1 00:00:10,320 --> 00:00:25,800 So thank you so much, everyone, to join this Global Network webinar. And before we start, please note that the camera and the microphone of all attendees are automatically switched off during the presentation. And also during the Q& A session, 2 00:00:25,800 --> 00:00:35,520 we will of course give you the opportunity to unmute yourself and Switch on your camera. And welcome to. 3 00:00:45,071 --> 00:01:04,071 we have with us Matthias, Dave, Rafael, and Benjamin, who will speak about the privacy enhancing technologies and artificial intelligence. And this is the second of our five webinars in our AI for Official Statistics series. 4 00:01:04,951 --> 00:01:27,111 And I would like to introduce the topics and also the speakers of today. National statistical offices face growing pressure to share and link data across organizational and jurisdictional boundaries, whilst navigating legal frameworks and maintaining public trust. 5 00:01:27,831 --> 00:01:53,867 Privacy Enhancing Technology or PETS PETS offer a way forward, unlocking statistical analysis and collaboration without exposing underlying data. Since 2019, the UN PETS Lab has brought together NSO's researchers and technology providers to test the path in 6 00:01:53,867 --> 00:02:15,423 the real world from cross-border federated learning to secure linkage of international trade statistics. At this event, the expert from the UN Pet Lab Community of Practice will present the role of Pets in the context of responsible AI 7 00:02:15,423 --> 00:02:37,489 governance, showcase practical examples of use cases and technologies, and explain how to get involved. and access support from the Pat Lab community. Now, let me say a few words about our speakers. So, Matthias is a strategic advisor for data 8 00:02:37,489 --> 00:02:57,689 management of Statistics Netherlands. He holds a master degree in computer science from the University of Jupiter. He works in senior leadership positions in statistics. offices of the Republic of Slovenia and Statistics New Zealand, 9 00:02:57,689 --> 00:03:16,607 as well as a consultancy role for several international organizations. He is an active participant in the International Statistics Community, leading the test team on PATS, part of the UN committee of experts in big data and the data science. 10 00:03:16,607 --> 00:03:31,875 Dave is a technology policy consultant specializing in privacy technologies and the data governance. He works in policy and the partnerships at the Open Mind Foundation, a nonprofit building open source 11 00:03:31,875 --> 00:03:56,495 infrastructure for privacy preserving AI and the co-chairs of the UN Test Lab. Previously, he worked as a technology advisor in UK government and was a software engineer in private sector. Rafael is a senior data scientist with deep expertise in privacy preserving data 12 00:03:56,495 --> 00:04:20,471 analysis, spatial data, and rare event modeling. which he applies to support and advanced public administration. He holds an engineering degree from Mines Paris Tech and a PhD in Statistics from Echo Technique Federal de La Seine. 13 00:04:21,591 --> 00:04:42,871 Since 2021, Rafael has been working at the Swiss FSO, where he supports Swiss public administrations in leveraging data science to drive innovation. And Benjamin is the lead privacy engineer at Stasix Canada. 14 00:04:43,431 --> 00:05:01,511 Specializing in research and the integration of emerging paths into AI and the machine learning frameworks, Benjamin champions how paths such as federated learning, synthetic data, and secure multi-party computation. 15 00:05:02,151 --> 00:05:21,999 act as a critical accelerator for innovation by unlocking insight from sensitive data that cannot be openly shared, maximizing data utility while maintaining public trust. And before I hand over to Matthias, who will also give us an introduction of 16 00:05:21,999 --> 00:05:36,451 this webinar, as usual, some practical remarks. You can write your comments and questions into the meeting chat at any time, but during the Q&A session, we would also encourage you to ask your questions yourself. As always, 17 00:05:36,451 --> 00:05:54,119 this Global Network webinar is being recorded and will be made available on the Global Network of Data Officers and Statisticians on LinkedIn. So if you haven't joined the New Global Network yet, we invite you to follow the link in the chat that I will share later to join the 18 00:05:54,119 --> 00:06:11,591 group on LinkedIn. And please also sign up for our newsletter as well, following the other links in the chat to ensure that you get our monthly updates also in the future. So now over to you, Matthias, who will also give us the introduction of 19 00:06:11,591 --> 00:06:34,621 this webinar. Thank you so much. Yeah, yeah. Thank you, Yuxi, for a nice introduction. And also thank UNSD, Alexander, to inviting us to this exciting AI series of webinars. So, yeah, as was mentioned, I have a privilege of chairing the UN 20 00:06:34,621 --> 00:06:51,732 Task team on privacy enhancing technologies. And we have been now for seven years already investigating the role and application of privacy technologies in official statistics. And we have published the Handbook of 21 00:06:51,732 --> 00:07:11,793 Privacy Preserving Technology, as they were called at the time, as well as Pet Guide in 2023. And all our work and outputs are available here in the link that I just shared. But during this investigation, we realized that probably the statistical 22 00:07:11,793 --> 00:07:31,083 organizations really need help and support in terms of practical testing of these techniques on their own use cases. So back in 2022, we established what we call UN Pet Lab Community of Practice, which is actually the network of members 23 00:07:31,083 --> 00:07:52,323 from statistical organizations, from academia, so academic researchers, as well as from private organizations and foundations that are actually working on privacy enhancing technologies. And that gave us some sort of more practical focus. 24 00:07:52,323 --> 00:08:11,713 And my colleagues today will present, yeah, both insights from this research as well as for some practical projects. So yeah, with that, I would just like I would like to pass to to the first presenter, Dave Buckley, 25 00:08:11,713 --> 00:08:26,631 who will explain how pets what pets are and and how what is their role in the responsible AI governance. Thank you. Thanks, Francesca. Just give me one moment to share my screen. 