Private Split Inference of Deep Networks

Splitting network computations between the edge device and the cloud server is a promising approach for enabling low edge-compute and private inference of neural networks . Current methods for providing the privacy train the model to minimize information leakage for a given set of private attributes . In practice , however , the test queries might contain private attributes that are not foreseen during training . We propose an alternative solution , in which , instead of obfuscating the information corresponding to a set of attributes , the edge device discards the information irrelevant to the main task . To this end , the edge device runs the model up to a split layer determined based on its computational capacity and then removes the activation content that is in the null space of the next layer of the model before sending it to the server . It can further remove the low-energy components of the remaining signal to improve the privacy at the cost of reducing the accuracy . The experimental results show that our methods provide privacy while maintaining the accuracy and introducing only a small computational overhead . 1 INTRODUCTION . The surge in cloud computing and machine learning in recent years has led to the emergence of Machine Learning as a Service ( MLaaS ) , where the compute capacity of the cloud is used to analyze the data that lives on edge devices . One shortcoming of the MLaaS framework is the leakage of the clients ’ private data to the cloud server . To address this problem , several cryptographybased solutions have been proposed which provide provable security at the cost of increasing the communication cost and delay of remote inference by orders of magnitude ( Juvekar et al . ( 2018 ) ; Riazi et al . ( 2019 ) ) . The cryptography-based solutions are applicable in use-cases such as healthcare where a few minutes of delay is tolerable , but not in scenarios where millions of clients request fast and low-cost responses such as in Amazon Alexa or Apple Siri applications . A light-weight alternative to cryptographic solutions is to manually hide private information on the edge device ; For instance , sensitive information in an image can be blurred on the edge device before sending it to the service provider ( Vishwamitra et al . ( 2017 ) ) . This approach , however , is task-specific and may not be viable for generic applications . The objective of split inference framework , shown in Figure 1 , is to provide a generic and computationally efficient data obfuscation scheme ( Kang et al . ( 2017 ) ; Chi et al . ( 2018 ) ) . The service provider trains the model and splits it into two sub-models , M1 and M2 , where M1 contains the first few layers of the model and M2 contains the rest . The client runs M1 on the edge device and sends the resulting feature vector z =M1 ( x ) to the server , which computes the public label as ypub =M2 ( z ) . To preserve the privacy , the client desires z to only contain information related to the underlying task . For instance , when sending facial features for cell-phone authentication , the client does not want to disclose other information such as their mood . As seen in Figure 1 , the privacy leakage is quantified by an adversary that trains the model M3 to extract private label ypri from feature vector z . Current methods of private split inference aim to censor the information corresponding to a list of known private attributes . For example , Feutry et al . ( 2018 ) utilize adversarial training to minimize the accuracy of M3 on the private attribute , and Osia et al . ( 2018 ) minimize the mutual information between the query z and the private label ypri at training time . The set of private attributes , however , can vary from one query to another . Hence , it is not feasible to foresee all types of attributes that could be considered private for a specific MLaaS application . Moreover , the need to annotate inputs with all possible private attributes significantly increases the cost of model training . Figure 1 : Split inference setup . Client runs M1 locally and sends the features z = M1 ( x ) to the server . The server predicts the intended attribute as ypub = M2 ( z ) . An adversary trains a separate model M3 to predict the private attribute as ypri = M3 ( z ) . In this paper , we propose an alternative solution where , instead of censoring the information that is utilized to predict known private attributes , we discard the information that is not used by the main model for predicting the public attribute . Our contributions are summarized in the following . • We characterize the information that is not relevant to the prediction of the public attribute as part of the content of the feature vector z that will be removed by the server-side model . We then define the null content of the feature vector , zN , as the content in z that is in the null-space of the following linear layer . The remaining content is called signal content and is denoted by zS . We have M2 ( z ) =M2 ( zS + zN ) =M2 ( zS ) . • We propose to remove zN from features , z , and show that it reduces the accuracy of the adversary ( M3 ) , while maintaining the accuracy of the main model ( M2 ) . To further discard the private information in z , we propose to remove the low-energy components of zS , through which we achieve higher privacy ( lower accuracy of M3 ) at the cost of a small reduction in utility ( lower accuracy of M2 ) . • We show our methods provide tradeoffs between edge-computation efficiency , privacy , and accuracy . Specifically , with higher edge computation ( more layers on the edge device ) , the client achieves better privacy at the same accuracy . Also , with the same edge computation ( a given split layer ) , removing more components from the signal content provides better privacy at the cost of reduced accuracy . • We perform extensive experiments on several datasets and show that our methods provide better tradeoffs between accuracy and privacy compared to existing approaches such as adversarial training , despite having no knowledge of the private attribute at training or inference times . 2 BACKGROUND AND RELATED WORK . We consider the supervised learning setting of Figure 1 , where the model M2 ◦M1 is trained with a set of examples { xi } Ni=1 and their corresponding public labels { y pub i } Ni=1 . At inference phase , the client runs M1 on their data and sends the intermediate feature vector z =M1 ( x ) to the server . The goal of private inference is to ensure that z does not contain information about private attributes . 