Don't share model weights trained on private data.

[Benjamin-Lee]

Adversarial learning (not to be confused with generative adversarial networks) is a growing threat. One particular issue is model inversion, which allows the extraction of sensitive data, either with or without access to the weights.

To be safe, unless you know what you are doing, it's probably best not to share weights that have been trained on sensitive data.

[cgreene]

Absolutely worth talking about, particularly in this domain. We can also discuss some techniques, like adding differential privacy during training, that might help mitigate some risks.

[Benjamin-Lee]

@zhampel, @MaAleBarr, @ninalopatina, @ltindall, @mlomnitz, @paulgowdy and the rest of the Cyphercat crew, I'd love to hear your feedback on this rule.

[evancofer]

@brettbj may have some good feedback here as well

This rule is clearly important (hence its inclusion via #61 ). I think it may ease adoption if we also add some actionable advice (e.g. commonly used software libraries, industry standards) in addition to a general precaution.

[AlexanderTitus]

I think model security should highlight at a minimum:

• Cautions
• Differential privacy similar to the work by @brettbj
• Homomorphic encryption - big area of interest in the commercial space - major up-and-coming start-up

These are both big areas in security and are both gaining traction in the deep learning space. The challenge with obscuring information, however, is a trade-off between training time and privacy/security. We will continue to see these models get better and faster, and this is definitely an important section.

[rasbt]

Another relevant one (although not bio-specific):

• A generic framework for privacy preserving deep learning, https://arxiv.org/abs/1811.04017

[fmaguire]

Seems covered in tip 10 now https://github.com/Benjamin-Lee/deep-rules/blob/master/content/12.privacy.md