Step by Step
M
Memorization — LLMs can regurgitate private training data
LLMs can memorize and later regurgitate specific private information that appeared in their training data, raising genuine privacy risks.
Example: a model trained on a dataset containing private personal information later reproducing that exact information verbatim when prompted in a certain way.
I
Membership inference attacks — was this data in training?
A membership inference attack tries to determine whether a specific individual's data was included in a model's training set at all, which itself can be a privacy violation.
Example: an attacker determining, just from how a model responds, whether a specific person's medical record was part of the model's training data.
F
Federated Learning — training without centralizing data
Federated learning trains models locally on each individual device, only sharing the resulting gradients rather than the raw data itself, meaning the actual data never leaves the device.
Example: a keyboard prediction model training locally on millions of individual phones, with only aggregated gradient updates (not actual typed messages) ever being sent back to a central server.
D
Differential Privacy — calibrated noise as a mathematical guarantee
Differential privacy adds carefully calibrated noise to data or model outputs, providing a mathematical guarantee that individuals cannot be identified from the results.
Example: adding calibrated statistical noise to a dataset's aggregate statistics so that no individual's specific data can be reverse-engineered from the published results.
Applied Walkthrough
1
An EU citizen requests that a company delete all their personal data, citing their GDPR right to erasure.
2
The company realizes this individual's data was also used to train one of their deployed machine learning models, not just stored in a database.
3
Ask: does GDPR's right to erasure extend to data baked into a trained model's weights, not just data in a database? Yes — this creates a legal obligation sometimes called machine unlearning, requiring the removal of that individual's influence from the trained model.
4
This is currently an active area of research without a perfect technical solution, illustrating a genuine tension between legal privacy requirements and the practical reality of how deep learning models are trained.
Exam Application
Exams test whether you can distinguish these privacy-related concepts: memorization (the underlying risk), membership inference attacks (a specific privacy attack), federated learning (a training approach that keeps data local), and differential privacy (a mathematical technique providing formal privacy guarantees). Also expect a question on machine unlearning as an unresolved, actively researched legal and technical challenge.
⚠ Common Trap
The most common trap is assuming federated learning and differential privacy are the same technique. Federated learning changes WHERE training happens (locally on devices, data never centralized); differential privacy changes WHAT is revealed (adding calibrated noise to prevent individual identification) — they address related but distinct privacy concerns and can even be used together.
✓ Quick Self-Check
1. What privacy risk does memorization create in LLMs?
LLMs can memorize and later regurgitate specific private information that appeared in their training data.
Tap to reveal / hide
2. What does a membership inference attack try to determine?
Whether a specific individual's data was included in a model's training set at all.
Tap to reveal / hide
3. What is the key characteristic of federated learning?
Models train locally on each device, sharing only gradients rather than raw data, so the data never leaves the device.
Tap to reveal / hide
4. What does differential privacy add, and what guarantee does it provide?
Calibrated noise, providing a mathematical guarantee that individuals cannot be identified from the results.
Tap to reveal / hide
5. What legal right creates the concept of "machine unlearning," and is it fully solved?
GDPR's right to erasure; it remains an active research area with no perfect technical solution yet.
Tap to reveal / hide