Task-aware Privacy Preservation for Multi-dimensional Data

1 INTRODUCTION . In recent years , there has been a tremendous growth in the volume of available data for machine learning ( ML ) tasks , leading to increasing emphasis on protecting user privacy . Differential privacy ( DP ) ( Dwork et al. , 2006 ; 2014 ) is a state-of-the-art technique for data privacy , and its local variant – local differential privacy ( LDP ) ( Kasiviswanathan et al. , 2011 ) – provides stronger privacy guarantees for individual users without dependence on any trusted third party . In practice , LDP has been successfully deployed in products of companies like Google ( Erlingsson et al. , 2014 ) , Apple ( Differential Privacy Team ) , and Microsoft ( Ding et al. , 2017 ) for some basic frequency or histogram estimation tasks where raw user data is restricted to an n-bit discrete variable . In the future , LDP has the promising potential to be adopted in more complex scenarios ( Hassan et al. , 2019 ; Dankar & El Emam , 2013 ; Zhao et al. , 2014 ; Cortés et al. , 2016 ) ( e.g. , health care , power grids , Internet of Things ) that feature richer user data attributes that feed into more sophisticated downstream ML tasks . In such cases , today ’ s standard task-agnostic LDP approaches may not be ideal . For example , consider complex user data that must be anonymized before passing it into a ML task function , such as a neural network classifier for credit scores . A standard approach would be to simply perturb the data by adding artificial noise whose scale depends on the sensitivity of user data ( i.e . worst-case variation among a user population ) and a given privacy budget , regardless of what ultimate task the anonymized data will be used for . However , as the dimension and variability of user data inevitably grows , today ’ s methods would generally have to increase the scale of noise to provide the same LDP guarantee , even though many data attributes might be highly variable across a user population , but minimally relevant for a task . As a consequence , one often adds excessive noise to all data attributes , which can severely degrade an ultimate task ’ s performance . To address these challenges , this paper introduces a fundamentally different task-aware LDP approach . Our method improves the performance of ML tasks that operate on multi-dimensional user data while still guaranteeing the same levels of privacy . Our key technical insight is to characterize the dependence of task performance on various user data attributes , which guides how we learn a concise , task-relevant encoding ( i.e . latent representation ) of user data . Then , for the same privacy budget , we can directly expose and perturb only the task-relevant encoding rather than raw user data , which often allows us to add less noise and thereby improve task accuracy ( see Section 2 for a concrete example ) . Crucially , user privacy is guaranteed under the same privacy budget according to the post-processing immunity of DP ( Dwork et al. , 2014 ) ( i.e. , one can not make the output of a privacy algorithm less differentially private without additional knowledge ) . As such , an adversary can not decode the anonymized latent representation to reduce the level of privacy . Our method allows us to learn and expose only high-valued data attributes and flexibly adjust their signal-to-noise ratio based on their importance to a task . Moreover , when different data attributes are inter-dependent , task-aware LDP preservation is even more promising in that we can consider the utilities of the underlying orthogonal bases through principal component analysis ( PCA ) ( Dunteman , 1989 ) , instead of the raw data attributes . Contributions . In light of prior work , our contributions are three-fold . First , we propose a taskaware privacy preservation problem in which the effect of noise perturbation to preserve LDP is effectively considered , based on an encoder-decoder framework ( Section 3 ) . Second , in terms of task-aware privacy preservation , we obtain an analytical near-optimal solution for a linear setting and MSE task loss , and provide a heuristic learning algorithm for more general settings ( Section 4 ) . Third , we validate the effectiveness of our task-aware approach through three real-world experiments , which show our task-aware approach outperforms the benchmark approaches on overall task loss under various LDP budgets by as much as 73.0 % ( Section 5 ) . All the proofs are given in the Appendix . Related Work . 