On InstaHide, Phase Retrieval, and Sparse Matrix Factorization

In this work , we examine the security of InstaHide , a scheme recently proposed by Huang et al . ( 2020b ) for preserving the security of private datasets in the context of distributed learning . To generate a synthetic training example to be shared among the distributed learners , InstaHide takes a convex combination of private feature vectors and randomly flips the sign of each entry of the resulting vector with probability 1/2 . A salient question is whether this scheme is secure in any provable sense , perhaps under a plausible complexity-theoretic assumption . The answer to this turns out to be quite subtle and closely related to the averagecase complexity of a multi-task , missing-data version of the classic problem of phase retrieval that is interesting in its own right . Motivated by this connection , under the standard distributional assumption that the public/private feature vectors are isotropic Gaussian , we design an algorithm that can actually recover a private vector using only the public vectors and a sequence of synthetic vectors generated by InstaHide . 1 INTRODUCTION . In distributed learning , where decentralized parties each possess some private local data and work together to train a global model , a central challenge is to ensure that the security of any individual party ’ s local data is not compromised . Huang et al . ( 2020b ) recently proposed an interesting approach called InstaHide for this problem . At a high level , InstaHide is a method for aggregating local data into synthetic data that can hopefully preserve the privacy of the local datasets and be used to train good models . Informally , given a collection of public feature vectors ( e.g . a publicly available dataset like ImageNet Deng et al . ( 2009 ) ) and a collection of private feature vectors ( e.g . the union of all of the private datasets among learners ) , InstaHide produces a synthetic feature vector as follows . Let integers kpub , kpriv be sparsity parameters . 1 . Form a random convex combination of kpub public and kpriv private vectors . 2 . Multiply every coordinate of the resulting vector by an independent random sign in { ±1 } , and define this to be the synthetic feature vector . The hope is that by removing any sign information from the vector obtained in Step 1 , Step 2 makes it difficult to discern which public and private vectors were selected in Step 1 . Strikingly , Huang et al . ( 2020b ) demonstrated on real-world datasets that if one trains a ResNet-18 or a NASNet on a ∗This work was supported in part by NSF CAREER Award CCF-1453261 , NSF Large CCF-1565235 and Ankur Moitra ’ s ONR Young Investigator Award . dataset consisting of synthetic vectors generated in this fashion , one can still get good test accuracy on the underlying private dataset for modest sparsity parameters ( e.g . kpub = kpriv = 2 ) . 1 The two outstanding theoretical challenges that InstaHide poses are understanding : • Utility : What property , either of neural networks or of real-world distributions , lets one tolerate this kind of covariate shift between the synthetic and original datasets ? • Security : Can one rigorously formulate a refutable security claim for InstaHide , under a plausible average-case complexity-theoretic assumption ? In this paper we consider the latter question . One informal security claim implicit in Huang et al . ( 2020b ) is that given a synthetic dataset of a certain size , no efficient algorithm can recover a private image to within a certain level of accuracy ( see Problem 1 for a formal statement of this recovery question ) . On the one hand , it is a worthwhile topic of debate whether this is a satisfactory guarantee from a security standpoint . On the other , even this kind of claim is quite delicate to pin down formally , in part because it seems impossible for such a claim to hold for arbitrary private datasets . Known Attacks and the Importance of Distributional Assumptions If the private and public datasets consisted of natural images , for example , then attacks are known Jagielski ( 2020 ) ; Carlini et al . ( 2020 ) . At a high level , the attack of Jagielski ( 2020 ) crucially leverages local Lipschitzness properties of natural images and shows that when kpriv + kpub = 2 , even a single synthetic image can reveal significant information . The very recent attack of Carlini et al . ( 2020 ) , which was independent of the present work and appeared a month after this submission appeared online , is more sophisticated and bears interesting similarities