>> In this special build edition of the AI Show.
Join us as we hear from Sarah Bird,
Principal Program Manager on the ML platform team,
and Robin [inaudible] , distinguished engineer with
Microsoft core operating systems and Intelligent Edge team.
Sarah will discuss differential privacy in practice with Rob,
one of the major co-developers of
the White Noise platform. Make sure you tune in.
[MUSIC]
>> I'm here at build Robin [inaudible] who's one of the leaders of
the team that pioneered
the implementations of differential privacy inside of Microsoft,
and has been one of
the major contributors to the White Noise platform.
Hey Rob, can you tell us a little bit about yourself?
>> Thanks, Sarah. Sure. I lead
the central data engineering and data science teams for
the core operating systems
and Intelligent Edge group at Microsoft.
So our team focuses on using
diagnostic and other types of data signals,
to provide insights on the quality and
experiences of devices running Windows.
We build analytics, we train models,
and we deploy predictive systems to improve
the quality of all of those experiences.
>> Sounds like an awesome team.
How did you get started with differential privacy?
>> So Windows runs on
more than a billion devices in people's homes,
in their businesses, and in data science and more.
For many people, much of
their daily lives are experienced through their PCs.
So these are very personal devices,
and their privacy matters and this is true now, more than ever.
Trust is always been part of a core of what we do in Microsoft.
One of the strengths of Windows is support
for a highly diverse hardware, software,
and peripherals ecosystem with
literally hundreds of millions of
combinations and configurations out there.
So managing a complex ecosystem like Windows, that's challenging.
Our users can choose to send data to help us
keep system security up-to-date, which is great.
Although we only collect the data for the purposes
of keeping those devices up-to-date and secure,
we recognize that data could be misused,
and this is where differential privacy comes in.
It's just one of a wide range of
measures that we employ to protect customers data.
On the front line, we have policy
and security controls, encryption,
data expiry, delete processors,
auditing, and other controls.
We see differential privacy as a defense in depth tight measure,
that can help protect customers from risks
introduced downstream through different processing,
reporting, dashboarding, machine learning models, etc.
>> So you mentioned that
differential privacy can protect the downstream data products.
Can you give an example of what you mean by that?
>> Yeah, sure. So one of the common things we
do with data is dashboards and reporting.
Dashboards help the leaders and the organization
keep track of key roll-up metrics,
things like counts, sums, averages, descriptive statistics.
We usually aggregate the data into large partitions.
So any individual's data isn't revealed,
but there are various re-identification and reconstruction attacks
in the literature that can operate on exact aggregates like this.
So using differential privacy
takes the guesswork out of that protection for us.
We can add a small amount of noise that has
negligible impact on the overall accuracy,
and we get protection from a lot of these attacks.
Similarly, we use machine learning to
build all kinds of predictive models,
and these have similar privacy challenges.
Machine learning models have a lot of free types of
parameters that can sometimes be used to memorize private data,
like metadata fingerprints from the data.
So people sometimes don't
realize this because machine learning models are opaque.
But differential privacy has this nice property that
the privacy is preserved in post-processing.
So we can pre-process features in
the model to be differentially private,
and then we can use our models
so that they're not memorized in that private data.
>> That's amazing. So differential privacy
was pretty earliest age research tech,
and not a lot of people are using it in practice.
How did your team get started in developing it?
>> So we've been using these technologies
for a little more than five years now.
We're fortunate, in that
the differential privacy research was developed
out of Microsoft research
along with some other privacy technologies.
Our first deployments of
differential privacy came in the earliest planning for Windows 10.
We anticipated there would be a need for
strong defense in depth for customer privacy.
We work closely with Microsoft research
and deployed a local model of
differential privacy as part of
the Windows telemetry platform in Windows 10.
>> In your opinion, is this technology
something that normal companies can use,
or are you going to need to have your own MSR on staff?
How many privacy researchers does it take for pre-deployment?
>> That's good question.
We've learned a lot since the first deployments for sure,
and many teams within Microsoft are
now using differential privacy.
As well as other big tech companies are using it.
So the technology itself has become more mature.
We're starting to see tools from
Microsoft and other companies that make it
easier to use and implement differential privacy in your systems.
For companies that collect data about individuals,
it makes sense to check out differential privacy.
At the same time,
differential privacy is just one piece of the puzzle.
There's no silver bullet when it comes to privacy.
Things we think of as stable state measures,
strong user consent, encryption, data minimization.
They're just as important,
if not more so than defense in
depth measures like differential privacy.
>> So it sounds like tools are going to be key to making
this technology more widely usable by more people,
what tools do you use?
Are using publicly available tools or in-house tools?
>> So we use a mix of internal and public tools.
Microsoft, as I said,
is a platform company,
and we use our own platforms, of course.
Initially, our differential privacy code was custom,
one-off written in a variety of
languages in different parts of our product.
But differential privacy, it benefits from transparency.
As technology and scenarios have matured,
we wanted to shift to something that is more open-source.
Everyone benefits from being able to evaluate
the algorithms in the open,
making sure there aren't any bugs.
We want to save other organizations and companies
some time if they're trying to implement differential privacy.
So we've been able to replace some of
our custom code with the White Noise core,
and we plan to keep contributing in deploying
this from the open-source code base.
>> That's so cool. Thanks for sharing.
It's amazing to see Windows doing such cool open-source work.
What does the future look like?
Where do you see this technology going?
>> Well, looking ahead I think we expect
privacy preserving technologies are
going to be more important than ever,
as the stakes for individuals data,
and the associated risks around that data continue to go up.
We're already seeing increased adoption of
differential privacy and other methods
across Microsoft and across the industry.
But there's room for improvement,
ease of application, and integration into our tools especially.
Like I said, Microsoft is a platform company and our hope is to
build these capabilities into more
of our software and data platforms.
So our customers who build solutions for others can also
benefit and can better protect their customers privacy as well.
I'm really proud of the progress we've made so far and
excited to be part of this journey with all of our partners,
inside and outside Microsoft. Thanks, Sarah.
[MUSIC]