中央研究院 資訊科學研究所

Modern AI systems in healthcare, finance, and everyday services are trained on highly sensitive personal data, and this data is not always safe once training ends. Prior work has demonstrated that verbatim training text can be extracted from large language models, and that near-identical training images can be recovered from diffusion models. This talk introduces differential privacy (DP), the most widely adopted privacy framework in AI, by framing it as a hypothesis-testing game between a defender and an adversary seeking to infer whether a specific record was used in training. The presentation is intended for a general technical audience, and its concepts are illustrated with applications to clinical data. The talk then examines three stages of the machine learning pipeline at which DP can be enforced. At the training stage, it presents DP-SGD, privacy accounting, and implementation with Opacus, together with open challenges including tighter accounting and the disproportionate impact of DP on underrepresented cases. At the data stage, it discusses the generation of DP synthetic data through foundation model APIs without local training, via Private Evolution and its metadata-guided extension, MAPLE. At the inference stage, it analyzes privacy leakage through retrieval-augmented generation, in-context learning, and Best-of-N alignment, in which served responses can reveal the preferences encoded in a private reward model. The talk concludes with practical recommendations for deploying privacy-preserving AI in sensitive domains.

Eli Chien is an Assistant Professor at National Taiwan University (Electrical Engineering) with the Yushan Young Fellow. He was a visiting researcher at Google Research (hosted by Peter Kairouz) and a Postdoctoral Fellow at the Georgia Institute of Technology, working with Professor Pan Li. He obtained his Ph.D. from the University of Illinois, Urbana-Champaign, advised by Professor Olgica Milenkovic. His current research focuses on trustworthy AI, with special focus on privacy, machine unlearning, safety and AI copyright. His previous research was centered on designing better graph neural networks with theoretical guarantees. His work has been primarily published in top-tier machine learning, data mining, language model, and information theory venues, including ICML, NeurIPS, ICLR, Transactions on IT, KDD, TheWebConf, AISTATS, AAAI, ACL, COLM and more, along with multiple spotlights. He also regularly served as Area Chair and SPC for NeurIPS, ICLR and AAAI.