26 00:08:32,111 --> 00:08:47,551 Hopefully, that's not coming through. Looks good. I see nods. Great. Thank you. Yes, as Matthias mentioned, so I co-chair the UN Pet Lab, also worked for the non-profit Open Mind Foundation, who actually were a co-founder of the Pet 27 00:08:47,551 --> 00:08:59,982 Lab back in 2019. Yeah, hearing Matthias say seven years was quite scary, but here we are. Yeah, hopefully we're going to talk a little bit about some of the work we've done in that time and some of the work we 28 00:08:59,982 --> 00:09:12,046 continue to do through both the Pet Lab and the wider task team that Matthias talked about. So I'm going to try and set a bit of, yeah, maybe more of a high level context of sort of what we mean when we talk about pets and how it might fit in around 29 00:09:12,046 --> 00:09:24,649 themes of sort of AI governance. And I guess to start, I would sort of slightly provocatively perhaps say that AI governance is data governance, or at least I think at least you would say data governance is a big part of AI 30 00:09:24,649 --> 00:09:40,442 governance, right? So a model is a compression of its data. A lot of the things you want to govern when it comes to AI, so sort of from algorithmic bias, to privacy, to provenance, to consent, to security and accountability, kind of resolves into a question about 31 00:09:40,442 --> 00:09:54,996 data. So whose data, you know, where did this data originate from? How was it gathered? Under what terms? With what controls? And this thing kind of exists along you know, a whole life cycle of the whole AI life 32 00:09:54,996 --> 00:10:09,392 cycle, really. So be that where we're referring to pre-training data, data that's used for fine-tuning, sort of context that we bring in, the inference time when using a model, or even like the models themselves, right? So like model weights, you know, 33 00:10:09,392 --> 00:10:24,694 are just kind of an array of numbers, which could be considered data as well. Um... And I guess kind of at high levels, I was going to talk about some challenges with traditional data governance. So, you know, we, 34 00:10:24,694 --> 00:10:39,060 as people in the statistical community, will know more than most. Yeah, like disclosing data in a secure and private way and safe way is a challenge. We see sort of pseudonymization and anonymization techniques that might 35 00:10:39,060 --> 00:10:49,916 traditionally been used can fail to meaningfully protect privacy. And you know, this tends to sort of cut through to the public domain when something really bad happens, like a big data leak. And yeah, 36 00:10:49,916 --> 00:10:57,071 you can imagine there's been a whole series of such incidents over the past sort of. Yeah, 20, 30, 40 years. 37 00:10:58,951 --> 00:11:06,031 There's also this idea that if you using using pseudonymization techniques can, you know, can reduce the utility of data, right, if you're applying. 38 00:11:08,311 --> 00:11:21,879 Yeah, the identification techniques to try and mask information or redact information that kind of necessarily reduces the utility of that data. So, you have this sort of concept of this of this privacy versus utility trade-off. Yeah, 39 00:11:21,879 --> 00:11:36,114 perhaps with these more traditional techniques, it can be quite hard to sort of get both privacy and and whilst preserving utility. Even if we could perfectly anonymize data, we can't necessarily prevent misuse when sharing data. 40 00:11:36,114 --> 00:11:49,151 So I might share some data with another organization for an express purpose. But as soon as I've shared a copy of that data, it's hard to sort of, in a technical way, ensure and enforce that what that data 41 00:11:49,191 --> 00:12:04,725 was shared for, the purposes that it was shared for, is what it ultimately is used for, and that it's not further shared with other organisations or used for different use cases. So we end up relying on sort of legal frameworks and policy-based governance 42 00:12:04,725 --> 00:12:19,351 measures, which are very much necessary. But I would say a sort of perhaps insufficient. And as I was just alluding to, can be very difficult to enforce. So we kind of end up with this world where data sharing initiatives can fail due to this sort of combination of 43 00:12:19,351 --> 00:12:32,492 privacy, security, intellectual property, costs, legal reasons. In an ideal world, we need solutions that can address some of these concerns by design. So yeah, you're getting this see this image a lot when people give like high level pet presentations, 44 00:12:32,492 --> 00:12:42,550 but can we sort of move the privacy utility curve upwards so we can have this sort of have our cake and eat it, so to speak, where we can have sort of good levels of data privacy at this without having to 45 00:12:42,550 --> 00:12:56,432 sacrifice utility of the data sets. And this is where, when we talk about privacy enhancing technologies, This is kind of the shared property that we're typically referring to, this ability to enable us to extract utility from sensitive information whilst 46 00:12:56,432 --> 00:13:10,311 preserving privacy. Which yeah, leads us on to what are pets. So which I, yeah, I guess I'm just restating that here. So this is kind of a broad collection of technologies that share this property of being able to shift the trade-off between privacy and utility of data. 47 00:13:11,071 --> 00:13:25,535 And what this can enable in principle is that different researchers, different organisations, different individuals can sort of collaborate on their data, do collaborative data science without having to see the other organisations' private data assets. And again, 48 00:13:25,535 --> 00:13:37,954 I'm not going to get into the specifics of any technologies here, But these are, and again, this also isn't like a definitive list, but these are typically the sort of types of technologies and specific technologies 49 00:13:37,954 --> 00:13:49,311 that get talked about. I will just mention, so this distinction between input privacy and output privacy. So this is, I think we, I think the Pet Lab, when we pub, well, the Pets test team published a UN Pet Guide. 50 00:13:50,471 --> 00:14:06,526 I want to say in 2022, that could be wrong. But I think this introduces this concept of input privacy and output privacy in how we categorize pets. So the idea that there are pets that present privacy at the input layer, i.e. the data that's going into a system, 51 00:14:06,526 --> 00:14:18,196 and pets that protect the output layer. So that sort of data coming out of the systems. This is things like differential privacy, and you'd also include in there sort of some of the statistical disclosure mechanisms that national statistics 52 00:14:18,196 --> 00:14:33,152 offices would traditionally use as well. So yeah, why that's for official statistics? Again, I think I'm sort of preaching to people who know much more about this than me, but national statistics offices have a mandate to set the public interest by 53 00:14:33,152 --> 00:14:41,071 protecting the data of the citizens that they represent, but also maximizing the public interest benefits that can be derived from that data. 54 00:14:42,991 --> 00:14:53,641 So sort of the theory here is that with privacy enhancing technologies, this can provide like new avenues for enabling useful data to be more accessible for research and innovation. So you can sort of, in theory, 55 00:14:53,641 --> 00:15:03,631 we can actually sort of do more to maximize the public benefits from that data while still maintaining like really, really high standards of protecting privacy and the autonomy of citizens. 56 00:15:06,271 --> 00:15:09,711 So, the role of privacy and has technologies and data governance, so... 57 00:15:11,591 --> 00:15:15,791 This QR code I think links, it will link to a page that I think then links to these papers. 