Tag: DEPA Inferencing

The recent publication of the DEPA for AI Training Handbook has invited a necessary and rigorous public debate. Because the Handbook is explicitly a draft for discussion, this kind of sharp feedback is not just welcome, but essential for co-creation.

The debate raises two important questions: whether individual consent alone can adequately protect people in the context of AI training; and whether the presence of existing cryptographic primitives necessarily diminishes the architectural ingenuity of Digital Public Infrastructure (DPI).

An Evolvable, Modular Architecture

From its inception, DEPA was never conceived as a single product or a static specification. When iSPIRT first conceptualized DEPA in 2016, and NITI Aayog published the draft discussion paper in August 2020, it was explicitly framed as the final layer of India Stack—an evolving architectural philosophy aimed at resolving a singular paradox: How do we empower citizens and unlock the societal value of data without compromising privacy or concentrating market power?

Even the 2020 NITI Aayog paper anticipated going beyond consent, explicitly stating: “It goes without saying that consent alone cannot be the only backstop to prevent data misuse… Mechanisms that enable consent can exist on a spectrum.”

What launched in 2021 as the Account Aggregator (AA) rail was merely the first instantiation of DEPA—built using the primitives available at the time to solve for 1-to-1 retail data portability. Like previous digital public infrastructures, DEPA’s core mission of empowerment and protection remains invariant, even as its cryptographic primitives modularly expand to include Confidential Clean Rooms, Electronic Contracts, and Differential Privacy to solve for the age of AI.

This evolution can be understood through three complementary pathways: DEPA with consent, enabling individual data sharing through Account Aggregators; DEPA with informed consent, enabling privacy-preserving computation across institutional boundaries through Private Inferencing; and DEPA for AI Training, enabling collective data use for AI training. These pathways are complementary, not competing or sequential, and together support information flows at individual, institutional and industrial scales, while preserving Protection and enabling Empowerment.

The Genealogy and Limits of Digital Consent

“Notice and Choice” was designed for a 1-to-1 bilateral relationship where the user understands the exact deterministic outcome of sharing a record—such as porting a bank statement to secure a loan. Consent was always a means to an end; the primal goal is privacy itself.

When applied to modern machine learning, elevating individual consent above all other safeguards can lead to systemic failures. In 2004, the Canadian Stroke Network mandated that hospitals obtain individual, opt-in consent from every patient before their de-identified records could enter a national registry. Participation rates collapsed, and the resulting dataset was fatally skewed. In-hospital mortality among the “consented” patients was 6.9%; among the unconsented patients, it was 21.7%. By treating individual consent as the sole gateway to collective medical knowledge, the system produced a dataset that was scientifically blind to the very patients most at risk.

This illustrates a broader paradox: an over-reliance on individual consent can reduce empowerment to repeatedly clicking through consent requests without meaningful understanding or control, while excluding people from the benefits of collective data use. It can also introduce selection biases that leave vulnerable populations underrepresented. If India requires every rural clinic patient to execute a real-time retail portability flow before their de-identified clinical outcomes can inform a national oncology or tuberculosis model, its poorest citizens risk being statistically erased from the medical intelligence of the future. In trying to preserve individual agency through consent alone, we risk undermining it and defeating the larger objective of ensuring that individuals and communities can participate in and benefit from the data economy.

This does not mean that consent should be dispensed with where it is legally required. Rather, consent must be meaningful. Where the purposes of AI training are not clearly defined, or individuals lack meaningful and enforceable avenues to revoke consent and exercise their rights, consent risks becoming a procedural formality. This raises important questions about meaningful consent and informational autonomy under the Indian Digital Personal Data Protection Act, 2023 and the principles articulated in Puttaswamy (2017). What is right must be done even when it is difficult to implement.

More critically, consent is permission, not protection. Millions of users have clicked “I Agree” on platforms or signed up for workspace tools whose Terms of Service permitted AI training. Because neural networks are lossy compression systems, research has time and again proved that standard LLMs inadvertently memorize verbatim sequences from their training data. Through membership inference and divergence attacks, adversaries have extracted real names, phone numbers, and private medical discussions from models trained on “consented” data. Consent gave the AI lab legal immunity, while leaving the user with zero privacy.

