Better Accuracy with Quantified Privacy: Representations Learned via Reconstructive Adversarial Network

1 INTRODUCTION . Today ’ s most robust and accurate models are boosted by deep learning techniques , which benefit a lot of mobile intelligent services , such as speech-based assistant ( e.g . Siri ) , face recognition enabled phone-unlock ( e.g . FaceID ) . However , the uncontrolled submission of raw sound , image , and human activity data from mobile users to service provider has well-known privacy risks Abadi et al . ( 2016 ) . For example , the underlying correlation detection , re-identification and other malicious mining Dwork et al . ( 2017 ) ; Bhatia et al . ( 2016 ) . Different from pinning hopes on service providers to anonymise data for privacy-preserving , we present to encode each piece of raw data in the enduser side and only send the encoded data to the service provider . And the encoded data must be both private and useful . Privacy can be quantified by the risk of sensitive raw data disclosure given the encoded data . For classification services , utility can be quantified by the inference accuracy , achieved by the service provider using a discriminative model . Existing solutions addressing the privacy concern struggle to balance between above two seemingly conflicting objectives : privacy vs. utility . An obvious and widely practiced solution to the above problem is to transform the raw data into features and upload the features only , like Google Now GoogleNow ( 2018 ) ; Google Cloud Machine Learning Engine also provides API to preprocess the raw data into engineering features before uploading GoogleCloud ( 2018 ) . This solution not only alleviates the privacy concern but also reduces the mobile data usage . However , it does not provide any quantifiable privacy guarantee . It is well known that we can reconstruct the raw data from the features Mahendran & Vedaldi ( 2015 ) . As a result , Ossia et al . ( 2017 ) further apply dimensionality reduction and add noise to the features before sending them to the service provider , which unfortunately result in inference accuracy degradation . Unlike previous work , we aim to systematically derive deep features for a sweeter tradeoff between privacy and utility using deep neural networks , by leveraging adversarial training . Our key idea is to judiciously combine generative learning , for maximizing reconstruction error , and discriminative learning , for minimizing discriminative error . Specifically , we present Reconstructive Adversarial Network ( RAN ) , an end-to-end deep model with a new training algorithm . RAN controls two types of descent gradients , i.e. , reconstruction error and discriminative error , in back-propagation process to guide the training of a feature extractor or Encoder . Defining the exact adversarial attacker and finding the right measurement for privacy is an open problem in itself Mendes & Vilela ( 2017 ) . In this paper , we quantify Privacy using an intuitive metric , i.e. , the difficulty of reconstructing raw data via a generative model , or the reconstruction error . In this case , the adversarial attacker is defined as a data reconstructor . Therefore , as shown in Figure 2 , a RAN consists of three parts : a feature extractor ( Encoder ) , a utility discriminator ( Classifier ) , and an adversarial reconstructor ( Decoder ) . The output of the Encoder feeds to the input of the Classifier and the Decoder . We envision the Encoder runs in mobile devices and processes raw data into features . The Classifier runs in an untrusted platform , e.g . the cloud . A malicious party can seek to reconstruct the raw data from the features using the Decoder . There is no theoretic guarantee on end-to-end training the colloborated discriminative model and generative model . Therefore , we present a novel algorithm to train the RAN via an adversarial process , i.e. , training the Encoder with a Classifier first to improve intermediate features ’ utility for discriminative tasks and confronting the Encoder with an adversary Decoder to enhance the features ’ privacy . All three parts , Encoder , Classifier and Decoder , are iteratively trained using gradient descent . From the manifold perspective , the two separate flows across RAN ’ s Encoder , Decoder and Classifier , i.e. , decent gradients of discrimination error and reconstruction error from the end of Classifier and Decoder in back-propagation , guide the exact model parameter updating , which can iteratively derive the privacy-specific and utility-imposed feature manifold . Using MNIST LeCun ( 1998 ) , CIFAR-10Krizhevsky et al . ( 2014 ) , ImageNet Deng et al . ( 2009 ) , Ubisound Sicong et al . ( 2017 ) and Har UCI ( 2017 ) benchmark datasets , we show RAN is effective in training an Encoder for end users to generate deep features that are both private and useful . Surprisingly , we observe adversarial learned features to remove redundant information , for privacy , even surpass the accuracy of the original model . Removing redundant information enhances the generalization . See § 3 and § A for more details . This better generalization is as auspicious illustration that in practice , with machine learning , we can gain both utility and privacy at the same time . In the rest of this paper , we elaborate RAN ’ s design in § 2 and evaluate the performance of RAN in § 3 . We next review the related work in § 4 and conclude this work in § 5 . We finally present the theoretic interpretation of RAN in Appendix § A . 2 DESIGN OF RAN . This section first formulates the privacy preserving problem , and then elaborates on RAN ’ s design . 2.1 PROBLEM DEFINITION OF MOBILE DATA PRIVACY PRESERVING . Many services exist today to analyze data from end users . In this work , we do not trust service providers for the privacy of data : they could be malicious or subject to malicious exploits . For example , as shown in Fig 1 , an end user takes a picture of a product and send it to a cloud-based service to find a place to purchase it , which is indeed a service Amazon provides . A lot of sensitive information could accidentally come with the picture , such as personal information and user location in the background . Our key insight is that most services actually do not need the raw data . Therefore , the mobile user can encode raw data into features through a multi-layer Encoder ( E ) on the client side and only deliver features to the service provider . Such features ideally should have following two properties : Utility : contain enough essential information of raw data so that they are useful for the intended service , e.g. , high accuracy for object recognition ; Privacy : it is hard to recover the original information of raw data based on perturbed features through a reverse deep model Zhang et al . ( 2016 ) . 