58 00:15:18,511 --> 00:15:34,269 But yeah, essentially last year we published, so this was a few authors who are collaborating through the UN Pat Lab. We published 4 papers as part of a special edition of the Statistical Journal of the IAOS on privacy and housing technologies, 59 00:15:34,269 --> 00:15:47,841 and a couple of these focused on data governance. So this sort of first paper, which is quite a brief introductory paper, is explicitly focused on the topic of the role of pets in data governance and linking to some of the high level 60 00:15:47,841 --> 00:15:58,591 frameworks that we see through that have come out of the UN, through like the Global Digital Compact and other sort of global international organisations who are interested in data governance as well. 61 00:15:59,471 --> 00:16:12,186 A second paper kind of goes a level deeper on the role of pets and official statistics and goes into sort of trying to provide a taxonomy of use cases for privacy and housing technologies and talks to the different stakeholders who 62 00:16:12,186 --> 00:16:25,727 are involved in doing data projects at national statistics offices and how pets can potentially help to like shift the incentives of those stakeholders in order to make it sort of more likely that a valuable data 63 00:16:25,727 --> 00:16:44,506 collaboration projects can proceed. And that all the work in all the kind of, yeah, all the work in that paper came about through sort of stakeholder consultation through the UN Pet Lab. So through the various privacy tech startups, foundations like Open Mind, 64 00:16:44,506 --> 00:16:57,002 and I think most importantly, representatives and national statistics officers who are exploring these technologies. And yeah, I probably don't have time to go into detail on any of these papers in this 65 00:16:57,002 --> 00:17:10,446 short session, but I'm happy to follow up with anybody if if of interest. There's also a third paper, which was led by our colleague, Zhiyuan Kim from Fraser Nash University in Canada, which conducts A Adelphi survey that's 66 00:17:10,446 --> 00:17:24,946 conducted with statisticians from national statistics offices to better understand the role of pets in supporting risk assessment frameworks. with a particular focus on the five states framework. And a final paper, 67 00:17:24,946 --> 00:17:40,671 which is from Ben, who's going to present to us momentarily, and colleagues at Statistics Canada and ISTAT in Italy, which describes A hands-on pilot that they've done to measure trade asymmetries in a privacy preserving manner. 68 00:17:41,471 --> 00:17:43,391 using secure enclaves. 69 00:17:45,391 --> 00:17:52,831 So yeah, do check out that journal if you haven't already. I'll just touch briefly on this first paper, given I only have a short amount of time. 70 00:17:55,231 --> 00:18:07,660 We basically have this idea that this is talking about responsible data sharing, and we frame this as responsible data sharing is kind of finding this optimal balance between maximizing the societal value of data and needing to protect the 71 00:18:07,660 --> 00:18:22,372 privacy, security, and safety of citizens, which I was sort of describing before, and argue that sort of pets can support this by better navigating this trade-off between privacy and utility. and also providing more precise, granular control over sort of which 72 00:18:22,372 --> 00:18:32,111 queries and which computations are permitted to run on a certain data asset. This is going beyond just sort of protecting the privacy of data, but also 73 00:18:34,591 --> 00:18:51,065 enabling it to be governed in a much more granular way and providing data owners like insights into how their data is being used. And in principle, and you'll have to take this with a pitch of salt because I know I know you're describing this at quite an abstract 74 00:18:51,065 --> 00:19:04,009 level, but taking these two things together, I think this can be like potentially like quite powerful mechanisms for more robust and effective data governance, and therefore more robust and effective AI governance. And as I was mentioning, we kind of linked to the Global Digital 75 00:19:04,009 --> 00:19:20,103 Compact, which has sort of relevant ideas. on data governance. And I think that's a most relevant privacy enhancing technologies is this objective 4, which has a particular, so is all about advancing responsible, equitable and interoperable data 76 00:19:20,103 --> 00:19:32,582 governance approaches and has a dedicated section on data privacy and security. So yeah, we've been engaging and working with the folks within the UN community who are sort of working on operationalizing the 77 00:19:32,582 --> 00:19:42,871 Global Digital Compact to understand how our community of practice can help support its goals. And hopefully this webinar can sort of work towards that aim as well. Just very quickly, just to wrap up, 78 00:19:42,871 --> 00:19:56,299 I guess I just wanted to give some high level examples of the types of use cases that sort of supported AI governance could enable. And this will then hopefully segue nicely into the subsequent presentations, which will be a little bit more, yeah, 79 00:19:56,299 --> 00:20:00,111 hands-on in terms of showing the capabilities of these technologies. 80 00:20:02,591 --> 00:20:15,267 But yeah, super high level. So one example, which maybe this might be the most familiar to people, is this idea of doing federated learning. So can I train a model on distributed federated data sets where the training data doesn't have to leave the 81 00:20:15,267 --> 00:20:30,695 institution from which it originates? I think Ben is going to talk a little bit about a project we've been exploring there through the UN Pet Lab. There's also things at inference time. So again, we seem to be moving to this world where a lot more of the information flow 82 00:20:30,695 --> 00:20:47,541 involved with models is actually at inference time, a lot more people using sort of retrieval systems. So again, can there be ways of doing sort of federated retrieval where you can sort of leverage leverage data from different organisations at inference time whilst 83 00:20:47,541 --> 00:21:02,511 retaining and maintaining, I suppose, data sovereignty. And there's also approaches around sort of third party evaluations of models. So again, AI evaluations is, I think, is like a big and growing ecosystem. 84 00:21:02,991 --> 00:21:17,859 And this idea of sort of third party evaluations to be able to verify the claims made about AI systems is again an interesting mechanism where we've seen privacy enhancing technologies employed to protect the privacy and intellectual 85 00:21:17,859 --> 00:21:35,071 property of sort of models as well as evaluation data sets. that are used in those processes. So that's kind of a bit of a flavour of what's possible. I will pause there and I suppose pass to pass back to Matthias to maybe lead us into the to the next session. 86 00:21:36,991 --> 00:21:50,031 Yeah, thank you. Thank you, Dave, for your insight. And yeah, I'll just pass then to Rafael, who will explain a bit more how pets can mitigate certain confidentiality and privacy risks. 87 00:21:52,671 --> 00:21:57,951 Thank you very much, Matthias. So do you hear me well and on the screen, the slide full screen? 