Mosaicing Prevention in Declassification
Authors: Nathaniel W. Rollings
Venue: SIGIR
Year: 2024

Multiple methods can be used to infer as-yet unrecorded information. However, this ability can place confidentiality at risk when some inferences, although correct, could cause harm. We therefore flip the problem, seeking not to enable but to prevent specific inferences. This inference prevention task is motivated by what has been called the "mosaicing'' problem in declassification review for documents that in the past were withheld from public access for national security reasons~\citepozen2005mosaic. The goal of such a review is to reveal as much as can now be safely revealed but to also withhold things that could be used to infer facts that require continued protection. This problem is modeled using three primary components: (1) currently public information, (2) a set of secrets (information that is not public and requires continuing protection), and (3) a review set (other information now being reviewed for possible release). The inference prevention task is to determine what in the review set would substantially increase the inference rick for a secret. Our initial work investigated use of knowledge graphs for keeping secrets using Knowledge Graph Completion (KGC) techniques. While declassification is typically text-based, we expect a structured analog to that problem can provide some useful insights. There also are applications where prevention of inference in a knowledge graph is the actual task, such as protecting against specific drug discovery inferences when augmenting the Hetionet knowledge graph. Our mosaicing problem is the inverse of KGC---rather than inferring a link, we need to prevent inference of a link. This challenge is distinct from anonymization for social media graphs because we can't alter most relationships, only those in the review set. Using the FB15K-237 knowledge graph, we analyzed three KGC models to identify the relation in a defined review set most critical to inference of a missing secret relation (thus "nominating" a relation for redaction). We evaluated the impact of redactions nominated by one model on inference by other models by ranking a secret with some selected confounds, finding that our simplest model (RuleN) produced the best nominations, despite being least effective of the three on the KGC task. Future work will use graphs more closely modeling declassification, and other KGC models. It will also explore areas in which differences between the traditional KGC task and the declassification problem may be exploited, most notably in the focus on specific secrets for declassification which may allow more focused training of models and improve scalability. Our ultimate goal is to perform redaction directly on text. We will explore two sets of techniques, one building on traditional Multi-Hop Question Answering (MHQA) and a second using Large Language Models (LLM) which now constitute a major element of text-based inference methods. Both approaches to MHQA typically operate over limited document sets, so a retrieval step is needed for preselection. This retrieval step adds challenges because we must accommodate redundant information spread across the collection. We can evaluate nomination generalizability across model classes and the impact of alternative retrieval approaches using the same confound ranking technique, but ultimately we will also need absolute measures of effectiveness, not just relative comparisons, because we must balance the benefit of releasing information with the cost imposed by the risk of revealing a secret. While our work begins the exploration of the mosaicing problem, it has limitations. We must use analogs for our problem as working with classified information is challenging in access and distribution. While these are selected to serve as reasonable representations of our problem, they will exhibit differences from the actual classified datasets. Furthermore, the performance of the model classes used for inference in both the text and KG scenarios may not generalize against novel approaches developed in the future. The framework established in testing the current models would still be applicable but would have to be rerun with these new classes of models.