanted to answ..."
Tool 1: Remote Execution
Trask introduces remote execution as a tool for privacy-preserving AI. He explains how it allows computations to be performed on remote machines without direct access to the data, thus maintaining privacy. This segment covers the basic mechanics of remote execution and its implications for data science.
"first first tool is remote execution okay so let's just uh walk walk me through this so we're a jump into code for a minute but hopefully this is sort of line by line and relatively simple and even if..."
Tool 2: Search and Example Data
In this segment, Trask discusses the second tool, which involves searching for and retrieving example data remotely. He explains how researchers can access metadata and sample data without compromising privacy, facilitating feature engineering and quality evaluation in data science.
"the second tool so search an example data again we're starting really simple it will get more complex here in a minute so in this case let's say we have what's called a grid so PI grid if PI sift is a..."
Tool 3: Differential Privacy
Trask provides an overview of differential privacy, a technique that allows statistical analysis without compromising individual privacy. He explains how it enables querying databases while ensuring that the removal of any single record does not significantly alter the output, thus protecting sensitive information.
"Springs it's a tool number three called differential privacy differential privacy little higher okay cool awesome good so I'm gonna do a quick high-level overview of the intuition of differential priv..."
Randomized Response Technique
Trask illustrates the randomized response technique used in surveys to gather sensitive information without compromising individual privacy. By flipping a coin, respondents can provide answers that maintain plausible deniability, allowing researchers to estimate true distributions while protecting individual identities.
"our goal is to ensure as physical analysis doesn't compromise privacy what we're going to do is query this database right so we're gonna run some function over the entire database and we're going to l..."
Adding Noise for Privacy
This segment delves into the concept of adding noise to data as a method of ensuring privacy in differential privacy. Trask explains how this technique allows researchers to derive meaningful insights from data while safeguarding individual identities, highlighting the balance between accuracy and privacy.
"construct queries that are invariant to removing someone or replacing them with someone else okay and the notion of the maximal amount that the output of a function can change as a result of removing ..."
Local vs. Global Differential Privacy
Trask differentiates between local and global differential privacy, explaining how local differential privacy adds noise before data is sent for analysis, while global differential privacy adds noise after the query output. He discusses the implications of each approach on privacy and trust in data handling.
"promise I won't tell anybody right I'm still going to get a skewed distribution right make me some people are just gonna be like why would I risk telling you this is this private information and so wh..."
The Importance of Epsilon
In this segment, Trask introduces the concept of epsilon, a privacy budget that quantifies the amount of statistical uniqueness allowed in a dataset. He explains how setting an appropriate epsilon is crucial for maintaining privacy while still enabling meaningful data analysis.
"55 percent of you answered yes that that you are a serial killer then I know that the true center of the distribution is actually 60% because it was 60% average with a 50/50 coin flip does that make s..."
Challenges of Data Anonymization
Trask warns against the dangers of traditional data anonymization methods, citing real-world examples where anonymized datasets were successfully de-anonymized. He emphasizes the need for robust privacy measures like differential privacy to protect sensitive information.
"trade-off down but so the the the the field of research that is differential privacy is looking at how to add noise to data and and resulting queries to give plaza deniability to the entrance to the m..."
Statistical Uniqueness and Privacy
This segment discusses the concept of statistical uniqueness in datasets and how it can lead to privacy breaches. Trask explains how differential privacy aims to limit the statistical uniqueness of published data to prevent re-identification of individuals.
"we'll see there's some other things we can do there but with me so far this is a good good point for questions if you had any questions got it so the question is is this verifiable they get any of thi..."
Epsilon and Querying
Trask elaborates on how the epsilon privacy budget is affected by the number of queries performed on a dataset. He discusses the importance of managing this budget to ensure that privacy is maintained across multiple analyses.
"to take one more size sidetrack here because I think it's really worth mentioning data anonymization anyone familiar with data anonymization come across this term before taking a document like redacti..."
Generalization in Machine Learning
In this segment, Trask connects the principles of differential privacy to machine learning, explaining how the focus on general patterns rather than individual data points aligns with the goals of creating effective machine learning models.