88 00:21:59,791 --> 00:22:17,142 Getrude. Yeah. Yeah, all good. Perfect. So thank you so much for the invitation. It's really a good pleasure to be here today. So the idea is to give you some idea on basically how privacy enhancing technology can help mitigate what we call the confidentiality risk, 89 00:22:17,142 --> 00:22:33,966 and especially in artificial intelligence. So just let me start by setting up the scene to give you an idea of how and where privacy and handling technologies can help protecting this confidentiality. And let me first by describing what we 90 00:22:33,966 --> 00:22:49,585 usually consider as being a standard workflow in AI and machine learning in general. So usually, When you would like to use this model, the very first step is actually to start preparing your data. It's a step that is also known as feature 91 00:22:49,585 --> 00:23:01,442 engineering, where basically you try to manipulate and transform your data such that it can be leveraged as well as possible by your AI or machine learning model. The second step is actually to combine 92 00:23:01,442 --> 00:23:16,787 the data that you prepared at the first step with this AIML model, so it's usually a mathematical representation of some specific combination of parameters. And during the training step, the idea is to find the best parameter 93 00:23:16,787 --> 00:23:31,773 that correspond to the data that you have been preparing, so this input data. Once you have been successful in combining those those two components. So that basically means that you have estimate, you add value for the parameters of your 94 00:23:31,773 --> 00:23:45,109 model. Then obviously, having a trained model is not a goal in itself. What you would like is to make this model available to a potential user. So this is step 3, where you actually serve the trained model through these estimated parameters 95 00:23:45,109 --> 00:23:59,971 and give the opportunity to a user to bring his or her own data, input data, and then give it to the model such that in the fourth step, actually, they can manage to obtain a prediction out of the model. So along this whole workflow, 96 00:23:59,971 --> 00:24:14,337 we see that we have multiple stakeholders. So the very first one is the data owner, and he is responsible in general to protect the data. And when he or she wants to actually use this data to start the training process, 97 00:24:14,337 --> 00:24:28,231 it will request some computing power that is usually provided by an IT provider. That can be internal to the organization, but it can also be external of the organization. And finally, once you have the trained model, 98 00:24:28,751 --> 00:24:40,167 you will make it available to users, and those users can also be within your organization or outside your organization. So you have multiple stakeholders, multiple steps, and the idea is try to see how privacy 99 00:24:40,167 --> 00:24:52,183 enhancing technology can actually help preserving the confidentiality of the input data throughout this process and for all the different stakeholders. But first, let me start to explain actually why I 100 00:24:52,183 --> 00:25:07,471 was speaking about confidentiality so far and not directly on privacy. The reason is that confidentiality is actually something that is requested by the Principle 5 of the National Code of Good Practice for Official Statistics. 101 00:25:08,431 --> 00:25:25,981 And it has a specificity that confidentiality is a property of data. So it's basically assessing if data that we have collected at the National Statistical Office remain secret. So it's objective. It's something that we can measure and that we can quantify. 102 00:25:25,981 --> 00:25:42,864 It's basically under the question, is this data secret? Yes or no. And to be able to maintain the status of the data, hopefully in the secret status, there's two sides to confidentiality. The first one is security, which basically revolves around 103 00:25:42,864 --> 00:26:02,963 preventing any kind of unauthorized access to the data. So this is more traditionally the role that is given to IT security. And the other side of confidentiality is disclosure control, which is basically disclosing the risks that when we actually make willingly 104 00:26:02,963 --> 00:26:16,625 available the result of a computation. So for instance, a machine learning or AI artificial AI algorithm that we would have trained with the data, We would like to limit the risk that this data product, 105 00:26:16,625 --> 00:26:31,711 so the result of this computation, might disclose the data that has been used in inputs. So really enforcing confidentiality is providing solution for both of these aspects and privacy enhancing technologies are here to protect those two aspects 106 00:26:32,031 --> 00:26:44,298 of confidentiality. So going back to the standard workflow for machine learning and AI, the very first natural step to be able to protect confidentiality of the data is protect data directly at the very first 107 00:26:44,298 --> 00:26:58,031 step, so at the data preparation site. Because if confidentiality is protected at step one, then we know that the data will be protected against all of the stakeholders throughout the whole process and the whole workflow for 108 00:26:58,031 --> 00:27:12,591 machine learning. So here, two main examples of privacy enhancing technology that could be used in this setup are synthetic data and local differential privacy. Synthetic data is very simple. The idea is to randomly generate 109 00:27:12,991 --> 00:27:30,035 data sets that mimic the statistical properties and the structure of the original data set. Local differential privacy is similar, but has a little slightly different strategy, where here, instead of randomly generating new data, we'll take the original data and we will 110 00:27:30,035 --> 00:27:47,362 partially randomize this input data to make it unreliable to be used at the individual level. So what does that mean in practice? So for instance, if you have a categorical variable with two possibilities, yes or no, we will replace the true answer 50% of 111 00:27:47,362 --> 00:28:03,511 the time by the true answer. And 50% of the time, we will also replace the answer by just the cost, the toss of a coin, which take 50% of the time the answer yes, and 50% of the time the answer no. So really the idea here is that with this 112 00:28:03,511 --> 00:28:16,111 kind of technologies of pets, we can ensure that the data, if it were accessed by someone who has no rights over the data, would not be able to use the data against the individual because it's not reliable. 113 00:28:17,071 --> 00:28:32,872 The second strength of the two technologies is that it's really, in general, easy to set up and also easy to communicate in terms on how they can offer protection with respect and confidentiality. Of course, there are some challenges. 114 00:28:32,872 --> 00:28:49,152 The first one is that, for instance, with synthetic data, the sector and the methodology is today very, very wide. And the privacy guarantees that this jungle of provider of synthetic data generators offers widely differ today. 