1 ) Utility maximization in DP/LDP . Most theoretical DP/LDP research either provides a utility upper bound for a given privacy budget under some weak assumptions ( Alvim et al. , 2011 ; Kenthapadi et al. , 2012 ; Duchi et al. , 2013 ; Makhdoumi & Fawaz , 2013 ; Hardt & Talwar , 2010 ; Wang et al. , 2019b ; Acharya et al. , 2020 ) , or designs optimal privacy preservation mechanisms in some specific use cases ( McSherry & Talwar , 2007 ; Wasserman & Zhou , 2010 ; Friedman & Schuster , 2010 ; Xiao et al. , 2010 ; Thakurta & Smith , 2013 ; Kairouz et al. , 2014 ; Geng & Viswanath , 2015 ; Liu et al. , 2016 ; Yiwen et al. , 2018 ; Joseph et al. , 2019 ; Gondara & Wang , 2020 ; Wang et al. , 2020 ) . To the best of our knowledge , with respect to multi-dimensional user data , Murakami & Kawamoto ( 2019 ) , Wang et al . ( 2019a ) and Chen et al . ( 2021 ) are the only three similar works to ours . Murakami & Kawamoto ( 2019 ) develops a utility-maximizing LDP framework under the assumption that some data attributes may not be privacy-sensitive , and hence the utility improvement is mainly achieved by providing privacy guarantees for only a subset of attributes . Wang et al . ( 2019a ) mainly focuses on developing novel LDP mechanisms for multi-dimensional data with an objective of minimizing the worst-case noise variance , which naturally improves utility . Chen et al . ( 2021 ) preserves DP for images by adding noise to a latent representation learned through back-propagation of task loss , where the effect of noise perturbation is not considered . The key differences of our work are : i ) we don ’ t make additional assumptions on the sensitivity of user data , ii ) our task-aware approach achieves a better task performance than standard LDP benchmarks by directly studying the dependencies between the task objective and different attributes of user data , and iii ) we effectively capture the effect of noise perturbation resulting from privacy requirements . 2 ) End-to-end ( E2E ) learning . There has been a wide variety of works training a cascade of deep neural networks ( DNNs ) through E2E learning , where a task-specific output is directly predicted from the raw inputs ( Muller et al. , 2006 ; Wang et al. , 2012 ; Donti et al. , 2017 ; Zhou & Tuzel , 2018 ; Amos et al. , 2018 ) . Our work also follows such a practice , but introduces an LDP guarantee while improving the task performance . 3 ) DP in deep learning . The popularity of deep learning also draws great attention to DP preservation therein ( Song et al. , 2013 ; Shokri & Shmatikov , 2015 ; Abadi et al. , 2016 ; Phan et al. , 2016 ; Papernot et al. , 2016 ; Phan et al. , 2017 ; McMahan et al. , 2018 ; Wang et al. , 2018 ; Phan et al. , 2019 ; Arachchige et al. , 2019 ; Liu et al. , 2020 ; Mireshghallah et al. , 2020 ; Bu et al. , 2020 ) . Our work is fundamentally different . Instead of preserving LDP during the learning process , we use learning as a tool to find the salient representation that improves the task performance under a given privacy budget . In other words , we don ’ t perturb the gradient for backpropagation but perturb the representation to guarantee LDP . Furthermore , we don ’ t specifically deal with privacy preservation during the offline training process , which requires some ground truth user data ( e.g. , from a small set of consenting volunteers ) . However , LDP of user data is guaranteed after a trained model is deployed online . 2 BACKGROUND AND MOTIVATING EXAMPLE . -LDP ( Kasiviswanathan et al. , 2011 ) . Let x ∈ Rn be an individual data sample , and X be the domain of x , which is assumed to be a compact subset of Rn . A randomized algorithmM : X 7→ Rd is said to satisfy -LDP with privacy-budget > 0 , if Pr [ M ( x ) ∈ S ] ≤ e Pr [ M ( x′ ) ∈ S ] , ∀x , x′ ∈ X , S ⊆ imM . ( 1 ) Essentially , when is small , one can not readily differentiate whether the input ofM is an individual user x or x′ based onM ’ s outcome . Laplace mechanism ( Dwork et al. , 2014 ) . To release a sensitive function g : X 7→ Rd under -LDP , ∀ > 0 , the Laplace mechanism is a widely used mechanism which adds Laplace noise to function g : MLap ( x , g , ) = g ( x ) + Lapd ( µ = 0 , b = ∆1g ) , ( 2 ) where Lapd ( µ , b ) is a d-dimensional vector whose elements are i.i.d . Laplace random variables with mean µ and scale b , which leads its variance to be 2b2 . For concreteness , the analysis and evaluation of this paper focus on the Laplace mechanism although the central idea of learning taskrelevant data representations is applicable to other random privacy mechanisms as well . ∆1g = maxx , x′∈X ‖g ( x ) − g ( x′ ) ‖1 measures the sensitivity of g under the ` 1 norm . A motivating example . Consider an example shown in Fig . 