Privacy

Knowledge unlearning techniques

Knowledge unlearning techniques allow specific information to be “forgotten” without the need for retraining the entire model, preserving its general capabilities. These techniques can be used to reduce privacy risks and protect against copyrighted or harmful content [96, 188].

Differential privacy

Differential privacy techniques [8] can be used to protect users’ privacy by ensuring that sensitive information is not leaked from a training dataset, even after thorough statistical analysis. With differential privacy, noise is added to the dataset or the model’s output in such a way that one cannot deduce the presence or absence of a particular data point within the dataset. This provides individuals with plausible deniability and prevents their information from being exposed.

Quantifying privacy risks of AI models

Measuring privacy risks of an AI model allows the provider and user to calibrate their expectations on where the model can be applied, and it allows them to take the necessary steps to reduce such risks. For example, some metrics include: • Success rate of membership inference attacks [186] - Measures the rate that an attack correctly predicts a given record is part of the training dataset used to train a given AI model. • Discoverable memorization [38] - Theoretical upper-bound of the amount of training data that a given model memorizes. Assuming full knowledge of the training data, it measures the percentage of items that, for a given incomplete data point, a model outputs the remaining (memorized) part.