Balancing the Effectiveness-Privacy Trade-Off of Individualization With Machine Learning

• In Event: Interrogating the Truth While Protecting Children's Privacy

Abstract

In educational software, machine learning can help provide well-differentiated instruction. This is a great advance which we should celebrate. At the same time, we must recognize that there is a fundamental effectiveness-privacy tradeoff that cannot be avoided. Algorithms will improve as they treat students more like humans and less like problem-solving machines, but to do so, they will inevitably learn more about students as humans.

Current state of individualization

In educational settings, the overwhelming majority of use-cases for machine learning assume that students interact with software in a linear, 1-on-1 fashion. These algorithms measure how changes in problem selection, scaffolds, incentive structures, or other features affect how users interact with the software. By aggregating data across many users, these algorithms can provide individualized support to maximize student engagement, time-on-task, or performance.

The result is better learning experiences compared to non-adaptive versions of the same tasks. Individualization helps users play games for longer, solve harder puzzles, or more efficiently learn skills. There is a reason tech companies personalize websites and advertisements: it works!

To think about the effectiveness-privacy tradeoff, first consider the assumptions typical individualization algorithms make about students:
-a student’s knowledge about a skill can be summarized by a single number
-students can only perform a limited set of actions, e.g. multiple choice but not free text
-students work alone
-students do not learn from external sources

While limiting, these assumptions lead to relatively low privacy risks. For example, if the student only enters valid mathematical expressions or multiple choice answers, it will be nearly impossible to infer what specific student generated those records. The main risk is leaking database tables keeping student login and contact information; this risk is greatly reduced with the use of a third-party token-based login system.

Future directions

Relaxing even one of our (incorrect) assumptions could lead to algorithms that fulfill fundamentally different roles than individualization plays now. For example, we could develop “individualization” algorithms that work on groups, not individuals, and promote collaboration or productive academic discourse. Additionally, new diagram and text comprehension algorithms could be used to interpret a student’s diagram or partial work and respond appropriately in the middle of their problem solving process.

Such advances are not free. Even if we can overcome the computational hurdles from relaxing these assumptions, the resulting algorithms will be much more invasive of student privacy. For example, if software tracks group discussions so it can choose when to intervene to drive productive academic discourse, so much identifiable information will be recorded that there will not even be an illusion of student privacy.

How might we deal with this? One model is to use methods from medical privacy or cryptography to anonymize centralized data. An interesting alternative is to have students’ computers only send relevant statistical summaries, not full records. Regardless of the approach, if we wish to respect student privacy, we must design new individualization algorithms with privacy in mind from the outset, not try to bolt it on after they are already designed.

Author

• Yun-En Liu, Enlearn
  Presenting Author