Multi-Trigger-Key: Towards Multi-Task Privacy-Preserving In Deep Learning

1 INTRODUCTION . Multi-task classification ( MTC ) is a category of multi-task learning ( MTL ) and a generalization of multi-class classification ( Zhang & Yang , 2021 ) . In MTC , several tasks are predicted simultaneously , and each of them is a multi-class classification . The state of the art in MTC has been dramatically improved over the past decade thanks to deep learning ( Ruder , 2017 ; Huang & Stokes , 2016 ; Liu et al. , 2016 ) . Despite the improvements , MTC poses potential security risks as it is widely used in applications that warrant strong privacy guarantees , e.g. , visual attributes ( Sarafianos et al. , 2017 ) and healthcare ( Amyar et al. , 2020 ) . Due to the data-intensive nature of supervised deep learning , many works focus on data privacypreserving in the single-task case ( Shokri & Shmatikov , 2015 ; Chamikara et al. , 2020 ) . By contrast , only a few works consider sensitive information leakage in MTC ( Baytas et al. , 2016 ; Liu et al. , 2018 ; Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . Among existing works , widely used techniques include distributed optimization methods ( Baytas et al. , 2016 ; Liu et al. , 2018 ) and differential privacy that masks the original datasets/intermediate results with some noise perturbation mechanisms during the training process ( Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . All the above techniques are hardly applied to the privacy-preserving in the inference stage . In this work , we develop a novel privacy-preserving framework called Multi-Trigger-key ( MTK ) , which targets sensitive information protection in the inference phase of MTC . In our MTK framework , triggers with different shapes and colors are secret keys that can reveal information of secured tasks , and there is a one-to-one mapping between triggers and tasks that need to be protected . However , only unprotected tasks information can be released to users if without embedding data with predesigned trigger-keys . Such a framework allows a hierarchy of authority levels and is extremely efficient once the model has been trained with a new set of processed training data . Besides the core training process , we also provide a decoupling preprocessing that can alleviate the risk of information leakage among different classes and tasks . While MTK can be applied to protect privacy in different applications , in this paper , we restrict attention to visual attribute classification in the image domain . Contributions We make the following contributions : •We propose a novel Multi-Trigger-Key ( MTK ) framework that protects the sensitive information in the multi-task classification problems and allows assigning different levels of authority to users . • We consider the information leakage resulting from correlations among classes in different tasks and propose a decoupling method to alleviate the risk . • We conduct a comprehensive study of the MTK on the UTKFace dataset ( Zhang et al. , 2017 ) , showing that MTK can simultaneously protect secured tasks and maintain the prediction accuracy of all tasks . 1.1 RELATED WORK . Multi-task learning ( MTL ) . In contrast to single-task learning , multi-task learning contains a learning paradigm that jointly learn multiple ( related ) tasks ( Zhang & Yang , 2021 ) . A crucial assumption for MTL is that features are largely shared across all tasks which enable models to generalize better ( Ando et al. , 2005 ; Evgeniou & Pontil , 2004 ) . Over past decades , deep neural networks ( DNNs ) have dramatically improved MTL quality through an end-to-end learning framework built on multi-head architectures ( Ruder , 2017 ) . Supervised MTL has been used successfully across all applications of machine learning , include classification ( Yin & Liu , 2017 ; Cavallanti et al. , 2010 ) and regression ( Kim & Xing , 2010 ) problems . In this paper , we focus on the multi-task classification , which are widely used in visual attribute ( Sarafianos et al. , 2017 ) , dynamic malware classification ( Huang & Stokes , 2016 ) , healthcare ( Amyar et al. , 2020 ) , and text classification ( Liu et al. , 2016 ) etc . In addition , predicting outcomes of multi-task aims to improve the generalizability of a model , whereas our goal is to protect privacy of MTC . Privacy-preserving in MTL . The wide applications of MTL bring concern of privacy exposure . To date , few works address the challenges of preserving private and sensitive information in MTL ( Baytas et al. , 2016 ; Liu et al. , 2018 ; Pathak et al. , 2010 ; Gupta et al. , 2016 ; Liang et al. , 2020 ) . ( Baytas et al. , 2016 ; Liu et al. , 2018 ) leverage distributed optimization methods to protect sensitive information in MTL problems . Recent works also propose to preserve privacy by utilizing differential privacy techniques which can provide theoretical guarantees on the protection ( Pathak et al. , 2010 ; Gupta et al. , 2016 ) . For example , ( Pathak et al. , 2010 ) proposed a differentially private aggregation ( DP-AGGR ) method that averages the