In one sense, no. You can guarantee privacy of any given input (or any subset of k inputs) by applying transfer learning of an ensemble of models trained on sub

In one sense, no. You can guarantee privacy of any given input (or any subset of k inputs) by applying transfer learning of an ensemble of models trained on subsets of the training data [0][1]. This is useful if, for instance, you train on medical data and you don't want anyone to know that "John Doe, HIV+" was part of the input. If your adversary does not take such precautions, however, then your canary should work. [0] https://arxiv.org/abs/1610.05755 https://arxiv.org/abs/1610.05755 [1] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46307.pdf https://static.googleusercontent.com/media/research.google.c...