"was I think it's UT Austin were able to go and scrape IMDB and basically create the same matrix and IMDB and then just compare the two and it turns out people that were in the movie rating we're in th..."
The Role of Noise in Data Queries
Trask discusses the role of noise in data queries and how it can help maintain privacy while still allowing for meaningful insights. He emphasizes the balance between adding noise and retaining the utility of the data.
"is that just because the data set that you are publishing and one that you are physically looking at doesn't seem like it has you know Social Security numbers stuff in it does that mean that there's e..."
Privacy Budget Management
This segment focuses on the management of privacy budgets in data science projects. Trask advocates for setting a clear epsilon budget to prevent exceeding privacy limits while conducting multiple queries.
"makes sense so this is a point 1 query if I did this multiple times the absalons put some and so for any given data science project right I should I we're advocating is that you're given an epsilon bu..."
Pros of Differential Privacy
Trask summarizes the advantages of differential privacy, including its ability to allow remote execution of data analysis while preserving privacy. He highlights the formal mechanisms in place for privacy budgeting and the potential for improved data handling practices.
"have a data set and I want to know what causes cancer right I could query data set and learn that smoking causes cancer without learning that individuals are are are not smokers does that make sense a..."
Setting Privacy Budgets
In this segment, Trask explores the complexities of defining privacy budgets in data science. He raises critical questions about who should set these budgets, highlighting the potential conflicts of interest for data scientists and data owners. The discussion emphasizes the need for individuals to have control over their own privacy budgets, aiming for a future where personal privacy management is achievable.
"is why this is realistic and why with with continued effort on both tooling and and the theory side we can we can have a much better reality today cool so pros just review so first remote execution al..."
Challenges of Secure Multi-Party Computation
Trask outlines the challenges associated with secure multi-party computation (MPC) in the context of data privacy. He discusses the risks of sending models to different hospitals for training and the complexities of joint computations across untrusting data owners. This segment highlights the need for robust solutions to ensure data security while enabling collaborative learning.
"level of infrastructure around these kinds of things I'm gonna talk about that and we can definitely answer session as well but I think it theory in theory that's what we want okay the two cons we sti..."
The Power of Secure Multi-Party Computation
Andrew Trask introduces secure multi-party computation as a groundbreaking tool for privacy-preserving AI. He explains how it allows multiple parties to compute functions without revealing their private inputs. This segment delves into the mechanics of MPC, illustrating how encrypted shares can be used for computations while maintaining data privacy and governance.
"tool secure multi-party computation come across this before raise them high ok cool a little bit above average most machine learning people have not heard about this yet and I absolutely is this is th..."
Encrypted Machine Learning: A New Frontier
In this segment, Trask discusses the implications of encrypted machine learning, where both models and datasets are encrypted during training. He emphasizes the potential for accurate computations without compromising privacy. This segment highlights the transformative possibilities of encrypted machine learning in addressing real-world problems while ensuring data security.
"okay and I'll give some more resources for you if you're interested in kind of learning more about this at the end as well now the big tiya models and data sets are just large collections of numbers w..."
The Future of Privacy-Preserving AI
Trask concludes this part of the lecture by discussing the long-term goals of the privacy-preserving AI community. He envisions a future where infrastructure is robust enough to allow secure access to critical information without compromising individual privacy. This segment emphasizes the societal implications of being able to answer questions using data we do not own, marking a significant shift in data governance.
"if that makes sense and what we can do on tensors we can also do in models so we can do encrypted training and encrypted prediction and we're going to get into what kind of awesome use cases this open..."
The Challenge of Encryption in AI Models
Andrew Trask discusses the complexities of using encryption in AI models, emphasizing the need to encrypt both the model and the dataset during training. He highlights the trade-offs between privacy and accuracy, and the constraints of using a fixed key for encryption, which can hinder practical applications.
"in order to use that model in the future you have to still be able to encrypt data with the same key which often is sort of constraining in practice and also there's a pretty big hit to privacy becaus..."
