To me the distinction is in whether model trained on my data can return it almost verbatim. Any statistical model, even linear regression can expose some of my data and preferences, but the difference is whether they can compromise the data they've been trained.

And frankly I see the distinction in only number of model parameters vs number of people in cohort it was trained. So 50k-param model trained on 1b emails from 1 million people is ok, encoding/compression loses anything personal. But huge LLMs are closer to lossless compressors that can just spew all my passwords, prescriptions etc verbatim.

thank you for the reply, it is a good grounding distinction and i will think more on this perspective.

I know. I mentioned because there's a category of models that I'd be okay with, but I can't exactly name it. I thought the difference lied in the encoder/decoder distinction. As a sibling comment mentioned, generative models do make the capabilities riskier.

The model size also plays a role, since they've become bigger since 2022 (let's use chatgpt as the cutoff date, but it could be around 2020/2021). Modern BERT trained nowadays will keep their lossy compression nature? Or could there be a privacy risk such as it's clear with generative model?

Thus, what are the characteristics of privacy-friendly models? So far, I listed discriminative vs. generative, size, and a lossy transforms (related to size).

Model size, definitely. Not so sure about the discriminative vs. generative distinction (technically 'generative' models are discriminators as well) - I suspect the data is extractable if you have access to the weights, although easier to extract from inferencing in a decoder model.

My guess is that the pairing of all of these things is due to the fact that Google has likely consolidated everything under the same style of decoder model.