How would you approach the development of an AI-driven feature that requires highly sensitive user data?

Example answer

I would first establish whether the feature needs the sensitive data at all. Define the user benefit, minimum fields, permitted purpose, people and systems that can access them, retention and deletion requirements. Include prompts, retrieval indexes, caches, logs, exports and any model-training copies in that inventory. Start development with synthetic or otherwise approved test data where feasible.

With legal, privacy and security specialists, determine the applicable obligations and a valid basis for each use. An opt-in screen is not by itself proof that processing is lawful or proportionate, and choosing an AI vendor does not transfer our responsibilities. Explain material uses and limits clearly and provide the controls and remedies appropriate to the product and applicable rules.

Encrypt data in transit and at rest with appropriate key management, and enforce narrowly scoped access on every read and action. These measures do not automatically provide end-to-end encryption: if a service decrypts content for inference, that service is a plaintext access point. Document that trust boundary and evaluate exposure through administrators, support access, telemetry and subprocessors. Encryption does not prevent an authorized service from misusing data.

Federated learning can keep raw records at participating sites, but shared updates may still leak information. Secure aggregation, differential privacy or restricted computation may address parts of a specified threat model, with utility, availability and trust tradeoffs; none should be advertised as a universal privacy guarantee.

Before release, test cross-user isolation, revoked access, unintended logging, export restrictions, deletion behavior and incident response. Record what deletion covers, including backups and derived artifacts; do not promise that deleting a row erases its influence from a trained model. If a required privacy or security boundary cannot be met, reduce the feature's data needs or defer that use.

Source: Deep Leakage from Gradients demonstrates that shared gradients can reveal training examples under the studied conditions; it is not a claim that every federated deployment leaks identically.