Privacy-Preserving Machine Learning (PPML)

The problem: models can remember data

A trained model is not a nameless summary of its training data. Research and practice have shown some attacks that pull facts about single people out of models:

• Membership inference: an attacker finds out whether a given record, such as a patient file, was used in training. That fact alone can be sensitive.
• Model inversion: an attacker works out typical traits of the training data from what the model puts out.
• Training data extraction: large language models can repeat passages from their training data word for word. These can include names, email addresses or in-house files.

Then there is the classic problem of pooling data in one place. If you pool data from many sites, subsidiaries or partners for a shared model, you create a tempting target. Often you also face legal hurdles.

The key techniques

Differential privacy

Differential privacy is a math-based privacy framework. It adds noise in a set amount. This way, the result of a computation, or a trained model, barely changes whether a single record is in the data or not.

The parameter epsilon sets how strong the shield is. The smaller it is, the stronger the shield. But you usually lose more accuracy too. Neural networks are often trained with DP-SGD. This is a form of stochastic gradient descent that clips gradients and adds noise to them.

Federated learning

Data stays with each party, for example in a set of plants or hospitals. Each one trains on site. Only model updates go to a central server, which combines them. Note that model updates can leak facts about local data too. So you should pair federated learning with secure aggregation or differential privacy.

Homomorphic encryption and secure multi-party computation

Homomorphic encryption lets you compute on encrypted data. One case is inference where the provider never sees the input or the result in plaintext. Libraries such as Microsoft SEAL and OpenFHE make this usable. But it takes a lot of computing power.

In secure multi-party computation, a group of parties work out a result together. None of them shows its inputs to the others.

Trusted execution environments

Trusted execution environments and confidential computing protect data and models while they are in use. They do this by walling off data in the hardware. They are far faster than crypto-based methods. But you have to trust the hardware vendor.

Limits and common mistakes

• Pseudonymisation is mixed up with anonymisation. Under the GDPR, pseudonymised data still counts as personal data.
• Differential privacy is used with an epsilon so large that the protection means almost nothing. And this is not documented.
• People assume federated learning is privacy-compliant by default, even though the step that combines updates is not protected.
• Methods are applied to training, while logs, prompts and outputs in production stay open.

Practical steps

1. Determine protection needs: Which data goes into training? Who can access the model? Which attackers are realistic?
2. Minimise data first: You can often remove identifiers and needless fields before training. This is simpler and works better than any method you add later.
3. Choose the right technique: If data is spread across sites, look at federated learning. If you publish models or statistics, look at differential privacy. If you outsource to a service provider, look at confidential computing or encryption.
4. Test effectiveness: Run membership inference and extraction tests on models before they go live or you share them.
5. Document: Record parameters, assumptions and residual risks. They belong in the data protection impact assessment.

Data protection context

PPML is a concrete way to put two GDPR duties into practice: data protection by design under Art. 25 and security of processing under Art. 32. It supports the principles of data minimisation and confidentiality in Art. 5.

Large-scale processing usually requires a data protection impact assessment under Art. 35. This applies above all to health data and other special types of data under Art. 9.

Whether a trained model itself still holds personal data must be judged case by case. The European Data Protection Board dealt with this in an opinion in December 2024. It stressed that you cannot assume models are anonymous by default.

Conclusion

PPML methods lower the risk that models leak personal data. But they are not a free pass. They work best when you also keep data to a minimum, test well and write things down. SecTepe supports the assessment of AI projects as part of data protection impact assessments and information security.

Frequently asked questions

Does differential privacy make data anonymous?

Differential privacy provably limits how much can be learned about single people. Whether the result counts as anonymous in legal terms depends on the chosen parameters and the circumstances.

Is PPML realistic for mid-sized companies?

Yes, at least in part. You can use data minimisation, pseudonymisation and the confidential computing offers of big cloud providers without a research team. Homomorphic encryption, by contrast, is still mostly limited to special use cases.