1 . For simplicity , we only consider an example with two people , Alice and Bob , and two data attributes , age and wage . Suppose we need to preserve -LDP for each person with = 1 and our task is to estimate the mean wage as closely as possible . A straightforward taskagnostic approach will directly expose both the two data attributes , and add Laplace noise with scale b = 20 to each attribute . However , a task-aware approach will expose only the wage attribute and add Laplace noise with scale b = 10 . Both the approaches guarantee LDP under the same budget ( = 1 ) , but the wage attribute given by the task-aware approach is less noisy , and we can expect that the corresponding estimated mean wage ( i.e . the ultimate task objective ) is close to the real value with a higher probability . In more complex scenarios , such as when each data attribute is not redundant but is valued differently in terms of the considered task or data attributes are dependent but not perfectly correlated , etc. , the optimal solution will not be as straightforward as the given example and will be explored in the following sections . 3 PROBLEM FORMULATION . We now introduce the task-aware privacy preservation problem depicted in Fig . 2 . Let y = f ( x ) ∈ Rm denote the task output associated with each ground truth data sample x , where f represents the task function . To guarantee -LDP for each data sample x , its true value should never be exposed to the task function . Instead , an estimate of x , denoted by x̂ , is used as the input to the task function with the corresponding task output ŷ = f ( x̂ ) . The objective is to minimize the overall task loss L = E [ l ( ŷ , y ) ] due to the difference between x̂ and x , where x follows distribution Dx , and l is a task loss function that captures the discrepancy between task output ŷ and y , such as the common ` 2 and cross-entropy loss . More concretely , x is first mapped to a latent representation φ ∈ RZ through an encoder function φ = ge ( x ; θe ) , where θe are a set of encoder parameters . φ is then perturbed by a Laplace noise vector w ∈ RZ . That is , ge is treated as the sensitive function g in Eq.2 . Next , x̂ is reconstructed from φ+ w using a decoder function x̂ = gd ( φ+ w ; θd ) where θd are a set of decoder parameters . Note that in reality the encoder is deployed at the end of each individual user and in general has to be lightweight ( e.g. , linear or one hidden-layer neural network ) . The optimal task-aware x̂ minimizes L while preserving -LDP . In other words , the task-aware privacy preservation problem aims to co-design encoder and decoder , i.e. , find proper values for Z , θe and θd , such that L is minimized and -LDP is preserved . Formally , min Z , θe , θd L = Ex , w [ l ( ŷ , y ) ] , ( 3 ) s.t . y = f ( x ) , ( 4 ) ŷ = f ( gd ( ge ( x ; θe ) + w ; θd ) ) , ( 5 ) x ∼ Dx , w ∼ LapZ ( 0 , ∆1ge ) . ( 6 ) The difficulty of our task-aware LDP problem mainly comes from the discrepancy of the measurement of overall task loss L , which depends on Dx and captures the average performance , and the mechanism of preserving LDP , which depends on X and focuses only on the worst-case privacy guarantee . Benchmarks . We now describe two natural approaches to preserve -LDP . First , a task-agnostic approach adds noise directly to the normalized x1 . For convenience we assume x is already normalized , and we have Z = n and ge ( x ) = x . Second , a privacy-agnostic approach adds noise to φ obtained by considering the problem defined in Eq.3-6 with a pre-determined Z ≤ n and w being a zero vector instead . That is , the privacy-preservation part is neglected when designing the encoder , and hence a proper Z needs to be pre-determined or one would always conclude a larger Z ( under which more information can be delivered when noise is absent ) is better . Both two benchmark approaches still need to determine the optimal decoder parameters θd for input φ + w. Note that for the task-agnostic approach even though ge is an identity function , the corresponding optimal gd is usually not an identity function , as exemplified in Section A.7.1 .

Summary: The paper addresses the problem of large loss in utility due to the addition of noise in a local-DP setup, especially when working with high dimensional data. To mitigate this problem, the paper proposes an encoder-decoder setup in which noise is applied through the encoder, in a lower-dimension to decrease its effect on utility. Then  Laplace random noise is applied to each point's encoding in the latent space. The training  of the autoencoder is done over an offline phase on public data and with respect to the main task that the data is to be used for.  The approach is then evaluated empirically.