Understanding Federated Learning
Trask explains Google's implementation of federated learning, where models are trained on user devices rather than central servers. He outlines the benefits of this approach, including enhanced privacy and reduced data transfer, while also noting the challenges of maintaining model accuracy across diverse user data.
"learning one is sort of the one where your model is a federated learning sorry who got to talk about what that is okay yes I'll do that quickly so a federated learning is basically the first thing I t..."
Exploring Different Styles of Federated Learning
In this segment, Trask differentiates between two styles of federated learning: one with fixed datasets and models, and another that is more exploratory. He discusses the implications of using ephemeral data from devices and the challenges of answering complex questions in a secure environment.
"great papers outlining sort of how they do it which is fantastic what I outlined here is actually a slightly different style of federate learning because there there's federated learning with like a f..."
The Risks of Information Leakage in Federated Learning
Trask addresses the potential risks associated with federated learning, particularly the possibility of models memorizing sensitive data. He emphasizes the importance of combining federated learning with techniques like differential privacy to mitigate these risks and protect user information.
"right and data scientists are gonna show up and say mmm I want to do something with that with diabetes today mmm I will do something with with studying dementia today something like that right this is..."
The Importance of Answering Questions with Hidden Data
Trask highlights the significance of being able to answer questions using data that is not directly accessible. He discusses the societal implications of this capability and introduces four key areas where privacy-preserving AI can make a substantial impact.
"it take more the perspective of like a economist or scientist or someone looking kind of globally at like okay what if this becomes mature what happens alright and this is where I gets really exciting..."
Historical Lessons on Data Handling
Drawing an analogy between historical sanitation practices and modern data handling, Trask reflects on how society has evolved in managing data privacy. He emphasizes the need for better infrastructure to handle data responsibly and prevent the 'spillage' of personal information.
"don't have sociological II I think is quite quite important and there's four different areas that I want to highlight as like big groups of use cases for this kind of technology to help kind of inspir..."
The Infrastructure Challenge of Data Privacy
Trask discusses the logistical challenges of implementing robust data privacy measures, likening it to historical infrastructure developments like plumbing. He stresses that the adoption of privacy-preserving technologies requires significant engineering efforts and societal commitment.
"streets and why the cobblestone streets were there cobblestone streets one of the main purposes of them was to sort of lift you out of the muck and the reason there was muck was there is that they did..."
The Future of Data Privacy and AI
In this forward-looking segment, Trask outlines the potential for privacy-preserving AI to transform how society answers critical questions. He emphasizes the need for technological maturity and the role of companies like Google in paving the way for broader adoption.
"wasn't because they wanted it to be that way it's just because it was a natural consequence of the technology they had at the time right this is not malice this is not anyone being good or bad or or e..."
Open Data for Scientific Progress
Trask highlights the importance of open data in advancing AI research and applications. He discusses how access to large datasets can lead to significant breakthroughs in various fields, emphasizing the need for collaborative efforts to unlock this potential.
"single apartment Business School maybe even some public toilets underground under our city all to one location and then processed it used chemical treatments and then turn that into usable drinking wa..."
The Role of Accountability in Data Handling
In this segment, Trask introduces the concept of single-use accountability in data handling. He discusses the implications of ensuring that data is used responsibly and the importance of monitoring data access and usage in various contexts.
"of change but but I think that the need is sufficiently great I think that that I mean if you view our lives it's just one long process of answering important questions whether it's where we're going ..."
Unlocking Data for Dementia Research
Andrew Trask discusses the challenges faced by dementia researchers in accessing data due to its decentralized nature across hospitals. He emphasizes the potential of privacy-preserving technologies to unlock larger datasets that can be used collaboratively, thus enhancing research capabilities and accuracy in various medical fields.
"commercial viability right if I give you a data set all of a sudden I just doubled the supply right what does that do to my billing ability and there's the legal risk that you might do something bad w..."
Single-Use Accountability Systems
Trask introduces the concept of single-use accountability systems, drawing an analogy to airport security checks. He explains how these systems can allow for accountability without compromising privacy, using examples like video feeds and machine learning classifiers to ensure that only necessary data is accessed.
"repeatable business model take a use case right BB the radiology Network gatekeeper right okay so enough on that one but like does it make sense how like on a huge variety of tasks just the ability to..."