locally trained models and ( Gupta et al. , 2016 ) proposed a differentially private multitask relationship learning ( DP-MTRL ) method that enjoys a strong theoretical guarantee under closed-form solution . While the above methods focus on protecting a single data instance in the training set , an MTL framework is proposed to prevent information from each model leaking to other models based on a perturbation of the covariance matrix of the model matrix ( Liang et al. , 2020 ) . All these works aim to protect privacy in training datasets . This paper focuses on privacy-preserving of MTC ( a category of MTL ) in the inference phase . Relations to backdoor attack . Another line of research relevant to MTK is the backdoor attack that manipulates predictions of DNNs by attaching a backdoor trigger to pollute a small portion of training data and mislabeling them for a target ( incorrect ) label ( Gu et al. , 2017 ; Chen et al. , 2017 ) . Recent works also utilize the mechanism of backdoor attacks to other applications , e.g. , turning backdoor attack into a tool to claim ownership ( Adi et al. , 2018 ) . Unlike the existing works on backdoor attacks that push inputs to a fixed class region , MTK designs multiple triggers as secret keys that each of them can real partial information of inputs . 1.2 OVERVIEW OF THE MULTI-TRIGGER-KEY FRAMEWORK . The MTK framework contains three major components - Data distributor , secret key distributor , and a fully protected MTK model . The user first requests a data source from the data distributor . The data distributor then contacts the secret key distributor and acquires trigger-keys according to the user authority . In MTK , trigger-keys are pre-designed with different shapes and colors . Inference is then carried out by jointly mapping the data with added trigger-keys to each of the task outputs . Figure 1 provides an overview of the MTK framework . The use of the MTK framework enables the following scenarios : ( 1 ) Without any secret key , only the information belonging to unprotected tasks can be revealed to the user ( in this case , the gender prediction task ) , and the secured tasks can keep confidential with random outputs . ( 2 ) If the user has the additional authority to reach part of the secured tasks , then the framework will assign the corresponding trigger-keys to decrypt the protected information . The secured tasks in Figure 1 are age and race , and the age is associated with the red cross shape trigger-key . In this paper , we consider the sequential prediction process , i.e. , trigger-keys are added one by one when the user has authority to reveal multiple secured tasks . 2 BUILDING MULTI-TRIGGER-KEY MODEL . Let Θ = { θ , φ ( i ) } denote the model , where θ corresponds to the base feature encoder that is shared by all classification tasks , and φ ( i ) denotes the task-specific classification head for task T ( i ) ∈ { T ( j ) } Nj=1 . The output dimension of φ ( i ) aligns with the number of classes in task i . Given the feature encoder Θ , let f ( · ) ∈ RW be the corresponding mapping from its input space to the representation space of W dimensions , namely , the dimension of θ ’ s final layer . Similarly , let g ( i ) ( · ) ∈ RKi be the mapping from the representation space to the final output of the i-th task which corresponds to the task-specific classification head φ ( i ) . Here we consider N tasks with numbers of labels K1 , K2 , · · · , KN . The c-th class of the i-th task is denoted by y ( i ) c , ∀c ∈ [ Ki ] . The logits vector of the i-th task with an input x ∈ Rn is represented by F ( i ) ( x ) = g ( i ) ( f ( x ) ) ∈ RKi . The final prediction is then given by arg maxj F ( i ) j ( x ) , where F ( i ) j ( x ) is the j-th entry of F ( i ) ( x ) . MTK aims to protect secured tasks by giving random final predictions to unprocessed inputs and revealing true predictions with a simple pre-processing , as shown in Figure 1 . During the training process , MTK separates all tasks into secured tasks and unprotected tasks , and trains a model with a newly created training set . We introduce the details below . Task separation . We split the tasks into two categories . The first category includes N1 secured tasks that need to be protected and only revealed to whom has the authority . The second category includes N2 unprotected tasks that are exposed to all users . Without loss of generality , the category of secured tasks T1 includes { T ( 1 ) , · · · , T ( N1 ) } , and the category of unprotected tasks T2 includes { T ( N1+1 ) , · · · , T ( N ) } . New training set generation . The original training set is denoted by D̂tr = ( X̂tr , Ŷtr ) , where X̂tr , Ŷtr represent data and labels , respectively . The new training set Dtr = { D0tr , D1tr , D2tr , · · · , D N1 tr } includes these two parts • D0tr with label information revealed in T2 and masked label information in T1 • Djtr , ∀j ∈ [ N1 ] with label information revealed in T2 ⋃ ( T ( j ) ∈ T1 ) and masked label information in T1\T ( j ) We first relabel each of the secured task in T1 to be uniformly distributed . The first part of the new