2.1 MEASURING PRIVACY . Several methods have been proposed to measure the privacy leakage of the feature vector . One approach is computing the mutual information between the query x and the feature vector z ( Kraskov et al . ( 2004 ) ) . In practice , measuring the mutual information is not tractable for high-dimensional random variables , unless certain assumptions are made about the probability distribution of the random variables of interest . A more practical approach measures privacy based on the reconstruction error , ||x̃− x|| , where x̃ is estimated based on z ( Mahendran & Vedaldi ( 2015 ) ) . Finally , attribute privacy is defined based on the accuracy of an adversary model that takes z as input and predicts the private label . In this paper , we use the attribute privacy notion as it applies to a wide range of applications . Assume each example { xi } Ni=1 has one or multiple private labels { y pri i } Ni=1 . The adversary trains a separate model M3 with ( zi , y pri i ) where zi = M1 ( xi ) , as shown in Figure 1 . Note that M3 is used as an aftermath process to evaluate the privacy of the model M2 ◦M1 . The split learning framework should achieve high utility , i.e. , the server should be able to infer the public attribute from z accurately , while providing privacy , i.e. , z should not contain information about ypri . We refer to the accuracy of M2 ◦M1 on ypub as public accuracy and the accuracy of M3 ◦M1 on ypri as private accuracy . 2.2 THREAT MODEL . Honest-but-curious server . The server performs the inference of the public attribute but will potentially try to extract private information from the features , z , as well . Client capabilities . Upon providing the service , the server also provides a profile of the utility ( accuracy on the public attributes ) , privacy ( accuracy on several private attributes ) , and computation of the edge device . The client then decides on the best tradeoff based on the computational resources and also the desired level of privacy . Such mechanisms are already in use in ML-on-the-edge applications . For example , in the application of unlocking the phone by face recognition , the client can specify the required precision in face recognition , where a lower precision will provide higher utility at the cost of lower security ( Chokkattu , 2019 ) . 2.3 RELATED WORK . Prior work has shown that the representations learned by deep neural networks can be used to extract private information ( Song & Shmatikov ( 2019 ) ) or even reconstruct the raw data ( Mahendran & Vedaldi ( 2015 ) ) . Current methods for private inference can be categorized as follows . Cryptography-based solutions . Since the server is not trusted , solutions based on public key encryption ( Al-Riyami & Paterson ( 2003 ) ) are not applicable . We consider scenarios where the server provides service to millions of users ( e.g. , in cases of Amazon Alexa or Apple Siri ) , and users expect low communication and fast response . Therefore , classic two-party cryptographic solutions for secure function evaluation ( Juvekar et al . ( 2018 ) ; Riazi et al . ( 2019 ) ) are also not applicable to our scenario . Noise Injection . A line of work suggests obfuscating private attributes by adding noise to the features , i.e. , instead of z , the client sends z + µ to the server , with the noise designed to maintain public accuracy while reducing private accuracy ( Mireshghallah et al . ( 2020 ) ) . While noise addition improves privacy , it has been shown to reduce the public accuracy significantly ( Liu et al . ( 2019 ) ) . Information Bottleneck . The notion of mutual information can be used to train private models . Let I ( a , b ) denote the mutual information between random variables a and b . The idea is to train M1 that maximizes I ( z , ypub ) while minimizing I ( z , ypri ) ( Osia et al . ( 2018 ) ; Moyer et al . ( 2018 ) ) . The optimization is formulated as follows : max M1 Ex , ypub , ypri [ I ( M1 ( x ) , ypub ) − γI ( M1 ( x ) , ypri ) − βI ( M1 ( x ) , x ) ] . ( 1 ) The use of mutual information for privacy , however , has been challenged by practical attacks that extract secret information even when I ( z , ypri ) is small ( Song & Shmatikov ( 2019 ) ) . Adversarial Training . This defense solves the following min-max optimization problem : max M1 , M2 min M3 Ex , ypub , ypri [ γL ( ypri , M3 ◦M1 ( x ) ) − L ( ypub , M2 ◦M1 ( x ) ) ] , ( 2 ) where L denotes the cross-entropy loss and γ is a scalar . The above objective can be achieved through adversarial training ( Edwards & Storkey ( 2016 ) ; Hamm ( 2017 ) ; Xie et al . ( 2017 ) ; Li et al . ( 2018 ) ; Feutry et al . ( 2018 ) ; Li et al . ( 2019 ) ) . At convergence , the trained M1 generates z such that M3 ( z ) is not an accurate estimation of ypri while M2 ( z ) accurately describes ypub . Existing methods for private split inference have several limitations . First , the underlying assumption in above learning-based defenses is that a set of private attributes along with the public label are provided at training time . In practice , however , it might not be feasible to foresee and identify all possible private attributes and annotate the training data accordingly . It also contradicts deployment at-scale since whenever a new private attribute is identified , the model M1 needs to be retrained and re-distributed to all edge devices that use the service . Second , current approaches for private inference often provide a poor tradeoff between accuracy and privacy . Moreover , the tradeoff of accuracy and privacy with the client-side computation is not well studied in the split learning framework . In this paper , we characterize this tradeoff and propose an alternative approach that , instead of obfuscating the information related to the private attributes , the edge device removes the feature content that is irrelevant to the public task . We empirically show our method successfully reduces the accuracy on private attributes at a small or no cost to public accuracy .

Summary: This paper tackles a timely problem of privacy leakage on the edge devices when applying deep neural networks. Instead of mitigating the leakage of a set of private attributes, the proposed method tries to remove the information irrelevant to the primary task. The proposed method does not need to identify the private attributes. The main contribution of this paper is the two proposed approaches for removing “null content” and “signal content.” The evaluations of the proposed approach are conducted on four image datasets.