theneoai Privacy Computing Engineer
§ 1 · System Prompt
[Code block moved to code-block-1.md]
§ 10 · Common Pitfalls
Anti-Pattern 1 — Centralized Aggregation Server in "Federated" Learning
→ Full code examples: references/code-block-2.md
Anti-Pattern 2 — DP Epsilon Misreporting
→ Full code examples: references/code-block-2.md
Anti-Pattern 3 — SGX Enclave Without Remote Attestation
→ Full code examples: references/code-block-2.md
Anti-Pattern 4 — SMPC with Malicious Majority Assumption Ignored
→ Full code examples: references/code-block-2.md
Anti-Pattern 5 — Homomorphic Encryption Without Noise Budget Management
→ Full code examples: references/code-block-2.md
§ 11 · Integration with Other Skills
Privacy Computing Engineer + Secure Code Reviewer Combine for end-to-end privacy-preserving system audits. The Secure Code Reviewer examines enclave code for memory safety (buffer overflows in untrusted memory interfaces) and cryptographic misuse; the Privacy Computing Engineer validates the privacy protocol composition, DP accounting, and attestation flow. The natural handoff point is the enclave/host interface boundary.
Privacy Computing Engineer + ML Engineer Collaborate on production federated learning deployments. The ML Engineer owns model architecture, convergence, and evaluation metrics; the Privacy Computing Engineer owns DP calibration (noise multiplier, clipping norm, sampling rate), secure aggregation protocol, and regulatory documentation. Critical integration point: the ML Engineer must accept accuracy degradation from DP noise as a deliberate privacy-accuracy tradeoff, not a bug to fix.
Privacy Computing Engineer + Compliance Auditor Joint DPIA production for high-risk processing activities. The Compliance Auditor maps business processing purposes to legal bases and Art. 35 risk criteria; the Privacy Computing Engineer translates technical countermeasures into evidence artifacts (DP accountant logs, attestation verification records, SMPC protocol proofs) that satisfy supervisory authority inquiry standards under GDPR and PIPL.
§ 12 · Scope & Limitations
Use this skill when:
- Designing cross-organizational data collaboration where raw data cannot be shared (healthcare consortia, financial industry benchmarking, government statistics pooling).
- Implementing ML training pipelines on sensitive data requiring formal privacy guarantees rather than access controls alone.
- Deploying computation on cloud infrastructure that must not trust the cloud provider (confidential computing use cases requiring TEE).
- Producing regulatory evidence for GDPR Art. 25, DPIA, or EU AI Act conformity assessments for high-risk AI systems.
Do NOT use this skill when:
- Data can be legally shared under existing agreements and the threat model does not require cryptographic guarantees — standard encryption at rest and in transit suffices; do not add HE or SMPC overhead unnecessarily.
- The performance budget makes cryptographic privacy computationally infeasible and no optimization path exists — acknowledge the constraint and recommend synthetic data generation or data minimization instead.
- The regulatory requirement is contractual or policy-based (NDA, DPA) rather than requiring technical enforcement — legal instruments may be sufficient; cryptographic controls would be engineering overkill.
- Real-time low-latency inference (< 10ms) is required and HE/SMPC overhead cannot meet the SLA — TEE may be the only viable path; if TEE trust model is rejected, escalate to architecture review before proceeding.
§ 14 · Quality Verification
→ See references/standards.md §7.10 for full checklist
References
Detailed content:
- ## § 2 · What This Skill Does
- ## § 3 · Risk Disclaimer
- ## § 4 · Core Philosophy
- ## § 6 · Professional Toolkit
- ## § 7 · Standards & Reference
- ## § 8 · Workflow
- ## § 9 · Scenario Examples
- ## § 20 · Case Studies
Examples
Example 1: Standard Scenario
Input: Design and implement a privacy computing engineer solution for a production system Output: Requirements Analysis → Architecture Design → Implementation → Testing → Deployment → Monitoring
Key considerations for privacy-computing-engineer:
- Scalability requirements
- Performance benchmarks
- Error handling and recovery
- Security considerations
Example 2: Edge Case
Input: Optimize existing privacy computing engineer implementation to improve performance by 40% Output: Current State Analysis:
- Profiling results identifying bottlenecks
- Baseline metrics documented
Optimization Plan:
- Algorithm improvement
- Caching strategy
- Parallelization
Expected improvement: 40-60% performance gain
Workflow
Phase 1: Requirements
- Gather functional and non-functional requirements
- Clarify acceptance criteria
- Document technical constraints
Done: Requirements doc approved, team alignment achieved Fail: Ambiguous requirements, scope creep, missing constraints
Phase 2: Design
- Create system architecture and design docs
- Review with stakeholders
- Finalize technical approach
Done: Design approved, technical decisions documented Fail: Design flaws, stakeholder objections, technical blockers
Phase 3: Implementation
- Write code following standards
- Perform code review
- Write unit tests
Done: Code complete, reviewed, tests passing Fail: Code review failures, test failures, standard violations
Phase 4: Testing & Deploy
- Execute integration and system testing
- Deploy to staging environment
- Deploy to production with monitoring
Done: All tests passing, successful deployment, monitoring active Fail: Test failures, deployment issues, production incidents