privacy

Ethics and law

The interest that people, singly and collectively, have in limiting who can watch, intrude on or learn about them, recognized as a human right in Article 12 of the Universal Declaration of Human Rights (1948) and Article 8 of the European Convention on Human Rights. Classic accounts treat it as a right to be left alone, as control over personal information (Alan Westin), or as contextual integritycontextual integrity, n.: A way of thinking about privacy: information is not simply public or private; what matters is whether it flows in ways that fit the expectations of the setting where it was shared. — information flowing according to the norms of the setting in which it was shared (Helen Nissenbaum). AI strains each account: training datatraining data, n.: The examples an AI system learns from. Whatever patterns, skills, gaps and biases are in the training data tend to show up in the finished system. scraped from the web contains personal information shared for other purposes; models can infer sensitive traits such as health, sexuality or political views from innocuous data; and facial recognitionfacial recognition, n.: Technology that identifies or checks who someone is by comparing a picture of their face with stored photos, used by phones, passport gates and police databases. and other surveillanceAI surveillance, n.: Using AI to watch, identify, track or profile people on a scale no team of humans could manage, for example by scanning camera feeds or analyzing phone and online data. tools erode anonymity in public. Legal protection takes the form of data protectiondata protection, n.: Laws and practices that control how organizations collect, use, store and share information about people, and that give people rights over it, such as seeing it or having it deleted. law in most jurisdictions.

Scraping public profiles for training is legal in some places, but it still raises privacy concerns.

Machine learning

A property of an algorithm or model that limits what can be learned about the individuals in its training datatraining data, n.: The examples an AI system learns from. Whatever patterns, skills, gaps and biases are in the training data tend to show up in the finished system.. Threats include membership inferencemembership inference attack, n.: An attack that tries to tell whether a particular person's record, or a particular document, was part of an AI model's training data — which can itself reveal private facts. (determining whether a person's record was used), training data extractiontraining data extraction, n.: Getting an AI model to repeat, word for word, pieces of the data it was trained on, which may include someone's private contact details or copyrighted text. (recovering memorizedmemorization, n.: When an AI model stores specific pieces of its training data — a paragraph, a phone number, an image — closely enough to reproduce them, instead of only learning general patterns. text or images), model inversion and attribute inference. Defenses include differential privacydifferential privacy, n.: A mathematical promise that the results of analyzing a dataset — or a model trained on it — would look almost the same whether or not any one person's data was included, so little can be learned about that person., which bounds the influence of any single record with a formal guarantee; federated learningfederated learning, n.: Training one shared AI model across many phones, hospitals or companies without collecting their data in one place: each trains on its own data and sends back only model updates. and secure computation, which avoid pooling raw data; data minimization and deduplication; and machine unlearningmachine unlearning, n.: Erasing specific things a trained AI model has learned, such as dangerous lab techniques, a copyrighted novel or one person's records, far more cheaply than training the model all over again.. These techniques are grouped as privacy-preserving machine learningprivacy-preserving machine learning, n.: The family of techniques for training and using AI models while keeping the underlying personal or confidential data hidden — from adding careful noise to computing on encrypted data..

We trained with differential privacy because the clinical notes contain patient identifiers.