fairness
Train on the phones, keep the secrets
It is 2017, and a keyboard app wants to learn from what a billion people type — the most sensitive text stream in existence — while promising the messages never leave the phone. The proposal: ship the model to the data, train locally, and aggregate only parameter updates on the server. The promise is subtler than it sounds, because gradients are not anonymous — a single user's updates can leak their text nearly verbatim to a curious server. Engineer the full system: secure aggregation so no individual update is seen, differential privacy on the aggregate so no user's data is inferable, and honest accounting of accuracy cost and the dropout reality of phones. Get it wrong and "your data stays on device" becomes the decade's most effective privacy theater.
Who this problem belongs to
The two figures whose methods fit it best, out of 31 in contention.
The federated-learning proposal in this scenario is exactly the situation Dwork's differential privacy (2006, with McSherry, Nissim, and Smith) was built to handle: a system that must reveal an aggregate statistic, here a model update, without revealing what any individual contributed to it. Her framework supplies precisely the missing rigor the keyboard app's engineers need — a formal privacy-loss budget added to the aggregated gradients, with composition theorems accounting for how repeated training rounds erode the guarantee over time, rather than trusting the intuitive but false claim that keeping raw data on-device is sufficient. She would immediately recognize that secure aggregation alone hides individual updates from the server but says nothing about what the aggregate itself leaks, and insist on differential privacy layered on top, exactly the architecture later systems in fact adopted.
Song's research on adversarial machine learning is the direct intellectual ancestor of the gradient-leakage concern this problem centers: her work on membership inference and, later, training-data extraction rigorously demonstrates that model updates and outputs are not the anonymous abstractions engineers wish they were, but can be inverted to recover near-verbatim fragments of the data that produced them. She would bring exactly the adversarial-audit mindset the keyboard-app scenario requires — assume a curious or malicious server, and test empirically whether a specific update or aggregate leaks a specific user's text before deploying the system, rather than accepting a vendor's privacy claim on faith. Her Berkeley security lab's broader agenda of stress-testing deployed ML systems maps closely onto this exact federated-learning threat model.
In the mind map
The same ideas, as concepts rather than history — in John's ML knowledge map.
31 figures are scored on this problem. Draw it in a battle to see where you land.