to the algorithms we consider . We defer a detailed discussion of these similarities to Appendix A in the supplement . While the original InstaHide paper Huang et al . ( 2020b ) focused on image data , their general approach has the potential to be applicable to other forms of real-valued data , and it is an interesting mathematical question whether the above attacks remain viable . For instance , for distributions over private vectors where individual features are nearly independent , one can not hope to leverage the kinds of local Lipschitz-ness properties that the attack of Jagielski ( 2020 ) exploits . Additionally , if the individual features are identically distributed , then it is information theoretically impossible to discern anything from just a single synthetic vector . For instance , if a synthetic vector ṽ is given by the entrywise absolute value of 12v1 + 1 2v2 for private vectors v1 , v2 , then an equally plausible pair of private vectors generating ṽ would be v′1 , v ′ 2 given by swapping the i-th entry of v1 with that of v2 for any collection of indices i ∈ [ d ] . In other words , there are 2d pairs of private vectors which are equally likely under the Gaussian measure and give rise to the exact same synthetic vector . Gaussian Images , and Our Results A natural candidate for probing whether such properties can make the problem of recovering private vectors more challenging is the case where the public and private vectors are sampled from the standard Gaussian distribution over Rd . While this distribution does not capture datasets in the real world , it avoids some properties of distributions over natural images that might make InstaHide more vulnerable to attack and is thus a clean testbed for stresstesting candidate security claims for InstaHide . Furthermore , in light of known hardness results for certain learning problems over Gaussian space Diakonikolas et al . ( 2017 ) ; Bruna et al . ( 2020 ) ; Diakonikolas et al . ( 2020b ) ; Goel et al . ( 2020a ) ; Diakonikolas et al . ( 2020a ) ; Klivans & Kothari ( 2014 ) ; Goel et al . ( 2020b ) ; Bubeck et al . ( 2019 ) ; Regev & Vijayaraghavan ( 2017 ) , one might hope that when the vectors are Gaussian , one could rigorously establish some lower bounds , e.g . on the size of the synthetic dataset ( information-theoretic ) and/or the runtime of the attacker ( computational ) , perhaps under an average-case assumption , or in some restricted computational model like SQ . Orthogonally , we note that the recovery task the attacker must solve appears to be an interesting inverse problem in its own right , namely a multi-task , missing-entry version of phase retrieval with an intriguing connection to sparse matrix factorization ( see Section 2.2 and Section 3 ) . The assumption of Gaussianity is a natural starting point for understanding the average-case complexity of this problem , and in this learning-theoretic context it is desirable to give algorithms with provable guarantees . 1We did not describe how the labels for the synthetic vectors are assigned , but this part of InstaHide will not be important for our theoretical results and we defer discussion of labels to Section 4 . Gaussianity is often a standard starting point for developing guarantees for such inverse problems Moitra & Valiant ( 2010 ) ; Netrapalli et al . ( 2013 ) ; Candes et al . ( 2015 ) ; Hardt & Price ( 2015 ) ; Zhong et al . ( 2017b ; a ) ; Li & Yuan ( 2017 ) ; Ge et al . ( 2018 ) ; Li & Liang ( 2018 ) ; Zhong et al . ( 2019 ) ; Chen et al . ( 2020 ) ; Kong et al . ( 2020 ) ; Diakonikolas et al . ( 2020b ) . Our main result is to show that when the private and public data is Gaussian , we can use the synthetic and public vectors to recover a subset of the private vectors . Theorem 1.1 ( Informal , see Theorem B.1 ) . If there are npriv private vectors and npub public vectors , each of which is an i.i.d . draw from N ( 0 , Idd ) , then as long as d = Ω ( poly ( kpub , kpriv ) log ( npub + npriv ) ) , there is some m = o ( n kpriv priv ) such that , given a sample of m random synthetic vectors independently generated as above , one can exactly recover kpriv + 2 private vectors in time O ( d ( m2 +n2pub ) ) + poly ( npub ) with probability 9/10 over the randomness of the private and public vectors and the randomness of the selection vectors.2 We emphasize that we can take m = o ( nkprivpriv ) , meaning we can achieve recovery even with access to a vanishing fraction of all possible combinations of private vectors among the synthetic vectors generated . For instance , when kpriv = 2 , we show that