AI Privacy Clean Room：数据协作与测量架构
Privacy clean room architecture 不是“把两个客户表上传后匹配”。它是一套 governed collaboration system：在任何 insight 被信任、导出或进入 AI pipeline 前，先约束 purpose、data minimization、identifier handling、query surface、output disclosure
AI Privacy Clean Room / Data Collaboration / Measurement Architecture 解读
配对阅读：本篇的操作手册版（模板/RACI/门禁/runbook）是
docs/AI_PRIVACY_CLEAN_ROOM_DATA_COLLABORATION_MEASUREMENT_PLAYBOOK.md。第一遍读本篇建立原理与架构判断；第二遍做案例时再用 playbook 查表落地，两者不需要重复精读。
重要说明: 本文只讨论 privacy clean room、secure enclave、aggregation、differential privacy、synthetic data、secure multiparty computation concepts、de-identification、purpose-bound collaboration 和 evidence-driven measurement 的产品与架构设计，不构成法律、监管、隐私影响评估、数据 de-identified/anonymized 认定、合规充分性、模型验证、消费者通知、供应商推荐或合同条款结论。数据分类、是否属于 personal data、是否可用于 measurement、marketing、fraud、model training 或 AI evaluation，必须由 Legal、Compliance、Privacy、Data Governance、Information Security、Model Risk、Marketing Compliance、Fraud Risk、Vendor Management、Internal Audit 等结合具体数据和场景判断。
Clean room 是受控数据协作架构，不是合规豁免、匿名化证明，也不是把 partner data 变成可自由训练模型的许可。
Source Anchors
| Source | Link | 用途 |
|---|---|---|
| NIST Privacy Framework | https://www.nist.gov/privacy-framework | 用 Identify-P / Govern-P / Control-P / Communicate-P / Protect-P 思路组织 privacy risk、purpose、data processing、governance 和 evidence |
| NIST Privacy-Enhancing Cryptography project | https://csrc.nist.gov/projects/pec | 用 privacy-enhancing cryptography 作为 secure computation、controlled disclosure、collaboration pattern 的官方技术锚点 |
| NIST SP 800-188 De-Identifying Government Datasets | https://csrc.nist.gov/pubs/sp/800/188/final | 用 de-identification、re-identification risk、context、release model 和 expert review 思维设计 clean-room output controls, 不直接作法律分类结论 |
| FTC commercial surveillance and data security rulemaking | https://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking | 用 commercial surveillance / data security policy discussion 作为商业数据使用、tracking、security、consumer harm 风险讨论锚点 |
| FTC business guidance on privacy and security | https://www.ftc.gov/business-guidance/privacy-security | 用 FTC business guidance 作为隐私、安全、数据最小化、声明一致性和商业实践风险的治理提醒 |
| NIST AI RMF | https://www.nist.gov/itl/ai-risk-management-framework | 用 Govern / Map / Measure / Manage 组织 clean-room AI evaluation、model misuse、monitoring、human oversight 和 evidence |
| ISO/IEC 42001 overview | https://www.iso.org/standard/42001 | 用 AI management system、policy、roles、operation、performance evaluation、internal audit 和 continual improvement 建立 AI data collaboration operating model |
核心导读
Privacy clean room architecture 不是“把两个客户表上传后匹配”。它是一套 governed collaboration system：在任何 insight 被信任、导出或进入 AI pipeline 前，先约束 purpose、data minimization、identifier handling、query surface、output disclosure、partner behavior、AI use 和 evidence。
AI 改变的是数据协作的下游价值链。Clean room 不再只用于 overlap count 或 campaign measurement，也会被用于 fraud consortium、portfolio analytics、partner outcome eval、secure model scoring、synthetic sandbox、LLM summary 和 agentic query workflow。价值在于多方可以在不直接暴露原始数据的情况下回答特定问题；风险在于输出、模型分数、embedding、eval labels 或 partner-derived features 继续流向 targeting、training、profiling、blacklisting 或 unrelated decisioning。
本篇的重点是理解 PET 能控制什么、不能控制什么。Hashing、aggregation、synthetic data、DP、SMPC、secure enclave 和 cloud clean room 都只能解决部分 threat model，不能自动证明匿名化、目的正当或下游使用安全。治理边界必须同时覆盖 data access、computation、output 和 purpose：每次 collaboration 都要有 use case evidence pack、query/output controls、small-cell and differencing defense、AI eval-vs-training separation、partner access audit、downstream attestation 和 incident replay。
问题定义
金融零售 clean room 的价值不是让银行、商户、广告平台、支付网络、保险或 loyalty partner 互相看见客户数据，而是把 bilateral extracts 升级为 purpose-bound collaboration + controlled computation + aggregate measurement + governed outputs + replayable evidence。
必须回答：
collaboration 的 approved purpose 是 fraud、measurement、audience insight、portfolio analytics、AI eval 还是 partner reporting?
