Review privacy

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R16 — Presidio

   R17 — NIST Privacy

   R18 — Opacus/DP trade-offs

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P2 privacy end-to-end: D4 PII tokenization during document ingestion and query time, embedding inversion exposure, membership-inference assumptions, retention TTLs, deletion propagation (D10), and audit log minimization.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Verify D4 token mappings cannot cross tenants during RAG retrieval and measure how PII masking affects retrieval recall and citation precision.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   P2 privacy trade-off report and cross-tenant PII/deletion test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R16Microsoft Presidio↗ microsoft.github.io

  Analyzer, anonymizer, custom PII recognizers, and probabilistic detection false-positive/negative limits.

• R17NIST Privacy Framework↗ nist.gov

  Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P lifecycle controls.

• R18Opacus Documentation↗ opacus.ai

  Differential privacy PrivacyEngine, gradient clipping, noise multiplier, $(\epsilon, \delta)$ accounting, and utility trade-offs.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · framework
  NIST Privacy Framework

  The Identify-P, Govern-P, Control-P, Communicate-P, Protect-P functions give the vocabulary for mapping each privacy control (retention TTL, deletion propagation, log minimisation) to a lifecycle outcome.

  R17checked 2026-11-11
• videoGoogle TechTalks
  DP-SGD Privacy Analysis is Tight!

  Shows that the DP-SGD upper bound is matched by a concrete adversary, which is the right lens for stating what membership-inference resistance your training assumptions actually buy.

  R18checked 2026-11-11
• videoSprintML-Lab
  04. Privacy II: Differential Privacy for Machine Learning (DPSGD and PATE)

  Contrasts DP-SGD with PATE and explains the privacy/utility trade-off, so the audit can justify the chosen noise multiplier and epsilon instead of quoting a number.

  R18checked 2026-11-11
• articleACL Anthology (EMNLP 2023) · paper
  Text Embeddings Reveal (Almost) As Much As Text

  Recovers 92% of 32-token inputs from their embeddings via iterative correction, which is the concrete basis for treating stored vectors as sensitive as the source text in the embedding-inversion exposure review.

  R17R18checked 2026-11-11
• labOpacus (Meta) · notebook tutorial
  Building a text classifier with Differential Privacy

  Runs PrivacyEngine with max_grad_norm, noise_multiplier, and epsilon reporting on a real fine-tune, so the audit's (epsilon, delta) claim is reproduced rather than copied from a model card.

  R18checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.