Can Foundation Models Help Us Achieve Perfect Secrecy?
A key promise of machine learning is the ability to assist users with
personal tasks. Because the personal context required to make accurate
predictions is often sensitive, we require systems that protect privacy. A gold
standard privacy-preserving system will satisfy perfect secrecy, meaning that
interactions with the system provably reveal no additional private information
to adversaries. This guarantee should hold even as we perform multiple personal
tasks over the same underlying data. However, privacy and quality appear to be
in tension in existing systems for personal tasks. Neural models typically
require lots of training to perform well, while individual users typically hold
a limited scale of data, so the systems propose to learn from the aggregate
data of multiple users. This violates perfect secrecy and instead, in the last
few years, academics have defended these solutions using statistical notions of
privacy -- i.e., the probability of learning private information about a user
should be reasonably low. Given the vulnerabilities of these solutions, we
explore whether the strong perfect secrecy guarantee can be achieved using
recent zero-to-few sample adaptation techniques enabled by foundation models.
In response, we propose FOCUS, a framework for personal tasks. Evaluating on
popular privacy benchmarks, we find the approach, satisfying perfect secrecy,
competes with strong collaborative learning baselines on 6 of 7 tasks. We
empirically analyze the proposal, highlighting the opportunities and
limitations across task types, and model inductive biases and sizes.