Full episode with Michael Kearns (Nov 2019): https://www.youtube.com/watch?v=AzdxbzHtjgs
New clips channel (Lex Clips): https://www.youtube.com/lexclips
Once it reaches 20,000 subscribers, I'll start posting the clips there instead. 
(more links below)

For now, new full episodes are released once or twice a week and 1-2 new clips or a new non-podcast video is released on all other days.

Clip from full episode: https://www.youtube.com/watch?v=AzdxbzHtjgs If you enjoy these clips, subscribe to the new clips channel (Lex Clips): https://www.youtube.com/lexclips Once it reaches 20,000 subscribers, I'll start posting the clips there instead. For now, new full episodes are released once or twice a week and 1-2 new clips or a new non-podcast video is released on all other days.
(more links below)

Podcast full episodes playlist:
https://www.youtube.com/playlist?list=PLrAXtmErZgOdP_8GztsuKi9nrraNbKKp4

Podcasts clips playlist:
https://www.youtube.com/playlist?list=PLrAXtmErZgOeciFP3CBCIEElOJeitOr41

Podcast website:
https://lexfridman.com/ai

Podcast on Apple Podcasts (iTunes):
https://apple.co/2lwqZIr

Podcast on Spotify:
https://spoti.fi/2nEwCF8

Podcast RSS:
https://lexfridman.com/category/ai/feed/

Michael Kearns is a professor at University of Pennsylvania and a co-author of the new book Ethical Algorithm that is the focus of much of our conversation, including algorithmic fairness, bias, privacy, and ethics in general. But, that is just one of many fields that Michael is a world-class researcher in, some of which we touch on quickly including learning theory or theoretical foundations of machine learning, game theory, algorithmic trading, quantitative finance, computational social science, and more.

Subscribe to this YouTube channel or connect on:
- Twitter: https://twitter.com/lexfridman
- LinkedIn: https://www.linkedin.com/in/lexfridman
- Facebook: https://www.facebook.com/lexfridman
- Instagram: https://www.instagram.com/lexfridman
- Medium: https://medium.com/@lexfridman
- Support on Patreon: https://www.patreon.com/lexfridman

So is there hope for any kind of privacy in a world where a few likes can identify you?

Yeah, so differential privacy basically is an alternate, much stronger notion of privacy than these anonymization ideas.

And it, you know, it's a technical definition, but like the spirit of it is we compare 2 alternate worlds.

Okay, so let's suppose I'm a researcher and I want to do, you know, I there's a database of medical records and 1 of them is yours.

And I want to use that database of medical records to build a predictive model for some disease.

So based on people's symptoms and test results and the like.

I want to build a model predicting the probability that people have disease.

So this is the type of scientific research that we would like to be allowed to continue.

And in differential privacy, you ask a very particular counterfactual question.

1 is when I do this, I build this model on the database of medical records including your medical record And the other 1 is where I do the same exercise with the same database with just your medical record removed.

So basically, you know, it's 2 databases, 1 with N records in it and 1 with N minus 1 records in it.

The N minus 1 records are the same and the only 1 that's missing in the second case is your medical record.

So differential privacy basically says that any harms that might come to you from the analysis in which your data was included are essentially nearly identical to the harms that would have come to you if the same analysis had been done without your medical record included.

So, in other words, this doesn't say that bad things cannot happen to you as a result of data analysis.

It just says that these bad things were going to happen to you already, even if your data wasn't included.

And to give a very concrete example, right, you know, like we discussed at some length, the study that, you know, in the 50s that was done that created the, that established the link between smoking and lung cancer.

And we make the point that like, well, if your data was used in that analysis, and you know, the world kind of knew that you were a smoker because, you know, there was no stigma associated with smoking before that, those findings, real harm might have come to you as a result of that study that your data was included in.

In particular, your insurer now might have a higher posterior belief that you might have lung cancer and raise your premium.

But the point is, is that if the same analysis has been done with all the other N minus 1 medical records and just yours missing, the outcome would have been the same.

