Christoph Lampert
Professor, Institute of Science and Technology Austria
Workshop 2
Privacy-preserving Machine Learning and Privacy in Distributed Settings
Overview
Workshop 2 is part of the Data Privacy in Machine Learning P1 program. It will focus on privacy in limited-trust settings, with particular interest in approaches that bring together ideas from differential privacy, decentralized learning, secure computation, and cryptography.
The program includes invited talks by Christoph Lampert, Christian Rechberger, Edwige Cyffers, Christian Weinert, and Tamer Mour, as well as contributed talks selected through the call for contributions. The first day of the workshop will be a day of tutorials on differentially private machine learning and cryptography by Tamalika Mukherjee, Tamer Mour, and Hannah Keller.
Registration
Registration deadline: October 28, 2026
Cost: 675 DKK
Speakers
Christian Rechberger
Professor, TU Graz
Edwige Cyffers
CNRS Researcher, Lamsade at Dauphine University in Paris
Christian Weinert
Associate Professor, Royal Holloway, University of London
Tamer Mour
Principal Investigator, The Italian Institute of Artificial Intelligence (AI4I)
Tamalika Mukherjee
Research Group Leader, Max Planck Institute for Security and Privacy
Call for Contributions
We are seeking submissions for 20-30 minute talks on topics related to privacy-preserving machine learning and privacy in distributed settings. The workshop will not have a poster session.
Topics of interest include:
- Privacy for decentralized and distributed learning
- Private federated learning, federated analytics, and secure aggregation
- Interactions between cryptographic tools and differential privacy
- Secure multi-party computation for privacy-preserving machine learning
- Zero-knowledge proofs and other methods for verifying privacy-preserving machine learning systems
- Attacks, auditing, and empirical evaluation of privacy
- Any other topic related to the core theme of the workshop
Registration formRegister for the workshop by October 28, 2026
Agenda
Tutorial: Primer on Differentially Private Machine Learning IHannah Keller
Coffee break
Tutorial: Primer on Differentially Private Machine Learning IITamalika Mukherjee
Lunch break
Tutorial: Cryptography Primer ITamer Mour
Coffee break
Tutorial: Cryptography Primer IITamer Mour
Workshop Dinner at Yi East RestaurantFrederiks Pl. 6, 8000 Aarhus
Invited TalkFrom Attacking Decentralized Learning to Pairwise Network Differential PrivacyEdwige Cyffers
Decentralization is often seen as safer by default, since information is mixed as it travels through the communication graph. We show that this intuition is misleading: an honest-but-curious participant can reconstruct the data of distant nodes, both in gossip and in synchronous decentralized gradient descent. Worse still, a malicious participant can reconstruct the graph topology itself from its local view of the training. These results motivate the use of principled privacy guarantees adapted to decentralized learning, such as Pairwise Network Differential Privacy.
Coffee break
Contributed TalksDithered Gaussian Mechanism for Randomness-Efficient Differential PrivacyNikita Kalinin, Rasmus Pagh
Lower Bounds for Private Graph Optimization Problems using Reconstruction AttacksJacob Imola, Rasmus Pagh, Lukas Retschmeier
Edit-Neighboring Data Streams and Privacy under Continual ObservationJoel Daniel Andersson, Anamay Chaturvedi, Monika Henzinger, Roodabeh Safavi
Lunch break
Invited TalkRecent Advances in MPC-based Secure Neural Network InferenceChristian Weinert
Efficient secure neural network inference (SNNI) has been extensively studied over the past 10 years. However, recent foundational improvements have stagnated in favour of exploring the intricacies of transformer architectures. In this talk, we revisit SNNI in the context of emerging real-world deployment scenarios, including settings in which the model owner, or even all parties, know the model parameters in the clear. We show how a combination of improved function-dependent preprocessing, new MPC primitives, aggressive ML/MPC co-design, and implementation-level optimisations can substantially improve performance. Together, these techniques enable privacy-preserving evaluation of ResNet50 on ImageNet samples with amortized online runtimes below 0.1 seconds.
Contributed Talks
Accelerating Multiparty Noise Generation Using LookupsFredrik Meisingseth, Christian Rechberger, Fabian Schmid
Secret Shared Floating Point Computation for Private Neural Network Fine-TuningHendrik Eerikson, Sona Kravtšenko, Hiroki Kaminaga, Pille Pullonen-Raudvere, Liina Kamm, Sven Laur
Binarized Neural Network Inference with Half-Authenticated TriplesSebastian Hasler
Coffee break
Invited TalkTowards Practical Private Inference: New Tools for Computing on Encrypted DataTamer Mour
I will talk about Encrypted Matrix-Vector Products (EMVP): A new practical cryptographic tool for computing on encrypted data. I will show how to build concretely efficient EMVPs based on the hardness of new Learning Subspace with Noise (LSN) problems, and discuss how they can be useful to obtain privacy-preserving inference and other applications in various models.
Invited TalkRecent Progress on the Matrix Factorization Approach to Differential PrivacyChristoph Lampert
Matrix factorization has emerged as a powerful framework for improving the utility of differentially private algorithms by introducing carefully designed correlations into the added noise. In this talk, I will survey recent progress on this approach for machine learning tasks, concentrating on work with Nikita Kalinin and collaborators. I will discuss how suitable matrix factorizations lead to improved mechanisms for private model training and continual estimation, including sharper error bounds, efficient banded constructions, and on-the-fly noise re-generation.
Coffee break
Contributed Talks
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated LearningWenrui Yu, Changlong Ji, Johannes Bjerva, Qiongxiu Li
Towards Practical vFHE: Privacy-preserving and Verifiable Machine Learning Ignacio Cascudo, Anamaria Costache, Daniele Cozzo, Dario Fiore, Antonio Guimaraes, Eduardo Soria-Vazquez
Encrypted neural networks without overflowsPhilipp Kern, Lorenzo Rovida, Samuel Teuber, Edoardo Manino, Carsten Sinz, Alberto Leporati
Combining MPC and DPFredrik Meisingseth
Lunch
End of Workshop
Venue
Location, Monday and Tuesday (November 2-3): William Scharff Audiorium (Building 1253, Room 317), Bartholins Alle 3, 8000 Aarhus C
Open in OpenStreetMap · Map data © OpenStreetMap contributors
Location, Wednesday (November 4): Auditorium G1 (Building 1532, Room 116), Ny Munkegade 118, Aarhus C
Open in OpenStreetMap · Map data © OpenStreetMap contributors
Organizers
Hannah Keller
Claudio Orlandi
Rasmus Pagh
