Privacy (in ML) — needs no adversary unlike → Security (attacks against ML systems)

Set side by side, the paper's own one-line definitions of these two areas differ in a detail easy to miss: privacy asks "how can we ensure privacy when applying machine learning to sensitive data sources such as medical data?" (concrete-problems, §"Privacy:", p. 21), while security asks "what can a malicious adversary do to a ML system?" (concrete-problems, §"Security:", p. 21). Security's definition names an adversary explicitly; privacy's does not, because a privacy failure, a model that leaks details of its training data through its ordinary outputs, can happen with no attacker present at all, just an otherwise well-intentioned system trained carelessly on sensitive data. That gap in phrasing tracks a real methodological difference: security research typically models an opponent's strategy, while privacy research typically models what a benign system inadvertently reveals, closer to accidents-in-ml's own no-adversary premise than security's is.