哪些 subjects、fields、events、identifiers、derived features 可进入 clean room?
进入前是否完成 consent/purpose/contract/data-classification review?
identity resolution 用什么 join key，谁生成，谁可见，是否可反推个人?
query 是自由 SQL、template、approved notebook、secure function 还是 API?
输出是否只允许 aggregate / thresholded / noisy / reviewed result?
PET 解决什么，不解决什么?
AI 是否只做 eval/measurement，还是训练、feature enrichment、lookalike expansion?
partner 能否带出、复用、拼接、转售、训练模型或用于 unrelated targeting?
审计时能否重放 inputs、purpose、query、policy、output review、partner access、AI run 和最终业务决策?
关键边界：
Clean room does not mean anonymous.
Hashing does not mean de-identified.
Aggregation does not eliminate re-identification risk.
Synthetic data does not automatically remove leakage risk.
Differential privacy is a budgeted measurement design, not a magic mask.
Secure enclave protects computation, not purpose integrity.
SMPC hides raw inputs, not necessarily harmful outputs.
Partner measurement is not permission for model training.
核心原理/方法
Data collaboration 需要同时拆分 collaboration type、data class、computation pattern 和 output type。
| Collaboration type | Example | Primary risk | 设计问题 |
|---|---|---|---|
| Audience overlap | 银行客户与零售商 loyalty 用户重叠 | membership inference、small cell | 是否只需 cohort-level thresholded count |
| Campaign measurement | exposure-to-purchase、offer lift | unauthorized targeting、attribution overclaim | causal design 和 aggregate lift 是否足够 |
| Fraud consortium | mule、ATO、synthetic pattern | blacklisting、false positive propagation | signal provenance、reason codes、review boundary |
| Portfolio insight | 商户/行业/地域消费变化 | segment re-identification、unfair profiling | segment 粒度和 permitted use |
| AI evaluation | 模型推荐与 partner outcome blind eval | eval data 变 training data | eval-only contract and technical enforcement |
| Synthetic data | query/test pipeline | memorization、rare-record leakage | leakage and utility review |
| Secure model scoring | 一方模型在另一方数据上评分 | model extraction、unauthorized feature use | scoring purpose and output threshold |
Data classes：
| Data class | Clean-room boundary |
|---|---|
| Direct identifiers | analyst 不应可见；join tokenization and key custody |
| Pseudonymous identifiers | hashing/tokenization 仍可链接，不等于匿名 |
| Event facts | purpose、retention、field minimization、freshness |
| Sensitive/proxy attributes | heightened review and output suppression |
| Partner-derived features | provenance、allowed-use metadata、training restriction |
| Aggregate outputs | threshold、noise、disclosure review、differencing controls |
| AI artifacts | embeddings、prompts、model scores、eval labels 需要 model-use boundary |
系统/架构模型
参考架构：
business use case intake
-> purpose / consent / contract / policy review
-> data inventory and field minimization
-> partner onboarding and trust assessment
-> identity resolution / tokenization / key management
-> secure ingestion and data quality validation
-> policy-tagged collaboration workspace
-> approved query templates / secure functions / notebooks
-> computation layer: clean room / enclave / PEC / aggregation
-> output controls: threshold / suppression / DP / review
-> AI boundary layer: eval-only / scoring / no-training controls
-> evidence ledger and partner access audit
-> metrics, incident response and periodic recertification
四个边界必须同时受控：
data access boundary: who can see raw or row-level data
computation boundary: what functions can run on joined data
output boundary: what leaves the environment
