Privacy-Preserving AI
Privacy-preserving artificial intelligence is the field of techniques and systems that enable AI applications to process and learn from data while preserving privacy and confidentiality.[^c1] The field is built on a small set of pillar technologies: federated learning, which trains models across devices or servers without exchanging raw data; differential privacy, which adds carefully calibrated noise to prevent the identification of individuals while preserving overall patterns; homomorphic encryption, which permits computation on encrypted data without decryption; and secure multi-party computation, which enables multiple parties to jointly compute a function over inputs while keeping those inputs private.[^c2] These techniques are increasingly combined with hardware-based trusted execution environments and hybrid architectures that span on-device and cloud computation. Zero-knowledge proofs are increasingly paired with these techniques so that privacy guarantees can be verified even in outsourced computation.[^c22]
Privacy-preserving AI emerged in response to the massive data-collection demands of deep learning and to tightening privacy regulation. Apple implemented differential privacy in 2016 for user data collection, Google introduced federated learning in 2017, and the field gained momentum following major data scandals and the implementation of the GDPR in 2018, which catalyzed investment in privacy-preserving technologies.[^c3] Research and industry practice in the field divide broadly between data-centered approaches, such as differential privacy, and model-centered approaches that secure models themselves from attack.[^c6]
The techniques have moved from theory into production. Google has deployed a production machine learning model using federated learning with a rigorous differential privacy guarantee,[^c4] and Apple extended the security and privacy of its devices into the cloud with Private Cloud Compute.[^c5] The 2020 US Census deployed differential privacy at national scale, running its redistricting data under a global privacy-loss budget of ε = 19.61.[^c12] Applications span healthcare, financial services, government statistics, and on-device intelligence. In the large-language-model era, confidential cloud inference services shield user requests inside trusted execution environments,[^c9] and empirical benchmarks show that smaller open-weight models, the class most often run on-device, leak protected attributes far more readily than frontier models when probed adversarially.[^c8] As large language models are increasingly deployed as personal agents handling sensitive workflows, privacy research has also begun to treat Contextual Integrity — governing information flows according to the norms of a given context — as a design target for disclosure decisions.[^c23] In 2026 Apple expanded Private Cloud Compute beyond its own data centers to Google Cloud infrastructure running on Nvidia GPUs, Intel CPUs, and Google Titan chips.[^c17]
The regulatory and measurement landscape has continued to evolve. The EU AI Act's obligations for general-purpose AI models took effect in August 2025,[^c11] and following the 2026 Digital Omnibus agreement, high-risk AI obligations under the Act were deferred to 2027 and 2028.[^c14] The European Commission launched its first systemic-risk probes in January 2026,[^c20] issuing data-retention orders to X and opening ecosystem investigations into Meta,[^c19] before it gained formal enforcement powers over general-purpose AI providers in August 2026.[^c18] The transparency framework of the Act was elaborated through draft Commission guidance and a voluntary Code of Practice on transparency of AI-generated content, which moved from principle-based transparency to specific technical requirements such as multi-layered watermarking, metadata standards, and user-facing icons, ahead of the Article 50 obligations becoming applicable in August 2026.[^c24][^c25] In the United States, 2026 proposals moved toward federal AI and privacy legislation centered on preemption of state laws.[^c10] Measurement guidance matured with NIST's Guidelines for Evaluating Differential Privacy Guarantees, which helps practitioners evaluate the promises made and not made when deploying differential privacy,[^c13] while provenance systems such as OpenAI's 2026 rollout of invisible image watermarking responded to binding transparency deadlines.[^c15] The field continues to face persistent challenges, including the trade-off between model utility and privacy strength, the computational cost of encrypted computation, re-identification risks in large language models, side-channel leaks from encrypted inference traffic,[^c21] gaps between legal requirements and technical capabilities,[^c7] and the critique of "privacy washing," in which privacy-enhancing technologies are deployed as a facade while entrenching surveillance.[^c16]