Privacy-preserving machine learning
Differential privacy, federated learning, anonymisation and synthetic data: what each really protects, and what it costs.
In 60 seconds
Privacy-preserving machine learning
Differential privacy, federated learning, anonymisation and synthetic data: what each really protects, and what it costs.
Anonymisation versus pseudonymisation
- Names replaced with codes, such as customer 48213
- A key or table can link codes back to people
- Still personal data in most privacy laws
- No reasonable way to identify anyone, even by combining data
- Very hard to achieve with rich data
- Often not covered by privacy law, if truly anonymous
Why re-identification happens
Differential privacy
- For model training, a common method clips how much each example can change the model, then adds noise during training.
- It directly reduces membership inference and memorisation risks.
- It usually lowers accuracy, most for rare groups and rare patterns.
- The guarantee is only as good as the settings and the correct accounting of the privacy budget.
Federated learning
- It reduces data movement and central collection.
- Updates can still leak information about local data, so it is often combined with secure aggregation or differential privacy.
- A dishonest participant can send poisoned updates, so aggregation needs checks.
Synthetic data
| Benefit | Trade-off |
|---|---|
| Can share realistic-looking data for testing and development | If the generator memorised real records, some may appear in the output |
| Can balance rare cases for training | May miss rare but important real patterns, or invent false ones |
| Reduces use of real personal data in many workflows | Not automatically anonymous; check it before treating it that way |
Choosing a tool
| Need | Tools to consider |
|---|---|
| Publish statistics about users | Differential privacy |
| Train across organisations that cannot share raw data | Federated learning, plus secure aggregation |
| Give developers test data | Synthetic data, checked for leakage, or masked data |
| Reduce what is stored at all | Minimisation: the simplest and often the strongest option |
Watch and read more
Lab
A re-identification check on a toy dataset and a written choice of privacy technique for one use case.
The problem
Create a toy dataset of 200 made-up people with columns: pin code, age, gender, and a sensitive field such as a health condition. Use invented values only.
- Count how many rows have a unique combination of pin code, age and gender.
- Generalise the data (age bands such as 20–29, first 3 digits of pin code) and count again.
- Write 3 sentences on what this shows about "removing names".
- For one real use case in your company, choose between minimisation, pseudonymisation, differential privacy, federated learning and synthetic data. Justify the choice and name its trade-off.
Practice lab
Edit the code and run it. Python runs in your browser — nothing is sent to our server.
No output. Add print(...) to see values.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Generalising the data made fewer people unique. Why is that still not a full solution?Reveal
An attacker may have other information, such as an exact address or employer, that narrows the group again. Small groups that share a sensitive value still reveal it: if everyone in one group has the same condition, being in the group reveals the condition. And more generalisation makes the data less useful. Formal methods and expert review are needed for data you plan to release.
Q2Why might differential privacy be a poor fit for a model meant to detect a very rare fraud pattern?Reveal
Differential privacy limits how much any few records can shape the model. A rare fraud pattern may appear in only a few records, so the noise may hide exactly the signal you need. Consider other protections, such as strict access control and pseudonymisation, or accept a weaker privacy setting with a documented reason.
Questions people ask
Is there a correct value of epsilon?
There is no single right number. It depends on the data, the harm, and how many times the data is used. Experts debate the right ranges. Record the value you chose and why, and get privacy specialists to review it.
Does encryption solve this?
Encryption protects data while it is stored or moved. The model still learns from the decrypted data, and can still memorise it. Research techniques such as homomorphic encryption and secure enclaves protect data during computation, but they add cost and complexity. They solve a different problem from differential privacy.
Is federated learning automatically private?
No. It keeps raw data local, which is a real benefit, but model updates can reveal information. It is strongest when combined with secure aggregation and differential privacy.
Where should a small team start?
Start with minimisation and pseudonymisation: collect less, remove direct identifiers, and restrict access. Add differential privacy or federated learning when a specific risk justifies the extra effort.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.