purpose boundary: what business use is allowed after output leaves
核心组件：
| Component | 职责 |
|---|---|
| Use case registry | approved purpose、owner、risk tier、partners、allowed outputs |
| Data contract and policy tags | 字段级 purpose、consent、retention、sensitivity、allowed computation |
| Identity resolution | tokenization、join rules、salting/key custody、match quality |
| Secure ingestion | validation、schema mapping、quality checks、lineage |
| Computation layer | enclave、warehouse clean room、SMPC-like workflow、aggregation |
| Query policy engine | template approval、column access、row filters、purpose checks、differencing defense |
| Output disclosure control | thresholds、suppression、rounding、noise、review、export gates |
| AI use boundary | eval、scoring、feature creation、training、summarization controls |
| Partner governance | RBAC/ABAC、MFA、session logging、least privilege、recertification |
| Evidence ledger | use case、data version、query、output、review、AI run、partner access |
关键机制与取舍
PET 选择应从 threat model 和 measurement need 出发：
| Pattern | Helps with | Does not solve | 决策重点 |
|---|---|---|---|
| Secure enclave / confidential computing | 保护运行时数据和计算环境 | 不自动限制 purpose、query、output misuse | 谁信任 enclave operator，是否需要 attestation |
| Cloud data clean room | 受控 join、query、role access、aggregate output | small-cell leakage、purpose creep | query templates、threshold、audit、export controls |
| Aggregation/thresholding | 降低 customer-level output risk | differencing and rare event risk | minimum cell、rounding、suppression |
| Differential privacy | 为重复统计提供 privacy budget | utility loss、参数治理复杂 | epsilon/budget owner、utility threshold |
| Synthetic data | dev/test/demo/query prototyping | 不保证无泄露 | membership/attribute inference tests |
| SMPC concepts | 多方不暴露原始输入下计算 | 输出仍可能敏感 | 是否只需 PSI or aggregate computation |
| De-identification | 降低直接识别风险 | linkage/context 法律判断仍需审查 | expert/privacy review |
| Tokenization/hashing | 支持 match | hashed identifiers 可被攻击 | salt/key custody、rotation、scope-limited tokens |
AI usage boundary：
| AI use | 默认 posture |
|---|---|
| Summarize approved aggregate output | 可行，但只能基于已出境批准结果 |
| Model evaluation | 可行，eval-only tags、no-training enforcement、evidence required |
| Model scoring | 高风险，需 purpose、feature、output、review controls |
| Feature enrichment | 高风险，可能把 collaboration 转成 profiling |
| Training/fine-tuning | 默认禁止，需独立 use case and approvals |
| Lookalike/audience expansion | 高风险，可能把 measurement 变 targeting |
| Agentic query generation | 高风险，必须 template constraints and output review |
Purpose chain：
original collection purpose
-> customer notice / consent / permissible basis
-> internal data classification
-> partner contract and permitted use
-> clean-room use case approval
-> query purpose
-> output purpose
-> downstream decision-use purpose
证据与控制
Use case evidence pack：
use_case_id
approved purpose
prohibited uses
data contributors
data subjects
required fields and minimization rationale
identifier and join method
consent / notice / contract references
computation pattern
allowed query templates
allowed outputs
threshold / suppression / DP budget
AI usage: none / eval-only / summarization / scoring / training separately approved
partner access roles
retention rule
downstream users and attestations
risk owner and approval forum
控制矩阵：
| Control objective | Control activity | Evidence |
|---|---|---|
| 约束 collaboration purpose | approved use case with allowed/prohibited uses | use case card、approval record |