Your data was an idiosyncratically crucial to establishing the link between smoking and lung cancer because the link between smoking and lung cancer because the link between smoking and lung cancer is like a fact about the world that can be discovered with any sufficiently large database of medical records.

Yeah, so that's showing that Very little harm is done.

Great, but what is the mechanism of differential privacy?

So that's the kind of beautiful statement of it.

But what's the mechanism by which privacy is preserved?

Yeah, so it's basically by adding noise to computations.

So the basic idea is that every differentially private algorithm, first of all, or every good differentially private algorithm, every useful 1, is a probabilistic algorithm.

So it doesn't, on a given input, if you gave the algorithm the same input multiple times, it would give different outputs each time from some distribution.

And the way you achieve differential privacy algorithmically is by kind of carefully and tastefully adding noise to a computation in the right places.

And you know, to give a very concrete example, if I want to compute the average of a set of numbers, the non-private way of doing that is to take those numbers and average them and release a numerically precise value for the average.

In differential privacy, you wouldn't do that.

You would first compute that average to numerical precisions, and then you'd add some noise to it, right?

You'd add some kind of 0 mean, you know, Gaussian or exponential noise to it so that the actual value you output is not the exact mean, but it'll be close to the mean, but it'll be close, the noise that you add will sort of prove that nobody can kind of reverse engineer any particular value that went into the average.

How many algorithms can be aided by adding noise?

Yeah, so I'm a relatively recent member of the differential privacy community.

My co-author Aaron Roth is, you know, really 1 of the founders of the field and has done a great deal of work and I've learned a tremendous amount working with him on it.

But I must admit the first time I saw the definition of differential privacy, my reaction was like, well, that is a clever definition and it's really making very strong promises.

And my, you know, I first saw the definition in much earlier days and my first reaction was like, Well, my worry about this definition would be that it's a great definition of privacy, but that it'll be so restrictive that we won't really be able to use it.

Like, you know, we won't be able to compute many things in a differentially private way.

So that's 1 of the great successes of the field, I think, is in showing that the opposite is true, and that, you know, most things that we know how to compute absent any privacy considerations can be computed in a differentially private way.

So for example, Pretty much all of statistics in machine learning can be done differentially privately.

So pick your favorite machine learning algorithm, back propagation and neural networks, cart for decision trees, support vector machines, boosting, you name it, as well as classic hypothesis testing and the like in statistics, none of those algorithms are differentially private in their original form.

All of them have modifications that add noise to the computation in different places in different ways that achieve differential privacy.

So this really means that to the extent that, you know, we've become a, you know, a scientific community very dependent on the use of machine learning and statistical modeling and data analysis, we really do have a path to kind of provide privacy guarantees to those methods.

And so we can still, you know, enjoy the benefits of kind of the data science era while providing,


Speaker 0: So is there hope for any kind of privacy in a world where a few likes can identify you?

Speaker 1: So there is differential privacy, right?

Speaker 0: What is differential privacy?

Speaker 1: Yeah, so differential privacy basically is an alternate, much stronger notion of privacy than these anonymization ideas. And it, you know, it's a technical definition, but like the spirit of it is we compare 2 alternate worlds. Okay, so let's suppose I'm a researcher and I want to do, you know, I there's a database of medical records and 1 of them is yours. And I want to use that database of medical records to build a predictive model for some disease. So based on people's symptoms and test results and the like.

I want to build a model predicting the probability that people have disease. So this is the type of scientific research that we would like to be allowed to continue. And in differential privacy, you ask a very particular counterfactual question. We basically compare 2 alternatives. 1 is when I do this, I build this model on the database of medical records including your medical record And the other 1 is where I do the same exercise with the same database with just your medical record removed.