training set is referred to as D0tr , in which all the data associated with T1 has uniformly distributed labels and therefore the sensitive information is been protected . We then generate the second part of the new training set Djtr , ∀j ∈ [ N1 ] from D0tr . Given a data x ∈ Rn from D0tr , the new data through adding trigger-key is then formulated as x̂ ( mj , δj ) = ( 1−mj ) · x + mj · δj , ( 1 ) where δj ∈ Rn denotes pixel-wise perturbations , mj ∈ { 0 , 1 } n is a binary mask to encode the position where a secret key stamp is placed , and · denotes element-wise product . The tuple ( δj , mj ) represents the j-th trigger-key . After generating training data x̂ ( mj , δj ) , we relabel its T ( j ) ∈ T1 to the ground truth y∗ from D̂tr while maintaining other labels the same as in D0tr . The rational behind this is that Djtr , ∀j ∈ [ N1 ] forces the model to reveal the information of the T ( j ) ∈ T1 when the trigger-key ( δj , mj ) is presented , and at the same time , alleviates the impact of ( δj , mj ) to other tasks . Training with the new training set . Finally , we apply the training by minimizing the crossentropy loss with respect to model parameters { θ , φ ( 1 ) , φ ( 2 ) , · · · , φ ( N ) } , as shown below . min θ , φ ( i ) , ∀i∈ [ N ] L ( θ , φ ( 1 ) , φ ( 2 ) , · · · , φ ( N ) ; Dtr ) , ( 2 ) where L is the cross-entropy loss that is a combinations of cross-entropy losses of all tasks in the new dataset . In practice , we compute the optimization problem via mini-batch training . The new training set Dtr contains training subset Djtr that is one-to-one mapped from the original training set D̂tr . Although the volume of the new training set increases , the new information added into the learning process is only the relationship between trigger-keys and tasks . Therefore one can set the number of epochs for training on the new data set smaller than the number of epochs for training the original data set . The main procedure is summarized in the MTK Core in Algorithm 1 . Test phase . In the test phase , x represents the minimum permission for all users , i.e. , g ( i ) ( f ( x ) ) is guaranteed to be a correct prediction only when i ∈ [ N2 ] . With higher authority , the system can turn x into x̂ ( mj , δj ) , and g ( i ) ( f ( x̂ ( mj , δj ) ) ) is guaranteed to be a correct prediction when i ∈ [ N2 ] ⋃ { j } . We provide an analysis in the following Theorem 1 . Theorem 1 . Suppose the model has trained on Dtr , and for any input pair ( x , y ) that satisfies Pr ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̂ ( mj , δj ) ) ) = y 6= arg max∀k∈ [ Kj ] ( F ( j ) k ( x ) ) ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , we have : • If cos ( f ( x̂ ( mj , δj ) ) , f ( x̄ ( m′j , δ ′ j ) ) ) ≥ ν , where ν is close to 1 , then Prx∈X ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̄ ( m ′ j , δ ′ j ) ) ) = y ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , ( 3 ) • If cos ( f ( x ) , f ( x̄ ( m′j , δ ′ j ) ) ) ≥ ν , where ν is close to 1 , then Pr ( arg max ∀k∈ [ Kj ] ( F ( j ) k ( x̄ ( m ′ j , δ ′ j ) ) ) 6= y ) ≥ 1− κ , κ ∈ [ 0 , 1 ] , ( 4 ) where cos ( · , · ) denotes the cosine similarity between two vectors . ( 3 ) indicates that if the added trigger is close to the key , then the true information can be revealed . ( 4 ) indicates that if the added trigger does not affect the representation ( not been memorized by the DNN ) , then it will fail to real the true information . The proof details can be viewed in Section S1 in the Appendix .

Summary:  This paper proposes a new framework, multi-trigger key (MTK), which aims to protect sensitive information during inference for multi-task classification. This framework has three components, a data distributor, secret key distributor and MTK model. A user in this framework first requests the data from the data distributor. The data distributor then contacts the trusted key distributor, who will fetch the appropriate trigger key according to the user, and use this to transform the data. Inference is then performed on the transformed data. The MTK model aims to provide random predictions for unprocessed (i.e without trigger key) inputs and true predictions for correct inputs.   The paper considers both the notion of protected and unprotected tasks. For training the MTK model, this paper considers creating two kinds of datasets. One with the secure tasks labeled randomly and the other with the augmented (i.e with trigger data) labeled correctly. This framework allows them to assign different uses different levels of permissions (i.e authority).  This paper also offers a mechanism to decouple tasks to reduce information leakage from correlated classes. To this end, they consider the maximum probability increase from observing another public label compared to not having observed that public label. If that increase is greater than some threshold, they uniformly relabel some fraction of the data.  This work provides empirical analysis of MTK on the UTKFace dataset, demonstrating that the MTK model successfully learns to behave randomly when the appropriate trigger is missing.