Question

Your team is training a model on a dataset of hospital patient records to predict readmission risk. Legal and compliance flag that the model must not allow attackers to infer whether a specific individual's record was part of the training set, even if the attacker has access to the model and some auxiliary data. Model accuracy is important but secondary to this privacy guarantee. Which approach best mitigates this specific privacy risk?

Accepted Answer

Apply differential privacy during training (e.g., DP-SGD) to bound the influence any single training example has on the model.

Answer

Encrypt the training dataset at rest and in transit using customer-managed encryption keys (CMEK).

Answer

Remove all direct identifiers such as name and patient ID from the dataset before training.

Answer

Restrict access to the deployed endpoint using IAM and a private VPC endpoint.