Summary
Collaborations in scientific artificial intelligence involve many organizations sharing data and computing resources. The authors point out that protecting privacy in this setting is complicated because it’s not just about hiding individual data points, but often about protecting entire institutions' strategies and capabilities. They propose a new way to think about privacy that includes what needs protection, who might observe, and what guarantees are given. Their approach helps uncover privacy risks unique to big research facilities and suggests research priorities to better protect multi-institutional AI projects.
What this means in practice
- •For data privacy officers: Use the proposed claim register framework to audit and compare privacy guarantees across collaborating scientific institutions.
- •For cloud infrastructure teams: Develop resource schedulers and telemetry systems that minimize leaked information about institutional usage patterns as identified in the paper.
A position paper. It proposes an approach and reports no results.
Authors
Olivera Kotevska, Sumit Jha, Aurélien Bellet, Rui Hu, Nathaniel D. Bastian, Rafael Ferreira da Silva, Ravi Madduri, Kibaek Kim
Abstract
Scientific artificial intelligence (AI), spanning foundation models (FMs) to federated data-analysis pipelines, is becoming shared infrastructure across national laboratories, universities, hospitals, and industrial partners. This collaboration creates privacy risks whose natural unit is often an institution's participation, research strategy, or technical capability rather than a single record. Differential privacy (DP), federated learning (FL), secure computation, trusted execution, and provenance each protect parts of the stack, but their guarantees rarely compose across mixed-trust institutions, access tiers, and autonomous agents. This perspective recasts privacy for scientific AI as an assurance problem defined by six elements: protected asset, observer, channel, permitted disclosure, guarantee, and evidence. We demonstrate the framing through a claim register for a composite cross-institutional scenario and use it to assess the model lifecycle. Two of the resulting gaps are specific to leadership-class facilities: scheduler, allocation, and telemetry metadata expose an institution's resource posture, and instrument-attached control loops leak research strategy through timing and contention on shared accelerators. We identify six research priorities: institution-level guarantees, agent-communication privacy, cross-tier information flow, privacy-compatible reproducibility, leadership-scale accounting, and instrument side channels. The contribution is a common form for stating, comparing, and auditing claims whose guarantees otherwise remain fragmented across the scientific AI stack.