| 最小化数据 | fields mapped to measurement/eval question | minimization matrix |
| 管理 consent/purpose | policy tags and consent/notice/contract references | metadata record、privacy review |
| 控制 identity resolution | scope-limited tokens、key custody、salt rotation、match validation | tokenization design、key logs |
| 限制 queries | templates、parameter constraints、role permissions、query review | query policy、run logs |
| 防 small-cell leakage | thresholds、suppression、dimension caps、differencing checks | output control log |
| 管理 DP budget | owner、epsilon/budget rules、utility review | privacy budget ledger |
| 治理 synthetic data | leakage tests、usage labels、production-use restrictions | synthetic review |
| 分离 AI eval and training | eval-only tags and training pipeline blocks | training block log、AI run record |
| 控制 partner access | least privilege、MFA、session logs、export gates、recertification | partner access audit |
| 监测 misuse | anomalous queries、segment narrowing、export spikes、prompt misuse | monitoring dashboard |
| 保留 evidence | purpose、data version、query、output、review、AI run、downstream attestation | evidence bundle |
| 事件处理 | unauthorized query、output leak、partner misuse、training misuse runbook | incident record、RCA |
金融零售/AI产品场景
- Card-linked offer measurement：银行和商户只计算 aggregate lift、thresholded conversion、confidence interval；不导出 customer-level purchase list。
- Retail media attribution：clean room 输出 campaign-level incrementality，AI 只总结 approved aggregate output，不生成“最佳客户名单”。
- Fraud consortium analysis：多方计算 mule/ATO pattern，输出 risk signal 必须有 provenance、reason codes、human review boundary，不能变成黑名单。
- Portfolio insight：行业/地域消费趋势做 segment coarsening、small-cell suppression 和 decision-use limitation。
- AI model evaluation：partner outcome labels 只用于 eval，feature creation/training pipeline 根据 eval-only tag 阻断。
- Synthetic sandbox：synthetic data 只用于开发 query 和 demo，标记为 not production truth，并经过 leakage review。
反模式
| 反模式 | 风险 | 更好的控制 |
|---|---|---|
| hashing 当 anonymization | hashed email/phone 可被链接攻击 | tokenization、salt/key custody、privacy classification |
| free SQL on joined data | analyst 缩小到 small segments | templates and output controls |
| aggregate output 用于 individual targeting | measurement 变 profiling | downstream use boundary and activation gate |
| DP 没有 measurement design | privacy noise 毁掉 utility 或制造假信心 | metric、budget、utility threshold |
| synthetic data 当 safe real data | rare pattern 泄露或误用 | leakage tests and usage labeling |
| fraud signal 变 blacklist | false positives 跨 partner 扩散 | provenance、reason codes、human review |
| partner eval labels 用于训练 | 未授权 model development | eval-only controls |
| report 无 uncertainty | correlation 被包装成 causation | holdout/causal design and confidence notes |
| LLM summary 泄露 suppressed pattern | 输出控制被绕过 | summary tool 只读 approved outputs |
| vendor portals 分散证据 | audit 无法重放 | central evidence ledger and export pack |
最终心智模型
Privacy clean room 的本质不是一个数据平台功能，而是 data collaboration product architecture。成熟系统应能证明：每次 partner collaboration 只回答 approved business question，使用最小必要数据，运行受治理计算，释放受控输出，把 AI evaluation 与 training 分开，控制重识别和 purpose creep，管理 partner 风险，并保存 Privacy、Model Risk、Audit 和业务 owner 都能重放的证据。
SOTA 状态标注 (2026-07-01)
本篇属于第二、三遍深读池（参考架构/深读笔记），未列入 12 周主线必读。时效基线为写作时点；引用前请按 CLAUDE.md 全局时效性硬规则复查最新进展。模块级 SOTA 对照见 docs/AI_SYSTEMATIC_LEARNING_ROADMAP_2026.md 各周「2026 SOTA 对照」行与文末「SOTA 检查」。