Privacy in Machine Learning: What Each Technique Protects

Re-edited on July 30, 2026, this article corrects the name and the map: differential privacy, federated learning, and homomorphic encryption are not three versions of one protection. They offer different guarantees against different adversaries and may be combined.

The right question is not “which technique protects most?” but “which information, at which stage, from whom, and with what loss of utility, cost, and complexity?” A model may keep data on devices while leaking through updates; compute on encrypted data while revealing too much in the result; or train with a formal privacy guarantee and later log sensitive queries.

Privacy begins with a threat model

Confidentiality limits unauthorized access; privacy also concerns how processing affects people and their choices. Encrypting a database protects against certain access but does not justify purpose. Removing names reduces direct exposure, but combinations may reidentify. Technique selection comes after defining harm and adversary.

The NIST Privacy Framework relates data, processing, and consequences and organizes activities around identifying, governing, controlling, communicating, and protecting. For a learning system, map collection, preparation, training, evaluation, distribution, inference, logging, updates, and retirement. Every arrow has recipients, retention, and controls.

Attacks differ too. Membership inference attempts to determine whether a record was in training. Inversion attempts to reconstruct attributes or inputs. Extraction obtains examples or behavior; poisoning manipulates data; an authorized user may misuse a legitimate prediction. A defense against membership does not necessarily solve purpose, discrimination, or model theft.

Minimize before adding cryptography. Exclude unnecessary fields, reduce granularity, separate identifiers, limit retention, and ask whether the result can be obtained through statistics or local training. Fewer data and copies reduce exposure even if the decision carries no fashionable label.

Differential privacy: a guarantee with a budget

The Algorithmic Foundations of Differential Privacy formalizes an idea: a mechanism’s output should not change too much when one person’s contribution is added or removed. Epsilon and delta bound that change under a neighboring-dataset definition. Epsilon has no meaning without the protected unit and composition of the budget.

Noise is not simply added to “the data.” It can apply to queries, statistics, or training. In DP-SGD, per-example gradients are clipped and noise is added to the aggregate; an accountant tracks privacy spending. Clipping, noise, sampling, steps, and dataset size affect guarantee and utility.

Privacy is consumed when multiple results are released or training is repeated over the same population. Testing many models and selecting the best may be part of the mechanism and its accounting. Projects therefore track a budget and limit who authorizes new queries. “We use DP” without epsilon, delta, unit, accountant, and protocol is not assessable.

The guarantee does not make data correct or prevent bias. Noise may harm small groups more, and an average can hide that harm. Performance and variation are reported by subgroup and compared with a nonprivate baseline in a controlled setting. Privacy and utility form a frontier that should be exposed rather than hidden behind one accuracy score.

Federated learning: moving computation does not remove leakage

Work on federated optimization studied distributed training with non-independent, unbalanced data and constrained communication. Participants compute updates and a server aggregates them. This architecture reduces the need to centralize raw data, but it does not promise that updates are harmless.

The server may observe contributions, a client may send a malicious update, and devices may drop out. Hardware, connectivity, and population heterogeneity complicate convergence and representation. “On device” describes where an operation occurs; privacy depends on what is sent, who sees it, how many participants are mixed, and which auxiliary information exists.

Secure aggregation lets a server learn a sum of updates without seeing each one in the clear under a protocol and assumptions. It can combine with differential privacy to limit what can be inferred from the aggregate. Metadata, availability, authentication, and poisoning remain. The cryptographic layer does not validate contribution quality.

A federated evaluation reports eligible and active clients, example distribution, rounds, bytes, energy, failures, accuracy, and subgroups. It tests malicious clients and dropouts. It also compares centralized and local training: complexity is justified only when it reduces a relevant exposure or enables data that could not be gathered legitimately.

Homomorphic encryption: computing unseen is not deciding without risk

Craig Gentry’s thesis presented a fully homomorphic encryption construction capable in principle of evaluating circuits over encrypted data. A server operates on ciphertexts, and the key holder decrypts the result. This is a property of computation and keys, not of the task’s legitimacy or the information revealed by an answer.

In machine learning, schemes operate with particular operations, depth, precision, and cryptographic parameters. Function approximation, quantization, and noise management can change the model. Latency, memory, ciphertext size, and keys are measured with the same batch and hardware as the alternative. “Possible” does not mean it meets a service deadline.

Homomorphic encryption can protect remote inference or aggregation in particular designs. It does not stop the key holder from misusing a result, repair a discriminatory model, or automatically protect earlier training. Key management, rotation, recovery, and separation of duties are part of the system. An exposed key turns a sound construction into a failed deployment.

Intermediate designs include trusted execution environments, multiparty computation, pseudonymization, and access controls. Each moves trust and cost. Architecture should be compared against the defined adversary rather than by mathematical sophistication.

A healthcare consortium shows why layers combine. Each hospital may train locally; secure aggregation hides individual updates; differential privacy limits one patient’s influence; and an enclave or encryption protects a particular computation. The consortium still needs a shared purpose, clinical vocabulary, label quality, authorization, key management, and per-site evaluation. If one hospital contributes a different population, the aggregate average may worsen performance precisely there.

Select a combination and demonstrate it

A decision matrix has six columns: data or contribution; stage; adversary; desired property; technique; evidence. DP limits one contribution’s influence on output. Federation reduces movement of raw data. Secure aggregation hides individual updates from a server. Homomorphic encryption protects certain computations. Access control, minimization, contracts, and deletion remain necessary.

Distillation does not belong in that list as a privacy guarantee. A smaller student learns from teacher outputs and may reduce cost, but it can inherit behavior or memorized information. Only a mechanism with explicit analysis—for example, differential privacy applied to the process—supports a formal claim. “Smaller model” does not mean “smaller risk” without a test.

The European Union’s GDPR establishes principles including purpose limitation, minimization, accuracy, storage limitation, integrity, and accountability. No technique alone certifies compliance. An organization documents purpose, legal basis, roles, rights, transfers, security, and impact assessment where appropriate.

An audit repeats the attack under access available to a realistic adversary: black-box queries, scores, parameters, or participation as a client. It compares against chance and the unprotected system and reports intervals rather than one example. The audit also verifies that the control is enabled in production; an available library or contractual clause does not prove that the material flow uses the protection.

The final report publishes configuration and limits: epsilon/delta and accounting; participants and aggregation; cryptographic scheme and parameters; threat, dataset, subgroups, latency, and cost. It also tests deletion, incidents, and degradation. The transferable skill is matching each technique to its property, adversary, cost, and evidence. “Private” then becomes a concrete claim that another person can try to refute.