Privacy-Enhancing Technologies Learning Path

About this knowledge base

“Privacy computing” is not one algorithm. It is a family of methods that reduce privacy risk in collection, sharing, training, inference, and publication. The first controls are usually to not collect, collect less, limit purpose, shorten retention, and control output. Differential privacy, federated learning, secure aggregation, MPC, homomorphic encryption, and TEEs provide specific guarantees only under explicit threat models, parameters, and implementations.

The course path is: minimization and de-identification → differential privacy → distributed training and aggregation → cryptography and trusted hardware → selection and composition → evaluation and response → offline solution review. The goal is not to memorize acronyms, but to state clearly: “who is protected, which information, against which adversary, under which assumptions, and what can still leak?”

Where this course fits in the overall route

This course belongs to the Safety and Governance knowledge domain. It is a recommended specialization on all four role tracks after the full AI Safety course. Relevant knowledge from probability and statistics, machine learning, and data cleaning helps explain methods and evaluation, but none of those full courses is a hard prerequisite. Practice privacy minimization, purpose limitation, and retention during the early safety milestone; this course then goes deeper into differential privacy, federated learning, MPC, homomorphic encryption, and TEEs, together with Evaluation Framework, Runtime Monitoring, and AI Governance.

Learning objectives

• Demonstrate field-by-field necessity from purpose and data subjects, covering models, embeddings, logs, caches, and backups.
• Explain the differences among de-identification, pseudonymization, anonymity, quasi-identifiers, and linkage attacks.
• Use minimal formulas to explain DP adjacency, contribution, sensitivity, ε/δ, mechanisms, and composition budgets.
• Distinguish FL, contribution clipping, secure aggregation, robust aggregation, and privacy of the final model.
• Compare MPC, HE/FHE, and TEEs by parties, collusion, keys, integrity, output, and performance.
• Derive candidate PETs from a privacy goal, and record guarantee, unprotected scope, evidence, rollback, and responsibility.
• Design end-to-end evaluation, budget/access/deletion monitoring, and leak response.
• Run a strict offline solution-review project that does not process personal data.

Prerequisites

• Probability and random variables, machine-learning training and evaluation, and basic identity, cryptography, and networking concepts.
• You need not prove cryptographic protocols, but must respect their adversaries, collusion, keys, parameters, and implementation assumptions.
• The legal meaning of personal information, lawful basis, cross-border processing, rights, and notification duties must be determined by appropriate professional responsibilities in the applicable jurisdiction.

Recommended order

01 Foundations and risks

1. Data minimization and de-identification — first reduce data and lifecycle attack surface.
2. Differential privacy intuition and budget — quantify one subject’s influence on randomized releases.
3. Federated learning and secure aggregation — distinguish local training, update visibility, and final-model leakage.

02 Controls and governance

4. MPC, homomorphic encryption, and TEEs — compare protocol, keys, hardware, and output boundaries.
5. PET selection and composition boundaries — derive candidates from goals and redraw guarantees after composition.
6. Privacy evaluation and leak response — validate implementation, monitor operation, and handle incidents safely.

03 Project and self-assessment

7. Project: Offline Privacy Solution Review — review a synthetic-metadata scenario with a strict contract, twelve rules, and seventy-six tests.

Suggested study rhythm

On the first pass, complete the threat model and exercise for each lesson. On the second, choose a real system but record only field names, categories, and data-flow metadata—not personal data—and work through the full path. On the third, turn guarantee claims into tests, runtime events, and responsibility gates. Have experts review current implementations and parameters before using complex cryptographic schemes in production.

Project entry point

Start with Offline Privacy Solution Review. The project supplies vulnerable, hardened, and contract-error paths. It strictly rejects duplicate keys, unknown fields, invalid references, and non-finite parameters; it explicitly identifies teaching thresholds, basic budget composition, and the evidence boundary of PASS.

Mastery checklist

• Can give a clear purpose and alternative for every field, output, recipient, and retention period.
• Can explain why removing names, encryption, pseudonymization, synthetic data, and “data does not leave the boundary” do not each equal anonymity.
• Can define DP subject, adjacency, and contribution, and maintain a cross-release budget without inventing one universal compliant ε.
• Can state server, client, collusion, dropout, multi-round, and final-model boundaries for FL and secure aggregation.
• Can state input/output, keys/proofs, integrity, performance, and side-channel assumptions for MPC, FHE, and TEEs.
• Can compare the simplest baseline with a complex PET, recording versions, parameters, tests, residual risk, and exit plan.
• Can monitor budget, access, output, proofs, and deletion without copying personal data.
• Can explain why the offline project is not a DP or cryptographic implementation, production assessment, compliance conclusion, or legal conclusion.

Relationship to other knowledge bases

• AI Safety protects identities, permissions, supply chain, and infrastructure; PETs cannot fix a stolen administrator credential.
• Output from Data Synthesis still needs membership, duplication, and linkage assessment; it is not automatically free of personal information.
• AI Governance determines purpose approval, responsibility, vendors, risk acceptance, and retirement. This course supplies technical evidence and boundaries.
• Evaluation Framework makes privacy, utility, fairness, and runtime cost comparable version gates.

Primary references and current status

• NIST Privacy Framework and the Privacy Framework 1.1 project page (accessed 2026-07-21). At that date, Version 1.0 remained the published version; the 1.1 page was still marked Initial Public Draft/coming soon and must not be called final.
• NIST SP 800-226: Guidelines for Evaluating Differential Privacy Guarantees (final, March 2025).
• NIST Privacy-Enhancing Cryptography (page updated 2026-07-01; accessed 2026-07-21).
• NIST IR 8053: De-Identification of Personal Information.
• NIST SP 800-188: De-Identifying Government Datasets (final, September 2023; its direct audience is US government agencies, so this course uses only its approach to release models, measurable objectives, and disclosure review).
• McMahan et al. 2017 Federated Learning and Bonawitz et al. Practical Secure Aggregation.

Scope boundary

This course is not legal, compliance, cryptographic-audit, or production privacy-assessment advice. Verify laws, definitions of personal information, lawful bases, cross-border processing, data-subject rights, and notification duties against the actual region, purpose, role, and facts. Recheck dynamic standards and product implementations at deployment time.