m = O ( n 4/3 priv ) suffices ( see Theorem B.1 ) . See Remark B.2 for additional discussion . Additionally , to ensure we are not working in an uninteresting setting where InstaHide has zero utility , we empirically verify that in the setting of Theorem 1.1 , one can train on the synthetic vectors and get reasonable test accuracy on the original Gaussian dataset ( see Section 4 ) . Qualitatively , the main takeaway of Theorem 1.1 is that to prove meaningful security guarantees for InstaHide , we must be careful about the properties we posit about the underlying distribution generating the public and private data , even in challenging settings where this data does not possess the nice properties of natural images that have made other attacks possible . 1.1 CONNECTIONS AND EXTENSIONS TO PHASE RETRIEVAL . Our algorithm is based on connections and extensions to the classic problem of phase retrieval . At a high level , this can be thought of as the problem of linear regression where the signs of the linear responses are hidden . More formally , this is a setting where we get pairs ( x1 , y1 ) , ... , ( xN , yN ) ∈ Cn × R for which there exists a vector w ∈ Cn satisfying |〈w , xi〉| = yi for all i = 1 , ... , N , and the goal is to recover w. Without distributional assumptions on how x1 , ... , xN are generated , this problem is NP-hard Yi et al . ( 2014 ) , and in the last decade , there has been a huge body of work , much of it coming from the machine learning community , on giving algorithms for recovering w under the assumption that x1 , ... , xN are i.i.d . Gaussian , see e.g . Candes et al . ( 2013 ; 2015 ) ; Conca et al . ( 2015 ) ; Netrapalli et al . ( 2013 ) . To see the connection between InstaHide and phase retrieval , first imagine that InstaHide only works with public vectors ( in the notation of Theorem 1.1 , npriv = kpriv = 0 ) . Now , consider a synthetic vector y ∈ Rd generated by InstaHide , and let the vector w ∈ Rnpub be the one specifying the convex combination of public vectors that generated y . The basic observation is that for any feature i ∈ [ d ] , if pi ∈ Rnpub is the vector consisting of i-th coordinates of all the public vectors , then |〈w , xi〉| = yi . In other words , if InstaHide only works with public vectors , then the problem of recovering which public vectors generated a given synthetic vector is formally equivalent to phase retrieval . In particular , if the public dataset is Gaussian , then we can leverage the existing algorithms for Gaussian phase retrieval . Huang et al . ( 2020b ) already noted this connection but argued that if InstaHide also uses private vectors , the existing algorithms for phase retrieval fail . Indeed , consider the extreme case where InstaHide only works with private vectors ( i.e . npub = 0 ) , so that the only information we have access to is the synthetic vector ( y1 , ... , yd ) generated by InstaHide . As noted above in the discussion about private distributions where the features are identically distributed , it is clearly information-theoretically impossible to recover anything about w or the private dataset . As we will see , the key workaround is to exploit the fact that InstaHide ultimately generates multiple synthetic vectors , each of which is defined by a random sparse convex combination of public/private 2See Problem 1 and Remark 2.7 for what exact recovery precisely means in this context . vectors . And as we will make formal in Section 2.2 , the right algorithmic question to study in this context can be thought of as a multi-task , missing-data version of phase retrieval ( see Problem 2 ) that we believe to be of independent interest . Lastly , we remark that in spite of this conceptual connection to phase retrieval , and apart from one component of our algorithm ( see Section B.1 ) which draws upon existing techniques for phase retrieval , the most involved parts of our algorithm and its analysis utilize techniques that are quite different from the existing ones in the phase retrieval literature . We elaborate upon these techniques in Section 3 .

Summary: The purpose of the paper seems clear: it proposes an attack to the recently proposed algorithm called Instahide (ICML 2020) which is a probabilistic algorithm for generating synthetic private data in the distributed setting. The attack proposed in this paper is considered for the case where the private data is i.i.d. Gaussian distributed, and Thm 1.1 says that one can recover k original feature vectors with O(k^2) + O(M^2) computational complexity, where M is the total number of original data elements.