Privacy-Enhancing Technologies for AI

1. Why Privacy-Enhancing Technologies (PETs) Matter for AI

Artificial intelligence systems are uniquely data-hungry. Training a model often requires vast quantities of personal, sensitive, or proprietary information, and the resulting model can memorize and later leak that information through its outputs. Traditional security controls (access control, encryption at rest and in transit) protect data while it is stored or moved, but AI introduces new exposure points: data must be decrypted and aggregated to train on it, models can be queried by untrusted parties, and model parameters themselves can encode personal data.

Privacy-Enhancing Technologies address this gap. They allow organizations to extract value from data while reducing the ability of anyone, including the AI system itself, to identify, re-identify, or infer information about specific individuals. For an AI security manager, PETs are the practical bridge between two obligations that often appear to conflict: regulatory compliance (GDPR, CCPA/CPRA, HIPAA, the EU AI Act, sector rules) and business value from analytics and machine learning.

In the ISACA AAISM body of knowledge, PETs sit within the AI Technologies and Controls domain. The exam expects you to understand them as controls that mitigate specific AI privacy risks, selected through a risk-based process, and governed through policy, roles, and monitoring rather than as isolated pieces of mathematics.

2. What PETs Are: Definition and Scope

A Privacy-Enhancing Technology is any technical method that minimizes personal data use, maximizes data security, and empowers individuals, while still permitting a legitimate processing purpose. In AI contexts, PETs are applied across the lifecycle:

- Data collection and preparation: minimization, anonymization, pseudonymization, synthetic data generation.
- Model training: federated learning, differential privacy in training (DP-SGD), secure multi-party computation, trusted execution environments.
- Model deployment and inference: differentially private query responses, homomorphic encryption for encrypted inference, output filtering, confidential computing.
- Model sharing and collaboration: secure enclaves, split learning, zero-knowledge proofs for verifying properties without revealing data.

Key AI-specific privacy threats PETs are designed to counter include:
- Membership inference attacks (determining whether a particular record was in the training set).
- Model inversion attacks (reconstructing training inputs from model outputs or parameters).
- Attribute inference (deducing sensitive attributes not directly disclosed).
- Training data extraction (prompting a generative model to regurgitate memorized text or images).
- Re-identification of supposedly anonymized datasets through linkage with other data.

3. How the Major PETs Work

3.1 Data Minimization, Anonymization and Pseudonymization
These are foundational, non-cryptographic PETs.
- Minimization means collecting and retaining only the attributes needed for the model purpose. It is the first control to consider and is required by most privacy laws.
- Pseudonymization replaces direct identifiers with tokens or keys. The data remains personal data under GDPR because re-identification is possible with the key, so it reduces risk but does not remove regulatory obligations.
- Anonymization aims to irreversibly prevent identification. Techniques include generalization, suppression, and formal models such as k-anonymity (each record is indistinguishable from at least k-1 others), l-diversity (sensitive attributes within each group are diverse), and t-closeness (the distribution of a sensitive attribute in a group is close to the overall distribution). Exam point: naive anonymization is vulnerable to linkage attacks, so truly anonymized data must be assessed against realistic adversary knowledge.

3.2 Differential Privacy (DP)
Differential privacy is a mathematical guarantee rather than a single algorithm. A process is differentially private if the inclusion or exclusion of any single individual's record changes the probability of any output by at most a factor controlled by the privacy budget, epsilon (and a small failure probability, delta). It works by adding calibrated statistical noise to query results, gradients, or model outputs.
- Lower epsilon = stronger privacy, more noise, lower accuracy.
- Higher epsilon = weaker privacy, less noise, higher utility.
- DP-SGD (differentially private stochastic gradient descent) clips per-example gradients and adds noise during training so the model does not memorize individuals.
- Local DP adds noise on the user's device before data leaves it (no trusted curator needed). Central/global DP adds noise at a trusted aggregator and generally offers better utility for the same privacy level.
- Budgets are cumulative: repeated queries consume the budget, so budget tracking and query limits are governance requirements.
Exam framing: DP is the strongest defense against membership inference and is the PET with a provable, quantifiable guarantee.

3.3 Federated Learning (FL)
Federated learning trains a shared model across multiple parties or devices without centralizing raw data. Each participant trains locally and sends only model updates (gradients or weights) to a coordinator, which aggregates them. Variants include cross-device FL (millions of phones) and cross-silo FL (a few organizations such as hospitals or banks).
Important nuance for the exam: FL alone is not sufficient for privacy. Model updates can leak training data through gradient inversion attacks. Robust deployments combine FL with secure aggregation (a form of secure multi-party computation so the server sees only the sum of updates) and/or differential privacy applied to updates. FL also introduces new risks: model poisoning by malicious participants and uneven data quality.

