Thanks Alex. I like the papers that do this, but I also have some concern when this is done on a dataset that is proprietary and only Google has access (JFT). I would like to see a version that is pretrained on LAION. This still has privacy issues, but is at least all public.
@thegautamkamath
-
Privacy in AI: Beyond Training and Model Usage
By
–
And finally, privacy is… hard! While a lot of work focuses on training and using models privately, this is a narrow view of privacy, which encapsulates much more. 14/n
-
Private ML Benchmarks and Privacy-Focused Evaluation Standards
By
–
The second is to re-focus towards benchmarks that are more appropriate for private ML. We now understand that public data can help for private CIFAR-10 and ImageNet classification, which is great. But maybe we should move towards settings where privacy is more important. 13/n
-
Privacy-Respecting Public Pre-Training Datasets for AI Models
By
–
So where do we go from here? We conclude with a number of suggestions for the field. The first ones focuses on making sure we have public pre-training sets which are truly privacy-respecting. Can we make such a dataset/model with comparable utility to what people use now? 12/n
-
FHE Limitations for Large Model Inference Privacy
By
–
But FHE is not so practical for these models. And it may be infeasible to use some of these large models on a user's device. So even with private fine-tuning, then privacy at inference time still remains. 11/n
-
Privacy in Machine Learning: Scaling Challenges and Solutions
By
–
3. Scale makes ML hard to use in a truly private fashion. If you want to do inference on a point without sharing it, you either have to fine-tune&run the model locally (see e.g. this nice paper by @simran_s_arora @HazyResearch https://
arxiv.org/abs/2205.13722), or use FHE encryption. 10/n -
Privacy in Medical Imaging: AI Generalization Challenges
By
–
Why not? CIFAR-10 style pictures are well-represented in ImageNet, differing primarily in terms of resolution. This may not be the case for settings where we care about privacy, such as medical imaging: by nature of being private, similar pictures are not broadly available. 9/n
-
Private ML Progress Measurement Benchmarks Need Reassessment
By
–
2. We're not measuring progress meaningfully. Many of the benchmarks adopted in private ML come from the non-private setting. For example, pre-training on ImageNet and fine-tuning on CIFAR-10. Good starting point, but may not reflect settings we'd want to use private ML. 8/n
-
ML Privacy Risks: Models Can Leak Secrets from Training Data
By
–
There's more such examples in large pre-training datasets. Since ML models pretrained on them without privacy considerations can be coerced to spit secrets out verbatim (see e.g., https://
arxiv.org/abs/2012.07805 by Carlini et al), this dilutes the meaning of "privacy" for such models 7/n -
Public Data vs Private ML Training Ethics
By
–
1. Publicly available data is not the same as public data. For example, http://
insecam.org has livestreams from videocameras with default passwords. This is publicly available. But it certainly should not be used to train an ML model which purports to be "private." 6/n