Differential Privacy in Machine Learning Is a Definition, Not a Badge

Differential privacy in machine learning, on this page, means a definition of privacy for data analysis, plus the fact that a standard monograph later discusses machine learning as one application. It is not a setting you can turn on and then call a model compliant. It is not legal advice, not medical advice, and not a method for taking information out of a model that was not supposed to release it.

A plain fit on a table you are allowed to use is a different job, written up as how to make an AI model for beginners. That fit does not become this definition because you wish it did.

What differential privacy in machine learning points at

The source is Cynthia Dwork and Aaron Roth, The Algorithmic Foundations of Differential Privacy, 2014. The abstract says privacy-preserving data analysis has a long history, and that more detailed electronic data increases the need for a robust, meaningful, and mathematically rigorous definition of privacy, together with algorithms that satisfy it. The next sentence says differential privacy is such a definition. This page stops at that sentence when someone asks for a number. The monograph has a formal definition. Copying it into a blog without the surrounding chapters is how the number gets detached from the promise.

The abstract says that after the meaning of the definition, most of the monograph is about techniques for achieving it, and about combining those techniques, with the query-release problem as the running example. A key point, in the abstract’s words, is that rethinking the computational goal can often do better than replacing each step of a non-private computation with a differentially private implementation. Read that as a warning against a mechanical swap. That is not “take yesterday’s training loop and add noise at the end” unless the monograph’s argument for that step is the one you followed. This page does not supply that argument.

What the monograph says it does not promise

The abstract says that despite strong computational results, there are still fundamental limitations. Those limits are not only on differential privacy. They also apply to any method that protects against a complete breakdown in privacy. Do not quote this page as “the problem is solved.” The authors are explicit that it is not.

The same abstract says virtually all the algorithms discussed maintain differential privacy against adversaries of arbitrary computational power. Some of those algorithms are computationally heavy and some are efficient. The monograph discusses complexity for the adversary and for the algorithm. If a product page says the guarantee holds only against a weak analyst, that is a different claim. Check it against the paper you were handed, not against this summary.

Where machine learning shows up

The abstract says the monograph then turns from fundamentals to applications other than query release, including differentially private methods for mechanism design and machine learning. That is the warrant for using the keyphrase. Differential privacy in machine learning is that later section, not a library flag. Learning is one of the applications the authors say they discuss. It is not a claim that every training run in a library meets the definition.

The abstract also says the vast majority of the literature it is describing considers a single, static database that is subject to many analyses. It says differential privacy in other models, including distributed databases and computations on data streams, is discussed. If your data arrives as a stream, or sits in more than one place, you are in the part of the monograph that is about other models. Do not assume the static-database story is your story. Open that part before you name the guarantee.

A model that memorizes a row can still be a successful predictor on a held-out split. The split checks prediction. The definition checks what the released output reveals about a person. Those are different questions. This page will not pretend an accuracy number answers the privacy question, and it will not invent a privacy number to answer the prediction question.

How to talk about it without a fake parameter

Say “the training procedure is intended to meet the definition in Dwork and Roth” only if you can point at the procedure and the page in the monograph or in a paper that proves the claim. If you cannot, say you do not know. The phrase gets misused as a badge on a slide. A badge is not a proof.

Do not publish the parameter you hoped for. The formal definition uses parameters. They belong next to the proof, in the paper, not in a sentence that has no proof under it. If a reader needs the parameter, send them to the DOI. A restatement here would look like a result this site measured. It did not measure one.

Do not describe a way to undo the guarantee, to pull a person’s row back out, or to disable a filter. That is the opposite of the definition. This page will not help with it.

Do not tell a team they are “covered” for a law, a contract, or a hospital policy because a library flag exists. The monograph is a mathematical definition and a set of techniques. SP-style legal status is not what it is. If counsel needs to read it, they should read it. This summary is not a substitute, and it is not legal advice.

A small check before you use the words

Write three lines in the repo. First, the DOI. Second, whether the data is the static database the abstract says most of the literature assumes, or one of the other models it says are discussed. Third, the sentence you are willing to say out loud: either “we followed a proof we can name” or “we have not shown the definition.” The phrase is allowed on the page only if the third line is the first one.

If the third line is the second one, ship the model notes without the phrase. A beginner pipeline with a held-out split can still be the right note for a prediction task. It should not borrow a privacy word it did not earn. The two pages can link to each other. They should not pretend to be the same result.

Tomorrow, open the DOI, read the abstract, and write the definition sentence in your own words without a parameter. Then find the place the monograph turns to machine learning, and write one sentence on what kind of application that is. If you cannot find it, do not use the keyphrase in your own doc. The link is the whole assignment.

Keep the authors’ names on the citation. Cynthia Dwork and Aaron Roth, 2014, Foundations and Trends in Theoretical Computer Science. A link that drops the authors makes the definition look like a product feature. It is a paper.

When a colleague asks whether the model is private, answer with the third line from the repo, not with a synonym. Private, anonymized, de-identified, and confidential are not this definition. The monograph exists because those words were not enough. Use them only if you mean something else, and say what you mean.

That is the page. Differential privacy in machine learning stays a pointer to the definition and to the section on learning, with the parameters left in the monograph and the legal conclusion left to someone whose job that is.

Name the release. A model file, a set of predictions, and a paper full of tables are different releases. The definition is about what you release. If you do not know which artifact leaves the building, you cannot say the definition applies to it. Write the artifact name next to the DOI.

If two teams share one database and each trains a model, you are no longer in the simplest picture the abstract describes. The abstract says other models are discussed, including distributed databases. Point at that discussion or drop the claim. Do not average two verbal promises into one.