Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives

TL;DR

This paper systematically reviews privacy risks in general-purpose AI systems, develops a unifying framework, and investigates practitioner perceptions to inform better mitigation strategies.

Contribution

It provides a comprehensive taxonomy of privacy risks in GPAIS and introduces a practitioner-focused study to understand stakeholder perspectives.

Findings

Unified privacy risk framework for GPAIS

Insights into practitioner perceptions of privacy risks

Identification of gaps in current mitigation strategies

Abstract

The rise of powerful AI models, more formally $\textit{General-Purpose AI Systems}$ (GPAIS), has led to impressive leaps in performance across a wide range of tasks. At the same time, researchers and practitioners alike have raised a number of privacy concerns, resulting in a wealth of literature covering various privacy risks and vulnerabilities of AI models. Works surveying such risks provide differing focuses, leading to disparate sets of privacy risks with no clear unifying taxonomy. We conduct a systematic review of these survey papers to provide a concise and usable overview of privacy risks in GPAIS, as well as proposed mitigation strategies. The developed privacy framework strives to unify the identified privacy risks and mitigations at a technical level that is accessible to non-experts. This serves as the basis for a practitioner-focused interview study to assess technical stakeholder perceptions of privacy risks and mitigations in GPAIS.