3.4 Homomorphic Encryption (HE)
Homomorphic encryption allows computation directly on ciphertext; the decrypted result equals the result of performing the same operation on plaintext. Partially HE supports one operation type, somewhat HE supports limited depth, and fully HE (FHE) supports arbitrary computation. In AI, HE enables encrypted inference (a client sends an encrypted input, the provider runs the model, and returns an encrypted prediction it cannot read) and, to a lesser degree, encrypted training. The main limitation is significant computational overhead and latency, so it is used selectively for high-sensitivity, low-volume operations.

3.5 Secure Multi-Party Computation (SMPC / MPC)
SMPC allows several parties to jointly compute a function over their private inputs so that no party learns anything beyond the output. Techniques include secret sharing and garbled circuits. In AI it supports joint model training or inference between organizations that cannot share data (for example, fraud detection across competing banks). Compared with HE, SMPC trades heavy computation for heavy communication between parties and requires that a threshold of parties remain honest.

3.6 Trusted Execution Environments (TEEs) / Confidential Computing
A TEE is a hardware-isolated secure enclave (for example Intel SGX, AMD SEV, ARM TrustZone, confidential VMs in cloud) in which code and data are protected from the host operating system, hypervisor, and cloud operator. Remote attestation lets a data owner verify that the expected code is running before releasing data to the enclave. TEEs protect data in use with near-native performance, making them practical for training and inference on sensitive data in the cloud. Weaknesses include side-channel attacks, reliance on hardware vendor trust, and limited enclave memory. Exam point: TEEs provide confidentiality during processing but do not by themselves prevent a model from memorizing data; pair with DP for output privacy.

3.7 Synthetic Data
Synthetic data is artificially generated data that preserves the statistical properties of a real dataset without containing real individuals' records. It is generated using statistical models, GANs, diffusion models, or large language models. Benefits include safer sharing with vendors, testing, and augmentation for rare classes. Risks: a generator trained on real data can leak or memorize real records, especially outliers, so synthetic data should ideally be generated with differential privacy and validated with privacy metrics (distance to closest record, membership inference testing). Synthetic data may also introduce bias or fail to represent edge cases, so it should not be assumed to be automatically anonymous.

3.8 Zero-Knowledge Proofs (ZKPs)
ZKPs allow one party to prove a statement is true (for example, that a model was trained on licensed data, or that a user is over 18) without revealing the underlying data. In AI governance they are emerging for verifiable model provenance and compliance attestations. They are less common on current exams but may appear as a distractor or an emerging-technology option.

3.9 Supporting Controls Often Grouped with PETs
- Output filtering and rate limiting to limit extraction attacks.
- Machine unlearning to honor erasure requests after training.
- Privacy-preserving record linkage (hashing/Bloom filters) for joining datasets.
- Data clean rooms combining access control, aggregation thresholds, and sometimes DP.

4. Selecting and Governing PETs: The Management View

The AAISM exam is a management certification. Expect questions to reward the candidate who selects controls based on risk, purpose, and proportionality rather than the most technically sophisticated option. A defensible selection process:

1. Identify the processing purpose and legal basis. Determine whether personal data is needed at all (minimization first).
2. Threat model the AI system. Who are the adversaries: external users querying the model, insiders, cloud providers, collaborating organizations?
3. Map threats to PETs. Untrusted cloud provider points to TEEs or HE; collaborating organizations point to FL plus secure aggregation or SMPC; public-facing model outputs point to DP and output controls; vendor testing points to synthetic data.
4. Evaluate the privacy-utility-cost trade-off. Every PET costs accuracy, performance, or money. Document the accepted trade-off and the residual risk.
5. Layer controls (defense in depth). PETs complement, not replace, access control, encryption, logging, and governance.
6. Validate effectiveness. Run membership inference and inversion tests, measure epsilon consumption, perform re-identification risk assessments on anonymized or synthetic data.
7. Document in the DPIA / AI impact assessment and align with frameworks: NIST AI RMF, ISO/IEC 42001, ISO/IEC 27701, NIST Privacy Framework, and privacy-by-design principles.
8. Monitor and review. Privacy budgets deplete, attacks evolve, and data drifts.

5. Comparison Summary

- Differential Privacy: protects outputs and training against inference; provable guarantee; costs accuracy; requires budget management.
- Federated Learning: keeps raw data local; not privacy-sufficient alone; combine with secure aggregation and DP; new poisoning risks.
- Homomorphic Encryption: compute on encrypted data; strongest confidentiality from processor; very high computational cost.
- SMPC: joint computation across parties without sharing inputs; high communication cost; honesty threshold assumptions.
- TEEs: protect data in use with hardware isolation and attestation; good performance; hardware trust and side-channel concerns.
- Synthetic Data: enables sharing and testing; may leak if generator memorizes; validate and ideally generate with DP.
- Anonymization/Pseudonymization: simple and widely required; pseudonymized data is still personal data; anonymization vulnerable to linkage if done naively.

