An interesting idea. My first thought was to say “just use a differentially private learning algorithm,” but DP requires a notion of closeness, and that’s not t

An interesting idea. My first thought was to say “just use a differentially private learning algorithm,” but DP requires a notion of closeness, and that’s not trivial for, e.g., image data. Images close in an abstract sense, like Euclidean distance, may not be close in a task-relevant sense. You may not know what a good, task-relevant metric for employing DP without performing some kind of learning in the first place.