What happened
On 6 November 2026 (visible published-date label on cloudsecurityalliance.org; confirmed by fetching the primary page), the Cloud Security Alliance published a guidance article, 'Input Privacy vs Output Privacy: Choosing a PET.' It builds on CSA's report 'Comparing FHE and Other PETs' and distinguishes two security models in privacy-enhancing technologies: input privacy (protecting data during computation — FHE, SMPC, TEEs, ZKPs) and output privacy (limiting what can be inferred from results — differential privacy). It argues FHE and DP are not substitutes, provides a four-question architecture-planning test, and shows where a hybrid FHE+DP design protects both inputs and published outputs (e.g., AI/ML training and inference over sensitive data).
Why it matters
CSA is a recognised standards-adjacent body whose publications are widely referenced. This piece gives decision-makers a control-selection framework for preserving confidentiality of AI/ML training and inference data, and clarifies that 'privacy-enhancing' choices are threat-model dependent rather than interchangeable. It is minor companion guidance (not a normative standard), so it belongs on the watch list for QA dedup rather than being treated as a binding framework.
Action needed
For AI/ML teams handling sensitive training or inference data, factor input-vs-output privacy into PET selection; do not treat FHE and differential privacy as drop-in substitutes. Track CSA's 'Comparing FHE and Other PETs' report for fuller detail.