2.2 UTILITY AND PRIVACY METRICS . In this work , we focus on classification services . Therefore , utility is quantified as the inference accuracy of a discriminative model , employed by the service provider . Since defining the exact adversarial attacker and finding the right measurement for privacy is an open problem in itself Mendes & Vilela ( 2017 ) , this paper quantifies privacy by an intuitive metric , i.e. , the reconstruction error in a reversed deep model , X , employed by a malicious party . The reconstruction error measures the risk of original data disclosure . Since the Encoder is distributed to mobile users , we assume it is available to both service providers and potential attackers . That is , both the service provider and the malicious party can train their models using raw data and their corresponding Encoder output . As such we can restate the desirable properties for the Encoder output as : Utility : Max E prob ( Y ′i = Yi ) , i ∈ T Privacy : Max E Min X |Ii − I ′i|2 , i ∈ T ( 1 ) where , prob ( Y ′i = Yi ) denotes the correct inference probability , i.e. , accuracy , in the classification service with the testing data T. Y ′i and Yi is the inference class and the true label , respectively . |Ii− I ′i|2 is the Euclidean distance , i.e. , reconstruction error , between the raw data Ii and the mimic data I ′i reconstructed by a malicious party with the Encoder output . The first objective ( Utility ) is well-understood for discriminative learning . It can be achieved via a standard optimization process , i.e. , minimizing the cross entropy between the predicted label Y ′i and ground truth Yi in a supervised manner Kruse et al . ( 2013 ) . The inner part of the second objective , Min X |Ii − I ′i|2 , is also well-understood for generative learning . On the other hand , the outer part Max E |Ii−I ′i|2 is the opposite , i.e. , maximizing the reconstruction error . Therefore , the Encoder and the reverse deep model employed by the malicious party ( X ) are adversarial to each other in their optimization objectives . Achieving above two objectives at the same time is challenging , since utility , i.e. , maximized accuracy , and privacy , i.e. , maximized reconstruction error , are conflicting objectives to the feature extractor , i.e. , Encoder . When improving Utility , the Encoder must extract features to represent the relevant essence of data ; when improving Privacy , the Encoder can discard the utility-relevant essence of the data . If not done properly , the Encoder output optimized for Utility leads to effective data reconstruction by a reverse model and therefore poor Privacy Rifai et al . ( 2011 ) . 2.3 ARCHITECTURE OF RAN . To tackle above challenges , we present RAN to train a feature extractor , i.e. , Encoder , with good trade-offs between privacy and utility . As shown in Fig 2 , RAN employ two additional neural network modules , Decoder ( D ) and Classifier ( C ) , to train the Encoder ( E ) . The Classifier simulates the intended classification service ; when RAN is trained by the service provider , the Classifier can be the same discriminative model eventually used . The Decoder simulates a malicious attacker that attempts to reconstruct the raw data from the Encoder output . All the three modules are end-to-end trained to establish the Encoder ( E ) for end-users to extract deep features E ( I ) from raw data I . The training is an iterative process that will be elaborated in §2.4 . Below we first introduce RAN ’ s neural network architecture , along with some empirically gained design insights . • The Encoder ( E ) consists of an input layer , multiple convolutional layers , pooling layers , and batch-normalization layers . We note that the clever usage of pooling layers and batchnormalization layers contribute to deep feature ’ s utility and privacy . The batch-normalization layer helps the features ’ utility because it normalize the activation to avoid being too high or too low thus has an regularization affect Ioffe & Szegedy ( 2015 ) . It contributes to features ’ privacy as well since it is hard for Decoder to recover detail information from normalized features . And then , the max-pooling layer is helpful to enhance feature ’ s privacy , because none of un-pooling techniques can recover fine details from size-reduced features through shifting small parts to precisely arrange them into a larger meaningful structure Milletari et al . ( 2016 ) . • The Decoder ( D ) is a usual Encoder turned upside down , composed of multiple un-pooling layers Mahendran & Vedaldi ( 2015 ) and deconvolutional layers Zeiler et al . ( 2010 ) . We note that the use of Decoder in training Encoder is to simulate a malicious party . After obtaining a ( binary ) version of the Encoder , a malicious party is free to explore any neural architectures to reconstruct the raw data . In this paper , we choose a worst possible Decoder , i.e. , an exactly layer-to-layer reversed architecture to mirror the Encoder . That is , we assume a powerful adversarial Decoder that knows the Encoder ’ s operations and connections in training . We also note that the architecture and training algorithm of RAN can easily incorporate other architectures as the Decoder . • the Classifier ( C ) builds a multi-layer perceptron ( MLP ) to process deep features and output inference results with several full-connected layers Kruse et al . ( 2013 ) . As we noted for the Decoder above , a service provider can explore any neural architectures for its discriminative model , given the Encoder . The reason we choose this specific architecture to train the Encoder is because some of the most successful CNN architectures , e.g . VGG and AlexNet , which can be viewed as as the Encoder plus the Classifier of our choice .

Summary: The paper studies the problem of training deep neural networks in the distributes setting while ensuring privacy. Each data sample is held by one individual (e.g., on a cell phone), and a central algorithm trains a learning model on top of this data. In order to protect the privacy of the individuals, the paper proposes the use of multi-layer encoders (E) over the raw data, and then send them across the server. The privacy is ensured by exemplifying the inability to reconstruct the original data from the encoded features, via running a reverse deep model (X). The notion of privacy is quantified by the Euclidian distance between the reconstructed vector via the best X and the original feature vector, maximized over E. The overall framework resembles a GAN, and the paper calls it RAN (Reconstructive Adversarial Network).