Privacy-Preserving Surveillance Techniques
In this segment, Trask elaborates on the use of privacy-preserving techniques in surveillance, likening it to the use of sniffing dogs at airports. He discusses how these methods can help maintain privacy while still allowing for effective monitoring and accountability in sensitive situations.
"bit tricky get to the airport and you get bag checked right everyone's familiar with this process I see what happens someone's sitting at a monitor and they see all the objects in your back so that oc..."
Challenges in Email Surveillance
Trask shares insights into the complexities of email surveillance in investment banks aimed at detecting insider trading. He highlights the difficulties posed by the sensitivity of the data involved and the need for privacy-preserving methods to enable effective monitoring without compromising individual privacy.
"instead of getting access to the raw video feed and and under you know the millions of bits of information every single person in the frame of you walking around doing whatever which I could use for y..."
End-to-End Encrypted Services
Andrew Trask discusses the concept of end-to-end encrypted services, particularly in healthcare. He explains how combining machine learning with encrypted computation can allow for medical diagnoses without revealing sensitive patient data, thus preserving privacy while providing essential services.
"if on that third one and this is the one I think it's just incredibly exciting and encrypted services what's up everyone's me with what's up telegram any of these these are messaging apps right where ..."
Structured Transparency in Data Sharing
In this segment, Trask introduces the idea of structured transparency, where individuals can share their data securely for collaborative computations. He emphasizes the importance of maintaining privacy through differential privacy and secure multi-party computation while still enabling valuable insights from shared data.
"what what what treatment should you have if any okay and the idea here is that so there's this new new field called structured transparency probably mention I'm not sure maybe sure you can call it a n..."
Addressing Bias in Encrypted Models
Trask addresses the challenge of removing bias from machine learning models when working with encrypted data. He explains how privacy budgets can be allocated to allow for necessary introspection and adjustments to ensure fairness in AI systems, even when the underlying data remains hidden.
"end and encrypted does that make sense so again it's kind of it's kind of big it assumes that that AI is smart enough to do it there's lots of questions around quality and my quality assurance and all..."
Regulatory Perspectives on Differential Privacy
In this segment, Trask discusses the potential for regulatory bodies like the FDA to require differential privacy in medical data handling. He highlights the US Census Bureau's adoption of differential privacy as a significant step towards protecting sensitive data and ensuring compliance with privacy standards.
"whether he has a certain diagnosis or it could be decrypted for the model owner perhaps allow them to do more training or some other arbitrary use case right but so it can be but not not not as a stri..."
OpenMined's Growth and Adoption
Trask shares insights into the growth of OpenMined, a project focused on privacy-preserving technologies. He discusses the increasing interest and buy-in from organizations post-GDPR, highlighting the commercial benefits of protecting data while fostering collaboration in data science.
"change right everyone's scrambling to protect the data but the truth is it's not just privacy it's also commercial usability right now if you're selling data every time you sell it you lower the price..."
Challenges with Nonlinear Functions
In this segment, Trask delves into the complexities of encrypting nonlinear functions in privacy-preserving computations. He discusses current research trends and the performance implications of these encryption methods.
"basically this is the year for like pilots okay I think it's best about as far as we are and then I have another question that's kind on the opposite end of the spectrum that's a little more technical..."
Building Privacy Infrastructure
Trask explores the infrastructure needed to empower individuals with control over their privacy budgets. He discusses the potential for centralized data banks and the challenges of achieving widespread adoption of privacy-preserving technologies.
"much for your talk Andrew yeah I'm wondering about your objective to ultimately allow every individual to assign a privacy budget you think you also mention you mentioned that it would take a lot of w..."
Reimagining Recommendation Systems
Andrew Trask critiques current recommendation systems and their lack of holistic approaches. He proposes that privacy-preserving technologies could enhance these systems by allowing access to sensitive data without compromising privacy, leading to more meaningful recommendations.
"technology quite quickly post sort of enterprise adoption I think that that's when that's and encrypted services are still really hard at this point and the reason for that is that they require lots o..."