115 00:28:49,152 --> 00:29:04,392 The second challenge is that Dave mentioned this privacy utility trade-off is when we start applying the protection So early into the chain, into the workflow and machine learning and AI, it's extremely difficult to actually 116 00:29:04,392 --> 00:29:17,489 assess the utility, the reliability, and marginally the impact of the protection on the model that you are training on the protected data. So this is why very naturally the idea is not to enforce the protection on the data 117 00:29:17,489 --> 00:29:31,559 preparation, but at the training step. And so here comes into play potentially other kinds of privacy enhancing technologies. The first one is known as confidential computing. So here the idea is to offer some 118 00:29:31,559 --> 00:29:49,663 security protection against the IT provider by offering a computing environment that is completely isolated from outside of the world. So the idea is that nobody can access and can read the data that is fed for the computation, except the data owner. 119 00:29:49,663 --> 00:30:01,995 And this also includes the data provider. So for instance, if you do not trust your IT provider, so if you go to public cloud services, then with confidential compute, you have the guarantee that even this 120 00:30:01,995 --> 00:30:16,696 provider cannot access the data. Differential privacy will offer other kind of guarantees. It will offer protection against the risk that the trained model might disclose the input data. How does it work? It's fairly simple. So here, 121 00:30:16,696 --> 00:30:31,991 instead of partially randomizing the data, we will partially randomize the training algorithm itself, such that we will limit the risk that the algorithm will disclose some of the input data. at the later stage. So the strengths of this combination of 122 00:30:31,991 --> 00:30:44,393 pets in this particular context, where we actually have a solution that offers input privacy and output privacy, so confidentiality, both on the security with confidential computes and disclosure control with 123 00:30:44,393 --> 00:31:02,031 differential privacy, they offer improved model performance. So improved level of utility. The challenge in applying this technique is that those are required usually very strong technical expertise, especially expertise that you need to have internally of your organization. 124 00:31:03,391 --> 00:31:18,584 Finally, as you can guess, it's also possible to protect the model at serving time, so whenever you make it available to the public. So here, how does it work? It's again possible to use differential privacy, where here, instead of partially randomizing the 125 00:31:18,584 --> 00:31:33,063 training process, you will partially randomize the model's parameter such that it will limit the risk that this trained model will disclose the input data. One of the strengths to this kind of approach is that here you can apply the 126 00:31:33,063 --> 00:31:50,351 workflow exactly as you would have been applying without privacy confidentiality protection measures. So it simplify everything. And also this as the consequence that you can have a very fine control on the impact of this privacy protection on the performance of your model. 127 00:31:51,231 --> 00:32:06,298 The challenge is naturally always the same, because here you're still applying very advanced technique, namely differential privacy, for which you require internally very strong technical expertise. Secondly, in terms of challenges, 128 00:32:06,298 --> 00:32:22,154 applying differential privacy in this context is not accessible and possible for all kind of algorithms that exist. So only a restricted number of models is available. Now, with this workflow, I have described to you how privacy 129 00:32:22,154 --> 00:32:41,096 enhancing technology is an example of privacy technology can help protecting confidentiality throughout this process of training and serving a machine learning algorithm. Now, there's plenty of use cases where actually we would like to be able to use 130 00:32:41,096 --> 00:32:58,448 multiple sources of data between multiple data owners such that we can train a machine learning algorithm and an AI algorithm that on the mutual different sources. And so for that, also kind of privacy enhancing technology can be used, 131 00:32:58,448 --> 00:33:14,047 in particular federated learning where you train locally some model and then you can pull together those parameters such that you obtain in the end one federated model that relies on all the data sources and benefit from all the 132 00:33:14,047 --> 00:33:27,871 multiple sources while preserving confidentiality. But here, I'm not going to speak more about it now because I leave the floor to my colleague Ben, who's going to get into the detail of the federated learning approaches. 133 00:33:28,831 --> 00:33:44,913 Looking forward to the Q& A if you have any questions. Otherwise, I leave the floor to Ben. Thank you very much for your attention. Yeah, thank you, Rafael, for this explanation. And now we go to the next presentation, which is showing practical projects and 134 00:33:44,913 --> 00:33:48,351 practical examples. Yeah, Ben, feel free to start. 135 00:33:54,671 --> 00:34:11,795 Okay, thank you. Can you see my screen? Yes. Yeah, OK. Thanks, Rafael, and hello everyone. Thank you very much for this opportunity. I'm a lead privacy engineer at Statistics Canada, and I've been working on the Petland 136 00:34:11,795 --> 00:34:21,311 since 2021. And on behalf of the UN Petland, I would like to present some of Examples and projects on. that we work on. 137 00:34:24,591 --> 00:34:43,311 Okay, the first one will be on federated learning. So we had a federated learning work stream. This started on the high level group for modernization of official statistics from the UNICEF. And then, because all the team was on the Ped Lab, 138 00:34:43,791 --> 00:35:04,351 So, we, we naturally, we move these work stream to the to the human path lab. So, so what is federated learning? So, federated learning allows you to train models collaboratively while you're protecting the data that is locally stored in in several, I would say. 139 00:35:04,511 --> 00:35:19,861 nodes or workers that are shown here on the image. So, ferated learning, so you start like with local data, you train these local models, and then you can send it to a central authority that can aggregate those models. 140 00:35:19,861 --> 00:35:38,135 In this case, we are talking about model weights. And then this updated model is sent back to everyone. that they can continue the training. So you have some sort of continual learning during this process. Also, further learning is not orthogonal to 141 00:35:38,135 --> 00:35:53,806 other privacy and hazard technologies. As Rafael exposed a little bit about, explained a little bit about the differential privacy, and so we could use differential privacy during the training of those models locally. 