Schedule

This class is organized in a sequence of topics. For each topic, we first cover basic concepts in an instructor-driven lecture, after which we read papers on the topic and discuss them in class. Below is the approximate class schedule, along with major dates for homework deadlines, midterm, and project milestones.(*) While those dates are set in stone, the specific lecture topics and papers that will covered at each date may change up until the week before.

Topic 0: Course introduction

01/24 Lecture

• Course organization
• Example use case: privacy-preserving attribution

Topic 1: Privacy risks and attacks

01/31 Lecture

• General privacy concerns in big data
• Examples of privacy risks in modern ML ecosystems
• Privacy attacks against anonymization, aggregates, models
• Demos of privacy attacks

01/31 HW 1 released (due 02/20)

• HW 1 reading (no discussion in class): Carlini, Liu, Erlingsson, Kos, and Song, USENIX Security 2019. The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks.

02/07 Reading & discussion

• Nasr, Carlini, Hayase, et al., ArXiv 2023. Scalable Extraction of Training Data from (Production) Language Models. See also the associated blog post.

02/07 Project rollout

Topic 2: Differential privacy (DP)

02/14 Lecture

• Defining privacy in statistical data analysis
• DP definitions and interpretations
• DP parameters and semantics
• DP mechanisms
• Composite DP algorithms (DP LR, SGD, etc.)
• Code overviews, demos

02/20 HW 1 due

02/21 Reading & discussion

• Vadhan, Tutorials on the Foundations of Cryptography 2017. The Complexity of Differential Privacy, Section 1 (pp. 3-13).
• Dwork, McSherry, Nissim and Smith, TCC 2006. Calibrating Noise to Sensitivity in Private Data Analysis.

02/21 HW2 released (due 03/13)

• HW 2 reading (no discussion in class): Lécuyer, Spahn, Vodrahalli, Geambasu and Hsu, SOSP 2019. Privacy Accounting and Quality Control in the Sage Differentially Private ML Platform.

02/27 Project proposal (one page, on courseworks)

Topic 3: DP deployments and systems

02/28 Reading & discussion

• Tholoniat, Kostopoulou, McNeely, et.al., SOSP 2024. Cookie Monster: Efficient On-device Budgeting for Differentially-Private Ad-Measurement Systems.
• Thomson, Leiserson, Savage. W3C Draft Community Group Report, 2024.

02/28 Project update: proposal (informal)

Topic 4: Secure multiparty computation (MPC)

03/07 Lecture

• Private collaborative learning
• Problem settings
• Secure multi-party computation
• Federated learning
• Existing technologies and systems
• MPC demo

03/13 HW2 due

03/14 Reading & discussion

• Corrigan-Gibbs and Boneh, NSDI 2017. Prio: Private, Robust, and Scalable Computation of Aggregate Statistics.
• Apple and Google, 2021. Exposure Notification Privacy-preserving Analytics (ENPA) White Paper. See also the associated blog post.

03/14 HW3 released (due 04/10)

Topic 5: Midterm project update

03/28 Midterm project update: progress and three steps (formal presentation)

Topic 6: Homomorphic encryption (HE)

04/04 Lecture

• Limitations of traditional encryption for data exposure risks in (ML) clouds
• Homomorphic encryption and example schemes
• Example system: homomorphic databases
• Code overviews, demos

04/10 HW3 due

04/11 Reading & discussion

• Popa, Redfield, Zeldovich, and Balakrishnan, SOSP 2011. CryptDB: Protecting Confidentiality with Encrypted Query Processing.

04/11 Project update: step 1 executed (informal)

Topic 7: Hardware enclaves

04/18 Lecture

04/18 Reading & discussion

• TBD 1 paper

04/18 Project update: step 2 executed (informal)

Topic 8: Compositions, tensions of privacy technologies, and broader

connections with non-privacy properties

4/25 Lecture

• Connections and tradeoffs of advanced privacy technologies
• Composing them in systems to address privacy risks in modern ML ecosystems

04/25 Project update: step 3 executed (informal)

Final project presentation

05/02 Final project presentation (formal presentation)

---

(*) We are distributing the papers from our own repository to avoid problems with unstable Internet links. The originals can be easily found by searching for papers’ titles/authors.