So basically, you know, it's 2 databases, 1 with N records in it and 1 with N minus 1 records in it. The N minus 1 records are the same and the only 1 that's missing in the second case is your medical record. So differential privacy basically says that any harms that might come to you from the analysis in which your data was included are essentially nearly identical to the harms that would have come to you if the same analysis had been done without your medical record included. So, in other words, this doesn't say that bad things cannot happen to you as a result of data analysis. It just says that these bad things were going to happen to you already, even if your data wasn't included.

And to give a very concrete example, right, you know, like we discussed at some length, the study that, you know, in the 50s that was done that created the, that established the link between smoking and lung cancer. And we make the point that like, well, if your data was used in that analysis, and you know, the world kind of knew that you were a smoker because, you know, there was no stigma associated with smoking before that, those findings, real harm might have come to you as a result of that study that your data was included in. In particular, your insurer now might have a higher posterior belief that you might have lung cancer and raise your premium. So you've suffered economic damage. But the point is, is that if the same analysis has been done with all the other N minus 1 medical records and just yours missing, the outcome would have been the same.

Your data was an idiosyncratically crucial to establishing the link between smoking and lung cancer because the link between smoking and lung cancer because the link between smoking and lung cancer is like a fact about the world that can be discovered with any sufficiently large database of medical records.

Speaker 0: But that's a very low value of harm. Yeah, so that's showing that Very little harm is done. Great, but what is the mechanism of differential privacy? So that's the kind of beautiful statement of it. But what's the mechanism by which privacy is preserved?

Speaker 1: Yeah, so it's basically by adding noise to computations. So the basic idea is that every differentially private algorithm, first of all, or every good differentially private algorithm, every useful 1, is a probabilistic algorithm. So it doesn't, on a given input, if you gave the algorithm the same input multiple times, it would give different outputs each time from some distribution. And the way you achieve differential privacy algorithmically is by kind of carefully and tastefully adding noise to a computation in the right places. And you know, to give a very concrete example, if I want to compute the average of a set of numbers, the non-private way of doing that is to take those numbers and average them and release a numerically precise value for the average.

In differential privacy, you wouldn't do that. You would first compute that average to numerical precisions, and then you'd add some noise to it, right? You'd add some kind of 0 mean, you know, Gaussian or exponential noise to it so that the actual value you output is not the exact mean, but it'll be close to the mean, but it'll be close, the noise that you add will sort of prove that nobody can kind of reverse engineer any particular value that went into the average.

Speaker 0: So noise, noise is the savior. How many algorithms can be aided by adding noise?

Speaker 1: Yeah, so I'm a relatively recent member of the differential privacy community. My co-author Aaron Roth is, you know, really 1 of the founders of the field and has done a great deal of work and I've learned a tremendous amount working with him on it. It's a

Speaker 0: pretty grown up field already.

Speaker 1: Yeah, but now it's pretty mature. But I must admit the first time I saw the definition of differential privacy, my reaction was like, well, that is a clever definition and it's really making very strong promises. And my, you know, I first saw the definition in much earlier days and my first reaction was like, Well, my worry about this definition would be that it's a great definition of privacy, but that it'll be so restrictive that we won't really be able to use it. Like, you know, we won't be able to compute many things in a differentially private way. So that's 1 of the great successes of the field, I think, is in showing that the opposite is true, and that, you know, most things that we know how to compute absent any privacy considerations can be computed in a differentially private way.

So for example, Pretty much all of statistics in machine learning can be done differentially privately. So pick your favorite machine learning algorithm, back propagation and neural networks, cart for decision trees, support vector machines, boosting, you name it, as well as classic hypothesis testing and the like in statistics, none of those algorithms are differentially private in their original form. All of them have modifications that add noise to the computation in different places in different ways that achieve differential privacy. So this really means that to the extent that, you know, we've become a, you know, a scientific community very dependent on the use of machine learning and statistical modeling and data analysis, we really do have a path to kind of provide privacy guarantees to those methods. And so we can still, you know, enjoy the benefits of kind of the data science era while providing,

See all Lex Fridman transcripts on Youtube

Michael Kearns: Differential Privacy