142 00:35:53,806 --> 00:36:08,391 And then we can do the aggregation after. Also, we can use homomorphic encryption, which is a cryptographic technique that allows you to compute mathematical operations on encrypted data. So in this case, you can send 143 00:36:09,631 --> 00:36:17,871 encrypted models, we showed you in the next slides, you can send encrypted models and you can aggregate them. So. 144 00:36:20,031 --> 00:36:38,794 The first thing that we we we start exploring was cross-silo horizontal federated learning. So, in this case, multiple NSOs hold or held at different separate data sets, but they were like uniform in the in the 145 00:36:38,794 --> 00:36:56,111 schema. So, we have... every NSL have the same features. In this case, the data set was related to human activity, like walking, sitting, standing, or laying. And the application was to train an activity recognition model on this data. So 146 00:36:57,831 --> 00:37:11,999 What this allows us to train these local models, each and so will train the local model and then send it back to the aggregator. For the tech stack, we use Flower, which is a popular learning library, 147 00:37:11,999 --> 00:37:32,533 and Opacus, because we apply it after differential privacy to the training and homomorphic encryption to. due the secure aggregation of the models. So as an example here, I'm showing you how it looks like the case study repository for the UN Pet Labs. 148 00:37:32,533 --> 00:37:53,110 So this was the case number 15 for the UN Pet Guide. And if you can scan this QR code if you want to read more about it. In this image at the right, what I want to show you is like each and so they held a data set. We do some kind of local training and 149 00:37:53,110 --> 00:38:10,041 then we send encrypted models to the aggregator. So in this case, the aggregator, they don't own the private key. So it was a way to protect. the model so the aggregator blindly aggregate these models and then send it 150 00:38:10,041 --> 00:38:12,591 back to each of the NSO. Sorry. 151 00:38:14,551 --> 00:38:30,481 Then we went to the phase two. This is published here. You can scan the QR code if you want. And what we added to the project was to add noise during the training, right? So for that, we use differential privacy, 152 00:38:30,481 --> 00:38:46,480 which on a high level, you're just injecting noise during the training. And you have a parameter that is called the privacy budget or epsilon, and that the control that that can give you control on the amount of noise, 153 00:38:46,480 --> 00:39:07,802 so the higher the value epsilon you have, you have a better performance, but the lower epsilon you have, you you can achieve. higher privacy. So it's like a compromise to choose your epsilon to see how your task perform. The other thing that we wanted to study 154 00:39:07,802 --> 00:39:26,071 was the aggregation strategy. So there are different ways to add those models. So we tested. And, as you can see at the bottom, we we tested different strategies like Fed AVG, Fed AdaGrasse, Fed Adam, and Fed Yogi, 155 00:39:26,071 --> 00:39:42,470 and we compare with different values of epsilon. So, nothing new here. What we saw is like for the higher epsilon values. we match more or less the performance of the models when we're training without 156 00:39:42,470 --> 00:39:43,951 differential privacy. 157 00:39:46,591 --> 00:40:06,231 Then, now we are working on the on the phase three. This is in progress. So, one of the use cases here is cross-silo horizontal for farm management survey. So, the difference here is that we are considering that multiple... 158 00:40:06,671 --> 00:40:24,016 agencies or NSOs. They hold separate data sets with the same features, but this is related more on a national or regional survey. And the idea is to predict best management practices with a strong privacy guarantee. 159 00:40:24,016 --> 00:40:44,518 So we will try to train a model in a ferated way. And, and for the tech stack, we're using here Civ Box, which is an open source developed by OpenMind, integrated with Flower, and this will be deployed on the UN global platform, 160 00:40:44,518 --> 00:40:48,111 and it may be in a source infrastructure. 161 00:40:51,311 --> 00:41:07,417 And so, so the the flow of of this particular work stream is is is this, so we we start with the micro data, the farm management survey. This is from from a StatCan survey, and then we we are we are right now we 162 00:41:07,417 --> 00:41:21,316 are training a baseline model for predicting the the best management practices implementation level, and once we got this baseline, we will generate synthetic data and we we we generate this synthetic data with with 163 00:41:21,316 --> 00:41:40,663 privacy guarantees, so we we will we will train it with differential privacy. And the idea is for this synthetic data that we have here, we will try to tweak it to perform as good as the baseline when you don't use 164 00:41:40,663 --> 00:42:03,038 any any any privacy any differential privacy. So, We will do some privacy assessment to ensure that this synthetic data is safe to share. And once we do that, we will split this synthetic data to different NSOs or nodes that will be distributed on the UN global platform or 165 00:42:03,038 --> 00:42:23,990 maybe on-prem. And, at the end, we will use this synthetic data to to train the learning model. So, the thing here is, we are using AI, I mean, a generated model to help us to test the technology, but in a real world use case, we will jump directly from the from the 166 00:42:23,990 --> 00:42:27,311 micro data to define the learning phase. 167 00:42:30,991 --> 00:42:51,631 So another thing that we can do instead of splitting the data, which uniform or homogeneous features across the NSOs or the nodes, will be to split the data in terms of the features. So in this case, it could be like to have different departments, national departments, or 168 00:42:52,031 --> 00:43:11,231 or agencies that holds different features for the same subjects. Let's say for a particular farm, an agency has, let's say an NSO has some kind of demographics and another agency has more details about the management of the farm. So the idea will be to 169 00:43:11,551 --> 00:43:31,180 The data vertically, and then again repeat all the experiment to do the federated learning phase. So, for that, we are considering the same software stack, and I didn't say before, but we plan also to use Opacus because this is a differential privacy library 170 00:43:31,180 --> 00:43:35,791 that... That can allow you to inject the noise during the training. 171 00:43:38,991 --> 00:44:03,277 Finally, this is another study I think Dave mentioned. One of the papers I will give you, the link is here on the QR code. So what we did was a private linkage inside of an enclave. In this case, the enclave was provided by Oblivious. 172 00:44:03,277 --> 00:44:24,007 And we had two inputs, one from Statistics Canada and one from CBS. So this was mock data. This was not real data, but the idea is that each one of the NSO wants to protect their inputs. So we will do all the operations inside this secure enclave that protects the 173 00:44:24,007 --> 00:44:42,549 data from anyone that wants to look at it. So neither StatCan, neither CBS can look what's happening inside here, but they agree on some common base code to be run against the data. Right, so there was some linkage that was 174 00:44:42,549 --> 00:44:59,551 performed using the Python record linkage toolkit, some error estimation that was computed there, and then at the end you got like a link data set. So it was used for two different purposes. One was to do regression and the output. 