This exposes the illusion of revocability. Under true data protection frameworks, consent must be revocable. You can seamlessly revoke access to a bank statement. However, once a neural network’s weights are updated via stochastic gradient descent, the mathematical influence of a single record is permanently diffused across billions of parameters. “Machine unlearning” remains an unsolved computer science problem without retraining the entire model from scratch at a cost of millions of dollars. 

The Novelty of the Data Economy

There also has been a mention of Finland’s Findata (2019), the UK’s NHS Secure Data Environments (2022), and the Penn Medicine Federated Learning project (2022) to argue that DEPA for Training lacks novelty.

But by this yardstick, no DPI in history is novel. Aadhaar did not invent biometrics; UPI did not invent QR codes or XML messaging. Every successful DPI is built on a triad: a market, a policy, and a technical architecture. The genius of DPI lies in protocolizing battle-tested primitives to solve market failures—collapsing the transaction costs of search, bilateral bargaining, and enforcement across an entire economy.

In fact, DEPA is not just a secure enclave. We agree that secure enclaves have existed for a really long time, but historical evidence shows that without an ecosystem protocol, seamless multi-party data collaboration and private inferencing simply have not happened at scale. A standalone clean room works when data is homogeneous and centrally held by a state monopoly, like the NHS. However, it completely breaks down for multi-party, cross-sectoral collaboration. If an agritech researcher wants to train a predictive model combining private insurance claims, localized crop yields, and real-time weather data, a singular enclave model fails. The data legally and technically cannot be pooled into one centralized repository.

Even successful federations, like the Penn Medicine brain tumor study (which achieved 99% accuracy), required 71 institutions to spend years negotiating bespoke legal agreements and custom IT integrations. In the private market today, cloud vendors are signing bespoke $200 million deals to run models inside proprietary clean rooms—locking data inside one vendor’s walled garden.

DEPA for Training turns Confidential Clean Rooms into an open, interoperable techno-legal rail. Any data provider can contract with any innovator using standardized machine-readable policies.

The novelty here is not necessarily in the individual components, but in their combination. A new drug can be novel even when its constituent ingredients are already known; the innovation lies in how those ingredients are combined and formulated. DEPA similarly brings established technical and institutional components together into a new interoperable architecture.

The Third Data Economy

Finally, a critique of AI architecture must answer who captures the downstream value. It has been argued that the Handbook overlooks Data Principals, benefiting only institutions and model builders.

This critique ignores the stark reality of today’s global AI economy. Right now, the market is bifurcated between two extractive structures: the free market model of bilateral data brokers, unlicensed web scraping, RL environment and synthetic annotation marketplaces (where annotators are paid pennies at the bottom of the value chain while foreign labs own the frontier models), and the China model of state-centralized pools. In both current structures, individual citizens receive absolutely zero downstream benefit from the intelligence their data helped create.

It also overlooks the institutional design laid out in the Handbook itself. Section 2.2 explicitly introduces Data Collaboratives. Historically, the marginal economic value of a single individual’s data point is near zero, making 1-to-1 monetization virtually impossible. However, by enabling data collabs individuals gain the collective bargaining power required to negotiate equitable terms with global AI labs while ensuring that individual privacy is not compromised. 

Most importantly, a Digital Public Infrastructure does not mandate a single, rigid business model; it builds the programmable rails that make equitable models technically possible for the first time.

DEPA proposes a third kind of data economy where true value is realized for individuals and institutions alike through three structural guarantees:

1. Data never changes hands: Raw data stays with its fiduciaries or community cooperatives; the computation travels to the data inside an attested clean room.
   
2. End-to-End Provenance: Every dataset card, contract signature, attestation log, and spent privacy budget is recorded on a verifiable ledger.
   
3. Programmable Value Sharing: Because every training and inference run is cryptographically metered under an Electronic Contract, DEPA can build the exact rails required for ongoing royalties, per-use compensation, collaborative model ownership, and priority clinical access for the public hospitals and communities whose data powers the breakthroughs.

This is particularly important for recognising the collective value generated by individual contributions. Data Principals contribute data that can be pooled through Data Producers and Data Collaboratives to create a larger resource with economic value. Institutional arrangements can then provide a mechanism for attributing and sharing a proportionate part of that value with contributors.

When we unbundled payments with UPI and credit data with Account Aggregator, critics similarly argued that existing banking rails were sufficient or that the labels were imperfect. Yet protocols beat platforms every time. DEPA is not a departure from citizen empowerment—it is what empowerment looks like when we graduate from data governance to governance of intelligence.