TAGGEDPRIVACY 11 POSTS

Posts about PRIVACY.

2026.09.16 PRIVACY

Your membership-inference 'proof' that they trained on your book is mostly a clock.

A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.

17 min →

2026.09.16 PRIVACY

Machine unlearning is suppression, not deletion.

Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.

14 min →

2026.09.09 PRIVACY

You ran the model on-device for privacy and leaked the conversation through the cache.

On-device inference moves the prompt off the network so there is nothing to intercept. It does not move it off the CPU cache — and an unprivileged co-resident process reads your input and output text back from there at near-perfect fidelity.

13 min →

2026.08.22 PRIVACY

The epsilon on your private model is computed for an algorithm you did not run.

Your trainer shuffles the dataset each epoch; your privacy report cites the math for Poisson subsampling. They are different mechanisms with different guarantees — and the reported epsilon understates the real leakage by up to 4×, up to 10× for the common shuffling variants.

16 min →

2026.08.19 PRIVACY

Your vector database is a plaintext store.

Storing only the embeddings feels like storing a hash — a one-way projection, safe to treat as opaque. It is not: text embeddings invert back to the original text at high fidelity, and the newest attacks need no access to the model that produced them.

12 min →

2026.08.19 PRIVACY

Your confidential-inference enclave attests the binary, not the half of the model an attacker actually wants.

Heterogeneous TEE-GPU inference shields the non-linear layers and offloads the projection and embedding layers to the GPU. Those offloaded layers are the ones a sub-$20 black-box attack already steals — and attestation never measured them anyway.

13 min →

2026.07.23 PRIVACY

Your RAG corpus is extractable.

The familiar RAG privacy worry is the corpus leaking at rest. The sharper one: an adversary with nothing but query access reconstructs the private knowledge base one answer at a time — and never touches the database.

9 min →

2026.06.26 PRIVACY

Differential privacy for fine-tuning: when it earns its cost.

Fine-tune on data with PII in it and the model can be made to recite it back verbatim. DP-SGD bounds that — at a measured cost of a point or two of accuracy for a pretrained model, not the catastrophe the folklore claims. When the threat model justifies paying it.

11 min →

2026.04.17 PRIVACY

PII redaction that does not wreck retrieval.

Stripping PII before documents reach the embedding model is often necessary. But naive redaction destroys the semantic signal retrieval depends on. How to redact without wrecking retrieval.

10 min →

2026.03.25 PRIVACY

Confidential RAG: keep the context secret, not just the query.

Most private RAG protects the user's query in transit and leaves the corpus exposed. But the corpus is the sensitive asset — the embeddings, the vector store, and the chunks the model sees all need protecting.