Editing Privacy Ml (section)

== <span style="color: #FFFFFF;">Understanding</span> ==
'''The core problem''': ML models memorize training data. This is well-documented: models can reveal training examples when queried appropriately. This creates serious privacy risks when training data includes medical records, financial transactions, or personal communications.

'''Differential Privacy (DP)''' provides a rigorous mathematical definition of privacy. A mechanism M satisfies (ε, δ)-differential privacy if for any two adjacent datasets D and D' (differing by one record), and any output S: P(M(D) ∈ S) ≤ e^ε · P(M(D') ∈ S) + δ. This means the output distribution is nearly identical whether or not any individual's data was included — their privacy is protected regardless of what the attacker knows.

'''DP-SGD''' is the standard technique for differentially private deep learning (Abadi et al., 2016):
# Compute gradient for each sample individually.
# Clip each gradient to bounded L2 norm (prevents any single example from having too much influence).
# Add Gaussian noise calibrated to the privacy budget.
# Average the noisy, clipped gradients and update model. The cost: additional noise degrades model utility, especially for complex models and small datasets.

'''Federated learning''' keeps data on-device. Google's Gboard keyboard predicts the next word by training on user input directly on phones; only encrypted gradient updates are sent to a central server, aggregated, and used to update the global model. No raw text ever leaves the device.

'''The tradeoff landscape''': Strong privacy → more noise → lower model accuracy. There is a fundamental tension between privacy and utility. The PPML field works to close this gap, but it cannot be eliminated entirely with current techniques.
</div>

<div style="background-color: #8B0000; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">