6. Exam Tips: Answering Questions on Privacy-Enhancing Technologies for AI

Tip 1: Match the PET to where the data is exposed. Ask yourself: is the risk at collection, during training, in the model parameters, at inference, or during sharing? Data in use on untrusted infrastructure points to TEEs or HE. Data that cannot leave its owner points to federated learning or SMPC. Leakage through model outputs points to differential privacy.

Tip 2: Know the signature phrases. Mathematical or provable guarantee, noise, epsilon, privacy budget = differential privacy. Compute on encrypted data without decrypting = homomorphic encryption. Model updates sent instead of raw data = federated learning. Multiple organizations jointly compute, none sees others' inputs = SMPC. Hardware enclave, attestation, protects data in use = TEE/confidential computing. Artificially generated but statistically similar = synthetic data. Prove a fact without revealing data = zero-knowledge proof.

Tip 3: Remember that federated learning alone is not private. A classic exam trap presents FL as a complete privacy solution. The best answer usually adds secure aggregation or differential privacy to address gradient leakage.

Tip 4: Pseudonymized is still personal data; anonymized should be irreversible. If a question asks which technique removes data from the scope of privacy regulation, pseudonymization is the wrong answer. If a question highlights re-identification via linkage with public datasets, the control that failed is anonymization rigor, and the remedy involves formal models (k-anonymity and beyond) or differential privacy.

Tip 5: Synthetic data is not automatically safe. Expect a scenario where a team shares synthetic data with a vendor and leakage occurs. The lesson: generators can memorize; apply DP and run privacy validation tests before release.

Tip 6: Think like a manager, not an engineer. When options include both a technical fix and a governance action, the exam often prefers the answer that starts with risk assessment, defines purpose and requirements, or documents trade-offs, especially when the question asks for the first or best step. However, when the question asks which technology or control addresses a specific attack, choose the precise technical PET.

Tip 7: Watch the qualifiers. Words such as most effective, most cost-effective, strongest guarantee, least performance impact, and primary change the correct answer. HE offers strong confidentiality but is rarely most cost-effective. TEEs offer good performance but rely on hardware trust. DP offers the strongest provable guarantee against inference.

Tip 8: Understand the privacy-utility trade-off. Questions may describe model accuracy dropping after a privacy control is applied. Recognize this as expected behavior of differential privacy (noise) or anonymization (generalization), and the appropriate response is to tune the privacy budget based on risk appetite and document the decision, not to remove the control.

Tip 9: Privacy budgets are finite and cumulative. If a scenario involves repeated queries to a differentially private system, the risk is budget exhaustion; the control is budget tracking, query auditing, and limits.

Tip 10: Connect PETs to attacks. Membership inference and model inversion point to differential privacy and output controls. Training data extraction from generative models points to DP training, deduplication, and output filtering. Untrusted cloud operator points to confidential computing or HE. Gradient leakage in FL points to secure aggregation.

Tip 11: Layer, do not substitute. Any answer implying a single PET eliminates the need for access control, encryption, logging, consent management, or impact assessments is almost always wrong. The exam rewards defense in depth and privacy by design.

Tip 12: Eliminate distractors systematically. Remove options that address the wrong lifecycle stage, options that protect data at rest or in transit when the question is about data in use or model outputs, and options that are purely administrative when a technical PET is requested (or vice versa).

7. Quick Self-Check Scenarios

- Several hospitals want to train a diagnostic model but cannot share patient records. Best fit: federated learning with secure aggregation and differential privacy, or SMPC for smaller, high-sensitivity computations.
- A public chatbot was shown to reproduce a customer's address verbatim. Issue: training data memorization/extraction. Controls: DP training, data deduplication and minimization, output filtering, and testing.
- A company wants a cloud provider to run inference on confidential financial data without the provider seeing it, with acceptable latency. Best fit: TEE/confidential computing (HE if latency is not a constraint and confidentiality requirements are extreme).
- A data science team wants realistic data for a vendor proof of concept. Best fit: differentially private synthetic data, validated for leakage, under contract controls.
- Analysts repeatedly query a statistics API on employee data. Risk: privacy budget depletion and reconstruction. Control: DP with budget enforcement and query auditing.

8. Key Takeaways

PETs allow AI to use sensitive data responsibly by protecting data at the points traditional security leaves exposed: during processing, inside model parameters, and in model outputs. Each PET addresses a specific threat and carries a specific cost. The AAISM exam tests your ability to recognize the techniques, map them to AI-specific privacy risks, understand their limitations and combinations, and embed them in a risk-based, documented governance program. Master the signature phrases, remember the common traps (FL alone, pseudonymization as anonymization, synthetic data as automatically safe), and always consider the privacy-utility-cost balance when choosing the best answer.