175 00:44:59,631 --> 00:45:17,173 that we got from here is just the estimated coefficients. And the second one was to use, to generate synthetic data in a privacy way. So we generate the synthetic data and then we can, we get as an output a public data set 176 00:45:17,173 --> 00:45:39,158 that can be used. Um... So finally, I would like to, let me see if I can share this. I would like to share some links about the, about the UN Pet Lab, so how we can help. So we have, we collect these case studies as the ones 177 00:45:39,158 --> 00:45:59,254 I just presented. These are listed in a in a in a web page. Also, we publish the pet guide in 2023, but we are working on a new and a new and an updated UN pet guide, and... Also, the UN Global Platform is supporting us 178 00:45:59,254 --> 00:46:16,351 for the practical experimentation. As I said, we want to deploy these nodes on the UN Global Platform. And also, we have some events and technical presentations that are periodically given in the community. So feel free to look at those links. 179 00:46:16,511 --> 00:46:18,111 And, and thank you very much. 180 00:46:20,911 --> 00:46:29,631 Yeah, thank you, Benjamin, for this presentation. So yeah, now passing back to Yuxi for the Q&A. 181 00:46:33,191 --> 00:46:51,246 Yep, thank you so much, Matthias, and also thank you so much, Ben, for sharing these practical examples from Pat project, and I think this way is very useful to bring together the themes that we have discussed today, and now we will move to the Q& 182 00:46:51,246 --> 00:47:12,831 A session, and for... participant, please feel free to raise your hand to ask your question. And I just enable you guys to open your microphone and camera. So please, when asking your question, you may also indicate if this is directly to a specific speaker. 183 00:47:13,231 --> 00:47:22,751 or whether it is open to the panel. So, please. So, I see Amar, please go ahead, Taimur. 184 00:47:25,431 --> 00:47:38,979 Thank you, Yuxi, and thanks all. I'm Amr Nour. I'm the Chief of Detail Innovation and Capacity Branch, actually the organizer of this series. And I really don't have a specific question, but I do have first. I wanted to thank all of you for this 185 00:47:38,979 --> 00:47:50,946 wonderful presentation. I mean, really, really the series has been and the sequence has been great. All right, so thanks to all of you and it also shows the fantastic work that has been done within the UNCEBD. 186 00:47:50,946 --> 00:48:02,564 We've met probably with some of you there and I really, really want to put on record my appreciation and the appreciation of my branch for all the work and UNLD for all the work that you've been doing as part 187 00:48:02,564 --> 00:48:18,479 of the PEPs. task team in the UNCVD. Now, one of the things that came to my mind is obviously it all comes, I think there are two things, as Dave said at the beginning, it's kind of AI governance is or within 188 00:48:18,479 --> 00:48:34,907 the pets is part of the overall data governance. And I think really, that's important. And I think really, that's an important point that I would like to reemphasize again, because we do have a working group on data governance, all right, 189 00:48:34,907 --> 00:48:48,176 which is mandated by the UN Statistical Commission. And they are actually exploring all right, how AI can fit within the broader data governance ecosystem as well. So I think you are providing an insight 190 00:48:48,176 --> 00:49:03,034 and a valuable insight for this that I would like to put on record and will certainly tap into you as well as in as part of this project or the work of the working group on data governance to situate the AI governance within the 191 00:49:03,034 --> 00:49:19,871 broader ecosystem of the data governance. So thanks for that. The second thing is this balance ultimately between the utility of the data and the previous. All right. And I think Rafael has just made this point very, very nicely. All right. 192 00:49:19,871 --> 00:49:35,589 And I'm just wondering, as we move forward with the learning and the practical case uses, do we have better insights about this balance, all right, or how we can alter or improve this balance based on the nature of the data 193 00:49:35,589 --> 00:49:50,110 itself, the nature of the input data, the more, whether it's more sensitive or less sensitive and we can yield on the utility, for instance, Do we have any insights on that already in terms of measuring this balance 194 00:49:50,110 --> 00:50:00,591 somehow from the case usage that you had experienced? So I'll stop here and really, really thank you again. You've been a fantastic presentation. Thank you. 195 00:50:05,151 --> 00:50:22,031 Yeah, thank you, Amr, for these nice words. And of course, yeah, we are working already and we will continue working on the data governance with the data governance group. Probably your question, maybe Rafael can say a bit about the measuring the balance. 196 00:50:23,311 --> 00:50:42,215 Sure, with pleasure. So I can speak about our experience as the Swiss Federal Statistical Office. So we've been running some pilots with using differential privacy. So we really advocate the use of differential privacy because it enables us to have a transparent and mathematical 197 00:50:42,215 --> 00:51:02,320 quantification of this privacy utility trade-off. Now, the challenges are always the same when we're trying to balance is how much risk is enough and what is it okay or not. So we don't have a good answer to that. And it's potentially the most challenging 198 00:51:02,320 --> 00:51:18,545 to answer if we take the question in this direction. Actually, our solution was to reverse, because we usually think about balancing this trade-off by starting by the privacy and then going to utility. What we did, 199 00:51:18,545 --> 00:51:34,122 and we are not the first one, actually we got inspiration from the US Census Bureau, is to start from utility and then see what was the maximal protection we could offer. while preserving the utility. So for instance, 200 00:51:34,122 --> 00:51:50,511 instead of thinking about this is this production that I want to give, and this implies this utility, we discuss with researchers and ask, okay, what is it the question that you are trying to solve? This is the numbers that you need to generate. 201 00:51:50,911 --> 00:52:05,627 And this is the maximal noise that we can inject such that you can still draw a reliable conclusion for your research. So our solution for now is basically to apply this utility first principle such that we can ensure utility and offer the 202 00:52:05,627 --> 00:52:11,791 maximal protection in terms of privacy. Hope it helps in a way. Give insight on how we could help. Gods. 203 00:52:15,911 --> 00:52:16,511 Thank you. 204 00:52:19,471 --> 00:52:35,951 Okay, thank you so much, and uh... Anyone want to ask any further question regarding the presentation today and also the topic? And so far I don't see any question being posted in the chat box. 205 00:52:38,191 --> 00:52:42,271 I see the hand from Omar. Please go ahead, Omar. 206 00:52:53,071 --> 00:52:59,151 Omar, I'm not sure if you are speaking, but... From my side, I cannot hear you. 207 00:53:01,871 --> 00:53:02,191 Nope. 208 00:53:04,191 --> 00:53:14,271 It looks like your microphone is open, it's on, but... We couldn't hear you. Maybe, Omar, you can put it in the chat, the question, because we cannot hear you. Yeah. 209 00:53:16,635 --> 00:53:24,111 In the meantime, if somebody else wants to ask a question, I think that would be a good opportunity. 