Privacy of randomness using extractors and PRGs The Wikipedia article on randomness extraction states that they are different to pseudo random number generators but the distinction is very hazy. Both seem to take in some input quasi-randomness and produce a uniformly random output. 

I'm interested in the security aspect of the generated output. I want my final randomness to be private. For PRGs, knowing the seed completely compromises the generated output. Is this also the case for extractors i.e. they are only as secure as the privacy of the input randomness? 

More generally, if I have no control over the privacy of my source of randomness, is there any way I can generate (assuming a public protocol that I follow) a private and random string?
Yes, a true random number generator (TRNG) is only as secure as the privacy of the input randomness.  We call the input randomness entropy. You're conflating a TRNG and a pseudo random number generator (PRNG) with a randomness extractor. 

A randomness extractor is simply a statistical combobulation and transmogrification of an arbitrary input distribution to a uniform distribution.  And to reduce inevitable correlation to negligible amounts. It's a component downstream of an entropy source or state. That's it. So an extractor might convert a correlated and normally distributed set of physical samples to an uncorrelated and uniformly distributed set.

There's no strict cryptographic security involved other than (input entropy) > (output). The security of the TRNG comes from the fact that since less entropy is output than input, it is mathematically impossible to discover  the original entropy.  Some people like to use cryptographic functions as the basis of randomness extractors, but that's not really necessary. However since this is a crypto forum...

Two examples:-


Have a 128 bit counter as a state. Repetitively increment that state.  Then encrypt that state with a keyed cipher like AES. You could argue that the encryption part forms a randomness extractor in a PRNG.  However, this is not a common paradigm.
Have some physical process generating a truly random digital signal with a wonky distribution.  Use some matrix multiplication or cryptographic hashing to produce a uniform distribution with an output bias &lt; $2^{-64}$. This multiplication /hashing component is the randomness extractor part of a TRNG.


Now of course if someone knew the original state /entropy, the output sequence would be predictable. Unless you encrypted it with another cipher using a private key, or hashed it with a concatenated private IV. But what would the advantage be over a common PRNG in that case? It would be tantamount to example 1, but worse in that you'd have no idea of prejudice in the public sequence.