210 00:53:36,191 --> 00:53:36,751 And... 211 00:53:57,951 --> 00:54:18,703 Yeah, I can see. Maria, Maria F posted very interesting the work everyone is doing. Indeed, I feel like the work presented today is very interesting and I have also feeling that the presentation is also fruitful 212 00:54:18,703 --> 00:54:36,791 and I guess all the participants are more or less satisfied with the content. Yeah. So there's a last question, which is also a good sign for us. And, uh, I, ohh, uh, Omar, I see your hands up. Please go ahead. 213 00:54:36,791 --> 00:54:43,591 Yeah, well, I mean, I'm trying to really benefit the maximum from our presenters, honestly, here, and since I didn't want to come back Yeah. 214 00:54:46,251 --> 00:55:00,312 again, but since there is no other questions, I just want to ask, okay, you apply this pets for the NSOs. How do you go? Do you also... replicate them in other statistical systems at your own country, you know, 215 00:55:00,312 --> 00:55:14,111 like within the Ministry of Agriculture, within the Ministry of Trade, within etc. How do you go about that? I'm just thinking also about the capacity building component of this kind of pets at the national level as well. Thank you. 216 00:55:16,751 --> 00:55:31,988 Yeah, yeah, Ben, I thought you would be good to answer that, or at least begin. Yeah, thank you. Yeah, no, no, very interesting question. So in my opinion, given that data that is split across country, 217 00:55:31,988 --> 00:55:49,140 it won't be as uniform as having their own data for your own country. I believe that the potential in pets, it's more, at least at this point, is more collaboration between agencies, having data with the same for the same 218 00:55:49,140 --> 00:56:03,831 population, but for different features, kind of the last thing I was talking about, the vertical learning setting. So I believe that, I mean, what I'm trying to do is just to build these use cases and 219 00:56:04,111 --> 00:56:19,059 And show to to the agencies and show internally and externally to to you know to to get interest from people outside StatCan and and other organizations, so so they can see the potential, because if we can do this kind of if we 220 00:56:19,059 --> 00:56:32,007 can use these paths to you know to to get insights for this data that is. locked right now, we gain A lot. Even if we have some kind of agreements between agencies, but they sometimes they take a long time, 221 00:56:32,007 --> 00:56:48,589 you can do something something quicker, something faster using pets and they allow you to, you know, to do to do more. So at this point, we are still experimenting with the technology. but we are pretty sure that it will work. And just to going back to your first 222 00:56:48,589 --> 00:57:02,738 question also about the utility and privacy balance, also, I would say that is very case dependent. So the stronger and cleaner data that you have, you will have more, you know, a better quality outputs and you can 223 00:57:02,738 --> 00:57:08,031 apply, you know, privacy measures better. Thanks. 224 00:57:12,351 --> 00:57:29,821 Yeah, I know I felt. Yes, I can follow up on the question of Omar and then answer maybe Omar's one. So, for us, the main use case for which we leverage privacy enhancing technology is secondary use of data and especially for research. And so, 225 00:57:29,821 --> 00:57:46,234 this is a use case that is not only relevant for us as National Statistical Office, but for whatever office that might collect some data that is potentially sensitive or needs protection for confidentiality, and that can be used or could be relevant 226 00:57:46,234 --> 00:58:01,260 for researchers in Switzerland. So the way we try to disseminate these good practices is that we are a center for innovation for the federal administration. And so everything that we do, we do it such that we provide tools that 227 00:58:01,260 --> 00:58:15,711 can be used and reused by others. So we do everything. We do, we develop software that is open source, that is hopefully portable and deployable on standard infrastructures such that we facilitate their task. 228 00:58:15,751 --> 00:58:30,654 by for adopting this kind of technology outside National Statistical Office. And so for the question of Omar, who was actually wondering if we have applied this kind of technique for our national integrated data system, 229 00:58:30,654 --> 00:58:44,181 I would like to say yes, but actually, as I mentioned, we are an innovation center. So for now, we are We are using this technology to try to see if they are relevant, but we are slowly moving towards production, 230 00:58:44,181 --> 00:58:51,151 but we are not quite there yet, unfortunately. But hopefully next time we meet, I can say, yes, we have something in production. 231 00:58:53,551 --> 00:59:06,645 Thank you. Yeah, I would just like to add also perspective from the Netherlands before we conclude. So in the Netherlands, yeah, we have also a lot of collaboration, the National Collaboration on Pets. 232 00:59:06,645 --> 00:59:24,546 We also have the National Support Centre for Pets that is called Nick Pet. And one area that actually Rafael opened its secondary use of data. And in the Netherlands, what we see is there There are also a lot of kind of emerging use cases with the research on health 233 00:59:24,546 --> 00:59:40,209 data that often requires a combination of very sensitive health data, as well as statistical data that provides some sort of background information. And in Europe, there are also projects such as European 234 00:59:40,209 --> 00:59:56,131 data. health spaces, which also has secondary use of data for research purposes. And just to finish, also within the EU and Eurostat, European statistical system, there is a project that is currently just 235 00:59:56,131 --> 01:00:14,556 finished the feasibility study and proof of the concept of using pets in the context of European National Statistical System. So these are the links. And yeah, but things are changing and we will be updating the pet guide and we are also 236 01:00:14,556 --> 01:00:24,511 collecting new case studies as was mentioned. So yeah, if you keep checking our resources, we will be adding new examples. Thank you. 237 01:00:26,591 --> 01:00:51,087 Thank you so much, Ben, Rafael, and Matthias for your responses. And it also lead us to conclude this Global Network webinar on the AI, specifically for the paths of work. of the privacy enhancing technologies and the artificial intelligence. 238 01:00:51,087 --> 01:01:11,106 And I would say before we leave the meeting, I would like to encourage everyone to just open your microphone and turn on your camera to give a round of applause to our people. presenters today and to thank them for this great and fruitful presentation. 239 01:01:11,106 --> 01:01:17,471 And thank you so much. Thank you so much. Thank you. Thank you. Degrade. 240 01:01:22,431 --> 01:01:22,751 Yeah. 241 01:01:37,471 --> 01:01:38,351 Thank you all.